@volter/teams 0.1.89 → 0.2.0

package/server/machine-link.mjs

@@ -56,6 +56,9 @@ export async function machineGrantRows(api, teamId, machineId) {
 
 /** What the caller may claim on the machine right now, or null (indistinguishable from no machine). */
 async function claimFor(api, auth, machineId) {
+  // Session credentials never inherit the team's all-session mail grant or machine grants.
+  // Their narrowly authorized session operations use the session door instead.
+  if(auth.agent_credential)return null;
   if(auth.installation_id&&auth.kind!=='delegated'&&!await appAuthentication(api,auth))return null;
   if (auth.kind === 'delegated') {
     const row = await api.store.one(`SELECT g.id,g.revision FROM machine_grants g JOIN app_installations i ON i.id=g.app_installation_id JOIN apps a ON a.id=i.app_id
@@ -98,6 +101,11 @@ export function closeAppChannels(api,installationId,reason='app_uninstalled'){
   for(const entry of channels(api))if(entry.installationId===installationId)entry.close(reason);
 }
 
+/** A represented agent's lifetime also fences a channel whose principal is its ancestor's app. */
+export function closeActorChannels(api,teamId,actor,reason='agent_ended'){
+  for(const entry of channels(api))if(entry.teamId===teamId&&entry.actors?.includes(actor))entry.close(reason);
+}
+
 /** Close the channels a revocation or machine removal leaves without authority; the next stream would be refused anyway. */
 export function closeMachineChannels(api, teamId, machineId, { grantId = null, reason = 'access_revoked' } = {}) {
   let closed = 0;
@@ -175,6 +183,7 @@ export async function authorizeMachineUpgrade(api, { authenticate, url, headers
   if (door === 'channel' && looksDelegated(presented)) return await delegatedChannel(api, teamId, machineId, presented);
   const auth = await authenticate(api, presented);
   if (!auth) return { status: 401, code: 'authentication_required', message: 'authentication required' };
+  if(auth.agent_credential)return {status:403,code:'forbidden',message:'agent session credential cannot open a machine channel'};
   if (door === 'link') {
     if (auth.kind !== 'machine' || auth.team_id !== teamId || auth.machine_id !== machineId) return { status: 403, code: 'forbidden', message: 'exact machine credential required' };
     const machine = await api.store.one('SELECT incarnation_id FROM machines WHERE team_id=? AND id=? AND revoked_at IS NULL', [teamId, machineId]);
@@ -278,7 +287,7 @@ async function boundSessionTarget(api, teamId, access) {
 /** The same delivery checks, explainable only through a session custodian's authenticated door.
  * No token is accepted and no grant, binding or native message is created by this read.
  */
-export async function sessionDeliveryResolution(api, teamId, access, diagnostics = false) {
+export async function sessionDeliveryResolution(api, teamId, access, diagnostics = false, auth = null) {
   const named = await api.store.query('SELECT id, canonical_id FROM sessions WHERE team_id=? AND deleted_at IS NULL AND (id=? OR id IN (SELECT session_id FROM origins WHERE team_id=? AND native_id=? AND deleted_at IS NULL))', [teamId, access.sessionRef, teamId, access.sessionRef]);
   let reason = 'session_not_found', origins = null;
   for (const found of named) {
@@ -294,6 +303,21 @@ export async function sessionDeliveryResolution(api, teamId, access, diagnostics
       ORDER BY (o.native_id=?) DESC, o.sequence DESC LIMIT 1`, [teamId, teamId, root.id, root.id, access.sessionRef]);
     if (origin) {
       const target = { sessionId: root.id, harness: origin.harness, nativeId: origin.native_id, machineId: origin.machine_id };
+      if(diagnostics){
+        if(await endedNoticeTarget(api,teamId,target.sessionId))return {state:'ended',reason:'agent_session_ended',target};
+        const machine=await api.store.one('SELECT name FROM machines WHERE team_id=? AND id=? AND revoked_at IS NULL',[teamId,target.machineId]);
+        const claim=auth?await claimFor(api,auth,target.machineId):null;
+        const link=links(api).get(key(teamId,target.machineId));
+        if(!machine||!claim||!link||link.channel.closed)return {state:'unknown',reason:!claim?'native_liveness_not_authorized':'machine_offline',target};
+        const name=String(machine.name).split('.')[0].toLowerCase().replace(/[^a-z0-9_-]/g,'-');
+        try{
+          const reply=await nativeMailReply(link,claim,{op:'status',to:`sc:${name}:${target.harness}:${target.nativeId}`},35000);
+          const native=reply.code===0?reply.native:null;
+          if(!native||!['running','stopped','unavailable','unknown'].includes(native.state))return {state:'unknown',reason:'native_liveness_unavailable',target};
+          return {state:native.state==='running'?'ready':native.state,reason:native.reason??(native.state==='stopped'?'native_session_stopped':null),target,
+            native:{state:native.state,resumable:native.resumable===true},checked_at:api.clock.nowMs()};
+        }catch{return {state:'unknown',reason:'native_liveness_unavailable',target};}
+      }
       return { state: 'ready', reason: null, target };
     }
     reason = 'no_live_origin';
@@ -317,6 +341,33 @@ export async function sessionDeliveryResolution(api, teamId, access, diagnostics
   return { state: 'unavailable', reason, target: null, ...(origins ? { origins } : {}) };
 }
 
+/** The agent ownership ledger exists after C7. A process stop is distinct from its owner's terminal end. */
+async function endedNoticeTarget(api,team,session){
+  if(!await api.store.one("SELECT 1 FROM sqlite_master WHERE type='table' AND name='agent_sessions'",[]))return false;
+  return Boolean(await api.store.one('SELECT 1 FROM agent_sessions WHERE team_id=? AND session_id=? AND ended_at IS NOT NULL',[team,session]));
+}
+
+async function nativeMailReply(link,claim,request,ms=35000){
+  const stream=await link.channel.open('mail',{_admitted:claim,request});
+  return new Promise((resolve,reject)=>{
+    let text='',finished=false;
+    const finish=(error,result)=>{if(finished)return;finished=true;clearTimeout(timer);error?reject(error):resolve(result);};
+    const timer=setTimeout(()=>{finish(new Error('native mail reply timed out'));stream.close('timeout');},ms);
+    stream.on('data',chunk=>{text+=chunk;if(text.length>65536){finish(new Error('native mail reply exceeded its bound'));stream.close('oversized');}});
+    stream.on('close',()=>{try{finish(null,JSON.parse(text));}catch{finish(new Error('native mail reply contained no JSON receipt'));}});
+    stream.on('error',error=>finish(error));
+  });
+}
+
+function noticeRefusal(reply){
+  const message=reply?.text??reply?.detail??'Room notice refused';
+  if(reply?.error==='session_resume_pending')return Object.assign(new Error(message),{status:503,code:'session_resume_pending'});
+  if(reply?.error==='session_resume_unavailable')return Object.assign(new Error(message),{status:409,code:'session_resume_unavailable'});
+  if(reply?.code===3)return Object.assign(new Error(message),{status:410,code:'session_not_running'});
+  if(reply?.code===2)return Object.assign(new Error(message),{status:403,code:'native_delivery_refused'});
+  return Object.assign(new Error(message),{status:503,code:'native_delivery_unconfirmed'});
+}
+
 /** Close every delegated channel whose grant came from one publication (issuer from delegatedGrantIssuer): it was unpublished. */
 export function closeDelegatedChannels(api, teamId, machineId, grantIssuer, reason = 'unpublished') {
   let closed = 0;
@@ -371,6 +422,33 @@ async function acceptLink(api, teamId, machineId, duplex, closeSocket) {
 }
 
