@skillcdn/console 0.4.4 → 0.4.5

package/src/plugin/rest-schemas.ts

@@ -7,6 +7,7 @@ import {
   MAX_PROJECT_DESCRIPTION_LENGTH,
   MAX_PROJECT_KEY_LENGTH,
   MAX_PROJECT_NAME_LENGTH,
+  MAX_TEAM_KEY_LENGTH,
 } from "../limits.js";
 import { PLUGIN_STATES } from "../vocabulary.js";
 import { ARG_TYPES } from "./args.js";
@@ -121,7 +122,15 @@ export const restPluginSchema = z.object({
   /** The asker's roles in the plugin; every role for an administrator. */
   roles: z.array(z.string()),
   /** The roles the plugin declares, by key, with their names. */
-  declaredRoles: z.array(z.object({ key: z.string(), name: localized, description: localized })),
+  declaredRoles: z.array(
+    z.object({
+      key: z.string(),
+      name: localized,
+      description: localized,
+      /** What the role follows, held with no grant: `reports`, whoever manages someone (ADR-0068); answered from 0.4.5 and read as optional. */
+      follows: z.optional(z.nullable(z.literal("reports"))),
+    }),
+  ),
   /** The role every member holds without a grant, or `null` where the manifest names none. */
   defaultRole: z.nullable(z.string()),
   menu: z.nullable(z.object({ group: z.string(), order: z.int(), name: z.nullable(localized) })),
@@ -170,6 +179,14 @@ export const restPluginSettingSchema = z.object({
   value: z.nullable(z.unknown()),
   /** When a secret was set, or `null`. */
   setAt: z.nullable(instant),
+  /** When a secret expires, or `null` (ADR-0070); answered from 0.4.5 and read as optional. */
+  expiresAt: z.optional(z.nullable(instant)),
+  /** `administrator` for a secret an administrator set, the host of the answer it was sealed from otherwise, `null` while unset. */
+  source: z.optional(z.nullable(z.string())),
+  /** The hosts a secret is pinned to, or `null` for any the plugin reaches. */
+  hosts: z.optional(z.nullable(z.array(z.string()))),
+  /** `verify` for a secret that verifies and signs nothing, or `null`. */
+  use: z.optional(z.nullable(z.literal("verify"))),
 });
 export type RestPluginSetting = z.infer<typeof restPluginSettingSchema>;
 
@@ -180,6 +197,10 @@ export const restPluginGrantSchema = z.object({
   person: z.nullable(z.object({ id: uuid, login: z.string(), name: z.nullable(z.string()) })),
   project: z.nullable(z.object({ key: z.string(), name: z.string() })),
   everyone: z.boolean(),
+  /** The plugin the role went to (ADR-0072), by key, or `null`; answered from 0.4.5 and read as optional. */
+  plugin: z.optional(z.nullable(z.string())),
+  /** The team the role went to (ADR-0073), whose members hold it, or `null`; answered from 0.4.5 and read as optional. */
+  team: z.optional(z.nullable(z.object({ key: z.string(), name: z.string() }))),
   createdAt: instant,
 });
 export type RestPluginGrant = z.infer<typeof restPluginGrantSchema>;
@@ -203,6 +224,28 @@ export const restPluginDetailSchema = z.extend(restPluginSchema, {
   grants: z.nullable(z.array(restPluginGrantSchema)),
   /** The plugin's own events are at this path. */
   events: z.string(),
+  /**
+   * Whether the plugin reads a time of day (a job at a time, a `time` setting) while the
+   * workspace has no time zone, so that its times run on UTC with nobody having said so: the
+   * pages and the command tell an administrator to set one. Answered from 0.4.5 and read as optional.
+   */
+  needsTimeZone: z.optional(z.boolean()),
+  /** The collections the plugin keeps for a while only, each with its days, so that an administrator reads what it forgets; answered from 0.4.5 and read as optional. */
+  keeps: z.optional(z.array(z.object({ collection: z.string(), days: z.int() }))),
+  /**
+   * What the manifest asks of other plugins (ADR-0072): a role of a plugin, why, and how it
+   * stands: granted, not yet, or the plugin is not enabled. Answered from 0.4.5 and read as optional.
+   */
+  asks: z.optional(
+    z.array(
+      z.object({
+        plugin: z.string(),
+        role: z.string(),
+        why: localized,
+        state: z.enum(["granted", "ungranted", "unavailable"]),
+      }),
+    ),
+  ),
 });
 export type RestPluginDetail = z.infer<typeof restPluginDetailSchema>;
 
