@ref0/sdk 0.10.0 → 0.12.0

package/dist/client.mjs

@@ -5423,12 +5423,15 @@ const name = ownerNamePattern.source.replace(/^\^|\$$/g, "");
 const projectPattern = new RegExp(`^(${name})/(${name})$`);
 const threadPattern = new RegExp(`^(${name})(?:/(${name}))?#([1-9][0-9]*)$`);
 const repoPattern = new RegExp(`^(${name})/(${repoNamePattern.source.replace(/^\^|\$$/g, "")})$`);
+const pullRequestPattern = new RegExp(`${repoPattern.source.replace(/\$$/, "")}#[1-9][0-9]*$`);
 /** A project, `owner/project`. */
 const WrittenProject = Schema.String.check(Schema.isPattern(projectPattern)).pipe(Schema.brand("WrittenProject"));
 /** A thread, `owner/project#number`, or an org thread, `owner#number`. */
 const WrittenThread = Schema.String.check(Schema.isPattern(threadPattern)).pipe(Schema.brand("WrittenThread"));
 /** A repo, `owner/repo`. */
 const WrittenRepo = Schema.String.check(Schema.isPattern(repoPattern)).pipe(Schema.brand("WrittenRepo"));
+/** A pull request, `owner/repo#number`. */
+const WrittenPullRequest = Schema.String.check(Schema.isPattern(pullRequestPattern)).pipe(Schema.brand("WrittenPullRequest"));
 /** A written project's parts, as an endpoint's path takes them. */
 const projectParts = (written) => {
 	const [, owner = "", project = ""] = projectPattern.exec(written) ?? [];
@@ -5437,6 +5440,15 @@ const projectParts = (written) => {
 		project
 	};
 };
+/** A written thread's parts, as an endpoint's path takes them: no project for an org thread. */
+const threadParts = (written) => {
+	const [, owner = "", project, number = ""] = threadPattern.exec(written) ?? [];
+	return {
+		owner,
+		project,
+		number
+	};
+};
 //#endregion
 //#region ../contracts/src/mention-views.ts
 /**
@@ -6493,14 +6505,13 @@ const ConnectOrganization = Schema.Struct({
 	organization: OrgId,
 	name: OwnerName
 });
-/** Whether admission replaced a live host grant, or skipped one that no longer belongs here. */
+/**
+* A folder's host grant from before: on and the person's, so the new grant's confirm turns it off,
+* or skipped, off already or not theirs, which a yes leaves as it is.
+*/
 const GrantReplacement = Schema.Struct({
 	grant: TokenId,
-	state: Schema.Literals([
-		"replaces",
-		"revoked",
-		"skipped"
-	]),
+	state: Schema.Literals(["replaces", "skipped"]),
 	attachedAt: Schema.optionalKey(Timestamp)
 });
 /**
@@ -6676,594 +6687,227 @@ Schema.Union([Schema.Struct({ found: Schema.Literal(false) }), Schema.Struct({
 	attachGrant: Schema.optionalKey(EventId)
 })]);
 //#endregion
-//#region ../contracts/src/approvals.ts
+//#region ../contracts/src/plan-events.ts
 /**
-* Approvals, as their commands travel: what a terminal, a page or an agent asks its person to
-* say yes to. A command is one endpoint, by its name in the surface table, and its request, as
-* that endpoint encodes it. ref0 decodes each part by the endpoint's own `Schema` before it
-* keeps or shows anything, so a command is exactly what the endpoint would take.
+* A plan's events, in its thread's project's log, written by the Project DO. A version's
+* state is folded from these and its thread's, never recorded on its own.
 */
 /**
-* An endpoint by its name in the surface table, `group.endpoint`. Checked against the table
-* where the command is made canonical, since the table is typed from the API this is part of.
+* A new version, as a draft. Its content never changes after this. Its reason, when given, says
+* why it was written; it's beside the plan, never in it, so it's no part of the content hash.
 */
-const CommandEndpoint = Schema.String.check(Schema.isPattern(/^[a-zA-Z]+\.[a-zA-Z]+$/));
-/** One command, as asked: its endpoint, and its request's path, query and payload, encoded. */
-const ApprovalCommand = Schema.Struct({
-	endpoint: CommandEndpoint,
-	params: Schema.optionalKey(Schema.Record(Schema.String, Schema.String)),
-	query: Schema.optionalKey(Schema.JsonObject),
-	payload: Schema.optionalKey(Schema.Json)
-});
-/** A command ref0 won't ask anyone about: not an endpoint's request, or not one an approval runs. */
-var CommandRefused = class extends Schema.TaggedError()("CommandRefused", { nextStep: Schema.String }, { httpApiStatus: 400 }) {};
-/** A terminal asking: its command, and the hash of the secret it collects the result with. */
-const StartApproval = Schema.Struct({
-	command: ApprovalCommand,
-	secretHash: SecretHash
-});
-/** A terminal's approval, started: what to show its person, and until when. */
-const ApprovalStarted = Schema.Struct({
-	approval: ApprovalId,
-	code: ApprovalCode,
-	expiresAt: Timestamp
-});
+const PlanWritten = eventKind("plan.written", Schema.Struct({
+	thread: ThreadId,
+	version: PlanVersion,
+	plan: PlanRecord,
+	contentHash: PlanContentHash,
+	reason: Schema.optionalKey(TextId)
+}));
 /**
-* An answer that waits for the person: the call only the person may make, or that agents ask
-* for, became an approval, which the person answers on their own page. A `202`, never a failure
-* of the call: whoever asked collects the result with `GET /v1/approvals/{approval}`.
+* The version is put to approval: each repo it names is asked to answer for it, and ref0 says yes
+* once they have or their time runs out. Any earlier draft or proposed version is
+* superseded.
 */
-var ApprovalNeeded = class extends Schema.TaggedError()("ApprovalNeeded", {
-	approval: ApprovalId,
-	says: Schema.String,
-	expiresAt: Timestamp
-}, { httpApiStatus: 202 }) {};
-const terminalAsker = Schema.Struct({ kind: Schema.Literal("terminal") });
-const pageAsker = Schema.Struct({ kind: Schema.Literal("page") });
-const agentAsker = Schema.Struct({
-	kind: Schema.Literal("agent"),
-	agent: AgentId,
-	handle: AgentHandle,
-	session: SessionId,
-	/** The attachment its credential was made under, for a person's agent in an organization. */
-	attachment: Schema.optionalKey(CredentialRef)
+const PlanProposed = eventKind("plan.proposed", Schema.Struct({
+	thread: ThreadId,
+	version: PlanVersion
+}));
+/** Who said yes: ref0's plans part, once every repo answered or its time ran out. */
+const PlanAcceptedBy = Schema.Struct({
+	kind: Schema.Literal("answered"),
+	part: Ref0Part
+});
+/** A child thread, by the plan entry that made it. */
+const PlanChildThread = Schema.Struct({
+	entry: PlanEntryKey,
+	thread: ThreadId
 });
+const ChildThreads = Schema.Array(PlanChildThread).check(Schema.isMaxLength(50));
 /**
-* Who asked, as a receipt keeps it: a terminal, one of ref0's pages, an agent, or a machine
-* asking to connect, by its ID and its own word for itself, and from where.
+* The version is accepted, and the one accepted before it superseded. Each child is named only
+* once its owner has registered it.
 */
-const ApprovalAsker = Schema.Union([
-	terminalAsker,
-	pageAsker,
-	Schema.Struct({
-		kind: Schema.Literal("machine"),
-		machine: MachineId,
-		machineName: MachineName,
-		askedFrom: Schema.optionalKey(Schema.String)
-	}),
-	agentAsker
-]);
+const PlanAccepted = eventKind("plan.accepted", Schema.Struct({
+	thread: ThreadId,
+	version: PlanVersion,
+	by: PlanAcceptedBy,
+	/** The version accepted before this one. */
+	supersedes: Schema.optionalKey(PlanVersion),
+	/** Children made now, each starting in planning. */
+	started: ChildThreads,
+	/** Entries an earlier version dropped and this one adds back: the same child, reopened if it was closed. */
+	rejoined: ChildThreads,
+	/** Children no longer part of the plan, so it stops waiting on them. Closing one is its own event. */
+	dropped: ChildThreads
+}));
+//#endregion
+//#region ../contracts/src/plan-calls.ts
 /**
-* Who asked, as the person reads a request before they answer: a terminal, a page or an agent.
-* A machine's request is read as an `AttachmentRequestView`, never as a command.
+* Plans and decisions: what the Worker asks a thread's Project DO, once `Authorize` has said
+* who's acting. A plan is written with its words; the Project DO stores each as a text and
+* records the version with their IDs.
 */
-const ApprovalViewAsker = Schema.Union([
-	terminalAsker,
-	pageAsker,
-	agentAsker
-]);
-/** A request, as the person reads it before they answer. */
-const ApprovalView = Schema.Struct({
-	approval: ApprovalId,
-	/** The command as its CLI line. */
-	says: Schema.String,
-	/** Everything the command carries, each named, in order: nothing it would run is left out. */
-	fields: Schema.Array(Schema.Struct({
-		name: Schema.String,
-		value: Schema.String,
-		part: Schema.Literals([
-			"path",
-			"query",
-			"payload"
-		])
-	})),
-	command: ApprovalCommand,
-	asker: ApprovalViewAsker,
-	askedFrom: Schema.optionalKey(Schema.String),
-	askedAt: Timestamp,
-	expiresAt: Timestamp,
-	/**
-	* An agent's ask: the kind of action its answer may set agents' permission for, and whether a
-	* yes may let agents take it without asking. A no with the passkey may always stop them asking.
-	*/
-	agentPermission: Schema.optionalKey(Schema.Struct({
-		action: ScopeAction,
-		mayAllow: Schema.Boolean
-	})),
-	/**
-	* What the command acts on, drawn as ref0 resolves it for the person reading, where its
-	* endpoint names a preview. Without one the page can draw, it offers only no.
-	*/
-	preview: Schema.optionalKey(ApprovalPreview)
-});
-/** A statement's hash: the SHA-256 of its words and quoted values as JSON, as lowercase hex. */
-const StatementHash = Schema.String.check(Schema.isPattern(/^[0-9a-f]{64}$/));
+/** A plan's free text: one of its outcomes, or an answer's reason. */
+const PlanText = Schema.String.check(Schema.isBetweenLength(1, 2048));
 /**
-* Who asks for a yes to a statement: a workflow's run, `passkey.run`'s, by the workflow and the
-* run; or a gate's check, `passkey.check`'s, by the check, the pull request's version it gates and
-* the check run its statement is over.
