@heychunky/core 0.15.1 → 0.16.0

package/dist/admin/apps.d.ts

@@ -31,15 +31,26 @@ export interface App {
     /** What the run did, step by step. Null for an app recorded before this. */
     provisioned: StepResult[] | null;
 }
-/** Refused because the owner already has as many apps as they may. */
+/** Refused because the organisation already has as many apps as it may. */
 export declare class AppLimitError extends Error {
     readonly limit: number;
-    constructor(email: string, limit: number);
+    constructor(org: string, limit: number);
 }
 export interface AppRecord {
     name: string;
+    /** The organisation that owns it. The tenancy boundary. */
+    orgId: string;
+    /** Who created it. Provenance, not tenancy. */
     owner: string;
-    org?: string | undefined;
+    /**
+     * The GitHub organisation the repository sits in.
+     *
+     * Named apart from `orgId` on purpose. Both used to be called `org`, one
+     * meaning a tenant here and one meaning an account at a provider, and two
+     * fields a keystroke apart with different blast radii is how somebody
+     * eventually writes a tenant id into a repository path.
+     */
+    githubOrg?: string | undefined;
     repo?: string | undefined;
     vercelProject?: string | undefined;
     neonProject?: string | undefined;
@@ -54,23 +65,31 @@ export interface AppRecord {
 /** The user id for an email, or the sole superadmin when none is named. */
 export declare function ownerId(email: string | undefined, register: Register): Promise<string>;
 /**
- * Refuse before anything is created, if the owner is at their limit.
+ * Refuse before anything is created, if the organisation is at its limit.
  *
  * Asked before provisioning rather than at the point of recording, because by
  * then a repository, a database and a deployment target already exist and the
  * limit has been passed rather than enforced.
  *
- * A count of what someone already has, against a number on their row. It is
- * not billing — it is the thing that makes inviting someone a bounded
+ * Counted per organisation, because that is what pays. A ceiling on the person
+ * would let one team of five have five times what it bought by taking turns
+ * creating things, and would charge a solo developer for having two
+ * organisations.
+ *
+ * It is not billing — it is the thing that makes inviting someone a bounded
  * decision, which is what lets invitations be given out at all.
  */
-export declare function assertCanCreate(owner: string, register: Register): Promise<void>;
+export declare function assertCanCreate(orgId: string, register: Register): Promise<void>;
 /**
  * Record an app, or update what is known about one.
  *
- * By name, because that is what is unique across the factory — a repository, a
- * Vercel project and a database all carry it. Re-running provisioning fills in
- * what a first, partial run could not, rather than making a second row.
+ * By organisation and name, which is what is unique now that two tenants may
+ * each have a `blog`. Re-running provisioning fills in what a first, partial
+ * run could not, rather than making a second row.
+ *
+ * Provider names are still global and are not what this conflicts on: a
+ * repository and a Vercel project cannot collide, and provisioning is what has
+ * to answer for that rather than the register.
  */
 export declare function recordApp(app: AppRecord, register: Register): Promise<App>;
 /**
@@ -105,8 +124,11 @@ export declare class NothingToAdoptError extends Error {
  */
 export declare function adoptApp(steps: readonly StepResult[], app: {
     name: string;
+    /** The organisation to adopt it into. */
+    orgId: string;
     owner: string;
-    org?: string | undefined;
+    /** The GitHub organisation its repository sits in. Not the tenant. */
+    githubOrg?: string | undefined;
     /**
      * A Neon project the walk cannot find by name.
      *
@@ -120,26 +142,29 @@ export declare function adoptApp(steps: readonly StepResult[], app: {
      */
     neonProject?: string | undefined;
 }, register: Register): Promise<App>;
-/** Apps an owner has, or every app when none is named. */
 /**
- * One app, if this operator may have it.
+ * Refused because a developer asked a tenancy question without naming a tenant.
+ *
+ * Not a permission answer — a bug. Returning "nothing" would look exactly like
+ * an empty organisation, and a caller that forgot to say which organisation it
+ * meant would ship looking like it worked.
+ */
+export declare class NoOrgError extends Error {
+    constructor();
+}
+/**
+ * Every app in one organisation, if this person is in it.
  *
- * The tenancy rule asked of a single row: a developer reaching for somebody
- * else's app by name gets nothing, which is the same answer as an app that
- * does not exist. Telling those apart would confirm what other people have
- * named their apps, and the caller is expected to answer both the same way.
+ * Ordered oldest first, which is the order somebody built them in and the only
+ * order that does not move under them as they work.
+ */
+export declare function appsFor(user: Pick<User, "id" | "role">, org: string | undefined, register: Register): Promise<App[]>;
+/**
+ * One app, if this person may have it through this organisation.
  *
  * This is what replaces a configured target repository. A run does not hold a
- * repo; it resolves one — from who is asking and which app they named — and
- * `repo` on the row it returns is the answer. Which means the authorisation
- * and the lookup are the same call, and a caller cannot perform the second
- * while forgetting the first.
- *
- * In the Core rather than in a caller because there are now three: the pages,
- * the API, and the superagent working on somebody's app on their behalf. A
- * tenancy rule that lives in one of them is a rule the other two can differ
- * from.
+ * repo; it resolves one — from who is asking, which organisation they are in,
+ * and which app they named — and `repo` on the row it returns is the answer.
  */
-export declare function appFor(user: Pick<User, "id" | "role">, name: string, register: Register): Promise<App | undefined>;
-export declare function listApps(owner: string | undefined, register: Register): Promise<App[]>;
+export declare function appFor(user: Pick<User, "id" | "role">, org: string | undefined, name: string, register: Register): Promise<App | undefined>;
 //# sourceMappingURL=apps.d.ts.map

