pi-roundtable 0.7.19 → 0.9.0

package/src/core/identity/caching-principal-store.ts

@@ -0,0 +1,111 @@
+import type { Tier } from "../speakers.ts";
+import type {
+	IdentityRef,
+	LinkSource,
+	NewPrincipal,
+	PrincipalStore,
+	Pronouns,
+	RoleSource,
+} from "./principal-store.ts";
+
+/** How long a read of the store is reused; a change another process makes is seen after it. */
+export const CACHE_MS = 30_000;
+
+/**
+ * The store with its reads reused for `CACHE_MS`; any write through it drops them all, so this
+ * process sees its own changes at once. Recording a principal as seen drops only theirs.
+ */
+export class CachingPrincipalStore implements PrincipalStore {
+	readonly #store: PrincipalStore;
+	readonly #now: () => number;
+	readonly #reads = new Map<string, { at: number; value: Promise<unknown> }>();
+
+	constructor(store: PrincipalStore, now: () => number) {
+		this.#store = store;
+		this.#now = now;
+	}
+
+	#cached<T>(key: string, read: () => Promise<T>): Promise<T> {
+		const now = this.#now();
+		const hit = this.#reads.get(key);
+		if (hit && now - hit.at < CACHE_MS) return hit.value as Promise<T>;
+		const value = read();
+		this.#reads.set(key, { at: now, value });
+		value.catch(() => this.#reads.delete(key));
+		return value;
+	}
+
+	async #write<T>(write: Promise<T>): Promise<T> {
+		try {
+			return await write;
+		} finally {
+			this.#reads.clear();
+		}
+	}
+
+	get(id: string) {
+		return this.#cached(`p\0${id}`, () => this.#store.get(id));
+	}
+	list() {
+		return this.#store.list();
+	}
+	identity(provider: string, subject: string) {
+		return this.#cached(`i\0${provider}\0${subject}`, () =>
+			this.#store.identity(provider, subject),
+		);
+	}
+	identitiesOf(principalId: string) {
+		return this.#store.identitiesOf(principalId);
+	}
+	rolesOf(principalId: string) {
+		return this.#cached(`r\0${principalId}`, () =>
+			this.#store.rolesOf(principalId),
+		);
+	}
+	holders(role: Tier) {
+		return this.#store.holders(role);
+	}
+	linksFrom(source: LinkSource) {
+		return this.#store.linksFrom(source);
+	}
+	create(input: NewPrincipal) {
+		return this.#write(this.#store.create(input));
+	}
+	update(
+		id: string,
+		change: { displayName?: string; pronouns?: Pronouns | null },
+	) {
+		return this.#write(this.#store.update(id, change));
+	}
+	link(principalId: string, identity: IdentityRef, source: LinkSource) {
+		return this.#write(this.#store.link(principalId, identity, source));
+	}
+	claim(principalId: string, identity: IdentityRef, displayName?: string) {
+		return this.#write(this.#store.claim(principalId, identity, displayName));
+	}
+	admit(identity: IdentityRef, displayName: string, id?: string) {
+		return this.#write(this.#store.admit(identity, displayName, id));
+	}
+	unlink(provider: string, subject: string) {
+		return this.#write(this.#store.unlink(provider, subject));
+	}
+	grant(principalId: string, role: Tier, source: RoleSource) {
+		return this.#write(this.#store.grant(principalId, role, source));
+	}
+	revoke(principalId: string, role: Tier, source?: RoleSource) {
+		return this.#write(this.#store.revoke(principalId, role, source));
+	}
+	disable(id: string) {
+		return this.#write(this.#store.disable(id));
+	}
+	enable(id: string) {
+		return this.#write(this.#store.enable(id));
+	}
+	async touch(id: string, tier: Tier | null, at?: Date) {
+		try {
+			await this.#store.touch(id, tier, at);
+		} finally {
+			this.#reads.delete(`p\0${id}`);
+		}
+	}
+}

package/src/core/identity/config-owner.ts

@@ -0,0 +1,145 @@
+import { ConfigError } from "../domain/errors.ts";
+import type { Logger } from "../log.ts";
+import type { AccessOwner } from "./access-policy.ts";
+import { identityOf } from "./actor-facts.ts";
+import type { DeclaredIdentity } from "./plugin-identities.ts";
+import type {
+	IdentityLink,
+	IdentityRef,
+	PrincipalStore,
+} from "./principal-store.ts";
+
+/** A configured owner, where the configuration lists them, and what the boot knows of the plugins. */
+export interface ConfiguredOwner {
