@ref0/sdk 0.5.0 → 0.7.0

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { An as WorkflowText, Ct as SandboxSize, Dn as WorkflowRequestRefusal, Gt as WorkflowAnswerer, Kt as WorkflowAsk, St as SandboxPushAnswer, Vt as VersionFile, at as PasskeyRefusal, it as PasskeyFrom$1, m as ChangeAuthor, pt as Ref0Owned, qt as WorkflowAskClosed, z as GateOwn } from "./index-Dns8tCkT.mjs";
-import { $ as StartActor, A as ForkOptions, B as WorkflowContext, C as Comment, D as EventWorkflow, E as EventOf, F as StepConfig, G as CalledWorkflow, H as text, I as StepContext, J as TreeEntry, K as JsonValue, L as ThreadStart, M as PullRequestAnswer, N as PullRequestOptions, O as EventWorkflowSpec, P as Ref0Actions, Q as Refusal, R as WaitType, S as CheckRunEnded, T as Duration, U as workflow, V as WorkflowStep, W as CalledRunFailed, X as Allow, Y as TreeRead, Z as CalledRun, _ as ActionAnswer, a as CheckRunOptions, at as allow, b as CalledContext, c as CheckRunResult, ct as Need, d as OneOfValues, et as StartContext, f as OutputResult, g as oneOf, h as check, i as CheckResult, it as StartRun, j as NeedAddOptions, k as ForkAnswer, l as CheckSpec, m as Step, n as Check, nt as StartOutput, o as CheckRunReference, ot as refuse, p as OutputSchema, q as Tree, r as CheckContext, rt as StartRule, s as CheckRunRefused, st as CheckNeed, t as Browser, tt as StartItem, u as DurationText, v as CallAnswer, w as ConnectionsOf, x as CalledWorkflowSpec, y as CallEnded, z as WaitedEvent } from "./browse-DBqoeS-u.mjs";
+import { $t as WorkflowAskClosed, In as WorkflowText, Nn as WorkflowRequestRefusal, Ot as SandboxPushAnswer, Qt as WorkflowAsk, W as GateOwn, Zt as WorkflowAnswerer, h as ChangeAuthor, kt as SandboxSize, lt as PasskeyFrom$1, qt as VersionFile, ut as PasskeyRefusal, vt as Ref0Owned } from "./index-Vb8-1Zk-.mjs";
+import { $ as StartActor, A as ForkOptions, B as WorkflowContext, C as Comment, D as EventWorkflow, E as EventOf, F as StepConfig, G as CalledWorkflow, H as text, I as StepContext, J as TreeEntry, K as JsonValue, L as ThreadStart, M as PullRequestAnswer, N as PullRequestOptions, O as EventWorkflowSpec, P as Ref0Actions, Q as Refusal, R as WaitType, S as CheckRunEnded, T as Duration, U as workflow, V as WorkflowStep, W as CalledRunFailed, X as Allow, Y as TreeRead, Z as CalledRun, _ as ActionAnswer, a as CheckRunOptions, at as allow, b as CalledContext, c as CheckRunResult, ct as Need, d as OneOfValues, et as StartContext, f as OutputResult, g as oneOf, h as check, i as CheckResult, it as StartRun, j as NeedAddOptions, k as ForkAnswer, l as CheckSpec, m as Step, n as Check, nt as StartOutput, o as CheckRunReference, ot as refuse, p as OutputSchema, q as Tree, r as CheckContext, rt as StartRule, s as CheckRunRefused, st as CheckNeed, t as Browser, tt as StartItem, u as DurationText, v as CallAnswer, w as ConnectionsOf, x as CalledWorkflowSpec, y as CallEnded, z as WaitedEvent } from "./browse-CLwrVDwR.mjs";
 //#region src/ask.d.ts
 /**
  * `ask`, ref0's leaf that asks someone a question and waits in the run for the answer, as a
@@ -150,8 +150,10 @@ export declare const local: (need: CheckNeed) => CheckNeed;
 /**
  * Who a request asks, as `PasskeyFrom` in `@ref0/contracts` says: the run's accountable person; a
  * person by their name; or anyone holding one of the repo's permissions, the first of whom to
- * answer decides. The workflow's `permissions.ask` names each kind it asks. An ask's `by` passes
- * as it is: `'accountable'`, or an agent, which is refused `agent`, since an agent has no passkey.
+ * answer decides. A person or a permission asks someone else, so the run's accountable person never
+ * answers it, and one that names them, or a permission only they hold, is refused `self`. The
+ * workflow's `permissions.ask` names each kind it asks. An ask's `by` passes as it is:
+ * `'accountable'`, or an agent, which is refused `agent`, since an agent has no passkey.
  */
 type PasskeyFrom = (typeof PasskeyFrom$1)['Encoded'] | {
   readonly agent: string;
@@ -197,7 +199,8 @@ declare const run: (step: WorkflowStep, options: PasskeyRunOptions) => Promise<P
 interface PasskeyCheckOptions {
   /**
    * Who says yes: by default the person behind the run that meets the need, a local run's
-   * signer's person, or the version's accountable person for a run of ref0's own.
+   * signer's person, or the version's accountable person for a run of ref0's own. A person or a
+   * permission asks someone else, so the person behind the run never answers it.
    */
   readonly from?: (typeof PasskeyFrom$1)['Encoded'];
 }
@@ -206,8 +209,10 @@ interface PasskeyCheckOptions {
  * `passkey.check(local(e2e()))`, or `passkey.check(e2e(), { from: { permission: 'qa' } })` to ask
  * someone else. For each part, ref0 asks for a yes to a statement that names the run that meets it,
  * its check-run identity, its conclusion and its outputs' hash, and the part waits for that yes. A
- * newer run that counts asks again. A no or the request's day ending waits for a newer local run;
- * on a run of ref0's, or from a person who can't be asked, the check needs an admin's override.
+ * newer run that counts asks again. Someone else is never the person behind the run. A no or the
+ * request's day ending waits for a newer local run; on a run of ref0's, or with nobody to ask, a
+ * person who can't be asked or nobody but the person behind the run, the check needs an admin's
+ * override.
  * When ref0's runs of an identity someone said yes over fail twice, their yes stops answering the
  * check until an admin restores them. It takes a check's need, never a check or another need, and wraps it
  * once, before or after `local`.

package/dist/index.mjs

@@ -1143,8 +1143,10 @@ const run = async (step, options) => {
 * `passkey.check(local(e2e()))`, or `passkey.check(e2e(), { from: { permission: 'qa' } })` to ask
 * someone else. For each part, ref0 asks for a yes to a statement that names the run that meets it,
 * its check-run identity, its conclusion and its outputs' hash, and the part waits for that yes. A
-* newer run that counts asks again. A no or the request's day ending waits for a newer local run;
-* on a run of ref0's, or from a person who can't be asked, the check needs an admin's override.
+* newer run that counts asks again. Someone else is never the person behind the run. A no or the
+* request's day ending waits for a newer local run; on a run of ref0's, or with nobody to ask, a
+* person who can't be asked or nobody but the person behind the run, the check needs an admin's
+* override.
 * When ref0's runs of an identity someone said yes over fail twice, their yes stops answering the
 * check until an admin restores them. It takes a check's need, never a check or another need, and wraps it
 * once, before or after `local`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ref0/sdk",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "What a repo's .ref0/ code imports to run on ref0, and ref0's HTTP client",
   "license": "Apache-2.0",
   "repository": {