package/dist/admin/apps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apps.d.ts","sourceRoot":"","sources":["../../src/admin/apps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,WAAW,GAAG;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,WAAW,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;CAClC;AAED,sEAAsE;AACtE,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBACX,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;CAKzC;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC;CACxC;AAED,2EAA2E;AAC3E,wBAAsB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAc5F;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBtF;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CA8BhF;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,SAAS,UAAU,EAAE,GAC3B,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,aAAa,CAAC,CAS3D;AAED,sEAAsE;AACtE,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,IAAI,EAAE,MAAM;CAIzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,QAAQ,CAC5B,KAAK,EAAE,SAAS,UAAU,EAAE,EAC5B,GAAG,EAAE;IACH,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC,EACD,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,GAAG,CAAC,CAad;AAED,0DAA0D;AAC1D;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,MAAM,CAC1B,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAAC,EAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAQ1B;AAED,wBAAsB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAU5F"}
+{"version":3,"file":"apps.d.ts","sourceRoot":"","sources":["../../src/admin/apps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,WAAW,GAAG;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,WAAW,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;CAClC;AAED,2EAA2E;AAC3E,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBACX,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;CAKvC;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC;CACxC;AAED,2EAA2E;AAC3E,wBAAsB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAc5F;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBtF;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CA4BhF;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,SAAS,UAAU,EAAE,GAC3B,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,aAAa,CAAC,CAS3D;AAED,sEAAsE;AACtE,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,IAAI,EAAE,MAAM;CAIzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,QAAQ,CAC5B,KAAK,EAAE,SAAS,UAAU,EAAE,EAC5B,GAAG,EAAE;IACH,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC,EACD,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,GAAG,CAAC,CAcd;AAED;;;;;;GAMG;AACH,qBAAa,UAAW,SAAQ,KAAK;;CAKpC;AA8CD;;;;;GAKG;AACH,wBAAsB,OAAO,CAC3B,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAAC,EAC/B,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,GAAG,EAAE,CAAC,CAIhB;AAED;;;;;;GAMG;AACH,wBAAsB,MAAM,CAC1B,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAAC,EAC/B,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAI1B"}

