@aglyn/tenant-data-admin 1.0.0-beta.221 → 1.0.0-beta.222

package/src/lib/server/organizations.js

@@ -19,7 +19,7 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * Admin-SDK-only by design: org creation, slug reservation, membership
  * and the projections the security rules authorize against are never
  * client-writable (docs/MULTI_TENANT_FIRESTORE.md §8).
- */ import { consentGroupForHost, checkHostCollaboratorQuota, checkSeatQuota, countCollaboratorSeats, countManagerSeatsExcluding, createResourceUid, generateOrgSlug, projectMemberResolvedPermissions, resolveOrgPermissions, isOrgWideMember, isValidOrgSlug, hostPermissionKeys, orgPermissionLabel, pluginOrgPermissionKeys, projectHostMemberPermissions, projectHostMemberRoles, projectMemberScopeTokens, resolveCollaboratorHostPermissions, scopeTokensForHost } from "@aglyn/aglyn/server";
+ */ import { consentGroupForHost, checkHostCollaboratorQuota, checkSeatQuota, countCollaboratorSeats, countManagerSeatsExcluding, createResourceUid, generateOrgSlug, projectMemberResolvedPermissions, resolveOrgPermissions, isOrgWideMember, isValidOrgSlug, hostPermissionKeys, parseOwnerHandoff, usesCustomerSeat, orgPermissionLabel, pluginOrgPermissionKeys, projectHostMemberPermissions, projectHostMemberRoles, projectMemberScopeTokens, resolveCollaboratorHostPermissions, scopeTokensForHost } from "@aglyn/aglyn/server";
 import { ACCOUNT_ACQUISITION_FIELD, organizationAcquisition } from "@aglyn/aglyn/app-utils/account-acquisition";
 import { activitySearchTokens } from "@aglyn/aglyn/app-utils/activity-search";
 import { nameSearchKey, nameSearchReversed, nameSearchTokens } from "@aglyn/aglyn/app-utils/name-search";
@@ -36,6 +36,7 @@ import firebaseAdmin from "./firebase-admin.js";
 import { enforceFreeWorkspaceCapInTransaction, readFreeWorkspaceCapConfig } from "./free-workspace-cap.js";
 import { deleteMemberHostProjections, syncHostProjectionForMembers, syncMemberHostProjections } from "./host-memberships.js";
 import { ORG_MEMBER_LIST_FIELD_NAMES, orgMemberListFields, orgMemberSearchTokens } from "./org-member-list-fields.js";
+import { isStaffAccount } from "./staff-seat.js";
 import { updateExisting } from "./update-existing.js";
 import { attachWorkspaceDomain } from "./workspace-domains.js";
 const firestore = ()=>firebaseAdmin.app().firestore();
@@ -154,6 +155,7 @@ reservation, now = Date.now()) {
  * `OrgSlugTakenError` when the slug is reserved; slug validity is the
  * caller's job (API routes return 400 with policy copy).
  */ export async function createOrganization(options) {
+    var _options_ownerStaffSeat;
     const { name, slug, ownerUid, ownerEmail, ownerDisplayName } = options;
     const db = firestore();
     const orgId = createResourceUid();
@@ -164,6 +166,9 @@ reservation, now = Date.now()) {
     // the verdict knows the difference between "staff set no limit" and "we
     // could not read it", and never treats the second as the first.
     const capConfig = options.bypassFreeWorkspaceCap ? null : await readFreeWorkspaceCapConfig();
+    // Read outside the transaction for the same reason: an auth record, not a
+    // document this creation races with (AGL-3466).