@@ -254,15 +297,23 @@ export const restPluginGrantInputSchema = z
     role: pluginKey,
     person: z.optional(uuid),
     project: z.optional(projectKey),
+    /** A plugin, by key, to hold the role as itself (ADR-0072). */
+    plugin: z.optional(pluginKey),
+    /** A team, by its key (ADR-0074), whose members hold the role (ADR-0073). */
+    team: z.optional(z.string().check(z.minLength(1), z.maxLength(MAX_TEAM_KEY_LENGTH))),
     everyone: z.optional(z.literal(true)),
   })
   .check(
     z.refine(
       (input) =>
-        [input.person !== undefined, input.project !== undefined, input.everyone === true].filter(
-          Boolean,
-        ).length === 1,
-      "names a person, a project or everyone, one of the three",
+        [
+          input.person !== undefined,
+          input.project !== undefined,
+          input.plugin !== undefined,
+          input.team !== undefined,
+          input.everyone === true,
+        ].filter(Boolean).length === 1,
+      "names a person, a project, a plugin, a team or everyone, one of the five",
     ),
   );
 export type RestPluginGrantInput = z.infer<typeof restPluginGrantInputSchema>;
@@ -311,6 +362,12 @@ export const restPluginInvocationSchema = z.object({
   text: z.string(),
   data: z.unknown(),
   waiting: z.nullable(z.string()),
+  /**
+   * The key of the project the decision in `waiting` waits in, the one it was raised in, where
+   * the caller reaches it, else `null`; with nothing waiting, the plugin's board project's, or
+   * `null`. Answered from 0.4.5 and read as optional.
+   */
+  project: z.optional(z.nullable(z.string())),
 });
 export type RestPluginInvocation = z.infer<typeof restPluginInvocationSchema>;
 

package/src/plugin/testing.ts

@@ -38,6 +38,7 @@ import { PluginRefusal } from "./refusals.js";
 export interface TestConsoleOptions {
   readonly workspace?: PluginConsole["workspace"];
   readonly people?: Partial<PluginConsole["people"]>;
+  readonly teams?: Partial<PluginConsole["teams"]>;
   readonly projects?: Partial<PluginConsole["projects"]>;
   readonly tasks?: Partial<PluginConsole["tasks"]>;
   readonly decisions?: Partial<PluginConsole["decisions"]>;
@@ -45,6 +46,16 @@ export interface TestConsoleOptions {
   readonly runs?: Partial<PluginConsole["runs"]>;
 }
 