package/dist/admin/apps.js

@@ -1,8 +1,8 @@
-/** Refused because the owner already has as many apps as they may. */
+/** Refused because the organisation already has as many apps as it may. */
 export class AppLimitError extends Error {
     limit;
-    constructor(email, limit) {
-        super(`${email} already has ${limit} app${limit === 1 ? "" : "s"}, which is their limit.`);
+    constructor(org, limit) {
+        super(`${org} already has ${limit} app${limit === 1 ? "" : "s"}, which is its limit.`);
         this.name = "AppLimitError";
         this.limit = limit;
     }
@@ -26,24 +26,27 @@ export async function ownerId(email, register) {
     return String(id);
 }
 /**
- * Refuse before anything is created, if the owner is at their limit.
+ * Refuse before anything is created, if the organisation is at its limit.
  *
  * Asked before provisioning rather than at the point of recording, because by
  * then a repository, a database and a deployment target already exist and the
  * limit has been passed rather than enforced.
  *
- * A count of what someone already has, against a number on their row. It is
- * not billing — it is the thing that makes inviting someone a bounded
+ * Counted per organisation, because that is what pays. A ceiling on the person
+ * would let one team of five have five times what it bought by taking turns
+ * creating things, and would charge a solo developer for having two
+ * organisations.
+ *
+ * It is not billing — it is the thing that makes inviting someone a bounded
  * decision, which is what lets invitations be given out at all.
  */
-export async function assertCanCreate(owner, register) {
-    const conn = register;
-    const { rows } = await conn.query(`select u.email, u.app_limit,
-            (select count(*) from apps a where a.owner_id = u.id) as owned
-       from users u where u.id = $1`, [owner]);
+export async function assertCanCreate(orgId, register) {
+    const { rows } = await register.query(`select o.name, o.app_limit,
+            (select count(*) from apps a where a.org_id = o.id) as owned
+       from orgs o where o.id = $1`, [orgId]);
     const row = rows[0];
     if (!row)
-        throw new Error("No such owner.");
+        throw new Error("No such organisation.");
     // No limit recorded means no ceiling, not a ceiling of zero. Number(null) is
     // 0 and `owned >= 0` is always true, so reading it the other way locks
     // somebody out of their own account — and does it silently, at the moment
@@ -55,40 +58,42 @@ export async function assertCanCreate(owner, register) {
     if (!Number.isFinite(limit))
         return;
     if (Number(row["owned"]) >= limit)
-        throw new AppLimitError(String(row["email"]), limit);
+        throw new AppLimitError(String(row["name"]), limit);
 }
 /**
  * Record an app, or update what is known about one.
  *
- * By name, because that is what is unique across the factory — a repository, a
- * Vercel project and a database all carry it. Re-running provisioning fills in
- * what a first, partial run could not, rather than making a second row.
+ * By organisation and name, which is what is unique now that two tenants may
+ * each have a `blog`. Re-running provisioning fills in what a first, partial
+ * run could not, rather than making a second row.
+ *
+ * Provider names are still global and are not what this conflicts on: a
+ * repository and a Vercel project cannot collide, and provisioning is what has
+ * to answer for that rather than the register.
  */
 export async function recordApp(app, register) {
     const conn = register;
     const { rows } = await conn.write(
-    // `org_id` is derived rather than passed, and derived the same way the
-    // backfill derived it: through the owner's username to their personal
-    // organisation. A caller that had to supply it is a caller that can supply
-    // the wrong one, and the invariant `heychunky register verify` asserts —
-    // every app is in an organisation — would then hold only until the next
-    // app was made.
+    // `org_id` is passed now rather than derived from the owner's username.
+    // While every organisation was somebody's personal one, deriving it was the
+    // safer shape — nothing could supply the wrong tenant. A team has no such
+    // derivation: the same person can create in two organisations, and only the
+    // caller knows which one they were acting in.
+    //
+    // The column is `not null`, so an app that names no organisation is refused
+    // by the database rather than becoming a row nobody can see.
     //
     // Kept on conflict, never overwritten. Re-running provisioning fills in
     // what a partial run could not; it must not move an app between tenants.
     `insert into apps (name, owner_id, org_id, org, repo, vercel_project, neon_project, provisioned)
-     values ($1, $2,
-             (select o.id from orgs o join users u on lower(o.name) = lower(u.username)
-               where u.id = $2 and o.kind = 'personal'),
-             $3, $4, $5, $6, $7)
-     on conflict (lower(name)) do update set
-       org_id         = coalesce(apps.org_id,             excluded.org_id),
+     values ($1, $2, $3, $4, $5, $6, $7, $8)
+     on conflict (org_id, lower(name)) do update set
        org            = coalesce(excluded.org,            apps.org),
        repo           = coalesce(excluded.repo,           apps.repo),
        vercel_project = coalesce(excluded.vercel_project, apps.vercel_project),
        neon_project   = coalesce(excluded.neon_project,   apps.neon_project),
        provisioned    = coalesce(excluded.provisioned,    apps.provisioned)
-     returning *`, [app.name, app.owner, app.org ?? null, app.repo ?? null,
+     returning *`, [app.name, app.owner, app.orgId, app.githubOrg ?? null, app.repo ?? null,
         app.vercelProject ?? null, app.neonProject ?? null,
         app.provisioned ? JSON.stringify(app.provisioned) : null]);
     return rows[0];
@@ -140,48 +145,85 @@ export async function adoptApp(steps, app, register) {
     const found = detailsFromRun(steps);
     return recordApp({
         name: app.name,
+        orgId: app.orgId,
         owner: app.owner,
-        org: app.org,
+        githubOrg: app.githubOrg,
         ...found,
         neonProject: app.neonProject ?? found.neonProject,
     }, register);
 }
-/** Apps an owner has, or every app when none is named. */
 /**
- * One app, if this operator may have it.
+ * Refused because a developer asked a tenancy question without naming a tenant.
+ *
+ * Not a permission answer — a bug. Returning "nothing" would look exactly like
+ * an empty organisation, and a caller that forgot to say which organisation it
+ * meant would ship looking like it worked.
+ */
+export class NoOrgError extends Error {
+    constructor() {
+        super("Which organisation? Every question about apps is asked of one.");
+        this.name = "NoOrgError";
+    }
+}
+/**
+ * The apps clause, with the tenancy rule fused into it.
  *
- * The tenancy rule asked of a single row: a developer reaching for somebody
- * else's app by name gets nothing, which is the same answer as an app that
- * does not exist. Telling those apart would confirm what other people have
- * named their apps, and the caller is expected to answer both the same way.
+ * `org_id` is the tenancy boundary; `owner_id` survives beside it as
+ * provenance. So the question a developer is really asking is *am I in this
+ * organisation*, and that `exists` is the whole of the answer — a person
+ * reaching into an organisation they are not in gets nothing, which is the same
+ * answer as an organisation that does not exist. Telling those apart would
+ * confirm what other people have named their organisations.
  *
- * This is what replaces a configured target repository. A run does not hold a
- * repo; it resolves one — from who is asking and which app they named — and
- * `repo` on the row it returns is the answer. Which means the authorisation
- * and the lookup are the same call, and a caller cannot perform the second
- * while forgetting the first.
+ * A superadmin omits the membership clause and, with no organisation named,
+ * omits the scope entirely: that is the factory role, and `/admin` is the one
+ * screen that must see across tenants.
  *
- * In the Core rather than in a caller because there are now three: the pages,
- * the API, and the superagent working on somebody's app on their behalf. A
- * tenancy rule that lives in one of them is a rule the other two can differ
- * from.
+ * Built here rather than in each query so that authorisation and lookup are the
+ * same call and cannot come apart. There are four callers now — the pages, the
+ * API, the CLI and the superagent — and a tenancy rule written four times is
+ * one the four can differ on.
  */
-export async function appFor(user, name, register) {
-    const select = `select a.*, u.email as owner_email from apps a
-                    join users u on u.id = a.owner_id
-                   where lower(a.name) = lower($1)`;
-    const { rows } = user.role === "superadmin"
-        ? await register.query(select, [name])
-        : await register.query(`${select} and a.owner_id = $2`, [name, user.id]);
-    return rows[0];
+function scoped(user, org, where, params) {
+    const select = `select a.*, u.email as owner_email, o.name as org_name from apps a
+       join users u on u.id = a.owner_id
+       join orgs o on o.id = a.org_id`;
+    if (!org) {
+        if (user.role !== "superadmin")
+            throw new NoOrgError();
+        return { sql: `${select} ${where}`, params };
+    }
+    const orgAt = `$${params.length + 1}`;
+    const sql = `${select} ${where}${where.trim() ? " and" : "where"} lower(o.name) = lower(${orgAt})`;
+    if (user.role === "superadmin")
+        return { sql, params: [...params, org] };
+    return {
+        sql: `${sql} and exists (select 1 from org_members m
+                              where m.org_id = o.id and m.user_id = $${params.length + 2})`,
+        params: [...params, org, user.id],
+    };
 }
-export async function listApps(owner, register) {
-    const conn = register;
-    const { rows } = owner
-        ? await conn.query(`select a.*, u.email as owner_email from apps a join users u on u.id = a.owner_id
-          where a.owner_id = $1 order by a.created_at`, [owner])
-        : await conn.query(`select a.*, u.email as owner_email from apps a join users u on u.id = a.owner_id
-          order by a.created_at`);
+/**
+ * Every app in one organisation, if this person is in it.
+ *
+ * Ordered oldest first, which is the order somebody built them in and the only
+ * order that does not move under them as they work.
+ */
+export async function appsFor(user, org, register) {
+    const { sql, params } = scoped(user, org, "", []);
+    const { rows } = await register.query(`${sql} order by a.created_at`, params);
     return rows;
 }
+/**
+ * One app, if this person may have it through this organisation.
+ *
+ * This is what replaces a configured target repository. A run does not hold a
+ * repo; it resolves one — from who is asking, which organisation they are in,
+ * and which app they named — and `repo` on the row it returns is the answer.
+ */
+export async function appFor(user, org, name, register) {
+    const { sql, params } = scoped(user, org, "where lower(a.name) = lower($1)", [name]);
+    const { rows } = await register.query(sql, params);
+    return rows[0];
+}
 //# sourceMappingURL=apps.js.map

