@skillcdn/console 0.4.0 → 0.4.1

package/docs/specs/rest.md

@@ -47,6 +47,8 @@ The API is the board as its members see it: the people, the projects, and in eac
 | 403 | `auth.forbidden_origin` | A request that changes something on a session did not come from the console's own pages. |
 | 403 | `auth.forbidden` | A member asked for what only an administrator, or only an owner of the project, may do. |
 | 403 | `auth.session_required` | A token asked for what only a person signed in may do: the tokens themselves, and the approval of an agent's connection, which makes one. |
+| 403 | `auth.deactivated` | A token the console knows, for a person deactivated: the token is kept, refused on every route while they are out, `GET /api/v1/me` included, and theirs again when they are taken back in ([ADR-0044](../adr/0044-a-token-of-a-person-who-is-out-is-kept-and-refused-with-the-reason-until-they-are-back-in.md)). |
+| 403 | `auth.not_admitted` | A token the console knows, for a person no longer let in: what let them in, the domain or the organization, is no longer named. Kept and refused the same way, and theirs again when they are back in. |
 | 403 | `run.not_yours` | The run is another person's. |
 | 404 | `project.not_found` | No project has that key, or it is not the asker's to see: the two are one answer. The key is checked before anything is asked. |
 | 404 | `task.not_found`, `decision.not_found`, `goal.not_found`, `token.not_found`, `person.not_found`, `run.not_found`, `run.task_not_found`, `member.not_found` | No such id in the project (or in the workspace, for a token, a person); for a token, none of the asker's. An id that is not a UUID is not found either, except a task's number. |
@@ -60,6 +62,11 @@ The API is the board as its members see it: the people, the projects, and in eac
 | 409 | `member.exists` | The person is listed in the project already. |
 | 409 | `member.open_project` | The project is open to the workspace, so everyone of it is a member already; only an owner is listed there ([ADR-0035](../adr/0035-who-may-see-whom-is-decided-by-one-policy-and-the-workspace-keeps-its-settings.md)). |
 | 409 | `category.key_taken`, `category.in_use`, `category.too_many` | A category of the workspace has that key already; tasks or goals are sorted into the category, so it stays until they are moved; the workspace has as many categories as one may (`MAX_CATEGORIES`). |
+| 409 | `project.too_many`, `task.too_many`, `goal.too_many`, `decision.too_many`, `document.too_many`, `run.too_many` | The workspace holds as many projects as one may (`MAX_PROJECTS_PER_WORKSPACE`); the project as many tasks, goals, decisions or pages (`MAX_TASKS_PER_PROJECT`, `MAX_GOALS_PER_PROJECT`, `MAX_DECISIONS_PER_PROJECT`, `MAX_DOCUMENTS_PER_PROJECT`), those put away counted; the task has been taken as many times as one may (`MAX_RUNS_PER_TASK`). Bounds a runaway script meets and real work does not. |
+| 409 | `project.too_many_bytes` | The files of the project, handed in by runs, put in comments and attached to pages, hold as many bytes together as the deployment allows one project (`PROJECT_FILE_BYTES_AT_MOST`, [deploy/README.md](../../deploy/README.md#a-shared-console)); no bound unless set. Asked before any byte is kept. |
+| 429 | `feed.too_many` | The person holds as many streams of the feed as one may at once (`MAX_STREAMS_PER_PERSON`), or the process does for everyone (`MAX_STREAMS`); `retry-after` says when to try again. |
+| 403 | `picture.refused` | The console fetches no picture from that address: one of its own network, the loopback, a private or a link-local range, or a redirect to one ([ADR-0048](../adr/0048-a-picture-from-elsewhere-is-read-through-the-console-from-a-public-address-and-kept-a-while.md)). |
+| 502 | `picture.unavailable` | The picture could not be fetched from where it is named: the origin answered an error or something that is not a picture, sent more than `MAX_FILE_BYTES`, or could not be reached in time. |
 | 409 | `decision.answered` | The decision has an answer already. |
 | 409 | `document.conflict` | The page has moved on since the version the write started from (`baseVersion`), or was written at that path by someone else first. |
 | 409 | `document.archived` | The page is archived: restore it before writing to it or attaching to it. |
@@ -85,7 +92,7 @@ The API is the board as its members see it: the people, the projects, and in eac
 
 ### `GET /api/v1/me`
 
-`{ "workspace": { "name", "tokenDaysAtMost", "skills": { "source", "address", "packToken" }, "peopleVisibility" }, "person": ... | null, "agent": "..." | null, "language": "..." | null, "signIn": [{ "key", "label" }, ...], "console": { "version", "clientRange" } }`: what the board is called, the most days a token may be good for here (or `null` where a person chooses), where the organization's skills come from (`source`, the origin of the SkillCDN deployment they are read through, and `address`, the organization's, canonical, which a project without one of its own reads, or `null`; and `packToken`, when the SkillCDN token the organization's pack is read with was set, `{ setAt }`, or `null`), who sees whom on the People page (`peopleVisibility`: `everyone`, or `shared_projects`, where a member sees only the people they share a project with and an administrator everyone; [ADR-0035](../adr/0035-who-may-see-whom-is-decided-by-one-policy-and-the-workspace-keeps-its-settings.md); read as optional, for a console from before the setting), the day the calendars begin a week on and this week is counted by (`weekStart`: `auto`, as the language of the pages has it, or `monday`, `sunday`; [ADR-0039](../adr/0039-this-week-is-the-plans-unit-and-the-week-begins-as-the-workspace-says.md)) and the workspace's time zone (`timeZone`: an IANA name, in which the command prints moments, or `null` for none; both optional the same way), who the session cookie or the token says is asking (`id`, `login`, `name` or `null`, `avatar` or `null`, `role`), with what (`agent`: the name of the token when a token asks, as its person called it, so that a console of a person's own knows it holds one and offers nothing a token cannot do; `null` on a session), the language the person chose for the pages (`language`, a tag, or `null` for the browser's), and the identity providers people sign in through (`gh`, `google`, each with the label of its button), none where nobody can; and the console's own version with the range of command versions it takes (`console`, [ADR-0025](../adr/0025-the-command-names-its-version-on-every-request-and-the-console-holds-it-to-the-range-it-takes.md)), for a console built on the package to compare itself with. Nobody is an answer, not an error; the pages ask this once to decide what to show, and the command once, at `login`, to see that the console knows the token.
+`{ "workspace": { "name", "tokenDaysAtMost", "skills": { "source", "address", "packToken" }, "peopleVisibility" }, "person": ... | null, "agent": "..." | null, "language": "..." | null, "signIn": [{ "key", "label", "admits": { "organization", "domains" } }, ...], "console": { "version", "clientRange" } }`: what the board is called, the most days a token may be good for here (or `null` where a person chooses), where the organization's skills come from (`source`, the origin of the SkillCDN deployment they are read through, and `address`, the organization's, canonical, which a project without one of its own reads, or `null`; and `packToken`, when the SkillCDN token the organization's pack is read with was set, `{ setAt }`, or `null`), who sees whom on the People page (`peopleVisibility`: `everyone`, or `shared_projects`, where a member sees only the people they share a project with and an administrator everyone; [ADR-0035](../adr/0035-who-may-see-whom-is-decided-by-one-policy-and-the-workspace-keeps-its-settings.md); read as optional, for a console from before the setting), the day the calendars begin a week on and this week is counted by (`weekStart`: `auto`, as the language of the pages has it, or `monday`, `sunday`; [ADR-0039](../adr/0039-this-week-is-the-plans-unit-and-the-week-begins-as-the-workspace-says.md)) and the workspace's time zone (`timeZone`: an IANA name, in which the command prints moments, or `null` for none; both optional the same way), who the session cookie or the token says is asking (`id`, `login`, `name` or `null`, `avatar` or `null`, `role`), with what (`agent`: the name of the token when a token asks, as its person called it, so that a console of a person's own knows it holds one and offers nothing a token cannot do; `null` on a session), the language the person chose for the pages (`language`, a tag, or `null` for the browser's), and the identity providers people sign in through (`gh`, `google`, each with the label of its button and, in `admits`, who gets in through it: the organization at the git host whose members are in, or `null`, and the Workspace domains whose accounts are, which a sign-in page says under the button; answered from 0.4.1 and read as optional), none where nobody can; and the console's own version with the range of command versions it takes (`console`, [ADR-0025](../adr/0025-the-command-names-its-version-on-every-request-and-the-console-holds-it-to-the-range-it-takes.md)), for a console built on the package to compare itself with. Nobody is an answer, not an error; the pages ask this once to decide what to show, and the command once, at `login`, to see that the console knows the token. A token the console knows whose person is out is refused here as on every route, `auth.deactivated` or `auth.not_admitted`, so that the agent learns why ([ADR-0044](../adr/0044-a-token-of-a-person-who-is-out-is-kept-and-refused-with-the-reason-until-they-are-back-in.md)).
 
