@coffre/vault 0.5.0 → 0.6.0

package/dist/{vault-CP8yU8xq.js → vault-ihE3Yc4a.js}

@@ -2,13 +2,13 @@ import { ACCESS_ACTIONS, checkpointMessage, checkpointVerifier, describeAccessFa
 import { DEK_BYTES, KEY_CHECK, KEY_CHECK_CONTEXT, KEY_CHECK_VALUE, KekBadClaimError, KekCancelledError, KekUnavailableError, LocalKekProvider } from "@coffre/core/kek";
 import { createHmac, hkdfSync, randomUUID, timingSafeEqual } from "node:crypto";
 import { tablesOf } from "@coffre/db";
-import { EVERYWHERE, NOTHING, allows, assignableToEnvironment, convertEveryProjectGrants, givesService, grantKind, isCredentialScope, isInstanceRole, isRole, isScope, managesService, mayManageAccess, normalScope, runsInstance, setsUpServices, unscoped } from "@coffre/core/access";
+import { EVERYWHERE, NOTHING, allows, assignableToEnvironment, givesService, grantKind, isCredentialScope, isInstanceRole, isRole, isScope, managesService, mayManageAccess, normalScope, ownsInstance, runsInstance, setsUpServices, unscoped } from "@coffre/core/access";
 import { GENESIS_HASH, deriveLogKey, verifyEntries } from "@coffre/core/audit";
 import { checkContext } from "@coffre/core/envelope";
 import { shownMember } from "@coffre/core/schemas";
 import { SNAPSHOT, clockMillis, engineOf, forUpdate, isUniqueViolation, tombstone, truth } from "@coffre/db/dialect";
-import { accessEntriesAbout, insertGrant, newestAccess, readGrants, reportStands, roleColumns, storedRole } from "@coffre/db/grants";
-import { LOOK_BACK, appendEntries, entryColumns, lockLogHead, newestAuthentic } from "@coffre/db/log";
+import { accessEntriesAbout, everyProjectConversion, insertGrant, liveProjects, newestAccess, readGrants, reportStands, roleColumns, storedRole } from "@coffre/db/grants";
+import { LOOK_BACK, appendEntries, entryColumns, lockLogHead, newestAuthentic, newestVaultEntries } from "@coffre/db/log";
 import { and, asc, count, desc, eq, gt, gte, inArray, isNull, lt, lte, or, sql } from "drizzle-orm";
 //#region src/accounting.ts
 const KEY_ACTIONS = /* @__PURE__ */ new Set([
@@ -228,6 +228,16 @@ async function allMembers(db) {
 	return (await db.select(memberColumns(db)).from(vaultMembers).orderBy(asc(vaultMembers.principal))).map(memberOf);
 }
 /**
+* The rows that say their member is an active Owner of the whole instance
+* (`ownsInstance` in @coffre/core/access), as stored: a row changed around
+* the vault says so too, which the caller checks. The scope is read as the
+* row's MAC reads it, parsed: any way of writing everywhere is everywhere.
+*/
+async function instanceOwners(db) {
+	const { vaultMembers } = tablesOf(db);
+	return (await db.select(memberColumns(db)).from(vaultMembers).where(and(eq(vaultMembers.status, "active"), eq(vaultMembers.role, "owner"))).orderBy(asc(vaultMembers.principal))).map(memberOf).filter(ownsInstance);
+}
+/**
 * Lock these members' rows for the rest of the transaction, in one order
 * everywhere, and read them: those that have none are not in the map. Every
 * decision about a member takes its row first, so two of them, from any
@@ -331,26 +341,6 @@ async function places(db, projectIds, environmentIds) {
 		deleted: new Set([...foundProjects, ...foundEnvironments].filter((row) => row.deleted).map((row) => row.id))
 	};
 }
-/** Every project not deleted, with its environments not deleted: what a grant on every project of 0.4 reached. */
-async function liveProjects(db) {
-	const { projects, environments } = tablesOf(db);
-	const [found, inside] = await Promise.all([db.select({
-		id: projects.id,
-		deleted: truth(tombstone(projects.slug))
-	}).from(projects).orderBy(asc(projects.id)), db.select({
-		id: environments.id,
-		projectId: environments.projectId,
-		slug: environments.slug,
-		deleted: truth(tombstone(environments.slug))
-	}).from(environments).orderBy(asc(environments.id))]);
-	return found.filter((project) => !project.deleted).map((project) => ({
-		id: project.id,
-		environments: inside.filter((environment) => environment.projectId === project.id && !environment.deleted).map(({ id, slug }) => ({
-			id,
-			slug
-		}))
-	}));
-}
 /** Who holds a grant on every project of 0.4, lapsed or not, which the vault replaces (`#convert`). */
 async function everyProjectHolders(db) {
 	const { vaultGrants } = tablesOf(db);
