@skillcdn/console 0.4.3 → 0.4.5

package/src/plugin.ts

@@ -29,6 +29,7 @@ export {
   type CapabilityWords,
   capabilityWords,
   isPluginCapability,
+  OUTBOUND_WEBRTC,
   outboundAllows,
   PLUGIN_CAPABILITIES,
   PLUGIN_CAPABILITY_PREFIXES,
@@ -72,8 +73,11 @@ export { PluginDefinitionError } from "./plugin/definition-error.js";
 export * from "./plugin/limits.js";
 export {
   CURRENT_PLUGIN_API,
+  capabilitiesAsked,
+  isCalendarDay,
   isPluginKey,
   type Localized,
+  legacyWidgetSize,
   localizedText,
   type ManifestParse,
   PLUGIN_API_MAJORS,
@@ -83,6 +87,8 @@ export {
   PLUGIN_PAGE_LEVELS,
   PLUGIN_SETTING_TYPES,
   PLUGIN_WIDGET_PLACES,
+  PLUGIN_WIDGET_SIZE_CELLS,
+  PLUGIN_WIDGET_SIZE_NAMES,
   PLUGIN_WIDGET_SIZES,
   type PluginBoard,
   type PluginBoardNeeds,
@@ -93,16 +99,20 @@ export {
   type PluginPageLevel,
   type PluginRole,
   type PluginSetting,
+  type PluginSettingGroup,
   type PluginSettingType,
   type PluginWidget,
   type PluginWidgetPlace,
   type PluginWidgetSize,
+  type PluginWidgetSizeName,
   parsePluginManifest,
   pluginManifestSchema,
   RESERVED_COMMAND_NAMES,
   RESERVED_PAGE_KEYS,
   RESERVED_PLUGIN_KEYS,
   SETTING_KEY_PATTERN,
+  TIME_OF_DAY,
+  widgetSizesOf,
 } from "./plugin/manifest.js";
 export {
   isPluginError,
@@ -124,3 +134,12 @@ export {
   REMOVED_GLOBALS,
   removedGlobalsIn,
 } from "./plugin/sandbox.js";
+export {
+  compareTriples,
+  formatTriple,
+  lineRangeFrom,
+  parseLooseVersion,
+  satisfiesRange,
+  type Triple,
+  versionOfDependency,
+} from "./plugin/semver.js";

package/src/router.ts

@@ -96,6 +96,10 @@ export type Route =
   | { readonly name: "people" }
   /** The form where an administrator lets someone in by login (ADR-0022). */
   | { readonly name: "new-listing" }
+  /** The teams of the workspace (ADR-0073), a view of the people's page. */
+  | { readonly name: "teams" }
+  /** The form where an administrator makes a team. */
+  | { readonly name: "new-team" }
   /** The agents of one person, for an administrator. */
   | { readonly name: "person-agents"; readonly id: string }
   /** Another person's plate, for whoever oversees them: a day of the week shown at the top, or today's. */
@@ -107,6 +111,8 @@ export type Route =
   | { readonly name: "work"; readonly week: string | undefined }
   /** The decisions addressed to the person (ADR-0042), across the projects they may see. */
   | { readonly name: "my-decisions" }
+  /** One decision wherever it is (ADR-0068), for whoever it reaches: in a project they may see or not. */
+  | { readonly name: "my-decision"; readonly id: string }
   /** The categories tasks are sorted into; an administrator keeps them here. */
   | { readonly name: "categories" }
   /** Where a person approves an agent's connection, by the code it showed, or types one. */
@@ -166,6 +172,10 @@ export const PATHS = {
   people: "/people",
   /** The form where an administrator lets someone in by login. */
   newListing: "/people/new",
+  /** The teams of the workspace, a view of the people's page. */
+  teams: "/people/teams",
+  /** The form where an administrator makes a team. */
+  newTeam: "/people/teams/new",
   /** The agents of whoever is signed in, which hold their tokens: their own page. */
   agents: "/agents",
   /** The form for a token made by hand, for a script or a console of one's own. */
@@ -293,12 +303,22 @@ export function matchRoute(pathname: string, search = ""): Route {
   if (path === PATHS.decisions) {
     return { name: "my-decisions" };
   }
+  if (path.startsWith(`${PATHS.decisions}/`)) {
+    const id = path.slice(PATHS.decisions.length + 1);
+    return UUID.test(id) ? { name: "my-decision", id } : NOT_FOUND;
+  }
   if (path === PATHS.people) {
     return { name: "people" };
   }
   if (path === PATHS.newListing) {
     return { name: "new-listing" };
   }
+  if (path === PATHS.teams) {
+    return { name: "teams" };
+  }
+  if (path === PATHS.newTeam) {
+    return { name: "new-team" };
+  }
   if (path === PATHS.agents) {
     return { name: "agents" };
   }
@@ -569,6 +589,11 @@ export function decisionsHref(key: string, page?: number): string {
 }
 