+	owner: AccessOwner;
+	/** The owner's index in `access.owners`. */
+	index: number;
+	/** The owner's identities, parsed, in the configuration's order. */
+	refs: readonly IdentityRef[];
+	/** Each identity the plugins declare, with the plugin and the principal it names. */
+	declaredBy: ReadonlyMap<string, DeclaredIdentity>;
+	/** The primary owner's principal, which a plugin naming none binds to; undefined while syncing the primary owner. */
+	primary: string | undefined;
+	logger: Logger;
+}
+
+/** A configured owner's identity that stops the start, and how to fix it. */
+export interface OwnerConflict {
+	problem: string;
+	fix: string;
+}
+
+/**
+ * Whether a configured owner may list an identity a plugin declares. The principal the plugin binds
+ * it to on this boot, its `principal` or else the primary owner, must be this owner, whatever it
+ * was bound to before: the boot moves it there. A plugin's credential never tells who the owner is,
+ * so an owner nothing else tells conflicts unless they are the primary owner the plugin defaults to
+ * and the credential is not a plugin's link to someone already. `primary` undefined with `first`
+ * false is a primary owner the start makes.
+ */
+export function declaredConflict({
+	index: n,
+	i,
+	identity,
+	id,
+	link,
+	declared: { plugin, principal },
+	primary,
+	first,
+}: {
+	index: number;
+	i: number;
+	identity: string;
+	/** The principal this owner is, as everything but a plugin's credential tells; undefined for one the boot makes. */
+	id: string | undefined;
+	link: IdentityLink | undefined;
+	declared: DeclaredIdentity;
+	primary: string | undefined;
+	first: boolean;
+}): OwnerConflict | undefined {
+	const at = `access.owners[${n}].identities[${i}]: ${identity} is an identity plugin ${plugin} declares`;
+	const remove = `Remove it from access.owners[${n}].identities`;
+	const untold: OwnerConflict = {
+		problem: "a plugin's credential does not tell who this owner is",
+		fix: `${remove}, or give this owner its principal and bind plugin ${plugin} to it`,
+	};
+	if (principal === undefined && first) {
+		// Bound to this owner, the primary owner: whoever they are, unless only that link would tell.
+		if (id !== undefined || link?.source !== "plugin") return undefined;
+		return {
+			...untold,
+			problem: `${at}, bound to principal ${link.principalId}, and ${untold.problem}`,
+		};
+	}
+	const target = principal ?? primary;
+	if (target !== undefined && target === id) return undefined;
+	const bound = `${at}, bound to ${target === undefined ? "the principal the start makes for access.owners[0]" : `principal ${target}`}`;
+	return id === undefined
+		? { ...untold, problem: `${bound}, and ${untold.problem}` }
+		: {
+				problem: `${bound}, not to this owner's ${id}`,
+				fix: `${remove}, or bind plugin ${plugin} to ${id} in its options`,
+			};
+}
+
+/**
+ * The principal a configured owner is: their `principal`, else the principal an identity of theirs
+ * is linked to; undefined for someone the boot makes. A plugin's credential is not the person's own
+ * identity, so a plugin's link never tells who the owner is, and one no plugin declares any more is
+ * unlinked first, as the boot would anyway. An identity linked to another principal stops the
+ * boot, and so does an identity a plugin declares that `declaredConflict` refuses. One a plugin
+ * declares and binds to this owner on this boot, still the plugin's link to someone else, is moved
+ * now, before the owner's identities are linked.
+ */
+export async function configuredOwnerId(
+	store: PrincipalStore,
+	{ owner, index: n, refs, declaredBy, primary, logger }: ConfiguredOwner,
+): Promise<string | undefined> {
+	const links = await Promise.all(
+		refs.map(async (ref) => {
+			const link = await store.identity(ref.provider, ref.subject);
+			if (link?.source !== "plugin" || declaredBy.has(identityOf(link)))
+				return link;
+			// No plugin declares it any more, so this boot unlinks it anyway: before it tells anyone anything.
