@ref0/sdk 0.12.0 → 0.13.0

package/dist/client.mjs

@@ -1,6 +1,7 @@
-import { Clock, Context, Cron, DateTime, Duration, Effect, Layer, Option, Predicate, Queue, Random, Result, Schema, SchemaIssue, SchemaTransformation, Stream, Struct, Tuple } from "effect";
+import { Clock, Context, Cron, DateTime, Duration, Effect, Layer, Option, Predicate, Queue, Random, Redacted, Ref, Result, Schema, SchemaIssue, SchemaTransformation, Stream, Struct, Tuple } from "effect";
 import { HttpApi, HttpApiClient, HttpApiEndpoint, HttpApiGroup, HttpApiMiddleware, HttpApiSchema, HttpApiSecurity } from "effect/http-api";
-import { FetchHttpClient, HttpBody, HttpClient, HttpClientRequest } from "effect/http";
+import { FetchHttpClient, Headers, HttpBody, HttpClient, HttpClientRequest } from "effect/http";
+import { Base64Url } from "effect/encoding";
 //#region ../contracts/src/typeid.ts
 /**
 * TypeIDs: a prefix, an underscore, then a UUID in 26 characters of Crockford's base32,
@@ -641,6 +642,402 @@ const AgentDetached = eventKind("agent.detached", Schema.Struct({
 	why: Schema.Literals(["revoked", "attach lost"])
 }));
 //#endregion
+//#region ../contracts/src/connections.ts
+/**
+* Connections and their signals. A connection links a project to one outside service, to receive
+* its signals: the service calls the connection's webhook, `/hooks/<connection>?token=<token>`,
+* and the project's Project DO records each signal in the project's log, by the connection. A
+* signal is short and structured, as every event is: what kind of thing happened and what it's
+* about, both IDs, and a title and a link, both text IDs. The raw payload is never kept.
+*/
+/** Where a connection's webhook is called, on ref0's one origin, beside `/v1`. */
+const hooksBase = "/hooks";
+/** Whether a path is under the webhooks'. */
+const isHooksPath = (pathname) => pathname.startsWith(`${hooksBase}/`);
+/**
+* A connection's name in its project, such as `sentry` or `deploys`: lowercase letters, digits
+* and hyphens, from a letter, as a mention names an outside service. `ref0` names ref0's own, so
+* no connection takes it. Two connections of a project are never named alike at once.
+*/
+const ConnectionName = Schema.String.check(Schema.isPattern(/^[a-z][a-z0-9-]{0,38}$/), Schema.makeFilter((name) => name !== "ref0" || "`ref0` names ref0’s own")).pipe(Schema.brand("ConnectionName"));
+/**
+* What reads a connection's deliveries: `webhook`, whose sender posts ref0's own shape, `{ kind,
+* key, title?, url? }`; or `sentry`, whose sender is Sentry, posting its issue and alert
+* webhooks, which its mapper reads. More kinds come one at a time, each with its mapper.
+*/
+const ConnectionKind = Schema.Literals(["webhook", "sentry"]);
+/** The most characters in a signal's link: a longer one is withheld. */
+const signalLinkLength = 2048;
+/**
+* An ID as a signal holds one: letters, digits and `:` `/` `.` `-` `_`, from a letter or a
+* digit, so it can't carry a space, a quote, an instruction or a command's option.
+*/
+const signalIdPattern = (length) => new RegExp(`^[A-Za-z0-9][A-Za-z0-9:/._-]{0,${length - 1}}$`);
+/** What happened, in the service's own word: `issue.created`, `deploy.finished`. */
+const SignalKind = Schema.String.check(Schema.isPattern(signalIdPattern(64))).pipe(Schema.brand("SignalKind"));
+/** What it's about, so a repeat can be recognised: an issue's ID, a release. */
+const SignalKey = Schema.String.check(Schema.isPattern(signalIdPattern(128))).pipe(Schema.brand("SignalKey"));
+/**
+* Why a signal's title or link wasn't kept: it looked like a secret; a link that isn't `https`;
+* or a link too long to keep whole.
+*/
+const SignalWithheldWhy = Schema.Literals([
+	"looks like a secret",
+	"not an https link",
+	"too long"
+]);
+/** A signal's title or link the connection gave, withheld, and why. */
+const SignalWithheld = Schema.Struct({
+	title: Schema.optionalKey(SignalWithheldWhy),
+	url: Schema.optionalKey(SignalWithheldWhy)
+});
+/**
+* A Sentry organization, by its slug as Sentry's URLs name it: lowercase letters, digits,
+* hyphens and underscores, from a letter or a digit.
+*/
+const SentryOrg = Schema.String.check(Schema.isPattern(/^[a-z0-9][a-z0-9_-]{0,49}$/)).pipe(Schema.brand("SentryOrg"));
+/** Where a Sentry organization's data lives, and so which of Sentry's API hosts answers for it. */
+const SentryRegion = Schema.Literals(["us", "de"]);
+/** A connection added to the project, by the admin whose approval added it. */
+const ConnectionAdded = eventKind("connection.added", Schema.Struct({
+	connection: ConnectionId,
+	name: ConnectionName,
+	kind: ConnectionKind
+}));
+/** A connection's token replaced, by the admin whose approval replaced it: the old one works no more. */
+const ConnectionRotated = eventKind("connection.rotated", Schema.Struct({ connection: ConnectionId }));
+/** A connection removed, by the admin whose approval removed it: its webhook takes nothing more. */
+const ConnectionRemoved = eventKind("connection.removed", Schema.Struct({ connection: ConnectionId }));
+/**
+* A `sentry` connection's credential set, by the admin whose approval set it: the Sentry
+* organization and region it reads, and that ref0 now holds a token for them, which only ref0's
+* server reads, to call Sentry for a workflow. Never the token, nor its hash. Setting it again
+* replaces the one before.
+*/
+const ConnectionCredentialSet = eventKind("connection.credential.set", Schema.Struct({
+	connection: ConnectionId,
+	org: SentryOrg,
+	region: SentryRegion
+}));
+/**
+* A signal, received by a connection: delivered to its webhook, by `ref0:hooks`, or sent with
+* `ref0 signal send` by the person or agent whose token sent it. `at` is when ref0 received it.
+* A title or link that failed its check is withheld, and says why in `withheld`; a title too long
+* is cut, and says so in `titleCut`. `dropped` counts the deliveries the connection dropped since
+* its last signal: over a bound, or refused. A delivery's ID, if the service gave one, is in the
+* envelope's `source` only as the SHA-256 of the connection and that ID.
+*/
+const SignalReceived = eventKind("signal.received", Schema.Struct({
+	connection: ConnectionId,
+	kind: SignalKind,
+	key: SignalKey,
+	title: Schema.optionalKey(TextId),
+	url: Schema.optionalKey(TextId),
+	withheld: Schema.optionalKey(SignalWithheld),
+	titleCut: Schema.optionalKey(Schema.Literal(true)),
+	dropped: Schema.optionalKey(Schema.Int.check(Schema.isGreaterThanOrEqualTo(1))),
+	at: Schema.DateTimeUtcFromMillis
+}));
+/**
+* ref0's one origin, as a client is given it: `http` or `https`, a host and maybe a port, and no
+* credentials, path, query or fragment. That pattern alone lets through a host or port no URL has,
+* such as `https://1.2.3.999`, `https://[1::2::3]` or `https://ref0.test:99999`, so the platform's own URL parser must take
+* it too. It's kept as written, case and any default port too: every path here is appended to it
+* as it is.
+*/
+const ApiOrigin = Schema.String.check(Schema.isPattern(/^https?:\/\/(?:\[[0-9A-Fa-f:.]+\]|[^\s/?#\\@:[\]]+)(?::\d+)?$/), Schema.makeFilter((origin) => URL.canParse(origin) || "a URL the platform can parse")).pipe(Schema.brand("ApiOrigin"));
+/** Where signing in's own routes live, which Better Auth serves, outside `Api`. */
+const signInBase = "/auth";
+/** Whether a path is signing in's. */
+const isSignInPath = (pathname) => pathname.startsWith(`${signInBase}/`);
+/**
+* A route under `signInBase`, by its method: its `path` from the origin's root, as a request
+* names it, and its `pathUnderBase`, as Better Auth names its endpoints.
+*/
+const signInRoute = (method, pathUnderBase) => ({
+	method,
+	pathUnderBase,
+	path: `${signInBase}${pathUnderBase}`
+});
+/** Signing in with GitHub, from ref0's pages: starting it, GitHub's way back, and signing out. */
+const signInRoutes = {
+	gitHubSignIn: signInRoute("POST", "/sign-in/social"),
+	gitHubCallback: signInRoute("GET", "/callback/github"),
+	signOut: signInRoute("POST", "/sign-out")
+};
+/**
+* The OAuth server outside MCP clients use (layer 4, PR 11a): its metadata, authorizing, the
+* token endpoint, registering a public client and revoking a token.
+*/
+const oauthRoutes = {
+	metadata: signInRoute("GET", "/.well-known/oauth-authorization-server"),
+	authorize: signInRoute("GET", "/oauth2/authorize"),
+	token: signInRoute("POST", "/oauth2/token"),
+	register: signInRoute("POST", "/oauth2/register"),
+	revoke: signInRoute("POST", "/oauth2/revoke")
+};
+signInRoute("POST", "/oauth2/consent");
+[...Object.values(signInRoutes), ...Object.values(oauthRoutes)];
+/**
+* Where an outside MCP client looks for `/mcp`'s OAuth (layer 4, PR 11a): RFC 9728's metadata
+* for the resource, and RFC 8414's for the server at `/auth`, each at the origin's root.