+* How a plan does its work, in system terms, for people: about a page. A revision replaces it,
+* with a reason; no one appends to it.
 */
-const StatementAsker = Schema.Union([Schema.Struct({
-	kind: Schema.Literal("workflow"),
-	workflow: WorkflowName,
-	run: WorkflowRunId
-}), Schema.Struct({
-	kind: Schema.Literal("gate"),
-	check: CheckKey,
-	pullRequest: PullRequestNumber,
-	version: VersionNumber,
-	run: CheckRunId
-})]);
+const Approach = Schema.String.check(Schema.isBetweenLength(1, 6e3));
 /**
-* A passkey request, as the person reads it before they answer: the statement, its words as its
-* asker wrote them and each value it quotes, and its hash; who asks; where, a workflow's
-* `owner/repo` or a thread's `owner/project#number`, or a gate's pull request, `owner/repo#number`;
-* whom it asks, the run's accountable person, or for a gate the person behind its run, a person by
-* name, or a permission's holders; and until when.
+* A child as written. On a top-level org thread's plan, `project` names one of its owner's
+* projects to start it in, as that project's thread; left out, it's in its parent's scope.
 */
-const StatementView = Schema.Struct({
-	approval: ApprovalId,
-	statement: WorkflowText,
-	hash: StatementHash,
-	asker: StatementAsker,
-	home: Schema.String,
-	from: Schema.Union([Schema.Literals(["accountable", "person"]), Schema.Struct({ permission: RepoPermissionName })]),
-	askedAt: Timestamp,
-	expiresAt: Timestamp
+const PlanChildInput = Schema.Struct({
+	entry: PlanEntryKey,
+	title: Title,
+	outcome: Outcome,
+	stackedOn: Schema.optionalKey(PlanEntryKey),
+	required: Schema.Boolean,
+	project: Schema.optionalKey(ProjectName)
 });
 /**
-* The person's own requests, waiting for them; the passkey requests workflows' runs and gates asked
-* them; and each machine's request this browser session is the answerer of, so a reload finds it
-* again without its code.
+* A plan as written: `PlanRecord`'s shape, with its words in place of text IDs. Its repos are up
+* to 20 of the project's, by name; a parent whose work is all in its children names none.
 */
-const ApprovalsWaiting = Schema.Struct({
-	approvals: Schema.Array(ApprovalView),
-	statements: Schema.Array(StatementView),
-	requests: Schema.Array(AttachmentRequestView)
-});
-/** Finding a terminal's request by the code it showed. */
-const FindApproval = Schema.Union([Schema.Struct({ code: TypedApprovalCode }), Schema.Struct({ link: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{22}$/)) })]);
+const PlanInput = Schema.Struct({
+	approach: Schema.optionalKey(Approach),
+	repos: Schema.Array(RepoName).check(Schema.isMaxLength(20)),
+	outcomes: Schema.Array(PlanText).check(Schema.isBetweenLength(1, 50)),
+	children: Schema.Array(PlanChildInput).check(Schema.isMaxLength(50))
+}).check(Schema.makeFilter((plan) => planProblem(plan) ?? true));
 /**
-* Asking for the passkey's options to answer a request: a terminal's request needs its code
-* again, so its ID alone, which travels where its code doesn't, never answers it. A machine's
-* request needs its answerer, and the agent it chooses to connect, before a yes has options.
+* A project a plan's child names, as the Worker found it in the plan's owner before it asked the
+* scope: its ID, and whether the writer can see it; or, with no `project`, that the owner has
+* none by that name. The Worker refuses nothing for it, since only the scope knows which entries
+* a version keeps.
 */
-const ApprovalOptionsRequest = Schema.Struct({
-	code: Schema.optionalKey(TypedApprovalCode),
-	folders: Schema.optionalKey(ConnectFolderChoices)
+const NamedProject = Schema.Struct({
+	name: ProjectName,
+	project: Schema.optionalKey(ProjectId),
+	seen: Schema.Boolean
 });
-/**
-* An answer: yes, with the passkey, or no. For an agent's ask, each answer can set the owner's
-* permission its own way, so a pairing that can't happen can't be sent: yes, and let agents do
-* it without asking; no, and stop agents asking, with the passkey too.
-*/
-const AnswerApproval = Schema.Union([
-	Schema.Struct({
-		answer: Schema.Literal("yes"),
-		permission: Schema.optionalKey(Schema.Literal("allow")),
-		assertion: PasskeyAsserted,
-		code: Schema.optionalKey(TypedApprovalCode),
-		/** The preview the page drew, where the command's endpoint names one. */
-		preview: Schema.optionalKey(PreviewEcho),
-		/** The statement the page showed, by its hash, for a workflow run's or a gate's passkey request. */
-		statement: Schema.optionalKey(Schema.Struct({ hash: StatementHash }))
-	}),
-	Schema.Struct({
-		answer: Schema.Literal("no"),
-		permission: Schema.Literal("deny"),
-		assertion: PasskeyAsserted,
-		code: Schema.optionalKey(TypedApprovalCode)
-	}),
-	Schema.Struct({
-		answer: Schema.Literal("no"),
-		code: Schema.optionalKey(TypedApprovalCode)
-	})
-]);
-/**
-* What running an approved command came to: its status, and its endpoint's answer or refusal,
-* as JSON. ref0 reads it by the command's endpoint before anyone sees it, and whoever asked reads
-* it the same way, with `ranOf`: this schema is part of the API the endpoints' types come from,
-* so it can't be typed by them itself.
-*/
-const Ran = Schema.Struct({
-	status: Schema.Int,
-	result: Schema.Json
-});
-/**
-* A ran command whose answer its endpoint's schemas no longer read, such as one kept from
-* before they changed: it ran, and what it came to can't be said.
-*/
-var ResultUnreadable = class extends Schema.TaggedError()("ResultUnreadable", { nextStep: Schema.String }, { httpApiStatus: 500 }) {};
-/**
-* Where a request stands, for whoever asked: still waiting; approved, and running as soon as
-* ref0 can; refused; expired; or what it ran to, with the endpoint it ran, whose schemas read it.
-*/
-const ApprovalState = Schema.Union([
-	Schema.Struct({
-		state: Schema.Literal("waiting"),
-		expiresAt: Timestamp
-	}),
-	Schema.Struct({
-		state: Schema.Literal("approved"),
-		/** A machine's answering browser may forget its saved answer once the terminal kept it. */
-		collected: Schema.optionalKey(Schema.Literal(true))
-	}),
-	Schema.Struct({ state: Schema.Literal("refused") }),
-	Schema.Struct({ state: Schema.Literal("expired") }),
-	Schema.Struct({
-		state: Schema.Literal("ran"),
-		endpoint: CommandEndpoint,
-		...Ran.fields
-	})
-]);
-/** Only the answering browser receives a machine's answer code; state reads never carry it. */
-const ApprovalAnswer = Schema.Union([
-	Schema.Struct({
-		...ApprovalState.members[1].fields,
-		answerCode: ApprovalCode
-	}),
-	Schema.Struct({
-		...ApprovalState.members[4].fields,
-		answerCode: ApprovalCode
-	}),
-	ApprovalState
-]);
-/** A request that isn't there, or isn't the caller's to see, answers the same. */
-var ApprovalNotFound = class extends Schema.TaggedError()("ApprovalNotFound", { nextStep: Schema.String }, { httpApiStatus: 404 }) {};
-/** Too many asked, or too many codes typed, from here in the last hour. */
-var SlowDown = class extends Schema.TaggedError()("SlowDown", { nextStep: Schema.String }, { httpApiStatus: 429 }) {};
-/** A command's hash: the SHA-256 of its canonical JSON, as lowercase hex. */
-const CommandHash = Schema.String.check(Schema.isPattern(/^[0-9a-f]{64}$/));
 Schema.Struct({
-	approval: ApprovalId,
-	endpoint: CommandEndpoint,
-	/** The command's canonical JSON. */
-	command: Schema.String,
-	commandHash: CommandHash,
-	asker: ApprovalAsker,
-	/** The browser session the person answered in, for their log. */
-	credential: CredentialRef,
-	generation: Generation,
-	/** When the request expires, in epoch milliseconds. */
-	deadline: Schema.Int,
-	challenge: Schema.String,
-	/** A machine answer retries only from its answering session, with this key. */
-	answerKey: Schema.optionalKey(RequestId),
-	/** An agent's ask: the credential it asked with, checked again before the answer counts. */
-	asking: Schema.optionalKey(TokenId),
-	/** The kind of action the person, answering, let agents take without asking from now on. */
-	allow: Schema.optionalKey(ScopeAction)
+	...commandFields,
+	project: ProjectId,
+	ownerName: OwnerName,
+	number: ThreadNumber,
+	plan: PlanInput,
+	projects: Schema.Array(NamedProject).check(Schema.isMaxLength(50)),
+	reason: Schema.optionalKey(Reason),
+	propose: Schema.Boolean
 });
 Schema.Struct({
-	approval: ApprovalId,
-	action: ScopeAction,
-	credential: CredentialRef,
-	generation: Generation
+	...commandFields,
+	ownerName: OwnerName,
+	project: ProjectId,
+	number: ThreadNumber,
+	version: PlanVersion
+});
+/** A decision as it stands: what it asks, who decides, the answers so far, and how it closed. */
+const DecisionView = Schema.Struct({
+	decision: DecisionId,
+	kind: DecisionKind,
+	subject: DecisionSubject,
+	question: Schema.optionalKey(TextId),
+	options: Schema.Array(AnswerOption),
+	lean: Schema.optionalKey(AnswerKey),
+	deciders: Schema.Array(Decider),
+	deadline: Schema.optionalKey(Schema.DateTimeUtcFromMillis),
+	state: Schema.Literals(["open", "closed"]),
+	answers: Schema.Array(Schema.Struct({
+		decider: DeciderRef,
+		answer: AnswerKey,
+		reason: Schema.optionalKey(TextId),
+		at: Schema.DateTimeUtcFromMillis
+	})),
+	result: Schema.optionalKey(AnswerKey),
+	closedWhy: Schema.optionalKey(DecisionClosedWhy)
 });
-Schema.Union([Schema.Struct({ denied: Schema.Literal(true) }), Schema.Struct({
-	denied: Schema.Literal(false),
-	reason: Schema.Literals(["generation moved", "not set up"])
-})]);
-Schema.Union([Schema.Struct({
-	admitted: Schema.Literal(true),
-	admittedAt: Schema.Int,
-	answerCode: Schema.optionalKey(ApprovalCode)
-}), Schema.Struct({
-	admitted: Schema.Literal(false),
-	reason: Schema.Literals([
-		"expired",
-		"generation moved",
-		"challenge used",
-		"not set up",
-		"asker gone"
-	])
-})]);
-Schema.Union([Schema.Struct({ found: Schema.Literal(false) }), Schema.Struct({
-	found: Schema.Literal(true),
-	endpoint: CommandEndpoint,
-	command: Schema.String,
-	commandHash: CommandHash,
-	generation: Generation,
-	generationNow: Generation,
-	/** The `approval.answered` its admission recorded in the person's log. */
-	answeredEvent: EventId,
-	/** Who asked, as that `approval.answered` says. */
-	asker: ApprovalAsker,
-	/** What running it came to, once it ran, as `KeptRan` keeps it. */
-	result: Schema.optionalKey(Schema.String)
-})]);
 /**
-* A `Ran` as it's kept, on its receipt and on its approval: its JSON, as text. The Owner DO
-* keeps it as it comes and runs no endpoint's schemas, so it's read only by its endpoint, with
-* `keptRan`, which refuses one they don't take.