package/dist/admin/apps.js.map

@@ -1 +1 @@
-{"version":3,"file":"apps.js","sourceRoot":"","sources":["../../src/admin/apps.ts"],"names":[],"mappings":"AAmCA,sEAAsE;AACtE,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC7B,KAAK,CAAS;IACvB,YAAY,KAAa,EAAE,KAAa;QACtC,KAAK,CAAC,GAAG,KAAK,gBAAgB,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,yBAAyB,CAAC,CAAC;QAC3F,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAkBD,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAyB,EAAE,QAAkB;IACzE,MAAM,IAAI,GAAG,QAAQ,CAAC;IACtB,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,qDAAqD,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAClG,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,kDAAkD,CAAC,CAAC;QAC7F,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC;IACD,4EAA4E;IAC5E,0DAA0D;IAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpF,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC9E,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa,EAAE,QAAkB;IACrE,MAAM,IAAI,GAAG,QAAQ,CAAC;IACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B;;oCAEgC,EAChC,CAAC,KAAK,CAAC,CACR,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAE5C,6EAA6E;IAC7E,uEAAuE;IACvE,0EAA0E;IAC1E,+BAA+B;IAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO;IACpC,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK;QAAE,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAc,EAAE,QAAkB;IAChE,MAAM,IAAI,GAAG,QAAQ,CAAC;IACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK;IAC/B,uEAAuE;IACvE,sEAAsE;IACtE,2EAA2E;IAC3E,yEAAyE;IACzE,wEAAwE;IACxE,gBAAgB;IAChB,EAAE;IACF,wEAAwE;IACxE,yEAAyE;IACzE;;;;;;;;;;;;iBAYa,EACb,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI;QACtD,GAAG,CAAC,aAAa,IAAI,IAAI,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QAClD,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAC3D,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAmB,CAAC;AACnC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,KAA4B;IAE5B,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAC9B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;QACnF,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,aAAa,CAAC;QAC3B,aAAa,EAAE,MAAM,CAAC,gBAAgB,CAAC;QACvC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,IAAY;QACtB,KAAK,CAAC,cAAc,IAAI,4DAA4D,CAAC,CAAC;QACtF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,KAA4B,EAC5B,GAgBC,EACD,QAAkB;IAElB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC;QAAE,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtF,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,SAAS,CACd;QACE,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,GAAG,KAAK;QACR,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW;KAClD,EACD,QAAQ,CACT,CAAC;AACJ,CAAC;AAED,0DAA0D;AAC1D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,IAA+B,EAC/B,IAAY,EACZ,QAAkB;IAElB,MAAM,MAAM,GAAG;;mDAEkC,CAAC;IAClD,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,KAAK,YAAY;QACzC,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,MAAM,sBAAsB,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC,CAAC,CAA+B,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAAyB,EAAE,QAAkB;IAC1E,MAAM,IAAI,GAAG,QAAQ,CAAC;IACtB,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK;QACpB,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CACd;sDAC8C,EAAE,CAAC,KAAK,CAAC,CAAC;QAC5D,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CACd;gCACwB,CAAC,CAAC;IAChC,OAAO,IAAwB,CAAC;AAClC,CAAC"}
+{"version":3,"file":"apps.js","sourceRoot":"","sources":["../../src/admin/apps.ts"],"names":[],"mappings":"AAmCA,2EAA2E;AAC3E,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC7B,KAAK,CAAS;IACvB,YAAY,GAAW,EAAE,KAAa;QACpC,KAAK,CAAC,GAAG,GAAG,gBAAgB,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,uBAAuB,CAAC,CAAC;QACvF,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AA6BD,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAyB,EAAE,QAAkB;IACzE,MAAM,IAAI,GAAG,QAAQ,CAAC;IACtB,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,qDAAqD,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAClG,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,kDAAkD,CAAC,CAAC;QAC7F,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC;IACD,4EAA4E;IAC5E,0DAA0D;IAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpF,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC9E,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa,EAAE,QAAkB;IACrE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,CACnC;;mCAE+B,EAC/B,CAAC,KAAK,CAAC,CACR,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAEnD,6EAA6E;IAC7E,uEAAuE;IACvE,0EAA0E;IAC1E,+BAA+B;IAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO;IACpC,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK;QAAE,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAc,EAAE,QAAkB;IAChE,MAAM,IAAI,GAAG,QAAQ,CAAC;IACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK;IAC/B,wEAAwE;IACxE,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,8CAA8C;IAC9C,EAAE;IACF,4EAA4E;IAC5E,6DAA6D;IAC7D,EAAE;IACF,wEAAwE;IACxE,yEAAyE;IACzE;;;;;;;;iBAQa,EACb,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI;QACvE,GAAG,CAAC,aAAa,IAAI,IAAI,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QAClD,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAC3D,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAmB,CAAC;AACnC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,KAA4B;IAE5B,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAC9B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;QACnF,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,aAAa,CAAC;QAC3B,aAAa,EAAE,MAAM,CAAC,gBAAgB,CAAC;QACvC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,IAAY;QACtB,KAAK,CAAC,cAAc,IAAI,4DAA4D,CAAC,CAAC;QACtF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,KAA4B,EAC5B,GAmBC,EACD,QAAkB;IAElB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC;QAAE,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtF,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,SAAS,CACd;QACE,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,GAAG,KAAK;QACR,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW;KAClD,EACD,QAAQ,CACT,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC;QACE,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,MAAM,CACb,IAA+B,EAC/B,GAAuB,EACvB,KAAa,EACb,MAAiB;IAEjB,MAAM,MAAM,GACV;;sCAEkC,CAAC;IAErC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;YAAE,MAAM,IAAI,UAAU,EAAE,CAAC;QACvD,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC;IAC/C,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,0BAA0B,KAAK,GAAG,CAAC;IACnG,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;IACzE,OAAO;QACL,GAAG,EAAE,GAAG,GAAG;uEACwD,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG;QACvF,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,IAA+B,EAC/B,GAAuB,EACvB,QAAkB;IAElB,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,wBAAwB,EAAE,MAAM,CAAC,CAAC;IAC9E,OAAO,IAAwB,CAAC;AAClC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,IAA+B,EAC/B,GAAuB,EACvB,IAAY,EACZ,QAAkB;IAElB,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,iCAAiC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACrF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,CAAC,CAA+B,CAAC;AAC/C,CAAC"}

