slotlock 0.9.0 → 0.10.0

package/ddl.js

@@ -10,6 +10,9 @@
 // transaction: under autocommit the pin ends with its own statement.
 import { SLOTLOCK_MAX_GROUPS_PER_RESOURCE, SLOTLOCK_MAX_LOCATION_DEPTH, SLOTLOCK_MAX_LOCATIONS, SLOTLOCK_MAX_RESOURCE_GROUPS, SLOTLOCK_MAX_KEY_SCOPE_REFS, SLOTLOCK_MAX_COMPOSITE_PARTS, SLOTLOCK_RECONCILE_TOLERANCE_PERCENT, SLOTLOCK_MAX_POOL_SETTINGS, SLOTLOCK_POOL_ORDERS, SLOTLOCK_RESOURCE_KINDS, SLOTLOCK_RESOURCE_PROFILE_LIMITS, } from './resource-profile.js';
 import { SLOTLOCK_CHANGE_ORIGINS, SLOTLOCK_WEBHOOK_FILTER_REFS, SLOTLOCK_WEBHOOK_FILTER_RESOURCES, legacyCoverageSourceDigestSql, } from './event-feed.js';
+import { SLOTLOCK_IDENTITY_DDL, SLOTLOCK_IDENTITY_FUNCTIONS, SLOTLOCK_IDENTITY_TABLES, SLOTLOCK_INVITE_DOMAIN_REFUSED, } from './ddl-identity.js';
+import { SLOTLOCK_SSO_DDL, SLOTLOCK_SSO_FUNCTIONS, SLOTLOCK_SSO_TABLES } from './ddl-sso.js';
+import { SLOTLOCK_SCIM_DDL, SLOTLOCK_SCIM_FUNCTIONS, SLOTLOCK_SCIM_TABLES } from './ddl-scim.js';
 import { SLOTLOCK_MAX_AVAILABILITY_RULES } from './weekly-hours.js';
 const CALLER_SEARCH_PATH_SETTING = 'slotlock.caller_search_path';
 const DEPLOYMENT_SEARCH_PATH_PIN = `SELECT pg_catalog.set_config('${CALLER_SEARCH_PATH_SETTING}', pg_catalog.current_setting('search_path'), true);
@@ -69,9 +72,10 @@ export const SLOTLOCK_SCHEMA_CONTROL_REFUSAL = 'Slotlock will not deploy into sc
  * The schema version this release creates, recorded in `slotlock.schema_version`. Up to 0.2
  * recorded nothing (0.1 was 1, 0.2 was 2); 0.3 to 0.5 recorded 3. 0.6 is 4, so a 0.5 release
  * refuses it rather than restoring the trigger that names a coverage source by its guessable
- * digest.
+ * digest. 0.10 is 5, so a 0.9 release refuses it rather than putting back an erase_tenant that
+ * leaves team workspaces, their members and invitations behind.
  */
-export const SLOTLOCK_SCHEMA_VERSION = 4;
+export const SLOTLOCK_SCHEMA_VERSION = 5;
 /** The start of the message with which the deployment DDL refuses a schema a newer release migrated. */
 export const SLOTLOCK_SCHEMA_NEWER_REFUSAL = 'Slotlock will not migrate a schema a newer release migrated';
 /** The oldest PostgreSQL the DDL runs on (`server_version_num`): it uses pg_input_is_valid. */
@@ -218,7 +222,21 @@ export const SLOTLOCK_API_KEY_FUNCTIONS = Object.freeze([
  * The table behind the dashboard's shared records (dashboard.ts). No role but its owner holds a
  * right on it; it is reached only through SLOTLOCK_DASHBOARD_FUNCTIONS.
  */
-export const SLOTLOCK_DASHBOARD_TABLES = Object.freeze(['dashboard_tokens', 'dashboard_organizations']);
+export const SLOTLOCK_DASHBOARD_TABLES = Object.freeze([
+    'dashboard_tokens',
+    'dashboard_organizations',
+    'dashboard_people',
+    'workspace_memberships',
+    'workspaces',
+    'workspace_invitations',
+    'dashboard_sessions',
+    // Verified domains and requests to join (ddl-identity.ts).
+    ...SLOTLOCK_IDENTITY_TABLES,
+    // Single sign-on (ddl-sso.ts).
+    ...SLOTLOCK_SSO_TABLES,
+    // SCIM provisioning (ddl-scim.ts).
+    ...SLOTLOCK_SCIM_TABLES,
+]);
 /** The SECURITY DEFINER functions through which the serving role reaches the dashboard's records. */
 export const SLOTLOCK_DASHBOARD_FUNCTIONS = Object.freeze([
     'slotlock.use_dashboard_token(text, bytea, timestamptz, bytea)',
@@ -226,8 +244,68 @@ export const SLOTLOCK_DASHBOARD_FUNCTIONS = Object.freeze([
     'slotlock.enabled_organizations(text)',
     'slotlock.enable_organization(text, text, text)',
     'slotlock.disable_organization(text, text)',
+    'slotlock.dashboard_sign_in(text, text)',
+    'slotlock.dashboard_standing(text, text, bytea)',
+    'slotlock.dashboard_sign_out_everywhere(text)',
+    'slotlock.prune_audit_events(text)',
+    'slotlock.dashboard_display(text, text)',
+    'slotlock.create_team(text, text, text, integer)',
+    'slotlock.workspace_info(text)',
+    'slotlock.person_workspaces(text)',
+    'slotlock.workspace_members(text)',
+    'slotlock.workspace_invitations_list(text)',
+    'slotlock.invite_member(text, text, text, text, text, text, bytea, integer, integer, integer)',
+    'slotlock.invitation_preview(bytea)',
+    'slotlock.accept_invitation(bytea, uuid, text, text[], integer)',
+    'slotlock.revoke_invitation(text, text, uuid)',
+    'slotlock.resend_invitation(text, text, uuid, bytea, integer, integer, integer)',
+    'slotlock.change_member_role(text, text, text, text)',
+    'slotlock.remove_member(text, text, text)',
+    'slotlock.pending_invitations_for(text, text[])',
+    'slotlock.workspace_active(text)',
+    'slotlock.prune_workspace_invitations()',
+    'slotlock.dashboard_session_started(text, bytea, timestamptz, text, text)',
+    'slotlock.dashboard_session_seen(text, bytea)',
+    'slotlock.dashboard_sessions_of(text)',
+    'slotlock.dashboard_session_end(text, bytea)',
+    'slotlock.prune_dashboard_sessions()',
+    'slotlock.schedule_team_deletion(text, text, text)',
+    'slotlock.cancel_team_deletion(text, text)',
+    'slotlock.erase_deleted_teams()',
+    'slotlock.workspace_delete_after(text)',
+    'slotlock.member_scope(text, text)',
+    'slotlock.set_member_scope(text, text, text, jsonb)',
+    'slotlock.member_scopes(text)',
+    ...SLOTLOCK_IDENTITY_FUNCTIONS,
+    ...SLOTLOCK_SSO_FUNCTIONS,
+    ...SLOTLOCK_SCIM_FUNCTIONS,
 ]);
+/**
+ * A workspace's roles (workspace-roles.ts), as workspace_memberships keeps them; and how long the
+ * audit log keeps an event.
+ */
+export const SLOTLOCK_WORKSPACE_ROLE_VALUES = Object.freeze(['owner', 'admin', 'developer', 'member', 'viewer', 'billing']);
+export const SLOTLOCK_AUDIT_RETENTION_DAYS = 180;
+/**
+ * Days the change history (slotlock.outbox: the feed, and each booking's history) keeps a change on
+ * each hosted plan (RFC 0004 D2). A tenant with no plan keeps the store's `retentionDays` (default
+ * 30); one with a plan keeps its plan's days, or the store's if longer. A cancelled plan keeps Free's.
+ * The workspace audit log keeps SLOTLOCK_AUDIT_RETENTION_DAYS, or the plan's days if longer.
+ */
+export const SLOTLOCK_CHANGE_RETENTION_BY_PLAN = Object.freeze({ free: 30, developer: 90, team: 400 });
+/** The plan's change retention in days for the tenant `tenant` (an SQL expression), null without a plan. */
+const planChangeRetentionDaysSql = (tenant) => `(SELECT CASE WHEN given.status = 'canceled' THEN ${SLOTLOCK_CHANGE_RETENTION_BY_PLAN.free}
+                ELSE CASE given.plan ${Object.entries(SLOTLOCK_CHANGE_RETENTION_BY_PLAN)
+    .map(([plan, days]) => `WHEN '${plan}' THEN ${days}`)
+    .join(' ')} END END
+      FROM slotlock.tenant_plan(${tenant}) given LIMIT 1)`;
 /** Live form records one person may leave in the dashboard's records (12 hours of forms). */
+/**
+ * The invitations one address is sent in a day, from every team together, where invitations are
+ * limited (a deployment with plans): with sign-up open, many accounts each within their own daily
+ * limit could otherwise fill one inbox.
+ */
+export const SLOTLOCK_INVITATIONS_PER_ADDRESS = 5;
 export const SLOTLOCK_DASHBOARD_FORM_LIMIT = 1_000;
 /** The table that records which release migrated the schema (SLOTLOCK_SCHEMA_VERSION). */
 export const SLOTLOCK_SCHEMA_TABLES = Object.freeze(['schema_version']);
@@ -277,6 +355,8 @@ export const SLOTLOCK_TENANT_ADMIN_FUNCTIONS = Object.freeze([
     'slotlock.note_usage_threshold(text, date, text, integer, bigint, bigint)',
     'slotlock.tenant_plan_quotas(text)',
     'slotlock.reset_test_tenant(text)',
+    'slotlock.prune_changes(text, integer, integer)',
+    'slotlock.erase_subject_changes(text, text, text, text)',
 ]);
 /** The functions usage metering runs (SLOTLOCK_USAGE=on): serve checks it may, before it starts. */
 export const SLOTLOCK_USAGE_FUNCTIONS = Object.freeze([
@@ -365,6 +445,13 @@ export const SLOTLOCK_DEFINER_FUNCTIONS = Object.freeze([
     ...SLOTLOCK_SCHEMA_FUNCTIONS,
     ...SLOTLOCK_TENANT_ADMIN_FUNCTIONS,
 ]);
+/**
+ * Tenant tables the serving role may only add to and read (no UPDATE or DELETE): the audit log,
+ * whose rows go only through slotlock.prune_audit_events and erasure, and the change history,
+ * whose rows go only through slotlock.prune_changes and erasure, and whose one edit is taking a
+ * person out of it (slotlock.erase_subject_changes).
+ */
+export const SLOTLOCK_APPEND_ONLY_TABLES = Object.freeze(['outbox', 'audit_events']);
 /** Tables no role but their owner reads or writes, reached only through SLOTLOCK_DEFINER_FUNCTIONS. */
 export const SLOTLOCK_DEFINER_TABLES = Object.freeze([
     ...SLOTLOCK_API_KEY_TABLES,
@@ -1045,59 +1132,1410 @@ CREATE TABLE IF NOT EXISTS slotlock.dashboard_organizations (
 ALTER TABLE slotlock.dashboard_organizations ENABLE ROW LEVEL SECURITY;
 REVOKE ALL ON slotlock.dashboard_organizations FROM PUBLIC;
 
--- Of these organization ids (comma-separated), the ones turned on.
-CREATE OR REPLACE FUNCTION slotlock.enabled_organizations(requested_ids text)
-RETURNS SETOF text
-LANGUAGE sql
-STABLE
+-- Of these organization ids (comma-separated), the ones turned on.
+CREATE OR REPLACE FUNCTION slotlock.enabled_organizations(requested_ids text)
+RETURNS SETOF text
+LANGUAGE sql
+STABLE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_enabled_organizations$
+  SELECT org.org_id FROM slotlock.dashboard_organizations org
+   WHERE org.enabled
+     AND org.org_id = ANY (pg_catalog.string_to_array(requested_ids, ','));
+$slotlock_enabled_organizations$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[2]} FROM PUBLIC;
+
+-- Turn Slotlock on for an organization; true when it was not on. Who may (an owner of it, read from
+-- GitHub at sign-in) is the dashboard's to check.
+CREATE OR REPLACE FUNCTION slotlock.enable_organization(requested_org text, requested_login text, requested_by text)
+RETURNS boolean
+LANGUAGE plpgsql
+VOLATILE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_enable_organization$
+DECLARE
+  was boolean;
+BEGIN
+  SELECT org.enabled INTO was FROM slotlock.dashboard_organizations org
+   WHERE org.org_id = requested_org FOR UPDATE;
+  INSERT INTO slotlock.dashboard_organizations AS org (org_id, login, enabled, changed_by)
+  VALUES (requested_org, requested_login, true, requested_by)
+  ON CONFLICT (org_id) DO UPDATE
+    SET login = EXCLUDED.login, enabled = true,
+        changed_by = CASE WHEN org.enabled THEN org.changed_by ELSE EXCLUDED.changed_by END,
+        changed_at = CASE WHEN org.enabled THEN org.changed_at ELSE statement_timestamp() END;
+  RETURN was IS NOT TRUE;
+END
+$slotlock_enable_organization$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[3]} FROM PUBLIC;
+
+-- Turn it off; true when it was on.
