@ref0/sdk 0.12.0 → 0.13.0

package/dist/{browse-SaxCrclF.d.mts → browse-Dios11m0.d.mts}

@@ -1,4 +1,4 @@
-import { A as ConnectionCall, An as WorkflowPasskeyState, At as SandboxPushAnswer, Bn as WorkflowTrigger, Bt as StartActor$1, Cn as WorkflowEvent, Dn as WorkflowPasskeyAsked, Dt as SandboxOpen, En as WorkflowPasskeyAsk, Et as SandboxExecAnswer, In as WorkflowStartEnded, K as GetIssueInput, Ln as WorkflowStartState, Nn as WorkflowPullRequestAnswer, On as WorkflowPasskeyEnded, Ot as SandboxOpenAnswer, Pn as WorkflowPullRequestOpen, Qt as WorkflowActionAnswer, Rn as WorkflowText, Sn as WorkflowConnections, Tn as WorkflowOwn, Tt as SandboxExec, U as ForkAnswer$1, V as EventRunInput, Vt as StartRun$1, W as ForkCreate, Wt as ThreadStage, Zt as WorkflowAction, _ as CheckOn, _n as WorkflowCheckStartAnswer, an as WorkflowCallInput, b as CheckRunParams, bn as WorkflowCheckWhere, bt as Ref0Owned, cn as WorkflowCalledState, dn as WorkflowCheckRefused, fn as WorkflowCheckResults, gn as WorkflowCheckStart, hn as WorkflowCheckRunEnded, in as WorkflowCallEnded, j as ConnectionCallAnswer, jn as WorkflowPermissions, kn as WorkflowPasskeyRead, kt as SandboxPush, ln as WorkflowCalledStateAnswer, mn as WorkflowCheckRun, nn as WorkflowCall, on as WorkflowCallRefusal, pn as WorkflowCheckResultsAnswer, rn as WorkflowCallAnswer, sn as WorkflowCallRefused, tn as WorkflowAskClosed, un as WorkflowCheckRefusal, v as CheckOwn, vn as WorkflowCheckStates, wn as WorkflowFilters, x as CheckTreeEntry, xn as WorkflowComment, y as CheckRunError, yn as WorkflowCheckStatesAnswer, zn as WorkflowThreadStart } from "./index-BSPC_jQm.mjs";
+import { A as ConnectionCall, An as WorkflowOwn, At as SandboxExec, Cn as WorkflowCheckStates, Dn as WorkflowConnections, En as WorkflowComment, Fn as WorkflowPasskeyState, Ft as SandboxPushAnswer, Gn as WorkflowTrigger, Gt as StartActor$1, Hn as WorkflowStartState, In as WorkflowPermissions, K as GetIssueInput, Kt as StartRun$1, Mn as WorkflowPasskeyAsked, Mt as SandboxOpen, Nn as WorkflowPasskeyEnded, Nt as SandboxOpenAnswer, On as WorkflowEvent, Pn as WorkflowPasskeyRead, Pt as SandboxPush, Rn as WorkflowPullRequestAnswer, Sn as WorkflowCheckStartAnswer, Tn as WorkflowCheckWhere, Tt as Ref0Owned, U as ForkAnswer$1, Un as WorkflowText, V as EventRunInput, Vn as WorkflowStartEnded, W as ForkCreate, Wn as WorkflowThreadStart, Yt as ThreadStage, _ as CheckOn, _n as WorkflowCheckResults, b as CheckRunParams, bn as WorkflowCheckRunEnded, cn as WorkflowCallAnswer, dn as WorkflowCallRefusal, fn as WorkflowCallRefused, gn as WorkflowCheckRefused, hn as WorkflowCheckRefusal, j as ConnectionCallAnswer, jn as WorkflowPasskeyAsk, jt as SandboxExecAnswer, kn as WorkflowFilters, ln as WorkflowCallEnded, mn as WorkflowCalledStateAnswer, nn as WorkflowAction, on as WorkflowAskClosed, pn as WorkflowCalledState, rn as WorkflowActionAnswer, sn as WorkflowCall, un as WorkflowCallInput, v as CheckOwn, vn as WorkflowCheckResultsAnswer, wn as WorkflowCheckStatesAnswer, x as CheckTreeEntry, xn as WorkflowCheckStart, y as CheckRunError, yn as WorkflowCheckRun, zn as WorkflowPullRequestOpen } from "./index-DRFaIKvW.mjs";
 import { z } from "zod";
 //#region src/needs.d.ts
 /**
@@ -671,4 +671,4 @@ interface Browser {
 }
 //#endregion