package/dist/admin/orgs.d.ts

@@ -53,6 +53,16 @@ export type OrgKind = (typeof ORG_KINDS)[number];
  * only in TypeScript is a rule the next caller writes around.
  */
 export declare const ORG_NAME: RegExp;
+/**
+ * Why this name cannot be an organisation, or undefined if it can.
+ *
+ * One rule, in the Core, because a name is three things at once: the publish
+ * scope, the URL segment, and — for a personal organisation — somebody's
+ * username. The app used to hold its own copy for usernames; two lists would
+ * disagree eventually, and the disagreement would be somebody claiming a name
+ * on one screen that means something else on another.
+ */
+export declare function invalidOrgName(raw: string): string | undefined;
 export interface Org {
     id: string;
     /** The publish scope and the URL segment. Unique without case. */
@@ -60,6 +70,8 @@ export interface Org {
     kind: OrgKind;
     /** What this tenant may spend. The plan moved here from the user. */
     plan: PlanKey;
+    /** Bends the plan's ceiling for one tenant. Null is no ceiling, not zero. */
+    app_limit: number | null;
     /** A provider's own name for the same tenant. Null until one is linked. */
     github_org: string | null;
     vercel_team: string | null;
@@ -70,7 +82,13 @@ export interface Org {
 export interface Membership extends Org {
     role: OrgRole;
 }
-/** Refused because the name belongs to an organisation that is not personal. */
+/**
+ * Refused because somebody already has the name.
+ *
+ * Deliberately says no more than that. Whether the holder is a person or a
+ * team is not the asker's business, and answering would turn this into a way
+ * to enumerate who exists.
+ */
 export declare class OrgNameTakenError extends Error {
     constructor(name: string);
 }
@@ -139,4 +157,31 @@ export interface CheckResult {
  * one to swallow, so nothing here catches.
  */
 export declare function verifyOrgs(register: Register): Promise<CheckResult[]>;
+/**
+ * Make a team organisation, with its founder running it.
+ *
+ * The one namespace is what makes this safe to state simply: a personal
+ * organisation is created by claiming a username, so every username already has
+ * a row here, and `orgs_name_key` is what refuses a team that reaches for one.
+ * There is no second list to consult and no race to lose — the unique index
+ * settles it, the way it settles a username.
+ *
+ * The founder is an `admin` rather than an owner. Ownership is not a role: it
+ * is what `kind` and, for a personal organisation, the matching username
+ * already say. The two roles that exist describe what somebody may *do*.
+ *
+ * No plan is chosen here. A new organisation starts free and is put on a plan
+ * the way an account is — assigned, because it decides how much of the
+ * factory's money it may spend.
+ */
+export declare function createOrg(name: string, founder: string, register: Register): Promise<Org>;
+/**
+ * Somebody's personal organisation.
+ *
+ * The one everybody has from the moment they claim a username, and where the
+ * operator puts an app when nobody said otherwise. Undefined for a user who has
+ * not claimed a name yet — which is a real state, not an error: an account
+ * exists before its owner has chosen what to be called.
+ */
+export declare function personalOrgFor(userId: string, register: Register): Promise<Org | undefined>;
 //# sourceMappingURL=orgs.d.ts.map