+CREATE OR REPLACE FUNCTION slotlock.disable_organization(requested_org text, requested_by text)
+RETURNS boolean
+LANGUAGE sql
+VOLATILE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_disable_organization$
+  UPDATE slotlock.dashboard_organizations org
+     SET enabled = false, changed_by = requested_by, changed_at = statement_timestamp()
+   WHERE org.org_id = requested_org AND org.enabled
+  RETURNING true;
+$slotlock_disable_organization$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[4]} FROM PUBLIC;
+
+-- The people who sign in to the dashboard, by their identity (github:<id> or google:<subject>,
+-- never an email): when they last signed in, and the epoch their sessions carry. The epoch is
+-- drawn at random: "Sign out everywhere" draws another, and a session sealed under any other is
+-- refused (ASVS 5.0 7.4.1's per-user revocation). A person without a row (erased) has no epoch,
+-- so none of their sessions passes, and a row made again draws afresh. Owner-only; reached
+-- through the functions below.
+CREATE TABLE IF NOT EXISTS slotlock.dashboard_people (
+  person_ref text PRIMARY KEY,
+  session_epoch integer NOT NULL DEFAULT (1 + floor(random() * 2147483646))::integer,
+  last_sign_in_at timestamptz NOT NULL DEFAULT statement_timestamp(),
+  created_at timestamptz NOT NULL DEFAULT statement_timestamp(),
+  CONSTRAINT slotlock_dashboard_people_valid CHECK (
+    person_ref ~ '^(github:[1-9][0-9]{0,19}|google:[A-Za-z0-9._-]{1,255}|sso:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$'
+    AND session_epoch > 0
+  )
+);
+ALTER TABLE slotlock.dashboard_people ENABLE ROW LEVEL SECURITY;
+REVOKE ALL ON slotlock.dashboard_people FROM PUBLIC;
+
+-- Who belongs to a shared workspace, and as what (workspace-roles.ts). A person's own workspace
+-- (their github:<id> or google:<subject> tenant) has no row: they are its Owner. The live tenant
+-- holds the rows; its test environment (~test) has the same members. Inactive rows are kept so
+-- someone added back gets their role again. Owner-only: the serving role reads and writes roles only
+-- through the functions below, which check what they are given; it cannot write the table itself.
+-- A change made in Slotlock (a role given, a member removed) sets source to 'created' or
+-- 'invitation', and sign-in's mirroring of GitHub never touches such a row again.
+CREATE TABLE IF NOT EXISTS slotlock.workspace_memberships (
+  tenant_ref text NOT NULL,
+  person_ref text NOT NULL,
+  role text NOT NULL,
+  status text NOT NULL DEFAULT 'active',
+  source text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT statement_timestamp(),
+  updated_at timestamptz NOT NULL DEFAULT statement_timestamp(),
+  deactivated_at timestamptz,
+  CONSTRAINT slotlock_workspace_memberships_pkey PRIMARY KEY (tenant_ref, person_ref),
+  CONSTRAINT slotlock_workspace_memberships_valid CHECK (
+    tenant_ref ~ '^(github-org:[1-9][0-9]{0,19}|team:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$'
+    AND person_ref ~ '^(github:[1-9][0-9]{0,19}|google:[A-Za-z0-9._-]{1,255}|sso:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$'
+    AND role IN ('owner', 'admin', 'developer', 'member', 'viewer', 'billing')
+    AND status IN ('active', 'inactive')
+    AND source IN ('github_org', 'invitation', 'created', 'domain', 'sso', 'scim')
+    AND (status = 'active') = (deactivated_at IS NULL)
+  )
+);
+CREATE INDEX IF NOT EXISTS slotlock_workspace_memberships_person_idx
+  ON slotlock.workspace_memberships (person_ref) WHERE status = 'active';
+ALTER TABLE slotlock.workspace_memberships ENABLE ROW LEVEL SECURITY;
+REVOKE ALL ON slotlock.workspace_memberships FROM PUBLIC;
+
+-- A sign-in: the person is recorded (their epoch returned, to seal into the session) and, signing
+-- in with GitHub, the organizations GitHub lists them in, as JSON [{"id":"123","role":"admin"}],
+-- become their memberships there: GitHub's owners Owner, its members Developer. An organization
+-- GitHub no longer lists ends the membership it gave. A role given in Slotlock (source other than
+-- github_org) is never changed here.
+CREATE OR REPLACE FUNCTION slotlock.dashboard_sign_in(requested_person text, requested_github_orgs text)
+RETURNS integer
+LANGUAGE plpgsql
+VOLATILE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_dashboard_sign_in$
+DECLARE
+  listed jsonb;
+  epoch integer;
+BEGIN
+  IF requested_person IS NULL
+     OR requested_person !~ '^(github:[1-9][0-9]{0,19}|google:[A-Za-z0-9._-]{1,255}|sso:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$' THEN
+    RAISE EXCEPTION 'Slotlock dashboard: invalid person' USING ERRCODE = '22023';
+  END IF;
+  -- A person a team's provider made exists only while an identity of theirs does: one erased while
+  -- their sign-in was under way (ddl-sso.ts) is not made again. The identity is locked, so an
+  -- erasure waits for this, or this sees it.
+  IF requested_person ~ '^sso:' THEN
+    PERFORM 1 FROM slotlock.sso_identities identity WHERE identity.person_ref = requested_person FOR SHARE;
+    IF NOT FOUND THEN
+      RAISE EXCEPTION 'Slotlock dashboard: that person is no longer here' USING ERRCODE = 'P0002';
+    END IF;
+  END IF;
+  INSERT INTO slotlock.dashboard_people AS person (person_ref) VALUES (requested_person)
+  ON CONFLICT (person_ref) DO UPDATE SET last_sign_in_at = statement_timestamp()
+  RETURNING person.session_epoch INTO epoch;
+  IF requested_github_orgs IS NULL THEN
+    RETURN epoch;
+  END IF;
+  IF requested_person !~ '^github:' OR octet_length(requested_github_orgs) > 8192 THEN
+    RAISE EXCEPTION 'Slotlock dashboard: invalid organizations' USING ERRCODE = '22023';
+  END IF;
+  listed := requested_github_orgs::jsonb;
+  IF jsonb_typeof(listed) <> 'array' OR jsonb_array_length(listed) > 100 OR EXISTS (
+    SELECT 1 FROM jsonb_array_elements(listed) org
+     WHERE jsonb_typeof(org) <> 'object'
+        OR coalesce(org ->> 'id', '') !~ '^[1-9][0-9]{0,19}$'
+        OR coalesce(org ->> 'role', '') NOT IN ('admin', 'member')
+  ) THEN
+    RAISE EXCEPTION 'Slotlock dashboard: invalid organizations' USING ERRCODE = '22023';
+  END IF;
+  INSERT INTO slotlock.workspace_memberships AS member (tenant_ref, person_ref, role, status, source)
+  SELECT DISTINCT ON (org ->> 'id') 'github-org:' || (org ->> 'id'), requested_person,
+         CASE org ->> 'role' WHEN 'admin' THEN 'owner' ELSE 'developer' END, 'active', 'github_org'
+    FROM jsonb_array_elements(listed) org
+   ORDER BY org ->> 'id', org ->> 'role'
+  ON CONFLICT (tenant_ref, person_ref) DO UPDATE
+    SET role = EXCLUDED.role, status = 'active', deactivated_at = NULL,
+        updated_at = statement_timestamp()
+    WHERE member.source = 'github_org';
+  UPDATE slotlock.workspace_memberships member
+     SET status = 'inactive', deactivated_at = statement_timestamp(), updated_at = statement_timestamp()
+   WHERE member.person_ref = requested_person
+     AND member.source = 'github_org'
+     AND member.status = 'active'
+     AND NOT EXISTS (
+       SELECT 1 FROM jsonb_array_elements(listed) org
+        WHERE member.tenant_ref = 'github-org:' || (org ->> 'id'));
+  RETURN epoch;
+END
+$slotlock_dashboard_sign_in$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[5]} FROM PUBLIC;
+
+-- A person's standing in a workspace now is slotlock.dashboard_standing(tenant, person, session),
+-- in ddl-sso.ts: it reads the single sign-on tables, so it is made after them. The form before
+-- single sign-on, without the session, is dropped, so every caller passes the session.
+DROP FUNCTION IF EXISTS slotlock.dashboard_standing(text, text);
+
+-- Sign a person out everywhere: a new epoch is drawn (never the old one), and every session sealed
+-- under the old is refused from now on. Returns the new epoch.
+CREATE OR REPLACE FUNCTION slotlock.dashboard_sign_out_everywhere(requested_person text)
+RETURNS integer
+LANGUAGE plpgsql
+VOLATILE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_dashboard_sign_out_everywhere$
+DECLARE
+  epoch integer;
+BEGIN
+  IF requested_person IS NULL
+     OR requested_person !~ '^(github:[1-9][0-9]{0,19}|google:[A-Za-z0-9._-]{1,255}|sso:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$' THEN
+    RAISE EXCEPTION 'Slotlock dashboard: invalid person' USING ERRCODE = '22023';
+  END IF;
+  INSERT INTO slotlock.dashboard_people AS person (person_ref) VALUES (requested_person)
+  ON CONFLICT (person_ref) DO UPDATE
+    SET session_epoch = (
+      SELECT CASE WHEN drawn.epoch = person.session_epoch THEN drawn.epoch % 2147483646 + 1 ELSE drawn.epoch END
+        FROM (SELECT (1 + floor(random() * 2147483646))::integer AS epoch) drawn)
+  RETURNING person.session_epoch INTO epoch;
+  RETURN epoch;
+END
+$slotlock_dashboard_sign_out_everywhere$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[7]} FROM PUBLIC;
+
+-- Team workspaces (team:<uuid>): a workspace Slotlock owns, not a person's and not a GitHub
+-- organization's, so its owners can change. Owner-only; reached through the functions below.
+CREATE TABLE IF NOT EXISTS slotlock.workspaces (
+  tenant_ref text PRIMARY KEY,
+  handle text NOT NULL,
+  name text NOT NULL,
+  status text NOT NULL DEFAULT 'active',
+  -- Who created it, for the free team workspaces a person may create; cleared when they are erased.
+  created_by text,
+  created_at timestamptz NOT NULL DEFAULT statement_timestamp(),
+  CONSTRAINT slotlock_workspaces_handle_key UNIQUE (handle),
+  CONSTRAINT slotlock_workspaces_valid CHECK (
+    tenant_ref ~ '^team:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
+    AND handle ~ '^[a-z0-9]([a-z0-9-]{0,37}[a-z0-9])?$'
+    AND char_length(name) BETWEEN 1 AND 80
+    AND name !~ '[[:cntrl:]]'
+    AND status IN ('active')
+    AND (created_by IS NULL OR created_by ~ '^(github:[1-9][0-9]{0,19}|google:[A-Za-z0-9._-]{1,255}|sso:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$')
+  )
+);
+ALTER TABLE slotlock.workspaces ENABLE ROW LEVEL SECURITY;
+REVOKE ALL ON slotlock.workspaces FROM PUBLIC;
+
+-- How a person is shown to the others in their workspaces: their GitHub login or the Google email
+-- Google verified, as they last signed in. Never an identifier: people are their github:/google: ref.
+ALTER TABLE slotlock.dashboard_people ADD COLUMN IF NOT EXISTS display text;
+DO $slotlock_people_display$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+     WHERE conname = 'slotlock_dashboard_people_display_valid'
+       AND conrelid = 'slotlock.dashboard_people'::regclass
+  ) THEN
+    ALTER TABLE slotlock.dashboard_people ADD CONSTRAINT slotlock_dashboard_people_display_valid
+      CHECK (display IS NULL OR (char_length(display) BETWEEN 1 AND 254 AND display !~ '[[:cntrl:]<>]'));
+  END IF;
+END
+$slotlock_people_display$;
+
+-- Invitations to a team workspace: to an email address or a GitHub account, with a role, by a
+-- member entitled to give it. Only a SHA-256 digest of the token is kept (the token is 256 random
+-- bits, shown or sent once). An invitation is pending until accepted, revoked or past expires_at;
+-- accepting needs the signed-in person to be the GitHub account invited, or to hold the invited
+-- email verified. Owner-only; reached through the functions below.