@@ -476,11 +466,6 @@ async function latestVaultEntry(db, actions) {
 	const [row] = await db.select(entryColumns(db)).from(auditLog).where(and(eq(auditLog.author, "vault"), inArray(auditLog.action, [...actions]), eq(auditLog.decision, "allow"))).orderBy(desc(auditLog.seq)).limit(1);
 	return row === void 0 ? void 0 : stored([row])[0];
 }
-/** Up to `limit` of the vault's allowed entries of `action` before `before` (the newest when undefined), newest first. */
-async function newestVaultEntries(db, action, limit, before) {
-	const { auditLog } = tablesOf(db);
-	return stored(await db.select(entryColumns(db)).from(auditLog).where(and(eq(auditLog.author, "vault"), eq(auditLog.action, action), eq(auditLog.decision, "allow"), before === void 0 ? void 0 : lt(auditLog.seq, before))).orderBy(desc(auditLog.seq)).limit(limit));
-}
 /** The vault's newest allowed access entry about each member who has one. */
 async function newestAccessEntries(db) {
 	const { auditLog } = tablesOf(db);
@@ -964,7 +949,6 @@ async function prepareVault(config, options = {}) {
 			clockOffset: options.clockOffset ?? (() => 0)
 		},
 		verified: UNVERIFIED,
-		rooted: /* @__PURE__ */ new Set(),
 		reported: /* @__PURE__ */ new Set(),
 		since: null,
 		superseded: null,
@@ -1000,7 +984,7 @@ const PRINCIPAL = /^(user|token):[^\s:][^\s]*$/;
 /** A person, and a service account: only a person sets one up (`givesService`). */
 const PERSON = /^user:/;
 const SERVICE = /^token:/;
-/** Who acts for the vault itself, as when it gives a root admin a member row. */
+/** Who acts for the vault itself, as when it makes an Owner its deployment names. */
 const VAULT_ACTOR = "system:vault";
 /** How many stored keys a KEK with no check yet is tried on: one that opens proves it. */
 const KEY_CHECK_SAMPLE = 3;
@@ -1024,6 +1008,12 @@ const CLOSED_SETTINGS = { serviceAccounts: {
 	projects: { only: [] },
 	environments: "all"
 } };
+/** Why a change to who is an Owner, scoped or not, is refused to anyone else: Owners make and unmake Owners. */
+const OWNERS_ONLY = "only an Owner of the whole instance makes someone an Owner, or changes or removes one";
+/** Why nobody demotes or removes a person the deployment names (`owners`), themselves included. */
+function declaredOwner(principal) {
+	return `the deployment names ${principal.slice(5)} an Owner (owners, in the vault's configuration): take them off that list and deploy first`;
+}
 /** Why a person's change to a service account is refused. */
 const NOT_THEIRS = "a person gives a service account at most what they hold, where the instance lets them set one up, and only to one whose every grant they hold";
 /** Who asks for checkpoints: the app's scheduled job. */
@@ -1072,7 +1062,7 @@ const MESSAGES = {
 	deleted: "this project or environment was deleted",
 	ended: "the reference read through was ended",
 	not_allowed: "not allowed to change this",
-	root_admin: "root admins are set in the vault configuration",
+	last_owner: "the last Owner of the whole instance stays one: make someone else an Owner first",
 	invalid: "not something the rules allow",
 	log_broken: "the vault log does not hold from the last checkpoint",
 	wrong_kek: "this vault's key does not open the data it holds",
@@ -1319,7 +1309,7 @@ var VaultService = class {
 	async #settled() {
 		const prepared = this.#prepared;
 		if (prepared.since === null && prepared.superseded === null) await this.#settle();
-		if (prepared.superseded === null && !prepared.converted) await this.#convert();
+		if (prepared.superseded === null && prepared.since !== null && !prepared.converted) await this.#convert();
 		return prepared.superseded;
 	}
 	/**
@@ -1336,14 +1326,16 @@ var VaultService = class {
 	* genuine row put back). `reportStands` is the rule, which `coffre
 	* migrate` applies too, holding no key, to every entry in the vault's
 	* name: it lists and marks a member so reported, forged or not.
-	* Removing them clears both.
+	* Removing them clears both. Then everyone the deployment names becomes
+	* an Owner (`#declare`): after, so that what their grants become is what
+	* `coffre migrate` says, by the same rule over the same rows
+	* (`everyProjectConversion`), which cannot tell who the configuration
+	* names. Until both finish, each call does again what is left, a few
+	* reads once nothing is.
