@volter/teams 0.1.90 → 0.2.0

package/server/migrations/020.mjs

@@ -0,0 +1,9 @@
+// A linked membership source names people by their identity issuer and subject. A subject nobody has signed in with
+// is kept as the team's pending seat until that person's own verified sign-in claims it: a tenant's assertion never
+// writes the server-wide issuer/subject link (principal_identities).
+export default `
+CREATE TABLE source_seats (
+  team_id TEXT NOT NULL REFERENCES teams(id), issuer TEXT NOT NULL, subject TEXT NOT NULL, role TEXT NOT NULL,
+  display_name TEXT, observation TEXT, created_at INTEGER NOT NULL, PRIMARY KEY(team_id,issuer,subject)
+) STRICT;
+`;

package/server/migrations/index.mjs

@@ -13,7 +13,13 @@ import m011 from './011.mjs';
 import m012 from './012.mjs';
 import m013 from './013.mjs';
 import m014 from './014.mjs';
-export const MIGRATIONS = [m001, m002, m003, m004, m005, m006, m007, m008, m009, m010, m011, m012, m013, m014];
+import m015 from './015.mjs';
+import m016 from './016.mjs';
+import m017 from './017.mjs';
+import m018 from './018.mjs';
+import m019 from './019.mjs';
+import m020 from './020.mjs';
+export const MIGRATIONS = [m001, m002, m003, m004, m005, m006, m007, m008, m009, m010, m011, m012, m013, m014, m015, m016, m017, m018, m019, m020];
 /** A message row's `until_revision` while its session's current version still holds it (schema 9). */
 export const OPEN_REVISION = Number.MAX_SAFE_INTEGER;
 /** SQL: message row `m` belongs to the version at revision ?1 (bind the revision twice). */

package/server/permissions.mjs

@@ -0,0 +1,121 @@
+// One role-and-binding shape and one evaluator (mirrored ontology C5, the spec's Permission noun). Roles bundle
+// actions; bindings grant a role or actions to a principal or a group on one resource (the Org itself, a session, a
+// machine, …). Membership is a binding of a role on the Org. Teams grants allow: withholding is not granting.
+import { isAdmin } from './auth.mjs';
+import { exact } from './request-json.mjs';
+
+const fail = (status, code, message) => { throw Object.assign(new Error(message), { status, code }); };
+const stmt = (sql, ...params) => ({ sql, params });
+const guard = (sql, params, message = 'permission authority changed') => ({ sql, params, status: 403, code: 'forbidden', message });
+const NAME = /^[a-z][a-z0-9_.-]{0,63}$/;
+const ACTION = /^(\*|[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)*(\.\*)?)$/;
+const RESOURCE_KINDS = ['org', 'session', 'machine', 'source', 'group', 'app'];
+const allows = (actions, action) => actions.some((a) => a === '*' || a === action || (a.endsWith('.*') && action.startsWith(a.slice(0, -1))));
+const bindingJson = (row) => ({ id: row.id, holder: { kind: row.holder_kind, id: row.holder_id }, role: row.role, actions: row.actions_json ? JSON.parse(row.actions_json) : null,
+  resource: { kind: row.resource_kind, id: row.resource_id }, effect: row.effect, conditions: JSON.parse(row.conditions_json), expires_at: row.expires_at, revoked_at: row.revoked_at, revision: row.revision });
+
+/**
+ * The decision for one actor, action and resource, with its reason and the deciding binding: the actor's Org role
+ * (its membership, a binding on the Org) and every live binding on the resource held by the actor or one of its
+ * groups. The custodian of a session or machine holds it whole. Nothing is cached; every call reads current state.
+ */
+export async function decide(api, team, principal, action, resource, now = api.clock.nowMs()) {
+  const receipt = (allowed, reason, binding = null) => ({ actor: principal, action, resource, at: now, allowed, reason, binding });
+  const member = await api.store.one('SELECT role FROM memberships WHERE team_id=? AND principal_id=? AND active=1', [team, principal]);
+  if (!member) return receipt(false, 'not a member of this Org');
+  const roleActions = async (name) => JSON.parse((await api.store.one('SELECT actions_json FROM roles WHERE team_id=? AND name=?', [team, name]))?.actions_json ?? '[]');
+  if (allows(await roleActions(member.role), action) && (resource.kind === 'org' || ['owner', 'admin'].includes(member.role))) return receipt(true, `Org role ${member.role}`, `membership:${principal}`);
+  if (resource.kind === 'session' || resource.kind === 'machine') {
+    const table = resource.kind === 'session' ? 'sessions' : 'machines';
+    const held = await api.store.one(`SELECT * FROM ${table} WHERE team_id=? AND id=?`, [team, resource.id]);
+    if (held?.custodian_id === principal) return receipt(true, 'custodian', null);
+    if (resource.kind === 'session' && held?.visibility === 'team' && action === 'sessions.read' && allows(await roleActions(member.role), action)) return receipt(true, 'shared with the Org', null);
+  }
+  const groups = (await api.store.query('SELECT group_id FROM group_members WHERE team_id=? AND principal_id=?', [team, principal])).map((row) => row.group_id);
+  const holders = [principal, ...groups];
+  const rows = await api.store.query(`SELECT * FROM permission_bindings WHERE team_id=? AND resource_kind=? AND resource_id=? AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at>?) AND holder_id IN (${holders.map(() => '?').join(',')}) ORDER BY id`,
+    [team, resource.kind, resource.id, now, ...holders]);
+  let granted = null;
+  for (const row of rows) {
+    const actions = row.actions_json ? JSON.parse(row.actions_json) : await roleActions(row.role);
+    if (!allows(actions, action)) continue;
+    if (row.effect === 'deny') return receipt(false, `denied by binding ${row.id}`, row.id);
+    granted ??= row;
+  }
+  return granted ? receipt(true, `granted by binding ${granted.id}`, granted.id) : receipt(false, 'no binding grants it');
+}
+
+export async function permissionRoute({ api, req, res, auth, sub, url, requestId, parseJson, send, result, guardedMutation }) {
+  if (!sub.startsWith('/permissions/')) return false;
+  if (auth.app_grants != null || auth.installation_id) fail(403, 'forbidden', 'permissions are managed by Org members, not apps');
+  const now = api.clock.nowMs();
+  const live = [guard('SELECT 1 FROM credentials WHERE id=? AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at>?)', [auth.credential_id, now]),
+    guard("SELECT 1 FROM memberships WHERE team_id=? AND principal_id=? AND active=1 AND role IN ('owner','admin')", [auth.team_id, auth.principal_id])];
+  if (req.method === 'GET' && sub === '/permissions/roles') {
+    const rows = await api.store.query('SELECT * FROM roles WHERE team_id=? ORDER BY builtin DESC,name', [auth.team_id]);
+    send(res, 200, result(api, auth, { items: rows.map((r) => ({ name: r.name, actions: JSON.parse(r.actions_json), builtin: Boolean(r.builtin) })) }), requestId); return true;