+* Where a decision is, as people write it: its thread, `pip/default#3`, or an org thread's,
+* `acme#7`; and a gate's pull request, `pip/notes#1`. Its Project DO writes them as it answers,
+* from its own threads and repos and the owner's name the Worker gives it, so each reads as it's
+* called now.
 */
-const KeptRan = Schema.fromJsonString(Ran);
-Schema.Struct({
-	approval: ApprovalId,
-	result: Schema.String
+const DecisionNames = Schema.Struct({
+	thread: WrittenThread,
+	pullRequest: Schema.optionalKey(WrittenPullRequest)
 });
-Schema.Struct({ result: Schema.String });
-Schema.Struct({ approval: ApprovalId });
-Schema.Struct({ approval: ApprovalId });
-Schema.Union([Schema.Struct({ expired: Schema.Literal(true) }), Schema.Struct({ expired: Schema.Literal(false) })]);
-Schema.Struct({
-	person: PersonId,
-	approval: ApprovalId
+/** A decision as `/v1` answers it: as it stands, and where it is, in words. */
+const NamedDecision = Schema.Struct({
+	...DecisionView.fields,
+	names: DecisionNames
 });
-//#endregion
-//#region ../contracts/src/browser-sessions.ts
 /**
-* A browser session's cookie: Better Auth's, named for ref0, `Secure` and host-only on the
-* app's one origin. It holds the session's token, signed; the directory and the person's Owner DO hold
-* only the token's SHA-256.
+* A version as it stands: its content, its state, and, once proposed, where its approval is: its
+* repos still being checked, or who accepted it.
 */
-const browserSessionCookie = "__Secure-ref0.session_token";
-Schema.Struct({
-	token: TokenId,
-	secretHash: SecretHash,
-	expiresAt: Schema.DateTimeUtcFromMillis
+const PlanVersionView = Schema.Struct({
+	thread: ThreadId,
+	number: ThreadNumber,
+	version: PlanVersion,
+	state: PlanState,
+	contentHash: PlanContentHash,
+	plan: PlanView,
+	/** Why it was written, when its writer said: never part of its content. */
+	reason: Schema.optionalKey(TextId),
+	writtenBy: ActorRef,
+	writtenAt: Schema.DateTimeUtcFromMillis,
+	/** Proposed, and its repos haven't all answered yet: it isn't accepted yet. */
+	checking: Schema.Boolean,
+	/**
+	* What its check found when it ended, every repo answered or their time run out: the repos
+	* that never answered. None for a draft, while it's being checked, or when a newer version or
+	* the thread closing ended the check first.
+	*/
+	check: Schema.optionalKey(PlanCheck),
+	/**
+	* Accepted, and waiting to be recorded: on its new `children` registering, or on a merge under
+	* the thread's current revision `publishing`.
+	*/
+	accepting: Schema.optionalKey(Schema.Literals(["children", "publishing"])),
+	acceptedBy: Schema.optionalKey(PlanAcceptedBy)
 });
-Schema.Struct({ registered: Schema.Boolean });
-/**
-* Where a signed-in person stands: naming, when the name their GitHub login gave was taken or
-* kept back, with that login as a suggestion; setting up, once their owner is made and before
-* it's ready with this session registered, which naming again finishes; or ready.
-*/
-const Welcome = Schema.Union([Schema.Struct({
-	state: Schema.Literals(["ready", "setting up"]),
-	person: PersonId,
-	owner: OwnerId,
-	name: OwnerName
-}), Schema.Struct({
-	state: Schema.Literal("naming"),
-	person: PersonId,
-	suggestion: Schema.optionalKey(Schema.String)
-})]);
+/** A plan's free text refused before anything was stored, saying which. */
+var PlanTextRefused = class extends Schema.TaggedError()("PlanTextRefused", {
+	/** Where it is in the plan, such as `outcomes[3]`. */
+	where: Schema.String,
+	problem: Schema.Literals([
+		"empty",
+		"too long",
+		"looks like a secret"
+	]),
+	nextStep: Schema.String
+}, { httpApiStatus: 422 }) {};
+/** A plan names a repo this project doesn't hold. */
+var PlanRepoNotFound = class extends Schema.TaggedError()("PlanRepoNotFound", {
+	repo: RepoName,
+	nextStep: Schema.String
+}, { httpApiStatus: 422 }) {};
 /**
-* A browser session renewed: its expiry, in its person's Owner DO and in the directory, and on its cookie.
-* Renewed at most once a day, so one asked sooner answers its expiry unchanged.
+* A plan names its scope's own repo, made just now, before the scope holds it. Nothing was kept
+* under the request's delivery ID, so the same request is written once it does.
 */
-const SessionRenewed = Schema.Struct({ expiresAt: Schema.DateTimeUtcFromMillis });
+var OwnRepoNotReady = class extends Schema.TaggedError()("OwnRepoNotReady", {
+	repo: RepoName,
+	nextStep: Schema.String
+}, { httpApiStatus: 503 }) {};
 /**
-* What starting a GitHub sign-in at `POST /auth/sign-in/social` answers: GitHub's address to go
-* to, with the sign-in's state in a cookie set alongside. Better Auth's answer, which ref0 serves.
+* A child entry this plan can't have: a project named on a project thread's plan or a nested org
+* thread's, a project that isn't there or the writer can't see, one where its proposer may not
+* start threads, an entry moved to another project, or a stack across scopes. A project that
+* isn't there and one the writer can't see are refused alike, as `ProjectNotFound` is.
 */
-const NavigationUrl = Schema.String.check(Schema.isPattern(/^https?:\/\/[^\s/]+(?:\/[^\s]*)?$/), Schema.makeFilter((url) => URL.canParse(url) || "an HTTP(S) URL the platform can parse")).pipe(Schema.brand("NavigationUrl"));
-const SignInStarted = Schema.Struct({ url: NavigationUrl });
+var PlanChildRefused = class extends Schema.TaggedError()("PlanChildRefused", { nextStep: Schema.String }, { httpApiStatus: 422 }) {};
+var PlanVersionNotFound = class extends Schema.TaggedError()("PlanVersionNotFound", {
+	number: ThreadNumber,
+	version: PlanVersion,
+	nextStep: Schema.String
+}, { httpApiStatus: 404 }) {};
 /**
-* Where signing in sends the browser back to, as `POST /auth/sign-in/social` takes it: a path on
-* ref0's own origin, such as `/welcome`, or a whole URL. Never a socket's.
-*/
-const SignInDestination = Schema.String.pipe(Schema.brand("SignInDestination"));
-/**
-* What `POST /auth/sign-in/social` takes to start signing in with GitHub: where the browser
-* lands coming back, and where it lands when signing in failed. Better Auth's body, which ref0
-* serves.
-*/
-const StartSignIn = Schema.Struct({
-	provider: Schema.Literal("github"),
-	callbackURL: SignInDestination,
-	errorCallbackURL: SignInDestination
-});
-/** The name a naming person chose for their owner. */
-const NameOwner = Schema.Struct({ name: OwnerName });
-//#endregion
-//#region ../contracts/src/plan-events.ts
-/**
-* A plan's events, in its thread's project's log, written by the Project DO. A version's
-* state is folded from these and its thread's, never recorded on its own.
-*/
-/**
-* A new version, as a draft. Its content never changes after this. Its reason, when given, says
-* why it was written; it's beside the plan, never in it, so it's no part of the content hash.
-*/
-const PlanWritten = eventKind("plan.written", Schema.Struct({
-	thread: ThreadId,
-	version: PlanVersion,
-	plan: PlanRecord,
-	contentHash: PlanContentHash,
-	reason: Schema.optionalKey(TextId)
-}));
-/**
-* The version is put to approval: each repo it names is asked to answer for it, and ref0 says yes
-* once they have or their time runs out. Any earlier draft or proposed version is
-* superseded.
-*/
-const PlanProposed = eventKind("plan.proposed", Schema.Struct({
-	thread: ThreadId,
-	version: PlanVersion
-}));
-/** Who said yes: ref0's plans part, once every repo answered or its time ran out. */
-const PlanAcceptedBy = Schema.Struct({
-	kind: Schema.Literal("answered"),
-	part: Ref0Part
-});
-/** A child thread, by the plan entry that made it. */
-const PlanChildThread = Schema.Struct({
-	entry: PlanEntryKey,
-	thread: ThreadId
-});
-const ChildThreads = Schema.Array(PlanChildThread).check(Schema.isMaxLength(50));
-/**
-* The version is accepted, and the one accepted before it superseded. Each child is named only
-* once its owner has registered it.
-*/
-const PlanAccepted = eventKind("plan.accepted", Schema.Struct({
-	thread: ThreadId,
-	version: PlanVersion,
-	by: PlanAcceptedBy,
-	/** The version accepted before this one. */
-	supersedes: Schema.optionalKey(PlanVersion),
-	/** Children made now, each starting in planning. */
-	started: ChildThreads,
-	/** Entries an earlier version dropped and this one adds back: the same child, reopened if it was closed. */
-	rejoined: ChildThreads,
-	/** Children no longer part of the plan, so it stops waiting on them. Closing one is its own event. */
-	dropped: ChildThreads
-}));
-//#endregion
-//#region ../contracts/src/plan-calls.ts
-/**
-* Plans and decisions: what the Worker asks a thread's Project DO, once `Authorize` has said
-* who's acting. A plan is written with its words; the Project DO stores each as a text and
-* records the version with their IDs.