+    const ownerStaffSeat = (_options_ownerStaffSeat = options.ownerStaffSeat) != null ? _options_ownerStaffSeat : await isStaffAccount(ownerUid);
     await db.runTransaction(async (tx)=>{
         const reservation = await tx.get(db.collection('orgSlugs').doc(slug));
         const held = reservation.exists ? reservation.data() : undefined;
@@ -263,7 +268,10 @@ reservation, now = Date.now()) {
             allHosts: true,
             email: ownerEmail != null ? ownerEmail : null,
             displayName: ownerDisplayName != null ? ownerDisplayName : null,
-            joinedAt: FieldValue.serverTimestamp(),
+            joinedAt: FieldValue.serverTimestamp()
+        }, ownerStaffSeat ? {
+            staffSeat: true
+        } : {}, {
             /*
          * The rules projection, stamped AT CREATION (AGL-1038).
          *
@@ -1070,7 +1078,8 @@ const MEMBER_PROJECTION_WRITE = {
  * rather than leaving the customer to infer it from a rejected click.
  */ async function assertCollaboratorSeats(options) {
     const { orgRef, org, hostIds, self, read } = options;
-    if (!hostIds.length) return;
+    // Platform staff take no seat (AGL-3466), so there is nothing to charge.
+    if (!hostIds.length || self.staffSeat) return;
     const entries = await readSeatEntries(orgRef, read);
     for (const hostId of hostIds){
         const used = countCollaboratorSeats(entries, hostId, self);
@@ -1086,7 +1095,8 @@ const MEMBER_PROJECTION_WRITE = {
  * every host and pays for it with a manager seat.
  */ function newlyScopedHosts(options) {
     var _ref;
-    const { role, allHosts, hostAccess, existing } = options;
+    const { role, allHosts, hostAccess, existing, staffSeat } = options;
+    if (staffSeat) return [];
     if (isOrgWideMember({
         role,
         allHosts,
@@ -1094,7 +1104,9 @@ const MEMBER_PROJECTION_WRITE = {
     })) {
         return [];
     }
-    const prior = (_ref = existing == null ? void 0 : existing.hostAccess) != null ? _ref : {};
+    // A row stamped as staff held no seat on any of its sites, so a former
+    // staff member keeping a site is taking that seat now, not re-writing one.
+    const prior = usesCustomerSeat(existing) ? (_ref = existing == null ? void 0 : existing.hostAccess) != null ? _ref : {} : {};
     return Object.keys(hostAccess).filter((hostId)=>!prior[hostId]);
 }
 /**
@@ -1129,7 +1141,7 @@ const MEMBER_PROJECTION_WRITE = {
  * transactional path.
  */ export async function collaboratorSeatRefusal(options) {
     const { orgId, org, hostIds, self } = options;
-    if (!hostIds.length) return null;
+    if (!hostIds.length || (self == null ? void 0 : self.staffSeat)) return null;
     try {
         await assertCollaboratorSeats({
             orgRef: firestore().collection('orgs').doc(orgId),
@@ -1207,7 +1219,8 @@ const MEMBER_PROJECTION_WRITE = {
  * may be added: the cap binds ADMISSION, never ACCESS.
  */ async function assertManagerSeats(options) {
     const { orgRef, org, becomesManager, self, read } = options;
-    if (!becomesManager) return;
+    // Platform staff take no seat (AGL-3466).
+    if (!becomesManager || self.staffSeat) return;
     const entries = await readSeatEntries(orgRef, read);
     const used = countManagerSeatsExcluding(entries, self);
     const quota = checkSeatQuota(org, 'managers', used);
@@ -1230,6 +1243,7 @@ const MEMBER_PROJECTION_WRITE = {
  * and gives one up on the collaborator side; that is a real transition and is
  * charged.
  */ function becomesOrgManager(options) {
+    if (options.staffSeat) return false;
     const next = isOrgWideMember({
         role: options.role,
         allHosts: options.allHosts,
@@ -1239,7 +1253,9 @@ const MEMBER_PROJECTION_WRITE = {
     // An ABSENT row is not a manager, and `isOrgWideMember(undefined)` is
     // already false — but saying so explicitly keeps the "was it one before?"
     // question readable next to the legacy shape that predates `allHosts`.
-    return !options.existing || !isOrgWideMember(options.existing);
+    // A row stamped as staff held no seat either (AGL-3466): a former staff
+    // manager whose row is rewritten is taking a customer seat now.