+*/
+const oauthDiscoveryPaths = ["/.well-known/oauth-protected-resource/mcp", `${oauthRoutes.metadata.pathUnderBase}${signInBase}`];
+/**
+* Where an outside service finds identity tokens' issuer and its public keys, each at the
+* origin's root: the issuer's discovery document, and its JWKS. Only these two: every other path
+* under `/.well-known/` is a page's.
+*/
+const identityDiscoveryRoutes = {
+	configuration: "/.well-known/openid-configuration",
+	keys: "/.well-known/jwks.json"
+};
+/** Whether a path is one of identity tokens' two published documents. */
+const isIdentityDiscoveryPath = (pathname) => pathname === identityDiscoveryRoutes.configuration || pathname === identityDiscoveryRoutes.keys;
+/**
+* Whether a path is Worker "server"'s to answer, not a page's: the API's, signing in's, a
+* connection's webhook, OAuth's metadata, or identity tokens' published documents.
+*/
+const isRef0Path = (pathname) => isSignInPath(pathname) || isHooksPath(pathname) || pathname === "/v1" || pathname.startsWith(`/v1/`) || oauthDiscoveryPaths.includes(pathname) || isIdentityDiscoveryPath(pathname);
+/** Where an agent's session asks for an identity token. */
+const identityTokenPath = "/v1/me/identity-token";
+/** One DNS label, or one part of an IPv4 address: letters, digits and inner hyphens. */
+const label = "[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?";
+/** `https://`, a host name, then maybe `:` and a port with no leading zero. */
+const audiencePattern = new RegExp(`^https://(${label}(?:\\.${label})*)(?::([1-9][0-9]{0,4}))?$`);
+/**
+* Whether the platform's URL parser reads the audience as written: an `https` URL whose host is
+* the audience's own, lowercased, and whose port is its own, or none for 443. That refuses a host
+* the parser rewrites, such as `https://1.2.3` read as `1.2.0.3`, and a port past 65535.
+*/
+const parsesAsWritten = (audience) => {
+	const parts = audiencePattern.exec(audience);
+	if (parts === null || !URL.canParse(audience)) return false;
+	const url = new URL(audience);
+	const port = parts[2] ?? "";
+	return url.protocol === "https:" && url.hostname === (parts[1] ?? "").toLowerCase() && url.port === (port === "443" ? "" : port);
+};
+/**
+* Who an identity token is for: an outside service's HTTPS origin, in ASCII, at most 255 bytes,
+* with no credentials, path, query, fragment, wildcard or space. It's kept exactly as asked, its
+* case and any port too, so `https://verifier.example:443` is another audience than
+* `https://verifier.example`. ref0 never fetches or resolves it.
+*/
+const IdentityAudience = Schema.String.check(Schema.isMaxLength(255), Schema.isPattern(audiencePattern), Schema.makeFilter((audience) => parsesAsWritten(audience) || "an origin the platform reads as written")).pipe(Schema.brand("IdentityAudience"));
+/** `POST /v1/me/identity-token`'s body: the one audience, and nothing else. */
+const IdentityTokenRequest = Schema.Struct({ audience: IdentityAudience });
+/** A compact JWT: its header, payload and signature, each in base64url, at most 4 KiB. */
+const IdentityToken = Schema.String.check(Schema.isMaxLength(4096), Schema.isPattern(/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/)).pipe(Schema.brand("IdentityToken"));
+/** What asking for an identity token answers: the token, and when it expires, its `exp`. */
+const IssuedIdentityToken = Schema.Struct({
+	token: IdentityToken,
+	expiresAt: Schema.DateTimeUtcFromMillis
+});
+/**
+* An identity token's `jti`: a fresh UUIDv4 from the platform's cryptographic source for each
+* token, naming its issuance in ref0's log without naming any row or secret.
+*/
+const IdentityTokenId = Schema.String.check(Schema.isPattern(/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/)).pipe(Schema.brand("IdentityTokenId"));
+/**
+* A person, as one audience knows them: `pperson_`, then the first 128 bits of an HMAC of the
+* person's ref0 ID for the token's issuer and audience, as a TypeID suffix. Stable at one
+* audience, different at every other, and carrying no time.
+*/
+const PairwisePersonId = TypeId("pperson").pipe(Schema.brand("PairwisePersonId"));
+/** A session, as one audience knows it, made as a person's is. */
+const PairwiseSessionId = TypeId("psession").pipe(Schema.brand("PairwiseSessionId"));
+/** The accountable person, last in a token's chain: only their pairwise ID. */
+const PersonActor = Schema.Struct({ sub: PairwisePersonId });
+/** A session in a token's chain, then whoever it acts for: its parent session, or the person. */
+const sessionActing = (act) => Schema.Struct({
+	sub: PairwiseSessionId,
+	act
+});
+const oneSession = sessionActing(PersonActor);
+const twoSessions = sessionActing(oneSession);
+const threeSessions = sessionActing(twoSessions);
+/**
+* A token's `act`, as RFC 8693 nests it: the current session, then up to three parent sessions,
+* then the accountable person, each by its pairwise ID. It's history, not authority: a verifier
+* allows the agent in `sub`, never an actor.
+*/
+const IdentityActor = Schema.Union([
+	oneSession,
+	twoSessions,
+	threeSessions,
+	sessionActing(threeSessions)
+]);
+/** A time in a token, in whole UTC epoch seconds. */
+const EpochSeconds = Schema.Int.check(Schema.isGreaterThan(0));
+Schema.Struct({
+	iss: ApiOrigin,
+	sub: AgentId,
+	aud: IdentityAudience,
+	iat: EpochSeconds,
+	exp: EpochSeconds,
+	jti: IdentityTokenId,
+	act: IdentityActor
+}).check(Schema.makeFilter(({ iat, exp }) => exp > iat && exp - iat <= 600 || `an expiry after its issue, at most 600 seconds later`));
+/**
+* A signing key's ID, its `kid`: the key's RFC 7638 thumbprint, SHA-256 in base64url, so one ID
+* never names two keys.
+*/
+const SigningKeyId = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)).pipe(Schema.brand("SigningKeyId"));
+Schema.Struct({
+	alg: Schema.Literal("ES256"),
+	kid: SigningKeyId,
+	typ: Schema.Literal("JWT")
+});
+/** A P-256 coordinate: 32 bytes in base64url, unpadded, in its one canonical spelling. */
+const Coordinate = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/));
+/** One public key in the JWKS: exactly these fields, and never a private one. */
+const PublicSigningKey = Schema.Struct({
+	kty: Schema.Literal("EC"),
+	crv: Schema.Literal("P-256"),
+	x: Coordinate,
+	y: Coordinate,
+	use: Schema.Literal("sig"),
+	alg: Schema.Literal("ES256"),
+	kid: SigningKeyId
+});
+Schema.Struct({ keys: Schema.Array(PublicSigningKey).check(Schema.isMaxLength(3)) });
+Schema.Struct({
+	issuer: ApiOrigin,
+	jwks_uri: Schema.String,
+	subject_types_supported: Schema.Tuple([Schema.Literal("public")]),
+	id_token_signing_alg_values_supported: Schema.Tuple([Schema.Literal("ES256")]),
+	claims_supported: Schema.Tuple([
+		Schema.Literal("iss"),
+		Schema.Literal("sub"),
+		Schema.Literal("aud"),
+		Schema.Literal("exp"),
+		Schema.Literal("iat"),
+		Schema.Literal("jti"),
+		Schema.Literal("act")
+	])
+});
+/**
+* The audience isn't one ref0 signs for: missing, given twice, or not an HTTPS origin as
+* `IdentityAudience` says. The refused text is never echoed.
+*/
+var IdentityAudienceRefused = class extends Schema.TaggedError()("IdentityAudienceRefused", { nextStep: Schema.String }, { httpApiStatus: 400 }) {};
+/**
+* Less than a whole second is left before the session, a parent or the credential expires, or
+* the token would expire before it's recorded: the next prompt renews or replaces the session.
+*/
+var IdentityTokenNotReady = class extends Schema.TaggedError()("IdentityTokenNotReady", { nextStep: Schema.String }, { httpApiStatus: 409 }) {};
+/**
+* ref0 signed an identity token for one of a project's sessions: in that project's log, on the
+* session's thread, with ref0's own IDs for the session, its agent and its accountable person,
+* and the token's `jti`, never the token. It proves ref0 made the token, not that any service
+* received or used it. A failed append discards the token, so every token has its event.
+*/
+const IdentityTokenIssued = eventKind("identity_token.issued", Schema.Struct({
+	session: SessionId,
+	agent: AgentRef,
+	/** The person whose attachment authorized the session's chain, last in the token's `act`. */
+	accountable: PersonId,
+	jti: IdentityTokenId,
+	audience: IdentityAudience,
+	issuer: ApiOrigin,
+	keyId: SigningKeyId,
+	issuedAt: Schema.DateTimeUtcFromMillis,
+	expiresAt: Schema.DateTimeUtcFromMillis
+}));
+//#endregion
+//#region ../contracts/src/proofs.ts
+/**
+* Proofs of possession: a credential bound to a key, and the proof that comes with each request
+* made with it, RFC 9449's DPoP. A bound credential, a host grant or a session's token, names its
+* key's thumbprint as `cnf`, which only ref0's own state says, never a caller. Each request sends
+* the token as `Authorization: DPoP <token>` and one `DPoP` header: a compact JWS, signed with
+* ES256 by that key, over the request's method and URL, when it was made, and the token's hash.
+* There's no server nonce and no replay store: a captured token and proof can be used again on
+* the same method and path while the proof's time is in the window, and a token alone can't.
+*/
+/** A P-256 key's RFC 7638 thumbprint: SHA-256 over its required members, in base64url. */
+const KeyThumbprint = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)).pipe(Schema.brand("KeyThumbprint"));
+/** The key a credential is bound to, by its thumbprint: RFC 7800's `cnf`, as `{ jkt }`. */
+const KeyBinding = Schema.Struct({ jkt: KeyThumbprint });
+/** Hosts ref0's origin may name over plain HTTP, for development on one machine. */
+const loopback = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]"
+]);
+/**
+* ref0's origin as a proof names it: HTTPS, or plain HTTP only on loopback, for development. A
+* client sends a proof, and ref0 takes one, for no other.
