@ref0/sdk 0.5.0 → 0.7.0

package/README.md

@@ -181,7 +181,7 @@ export default workflow({
 
 `ask.run` is a step of its own. It waits for `{ key, by, via, at }`. At its deadline it returns the lean with `via: 'deadline'` and no `by`. It offers two to five answers, and a run uses each ask key once. A refused or withdrawn ask throws `AskRefused`.
 
-`passkey.run` is also a step of its own. Only the person in their approving browser can answer yes with their passkey. The result has `approved`, `at` and, when someone answered, `by`. A deadline answers no. `from` can also name `{ person: 'mo' }` or `{ permission: 'deploy' }`, with `person` or `permission` in `permissions.ask`. Agents have no passkey.
+`passkey.run` is also a step of its own. Only the person in their approving browser can answer yes with their passkey. The result has `approved`, `at` and, when someone answered, `by`. A deadline answers no. `from` can also name someone else, `{ person: 'pip' }` or `{ permission: 'deploy' }`, with `person` or `permission` in `permissions.ask`. Someone else is never the run's accountable person: naming Mo here, or a permission only Mo holds, throws `PasskeyRequestRefused` with `self`. Agents have no passkey.
 
 Call both leaves outside `step.do` callbacks. Each request spends from the workflow's `asks` budget. Deadlines range from a minute to a day, bounded by the run's remaining day. A called workflow parses its input with one `z.object` and returns JSON to its caller.
 
@@ -248,7 +248,7 @@ The gate in story 1 takes local results with `local(unit())` and `passkey.check(
 
 The newest finished local run counts unless a ref0 failure stands. A newer local run replaces an earlier one, and a newer ref0 pass counts instead. A ref0 failure stands until an admin overrides it, even if a later run passes.
 
-`passkey.check` waits for the person behind the counted run to say yes over its result with their passkey. For a local run, that's the signer's person. For ref0's run, it's the version's accountable person. `{ from }` asks someone else, as in `passkey.check(local(e2e()), { from: { person: 'mo' } })`. The statement names the check-run identity, conclusion and outputs' hash. A newer counted run needs a new yes.
+`passkey.check` waits for the person behind the counted run to say yes over its result with their passkey. For a local run, that's the signer's person. For ref0's run, it's the version's accountable person. `{ from }` asks someone else, as in `passkey.check(local(e2e()), { from: { person: 'mo' } })`. Someone else is never the person behind the run: if Mo ran it, or only Mo holds the permission named, ref0 refuses the request at once, and the check needs an admin's override. The statement names the check-run identity, conclusion and outputs' hash. A newer counted run needs a new yes.
 
 When ref0 runs the same check-run identity as a signed success and it fails twice, the signer stops answering that check. For `local`, ref0 revokes the attachment. For `passkey.check`, it revokes the person whose yes stood over the result. An admin restores the signer with `ref0 checks signers restore`, using `--person` for a person. The floor's needs and the queue's tip take only ref0's runs.
 