 ### `GET /api/v1/people?login=`
 
@@ -105,7 +112,7 @@ Who may sign in, by login ([ADR-0022](../adr/0022-who-is-in-is-the-consoles-own-
 
 ### `POST /api/v1/projects`
 
-Takes `key` and `name`, and optionally `description`, `visibility` (default `private`), `skillsAddress` (checked as the standard spells one, kept canonical; `project.invalid_address`), `color` and `symbol`. For whoever is signed in, or their agent with their token; they become the project's owner. Answers `201` with the project and writes a `project.created` event in it, with `key` and `name`. A key taken is `project.key_taken`.
+Takes `key` and `name`, and optionally `description`, `visibility` (default `private`), `skillsAddress` (checked as the standard spells one, kept canonical; `project.invalid_address`), `color` and `symbol`. For an administrator, signed in or through their agent with their token ([ADR-0045](../adr/0045-a-project-is-made-by-an-administrator.md)); they become the project's owner, and list another as owner from there. A member is refused with `auth.forbidden`. Answers `201` with the project and writes a `project.created` event in it, with `key` and `name`. A key taken is `project.key_taken`.
 
 ### `GET /api/v1/events?after=&limit=`
 
@@ -123,9 +130,9 @@ The workspace's settings, which an administrator keeps on the Settings page ([AD
 
 The SkillCDN token the organization's pack is read with ([ADR-0036](../adr/0036-a-private-pack-is-connected-with-a-code-a-person-approves-from-the-projects-settings.md)), for an administrator, signed in from the console's own pages or through their agent's token: every project that names no address of its own and holds no token of its own reads the organization's pack (`SKILLS_ADDRESS`) with it. `PUT` takes `{ "token" }` as the project's route does, tries it against the organization's pack once (`workspace.pack_token_refused` when the pack is not served to it or the console names no address for the organization's skills; `skills.unavailable` when the deployment could not be reached), seals it with the console's secret (`workspace.pack_token_unsupported` where the console has none) and keeps it on the workspace, answering the workspace as `me` carries it, with `skills.packToken: { setAt }`, and writing a `workspace.updated` event naming the field `packToken`. The token is answered nowhere and logged nowhere. `DELETE` takes it away the same way; taking away what is not there writes nothing.
 
-### `POST /api/v1/workspace/pack-token/connect`, `GET .../pack-token/connect` and `DELETE .../pack-token/connect`
+### `POST /api/v1/workspace/pack-token/connect`, `GET .../pack-token/connect`, `POST .../pack-token/connect/claim` and `DELETE .../pack-token/connect`
 
-The workspace's token connected with a code a person approves ([ADR-0036](../adr/0036-a-private-pack-is-connected-with-a-code-a-person-approves-from-the-projects-settings.md)), for an administrator, as a project's is: `POST` asks the deployment to connect the organization's address and answers `201` with `{ "code", "url", "expiresAt", "intervalSeconds" }`, with `workspace.pack_connect_unsupported`, `workspace.pack_connect_refused` and `skills.unavailable` where a project's route has its own, the refusal naming a console with no address for the organization's skills; `GET` answers `{ "status": "none" }`, `pending` with what the person is shown, `connected` with `workspace` as `me` carries it once the token is kept, or `ended` with `reason`; `DELETE` gives the request up. One request for the workspace at a time.
+The workspace's token connected with a code a person approves ([ADR-0036](../adr/0036-a-private-pack-is-connected-with-a-code-a-person-approves-from-the-projects-settings.md)), for an administrator, as a project's is: `POST .../connect` asks the deployment to connect the organization's address and answers `201` with `{ "code", "url", "expiresAt", "intervalSeconds" }`, with `workspace.pack_connect_unsupported`, `workspace.pack_connect_refused` and `skills.unavailable` where a project's route has its own, the refusal naming a console with no address for the organization's skills; `GET` reads how it stands and changes nothing: `{ "status": "none" }`, `pending` with what the person is shown, or `ended` with `reason` `expired`; `POST .../connect/claim` asks the deployment whether the person approved ([ADR-0046](../adr/0046-the-claim-of-a-pack-token-is-a-request-of-its-own-and-reading-how-the-connection-stands-changes-nothing.md)) and answers `pending` still, `connected` with `workspace` as `me` carries it once the token is kept, or `ended` with `reason`; `DELETE` gives the request up. One request for the workspace at a time.
 
 ### `GET /api/v1/categories`
 
@@ -157,7 +164,7 @@ Takes one of the asker's tokens away, whoever holds it, and answers `204`. A tok
 
 ### `DELETE /api/v1/me/token`
 
-The token the request is made with gives itself up, so that it is good for nothing from now on, and the answer is `204`: what `console logout` does, so that a token forgotten on a machine does not outlive it. The one thing a token does about the tokens; with a session, which has none to give, it is `request.invalid`.
+The token the request is made with gives itself up, so that it is good for nothing from now on, and the answer is `204`: what `console logout` does, so that a token forgotten on a machine does not outlive it. The one thing a token does about the tokens; with a session, which has none to give, it is `request.invalid`. A token whose person is out is refused here as everywhere ([ADR-0044](../adr/0044-a-token-of-a-person-who-is-out-is-kept-and-refused-with-the-reason-until-they-are-back-in.md)): the console keeps it for when they are back in, and the command forgets it on the machine.
 
 ### `GET /api/v1/people/<id>/tokens` and `DELETE /api/v1/people/<id>/tokens/<token id>`
 
@@ -167,11 +174,15 @@ An administrator's sight of everyone's agents ([ADR-0011](../adr/0011-an-agent-c
 
 `{ "tasks": [{ "project", "task" }, ...], "closed": [{ "project", "task" }, ...] }`: what is on another person's plate, for whoever oversees them: an administrator, or an owner of a project the person is in (everyone of the workspace is in a project open to it; a private one holds those listed), signed in or through their agent. The open tasks the person is at work on, the sooner due first and those with no day last, and as `closed` those of them done or dropped and not yet put away, both within the projects the asker may see and no other, each with its project; the decisions are left out, since they wait for anyone. `auth.forbidden` for anyone else; `person.not_found` for an id that is nobody's.
 