+			await store.unlink(link.provider, link.subject);
+			logger.info(
+				`${identityOf(link)} is no longer an identity a plugin declares; it was unlinked from principal ${link.principalId}`,
+			);
+			return undefined;
+		}),
+	);
+	let id = owner.principal;
+	links.forEach((link, i) => {
+		if (!link || link.source === "plugin") return;
+		id ??= link.principalId;
+		if (link.principalId !== id)
+			throw new ConfigError(
+				`config access.owners[${n}].identities[${i}]: ${owner.identities[i]} is linked to principal ${link.principalId}, not to this owner's ${id}. Unlink it with roundtable principal unlink ${owner.identities[i]}, or fix the configuration.`,
+			);
+	});
+	for (const [i, ref] of refs.entries()) {
+		const declared = declaredBy.get(identityOf(ref));
+		if (!declared) continue;
+		const link = links[i];
+		const conflict = declaredConflict({
+			index: n,
+			i,
+			identity: owner.identities[i] ?? identityOf(ref),
+			id,
+			link,
+			declared,
+			primary,
+			first: n === 0,
+		});
+		// The CLI refuses to unlink a plugin's identity: the plugin's options move it.
+		if (conflict)
+			throw new ConfigError(`config ${conflict.problem}. ${conflict.fix}.`);
+		if (link?.source !== "plugin" || link.principalId === id) continue;
+		// The plugin binds it to this owner on this boot, and a link refuses an identity linked elsewhere.
+		await store.unlink(link.provider, link.subject);
+		logger.info(
+			`${identityOf(link)} of plugin ${declared.plugin} moved from principal ${link.principalId} to ${id}`,
+		);
+	}
+	return id;
+}

package/src/core/identity/contact.ts

@@ -0,0 +1,27 @@
+import type { ChannelKey } from "../sessions.ts";
+import type { Speaker } from "../speakers.ts";
+import type { ActorFacts } from "./actor-facts.ts";
+
+/**
+ * A person a surface reports, assessed before any claim takes their message: who they would be,
+ * with nothing written yet.
+ */
+export interface Contact {
+	/** The speaker they would be: their principal's, or at a first contact the principal they would claim or be admitted as. */
+	readonly speaker: Speaker;
+	/**
+	 * Records the contact once a claim takes their message: claims their 0.8 principal or admits
+	 * them first, then records them as seen. The speaker they are now, whose principal differs from
+	 * the assessed one only when another process linked them meanwhile; undefined when they are no
+	 * one now.
+	 */
+	take(): Promise<Speaker | undefined>;
+}
+
+/** Assesses the people of messages before a claim takes them, so nobody's message that no claim serves writes anything. Core-internal: the router's. */
+export interface ContactAssessor {
+	assess(
+		facts: ActorFacts,
+		scope?: { conversation?: ChannelKey },
+	): Promise<Contact | undefined>;
+}

package/src/core/identity/identity-plugin.ts

@@ -0,0 +1,56 @@
+import type { RoundtablePlugin } from "../plugin.ts";
+import { IDENTITY } from "../services.ts";
+import type { AccessRules } from "./access-policy.ts";
+import { type BackfillSummary, identityMigrations } from "./identity-schema.ts";
+import { PgIdentityService } from "./identity-service.ts";
+import { identityView } from "./identity-view.ts";
+import { declaredIdentities } from "./plugin-identities.ts";
+import { PgPrincipalStore } from "./principal-store.ts";
+
+/** The name of the identity plugin, as the migration ledger names it. */
+export const IDENTITY_PLUGIN = "identity";
+
+export interface IdentityOptions {
+	/** Who the host serves; the backfill makes the owners with a principal id first, by their names, and caps what a carried-over author of schedules is seen at by the tiers. */
+	rules: AccessRules;
+	/** The host's other plugins, whose declared `identities` setup links; checked when this plugin is made. */
+	plugins?: readonly RoundtablePlugin[];
+}
+
+/** One line for the log: what the boot's backfill made, and from where. */
+export function backfillLine(summary: BackfillSummary): string {
+	const sources = Object.entries(summary.sources)
+		.map(([source, count]) => `${source} ${count}`)
+		.join(", ");
+	return `principal backfill: ${summary.created} created; ids found: ${sources}`;
+}
+
+/**
+ * The principals, their identity links, and their roles: the tables, the backfill that makes a
+ * principal of every person 0.8 stored, and the identity service over them provided as
+ * `IDENTITY`, read-only, its configured owners and the plugins' declared identities synced at
+ * setup. It runs first, so every later plugin may read it.