-*/
-/** A plan's free text: one of its outcomes, or an answer's reason. */
-const PlanText = Schema.String.check(Schema.isBetweenLength(1, 2048));
-/**
-* How a plan does its work, in system terms, for people: about a page. A revision replaces it,
-* with a reason; no one appends to it.
-*/
-const Approach = Schema.String.check(Schema.isBetweenLength(1, 6e3));
-/**
-* A child as written. On a top-level org thread's plan, `project` names one of its owner's
-* projects to start it in, as that project's thread; left out, it's in its parent's scope.
-*/
-const PlanChildInput = Schema.Struct({
-	entry: PlanEntryKey,
-	title: Title,
-	outcome: Outcome,
-	stackedOn: Schema.optionalKey(PlanEntryKey),
-	required: Schema.Boolean,
-	project: Schema.optionalKey(ProjectName)
-});
-/**
-* A plan as written: `PlanRecord`'s shape, with its words in place of text IDs. Its repos are up
-* to 20 of the project's, by name; a parent whose work is all in its children names none.
-*/
-const PlanInput = Schema.Struct({
-	approach: Schema.optionalKey(Approach),
-	repos: Schema.Array(RepoName).check(Schema.isMaxLength(20)),
-	outcomes: Schema.Array(PlanText).check(Schema.isBetweenLength(1, 50)),
-	children: Schema.Array(PlanChildInput).check(Schema.isMaxLength(50))
-}).check(Schema.makeFilter((plan) => planProblem(plan) ?? true));
-/**
-* A project a plan's child names, as the Worker found it in the plan's owner before it asked the
-* scope: its ID, and whether the writer can see it; or, with no `project`, that the owner has
-* none by that name. The Worker refuses nothing for it, since only the scope knows which entries
-* a version keeps.
-*/
-const NamedProject = Schema.Struct({
-	name: ProjectName,
-	project: Schema.optionalKey(ProjectId),
-	seen: Schema.Boolean
-});
-Schema.Struct({
-	...commandFields,
-	project: ProjectId,
-	ownerName: OwnerName,
-	number: ThreadNumber,
-	plan: PlanInput,
-	projects: Schema.Array(NamedProject).check(Schema.isMaxLength(50)),
-	reason: Schema.optionalKey(Reason),
-	propose: Schema.Boolean
-});
-Schema.Struct({
-	...commandFields,
-	ownerName: OwnerName,
-	project: ProjectId,
-	number: ThreadNumber,
-	version: PlanVersion
-});
-/** A decision as it stands: what it asks, who decides, the answers so far, and how it closed. */
-const DecisionView = Schema.Struct({
-	decision: DecisionId,
-	kind: DecisionKind,
-	subject: DecisionSubject,
-	question: Schema.optionalKey(TextId),
-	options: Schema.Array(AnswerOption),
-	lean: Schema.optionalKey(AnswerKey),
-	deciders: Schema.Array(Decider),
-	deadline: Schema.optionalKey(Schema.DateTimeUtcFromMillis),
-	state: Schema.Literals(["open", "closed"]),
-	answers: Schema.Array(Schema.Struct({
-		decider: DeciderRef,
-		answer: AnswerKey,
-		reason: Schema.optionalKey(TextId),
-		at: Schema.DateTimeUtcFromMillis
-	})),
-	result: Schema.optionalKey(AnswerKey),
-	closedWhy: Schema.optionalKey(DecisionClosedWhy)
-});
-/**
-* A version as it stands: its content, its state, and, once proposed, where its approval is: its
-* repos still being checked, or who accepted it.
-*/
-const PlanVersionView = Schema.Struct({
-	thread: ThreadId,
-	number: ThreadNumber,
-	version: PlanVersion,
-	state: PlanState,
-	contentHash: PlanContentHash,
-	plan: PlanView,
-	/** Why it was written, when its writer said: never part of its content. */
-	reason: Schema.optionalKey(TextId),
-	writtenBy: ActorRef,
-	writtenAt: Schema.DateTimeUtcFromMillis,
-	/** Proposed, and its repos haven't all answered yet: it isn't accepted yet. */
-	checking: Schema.Boolean,
-	/**
-	* What its check found when it ended, every repo answered or their time run out: the repos
-	* that never answered. None for a draft, while it's being checked, or when a newer version or
-	* the thread closing ended the check first.
-	*/
-	check: Schema.optionalKey(PlanCheck),
-	/**
-	* Accepted, and waiting to be recorded: on its new `children` registering, or on a merge under
-	* the thread's current revision `publishing`.
-	*/
-	accepting: Schema.optionalKey(Schema.Literals(["children", "publishing"])),
-	acceptedBy: Schema.optionalKey(PlanAcceptedBy)
-});
-/** A plan's free text refused before anything was stored, saying which. */
-var PlanTextRefused = class extends Schema.TaggedError()("PlanTextRefused", {
-	/** Where it is in the plan, such as `outcomes[3]`. */
-	where: Schema.String,
-	problem: Schema.Literals([
-		"empty",
-		"too long",
-		"looks like a secret"
-	]),
-	nextStep: Schema.String
-}, { httpApiStatus: 422 }) {};
-/** A plan names a repo this project doesn't hold. */
-var PlanRepoNotFound = class extends Schema.TaggedError()("PlanRepoNotFound", {
-	repo: RepoName,
-	nextStep: Schema.String
-}, { httpApiStatus: 422 }) {};
-/**
-* A plan names its scope's own repo, made just now, before the scope holds it. Nothing was kept
-* under the request's delivery ID, so the same request is written once it does.
-*/
-var OwnRepoNotReady = class extends Schema.TaggedError()("OwnRepoNotReady", {
-	repo: RepoName,
-	nextStep: Schema.String
-}, { httpApiStatus: 503 }) {};
-/**
-* A child entry this plan can't have: a project named on a project thread's plan or a nested org
-* thread's, a project that isn't there or the writer can't see, one where its proposer may not
-* start threads, an entry moved to another project, or a stack across scopes. A project that
-* isn't there and one the writer can't see are refused alike, as `ProjectNotFound` is.
-*/
-var PlanChildRefused = class extends Schema.TaggedError()("PlanChildRefused", { nextStep: Schema.String }, { httpApiStatus: 422 }) {};
-var PlanVersionNotFound = class extends Schema.TaggedError()("PlanVersionNotFound", {
-	number: ThreadNumber,
-	version: PlanVersion,
-	nextStep: Schema.String
-}, { httpApiStatus: 404 }) {};
-/**
-* Only a thread's newest version is proposed, and never one already declined, nor one whose
-* required or stacked children would close a cycle of threads waiting on each other.
+* Only a thread's newest version is proposed, and never one already declined, nor one whose
+* required or stacked children would close a cycle of threads waiting on each other.
 */
 var PlanNotProposable = class extends Schema.TaggedError()("PlanNotProposable", {
 	version: PlanVersion,
@@ -7334,126 +6978,525 @@ var AnswerRefused = class extends Schema.TaggedError()("AnswerRefused", {
 	nextStep: Schema.String
 }, { httpApiStatus: 409 }) {};
 /**
-* Where a gate's answer goes: its Repo DO, which alone decides it, named by the gate's subject,
-* with the answer's reason already stored here, where the fold reads it, and the scope it's in,
-* which the Worker's `nextStep`s write. The Project DO keeps no receipt for a route, so a
-* retry routes again, and the Repo DO keeps the answer's. The Worker takes it and never answers
-* with it.
+* Where a gate's answer goes: its Repo DO, which alone decides it, named by the gate's subject,
+* with the answer's reason already stored here, where the fold reads it, and the scope it's in,
+* which the Worker's `nextStep`s write. The Project DO keeps no receipt for a route, so a
+* retry routes again, and the Repo DO keeps the answer's. The Worker takes it and never answers
+* with it.
+*/
+const GateAnswerRoute = Schema.TaggedStruct("GateAnswerRoute", {
+	scope: ThreadScope,
+	decision: DecisionId,
+	repo: RepoId,
+	pullRequest: PullRequestNumber,
+	version: VersionNumber,
+	reason: Schema.optionalKey(TextId)
+});
+Schema.Union([
+	NamedDecision,
+	GateAnswerRoute,
+	DecisionNotFound,
+	AnswerRefused,
+	PlanTextRefused,
+	ProjectNotReady,
+	ProjectNotFound,
+	DeliveryOutsideWindow
+]);
+Schema.Struct({
+	...commandFields,
+	project: ProjectId,
+	decision: DecisionId,
+	pullRequest: PullRequestNumber,
+	version: VersionNumber,
+	answer: AnswerKey,
+	reason: Schema.optionalKey(TextId),
+	admin: Schema.Boolean
+});
+Schema.Union([
+	Schema.Struct({
+		outcome: Schema.Literal("answered"),
+		deciders: Schema.Array(DeciderRef)
+	}),
+	Schema.Struct({ outcome: Schema.Literals([
+		"decision closed",
+		"not a decider",
+		"already answered",
+		"not an answer"
+	]) }),
+	DeliveryOutsideWindow
+]);
+/** Someone decisions wait on: a person, or an agent, and the roles the Worker found they hold. */
+const Waiter = Schema.Struct({
+	decider: DeciderRef,
+	roles: Schema.Array(Schema.Struct({
+		role: Schema.Literal("admin"),
+		owner: OwnerId
+	}))
+});
+Schema.Struct({
+	ownerName: OwnerName,
+	you: Waiter,
+	person: Schema.optionalKey(Waiter),
+	decisions: Schema.optionalKey(Schema.Array(DecisionId).check(Schema.isMaxLength(100)))
+});
+/**
+* An open decision that waits on the caller: on them, or, for an agent, on its person, who
+* answers it. A gate never takes an agent's answer, so an agent's gate always waits on its person.
+*/
+const WaitingDecision = Schema.Struct({
+	...NamedDecision.fields,
+	waitsOn: Schema.Literals(["you", "your person"])
+});
+const WaitingPage = Schema.Struct({ decisions: Schema.Array(WaitingDecision) });
+Schema.Struct({
+	ownerName: OwnerName,
+	number: ThreadNumber
+});
+const PlanVersionPage = Schema.Struct({ versions: Schema.Array(PlanVersionView) });
+Schema.Union([PlanVersionPage, ThreadNotFound]);
+/** One decision of the project's, by its ID. */
+/** At most how long a read of a decision waits for it to close, in seconds. */
+const DecisionWait = Schema.Int.check(Schema.isBetween({
+	minimum: 1,
+	maximum: 60
+}));
+Schema.Struct({
+	ownerName: OwnerName,
+	decision: DecisionId,
+	wait: Schema.optionalKey(DecisionWait)
+});
+Schema.Union([NamedDecision, DecisionNotFound]);
+/**
+* `POST …/plans`: a version, as a draft unless it's proposed at once, and why it was written.
