@augurworks/augur 0.15.6 → 0.15.8

package/agents/drafts.md

@@ -55,7 +55,8 @@ saves on every burst of changes; `augur save` saves once.
 ## Landing
 
 `augur land` replaces the prototype's real URL with your draft, records who landed it and
-when, and closes the draft. It is refused in exactly one case: somebody landed on this
+when — and whose draft it was, when a member lands somebody else's from the site — and
+closes the draft. It is refused in exactly one case: somebody landed on this
 prototype since you opened yours. Then:
 
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@augurworks/augur",
-  "version": "0.15.6",
+  "version": "0.15.8",
   "files": [
     "scripts/",
     "build.js",

package/scripts/connect.mjs

@@ -64,6 +64,32 @@ async function post(pathPart, body) {
   return { status: r.status, json };
 }
 
+// A machine that is ALREADY connected to this origin does not pair again by accident. One
+// cold agent collected its token with a blocking `connect`, did not read the answer, ran
+// `connect` again, minted a second code, and had the person approve that too. If the saved
+// token still answers, say so and stop; `--again` pairs afresh on purpose, and a token the
+// workspace no longer honours (revoked, another workspace's) falls through to a new pairing.
+const AGAIN = argv.includes("--again");
+const TOKENS_FILE = path.join(os.homedir(), ".config", "augur", "tokens.json");
+function savedToken() {
+  try { const t = JSON.parse(readFileSync(TOKENS_FILE, "utf8"))[host]; return t && t.token ? t : null; } catch (e) { return null; }
+}
+if (!AGAIN && !process.env.AUGUR_TOKEN) {
+  const saved = savedToken();
+  if (saved && !(saved.expiresAt && Date.parse(saved.expiresAt) <= Date.now())) {
+    let live = false;
+    try {
+      const r = await fetch(`${ORIGIN}/__unit/drafts`, { headers: { Authorization: `Bearer ${saved.token}`, Accept: "application/json" } });
+      live = r.status === 200;
+    } catch (e) { live = false; }
+    if (live) {
+      log(`this machine is already connected to ${C.bold}${host}${C.off}${saved.at ? ` (since ${saved.at.slice(0, 16).replace("T", " ")})` : ""}. Nothing to approve.`);
+      console.log(`  ${C.dim}\`augur open <opportunity>/<prototype>\` works from here. \`augur connect --again\` pairs afresh.${C.off}`);
+      process.exit(0);
+    }
+  }
+}
+
 // A pairing this machine already started and nobody has collected: ask once whether it
 // was approved meanwhile, and if not, keep waiting on THAT code rather than minting a
 // second one for the same person to type.

package/scripts/restore.mjs

@@ -292,6 +292,14 @@ if (STATE) {
     })).json();
     if (!res.ok) die(`the instance refused the state: ${res.reason}${res.failed ? ` (${res.failed.join(", ")})` : ""}`);
     if (res.skipped && res.skipped.length) log(`\x1b[33mskipped (not in the instance's inventory): ${res.skipped.join(", ")}\x1b[0m`);
+    // A restore says "at least this": a member the copy does not name stays, and the
+    // instance names them so a keep is never mistaken for a replace.
+    if (res.members && res.members.kept && res.members.kept.length) {
+      log(`\x1b[33mkept ${res.members.kept.length} member(s) this copy does not name (a restore removes nobody): ${res.members.kept.join(", ")} — remove them in the people panel if they should go\x1b[0m`);
+    }
+    if (res.members && res.members.removed && res.members.removed.length) {
+      log(`removed ${res.members.removed.length} member(s) this copy does not name: ${res.members.removed.join(", ")}`);
+    }
     stateReport = res;
   }
 }