+/**
+ * Another plugin as a test gives it: its version and its api; and, where `for` is given, what it
+ * answers when called for a person. Without `for`, it answers the same for anyone.
+ */
+export interface TestOtherPlugin {
+  readonly version: string;
+  readonly api: OtherPlugin["api"];
+  readonly for?: ((personId: string) => TestOtherPlugin) | undefined;
+}
+
 export interface TestContextOptions {
   readonly plugin?: Partial<PluginInfo>;
   readonly caller?: PluginCaller;
@@ -56,7 +67,11 @@ export interface TestContextOptions {
   readonly fetch?: (url: string, init?: PluginFetchInit) => Promise<PluginFetchResponse>;
   /** The secrets by name; `sign` and `verify` use them, and never hand them over. */
   readonly secrets?: Readonly<Record<string, string>>;
-  readonly plugins?: Readonly<Record<string, OtherPlugin>>;
+  readonly plugins?: Readonly<Record<string, TestOtherPlugin>>;
+  /** The console's public origin, from which `ctx.endpoints.url` is answered; left out, it is `plugin.unavailable`. */
+  readonly publicUrl?: string;
+  /** The endpoints the plugin defines, by name, which `ctx.endpoints.url` answers for; any name when left out. */
+  readonly endpoints?: readonly string[];
   readonly now?: () => Date;
   readonly language?: string;
 }
@@ -226,7 +241,7 @@ function memoryRecords<T extends Record<string, unknown>>(
     }
     return found;
   };
-  const by = caller.kind === "person" ? caller.person.id : null;
+  const by = actingPersonOf(caller)?.id ?? null;
   const indexed = (field: string) => {
     if (
       collection !== undefined &&
@@ -520,14 +535,34 @@ function refusingConsole(given: TestConsoleOptions | undefined): PluginConsole {
     workspace:
       given?.workspace ?? (async () => forbidden("console.workspace", "console.workspace")),
     people: fill("people", ["list", "get", "granted"], given?.people),
+    teams: fill("teams", ["list", "get"], given?.teams),
     projects: fill("projects", ["list", "get", "members"], given?.projects),
     tasks: fill("tasks", ["list", "get", "create", "update", "comment"], given?.tasks),
-    decisions: fill("decisions", ["list", "get", "ask"], given?.decisions),
+    decisions: fill("decisions", ["list", "get", "ask", "answer"], given?.decisions),
     documents: fill("documents", ["list", "read", "write"], given?.documents),
     runs: fill("runs", ["list", "get"], given?.runs),
   };
 }
 
+/** The person a caller acts as: themselves, or the one a plugin acts for; none for the console or a plugin as itself. */
+function actingPersonOf(caller: PluginCaller) {
+  return caller.kind === "person"
+    ? caller.person
+    : caller.kind === "plugin"
+      ? (caller.for ?? undefined)
+      : undefined;
+}
+
+/** Another plugin as the context hands it over: `for` answers as the test said, or the same as for anyone. */
+function withFor(other: TestOtherPlugin): OtherPlugin {
+  const built: OtherPlugin = {
+    version: other.version,
+    api: other.api,
+    for: (personId) => (other.for === undefined ? built : withFor(other.for(personId))),
+  };
+  return built;
+}
+
 function build(store: Store, options: TestContextOptions, caller: PluginCaller): TestContext {
   const now = options.now ?? (() => new Date());
   const collections = new Map(
@@ -541,6 +576,7 @@ function build(store: Store, options: TestContextOptions, caller: PluginCaller):
     capabilities: [],
     board: null,
     projects: "all",
+    grants: [],
     ...options.plugin,
   };
   const secrets = options.secrets ?? {};
@@ -571,6 +607,12 @@ function build(store: Store, options: TestContextOptions, caller: PluginCaller):
     fetch: options.fetch ?? (async () => forbidden("fetch", "fetch")),
     secrets: {
       has: async (name) => name in secrets,
+      status: async (name) => ({
+        set: name in secrets,
+        setAt: name in secrets ? now().toISOString() : null,
+        expiresAt: null,
+        source: name in secrets ? "administrator" : null,
+      }),
       sign: async (name, payload) => {
         const secret = secrets[name];
         if (secret === undefined) {
@@ -591,12 +633,26 @@ function build(store: Store, options: TestContextOptions, caller: PluginCaller):
         if (other === undefined) {
           forbidden(`plugins.get(${key})`, `plugins.${key}`);
         }
-        return other;
+        return withFor(other);
+      },
+    },
+    endpoints: {
+      async url(name) {
+        if (options.endpoints !== undefined && !options.endpoints.includes(name)) {
+          throw new PluginRefusal("plugin.not_found", `the plugin defines no endpoint ${name}`);
+        }
+        if (options.publicUrl === undefined) {
+          throw new PluginRefusal(
+            "plugin.unavailable",
+            "this console has no public address (PUBLIC_URL) to reach its endpoints at",
+          );
+        }
+        return `${options.publicUrl}/api/v1/plugins/${encodeURIComponent(plugin.key)}/x/${encodeURIComponent(name)}`;
       },
     },
     log: { info: log("info"), warn: log("warn"), error: log("error") },
     now,
-    language: options.language ?? (caller.kind === "person" ? caller.person.language : "en"),
+    language: options.language ?? actingPersonOf(caller)?.language ?? "en",
     signal: new AbortController().signal,
     emitted: store.emitted,
     logged: store.logged,