package/dist/admin/orgs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orgs.d.ts","sourceRoot":"","sources":["../../src/admin/orgs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,0EAA0E;AAC1E,eAAO,MAAM,SAAS,iCAAkC,CAAC;AACzD,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,+BAAgC,CAAC;AACvD,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ,QAAyB,CAAC;AAE/C,MAAM,WAAW,GAAG;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,qEAAqE;IACrE,IAAI,EAAE,OAAO,CAAC;IACd,2EAA2E;IAC3E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,gEAAgE;AAChE,MAAM,WAAW,UAAW,SAAQ,GAAG;IACrC,IAAI,EAAE,OAAO,CAAC;CACf;AAED,gFAAgF;AAChF,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,IAAI,EAAE,MAAM;CAIzB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,GAAG,CAAC,CAwBd;AAED,oEAAoE;AACpE,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAQvF;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,UAAU,EAAE,SAAS;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAqD/D,CAAC;AAEF,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,OAAO,CAAC;CACb;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAQ3E"}
+{"version":3,"file":"orgs.d.ts","sourceRoot":"","sources":["../../src/admin/orgs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,0EAA0E;AAC1E,eAAO,MAAM,SAAS,iCAAkC,CAAC;AACzD,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,+BAAgC,CAAC;AACvD,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ,QAA2C,CAAC;AAgBjE;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAW9D;AAED,MAAM,WAAW,GAAG;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,qEAAqE;IACrE,IAAI,EAAE,OAAO,CAAC;IACd,6EAA6E;IAC7E,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,2EAA2E;IAC3E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,gEAAgE;AAChE,MAAM,WAAW,UAAW,SAAQ,GAAG;IACrC,IAAI,EAAE,OAAO,CAAC;CACf;AAED;;;;;;GAMG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,IAAI,EAAE,MAAM;CAIzB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,GAAG,CAAC,CAyBd;AAED,oEAAoE;AACpE,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAQvF;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,UAAU,EAAE,SAAS;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAqD/D,CAAC;AAEF,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,OAAO,CAAC;CACb;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAQ3E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,GAAG,CAAC,CAsBd;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAO1B"}

package/dist/admin/orgs.js

@@ -15,11 +15,56 @@ export const ORG_KINDS = ["personal", "team"];
  * string. Enforced by a check constraint as well as here — a rule that lives
  * only in TypeScript is a rule the next caller writes around.
  */
-export const ORG_NAME = /^[a-z0-9][a-z0-9-]*$/;
-/** Refused because the name belongs to an organisation that is not personal. */
+export const ORG_NAME = /^[a-z0-9](?:[a-z0-9-]{0,30}[a-z0-9])?$/;
+/**
+ * Names the product needs for itself, or that would read as someone official.
+ *
+ * Kept short on purpose: a long denylist is a list of names nobody can have for
+ * reasons nobody remembers. It matters more than it did — an organisation's
+ * name is a URL segment now, so `/@admin/apps` would be a page that looks like
+ * ours and is not.
+ */
+const RESERVED = new Set([
+    "admin", "administrator", "root", "superadmin", "support", "help",
+    "chunky", "heychunky", "api", "app", "www", "registry", "r", "new",
+    "settings", "account", "billing", "login", "signin", "signout", "me",
+]);
+/**
+ * Why this name cannot be an organisation, or undefined if it can.
+ *
+ * One rule, in the Core, because a name is three things at once: the publish
+ * scope, the URL segment, and — for a personal organisation — somebody's
+ * username. The app used to hold its own copy for usernames; two lists would
+ * disagree eventually, and the disagreement would be somebody claiming a name
+ * on one screen that means something else on another.
+ */
+export function invalidOrgName(raw) {
+    const name = raw.trim();
+    if (!name)
+        return "Pick a name.";
+    if (name !== name.toLowerCase())
+        return "Names are lowercase.";
+    if (name.length < 2)
+        return "That is too short — two characters at least.";
+    if (name.length > 32)
+        return "That is too long — thirty-two characters at most.";
+    if (!ORG_NAME.test(name)) {
+        return "Letters, numbers and hyphens only, starting and ending with a letter or number.";
+    }
+    if (RESERVED.has(name))
+        return "That one is spoken for.";
+    return undefined;
+}
+/**
+ * Refused because somebody already has the name.
+ *
+ * Deliberately says no more than that. Whether the holder is a person or a
+ * team is not the asker's business, and answering would turn this into a way
+ * to enumerate who exists.
+ */
 export class OrgNameTakenError extends Error {
     constructor(name) {
-        super(`"${name}" is a team organisation, so it cannot also be somebody's personal one.`);
+        super(`The name "${name}" is taken.`);
         this.name = "OrgNameTakenError";
     }
 }
@@ -44,8 +89,9 @@ export class OrgNameTakenError extends Error {
  * would hand them somebody else's tenant. So it is looked at, and refused.
  */
 export async function claimPersonalOrg(userId, username, register) {
-    if (!ORG_NAME.test(username))
-        throw new Error(`"${username}" is not a name an organisation can have.`);
+    const bad = invalidOrgName(username);
+    if (bad)
+        throw new Error(bad);
     await register.write(`insert into orgs (name, kind, plan)
      select $1, 'personal', coalesce(u.plan, 'free') from users u where u.id = $2
      on conflict (lower(name)) do nothing`, [username, userId]);
@@ -163,4 +209,51 @@ export async function verifyOrgs(register) {
     }
     return out;
 }
+/**
+ * Make a team organisation, with its founder running it.
+ *
+ * The one namespace is what makes this safe to state simply: a personal
+ * organisation is created by claiming a username, so every username already has
+ * a row here, and `orgs_name_key` is what refuses a team that reaches for one.
+ * There is no second list to consult and no race to lose — the unique index
+ * settles it, the way it settles a username.
+ *
+ * The founder is an `admin` rather than an owner. Ownership is not a role: it
+ * is what `kind` and, for a personal organisation, the matching username
+ * already say. The two roles that exist describe what somebody may *do*.
+ *
+ * No plan is chosen here. A new organisation starts free and is put on a plan
+ * the way an account is — assigned, because it decides how much of the
+ * factory's money it may spend.
+ */
+export async function createOrg(name, founder, register) {
+    const bad = invalidOrgName(name);
+    if (bad)
+        throw new Error(bad);
+    const { rows } = await register.write(`insert into orgs (name, kind, plan) values ($1, 'team', 'free')
+     on conflict (lower(name)) do nothing
+     returning *`, [name]);
+    const org = rows[0];
+    // `do nothing` returns no row when the name was taken, which is the whole
+    // answer: somebody has it, and whether they are a person or a team is not
+    // this caller's business to find out.
+    if (!org)
+        throw new OrgNameTakenError(name);
+    await register.write(`insert into org_members (org_id, user_id, role) values ($1, $2, 'admin')
+     on conflict (org_id, user_id) do nothing`, [org.id, founder]);
+    return org;
+}
+/**
+ * Somebody's personal organisation.
+ *
+ * The one everybody has from the moment they claim a username, and where the
+ * operator puts an app when nobody said otherwise. Undefined for a user who has
+ * not claimed a name yet — which is a real state, not an error: an account
+ * exists before its owner has chosen what to be called.
+ */
+export async function personalOrgFor(userId, register) {
+    const { rows } = await register.query(`select o.* from orgs o join users u on lower(u.username) = lower(o.name)
+      where u.id = $1 and o.kind = 'personal'`, [userId]);
+    return rows[0];
+}
 //# sourceMappingURL=orgs.js.map