package/src/_worker.js

@@ -3754,10 +3754,13 @@ function connectPage(tctx, me) {
        <p>This account can look around but not publish, so it cannot approve a terminal.</p>
        <a class="home" href="/">Back to Augur</a>`
     : `<h1>Connect a terminal</h1>
-       <p>Type the code your terminal is showing. Approving it lets that terminal publish as
-          <strong>${escapeHtml(me.email)}</strong>.</p>
-       <p class="warn">Only approve a code you are reading off your own screen right now.
-          Nobody legitimate will ever send you one.</p>
+       <p>Type the code that your terminal, or the assistant you are working with right now,
+          is showing you. Approving it lets that terminal publish as
+          <strong>${escapeHtml(me.email)}</strong>: it works as you, and everything it lands
+          carries your name.</p>
+       <p class="warn">Only approve a code from a terminal you started or an assistant you
+          are talking to right now. A code that arrives by mail, from a stranger, or out of
+          the blue is not yours — do not type it.</p>
        <form id="pairf">
          <input id="pairc" autocomplete="off" autocapitalize="characters" spellcheck="false"
                 placeholder="ABCD-EFGH" aria-label="Pairing code" />
@@ -5219,7 +5222,11 @@ function personFace(users, id) {
     : { name: null, initials: null, color: null };
 }
 const decorateDrafts = (drafts, users) => (drafts || []).map((d) => ({ ...d, ...personFace(users, d.owner) }));
-const decorateLandings = (landings, users) => (landings || []).map((l) => ({ ...l, ...personFace(users, l.by) }));
+const decorateLandings = (landings, users) => (landings || []).map((l) => ({
+  ...l, ...personFace(users, l.by),
+  // The draft's owner, with a face, when the landing was made from somebody else's draft.
+  draft: l.draftOwner && l.draftOwner !== l.by ? { owner: l.draftOwner, session: l.draftSession || "", ...personFace(users, l.draftOwner) } : null,
+}));
 