+CREATE TABLE IF NOT EXISTS slotlock.workspace_invitations (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_ref text NOT NULL REFERENCES slotlock.workspaces (tenant_ref) ON DELETE CASCADE,
+  token_sha256 bytea NOT NULL,
+  email text,
+  github_ref text,
+  github_login text,
+  role text NOT NULL,
+  inviter_ref text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT statement_timestamp(),
+  sent_at timestamptz NOT NULL DEFAULT statement_timestamp(),
+  expires_at timestamptz NOT NULL,
+  accepted_at timestamptz,
+  accepted_by text,
+  revoked_at timestamptz,
+  CONSTRAINT slotlock_workspace_invitations_token_key UNIQUE (token_sha256),
+  CONSTRAINT slotlock_workspace_invitations_valid CHECK (
+    octet_length(token_sha256) = 32
+    AND (email IS NULL) <> (github_ref IS NULL)
+    AND (email IS NULL OR (char_length(email) BETWEEN 3 AND 254 AND email = lower(email)
+                           AND email ~ '^[^@[:space:][:cntrl:]<>]+@[^@[:space:][:cntrl:]<>]+$'))
+    AND (github_ref IS NULL OR github_ref ~ '^github:[1-9][0-9]{0,19}$')
+    AND (github_login IS NULL OR github_login ~ '^[A-Za-z0-9][A-Za-z0-9_-]{0,99}$')
+    AND role IN ('owner', 'admin', 'developer', 'member', 'viewer', 'billing')
+    AND inviter_ref ~ '^(github:[1-9][0-9]{0,19}|google:[A-Za-z0-9._-]{1,255}|sso:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$'
+    AND (accepted_by IS NULL OR accepted_by ~ '^(github:[1-9][0-9]{0,19}|google:[A-Za-z0-9._-]{1,255}|sso:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$')
+    AND expires_at > created_at
+  )
+);
+CREATE INDEX IF NOT EXISTS slotlock_workspace_invitations_tenant_idx
+  ON slotlock.workspace_invitations (tenant_ref, sent_at DESC);
+CREATE INDEX IF NOT EXISTS slotlock_workspace_invitations_github_idx
+  ON slotlock.workspace_invitations (github_ref) WHERE accepted_at IS NULL AND revoked_at IS NULL;
+CREATE INDEX IF NOT EXISTS slotlock_workspace_invitations_email_idx
+  ON slotlock.workspace_invitations (email) WHERE accepted_at IS NULL AND revoked_at IS NULL;
+CREATE INDEX IF NOT EXISTS slotlock_workspace_invitations_sent_email_idx
+  ON slotlock.workspace_invitations (email, sent_at) WHERE email IS NOT NULL;
+ALTER TABLE slotlock.workspace_invitations ENABLE ROW LEVEL SECURITY;
+REVOKE ALL ON slotlock.workspace_invitations FROM PUBLIC;
+
+-- Whether a role may give another (workspace-roles.ts slotlockRoleMayGrant): an Owner any role, an
+-- Admin up to Admin (never Owner or Billing), anyone else none.
+CREATE OR REPLACE FUNCTION slotlock.workspace_may_grant(granter text, granted text)
+RETURNS boolean
+LANGUAGE sql
+IMMUTABLE
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_workspace_may_grant$
+  SELECT CASE granter
+           WHEN 'owner' THEN granted IN ('owner', 'admin', 'developer', 'member', 'viewer', 'billing')
+           WHEN 'admin' THEN granted IN ('admin', 'developer', 'member', 'viewer')
+           ELSE false
+         END;
+$slotlock_workspace_may_grant$;
+REVOKE ALL ON FUNCTION slotlock.workspace_may_grant(text, text) FROM PUBLIC;
+
+-- A person's display (their GitHub login, or the email Google verified), at sign-in.
+CREATE OR REPLACE FUNCTION slotlock.dashboard_display(requested_person text, requested_display text)
+RETURNS void
+LANGUAGE plpgsql
+VOLATILE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_dashboard_display$
+BEGIN
+  UPDATE slotlock.dashboard_people person
+     SET display = NULLIF(requested_display, '')
+   WHERE person.person_ref = requested_person;
+END
+$slotlock_dashboard_display$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[9]} FROM PUBLIC;
+
+-- A new team workspace, its creator its Owner. With requested_cap, a person may have created at
+-- most that many active team workspaces that are not on a paid plan.
+CREATE OR REPLACE FUNCTION slotlock.create_team(
+  requested_person text, requested_name text, requested_handle text, requested_cap integer)
+RETURNS TABLE (tenant_ref text, refusal text)
+LANGUAGE plpgsql
+VOLATILE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_create_team$
+DECLARE
+  created text := 'team:' || gen_random_uuid()::text;
+  free_count integer;
+BEGIN
+  IF requested_person !~ '^(github:[1-9][0-9]{0,19}|google:[A-Za-z0-9._-]{1,255}|sso:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$' THEN
+    RAISE EXCEPTION 'Slotlock teams: invalid person' USING ERRCODE = '22023';
+  END IF;
+  -- A person a team's identity provider made (sso:) creates no team: their organization holds them.
+  IF requested_person ~ '^sso:' THEN
+    RETURN QUERY SELECT NULL::text, 'not_allowed'::text;
+    RETURN;
+  END IF;
+  IF requested_handle IS NULL OR requested_handle !~ '^[a-z0-9]([a-z0-9-]{0,37}[a-z0-9])?$' THEN
+    RETURN QUERY SELECT NULL::text, 'invalid_handle'::text;
+    RETURN;
+  END IF;
+  IF requested_name IS NULL OR char_length(btrim(requested_name)) NOT BETWEEN 1 AND 80
+     OR requested_name ~ '[[:cntrl:]]' THEN
+    RETURN QUERY SELECT NULL::text, 'invalid_name'::text;
+    RETURN;
+  END IF;
+  -- One person's creations at a time, so two at once cannot both pass the cap.
+  PERFORM pg_advisory_xact_lock(hashtextextended('slotlock:create-team:' || requested_person, 0));
+  IF requested_cap IS NOT NULL THEN
+    SELECT count(*) INTO free_count FROM slotlock.workspaces ws
+     WHERE ws.created_by = requested_person AND ws.status = 'active'
+       AND NOT EXISTS (SELECT 1 FROM slotlock.tenant_plans paid
+                        WHERE paid.tenant_ref = ws.tenant_ref AND paid.plan <> 'free' AND paid.status <> 'canceled');
+    IF free_count >= requested_cap THEN
+      RETURN QUERY SELECT NULL::text, 'team_limit'::text;
+      RETURN;
+    END IF;
+  END IF;
+  IF EXISTS (SELECT 1 FROM slotlock.workspaces ws WHERE ws.handle = requested_handle) THEN
+    RETURN QUERY SELECT NULL::text, 'handle_taken'::text;
+    RETURN;
+  END IF;
+  INSERT INTO slotlock.workspaces (tenant_ref, handle, name, created_by)
+  VALUES (created, requested_handle, btrim(requested_name), requested_person);
+  INSERT INTO slotlock.workspace_memberships (tenant_ref, person_ref, role, source)
+  VALUES (created, requested_person, 'owner', 'created');
+  RETURN QUERY SELECT created, NULL::text;
+EXCEPTION WHEN unique_violation THEN
+  RETURN QUERY SELECT NULL::text, 'handle_taken'::text;
+END
+$slotlock_create_team$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[10]} FROM PUBLIC;
+
+-- A team workspace's handle, name and status (its test environment's are its own).
+CREATE OR REPLACE FUNCTION slotlock.workspace_info(requested_tenant text)
+RETURNS TABLE (handle text, name text, status text)
+LANGUAGE plpgsql
+STABLE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_workspace_info$
+BEGIN
+  RETURN QUERY SELECT ws.handle, ws.name, ws.status FROM slotlock.workspaces ws
+   WHERE ws.tenant_ref = pg_catalog.regexp_replace(requested_tenant, '~test$', '');
+END
+$slotlock_workspace_info$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[11]} FROM PUBLIC;
+
+-- The team workspaces a person is an active member of, with their role, by name.
+CREATE OR REPLACE FUNCTION slotlock.person_workspaces(requested_person text)
+RETURNS TABLE (tenant_ref text, handle text, name text, role text)
+LANGUAGE plpgsql
+STABLE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_person_workspaces$
+BEGIN
+  RETURN QUERY SELECT ws.tenant_ref, ws.handle, ws.name, member.role
+    FROM slotlock.workspace_memberships member
+    JOIN slotlock.workspaces ws ON ws.tenant_ref = member.tenant_ref AND ws.status IN ('active', 'deleting')
+   WHERE member.person_ref = requested_person AND member.status = 'active'
+   ORDER BY lower(ws.name), ws.handle
+   LIMIT 100;
+END
+$slotlock_person_workspaces$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[12]} FROM PUBLIC;
+
+-- A workspace's active members, Owners first, with how each is shown.
+CREATE OR REPLACE FUNCTION slotlock.workspace_members(requested_tenant text)
+RETURNS TABLE (person_ref text, role text, source text, display text, joined_at timestamptz)
+LANGUAGE plpgsql
+STABLE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_workspace_members$
+BEGIN
+  RETURN QUERY SELECT member.person_ref, member.role, member.source, person.display, member.created_at
+    FROM slotlock.workspace_memberships member
+    LEFT JOIN slotlock.dashboard_people person ON person.person_ref = member.person_ref
+   WHERE member.tenant_ref = pg_catalog.regexp_replace(requested_tenant, '~test$', '')
+     AND member.status = 'active'
+   ORDER BY array_position(ARRAY['owner', 'admin', 'developer', 'member', 'viewer', 'billing'], member.role),
+            lower(coalesce(person.display, member.person_ref))
+   LIMIT 1000;
+END
+$slotlock_workspace_members$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[13]} FROM PUBLIC;
+
+-- A workspace's invitations not accepted or revoked: pending ones, and those expired in the last
+-- 30 days (to send again), newest first.
+CREATE OR REPLACE FUNCTION slotlock.workspace_invitations_list(requested_tenant text)
+RETURNS TABLE (id uuid, email text, github_login text, role text, inviter_display text,
+               sent_at timestamptz, expires_at timestamptz)
+LANGUAGE plpgsql
+STABLE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_workspace_invitations_list$
+BEGIN
+  RETURN QUERY SELECT invitation.id, invitation.email, invitation.github_login, invitation.role,
+                      coalesce(inviter.display, invitation.inviter_ref), invitation.sent_at, invitation.expires_at
+    FROM slotlock.workspace_invitations invitation
+    LEFT JOIN slotlock.dashboard_people inviter ON inviter.person_ref = invitation.inviter_ref
+   WHERE invitation.tenant_ref = pg_catalog.regexp_replace(requested_tenant, '~test$', '')
+     AND invitation.accepted_at IS NULL AND invitation.revoked_at IS NULL
+     AND invitation.expires_at > statement_timestamp() - interval '30 days'
+   ORDER BY invitation.sent_at DESC
+   LIMIT 500;
+END
+$slotlock_workspace_invitations_list$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[14]} FROM PUBLIC;
+
+-- Invite to a team workspace: by email or GitHub account, with a role the inviter may give, one
+-- pending invitation per address (a new one replaces it), at most requested_daily_limit sent a day,
+-- and with requested_member_cap, no more people than it counting pending invitations. The token
+-- is given as its SHA-256 digest only.
+CREATE OR REPLACE FUNCTION slotlock.invite_member(
+  requested_tenant text, requested_inviter text, requested_email text, requested_github text,
+  requested_github_login text, requested_role text, requested_token bytea, requested_days integer,
+  requested_daily_limit integer, requested_member_cap integer)
+RETURNS TABLE (invitation_id uuid, refusal text)
+LANGUAGE plpgsql
+VOLATILE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_invite_member$
+DECLARE
+  inviter_role text;
+  email_normalized text := NULLIF(lower(btrim(requested_email)), '');
+  occupied integer;
+  created uuid;
+BEGIN
+  IF requested_days IS NULL OR requested_days NOT BETWEEN 1 AND 30 THEN
+    RAISE EXCEPTION 'Slotlock teams: invitations last 1-30 days' USING ERRCODE = '22023';
+  END IF;
+  -- The workspace's invitations one at a time: the cap and the daily limit see each other.
+  PERFORM 1 FROM slotlock.workspaces ws
+   WHERE ws.tenant_ref = requested_tenant AND ws.status = 'active' FOR UPDATE;
+  IF NOT FOUND THEN
+    RETURN QUERY SELECT NULL::uuid, 'not_found'::text;
+    RETURN;
+  END IF;
+  SELECT member.role INTO inviter_role FROM slotlock.workspace_memberships member
+   WHERE member.tenant_ref = requested_tenant AND member.person_ref = requested_inviter AND member.status = 'active';
+  IF inviter_role IS NULL OR NOT slotlock.workspace_may_grant(inviter_role, requested_role) THEN
+    RETURN QUERY SELECT NULL::uuid, 'not_allowed'::text;
+    RETURN;
+  END IF;
+  IF (email_normalized IS NULL) = (requested_github IS NULL) THEN
+    RAISE EXCEPTION 'Slotlock teams: invite an email or a GitHub account' USING ERRCODE = '22023';
+  END IF;
+  -- Held to the team's verified domains (ddl-identity.ts): only addresses at one, and so no GitHub
+  -- account, which carries none.
+  IF ${SLOTLOCK_INVITE_DOMAIN_REFUSED('requested_tenant', 'email_normalized', 'requested_github')} THEN
+    RETURN QUERY SELECT NULL::uuid, 'domain_restricted'::text;
+    RETURN;
+  END IF;
+  IF requested_github IS NOT NULL AND EXISTS (
+    SELECT 1 FROM slotlock.workspace_memberships member
+     WHERE member.tenant_ref = requested_tenant AND member.person_ref = requested_github AND member.status = 'active'
+  ) THEN
+    RETURN QUERY SELECT NULL::uuid, 'already_member'::text;
+    RETURN;
+  END IF;
+  -- The team's invitations a day, and the inviter's across every team they are in.