+    return !options.existing || !usesCustomerSeat(options.existing) || !isOrgWideMember(options.existing);
 }
 /**
  * Turn a manager-seat refusal into the 403 the admitting routes return, or
@@ -1272,7 +1288,7 @@ const MEMBER_PROJECTION_WRITE = {
  * access, because access is only ever granted through the transactional path.
  */ export async function managerSeatRefusal(options) {
     const { orgId, org, becomesManager, self } = options;
-    if (!becomesManager) return null;
+    if (!becomesManager || (self == null ? void 0 : self.staffSeat)) return null;
     try {
         await assertManagerSeats({
             orgRef: firestore().collection('orgs').doc(orgId),
@@ -1317,6 +1333,19 @@ const MEMBER_PROJECTION_WRITE = {
         status: 409
     });
 }
+/**
+ * The `staffSeat` field of a member write (AGL-3466): stamped while the
+ * account holds the `staff` claim, and taken off a row that still carries a
+ * stamp once it does not, so the row converges on the claim the next time
+ * anything writes it.
+ */ function staffSeatWrite(staffSeat, existing) {
+    if (staffSeat) return {
+        staffSeat: true
+    };
+    return (existing == null ? void 0 : existing.staffSeat) !== undefined ? {
+        staffSeat: FieldValue.delete()
+    } : {};
+}
 /**
  * Creates or updates a member transactionally with its reverse-index
  * entry, then re-syncs host projections.
@@ -1372,6 +1401,10 @@ const MEMBER_PROJECTION_WRITE = {
     // refusing here is what lets the spec assert that NOTHING was written
     // rather than that a throw happened somewhere.
     if (role === 'owner') throw new OrgOwnerSeatError('grant');
+    // Platform staff take none of the customer's seats (AGL-3466). Asked of
+    // the auth record at write time, so the claim decides it rather than
+    // anything the caller says, and a lookup that fails answers "not staff".
+    const staffSeat = await isStaffAccount(uid);
     const db = firestore();
     await db.runTransaction(async (tx)=>{
         var _org_name, _org_slug;
@@ -1381,6 +1414,7 @@ const MEMBER_PROJECTION_WRITE = {
         const org = orgSnapshot.data();
         const memberRef = db.collection('orgs').doc(orgId).collection('members').doc(uid);
         const existing = await tx.get(memberRef);
+        const existingData = existing.data();
         // The owner's own row is not writable here (AGL-1888). Both facts, not
         // one standing in for the other — see the note on this function.
         if (org.ownerUid === uid || ((_existing_data = existing.data()) == null ? void 0 : _existing_data.role) === 'owner') {
@@ -1400,12 +1434,14 @@ const MEMBER_PROJECTION_WRITE = {
                 role,
                 allHosts: allHosts != null ? allHosts : false,
                 hostAccess: hostAccess != null ? hostAccess : {},
-                existing: existing.data()
+                existing: existingData,
+                staffSeat
             }),
             self: {
                 uid,
                 email,
-                emails: seatAliasEmails
+                emails: seatAliasEmails,
+                staffSeat
             },
             read: (query)=>tx.get(query)
         });
@@ -1422,12 +1458,14 @@ const MEMBER_PROJECTION_WRITE = {
                 role,
                 allHosts: allHosts != null ? allHosts : false,
                 hostAccess: hostAccess != null ? hostAccess : {},
-                existing: existing.data()
+                existing: existingData,
+                staffSeat
             }),
             self: {
                 uid,
                 email,
-                emails: seatAliasEmails
+                emails: seatAliasEmails,
+                staffSeat
             },
             read: (query)=>tx.get(query)
         });
@@ -1435,7 +1473,7 @@ const MEMBER_PROJECTION_WRITE = {
             role,
             allHosts: allHosts != null ? allHosts : false,
             hostAccess: hostAccess != null ? hostAccess : {}
-        }, roleId !== undefined ? {
+        }, staffSeatWrite(staffSeat, existingData), roleId !== undefined ? {
             roleId
         } : {}, email !== undefined ? {
             email
@@ -1572,6 +1610,79 @@ const MEMBER_PROJECTION_WRITE = {
     }
     return written;
 }
+/**
+ * The writes that move the owner seat, inside the caller's transaction.