 	*/
 	async #convert() {
-		for (const principal of await everyProjectHolders(this.#db)) {
-			if (this.#isRootAdmin(principal)) continue;
-			await this.#decideNow([principal], (d) => this.#replaceEveryProject(d, principal));
-		}
-		this.#prepared.converted = true;
+		for (const principal of await everyProjectHolders(this.#db)) await this.#decideNow([principal], (d) => this.#replaceEveryProject(d, principal));
+		this.#prepared.converted = await this.#declare(this.#config.owners.map((email) => `user:${email}`));
 	}
 	async #replaceEveryProject(d, principal) {
 		const row = d.members.get(principal);
@@ -1354,22 +1346,7 @@ var VaultService = class {
 		if (await reportStands(d.tx, principal, this.#check(d.reports, principal))) return;
 		await lockLogHead(d.tx);
 		const before = roleOf(principal, row);
-		const conversion = convertEveryProjectGrants({
-			person: principal.startsWith("user:"),
-			role: before.role,
-			everyProject: everyProject.filter((grant) => live(grant, d.at)).map((grant) => ({
-				environmentSlug: grant.environmentSlug,
-				role: grant.role,
-				expiresAt: grant.expiresAt
-			})),
-			grants: subject.stored.filter((grant) => grantKind(grant) !== null && live(grant, d.at)).map((grant) => ({
-				projectId: grant.projectId,
-				environmentId: grant.environmentId,
-				role: grant.role,
-				expiresAt: grant.expiresAt
-			})),
-			projects: await liveProjects(d.tx)
-		});
+		const conversion = everyProjectConversion(principal, before.role, subject.stored, d.at, await liveProjects(d.tx));
 		const after = {
 			role: conversion.role,
 			scope: conversion.scope
@@ -1693,7 +1670,6 @@ var VaultService = class {
 		};
 	}
 	async #refuseVersions(principal, code, entries) {
-		if (this.#isRootAdmin(principal)) await this.#rootRow(principal);
 		return this.#decide([principal], async () => {
 			throw new Refused(refusal(code, MESSAGES[code]), entries);
 		});
@@ -1729,7 +1705,6 @@ var VaultService = class {
 		if (wrongKek !== null) return this.#decide([], async () => {
 			throw new Refused(refusal("wrong_kek", wrongKek), secrets.map((secret) => entry(secret, "deny", "wrong_kek")));
 		});
-		if (this.#isRootAdmin(principal)) await this.#rootRow(principal);
 		const check = async (d) => {
 			const reader = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports), call.input);
 			const at = secrets.map((secret, i) => call.places?.[i] ?? secret);
@@ -1875,7 +1850,6 @@ var VaultService = class {
 				})
 			};
 		};
-		if (this.#isRootAdmin(principal)) await this.#rootRow(principal);
 		return this.#decide([principal], async (d) => {
 			const reader = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports), input);
 			const environments = await environmentsById(d.tx, items.flatMap((item) => {
@@ -1948,7 +1922,6 @@ var VaultService = class {
 				...traced(input)
 			})
 		});
-		if (this.#isRootAdmin(principal)) await this.#rootRow(principal);
 		if (sealed.some((seal) => seal === null)) return this.#decide([principal], async () => {
 			throw new Refused(refusal("bad_claim", MESSAGES.bad_claim), vias.map((via, i) => entry(via, sealed[i], "deny", "bad_claim")));
 		});
@@ -1996,80 +1969,129 @@ var VaultService = class {
 			return sealedReference(entry, via.reference);
 		});
 	}
-	#isRootAdmin(principal) {
-		return principal.startsWith("user:") && this.#config.rootAdmins.includes(principal.slice(5));
+	/** Whether the deployment names `principal` an Owner of the whole instance (`owners`). */
+	#listed(principal) {
+		return principal.startsWith("user:") && this.#config.owners.includes(principal.slice(5));
 	}
 	/**
-	* Give a root admin a member row the first time anyone asks about them:
-	* the app's sign-ins and sessions point at it, and their reads queue on
-	* it like anyone's. Logged, and made in a transaction of its own, under
-	* the log's lock: a decision that held the head and then waited for a
-	* member row would take the locks out of order. The row never makes
-	* anyone a root admin; the configuration does. Rows are never deleted, so
-	* one read finds it made already, as on every fresh isolate but the first,
-	* without queueing on the log's lock.
+	* An Owner of the whole instance other than `except`, as their row says
+	* and its check holds (`#integrity`), or null when there is none. A row
+	* changed around the vault owns nothing, and is reported. Read under the
+	* log's head, which every change to a member takes before it writes, the
+	* answer stands until the reader commits.