+ */
+export function identityPlugin(options: IdentityOptions): RoundtablePlugin {
+	const { rules } = options;
+	const identities = declaredIdentities(options.plugins ?? []);
+	let summary: BackfillSummary | undefined;
+	return {
+		name: IDENTITY_PLUGIN,
+		migrations: identityMigrations(rules, (made) => {
+			summary = made;
+		}),
+		provides: [IDENTITY],
+		setup: async ({ database, services, logger }) => {
+			if (summary) logger.info(backfillLine(summary));
+			const identity = new PgIdentityService(
+				await PgPrincipalStore.attach(database()),
+				rules,
+				{ logger, identities },
+			);
+			await identity.syncConfig();
+			services.provide(IDENTITY, identityView(identity));
+			return {};
+		},
+	};
+}

package/src/core/identity/identity-schema.ts

@@ -0,0 +1,282 @@
+import type { SQL } from "bun";
+import type { Migration } from "../db/migrations.ts";
+import { type Tier, tierAtLeast } from "../speakers.ts";
+import type { AccessRules, AccessTier } from "./access-policy.ts";
+import { parseIdentity } from "./actor-facts.ts";
+import {
+	LEGACY_PROVIDER,
+	LEGACY_REMOTE_SPEAKER,
+	SYSTEM_PRINCIPAL,
+} from "./principal-store.ts";
+import {
+	PRINCIPAL_PLUGIN_LINKS,
+	PRINCIPAL_TABLES,
+	PRINCIPALS_CLAIMABLE,
+} from "./principal-tables.ts";
+
+/** Where the backfill finds the ids of people 0.8 stored: the configured owners, then four tables. */
+export type BackfillSource =
+	| "config"
+	| "owner_memory"
+	| "schedules"
+	| "conversations"
+	| "held_actions";
+
+/** The rules the backfill reads: the owners with a principal id, made first by their names, and the tiers that cap what a carried-over author of schedules is seen at. */
+export type BackfillRules = Pick<AccessRules, "owners" | "admins" | "members">;
+
+/** What one backfill made: the principals it created, and how many distinct ids each source held. */
+export interface BackfillSummary {
+	created: number;
+	sources: Record<BackfillSource, number>;
+}
+
+/**
+ * The column each table keeps a person's id in, and the column naming them, where there is one.
+ * `principal` is a column a newer build fills with the principal beside an actor id: a row with
+ * it filled is not 0.8's, so its id makes no principal. Where `principalHold` names the hold the
+ * principal was written with, it counts only while that is the row's (`principalHold = held`),
+ * as 0.8 writes over a row and leaves the principal as it was.
+ */
+const TABLES: readonly {
+	table: Exclude<BackfillSource, "config">;
+	column: string;
+	name?: string;
+	order?: string;
+	principal?: string;
+	principalHold?: { column: string; held: string };
+}[] = [
+	{ table: "owner_memory", column: "speaker_id" },
+	{
+		table: "schedules",
+		column: "created_by_id",
+		name: "created_by_name",
+		order: "created_at DESC",
+	},
+	{ table: "conversations", column: "principal_id" },
+	{
+		table: "held_actions",
+		column: "speaker_id",
+		principal: "principal_id",
+		principalHold: { column: "principal_held_at", held: "held_at" },
+	},
+];
+
+/** Whether the tier's rules could hold the person of a 0.8 speaker id, whose surface and roles are unknown here. */
+function couldHold(tier: AccessTier | undefined, id: string): boolean {
+	if (!tier) return false;
+	const { everyone } = tier;
+	if (everyone === true || (Array.isArray(everyone) && everyone.length > 0))
+		return true;
+	if ((tier.roles?.length ?? 0) > 0) return true;
+	return (tier.identities ?? []).some(
+		(identity) => identity === id || parseIdentity(identity)?.subject === id,
+	);
+}
+
+/** The most the rules could give the person of a 0.8 speaker id: admin, member, or nothing; never owner, which only the owners hold. */
+function ceilingOf(
+	rules: BackfillRules,
+	id: string,
+): Exclude<Tier, "owner"> | undefined {
+	if (couldHold(rules.admins, id)) return "admin";
+	if (couldHold(rules.members, id)) return "member";
+	return undefined;
+}
+
+/** The highest tier each author created a schedule at, where the table records it. */
+async function scheduledTiers(sql: SQL): Promise<Map<string, Tier>> {