 const LINK_WAIT_MS = 10_000;
+
+/** Send one already-authorized, exact native message. The receipt, rather than subprocess exit, confirms delivery. */
+export async function deliverNativeMail(api, teamId, machineId, claim, request, authorize) {
+  const link=await linkWithin(api,key(teamId,machineId),LINK_WAIT_MS);
+  if(!link)throw Object.assign(new Error('machine is offline'),{status:503,code:'machine_offline'});
+  await authorize();
+  const stream=await link.channel.open('mail',{_admitted:claim,request});
+  return await new Promise((resolve,reject)=>{
+    let text='';
+    const timeout=setTimeout(()=>{reject(new Error('native message delivery not confirmed'));stream.close('timeout');},15000);
+    stream.on('data',chunk=>{
+      text+=chunk;
+      if(text.length>65536){clearTimeout(timeout);reject(new Error('native message receipt exceeds limit'));stream.close('receipt_limit');}
+    });
+    stream.on('close',()=>{
+      clearTimeout(timeout);
+      try{
+        if(!text.trim())throw new Error('native message returned no receipt');
+        const result=JSON.parse(text);
+        if(result.code!==0)throw new Error(result.text??result.detail??'native message refused');
+        if(result.receipt?.delivered!==true)throw new Error(result.receipt?.reason??'native message delivery not confirmed');
+        resolve({delivered:true});
+      }catch(error){reject(error);}
+    });
+    stream.on('error',error=>{clearTimeout(timeout);reject(error);});
+  });
+}
 /** How often an open delegated channel asks its workplace whether the token's access still holds. */
 const DELEGATED_RECHECK_MS = 15_000;
 
@@ -407,7 +485,7 @@ async function acceptChannel(api, auth, machineId, duplex, closeSocket) {
   } catch { closeSocket('refused'); return; }
   const open = new Set();
   const entry = {
-    teamId: auth.team_id, machineId, installationId:auth.installation_id??null, principal: auth.principal_id, claim: null, grantIssuer: auth.grant_issuer ?? null,
+    teamId: auth.team_id, machineId, installationId:auth.installation_id??null, principal: auth.principal_id, actors:[...(auth.act??[])], claim: null, grantIssuer: auth.grant_issuer ?? null,
     close: (reason) => closeSocket(reason),
     dropStreams: (reason) => { for (const pair of open) pair.close(reason); },
   };
@@ -466,6 +544,7 @@ async function acceptChannel(api, auth, machineId, duplex, closeSocket) {
 export async function deliverSessionRoomNotice(api, access) {
   const target = await boundSessionTarget(api, access.teamId, access);
   if (!target || target.harness !== access.harness) throw Object.assign(new Error('session not found'), { status: 404, code: 'not_found' });
+  if(await endedNoticeTarget(api,access.teamId,target.sessionId))throw Object.assign(new Error('the session owner has ended; nothing was sent'),{status:410,code:'agent_session_ended'});
   const machine = await api.store.one('SELECT name FROM machines WHERE team_id=? AND id=? AND revoked_at IS NULL', [access.teamId, target.machineId]);
   if (!machine) throw Object.assign(new Error('machine not found'), { status: 404, code: 'not_found' });
   const machineName = String(machine.name).split('.')[0].toLowerCase().replace(/[^a-z0-9_-]/g, '-');
@@ -480,26 +559,43 @@ export async function deliverSessionRoomNotice(api, access) {
       params: [access.teamId, id, target.machineId, principal, JSON.stringify(['mail']), JSON.stringify([`mail:${to}`]), `delegated:room-notice:${digest}`, now, access.expiresAt, access.installationId] }]);
     try {
       const link = await linkWithin(api, key(access.teamId, target.machineId), LINK_WAIT_MS);
-      if (!link) throw new Error('machine offline; Room notice remains pending');
-      const stream = await link.channel.open('mail', { _admitted: { principal, groups: [], grants: [id], revisions: { [id]: 1 } },
+      if (!link) throw Object.assign(new Error('machine offline; Room notice remains pending'),{status:503,code:'machine_offline'});
+      const claim={principal,groups:[],grants:[id],revisions:{[id]:1}};
+      let state;
+      try{state=await nativeMailReply(link,claim,{op:'status',to},35000);}
+      catch(error){
+        // A connector that predates the status door refuses the op itself. It still delivers to a running
+        // session exactly as before; only the stopped-thread resume needs the updated connector.
+        if(!/^mail refused: mail needs a send, file, list or turn request/.test(error.message))throw Object.assign(new Error('native liveness is unavailable; nothing was sent'),{status:503,code:'native_liveness_unavailable'});
+        state=null;
+      }
+      if(state&&(state.code!==0||!['running','stopped','unavailable'].includes(state.native?.state)))throw Object.assign(new Error('native liveness is unavailable; nothing was sent'),{status:503,code:'native_liveness_unavailable'});
+      if(state?.native.state==='unavailable')throw Object.assign(new Error('native session is absent; nothing was sent'),{status:410,code:'native_session_not_found'});
+      if(state?.native.state==='stopped'&&!state.native.resumable)throw Object.assign(new Error(state.native.reason??'native resume authority is unrecorded; nothing was sent'),{status:409,code:'session_resume_unavailable'});
+      // Recheck admission and the exact binding after a potentially slow native read.
+      const current=await boundSessionTarget(api,access.teamId,access);
+      if(!current||JSON.stringify(current)!==JSON.stringify(target))throw Object.assign(new Error('session binding changed; nothing was sent'),{status:409,code:'session_binding_changed'});
+      if(await endedNoticeTarget(api,access.teamId,target.sessionId))throw Object.assign(new Error('the session owner has ended; nothing was sent'),{status:410,code:'agent_session_ended'});
+      await api.store.guardedTransaction([installedGuard(access,'delegation.notices')],[]);
+      const stream = await link.channel.open('mail', { _admitted: claim,
         request: { op: 'send', from: `sc:${machineName}:operator:room-${digest.slice(0, 24)}`, from_name: `Room ${access.roomName}`,
-          to, body: access.notice.text, id: `room-notice:${digest}`, queue: false } });
+          to, body: access.notice.text, id: `room-notice:${digest}`, queue: false,...(state?{resume_if_closed:true}:{}) } });
       return await new Promise((resolve, reject) => {
         let text = '';
-        const timeout = setTimeout(() => { reject(new Error('Room notice delivery not confirmed')); stream.close('timeout'); }, 15000);
+        const timeout = setTimeout(() => { reject(Object.assign(new Error('Room notice delivery not confirmed'),{status:503,code:'native_delivery_unconfirmed'})); stream.close('timeout'); }, 60000);
         // Channel data is already text; the machine writes remote-deliver's JSON reply as a string.
         stream.on('data', chunk => { text += chunk; });
         stream.on('close', () => {
           clearTimeout(timeout);
           try {
-            if (!text.trim()) throw new Error('Room notice delivery returned no receipt');
+            if (!text.trim()) throw Object.assign(new Error('Room notice delivery returned no receipt'),{status:503,code:'native_delivery_unconfirmed'});
             const result = JSON.parse(text);
-            if (result?.code !== 0) throw new Error(result?.text ?? result?.detail ?? 'Room notice refused');
-            if (result.receipt?.delivered !== true) throw new Error(result.receipt?.reason ?? 'Room notice native delivery not confirmed');
+            if (result?.code !== 0) throw noticeRefusal(result);
+            if (result.receipt?.delivered !== true) throw Object.assign(new Error(result.receipt?.reason ?? 'Room notice native delivery not confirmed'),{status:503,code:'native_delivery_unconfirmed'});
             resolve({ delivered: true, noticeId: access.notice.id });
-          } catch (error) { reject(error); }
+          } catch (error) { reject(error.status?error:Object.assign(new Error('Room notice delivery returned an invalid receipt'),{status:503,code:'native_delivery_unconfirmed'})); }
         });
-        stream.on('error', error => { clearTimeout(timeout); reject(error); });
+        stream.on('error', () => { clearTimeout(timeout); reject(Object.assign(new Error('Room notice delivery channel failed'),{status:503,code:'native_delivery_unconfirmed'})); });
       });
     } finally { await api.store.transaction([{ sql: 'DELETE FROM machine_grants WHERE team_id=? AND id=?', params: [access.teamId, id] }]); }
   })();