 	*/
-	async #rootRow(principal) {
-		if (this.#prepared.rooted.has(principal) || await this.#settled() !== null) return;
-		if (await member(this.#db, principal) !== void 0) {
-			this.#prepared.rooted.add(principal);
-			return;
+	async #anOwner(db, reports, except = null) {
+		for (const row of await instanceOwners(db)) {
+			if (row.principal === except) continue;
+			if (await this.#integrity(db, row.principal, row, await grants(db, row.principal), reports) === null) return row.principal;
 		}
-		await this.#db.transaction(async (tx) => {
-			await lockLogHead(tx);
-			if (await member(tx, principal) !== void 0) return;
-			const { occurredAt: at, seqStart } = await this.#append(tx, [{
-				actor: VAULT_ACTOR,
-				action: "member.add",
-				decision: "allow",
-				subjectPrincipal: principal,
-				metadata: JSON.stringify({
-					role: "member",
-					rootAdmin: true
-				})
-			}]);
-			const row = {
+		return null;
+	}
+	/**
+	* Make each of `principals`, people the deployment names (`owners`), an
+	* Owner of the whole instance, whoever else is one: asked about all of
+	* them at the start of each process (`#convert`), and at `access` about
+	* one who owns nothing, which is a new instance's first sign-in, before
+	* the vault has written to its log, and the way back for someone whose
+	* row was changed around the vault since. An unlocked read of each finds
+	* who is one already, the quick way out: a hint, never a report, and
+	* never `#record`, which would settle the vault, and so convert, again;
+	* one it cannot tell, a row changing under it as another process makes
+	* them an Owner, is due. Then one decision, under the others' rows, reads
+	* again (`#makeOwner`). One whose row the log never admitted stays as it is,
+	* and is asked about again at each of their requests. Whether it ran.
+	*/
+	async #declare(principals) {
+		const at = await this.#now(this.#db);
+		const due = [];
+		for (const principal of principals) {
+			const subject = await this.#standing(this.#db, principal, await member(this.#db, principal), at, []).catch((error) => {
+				if (error instanceof Retry) return null;
+				throw error;
+			});
+			if (!(subject?.status === "active" && ownsInstance(subject.live))) due.push(principal);
+		}
+		if (due.length === 0) return true;
+		return (await this.#decideNow(due, async (d) => {
+			for (const principal of due) await this.#makeOwner(d, principal, "owners");
+		})).ok;
+	}
+	/**
+	* Refuse a change that would leave `principal`, an Owner of the whole
+	* instance, no longer one, unless another is. Counted under the log's
+	* head: two changes at once, each demoting or removing a different
+	* Owner, lock different rows, and only the head puts one after the other.
+	*/
+	async #keepAnOwner(d, actor, principal, refused) {
+		await lockLogHead(d.tx);
+		if (await this.#anOwner(d.tx, d.reports, principal) !== null) return;
+		throw refused("last_owner", actor === principal ? "you're the last Owner of the whole instance: make someone else an Owner first" : `${principal.slice(5)} is the last Owner of the whole instance: make someone else an Owner first`);
+	}
+	/**
+	* Make `principal`, a person, an Owner of the whole instance, as the
+	* vault, for `reason`: admitted, brought back, or given the role, the
+	* grants they hold kept. One whose row fails its check is started over
+	* first, as removing them would; one the log never admitted, whose row was
+	* written around the vault, is left as it is. Whether it made them one.