package/dist/{browse-DBqoeS-u.d.mts → browse-CLwrVDwR.d.mts}

@@ -1,4 +1,4 @@
-import { $t as WorkflowCallRefused, An as WorkflowText, B as GetIssueInput, Cn as WorkflowPermissions, E as ConnectionCallAnswer, En as WorkflowPullRequestOpen, I as EventRunInput, It as ThreadStage, Jt as WorkflowCall, L as ForkAnswer$1, Mn as WorkflowTrigger, Mt as StartActor$1, Nt as StartRun$1, On as WorkflowStartEnded, Qt as WorkflowCallRefusal, R as ForkCreate, Sn as WorkflowPasskeyState, St as SandboxPushAnswer, T as ConnectionCall, Tn as WorkflowPullRequestAnswer, Ut as WorkflowAction, Wt as WorkflowActionAnswer, Xt as WorkflowCallEnded, Yt as WorkflowCallAnswer, Zt as WorkflowCallInput, _ as CheckRunError, _n as WorkflowOwn, _t as SandboxExec, an as WorkflowCheckResultsAnswer, bn as WorkflowPasskeyEnded, bt as SandboxOpenAnswer, cn as WorkflowCheckStart, dn as WorkflowCheckStatesAnswer, en as WorkflowCalledState, fn as WorkflowCheckWhere, g as CheckOwn, gn as WorkflowFilters, h as CheckOn, hn as WorkflowEvent, in as WorkflowCheckResults, jn as WorkflowThreadStart, kn as WorkflowStartState, ln as WorkflowCheckStartAnswer, mn as WorkflowConnections, nn as WorkflowCheckRefusal, on as WorkflowCheckRun, pn as WorkflowComment, pt as Ref0Owned, qt as WorkflowAskClosed, rn as WorkflowCheckRefused, sn as WorkflowCheckRunEnded, tn as WorkflowCalledStateAnswer, un as WorkflowCheckStates, v as CheckRunParams, vn as WorkflowPasskeyAsk, vt as SandboxExecAnswer, xn as WorkflowPasskeyRead, xt as SandboxPush, y as CheckTreeEntry, yn as WorkflowPasskeyAsked, yt as SandboxOpen } from "./index-Dns8tCkT.mjs";
+import { $t as WorkflowAskClosed, A as ConnectionCallAnswer, B as EventRunInput, Cn as WorkflowOwn, Ct as SandboxExec, Dn as WorkflowPasskeyRead, Dt as SandboxPush, En as WorkflowPasskeyEnded, Et as SandboxOpenAnswer, Fn as WorkflowStartState, G as GetIssueInput, H as ForkAnswer$1, Ht as ThreadStage, In as WorkflowText, Ln as WorkflowThreadStart, Mn as WorkflowPullRequestOpen, On as WorkflowPasskeyState, Ot as SandboxPushAnswer, Pn as WorkflowStartEnded, Rn as WorkflowTrigger, Rt as StartActor$1, Sn as WorkflowFilters, Tn as WorkflowPasskeyAsked, Tt as SandboxOpen, U as ForkCreate, Xt as WorkflowActionAnswer, Yt as WorkflowAction, _ as CheckOwn, _n as WorkflowCheckStatesAnswer, an as WorkflowCallRefused, b as CheckTreeEntry, bn as WorkflowConnections, cn as WorkflowCheckRefusal, dn as WorkflowCheckResultsAnswer, en as WorkflowCall, fn as WorkflowCheckRun, g as CheckOn, gn as WorkflowCheckStates, hn as WorkflowCheckStartAnswer, in as WorkflowCallRefusal, jn as WorkflowPullRequestAnswer, k as ConnectionCall, kn as WorkflowPermissions, ln as WorkflowCheckRefused, mn as WorkflowCheckStart, nn as WorkflowCallEnded, on as WorkflowCalledState, pn as WorkflowCheckRunEnded, rn as WorkflowCallInput, sn as WorkflowCalledStateAnswer, tn as WorkflowCallAnswer, un as WorkflowCheckResults, v as CheckRunError, vn as WorkflowCheckWhere, vt as Ref0Owned, wn as WorkflowPasskeyAsk, wt as SandboxExecAnswer, xn as WorkflowEvent, y as CheckRunParams, yn as WorkflowComment, zt as StartRun$1 } from "./index-Vb8-1Zk-.mjs";
 import { z } from "zod";
 //#region src/needs.d.ts
 /**
@@ -551,10 +551,10 @@ interface CheckSpec<Params extends z.ZodObject, Output> {
   /** For the whole check run, 45 minutes unless it says, and 6 hours at most. */
   readonly timeout?: DurationText;
   /**
-   * When ref0 starts it itself, each once: `'change'`, on each change before it joins `main`;
-   * `'tip'`, on the merge queue's tip before `main` moves, so it guards `main`; `'deployed'`, on
-   * what deployed. `['change', 'tip']` unless it says, and `[]` for ref0 never to start it, so only
-   * other code and people do, as its start rule lets them.
+   * When ref0 starts it itself, each once: `'change'`, on each change before it joins `main`; or
+   * `'tip'`, on the merge queue's tip before `main` moves, so it guards `main`. `['change', 'tip']`
+   * unless it says, and `[]` for ref0 never to start it, so only other code and people do, as its
+   * start rule lets them.
    */
   readonly on?: CheckOn;
   /**
@@ -671,4 +671,4 @@ interface Browser {
 }
 //#endregion
 export { StartActor as $, ForkOptions as A, WorkflowContext as B, Comment as C, EventWorkflow as D, EventOf as E, StepConfig as F, CalledWorkflow as G, text as H, StepContext as I, TreeEntry as J, JsonValue as K, ThreadStart as L, PullRequestAnswer as M, PullRequestOptions as N, EventWorkflowSpec as O, Ref0Actions as P, Refusal as Q, WaitType as R, CheckRunEnded as S, Duration as T, workflow as U, WorkflowStep as V, CalledRunFailed as W, Allow as X, TreeRead as Y, CalledRun as Z, ActionAnswer as _, CheckRunOptions as a, allow as at, CalledContext as b, CheckRunResult as c, Need as ct, OneOfValues as d, StartContext as et, OutputResult as f, oneOf as g, check as h, CheckResult as i, StartRun as it, NeedAddOptions as j, ForkAnswer as k, CheckSpec as l, Step as m, Check as n, StartOutput as nt, CheckRunReference as o, refuse as ot, OutputSchema as p, Tree as q, CheckContext as r, StartRule as rt, CheckRunRefused as s, CheckNeed as st, Browser as t, StartItem as tt, DurationText as u, CallAnswer as v, ConnectionsOf as w, CalledWorkflowSpec as x, CallEnded as y, WaitedEvent as z };
-//# sourceMappingURL=browse-DBqoeS-u.d.mts.map
+//# sourceMappingURL=browse-CLwrVDwR.d.mts.map