package/src/plugin/web.ts

@@ -15,6 +15,7 @@ import {
   type BridgeToPage,
   isBridgePath,
   isBridgeToFrame,
+  isBridgeUrl,
   MAX_BRIDGE_TITLE_LENGTH,
   PLUGIN_BRIDGE_VERSION,
   type PluginWidgetSizeName,
@@ -122,6 +123,12 @@ export interface PluginFrame {
   };
   /** The console's page follows a path of the console's in place; a URL is refused. */
   navigate(path: string): void;
+  /**
+   * The console's page opens a web or a mail address in a new tab (ADR-0067), for a link a
+   * person pressed: call it from the press itself, since the page opens nothing but right after
+   * one. Anything else, a path of the console's included, is refused; `navigate` takes those.
+   */
+  open(url: string): void;
   /** The console's page downloads a file of this plugin. */
   download(id: string): void;
   setTitle(text: string): void;
@@ -350,6 +357,16 @@ export function connect(options: ConnectOptions = {}): Promise<PluginFrame> {
               }
               post({ v: PLUGIN_BRIDGE_VERSION, t: "navigate", path });
             },
+            open: (url) => {
+              if (!isBridgeUrl(url)) {
+                throw new PluginBridgeError({
+                  code: "plugin.forbidden",
+                  message:
+                    "open takes a web or a mail address; navigate takes a path of the console's",
+                });
+              }
+              post({ v: PLUGIN_BRIDGE_VERSION, t: "open", url });
+            },
             download: (id) => post({ v: PLUGIN_BRIDGE_VERSION, t: "download", id }),
             setTitle: (text) => {
               const title = text.slice(0, MAX_BRIDGE_TITLE_LENGTH).replace(/[\r\n]+/g, " ");

package/src/plugin.ts

@@ -74,6 +74,7 @@ export * from "./plugin/limits.js";
 export {
   CURRENT_PLUGIN_API,
   capabilitiesAsked,
+  isCalendarDay,
   isPluginKey,
   type Localized,
   legacyWidgetSize,