 export { StartActor as $, ForkOptions as A, WorkflowContext as B, Comment as C, EventWorkflow as D, EventOf as E, StepConfig as F, CalledWorkflow as G, text as H, StepContext as I, TreeEntry as J, JsonValue as K, ThreadStart as L, PullRequestAnswer as M, PullRequestOptions as N, EventWorkflowSpec as O, Ref0Actions as P, Refusal as Q, WaitType as R, CheckRunEnded as S, Duration as T, workflow as U, WorkflowStep as V, CalledRunFailed as W, Allow as X, TreeRead as Y, CalledRun as Z, ActionAnswer as _, CheckRunOptions as a, allow as at, CalledContext as b, CheckRunResult as c, Need as ct, OneOfValues as d, StartContext as et, OutputResult as f, oneOf as g, check as h, CheckResult as i, StartRun as it, NeedAddOptions as j, ForkAnswer as k, CheckSpec as l, Step as m, Check as n, StartOutput as nt, CheckRunReference as o, refuse as ot, OutputSchema as p, Tree as q, CheckContext as r, StartRule as rt, CheckRunRefused as s, CheckNeed as st, Browser as t, StartItem as tt, DurationText as u, CallAnswer as v, ConnectionsOf as w, CalledWorkflowSpec as x, CallEnded as y, WaitedEvent as z };
-//# sourceMappingURL=browse-SaxCrclF.d.mts.map
+//# sourceMappingURL=browse-Dios11m0.d.mts.map

package/dist/browser.d.mts

@@ -1,4 +1,4 @@
-import { t as Browser } from "./browse-SaxCrclF.mjs";
+import { t as Browser } from "./browse-Dios11m0.mjs";
 import { BrowserContext, BrowserContext as BrowserContext$1, BrowserContextOptions, Locator, Page, Page as Page$1, Request, Response } from "@cloudflare/playwright";
 import { expect as expect$1 } from "@cloudflare/playwright/test";
 //#region src/browser-stub.d.ts

package/dist/client.d.mts

@@ -1,5 +1,5 @@
-import { $ as MirrorChoice, B as EndpointName, C as ClientGranted, Ct as RepoView, D as ConnectFolderOption, E as ConnectFolderChoices, F as ConnectionView, Ft as SentryRegion, Gn as hookTokenPrefix, Gt as TrackClosed, H as FoldersConnected, Hn as commandLine, Ht as StatementView, I as ConsentAsked, It as SentryToken, J as ImportFailure, Jn as liveSocketUrl, Jt as TypedApprovalCode, Kn as hookUrl, Kt as TrackSession, L as ConsentClient, Lt as SignInDestination, M as ConnectionChanged, Mn as WorkflowPreview, Mt as ScopeAction, N as ConnectionKind, Nt as SecretHash, O as ConnectOptions, P as ConnectionName, Pt as SentryOrg, Q as MachineConnected, Qn as threadParts, R as ConsentProject, Rt as SignedIn, S as ClientAccess, St as RepoUrl, T as ConnectChosen, Un as connectEndpoint, Ut as ThreadId, Vn as WrittenProject, Wn as encodeSecret, Wt as ThreadStage, X as LiveTicketRequest, Xn as repoNameKey, Xt as Welcome, Y as LiveTicket, Yn as projectParts, Z as LiveTrackName, Zn as surfaceOf, _t as ProjectTrackMessage, a as AnswerKey, at as OwnerThreadPage, c as ApprovalAnswer, ct as PasskeyAsserted, d as ApprovalState, et as MirrorEntry, f as ApprovalView, gt as ProjectName, h as Authorization, ht as PreviewUnavailable, i as AgentView, it as OwnerName, k as ConnectableAgent, l as ApprovalId, lt as PasskeyCreated, m as AttachmentRequestView, mt as PreviewEcho, n as AgentPermissionChoice, nt as NamedDecision, o as Api, ot as OwnerThreadView, p as AttachmentFailed, pt as PasskeyRequestOptions, q as Harness, qn as isRef0Path, qt as TrackThread, r as AgentPermissionSetting, rt as OwnerId, s as ApiOrigin, st as OwnerTrackMessage, t as AgentHandle, tt as MirrorView, u as ApprovalPreview, ut as PasskeyCreationOptions, vt as RanOf, w as ConnectAgent, wt as RequestFolder, xt as RepoName, yt as ReadEvent, z as CredentialView, zt as SocketUrl } from "./index-BSPC_jQm.mjs";
-import { Effect, Layer, Option, Redacted, Schema, Stream } from "effect";