package/dist/browser.d.mts

@@ -1,4 +1,4 @@
-import { t as Browser } from "./browse-DBqoeS-u.mjs";
+import { t as Browser } from "./browse-CLwrVDwR.mjs";
 import { BrowserContext, BrowserContext as BrowserContext$1, BrowserContextOptions, Locator, Page, Page as Page$1, Request, Response } from "@cloudflare/playwright";
 import { expect as expect$1 } from "@cloudflare/playwright/test";
 //#region src/browser-stub.d.ts

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { $ as OwnerThreadView, A as ConnectionView, At as SignedIn, Bn as liveSocketUrl, Bt as TypedApprovalCode, C as ConnectChosen, D as ConnectionChanged, Dt as SentryRegion, Et as SentryOrg, F as EndpointName, Fn as connectEndpoint, Ft as ThreadId, G as LiveTrackName, H as ImportFailure, Hn as repoNameKey, Ht as Welcome, In as encodeSecret, It as ThreadStage, J as MirrorEntry, K as MachineConnected, Ln as hookTokenPrefix, Lt as TrackClosed, M as ConsentClient, N as ConsentProject, Nn as WrittenProject, O as ConnectionKind, Ot as SentryToken, P as CredentialView, Pn as commandLine, Pt as StatementView, Q as OwnerThreadPage, Rn as hookUrl, Rt as TrackSession, S as ConnectAgent, Tt as SecretHash, U as LiveTicket, Un as surfaceOf, V as Harness, Vn as projectParts, W as LiveTicketRequest, X as OwnerId, Y as MirrorView, Z as OwnerName, a as Api, b as ClientAccess, c as ApprovalPreview, ct as PreviewUnavailable, d as AttachmentFailed, dt as RanOf, et as OwnerTrackMessage, f as AttachmentRequestView, ft as ReadEvent, gt as RepoView, ht as RepoUrl, i as AgentView, j as ConsentAsked, jt as SocketUrl, k as ConnectionName, kt as SignInDestination, l as ApprovalState, lt as ProjectName, mt as RepoName, n as AgentPermissionChoice, nt as PasskeyCreated, o as ApiOrigin, ot as PasskeyRequestOptions, p as Authorization, q as MirrorChoice, r as AgentPermissionSetting, rt as PasskeyCreationOptions, s as ApprovalId, st as PreviewEcho, t as AgentHandle, tt as PasskeyAsserted, u as ApprovalView, ut as ProjectTrackMessage, w as ConnectableAgent, wn as WorkflowPreview, wt as ScopeAction, x as ClientGranted, zn as isRef0Path, zt as TrackThread } from "./index-Dns8tCkT.mjs";
+import { $ as MirrorEntry, An as WorkflowPreview, At as ScopeAction, Bn as commandLine, Bt as StatementView, C as ConnectAgent, D as ConnectOptions, E as ConnectFolderOption, F as ConsentAsked, Ft as SignInDestination, Gn as isRef0Path, Gt as TrackThread, Hn as encodeSecret, Ht as ThreadStage, I as ConsentClient, It as SignedIn, J as LiveTicket, Jn as repoNameKey, Jt as Welcome, K as Harness, Kn as liveSocketUrl, Kt as TypedApprovalCode, L as ConsentProject, Lt as SocketUrl, M as ConnectionKind, Mt as SentryOrg, N as ConnectionName, Nt as SentryRegion, O as ConnectableAgent, P as ConnectionView, Pt as SentryToken, Q as MirrorChoice, R as CredentialView, S as ClientGranted, St as RequestFolder, T as ConnectFolderChoices, Un as hookTokenPrefix, Ut as TrackClosed, V as FoldersConnected, Vn as connectEndpoint, Vt as ThreadId, Wn as hookUrl, Wt as TrackSession, X as LiveTrackName, Y as LiveTicketRequest, Yn as surfaceOf, Z as MachineConnected, _t as ReadEvent, a as Api, at as OwnerTrackMessage, bt as RepoUrl, c as ApprovalId, ct as PasskeyCreationOptions, d as ApprovalView, dt as PasskeyRequestOptions, et as MirrorView, f as AttachmentFailed, ft as PreviewEcho, gt as RanOf, ht as ProjectTrackMessage, i as AgentView, it as OwnerThreadView, j as ConnectionChanged, jt as SecretHash, l as ApprovalPreview, m as Authorization, mt as ProjectName, n as AgentPermissionChoice, nt as OwnerName, o as ApiOrigin, ot as PasskeyAsserted, p as AttachmentRequestView, pt as PreviewUnavailable, q as ImportFailure, qn as projectParts, r as AgentPermissionSetting, rt as OwnerThreadPage, s as ApprovalAnswer, st as PasskeyCreated, t as AgentHandle, tt as OwnerId, u as ApprovalState, w as ConnectChosen, x as ClientAccess, xt as RepoView, yt as RepoName, z as EndpointName, zn as WrittenProject } from "./index-Vb8-1Zk-.mjs";