package/server/member-mirror.mjs

@@ -0,0 +1,147 @@
+// Standard org doors (mirrored ontology C6, M6; ADR 0018). Two ways a team takes members from outside:
+// - an identity issuer's GROUP: an admin links the team to a group, and a person whose verified sign-in token carries
+//   that group in its `groups` claim joins as a member (a member removed from the team stays removed);
+// - a LINKED SOURCE: an admin names one installed app as the team's membership source; that app's installation writes
+//   the members, each by an issuer the team installed for sign-in and a subject, and nobody else does. A subject
+//   already linked by a sign-in is seated at once; any other is a pending seat its owner's own sign-in claims, so a
+//   tenant's assertion never writes the server-wide issuer/subject link.
+//   A removal the team cannot apply (the last owner) is kept as an alarm for the admins.
+// Joining a team gives no machine or session access.
+import { isAdmin } from './auth.mjs';
+import { installedIssuer } from './apps.mjs';
+
+const text = (value, name, max = 512) => { if (typeof value !== 'string' || !value.trim() || value.length > max) throw Object.assign(new Error(`${name} is required`), { status: 400, code: 'invalid_request' }); return value.trim(); };
+const forbid = (message) => { throw Object.assign(new Error(message), { status: 403, code: 'forbidden' }); };
+
+/** The installation a linked team takes its membership from, or null. */
+export async function membershipSource(api, teamId) {
+  return (await api.store.one('SELECT installation_id FROM membership_sources WHERE team_id=?', [teamId]))?.installation_id ?? null;
+}
+
+/** Refuse a membership change in a linked team made by anyone but its source. */
+export async function requireUnlinked(api, teamId) {
+  if (await membershipSource(api, teamId)) throw Object.assign(new Error('this team takes its members from its linked source; change them there'), { status: 409, code: 'membership_linked' });
+}
+
+/** Whether a verified person's `groups` claim names a group this (unlinked) team admits from that issuer. */
+export async function admittedByGroup(api, teamId, person) {
+  if (!Array.isArray(person.groups) || !person.groups.length || await membershipSource(api, teamId)) return false;
+  const rows = await api.store.query('SELECT group_name FROM identity_group_links WHERE team_id=? AND issuer=?', [teamId, person.issuer]);
+  return rows.some((row) => person.groups.includes(row.group_name));
+}
+
+/**
+ * A member the issuer's group admitted stays only while their token still carries a linked group: a sign-in whose
+ * token no longer does ends the membership and is refused. A member who came by invitation is unaffected.
+ */
+export async function groupStillAdmits(api, teamId, principalId, person) {
+  const admitted = await api.store.one('SELECT issuer FROM group_admissions WHERE team_id=? AND principal_id=?', [teamId, principalId]);
+  if (!admitted || admitted.issuer !== person.issuer) return true;
+  const rows = await api.store.query('SELECT group_name FROM identity_group_links WHERE team_id=? AND issuer=?', [teamId, person.issuer]);
+  if (rows.some((row) => (person.groups ?? []).includes(row.group_name))) return true;
+  const now = api.clock.nowMs();
+  await api.store.transaction([
+    { sql: 'UPDATE memberships SET active=0,revision=revision+1 WHERE team_id=? AND principal_id=? AND active=1', params: [teamId, principalId] },
+    { sql: 'UPDATE credentials SET revoked_at=? WHERE team_id=? AND principal_id=? AND revoked_at IS NULL', params: [now, teamId, principalId] },
+    { sql: 'DELETE FROM group_admissions WHERE team_id=? AND principal_id=?', params: [teamId, principalId] },
+    { sql: 'UPDATE teams SET auth_epoch=auth_epoch+1 WHERE id=?', params: [teamId] },
+  ]);
+  api.events.publish(teamId, { type: 'authorization_changed', principal_id: principalId });
+  return false;
+}
+
+export async function memberMirrorRoute({ api, req, res, auth, sub, requestId, parseJson, send, result }) {
+  const admin = () => { if (!isAdmin(auth) || auth.installation_id) forbid('a team admin manages its org links'); };
+  const now = api.clock.nowMs();
+  if (sub === '/identity/groups') {
+    admin();
+    if (req.method === 'GET') { send(res, 200, result(api, auth, { links: await api.store.query('SELECT issuer,group_name "group",linked_by,created_at FROM identity_group_links WHERE team_id=? ORDER BY issuer,group_name', [auth.team_id]) }), requestId); return true; }
+    const body = await parseJson(req);
+    const issuer = text(body.issuer, 'issuer'), group = text(body.group, 'group', 256);
+    if (req.method === 'POST') await api.store.transaction([{ sql: 'INSERT OR IGNORE INTO identity_group_links(team_id,issuer,group_name,linked_by,created_at) VALUES (?,?,?,?,?)', params: [auth.team_id, issuer, group, auth.principal_id, now] }]);
+    else if (req.method === 'DELETE') await api.store.transaction([{ sql: 'DELETE FROM identity_group_links WHERE team_id=? AND issuer=? AND group_name=?', params: [auth.team_id, issuer, group] }]);
+    else return false;
+    send(res, 200, result(api, auth, { issuer, group, linked: req.method === 'POST' }), requestId); return true;
+  }
+  if (sub === '/membership-source') {
+    admin();
+    if (req.method === 'GET') { send(res, 200, result(api, auth, { installation_id: await membershipSource(api, auth.team_id) }), requestId); return true; }
+    if (req.method === 'PUT') {
+      const body = await parseJson(req);
+      const installation = await api.store.one("SELECT id FROM app_installations WHERE id=? AND team_id=? AND state='active'", [text(body.installation_id, 'installation_id'), auth.team_id]);
+      if (!installation) throw Object.assign(new Error('no active installation by that id in this team'), { status: 404, code: 'not_found' });
+      await api.store.transaction([{ sql: 'INSERT INTO membership_sources(team_id,installation_id,linked_by,linked_at) VALUES (?,?,?,?) ON CONFLICT(team_id) DO UPDATE SET installation_id=excluded.installation_id,linked_by=excluded.linked_by,linked_at=excluded.linked_at', params: [auth.team_id, installation.id, auth.principal_id, now] }]);
+      send(res, 200, result(api, auth, { installation_id: installation.id }), requestId); return true;
+    }
+    if (req.method === 'DELETE') { await api.store.transaction([{ sql: 'DELETE FROM membership_sources WHERE team_id=?', params: [auth.team_id] }]); send(res, 200, result(api, auth, { installation_id: null }), requestId); return true; }
+    return false;
+  }
+  if (sub === '/membership-alarms' && req.method === 'GET') {
+    admin();