 /** How many units the gallery's index will ask about in one answer. */
 const DRAFTS_INDEX_MAX = 50;
@@ -6916,6 +6923,7 @@ function loginPage(tctx, redirect, error, requestUrl, opts = {}) {
 <head>
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <meta name="description" content="A sign-in gate. Assistants and scripts: GET /llms.txt says how to get in." />
   <meta name="robots" content="noindex, nofollow" />
   ${previewHead(tctx, requestUrl)}
   <link rel="preload" href="/fonts/inter-latin-wght-normal.woff2" as="font" type="font/woff2" crossorigin />
@@ -7022,6 +7030,7 @@ function loginPage(tctx, redirect, error, requestUrl, opts = {}) {
     </div>
     ${formBody}
     ${tctx.LOGIN_HINT && !passwordless ? `<p class="hint">${escapeHtml(tctx.LOGIN_HINT)}</p>` : ""}
+    <p class="hint door">Connecting an assistant or a script? It reads <a href="/llms.txt">/llms.txt</a>.</p>
   </main>
 </body>
 </html>`;
@@ -7359,8 +7368,86 @@ async function withDraftUi(tctx, res, url, me, env) {
   return new Response(html, { status: res.status, statusText: res.statusText, headers });
 }
 /** A content response, dressed: the live-reload poll, the current chrome, the draft bar, the cache policy. */
-async function serveContent(tctx, asset, url, me, env) {
-  return withAssetCache(await withDraftUi(tctx, await composeChrome(tctx, withLiveReload(tctx, asset, url), url), url, me, env), url);
+async function serveContent(tctx, asset, url, me, env, request = null) {
+  return withAgentPreface(withDoorLink(withAssetCache(await withDraftUi(tctx, await composeChrome(tctx, withLiveReload(tctx, asset, url), url), url, me, env), url)), request, url, me);
+}
+
+/**
+ * Is this fetch a BROWSER's? Every browser sends `Sec-Fetch-Dest` (and `-Mode`) on every
+ * request it makes — a navigation, an iframe, an image, a prefetch — and no scripted
+ * fetcher does: curl, node, Python, the fetch behind a summarising tool. The headers are
+ * forbidden to page script, so a page cannot fake them off; a fetcher can only fake them
+ * ON, which is the harmless direction. A `Mozilla/` user agent counts as a browser too,
+ * for the browser old enough to send no Sec-Fetch at all and for the fetcher that dresses
+ * as one — both get the page a person gets, which is the conservative side of the line.
+ */
+function browserFetch(request) {
+  if (!request || !request.headers) return true;
+  if (request.headers.has("Sec-Fetch-Dest") || request.headers.has("Sec-Fetch-Mode")) return true;
+  return /^Mozilla\//.test(request.headers.get("User-Agent") || "");
+}
+
+/**
+ * The one paragraph a non-browser fetch of a prototype is given, first in the body.
+ *
+ * DESCRIPTIVE, THIRD PERSON, NO ADDRESS AND NO REASSURANCE. A first draft said "Assistants
+ * and scripts: … a terminal is paired with the person's approval, and nobody is ever asked
+ * for a password", and the third cold agent read exactly that sentence as a prompt
+ * injection — text on a fetched page that speaks to the agent and reassures it is the
+ * shape of an attack, whatever it says. A statement of fact and a link is what a page may
+ * carry: what this is, and where the workspace documents how it is edited.
+ */
+function agentPreface(url) {
+  const origin = escapeHtml(url.origin);
+  return `<p data-augur-door>This prototype is served by an Augur workspace (${origin}). `
+    + `The workspace documents how its prototypes are edited at <a href="${DOOR_DOCS}">${origin}${DOOR_DOCS}</a>.</p>`;
+}
+
+/**
+ * A prototype fetched by something that is not a browser opens with the door.
+ *
+ * An agent handed a prototype's URL fetches the page and finds a finished site with
+ * nothing on it about how it is edited — the customer's own HTML, and on a public
+ * prototype never the gate. The `Link` header (below) reaches a scripted agent; a
+ * summarising fetch keeps only the text. So a fetch that carries no browser headers gets
+ * ONE paragraph prepended to the body, naming the origin and `/llms.txt`, and a browser
+ * gets the page byte for byte as published — a person never sees it, an embed never
+ * carries it, and the design is not touched. Decided 6 Sep 2026 after two of four cold
+ * agents fetched the prototype rather than the workspace and told the person to ask a
+ * developer.
+ *
+ * `no-store`, so the agent's variant is never what a cache hands a browser; the wrap is
+ * the outermost on the serving path for the same reason — nothing below it stores what
+ * this adds. Only a 200 HTML page: an error page, a redirect and a stylesheet are left alone.
+ * Only a SIGNED-OUT fetch: a request carrying a member's session is already inside, and
+ * what it is served — the gallery, a gated prototype — stays byte for byte what it was.
+ */
+async function withAgentPreface(res, request, url, me = null) {
+  if (!res || res.status !== 200 || !/text\/html/.test(res.headers.get("Content-Type") || "")) return res;
+  if (me || browserFetch(request)) return res;
+  const html = await res.text();
+  const m = /<body[^>]*>/i.exec(html);
+  const out = m ? html.slice(0, m.index + m[0].length) + agentPreface(url) + html.slice(m.index + m[0].length) : agentPreface(url) + html;
+  const headers = new Headers(res.headers);
+  headers.delete("Content-Length");
+  headers.delete("ETag");
+  headers.set("Cache-Control", "no-store");
+  headers.set("Vary", "Sec-Fetch-Dest, User-Agent");
+  return new Response(out, { status: res.status, statusText: res.statusText, headers });
+}
+/**
+ * A served page carries the same `Link: </llms.txt>; rel="help"` the gate carries. An agent
+ * handed the URL of a PUBLIC prototype never meets the gate — it fetches the page, finds a
+ * finished site with nothing on it about how it is edited, and gives up. The header is the
+ * one pointer that costs the page no bytes and no pixels; a scripted agent reads it, and a
+ * summarising one at least reaches the gate's own words at the workspace root.
+ */
+function withDoorLink(res) {
+  if (!res || !/text\/html/.test(res.headers.get("Content-Type") || "")) return res;
+  if (res.headers.get("Link")) return res;
+  const headers = new Headers(res.headers);
+  headers.set("Link", `<${DOOR_DOCS}>; rel="help"`);
+  return new Response(res.body, { status: res.status, statusText: res.statusText, headers });
 }
 