 /** Where the person's own work is, with the week of a day at the top, or this week's when none is named. */
+/** Where one decision is read wherever it is (ADR-0068), by whoever it reaches: a person outside its project too. */
+export function myDecisionHref(id: string): string {
+  return `${PATHS.decisions}/${id}`;
+}
+
 export function workHref(week?: string): string {
   return week === undefined ? PATHS.work : `${PATHS.work}?week=${week}`;
 }

package/src/routes.ts

@@ -17,6 +17,8 @@ export const REST_ROUTES = {
   workspacePackToken: "/api/v1/workspace/pack-token",
   /** The people of the workspace: everyone who has signed in, and the logins let in that have not. */
   people: "/api/v1/people",
+  /** The teams of the workspace (ADR-0073): a name and its members, kept by an administrator. */
+  teams: "/api/v1/teams",
   /** The logins an administrator let in (ADR-0022), made and removed by one. */
   listings: "/api/v1/listings",
   /** The projects the asker may see; the board of each is under its key. */
@@ -68,6 +70,19 @@ export function personWorkPath(personId: string): string {
   return `${restPath("people", personId)}/work`;
 }
 
+/** The REST path of one decision wherever it is (ADR-0068), by its id; `/answer` under it answers. */
+export function decisionPath(id: string): string {
+  return `${REST_ROUTES.decisions}/${encodeURIComponent(id)}`;
+}
+
+/**
+ * The REST path of a file put on a decision (ADR-0055), read at the decision's own address, for
+ * whoever the decision reaches wherever it is (ADR-0068), in a project they may see or not.
+ */
+export function decisionFilePath(decisionId: string, fileId: string): string {
+  return `${decisionPath(decisionId)}/files/${encodeURIComponent(fileId)}`;
+}
+
 /** The REST path of a person's tokens, or of one of them: for an administrator. */
 export function personTokensPath(personId: string, tokenId?: string): string {
   const base = `${restPath("people", personId)}/tokens`;
@@ -126,9 +141,9 @@ export function signInPath(page: string, failure: SignInFailure): string {
   return `${page}${page.includes("?") ? "&" : "?"}${SIGN_IN_PARAM}=${failure}`;
 }
 
-/** The REST path of one person, listing, token or project: the collection, then the id or the key. */
+/** The REST path of one person, listing, token, project or team: the collection, then the id or the key. */
 export function restPath(
-  collection: "people" | "listings" | "tokens" | "projects",
+  collection: "people" | "listings" | "tokens" | "projects" | "teams",
   id: string,
 ): string {
   return `${REST_ROUTES[collection]}/${encodeURIComponent(id)}`;

package/src/rules.ts

@@ -83,7 +83,7 @@ export function isReferenceRules(body: string): boolean {
 /** What stands in the rules for the language of the person the agent works for. */
 export const RULES_LANGUAGE_PLACEHOLDER = "{language}";
 
-/** What the rules say when the person chose no language: the task's, as the people of the board wrote it. */
+/** What the rules say for a person with no language yet: the task's, as the people of the board wrote it. */
 const TASKS_LANGUAGE = "the language the task is written in";
 
 /** The name of a language in English, from its tag (`ko` is Korean); the tag itself when it is not one. */
@@ -101,8 +101,8 @@ export function languageNameOf(tag: string): string {
 
 /**
  * The rules as they read for a person: `{language}` filled with the name of the language they
- * chose for the pages, or with the task's language when they chose none. The command fills
- * them for the person whose token it holds; the pages for whoever reads them.
+ * read in (ADR-0065), or with the task's language while they have none. The command fills them
+ * for the person whose token it holds; the pages for whoever reads them.
  */
 export function fillRules(body: string, language: string | null | undefined): string {
   const name = language == null ? TASKS_LANGUAGE : languageNameOf(language);