+  IF requested_daily_limit IS NOT NULL AND (
+    (SELECT count(*) FROM slotlock.workspace_invitations sent
+      WHERE sent.tenant_ref = requested_tenant AND sent.sent_at > statement_timestamp() - interval '1 day')
+      >= requested_daily_limit
+    OR (SELECT count(*) FROM slotlock.workspace_invitations sent
+         WHERE sent.inviter_ref = requested_inviter AND sent.sent_at > statement_timestamp() - interval '1 day')
+      >= requested_daily_limit
+  ) THEN
+    RETURN QUERY SELECT NULL::uuid, 'invitation_limit'::text;
+    RETURN;
+  END IF;
+  -- One address's invitations a day, from every team together (SLOTLOCK_INVITATIONS_PER_ADDRESS).
+  IF requested_daily_limit IS NOT NULL AND email_normalized IS NOT NULL AND
+     (SELECT count(*) FROM slotlock.workspace_invitations sent
+       WHERE sent.email = email_normalized AND sent.sent_at > statement_timestamp() - interval '1 day')
+     >= ${SLOTLOCK_INVITATIONS_PER_ADDRESS} THEN
+    RETURN QUERY SELECT NULL::uuid, 'recipient_limit'::text;
+    RETURN;
+  END IF;
+  -- A pending invitation to the same address is replaced, so it is not counted against the cap.
+  IF requested_member_cap IS NOT NULL THEN
+    SELECT (SELECT count(*) FROM slotlock.workspace_memberships member
+             WHERE member.tenant_ref = requested_tenant AND member.status = 'active')
+         + (SELECT count(*) FROM slotlock.workspace_invitations pending
+             WHERE pending.tenant_ref = requested_tenant AND pending.accepted_at IS NULL
+               AND pending.revoked_at IS NULL AND pending.expires_at > statement_timestamp()
+               AND NOT coalesce(pending.email = email_normalized OR pending.github_ref = requested_github, false))
+      INTO occupied;
+    IF occupied >= requested_member_cap THEN
+      RETURN QUERY SELECT NULL::uuid, 'member_cap'::text;
+      RETURN;
+    END IF;
+  END IF;
+  UPDATE slotlock.workspace_invitations old
+     SET revoked_at = statement_timestamp()
+   WHERE old.tenant_ref = requested_tenant AND old.accepted_at IS NULL AND old.revoked_at IS NULL
+     AND (old.email = email_normalized OR old.github_ref = requested_github);
+  INSERT INTO slotlock.workspace_invitations
+    (tenant_ref, token_sha256, email, github_ref, github_login, role, inviter_ref, expires_at)
+  VALUES (requested_tenant, requested_token, email_normalized, requested_github,
+          CASE WHEN requested_github IS NULL THEN NULL ELSE requested_github_login END,
+          requested_role, requested_inviter,
+          statement_timestamp() + make_interval(days => requested_days))
+  RETURNING id INTO created;
+  RETURN QUERY SELECT created, NULL::text;
+END
+$slotlock_invite_member$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[15]} FROM PUBLIC;
+
+-- What an invitation's holder may see before joining: the workspace, who invited them, the role,
+-- whom it is for, and its state. Nothing else of the workspace.
+CREATE OR REPLACE FUNCTION slotlock.invitation_preview(requested_token bytea)
+RETURNS TABLE (invitation_id uuid, tenant_ref text, workspace_name text, workspace_handle text,
+               inviter_display text, role text, email text, github_ref text, github_login text, state text)
+LANGUAGE plpgsql
+STABLE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_invitation_preview$
+BEGIN
+  RETURN QUERY SELECT invitation.id, invitation.tenant_ref, ws.name, ws.handle,
+         coalesce(inviter.display, 'A member'), invitation.role, invitation.email, invitation.github_ref,
+         invitation.github_login,
+         CASE WHEN invitation.revoked_at IS NOT NULL THEN 'revoked'
+              WHEN invitation.accepted_at IS NOT NULL THEN 'accepted'
+              WHEN invitation.expires_at <= statement_timestamp() THEN 'expired'
+              ELSE 'pending' END
+    FROM slotlock.workspace_invitations invitation
+    JOIN slotlock.workspaces ws ON ws.tenant_ref = invitation.tenant_ref
+    LEFT JOIN slotlock.dashboard_people inviter ON inviter.person_ref = invitation.inviter_ref
+   WHERE invitation.token_sha256 = requested_token;
+END
+$slotlock_invitation_preview$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[16]} FROM PUBLIC;
+
+-- Accept an invitation, by its token's digest or (one found for the person) its id: in one
+-- transaction, only while pending, only by the GitHub account invited or a person holding the
+-- invited email verified, only while the inviter may still give the role, and within
+-- requested_member_cap. A member already keeps their role.
+CREATE OR REPLACE FUNCTION slotlock.accept_invitation(
+  requested_token bytea, requested_id uuid, requested_person text, requested_emails text[],
+  requested_member_cap integer)
+RETURNS TABLE (tenant_ref text, refusal text)
+LANGUAGE plpgsql
+VOLATILE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_accept_invitation$
+DECLARE
+  invitation slotlock.workspace_invitations%ROWTYPE;
+  found_id uuid;
+  found_tenant text;
+  inviter_role text;
+  members integer;
+BEGIN
+  IF requested_person !~ '^(github:[1-9][0-9]{0,19}|google:[A-Za-z0-9._-]{1,255}|sso:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$' THEN
+    RAISE EXCEPTION 'Slotlock teams: invalid person' USING ERRCODE = '22023';
+  END IF;
+  SELECT found.id, found.tenant_ref INTO found_id, found_tenant FROM slotlock.workspace_invitations found
+   WHERE (requested_token IS NOT NULL AND found.token_sha256 = requested_token)
+      OR (requested_token IS NULL AND found.id = requested_id);
+  IF found_id IS NULL THEN
+    RETURN QUERY SELECT NULL::text, 'not_found'::text;
+    RETURN;
+  END IF;
+  -- The workspace first, then the invitation: the order every change to it takes, so none deadlock.
+  PERFORM 1 FROM slotlock.workspaces ws WHERE ws.tenant_ref = found_tenant AND ws.status = 'active' FOR UPDATE;
+  IF NOT FOUND THEN
+    RETURN QUERY SELECT NULL::text, 'not_found'::text;
+    RETURN;
+  END IF;
+  SELECT * INTO invitation FROM slotlock.workspace_invitations found WHERE found.id = found_id FOR UPDATE;
+  -- Sent again while this waited: the old token no longer opens it.
+  IF NOT FOUND OR (requested_token IS NOT NULL AND invitation.token_sha256 <> requested_token) THEN
+    RETURN QUERY SELECT NULL::text, 'not_found'::text;
+    RETURN;
+  END IF;
+  -- An Owner signs in with GitHub or Google too, for when the team's provider is down (ddl-sso.ts).
+  IF invitation.role = 'owner' AND requested_person ~ '^sso:' THEN
+    RETURN QUERY SELECT NULL::text, 'not_for_you'::text;
+    RETURN;
+  END IF;
+  IF invitation.revoked_at IS NOT NULL THEN
+    RETURN QUERY SELECT NULL::text, 'revoked'::text;
+    RETURN;
+  ELSIF invitation.accepted_at IS NOT NULL THEN
+    RETURN QUERY SELECT NULL::text, 'accepted'::text;
+    RETURN;
+  ELSIF invitation.expires_at <= statement_timestamp() THEN
+    RETURN QUERY SELECT NULL::text, 'expired'::text;
+    RETURN;
+  END IF;
+  IF NOT (
+    (invitation.github_ref IS NOT NULL AND invitation.github_ref = requested_person)
+    OR (invitation.email IS NOT NULL AND invitation.email = ANY (
+          SELECT lower(btrim(given)) FROM unnest(coalesce(requested_emails, ARRAY[]::text[])) given))
+  ) THEN
+    RETURN QUERY SELECT NULL::text, 'not_for_you'::text;
+    RETURN;
+  END IF;
+  SELECT member.role INTO inviter_role FROM slotlock.workspace_memberships member
+   WHERE member.tenant_ref = invitation.tenant_ref AND member.person_ref = invitation.inviter_ref
+     AND member.status = 'active';
+  IF inviter_role IS NULL OR NOT slotlock.workspace_may_grant(inviter_role, invitation.role) THEN
+    UPDATE slotlock.workspace_invitations SET revoked_at = statement_timestamp() WHERE id = invitation.id;
+    RETURN QUERY SELECT NULL::text, 'revoked'::text;
+    RETURN;
+  END IF;
+  IF EXISTS (SELECT 1 FROM slotlock.workspace_memberships member
+              WHERE member.tenant_ref = invitation.tenant_ref AND member.person_ref = requested_person
+                AND member.status = 'active') THEN
+    UPDATE slotlock.workspace_invitations
+       SET accepted_at = statement_timestamp(), accepted_by = requested_person WHERE id = invitation.id;
+    RETURN QUERY SELECT invitation.tenant_ref, NULL::text;
+    RETURN;
+  END IF;
+  IF requested_member_cap IS NOT NULL THEN
+    SELECT count(*) INTO members FROM slotlock.workspace_memberships member
+     WHERE member.tenant_ref = invitation.tenant_ref AND member.status = 'active';
+    IF members >= requested_member_cap THEN
+      RETURN QUERY SELECT NULL::text, 'member_cap'::text;
+      RETURN;
+    END IF;
+  END IF;
+  INSERT INTO slotlock.workspace_memberships AS member (tenant_ref, person_ref, role, source, joined_email)
+  VALUES (invitation.tenant_ref, requested_person, invitation.role, 'invitation', invitation.email)
+  ON CONFLICT ON CONSTRAINT slotlock_workspace_memberships_pkey DO UPDATE
+    SET role = EXCLUDED.role, status = 'active', source = 'invitation', deactivated_at = NULL, deactivated_by = NULL,
+        joined_email = coalesce(EXCLUDED.joined_email, member.joined_email), joined_via_domain = NULL,
+        role_managed_by = 'manual', updated_at = statement_timestamp();
+  UPDATE slotlock.workspace_invitations
+     SET accepted_at = statement_timestamp(), accepted_by = requested_person WHERE id = invitation.id;
+  RETURN QUERY SELECT invitation.tenant_ref, NULL::text;
+END
+$slotlock_accept_invitation$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[17]} FROM PUBLIC;
+
+-- Revoke a pending invitation, by an Owner or Admin of its workspace.
+CREATE OR REPLACE FUNCTION slotlock.revoke_invitation(requested_tenant text, requested_actor text, requested_id uuid)
+RETURNS boolean
+LANGUAGE plpgsql
+VOLATILE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_revoke_invitation$
+DECLARE
+  actor_role text;
+  changed integer;
+BEGIN
+  PERFORM 1 FROM slotlock.workspaces ws WHERE ws.tenant_ref = requested_tenant AND ws.status = 'active' FOR UPDATE;
+  IF NOT FOUND THEN
+    RETURN false;
+  END IF;
+  SELECT member.role INTO actor_role FROM slotlock.workspace_memberships member
+   WHERE member.tenant_ref = requested_tenant AND member.person_ref = requested_actor AND member.status = 'active';
+  -- Only an invitation whose role the actor could give: an Admin never withdraws an Owner's.
+  UPDATE slotlock.workspace_invitations invitation SET revoked_at = statement_timestamp()
+   WHERE invitation.id = requested_id AND invitation.tenant_ref = requested_tenant
+     AND invitation.accepted_at IS NULL AND invitation.revoked_at IS NULL
+     AND actor_role IS NOT NULL AND slotlock.workspace_may_grant(actor_role, invitation.role);
+  GET DIAGNOSTICS changed = ROW_COUNT;
+  RETURN changed > 0;
+END
+$slotlock_revoke_invitation$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[18]} FROM PUBLIC;
+
+-- Send an invitation again, with a new token and a new expiry: by someone who may give its role,
+-- within the daily limit and the address's. As inviting the address again does, it withdraws the
+-- old invitation and adds a new one, so each re-send counts as a send: re-sending one row in place
+-- made a new link, and an email, the daily limit never saw.
+CREATE OR REPLACE FUNCTION slotlock.resend_invitation(
+  requested_tenant text, requested_actor text, requested_id uuid, requested_token bytea,
+  requested_days integer, requested_daily_limit integer, requested_member_cap integer)
+RETURNS text
+LANGUAGE plpgsql
+VOLATILE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_resend_invitation$
+DECLARE
+  actor_role text;
+  invitation_role text;
+  invitation_email text;
+  invitation_github text;
+BEGIN
+  IF requested_days IS NULL OR requested_days NOT BETWEEN 1 AND 30 THEN
+    RAISE EXCEPTION 'Slotlock teams: invitations last 1-30 days' USING ERRCODE = '22023';
+  END IF;
+  PERFORM 1 FROM slotlock.workspaces ws WHERE ws.tenant_ref = requested_tenant AND ws.status = 'active' FOR UPDATE;
+  IF NOT FOUND THEN
+    RETURN 'not_found';
+  END IF;
+  SELECT member.role INTO actor_role FROM slotlock.workspace_memberships member
+   WHERE member.tenant_ref = requested_tenant AND member.person_ref = requested_actor AND member.status = 'active';
+  SELECT invitation.role, invitation.email, invitation.github_ref INTO invitation_role, invitation_email, invitation_github
+    FROM slotlock.workspace_invitations invitation
+   WHERE invitation.id = requested_id AND invitation.tenant_ref = requested_tenant
+     AND invitation.accepted_at IS NULL AND invitation.revoked_at IS NULL
+   FOR UPDATE;
+  IF invitation_role IS NULL THEN
+    RETURN 'not_found';
+  END IF;
+  IF actor_role IS NULL OR NOT slotlock.workspace_may_grant(actor_role, invitation_role) THEN
+    RETURN 'not_allowed';
+  END IF;
+  -- Sent again only where it could be sent now (ddl-identity.ts).