+    send(res, 200, result(api, auth, { alarms: await api.store.query('SELECT id,principal_id,issuer,subject,reason,created_at FROM membership_alarms WHERE team_id=? AND cleared_at IS NULL ORDER BY created_at', [auth.team_id]) }), requestId); return true;
+  }
+  if (sub === '/membership-seats' && req.method === 'GET') {
+    admin();
+    send(res, 200, result(api, auth, { seats: await api.store.query('SELECT issuer,subject,role,display_name,observation,created_at FROM source_seats WHERE team_id=? ORDER BY created_at', [auth.team_id]) }), requestId); return true;
+  }
+  if (sub === '/members/mirror' && req.method === 'POST') {
+    const source = await membershipSource(api, auth.team_id);
+    if (!source || auth.installation_id !== source) forbid('only the team\'s linked membership source mirrors members');
+    const body = await parseJson(req);
+    const issuer = text(body.issuer, 'issuer'), subject = text(body.subject, 'subject'), active = body.active !== false;
+    const role = body.role === 'admin' ? 'admin' : 'member';
+    // The source's own record of this person (an RH2 principal, `rh2:<id>`): linked to whoever holds the subject.
+    const observed = body.observation == null ? null : text(body.observation, 'observation');
+    if (observed !== null && !/^[a-z][a-z0-9_-]*:\S+$/.test(observed)) throw Object.assign(new Error('observation is a namespaced identifier'), { status: 400, code: 'invalid_request' });
+    // Only an issuer this team installed for sign-in names its members.
+    if (!await installedIssuer(api, issuer, 'identity.login', auth.team_id)) forbid('this team has not installed that issuer for sign-in');
+    const linked = await api.store.one('SELECT principal_id FROM principal_identities WHERE issuer=? AND subject=?', [issuer, subject]);
+    if (!active) {
+      await api.store.transaction([{ sql: 'DELETE FROM source_seats WHERE team_id=? AND issuer=? AND subject=?', params: [auth.team_id, issuer, subject] }]);
+      if (!linked) { send(res, 200, result(api, auth, { applied: true, member: null }), requestId); return true; }
+      const member = await api.store.one('SELECT role FROM memberships WHERE team_id=? AND principal_id=? AND active=1', [auth.team_id, linked.principal_id]);
+      if (member?.role === 'owner' && (await api.store.one("SELECT count(*) n FROM memberships WHERE team_id=? AND role='owner' AND active=1", [auth.team_id])).n <= 1) {
+        await api.store.transaction([{ sql: 'INSERT INTO membership_alarms(team_id,id,principal_id,issuer,subject,reason,created_at) VALUES (?,?,?,?,?,?,?)', params: [auth.team_id, api.ids.next('alarm'), linked.principal_id, issuer, subject, 'the source removed the team\'s last owner', now] }]);
+        throw Object.assign(new Error('the team cannot remove its last owner; an alarm was raised for its admins'), { status: 409, code: 'removal_unapplied' });
+      }
+      if (member) await api.store.transaction([
+        { sql: 'UPDATE memberships SET active=0,revision=revision+1 WHERE team_id=? AND principal_id=?', params: [auth.team_id, linked.principal_id] },
+        { sql: 'UPDATE credentials SET revoked_at=? WHERE team_id=? AND principal_id=? AND revoked_at IS NULL', params: [now, auth.team_id, linked.principal_id] },
+        { sql: 'UPDATE teams SET auth_epoch=auth_epoch+1 WHERE id=?', params: [auth.team_id] },
+      ]);
+      api.events.publish(auth.team_id, { type: 'authorization_changed', principal_id: linked.principal_id });
+      send(res, 200, result(api, auth, { applied: true, member: null }), requestId); return true;
+    }
+    if (!linked) {
+      // Nobody has signed in as this subject: the team keeps a pending seat that the person's own sign-in claims.
+      await api.store.transaction([{ sql: 'INSERT INTO source_seats(team_id,issuer,subject,role,display_name,observation,created_at) VALUES (?,?,?,?,?,?,?) ON CONFLICT(team_id,issuer,subject) DO UPDATE SET role=excluded.role,display_name=excluded.display_name,observation=excluded.observation', params: [auth.team_id, issuer, subject, role, typeof body.name === 'string' && body.name.trim() ? body.name.trim().slice(0, 200) : null, observed, now] }]);
+      send(res, 200, result(api, auth, { applied: true, member: null, pending: true }), requestId); return true;
+    }
+    const pid = linked.principal_id;
+    const statements = observed === null ? [] : integrationLink(api, auth.team_id, observed, pid, auth.installation_id, auth.principal_id, issuer, subject, now);
+    const member = await api.store.one('SELECT active,role FROM memberships WHERE team_id=? AND principal_id=?', [auth.team_id, pid]);
+    if (!member) statements.push({ sql: 'INSERT INTO memberships(team_id,principal_id,role) VALUES (?,?,?)', params: [auth.team_id, pid, role] });
+    else if (!member.active || (member.role !== role && member.role !== 'owner')) statements.push({ sql: 'UPDATE memberships SET active=1,role=?,revision=revision+1 WHERE team_id=? AND principal_id=?', params: [member.role === 'owner' ? 'owner' : role, auth.team_id, pid] });
+    if (statements.length) await api.store.transaction(statements);
+    send(res, 200, result(api, auth, { applied: true, member: { principal_id: pid, role: member?.role === 'owner' ? 'owner' : role } }), requestId); return true;
+  }
+  return false;
+}
+
+/** The pending seat a linked source keeps in this team for a verified person, or null (sign-in claims it). */
+export async function sourceSeat(api, teamId, person) {
+  return api.store.one('SELECT role,display_name,observation FROM source_seats WHERE team_id=? AND issuer=? AND subject=?', [teamId, person.issuer, person.subject]);
+}
+
+/**
+ * The statements that link a membership source's own record of a person (`rh2:<id>`) to the principal who signed in as
+ * the subject the source named: proven, kind integration, through the source's installation; written only while the
+ * observation has no live proven link.
+ */
+export function integrationLink(api, teamId, observation, principalId, installationId, by, issuer, subject, now) {
+  return [
+    { sql: 'INSERT INTO identity_observations(team_id,id,first_seen,last_seen) VALUES (?,?,?,?) ON CONFLICT(team_id,id) DO NOTHING', params: [teamId, observation, now, now] },
+    { sql: "INSERT INTO identity_links(team_id,id,observation_id,principal_id,classification,proof_kind,evidence_json,created_by,created_at,installation_id) SELECT ?,?,?,?,'proven','integration',?,?,?,? WHERE NOT EXISTS (SELECT 1 FROM identity_links WHERE team_id=? AND observation_id=? AND classification='proven' AND revoked_at IS NULL)",
+      params: [teamId, api.ids.next('identity_link'), observation, principalId, JSON.stringify({ installation_id: installationId, issuer, subject }), by, now, installationId, teamId, observation] },
+  ];
+}