package/src/schemas.ts

@@ -16,9 +16,12 @@ import {
   MAX_BODY_LENGTH,
   MAX_CATEGORY_KEY_LENGTH,
   MAX_CATEGORY_NAME_LENGTH,
+  MAX_DECIDERS,
   MAX_DOCUMENT_LENGTH,
   MAX_DOCUMENT_PATH_LENGTH,
   MAX_FILE_NAME_LENGTH,
+  MAX_HOME_ROW,
+  MAX_HOME_TILES,
   MAX_LANGUAGE_TAG_LENGTH,
   MAX_LINK_LABEL_LENGTH,
   MAX_LINKS,
@@ -35,6 +38,8 @@ import {
   MAX_SECRET_LENGTH,
   MAX_SKILLS_ADDRESS_LENGTH,
   MAX_SUMMARY_LENGTH,
+  MAX_TEAM_KEY_LENGTH,
+  MAX_TEAM_NAME_LENGTH,
   MAX_TITLE_LENGTH,
   MAX_TOKEN_DAYS,
   MAX_TOKEN_NAME_LENGTH,
@@ -42,6 +47,7 @@ import {
   MAX_WORKERS,
   MIN_OPTIONS,
 } from "./limits.js";
+import { PLUGIN_WIDGET_SIZE_NAMES } from "./plugin/manifest.js";
 import { hasForbiddenCodePoint } from "./text.js";
 import {
   ARTIFACT_KINDS,
@@ -100,6 +106,14 @@ const day = z.iso.date();
 const count = z.int().check(z.nonnegative());
 
 /** A person of the workspace, as the pages show them. Nothing here is a secret. */
+/** A language tag as a browser sends one (`en`, `ko-KR`). */
+const languageTag = z
+  .string()
+  .check(
+    z.maxLength(MAX_LANGUAGE_TAG_LENGTH),
+    z.regex(/^[A-Za-z]{2,8}(?:-[A-Za-z0-9]{1,8})*$/, "must be a language tag"),
+  );
+
 export const restPersonSchema = z.object({
   id: uuid,
   /** What the account is called at its provider: a login at the git host, an address at Google. */
@@ -116,6 +130,28 @@ export const restPersonSchema = z.object({
   source: z.enum(MEMBERSHIP_SOURCES),
   /** When they were deactivated, or `null`. */
   deactivatedAt: z.nullable(instant),
+  /**
+   * The id of the person they report to, the reporting line of the directory an administrator
+   * keeps, or `null` for nobody; what a plugin reads as the default approver, the default
+   * assignee, in place of a line of its own. Answered from 0.4.4 and read as optional, so that
+   * a console built on this package still reads an older console's people.
+   */
+  managerId: z.optional(z.nullable(uuid)),
+  /** The teams the person is in (ADR-0073), by their keys (ADR-0074): on the people listing and to a plugin, from 0.4.5, and read as optional. */
+  teams: z.optional(z.array(z.string())),
+  /**
+   * The language the person reads in (ADR-0065), a tag: the one they chose, else the one the pages
+   * first saw them in; `null` until they have opened the pages. What a plugin or an agent writes
+   * for them in. Answered from 0.4.4 and read as optional, as `managerId` is.
+   */
+  language: z.optional(z.nullable(languageTag)),
+  /**
+   * The person's work email, lowercase: the address they sign in with at Google, else what an
+   * administrator wrote; `null` until known. Answered to an administrator and to the person
+   * themselves alone, and left out everywhere else, so that a task's owner or a comment's author
+   * carries none. Answered from 0.4.5 and read as optional.
+   */
+  email: z.optional(z.nullable(z.string())),
 });
 export type RestPerson = z.infer<typeof restPersonSchema>;
 
@@ -163,6 +199,47 @@ export const restListingInputSchema = z
   .check(z.refine((input) => isLoginAt(input.host, input.login), "must be a login at the host"));
 export type RestListingInput = z.infer<typeof restListingInputSchema>;
 