+ *
+ * THE ONE COPY. `transferOrgOwnership` and `acceptOwnerHandoff` both call
+ * this, so an org can never end up with an owner one door produced and the
+ * other would not recognize: one `ownerUid`, exactly one `role: 'owner'` row,
+ * and reverse-index entries that agree with both.
+ *
+ * Every member write is a MERGE, which is what keeps a `staffSeat` stamp
+ * where it was (AGL-3466): a staff owner handing over and staying on remains
+ * a no-seat admin, and a staff member taking over remains a no-seat owner.
+ *
+ * `createdByUid` is not written here and must never be (AGL-2265) — see the
+ * note on `transferOrgOwnership`.
+ */ function writeOwnershipMove(tx, db, move) {
+    var _move_newOwnerRow, _move_newOwnerIndex;
+    const { orgId, fromUid, toUid, previousOwner } = move;
+    const orgRef = db.collection('orgs').doc(orgId);
+    tx.set(orgRef, {
+        ownerUid: toUid,
+        updatedAt: FieldValue.serverTimestamp()
+    }, {
+        merge: true
+    });
+    tx.set(orgRef.collection('members').doc(toUid), _extends({}, (_move_newOwnerRow = move.newOwnerRow) != null ? _move_newOwnerRow : {}, {
+        role: 'owner',
+        allHosts: true
+    }), {
+        merge: true
+    });
+    tx.set(db.collection('users').doc(toUid).collection('orgs').doc(orgId), // Both principals end up owner/admin, which is org-wide reach whatever
+    // they were before — a promoted site collaborator must lose the scoped
+    // console along with the scoped membership (AGL-1032).
+    _extends({}, (_move_newOwnerIndex = move.newOwnerIndex) != null ? _move_newOwnerIndex : {}, {
+        role: 'owner',
+        orgWide: true
+    }), {
+        merge: true
+    });
+    if (previousOwner === 'stay') {
+        tx.set(orgRef.collection('members').doc(fromUid), {
+            role: 'admin'
+        }, {
+            merge: true
+        });
+        tx.set(db.collection('users').doc(fromUid).collection('orgs').doc(orgId), {
+            role: 'admin',
+            orgWide: true
+        }, {
+            merge: true
+        });
+        return;
+    }
+    // Leaving: the same three documents `removeOrgMember` deletes, inside this
+    // transaction so the org is never briefly without its outgoing owner AND
+    // without its incoming one.
+    tx.delete(orgRef.collection('members').doc(fromUid));
+    tx.delete(orgRef.collection(MEMBER_EMAIL_ALIASES_COLLECTION).doc(fromUid));
+    tx.delete(db.collection('users').doc(fromUid).collection('orgs').doc(orgId));
+}
+/**
+ * The projections an ownership move changes, after its transaction: the
+ * whole roster's auth projections, and each principal's host reverse index
+ * (the owner spans every host — AGL-844). A principal who left has theirs
+ * deleted, as `removeOrgMember` does.