package/server/migrations/015.mjs

@@ -0,0 +1,72 @@
+// The event and its delivery obligations share the source mutation's transaction on both hosts.
+const now = "CAST((julianday('now')-2440587.5)*86400000 AS INTEGER)";
+const insert = (team, kind, type, id, at, data) => `
+INSERT INTO org_events(id,team_id,kind,resource_kind,resource_id,created_at,actor_json,data_json)
+VALUES ('evt_'||lower(hex(randomblob(16))),${team},${kind},'${type}',${id},${at},'{"principal":null,"session":null,"lineage":[]}',${data});`;
+const session = (team, id) => `json_object('id',${id},'harness',(SELECT harness FROM sessions WHERE team_id=${team} AND id=${id}),
+  'bindings',json(COALESCE((SELECT json_group_array(json(descriptor_json)) FROM bindings WHERE team_id=${team} AND session_id=${id}),'[]')))`;
+const membership = "json_object('principal_id',NEW.principal_id,'role',NEW.role,'active',json(CASE WHEN NEW.active=1 THEN 'true' ELSE 'false' END),'revision',NEW.revision)";
+const otherRunning = "EXISTS (SELECT 1 FROM bindings b WHERE b.team_id=NEW.team_id AND b.session_id=NEW.session_id AND b.id!=NEW.id AND json_extract(b.descriptor_json,'$.state')='running')";
+const bindingKind = `CASE WHEN json_extract(NEW.descriptor_json,'$.state')='running' AND NOT ${otherRunning} THEN 'session.started' WHEN json_extract(NEW.descriptor_json,'$.state')='stopped' AND NOT ${otherRunning} THEN 'session.ended' ELSE 'session.changed' END`;
+const bindingChanged = "OLD.incarnation_id!=NEW.incarnation_id OR json_extract(OLD.descriptor_json,'$.state') IS NOT json_extract(NEW.descriptor_json,'$.state') OR json_extract(OLD.descriptor_json,'$.native_runtime_id') IS NOT json_extract(NEW.descriptor_json,'$.native_runtime_id')";
+export default `
+CREATE TABLE event_sources (
+  team_id TEXT NOT NULL, id TEXT NOT NULL, principal_id TEXT NOT NULL, name TEXT NOT NULL,
+  PRIMARY KEY(team_id,id), UNIQUE(team_id,principal_id,name),
+  FOREIGN KEY(team_id,principal_id) REFERENCES memberships(team_id,principal_id)
+) STRICT;
+CREATE TABLE org_events (
+  sequence INTEGER PRIMARY KEY AUTOINCREMENT, id TEXT NOT NULL UNIQUE, team_id TEXT NOT NULL REFERENCES teams(id),
+  source_id TEXT, source_revision INTEGER, kind TEXT NOT NULL, resource_kind TEXT NOT NULL, resource_id TEXT NOT NULL,
+  actor_json TEXT NOT NULL CHECK(json_valid(actor_json)), data_json TEXT NOT NULL CHECK(json_valid(data_json)), created_at INTEGER NOT NULL
+) STRICT;
+CREATE INDEX org_events_replay ON org_events(team_id,sequence);
+CREATE TABLE event_resources (
+  team_id TEXT NOT NULL, source_id TEXT NOT NULL DEFAULT '', resource_kind TEXT NOT NULL, resource_id TEXT NOT NULL,
+  sequence INTEGER NOT NULL, source_revision INTEGER, event_json TEXT NOT NULL CHECK(json_valid(event_json)),
+  PRIMARY KEY(team_id,source_id,resource_kind,resource_id)
+) STRICT;
+CREATE TABLE event_retention (team_id TEXT PRIMARY KEY, pruned_through INTEGER NOT NULL) STRICT;
+CREATE TRIGGER org_event_record AFTER INSERT ON org_events BEGIN
+  INSERT INTO event_resources(team_id,source_id,resource_kind,resource_id,sequence,source_revision,event_json)
+  VALUES (NEW.team_id,COALESCE(NEW.source_id,''),NEW.resource_kind,NEW.resource_id,NEW.sequence,NEW.source_revision,
+    json_object('id',NEW.id,'org',NEW.team_id,'at',NEW.created_at,'actor',json(NEW.actor_json),'kind',NEW.kind,
+      'resource',json_object('kind',NEW.resource_kind,'id',NEW.resource_id),'data',json(NEW.data_json)))
+  ON CONFLICT(team_id,source_id,resource_kind,resource_id) DO UPDATE SET sequence=excluded.sequence,source_revision=excluded.source_revision,event_json=excluded.event_json;
+  INSERT INTO app_webhook_deliveries(id,installation_id,event_id,body,state,next_at,created_at)
+  SELECT 'delivery_'||lower(hex(randomblob(16))),i.id,NEW.id,
+    json_object('id',NEW.id,'org',NEW.team_id,'at',NEW.created_at,'actor',json(NEW.actor_json),'kind',NEW.kind,
+      'resource',json_object('kind',NEW.resource_kind,'id',NEW.resource_id),'data',json(NEW.data_json)),
+    'pending',NEW.created_at,NEW.created_at
+  FROM app_installations i JOIN apps a ON a.id=i.app_id
+  WHERE i.team_id=NEW.team_id AND i.state='active' AND a.state='active' AND a.webhook_url IS NOT NULL
+    AND EXISTS (SELECT 1 FROM json_each(a.events_json) WHERE value=NEW.kind);
+END;
+CREATE TRIGGER membership_event_added AFTER INSERT ON memberships WHEN NEW.active=1 BEGIN
+  ${insert('NEW.team_id', "'membership.added'", 'membership', 'NEW.principal_id', now, membership)}
+END;
+CREATE TRIGGER membership_event_changed AFTER UPDATE OF active,role ON memberships WHEN OLD.active!=NEW.active OR OLD.role!=NEW.role BEGIN
+  ${insert('NEW.team_id', "CASE WHEN NEW.active=0 THEN 'membership.removed' WHEN OLD.active=0 THEN 'membership.added' ELSE 'membership.changed' END", 'membership', 'NEW.principal_id', now, membership)}
+END;
+CREATE TRIGGER session_event_capture AFTER INSERT ON session_versions BEGIN
+  ${insert('NEW.team_id', "'session.changed'", 'session', 'NEW.session_id', 'NEW.created_at', session('NEW.team_id', 'NEW.session_id'))}
+END;
+CREATE TRIGGER session_event_binding_added AFTER INSERT ON bindings BEGIN
+  ${insert('NEW.team_id', bindingKind, 'session', 'NEW.session_id', 'NEW.observed_at', session('NEW.team_id', 'NEW.session_id'))}
+END;
+CREATE TRIGGER session_event_binding_changed AFTER UPDATE ON bindings WHEN ${bindingChanged} BEGIN
+  ${insert('NEW.team_id', bindingKind, 'session', 'NEW.session_id', 'NEW.observed_at', session('NEW.team_id', 'NEW.session_id'))}
+END;
+CREATE TRIGGER session_event_binding_removed AFTER DELETE ON bindings BEGIN
+  ${insert('OLD.team_id', "'session.changed'", 'session', 'OLD.session_id', now, session('OLD.team_id', 'OLD.session_id'))}
+END;
+CREATE TRIGGER machine_event_presence AFTER INSERT ON machine_presence_events BEGIN
+  ${insert('NEW.team_id', "'resource.changed'", 'machine', 'NEW.machine_id', 'NEW.created_at', "json_object('id',NEW.machine_id,'name',NEW.name,'linked',json(CASE WHEN NEW.linked=1 THEN 'true' ELSE 'false' END))")}
+END;
+INSERT INTO org_events(id,team_id,kind,resource_kind,resource_id,created_at,actor_json,data_json)
+SELECT 'evt_'||lower(hex(randomblob(16))),m.team_id,'membership.changed','membership',m.principal_id,${now},'{"principal":null,"session":null,"lineage":[]}',json_object('principal_id',m.principal_id,'role',m.role,'active',json(CASE WHEN m.active=1 THEN 'true' ELSE 'false' END),'revision',m.revision) FROM memberships m;
+INSERT INTO org_events(id,team_id,kind,resource_kind,resource_id,created_at,actor_json,data_json)
+SELECT 'evt_'||lower(hex(randomblob(16))),s.team_id,'session.changed','session',s.id,${now},'{"principal":null,"session":null,"lineage":[]}',${session('s.team_id', 's.id')} FROM sessions s WHERE s.deleted_at IS NULL;
+INSERT INTO org_events(id,team_id,kind,resource_kind,resource_id,created_at,actor_json,data_json)
+SELECT 'evt_'||lower(hex(randomblob(16))),p.team_id,'resource.changed','machine',p.machine_id,p.changed_at,'{"principal":null,"session":null,"lineage":[]}',json_object('id',p.machine_id,'name',p.name,'linked',json(CASE WHEN p.linked=1 THEN 'true' ELSE 'false' END)) FROM machine_presence p;
+`;