+* A first version needs no reason, and a later one may leave it out.
+*/
+const WritePlanRequest = Schema.Struct({
+	plan: PlanInput,
+	reason: Schema.optionalKey(Reason),
+	propose: Schema.optionalKey(Schema.Boolean)
+});
+/** `POST …/decisions/{decision}/answers`: one of its answers, and why, in words. */
+const AnswerRequest = Schema.Struct({
+	answer: AnswerKey,
+	reason: Schema.optionalKey(PlanText)
+});
+Schema.Struct({
+	thread: ThreadId,
+	owner: OwnerId,
+	parent: ThreadId,
+	parentScope: ProjectId,
+	parentNumber: ThreadNumber,
+	fromPlan: Schema.Struct({
+		version: PlanVersion,
+		entry: PlanEntryKey
+	}),
+	title: Title,
+	outcome: Outcome,
+	required: Schema.Boolean,
+	actor: ActorRef,
+	cause: EventRef
+});
+/** The child as it stands, whether this call started it or an earlier one did. */
+const RemoteChildStarted = Schema.Struct({
+	number: ThreadNumber,
+	stage: ThreadStage,
+	stageRevision: StageRevision
+});
+Schema.Union([RemoteChildStarted, ProjectNotReady]);
+Schema.Struct({
+	thread: ThreadId,
+	number: ThreadNumber
+});
+/** A child's stage and its revision, as one read found them. */
+const ChildStageView = Schema.Struct({
+	stage: ThreadStage,
+	stageRevision: StageRevision
+});
+Schema.Union([ChildStageView, ThreadNotFound]);
+//#endregion
+//#region ../contracts/src/approvals.ts
+/**
+* Approvals, as their commands travel: what a terminal, a page or an agent asks its person to
+* say yes to. A command is one endpoint, by its name in the surface table, and its request, as
+* that endpoint encodes it. ref0 decodes each part by the endpoint's own `Schema` before it
+* keeps or shows anything, so a command is exactly what the endpoint would take.
+*/
+/**
+* An endpoint by its name in the surface table, `group.endpoint`. Checked against the table
+* where the command is made canonical, since the table is typed from the API this is part of.
+*/
+const CommandEndpoint = Schema.String.check(Schema.isPattern(/^[a-zA-Z]+\.[a-zA-Z]+$/));
+/** One command, as asked: its endpoint, and its request's path, query and payload, encoded. */
+const ApprovalCommand = Schema.Struct({
+	endpoint: CommandEndpoint,
+	params: Schema.optionalKey(Schema.Record(Schema.String, Schema.String)),
+	query: Schema.optionalKey(Schema.JsonObject),
+	payload: Schema.optionalKey(Schema.Json)
+});
+/** A command ref0 won't ask anyone about: not an endpoint's request, or not one an approval runs. */
+var CommandRefused = class extends Schema.TaggedError()("CommandRefused", { nextStep: Schema.String }, { httpApiStatus: 400 }) {};
+/** A terminal asking: its command, and the hash of the secret it collects the result with. */
+const StartApproval = Schema.Struct({
+	command: ApprovalCommand,
+	secretHash: SecretHash
+});
+/** A terminal's approval, started: what to show its person, and until when. */
+const ApprovalStarted = Schema.Struct({
+	approval: ApprovalId,
+	code: ApprovalCode,
+	expiresAt: Timestamp
+});
+/**
+* An answer that waits for the person: the call only the person may make, or that agents ask
+* for, became an approval, which the person answers on their own page. A `202`, never a failure
+* of the call: whoever asked collects the result with `GET /v1/approvals/{approval}`.
+*/
+var ApprovalNeeded = class extends Schema.TaggedError()("ApprovalNeeded", {
+	approval: ApprovalId,
+	says: Schema.String,
+	expiresAt: Timestamp
+}, { httpApiStatus: 202 }) {};
+const terminalAsker = Schema.Struct({ kind: Schema.Literal("terminal") });
+const pageAsker = Schema.Struct({ kind: Schema.Literal("page") });
+const agentAsker = Schema.Struct({
+	kind: Schema.Literal("agent"),
+	agent: AgentId,
+	handle: AgentHandle,
+	session: SessionId,
+	/** The attachment its credential was made under, for a person's agent in an organization. */
+	attachment: Schema.optionalKey(CredentialRef)
+});
+/**
+* Who asked, as a receipt keeps it: a terminal, one of ref0's pages, an agent, or a machine
+* asking to connect, by its ID and its own word for itself, and from where.
+*/
+const ApprovalAsker = Schema.Union([
+	terminalAsker,
+	pageAsker,
+	Schema.Struct({
+		kind: Schema.Literal("machine"),
+		machine: MachineId,
+		machineName: MachineName,
+		askedFrom: Schema.optionalKey(Schema.String)
+	}),
+	agentAsker
+]);
+/**
+* Who asked, as the person reads a request before they answer: a terminal, a page or an agent.
+* A machine's request is read as an `AttachmentRequestView`, never as a command.
+*/
+const ApprovalViewAsker = Schema.Union([
+	terminalAsker,
+	pageAsker,
+	agentAsker
+]);
+/** A request, as the person reads it before they answer. */
+const ApprovalView = Schema.Struct({
+	approval: ApprovalId,
+	/** The command as its CLI line. */
+	says: Schema.String,
+	/** Everything the command carries, each named, in order: nothing it would run is left out. */
+	fields: Schema.Array(Schema.Struct({
+		name: Schema.String,
+		value: Schema.String,
+		part: Schema.Literals([
+			"path",
+			"query",
+			"payload"
+		])
+	})),
+	command: ApprovalCommand,
+	asker: ApprovalViewAsker,
+	askedFrom: Schema.optionalKey(Schema.String),
+	askedAt: Timestamp,
+	expiresAt: Timestamp,
+	/**
+	* An agent's ask: the kind of action its answer may set agents' permission for, and whether a
+	* yes may let agents take it without asking. A no with the passkey may always stop them asking.
+	*/
+	agentPermission: Schema.optionalKey(Schema.Struct({
+		action: ScopeAction,
+		mayAllow: Schema.Boolean
+	})),
+	/**
+	* What the command acts on, drawn as ref0 resolves it for the person reading, where its
+	* endpoint names a preview. Without one the page can draw, it offers only no.
+	*/
+	preview: Schema.optionalKey(ApprovalPreview)
+});
+/** A statement's hash: the SHA-256 of its words and quoted values as JSON, as lowercase hex. */
+const StatementHash = Schema.String.check(Schema.isPattern(/^[0-9a-f]{64}$/));
+/**
+* Who asks for a yes to a statement: a workflow's run, `passkey.run`'s, by the workflow and the
+* run; or a gate's check, `passkey.check`'s, by the check, the pull request's version it gates and
+* the check run its statement is over.
+*/
+const StatementAsker = Schema.Union([Schema.Struct({
+	kind: Schema.Literal("workflow"),
+	workflow: WorkflowName,
+	run: WorkflowRunId
+}), Schema.Struct({
+	kind: Schema.Literal("gate"),
+	check: CheckKey,
+	pullRequest: PullRequestNumber,
+	version: VersionNumber,
+	run: CheckRunId
+})]);
+/**
+* A passkey request, as the person reads it before they answer: the statement, its words as its
+* asker wrote them and each value it quotes, and its hash; who asks; where, a workflow's
+* `owner/repo` or a thread's `owner/project#number`, or a gate's pull request, `owner/repo#number`;
+* whom it asks, the run's accountable person, or for a gate the person behind its run, a person by
+* name, or a permission's holders; and until when.
+*/
+const StatementView = Schema.Struct({
+	approval: ApprovalId,
+	statement: WorkflowText,
+	hash: StatementHash,
+	asker: StatementAsker,
+	home: Schema.String,
+	from: Schema.Union([Schema.Literals(["accountable", "person"]), Schema.Struct({ permission: RepoPermissionName })]),
+	askedAt: Timestamp,
+	expiresAt: Timestamp
+});
+/**
+* The person's own requests, waiting for them; the passkey requests workflows' runs and gates asked
+* them; each machine's request this browser session is the answerer of, so a reload finds it
+* again without its code; and the gates' decisions that wait on their yes or no, in every project
+* they see, oldest first.
+*/
+const ApprovalsWaiting = Schema.Struct({
+	approvals: Schema.Array(ApprovalView),
+	statements: Schema.Array(StatementView),
+	requests: Schema.Array(AttachmentRequestView),
+	decisions: Schema.Array(NamedDecision)
+});
+/** Finding a terminal's request by the code it showed. */
+const FindApproval = Schema.Union([Schema.Struct({ code: TypedApprovalCode }), Schema.Struct({ link: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{22}$/)) })]);
+/**
+* Asking for the passkey's options to answer a request: a terminal's request needs its code
+* again, so its ID alone, which travels where its code doesn't, never answers it. A machine's
+* request needs its answerer, and the agent it chooses to connect, before a yes has options.
+*/
+const ApprovalOptionsRequest = Schema.Struct({
+	code: Schema.optionalKey(TypedApprovalCode),
+	folders: Schema.optionalKey(ConnectFolderChoices)
+});
+/**
+* An answer: yes, with the passkey, or no. For an agent's ask, each answer can set the owner's
+* permission its own way, so a pairing that can't happen can't be sent: yes, and let agents do
+* it without asking; no, and stop agents asking, with the passkey too.
+*/
+const AnswerApproval = Schema.Union([
+	Schema.Struct({
+		answer: Schema.Literal("yes"),
+		permission: Schema.optionalKey(Schema.Literal("allow")),
+		assertion: PasskeyAsserted,
+		code: Schema.optionalKey(TypedApprovalCode),
+		/** The preview the page drew, where the command's endpoint names one. */
+		preview: Schema.optionalKey(PreviewEcho),
+		/** The statement the page showed, by its hash, for a workflow run's or a gate's passkey request. */
+		statement: Schema.optionalKey(Schema.Struct({ hash: StatementHash }))
+	}),
+	Schema.Struct({
+		answer: Schema.Literal("no"),
+		permission: Schema.Literal("deny"),
+		assertion: PasskeyAsserted,
+		code: Schema.optionalKey(TypedApprovalCode)
+	}),
+	Schema.Struct({
+		answer: Schema.Literal("no"),
+		code: Schema.optionalKey(TypedApprovalCode)
+	})
+]);
+/**
+* What running an approved command came to: its status, and its endpoint's answer or refusal,
+* as JSON. ref0 reads it by the command's endpoint before anyone sees it, and whoever asked reads
+* it the same way, with `ranOf`: this schema is part of the API the endpoints' types come from,
+* so it can't be typed by them itself.