+### `GET /api/v1/pictures?src=`
+
+A picture from elsewhere, for a page that shows one ([ADR-0048](../adr/0048-a-picture-from-elsewhere-is-read-through-the-console-from-a-public-address-and-kept-a-while.md)): the console fetches it and hands it over, so that the person's browser reaches nobody's server. `src` is the https URL that names it, up to `MAX_URL_LENGTH`, on its default port and with no credentials in it; anything else is `request.invalid`. For whoever is signed in, with a session or a token. Fetched from a public address only, the host resolved first: an address of the console's own network, the loopback, a private or a link-local range, is `picture.refused` (`403`), and so is a redirect to one. What comes back must say it is a picture (`image/*`) and be at most `MAX_FILE_BYTES`; the origin's error, its silence or anything else is `picture.unavailable` (`502`). Answered with the picture's bytes and type, an `etag` of the bytes, `cache-control: private, max-age=86400`, so that a browser keeps it a day and asks with `if-none-match` after (`304`), and the headers a file is served with, under a policy that runs nothing. The console keeps what it fetched in memory, within a bounded room, for an hour before it asks the origin again with what the origin said the picture was; keeps serving it for a day when the origin cannot be reached; and keeps a refusal five minutes, so that a dead link costs one try in a while. The pages read every picture from elsewhere through here, a person's picture from the git host included, and load nothing from elsewhere themselves.
+
 ### Connecting an agent
 
 `POST /api/v1/connect`, `GET /api/v1/connect/<code>`, `POST /api/v1/connect/<code>/approve`, `POST /api/v1/connect/<code>/deny` and `POST /api/v1/connect/claim`: how an agent gets its token without anyone copying one ([ADR-0011](../adr/0011-an-agent-connects-with-a-short-code-a-person-approves-and-the-token-is-never-shown.md)).
 
-`POST /api/v1/connect` is nobody's: the command sends `{ "agent" }` (what the agent calls itself and where it runs, a line up to `MAX_TOKEN_NAME_LENGTH`) and is answered `201` with `{ "code", "url", "secret", "expiresAt", "interval" }`: a code of eight characters in two groups (`ABCD-EFGH`, from an alphabet without look-alikes) for a person to approve, the console's own page for it, a secret (`cns_c_...`) the command claims with and shows nowhere, when the request expires (thirty minutes after it began), and how many seconds the command waits between claims. A deployment holds a bounded number of requests at once (`connect.too_many`).
+`POST /api/v1/connect` is nobody's: the command sends `{ "agent" }` (what the agent calls itself and where it runs, a line up to `MAX_TOKEN_NAME_LENGTH`) and is answered `201` with `{ "code", "url", "secret", "expiresAt", "interval" }`: a code of eight characters in two groups (`ABCD-EFGH`, from an alphabet without look-alikes) for a person to approve, the console's own page for it, a secret (`cns_c_...`) the command claims with and shows nowhere, when the request expires (thirty minutes after it began), and how many seconds the command waits between claims. A deployment holds a bounded number of requests at once (`connect.too_many`), and a bounded number from one address, as the trusted proxies resolve it: at that bound the oldest request of the address not yet approved makes way for the new one, and its claim is `connect.not_found`; an address whose requests are all approved is `connect.too_many` ([ADR-0047](../adr/0047-a-connection-request-is-bounded-per-address-and-the-oldest-not-yet-approved-makes-way.md)).
 
 `GET /api/v1/connect/<code>`, for a person signed in, answers what asks: `{ "code", "agent", "createdAt", "expiresAt", "approved" }`. A code is read as a person types it: any case, with or without the hyphen. `POST .../approve`, from the console's own pages, takes what `POST /api/v1/tokens` takes (`name`, `expiresInDays`) and answers the request, approved; `POST .../deny` takes the request away and answers `204`.
 
@@ -259,7 +270,7 @@ How the work goes, and what was made. A report takes `body` (Markdown, `MAX_BODY
 
 ### `POST .../runs/<id>/files` and `GET /api/v1/projects/<key>/files/<id>`
 
-A file handed in, as the parts of a form (`multipart/form-data`): the part `file` carries the bytes, with the file's name and its media type; the part `label` is optional. The name is one line without a path (`MAX_FILE_NAME_LENGTH`), the file is not empty and at most `MAX_FILE_BYTES` (`request.too_large`), and a media type that is not one, or none, is `application/octet-stream`. The bytes are kept under their SHA-256, so the same file handed in twice is kept once; the artifact on the run is `kind: "file"` with `file` filled in and `url` null. Answers `201` with the run and tells the board (`run.handed_in`, with the label or the file's name). The same rules as for a link: the run's person only, while the run is open, and only so many. A picture among the files is shown on the task's page small, and large when pressed, and a report that names it as `![words](its name)` shows it where the words are.
+A file handed in, as the parts of a form (`multipart/form-data`): the part `file` carries the bytes, with the file's name and its media type; the part `label` is optional. The name is one line without a path (`MAX_FILE_NAME_LENGTH`), the file is not empty and at most `MAX_FILE_BYTES` (`request.too_large`), and a media type that is not one, or none, is `application/octet-stream`. Where the deployment bounds what one project's files hold together (`PROJECT_FILE_BYTES_AT_MOST`), a file that would take the project over it, counted with every file handed in, put in a comment or attached to a page, is `project.too_many_bytes` (`409`) and nothing of it is kept; a comment's files and a page's file are held to the same bound. The bytes are kept under their SHA-256, so the same file handed in twice is kept once; the artifact on the run is `kind: "file"` with `file` filled in and `url` null. Answers `201` with the run and tells the board (`run.handed_in`, with the label or the file's name). The same rules as for a link: the run's person only, while the run is open, and only so many. A picture among the files is shown on the task's page small, and large when pressed, and a report that names it as `![words](its name)` shows it where the words are.
 
 The bytes of any file of the project, handed in by a run, put in a comment or attached to a page, are read back at `/api/v1/projects/<key>/files/<file id>`, the project's one address for files, by whoever may see the project, with a session or a token: `content-length` and `content-disposition` name the file, the few kinds a browser may show in place (pictures, plain text, Markdown, CSV, JSON) are answered with their type and `inline`, and every other kind as `application/octet-stream` and `attachment`, never sniffed (`x-content-type-options`) and under a policy that runs nothing (`sandbox`). An id that is a link's, or nothing, or another project's, is `file.not_found`.
 
@@ -279,9 +290,9 @@ One skill of the pack, a file of it, what a folder holds and what words find, re
 
 The pack token ([ADR-0028](../adr/0028-the-console-reads-a-projects-pack-through-the-deployments-rest-api-with-a-pack-token-for-a-private-one.md)), for an owner, signed in from the console's own pages or through their agent's token. `PUT` takes `{ "token" }`, a token a person made at the deployment for the pack's repository (8 to 1024 characters, no whitespace), tries it against the deployment once (`project.pack_token_refused` when the pack is not served to it or the project names no pack; `skills.unavailable` when the deployment could not be reached), seals it with the console's secret (`project.pack_token_unsupported` where the console has none) and keeps it, answering the project with `packToken: { setAt }` and writing a `project.updated` event naming the field `packToken`. The token is answered nowhere and logged nowhere. `DELETE` takes it away the same way; taking away what is not there writes nothing.
 