package/server/migrations/016.mjs

@@ -0,0 +1,28 @@
+// Identity evidence is Org-owned. Declaring a person grants no membership or credential.
+export default `
+CREATE TABLE identity_principals (
+  team_id TEXT NOT NULL REFERENCES teams(id), principal_id TEXT NOT NULL REFERENCES principals(id),
+  declared_by TEXT NOT NULL REFERENCES principals(id), created_at INTEGER NOT NULL,
+  PRIMARY KEY(team_id,principal_id)
+) STRICT;
+CREATE TABLE identity_observations (
+  team_id TEXT NOT NULL REFERENCES teams(id), id TEXT NOT NULL, first_seen INTEGER NOT NULL, last_seen INTEGER NOT NULL,
+  PRIMARY KEY(team_id,id)
+) STRICT;
+CREATE TABLE identity_sightings (
+  team_id TEXT NOT NULL, id TEXT NOT NULL, observation_id TEXT NOT NULL, location TEXT NOT NULL,
+  observed_at INTEGER NOT NULL, recorded_at INTEGER NOT NULL, recorder_id TEXT NOT NULL REFERENCES principals(id),
+  name TEXT, evidence_json TEXT NOT NULL CHECK(json_valid(evidence_json)),
+  PRIMARY KEY(team_id,id), FOREIGN KEY(team_id,observation_id) REFERENCES identity_observations(team_id,id)
+) STRICT;
+CREATE INDEX identity_sightings_lookup ON identity_sightings(team_id,observation_id,recorded_at,id);
+CREATE TABLE identity_links (
+  team_id TEXT NOT NULL, id TEXT NOT NULL, observation_id TEXT NOT NULL, principal_id TEXT NOT NULL REFERENCES principals(id),
+  classification TEXT NOT NULL CHECK(classification IN ('proven','inferred')),
+  proof_kind TEXT NOT NULL, evidence_json TEXT NOT NULL CHECK(json_valid(evidence_json)),
+  created_by TEXT NOT NULL REFERENCES principals(id), created_at INTEGER NOT NULL, revision INTEGER NOT NULL DEFAULT 1,
+  revoked_at INTEGER, revoked_by TEXT REFERENCES principals(id), installation_id TEXT REFERENCES app_installations(id),
+  PRIMARY KEY(team_id,id), FOREIGN KEY(team_id,observation_id) REFERENCES identity_observations(team_id,id)
+) STRICT;
+CREATE UNIQUE INDEX identity_one_proven ON identity_links(team_id,observation_id) WHERE classification='proven' AND revoked_at IS NULL;
+`;