 // Test seam: loadConfig fills the chrome pointer, the workspace list and the runtime-
@@ -8386,6 +8473,43 @@ async function readStateFamily(tctx, env, entry, store, kv) {
     }
     return await store.read(family, "");
   }
+  // ── the identity families the workspace OBJECT holds since the cut-over ──────────
+  //
+  // `publish:tokens` is read by the publish path from the object FIRST and KV second, and a
+  // mint writes both — so a row can be in one store and not the other. Reading KV alone
+  // here (which is what this did) produced a `--full` copy that omitted tokens which were
+  // live and answering; a restore from it would have dropped them without a word. The copy
+  // is the union of both stores.
+  //
+  // ⚠️ FOR A HASH BOTH STORES HOLD, KV'S RECORD IS THE ONE COPIED, VERBATIM. The object's
+  // row is a projection into columns — it stamps a `createdAt` on a record the copy never
+  // carried and spells `label` as null where the record had none — and a copy that took
+  // the projection stopped verifying: `augur migrate` compares the target's export with the
+  // source's, and a KV→workspace migration reported `publish:tokens` as not matching on
+  // data that had landed. What the object ADDS is the rows KV lacks; what KV holds is what a
+  // restore wrote and what a verifier reads back. (The admin panel lists the same union the
+  // other way round — the object's row is what governs a publish — and that is a display
+  // question, not a copy question.)
+  //
+  // An object that CANNOT be asked throws, and the export files that under `failed` — a
+  // restore refuses such a copy. Answering from KV alone instead would be a copy that calls
+  // itself full while missing every object-held token, the exact thing this branch closes.
+  if (entry.id === PUBLISH_TOKENS_KEY) {
+    const ident = identityFor(env, tctx, "publishTokens");
+    if (ident) {
+      const listed = await ident.tokenList();
+      const held = (listed && listed.tokens && typeof listed.tokens === "object") ? listed.tokens : {};
+      let map = null;
+      if (kv) {
+        const raw = await kv.get(entry.id);
+        if (raw != null) { try { map = JSON.parse(raw); } catch (e) { map = null; } }
+      }
+      // Absent stays absent: no document in KV and no row in the object is the one answer a
+      // restore must LEAVE alone (it clears a `{}`). A seeded-but-empty object is `{}`.
+      if (map === null && !Object.keys(held).length && !(listed && listed.seeded)) return null;
+      return { ...held, ...(map || {}) };
+    }
+  }
   if (!kv) return null;
   if (STATE_KV_PREFIXED.includes(entry.id)) {
     const out = {};
@@ -8652,6 +8776,9 @@ async function importState(tctx, env, doc) {
       },
     );
 
+    // Whether the copy carried the roster overlay at all: the object counts the people
+    // the copy does not name only when the copy claims to say who belongs.
+    identity.rosterCarried = Object.prototype.hasOwnProperty.call(doc.families, "users:roster");
     const res = await stub.fetch("https://workspace/state/import", {
       method: "POST",
       headers: { "content-type": "application/json" },
@@ -8660,7 +8787,15 @@ async function importState(tctx, env, doc) {
       }),
     });
     if (!res.ok) return { ok: false, reason: "workspace-refused", status: res.status };
-    const { atomic, refused } = await res.json();
+    const { atomic, refused, members } = await res.json();
+    // The people `prune` removed from the object are removed the way the admin panel
+    // removes them: the session, the KV-side token and invite copies go too. Best-effort
+    // and after the object's transaction — the row is the fact, these are its consequences.
+    for (const email of (members && members.removed) || []) {
+      try { await revokeSecret(env, email, tctx); } catch (e) { /* no KV binding: nothing to revoke there */ }
+      await revokePublishTokens(tctx, env, email);
+      await revokeInvitesFor(tctx, env, email);
+    }
     // ⚠️ THE IDENTITY FAMILIES GO TO BOTH, AND THAT IS THE POINT OF THE SPLIT.
     // The object gets a faithful copy and KV stays exactly what the KV path reads, so a
     // restore cannot take an instance down whichever store is currently answering. With the
@@ -8681,6 +8816,9 @@ async function importState(tctx, env, doc) {
       // from a complete one, which is the failure this whole path exists to avoid.
       unmapped: identitySkipped,
       refusedRows: refused || [],
+      // Who the copy did not name and what became of them — `kept` on a plain restore,
+      // `removed` under `prune`. Absent when the copy carried no roster.
+      ...(members ? { members } : {}),
     };
   }
 