-### `POST /api/v1/projects/<key>/pack-token/connect`, `GET .../pack-token/connect` and `DELETE .../pack-token/connect`
+### `POST /api/v1/projects/<key>/pack-token/connect`, `GET .../pack-token/connect`, `POST .../pack-token/connect/claim` and `DELETE .../pack-token/connect`
 
-A private pack connected with a code a person approves ([ADR-0036](../adr/0036-a-private-pack-is-connected-with-a-code-a-person-approves-from-the-projects-settings.md)), for an owner. `POST` asks the deployment to connect the project's address (the project's own, or the organization's), as nobody, the console calling itself by the workspace's name with Console after it, once (`Acme Console`, whether the name ends with it or not), and answers `201` with what the person is shown: `{ "code", "url", "expiresAt", "intervalSeconds" }`, the code, the page at the deployment to approve it on, until when, and how often to ask again; the secret the console claims with is kept sealed on a row of the project's and answered never. One request per project at a time: a new one replaces the one under way. `project.pack_connect_unsupported` (`409`) where the console reaches no deployment or keeps no secret to seal with; `project.pack_connect_refused` (`400`) when the project names no pack, the pack is on the console's machine, or the deployment refused to begin, in its words (an address with a ref or a path, a public pack); `skills.unavailable` (`503`) when the deployment could not be reached. `GET` asks how it stands and answers one of `{ "status": "none" }`, nothing asked; `{ "status": "pending", "code", "url", "expiresAt", "intervalSeconds" }`, while the person has not approved; `{ "status": "connected", "project" }`, once, when the token was claimed, sealed and kept as `PUT .../pack-token` keeps one, writing `project.updated` with `packToken`, the project answered as it stands; or `{ "status": "ended", "reason": "expired" | "declined" | "refused" }`, when the code's time ran out, the person declined or the code was spent, or the deployment refused (a repository the person may not open, as many tokens as one may hold), the request gone each time. A deployment that could not be reached is `skills.unavailable`, and the request stands. `DELETE` gives the request up and answers `204`.
+A private pack connected with a code a person approves ([ADR-0036](../adr/0036-a-private-pack-is-connected-with-a-code-a-person-approves-from-the-projects-settings.md)), for an owner. `POST` asks the deployment to connect the project's address (the project's own, or the organization's), as nobody, the console calling itself by the workspace's name with Console after it, once (`Acme Console`, whether the name ends with it or not), and answers `201` with what the person is shown: `{ "code", "url", "expiresAt", "intervalSeconds" }`, the code, the page at the deployment to approve it on, until when, and how often to ask again; the secret the console claims with is kept sealed on a row of the project's and answered never. One request per project at a time: a new one replaces the one under way. `project.pack_connect_unsupported` (`409`) where the console reaches no deployment or keeps no secret to seal with; `project.pack_connect_refused` (`400`) when the project names no pack, the pack is on the console's machine, or the deployment refused to begin, in its words (an address with a ref or a path, a public pack); `skills.unavailable` (`503`) when the deployment could not be reached. `GET` reads how it stands and changes nothing ([ADR-0046](../adr/0046-the-claim-of-a-pack-token-is-a-request-of-its-own-and-reading-how-the-connection-stands-changes-nothing.md)): `{ "status": "none" }`, nothing asked; `{ "status": "pending", "code", "url", "expiresAt", "intervalSeconds" }`, while the request stands; or `{ "status": "ended", "reason": "expired" }`, once its time ran out. `POST .../pack-token/connect/claim`, from the console's own pages or with a token, asks the deployment whether the person approved, at the interval it named, and answers `pending` still, with the same; `{ "status": "connected", "project" }`, once, when the token was claimed, sealed and kept as `PUT .../pack-token` keeps one, writing `project.updated` with `packToken`, the project answered as it stands; or `{ "status": "ended", "reason": "expired" | "declined" | "refused" }`, when the code's time ran out, the person declined or the code was spent, or the deployment refused (a repository the person may not open, as many tokens as one may hold), the request gone each time. A deployment that could not be reached is `skills.unavailable`, and the request stands. `DELETE` gives the request up and answers `204`.
 
 ### `GET /api/v1/projects/<key>/rules`
 
@@ -317,11 +328,11 @@ A file attached to the page, sent and read back exactly as a run hands one in ([
 
 ### `GET /api/v1/projects/<key>/events?after=&limit=&task=&run=&decision=&document=&goal=`
 
-`{ "items": [event, ...], "more": boolean }`: what happened in the project after event number `after` (`0` for the beginning), oldest first, at most `limit` (default and maximum `EVENTS_PAGE_LIMIT`); `more` says whether there is more after the last item. `task=<id>`, `run=<id>`, `decision=<id>`, `document=<id>` or `goal=<id>` keeps the events about one of them: how a page shows everything that happened to a task, a run, a decision, a document or a goal. An event carries its `id` (the number), `kind` (one of `EVENT_KINDS`), the `actor` (a person, or, for what an agent did, the person it acts for), `agent` (what the person acted through: the run's agent for what a run did, else the name of the token presented; `null` when a person acted themselves), `projectId`, `taskId`, `decisionId`, `runId`, `documentId` and `goalId` (or `null`), `data` (what a feed shows without asking for the subject: `number`, `title`, `fields`, `from`, `to`, `question`, `option`, `login`, `role`, `key`, `name`, `agent`, `status`, `label`, `excerpt`, `path`, `version`, each only when the kind has it), and `createdAt`.
+`{ "items": [event, ...], "more": boolean }`: what happened in the project after event number `after` (`0` for the beginning), oldest first, at most `limit` (default and maximum `EVENTS_PAGE_LIMIT`); `more` says whether there is more after the last item. With `latest=true`, the newest `limit` events instead, oldest first, and `more` says whether there are earlier ones: how a page shows the feed as it stands without reading it from the beginning; `after` is not looked at then. The workspace's own feed takes `latest` the same way. `task=<id>`, `run=<id>`, `decision=<id>`, `document=<id>` or `goal=<id>` keeps the events about one of them: how a page shows everything that happened to a task, a run, a decision, a document or a goal. An event carries its `id` (the number), `kind` (one of `EVENT_KINDS`), the `actor` (a person, or, for what an agent did, the person it acts for), `agent` (what the person acted through: the run's agent for what a run did, else the name of the token presented; `null` when a person acted themselves), `projectId`, `taskId`, `decisionId`, `runId`, `documentId` and `goalId` (or `null`), `data` (what a feed shows without asking for the subject: `number`, `title`, `fields`, `from`, `to`, `question`, `option`, `login`, `role`, `key`, `name`, `agent`, `status`, `label`, `excerpt`, `path`, `version`, each only when the kind has it), and `createdAt`.
 