+ */ async function settleOwnershipMove(move) {
+    const { orgId, fromUid, toUid, previousOwner } = move;
+    await syncOrgAuthProjections(orgId);
+    await Promise.all([
+        syncMemberHostProjections(orgId, toUid),
+        previousOwner === 'stay' ? syncMemberHostProjections(orgId, fromUid) : deleteMemberHostProjections(orgId, fromUid)
+    ]);
+}
 /**
  * Transfers org ownership (AGL-232): the target must already be on the
  * roster; the previous owner steps down to admin. One transaction across
@@ -1587,6 +1698,12 @@ const MEMBER_PROJECTION_WRITE = {
  */ export async function transferOrgOwnership(orgId, fromUid, toUid) {
     if (fromUid === toUid) throw new Error('Target already owns this org');
     const db = firestore();
+    const move = {
+        orgId,
+        fromUid,
+        toUid,
+        previousOwner: 'stay'
+    };
     await db.runTransaction(async (tx)=>{
         const orgRef = db.collection('orgs').doc(orgId);
         const orgSnapshot = await tx.get(orgRef);
@@ -1600,45 +1717,9 @@ const MEMBER_PROJECTION_WRITE = {
         if (!target.exists) {
             throw new Error('The new owner must already be an org member');
         }
-        tx.set(orgRef, {
-            ownerUid: toUid,
-            updatedAt: FieldValue.serverTimestamp()
-        }, {
-            merge: true
-        });
-        tx.set(targetRef, {
-            role: 'owner',
-            allHosts: true
-        }, {
-            merge: true
-        });
-        tx.set(orgRef.collection('members').doc(fromUid), {
-            role: 'admin'
-        }, {
-            merge: true
-        });
-        tx.set(db.collection('users').doc(toUid).collection('orgs').doc(orgId), // Both principals end up owner/admin, which is org-wide reach whatever
-        // they were before — a promoted site collaborator must lose the scoped
-        // console along with the scoped membership (AGL-1032).
-        {
-            role: 'owner',
-            orgWide: true
-        }, {
-            merge: true
-        });
-        tx.set(db.collection('users').doc(fromUid).collection('orgs').doc(orgId), {
-            role: 'admin',
-            orgWide: true
-        }, {
-            merge: true
-        });
+        writeOwnershipMove(tx, db, move);
     });
-    await syncOrgAuthProjections(orgId);
-    // Both principals' host access changed (owner spans every host) — AGL-844.
-    await Promise.all([
-        syncMemberHostProjections(orgId, toUid),
-        syncMemberHostProjections(orgId, fromUid)
-    ]);
+    await settleOwnershipMove(move);
     /*
    * A workspace changing hands is the highest-consequence thing that can
    * happen to an account, and until AGL-118 it left no trace anywhere: the
@@ -1670,6 +1751,248 @@ const MEMBER_PROJECTION_WRITE = {
         name: toEmail
     } : {}));
 }
+/**
+ * An owner handoff refused because it would need a team seat the plan does
+ * not have (AGL-3466).
+ *
+ * The loophole guard. A handoff reserves no seat, because the owner seat
+ * MOVES — but a `stay` handoff keeps the outgoing owner as an admin, so the
+ * workspace ends with one more manager than it started with. On Free that is
+ * a second manager on a one-seat plan, and without this check any owner could
+ * mint free managers by handing the workspace back and forth. The refusal
+ * names the way out: the outgoing owner leaving instead.
+ *
+ * Separate from {@link ManagerSeatLimitError} because the remedy is
+ * different, and a client that branches on `code` must be able to tell.
+ */ export class OwnerHandoffSeatError extends Error {
+    constructor(previousOwner, quota){
+        super(previousOwner === 'stay' ? `Team seats full (${quota.limit}) — the current owner can't stay on ` + 'as an admin after the handoff without a seat of their own. ' + 'Choose "Leave after the handoff", or add a seat first.' : `Team seats full (${quota.limit}) — the new owner needs a team ` + 'seat, and every seat is taken. Remove a member or add a seat first.');
+        this.name = 'OwnerHandoffSeatError';
+        this.limit = quota.limit;
+        this.upgradeRequired = quota.upgradeRequired;
+        this.previousOwner = previousOwner;
+    }
+}
+/**
+ * An owner handoff that can no longer be accepted as asked (AGL-3466): the
+ * invite was answered or withdrawn in the meantime, is not a handoff, is
+ * addressed to somebody else, or the accepter already owns the workspace.