package/server/migrations/017.mjs

@@ -0,0 +1,60 @@
+// Agent identity is a principal; its assignments and intended profile live in the orchestrator.
+import { agentSessionEventTriggers } from '../session-snapshot.mjs';
+export default `
+-- Replace only the column-local enum. Principal ids and every foreign key stay in place.
+ALTER TABLE principals RENAME COLUMN kind TO previous_kind;
+ALTER TABLE principals ADD COLUMN kind TEXT NOT NULL DEFAULT 'service' CHECK(kind IN ('user','service','agent'));
+UPDATE principals SET kind=previous_kind;
+ALTER TABLE principals DROP COLUMN previous_kind;
+
+CREATE TABLE agents (
+  team_id TEXT NOT NULL REFERENCES teams(id), id TEXT NOT NULL REFERENCES principals(id),
+  name TEXT NOT NULL, parent_id TEXT, custodian_id TEXT NOT NULL REFERENCES principals(id),
+  lineage_json TEXT NOT NULL CHECK(json_valid(lineage_json)), sponsor_id TEXT REFERENCES principals(id),
+  profile_ref TEXT NOT NULL, state TEXT NOT NULL CHECK(state IN ('active','suspended','ended')),
+  main_session_id TEXT, created_at INTEGER NOT NULL, ended_at INTEGER, end_reason TEXT,
+  revision INTEGER NOT NULL DEFAULT 1,
+  PRIMARY KEY(team_id,id), FOREIGN KEY(team_id,parent_id) REFERENCES agents(team_id,id),
+  FOREIGN KEY(team_id,main_session_id) REFERENCES sessions(team_id,id)
+) STRICT;
+CREATE UNIQUE INDEX live_agent_names ON agents(team_id,COALESCE(parent_id,''),name) WHERE state!='ended';
+ALTER TABLE teams ADD COLUMN root_agent_id TEXT REFERENCES principals(id);
+CREATE TABLE principal_sponsors (
+  team_id TEXT NOT NULL REFERENCES teams(id), principal_id TEXT NOT NULL REFERENCES principals(id),
+  sponsor_id TEXT NOT NULL REFERENCES principals(id), set_by TEXT NOT NULL REFERENCES principals(id),
+  created_at INTEGER NOT NULL, PRIMARY KEY(team_id,principal_id)
+) STRICT;
+CREATE TABLE agent_sessions (
+  team_id TEXT NOT NULL, session_id TEXT NOT NULL, agent_id TEXT,
+  starter_json TEXT NOT NULL CHECK(json_valid(starter_json)),
+  profile_json TEXT NOT NULL CHECK(json_valid(profile_json)),
+  resolved_at INTEGER NOT NULL, main INTEGER NOT NULL DEFAULT 0 CHECK(main IN (0,1)),
+  ended_at INTEGER, end_reason TEXT, revision INTEGER NOT NULL DEFAULT 1,
+  PRIMARY KEY(team_id,session_id),
+  FOREIGN KEY(team_id,session_id) REFERENCES sessions(team_id,id),
+  FOREIGN KEY(team_id,agent_id) REFERENCES agents(team_id,id)
+) STRICT;
+CREATE TABLE session_profile_history (
+  team_id TEXT NOT NULL, session_id TEXT NOT NULL, revision INTEGER NOT NULL,
+  profile_json TEXT NOT NULL CHECK(json_valid(profile_json)), recorded_at INTEGER NOT NULL,
+  PRIMARY KEY(team_id,session_id,revision),
+  FOREIGN KEY(team_id,session_id) REFERENCES agent_sessions(team_id,session_id)
+) STRICT;
+CREATE TABLE agent_credentials (
+ credential_id TEXT PRIMARY KEY REFERENCES credentials(id),
+ parent_credential_id TEXT NOT NULL REFERENCES credentials(id),
+ agent_id TEXT NOT NULL REFERENCES principals(id), team_id TEXT NOT NULL REFERENCES teams(id),
+ created_at INTEGER NOT NULL
+) STRICT;
+CREATE UNIQUE INDEX one_agent_main ON agent_sessions(team_id,agent_id) WHERE main=1 AND ended_at IS NULL AND agent_id IS NOT NULL;
+CREATE TABLE agent_session_closures (
+  team_id TEXT NOT NULL, id TEXT NOT NULL, agent_id TEXT NOT NULL, session_id TEXT NOT NULL,
+  machine_id TEXT NOT NULL, source_id TEXT NOT NULL, harness TEXT NOT NULL, native_id TEXT NOT NULL,
+  state TEXT NOT NULL DEFAULT 'pending' CHECK(state IN ('pending','claimed','closed','failed','unknown')),
+  reason TEXT NOT NULL, created_at INTEGER NOT NULL, result_json TEXT, claimed_at INTEGER, finished_at INTEGER,
+  PRIMARY KEY(team_id,id), UNIQUE(team_id,agent_id,machine_id,harness,native_id),
+  FOREIGN KEY(team_id,agent_id) REFERENCES agents(team_id,id),
+  FOREIGN KEY(team_id,machine_id) REFERENCES machines(team_id,id)
+) STRICT;
+${agentSessionEventTriggers()}
+`;