package/src/router.ts

@@ -96,6 +96,10 @@ export type Route =
   | { readonly name: "people" }
   /** The form where an administrator lets someone in by login (ADR-0022). */
   | { readonly name: "new-listing" }
+  /** The teams of the workspace (ADR-0073), a view of the people's page. */
+  | { readonly name: "teams" }
+  /** The form where an administrator makes a team. */
+  | { readonly name: "new-team" }
   /** The agents of one person, for an administrator. */
   | { readonly name: "person-agents"; readonly id: string }
   /** Another person's plate, for whoever oversees them: a day of the week shown at the top, or today's. */
@@ -107,6 +111,8 @@ export type Route =
   | { readonly name: "work"; readonly week: string | undefined }
   /** The decisions addressed to the person (ADR-0042), across the projects they may see. */
   | { readonly name: "my-decisions" }
+  /** One decision wherever it is (ADR-0068), for whoever it reaches: in a project they may see or not. */
+  | { readonly name: "my-decision"; readonly id: string }
   /** The categories tasks are sorted into; an administrator keeps them here. */
   | { readonly name: "categories" }
   /** Where a person approves an agent's connection, by the code it showed, or types one. */
@@ -166,6 +172,10 @@ export const PATHS = {
   people: "/people",
   /** The form where an administrator lets someone in by login. */
   newListing: "/people/new",
+  /** The teams of the workspace, a view of the people's page. */
+  teams: "/people/teams",
+  /** The form where an administrator makes a team. */
+  newTeam: "/people/teams/new",
   /** The agents of whoever is signed in, which hold their tokens: their own page. */
   agents: "/agents",
   /** The form for a token made by hand, for a script or a console of one's own. */
@@ -293,12 +303,22 @@ export function matchRoute(pathname: string, search = ""): Route {
   if (path === PATHS.decisions) {
     return { name: "my-decisions" };
   }
+  if (path.startsWith(`${PATHS.decisions}/`)) {
+    const id = path.slice(PATHS.decisions.length + 1);
+    return UUID.test(id) ? { name: "my-decision", id } : NOT_FOUND;
+  }
   if (path === PATHS.people) {
     return { name: "people" };
   }
   if (path === PATHS.newListing) {
     return { name: "new-listing" };
   }
+  if (path === PATHS.teams) {
+    return { name: "teams" };
+  }
+  if (path === PATHS.newTeam) {
+    return { name: "new-team" };
+  }
   if (path === PATHS.agents) {
     return { name: "agents" };
   }
@@ -569,6 +589,11 @@ export function decisionsHref(key: string, page?: number): string {
 }
 
 /** Where the person's own work is, with the week of a day at the top, or this week's when none is named. */
+/** Where one decision is read wherever it is (ADR-0068), by whoever it reaches: a person outside its project too. */
+export function myDecisionHref(id: string): string {
+  return `${PATHS.decisions}/${id}`;
+}
+
 export function workHref(week?: string): string {
   return week === undefined ? PATHS.work : `${PATHS.work}?week=${week}`;
 }

package/src/routes.ts

@@ -17,6 +17,8 @@ export const REST_ROUTES = {
   workspacePackToken: "/api/v1/workspace/pack-token",
   /** The people of the workspace: everyone who has signed in, and the logins let in that have not. */
   people: "/api/v1/people",
+  /** The teams of the workspace (ADR-0073): a name and its members, kept by an administrator. */
+  teams: "/api/v1/teams",
   /** The logins an administrator let in (ADR-0022), made and removed by one. */
   listings: "/api/v1/listings",
   /** The projects the asker may see; the board of each is under its key. */
@@ -68,6 +70,19 @@ export function personWorkPath(personId: string): string {
   return `${restPath("people", personId)}/work`;
 }
 
+/** The REST path of one decision wherever it is (ADR-0068), by its id; `/answer` under it answers. */
+export function decisionPath(id: string): string {
+  return `${REST_ROUTES.decisions}/${encodeURIComponent(id)}`;
+}
+
+/**
+ * The REST path of a file put on a decision (ADR-0055), read at the decision's own address, for
+ * whoever the decision reaches wherever it is (ADR-0068), in a project they may see or not.
+ */
+export function decisionFilePath(decisionId: string, fileId: string): string {
+  return `${decisionPath(decisionId)}/files/${encodeURIComponent(fileId)}`;
+}
+
 /** The REST path of a person's tokens, or of one of them: for an administrator. */
 export function personTokensPath(personId: string, tokenId?: string): string {
   const base = `${restPath("people", personId)}/tokens`;
@@ -126,9 +141,9 @@ export function signInPath(page: string, failure: SignInFailure): string {
   return `${page}${page.includes("?") ? "&" : "?"}${SIGN_IN_PARAM}=${failure}`;
 }
 