 ### `GET /api/v1/projects/<key>/events/stream?after=`
 
-The same events as they happen, as server-sent events: one message per event, with `id` the event's number, `event` its kind and `data` the event as JSON; a comment (`: ping`) every 25 seconds of silence. A browser that reconnects sends `Last-Event-ID`, which wins over `after`, so that nothing is missed. The stream ends when the server shuts down; an `EventSource` reconnects on its own.
+The same events as they happen, as server-sent events: one message per event, with `id` the event's number, `event` its kind and `data` the event as JSON; a comment (`: ping`) every 25 seconds of silence. A browser that reconnects sends `Last-Event-ID`, which wins over `after`, so that nothing is missed. The stream ends when the server shuts down, and when the person may no longer read the project, which is asked again before every delivery and every heartbeat: a member taken off a private project, a person deactivated or a token revoked stops reading within a heartbeat. An `EventSource` reconnects on its own, and is answered as any request is. A person holds at most `MAX_STREAMS_PER_PERSON` streams at once, across their tabs, and a process of the console `MAX_STREAMS` for everyone: one more is `feed.too_many` (`429`, `retry-after`), which a browser's `EventSource` does not retry on its own; the page shows the board as it stands and loads it again on the next visit.
 
 The feed is written in the same transaction as the change it records, so what a stream carries happened, and what happened is carried; every process of the deployment learns of a change through the database's own channel, so a board with several `api` replicas is one board.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skillcdn/console",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "What a custom SkillCDN console is built from: the API client and schemas, the components, the composition of the default console, and the console command agents work the board with.",
   "license": "MIT",
   "homepage": "https://github.com/skillcdn/console#readme",
@@ -68,7 +68,7 @@
     "vitest": "^5.0.3"
   },
   "dependencies": {
-    "@skillcdn/core": "^0.4.0",
+    "@skillcdn/core": "^0.4.1",
     "react-markdown": "^10.1.0",
     "remark-gfm": "^4.0.1",
     "zod": "^4.6.5"

package/skills/building-a-console/SKILL.md

@@ -90,9 +90,9 @@ Produces the **checked build** and the delivery. `npx tsc --noEmit` and `npx vit
 
 ## Hard rules
 
-- What people and agents wrote is untrusted: shown with the package's `Markdown` (elements, never HTML), never with `dangerouslySetInnerHTML`, never as a script or a style; pictures over https only.
+- What people and agents wrote is untrusted: shown with the package's `Markdown` (elements, never HTML), never with `dangerouslySetInnerHTML`, never as a script or a style; a picture from elsewhere is read through the console (`RemotePicturesContext`, which the composition provides from the client; [ADR-0048](/docs/adr/0048-a-picture-from-elsewhere-is-read-through-the-console-from-a-public-address-and-kept-a-while.md)).
 - A token never goes into a page, a bundle, a configuration file or a repository: `console serve` carries it, and a script reads it from the environment.
-- The policy stays: a build is served under a content security policy that runs nothing inline and loads nothing from elsewhere but pictures over https. Scripts, styles and fonts are bundled, never loaded from a CDN or written inline.
+- The policy stays: a build is served under a content security policy that runs nothing inline and loads nothing from elsewhere, pictures included, which come through the console. Scripts, styles and fonts are bundled, never loaded from a CDN or written inline, and a picture of the console's own pages is in the build or reached through `GET /api/v1/pictures`.
 - The package is pinned by version: the API is `/api/v1`, the schemas in the package are the contract of the version it was built against, and a console is rebuilt to take a new one.
 - The marks of SkillCDN are trademarks, not part of the MIT license: a console of one's own shows its own marks through `brand`, or none.
 - Nothing of the server is rebuilt: a console shows the organization's board and holds nothing of its own. A second database is not a console.

package/skills/working-the-board/references/setting-up.md

@@ -1,3 +1,3 @@
 # Setting up, when told to
 
-A task or a person may ask for the project itself rather than work in it: a project made or changed (`console project new <key> "<name>"`, `console project edit <key>`), its mark (`console project icon <key> <file>`), its members (`console member add <login>`, `console member role`, `console member remove`), the workspace's categories (`console category new <key> "<name>"`, `console category edit`, `console category remove`), what a person is (`console person role <login> <admin|member>`), its goals (`console goal new`), and its rules (`console rules write --file <path>`, from [the example](project-rules.md); the workspace's with `--workspace`, for an administrator). The agent does these as its person may, an owner of the project or an administrator of the workspace ([ADR-0021](/docs/adr/0021-a-token-configures-as-its-person-does.md)); the feed names the agent beside the person on each. What the person may not, the console refuses (`auth.forbidden`): that step goes back to the person in the report, never worked around. `console people` and `console members` say who is who, by login; `console workspace` says the workspace's settings, and `console workspace edit` changes them for an administrator: `--people-visibility <everyone|shared-projects>`, who sees whom on the People page; `--week-start <auto|monday|sunday>`, the day the calendars begin a week on; `--time-zone <zone|none>`, the workspace's time zone, an IANA name such as `Asia/Seoul`, in which the command prints moments ([ADR-0035](/docs/adr/0035-who-may-see-whom-is-decided-by-one-policy-and-the-workspace-keeps-its-settings.md)). In a project open to the workspace everyone is a member already: `console member add <login> --role owner` lists an owner, and `member role <login> member` takes one back; a plain `member add` is refused there (`member.open_project`). A login is found exactly, so an owner lists someone `console people` does not show them. A private pack is connected by an owner with `console project pack-token <key> --connect`, or, for the organization's pack, which projects read when they name no address of their own, by an administrator with `console workspace pack-token --connect` ([ADR-0036](/docs/adr/0036-a-private-pack-is-connected-with-a-code-a-person-approves-from-the-projects-settings.md)): the command prints a page at SkillCDN and a code, which the agent relays; the person approves there, signed in as someone who may open the repository, and the console keeps the SkillCDN token, shown to nobody. Until then `console skills` says the pack is not served to the console.
+A task or a person may ask for the project itself rather than work in it: a project made or changed (`console project new <key> "<name>"`, `console project edit <key>`), its mark (`console project icon <key> <file>`), its members (`console member add <login>`, `console member role`, `console member remove`), the workspace's categories (`console category new <key> "<name>"`, `console category edit`, `console category remove`), what a person is (`console person role <login> <admin|member>`), its goals (`console goal new`), and its rules (`console rules write --file <path>`, from [the example](project-rules.md); the workspace's with `--workspace`, for an administrator). The agent does these as its person may, an owner of the project or an administrator of the workspace ([ADR-0021](/docs/adr/0021-a-token-configures-as-its-person-does.md)), and a project is made by an administrator alone ([ADR-0045](/docs/adr/0045-a-project-is-made-by-an-administrator.md)); the feed names the agent beside the person on each. What the person may not, the console refuses (`auth.forbidden`): that step goes back to the person in the report, never worked around. `console people` and `console members` say who is who, by login; `console workspace` says the workspace's settings, and `console workspace edit` changes them for an administrator: `--people-visibility <everyone|shared-projects>`, who sees whom on the People page; `--week-start <auto|monday|sunday>`, the day the calendars begin a week on; `--time-zone <zone|none>`, the workspace's time zone, an IANA name such as `Asia/Seoul`, in which the command prints moments ([ADR-0035](/docs/adr/0035-who-may-see-whom-is-decided-by-one-policy-and-the-workspace-keeps-its-settings.md)). In a project open to the workspace everyone is a member already: `console member add <login> --role owner` lists an owner, and `member role <login> member` takes one back; a plain `member add` is refused there (`member.open_project`). A login is found exactly, so an owner lists someone `console people` does not show them. A private pack is connected by an owner with `console project pack-token <key> --connect`, or, for the organization's pack, which projects read when they name no address of their own, by an administrator with `console workspace pack-token --connect` ([ADR-0036](/docs/adr/0036-a-private-pack-is-connected-with-a-code-a-person-approves-from-the-projects-settings.md)): the command prints a page at SkillCDN and a code, which the agent relays; the person approves there, signed in as someone who may open the repository, and the console keeps the SkillCDN token, shown to nobody. Until then `console skills` says the pack is not served to the console.