+  IF ${SLOTLOCK_INVITE_DOMAIN_REFUSED('requested_tenant', 'invitation_email', 'invitation_github')} THEN
+    RETURN 'domain_restricted';
+  END IF;
+  IF requested_daily_limit IS NOT NULL AND (
+    (SELECT count(*) FROM slotlock.workspace_invitations sent
+      WHERE sent.tenant_ref = requested_tenant AND sent.sent_at > statement_timestamp() - interval '1 day')
+      >= requested_daily_limit
+    OR (SELECT count(*) FROM slotlock.workspace_invitations sent
+         WHERE sent.inviter_ref = requested_actor AND sent.sent_at > statement_timestamp() - interval '1 day')
+      >= requested_daily_limit
+  ) THEN
+    RETURN 'invitation_limit';
+  END IF;
+  IF requested_daily_limit IS NOT NULL AND invitation_email IS NOT NULL AND
+     (SELECT count(*) FROM slotlock.workspace_invitations sent
+       WHERE sent.email = invitation_email AND sent.sent_at > statement_timestamp() - interval '1 day')
+     >= ${SLOTLOCK_INVITATIONS_PER_ADDRESS} THEN
+    RETURN 'recipient_limit';
+  END IF;
+  -- Sent again, it is open again: held to the cap with the members and the other open invitations.
+  IF requested_member_cap IS NOT NULL AND
+     (SELECT count(*) FROM slotlock.workspace_memberships member
+       WHERE member.tenant_ref = requested_tenant AND member.status = 'active')
+     + (SELECT count(*) FROM slotlock.workspace_invitations pending
+         WHERE pending.tenant_ref = requested_tenant AND pending.id <> requested_id
+           AND pending.accepted_at IS NULL AND pending.revoked_at IS NULL
+           AND pending.expires_at > statement_timestamp())
+     >= requested_member_cap THEN
+    RETURN 'member_cap';
+  END IF;
+  UPDATE slotlock.workspace_invitations invitation SET revoked_at = statement_timestamp()
+   WHERE invitation.id = requested_id;
+  INSERT INTO slotlock.workspace_invitations
+    (tenant_ref, token_sha256, email, github_ref, github_login, role, inviter_ref, expires_at)
+  SELECT old.tenant_ref, requested_token, old.email, old.github_ref, old.github_login, old.role,
+         requested_actor, statement_timestamp() + make_interval(days => requested_days)
+    FROM slotlock.workspace_invitations old
+   WHERE old.id = requested_id;
+  RETURN NULL;
+END
+$slotlock_resend_invitation$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[19]} FROM PUBLIC;
+
+-- Change a member's role, by someone who may give both their current role and the new one; a
+-- workspace always keeps an Owner. A role given in Slotlock is never changed by a GitHub sign-in.
+CREATE OR REPLACE FUNCTION slotlock.change_member_role(
+  requested_tenant text, requested_actor text, requested_person text, requested_role text)
+RETURNS text
+LANGUAGE plpgsql
+VOLATILE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_change_member_role$
+DECLARE
+  actor_role text;
+  current_role_of text;
+BEGIN
+  IF requested_role NOT IN ('owner', 'admin', 'developer', 'member', 'viewer', 'billing') THEN
+    RAISE EXCEPTION 'Slotlock teams: invalid role' USING ERRCODE = '22023';
+  END IF;
+  -- The workspace's owners one change at a time, so two Owners demoting each other leave one.
+  PERFORM 1 FROM slotlock.workspaces ws WHERE ws.tenant_ref = requested_tenant AND ws.status = 'active' FOR UPDATE;
+  IF NOT FOUND THEN
+    RETURN 'not_found';
+  END IF;
+  SELECT member.role INTO actor_role FROM slotlock.workspace_memberships member
+   WHERE member.tenant_ref = requested_tenant AND member.person_ref = requested_actor AND member.status = 'active';
+  SELECT member.role INTO current_role_of FROM slotlock.workspace_memberships member
+   WHERE member.tenant_ref = requested_tenant AND member.person_ref = requested_person AND member.status = 'active';
+  IF current_role_of IS NULL THEN
+    RETURN 'not_found';
+  END IF;
+  IF actor_role IS NULL OR NOT slotlock.workspace_may_grant(actor_role, current_role_of)
+     OR NOT slotlock.workspace_may_grant(actor_role, requested_role) THEN
+    RETURN 'not_allowed';
+  END IF;
+  -- Every Owner can sign in with GitHub or Google, for when the team's provider is down: so the
+  -- Owner a team always keeps is one who may bypass single sign-on (ddl-sso.ts).
+  IF requested_role = 'owner' AND requested_person ~ '^sso:' THEN
+    RETURN 'sso_owner';
+  END IF;
+  IF current_role_of = 'owner' AND requested_role <> 'owner' AND NOT EXISTS (
+    SELECT 1 FROM slotlock.workspace_memberships other
+     WHERE other.tenant_ref = requested_tenant AND other.status = 'active' AND other.role = 'owner'
+       AND other.person_ref <> requested_person
+  ) THEN
+    RETURN 'last_owner';
+  END IF;
+  -- A role set by hand stays: the team's provider no longer recomputes it at sign-in.
+  UPDATE slotlock.workspace_memberships member
+     SET role = requested_role, source = CASE WHEN member.source = 'github_org' THEN 'created' ELSE member.source END,
+         role_managed_by = 'manual', updated_at = statement_timestamp()
+   WHERE member.tenant_ref = requested_tenant AND member.person_ref = requested_person;
+  RETURN NULL;
+END
+$slotlock_change_member_role$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[20]} FROM PUBLIC;
+
+-- A member limited to part of the workspace (RFC 0004 D1): the locations and groups whose resources
+-- they reach, as an API key's resource scope (RFC 0003 G6). Null is the whole workspace; an Owner is
+-- never limited.
+ALTER TABLE slotlock.workspace_memberships ADD COLUMN IF NOT EXISTS resource_scope jsonb;
+DO $slotlock_membership_scope$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'slotlock_workspace_memberships_scope_check') THEN
+    -- As a key's scope: 1-20 locations and 1-20 groups by reference, at least one in all. A CASE,
+    -- not AND, so no array function sees what is not an array, and false (never null) otherwise.
+    ALTER TABLE slotlock.workspace_memberships ADD CONSTRAINT slotlock_workspace_memberships_scope_check CHECK (
+      resource_scope IS NULL OR CASE
+        WHEN jsonb_typeof(resource_scope) = 'object'
+             AND jsonb_typeof(resource_scope -> 'locations') IS NOT DISTINCT FROM 'array'
+             AND jsonb_typeof(resource_scope -> 'groups') IS NOT DISTINCT FROM 'array'
+        THEN jsonb_array_length(resource_scope -> 'locations') <= 20
+             AND jsonb_array_length(resource_scope -> 'groups') <= 20
+             AND jsonb_array_length(resource_scope -> 'locations') + jsonb_array_length(resource_scope -> 'groups') >= 1
+             AND NOT jsonb_path_exists(resource_scope,
+               '$.locations[*] ? (@.type() != "string" || !(@ like_regex "^[a-z0-9][a-z0-9._-]{0,99}$"))')
+             AND NOT jsonb_path_exists(resource_scope,
+               '$.groups[*] ? (@.type() != "string" || !(@ like_regex "^[a-z0-9][a-z0-9._-]{0,99}$"))')
+        ELSE false
+      END
+    );
+  END IF;
+END
+$slotlock_membership_scope$;
+
+-- An Owner reaches the whole workspace: made one by any path (a role change, an invitation, a
+-- GitHub organization's sign-in), their limit is cleared, so it does not return if they stop being
+-- one.
+CREATE OR REPLACE FUNCTION slotlock.workspace_owner_unlimited()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_workspace_owner_unlimited$
+BEGIN
+  IF NEW.role = 'owner' THEN
+    NEW.resource_scope := NULL;
+  END IF;
+  RETURN NEW;
+END
+$slotlock_workspace_owner_unlimited$;
+CREATE OR REPLACE TRIGGER slotlock_workspace_owner_unlimited
+  BEFORE INSERT OR UPDATE OF role, resource_scope ON slotlock.workspace_memberships
+  FOR EACH ROW EXECUTE FUNCTION slotlock.workspace_owner_unlimited();
+-- Owners limited before this trigger: none should be, but a database that has one is cleared.
+UPDATE slotlock.workspace_memberships SET resource_scope = NULL
+ WHERE role = 'owner' AND resource_scope IS NOT NULL;
+
+-- The part of a workspace (its test environment is its live tenant's) a person is limited to, or
+-- null for all of it. An Owner reaches all of it.
+CREATE OR REPLACE FUNCTION slotlock.member_scope(requested_tenant text, requested_person text)
+RETURNS jsonb
+LANGUAGE sql
+STABLE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_member_scope$
+  SELECT CASE WHEN member.role = 'owner' THEN NULL ELSE member.resource_scope END
+    FROM slotlock.workspace_memberships member
+   WHERE member.tenant_ref = pg_catalog.regexp_replace(requested_tenant, '~test$', '')
+     AND member.person_ref = requested_person AND member.status = 'active';
+$slotlock_member_scope$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[34]} FROM PUBLIC;
+
+-- Every member of a workspace limited to part of it, with what they are limited to (Members).
+CREATE OR REPLACE FUNCTION slotlock.member_scopes(requested_tenant text)
+RETURNS TABLE (person_ref text, resource_scope jsonb)
+LANGUAGE sql
+STABLE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_member_scopes$
+  SELECT member.person_ref, member.resource_scope
+    FROM slotlock.workspace_memberships member
+   WHERE member.tenant_ref = pg_catalog.regexp_replace(requested_tenant, '~test$', '')
+     AND member.status = 'active' AND member.role <> 'owner' AND member.resource_scope IS NOT NULL
+   LIMIT 1000;
+$slotlock_member_scopes$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[36]} FROM PUBLIC;
+
+-- Limit a member to locations and groups, or give them the whole workspace again (null): by an
+-- Owner or Admin who is not limited themselves, of a member who is not an Owner and whose role they
+-- may grant. Null on success; else not_found, not_allowed or owner.
+CREATE OR REPLACE FUNCTION slotlock.set_member_scope(
+  requested_tenant text, requested_actor text, requested_person text, requested_scope jsonb)
+RETURNS text
+LANGUAGE plpgsql
+VOLATILE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_set_member_scope$
+DECLARE
+  actor_role text;
+  actor_scope jsonb;
+  member_role text;
+BEGIN
+  PERFORM 1 FROM slotlock.workspaces ws WHERE ws.tenant_ref = requested_tenant AND ws.status = 'active' FOR UPDATE;
+  IF NOT FOUND THEN
+    RETURN 'not_found';
+  END IF;
+  SELECT member.role, member.resource_scope INTO actor_role, actor_scope FROM slotlock.workspace_memberships member
+   WHERE member.tenant_ref = requested_tenant AND member.person_ref = requested_actor AND member.status = 'active';
+  SELECT member.role INTO member_role FROM slotlock.workspace_memberships member
+   WHERE member.tenant_ref = requested_tenant AND member.person_ref = requested_person AND member.status = 'active';
+  IF member_role IS NULL THEN
+    RETURN 'not_found';
+  END IF;
+  IF member_role = 'owner' THEN
+    RETURN 'owner';
+  END IF;
+  IF actor_role IS NULL OR actor_role NOT IN ('owner', 'admin') OR actor_scope IS NOT NULL
+     OR NOT slotlock.workspace_may_grant(actor_role, member_role) THEN
+    RETURN 'not_allowed';
+  END IF;
+  UPDATE slotlock.workspace_memberships member
+     SET resource_scope = requested_scope, updated_at = statement_timestamp()
+   WHERE member.tenant_ref = requested_tenant AND member.person_ref = requested_person;
+  RETURN NULL;
+END
+$slotlock_set_member_scope$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[35]} FROM PUBLIC;
+
+-- Remove a member (or, the actor themselves, leave): by someone who may give their role; a
+-- workspace always keeps an Owner. Their pending invitations go with them. The membership is kept
+-- inactive, so inviting them back restores what an invitation gives.