 import { Effect, Layer, Option, Redacted, Schema, Stream } from "effect";
 import { HttpApi, HttpApiClient, HttpApiGroup, HttpApiMiddleware } from "effect/http-api";
 import { HttpBody, HttpClient } from "effect/http";
@@ -90,5 +90,5 @@ export declare const startGitHubSignIn: (landing: {
  */
 export declare const signOut: (origin?: ApiOrigin) => Effect.Effect<void, import("effect/http/HttpClientError").HttpClientError, HttpClient.HttpClient>;
 //#endregion
-export { AgentHandle, type AgentPermissionChoice, type AgentPermissionSetting, type AgentView, ApiOrigin, type ApprovalId, type ApprovalPreview, type ApprovalState, type ApprovalView, AttachmentFailed, type AttachmentRequestView, ClientAccess, ClientGranted, type ConnectAgent, type ConnectChosen, type ConnectableAgent, ConnectionChanged, ConnectionKind, ConnectionName, type ConnectionView, type ConsentAsked, type ConsentClient, ConsentProject, type CredentialView, type Harness, type ImportFailure, type LiveTicket, type LiveTicketRequest, LiveTrackName, MachineConnected, type MirrorChoice, type MirrorEntry, type MirrorView, type OwnerId, OwnerName, type OwnerThreadPage, type OwnerThreadView, OwnerTrackMessage, PasskeyAsserted, PasskeyCreated, type PasskeyCreationOptions, type PasskeyRequestOptions, type PreviewEcho, PreviewUnavailable, ProjectName, ProjectTrackMessage, type ReadEvent, type Ref0Client, RepoName, RepoUrl, type RepoView, type ScopeAction, SecretHash, SentryOrg, SentryRegion, SentryToken, type SettledApproval, SignInDestination, type StatementView, ThreadId, ThreadStage, type TrackClosed, type TrackSession, type TrackThread, TypedApprovalCode, type Welcome, WorkflowPreview, WrittenProject, commandLine, connectEndpoint, encodeSecret, hookTokenPrefix, hookUrl, isRef0Path, liveSocketUrl, projectParts, repoNameKey, surfaceOf };
+export { AgentHandle, type AgentPermissionChoice, type AgentPermissionSetting, type AgentView, ApiOrigin, type ApprovalAnswer, type ApprovalId, type ApprovalPreview, type ApprovalState, type ApprovalView, AttachmentFailed, AttachmentRequestView, ClientAccess, ClientGranted, type ConnectAgent, type ConnectChosen, type ConnectFolderChoices, type ConnectFolderOption, type ConnectOptions, type ConnectableAgent, ConnectionChanged, ConnectionKind, ConnectionName, type ConnectionView, type ConsentAsked, type ConsentClient, ConsentProject, type CredentialView, FoldersConnected, type Harness, type ImportFailure, type LiveTicket, type LiveTicketRequest, LiveTrackName, MachineConnected, type MirrorChoice, type MirrorEntry, type MirrorView, type OwnerId, OwnerName, type OwnerThreadPage, type OwnerThreadView, OwnerTrackMessage, PasskeyAsserted, PasskeyCreated, type PasskeyCreationOptions, type PasskeyRequestOptions, type PreviewEcho, PreviewUnavailable, ProjectName, ProjectTrackMessage, type ReadEvent, type Ref0Client, RepoName, RepoUrl, type RepoView, type RequestFolder, type ScopeAction, SecretHash, SentryOrg, SentryRegion, SentryToken, type SettledApproval, SignInDestination, type StatementView, ThreadId, ThreadStage, type TrackClosed, type TrackSession, type TrackThread, TypedApprovalCode, type Welcome, WorkflowPreview, WrittenProject, commandLine, connectEndpoint, encodeSecret, hookTokenPrefix, hookUrl, isRef0Path, liveSocketUrl, projectParts, repoNameKey, surfaceOf };
 //# sourceMappingURL=client.d.mts.map