@@ -9100,6 +9238,8 @@ function wantsJson(request, url) {
 // probe and the "an unknown path and the root are the same page" contract depend on it.
 const DOOR_DOCS = "/llms.txt";
 const DOOR_WELL_KNOWN = "/.well-known/augur.json";
+/** The engine's public source — what the CLI on npm is built from, named so an agent can check. */
+const ENGINE_SOURCE = "https://github.com/andratwiro/augur";
 
 /** Does this deployment serve drafts — a unit store beside a bundle store. The same two checks `unitApi` makes. */
 const draftsServedHere = (env) => !!(env && env.BUNDLES && unitNamespace(env));
@@ -9114,6 +9254,10 @@ function doorFacts(tctx, url, env) {
     engine: tctx.INSTANCE_ENGINE_VERSION ? { version: tctx.INSTANCE_ENGINE_VERSION } : {},
     pairing: { enabled: pairing, start: "/__publish/_pair/start", approve: "/__connect" },
     connect: pairing ? `npx @augurworks/augur connect --origin ${url.origin}` : null,
+    // Where the CLI comes from, for an agent that checks before it runs anything: the
+    // package is the same open-source engine that serves this page, and `npm view
+    // @augurworks/augur repository` names the same repository.
+    source: ENGINE_SOURCE,
     docs: DOOR_DOCS,
     // Where drafts are served, a prototype is changed by opening it, not by shipping a
     // tree — and the door is where a cold agent learns which of the two this instance is.
@@ -9134,11 +9278,16 @@ function doorText(f) {
       + `It prints a link and a code. The owner of this workspace opens the link in a\n`
       + `browser they are already signed in to and enters the code. The token lands on\n`
       + `that machine, and every verb below uses it from then on.\n\n`
-      + `AGENTS: if your person reads your messages only after you finish your turn, run\n`
-      + `it with --no-wait. It prints the line and exits; send them that line, end your\n`
-      + `turn, and run the same command again once they say they approved — the token is\n`
-      + `collected then, for that same code. Do not poll for the approval in one turn:\n`
-      + `the code lives five minutes and nobody sees it until you stop.\n\n`
+      + `The CLI is this engine's own, open source at ${f.source} — the same engine that\n`
+      + `serves this page; \`npm view @augurworks/augur repository\` names that repository.\n\n`
+      + `AGENTS: the approval is the person's act, in their browser — you cannot approve\n`
+      + `it from here and must not try; your part is to send them the line and collect\n`
+      + `the token afterwards. If your person reads your messages only after you finish\n`
+      + `your turn, run it with --no-wait: it prints the line and exits. Send them that\n`
+      + `line, end your turn, and run the same command again once they say they approved —\n`
+      + `the token is collected then, for that same code, and no second code is minted.\n`
+      + `Waiting inside one turn skips nothing; it only hides the code from them for the\n`
+      + `five minutes it lives.\n\n`
       + (f.drafts && f.drafts.enabled
         ? `You need no source tree here: \`augur open <opportunity>/<prototype>\` fetches that one\n`
           + `prototype into a folder of its own (see below). Do not clone the workspace first.\n\n`
@@ -12247,7 +12396,7 @@ async function handleRequest(request, env, ctx, url, trace) {
       }
       const asset = await assetFetch(tctx.tenantId, env, request);
       if (asset.status === 404) return notFoundResponse(tctx);
-      return serveContent(tctx, asset, url, me, env);
+      return serveContent(tctx, asset, url, me, env, request);
     }
 