+  }
+  if (req.method === 'POST' && sub === '/permissions/roles') {
+    if (!isAdmin(auth)) fail(403, 'forbidden', 'only an Org admin defines a role');
+    const body = await parseJson(req); exact(body, ['name', 'actions']);
+    if (typeof body.name !== 'string' || !NAME.test(body.name)) fail(400, 'invalid_request', 'a role name is a lowercase word');
+    if (!Array.isArray(body.actions) || !body.actions.length || body.actions.length > 64 || body.actions.some((a) => typeof a !== 'string' || !ACTION.test(a))) fail(400, 'invalid_request', 'actions are 1..64 action patterns');
+    const response = result(api, auth, { name: body.name, actions: body.actions, builtin: false });
+    await guardedMutation(api, res, auth, [...live, guard('SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM roles WHERE team_id=? AND name=? AND builtin=1)', [auth.team_id, body.name], 'a built-in role is not redefined')],
+      [stmt('INSERT INTO roles(team_id,name,actions_json,builtin,created_at) VALUES (?,?,?,0,?) ON CONFLICT(team_id,name) DO UPDATE SET actions_json=excluded.actions_json', auth.team_id, body.name, JSON.stringify(body.actions), now)], { status: 201, body: response, targetId: body.name });
+    send(res, 201, response, requestId); return true;
+  }
+  if (req.method === 'GET' && sub === '/permissions/bindings') {
+    const kind = url.searchParams.get('resource_kind'), id = url.searchParams.get('resource_id');
+    if (!kind || !id) fail(400, 'invalid_request', 'name the resource_kind and resource_id');
+    const decision = await decide(api, auth.team_id, auth.principal_id, `${kind === 'org' ? 'members' : `${kind}s`}.read`, { kind, id }, now);
+    if (!decision.allowed) fail(404, 'not_found', 'resource not found');
+    const rows = await api.store.query('SELECT * FROM permission_bindings WHERE team_id=? AND resource_kind=? AND resource_id=? ORDER BY id', [auth.team_id, kind, id]);
+    send(res, 200, result(api, auth, { items: rows.map(bindingJson) }), requestId); return true;
+  }
+  if (req.method === 'POST' && sub === '/permissions/bindings') {
+    const body = await parseJson(req); exact(body, ['holder', 'role', 'actions', 'resource', 'expires_at', 'conditions']);
+    exact(body.holder ?? {}, ['kind', 'id']); exact(body.resource ?? {}, ['kind', 'id']);
+    if (!['principal', 'group'].includes(body.holder?.kind) || typeof body.holder.id !== 'string') fail(400, 'invalid_request', 'holder is a principal or a group');
+    if (!RESOURCE_KINDS.includes(body.resource?.kind) || typeof body.resource.id !== 'string') fail(400, 'invalid_request', `resource kind is one of ${RESOURCE_KINDS.join(', ')}`);
+    if ((body.role == null) === (body.actions == null)) fail(400, 'invalid_request', 'grant a role or explicit actions');
+    if (body.actions != null && (!Array.isArray(body.actions) || !body.actions.length || body.actions.some((a) => typeof a !== 'string' || !ACTION.test(a)))) fail(400, 'invalid_request', 'actions are action patterns');
+    if (body.expires_at != null && (!Number.isSafeInteger(body.expires_at) || body.expires_at <= now)) fail(400, 'invalid_request', 'expires_at is a future epoch millisecond');
+    if (body.role != null && !await api.store.one('SELECT 1 FROM roles WHERE team_id=? AND name=?', [auth.team_id, body.role])) fail(404, 'not_found', 'role not found');
+    // a machine binding is what the machine admits: capabilities, their targets and an end (the machine channel's grant)
+    if (body.resource.kind === 'machine' && (!body.actions || !Array.isArray(body.conditions?.targets) || !body.conditions.targets.every((t) => typeof t === 'string') || body.expires_at == null))
+      fail(400, 'invalid_request', 'a machine binding names its capabilities as actions, conditions.targets and expires_at');
+    if (body.resource.kind === 'session' && body.role != null && !['reader', 'manager'].includes(body.role)) fail(400, 'invalid_request', 'a session binding grants reader or manager');
+    // Passing permission only narrows: a non-admin grants on a resource only what it may itself manage there.
+    const manage = isAdmin(auth) || (await decide(api, auth.team_id, auth.principal_id, `${body.resource.kind}s.access`, body.resource, now)).allowed;
+    if (!manage) fail(403, 'forbidden', 'you cannot share this resource');
+    const id = api.ids.next('binding');
+    const row = { id, holder_kind: body.holder.kind, holder_id: body.holder.id, role: body.role ?? null, actions_json: body.actions ? JSON.stringify(body.actions) : null, resource_kind: body.resource.kind,
+      resource_id: body.resource.id, effect: 'allow', conditions_json: JSON.stringify(body.conditions ?? {}), expires_at: body.expires_at ?? null, revoked_at: null, revision: 1 };
+    const response = result(api, auth, bindingJson(row));
+    await guardedMutation(api, res, auth, [guard('SELECT 1 FROM credentials WHERE id=? AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at>?)', [auth.credential_id, now]),
+      guard('SELECT 1 FROM memberships WHERE team_id=? AND principal_id=? AND active=1', [auth.team_id, auth.principal_id])],
+      [stmt('INSERT INTO permission_bindings(team_id,id,holder_kind,holder_id,role,actions_json,resource_kind,resource_id,effect,conditions_json,issuer_id,created_at,expires_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)',
+        auth.team_id, id, row.holder_kind, row.holder_id, row.role, row.actions_json, row.resource_kind, row.resource_id, 'allow', row.conditions_json, auth.principal_id, now, row.expires_at),
+       stmt('UPDATE teams SET auth_epoch=auth_epoch+1 WHERE id=?', auth.team_id)], { status: 201, body: response, targetId: id });
+    send(res, 201, response, requestId); return true;
+  }
+  const match = /^\/permissions\/bindings\/([^/]+)$/.exec(sub);
+  if (req.method === 'DELETE' && match) {
+    const row = await api.store.one('SELECT * FROM permission_bindings WHERE team_id=? AND id=?', [auth.team_id, decodeURIComponent(match[1])]);
+    if (!row) fail(404, 'not_found', 'binding not found');
+    if (!isAdmin(auth) && row.issuer_id !== auth.principal_id) fail(403, 'forbidden', 'only its issuer or an Org admin revokes a binding');
+    await guardedMutation(api, res, auth, [guard('SELECT 1 FROM credentials WHERE id=? AND revoked_at IS NULL', [auth.credential_id])],
+      [stmt('UPDATE permission_bindings SET revoked_at=COALESCE(revoked_at,?),revision=revision+1 WHERE team_id=? AND id=?', now, auth.team_id, row.id),
+       stmt('UPDATE teams SET auth_epoch=auth_epoch+1 WHERE id=?', auth.team_id)], { status: 204, body: null, targetId: row.id });
+    send(res, 204, null, requestId); return true;
+  }
+  if (req.method === 'POST' && sub === '/permissions/decide') {
