feat(base)!: one budget per person for all their assistants, the effort each takes, the operator's lists by page

A grant now says only which assistant a person may use, and keeps their
agreement; the limits are the person's (assistant_budget): one per UTC
day and month in money and in tokens, each optional, money counting the
assistants with prices, tokens every one (Halkyon Learn's ADR 0021, D58,
D59). assistantOperator.grant gives several people several assistants
with one budget, change sets one person's exactly, revoke takes back
everything; grantees and granteesOf list people with their assistants,
budget and use, 50 at a time. The migration carries each person's grant
limits into a budget: per unit, their sum, a grant without a limit making
it none.

assistants.env gives each assistant a default and a highest effort
(_EFFORT, _MAX_EFFORT; refused at start where the provider takes none);
ask takes one within that range, refusing another (invalidEffort), and
caps the output at its ceiling (D63).

instanceOperator.waiting and accounts come 50 at a time from an offset,
and counts gives the rows of the operator's screen (D62).

BREAKING CHANGE: the offer, the grants and the operator's lists changed
shape; Learn's server now asks for build 25.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/README.md

@@ -23,10 +23,10 @@ Endpoints, under the nickname `base` in a host's client (`client.modules.base.em
 | `emailCode` | `sendCode`: a code by mail, which proves the address and signs nobody in | anyone |
 | `account` | `delete` (with the password's proof where the account has one, `keysProof` for one that signs in with SimpleLogin), `signInWays`, `operating`: how many accounts wait, for an operator (Halkyon Learn's ADR 0021, D34; null for anyone else) | signed in |
 | `waiting` | with a waiting account's pass (Halkyon Learn's ADR 0021, D31): `look` (waiting, suspended, approved, which takes the pass, or unknown), `deleteAccount` (a new account never approved), `forget` | without a session |
-| `instanceOperator` | `waiting`, `approve`, `refuse` (a new account, deleted), `accounts` (by the start of a handle, at most 50), `suspend` (every session ending, the account waiting anew; never an operator), `operators`, `appoint` (by handle, approving one that waits), `takeBack` (never the last operator) | `identified` and `operator`, on the register |
+| `instanceOperator` | `counts` (who waits, operates, has an account: D62), `waiting` (50 from an offset), `approve`, `refuse` (a new account, deleted), `accounts` (by the start of a handle, 50 from an offset), `suspend` (every session ending, the account waiting anew; never an operator), `operators`, `appoint` (by handle, approving one that waits), `takeBack` (never the last operator) | `identified` and `operator`, on the register |
 | `instance` | `basics`: the app it serves, whether codes by mail, password sign-in and SimpleLogin are on, who may sign up (`SIGN_UP`), the source link, the oldest app build, where data and backups are, whether people may add assistants with their own keys | anyone |
-| `assistant` | Halkyon Learn's ADR 0021, step 2: `offered`, the assistants granted to the caller that are set, with what goes where, what is left of their limits and whether they agreed (none on a member, D43); `agree(assistant)`, to what goes where, its provider as it is now (D40); `ask(question)`, a stream: the answer's text as the model writes it, then the whole turn with why it stopped and its tokens, once counted (D35, D38); `figures`, the caller's own, month by month | `identified` |
-| `assistantOperator` | `setUp`: the assistants set, without their keys; `grants`, by handle; `grant(account, assistant, dailyLimit, monthlyLimit)`, in money with prices, else tokens, the agreement kept when the limits change; `revoke`; `figures(month)`: everyone's of a UTC month, per person and assistant | `identified` and `operator`, on the register |
+| `assistant` | Halkyon Learn's ADR 0021, step 2: `offered`, the assistants granted to the caller that are set, with what goes where, their effort and whether they agreed, and the caller's budget with what is used of it (none on a member, D43); `agree(assistant)`, to what goes where, its provider as it is now (D40); `ask(question)`, at an effort offered or the operator's default (D63), a stream: the answer's text as the model writes it, then the whole turn with why it stopped and its tokens, once counted (D35, D38); `figures`, the caller's own, month by month | `identified` |
+| `assistantOperator` | `setUp`: the assistants set, without their keys, with their effort, and how many people have any; `grantees` (by the start of a handle, 50 from an offset) and `granteesOf(accounts)`: each person's assistants, budget and what they used; `grant(accounts, assistants, budget)`: each person the assistants they lack, the agreements of the others kept, and the budget (D58); `change(account, assistants, budget)`: exactly those; `revoke(account)`: every assistant and the budget; `figures(month)`: everyone's of a UTC month, per person and assistant | `identified` and `operator`, on the register |
 | `profile` | `mine`, `save`, `checkHandle` (with every answer about a new handle, at most 30 an hour per person and 60 per network), `checkLinks` (at most 10 an hour), `setAvatar`, `removeAvatar`, `remove` (what it shows goes, the handle stays, private again: Halkyon Learn's ADR 0020, D27): the caller's own public profile | `identified` |
 | `profiles` | `byHandle`: anyone's public profile once they went public, whatever the handle's case | signed in |
 
@@ -128,14 +128,19 @@ Endpoints, under the nickname `base` in a host's client (`client.modules.base.em
 - **Assistants** (Halkyon Learn's ADR 0021, points 4 to 8, D27 to D46): the operator's
   language models, set in `deploy/assistants.env` (`assistantsFrom`, read as the server
   starts, anything it can't use stopping it), each through halkyon_llm with the
-  operator's key; nobody has one until an operator grants it, with limits per UTC day
-  and month (`assistant_grant`). `ask` checks, in order: at most `maxQuestionsAtOnce`
-  (2) on their way per person (`tooManyAtOnce`), the grant (`notGranted`), the
-  agreement (`notAgreed`), limits set in the unit the assistant's pricing has now
-  (`limitOutdated`), the month's limit, the day's (`limitReached`, with when it
-  resets), then the question itself (`requestOf`: `malformed`, `imagesNotRead`,
-  `tooLarge` past `assistantQuestionMaxCharacters`, `assistantImageMaxBytes` or
-  `assistantQuestionMaxImages`); the output is capped at `assistantOutputCeiling`. Each
+  operator's key; nobody has one until an operator grants it (`assistant_grant`), and
+  each person has one budget for all their assistants together (`assistant_budget`,
+  D58, D59): a limit per UTC day and month in money and in tokens, each optional,
+  money counting the assistants with prices, tokens every one. `ask` checks, in order:
+  at most `maxQuestionsAtOnce` (2) on their way per person (`tooManyAtOnce`), the grant
+  (`notGranted`), the agreement (`notAgreed`), the budget's month, then its day
+  (`limitReached`, with when it resets), then the question itself (`requestOf`:
+  `invalidEffort` for an effort above the operator's highest or where there is none to
+  choose, `malformed`, `imagesNotRead`, `tooLarge` past
+  `assistantQuestionMaxCharacters`, `assistantImageMaxBytes` or
+  `assistantQuestionMaxImages`). The effort is the question's or the operator's default
+  (`_EFFORT`, `_MAX_EFFORT`, D63), and the output is capped at that effort's ceiling
+  (halkyon_llm's `LlmEffort.outputCeiling`, 16,384 without one). Each
   request carries the person's opaque ID (HMAC-SHA256 under `ASSISTANT_ID_KEY`,
   `personIdOf`, D30), never their account. Once sent, the provider's reply is read to
   its end whatever the app does and counted on a session of its own