package/server/migrations/018.mjs

@@ -0,0 +1,82 @@
+// One role-and-binding shape (mirrored ontology C5): roles bundle actions; a binding grants a role or actions to a
+// principal or a group on one resource. Session and machine grants are bindings; their old names are views.
+export default `
+CREATE TABLE roles (
+  team_id TEXT NOT NULL REFERENCES teams(id), name TEXT NOT NULL,
+  actions_json TEXT NOT NULL CHECK(json_valid(actions_json)), builtin INTEGER NOT NULL DEFAULT 0 CHECK(builtin IN (0,1)),
+  created_at INTEGER NOT NULL DEFAULT 0, PRIMARY KEY(team_id,name)
+) STRICT;
+INSERT INTO roles(team_id,name,actions_json,builtin)
+  SELECT t.id,r.name,r.actions,1 FROM teams t,(
+    SELECT 'owner' name,'["*"]' actions UNION ALL
+    SELECT 'admin','["*"]' UNION ALL
+    SELECT 'member','["teams.read","members.read","groups.read","sessions.read","sessions.write","machines.read","sources.read","events.read","agents.read","identity.read","identity.observe"]' UNION ALL
+    SELECT 'viewer','["teams.read","members.read","groups.read","sessions.read","machines.read","events.read","agents.read","identity.read"]' UNION ALL
+    SELECT 'reader','["sessions.read"]' UNION ALL
+    SELECT 'manager','["sessions.read","sessions.write","sessions.access"]'
+  ) r;
+CREATE TRIGGER team_builtin_roles AFTER INSERT ON teams BEGIN
+  INSERT INTO roles(team_id,name,actions_json,builtin) VALUES
+    (NEW.id,'owner','["*"]',1),(NEW.id,'admin','["*"]',1),
+    (NEW.id,'member','["teams.read","members.read","groups.read","sessions.read","sessions.write","machines.read","sources.read","events.read","agents.read","identity.read","identity.observe"]',1),
+    (NEW.id,'viewer','["teams.read","members.read","groups.read","sessions.read","machines.read","events.read","agents.read","identity.read"]',1),
+    (NEW.id,'reader','["sessions.read"]',1),(NEW.id,'manager','["sessions.read","sessions.write","sessions.access"]',1);
+END;
+CREATE TABLE permission_bindings (
+  team_id TEXT NOT NULL REFERENCES teams(id), id TEXT NOT NULL,
+  holder_kind TEXT NOT NULL CHECK(holder_kind IN ('principal','group')), holder_id TEXT NOT NULL,
+  role TEXT, actions_json TEXT CHECK(actions_json IS NULL OR json_valid(actions_json)),
+  resource_kind TEXT NOT NULL, resource_id TEXT NOT NULL,
+  effect TEXT NOT NULL DEFAULT 'allow' CHECK(effect IN ('allow','deny')),
+  conditions_json TEXT NOT NULL DEFAULT '{}' CHECK(json_valid(conditions_json)),
+  issuer_id TEXT, created_at INTEGER NOT NULL DEFAULT 0, expires_at INTEGER, revoked_at INTEGER,
+  revision INTEGER NOT NULL DEFAULT 1, app_installation_id TEXT,
+  CHECK(role IS NOT NULL OR actions_json IS NOT NULL),
+  PRIMARY KEY(team_id,id)
+) STRICT;
+CREATE INDEX permission_bindings_resource ON permission_bindings(team_id,resource_kind,resource_id,holder_id,expires_at);
+CREATE INDEX permission_bindings_holder ON permission_bindings(team_id,holder_id);
+CREATE INDEX permission_bindings_installation ON permission_bindings(app_installation_id);
+CREATE UNIQUE INDEX one_session_binding ON permission_bindings(team_id,resource_id,holder_kind,holder_id)
+  WHERE resource_kind='session' AND effect='allow' AND revoked_at IS NULL;
+INSERT INTO permission_bindings(team_id,id,holder_kind,holder_id,role,actions_json,resource_kind,resource_id,conditions_json,issuer_id,created_at,expires_at,revision,app_installation_id)
+  SELECT g.team_id,g.id,CASE WHEN EXISTS(SELECT 1 FROM groups_table x WHERE x.team_id=g.team_id AND x.id=g.subject_id) THEN 'group' ELSE 'principal' END,
+    g.subject_id,NULL,g.caps_json,'machine',g.machine_id,json_object('targets',json(g.targets_json)),g.issuer_id,g.created_at,g.expires_at,g.revision,g.app_installation_id
+  FROM machine_grants g;
+INSERT INTO permission_bindings(team_id,id,holder_kind,holder_id,role,resource_kind,resource_id,expires_at)
+  SELECT team_id,id,subject_kind,subject_id,role,'session',session_id,expires_at FROM session_grants;
+DROP TABLE machine_grants;
+DROP TABLE session_grants;
+CREATE VIEW machine_grants AS
+  SELECT team_id,id,resource_id AS machine_id,holder_id AS subject_id,actions_json AS caps_json,
+    json_extract(conditions_json,'$.targets') AS targets_json,issuer_id,created_at,expires_at,revision,app_installation_id
+  FROM permission_bindings WHERE resource_kind='machine' AND effect='allow' AND revoked_at IS NULL;
+CREATE TRIGGER machine_grants_insert INSTEAD OF INSERT ON machine_grants BEGIN
+  INSERT INTO permission_bindings(team_id,id,holder_kind,holder_id,actions_json,resource_kind,resource_id,conditions_json,issuer_id,created_at,expires_at,revision,app_installation_id)
+  VALUES (NEW.team_id,NEW.id,CASE WHEN EXISTS(SELECT 1 FROM groups_table x WHERE x.team_id=NEW.team_id AND x.id=NEW.subject_id) THEN 'group' ELSE 'principal' END,
+    NEW.subject_id,NEW.caps_json,'machine',NEW.machine_id,json_object('targets',json(NEW.targets_json)),NEW.issuer_id,COALESCE(NEW.created_at,0),NEW.expires_at,COALESCE(NEW.revision,1),NEW.app_installation_id);
+END;
+CREATE TRIGGER machine_grants_update INSTEAD OF UPDATE ON machine_grants BEGIN
+  UPDATE permission_bindings SET holder_id=NEW.subject_id,actions_json=NEW.caps_json,resource_id=NEW.machine_id,
+    conditions_json=json_object('targets',json(NEW.targets_json)),issuer_id=NEW.issuer_id,expires_at=NEW.expires_at,
+    revision=NEW.revision,app_installation_id=NEW.app_installation_id
+  WHERE team_id=OLD.team_id AND id=OLD.id;
+END;
+CREATE TRIGGER machine_grants_delete INSTEAD OF DELETE ON machine_grants BEGIN
+  DELETE FROM permission_bindings WHERE team_id=OLD.team_id AND id=OLD.id;
+END;
+CREATE VIEW session_grants AS
+  SELECT team_id,id,resource_id AS session_id,holder_kind AS subject_kind,holder_id AS subject_id,role,expires_at
+  FROM permission_bindings WHERE resource_kind='session' AND effect='allow' AND revoked_at IS NULL;
+CREATE TRIGGER session_grants_insert INSTEAD OF INSERT ON session_grants BEGIN
+  INSERT INTO permission_bindings(team_id,id,holder_kind,holder_id,role,resource_kind,resource_id,expires_at)
+  VALUES (NEW.team_id,NEW.id,NEW.subject_kind,NEW.subject_id,NEW.role,'session',NEW.session_id,NEW.expires_at);
+END;
+CREATE TRIGGER session_grants_update INSTEAD OF UPDATE ON session_grants BEGIN
+  UPDATE permission_bindings SET holder_kind=NEW.subject_kind,holder_id=NEW.subject_id,role=NEW.role,resource_id=NEW.session_id,expires_at=NEW.expires_at
+  WHERE team_id=OLD.team_id AND id=OLD.id;
+END;
+CREATE TRIGGER session_grants_delete INSTEAD OF DELETE ON session_grants BEGIN
+  DELETE FROM permission_bindings WHERE team_id=OLD.team_id AND id=OLD.id;
+END;
+`;

package/server/migrations/019.mjs

@@ -0,0 +1,20 @@
+// Standard org doors (mirrored ontology C6 and M6): a team admits the members of an identity issuer's group named in the
+// sign-in token's `groups` claim; a team may take its membership from one installed app (the linked source), read-only
+// otherwise; a removal the source asks for that the team cannot apply is kept as an alarm.
+export default `
+CREATE TABLE identity_group_links (
+  team_id TEXT NOT NULL REFERENCES teams(id), issuer TEXT NOT NULL, group_name TEXT NOT NULL,
+  linked_by TEXT NOT NULL, created_at INTEGER NOT NULL, PRIMARY KEY(team_id,issuer,group_name)
+) STRICT;
+CREATE TABLE membership_sources (
+  team_id TEXT PRIMARY KEY REFERENCES teams(id), installation_id TEXT NOT NULL, linked_by TEXT NOT NULL, linked_at INTEGER NOT NULL
+) STRICT;
+CREATE TABLE group_admissions (
+  team_id TEXT NOT NULL REFERENCES teams(id), principal_id TEXT NOT NULL, issuer TEXT NOT NULL, admitted_at INTEGER NOT NULL,
+  PRIMARY KEY(team_id,principal_id)
+) STRICT;
+CREATE TABLE membership_alarms (
+  team_id TEXT NOT NULL REFERENCES teams(id), id TEXT NOT NULL, principal_id TEXT, issuer TEXT NOT NULL, subject TEXT NOT NULL,
+  reason TEXT NOT NULL, created_at INTEGER NOT NULL, cleared_at INTEGER, PRIMARY KEY(team_id,id)
+) STRICT;
+`;