+import { $ as LiveTicketRequest, $n as liveSocketUrl, $t as TypedApprovalCode, B as EndpointName, Bt as SentryRegion, C as ClientGranted, Ct as RanOf, D as ConnectFolderOption, Dt as RepoUrl, E as ConnectFolderChoices, Et as RepoName, F as ConnectionView, H as FoldersConnected, Ht as SignInDestination, I as ConsentAsked, J as ImportFailure, Jn as connectEndpoint, Jt as ThreadId, Kn as WrittenProject, L as ConsentClient, Ln as WorkflowPreview, Lt as ScopeAction, M as ConnectionChanged, N as ConnectionKind, O as ConnectOptions, Ot as RepoView, P as ConnectionName, Q as LiveTicket, Qn as isRef0Path, Qt as TrackThread, R as ConsentProject, Rt as SecretHash, S as ClientAccess, St as PublicJwk, T as ConnectChosen, Ut as SignedIn, Vt as SentryToken, Wt as SocketUrl, X as KeyProof, Xn as hookTokenPrefix, Xt as TrackClosed, Y as InvalidDpopProof, Yn as encodeSecret, Yt as ThreadStage, Z as KeyStoreUnavailable, Zn as hookUrl, Zt as TrackSession, _t as PreviewEcho, a as AnswerKey, at as NamedDecision, bt as ProjectTrackMessage, c as ApprovalAnswer, ct as OwnerThreadPage, d as ApprovalState, dt as PasskeyAsserted, er as projectParts, et as LiveTrackName, f as ApprovalView, ft as PasskeyCreated, gt as PasskeyRequestOptions, h as Authorization, i as AgentView, it as MirrorView, k as ConnectableAgent, kt as RequestFolder, l as ApprovalId, lt as OwnerThreadView, m as AttachmentRequestView, n as AgentPermissionChoice, nr as surfaceOf, nt as MirrorChoice, o as Api, ot as OwnerId, p as AttachmentFailed, pt as PasskeyCreationOptions, q as Harness, qn as commandLine, qt as StatementView, r as AgentPermissionSetting, rr as threadParts, rt as MirrorEntry, s as ApiOrigin, st as OwnerName, t as AgentHandle, tn as Welcome, tr as repoNameKey, tt as MachineConnected, u as ApprovalPreview, ut as OwnerTrackMessage, vt as PreviewUnavailable, w as ConnectAgent, wt as ReadEvent, xt as ProofOrigin, yt as ProjectName, z as CredentialView, zt as SentryOrg } from "./index-DRFaIKvW.mjs";
+import { Context, Effect, Layer, Option, Redacted, Ref, Schema, Stream } from "effect";
 import { HttpApi, HttpApiClient, HttpApiGroup, HttpApiMiddleware } from "effect/http-api";
 import { HttpBody, HttpClient } from "effect/http";
 //#region src/client/client.d.ts
@@ -13,11 +13,11 @@ type Ref0Client = HttpApiClient.ForApi<typeof Api>;
  */
 export declare const ref0Client: (origin?: ApiOrigin) => Effect.Effect<Ref0Client, never, HttpClient.HttpClient | HttpApiGroup.MiddlewareClient<ApiGroups>>;
 /** A bearer token: an agent's credential, sent with every request. */
-export declare const bearerCredential: (token: Redacted.Redacted<string>) => Layer.Layer<HttpApiMiddleware.ForClient<Authorization> | HttpApiMiddleware.ForClient<SignedIn>, never, never>;
+export declare const bearerCredential: (token: Redacted.Redacted<string>) => Layer.Layer<HttpApiMiddleware.ForClient<Authorization> | HttpApiMiddleware.ForClient<KeyProof> | HttpApiMiddleware.ForClient<SignedIn>, never, never>;
 /** A browser session: the browser sends its cookie on ref0's own origin, so nothing is added. */
-export declare const browserCredential: Layer.Layer<HttpApiMiddleware.ForClient<Authorization> | HttpApiMiddleware.ForClient<SignedIn>, never, never>;
+export declare const browserCredential: Layer.Layer<HttpApiMiddleware.ForClient<Authorization> | HttpApiMiddleware.ForClient<KeyProof> | HttpApiMiddleware.ForClient<SignedIn>, never, never>;
 /** No credential: a terminal asking its person, which sends nothing of theirs. */
-export declare const anonymousCredential: Layer.Layer<HttpApiMiddleware.ForClient<Authorization> | HttpApiMiddleware.ForClient<SignedIn>, never, never>;