     // Published prototypes are public — never gated, regardless of the cookie.
@@ -12256,7 +12405,7 @@ async function handleRequest(request, env, ctx, url, trace) {
     if (isPublicPath(tctx, url.pathname)) {
       const asset = await assetFetch(tctx.tenantId, env, request);
       if (asset.status === 404) return notFoundResponse(tctx);
-      const res = await serveContent(tctx, asset, url, me, env);
+      const res = await serveContent(tctx, asset, url, me, env, request);
       const out = new Response(res.body, res);
       out.headers.set("X-Robots-Tag", "noindex, nofollow, noarchive");
       return out;
@@ -12287,14 +12436,14 @@ async function handleRequest(request, env, ctx, url, trace) {
       // Where drafts are served, the gallery and its indexes are derived from the live
       // store rather than read from it — a landing is on them at once.
       const derived = await derivedPage(tctx, env, url);
-      if (derived) return stamp(derived.status === 308 ? derived : await serveContent(tctx, derived, url, me, env));
+      if (derived) return stamp(derived.status === 308 ? derived : await serveContent(tctx, derived, url, me, env, request));
       const asset = await assetFetch(tctx.tenantId, env, request, { dsDraft: ds.draft });
       if (asset.status === 404) {
         const virt = await virtualCanvas(tctx, request, env, url);
         if (virt) return stamp(virt);
         return stamp(notFoundResponse(tctx));
       }
-      return stamp(await serveContent(tctx, asset, url, me, env));
+      return stamp(await serveContent(tctx, asset, url, me, env, request));
     }
 
     // Created canvas boards are public like published prototypes — same obscure
@@ -12376,7 +12525,7 @@ export const __testables = Object.freeze({
   doorFacts, doorText, wantsMachineDoor, gateResponse, DOOR_DOCS, DOOR_WELL_KNOWN,
   resumeAfterDormancy,
   PITI_VIEW_KEY, PITI_REMARKS_KEY,
-  publishAuthDetailed, unitApi, unitCaller, personFace, withDraftUi, draftUiBoot, derivedPage, dsOverlay, isEngineChrome, publishRefusalBody, splitDraftPath,
+  publishAuthDetailed, unitApi, unitCaller, personFace, withDoorLink, withAgentPreface, browserFetch, withDraftUi, draftUiBoot, derivedPage, dsOverlay, isEngineChrome, publishRefusalBody, splitDraftPath,
   adminStorageApi,
   adminCustomDomainApi,
   isPrefixBacked, backedPublicPrefixes,

package/src/drafts/drafts.js

@@ -223,6 +223,7 @@
         row.appendChild(face(l));
         var text = el("div");
         var who = l.by === "live" ? "Adopted from the live site" : label(l);
+        if (l.draft && l.draft.owner) who += " · draft by " + label(l.draft);
         text.appendChild(el("div", null, "#" + l.revision + " · " + who));
         var meta = (l.note ? l.note + " · " : "") + ago(l.at, "landed")
           + (l.restoredFrom ? " · restored from #" + l.restoredFrom : "")

package/src/tenant-do.js

@@ -739,7 +739,7 @@ function seedCount(seed) {
  * `users:roster`'s `remove` list, and dropping the person here instead would let a
  * re-invite inherit the role the last holder of that address had.
  */
-function writeIdentity(sql, identity, at, written = [], refused = []) {
+function writeIdentity(sql, identity, at, written = [], refused = [], { prune = false } = {}) {
   if (!identity || typeof identity !== "object") return { written, refused };
   const list = (k) => (Array.isArray(identity[k]) ? identity[k] : []);
   const touched = (family, n) => { if (n) written.push(family); };
@@ -775,6 +775,39 @@ function writeIdentity(sql, identity, at, written = [], refused = []) {
   touched("members", n);
   if (n) markSeeded(sql, "roster", at);
 