-/** The REST path of one person, listing, token or project: the collection, then the id or the key. */
+/** The REST path of one person, listing, token, project or team: the collection, then the id or the key. */
 export function restPath(
-  collection: "people" | "listings" | "tokens" | "projects",
+  collection: "people" | "listings" | "tokens" | "projects" | "teams",
   id: string,
 ): string {
   return `${REST_ROUTES[collection]}/${encodeURIComponent(id)}`;

package/src/schemas.ts

@@ -38,6 +38,8 @@ import {
   MAX_SECRET_LENGTH,
   MAX_SKILLS_ADDRESS_LENGTH,
   MAX_SUMMARY_LENGTH,
+  MAX_TEAM_KEY_LENGTH,
+  MAX_TEAM_NAME_LENGTH,
   MAX_TITLE_LENGTH,
   MAX_TOKEN_DAYS,
   MAX_TOKEN_NAME_LENGTH,
@@ -135,12 +137,21 @@ export const restPersonSchema = z.object({
    * a console built on this package still reads an older console's people.
    */
   managerId: z.optional(z.nullable(uuid)),
+  /** The teams the person is in (ADR-0073), by their keys (ADR-0074): on the people listing and to a plugin, from 0.4.5, and read as optional. */
+  teams: z.optional(z.array(z.string())),
   /**
    * The language the person reads in (ADR-0065), a tag: the one they chose, else the one the pages
    * first saw them in; `null` until they have opened the pages. What a plugin or an agent writes
    * for them in. Answered from 0.4.4 and read as optional, as `managerId` is.
    */
   language: z.optional(z.nullable(languageTag)),
+  /**
+   * The person's work email, lowercase: the address they sign in with at Google, else what an
+   * administrator wrote; `null` until known. Answered to an administrator and to the person
+   * themselves alone, and left out everywhere else, so that a task's owner or a comment's author
+   * carries none. Answered from 0.4.5 and read as optional.
+   */
+  email: z.optional(z.nullable(z.string())),
 });
 export type RestPerson = z.infer<typeof restPersonSchema>;
 
@@ -188,6 +199,47 @@ export const restListingInputSchema = z
   .check(z.refine((input) => isLoginAt(input.host, input.login), "must be a login at the host"));
 export type RestListingInput = z.infer<typeof restListingInputSchema>;
 
+/**
+ * A team's key (ADR-0074): what its addresses, a grant, a plugin and the command call it. A
+ * project key's shape, one name among the teams' keys and the projects' keys of a workspace;
+ * immutable once the team is made.
+ */
+const teamKey = z.string().check(
+  z.maxLength(MAX_TEAM_KEY_LENGTH),
+  z.regex(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/, "must be lowercase letters, digits and hyphens"),
+  z.refine((key) => key !== "new", "is a word the pages reserve"),
+);
+
+/** A team of the workspace (ADR-0073): its key, its name and who is in it, among the people the asker may see. */
+export const restTeamSchema = z.object({
+  id: uuid,
+  key: z.string(),
+  name: z.string(),
+  memberIds: z.array(uuid),
+  createdAt: instant,
+});
+export type RestTeam = z.infer<typeof restTeamSchema>;
+
+export const restTeamsSchema = z.object({ items: z.array(restTeamSchema) });
+export type RestTeams = z.infer<typeof restTeamsSchema>;
+
+/** What `POST /api/v1/teams` is sent: the key, which stays, and the name. */
+export const restTeamInputSchema = z.object({
+  key: teamKey,
+  name: line(MAX_TEAM_NAME_LENGTH),
+});
+export type RestTeamInput = z.infer<typeof restTeamInputSchema>;
+
+/** What `PATCH /api/v1/teams/<key>` is sent: the name; the key never changes. */
+export const restTeamPatchSchema = z.object({
+  name: line(MAX_TEAM_NAME_LENGTH),
+});
+export type RestTeamPatch = z.infer<typeof restTeamPatchSchema>;
+
+/** What `POST /api/v1/teams/<key>/members` is sent. */
+export const restTeamMemberInputSchema = z.object({ personId: uuid });
+export type RestTeamMemberInput = z.infer<typeof restTeamMemberInputSchema>;
+
 /** An identity provider people may sign in through, as the pages offer it. */
 export const restProviderSchema = z.object({
   key: z.enum(PROVIDER_KEYS),
@@ -388,12 +440,17 @@ export const restPersonPatchSchema = z
     status: z.optional(z.enum(PERSON_STATUSES)),
     /** Whom the person reports to: another active person of the workspace, or `null` for nobody. */
     managerId: z.optional(z.nullable(uuid)),
+    /** The person's work email, one per workspace, or `null` for none; an administrator's to write. */
+    email: z.optional(z.nullable(z.email().check(z.maxLength(254)))),
   })
   .check(
     z.refine(
       (patch) =>
-        patch.role !== undefined || patch.status !== undefined || patch.managerId !== undefined,
-      "must name a role, a status or a manager",
+        patch.role !== undefined ||
+        patch.status !== undefined ||
+        patch.managerId !== undefined ||
+        patch.email !== undefined,
+      "must name a role, a status, a manager or an email",
     ),
   );
 export type RestPersonPatch = z.infer<typeof restPersonPatchSchema>;
@@ -886,6 +943,18 @@ export const restMyDecisionsSchema = z.object({
 });
 export type RestMyDecisions = z.infer<typeof restMyDecisionsSchema>;
 