+    const body = await parseJson(req); exact(body, ['principal', 'action', 'resource']);
+    if (body.principal !== auth.principal_id && !isAdmin(auth)) fail(403, 'forbidden', 'only an Org admin asks for another principal');
+    if (typeof body.action !== 'string' || !ACTION.test(body.action)) fail(400, 'invalid_request', 'action is an action name');
+    exact(body.resource ?? {}, ['kind', 'id']);
+    send(res, 200, result(api, auth, await decide(api, auth.team_id, body.principal ?? auth.principal_id, body.action, body.resource, now)), requestId); return true;
+  }
+  fail(404, 'not_found', 'permission operation not found');
+}

package/server/published-events.mjs

@@ -0,0 +1,145 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { appAuthentication } from './apps.mjs';
+import { isAdmin } from './auth.mjs';
+import { exact } from './request-json.mjs';
+import { canonicalJson } from './wire.mjs';
+import { writeSse } from './events.mjs';
+import { APP_EVENTS, PUBLISHABLE_EVENTS, eventReadAction } from './event-catalogue.mjs';
+
+const stmt = (sql, ...params) => ({sql, params});
+const fail = (status,code,message) => {throw Object.assign(new Error(message),{status,code});};
+const text = (value,label) => {if(typeof value!=='string'||!value||value.length>256||/[\x00-\x1f]/.test(value))fail(400,'invalid_request',`${label} must be a nonempty string of at most 256 characters`);return value;};
+const eventOf = row => ({id:row.id,org:row.team_id,at:row.created_at,actor:JSON.parse(row.actor_json),kind:row.kind,resource:{kind:row.resource_kind,id:row.resource_id},data:JSON.parse(row.data_json)});
+const authorityGuards=(auth,now)=>[
+  {sql:'SELECT 1 FROM credentials WHERE id=? AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at>?)',params:[auth.credential_id,now],status:401,code:'authentication_required',message:'event credential revoked'},
+  {sql:'SELECT 1 FROM memberships WHERE team_id=? AND principal_id=? AND active=1',params:[auth.team_id,auth.principal_id],status:401,code:'authentication_required',message:'event membership revoked'},
+];
+
+/** Re-evaluate the installation and each correlated session's current ACL before every delivery or replay. */
+export async function mayReadEvent(api,auth,event) {
+  const action=eventReadAction(event.resource.kind);
+  if(auth.installation_id&&!auth.app_actions?.includes(action))return false;
+  if(auth.app_grants!=null&&event.resource.kind!=='session')return false;
+  if(event.resource.kind==='session'){
+    try {await api.store.authorizedSession({teamId:auth.team_id,principalId:auth.principal_id,credentialId:auth.credential_id,ref:event.resource.id,now:api.clock.nowMs()});}
+    catch(error){if([401,403,404].includes(error.status))return false;throw error;}
+  }
+  if(event.resource.kind==='machine'){
+    const machine=await api.store.one('SELECT 1 FROM machines WHERE team_id=? AND id=? AND revoked_at IS NULL',[auth.team_id,event.resource.id]);
+    if(!machine)return false;
+  }
+  return true;
+}
+
+async function liveAuth(api,auth) {
+  const now=api.clock.nowMs();
+  const row=await api.store.one(`SELECT c.revoked_at,c.expires_at,m.active,m.role,t.auth_epoch FROM credentials c JOIN memberships m ON m.team_id=? AND m.principal_id=c.principal_id JOIN teams t ON t.id=m.team_id WHERE c.id=?`,[auth.team_id,auth.credential_id]);
+  if(!row?.active||row.revoked_at!=null||row.expires_at!=null&&row.expires_at<=now)fail(401,'authentication_required','event subscription revoked');
+  const next=await appAuthentication(api,{...auth,role:row.role,active:row.active,now});
+  if(!next)fail(401,'authentication_required','event installation revoked');
+  return {...next,epoch:row.auth_epoch};
+}
+function cursorCodec(api,auth,query) {
+  if(!api.appRootSecret)fail(503,'unavailable','the Teams root secret is required for event cursors');
+  const mac=value=>createHmac('sha256',api.appRootSecret).update(`Teams events v1\0${value}`).digest('base64url');
+  const audience=canonicalJson({org:auth.team_id,principal:auth.principal_id,credential:auth.credential_id,epoch:auth.epoch,query});
+  return {
+    encode(sequence){const value=Buffer.from(JSON.stringify({sequence,audience,expires:api.clock.nowMs()+7*86400000})).toString('base64url');return `${value}.${mac(value)}`;},
+    decode(token){
+      try{const [value,signature,...rest]=token.split('.'),expected=Buffer.from(mac(value)),actual=Buffer.from(signature??'');
+        if(rest.length||actual.length!==expected.length||!timingSafeEqual(actual,expected))throw new Error();
+        const body=JSON.parse(Buffer.from(value,'base64url').toString());
+        if(body.audience!==audience||body.expires<=api.clock.nowMs()||!Number.isSafeInteger(body.sequence)||body.sequence<0)throw new Error();return body.sequence;
+      }catch{fail(409,'resync_required','event cursor expired, mismatched, or authorization changed');}
+    },
+  };
+}
+
+export async function publishedEventRoute(ctx) {
+  const {api,req,res,auth,sub,url,requestId,parseJson,send,result,guardedMutation}=ctx;
+  if(sub==='/event-sources'&&req.method==='POST'){
+    if(!isAdmin(auth)&&!(auth.installation_id&&auth.app_actions.includes('events.publish')))fail(403,'forbidden','an admin or a consented publisher installation must authorize an event source');
+    const body=await parseJson(req);exact(body,['name']);text(body.name,'name');
+    const old=await api.store.one('SELECT * FROM event_sources WHERE team_id=? AND principal_id=? AND name=?',[auth.team_id,auth.principal_id,body.name]);
+    const id=old?.id??api.ids.next('event_source'),response=result(api,auth,{id,name:body.name});
+    await guardedMutation(api,res,auth,authorityGuards(auth,api.clock.nowMs()),old?[]:[stmt('INSERT INTO event_sources VALUES (?,?,?,?)',auth.team_id,id,auth.principal_id,body.name)],{status:201,body:response,targetId:id});
+    send(res,201,response,requestId);return true;
+  }
+  const publication=/^\/event-sources\/([^/]+)\/events$/.exec(sub);
+  if(publication&&req.method==='POST'){
+    const body=await parseJson(req);exact(body,['id','kind','resource','revision','data','actor']);
+    text(body.id,'id');text(body.resource?.id,'resource.id');exact(body.resource,['kind','id']);
+    if(!PUBLISHABLE_EVENTS.includes(body.kind)||body.resource.kind!==body.kind.split('.')[0]||!body.resource.id.startsWith(`${publication[1]}:`)||!Number.isSafeInteger(body.revision)||body.revision<1||!body.data||typeof body.data!=='object'||Array.isArray(body.data)||Buffer.byteLength(JSON.stringify(body.data))>262144)fail(400,'invalid_request','invalid source event or snapshot');
+    // A source can prove only its own principal. A plain session is evidence, never principal identity.