+	const tiers = new Map<string, Tier>();
+	if (
+		!(
+			(await hasColumn(sql, "schedules", "created_by_id")) &&
+			(await hasColumn(sql, "schedules", "created_tier"))
+		)
+	)
+		return tiers;
+	const rows = (await sql`
+		SELECT created_by_id AS id, created_tier AS tier FROM schedules
+		WHERE created_by_id IS NOT NULL`) as { id: string; tier: Tier }[];
+	for (const { id, tier } of rows) {
+		const best = tiers.get(id);
+		if (!best || tierAtLeast(tier, best)) tiers.set(id, tier);
+	}
+	return tiers;
+}
+
+async function hasColumn(
+	sql: SQL,
+	table: string,
+	column: string,
+): Promise<boolean> {
+	const rows = await sql`
+		SELECT 1 FROM information_schema.columns
+		WHERE table_schema = current_schema() AND table_name = ${table} AND column_name = ${column}`;
+	return rows.length > 0;
+}
+
+/** The tier a carried-over author of schedules is seen at: the highest they scheduled at, at most what the rules could give them. */
+function seenTier(
+	rules: BackfillRules,
+	id: string,
+	scheduled: ReadonlyMap<string, Tier>,
+): Tier | null {
+	const tier = scheduled.get(id);
+	const ceiling = tier && ceilingOf(rules, id);
+	if (!tier || !ceiling) return null;
+	return tierAtLeast(tier, ceiling) ? ceiling : tier;
+}
+
+/** The ids a table holds, each with the name it last gave them, or none. */
+async function idsIn(
+	sql: SQL,
+	source: (typeof TABLES)[number],
+): Promise<{ id: string; name: string | null }[]> {
+	if (!(await hasColumn(sql, source.table, source.column))) return [];
+	// The identifiers are this module's constants, never input.
+	const name = source.name ?? "NULL::text";
+	const order = source.order ? `, ${source.order}` : "";
+	const hold =
+		source.principalHold &&
+		(await hasColumn(sql, source.table, source.principalHold.column))
+			? ` OR ${source.principalHold.column} IS DISTINCT FROM ${source.principalHold.held}`
+			: "";
+	const legacy =
+		source.principal && (await hasColumn(sql, source.table, source.principal))
+			? ` AND (${source.principal} IS NULL${hold})`
+			: "";
+	return (await sql.unsafe(
+		`SELECT DISTINCT ON (${source.column}) ${source.column} AS id, ${name} AS name
+		FROM ${source.table} WHERE ${source.column} IS NOT NULL AND ${source.column} <> ''${legacy}
+		ORDER BY ${source.column}${order}`,
+	)) as { id: string; name: string | null }[];
+}
+
+/**
+ * Makes a principal of the same id for every person 0.8 stored: the configured owners, and each
+ * id in `owner_memory`, `schedules`, `conversations`, and `held_actions`, skipping a table or a
+ * column the database does not have yet, and a held action that names its principal in
+ * `principal_id` for the hold it holds (`principal_held_at`), whose `speaker_id` is an actor id
+ * this version stored, and any id a surface
+ * knows a linked identity by (its subject, or `<provider>:<subject>`, as `ActorFacts.legacyId`
+ * names it): that person has a principal already, and this version wrote the row, so the boot
+ * after someone is admitted makes no second principal of their actor id. Each but a configured
+ * owner is claimable once, by the person of that id at their first contact
+ * (IdentityService.resolve); a configured owner never is, even once the configuration names
+ * another owner. 0.8's `remote-mcp` speaker, the owner writing over MCP, gets no principal: it is
+ * linked as `legacy:remote-mcp` to the primary owner's, so what it created stays the owner's. One that created
+ * schedules, other than a configured owner, is recorded as seen now at the highest tier it
+ * scheduled at, capped at the most the rules could give it, so its schedules keep running until
+ * `backgroundStaleDays` pass unseen. It only inserts, so it changes no row, and a second run
+ * makes nothing; an id an older build wrote since gets its principal at the next run. The owners
+ * are named as configured, a schedule's author as the schedule names them, anyone else by their
+ * id. `dryRun` counts and writes nothing. The system principal is never made.