+export declare const anonymousCredential: Layer.Layer<HttpApiMiddleware.ForClient<Authorization> | HttpApiMiddleware.ForClient<KeyProof> | HttpApiMiddleware.ForClient<SignedIn>, never, never>;
 /** The platform's `fetch`, for a client in a browser or a Worker. */
 export declare const fetchTransport: Layer.Layer<HttpClient.HttpClient, never, never>;
 //#endregion
@@ -65,6 +65,60 @@ export declare const followApproval: <Name extends EndpointName>(client: Ref0Cli
 /** What a socket opened at `url` hears, as `message` decodes it, ending when it closes. */
 export declare const liveMessages: <M>(url: SocketUrl, message: Schema.Codec<M, unknown>) => Stream.Stream<M>;
 //#endregion
+//#region src/client/proofs.d.ts
+/**
+ * A credential bound to a key, sent with a proof of possession on each attempt: RFC 9449's DPoP.
+ * The adapter builds each proof and knows nothing of where the key is kept; a key store signs.
+ */
+/**
+ * Where a key that signs proofs is kept, such as a machine's keychain, a file only its user can
+ * read, or hardware: the public half it signs for, and its signing, which answers ES256's
+ * signature as JOSE has it, `r` then `s`, 64 bytes. The signer never sees the key itself, and a
+ * store that takes its time, or asks a person, fits the same.
+ */
+interface KeyStore {
+  readonly publicKey: PublicJwk;
+  readonly sign: (bytes: Uint8Array) => Effect.Effect<Uint8Array, KeyStoreUnavailable>;
+}
+declare const ProofClock_base: Context.ServiceClass<ProofClock, "ref0/sdk/ProofClock", {
+  readonly offset: Ref.Ref<number>;
+}>;
+/**
+ * How far ref0's clock is ahead of this machine's, in milliseconds, as the `Date` of a refused
+ * proof's answer said: provided once for a process, so every proof it signs after is dated by it.
+ */
+export declare class ProofClock extends ProofClock_base {
+  static readonly layer: Layer.Layer<ProofClock, never, never>;
+}
+/**
+ * RFC 7638's thumbprint of a P-256 public key: the SHA-256 of its required members, in order, as
+ * JSON, in base64url. What a credential bound to the key names it by, as `cnf.jkt`.
+ */
+export declare const keyThumbprint: (jwk: PublicJwk) => Effect.Effect<string & import("effect/Brand").Brand<"KeyThumbprint">, never, never>;
+/** A key that signs proofs: ref0's origin, where its client sends requests, and its key's store. */
+interface ProofSigner {
+  readonly origin: ProofOrigin;
+  readonly store: KeyStore;
+}
+/** A credential bound to a key: its token, and the key that signs a proof for it. */
+interface BoundCredential extends ProofSigner {
+  readonly token: Redacted.Redacted<string>;
+}
+/**
+ * ref0's `/v1` as a typed client at a bound credential's origin, sending its token with a proof
+ * its key store signs for each attempt. The client is made at the origin its proofs name, so
+ * neither the token nor a proof is sent anywhere else. It needs the process's `ProofClock`. A
+ * request's trace redacts its proof, but an error it fails with still holds the request: a
+ * program that logs errors adds `dpop` to `Headers.CurrentRedactedNames` at its root.
+ */
+export declare const boundClient: (credential: BoundCredential) => Effect.Effect<Ref0Client, never, HttpClient.HttpClient | ProofClock>;
+/**
+ * ref0's `/v1` as a typed client at a key's origin, with no credential, signing each request that
+ * asks for a proof, such as a machine's ask to connect, with the key its store holds. It needs the
+ * process's `ProofClock`, and its errors still hold their requests, as `boundClient`'s do.