+*/
+const ProofOrigin = ApiOrigin.check(Schema.makeFilter((origin) => {
+	const url = URL.parse(origin);
+	return url?.protocol === "https:" || url?.protocol === "http:" && loopback.has(url.hostname) || "HTTPS, or HTTP on loopback";
+})).pipe(Schema.brand("ProofOrigin"));
+/** The most a proof takes, as its compact JWS, before anything else reads it. */
+const dpopProofMaxBytes = 2048;
+const utf8$1 = new TextEncoder();
+const encodeJson$2 = Schema.encodeSync(Schema.fromJsonString(Schema.Unknown));
+/**
+* An object with exactly `fields`, of at most `maxBytes` as JSON, whatever a decode's options
+* say: an exact `Struct` alone drops a member it doesn't know unless its decode is told to refuse
+* one, so the members are checked on the object as it came, before the struct reads them.
+*/
+const exactly = (fields, maxBytes) => {
+	const names = new Set(Object.keys(fields));
+	return Schema.Record(Schema.String, Schema.Unknown).check(Schema.makeFilter((members) => Object.keys(members).every((name) => names.has(name)) || `only ${[...names].join(", ")}`), Schema.makeFilter((members) => utf8$1.encode(encodeJson$2(members)).byteLength <= maxBytes || `at most ${maxBytes} bytes as JSON`)).pipe(Schema.decodeTo(Schema.Struct(fields), SchemaTransformation.passthroughSupertype()));
+};
+/**
+* A P-256 public key as a JWK: exactly `kty`, `crv`, `x` and `y`, so never a private part, a
+* key reference or another algorithm's key. Whether its point is on the curve is for Web Crypto
+* to say, when it imports it.
+*/
+const PublicJwk = exactly({
+	kty: Schema.Literal("EC"),
+	crv: Schema.Literal("P-256"),
+	x: PublicSigningKey.fields.x,
+	y: PublicSigningKey.fields.y
+}, 512);
+/** A proof's protected header: its type, ES256, and the public key that signed it. */
+const DpopProofHeader = exactly({
+	typ: Schema.Literal("dpop+jwt"),
+	alg: Schema.Literal("ES256"),
+	jwk: PublicJwk
+}, dpopProofMaxBytes);
+/** A proof's `jti`: a fresh UUIDv4 for each proof. Nothing keeps it to refuse a repeat. */
+const DpopProofId = Schema.String.check(Schema.isPattern(/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/)).pipe(Schema.brand("DpopProofId"));
+/**
+* A proof's claims: its ID; the request's method, and its URL with no query or fragment, as its
+* client sent it, after the URL was built; when it was made, in whole seconds; and, with a token,
+* `ath`, the SHA-256 of the whole token in base64url.
+*/
+const DpopProofClaims = exactly({
+	jti: DpopProofId,
+	htm: Schema.String.check(Schema.isPattern(/^[A-Z]{1,16}$/)),
+	htu: Schema.String.check(Schema.isMaxLength(dpopProofMaxBytes)),
+	iat: Schema.Int.check(Schema.isGreaterThan(0)),
+	ath: Schema.optionalKey(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)))
+}, dpopProofMaxBytes);
+/**
+* A bound credential came with a proof that's missing, malformed, stale, from another key, or
+* for another request, or came as a bearer token, or a proof came with no `DPoP` credential to
+* go with it. ref0 answers it before any handler runs, so nothing was done. A machine whose clock
+* is off signs again once, by the answer's `Date`. Also what a machine answers itself when the key
+* its credential is bound to is gone, without sending anything.
+*/
+var InvalidDpopProof = class extends Schema.TaggedError()("InvalidDpopProof", {
+	error: Schema.Literal("invalid_dpop_proof"),
+	nextStep: Schema.String
+}, { httpApiStatus: 401 }) {};
+new InvalidDpopProof({
+	error: "invalid_dpop_proof",
+	nextStep: "If this machine’s key was lost, run ref0 connect in your own terminal, then send the next prompt."
+});
+/**
+* The key store a request's proof is signed in didn't sign it: locked, unavailable or out of
+* time. Nothing was sent. A client's own, never an answer of ref0's.
+*/
+var KeyStoreUnavailable = class extends Schema.TaggedError()("KeyStoreUnavailable", { nextStep: Schema.String }) {};
+//#endregion
 //#region ../contracts/src/credential-events.ts
 /**
 * A person's credentials, in that person's own log. Never the token: only its ID, its kind
@@ -661,7 +1058,9 @@ const TokenDelegated = eventKind("token.delegated", Schema.Struct({
 	session: Schema.optionalKey(SessionId),
 	/** The credential this one was made under, when there is one. */
 	parent: Schema.optionalKey(CredentialRef),
-	expiresAt: Schema.optionalKey(Schema.DateTimeUtcFromMillis)
+	expiresAt: Schema.optionalKey(Schema.DateTimeUtcFromMillis),
+	/** The key it's bound to, by its thumbprint, for a host grant made with one. */
+	cnf: Schema.optionalKey(KeyBinding)
 }));
 const TokenRevoked = eventKind("token.revoked", Schema.Struct({
 	credential: CredentialRef,
@@ -976,6 +1375,11 @@ const CredentialFacts = Schema.Struct({
 		target: Schema.optionalKey(TargetGeneration)
 	}),
 	expiresAt: Schema.optionalKey(Schema.DateTimeUtcFromMillis),
+	/**
+	* The key it's bound to, for a host grant or a session's token made with one: every request
+	* with it must carry a proof that key signed. ref0's own state says it, never a caller.
+	*/
+	cnf: Schema.optionalKey(KeyBinding),
 	/** What it may do, and where. Rows a reader can't decode were left out: they grant nothing. */
 	scopes: Schema.Array(Scope),
 	/**
@@ -2680,103 +3084,6 @@ Schema.Struct({ intent: PublishIntentId });
 Schema.Struct({ intent: PublishIntentId });
 Schema.Union([PublishState, Schema.Struct({ none: Schema.Literal(true) })]);
 //#endregion
-//#region ../contracts/src/connections.ts
-/**
-* Connections and their signals. A connection links a project to one outside service, to receive
-* its signals: the service calls the connection's webhook, `/hooks/<connection>?token=<token>`,
-* and the project's Project DO records each signal in the project's log, by the connection. A
-* signal is short and structured, as every event is: what kind of thing happened and what it's
-* about, both IDs, and a title and a link, both text IDs. The raw payload is never kept.
-*/
-/** Where a connection's webhook is called, on ref0's one origin, beside `/v1`. */
-const hooksBase = "/hooks";
-/** Whether a path is under the webhooks'. */
-const isHooksPath = (pathname) => pathname.startsWith(`${hooksBase}/`);
-/**
-* A connection's name in its project, such as `sentry` or `deploys`: lowercase letters, digits
-* and hyphens, from a letter, as a mention names an outside service. `ref0` names ref0's own, so
-* no connection takes it. Two connections of a project are never named alike at once.
-*/
-const ConnectionName = Schema.String.check(Schema.isPattern(/^[a-z][a-z0-9-]{0,38}$/), Schema.makeFilter((name) => name !== "ref0" || "`ref0` names ref0’s own")).pipe(Schema.brand("ConnectionName"));
-/**
-* What reads a connection's deliveries: `webhook`, whose sender posts ref0's own shape, `{ kind,
-* key, title?, url? }`; or `sentry`, whose sender is Sentry, posting its issue and alert
-* webhooks, which its mapper reads. More kinds come one at a time, each with its mapper.
-*/
-const ConnectionKind = Schema.Literals(["webhook", "sentry"]);
-/** The most characters in a signal's link: a longer one is withheld. */
-const signalLinkLength = 2048;
-/**
-* An ID as a signal holds one: letters, digits and `:` `/` `.` `-` `_`, from a letter or a
-* digit, so it can't carry a space, a quote, an instruction or a command's option.
-*/
-const signalIdPattern = (length) => new RegExp(`^[A-Za-z0-9][A-Za-z0-9:/._-]{0,${length - 1}}$`);
-/** What happened, in the service's own word: `issue.created`, `deploy.finished`. */
-const SignalKind = Schema.String.check(Schema.isPattern(signalIdPattern(64))).pipe(Schema.brand("SignalKind"));
-/** What it's about, so a repeat can be recognised: an issue's ID, a release. */
-const SignalKey = Schema.String.check(Schema.isPattern(signalIdPattern(128))).pipe(Schema.brand("SignalKey"));
-/**
-* Why a signal's title or link wasn't kept: it looked like a secret; a link that isn't `https`;
-* or a link too long to keep whole.
-*/
-const SignalWithheldWhy = Schema.Literals([
-	"looks like a secret",
-	"not an https link",
-	"too long"
-]);
-/** A signal's title or link the connection gave, withheld, and why. */
-const SignalWithheld = Schema.Struct({
-	title: Schema.optionalKey(SignalWithheldWhy),
-	url: Schema.optionalKey(SignalWithheldWhy)
-});
-/**
-* A Sentry organization, by its slug as Sentry's URLs name it: lowercase letters, digits,
-* hyphens and underscores, from a letter or a digit.