+ */ export class OwnerHandoffError extends Error {
+    constructor(reason){
+        super(reason === 'not-pending' ? 'This handoff was already answered or withdrawn.' : reason === 'not-handoff' ? 'This invitation does not hand the workspace over.' : reason === 'not-addressed' ? 'This handoff is for a different (or unverified) email.' : 'You already own this workspace.');
+        this.name = 'OwnerHandoffError';
+        this.reason = reason;
+    }
+}
+/**
+ * Turn a handoff refusal into the response the invite route returns, or
+ * null when the error is something else and must keep propagating.
+ */ export function ownerHandoffRefusalResponse(error) {
+    if (error instanceof OwnerHandoffSeatError) {
+        return Response.json({
+            error: error.message,
+            code: 'owner_handoff_seat',
+            limit: error.limit,
+            upgradeRequired: error.upgradeRequired,
+            previousOwner: error.previousOwner
+        }, {
+            status: 403
+        });
+    }
+    if (error instanceof OwnerHandoffError) {
+        return Response.json({
+            error: error.message,
+            code: 'owner_handoff',
+            reason: error.reason
+        }, {
+            status: error.reason === 'not-addressed' ? 403 : 409
+        });
+    }
+    return null;
+}
+/**
+ * Does accepting this handoff leave the workspace with one more manager
+ * seat in use than it has now? (AGL-3466)
+ *
+ * The incoming owner takes the owner seat. That costs nothing when they are
+ * staff, or already hold a manager seat here. Otherwise it is one more seat —
+ * unless the outgoing owner LEAVES and frees one, which they only do if they
+ * held a seat to free: a staff owner leaving frees nothing.
+ */ function handoffTakesManagerSeat(options) {
+    const { previousOwner, inviteeStaff, invitee, owner } = options;
+    const heldSeat = (row)=>!!row && usesCustomerSeat(row) && isOrgWideMember(row);
+    if (inviteeStaff || heldSeat(invitee)) return false;
+    return !(previousOwner === 'leave' && heldSeat(owner));
+}
+/**
+ * The seat check a handoff answers, at send and again at accept.
+ *
+ * Grandfathered the way every seat gate here is: only the transition is
+ * charged, so a handoff that leaves the seat count where it was is never
+ * refused, however far over its cap the workspace already is.
+ */ async function assertOwnerHandoffSeat(options) {
+    if (!handoffTakesManagerSeat(options)) return;
+    const entries = await readSeatEntries(options.orgRef, options.read);
+    const used = countManagerSeatsExcluding(entries, options.self);
+    const quota = checkSeatQuota(options.org, 'managers', used);
+    if (!quota.allowed) throw new OwnerHandoffSeatError(options.previousOwner, quota);
+}
+/**
+ * The handoff seat check, asked when the invitation is SENT (AGL-3466), so
+ * nobody is mailed a handoff that will be refused when they click it.
+ *
+ * Not the enforcement — `acceptOwnerHandoff` asks again inside its
+ * transaction, against the account that actually accepts. Here the invitee
+ * is only an address, so their current seat is read off the roster row that
+ * carries it.
+ *
+ * @returns the 403 to send, or null to proceed.
+ */ export async function ownerHandoffSeatRefusal(options) {
+    const { orgId, previousOwner, inviteeStaff } = options;
+    const email = options.email.trim().toLowerCase();
+    const db = firestore();
+    const orgRef = db.collection('orgs').doc(orgId);
+    const orgSnapshot = await orgRef.get();
+    if (!orgSnapshot.exists) return null;
+    const org = orgSnapshot.data();
+    const ownerSnapshot = org.ownerUid ? await orgRef.collection('members').doc(org.ownerUid).get() : null;
+    const roster = await orgRef.collection('members').where('email', '==', email).limit(1).get();
+    try {
+        await assertOwnerHandoffSeat({
+            orgRef,
+            org,
+            previousOwner,
+            inviteeStaff,
+            invitee: roster.empty ? undefined : roster.docs[0].data(),
+            owner: (ownerSnapshot == null ? void 0 : ownerSnapshot.exists) ? ownerSnapshot.data() : undefined,
+            self: {
+                email
+            },
+            read: (query)=>query.get()
+        });
+    } catch (error) {
+        const refusal = ownerHandoffRefusalResponse(error);
+        if (refusal) return refusal;
+        throw error;
+    }
+    return null;
+}
+/**
+ * Accept an owner handoff (AGL-3466): the invitee becomes the owner, the
+ * outgoing owner stays on as an admin or leaves, and the invite is marked
+ * accepted — all in ONE transaction, with the seat check inside it.