+CREATE OR REPLACE FUNCTION slotlock.remove_member(requested_tenant text, requested_actor text, requested_person text)
+RETURNS text
+LANGUAGE plpgsql
+VOLATILE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_remove_member$
+DECLARE
+  actor_role text;
+  removed_role text;
+BEGIN
+  PERFORM 1 FROM slotlock.workspaces ws WHERE ws.tenant_ref = requested_tenant AND ws.status = 'active' FOR UPDATE;
+  IF NOT FOUND THEN
+    RETURN 'not_found';
+  END IF;
+  SELECT member.role INTO actor_role FROM slotlock.workspace_memberships member
+   WHERE member.tenant_ref = requested_tenant AND member.person_ref = requested_actor AND member.status = 'active';
+  SELECT member.role INTO removed_role FROM slotlock.workspace_memberships member
+   WHERE member.tenant_ref = requested_tenant AND member.person_ref = requested_person AND member.status = 'active';
+  IF removed_role IS NULL OR actor_role IS NULL THEN
+    RETURN 'not_found';
+  END IF;
+  IF requested_actor <> requested_person AND NOT slotlock.workspace_may_grant(actor_role, removed_role) THEN
+    RETURN 'not_allowed';
+  END IF;
+  IF removed_role = 'owner' AND NOT EXISTS (
+    SELECT 1 FROM slotlock.workspace_memberships other
+     WHERE other.tenant_ref = requested_tenant AND other.status = 'active' AND other.role = 'owner'
+       AND other.person_ref <> requested_person
+  ) THEN
+    RETURN 'last_owner';
+  END IF;
+  -- Removed by someone else, the address they came by joins at once no more (ddl-identity.ts),
+  -- nor do those their sign-ins through the team's provider carried (ddl-sso.ts).
+  IF requested_actor <> requested_person THEN
+    INSERT INTO slotlock.workspace_join_blocks (tenant_ref, email_sha256)
+    SELECT requested_tenant, sha256(convert_to(address.email, 'UTF8'))
+      FROM (SELECT member.joined_email AS email FROM slotlock.workspace_memberships member
+             WHERE member.tenant_ref = requested_tenant AND member.person_ref = requested_person
+            UNION
+            SELECT identity.email_last FROM slotlock.sso_identities identity
+              JOIN slotlock.sso_connections linked ON linked.id = identity.connection_id AND linked.tenant_ref = requested_tenant
+             WHERE identity.person_ref = requested_person) address
+     WHERE address.email IS NOT NULL
+    ON CONFLICT ON CONSTRAINT slotlock_workspace_join_blocks_pkey DO NOTHING;
+  END IF;
+  UPDATE slotlock.workspace_memberships member
+     SET status = 'inactive', source = 'created', deactivated_at = statement_timestamp(),
+         deactivated_by = CASE WHEN requested_actor = requested_person THEN 'self' ELSE 'team' END,
+         updated_at = statement_timestamp()
+   WHERE member.tenant_ref = requested_tenant AND member.person_ref = requested_person;
+  -- Their pending invitations go with them: those they sent, and those sent to them (their account,
+  -- or an address they joined with or signed in through the team's provider with), which would
+  -- otherwise let them back in.
+  UPDATE slotlock.workspace_invitations invitation SET revoked_at = statement_timestamp()
+   WHERE invitation.tenant_ref = requested_tenant AND invitation.accepted_at IS NULL AND invitation.revoked_at IS NULL
+     AND (invitation.inviter_ref = requested_person
+          OR (requested_actor <> requested_person AND (
+                invitation.github_ref = requested_person
+                OR invitation.email IN (
+                  SELECT member.joined_email FROM slotlock.workspace_memberships member
+                   WHERE member.tenant_ref = requested_tenant AND member.person_ref = requested_person
+                  UNION
+                  SELECT identity.email_last FROM slotlock.sso_identities identity
+                    JOIN slotlock.sso_connections linked ON linked.id = identity.connection_id AND linked.tenant_ref = requested_tenant
+                   WHERE identity.person_ref = requested_person))));
+  RETURN NULL;
+END
+$slotlock_remove_member$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[21]} FROM PUBLIC;
+
+-- The pending invitations meant for a person: to their GitHub account, or to an email they hold
+-- verified. For the dashboard to offer "Join" without the link.
+CREATE OR REPLACE FUNCTION slotlock.pending_invitations_for(requested_person text, requested_emails text[])
+RETURNS TABLE (invitation_id uuid, tenant_ref text, workspace_name text, workspace_handle text,
+               inviter_display text, role text)
+LANGUAGE plpgsql
+STABLE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_pending_invitations_for$
+BEGIN
+  RETURN QUERY SELECT invitation.id, invitation.tenant_ref, ws.name, ws.handle,
+         coalesce(inviter.display, 'A member'), invitation.role
+    FROM slotlock.workspace_invitations invitation
+    JOIN slotlock.workspaces ws ON ws.tenant_ref = invitation.tenant_ref AND ws.status = 'active'
+    LEFT JOIN slotlock.dashboard_people inviter ON inviter.person_ref = invitation.inviter_ref
+   WHERE invitation.accepted_at IS NULL AND invitation.revoked_at IS NULL
+     AND invitation.expires_at > statement_timestamp()
+     AND (invitation.github_ref = requested_person
+          OR invitation.email = ANY (SELECT lower(btrim(given)) FROM unnest(coalesce(requested_emails, ARRAY[]::text[])) given))
+     AND NOT EXISTS (SELECT 1 FROM slotlock.workspace_memberships member
+                      WHERE member.tenant_ref = invitation.tenant_ref AND member.person_ref = requested_person
+                        AND member.status = 'active')
+   ORDER BY invitation.sent_at DESC
+   LIMIT 20;
+END
+$slotlock_pending_invitations_for$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[22]} FROM PUBLIC;
+
+-- Whether a team workspace serves its keys: only while it exists and is active.
+CREATE OR REPLACE FUNCTION slotlock.workspace_active(requested_tenant text)
+RETURNS boolean
+LANGUAGE plpgsql
+STABLE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_workspace_active$
+BEGIN
+  RETURN EXISTS (SELECT 1 FROM slotlock.workspaces ws
+                  WHERE ws.tenant_ref = pg_catalog.regexp_replace(requested_tenant, '~test$', '')
+                    AND ws.status = 'active');
+END
+$slotlock_workspace_active$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[23]} FROM PUBLIC;
+
+-- Invitations finished (accepted, revoked or expired) more than 30 days ago, with the address they
+-- were sent to: deleted.
+CREATE OR REPLACE FUNCTION slotlock.prune_workspace_invitations()
+RETURNS integer
+LANGUAGE plpgsql
+VOLATILE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_prune_workspace_invitations$
+DECLARE
+  pruned integer;
+BEGIN
+  -- Ended when accepted, revoked or, untouched, expired.
+  DELETE FROM slotlock.workspace_invitations finished
+   WHERE coalesce(finished.accepted_at, finished.revoked_at, finished.expires_at)
+         < statement_timestamp() - interval '30 days';
+  GET DIAGNOSTICS pruned = ROW_COUNT;
+  RETURN pruned;
+END
+$slotlock_prune_workspace_invitations$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[24]} FROM PUBLIC;
+
+-- Each dashboard session a person signed in with, for the Account page: when it began, when it was
+-- last seen (to five minutes), the browser and address it began from, and whether the person
+-- signed it out from another. Only a SHA-256 digest of the session's id is kept. Owner-only;
+-- reached through the functions below.
+CREATE TABLE IF NOT EXISTS slotlock.dashboard_sessions (
+  sid_sha256 bytea PRIMARY KEY,
+  person_ref text NOT NULL,
+  started_at timestamptz NOT NULL DEFAULT statement_timestamp(),
+  last_seen_at timestamptz NOT NULL DEFAULT statement_timestamp(),
+  expires_at timestamptz NOT NULL,
+  ended_at timestamptz,
+  user_agent text,
+  ip_address text,
+  CONSTRAINT slotlock_dashboard_sessions_valid CHECK (
+    octet_length(sid_sha256) = 32
+    AND person_ref ~ '^(github:[1-9][0-9]{0,19}|google:[A-Za-z0-9._-]{1,255}|sso:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$'
+    AND (user_agent IS NULL OR char_length(user_agent) BETWEEN 1 AND 256)
+    AND (ip_address IS NULL OR char_length(ip_address) BETWEEN 1 AND 64)
+    AND expires_at > started_at
+  )
+);
+CREATE INDEX IF NOT EXISTS slotlock_dashboard_sessions_person_idx
+  ON slotlock.dashboard_sessions (person_ref, last_seen_at DESC);
+ALTER TABLE slotlock.dashboard_sessions ENABLE ROW LEVEL SECURITY;
+REVOKE ALL ON slotlock.dashboard_sessions FROM PUBLIC;
+
+-- A session begun: recorded, and the person's expired ones dropped; at most 50 kept, newest first.
+CREATE OR REPLACE FUNCTION slotlock.dashboard_session_started(
+  requested_person text, requested_sid bytea, requested_expires timestamptz, requested_agent text,
+  requested_address text)
+RETURNS void
+LANGUAGE plpgsql
+VOLATILE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_dashboard_session_started$
+BEGIN
+  IF requested_person ~ '^sso:' THEN
+    PERFORM 1 FROM slotlock.sso_identities identity WHERE identity.person_ref = requested_person FOR SHARE;
+    IF NOT FOUND THEN
+      RAISE EXCEPTION 'Slotlock dashboard: that person is no longer here' USING ERRCODE = 'P0002';
+    END IF;
+  END IF;
+  INSERT INTO slotlock.dashboard_sessions (sid_sha256, person_ref, expires_at, user_agent, ip_address)
+  VALUES (requested_sid, requested_person, requested_expires,
+          NULLIF(left(requested_agent, 256), ''), NULLIF(left(requested_address, 64), ''))
+  ON CONFLICT ON CONSTRAINT dashboard_sessions_pkey DO NOTHING;
+  DELETE FROM slotlock.dashboard_sessions old
+   WHERE old.person_ref = requested_person
+     AND (old.expires_at <= statement_timestamp()
+          -- The 50 newest are kept, sessions through a team's provider alone going first: a
+          -- provider signing in as a linked member cannot push out the sessions they began.
+          OR old.sid_sha256 IN (SELECT kept.sid_sha256 FROM slotlock.dashboard_sessions kept
+                                 WHERE kept.person_ref = requested_person
+                                 ORDER BY (kept.sso_connection_id IS NULL) DESC, kept.started_at DESC OFFSET 50));
+END
+$slotlock_dashboard_session_started$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[25]} FROM PUBLIC;
+
+-- Whether the person's session may go on: recorded for them, not signed out from another device,
+-- not expired. A session with no record (one the 50 kept dropped, one from before these records)
+-- does not, so a session signed out stays out however many sign-ins follow. Noted seen at most
+-- every five minutes.
+CREATE OR REPLACE FUNCTION slotlock.dashboard_session_seen(requested_person text, requested_sid bytea)
+RETURNS boolean
+LANGUAGE plpgsql
+VOLATILE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_dashboard_session_seen$
+BEGIN
+  UPDATE slotlock.dashboard_sessions seen SET last_seen_at = statement_timestamp()
+   WHERE seen.sid_sha256 = requested_sid AND seen.person_ref = requested_person AND seen.ended_at IS NULL
+     AND seen.last_seen_at < statement_timestamp() - interval '5 minutes';
+  RETURN EXISTS (
+    SELECT 1 FROM slotlock.dashboard_sessions alive
+     WHERE alive.sid_sha256 = requested_sid AND alive.person_ref = requested_person
+       AND alive.ended_at IS NULL AND alive.expires_at > statement_timestamp());
+END
+$slotlock_dashboard_session_seen$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[26]} FROM PUBLIC;
+
+-- The person's sessions still going, most recently seen first.
+CREATE OR REPLACE FUNCTION slotlock.dashboard_sessions_of(requested_person text)
+RETURNS TABLE (sid_sha256 bytea, started_at timestamptz, last_seen_at timestamptz, expires_at timestamptz,
+               user_agent text, ip_address text)
+LANGUAGE plpgsql
+STABLE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_dashboard_sessions_of$
+BEGIN
+  RETURN QUERY SELECT kept.sid_sha256, kept.started_at, kept.last_seen_at, kept.expires_at, kept.user_agent,
+                      kept.ip_address
+    FROM slotlock.dashboard_sessions kept
+   WHERE kept.person_ref = requested_person AND kept.ended_at IS NULL
+     AND kept.expires_at > statement_timestamp()
+   ORDER BY kept.last_seen_at DESC
+   LIMIT 50;
+END
+$slotlock_dashboard_sessions_of$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[27]} FROM PUBLIC;
+
+-- Sign one of the person's sessions out (or, with no session, all of them): whether any was.
+CREATE OR REPLACE FUNCTION slotlock.dashboard_session_end(requested_person text, requested_sid bytea)
+RETURNS boolean
+LANGUAGE plpgsql
+VOLATILE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_dashboard_session_end$
+DECLARE
+  changed integer;
+BEGIN
+  UPDATE slotlock.dashboard_sessions ending SET ended_at = statement_timestamp()
+   WHERE ending.person_ref = requested_person AND ending.ended_at IS NULL
+     AND (requested_sid IS NULL OR ending.sid_sha256 = requested_sid);
+  GET DIAGNOSTICS changed = ROW_COUNT;
+  RETURN changed > 0;
+END
+$slotlock_dashboard_session_end$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[28]} FROM PUBLIC;
+
+-- Sessions that ended or expired more than a day ago: deleted.