package/src/api.ts

@@ -72,13 +72,16 @@ export {
   MAX_CATEGORY_KEY_LENGTH,
   MAX_CATEGORY_NAME_LENGTH,
   MAX_COMMENTS_PER_TASK,
+  MAX_DECISIONS_PER_PROJECT,
   MAX_DOCUMENT_LENGTH,
   MAX_DOCUMENT_PATH_LENGTH,
   MAX_DOCUMENT_SEGMENT_LENGTH,
+  MAX_DOCUMENTS_PER_PROJECT,
   MAX_FILE_BYTES,
   MAX_FILE_NAME_LENGTH,
   MAX_FILES_PER_COMMENT,
   MAX_FILES_PER_DOCUMENT,
+  MAX_GOALS_PER_PROJECT,
   MAX_LANGUAGE_TAG_LENGTH,
   MAX_LINK_LABEL_LENGTH,
   MAX_LINKS,
@@ -91,13 +94,18 @@ export {
   MAX_PROJECT_KEY_LENGTH,
   MAX_PROJECT_NAME_LENGTH,
   MAX_PROJECT_SYMBOL_LENGTH,
+  MAX_PROJECTS_PER_WORKSPACE,
   MAX_QUESTION_LENGTH,
   MAX_REPORTS_PER_RUN,
   MAX_RULES_LENGTH,
+  MAX_RUNS_PER_TASK,
   MAX_SEARCH_LENGTH,
   MAX_SECRET_LENGTH,
   MAX_SKILLS_ADDRESS_LENGTH,
+  MAX_STREAMS,
+  MAX_STREAMS_PER_PERSON,
   MAX_SUMMARY_LENGTH,
+  MAX_TASKS_PER_PROJECT,
   MAX_TITLE_LENGTH,
   MAX_TOKEN_DAYS,
   MAX_TOKEN_NAME_LENGTH,

package/src/cli/cli.ts

@@ -801,13 +801,19 @@ const logout: Command = async (args, io) => {
   }
   // The token is given up at the console first, so that it is good for nothing from now on;
   // one the console no longer knows is gone already. A console out of reach leaves it to the
-  // Agents page, and the person is told so.
-  let gone = true;
+  // Agents page, and the person is told so. A console that keeps it because the person is out
+  // (ADR-0044) is told so too: the token is theirs again when they are back in.
+  let outcome: "gone" | "kept" | "left" = "gone";
   try {
     await clientOf(io, url, login.token).giveUpToken();
   } catch (error) {
-    if (!(error instanceof ApiError && error.code === "auth.required")) {
-      gone = false;
+    if (
+      error instanceof ApiError &&
+      (error.code === "auth.deactivated" || error.code === "auth.not_admitted")
+    ) {
+      outcome = "kept";
+    } else if (!(error instanceof ApiError && error.code === "auth.required")) {
+      outcome = "left";
     }
   }
   const next = withoutLogin(credentials, url, login.account);
@@ -818,9 +824,11 @@ const logout: Command = async (args, io) => {
   }
   const whom = login.account === undefined ? "" : ` as ${login.account}`;
   io.stdout(
-    gone
+    outcome === "gone"
       ? `Signed out of ${url}${whom}: the token is given up at the console and forgotten here.\n`
-      : `Signed out of ${url}${whom} here, but the console could not be reached to give the token up: a person removes it on the Agents page.\n`,
+      : outcome === "kept"
+        ? `Signed out of ${url}${whom} here: the console keeps the token while the person is out, for when they are back in.\n`
+        : `Signed out of ${url}${whom} here, but the console could not be reached to give the token up: a person removes it on the Agents page.\n`,
   );
   envNote();
   return EXIT.ok;
@@ -2499,8 +2507,8 @@ const workspace: Command = async (args, io) => {
         set: (token) => client.setWorkspacePackToken({ token }),
         remove: () => client.removeWorkspacePackToken(),
         connect: () => client.connectWorkspacePackToken(),
-        async standing() {
-          const state = await client.workspacePackTokenConnection();
+        async claim() {
+          const state = await client.claimWorkspacePackTokenConnection();
           return state.status === "connected"
             ? { status: "connected", held: state.workspace }
             : state;
@@ -2660,7 +2668,8 @@ interface TokenHolder<T> {
   set(token: string): Promise<T>;
   remove(): Promise<T>;
   connect(): Promise<RestPackConnectStarted>;
-  standing(): Promise<
+  /** Asks the console to claim the token at the deployment (ADR-0046), and answers how it stands. */
+  claim(): Promise<
     | { readonly status: "none" }
     | { readonly status: "pending" }
     | { readonly status: "ended"; readonly reason: keyof typeof PACK_CONNECT_ENDED }
@@ -2692,7 +2701,7 @@ async function packToken<T>(
     );
     for (;;) {
       await io.sleep(started.intervalSeconds * 1000);
-      const state = await holder.standing();
+      const state = await holder.claim();
       if (state.status === "pending") {
         continue;
       }
@@ -2740,8 +2749,8 @@ const projectPackToken: Command = async (args, io) => {
       set: (token) => project.setPackToken({ token }),
       remove: () => project.removePackToken(),
       connect: () => project.connectPackToken(),
-      async standing() {
-        const state = await project.packTokenConnection();
+      async claim() {
+        const state = await project.claimPackTokenConnection();
         return state.status === "connected" ? { status: "connected", held: state.project } : state;
       },
     },
@@ -3122,6 +3131,10 @@ function hintFor(error: ApiError, io: CliIo, seen: ConsoleSeen): string {
       return `Install the console's version: ${updateWords(io, seen.version)}; or ask the console's operator to update the console.\n`;
     case "auth.required":
       return "The token is not one the console knows, any more or at all. A person signs the command in again: console login\n";
+    case "auth.deactivated":
+      return "Tell the person: they are taken back in on the People page, by an administrator or by their organization, and this token works again then. console logout forgets it here meanwhile.\n";
+    case "auth.not_admitted":
+      return "Tell the person: they are back in when what let them in is named again, or when an administrator lists their login and they sign in again, and this token works again then. console logout forgets it here meanwhile.\n";
     case "project.not_found":
       return "No project has this key, or it is not yours to see. console projects lists the projects you may work in.\n";
     case "document.not_found":
@@ -3146,6 +3159,20 @@ function hintFor(error: ApiError, io: CliIo, seen: ConsoleSeen): string {
       return "What was asked is an administrator's, or an owner's of the project, and the person this token acts as is not one here. Hand the step to them.\n";
     case "project.key_taken":
       return "A project has that key already. console projects lists them.\n";
+    case "project.too_many":
+      return "The workspace holds as many projects as one may. Work goes on in a project there is.\n";
+    case "project.too_many_bytes":
+      return "The project's files hold as many bytes together as this console allows. Hand in a link to where the file is instead, and say so in the report.\n";
+    case "task.too_many":
+      return "The project holds as many tasks as one may, those put away counted. The work goes on in another project; ask the person which.\n";
+    case "goal.too_many":
+      return "The project holds as many goals as one may. console goals lists them; one done or dropped is still a goal.\n";
+    case "decision.too_many":
+      return "The project holds as many decisions as one may. Ask the person in the report instead.\n";
+    case "document.too_many":
+      return "The project holds as many pages as one may. Write on a page there is: console docs lists them.\n";
+    case "run.too_many":
+      return "The task has been taken as many times as one may. Write a new task for what is left, and take that.\n";
     case "project.invalid_address":
       return "The skills address is not one as SkillCDN spells it; none makes the organization's skills the project's.\n";
     case "project.invalid_icon":