+    const actor={principal:auth.principal_id,session:null,lineage:auth.act??[]};
+    if(body.actor!=null){exact(body.actor,['session']);if(body.actor.session!=null){text(body.actor.session,'actor.session');if(!body.actor.session.startsWith('session:'))fail(400,'invalid_request','actor.session must name a session');actor.session=body.actor.session;}}
+    const source=await api.store.one('SELECT 1 FROM event_sources WHERE team_id=? AND id=? AND principal_id=?',[auth.team_id,publication[1],auth.principal_id]);
+    if(!source)fail(404,'not_found','event source not found');
+    const old=await api.store.one('SELECT * FROM org_events WHERE id=?',[body.id]);
+    if(old){if(old.team_id!==auth.team_id||old.source_id!==publication[1]||old.kind!==body.kind||old.resource_id!==body.resource.id||old.source_revision!==body.revision||canonicalJson(JSON.parse(old.data_json))!==canonicalJson(body.data)||canonicalJson(JSON.parse(old.actor_json))!==canonicalJson(actor))fail(409,'idempotency_conflict','event id already names another event');send(res,200,result(api,auth,eventOf(old)),requestId);return true;}
+    const now=api.clock.nowMs(),guards=[...authorityGuards(auth,now),{sql:'SELECT 1 FROM event_sources WHERE team_id=? AND id=? AND principal_id=?',params:[auth.team_id,publication[1],auth.principal_id],status:403,code:'forbidden',message:'event source authority changed'},
+      {sql:'SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM event_resources WHERE team_id=? AND source_id=? AND resource_kind=? AND resource_id=? AND source_revision>=?)',params:[auth.team_id,publication[1],body.resource.kind,body.resource.id,body.revision],status:409,code:'revision_mismatch',message:'resource publication is older than its current snapshot'}];
+    const event={id:body.id,org:auth.team_id,at:now,actor,kind:body.kind,resource:body.resource,data:body.data},response=result(api,auth,event);
+    await guardedMutation(api,res,auth,guards,[stmt('INSERT INTO org_events(id,team_id,source_id,source_revision,kind,resource_kind,resource_id,actor_json,data_json,created_at) VALUES (?,?,?,?,?,?,?,?,?,?)',body.id,auth.team_id,publication[1],body.revision,body.kind,body.resource.kind,body.resource.id,JSON.stringify(actor),JSON.stringify(body.data),now)],{status:201,body:response,targetId:body.resource.id});
+    send(res,201,response,requestId);return true;
+  }
+  if(sub==='/events/catalogue'&&req.method==='GET'){send(res,200,result(api,auth,{kinds:APP_EVENTS}),requestId);return true;}
+  if(sub==='/events'&&req.method==='GET'){await eventStream(ctx);return true;}
+  return false;
+}
+
+async function eventStream({api,req,res,auth,url,requestId}){
+  const query={source:url.searchParams.get('source'),kinds:url.searchParams.get('kinds')?.split(',').sort()??null};
+  if([...url.searchParams.keys()].some(key=>!['after','source','kinds'].includes(key))||query.kinds?.some(kind=>!APP_EVENTS.includes(kind)))fail(400,'invalid_request','invalid event subscription');
+  auth=await liveAuth(api,auth);let codec=cursorCodec(api,auth,query);
+  const after=url.searchParams.get('after')??req.headers['last-event-id'];let cursor=after==null?null:codec.decode(after);
+  const count=api.openStreams.get(auth.credential_id)??0;if(count>=10)fail(429,'rate_limited','too many event subscriptions');
+  api.openStreams.set(auth.credential_id,count+1);
+  let closed=false,running=null,dirty=false;
+  const close=()=>{if(closed)return;closed=true;clearInterval(timer);unsubscribe();req.off('close',close);api.events.off('shutdown',close);api.openStreams.set(auth.credential_id,Math.max(0,(api.openStreams.get(auth.credential_id)??1)-1));res.end();};
+  const terminal=(type,reason)=>{if(!closed)writeSse(res,{type,reason,terminal:true});close();};
+  const write=event=>{if(closed)return false;if(res.writableLength+Buffer.byteLength(JSON.stringify(event))>1048576){terminal('resync_required','slow_reader');return false;}writeSse(res,event);return true;};
+  const readable=async event=>{
+    const current=await liveAuth(api,auth);
+    if(current.epoch!==auth.epoch)fail(409,'resync_required','authorization changed during event delivery');
+    auth=current;return mayReadEvent(api,auth,event);
+  };
+  const filterKinds=query.kinds==null?null:JSON.stringify(query.kinds);
+  // A snapshot is each resource's current state, so it takes a resource whose kind the subscription names (a card whose
+  // latest event is a comment is still a card to a subscriber of task changes) as well as one whose latest event it names
+  // (a machine's `resource.changed`).
+  const filterResources=query.kinds==null?null:JSON.stringify([...new Set(query.kinds.map(kind=>kind.split('.')[0]))]);
+  const drain=async()=>{
+    const next=await liveAuth(api,auth);if(next.epoch!==auth.epoch){terminal('resync_required','authorization_changed');return;}auth=next;
+    const bounds=await api.store.one('SELECT COALESCE((SELECT max(sequence) FROM org_events WHERE team_id=?),0) last,COALESCE((SELECT pruned_through FROM event_retention WHERE team_id=?),0) floor',[auth.team_id,auth.team_id]);
+    if(cursor!==null&&(cursor<bounds.floor||cursor>Math.max(bounds.last,bounds.floor))){terminal('resync_required','retention');return;}
+    if(cursor===null){
+      // Subscribe before reading the atomic snapshot. Replay after this watermark repairs all concurrent writes.