+CREATE OR REPLACE FUNCTION slotlock.prune_dashboard_sessions()
+RETURNS integer
+LANGUAGE plpgsql
+VOLATILE
 SECURITY DEFINER
 SET search_path = pg_catalog, slotlock, pg_temp
-AS $slotlock_enabled_organizations$
-  SELECT org.org_id FROM slotlock.dashboard_organizations org
-   WHERE org.enabled
-     AND org.org_id = ANY (pg_catalog.string_to_array(requested_ids, ','));
-$slotlock_enabled_organizations$;
-REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[2]} FROM PUBLIC;
+AS $slotlock_prune_dashboard_sessions$
+DECLARE
+  pruned integer;
+BEGIN
+  DELETE FROM slotlock.dashboard_sessions old
+   WHERE least(coalesce(old.ended_at, 'infinity'), old.expires_at) < statement_timestamp() - interval '1 day';
+  GET DIAGNOSTICS pruned = ROW_COUNT;
+  RETURN pruned;
+END
+$slotlock_prune_dashboard_sessions$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[29]} FROM PUBLIC;
 
--- Turn Slotlock on for an organization; true when it was not on. Who may (an owner of it, read from
--- GitHub at sign-in) is the dashboard's to check.
-CREATE OR REPLACE FUNCTION slotlock.enable_organization(requested_org text, requested_login text, requested_by text)
-RETURNS boolean
+-- A team workspace being deleted: its keys stop at once, its people stay until it goes seven days
+-- later, and any Owner can cancel meanwhile. Its status and when it goes, held together.
+ALTER TABLE slotlock.workspaces ADD COLUMN IF NOT EXISTS delete_after timestamptz;
+DO $slotlock_workspaces_deleting$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+     WHERE conname = 'slotlock_workspaces_status_valid' AND conrelid = 'slotlock.workspaces'::regclass
+  ) THEN
+    ALTER TABLE slotlock.workspaces DROP CONSTRAINT IF EXISTS slotlock_workspaces_valid;
+    ALTER TABLE slotlock.workspaces ADD CONSTRAINT slotlock_workspaces_valid CHECK (
+      tenant_ref ~ '^team:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
+      AND handle ~ '^[a-z0-9]([a-z0-9-]{0,37}[a-z0-9])?$'
+      AND char_length(name) BETWEEN 1 AND 80
+      AND name !~ '[[:cntrl:]]'
+      AND (created_by IS NULL OR created_by ~ '^(github:[1-9][0-9]{0,19}|google:[A-Za-z0-9._-]{1,255}|sso:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$')
+    );
+    ALTER TABLE slotlock.workspaces ADD CONSTRAINT slotlock_workspaces_status_valid CHECK (
+      status IN ('active', 'deleting') AND (status = 'deleting') = (delete_after IS NOT NULL)
+    );
+  END IF;
+END
+$slotlock_workspaces_deleting$;
+
+-- Schedule a team's deletion, by an Owner who types its handle: refused while it has a subscription
+-- (cancelled first, as erase_tenant demands, so nobody is charged for a team that is gone).
+CREATE OR REPLACE FUNCTION slotlock.schedule_team_deletion(requested_tenant text, requested_actor text, requested_handle text)
+RETURNS text
 LANGUAGE plpgsql
 VOLATILE
 SECURITY DEFINER
 SET search_path = pg_catalog, slotlock, pg_temp
-AS $slotlock_enable_organization$
+AS $slotlock_schedule_team_deletion$
 DECLARE
-  was boolean;
+  team_handle text;
 BEGIN
-  SELECT org.enabled INTO was FROM slotlock.dashboard_organizations org
-   WHERE org.org_id = requested_org FOR UPDATE;
-  INSERT INTO slotlock.dashboard_organizations AS org (org_id, login, enabled, changed_by)
-  VALUES (requested_org, requested_login, true, requested_by)
-  ON CONFLICT (org_id) DO UPDATE
-    SET login = EXCLUDED.login, enabled = true,
-        changed_by = CASE WHEN org.enabled THEN org.changed_by ELSE EXCLUDED.changed_by END,
-        changed_at = CASE WHEN org.enabled THEN org.changed_at ELSE statement_timestamp() END;
-  RETURN was IS NOT TRUE;
+  SELECT ws.handle INTO team_handle FROM slotlock.workspaces ws
+   WHERE ws.tenant_ref = requested_tenant AND ws.status = 'active' FOR UPDATE;
+  IF team_handle IS NULL THEN
+    RETURN 'not_found';
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM slotlock.workspace_memberships member
+                  WHERE member.tenant_ref = requested_tenant AND member.person_ref = requested_actor
+                    AND member.status = 'active' AND member.role = 'owner') THEN
+    RETURN 'not_allowed';
+  END IF;
+  IF requested_handle IS DISTINCT FROM team_handle THEN
+    RETURN 'confirm';
+  END IF;
+  IF EXISTS (SELECT 1 FROM slotlock.tenant_plans paid
+              WHERE paid.tenant_ref = requested_tenant AND paid.stripe_subscription IS NOT NULL) THEN
+    RETURN 'subscription_live';
+  END IF;
+  UPDATE slotlock.workspaces ws SET status = 'deleting', delete_after = statement_timestamp() + interval '7 days'
+   WHERE ws.tenant_ref = requested_tenant;
+  RETURN NULL;
 END
-$slotlock_enable_organization$;
-REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[3]} FROM PUBLIC;
+$slotlock_schedule_team_deletion$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[30]} FROM PUBLIC;
 
--- Turn it off; true when it was on.
-CREATE OR REPLACE FUNCTION slotlock.disable_organization(requested_org text, requested_by text)
-RETURNS boolean
-LANGUAGE sql
+-- Cancel a team's deletion, by any of its Owners, before it goes.
+CREATE OR REPLACE FUNCTION slotlock.cancel_team_deletion(requested_tenant text, requested_actor text)
+RETURNS text
+LANGUAGE plpgsql
 VOLATILE
 SECURITY DEFINER
 SET search_path = pg_catalog, slotlock, pg_temp
-AS $slotlock_disable_organization$
-  UPDATE slotlock.dashboard_organizations org
-     SET enabled = false, changed_by = requested_by, changed_at = statement_timestamp()
-   WHERE org.org_id = requested_org AND org.enabled
-  RETURNING true;
-$slotlock_disable_organization$;
-REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[4]} FROM PUBLIC;
+AS $slotlock_cancel_team_deletion$
+BEGIN
+  PERFORM 1 FROM slotlock.workspaces ws WHERE ws.tenant_ref = requested_tenant AND ws.status = 'deleting' FOR UPDATE;
+  IF NOT FOUND THEN
+    RETURN 'not_found';
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM slotlock.workspace_memberships member
+                  WHERE member.tenant_ref = requested_tenant AND member.person_ref = requested_actor
+                    AND member.status = 'active' AND member.role = 'owner') THEN
+    RETURN 'not_allowed';
+  END IF;
+  UPDATE slotlock.workspaces ws SET status = 'active', delete_after = NULL WHERE ws.tenant_ref = requested_tenant;
+  RETURN NULL;
+END
+$slotlock_cancel_team_deletion$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[31]} FROM PUBLIC;
+
+-- Erase the teams whose seven days have passed, live and test, each on its own. One with a
+-- subscription is left until it is cancelled; one that fails otherwise is tried again a day later,
+-- so neither holds up the rest. How many went.
+CREATE OR REPLACE FUNCTION slotlock.erase_deleted_teams()
+RETURNS integer
+LANGUAGE plpgsql
+VOLATILE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_erase_deleted_teams$
+DECLARE
+  due text;
+  erased integer := 0;
+BEGIN
+  FOR due IN
+    SELECT ws.tenant_ref FROM slotlock.workspaces ws
+     WHERE ws.status = 'deleting' AND ws.delete_after <= statement_timestamp()
+       AND NOT EXISTS (SELECT 1 FROM slotlock.tenant_plans billed
+                        WHERE billed.tenant_ref = ws.tenant_ref AND billed.stripe_subscription IS NOT NULL)
+     ORDER BY ws.delete_after
+     LIMIT 20
+  LOOP
+    BEGIN
+      -- Read again, and locked, as it is now: a team an Owner kept since the list was read (while
+      -- an earlier one was being erased) is left, and keeping it waits for this erasure to finish.
+      PERFORM 1 FROM slotlock.workspaces ws
+       WHERE ws.tenant_ref = due AND ws.status = 'deleting' AND ws.delete_after <= statement_timestamp()
+       FOR UPDATE;
+      IF FOUND THEN
+        PERFORM * FROM slotlock.erase_tenant(due || '~test');
+        PERFORM * FROM slotlock.erase_tenant(due);
+        erased := erased + 1;
+      END IF;
+    EXCEPTION WHEN OTHERS THEN
+      UPDATE slotlock.workspaces ws SET delete_after = statement_timestamp() + interval '1 day'
+       WHERE ws.tenant_ref = due AND ws.status = 'deleting';
+      RAISE WARNING 'Slotlock could not erase deleted team %, trying again in a day: %', due, SQLERRM;
+    END;
+  END LOOP;
+  RETURN erased;
+END
+$slotlock_erase_deleted_teams$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[32]} FROM PUBLIC;
+
+-- When a team being deleted goes, or null.
+CREATE OR REPLACE FUNCTION slotlock.workspace_delete_after(requested_tenant text)
+RETURNS timestamptz
+LANGUAGE plpgsql
+STABLE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_workspace_delete_after$
+BEGIN
+  RETURN (SELECT ws.delete_after FROM slotlock.workspaces ws
+           WHERE ws.tenant_ref = pg_catalog.regexp_replace(requested_tenant, '~test$', ''));
+END
+$slotlock_workspace_delete_after$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[33]} FROM PUBLIC;
 `;
 // The schema's version: one row, written by the DDL itself, so running SLOTLOCK_CORE_DDL directly
 // is versioned too. applySchema adds digests of the DDL and catalog so a later no-op migration can
@@ -1897,6 +3335,9 @@ DECLARE
   setting text;
   previous jsonb := '{}'::jsonb;
   tested record;
+  cleared_rows bigint;
+  sso_people text[] := ARRAY[]::text[];
+  departing text;
 BEGIN
   IF requested_tenant_ref IS NULL OR octet_length(requested_tenant_ref) NOT BETWEEN 1 AND 500 THEN
     RAISE EXCEPTION 'Slotlock tenant reference must be 1-500 UTF-8 bytes'
@@ -1914,6 +3355,26 @@ BEGIN
     RAISE EXCEPTION 'Slotlock tenant has a live subscription: cancel it before erasing the tenant'
       USING ERRCODE = 'object_in_use', HINT = 'billing_active';
   END IF;
+  -- Erasing a person never takes other people's workspace with it: a team's only Owner hands it
+  -- on, or deletes it, first. The teams they own are locked first, as every change to a team's
+  -- people locks it, so an Owner leaving meanwhile waits, and this check sees what it left.
+  PERFORM 1 FROM slotlock.workspaces ws
+   WHERE ws.tenant_ref IN (SELECT mine.tenant_ref FROM slotlock.workspace_memberships mine
+                            WHERE mine.person_ref = requested_tenant_ref AND mine.status = 'active'
+                              AND mine.role = 'owner')
+   ORDER BY ws.tenant_ref
+   FOR UPDATE;
+  IF requested_tenant_ref ~ '^(github:[1-9][0-9]{0,19}|google:[A-Za-z0-9._-]{1,255}|sso:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$' AND EXISTS (
+    SELECT 1 FROM slotlock.workspace_memberships mine
+      JOIN slotlock.workspaces ws ON ws.tenant_ref = mine.tenant_ref AND ws.status = 'active'
+     WHERE mine.person_ref = requested_tenant_ref AND mine.status = 'active' AND mine.role = 'owner'
+       AND NOT EXISTS (SELECT 1 FROM slotlock.workspace_memberships other
+                        WHERE other.tenant_ref = mine.tenant_ref AND other.status = 'active'
+                          AND other.role = 'owner' AND other.person_ref <> mine.person_ref)
+  ) THEN
+    RAISE EXCEPTION 'Slotlock person is the only owner of a team workspace: make another owner, or delete it, first'
+      USING ERRCODE = 'object_in_use', HINT = 'sole_owner';
+  END IF;
   FOR setting IN
     SELECT DISTINCT contract.tenant_context_setting FROM slotlock.rls_policy_contracts contract
   LOOP
@@ -1984,6 +3445,14 @@ BEGIN
   DELETE FROM slotlock.source_busy WHERE tenant_ref = requested_tenant_ref;
   GET DIAGNOSTICS erased_rows = ROW_COUNT;
   RETURN NEXT;
+  erased_table := 'tenant_export_parts';
+  DELETE FROM slotlock.tenant_export_parts WHERE tenant_ref = requested_tenant_ref;
+  GET DIAGNOSTICS erased_rows = ROW_COUNT;
+  RETURN NEXT;
+  erased_table := 'tenant_exports';
+  DELETE FROM slotlock.tenant_exports WHERE tenant_ref = requested_tenant_ref;
+  GET DIAGNOSTICS erased_rows = ROW_COUNT;
+  RETURN NEXT;
   erased_table := 'reservations';
   DELETE FROM slotlock.reservations
    WHERE tenant_ref = requested_tenant_ref
@@ -2071,6 +3540,10 @@ BEGIN
   DELETE FROM slotlock.assistant_chats WHERE tenant_ref = requested_tenant_ref;
   GET DIAGNOSTICS erased_rows = ROW_COUNT;
   RETURN NEXT;
+  erased_table := 'audit_events';
+  DELETE FROM slotlock.audit_events WHERE tenant_ref = requested_tenant_ref;
+  GET DIAGNOSTICS erased_rows = ROW_COUNT;
+  RETURN NEXT;
   erased_table := 'assistant_settings';
   DELETE FROM slotlock.assistant_settings WHERE tenant_ref = requested_tenant_ref;
   GET DIAGNOSTICS erased_rows = ROW_COUNT;
@@ -2153,6 +3626,124 @@ BEGIN
   )
   SELECT count(*) INTO erased_rows FROM erased;
   RETURN NEXT;
+  -- A team's directory goes with it; a person comes off the directory users bound to them.