+	*/
+	async #makeOwner(d, principal, reason) {
+		const row = d.members.get(principal);
+		const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
+		if (subject.status === "active" && ownsInstance(subject.live)) return false;
+		const tampered = subject.status === "tampered";
+		if (tampered && await this.#logged(d.tx, principal) === void 0) return false;
+		const correlation = { operationId: randomUUID() };
+		const owner = {
+			role: "owner",
+			scope: EVERYWHERE
+		};
+		d.grants.set(principal, [...subject.stored]);
+		d.touched.add(principal);
+		if (tampered) await this.#startOver(d, VAULT_ACTOR, principal, row, subject.fault, correlation, (code, message) => new Refused(refusal(code, message ?? MESSAGES[code]), []));
+		if (row === void 0 && !tampered) {
+			d.log.push(accessEntry(VAULT_ACTOR, "member.add", principal, "allow", correlation, {
+				...owner,
+				reason
+			}));
+			d.writes.push((at) => insertMember(d.tx, {
 				principal,
 				status: "active",
-				role: "member",
-				scope: EVERYWHERE,
+				...owner,
 				generation: 0,
 				createdAt: at,
 				createdBy: VAULT_ACTOR,
 				statusChangedAt: at,
 				statusChangedBy: VAULT_ACTOR,
-				accessSeq: seqStart
-			};
-			await insertMember(tx, {
-				...row,
-				mac: memberMac(this.#prepared.rowKey, row, [])
-			});
-		});
-		this.#prepared.rooted.add(principal);
+				...UNSEALED
+			}));
+		} else if (tampered || row?.status === "removed") {
+			d.log.push(accessEntry(VAULT_ACTOR, "member.restore", principal, "allow", correlation, {
+				...owner,
+				reason
+			}));
+			d.writes.push((at) => updateMember(d.tx, principal, {
+				status: "active",
+				...owner,
+				statusChangedAt: at,
+				statusChangedBy: VAULT_ACTOR
+			}));
+		} else {
+			d.log.push(accessEntry(VAULT_ACTOR, "member.role", principal, "allow", correlation, {
+				...owner,
+				previousRole: row.role,
+				previousScope: row.scope,
+				reason
+			}));
+			d.writes.push(() => updateMember(d.tx, principal, owner));
+		}
+		return true;
 	}
 	/**
 	* What `principal` holds, their row checked first (`#integrity`): a row
-	* that fails holds nothing, and is `tampered`. A root admin's come from the
-	* configuration, which no row can change.
+	* that fails holds nothing, and is `tampered`.
 	*/
 	async #standing(db, principal, row, at, reports) {
 		const none = NOTHING;
-		if (this.#isRootAdmin(principal)) {
-			const root = {
-				isRootAdmin: true,
-				role: "owner",
-				scope: EVERYWHERE,
-				grants: []
-			};
-			return {
-				principal,
-				status: "active",
-				live: root,
-				all: root,
-				fault: null,
-				stored: []
-			};
-		}
 		const grants$1 = row === void 0 ? [] : await grants(db, principal);
 		const fault = await this.#integrity(db, principal, row, grants$1, reports);
 		if (fault !== null) return {
@@ -2105,13 +2127,11 @@ var VaultService = class {
 			principal,
 			status: "active",
 			live: {
-				isRootAdmin: false,
 				role,
 				scope,
 				grants: held.filter((grant) => live(grant, at))
 			},
 			all: {
-				isRootAdmin: false,
 				role,
 				scope,
 				grants: held
@@ -2121,23 +2141,11 @@ var VaultService = class {
 		};
 	}
 	#access(principal, row, held, at, tampered) {
-		if (this.#isRootAdmin(principal)) return {
-			principal,
-			status: "active",
-			generation: row?.generation ?? 0,
-			isRootAdmin: true,
-			role: "owner",
-			scope: EVERYWHERE,
-			grants: [],
-			since: null,
-			by: null
-		};
 		const active = PRINCIPAL.test(principal) && !tampered && row?.status === "active";
 		return {
 			principal,
 			status: tampered ? "tampered" : !PRINCIPAL.test(principal) ? "unknown" : row?.status ?? "unknown",
 			generation: row?.generation ?? 0,
-			isRootAdmin: false,
 			...active ? roleOf(principal, row) : {
 				role: "member",
 				scope: EVERYWHERE
@@ -2151,18 +2159,29 @@ var VaultService = class {
 	* What `principal` holds now. Read without locks, the fast way; a row that
 	* seems to fail its check is read again in one snapshot before anyone is
 	* called tampered, since a change committed between two of the reads
-	* looks like one.
+	* looks like one. A person the deployment names (`owners`) who owns
+	* nothing becomes an Owner of the whole instance first (`#declare`). A
+	* vault that holds no key the log's newest entries are under, given the
+	* wrong vault key, cannot tell a row it cannot check from one changed
+	* around it: it says so, an outage, rather than call the member tampered.
+	* A row it can check still answers, so a forged entry that stops it
+	* writing leaves the Owners able to sign in and find it.