package/dist/admin/orgs.js.map

@@ -1 +1 @@
-{"version":3,"file":"orgs.js","sourceRoot":"","sources":["../../src/admin/orgs.ts"],"names":[],"mappings":"AAoCA,0EAA0E;AAC1E,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,WAAW,CAAU,CAAC;AAGzD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,UAAU,EAAE,MAAM,CAAU,CAAC;AAGvD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,sBAAsB,CAAC;AAqB/C,gFAAgF;AAChF,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,IAAY;QACtB,KAAK,CAAC,IAAI,IAAI,yEAAyE,CAAC,CAAC;QACzF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,QAAgB,EAChB,QAAkB;IAElB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,QAAQ,2CAA2C,CAAC,CAAC;IAEvG,MAAM,QAAQ,CAAC,KAAK,CAClB;;0CAEsC,EACtC,CAAC,QAAQ,EAAE,MAAM,CAAC,CACnB,CAAC;IAEF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,CACnC,kDAAkD,EAClD,CAAC,QAAQ,CAAC,CACX,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAA+B,CAAC;IAClD,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,SAAS,QAAQ,sBAAsB,CAAC,CAAC;IACpF,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU;QAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAEnE,MAAM,QAAQ,CAAC,KAAK,CAClB;8CAC0C,EAC1C,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CACjB,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,QAAkB;IAC9D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,CACnC;;kDAE8C,EAC9C,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,IAA+B,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAc,EACd,GAAW,EACX,QAAkB;IAElB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,CACnC;yDACqD,EACrD,CAAC,MAAM,EAAE,GAAG,CAAC,CACd,CAAC;IACF,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,UAAU,GAA8C;IACnE;QACE,KAAK,EAAE,oDAAoD;QAC3D,GAAG,EAAE;;6FAEoF;KAC1F;IACD;QACE,KAAK,EAAE,wDAAwD;QAC/D,GAAG,EAAE;0FACiF;KACvF;IACD;QACE,KAAK,EAAE,yDAAyD;QAChE,GAAG,EAAE;;kEAEyD;KAC/D;IACD;QACE,KAAK,EAAE,4DAA4D;QACnE,GAAG,EAAE;2EACkE;KACxE;IACD;QACE,KAAK,EAAE,yBAAyB;QAChC,GAAG,EAAE,qDAAqD;KAC3D;IACD;QACE,KAAK,EAAE,2DAA2D;QAClE,GAAG,EAAE;;;;;oFAK2E;KACjF;IACD;QACE,KAAK,EAAE,uEAAuE;QAC9E,GAAG,EAAE;oCAC2B;KACjC;IACD;QACE,KAAK,EAAE,mCAAmC;QAC1C,GAAG,EAAE,8DAA8D;KACpE;IACD;QACE,KAAK,EAAE,+BAA+B;QACtC,GAAG,EAAE,2DAA2D;KACjE;IACD;QACE,KAAK,EAAE,qCAAqC;QAC5C,GAAG,EAAE,+DAA+D;KACrE;CACF,CAAC;AAUF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAkB;IACjD,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,UAAU,EAAE,CAAC;QACxC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"orgs.js","sourceRoot":"","sources":["../../src/admin/orgs.ts"],"names":[],"mappings":"AAoCA,0EAA0E;AAC1E,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,WAAW,CAAU,CAAC;AAGzD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,UAAU,EAAE,MAAM,CAAU,CAAC;AAGvD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,wCAAwC,CAAC;AAEjE;;;;;;;GAOG;AACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;IACvB,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM;IACjE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK;IAClE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI;CACrE,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,CAAC,IAAI;QAAE,OAAO,cAAc,CAAC;IACjC,IAAI,IAAI,KAAK,IAAI,CAAC,WAAW,EAAE;QAAE,OAAO,sBAAsB,CAAC;IAC/D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,8CAA8C,CAAC;IAC3E,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,mDAAmD,CAAC;IACjF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,iFAAiF,CAAC;IAC3F,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,yBAAyB,CAAC;IACzD,OAAO,SAAS,CAAC;AACnB,CAAC;AAuBD;;;;;;GAMG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,IAAY;QACtB,KAAK,CAAC,aAAa,IAAI,aAAa,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,QAAgB,EAChB,QAAkB;IAElB,MAAM,GAAG,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;IAE9B,MAAM,QAAQ,CAAC,KAAK,CAClB;;0CAEsC,EACtC,CAAC,QAAQ,EAAE,MAAM,CAAC,CACnB,CAAC;IAEF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,CACnC,kDAAkD,EAClD,CAAC,QAAQ,CAAC,CACX,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAA+B,CAAC;IAClD,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,SAAS,QAAQ,sBAAsB,CAAC,CAAC;IACpF,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU;QAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAEnE,MAAM,QAAQ,CAAC,KAAK,CAClB;8CAC0C,EAC1C,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CACjB,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,QAAkB;IAC9D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,CACnC;;kDAE8C,EAC9C,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,IAA+B,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAc,EACd,GAAW,EACX,QAAkB;IAElB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,CACnC;yDACqD,EACrD,CAAC,MAAM,EAAE,GAAG,CAAC,CACd,CAAC;IACF,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,UAAU,GAA8C;IACnE;QACE,KAAK,EAAE,oDAAoD;QAC3D,GAAG,EAAE;;6FAEoF;KAC1F;IACD;QACE,KAAK,EAAE,wDAAwD;QAC/D,GAAG,EAAE;0FACiF;KACvF;IACD;QACE,KAAK,EAAE,yDAAyD;QAChE,GAAG,EAAE;;kEAEyD;KAC/D;IACD;QACE,KAAK,EAAE,4DAA4D;QACnE,GAAG,EAAE;2EACkE;KACxE;IACD;QACE,KAAK,EAAE,yBAAyB;QAChC,GAAG,EAAE,qDAAqD;KAC3D;IACD;QACE,KAAK,EAAE,2DAA2D;QAClE,GAAG,EAAE;;;;;oFAK2E;KACjF;IACD;QACE,KAAK,EAAE,uEAAuE;QAC9E,GAAG,EAAE;oCAC2B;KACjC;IACD;QACE,KAAK,EAAE,mCAAmC;QAC1C,GAAG,EAAE,8DAA8D;KACpE;IACD;QACE,KAAK,EAAE,+BAA+B;QACtC,GAAG,EAAE,2DAA2D;KACjE;IACD;QACE,KAAK,EAAE,qCAAqC;QAC5C,GAAG,EAAE,+DAA+D;KACrE;CACF,CAAC;AAUF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAkB;IACjD,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,UAAU,EAAE,CAAC;QACxC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAY,EACZ,OAAe,EACf,QAAkB;IAElB,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;IAE9B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,CACnC;;iBAEa,EACb,CAAC,IAAI,CAAC,CACP,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAA+B,CAAC;IAClD,0EAA0E;IAC1E,0EAA0E;IAC1E,sCAAsC;IACtC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAE5C,MAAM,QAAQ,CAAC,KAAK,CAClB;8CAC0C,EAC1C,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAClB,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,EACd,QAAkB;IAElB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,CACnC;8CAC0C,EAC1C,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAA+B,CAAC;AAC/C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heychunky/core",
-  "version": "0.15.1",
+  "version": "0.16.0",
   "description": "The engine the Chunky CLI, worker and apps run on.",
   "license": "MIT",
   "type": "module",