+/**
+ * A team's key (ADR-0074): what its addresses, a grant, a plugin and the command call it. A
+ * project key's shape, one name among the teams' keys and the projects' keys of a workspace;
+ * immutable once the team is made.
+ */
+const teamKey = z.string().check(
+  z.maxLength(MAX_TEAM_KEY_LENGTH),
+  z.regex(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/, "must be lowercase letters, digits and hyphens"),
+  z.refine((key) => key !== "new", "is a word the pages reserve"),
+);
+
+/** A team of the workspace (ADR-0073): its key, its name and who is in it, among the people the asker may see. */
+export const restTeamSchema = z.object({
+  id: uuid,
+  key: z.string(),
+  name: z.string(),
+  memberIds: z.array(uuid),
+  createdAt: instant,
+});
+export type RestTeam = z.infer<typeof restTeamSchema>;
+
+export const restTeamsSchema = z.object({ items: z.array(restTeamSchema) });
+export type RestTeams = z.infer<typeof restTeamsSchema>;
+
+/** What `POST /api/v1/teams` is sent: the key, which stays, and the name. */
+export const restTeamInputSchema = z.object({
+  key: teamKey,
+  name: line(MAX_TEAM_NAME_LENGTH),
+});
+export type RestTeamInput = z.infer<typeof restTeamInputSchema>;
+
+/** What `PATCH /api/v1/teams/<key>` is sent: the name; the key never changes. */
+export const restTeamPatchSchema = z.object({
+  name: line(MAX_TEAM_NAME_LENGTH),
+});
+export type RestTeamPatch = z.infer<typeof restTeamPatchSchema>;
+
+/** What `POST /api/v1/teams/<key>/members` is sent. */
+export const restTeamMemberInputSchema = z.object({ personId: uuid });
+export type RestTeamMemberInput = z.infer<typeof restTeamMemberInputSchema>;
+
 /** An identity provider people may sign in through, as the pages offer it. */
 export const restProviderSchema = z.object({
   key: z.enum(PROVIDER_KEYS),
@@ -195,16 +272,59 @@ export const timeZoneName = z
     z.regex(/^[A-Za-z0-9_+-]+(?:\/[A-Za-z0-9_+-]+)*$/, "must be a time zone name"),
   );
 
-/** A language tag as a browser sends one (`en`, `ko-KR`): what the pages speak, by the person's choice. */
-const languageTag = z
+/** What `PATCH /api/v1/me` is sent: the language the person chose, or `null` to choose none. */
+/** The sizes of a tile on the front page (ADR-0061): a project's icon, and the widgets' family. */
+export const HOME_TILE_SIZES = ["icon", ...PLUGIN_WIDGET_SIZE_NAMES] as const;
+
+/** A tile by what it is: a project by its id, a widget by its plugin's key and its own. */
+const homeTileId = z
   .string()
   .check(
-    z.maxLength(MAX_LANGUAGE_TAG_LENGTH),
-    z.regex(/^[A-Za-z]{2,8}(?:-[A-Za-z0-9]{1,8})*$/, "must be a language tag"),
+    z.regex(
+      /^(?:project:[0-9a-f-]{36}|widget:[a-z][a-z0-9-]{0,31}:[a-z][a-z0-9-]{0,31})$/,
+      "must name a project or a widget",
+    ),
   );
 
-/** What `PATCH /api/v1/me` is sent: the language the person chose, or `null` to choose none. */
-export const restMePatchSchema = z.object({ language: z.nullable(languageTag) });
+/** One tile of a person's own front page, at a place of the grid and at a size. */
+export const restHomeTileSchema = z.object({
+  tile: homeTileId,
+  x: z.int().check(z.gte(0), z.lte(11)),
+  y: z.int().check(z.gte(0), z.lte(MAX_HOME_ROW)),
+  size: z.enum(HOME_TILE_SIZES),
+});
+export type RestHomeTile = z.infer<typeof restHomeTileSchema>;
+
+const homeLayoutSchema = z.array(restHomeTileSchema).check(z.maxLength(MAX_HOME_TILES));
+
+/**
+ * A person's own front page (ADR-0061): the tiles they took off it, which stay off, and what
+ * they arranged at each width of the grid, by its columns; what they have not seen yet takes
+ * the first room.
+ */
+export const restHomeSchema = z.object({
+  hidden: z.array(homeTileId).check(z.maxLength(MAX_HOME_TILES)),
+  layouts: z.object({
+    12: z.optional(homeLayoutSchema),
+    8: z.optional(homeLayoutSchema),
+    6: z.optional(homeLayoutSchema),
+    4: z.optional(homeLayoutSchema),
+  }),
+});
+export type RestHome = z.infer<typeof restHomeSchema>;
+
+/** What `PATCH /api/v1/me` is sent: the language, the front page, either or both; `null` lets the console choose. */
+export const restMePatchSchema = z
+  .object({
+    language: z.optional(z.nullable(languageTag)),
+    home: z.optional(z.nullable(restHomeSchema)),
+  })
+  .check(
+    z.refine(
+      (patch) => patch.language !== undefined || patch.home !== undefined,
+      "must name a language or the front page",
+    ),
+  );
 export type RestMePatch = z.infer<typeof restMePatchSchema>;
 