-*/
-const SentryOrg = Schema.String.check(Schema.isPattern(/^[a-z0-9][a-z0-9_-]{0,49}$/)).pipe(Schema.brand("SentryOrg"));
-/** Where a Sentry organization's data lives, and so which of Sentry's API hosts answers for it. */
-const SentryRegion = Schema.Literals(["us", "de"]);
-/** A connection added to the project, by the admin whose approval added it. */
-const ConnectionAdded = eventKind("connection.added", Schema.Struct({
-	connection: ConnectionId,
-	name: ConnectionName,
-	kind: ConnectionKind
-}));
-/** A connection's token replaced, by the admin whose approval replaced it: the old one works no more. */
-const ConnectionRotated = eventKind("connection.rotated", Schema.Struct({ connection: ConnectionId }));
-/** A connection removed, by the admin whose approval removed it: its webhook takes nothing more. */
-const ConnectionRemoved = eventKind("connection.removed", Schema.Struct({ connection: ConnectionId }));
-/**
-* A `sentry` connection's credential set, by the admin whose approval set it: the Sentry
-* organization and region it reads, and that ref0 now holds a token for them, which only ref0's
-* server reads, to call Sentry for a workflow. Never the token, nor its hash. Setting it again
-* replaces the one before.
-*/
-const ConnectionCredentialSet = eventKind("connection.credential.set", Schema.Struct({
-	connection: ConnectionId,
-	org: SentryOrg,
-	region: SentryRegion
-}));
-/**
-* A signal, received by a connection: delivered to its webhook, by `ref0:hooks`, or sent with
-* `ref0 signal send` by the person or agent whose token sent it. `at` is when ref0 received it.
-* A title or link that failed its check is withheld, and says why in `withheld`; a title too long
-* is cut, and says so in `titleCut`. `dropped` counts the deliveries the connection dropped since
-* its last signal: over a bound, or refused. A delivery's ID, if the service gave one, is in the
-* envelope's `source` only as the SHA-256 of the connection and that ID.
-*/
-const SignalReceived = eventKind("signal.received", Schema.Struct({
-	connection: ConnectionId,
-	kind: SignalKind,
-	key: SignalKey,
-	title: Schema.optionalKey(TextId),
-	url: Schema.optionalKey(TextId),
-	withheld: Schema.optionalKey(SignalWithheld),
-	titleCut: Schema.optionalKey(Schema.Literal(true)),
-	dropped: Schema.optionalKey(Schema.Int.check(Schema.isGreaterThanOrEqualTo(1))),
-	at: Schema.DateTimeUtcFromMillis
-}));
-//#endregion
 //#region ../contracts/src/date-time.ts
 /** A UTC date decoded from a string and encoded in ISO format. */
 const Timestamp = Schema.DateTimeUtcFromString;
@@ -5308,8 +5615,26 @@ Schema.Union([
 	NotPermitted,
 	DeliveryOutsideWindow
 ]);
+/**
+* Where a session is, as a fork's URL names it: its owner, project, thread and numbers. With its
+* project's visibility, which a session's routes read who sees the project by.
+*/
+const SessionPlace = Schema.Struct({
+	owner: OwnerId,
+	project: ProjectId,
+	visibility: Visibility,
+	thread: ThreadId,
+	threadNumber: ThreadNumber,
+	session: SessionId,
+	number: SessionNumber,
+	/** Whether it's still going: not ended, and its lease not run out. */
+	live: Schema.Boolean
+});
 Schema.Struct({ session: SessionId });
-Schema.Struct({ live: Schema.Boolean });
+Schema.Union([Schema.Struct({
+	live: Schema.Literal(true),
+	place: SessionPlace
+}), Schema.Struct({ live: Schema.Literal(false) })]);
 Schema.Struct({
 	...commandFields,
 	project: ProjectId,
@@ -6297,8 +6622,8 @@ var ApprovalStale = class extends Schema.TaggedError()("ApprovalStale", { nextSt
 var PreviewNotReady = class extends Schema.TaggedError()("PreviewNotReady", { nextStep: Schema.String }, { httpApiStatus: 503 }) {};
 //#endregion
 //#region ../contracts/src/passkeys.ts
-const Base64Url = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]*$/));
-Schema.Struct({ challenge: Base64Url.check(Schema.isMinLength(1)) });
+const Base64Url$1 = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]*$/));
+Schema.Struct({ challenge: Base64Url$1.check(Schema.isMinLength(1)) });
 /** How a browser reaches a passkey's authenticator, as WebAuthn names it. */
 const PasskeyTransport = Schema.Literals([
 	"ble",
@@ -6310,7 +6635,7 @@ const PasskeyTransport = Schema.Literals([
 	"usb"
 ]);
 const CredentialDescriptor = Schema.Struct({
-	id: Base64Url,
+	id: Base64Url$1,
 	type: Schema.Literal("public-key"),
 	transports: Schema.optionalKey(Schema.Array(PasskeyTransport))
 });
@@ -6321,11 +6646,11 @@ const PasskeyCreationOptions = Schema.Struct({
 		name: Schema.String
 	}),
 	user: Schema.Struct({
-		id: Base64Url,
+		id: Base64Url$1,
 		name: Schema.String,
 		displayName: Schema.String
 	}),
-	challenge: Base64Url,
+	challenge: Base64Url$1,
 	pubKeyCredParams: Schema.Array(Schema.Struct({
 		type: Schema.Literal("public-key"),
 		alg: Schema.Int
@@ -6364,23 +6689,23 @@ const PasskeyCreationOptions = Schema.Struct({
 * as its WebAuthn library leaves it.
 */
 const PasskeyCreated = Schema.Struct({
-	id: Base64Url,
-	rawId: Base64Url,
+	id: Base64Url$1,
+	rawId: Base64Url$1,
 	type: Schema.Literal("public-key"),
 	response: Schema.Struct({
-		clientDataJSON: Base64Url,
-		attestationObject: Base64Url,
-		authenticatorData: Schema.optional(Base64Url),
+		clientDataJSON: Base64Url$1,
+		attestationObject: Base64Url$1,
+		authenticatorData: Schema.optional(Base64Url$1),
 		transports: Schema.optional(Schema.Array(PasskeyTransport)),
 		publicKeyAlgorithm: Schema.optional(Schema.Int),
-		publicKey: Schema.optional(Base64Url)
+		publicKey: Schema.optional(Base64Url$1)
 	}),
 	authenticatorAttachment: Schema.optional(Schema.Literals(["platform", "cross-platform"])),
 	clientExtensionResults: Schema.Struct({ credProps: Schema.optionalKey(Schema.Struct({ rk: Schema.optionalKey(Schema.Boolean) })) })
 });
 /** What ref0 hands a browser to answer with a passkey: WebAuthn's request options, as JSON. */
 const PasskeyRequestOptions = Schema.Struct({
-	challenge: Base64Url,
+	challenge: Base64Url$1,
 	timeout: Schema.optionalKey(Schema.Int),
 	rpId: Schema.optionalKey(Schema.String),
 	allowCredentials: Schema.optionalKey(Schema.Array(CredentialDescriptor)),
@@ -6400,14 +6725,14 @@ const PasskeyRequestOptions = Schema.Struct({
 * as JSON. A field the browser doesn't have may be missing, or there as `undefined`.
 */
 const PasskeyAsserted = Schema.Struct({
-	id: Base64Url,
-	rawId: Base64Url,
+	id: Base64Url$1,
+	rawId: Base64Url$1,
 	type: Schema.Literal("public-key"),
 	response: Schema.Struct({
-		clientDataJSON: Base64Url,
-		authenticatorData: Base64Url,
-		signature: Base64Url,
-		userHandle: Schema.optional(Base64Url)
+		clientDataJSON: Base64Url$1,
+		authenticatorData: Base64Url$1,
+		signature: Base64Url$1,
+		userHandle: Schema.optional(Base64Url$1)
 	}),
 	authenticatorAttachment: Schema.optional(Schema.Literals(["platform", "cross-platform"])),
 	clientExtensionResults: Schema.Struct({})
@@ -6459,10 +6784,15 @@ const RequestFolder = Schema.Struct({
 	secretHash: SecretHash,
 	replaces: Schema.optionalKey(TokenId)
 });
-/** One to eight config folders, each with its own grant secret. */
+/**
+* One to eight config folders, each with its own grant secret, and the machine key its grants are
+* bound to: its public half, which a proof that key signed comes with. A request without one makes
+* grants bound to no key, as an older ref0 asks, until binding is required.
+*/
 const RequestAttachment = Schema.Struct({
 	machine: MachineId,
 	machineName: MachineName,
+	publicKey: Schema.optionalKey(PublicJwk),
 	folders: Schema.Array(RequestFolder).check(Schema.isMinLength(1), Schema.isMaxLength(8), uniqueFolderPaths),
 	collectHash: SecretHash,
 	linkHash: SecretHash,
@@ -6576,12 +6906,15 @@ const RequestOrganization = Schema.Struct({
 /**
 * The result collected with the machine's two proofs: each included folder's identity and grant,
 * its agent's owner name and organizations, and excluded paths. Confirmation checks each saved
-* grant's live deadline in the Owner DO.
+* grant's live deadline in the Owner DO. Once a yes connected and the machine hasn't sent its
+* answer code, waiting says until when: `confirmBy`, when ref0 revokes each grant the machine
+* hasn't confirmed.
 */
 const RequestState = Schema.Union([
 	Schema.Struct({
 		state: Schema.Literal("waiting"),
-		expiresAt: Timestamp
+		expiresAt: Timestamp,
+		confirmBy: Schema.optionalKey(Timestamp)
 	}),
 	Schema.Struct({
 		state: Schema.Literal("connected"),
@@ -6655,6 +6988,7 @@ Schema.Struct({
 	request: ApprovalId,
 	machine: MachineId,
 	machineName: MachineName,
+	cnf: Schema.optionalKey(KeyBinding),
 	browserSession: TokenId,
 	personGeneration: Generation,
 	folders: Schema.Array(ConnectFolderCommand).check(Schema.isMinLength(1), Schema.isMaxLength(8), uniqueFolderPaths),
@@ -10215,117 +10549,56 @@ const GrantView = Schema.Struct({
 	role: GrantRole,
 	grantedBy: ActorRef,
 	grantedAt: Schema.DateTimeUtcFromMillis
-});
-/** A page of the grants a reader may see, in the order they were given, and where the next starts. */
-const GrantPage = Schema.Struct({
-	grants: Schema.Array(GrantView),
-	nextAfter: Schema.optionalKey(EventId)
-});
-Schema.Struct({
-	reader: PersonId,
-	after: Schema.optionalKey(EventId),
-	limit: PageLimit
-});
-/**
-* A grant as its Owner DO holds it: what it's on by the names it keeps, a thread by its scope and
-* number; who holds it, by ID, for the Worker to name.