+      const [head,resources]=await api.store.snapshot([
+        {kind:'one',sql:'SELECT COALESCE((SELECT max(sequence) FROM org_events WHERE team_id=?),(SELECT pruned_through FROM event_retention WHERE team_id=?),0) last',params:[auth.team_id,auth.team_id]},
+        {kind:'query',sql:'SELECT r.sequence FROM event_resources r JOIN org_events e ON e.sequence=r.sequence WHERE r.team_id=? AND (? IS NULL OR r.source_id=?) AND (? IS NULL OR r.resource_kind IN (SELECT value FROM json_each(?)) OR e.kind IN (SELECT value FROM json_each(?))) ORDER BY r.source_id,r.resource_kind,r.resource_id',params:[auth.team_id,query.source,query.source,filterResources,filterResources,filterKinds]},
+      ]);
+      cursor=head.last;write({type:'snapshot_begin'});
+      for(let at=0;at<resources.length;at+=32){
+        const sequences=resources.slice(at,at+32).map(row=>row.sequence);
+        const rows=await api.store.query('SELECT * FROM org_events WHERE team_id=? AND sequence IN (SELECT value FROM json_each(?)) ORDER BY sequence',[auth.team_id,JSON.stringify(sequences)]);
+        if(rows.length!==sequences.length){terminal('resync_required','snapshot_retention');return;}
+        for(const row of rows){const event=eventOf(row);if(await readable(event))if(!write({type:'snapshot_item',sequence:row.sequence,data:event}))return;}
+      }
+      write({type:'snapshot_end',cursor:codec.encode(cursor)});
+    }
+    for(;;){
+      const rows=await api.store.query('SELECT * FROM org_events WHERE team_id=? AND sequence>? AND (? IS NULL OR source_id=?) AND (? IS NULL OR kind IN (SELECT value FROM json_each(?))) ORDER BY sequence LIMIT 128',[auth.team_id,cursor,query.source,query.source,filterKinds,filterKinds]);
+      if(!rows.length){cursor=Math.max(cursor,bounds.last);write({type:'checkpoint',cursor:codec.encode(cursor)});break;}
+      for(const row of rows){if(closed)return;cursor=row.sequence;const event=eventOf(row);if(await readable(event))write({type:'event',sequence:row.sequence,cursor:codec.encode(cursor),data:event});}
+      // Advance even when the reader was not authorized for a resource; never leak its data.
+      write({type:'checkpoint',cursor:codec.encode(cursor)});if(rows.length<128)break;
+    }
+  };
+  const enqueue=()=>{dirty=true;if(running)return running;running=(async()=>{while(dirty&&!closed){dirty=false;await drain();}})().catch(error=>terminal([401,403].includes(error.status)?'access_revoked':'resync_required',error.code??'unavailable')).finally(()=>{running=null;});return running;};
+  const unsubscribe=api.events.subscribe(`team:${auth.team_id}`,()=>void enqueue());
+  const timer=setInterval(()=>void enqueue().then(()=>{if(!closed)res.write(': heartbeat\n\n');}),15000);timer.unref?.();
+  req.once('close',close);api.events.once('shutdown',close);
+  res.writeHead(200,{'Content-Type':'text/event-stream','Cache-Control':'no-store','X-Request-ID':requestId});await enqueue();
+  if(!closed)write({type:'checkpoint',cursor:codec.encode(cursor)});
+}

package/server/session-snapshot.mjs

@@ -0,0 +1,28 @@
+// SQL fragments receive only source-owned aliases, never request values.
+export const nativeSessionSnapshot=(team,id)=>`json_object('id',${id},'harness',(SELECT harness FROM sessions WHERE team_id=${team} AND id=${id}),
+  'bindings',json(COALESCE((SELECT json_group_array(json(descriptor_json)) FROM bindings WHERE team_id=${team} AND session_id=${id}),'[]')),
+  'agent_identity',json((SELECT json_object('session',a.session_id,'agent',CASE WHEN a.agent_id IS NULL THEN NULL ELSE json_object('id',a.agent_id) END,
+    'starter',json(a.starter_json),'resolved',json(a.profile_json),'resolved_at',CASE WHEN a.profile_json='null' THEN NULL ELSE a.resolved_at END,
+    'main',json(CASE WHEN a.main=1 THEN 'true' ELSE 'false' END),'ended_at',a.ended_at,'end_reason',a.end_reason,'revision',a.revision)
+    FROM agent_sessions a WHERE a.team_id=${team} AND a.session_id=${id})))`;
+
+export function agentSessionEventTriggers(){
+  const now="CAST((julianday('now')-2440587.5)*86400000 AS INTEGER)";
+  const insert=(team,id,kind,at)=>`INSERT INTO org_events(id,team_id,kind,resource_kind,resource_id,created_at,actor_json,data_json)
+    VALUES ('evt_'||lower(hex(randomblob(16))),${team},${kind},'session',${id},${at},'{"principal":null,"session":null,"lineage":[]}',${nativeSessionSnapshot(team,id)});`;
+  const other="EXISTS (SELECT 1 FROM bindings b WHERE b.team_id=NEW.team_id AND b.session_id=NEW.session_id AND b.id!=NEW.id AND json_extract(b.descriptor_json,'$.state')='running')";
+  const kind=`CASE WHEN json_extract(NEW.descriptor_json,'$.state')='running' AND NOT ${other} THEN 'session.started' WHEN json_extract(NEW.descriptor_json,'$.state')='stopped' AND NOT ${other} THEN 'session.ended' ELSE 'session.changed' END`;
+  return `
+    DROP TRIGGER session_event_capture;
+    DROP TRIGGER session_event_binding_added;
+    DROP TRIGGER session_event_binding_changed;
+    DROP TRIGGER session_event_binding_removed;
+    CREATE TRIGGER session_event_capture AFTER INSERT ON session_versions BEGIN
+      ${insert('NEW.team_id','NEW.session_id',"'session.changed'",'NEW.created_at')} END;
+    CREATE TRIGGER session_event_binding_added AFTER INSERT ON bindings BEGIN
+      ${insert('NEW.team_id','NEW.session_id',kind,'NEW.observed_at')} END;
+    CREATE TRIGGER session_event_binding_changed AFTER UPDATE ON bindings WHEN OLD.incarnation_id!=NEW.incarnation_id OR json_extract(OLD.descriptor_json,'$.state') IS NOT json_extract(NEW.descriptor_json,'$.state') OR json_extract(OLD.descriptor_json,'$.native_runtime_id') IS NOT json_extract(NEW.descriptor_json,'$.native_runtime_id') BEGIN
+      ${insert('NEW.team_id','NEW.session_id',kind,'NEW.observed_at')} END;
+    CREATE TRIGGER session_event_binding_removed AFTER DELETE ON bindings BEGIN
+      ${insert('OLD.team_id','OLD.session_id',"'session.changed'",now)} END;`;
+}

package/viewer/session-view.css

@@ -1,4 +1,4 @@
-/* Generated from src/styles/*.css by scripts/build-styles.mjs. Edit those files. */
+/* Generated from src/styles/*.css; orchestration components belong to the full UI bundle. */
 @layer scui.tokens, scui.components;
 @layer scui.tokens {
   /*
@@ -655,107 +655,6 @@
   @media (pointer:coarse) {
     .scui-harness-option,.scui-harness-manage-item { min-height:44px }
   }
-  /* Workflow and orchestration components share the consumer theme contract. */