 	*/
 	async access(principal) {
-		await this.#settled();
-		if (this.#isRootAdmin(principal)) await this.#rootRow(principal);
+		const superseded = await this.#settled();
+		const access = await this.#read(principal, superseded);
+		if (superseded !== null || !this.#listed(principal) || access.status === "active" && ownsInstance(access)) return access;
+		return await this.#declare([principal]) ? this.#read(principal, superseded) : access;
+	}
+	/** `access`, as the rows are now. */
+	async #read(principal, superseded) {
 		const read = async (db, reports) => {
 			const [row, held, at] = await Promise.all([
 				member(db, principal),
 				grants(db, principal),
 				this.#now(db)
 			]);
-			const fault = this.#isRootAdmin(principal) ? null : await this.#integrity(db, principal, row, held, reports);
+			const fault = await this.#integrity(db, principal, row, held, reports);
 			return this.#access(principal, row, held, at, fault !== null);
 		};
 		const found = [];
@@ -2176,6 +2195,7 @@ var VaultService = class {
 		}
 		const reports = [];
 		const access = await this.#db.transaction((tx) => read(tx, reports), SNAPSHOT);
+		if (access.status === "tampered" && superseded !== null) throw new Error(superseded);
 		await this.#record(reports);
 		return access;
 	}
@@ -2194,7 +2214,6 @@ var VaultService = class {
 		const held = await grants(db);
 		const newest = await newestAccessEntries(db);
 		for (const row of rows) {
-			if (this.#isRootAdmin(row.principal)) continue;
 			const grants = held.filter((grant) => grant.principal === row.principal);
 			const entry = newest.get(row.principal);
 			if (!(entry !== void 0 && this.#authentic(entry) && this.#sealed(row, grants) && entry.seq === row.accessSeq)) await this.#integrity(db, row.principal, row, grants, reports);
@@ -2227,7 +2246,6 @@ var VaultService = class {
 		return this.#decide([actor, principal], async (d) => {
 			validateCorrelation(input);
 			if (!PRINCIPAL.test(principal)) throw refused("invalid", `not a principal: ${principal}`);
-			if (this.#isRootAdmin(principal)) throw refused("root_admin");
 			const places$1 = /* @__PURE__ */ new Set();
 			for (const change of changes) {
 				if (grantKind(change) === null) throw refused("invalid", change.projectId === null && change.environmentId === null ? "grants are on a project or an environment: a person reaches every project by their instance role" : "an environment is named in its project");
@@ -2255,15 +2273,19 @@ var VaultService = class {
 			if (acting.status === "tampered") throw refused("tampered");
 			const manages = where.every((place) => mayManageAccess(acting.live, place));
 			if (!manages && !(SERVICE.test(principal) && PERSON.test(actor))) throw refused("not_allowed");
-			if (actor === principal && !acting.live.isRootAdmin && changes.some((change) => change.role !== null)) throw refused("not_allowed", "nobody grants themselves a role: ask another admin");
+			if (actor === principal && changes.some((change) => change.role !== null)) throw refused("not_allowed", "nobody grants themselves a role: ask another admin");
 			const row = d.members.get(principal);
 			const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
 			if (subject.status === "tampered") throw refused("tampered", TAMPERED_SUBJECT);
-			if (row?.status === "removed") throw refused("removed");
-			if (row === void 0) throw refused("not_a_member");
+			const admitted = input.admit === true && row?.status !== "active" ? await this.#admitWith(d, acting, principal, row, input) : void 0;
+			if (admitted === void 0 && row?.status === "removed") throw refused("removed");
+			if (admitted === void 0 && row === void 0) throw refused("not_a_member");
 			if (!manages) {
 				const setting = (await this.#settingsAt(d.tx, d.reports)).serviceAccounts;
-				const account = await this.#account(d.tx, subject, row);
+				const account = admitted !== void 0 || row === void 0 ? {
+					grants: [],
+					admittedBy: actor
+				} : await this.#account(d.tx, subject, row);
 				if (!changes.every((change, i) => {
 					const before = subject.live.grants.find((grant) => placeKey({
 						...grant,
@@ -2276,9 +2298,23 @@ var VaultService = class {
 			d.grants.set(principal, [...held]);
 			const outcomes = changes.map((change) => this.#apply(d, actor, principal, held, change, input));
 			if (d.writes.length > 0) d.touched.add(principal);
-			return { changes: outcomes };
+			return {
+				changes: outcomes,
+				...admitted === void 0 ? {} : { admitted }
+			};
 		});
 	}
+	/**
+	* Admit a service account that `setAccess` gives its first grants, as
+	* `admit` would, its refusals logged as `member.add`'s: someone who does
+	* not run the instance sets one up as they would through `admit`.