+/**
+ * `GET /api/v1/decisions/<id>`: one decision wherever it is (ADR-0068), in a project the asker
+ * may see or one that reaches them from elsewhere, with its project and whether they may answer
+ * it (`mayAnswer`, read as optional).
+ */
+export const restReachedDecisionSchema = z.object({
+  project: projectRef,
+  decision: restDecisionSchema,
+  mayAnswer: z.optional(z.boolean()),
+});
+export type RestReachedDecision = z.infer<typeof restReachedDecisionSchema>;
+
 /**
  * What `GET /api/v1/people/<id>/work` answers: another person's open tasks, and their closed
  * ones for the week, within the projects the asker may see, for whoever oversees them. No
@@ -981,6 +1050,10 @@ export const restEventDataSchema = z.object({
   role: z.optional(z.string()),
   /** For `person.manager_changed`: the login of whom the person reports to now, or `null` for nobody. */
   manager: z.optional(z.nullable(z.string())),
+  /** For the events about a team (ADR-0073), and for a role granted to one: its name; `team.renamed` holds the name before in `name`, and each event of a team its `key` (ADR-0074). */
+  team: z.optional(z.string()),
+  /** For `person.email_changed`: whether the person has an address now; never the address itself. */
+  set: z.optional(z.boolean()),
   /** For the events about a project: its key and its name. */
   key: z.optional(z.string()),
   name: z.optional(z.string()),
@@ -1003,6 +1076,10 @@ export const restEventDataSchema = z.object({
   args: z.optional(z.record(z.string(), z.unknown())),
   /** For `plugin.enabled` and `plugin.configured`: the capabilities consented to. */
   capabilities: z.optional(z.array(z.string())),
+  /** For `plugin.configured` of a secret: `administrator`, or the host of the answer it was sealed from (ADR-0070). */
+  source: z.optional(z.string()),
+  /** For `plugin.granted` and `plugin.revoked`: the plugin the role went to, by key, where one did (ADR-0072). */
+  grantee: z.optional(z.string()),
   /** For `plugin.granted` and `plugin.revoked`: whether the role went to everyone. */
   everyone: z.optional(z.boolean()),
   /** For `plugin.failed`: what went wrong, in words for a person. */
@@ -1029,6 +1106,8 @@ export const restEventSchema = z.object({
   goalId: z.nullable(uuid),
   /** The plugin that caused it, by key, or `null` (ADR-0052). */
   plugin: z.nullable(z.string()),
+  /** The plugin the person acted through (ADR-0072), by key, when one acted for them; answered from 0.4.5 and read as optional. */
+  via: z.optional(z.nullable(z.string())),
   data: restEventDataSchema,
   createdAt: instant,
 });