package/register/0003-orgs-own-the-tenancy/01-orgs-app-limit.sql

@@ -0,0 +1,6 @@
+-- The per-account override follows the plan onto the organisation.
+--
+-- `users.app_limit` was "bend the ceiling for one person without inventing a
+-- sixth plan". Now that apps are counted per organisation, an override that
+-- stayed on the user would bend a ceiling nobody measures against.
+alter table orgs add column app_limit integer;

package/register/0003-orgs-own-the-tenancy/02-orgs-app-limit-check.sql

@@ -0,0 +1 @@
+alter table orgs add constraint orgs_app_limit_check check ((app_limit >= 0));

package/register/0003-orgs-own-the-tenancy/03-backfill-orgs-app-limit.sql

@@ -0,0 +1,8 @@
+-- Personal organisations inherit their person's override, so nobody's ceiling
+-- moves on the day the reads do. `users.app_limit` is dead after this and is
+-- dropped in a later contract, once nothing has read it for a while.
+update orgs o
+   set app_limit = u.app_limit
+  from users u
+ where lower(u.username) = lower(o.name) and o.kind = 'personal'
+   and o.app_limit is null and u.app_limit is not null;

package/register/0003-orgs-own-the-tenancy/04-apps-org-id-not-null.sql

@@ -0,0 +1,10 @@
+-- An app must be in an organisation.
+--
+-- Until now `org_id` could be null, which was right while nothing read it — the
+-- backfill had to be allowed to leave a gap rather than fail. Now that every
+-- tenancy question is `where org_id = $1`, a null is an app that exists and
+-- that nobody, including its owner, can see. Better refused at write time.
+--
+-- `heychunky register verify` counts apps in no organisation, and it must read
+-- zero before this can apply.
+alter table apps alter column org_id set not null;

package/register/0003-orgs-own-the-tenancy/05-drop-apps-name-key.sql

@@ -0,0 +1,11 @@
+-- Names become unique per organisation rather than across the factory.
+--
+-- `apps_org_name_key` has been carrying this since 0002; this only removes the
+-- global rule it made redundant. Keeping both would mean the first organisation
+-- to call an app `blog` took the name from everybody, which is the whole thing
+-- an organisation is supposed to stop.
+--
+-- Provider names are a separate question and stay global: a repository and a
+-- Vercel project still cannot collide, and provisioning is what has to answer
+-- for that.
+drop index apps_name_key;

package/register/0003-orgs-own-the-tenancy/06-drop-context-members.sql

@@ -0,0 +1,4 @@
+-- Absorbed by `org_members`. Never held a row, and has had no reader since
+-- `orgs.ts` replaced `contexts.ts`, nor a writer since `claimUsername` started
+-- creating the personal organisation instead.
+drop table context_members;

package/register/0003-orgs-own-the-tenancy/07-drop-contexts.sql

@@ -0,0 +1,2 @@
+-- Absorbed by `orgs`. Dropped after `context_members`, which referenced it.
+drop table contexts;