package/src/cli/help.ts

@@ -7,11 +7,14 @@ import {
   MAX_CATEGORY_KEY_LENGTH,
   MAX_CATEGORY_NAME_LENGTH,
   MAX_COMMENTS_PER_TASK,
+  MAX_DECISIONS_PER_PROJECT,
   MAX_DOCUMENT_LENGTH,
   MAX_DOCUMENT_PATH_LENGTH,
+  MAX_DOCUMENTS_PER_PROJECT,
   MAX_FILE_BYTES,
   MAX_FILES_PER_COMMENT,
   MAX_FILES_PER_DOCUMENT,
+  MAX_GOALS_PER_PROJECT,
   MAX_LINK_LABEL_LENGTH,
   MAX_NOTE_LENGTH,
   MAX_OPTION_LABEL_LENGTH,
@@ -21,11 +24,14 @@ import {
   MAX_PROJECT_KEY_LENGTH,
   MAX_PROJECT_NAME_LENGTH,
   MAX_PROJECT_SYMBOL_LENGTH,
+  MAX_PROJECTS_PER_WORKSPACE,
   MAX_QUESTION_LENGTH,
   MAX_REPORTS_PER_RUN,
   MAX_RULES_LENGTH,
+  MAX_RUNS_PER_TASK,
   MAX_SEARCH_LENGTH,
   MAX_SUMMARY_LENGTH,
+  MAX_TASKS_PER_PROJECT,
   MAX_TITLE_LENGTH,
   MAX_VERSIONS_PER_DOCUMENT,
   MAX_WORKERS,
@@ -59,6 +65,7 @@ export interface CommandHelp {
 /** The refusals any command may meet, said once in the overview. */
 const COMMON_REFUSALS = [
   "auth.required: the token is not one the console knows, any more or at all; a person signs the command in again",
+  "auth.deactivated, auth.not_admitted: the person this token acts as is out, deactivated or no longer let in; the console keeps the token, and it works again when they are back in",
   "request.invalid: what was sent is over a limit or malformed; the message names the field",
   "network: the console could not be reached at its address",
 ];
@@ -171,8 +178,13 @@ export const COMMAND_HELP: Readonly<Record<string, CommandHelp>> = {
       `title: one line, up to ${MAX_TITLE_LENGTH} characters, saying what is to be done on its own; what it refers to goes in the body`,
       `body: ${MARKDOWN}`,
       ...TASK_FIELD_LIMITS,
+      `at most ${MAX_TASKS_PER_PROJECT} tasks in one project, those put away counted`,
+    ],
+    refusals: [
+      "task.not_found: no task has that number or id",
+      ...TASK_FIELD_REFUSALS,
+      "task.too_many: the project holds as many tasks as one may; the work goes on in another project",
     ],
-    refusals: ["task.not_found: no task has that number or id", ...TASK_FIELD_REFUSALS],
   },
   goals: {
     usage:
@@ -193,11 +205,13 @@ export const COMMAND_HELP: Readonly<Record<string, CommandHelp>> = {
       `title: one line, up to ${MAX_TITLE_LENGTH} characters`,
       `body: ${MARKDOWN}`,
       `starts, due: ${DAY}`,
+      `at most ${MAX_GOALS_PER_PROJECT} goals in one project`,
     ],
     refusals: [
       "goal.not_found: no goal of this project has that id",
       "goal.invalid_category: no category of the workspace has that key",
       "goal.invalid_dates: the target day is before the start",
+      "goal.too_many: the project holds as many goals as one may",
       "auth.forbidden: only an owner of the project sets its roadmap",
     ],
   },
@@ -259,11 +273,13 @@ export const COMMAND_HELP: Readonly<Record<string, CommandHelp>> = {
       `name: one line, up to ${MAX_PROJECT_NAME_LENGTH} characters; description: up to ${MAX_PROJECT_DESCRIPTION_LENGTH}`,
       `color: ${COLORS}; symbol: up to ${MAX_PROJECT_SYMBOL_LENGTH} characters without spaces, shown on the colour; left out, the pages choose both from the key and the name`,
       `image: a PNG, a JPEG, a GIF or a WebP of at most ${MAX_PROJECT_ICON_BYTES} bytes`,
+      `at most ${MAX_PROJECTS_PER_WORKSPACE} projects in the workspace`,
     ],
     refusals: [
       "project.not_found: no project has that key, or it is not yours to see",
-      "auth.forbidden: only an owner of the project changes it",
+      "auth.forbidden: only an administrator makes a project, and only an owner changes it",
       "project.key_taken: a project has that key already",
+      "project.too_many: the workspace holds as many projects as one may",
       "project.invalid_address: the skills address is not one as SkillCDN spells it",
       "project.invalid_icon: the file is not an image of those kinds, by its bytes",
       "request.too_large: the image is over the limit",
@@ -358,10 +374,14 @@ export const COMMAND_HELP: Readonly<Record<string, CommandHelp>> = {
     synopsis: "Takes a task: a run begins, and the task is in progress and the person's.",
     about:
       "Takes a task: a run begins, and the task is in progress and the person's; the run's id and the task's id are printed on a line of their own, then the task, then the rules of the board. A run still open on the task is taken over, since the board cannot know whether its agent still runs: it ends as abandoned, the feed says who took over, and that agent is refused on its next command; console task <number> shows the runs on a task, with when each was last heard from, before it is taken. --agent is what people see at work; left out, it is what the person called the token.",
-    limits: [`agent: one line, up to ${MAX_AGENT_LENGTH} characters`],
+    limits: [
+      `agent: one line, up to ${MAX_AGENT_LENGTH} characters`,
+      `at most ${MAX_RUNS_PER_TASK} runs on one task`,
+    ],
     refusals: [
       "task.not_found: no task has that number or id",
       "run.task_closed: the task is done or dropped",
+      "run.too_many: the task has been taken as many times as one may; write a new task for what is left",
     ],
   },
   report: {
@@ -391,6 +411,7 @@ export const COMMAND_HELP: Readonly<Record<string, CommandHelp>> = {
       ...RUN_REFUSALS,
       "run.too_many_artifacts: the run carries as many as one may",
       "request.too_large: the file is over the limit",
+      "project.too_many_bytes: the project's files hold as many bytes together as this console allows; hand in a link instead",
     ],
   },
   ask: {
@@ -406,11 +427,13 @@ export const COMMAND_HELP: Readonly<Record<string, CommandHelp>> = {
       `options: ${MIN_OPTIONS} to ${MAX_OPTIONS}, each one line up to ${MAX_OPTION_LABEL_LENGTH} characters`,
       `body: ${MARKDOWN}`,
       "to: a login of the project, or me",
+      `at most ${MAX_DECISIONS_PER_PROJECT} decisions in one project`,
     ],
     refusals: [
       ...RUN_CHOICE,
       "decision.invalid_run: the run is not yours, or is over",
       "decision.invalid_decider: the person named may not work in the project",
+      "decision.too_many: the project holds as many decisions as one may",
     ],
   },
   answer: {
@@ -494,6 +517,7 @@ export const COMMAND_HELP: Readonly<Record<string, CommandHelp>> = {
       "comment.too_many: the task carries as many comments as one may",
       "comment.too_many_files: more files than one comment may carry",
       "request.too_large: the files are over the limit together",
+      "project.too_many_bytes: the project's files hold as many bytes together as this console allows; say where the file is instead",
     ],
   },
   file: {
@@ -525,13 +549,14 @@ export const COMMAND_HELP: Readonly<Record<string, CommandHelp>> = {
       `path: ${DOCUMENT_PATH}`,
       `title: one line, up to ${MAX_TITLE_LENGTH} characters`,
       `body: Markdown, up to ${MAX_DOCUMENT_LENGTH} characters`,
-      `at most ${MAX_VERSIONS_PER_DOCUMENT} versions of one page`,
+      `at most ${MAX_VERSIONS_PER_DOCUMENT} versions of one page, and ${MAX_DOCUMENTS_PER_PROJECT} pages in one project`,
     ],
     refusals: [
       "document.invalid_path: the path is not one",
       "document.conflict: the page has moved on since --base; read it again",
       "document.archived: the page is archived; restore it first",
       "document.too_many_versions: the page carries as many versions as one may; write a new page",
+      "document.too_many: the project holds as many pages as one may; write on a page there is",
     ],
   },
   attach: {
@@ -548,6 +573,7 @@ export const COMMAND_HELP: Readonly<Record<string, CommandHelp>> = {
       "document.archived: the page is archived; restore it first",
       "document.too_many_files: the page carries as many files as one may",
       "request.too_large: the file is over the limit",
+      "project.too_many_bytes: the project's files hold as many bytes together as this console allows; link to where the file is instead",
     ],
   },
   archive: {