-*/
-const GrantFound = Schema.Struct({
-	grant: EventId,
-	subject: Schema.Union([
-		Schema.Struct({ kind: Schema.Literal("owner") }),
-		Schema.Struct({
-			kind: Schema.Literal("project"),
-			project: ProjectName
-		}),
-		Schema.Struct({
-			kind: Schema.Literal("thread"),
-			scope: ThreadScope,
-			number: ThreadNumber
-		}),
-		Schema.Struct({
-			kind: Schema.Literal("agent"),
-			handle: AgentHandle
-		})
-	]),
-	principal: Principal,
-	role: GrantRole,
-	grantedBy: ActorRef,
-	grantedAt: Schema.DateTimeUtcFromMillis
-});
-Schema.Struct({
-	grants: Schema.Array(GrantFound),
-	nextAfter: Schema.optionalKey(EventId)
-});
-Schema.Struct({
-	project: ProjectId,
-	number: ThreadNumber
-});
-Schema.Union([Schema.Struct({
-	found: Schema.Literal(true),
-	thread: ThreadId
-}), Schema.Struct({ found: Schema.Literal(false) })]);
-/**
-* ref0's one origin, as a client is given it: `http` or `https`, a host and maybe a port, and no
-* credentials, path, query or fragment. That pattern alone lets through a host or port no URL has,
-* such as `https://1.2.3.999`, `https://[1::2::3]` or `https://ref0.test:99999`, so the platform's own URL parser must take
-* it too. It's kept as written, case and any default port too: every path here is appended to it
-* as it is.
-*/
-const ApiOrigin = Schema.String.check(Schema.isPattern(/^https?:\/\/(?:\[[0-9A-Fa-f:.]+\]|[^\s/?#\\@:[\]]+)(?::\d+)?$/), Schema.makeFilter((origin) => URL.canParse(origin) || "a URL the platform can parse")).pipe(Schema.brand("ApiOrigin"));
-/** Where signing in's own routes live, which Better Auth serves, outside `Api`. */
-const signInBase = "/auth";
-/** Whether a path is signing in's. */
-const isSignInPath = (pathname) => pathname.startsWith(`${signInBase}/`);
-/**
-* A route under `signInBase`, by its method: its `path` from the origin's root, as a request
-* names it, and its `pathUnderBase`, as Better Auth names its endpoints.
-*/
-const signInRoute = (method, pathUnderBase) => ({
-	method,
-	pathUnderBase,
-	path: `${signInBase}${pathUnderBase}`
-});
-/** Signing in with GitHub, from ref0's pages: starting it, GitHub's way back, and signing out. */
-const signInRoutes = {
-	gitHubSignIn: signInRoute("POST", "/sign-in/social"),
-	gitHubCallback: signInRoute("GET", "/callback/github"),
-	signOut: signInRoute("POST", "/sign-out")
-};
-/**
-* The OAuth server outside MCP clients use (layer 4, PR 11a): its metadata, authorizing, the
-* token endpoint, registering a public client and revoking a token.
-*/
-const oauthRoutes = {
-	metadata: signInRoute("GET", "/.well-known/oauth-authorization-server"),
-	authorize: signInRoute("GET", "/oauth2/authorize"),
-	token: signInRoute("POST", "/oauth2/token"),
-	register: signInRoute("POST", "/oauth2/register"),
-	revoke: signInRoute("POST", "/oauth2/revoke")
-};
-signInRoute("POST", "/oauth2/consent");
-[...Object.values(signInRoutes), ...Object.values(oauthRoutes)];
-/**
-* Where an outside MCP client looks for `/mcp`'s OAuth (layer 4, PR 11a): RFC 9728's metadata
-* for the resource, and RFC 8414's for the server at `/auth`, each at the origin's root.
-*/
-const oauthDiscoveryPaths = ["/.well-known/oauth-protected-resource/mcp", `${oauthRoutes.metadata.pathUnderBase}${signInBase}`];
-/**
-* Where an outside service finds identity tokens' issuer and its public keys, each at the
-* origin's root: the issuer's discovery document, and its JWKS. Only these two: every other path
-* under `/.well-known/` is a page's.
-*/
-const identityDiscoveryRoutes = {
-	configuration: "/.well-known/openid-configuration",
-	keys: "/.well-known/jwks.json"
-};
-/** Whether a path is one of identity tokens' two published documents. */
-const isIdentityDiscoveryPath = (pathname) => pathname === identityDiscoveryRoutes.configuration || pathname === identityDiscoveryRoutes.keys;
+});
+/** A page of the grants a reader may see, in the order they were given, and where the next starts. */
+const GrantPage = Schema.Struct({
+	grants: Schema.Array(GrantView),
+	nextAfter: Schema.optionalKey(EventId)
+});
+Schema.Struct({
+	reader: PersonId,
+	after: Schema.optionalKey(EventId),
+	limit: PageLimit
+});
 /**
-* Whether a path is Worker "server"'s to answer, not a page's: the API's, signing in's, a
-* connection's webhook, OAuth's metadata, or identity tokens' published documents.
+* A grant as its Owner DO holds it: what it's on by the names it keeps, a thread by its scope and
+* number; who holds it, by ID, for the Worker to name.
 */
-const isRef0Path = (pathname) => isSignInPath(pathname) || isHooksPath(pathname) || pathname === "/v1" || pathname.startsWith(`/v1/`) || oauthDiscoveryPaths.includes(pathname) || isIdentityDiscoveryPath(pathname);
+const GrantFound = Schema.Struct({
+	grant: EventId,
+	subject: Schema.Union([
+		Schema.Struct({ kind: Schema.Literal("owner") }),
+		Schema.Struct({
+			kind: Schema.Literal("project"),
+			project: ProjectName
+		}),
+		Schema.Struct({
+			kind: Schema.Literal("thread"),
+			scope: ThreadScope,
+			number: ThreadNumber
+		}),
+		Schema.Struct({
+			kind: Schema.Literal("agent"),
+			handle: AgentHandle
+		})
+	]),
+	principal: Principal,
+	role: GrantRole,
+	grantedBy: ActorRef,
+	grantedAt: Schema.DateTimeUtcFromMillis
+});
+Schema.Struct({
+	grants: Schema.Array(GrantFound),
+	nextAfter: Schema.optionalKey(EventId)
+});
+Schema.Struct({
+	project: ProjectId,
+	number: ThreadNumber
+});
+Schema.Union([Schema.Struct({
+	found: Schema.Literal(true),
+	thread: ThreadId
+}), Schema.Struct({ found: Schema.Literal(false) })]);
 //#endregion
 //#region ../contracts/src/live-calls.ts
 /**
@@ -10974,22 +11247,75 @@ const TurnTokens = Schema.Union([Schema.Struct({
 	known: Schema.Literal("read"),
 	models: Schema.Array(ModelTokens).check(Schema.isMaxLength(16), Schema.makeFilter((models) => new Set(models.map((each) => each.model)).size === models.length || "each model once"))
 }), Schema.Struct({ known: Schema.Literal("unknown") })]);
+const Name = Schema.String.check(Schema.isBetweenLength(1, 128));
+const Millis = Schema.Int.check(Schema.isGreaterThanOrEqualTo(0));
+/**
+* How long a turn's tool calls ran, summed, and its longest call, by tool: Claude Code's own
+* `duration_ms` for each, and, for Codex, whose hooks say none, from its `PreToolUse` to its
+* `PostToolUse` by `ref0 mcp`'s clock. Only calls that ended count: one with no end, as one a
+* `PreToolUse` answer denied or a Codex call cut short, isn't in it. `unknown`, never zero, when a
+* call that ended can't be timed, as one whose end says no time and whose start wasn't seen.
+*/
+const ToolTime = Schema.Union([Schema.Struct({
+	known: Schema.Literal("timed"),
+	totalMs: Millis,
+	/** None when the turn called no tool. */
+	longest: Schema.optionalKey(Schema.Struct({
+		tool: Name,
+		ms: Millis
+	}))
+}), Schema.Struct({ known: Schema.Literal("unknown") })]);
+/**
+* A compaction of the session's context during a turn: whether it was `auto` or `manual`, where
+* the harness says, as Claude Code does and Codex doesn't, and how long after ref0 started the
+* turn it happened, by the harness's own transcript, where both are known.
+*/
+const Compaction = Schema.Struct({
+	trigger: Schema.optionalKey(Schema.Literals(["auto", "manual"])),
+	afterMs: Schema.optionalKey(Millis)
+});
+/**
+* A turn's context, read from the session's own transcript as its tokens are: `peak`, the most
+* one request of the session's own sent, its cached tokens included, none for a turn with no
+* request, and each compaction. `unknown`, with neither, where the transcript wasn't read whole.
+* A subagent's context is its own, and isn't in it.
+*/
+const TurnContext = Schema.Union([Schema.Struct({
+	known: Schema.Literal("read"),
+	peak: Schema.optionalKey(TokenCount),
+	compactions: Schema.Array(Compaction).check(Schema.isMaxLength(100))
+}), Schema.Struct({ known: Schema.Literal("unknown") })]);
+/**
+* One of the harness's own subagents that a turn ran, such as Claude Code's Task agents or
+* Codex's: its type, where the harness names one, and its own tokens, which the turn's tokens
+* already include, so the turn's less its subagents' are the session's own. Its tokens, and the
+* turn's, are `unknown` when the harness kept no transcript of it. Not a child session: ref0
+* knows it only from its `SubagentStop` and its transcript.