+	*/
+	async #admitWith(d, acting, principal, row, input) {
+		const refused = (code, message = MESSAGES[code]) => new Refused(refusal(code, message), [accessEntry(acting.principal, "member.add", principal, "deny", input, { changes: input.changes }, code)]);
+		if (!SERVICE.test(principal)) throw refused("invalid", "only a service account is admitted with its grants: a person, by an instance role");
+		if (!runsInstance(acting.live)) await this.#setsUp(d, acting, true, refused);
+		return this.#enlist(d, acting, principal, row, void 0, input, refused);
+	}
 	/** One place's change, logged when it changes what is live. */
 	#apply(d, actor, principal, held, change, correlation) {
 		const existing = held.find((grant) => placeKey(grant) === placeKey(change));
@@ -2341,15 +2377,9 @@ var VaultService = class {
 			validateCorrelation(input);
 			const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports), input);
 			if (acting.status === "tampered") throw refused("tampered");
-			if (!runsInstance(acting.live)) {
-				const service = SERVICE.test(principal) && (input.role ?? "member") === "member" && input.scope === void 0;
-				const setting = (await this.#settingsAt(d.tx, d.reports)).serviceAccounts;
-				if (!service || !PERSON.test(actor) || !setsUpServices(acting.live, setting, placesOf(await liveProjects(d.tx)))) throw refused("not_allowed", "only admins and owners of the whole instance may add people or set their roles, and a service account takes access somewhere the instance lets people set one up");
-				const removed = d.members.get(principal);
-				if (removed?.status === "removed" && removed.statusChangedBy !== actor) throw refused("not_allowed", `${shownMember(removed.statusChangedBy)} removed this service account: only they, or someone who runs the whole instance, may bring it back`);
-			}
+			const service = SERVICE.test(principal) && (input.role ?? "member") === "member" && input.scope === void 0;
+			if (!runsInstance(acting.live)) await this.#setsUp(d, acting, service, refused);
 			if (!PRINCIPAL.test(principal)) throw refused("invalid", `not a member: ${shownMember(principal)}`);
-			if (this.#isRootAdmin(principal)) throw refused("root_admin");
 			if (input.role !== void 0 && !isInstanceRole(input.role)) throw refused("invalid", `no such instance role: ${input.role}`);
 			if (input.scope !== void 0 && (input.role === void 0 || !isScope(input.scope))) throw refused("invalid", "a scope is a role's: { projects, environments }, each all, only or except");
 			const wanted = input.role === void 0 ? void 0 : {
@@ -2362,53 +2392,22 @@ var VaultService = class {
 			if (subject.status === "tampered") throw refused("tampered", TAMPERED_SUBJECT);
 			d.touched.add(principal);
 			d.grants.set(principal, [...subject.stored]);
-			const entry = (action, detail) => d.log.push(accessEntry(actor, action, principal, "allow", input, detail));
 			if (row === void 0 || row.status === "removed") {
-				const { role, scope } = wanted ?? {
-					role: "member",
-					scope: EVERYWHERE
-				};
-				entry(row === void 0 ? "member.add" : "member.restore", {
-					role,
-					scope
-				});
-				d.writes.push(async (at) => {
-					if (row === void 0) await insertMember(d.tx, {
-						principal,
-						status: "active",
-						role,
-						scope,
-						generation: 0,
-						createdAt: at,
-						createdBy: actor,
-						statusChangedAt: at,
-						statusChangedBy: actor,
-						...UNSEALED
-					});
-					else await updateMember(d.tx, principal, {
-						status: "active",
-						role,
-						scope,
-						statusChangedAt: at,
-						statusChangedBy: actor
-					});
-				});
-				return {
-					created: true,
-					role,
-					scope,
-					generation: row?.generation ?? 0
-				};
+				if (this.#listed(principal) && !(wanted !== void 0 && ownsInstance(wanted))) throw refused("not_allowed", declaredOwner(principal));
+				return this.#enlist(d, acting, principal, row, wanted, input, refused);
 			}
 			const changed = wanted !== void 0 && JSON.stringify(standing(wanted)) !== JSON.stringify(standing(row));
-			if (changed && actor === principal) throw refused("not_allowed", "nobody changes their own instance role: ask another admin");
+			if (changed && this.#listed(principal) && !ownsInstance(wanted)) throw refused("not_allowed", declaredOwner(principal));
+			if (changed && (wanted.role === "owner" || subject.live.role === "owner") && !ownsInstance(acting.live)) throw refused("not_allowed", OWNERS_ONLY);
+			if (changed && actor === principal && !ownsInstance(acting.live)) throw refused("not_allowed", "nobody changes their own instance role: ask another admin");
+			if (changed && ownsInstance(subject.live) && !ownsInstance(wanted)) await this.#keepAnOwner(d, actor, principal, refused);
 			if (changed) {
-				entry("member.role", {
+				d.log.push(accessEntry(actor, "member.role", principal, "allow", input, {
 					role: wanted.role,
 					scope: wanted.scope,
 					previousRole: row.role,
 					previousScope: row.scope
-				});
+				}));
 				d.writes.push(() => updateMember(d.tx, principal, {
 					role: wanted.role,
 					scope: wanted.scope
@@ -2427,19 +2426,75 @@ var VaultService = class {
 			};
 		});
 	}
+	/**
+	* Whether `acting`, who does not run the instance, may admit `principal`:
+	* only a service account (`service`: one asked for with no role), as a
+	* person who could give it a grant somewhere (`setsUpServices`), and one
+	* removed only if they removed it themselves, never one someone else
+	* took away.