 /**
@@ -274,8 +394,13 @@ export const restMeSchema = z.object({
    * person's own knows it holds one. `null` on a session, and for nobody.
    */
   agent: z.nullable(z.string()),
-  /** The language the person chose for the pages (ADR-0012), or `null` for the browser's. */
+  /** The language the person reads in (ADR-0065): the one they chose, else the one the pages first saw them in; `null` until then. */
   language: z.nullable(languageTag),
+  /**
+   * The person's own front page (ADR-0061), or `null` while they have arranged nothing; answered
+   * from 0.4.4 and read as optional.
+   */
+  home: z.optional(z.nullable(restHomeSchema)),
   signIn: z.array(restProviderSchema),
   /**
    * The console's version and the range of command versions it takes, as npm spells one
@@ -313,11 +438,19 @@ export const restPersonPatchSchema = z
   .object({
     role: z.optional(z.enum(PERSON_ROLES)),
     status: z.optional(z.enum(PERSON_STATUSES)),
+    /** Whom the person reports to: another active person of the workspace, or `null` for nobody. */
+    managerId: z.optional(z.nullable(uuid)),
+    /** The person's work email, one per workspace, or `null` for none; an administrator's to write. */
+    email: z.optional(z.nullable(z.email().check(z.maxLength(254)))),
   })
   .check(
     z.refine(
-      (patch) => patch.role !== undefined || patch.status !== undefined,
-      "must name a role or a status",
+      (patch) =>
+        patch.role !== undefined ||
+        patch.status !== undefined ||
+        patch.managerId !== undefined ||
+        patch.email !== undefined,
+      "must name a role, a status, a manager or an email",
     ),
   );
 export type RestPersonPatch = z.infer<typeof restPersonPatchSchema>;
@@ -505,6 +638,8 @@ export const restTaskSchema = z.object({
   owner: restPersonSchema,
   /** The plugin that made it, by key (ADR-0052), or `null`; left out by a console older than the plugins. */
   plugin: z.optional(z.nullable(z.string())),
+  /** The agent the task was written through, or `null` when a person wrote it themselves (ADR-0056); the owner may have changed since. Left out by an older console. */
+  agent: z.optional(z.nullable(z.string())),
   /** The people at work on it (ADR-0037), in the order they came to it; `[]` while nobody is. */
   workers: z.array(restPersonSchema),
   /** The task this one is part of, or `null`. */
@@ -615,6 +750,8 @@ export const restGoalSchema = z.object({
   /** The day the goal is meant to be reached by, or `null`. */
   dueOn: z.nullable(day),
   createdBy: restPersonSchema,
+  /** The agent the goal was set through, or `null` when a person set it themselves (ADR-0056); left out by an older console. */
+  agent: z.optional(z.nullable(z.string())),
   /** The tasks that work towards it, counted by state. */
   taskCounts: restTaskCountsSchema,
   createdAt: instant,
@@ -714,8 +851,15 @@ export const restDecisionSchema = z.object({
   /** The task's number, when there is a task, or `null`. */
   taskNumber: z.nullable(z.int()),
   raisedBy: restPersonSchema,
-  /** Who is to answer (ADR-0042): the raiser, unless another person of the project was named. */
+  /** The first of those to answer (ADR-0042): the raiser, unless others of the project were named. */
   decider: restPersonSchema,
+  /**
+   * Everyone the decision is addressed to (ADR-0057), `decider` first: each finds it among their
+   * decisions, any of them may answer, and the first answer ends it. Answered from 0.4.4 and read
+   * as optional, so that a console built on this package still reads an older console's
+   * decisions, where it is `[decider]`.
+   */
+  deciders: z.optional(z.array(restPersonSchema)),
   /** The run that raised it, as the agent asked, or `null` when a person did. */
   run: z.nullable(z.object({ id: uuid, agent: z.string() })),
   /** The plugin that raised it, by key (ADR-0052), or `null`; left out by a console older than the plugins. */
@@ -729,10 +873,24 @@ export const restDecisionSchema = z.object({
       note: z.nullable(z.string()),
       by: restPersonSchema,
       at: instant,
+      /**
+       * The agent the answer came through, when the person's agent wrote it in their name
+       * (`console answer`, ADR-0021), or `null` when they answered themselves (ADR-0056).
+       * Answered from 0.4.4 and read as optional, so that a console built on this package still
+       * reads an older console's decisions.
+       */
+      agent: z.optional(z.nullable(z.string())),
     }),
   ),
   /** What followed the decision, in Markdown, written afterwards; `null` until someone does. */
   outcome: z.nullable(z.string()),
+  /**
+   * Who wrote what followed, the agent they wrote it through (`null` when themselves) and when
+   * (ADR-0056); each `null` until someone does. Answered from 0.4.4 and read as optional.
+   */
+  outcomeBy: z.optional(z.nullable(restPersonSchema)),
+  outcomeAgent: z.optional(z.nullable(z.string())),
+  outcomeAt: z.optional(z.nullable(instant)),
   /**
    * The files put on it when it was raised (ADR-0055), in the order they came; a picture among
    * them is shown where the context names it as `![words](its name)`, else after it. Answered
@@ -785,6 +943,18 @@ export const restMyDecisionsSchema = z.object({
 });
 export type RestMyDecisions = z.infer<typeof restMyDecisionsSchema>;
 