-  .scui-domain { background:var(--scui-domain-bg, var(--scui-bg)); border:var(--scui-domain-border, 1px solid var(--scui-border)); border-radius:var(--scui-domain-radius, var(--scui-card-radius, var(--scui-radius-xl))); overflow:hidden; container-type:inline-size; contain-intrinsic-inline-size:var(--scui-intrinsic-width, 620px); }
-  .scui-domain-button { padding:calc(7px * var(--scui-scaling)) calc(11px * var(--scui-scaling)); color:inherit; min-height:var(--scui-domain-control-height, calc(36px * var(--scui-scaling))); }
-  .scui-domain-select { padding:calc(7px * var(--scui-scaling)) calc(11px * var(--scui-scaling)); border:var(--scui-button-border, 1px solid var(--scui-border-strong)); border-radius:var(--scui-button-radius, var(--scui-radius-sm)); background:var(--scui-button-bg, var(--scui-bg)); color:inherit; cursor:pointer; min-height:var(--scui-domain-control-height, calc(40px * var(--scui-scaling))); max-width:100%; }
-  .scui-domain-button:disabled { color:var(--scui-muted); opacity:1; }
-  .scui-domain-button:focus-visible,.scui-domain-select:focus-visible,.scui-domain-search-input:focus-visible,.scui-inventory-memory-search-input:focus-visible,.scui-domain-summary:focus-visible,.scui-domain-pre:focus-visible { outline:2px solid var(--scui-accent); outline-offset:3px; }
-  /* Headings, lists and panels take focus when they open, for screen readers; a host may quiet their ring. */
-  .scui-domain-heading:focus-visible,.scui-domain-collection:focus-visible,.scui-domain-detail:focus-visible { outline:var(--scui-focus-target-outline, 2px solid var(--scui-accent)); outline-offset:3px; }
-  .scui-domain-title { font-size:var(--scui-domain-title-size, var(--scui-text-4xl)); line-height:1.25; margin:calc(6px * var(--scui-scaling)) 0; letter-spacing:-.4px; font-family:var(--scui-heading-font, inherit); font-weight:var(--scui-heading-weight, bold); }
-  .scui-domain-heading { font-size:var(--scui-domain-heading-size, var(--scui-text-3xl)); line-height:1.35; margin:calc(12px * var(--scui-scaling)) 0; font-family:var(--scui-heading-font, inherit); font-weight:var(--scui-heading-weight, bold); }
-  .scui-domain-subheading { font-size:var(--scui-text-base); margin:calc(22px * var(--scui-scaling)) 0 calc(8px * var(--scui-scaling)); }
-  .scui-domain-header { padding:var(--scui-domain-header-padding, calc(24px * var(--scui-scaling))); display:var(--scui-domain-header-display, flex); justify-content:space-between; align-items:flex-start; gap:calc(16px * var(--scui-scaling)); }
-  .scui-domain-subtitle,.scui-domain-meta,.scui-domain-footnote { color:var(--scui-muted); font-size:var(--scui-domain-meta-size, var(--scui-text-lg)); }
-  .scui-domain-eyebrow { font-size:var(--scui-text-sm); letter-spacing:var(--scui-eyebrow-tracking, 1.2px); text-transform:var(--scui-eyebrow-transform, none); color:var(--scui-muted); }
-  .scui-domain-badge { display:inline-flex; align-items:center; gap:calc(6px * var(--scui-scaling)); padding:var(--scui-badge-padding, calc(3px * var(--scui-scaling)) calc(8px * var(--scui-scaling))); border:var(--scui-badge-border, 0); border-radius:var(--scui-badge-radius, var(--scui-radius-sm)); background:var(--scui-badge-bg, var(--scui-bg-raised)); font-size:var(--scui-badge-size, var(--scui-text-lg)); font-weight:var(--scui-badge-weight, inherit); text-transform:var(--scui-badge-transform, none); white-space:nowrap; }
-  .scui-domain-badge::before { content:''; display:var(--scui-badge-dot-display, block); width:6px; height:6px; border-radius:50%; background:currentColor; }
-  .scui-domain-badge[data-tone="positive"] { color:var(--scui-positive); }
-  .scui-domain-badge[data-tone="danger"] { color:var(--scui-danger); }
-  .scui-domain-badge[data-tone="warning"] { color:var(--scui-fg); }
-  .scui-domain-badge[data-tone="warning"]::before { background:var(--scui-warning); }
-  .scui-domain-toolbar { padding:var(--scui-domain-toolbar-padding, calc(12px * var(--scui-scaling)) calc(24px * var(--scui-scaling))); border-block:var(--scui-domain-toolbar-border, 1px solid var(--scui-border)); display:var(--scui-domain-toolbar-display, flex); align-items:var(--scui-domain-toolbar-align, flex-end); justify-content:space-between; gap:calc(16px * var(--scui-scaling)); }
-  .scui-domain-search { display:grid; grid-template-columns:var(--scui-domain-search-columns, none); align-items:center; gap:calc(5px * var(--scui-scaling)) calc(10px * var(--scui-scaling)); font-size:var(--scui-domain-search-size, var(--scui-text-lg)); }
-  .scui-domain-search { flex:1; max-width:350px; }
-  .scui-domain-search-input { width:100%; padding:calc(8px * var(--scui-scaling)) calc(10px * var(--scui-scaling)); color:inherit; min-height:var(--scui-domain-control-height, calc(40px * var(--scui-scaling))); }
-  .scui-domain-switch { display:var(--scui-domain-switch-display, flex); gap:calc(4px * var(--scui-scaling)); }
-  .scui-domain-switch-option[aria-pressed="true"] { background:var(--scui-fill); }
-  .scui-domain-workspace { display:grid; min-height:380px; }
-  /* `minmax(0,1fr)` stacks the detail below the collection. */
-  .scui-domain-workspace[data-detail="true"] { grid-template-columns:var(--scui-domain-detail-columns, minmax(0,1fr) minmax(320px,40%)); }
-  .scui-domain-collection { min-width:0; padding:var(--scui-domain-collection-padding, calc(20px * var(--scui-scaling))); overflow:auto; }
-  .scui-domain-board { display:grid; grid-template-columns:repeat(4,minmax(190px,1fr)); gap:var(--scui-board-gap, calc(12px * var(--scui-scaling))); }
-  .scui-domain-lane { background:var(--scui-lane-bg, var(--scui-bg-raised)); padding:var(--scui-lane-padding, calc(10px * var(--scui-scaling))); border:var(--scui-lane-border, 0); border-radius:var(--scui-lane-radius, var(--scui-card-radius, var(--scui-radius-md))); min-height:var(--scui-lane-min-height, 290px); }
-  .scui-domain-lane-title { font-family:var(--scui-lane-title-font, var(--scui-font)); font-weight:var(--scui-lane-title-weight, bold); font-size:var(--scui-lane-title-size, var(--scui-text-lg)); color:var(--scui-lane-title-fg, inherit); text-transform:var(--scui-lane-title-transform, none); letter-spacing:var(--scui-lane-title-tracking, normal); display:flex; justify-content:var(--scui-lane-title-justify, space-between); gap:var(--scui-lane-title-gap, 0); padding:var(--scui-lane-title-padding, 0); margin:0 0 calc(12px * var(--scui-scaling)); }