+	*/
+	async #setsUp(d, acting, service, refused) {
+		const setting = (await this.#settingsAt(d.tx, d.reports)).serviceAccounts;
+		if (!service || !PERSON.test(acting.principal) || !setsUpServices(acting.live, setting, placesOf(await liveProjects(d.tx)))) throw refused("not_allowed", "only admins and owners of the whole instance may add people or set their roles, and a service account takes access somewhere the instance lets people set one up");
+	}
+	/**
+	* Admit `principal`, who has no row or a removed one: a fresh start, as a
+	* member unless given a role (`wanted`), at the generation a removal
+	* moved on. The caller has checked who may, and locked the row.
+	*/
+	#enlist(d, acting, principal, row, wanted, correlation, refused) {
+		const actor = acting.principal;
+		if (row?.status === "removed" && row.statusChangedBy !== actor && !runsInstance(acting.live)) throw refused("not_allowed", `${shownMember(row.statusChangedBy)} removed this service account: only they, or someone who runs the whole instance, may bring it back`);
+		if (wanted?.role === "owner" && !ownsInstance(acting.live)) throw refused("not_allowed", OWNERS_ONLY);
+		const { role, scope } = wanted ?? {
+			role: "member",
+			scope: EVERYWHERE
+		};
+		d.log.push(accessEntry(actor, row === void 0 ? "member.add" : "member.restore", principal, "allow", correlation, {
+			role,
+			scope
+		}));
+		d.writes.push(async (at) => {
+			if (row === void 0) await insertMember(d.tx, {
+				principal,
+				status: "active",
+				role,
+				scope,
+				generation: 0,
+				createdAt: at,
+				createdBy: actor,
+				statusChangedAt: at,
+				statusChangedBy: actor,
+				...UNSEALED
+			});
+			else await updateMember(d.tx, principal, {
+				status: "active",
+				role,
+				scope,
+				statusChangedAt: at,
+				statusChangedBy: actor
+			});
+		});
+		return {
+			created: true,
+			role,
+			scope,
+			generation: row?.generation ?? 0
+		};
+	}
 	remove(input) {
 		const { actor, principal } = input;
 		const refused = (code, message = MESSAGES[code]) => new Refused(refusal(code, message), [accessEntry(actor, "member.remove", principal, "deny", input, {}, code)]);
 		return this.#decide([actor, principal], async (d) => {
 			validateCorrelation(input);
 			if (!PRINCIPAL.test(principal)) throw refused("invalid", `not a member: ${shownMember(principal)}`);
-			if (this.#isRootAdmin(principal)) throw refused("root_admin");
 			const row = d.members.get(principal);
 			const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports), input);
 			if (acting.status === "tampered") throw refused("tampered");
 			const holder = acting.live;
 			const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
 			const held = subject.stored;
+			if (this.#listed(principal)) throw refused("not_allowed", declaredOwner(principal));
 			if (subject.status === "tampered") {
 				if (!runsInstance(holder)) throw refused("not_allowed", "only admins and owners of the whole instance may remove a member whose record failed its check");
 				return this.#startOver(d, actor, principal, row, subject.fault, input, refused);
@@ -2448,6 +2503,8 @@ var VaultService = class {
 				if (!(SERVICE.test(principal) && PERSON.test(actor) && row?.status === "active" && managesService(holder, (await this.#settingsAt(d.tx, d.reports)).serviceAccounts, actor, await this.#account(d.tx, subject, row)))) throw refused("not_allowed", "only admins and owners of the whole instance may remove members, and a service account whoever manages it");
 			}
 			if (row?.status !== "active") throw refused(row === void 0 ? "not_a_member" : "removed");
+			if (subject.live.role === "owner" && !ownsInstance(holder)) throw refused("not_allowed", OWNERS_ONLY);
+			if (ownsInstance(subject.live)) await this.#keepAnOwner(d, actor, principal, refused);
 			const revoked = held.filter((grant) => live(grant, d.at));
 			for (const grant of revoked) {
 				const where = located(grant);
@@ -2814,7 +2871,8 @@ var VaultService = class {
 				publicKey,
 				until: i === 0 ? null : until
 			}])),
-			rootAdmins: this.#config.rootAdmins.map((email) => `user:${email}`)
+			owners: [...this.#config.owners],
+			rootAdmins: []
 		};
 	}
 	async keyChecks() {