package/src/client.ts

@@ -208,6 +208,8 @@ export interface EventFilter {
   readonly run?: string | undefined;
   readonly decision?: string | undefined;
   readonly document?: string | undefined;
+  /** True for the newest events, oldest first, and whether there are earlier ones; `after` is not looked at then. */
+  readonly latest?: boolean | undefined;
 }
 
 /** One page of a listing: how many items, from which one on; the server's bounds apply. */
@@ -364,8 +366,14 @@ export interface ProjectClient {
   removePackToken(): Promise<RestProject>;
   /** Asks the deployment to connect the project's pack with a code a person approves (ADR-0036); for an owner. */
   connectPackToken(): Promise<RestPackConnectStarted>;
-  /** How that connection stands; the token is kept when the person approved. For an owner. */
+  /** How that connection stands, read and changed nothing: pending, ended, or none; for an owner. */
   packTokenConnection(signal?: AbortSignal): Promise<RestPackConnect>;
+  /**
+   * Asks the console to claim the token at the deployment (ADR-0046): pending while the person
+   * has not approved, connected once, the token kept and the project as it stands, or ended;
+   * for an owner.
+   */
+  claimPackTokenConnection(signal?: AbortSignal): Promise<RestPackConnect>;
   /** Gives the connection up; for an owner. */
   cancelPackTokenConnection(): Promise<void>;
   /** The rules that hold in the project (ADR-0023): the workspace's, and what the project adds. */
@@ -414,6 +422,7 @@ export interface ConsoleClient {
   removeWorkspacePackToken(): Promise<RestWorkspace>;
   connectWorkspacePackToken(): Promise<RestPackConnectStarted>;
   workspacePackTokenConnection(signal?: AbortSignal): Promise<RestWorkspacePackConnect>;
+  claimWorkspacePackTokenConnection(signal?: AbortSignal): Promise<RestWorkspacePackConnect>;
   cancelWorkspacePackTokenConnection(): Promise<void>;
   /** The people the asker may see: everyone, or those they share a project with (ADR-0035). */
   people(signal?: AbortSignal): Promise<RestPeople>;
@@ -436,6 +445,8 @@ export interface ConsoleClient {
   project(key: string): ProjectClient;
   /** The workspace's own events, the ones about no project, after event number `after`. */
   events(after: number, signal?: AbortSignal): Promise<RestEvents>;
+  /** Where a picture from elsewhere is read through the console (ADR-0048), given the https URL that names it. */
+  pictureUrl(url: string): string;
   /** The categories tasks are sorted into (ADR-0019), by name. */
   categories(signal?: AbortSignal): Promise<RestCategories>;
   /** The workspace's rules (ADR-0023): the console's own until an administrator writes the organization's. */
@@ -752,6 +763,7 @@ export function createClient(options: ClientOptions = {}): ConsoleClient {
           "GET",
           withQuery(at("events"), {
             after: String(after),
+            latest: filter.latest === true ? "true" : undefined,
             task: filter.task,
             run: filter.run,
             decision: filter.decision,
@@ -828,6 +840,14 @@ export function createClient(options: ClientOptions = {}): ConsoleClient {
           restPackConnectSchema,
           signal,
         ),
+      claimPackTokenConnection: (signal) =>
+        request(
+          "POST",
+          `${base}${at()}/pack-token/connect/claim`,
+          undefined,
+          restPackConnectSchema,
+          signal,
+        ),
       cancelPackTokenConnection: () =>
         request("DELETE", `${base}${at()}/pack-token/connect`, undefined, undefined),
       rules: (signal) =>
@@ -931,6 +951,14 @@ export function createClient(options: ClientOptions = {}): ConsoleClient {
         restWorkspacePackConnectSchema,
         signal,
       ),
+    claimWorkspacePackTokenConnection: (signal) =>
+      request(
+        "POST",
+        `${base}${REST_ROUTES.workspacePackToken}/connect/claim`,
+        undefined,
+        restWorkspacePackConnectSchema,
+        signal,
+      ),
     cancelWorkspacePackTokenConnection: () =>
       request("DELETE", `${base}${REST_ROUTES.workspacePackToken}/connect`, undefined, undefined),
     updatePerson: (id, patch) =>
@@ -952,6 +980,7 @@ export function createClient(options: ClientOptions = {}): ConsoleClient {
         restEventsSchema,
         signal,
       ),
+    pictureUrl: (url) => withQuery(REST_ROUTES.pictures, { src: url }),
     categories: (signal) =>
       request("GET", `${base}${REST_ROUTES.categories}`, undefined, restCategoriesSchema, signal),
     rules: (signal) =>

package/src/compat.ts

@@ -113,7 +113,7 @@ export interface ClientPolicy {
  * last changed what the command reads or sends (ADR-0038), whose changelog entry begins with
  * `Breaking:`; `pnpm check` holds it to a version the package has, or is about to have.
  */
-export const CLIENT_POLICY: ClientPolicy = { atLeast: "0.4.0" };
+export const CLIENT_POLICY: ClientPolicy = { atLeast: "0.4.1" };
 
 /**
  * The oldest console this command works with (ADR-0038): raised by the release that last
@@ -122,7 +122,7 @@ export const CLIENT_POLICY: ClientPolicy = { atLeast: "0.4.0" };
  * itself, naming the command to install instead; `pnpm check` holds it as it holds the
  * console's floor.
  */
-export const CONSOLE_AT_LEAST = "0.4.0";
+export const CONSOLE_AT_LEAST = "0.4.1";
 
 /** `common` from `atLeast` on, where that floor is within it; `common` as it is otherwise. */
 function narrowed(common: VersionRange, atLeast: string | undefined): VersionRange {