+/**
+ * `GET /api/v1/decisions/<id>`: one decision wherever it is (ADR-0068), in a project the asker
+ * may see or one that reaches them from elsewhere, with its project and whether they may answer
+ * it (`mayAnswer`, read as optional).
+ */
+export const restReachedDecisionSchema = z.object({
+  project: projectRef,
+  decision: restDecisionSchema,
+  mayAnswer: z.optional(z.boolean()),
+});
+export type RestReachedDecision = z.infer<typeof restReachedDecisionSchema>;
+
 /**
  * What `GET /api/v1/people/<id>/work` answers: another person's open tasks, and their closed
  * ones for the week, within the projects the asker may see, for whoever oversees them. No
@@ -820,6 +990,11 @@ export const restDecisionInputSchema = z.object({
   runId: z.optional(z.nullable(uuid)),
   /** Who is to answer (ADR-0042): a person who may work in the project; the asker when left out. */
   deciderId: z.optional(uuid),
+  /**
+   * Several to answer (ADR-0057), in place of `deciderId`: each a person who may work in the
+   * project, up to `MAX_DECIDERS`; any of them may answer, and the first answer ends the decision.
+   */
+  deciderIds: z.optional(z.array(uuid).check(z.minLength(1), z.maxLength(MAX_DECIDERS))),
 });
 export type RestDecisionInput = z.infer<typeof restDecisionInputSchema>;
 
@@ -873,6 +1048,12 @@ export const restEventDataSchema = z.object({
   /** For `person.role_changed` and the events about a project's members: whose role, and what it became. */
   login: z.optional(z.string()),
   role: z.optional(z.string()),
+  /** For `person.manager_changed`: the login of whom the person reports to now, or `null` for nobody. */
+  manager: z.optional(z.nullable(z.string())),
+  /** For the events about a team (ADR-0073), and for a role granted to one: its name; `team.renamed` holds the name before in `name`, and each event of a team its `key` (ADR-0074). */
+  team: z.optional(z.string()),
+  /** For `person.email_changed`: whether the person has an address now; never the address itself. */
+  set: z.optional(z.boolean()),
   /** For the events about a project: its key and its name. */
   key: z.optional(z.string()),
   name: z.optional(z.string()),
@@ -895,6 +1076,10 @@ export const restEventDataSchema = z.object({
   args: z.optional(z.record(z.string(), z.unknown())),
   /** For `plugin.enabled` and `plugin.configured`: the capabilities consented to. */
   capabilities: z.optional(z.array(z.string())),
+  /** For `plugin.configured` of a secret: `administrator`, or the host of the answer it was sealed from (ADR-0070). */
+  source: z.optional(z.string()),
+  /** For `plugin.granted` and `plugin.revoked`: the plugin the role went to, by key, where one did (ADR-0072). */
+  grantee: z.optional(z.string()),
   /** For `plugin.granted` and `plugin.revoked`: whether the role went to everyone. */
   everyone: z.optional(z.boolean()),
   /** For `plugin.failed`: what went wrong, in words for a person. */
@@ -921,6 +1106,8 @@ export const restEventSchema = z.object({
   goalId: z.nullable(uuid),
   /** The plugin that caused it, by key, or `null` (ADR-0052). */
   plugin: z.nullable(z.string()),
+  /** The plugin the person acted through (ADR-0072), by key, when one acted for them; answered from 0.4.5 and read as optional. */
+  via: z.optional(z.nullable(z.string())),
   data: restEventDataSchema,
   createdAt: instant,
 });