-  .scui-domain-lane-count { padding:var(--scui-lane-count-padding, 0); border-radius:var(--scui-lane-count-radius, 0); background:var(--scui-lane-count-bg, transparent); color:var(--scui-lane-count-fg, var(--scui-muted)); font-size:var(--scui-lane-count-size, inherit); font-weight:var(--scui-lane-count-weight, 400); }
-  .scui-domain-task { border-radius:var(--scui-task-radius, var(--scui-card-radius, var(--scui-radius-sm))); display:grid; grid-auto-flow:var(--scui-task-flow, row); grid-template-columns:var(--scui-task-columns, none); justify-content:normal; align-items:var(--scui-task-align, normal); gap:var(--scui-task-gap, calc(9px * var(--scui-scaling))); width:100%; text-align:left; border:var(--scui-task-border, 1px solid var(--scui-border)); background:var(--scui-task-bg, var(--scui-button-bg, var(--scui-bg))); box-shadow:var(--scui-task-shadow, none); padding:var(--scui-task-padding, calc(12px * var(--scui-scaling))); margin:0 0 var(--scui-task-spacing, calc(8px * var(--scui-scaling))); }
-  .scui-domain-task-title { order:var(--scui-task-title-order, 0); color:var(--scui-task-title-fg, inherit); font-size:var(--scui-task-title-size, var(--scui-text-base)); font-weight:var(--scui-task-title-weight, 550); }
-  .scui-domain-list { display:grid; }
-  /* A card's id row and status row; a host whose slots carry that information hides them. */
-  .scui-domain-task-meta { display:var(--scui-task-meta-display, block); }
-  .scui-domain-task-status { display:var(--scui-task-status-display, block); }
-  .scui-domain-detail { border-left:var(--scui-domain-detail-border, 1px solid var(--scui-border)); border-top:var(--scui-domain-detail-border-top, 0); background:var(--scui-domain-detail-bg, transparent); padding:calc(20px * var(--scui-scaling)) calc(24px * var(--scui-scaling)); overflow-wrap:anywhere; }
-  .scui-domain-detail-top,.scui-domain-inline { display:flex; align-items:center; justify-content:space-between; gap:calc(10px * var(--scui-scaling)); }
-  .scui-domain-inline { justify-content:flex-start; }
-  .scui-domain-callout { padding:calc(12px * var(--scui-scaling)) calc(14px * var(--scui-scaling)); margin:calc(20px * var(--scui-scaling)) 0; border-left:3px solid var(--scui-warning); background:var(--scui-bg-raised); }
-  .scui-domain-callout-title { margin:0; }
-  /* After the callout: a paragraph callout keeps the paragraph margin. */
-  .scui-domain-text { margin:calc(8px * var(--scui-scaling)) 0; }
-  .scui-domain-related { border-radius:var(--scui-card-radius, var(--scui-radius-sm)); display:grid; justify-content:normal; align-items:normal; text-align:left; width:100%; font-size:var(--scui-text-base); gap:calc(4px * var(--scui-scaling)); }
-  .scui-domain-timeline { padding-left:calc(20px * var(--scui-scaling)); }
-  .scui-domain-timeline-item { padding:0 0 calc(18px * var(--scui-scaling)) calc(4px * var(--scui-scaling)); }
-  .scui-domain-timeline-title { font-size:var(--scui-text-base); }
-  .scui-domain-summary { cursor:pointer; color:var(--scui-accent); padding-block:calc(8px * var(--scui-scaling)); }
-  .scui-domain-footnote { border-top:1px solid var(--scui-border); padding-top:calc(16px * var(--scui-scaling)); }
-  .scui-domain-banner { padding:calc(12px * var(--scui-scaling)) calc(24px * var(--scui-scaling)); background:var(--scui-bg-raised); border-left:3px solid var(--scui-accent); }
-  .scui-domain-schedule { display:flex; gap:calc(36px * var(--scui-scaling)); padding:var(--scui-domain-schedule-padding, 0 calc(24px * var(--scui-scaling)) calc(24px * var(--scui-scaling))); flex-wrap:wrap; }
-  .scui-domain-filter { display:flex; align-items:center; gap:calc(8px * var(--scui-scaling)); font-size:var(--scui-domain-search-size, inherit); }
-  .scui-domain-schedule-item { display:grid; gap:calc(5px * var(--scui-scaling)); }
-  .scui-domain-schedule-value { font-size:var(--scui-text-base); font-weight:500; }
-  .scui-domain-run { width:100%; display:grid; justify-content:normal; align-items:normal; grid-template-columns:minmax(150px,1fr) 105px 90px; gap:calc(12px * var(--scui-scaling)); text-align:left; border:0; border-bottom:var(--scui-run-border, 1px solid var(--scui-border)); border-radius:0; padding:var(--scui-run-padding, calc(16px * var(--scui-scaling)) calc(8px * var(--scui-scaling))); }
-  .scui-domain-run-cell { display:grid; justify-items:start; align-content:center; gap:calc(4px * var(--scui-scaling)); }
-  .scui-domain-run-time { font-size:var(--scui-text-base); font-weight:500; }
-  .scui-domain-facts { display:grid; grid-template-columns:1fr 1fr; gap:calc(8px * var(--scui-scaling)); font-size:var(--scui-text-lg); }
-  .scui-domain-fact-label { color:var(--scui-muted); }
-  .scui-domain-fact-value { margin:0; }
-  @container (max-width:650px) {
-    .scui-domain-header { padding:var(--scui-domain-header-padding, calc(16px * var(--scui-scaling))); }
-    .scui-domain-toolbar { padding:var(--scui-domain-toolbar-padding, calc(16px * var(--scui-scaling))); }
-    .scui-domain-toolbar { flex-wrap:wrap; align-items:center; }
-    .scui-domain-title { font-size:var(--scui-text-3xl); }
-    .scui-domain-workspace[data-detail="true"] { grid-template-columns:1fr; }
-    .scui-domain-workspace[data-detail="true"] .scui-domain-collection { display:none; }
-    .scui-domain-detail { border-left:0; padding:calc(16px * var(--scui-scaling)); }
-    .scui-domain-collection { padding:calc(12px * var(--scui-scaling)); }
-    .scui-domain-run { grid-template-columns:1fr 1fr; }
-    .scui-domain-run-cell:first-child { grid-column:1 / -1; }
-    .scui-domain-schedule { gap:calc(16px * var(--scui-scaling)); padding:var(--scui-domain-schedule-padding, 0 calc(16px * var(--scui-scaling)) calc(20px * var(--scui-scaling))); }
-  }
-  .scui-domain { display:block; width:100%; height:auto; min-width:0; font-size:var(--scui-text-xl); line-height:1.5; overflow-wrap:anywhere; }
-  .scui-domain-pre { overflow:auto; max-width:100%; white-space:pre-wrap; overflow-wrap:anywhere; }
-  .scui-inventory-nav { display:flex; flex-wrap:wrap; gap:var(--scui-inventory-nav-gap, calc(8px * var(--scui-scaling))); padding:var(--scui-inventory-nav-padding, calc(12px * var(--scui-scaling)) calc(24px * var(--scui-scaling))); border-bottom:var(--scui-inventory-nav-border, 0); background:var(--scui-inventory-nav-bg, transparent); }
-  .scui-inventory-actions { display:flex; flex-wrap:wrap; gap:calc(8px * var(--scui-scaling)); padding:calc(12px * var(--scui-scaling)) calc(24px * var(--scui-scaling)); }