+  // ── the people the copy does NOT name ──────────────────────────────────────────
+  //
+  // On KV the roster overlay is one document and an import replaces it, so anybody the
+  // copy does not name is gone. Here the rows above were upserted and every other row was
+  // left as it was — a member the copy does not name STAYS, with their session and their
+  // tokens, and for a while this reported `users:roster` as written and said nothing else,
+  // which read as a replace. So the ones left are counted and named:
+  //
+  //   · a plain restore says "at least this" and KEEPS them — `kept` says who, so a person
+  //     reading the result cannot mistake a keep for a replace;
+  //   · `prune` says "exactly this" and REMOVES them the way the admin panel's remove
+  //     does — a tombstone (a re-invite must not inherit the old role), no publish token,
+  //     no outstanding invite. The worker revokes the session and the KV-side copies.
+  //
+  // Only overlay rows: a config member is the durable roster, not the copy's to remove.
+  // Only when the copy CARRIED the roster family — a copy of nothing but statuses says
+  // nothing about who belongs. `rosterCarried` is the worker's word for that.
+  let members;
+  if (identity.rosterCarried) {
+    const named = new Set(list("members").map((m) => lcAddr(m && m.email)).filter(Boolean));
+    const left = [...sql.exec(
+      `SELECT email FROM members WHERE source = 'overlay' AND removed_at IS NULL ORDER BY email`,
+    )].map((r) => String(r.email)).filter((e) => !named.has(e));
+    members = { kept: [], removed: [] };
+    for (const e of left) {
+      if (!prune) { members.kept.push(e); continue; }
+      sql.exec(`UPDATE members SET removed_at = ? WHERE email = ?`, at, e);
+      sql.exec(`DELETE FROM publish_tokens WHERE LOWER(label) = ?`, e);
+      sql.exec(`DELETE FROM invites WHERE email = ?`, e);
+      members.removed.push(e);
+    }
+  }
+
   n = 0;
   for (const i of list("invites")) {
     if (!i || !i.tokenHash) continue;
@@ -838,7 +871,7 @@ function writeIdentity(sql, identity, at, written = [], refused = []) {
   }
   touched("blobs", n);
 
-  return { written, refused };
+  return { written, refused, members };
 }
 
 /**
@@ -2550,11 +2583,12 @@ export class TenantStore {
           written.push(scope ? `${family}/${scope}` : family);
         }
       }
-      writeIdentity(this.sql, identity, stamp, written, refused);
+      members = writeIdentity(this.sql, identity, stamp, written, refused, { prune }).members;
     };
+    let members;
     const atomic = typeof this.ctx.storage.transactionSync === "function";
     if (atomic) this.ctx.storage.transactionSync(body); else body();
-    return { written, refused, atomic };
+    return members ? { written, refused, atomic, members } : { written, refused, atomic };
   }
 
   /**

package/src/unit-object.mjs

@@ -265,11 +265,17 @@ export class UnitObject {
     const rows = [...this.sql.exec(`SELECT * FROM landings ORDER BY revision DESC`)];
     return {
       revision: this.mainRevision(),
-      landings: rows.map((r) => ({
-        revision: Number(r.revision), by: r.by || null, session: r.session || "", at: r.at, note: r.note || "",
-        draftId: r.draft_id || null, restoredFrom: r.restored_from == null ? null : Number(r.restored_from),
-        files: Object.keys(JSON.parse(r.tbl)).length,
-      })),
+      landings: rows.map((r) => {
+        // Any member may land any draft from the bar, so a landing has two people on it:
+        // who pressed Land (`by`) and whose draft it was. The draft row keeps the second.
+        const d = r.draft_id ? this.draft(r.draft_id) : null;
+        return {
+          revision: Number(r.revision), by: r.by || null, session: r.session || "", at: r.at, note: r.note || "",
+          draftId: r.draft_id || null, restoredFrom: r.restored_from == null ? null : Number(r.restored_from),
+          draftOwner: d ? d.owner : null, draftSession: d ? d.session : "",
+          files: Object.keys(JSON.parse(r.tbl)).length,
+        };
+      }),
     };
   }