+ */
+export async function backfillPrincipals(
+	sql: SQL,
+	rules: BackfillRules,
+	options: { dryRun?: boolean } = {},
+): Promise<BackfillSummary> {
+	const owners = rules.owners.flatMap((owner) =>
+		owner.principal === undefined
+			? []
+			: [{ id: owner.principal, name: owner.name }],
+	);
+	const names = new Map<string, string | undefined>();
+	const sources = {
+		config: 0,
+		owner_memory: 0,
+		schedules: 0,
+		conversations: 0,
+		held_actions: 0,
+	} satisfies Record<BackfillSource, number>;
+	// 0.8's remote-mcp speaker was the owner over MCP: it stands for the primary owner.
+	const primary = owners[0]?.id;
+	let remote = false;
+	const add = (source: BackfillSource, id: string, name: string | null) => {
+		if (id === SYSTEM_PRINCIPAL) return;
+		sources[source]++;
+		if (primary !== undefined && id === LEGACY_REMOTE_SPEAKER) {
+			remote = true;
+			return;
+		}
+		if (!names.get(id)) names.set(id, name?.trim() || undefined);
+	};
+	for (const owner of owners) add("config", owner.id, owner.name);
+	for (const source of TABLES)
+		for (const row of await idsIn(sql, source))
+			add(source.table, row.id, row.name);
+
+	const [table] = await sql`SELECT to_regclass('principals') AS made`;
+	const existing = new Set<string>(
+		table?.made
+			? (await sql`SELECT id FROM principals`).map(
+					(row: { id: string }) => row.id,
+				)
+			: [],
+	);
+	// The id a surface knows a linked person by is no 0.8 speaker's: this version wrote it.
+	const linked = new Set<string>(
+		table?.made
+			? (
+					(await sql`SELECT provider, subject FROM principal_identities`) as {
+						provider: string;
+						subject: string;
+					}[]
+				).flatMap((row) => [row.subject, `${row.provider}:${row.subject}`])
+			: [],
+	);
+	const missing = [...names].filter(
+		([id]) => !existing.has(id) && !linked.has(id),
+	);
+	if (options.dryRun) return { created: missing.length, sources };
+	const scheduled = await scheduledTiers(sql);
+	const configured = new Set(owners.map((owner) => owner.id));
+	const upgraded = new Date();
+	let created = 0;
+	for (const [id, displayName] of missing) {
+		const owner = configured.has(id);
+		const seen = owner ? null : seenTier(rules, id, scheduled);
+		const rows = await sql`
+			INSERT INTO principals (id, display_name, claimable, last_tier, last_seen_at)
+			VALUES (${id}, ${displayName ?? id}, ${!owner}, ${seen}, ${seen ? upgraded : null})
+			ON CONFLICT (id) DO NOTHING
+			RETURNING id`;
+		created += rows.length;
+	}
+	if (remote && primary !== undefined)
+		await sql`
+			INSERT INTO principal_identities (provider, subject, principal_id, source)
+			VALUES (${LEGACY_PROVIDER}, ${LEGACY_REMOTE_SPEAKER}, ${primary}, 'legacy')
+			ON CONFLICT (provider, subject) DO NOTHING`;
+	// An owner is one by the configuration, never by a claim, even after it names someone else.
+	if (configured.size > 0)
+		await sql`
+			UPDATE principals SET claimable = false
+			WHERE claimable AND id IN ${sql([...configured])}`;
+	return { created, sources };
+}
+
+/**
+ * The identity plugin's migrations: its tables once, the claimable column and the plugins' link
+ * source once each (apart, so a database an earlier build made the tables on gets them too), then
+ * the backfill at every boot, which hands its summary to `report`.
+ */
+export function identityMigrations(
+	rules: BackfillRules,
+	report?: (summary: BackfillSummary) => void,
+): Migration[] {
+	return [
+		{ name: "principals", up: PRINCIPAL_TABLES },
+		{ name: "principals-claimable", up: PRINCIPALS_CLAIMABLE },
+		{ name: "principals-plugin-links", up: PRINCIPAL_PLUGIN_LINKS },
+		{
+			name: "backfill",
+			runs: "every-boot",
+			up: async (sql) => {
+				const summary = await backfillPrincipals(sql, rules);
+				report?.(summary);
+			},
+		},
+	];
+}