+*/
+const Ran = Schema.Struct({
+	status: Schema.Int,
+	result: Schema.Json
+});
+/**
+* A ran command whose answer its endpoint's schemas no longer read, such as one kept from
+* before they changed: it ran, and what it came to can't be said.
+*/
+var ResultUnreadable = class extends Schema.TaggedError()("ResultUnreadable", { nextStep: Schema.String }, { httpApiStatus: 500 }) {};
+/**
+* Where a request stands, for whoever asked: still waiting; approved, and running as soon as
+* ref0 can; refused; expired; or what it ran to, with the endpoint it ran, whose schemas read it.
+*/
+const ApprovalState = Schema.Union([
+	Schema.Struct({
+		state: Schema.Literal("waiting"),
+		expiresAt: Timestamp
+	}),
+	Schema.Struct({
+		state: Schema.Literal("approved"),
+		/** A machine's answering browser may forget its saved answer once the terminal kept it. */
+		collected: Schema.optionalKey(Schema.Literal(true))
+	}),
+	Schema.Struct({ state: Schema.Literal("refused") }),
+	Schema.Struct({ state: Schema.Literal("expired") }),
+	Schema.Struct({
+		state: Schema.Literal("ran"),
+		endpoint: CommandEndpoint,
+		...Ran.fields
+	})
+]);
+/** Only the answering browser receives a machine's answer code; state reads never carry it. */
+const ApprovalAnswer = Schema.Union([
+	Schema.Struct({
+		...ApprovalState.members[1].fields,
+		answerCode: ApprovalCode
+	}),
+	Schema.Struct({
+		...ApprovalState.members[4].fields,
+		answerCode: ApprovalCode
+	}),
+	ApprovalState
+]);
+/** A request that isn't there, or isn't the caller's to see, answers the same. */
+var ApprovalNotFound = class extends Schema.TaggedError()("ApprovalNotFound", { nextStep: Schema.String }, { httpApiStatus: 404 }) {};
+/** Too many asked, or too many codes typed, from here in the last hour. */
+var SlowDown = class extends Schema.TaggedError()("SlowDown", { nextStep: Schema.String }, { httpApiStatus: 429 }) {};
+/** A command's hash: the SHA-256 of its canonical JSON, as lowercase hex. */
+const CommandHash = Schema.String.check(Schema.isPattern(/^[0-9a-f]{64}$/));
+Schema.Struct({
+	approval: ApprovalId,
+	endpoint: CommandEndpoint,
+	/** The command's canonical JSON. */
+	command: Schema.String,
+	commandHash: CommandHash,
+	asker: ApprovalAsker,
+	/** The browser session the person answered in, for their log. */
+	credential: CredentialRef,
+	generation: Generation,
+	/** When the request expires, in epoch milliseconds. */
+	deadline: Schema.Int,
+	challenge: Schema.String,
+	/** A machine answer retries only from its answering session, with this key. */
+	answerKey: Schema.optionalKey(RequestId),
+	/** An agent's ask: the credential it asked with, checked again before the answer counts. */
+	asking: Schema.optionalKey(TokenId),
+	/** The kind of action the person, answering, let agents take without asking from now on. */
+	allow: Schema.optionalKey(ScopeAction)
+});
+Schema.Struct({
+	approval: ApprovalId,
+	action: ScopeAction,
+	credential: CredentialRef,
+	generation: Generation
+});
+Schema.Union([Schema.Struct({ denied: Schema.Literal(true) }), Schema.Struct({
+	denied: Schema.Literal(false),
+	reason: Schema.Literals(["generation moved", "not set up"])
+})]);
+Schema.Union([Schema.Struct({
+	admitted: Schema.Literal(true),
+	admittedAt: Schema.Int,
+	answerCode: Schema.optionalKey(ApprovalCode)
+}), Schema.Struct({
+	admitted: Schema.Literal(false),
+	reason: Schema.Literals([
+		"expired",
+		"generation moved",
+		"challenge used",
+		"not set up",
+		"asker gone"
+	])
+})]);
+Schema.Union([Schema.Struct({ found: Schema.Literal(false) }), Schema.Struct({
+	found: Schema.Literal(true),
+	endpoint: CommandEndpoint,
+	command: Schema.String,
+	commandHash: CommandHash,
+	generation: Generation,
+	generationNow: Generation,
+	/** The `approval.answered` its admission recorded in the person's log. */
+	answeredEvent: EventId,
+	/** Who asked, as that `approval.answered` says. */
+	asker: ApprovalAsker,
+	/** What running it came to, once it ran, as `KeptRan` keeps it. */
+	result: Schema.optionalKey(Schema.String)
+})]);
+/**
+* A `Ran` as it's kept, on its receipt and on its approval: its JSON, as text. The Owner DO
+* keeps it as it comes and runs no endpoint's schemas, so it's read only by its endpoint, with
+* `keptRan`, which refuses one they don't take.
 */
-const GateAnswerRoute = Schema.TaggedStruct("GateAnswerRoute", {
-	scope: ThreadScope,
-	decision: DecisionId,
-	repo: RepoId,
-	pullRequest: PullRequestNumber,
-	version: VersionNumber,
-	reason: Schema.optionalKey(TextId)
-});
-Schema.Union([
-	DecisionView,
-	GateAnswerRoute,
-	DecisionNotFound,
-	AnswerRefused,
-	PlanTextRefused,
-	ProjectNotReady,
-	ProjectNotFound,
-	DeliveryOutsideWindow
-]);
-Schema.Struct({
-	...commandFields,
-	project: ProjectId,
-	decision: DecisionId,
-	pullRequest: PullRequestNumber,
-	version: VersionNumber,
-	answer: AnswerKey,
-	reason: Schema.optionalKey(TextId),
-	admin: Schema.Boolean
-});
-Schema.Union([
-	Schema.Struct({
-		outcome: Schema.Literal("answered"),
-		deciders: Schema.Array(DeciderRef)
-	}),
-	Schema.Struct({ outcome: Schema.Literals([
-		"decision closed",
-		"not a decider",
-		"already answered",
-		"not an answer"
-	]) }),
-	DeliveryOutsideWindow
-]);
+const KeptRan = Schema.fromJsonString(Ran);
 Schema.Struct({
-	decider: DeciderRef,
-	roles: Schema.optionalKey(Schema.Array(Schema.Struct({
-		role: Schema.Literal("admin"),
-		owner: OwnerId
-	})))
+	approval: ApprovalId,
+	result: Schema.String
 });
-const WaitingPage = Schema.Struct({ decisions: Schema.Array(DecisionView) });
+Schema.Struct({ result: Schema.String });
+Schema.Struct({ approval: ApprovalId });
+Schema.Struct({ approval: ApprovalId });
+Schema.Union([Schema.Struct({ expired: Schema.Literal(true) }), Schema.Struct({ expired: Schema.Literal(false) })]);
 Schema.Struct({
-	ownerName: OwnerName,
-	number: ThreadNumber
+	person: PersonId,
+	approval: ApprovalId
 });
-const PlanVersionPage = Schema.Struct({ versions: Schema.Array(PlanVersionView) });
-Schema.Union([PlanVersionPage, ThreadNotFound]);
-/** One decision of the project's, by its ID. */
-/** At most how long a read of a decision waits for it to close, in seconds. */
-const DecisionWait = Schema.Int.check(Schema.isBetween({
-	minimum: 1,
-	maximum: 60
-}));
+//#endregion
+//#region ../contracts/src/browser-sessions.ts
+/**
+* A browser session's cookie: Better Auth's, named for ref0, `Secure` and host-only on the
+* app's one origin. It holds the session's token, signed; the directory and the person's Owner DO hold
+* only the token's SHA-256.
+*/
+const browserSessionCookie = "__Secure-ref0.session_token";
 Schema.Struct({
-	ownerName: OwnerName,
-	decision: DecisionId,
-	wait: Schema.optionalKey(DecisionWait)
+	token: TokenId,
+	secretHash: SecretHash,
+	expiresAt: Schema.DateTimeUtcFromMillis
 });
-Schema.Union([DecisionView, DecisionNotFound]);
+Schema.Struct({ registered: Schema.Boolean });
 /**
-* `POST …/plans`: a version, as a draft unless it's proposed at once, and why it was written.
-* A first version needs no reason, and a later one may leave it out.
+* Where a signed-in person stands: naming, when the name their GitHub login gave was taken or
+* kept back, with that login as a suggestion; setting up, once their owner is made and before
+* it's ready with this session registered, which naming again finishes; or ready.
 */
-const WritePlanRequest = Schema.Struct({
-	plan: PlanInput,
-	reason: Schema.optionalKey(Reason),
-	propose: Schema.optionalKey(Schema.Boolean)
-});
-/** `POST …/decisions/{decision}/answers`: one of its answers, and why, in words. */
-const AnswerRequest = Schema.Struct({
-	answer: AnswerKey,
-	reason: Schema.optionalKey(PlanText)
-});
-Schema.Struct({
-	thread: ThreadId,
+const Welcome = Schema.Union([Schema.Struct({
+	state: Schema.Literals(["ready", "setting up"]),
+	person: PersonId,
 	owner: OwnerId,
-	parent: ThreadId,
-	parentScope: ProjectId,
-	parentNumber: ThreadNumber,
-	fromPlan: Schema.Struct({
-		version: PlanVersion,
-		entry: PlanEntryKey
-	}),
-	title: Title,
-	outcome: Outcome,
-	required: Schema.Boolean,
-	actor: ActorRef,
-	cause: EventRef
-});
-/** The child as it stands, whether this call started it or an earlier one did. */
-const RemoteChildStarted = Schema.Struct({
-	number: ThreadNumber,
-	stage: ThreadStage,
-	stageRevision: StageRevision
-});
-Schema.Union([RemoteChildStarted, ProjectNotReady]);
-Schema.Struct({
-	thread: ThreadId,
-	number: ThreadNumber
-});
-/** A child's stage and its revision, as one read found them. */
-const ChildStageView = Schema.Struct({
-	stage: ThreadStage,
-	stageRevision: StageRevision
+	name: OwnerName
+}), Schema.Struct({
+	state: Schema.Literal("naming"),
+	person: PersonId,
+	suggestion: Schema.optionalKey(Schema.String)
+})]);
+/**
+* A browser session renewed: its expiry, in its person's Owner DO and in the directory, and on its cookie.