+*/
+const TurnSubagent = Schema.Struct({
+	type: Schema.optionalKey(Name),
+	tokens: TurnTokens
+});
 /**
-* A turn's facts but its tokens, which `TurnFacts` adds for whoever sends them and `turn.ended`
-* carries only to those who may see them.
+* A turn's facts but its tokens and its subagents', which `TurnFacts` adds for whoever sends them
+* and `turn.ended` carries only to those who may see them.
 */
 const turnFactsFields = {
 	/** The turn's model, where the harness said it: Codex in every hook. */
-	model: Schema.optionalKey(Schema.String.check(Schema.isBetweenLength(1, 128))),
+	model: Schema.optionalKey(Name),
 	modelSource: ModelSource,
 	/** Tool calls by tool name. */
-	tools: Schema.Record(Schema.String.check(Schema.isBetweenLength(1, 128)), Schema.Int.check(Schema.isGreaterThanOrEqualTo(1))).check(Schema.makeFilter((tools) => Object.keys(tools).length <= 100 || "at most 100 tools")),
+	tools: Schema.Record(Name, Schema.Int.check(Schema.isGreaterThanOrEqualTo(1))).check(Schema.makeFilter((tools) => Object.keys(tools).length <= 100 || "at most 100 tools")),
 	/** The files its edits touched, by repo and path, at most 50; `more` counts the rest. */
 	addresses: Schema.Array(Schema.Struct({
 		repo: RepoName,
 		path: RepoPath
 	})).check(Schema.isMaxLength(50)),
-	more: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0))
+	more: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	toolTime: ToolTime,
+	context: TurnContext,
+	/** How many subagents past the first 100 the turn ran. */
+	moreSubagents: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0))
 };
 /**
 * What `ref0 mcp` saw of a turn, sent at its `Stop`s and when the next one starts, and again as
@@ -11001,16 +11327,23 @@ const turnFactsFields = {
 const TurnFacts = Schema.Struct({
 	...turnFactsFields,
 	tokens: TurnTokens,
-	stoppedAfterMs: Schema.optionalKey(Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)))
+	/** The turn's subagents, in the order their transcripts were first read, at most 100. */
+	subagents: Schema.Array(TurnSubagent).check(Schema.isMaxLength(100)),
+	stoppedAfterMs: Schema.optionalKey(Millis)
 });
 /**
-* A turn's facts as `turn.ended` shows them: its tokens only to an admin of the project's owner
-* and to the session's accountable person. A thread's totals still go to every reader of it, in
-* `ThreadUsage`, so on a thread with one person's sessions they are that person's usage.
+* A turn's facts as `turn.ended` shows them: its tokens and its subagents' only to an admin of
+* the project's owner and to the session's accountable person. A thread's totals still go to
+* every reader of it, in `ThreadUsage`, so on a thread with one person's sessions they are that
+* person's usage.
 */
 const EndedTurnFacts = Schema.Struct({
 	...turnFactsFields,
-	tokens: Schema.optionalKey(TurnTokens)
+	tokens: Schema.optionalKey(TurnTokens),
+	subagents: Schema.Array(Schema.Struct({
+		type: TurnSubagent.fields.type,
+		tokens: Schema.optionalKey(TurnTokens)
+	})).check(Schema.isMaxLength(100))
 });
 /**
 * `POST /v1/sessions/{session}/turns`: a new turn, for the harness's own turn ID, so a retry, or
@@ -11638,151 +11971,6 @@ Schema.Struct({
 		name: RepoName
 	}))
 });
-/** Where an agent's session asks for an identity token. */
-const identityTokenPath = "/v1/me/identity-token";
-/** One DNS label, or one part of an IPv4 address: letters, digits and inner hyphens. */
-const label = "[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?";
-/** `https://`, a host name, then maybe `:` and a port with no leading zero. */
-const audiencePattern = new RegExp(`^https://(${label}(?:\\.${label})*)(?::([1-9][0-9]{0,4}))?$`);
-/**
-* Whether the platform's URL parser reads the audience as written: an `https` URL whose host is
-* the audience's own, lowercased, and whose port is its own, or none for 443. That refuses a host
-* the parser rewrites, such as `https://1.2.3` read as `1.2.0.3`, and a port past 65535.
-*/
-const parsesAsWritten = (audience) => {
-	const parts = audiencePattern.exec(audience);
-	if (parts === null || !URL.canParse(audience)) return false;
-	const url = new URL(audience);
-	const port = parts[2] ?? "";
-	return url.protocol === "https:" && url.hostname === (parts[1] ?? "").toLowerCase() && url.port === (port === "443" ? "" : port);
-};
-/**
-* Who an identity token is for: an outside service's HTTPS origin, in ASCII, at most 255 bytes,
-* with no credentials, path, query, fragment, wildcard or space. It's kept exactly as asked, its
-* case and any port too, so `https://verifier.example:443` is another audience than
-* `https://verifier.example`. ref0 never fetches or resolves it.
-*/
-const IdentityAudience = Schema.String.check(Schema.isMaxLength(255), Schema.isPattern(audiencePattern), Schema.makeFilter((audience) => parsesAsWritten(audience) || "an origin the platform reads as written")).pipe(Schema.brand("IdentityAudience"));
-/** `POST /v1/me/identity-token`'s body: the one audience, and nothing else. */
-const IdentityTokenRequest = Schema.Struct({ audience: IdentityAudience });
-/** A compact JWT: its header, payload and signature, each in base64url, at most 4 KiB. */
-const IdentityToken = Schema.String.check(Schema.isMaxLength(4096), Schema.isPattern(/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/)).pipe(Schema.brand("IdentityToken"));
-/** What asking for an identity token answers: the token, and when it expires, its `exp`. */
-const IssuedIdentityToken = Schema.Struct({
-	token: IdentityToken,
-	expiresAt: Schema.DateTimeUtcFromMillis
-});
-/**
-* An identity token's `jti`: a fresh UUIDv4 from the platform's cryptographic source for each
-* token, naming its issuance in ref0's log without naming any row or secret.
-*/
-const IdentityTokenId = Schema.String.check(Schema.isPattern(/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/)).pipe(Schema.brand("IdentityTokenId"));
-/**
-* A person, as one audience knows them: `pperson_`, then the first 128 bits of an HMAC of the
-* person's ref0 ID for the token's issuer and audience, as a TypeID suffix. Stable at one
-* audience, different at every other, and carrying no time.
-*/
-const PairwisePersonId = TypeId("pperson").pipe(Schema.brand("PairwisePersonId"));
-/** A session, as one audience knows it, made as a person's is. */
-const PairwiseSessionId = TypeId("psession").pipe(Schema.brand("PairwiseSessionId"));
-/** The accountable person, last in a token's chain: only their pairwise ID. */
-const PersonActor = Schema.Struct({ sub: PairwisePersonId });
-/** A session in a token's chain, then whoever it acts for: its parent session, or the person. */
-const sessionActing = (act) => Schema.Struct({
-	sub: PairwiseSessionId,
-	act
-});
-const oneSession = sessionActing(PersonActor);
-const twoSessions = sessionActing(oneSession);
-const threeSessions = sessionActing(twoSessions);
-/**
-* A token's `act`, as RFC 8693 nests it: the current session, then up to three parent sessions,
-* then the accountable person, each by its pairwise ID. It's history, not authority: a verifier
-* allows the agent in `sub`, never an actor.
-*/
-const IdentityActor = Schema.Union([
-	oneSession,
-	twoSessions,
-	threeSessions,
-	sessionActing(threeSessions)
-]);
-/** A time in a token, in whole UTC epoch seconds. */
-const EpochSeconds = Schema.Int.check(Schema.isGreaterThan(0));
-Schema.Struct({
-	iss: ApiOrigin,
-	sub: AgentId,
-	aud: IdentityAudience,
-	iat: EpochSeconds,
-	exp: EpochSeconds,
-	jti: IdentityTokenId,
-	act: IdentityActor
-}).check(Schema.makeFilter(({ iat, exp }) => exp > iat && exp - iat <= 600 || `an expiry after its issue, at most 600 seconds later`));
-/**
-* A signing key's ID, its `kid`: the key's RFC 7638 thumbprint, SHA-256 in base64url, so one ID
-* never names two keys.
-*/
-const SigningKeyId = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)).pipe(Schema.brand("SigningKeyId"));
-Schema.Struct({
-	alg: Schema.Literal("ES256"),
-	kid: SigningKeyId,
-	typ: Schema.Literal("JWT")
-});
-/** A P-256 coordinate: 32 bytes in base64url, unpadded, in its one canonical spelling. */
-const Coordinate = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/));
-/** One public key in the JWKS: exactly these fields, and never a private one. */
-const PublicSigningKey = Schema.Struct({
-	kty: Schema.Literal("EC"),
-	crv: Schema.Literal("P-256"),
-	x: Coordinate,
-	y: Coordinate,
-	use: Schema.Literal("sig"),
-	alg: Schema.Literal("ES256"),
-	kid: SigningKeyId
-});
-Schema.Struct({ keys: Schema.Array(PublicSigningKey).check(Schema.isMaxLength(3)) });
-Schema.Struct({
-	issuer: ApiOrigin,
-	jwks_uri: Schema.String,
-	subject_types_supported: Schema.Tuple([Schema.Literal("public")]),
-	id_token_signing_alg_values_supported: Schema.Tuple([Schema.Literal("ES256")]),
-	claims_supported: Schema.Tuple([
-		Schema.Literal("iss"),
-		Schema.Literal("sub"),
-		Schema.Literal("aud"),
-		Schema.Literal("exp"),
-		Schema.Literal("iat"),
-		Schema.Literal("jti"),
-		Schema.Literal("act")
-	])
-});
-/**
-* The audience isn't one ref0 signs for: missing, given twice, or not an HTTPS origin as
-* `IdentityAudience` says. The refused text is never echoed.