+ *
+ * The move itself is {@link writeOwnershipMove}, the same writes a transfer
+ * makes. What this adds is what an invitation needs that a transfer does not:
+ * the incoming owner may not be on the roster yet, so their row is created
+ * with the identity a join would give it; and the outgoing owner may leave.
+ *
+ * The SSO lockout check is the CALLER's, for the reason
+ * `assessOwnershipTransferLockout` gives: it cannot live in this library
+ * without an import cycle, and `sso-transfer-lockout-wiring.spec.ts` pins
+ * that every caller of this asks it first.
+ */ export async function acceptOwnerHandoff(options) {
+    const { orgId, inviteId, uid, email, displayName, photoURL } = options;
+    const addresses = new Set([
+        email,
+        ...options.emails
+    ].map((address)=>address.trim().toLowerCase()));
+    // The accepter's claim, read at accept rather than trusted from the send.
+    const inviteeStaff = await isStaffAccount(uid);
+    const db = firestore();
+    let move = null;
+    let ownerEmail = null;
+    await db.runTransaction(async (tx)=>{
+        var _invite_email, _org_name, _org_slug;
+        const orgRef = db.collection('orgs').doc(orgId);
+        const orgSnapshot = await tx.get(orgRef);
+        if (!orgSnapshot.exists) throw new Error(`Unknown org: ${orgId}`);
+        const org = orgSnapshot.data();
+        const inviteRef = orgRef.collection('invites').doc(inviteId);
+        const inviteSnapshot = await tx.get(inviteRef);
+        const invite = inviteSnapshot.data();
+        if (!inviteSnapshot.exists || !invite || invite['acceptedAt']) {
+            throw new OwnerHandoffError('not-pending');
+        }
+        const handoff = parseOwnerHandoff(invite.handoff);
+        if (invite['role'] !== 'owner' || !handoff) {
+            throw new OwnerHandoffError('not-handoff');
+        }
+        if (!addresses.has(String((_invite_email = invite['email']) != null ? _invite_email : '').toLowerCase())) {
+            throw new OwnerHandoffError('not-addressed');
+        }
+        const fromUid = typeof org.ownerUid === 'string' ? org.ownerUid : '';
+        if (!fromUid) throw new Error(`Org ${orgId} has no owner to hand over`);
+        if (fromUid === uid) throw new OwnerHandoffError('already-owner');
+        const inviteeSnapshot = await tx.get(orgRef.collection('members').doc(uid));
+        const ownerSnapshot = await tx.get(orgRef.collection('members').doc(fromUid));
+        const invitee = inviteeSnapshot.data();
+        const owner = ownerSnapshot.data();
+        ownerEmail = typeof (owner == null ? void 0 : owner.email) === 'string' ? owner.email : null;
+        await assertOwnerHandoffSeat({
+            orgRef,
+            org,
+            previousOwner: handoff.previousOwner,
+            inviteeStaff,
+            invitee,
+            owner,
+            self: {
+                uid,
+                email,
+                emails: [
+                    ...addresses
+                ]
+            },
+            read: (query)=>tx.get(query)
+        });
+        move = {
+            orgId,
+            fromUid,
+            toUid: uid,
+            previousOwner: handoff.previousOwner,
+            newOwnerRow: _extends({
+                email
+            }, displayName !== undefined ? {
+                displayName
+            } : {}, photoURL !== undefined ? {
+                photoURL
+            } : {}, staffSeatWrite(inviteeStaff, invitee), inviteeSnapshot.exists ? {} : _extends({
+                hostAccess: {},
+                joinedAt: FieldValue.serverTimestamp()
+            }, typeof invite['invitedBy'] === 'string' ? {
+                invitedBy: invite['invitedBy']
+            } : {})),
+            newOwnerIndex: {
+                orgName: (_org_name = org.name) != null ? _org_name : null,
+                slug: (_org_slug = org.slug) != null ? _org_slug : null
+            }
+        };
+        writeOwnershipMove(tx, db, move);
+        tx.set(inviteRef, {
+            acceptedAt: FieldValue.serverTimestamp(),
+            acceptedBy: uid
+        }, {
+            merge: true
+        });
+    });
+    // Assigned inside the transaction, which has returned without throwing.