+* Renewed at most once a day, so one asked sooner answers its expiry unchanged.
+*/
+const SessionRenewed = Schema.Struct({ expiresAt: Schema.DateTimeUtcFromMillis });
+/**
+* What starting a GitHub sign-in at `POST /auth/sign-in/social` answers: GitHub's address to go
+* to, with the sign-in's state in a cookie set alongside. Better Auth's answer, which ref0 serves.
+*/
+const NavigationUrl = Schema.String.check(Schema.isPattern(/^https?:\/\/[^\s/]+(?:\/[^\s]*)?$/), Schema.makeFilter((url) => URL.canParse(url) || "an HTTP(S) URL the platform can parse")).pipe(Schema.brand("NavigationUrl"));
+const SignInStarted = Schema.Struct({ url: NavigationUrl });
+/**
+* Where signing in sends the browser back to, as `POST /auth/sign-in/social` takes it: a path on
+* ref0's own origin, such as `/welcome`, or a whole URL. Never a socket's.
+*/
+const SignInDestination = Schema.String.pipe(Schema.brand("SignInDestination"));
+/**
+* What `POST /auth/sign-in/social` takes to start signing in with GitHub: where the browser
+* lands coming back, and where it lands when signing in failed. Better Auth's body, which ref0
+* serves.
+*/
+const StartSignIn = Schema.Struct({
+	provider: Schema.Literal("github"),
+	callbackURL: SignInDestination,
+	errorCallbackURL: SignInDestination
 });
-Schema.Union([ChildStageView, ThreadNotFound]);
+/** The name a naming person chose for their owner. */
+const NameOwner = Schema.Struct({ name: OwnerName });
 //#endregion
 //#region ../contracts/src/ask-calls.ts
 /**
@@ -10268,10 +10311,21 @@ signInRoute("POST", "/oauth2/consent");
 */
 const oauthDiscoveryPaths = ["/.well-known/oauth-protected-resource/mcp", `${oauthRoutes.metadata.pathUnderBase}${signInBase}`];
 /**
+* Where an outside service finds identity tokens' issuer and its public keys, each at the
+* origin's root: the issuer's discovery document, and its JWKS. Only these two: every other path
+* under `/.well-known/` is a page's.
+*/
+const identityDiscoveryRoutes = {
+	configuration: "/.well-known/openid-configuration",
+	keys: "/.well-known/jwks.json"
+};
+/** Whether a path is one of identity tokens' two published documents. */
+const isIdentityDiscoveryPath = (pathname) => pathname === identityDiscoveryRoutes.configuration || pathname === identityDiscoveryRoutes.keys;
+/**
 * Whether a path is Worker "server"'s to answer, not a page's: the API's, signing in's, a
-* connection's webhook, or OAuth's metadata.
+* connection's webhook, OAuth's metadata, or identity tokens' published documents.
 */
-const isRef0Path = (pathname) => isSignInPath(pathname) || isHooksPath(pathname) || pathname === "/v1" || pathname.startsWith(`/v1/`) || oauthDiscoveryPaths.includes(pathname);
+const isRef0Path = (pathname) => isSignInPath(pathname) || isHooksPath(pathname) || pathname === "/v1" || pathname.startsWith(`/v1/`) || oauthDiscoveryPaths.includes(pathname) || isIdentityDiscoveryPath(pathname);
 //#endregion
 //#region ../contracts/src/live-calls.ts
 /**
@@ -11584,6 +11638,151 @@ Schema.Struct({
 		name: RepoName
 	}))
 });
+/** Where an agent's session asks for an identity token. */
+const identityTokenPath = "/v1/me/identity-token";
+/** One DNS label, or one part of an IPv4 address: letters, digits and inner hyphens. */
+const label = "[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?";
+/** `https://`, a host name, then maybe `:` and a port with no leading zero. */
+const audiencePattern = new RegExp(`^https://(${label}(?:\\.${label})*)(?::([1-9][0-9]{0,4}))?$`);
+/**
+* Whether the platform's URL parser reads the audience as written: an `https` URL whose host is
+* the audience's own, lowercased, and whose port is its own, or none for 443. That refuses a host
+* the parser rewrites, such as `https://1.2.3` read as `1.2.0.3`, and a port past 65535.
+*/
+const parsesAsWritten = (audience) => {
+	const parts = audiencePattern.exec(audience);
+	if (parts === null || !URL.canParse(audience)) return false;
+	const url = new URL(audience);
+	const port = parts[2] ?? "";
+	return url.protocol === "https:" && url.hostname === (parts[1] ?? "").toLowerCase() && url.port === (port === "443" ? "" : port);
+};
+/**
+* Who an identity token is for: an outside service's HTTPS origin, in ASCII, at most 255 bytes,
+* with no credentials, path, query, fragment, wildcard or space. It's kept exactly as asked, its
+* case and any port too, so `https://verifier.example:443` is another audience than
+* `https://verifier.example`. ref0 never fetches or resolves it.
+*/
+const IdentityAudience = Schema.String.check(Schema.isMaxLength(255), Schema.isPattern(audiencePattern), Schema.makeFilter((audience) => parsesAsWritten(audience) || "an origin the platform reads as written")).pipe(Schema.brand("IdentityAudience"));
+/** `POST /v1/me/identity-token`'s body: the one audience, and nothing else. */
+const IdentityTokenRequest = Schema.Struct({ audience: IdentityAudience });
+/** A compact JWT: its header, payload and signature, each in base64url, at most 4 KiB. */
+const IdentityToken = Schema.String.check(Schema.isMaxLength(4096), Schema.isPattern(/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/)).pipe(Schema.brand("IdentityToken"));
+/** What asking for an identity token answers: the token, and when it expires, its `exp`. */
+const IssuedIdentityToken = Schema.Struct({
+	token: IdentityToken,
+	expiresAt: Schema.DateTimeUtcFromMillis
+});
+/**
+* An identity token's `jti`: a fresh UUIDv4 from the platform's cryptographic source for each
+* token, naming its issuance in ref0's log without naming any row or secret.
+*/
+const IdentityTokenId = Schema.String.check(Schema.isPattern(/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/)).pipe(Schema.brand("IdentityTokenId"));
+/**
+* A person, as one audience knows them: `pperson_`, then the first 128 bits of an HMAC of the
+* person's ref0 ID for the token's issuer and audience, as a TypeID suffix. Stable at one
+* audience, different at every other, and carrying no time.
+*/
+const PairwisePersonId = TypeId("pperson").pipe(Schema.brand("PairwisePersonId"));
+/** A session, as one audience knows it, made as a person's is. */
+const PairwiseSessionId = TypeId("psession").pipe(Schema.brand("PairwiseSessionId"));
+/** The accountable person, last in a token's chain: only their pairwise ID. */
+const PersonActor = Schema.Struct({ sub: PairwisePersonId });
+/** A session in a token's chain, then whoever it acts for: its parent session, or the person. */
+const sessionActing = (act) => Schema.Struct({
+	sub: PairwiseSessionId,
+	act
+});
+const oneSession = sessionActing(PersonActor);
+const twoSessions = sessionActing(oneSession);
+const threeSessions = sessionActing(twoSessions);
+/**
+* A token's `act`, as RFC 8693 nests it: the current session, then up to three parent sessions,
+* then the accountable person, each by its pairwise ID. It's history, not authority: a verifier
+* allows the agent in `sub`, never an actor.
+*/
+const IdentityActor = Schema.Union([
+	oneSession,
+	twoSessions,
+	threeSessions,
+	sessionActing(threeSessions)
+]);
+/** A time in a token, in whole UTC epoch seconds. */
+const EpochSeconds = Schema.Int.check(Schema.isGreaterThan(0));
+Schema.Struct({
+	iss: ApiOrigin,
+	sub: AgentId,
+	aud: IdentityAudience,
+	iat: EpochSeconds,
+	exp: EpochSeconds,
+	jti: IdentityTokenId,
+	act: IdentityActor
+}).check(Schema.makeFilter(({ iat, exp }) => exp > iat && exp - iat <= 600 || `an expiry after its issue, at most 600 seconds later`));
+/**
+* A signing key's ID, its `kid`: the key's RFC 7638 thumbprint, SHA-256 in base64url, so one ID
+* never names two keys.
+*/
+const SigningKeyId = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)).pipe(Schema.brand("SigningKeyId"));
+Schema.Struct({
+	alg: Schema.Literal("ES256"),
+	kid: SigningKeyId,
+	typ: Schema.Literal("JWT")
+});
+/** A P-256 coordinate: 32 bytes in base64url, unpadded, in its one canonical spelling. */
+const Coordinate = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/));
+/** One public key in the JWKS: exactly these fields, and never a private one. */
+const PublicSigningKey = Schema.Struct({
+	kty: Schema.Literal("EC"),
+	crv: Schema.Literal("P-256"),
+	x: Coordinate,
+	y: Coordinate,
+	use: Schema.Literal("sig"),
+	alg: Schema.Literal("ES256"),
+	kid: SigningKeyId
+});
+Schema.Struct({ keys: Schema.Array(PublicSigningKey).check(Schema.isMaxLength(3)) });
+Schema.Struct({
+	issuer: ApiOrigin,
+	jwks_uri: Schema.String,
+	subject_types_supported: Schema.Tuple([Schema.Literal("public")]),
+	id_token_signing_alg_values_supported: Schema.Tuple([Schema.Literal("ES256")]),
+	claims_supported: Schema.Tuple([
+		Schema.Literal("iss"),
+		Schema.Literal("sub"),
+		Schema.Literal("aud"),
+		Schema.Literal("exp"),
+		Schema.Literal("iat"),
+		Schema.Literal("jti"),
+		Schema.Literal("act")
+	])
+});
+/**
+* The audience isn't one ref0 signs for: missing, given twice, or not an HTTPS origin as
+* `IdentityAudience` says. The refused text is never echoed.
+*/
+var IdentityAudienceRefused = class extends Schema.TaggedError()("IdentityAudienceRefused", { nextStep: Schema.String }, { httpApiStatus: 400 }) {};
+/**
+* Less than a whole second is left before the session, a parent or the credential expires, or
+* the token would expire before it's recorded: the next prompt renews or replaces the session.
+*/
+var IdentityTokenNotReady = class extends Schema.TaggedError()("IdentityTokenNotReady", { nextStep: Schema.String }, { httpApiStatus: 409 }) {};
+/**
+* ref0 signed an identity token for one of a project's sessions: in that project's log, on the
+* session's thread, with ref0's own IDs for the session, its agent and its accountable person,
+* and the token's `jti`, never the token. It proves ref0 made the token, not that any service
+* received or used it. A failed append discards the token, so every token has its event.