-*/
-var IdentityAudienceRefused = class extends Schema.TaggedError()("IdentityAudienceRefused", { nextStep: Schema.String }, { httpApiStatus: 400 }) {};
-/**
-* Less than a whole second is left before the session, a parent or the credential expires, or
-* the token would expire before it's recorded: the next prompt renews or replaces the session.
-*/
-var IdentityTokenNotReady = class extends Schema.TaggedError()("IdentityTokenNotReady", { nextStep: Schema.String }, { httpApiStatus: 409 }) {};
-/**
-* ref0 signed an identity token for one of a project's sessions: in that project's log, on the
-* session's thread, with ref0's own IDs for the session, its agent and its accountable person,
-* and the token's `jti`, never the token. It proves ref0 made the token, not that any service
-* received or used it. A failed append discards the token, so every token has its event.
-*/
-const IdentityTokenIssued = eventKind("identity_token.issued", Schema.Struct({
-	session: SessionId,
-	agent: AgentRef,
-	/** The person whose attachment authorized the session's chain, last in the token's `act`. */
-	accountable: PersonId,
-	jti: IdentityTokenId,
-	audience: IdentityAudience,
-	issuer: ApiOrigin,
-	keyId: SigningKeyId,
-	issuedAt: Schema.DateTimeUtcFromMillis,
-	expiresAt: Schema.DateTimeUtcFromMillis
-}));
 Schema.Literals([
 	"info/refs",
 	"git-upload-pack",
@@ -11810,6 +11998,11 @@ Schema.Union([
 Schema.Struct({
 	reader: Reader,
 	name: RepoName,
+	/**
+	* For a fork's path, the scope it names: a project, by its ID or its name, or, with none, the
+	* owner's own scope, which holds an organization's org threads.
+	*/
+	scope: Schema.optionalKey(Schema.Struct({ project: Schema.optionalKey(ProjectRef) })),
 	push: Schema.optionalKey(Schema.Struct({
 		thread: ThreadId,
 		session: SessionId
@@ -11823,7 +12016,9 @@ const GitTarget = Schema.Struct({
 	* their sessions' forks, and the repo's `main`. Unset for one that reads the repo's project as
 	* a whole.
 	*/
-	threads: Schema.optionalKey(Schema.Array(ThreadId))
+	threads: Schema.optionalKey(Schema.Array(ThreadId)),
+	/** For a fork's path, the project its scope resolved to: a project's, or the owner's own. */
+	scope: Schema.optionalKey(ProjectId)
 });
 Schema.Union([GitTarget, RepoNotFound]);
 /** A repo whose baseline isn't readable yet: Git is told to try again in a few seconds. */
@@ -11834,28 +12029,6 @@ const CurrentBaseline = Schema.Struct({
 	name: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/))
 });
 Schema.Union([CurrentBaseline, RepoNotReady]);
-//#endregion
-//#region ../contracts/src/fork-calls.ts
-/**
-* A session's fork of a repo: its own copy, made in the background from the repo's current
-* baseline when the session first reaches the repo. Agents push only to their own session's
-* forks. A fork isn't deleted yet: when it may be, and what's saved first, waits for the user.
-*/
-/**
-* Where a session is, as a fork's URL names it: its owner, project, thread and numbers. With its
-* project's visibility, which a session's routes read who sees the project by.
-*/
-const SessionPlace = Schema.Struct({
-	owner: OwnerId,
-	project: ProjectId,
-	visibility: Visibility,
-	thread: ThreadId,
-	threadNumber: ThreadNumber,
-	session: SessionId,
-	number: SessionNumber,
-	/** Whether it's still going: not ended, and its lease not run out. */
-	live: Schema.Boolean
-});
 Schema.Struct({ session: SessionId });
 Schema.Union([SessionPlace, SessionNotFound]);
 Schema.Struct({
@@ -15154,17 +15327,21 @@ const browserSession = HttpApiSecurity.apiKey({
 	key: browserSessionCookie
 });
 /**
-* Every endpoint's credential, checked before its handler runs: a bearer token, or a browser
-* session's cookie. A request with both is refused before it gets here.
+* Every endpoint's credential, checked before its handler runs: a bearer token, a token bound to
+* a key with a proof that key signed (`Authorization: DPoP` and one `DPoP` header), or a browser
+* session's cookie. A request with a cookie and a token is refused before it gets here. A client
+* that signs proofs may fail before it sends anything, when its key store doesn't sign.
 */
 var Authorization = class extends HttpApiMiddleware.Service()("ref0/contracts/Authorization", {
 	requiredForClient: true,
 	security: {
 		bearer: HttpApiSecurity.bearer,
+		dpop: HttpApiSecurity.http({ scheme: "DPoP" }),
 		browserSession
 	},
 	error: [
 		Unauthenticated,
+		InvalidDpopProof,
 		SessionHasEnded,
 		AuthorityUnavailable
 	]
@@ -15195,6 +15372,18 @@ var ApprovalSecret = class extends HttpApiMiddleware.Service()("ref0/contracts/A
 * what to change. Any other part that fails its contract is answered with Effect's empty 400.
 */
 var MachineNameRefusal = class extends HttpApiMiddleware.Service()("ref0/contracts/MachineNameRefusal", { error: CommandRefused }) {};
+Context.Service()("ref0/contracts/ProvedKey");
+/**
+* A request with no credential, signed by a key it names, such as a machine's ask to connect: one
+* `DPoP` header, a proof with no `ath`, since there's no token, checked before the request is
+* read, which says the key that signed it; or no proof, which says none. Every client supplies
+* it, as it does `Authorization`, so its key store's failure, before anything is sent, is typed:
+* one with a key store signs, and every other sends no proof.
+*/
+var KeyProof = class extends HttpApiMiddleware.Service()("ref0/contracts/KeyProof", {
+	requiredForClient: true,
+	error: InvalidDpopProof
+}) {};
 /**
 * An identity token's request whose audience its contract refuses, missing or not an HTTPS
 * origin, answered as `IdentityAudienceRefused`, which never echoes what was sent.
@@ -15310,8 +15499,9 @@ var AttachmentsGroup = class extends HttpApiGroup.make("attachments").add(HttpAp
 })).middleware(Authorization) {};
 /**
 * Connecting a machine, the machine's side: asking, with no credential, to connect to one owner's
-* agent, whose terminal shows the code their person types; then collecting what came of it,
-* confirming it saved the grant, or aborting, with its collecting secret.
+* agent, whose terminal shows the code their person types, signed by the machine key it names;
+* then collecting what came of it, confirming it saved the grant, or aborting, with its collecting
+* secret, which needs no proof: a grant it collects is bound to the key its ask named.
 */
 var MachineAttachmentsGroup = class extends HttpApiGroup.make("machineAttachments").add(HttpApiEndpoint.post("request", "/v1/attachments/requests", {
 	headers: idempotency,
@@ -15321,9 +15511,10 @@ var MachineAttachmentsGroup = class extends HttpApiGroup.make("machineAttachment
 		NotPermitted,
 		CommandRefused,
 		SlowDown,
+		InvalidDpopProof,
 		AuthorityUnavailable
 	]
-}).middleware(MachineNameRefusal), HttpApiEndpoint.post("collect", "/v1/attachments/requests/:approval/result", {
+}).middleware(MachineNameRefusal).middleware(KeyProof), HttpApiEndpoint.post("collect", "/v1/attachments/requests/:approval/result", {
 	params: { approval: ApprovalId },
 	payload: Schema.Struct({ answerCode: Schema.optionalKey(Schema.String.check(Schema.isMaxLength(64))) }),
 	success: RequestState,
@@ -18557,10 +18748,12 @@ const followApproval = (client, approval, endpoint) => Effect.gen(function* () {
 * credential it sends, a bearer token or a browser session.
 */
 const ref0Client = (origin) => HttpApiClient.make(Api, origin === void 0 ? {} : { baseUrl: origin });
+/** No proof of a key for a request that asks for one: a client with no key store's. */
+const noKeyProof = HttpApiMiddleware.layerClient(KeyProof, ({ request, next }) => next(request));
 /** A bearer token: an agent's credential, sent with every request. */
-const bearerCredential = (token) => Layer.mergeAll(HttpApiMiddleware.layerClient(Authorization, ({ request, next }) => next(HttpClientRequest.bearerToken(request, token))), HttpApiMiddleware.layerClient(SignedIn, ({ request, next }) => next(request)));
+const bearerCredential = (token) => Layer.mergeAll(HttpApiMiddleware.layerClient(Authorization, ({ request, next }) => next(HttpClientRequest.bearerToken(request, token))), HttpApiMiddleware.layerClient(SignedIn, ({ request, next }) => next(request)), noKeyProof);
 /** A browser session: the browser sends its cookie on ref0's own origin, so nothing is added. */
-const browserCredential = Layer.mergeAll(HttpApiMiddleware.layerClient(Authorization, ({ request, next }) => next(request)), HttpApiMiddleware.layerClient(SignedIn, ({ request, next }) => next(request)));
+const browserCredential = Layer.mergeAll(HttpApiMiddleware.layerClient(Authorization, ({ request, next }) => next(request)), HttpApiMiddleware.layerClient(SignedIn, ({ request, next }) => next(request)), noKeyProof);
 /** No credential: a terminal asking its person, which sends nothing of theirs. */
 const anonymousCredential = browserCredential;
 /** The platform's `fetch`, for a client in a browser or a Worker. */
@@ -18587,6 +18780,121 @@ const liveMessages = (url, message) => {
 	}), (socket) => Effect.sync(() => socket.close())));
 };
 //#endregion
+//#region src/client/proofs.ts
+/**
+* How far ref0's clock is ahead of this machine's, in milliseconds, as the `Date` of a refused
+* proof's answer said: provided once for a process, so every proof it signs after is dated by it.