+    const settled = move;
+    await settleOwnershipMove(settled);
+    // Both principals, as the transfer's row names them, written by the
+    // person who accepted — the only party who could make this happen.
+    await logOrgActivity(orgId, {
+        uid,
+        email
+    }, settled.previousOwner === 'stay' ? `Took over the workspace; ${ownerEmail != null ? ownerEmail : 'the previous owner'} stays on as an admin` : `Took over the workspace; ${ownerEmail != null ? ownerEmail : 'the previous owner'} left it`, {
+        type: 'member',
+        id: uid,
+        name: email
+    });
+    return {
+        previousOwnerUid: settled.fromUid,
+        previousOwner: settled.previousOwner
+    };
+}
 /**
  * Grants (or updates) per-host access for a uid without disturbing an
  * existing membership's org role or allHosts flag (AGL-238: the host user
@@ -1677,6 +2000,8 @@ const MEMBER_PROJECTION_WRITE = {
  * just this host when the uid is not on the roster yet.
  */ export async function grantHostAccess(options) {
     const { orgId, uid, hostId, role, email, displayName, invitedBy } = options;
+    // Platform staff take no collaborator seat either (AGL-3466).
+    const staffSeat = await isStaffAccount(uid);
     const db = firestore();
     await db.runTransaction(async (tx)=>{
         const orgRef = db.collection('orgs').doc(orgId);
@@ -1685,6 +2010,7 @@ const MEMBER_PROJECTION_WRITE = {
         const org = orgSnapshot.data();
         const memberRef = orgRef.collection('members').doc(uid);
         const existing = await tx.get(memberRef);
+        const existingData = existing.data();
         // Collaborator seat cap (AGL-2068). This door DID meter, but against
         // `hosts/{hostId}/members` — a display roster only its own route writes,
         // so it could not see anyone admitted by invite or by `/api/orgs/members`
@@ -1700,17 +2026,21 @@ const MEMBER_PROJECTION_WRITE = {
             // precisely so it is not locked out, must not be re-classified into a
             // collaborator seat by the act of writing a host key onto it.
             hostIds: (()=>{
-                var _current_hostAccess;
-                const current = existing.data();
-                if (existing.exists && isOrgWideMember(current)) return [];
-                if (current == null ? void 0 : (_current_hostAccess = current.hostAccess) == null ? void 0 : _current_hostAccess[hostId]) return [];
+                var _existingData_hostAccess;
+                if (existing.exists && isOrgWideMember(existingData)) return [];
+                // A stamped row held no seat on this site, so keeping it after the
+                // claim is gone takes one now (AGL-3466).
+                if (usesCustomerSeat(existingData) && (existingData == null ? void 0 : (_existingData_hostAccess = existingData.hostAccess) == null ? void 0 : _existingData_hostAccess[hostId])) {
+                    return [];
+                }
                 return [
                     hostId
                 ];
             })(),
             self: {
                 uid,
-                email
+                email,
+                staffSeat
             },
             read: (query)=>tx.get(query)
         });
@@ -1722,7 +2052,7 @@ const MEMBER_PROJECTION_WRITE = {
             hostAccess: {
                 [hostId]: role
             }
-        }, email !== undefined ? {
+        }, staffSeatWrite(staffSeat, existingData), email !== undefined ? {
             email
         } : {}, displayName !== undefined ? {
             displayName