+ */
+export declare const provingClient: (signer: ProofSigner) => Effect.Effect<Ref0Client, never, HttpClient.HttpClient | ProofClock>;
+//#endregion
 //#region src/client/request-id.d.ts
 /**
  * A new delivery ID, for a request that changes something's `Idempotency-Key`: a UUIDv7 from the
@@ -90,5 +144,5 @@ export declare const startGitHubSignIn: (landing: {
  */
 export declare const signOut: (origin?: ApiOrigin) => Effect.Effect<void, import("effect/http/HttpClientError").HttpClientError, HttpClient.HttpClient>;
 //#endregion
-export { AgentHandle, type AgentPermissionChoice, type AgentPermissionSetting, type AgentView, AnswerKey, ApiOrigin, type ApprovalAnswer, type ApprovalId, type ApprovalPreview, type ApprovalState, type ApprovalView, AttachmentFailed, AttachmentRequestView, ClientAccess, ClientGranted, type ConnectAgent, type ConnectChosen, type ConnectFolderChoices, type ConnectFolderOption, type ConnectOptions, type ConnectableAgent, ConnectionChanged, ConnectionKind, ConnectionName, type ConnectionView, type ConsentAsked, type ConsentClient, ConsentProject, type CredentialView, FoldersConnected, type Harness, type ImportFailure, type LiveTicket, type LiveTicketRequest, LiveTrackName, MachineConnected, type MirrorChoice, type MirrorEntry, type MirrorView, type NamedDecision, type OwnerId, OwnerName, type OwnerThreadPage, type OwnerThreadView, OwnerTrackMessage, PasskeyAsserted, PasskeyCreated, type PasskeyCreationOptions, type PasskeyRequestOptions, type PreviewEcho, PreviewUnavailable, ProjectName, ProjectTrackMessage, type ReadEvent, type Ref0Client, RepoName, RepoUrl, type RepoView, type RequestFolder, type ScopeAction, SecretHash, SentryOrg, SentryRegion, SentryToken, type SettledApproval, SignInDestination, type StatementView, ThreadId, ThreadStage, type TrackClosed, type TrackSession, type TrackThread, TypedApprovalCode, type Welcome, WorkflowPreview, WrittenProject, commandLine, connectEndpoint, encodeSecret, hookTokenPrefix, hookUrl, isRef0Path, liveSocketUrl, projectParts, repoNameKey, surfaceOf, threadParts };
+export { AgentHandle, type AgentPermissionChoice, type AgentPermissionSetting, type AgentView, AnswerKey, ApiOrigin, type ApprovalAnswer, type ApprovalId, type ApprovalPreview, type ApprovalState, type ApprovalView, AttachmentFailed, AttachmentRequestView, type BoundCredential, ClientAccess, ClientGranted, type ConnectAgent, type ConnectChosen, type ConnectFolderChoices, type ConnectFolderOption, type ConnectOptions, type ConnectableAgent, ConnectionChanged, ConnectionKind, ConnectionName, type ConnectionView, type ConsentAsked, type ConsentClient, ConsentProject, type CredentialView, FoldersConnected, type Harness, type ImportFailure, InvalidDpopProof, type KeyStore, KeyStoreUnavailable, type LiveTicket, type LiveTicketRequest, LiveTrackName, MachineConnected, type MirrorChoice, type MirrorEntry, type MirrorView, type NamedDecision, type OwnerId, OwnerName, type OwnerThreadPage, type OwnerThreadView, OwnerTrackMessage, PasskeyAsserted, PasskeyCreated, type PasskeyCreationOptions, type PasskeyRequestOptions, type PreviewEcho, PreviewUnavailable, ProjectName, ProjectTrackMessage, ProofOrigin, type ProofSigner, PublicJwk, type ReadEvent, type Ref0Client, RepoName, RepoUrl, type RepoView, type RequestFolder, type ScopeAction, SecretHash, SentryOrg, SentryRegion, SentryToken, type SettledApproval, SignInDestination, type StatementView, ThreadId, ThreadStage, type TrackClosed, type TrackSession, type TrackThread, TypedApprovalCode, type Welcome, WorkflowPreview, WrittenProject, commandLine, connectEndpoint, encodeSecret, hookTokenPrefix, hookUrl, isRef0Path, liveSocketUrl, projectParts, repoNameKey, surfaceOf, threadParts };
 //# sourceMappingURL=client.d.mts.map