-  .scui-inventory-nav-item[aria-current="page"] { background:var(--scui-inventory-nav-active-bg, var(--scui-fill)); font-weight:var(--scui-inventory-nav-active-weight, 600); }
-  .scui-inventory-rows { display:grid; gap:var(--scui-inventory-row-gap, calc(12px * var(--scui-scaling))); }
-  .scui-inventory-row { min-width:0; border:var(--scui-inventory-row-border, 1px solid var(--scui-border)); border-radius:var(--scui-inventory-row-radius, var(--scui-card-radius, var(--scui-radius-md))); padding:var(--scui-inventory-row-padding, calc(16px * var(--scui-scaling))); background:var(--scui-inventory-row-bg, transparent); }
-  .scui-inventory-row-title { font-family:var(--scui-font); font-weight:bold; font-size:var(--scui-inventory-row-title-size, var(--scui-text-2xl)); margin:0; }
-  .scui-inventory-row-action { text-align:left; max-width:100%; white-space:normal; }
-  .scui-source-inspector[data-control-size="large"] .scui-domain-button,.scui-inventory-action { min-height:var(--scui-domain-control-height, calc(44px * var(--scui-scaling))); }
-  .scui-source-inspector[data-control-size="large"] .scui-domain-search-input,.scui-source-inspector[data-control-size="large"] .scui-inventory-memory-search-input { font-size:16px; }
-  .scui-inventory-memory-search { display:flex; flex-wrap:wrap; align-items:end; gap:calc(8px * var(--scui-scaling)); margin-bottom:calc(16px * var(--scui-scaling)); }
-  .scui-inventory-memory-search-label { display:grid; gap:calc(4px * var(--scui-scaling)); max-width:100%; }
-  .scui-inventory-memory-search-input { max-width:100%; padding:calc(8px * var(--scui-scaling)); min-height:calc(40px * var(--scui-scaling)); }
-  .scui-domain-header-copy { min-width:0; }
-  .scui-domain-header { flex-wrap:wrap; }
-  .scui-domain-workspace { align-items:start; }
-  /* After the pressed and current states, which hover still repaints. */
-  .scui-domain-button:hover { background:var(--scui-bg-raised); }
-  .scui-domain-task:hover:not(:disabled) { background:var(--scui-task-hover-bg, var(--scui-bg-raised)); }
-  @media (pointer:coarse) {
-    .scui-domain-button,.scui-source-inspector[data-control-size="large"] .scui-domain-button { min-height:44px; }
-    .scui-domain-search-input,.scui-inventory-memory-search-input,.scui-domain-select { min-height:44px; font-size:16px; }
-  }
   .scui-agent-configuration { color:var(--scui-fg); font:var(--scui-text-base)/1.45 var(--scui-font); padding:var(--scui-panel-padding, calc(20px * var(--scui-scaling))); width:var(--scui-panel-width, auto); max-width:var(--scui-panel-max-width, 720px); margin:var(--scui-panel-margin, 0 auto); }
   .scui-configuration-header { display:flex; align-items:center; justify-content:space-between; gap:calc(12px * var(--scui-scaling)); }
   .scui-configuration-title { font-size:var(--scui-configuration-title-size, var(--scui-text-3xl)); margin:0; font-family:var(--scui-heading-font, inherit); font-weight:var(--scui-heading-weight, bold); }

package/server/identity-orgs.mjs

@@ -1,54 +0,0 @@
-// Joining a team through an identity service's organization (Volter ID ADR-0002): a team may be linked to an
-// organization the identity service keeps for this server, and a person signed in with that service who is a member of
-// it joins the team with no invitation. The identity service's tokens name only the person, so membership is asked
-// through its organizations door with this server's own product credential (a `client_credentials` token for
-// `<issuer>/organizations`, scope `organizations`), which reads only the organizations this product created.
-//
-// Configured by `identityOrganizations: { clientId, clientSecret, teams: { <team id or name>: <organization slug> } }`,
-// from the environment as VOLTER_ORG_CLIENT_ID, VOLTER_ORG_CLIENT_SECRET and VOLTER_TEAM_ORGS (`team=slug,…`).
-
-/** The configuration from the environment, or null when a piece is missing. */
-export function identityOrganizationsFromEnv(env) {
-  const clientId = env.VOLTER_ORG_CLIENT_ID, clientSecret = env.VOLTER_ORG_CLIENT_SECRET, pairs = env.VOLTER_TEAM_ORGS;
-  if (!clientId || !clientSecret || !pairs) return null;
-  const teams = {};
-  for (const pair of String(pairs).split(',')) {
-    const [team, slug] = pair.split('=').map((part) => part?.trim());
-    if (team && slug) teams[team] = slug;
-  }
-  return Object.keys(teams).length ? { clientId, clientSecret, teams } : null;
-}
-
-/** The organization slug a team is linked to, by its id or its name. */
-export function linkedOrganization(api, team) {
-  const teams = api.identityOrganizations?.teams ?? {};
-  return teams[team.id] ?? teams[team.name] ?? null;
-}
-
-async function productToken(api) {
-  const held = api.identityOrganizationToken;
-  if (held && held.expiresAt > api.clock.nowMs() + 60_000) return held.token;
-  const discovery = await (await fetch(`${api.identityIssuer}/.well-known/openid-configuration`)).json();
-  const { clientId, clientSecret } = api.identityOrganizations;
-  const response = await fetch(discovery.token_endpoint, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/x-www-form-urlencoded', Authorization: `Basic ${btoa(`${clientId}:${clientSecret}`)}` },
-    body: new URLSearchParams({ grant_type: 'client_credentials', scope: 'organizations', resource: `${api.identityIssuer}/organizations` }),
-  });
-  if (!response.ok) throw new Error(`the identity service refused this server's product credential (${response.status})`);
-  const value = await response.json();
-  api.identityOrganizationToken = { token: value.access_token, expiresAt: api.clock.nowMs() + (Number(value.expires_in) || 300) * 1000 };
-  return value.access_token;
-}
-
-/** Whether the identity service's subject is a member of the organization `slug` this product keeps there. */
-export async function inOrganization(api, subject, slug) {
-  if (!api.identityOrganizations || !api.identityIssuer) return false;
-  const token = await productToken(api);
-  const response = await fetch(`${api.identityIssuer}/api/people/${encodeURIComponent(subject)}/organizations`, { headers: { Authorization: `Bearer ${token}` } });
-  if (response.status === 404) return false;
-  if (!response.ok) throw new Error(`the identity service did not answer for that person's organizations (${response.status})`);
-  const value = await response.json();
-  const rows = Array.isArray(value) ? value : Array.isArray(value?.organizations) ? value.organizations : [];
-  return rows.some((row) => row?.slug === slug);
-}