+*/
+const IdentityTokenIssued = eventKind("identity_token.issued", Schema.Struct({
+	session: SessionId,
+	agent: AgentRef,
+	/** The person whose attachment authorized the session's chain, last in the token's `act`. */
+	accountable: PersonId,
+	jti: IdentityTokenId,
+	audience: IdentityAudience,
+	issuer: ApiOrigin,
+	keyId: SigningKeyId,
+	issuedAt: Schema.DateTimeUtcFromMillis,
+	expiresAt: Schema.DateTimeUtcFromMillis
+}));
 Schema.Literals([
 	"info/refs",
 	"git-upload-pack",
@@ -11834,6 +12033,71 @@ const GateAddition = Schema.Struct({
 	from: NeedFrom
 });
 /**
+* A yes that met a need: its decider's, given by the person `by` when one gave it, such as an
+* admin answering as the owner's admins; or, `overridden`, a check ref0 said no to, met by the
+* yes of each of its overrides.
+*/
+const NeedYes = Schema.Struct({
+	decider: DeciderRef,
+	by: Schema.optionalKey(PersonId),
+	overridden: Schema.optionalKey(Schema.Literal(true))
+});
+/**
+* An override left of a check ref0 said no to: of a part's failed run, or of the check not running,
+* and who answers it.
+*/
+const OverrideLeft = Schema.Struct({
+	of: Schema.Literals(["failed run", "not run"]),
+	by: OverrideAnswerer
+});
+/**
+* A decider a need waits on. For a check ref0 said no to, `overrides` lists each of its overrides
+* left, every one of whose yeses meets it in a pass's place, none when it has none: one yes to a
+* gate answers every decider its person may answer as, each override among them.
+*/
+const NeedWait = Schema.Struct({
+	decider: DeciderRef,
+	overrides: Schema.optionalKey(Schema.Array(OverrideLeft).check(Schema.isMaxLength(maxGateDeciders)))
+});
+/**
+* How one of a version's needs stands under its gate's answers now, as the gate is decided from
+* them: `met` by each yes in `by`; `met` with nothing to wait for, `as` `no checks`, for `checks`
+* when none of the repo's checks runs on the change, or `on the tip`, for a check only the merge
+* queue's tip runs, which judges it before `main` moves; `waiting` on each decider in `on`, when
+* `all`, or else on a yes from any one of them; `waiting` for ref0 to read which of `main`'s
+* checks run on the change; or `refused` by a person's no to one of its deciders, or to an
+* override of one, which decides the whole gate no.
+*/
+const NeedStanding = Schema.Union([
+	Schema.Struct({
+		state: Schema.Literal("met"),
+		by: Schema.Array(NeedYes).check(Schema.isMaxLength(maxGateDeciders))
+	}),
+	Schema.Struct({
+		state: Schema.Literal("met"),
+		as: Schema.Literals(["no checks", "on the tip"])
+	}),
+	Schema.Struct({
+		state: Schema.Literal("waiting"),
+		on: Schema.Array(NeedWait).check(Schema.isMaxLength(maxGateDeciders)),
+		all: Schema.Boolean
+	}),
+	Schema.Struct({
+		state: Schema.Literal("waiting"),
+		for: Schema.Literal("checks read")
+	}),
+	Schema.Struct({
+		state: Schema.Literal("refused"),
+		decider: DeciderRef,
+		by: PersonId
+	})
+]);
+/** A version's need, with every place it came from, and how it stands once its gate is open. */
+const GateNeedView = Schema.Struct({
+	...GateNeed.fields,
+	standing: Schema.optionalKey(NeedStanding)
+});
+/**
 * The version's gate decided again in place under `main`'s `.ref0/` now (Q7c): on which `main`
 * and under its tree, `pending` until `main`'s gate answers, then `held` or `grew`; the needs
 * it answered, joined to ref0's floor, absent while pending; what `main`'s gate read of the
@@ -11935,8 +12199,21 @@ const GateView = Schema.Struct({
 	state: GateState,
 	/** Why the gate failed; null otherwise. */
 	why: Schema.NullOr(Schema.String),
-	/** None while pending; once answered, the floor's too, sorted as they're spelled. */
-	needs: Schema.Array(GateNeed),
+	/**
+	* None while pending; once answered, the floor's too, sorted as they're spelled, each with how
+	* it stands once the version's gate is open.
+	*/
+	needs: Schema.Array(GateNeedView),
+	/** The repo's owner, whose admins answer its admins' needs: at home, its person alone. */
+	owner: OwnerId,
+	/**
+	* The names of the owner and of the people its needs' standings name, where the directory has
+	* them.
+	*/
+	names: Schema.optionalKey(Schema.Array(Schema.Struct({
+		owner: OwnerId,
+		name: OwnerName
+	})).check(Schema.isMaxLength(maxGateDeciders + 1))),
 	/** What the gate read of the change's trees, each read once, in order; none while pending. */
 	reads: GateReads,
 	/** The project gate revision the version was decided under; none for 0. */
@@ -14074,6 +14351,7 @@ const KnownEvent = Schema.Union([
 	ThreadListingChanged,
 	SessionStarted,
 	SessionEnded,
+	IdentityTokenIssued,
 	MemberRoleChanged,
 	MemberRemoved,
 	InvitationSent,
@@ -14917,6 +15195,11 @@ var ApprovalSecret = class extends HttpApiMiddleware.Service()("ref0/contracts/A
 * what to change. Any other part that fails its contract is answered with Effect's empty 400.
 */
 var MachineNameRefusal = class extends HttpApiMiddleware.Service()("ref0/contracts/MachineNameRefusal", { error: CommandRefused }) {};
+/**
+* An identity token's request whose audience its contract refuses, missing or not an HTTPS
+* origin, answered as `IdentityAudienceRefused`, which never echoes what was sent.
+*/
+var IdentityAudienceRefusal = class extends HttpApiMiddleware.Service()("ref0/contracts/IdentityAudienceRefusal", { error: IdentityAudienceRefused }) {};
 const idempotency = { "idempotency-key": RequestId };
 const inProject = {
 	owner: OwnerRef,
@@ -15139,7 +15422,18 @@ var MeGroup = class extends HttpApiGroup.make("me").add(HttpApiEndpoint.get("get
 		UsageRangeRefused,
 		AuthorityUnavailable
 	]
-})).middleware(Authorization) {};
+}), HttpApiEndpoint.post("identityToken", identityTokenPath, {
+	payload: IdentityTokenRequest,
+	success: IssuedIdentityToken,
+	error: [
+		IdentityAudienceRefused,
+		IdentityTokenNotReady,
+		NotPermitted,
+		SessionHasEnded,
+		SlowDown,
+		AuthorityUnavailable
+	]
+}).middleware(IdentityAudienceRefusal)).middleware(Authorization) {};
 /**
 * A thread's endpoints, as one of a project's threads and an org thread take them alike, by
 * where they are: `at` is a project's path parameters, or the owner's alone for its own scope.
@@ -16075,15 +16369,18 @@ const decisionEndpoints = (at) => {
 		HttpApiEndpoint.get("get", "/:decision", {
 			params: onDecision,
 			query: { wait: Schema.optionalKey(DecisionWait) },
-			success: DecisionView,
+			success: NamedDecision,
 			error: [...projectErrors, DecisionNotFound]
 		}),
 		HttpApiEndpoint.post("answer", "/:decision/answers", {
 			params: onDecision,
 			headers: idempotency,
 			payload: AnswerRequest,
-			success: DecisionView,
+			success: NamedDecision,
 			error: [
+				ApprovalNeeded,
+				CommandRefused,
+				SlowDown,
 				...projectErrors,
 				DecisionNotFound,
 				AnswerRefused,
@@ -16898,6 +17195,15 @@ const ownSurfaces = {
 		cli: "meters",
 		mcp: null
 	},
+	"me.identityToken": {
+		action: "session:change",
+		actors: "agent",
+		target: "session",
+		stepUp: "never",
+		asks: "never",
+		cli: "identity-token",
+		mcp: null
+	},
 	"threads.list": {
 		action: "project:read",
 		actors: "both",
@@ -18328,6 +18634,6 @@ const signOut = (origin) => Effect.gen(function* () {
 	yield* client.execute(HttpClientRequest.make(method)(path, { body: HttpBody.jsonUnsafe({}) }));
 });
 //#endregion
-export { AgentHandle, ApiOrigin, AttachmentFailed, AttachmentRequestView, ClientAccess, ClientGranted, ConnectionChanged, ConnectionKind, ConnectionName, ConsentProject, FoldersConnected, LiveTrackName, MachineConnected, OwnerName, OwnerTrackMessage, PasskeyAsserted, PasskeyCreated, PreviewUnavailable, ProjectName, ProjectTrackMessage, RepoName, RepoUrl, SecretHash, SentryOrg, SentryRegion, SentryToken, SignInDestination, ThreadId, ThreadStage, TypedApprovalCode, WorkflowPreview, WrittenProject, anonymousCredential, bearerCredential, browserCredential, commandLine, connectEndpoint, encodeSecret, fetchTransport, followApproval, hookTokenPrefix, hookUrl, isRef0Path, liveMessages, liveSocketUrl, newRequestId, projectParts, ref0Client, repoNameKey, settledOf, signOut, startGitHubSignIn, surfaceOf };
+export { AgentHandle, AnswerKey, ApiOrigin, AttachmentFailed, AttachmentRequestView, ClientAccess, ClientGranted, ConnectionChanged, ConnectionKind, ConnectionName, ConsentProject, FoldersConnected, LiveTrackName, MachineConnected, OwnerName, OwnerTrackMessage, PasskeyAsserted, PasskeyCreated, PreviewUnavailable, ProjectName, ProjectTrackMessage, RepoName, RepoUrl, SecretHash, SentryOrg, SentryRegion, SentryToken, SignInDestination, ThreadId, ThreadStage, TypedApprovalCode, WorkflowPreview, WrittenProject, anonymousCredential, bearerCredential, browserCredential, commandLine, connectEndpoint, encodeSecret, fetchTransport, followApproval, hookTokenPrefix, hookUrl, isRef0Path, liveMessages, liveSocketUrl, newRequestId, projectParts, ref0Client, repoNameKey, settledOf, signOut, startGitHubSignIn, surfaceOf, threadParts };
 
 //# sourceMappingURL=client.mjs.map