+*/
+var ProofClock = class ProofClock extends Context.Service()("ref0/sdk/ProofClock") {
+	static layer = Layer.effect(ProofClock, Effect.map(Ref.make(0), (offset) => ProofClock.of({ offset })));
+};
+/** How far apart the two clocks may be before a refused proof is signed again by ref0's. */
+const clockSkewMillis = 5e3;
+const encodeHeader = Schema.encodeSync(Schema.fromJsonString(DpopProofHeader));
+const encodeClaims = Schema.encodeSync(Schema.fromJsonString(DpopProofClaims));
+const decodeProofId = Schema.decodeSync(DpopProofId);
+const utf8 = new TextEncoder();
+/** A fresh UUIDv4 from the platform's cryptographic source, a proof's `jti`. */
+const freshProofId = Effect.sync(() => {
+	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16));
+	bytes[6] = 64 | (bytes[6] ?? 0) & 15;
+	bytes[8] = 128 | (bytes[8] ?? 0) & 63;
+	const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+	return decodeProofId(`${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`);
+});
+const decodeThumbprint = Schema.decodeSync(KeyThumbprint);
+/**
+* RFC 7638's thumbprint of a P-256 public key: the SHA-256 of its required members, in order, as
+* JSON, in base64url. What a credential bound to the key names it by, as `cnf.jkt`.
+*/
+const keyThumbprint = (jwk) => Effect.promise(async () => decodeThumbprint(Base64Url.encode(new Uint8Array(await crypto.subtle.digest("SHA-256", utf8.encode(`{"crv":"P-256","kty":"EC","x":"${jwk.x}","y":"${jwk.y}"}`))))));
+/** `ath`: the SHA-256 of the whole token, in base64url. */
+const tokenHashOf = (token) => Effect.promise(async () => Base64Url.encode(new Uint8Array(await crypto.subtle.digest("SHA-256", utf8.encode(token)))));
+/**
+* A proof for one attempt at a request: its method, and its URL as built, with no query or
+* fragment; dated by this machine's clock, moved by `offset`; with the token's hash, if it's sent
+* with one; signed by the store.
+*/
+const proofFor = Effect.fnUntraced(function* (store, attempt, offset) {
+	const now = (yield* Clock.currentTimeMillis) + offset;
+	const header = encodeHeader({
+		typ: "dpop+jwt",
+		alg: "ES256",
+		jwk: store.publicKey
+	});
+	const signs = {
+		jti: yield* freshProofId,
+		htm: attempt.method,
+		htu: `${attempt.url.origin}${attempt.url.pathname}`,
+		iat: Math.floor(now / 1e3)
+	};
+	if (attempt.token !== void 0) signs.ath = yield* tokenHashOf(attempt.token);
+	const claims = encodeClaims(signs);
+	const signed = `${Base64Url.encode(header)}.${Base64Url.encode(claims)}`;
+	const signature = yield* store.sign(utf8.encode(signed));
+	if (signature.byteLength !== 64) return yield* Effect.die("a key store answers r||s, 64 bytes");
+	return `${signed}.${Base64Url.encode(signature)}`;
+});
+/**
+* How far ref0's clock was from this machine's, moved by `offset`, by a refused proof's answer:
+* none for any other answer, or one without a `Date`.
+*/
+const skewOf = (response, local) => {
+	const challenge = response.headers["www-authenticate"] ?? "";
+	if (response.status !== 401 || !challenge.includes("DPoP error=\"invalid_dpop_proof\"")) return Option.none();
+	return Option.map(DateTime.make(response.headers["date"] ?? ""), (date) => DateTime.toEpochMillis(date) - local);
+};
+/**
+* Sends one request, with its credential if it has one, signing each attempt afresh: once, and
+* once more, by ref0's clock, after a refused proof whose answer is dated more than five seconds
+* from this machine's. The process keeps the offset for every proof after.
+*/
+const signedAttempts = (credential, offsetRef) => ({ request, next }) => Effect.gen(function* () {
+	const token = credential.token === void 0 ? void 0 : Redacted.value(credential.token);
+	const attempt = {
+		method: request.method,
+		url: new URL(`${credential.origin}${request.url}`),
+		token
+	};
+	const redacted = [...yield* Effect.service(Headers.CurrentRedactedNames), "dpop"];
+	const send = (offset) => proofFor(credential.store, attempt, offset).pipe(Effect.map((proof) => HttpClientRequest.setHeaders(request, token === void 0 ? { dpop: proof } : {
+		authorization: `DPoP ${token}`,
+		dpop: proof
+	})), Effect.flatMap(next), Effect.provideService(Headers.CurrentRedactedNames, redacted));
+	const offset = yield* Ref.get(offsetRef);
+	const answer = yield* send(offset);
+	const skew = skewOf(answer, (yield* Clock.currentTimeMillis) + offset);
+	if (Option.isNone(skew) || Math.abs(skew.value) <= clockSkewMillis) return answer;
+	yield* Effect.ignore(answer.text);
+	yield* Ref.set(offsetRef, offset + skew.value);
+	return yield* send(offset + skew.value);
+});
+/**
+* A token bound to a key, sent as `Authorization: DPoP` with a proof its key store signs afresh
+* for each attempt. Signing in's own endpoints take no token.
+*/
+const dpopCredential = (credential) => Layer.mergeAll(HttpApiMiddleware.layerClient(Authorization, Effect.map(Effect.service(ProofClock), (clock) => signedAttempts(credential, clock.offset))), HttpApiMiddleware.layerClient(SignedIn, ({ request, next }) => next(request)), noKeyProof);
+/**
+* ref0's `/v1` as a typed client at a bound credential's origin, sending its token with a proof
+* its key store signs for each attempt. The client is made at the origin its proofs name, so
+* neither the token nor a proof is sent anywhere else. It needs the process's `ProofClock`. A
+* request's trace redacts its proof, but an error it fails with still holds the request: a
+* program that logs errors adds `dpop` to `Headers.CurrentRedactedNames` at its root.
+*/
+const boundClient = (credential) => ref0Client(credential.origin).pipe(Effect.provide(dpopCredential(credential)));
+/**
+* A request with no credential, signed by the key it names, such as a machine's ask to connect:
+* a proof its key store signs for each attempt, with no `ath`, since there's no token. Any other
+* request is sent with nothing added.
+*/
+const keyProof = (signer) => Layer.mergeAll(HttpApiMiddleware.layerClient(KeyProof, Effect.map(Effect.service(ProofClock), (clock) => signedAttempts(signer, clock.offset))), HttpApiMiddleware.layerClient(Authorization, ({ request, next }) => next(request)), HttpApiMiddleware.layerClient(SignedIn, ({ request, next }) => next(request)));
+/**
+* ref0's `/v1` as a typed client at a key's origin, with no credential, signing each request that
+* asks for a proof, such as a machine's ask to connect, with the key its store holds. It needs the
+* process's `ProofClock`, and its errors still hold their requests, as `boundClient`'s do.
+*/
+const provingClient = (signer) => ref0Client(signer.origin).pipe(Effect.provide(keyProof(signer)));
+//#endregion
 //#region src/client/request-id.ts
 const decodeRequestId = Schema.decodeUnknownEffect(RequestId);
 /**
@@ -18634,6 +18942,6 @@ const signOut = (origin) => Effect.gen(function* () {
 	yield* client.execute(HttpClientRequest.make(method)(path, { body: HttpBody.jsonUnsafe({}) }));
 });
 //#endregion
-export { AgentHandle, AnswerKey, ApiOrigin, AttachmentFailed, AttachmentRequestView, ClientAccess, ClientGranted, ConnectionChanged, ConnectionKind, ConnectionName, ConsentProject, FoldersConnected, LiveTrackName, MachineConnected, OwnerName, OwnerTrackMessage, PasskeyAsserted, PasskeyCreated, PreviewUnavailable, ProjectName, ProjectTrackMessage, RepoName, RepoUrl, SecretHash, SentryOrg, SentryRegion, SentryToken, SignInDestination, ThreadId, ThreadStage, TypedApprovalCode, WorkflowPreview, WrittenProject, anonymousCredential, bearerCredential, browserCredential, commandLine, connectEndpoint, encodeSecret, fetchTransport, followApproval, hookTokenPrefix, hookUrl, isRef0Path, liveMessages, liveSocketUrl, newRequestId, projectParts, ref0Client, repoNameKey, settledOf, signOut, startGitHubSignIn, surfaceOf, threadParts };
+export { AgentHandle, AnswerKey, ApiOrigin, AttachmentFailed, AttachmentRequestView, ClientAccess, ClientGranted, ConnectionChanged, ConnectionKind, ConnectionName, ConsentProject, FoldersConnected, InvalidDpopProof, KeyStoreUnavailable, LiveTrackName, MachineConnected, OwnerName, OwnerTrackMessage, PasskeyAsserted, PasskeyCreated, PreviewUnavailable, ProjectName, ProjectTrackMessage, ProofClock, ProofOrigin, PublicJwk, RepoName, RepoUrl, SecretHash, SentryOrg, SentryRegion, SentryToken, SignInDestination, ThreadId, ThreadStage, TypedApprovalCode, WorkflowPreview, WrittenProject, anonymousCredential, bearerCredential, boundClient, browserCredential, commandLine, connectEndpoint, encodeSecret, fetchTransport, followApproval, hookTokenPrefix, hookUrl, isRef0Path, keyThumbprint, liveMessages, liveSocketUrl, newRequestId, projectParts, provingClient, ref0Client, repoNameKey, settledOf, signOut, startGitHubSignIn, surfaceOf, threadParts };
 
 //# sourceMappingURL=client.mjs.map