+  erased_table := 'scim_users';
+  DELETE FROM slotlock.scim_users directory WHERE directory.tenant_ref = requested_tenant_ref;
+  GET DIAGNOSTICS erased_rows = ROW_COUNT;
+  IF requested_tenant_ref ~ '^(github:[1-9][0-9]{0,19}|google:[A-Za-z0-9._-]{1,255}|sso:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$' THEN
+    UPDATE slotlock.scim_users directory SET person_ref = NULL WHERE directory.person_ref = requested_tenant_ref;
+    GET DIAGNOSTICS cleared_rows = ROW_COUNT;
+    erased_rows := erased_rows + cleared_rows;
+  END IF;
+  RETURN NEXT;
+  erased_table := 'scim_groups';
+  DELETE FROM slotlock.scim_groups grouped WHERE grouped.tenant_ref = requested_tenant_ref;
+  GET DIAGNOSTICS erased_rows = ROW_COUNT;
+  RETURN NEXT;
+  erased_table := 'scim_tokens';
+  DELETE FROM slotlock.scim_tokens token WHERE token.tenant_ref = requested_tenant_ref;
+  GET DIAGNOSTICS erased_rows = ROW_COUNT;
+  IF requested_tenant_ref ~ '^(github:[1-9][0-9]{0,19}|google:[A-Za-z0-9._-]{1,255}|sso:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$' THEN
+    UPDATE slotlock.scim_tokens token SET created_by = NULL WHERE token.created_by = requested_tenant_ref;
+    GET DIAGNOSTICS cleared_rows = ROW_COUNT;
+    erased_rows := erased_rows + cleared_rows;
+  END IF;
+  RETURN NEXT;
+  -- A team's single sign-on goes with it (its identities, mappings, proofs and the sessions signed in
+  -- through it alone with the connection); a person takes their identities, and their bypasses.
+  erased_table := 'sso_bypasses';
+  DELETE FROM slotlock.sso_bypasses bypass
+   WHERE bypass.tenant_ref = requested_tenant_ref OR bypass.person_ref = requested_tenant_ref;
+  GET DIAGNOSTICS erased_rows = ROW_COUNT;
+  RETURN NEXT;
+  -- Who signed in only through the team's provider: erased below, with no way in left.
+  IF requested_tenant_ref ~ '^team:' THEN
+    SELECT coalesce(array_agg(DISTINCT identity.person_ref), ARRAY[]::text[]) INTO sso_people
+      FROM slotlock.sso_identities identity
+      JOIN slotlock.sso_connections linked ON linked.id = identity.connection_id AND linked.tenant_ref = requested_tenant_ref
+     WHERE identity.person_ref ~ '^sso:';
+  END IF;
+  erased_table := 'sso_identities';
+  DELETE FROM slotlock.sso_identities identity
+   WHERE identity.person_ref = requested_tenant_ref
+      OR identity.connection_id IN (SELECT linked.id FROM slotlock.sso_connections linked WHERE linked.tenant_ref = requested_tenant_ref);
+  GET DIAGNOSTICS erased_rows = ROW_COUNT;
+  RETURN NEXT;
+  erased_table := 'sso_connections';
+  DELETE FROM slotlock.sso_connections linked WHERE linked.tenant_ref = requested_tenant_ref;
+  GET DIAGNOSTICS erased_rows = ROW_COUNT;
+  IF requested_tenant_ref ~ '^(github:[1-9][0-9]{0,19}|google:[A-Za-z0-9._-]{1,255}|sso:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$' THEN
+    UPDATE slotlock.sso_connections linked SET created_by = NULL WHERE linked.created_by = requested_tenant_ref;
+    GET DIAGNOSTICS cleared_rows = ROW_COUNT;
+    erased_rows := erased_rows + cleared_rows;
+    -- What a test sign-in showed (the tester's email among it) goes with the tester.
+    UPDATE slotlock.sso_connections linked SET last_test_claims = NULL, tested_by = NULL
+     WHERE linked.tested_by = requested_tenant_ref;
+    GET DIAGNOSTICS cleared_rows = ROW_COUNT;
+    erased_rows := erased_rows + cleared_rows;
+  END IF;
+  RETURN NEXT;
+  -- A team's requests to join and domains go with it; a person's own tenant takes their requests,
+  -- and their name off the domains they claimed and the requests they decided.
+  erased_table := 'workspace_join_requests';
+  DELETE FROM slotlock.workspace_join_requests asked
+   WHERE asked.tenant_ref = requested_tenant_ref
+      OR (requested_tenant_ref ~ '^(github:[1-9][0-9]{0,19}|google:[A-Za-z0-9._-]{1,255}|sso:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$'
+          AND asked.person_ref = requested_tenant_ref);
+  GET DIAGNOSTICS erased_rows = ROW_COUNT;
+  IF requested_tenant_ref ~ '^(github:[1-9][0-9]{0,19}|google:[A-Za-z0-9._-]{1,255}|sso:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$' THEN
+    UPDATE slotlock.workspace_join_requests asked SET decided_by = NULL WHERE asked.decided_by = requested_tenant_ref;
+    GET DIAGNOSTICS cleared_rows = ROW_COUNT;
+    erased_rows := erased_rows + cleared_rows;
+  END IF;
+  RETURN NEXT;
+  erased_table := 'workspace_join_blocks';
+  DELETE FROM slotlock.workspace_join_blocks blocked WHERE blocked.tenant_ref = requested_tenant_ref;
+  GET DIAGNOSTICS erased_rows = ROW_COUNT;
+  RETURN NEXT;
+  erased_table := 'workspace_domains';
+  DELETE FROM slotlock.workspace_domains claim WHERE claim.tenant_ref = requested_tenant_ref;
+  GET DIAGNOSTICS erased_rows = ROW_COUNT;
+  IF requested_tenant_ref ~ '^(github:[1-9][0-9]{0,19}|google:[A-Za-z0-9._-]{1,255}|sso:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$' THEN
+    UPDATE slotlock.workspace_domains claim SET created_by = NULL WHERE claim.created_by = requested_tenant_ref;
+    GET DIAGNOSTICS cleared_rows = ROW_COUNT;
+    erased_rows := erased_rows + cleared_rows;
+  END IF;
+  RETURN NEXT;
+  -- A team workspace's record and invitations go with it.
+  erased_table := 'workspace_invitations';
+  DELETE FROM slotlock.workspace_invitations invitation
+   WHERE invitation.tenant_ref = requested_tenant_ref
+      OR (requested_tenant_ref ~ '^(github:[1-9][0-9]{0,19}|google:[A-Za-z0-9._-]{1,255}|sso:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$'
+          AND (invitation.inviter_ref = requested_tenant_ref OR invitation.accepted_by = requested_tenant_ref));
+  GET DIAGNOSTICS erased_rows = ROW_COUNT;
+  RETURN NEXT;
+  erased_table := 'workspaces';
+  DELETE FROM slotlock.workspaces ws WHERE ws.tenant_ref = requested_tenant_ref;
+  GET DIAGNOSTICS erased_rows = ROW_COUNT;
+  IF requested_tenant_ref ~ '^(github:[1-9][0-9]{0,19}|google:[A-Za-z0-9._-]{1,255}|sso:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$' THEN
+    UPDATE slotlock.workspaces ws SET created_by = NULL WHERE ws.created_by = requested_tenant_ref;
+    GET DIAGNOSTICS cleared_rows = ROW_COUNT;
+    erased_rows := erased_rows + cleared_rows;
+  END IF;
+  RETURN NEXT;
+  -- A shared workspace's members go with it; a person's own tenant takes their memberships of
+  -- every workspace, and their record of signing in, with it.
+  erased_table := 'workspace_memberships';
+  DELETE FROM slotlock.workspace_memberships member
+   WHERE member.tenant_ref = requested_tenant_ref
+      OR (requested_tenant_ref ~ '^(github:[1-9][0-9]{0,19}|google:[A-Za-z0-9._-]{1,255}|sso:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$'
+          AND member.person_ref = requested_tenant_ref);
+  GET DIAGNOSTICS erased_rows = ROW_COUNT;
+  RETURN NEXT;
+  erased_table := 'dashboard_sessions';
+  DELETE FROM slotlock.dashboard_sessions session_kept WHERE session_kept.person_ref = requested_tenant_ref;
+  GET DIAGNOSTICS erased_rows = ROW_COUNT;
+  RETURN NEXT;
+  erased_table := 'dashboard_people';
+  DELETE FROM slotlock.dashboard_people person WHERE person.person_ref = requested_tenant_ref;
+  GET DIAGNOSTICS erased_rows = ROW_COUNT;
+  RETURN NEXT;
   -- An organization's record of being turned on goes with its tenant (Teams on Cloud).
   erased_table := 'dashboard_organizations';
   DELETE FROM slotlock.dashboard_organizations org
@@ -2194,6 +3785,22 @@ BEGIN
   FOR setting IN SELECT jsonb_object_keys(previous) LOOP
     PERFORM set_config(setting, coalesce(previous ->> setting, ''), true);
   END LOOP;
+
+  -- The people who signed in only through the erased team's provider (sso:), reported as one line:
+  -- they were members of no other team, and can no longer sign in to ask for their own erasure.
+  IF cardinality(sso_people) > 0 THEN
+    erased_table := 'sso_people';
+    erased_rows := 0;
+    FOREACH departing IN ARRAY sso_people LOOP
+      IF NOT EXISTS (SELECT 1 FROM slotlock.workspace_memberships other
+                      WHERE other.person_ref = departing AND other.status = 'active')
+         AND NOT EXISTS (SELECT 1 FROM slotlock.sso_identities other WHERE other.person_ref = departing) THEN
+        PERFORM 1 FROM slotlock.erase_tenant(departing);
+        erased_rows := erased_rows + 1;
+      END IF;
+    END LOOP;
+    RETURN NEXT;
+  END IF;
 END
 $slotlock_erase_tenant$;
 REVOKE ALL ON FUNCTION ${SLOTLOCK_TENANT_ADMIN_FUNCTIONS[1]} FROM PUBLIC;
@@ -2241,7 +3848,8 @@ BEGIN
     'calendar_event_occurrences', 'composite_claims', 'approvals', 'approval_policies',
     'availability_exceptions', 'holiday_calendars', 'availability_defaults', 'contacts', 'reminder_dispatches',
     'reservation_reminder_dispatches',
-    'hold_payments', 'source_busy', 'calendar_events', 'calendar_event_tombstones', 'calendar_event_commands',
+    'hold_payments', 'source_busy', 'tenant_export_parts', 'tenant_exports',
+    'calendar_events', 'calendar_event_tombstones', 'calendar_event_commands',
     'reservation_tombstones', 'reservation_conflict_archive', 'calendar_coverage', 'hold_commands',
     'waitlist_entries', 'booking_rule_defaults', 'pool_settings', 'resource_group_members',
     'resources', 'resource_groups', 'outbox'
@@ -3113,6 +4721,300 @@ SELECT moved.tenant_ref, moved.member_ref,
   ) first_user ON true
 ON CONFLICT DO NOTHING;
 
+-- A workspace's audit log: who did what to its people, keys, webhooks, billing and settings, from
+-- where, and whether it was refused. Not the change feed: that keeps 30 days and goes to the
+-- tenant's webhooks; this keeps SLOTLOCK_AUDIT_RETENTION_DAYS (180) and goes nowhere. The serving
+-- role may only add and read rows (no UPDATE, DELETE or TRUNCATE): an event once written stays as
+-- it was until slotlock.prune_audit_events, or erasure, takes it. Names are never stored, only
+-- references (github:<id>, api_key:<id>), resolved when the log is read.
+CREATE TABLE IF NOT EXISTS slotlock.audit_events (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_ref text NOT NULL,
+  occurred_at timestamptz NOT NULL DEFAULT statement_timestamp(),
+  action text NOT NULL,
+  actor_type text NOT NULL,
+  actor_ref text NOT NULL,
+  actor_role text,
+  target_type text,
+  target_ref text,
+  outcome text NOT NULL DEFAULT 'success',
+  reason text,
+  ip_address text,
+  user_agent text,
+  metadata jsonb NOT NULL DEFAULT '{}'::jsonb,
+  CONSTRAINT slotlock_audit_events_valid CHECK (
+    octet_length(tenant_ref) BETWEEN 1 AND 500
+    AND action ~ '^[a-z][a-z_]{0,31}(\\.[a-z][a-z_]{0,31}){1,2}$'
+    AND actor_type IN ('person', 'api_key', 'assistant', 'system')
+    AND octet_length(actor_ref) BETWEEN 1 AND 500
+    AND (actor_role IS NULL OR actor_role IN ('owner', 'admin', 'developer', 'member', 'viewer', 'billing'))
+    AND (target_type IS NULL OR target_type ~ '^[a-z][a-z_]{0,31}$')
+    AND (target_ref IS NULL OR octet_length(target_ref) BETWEEN 1 AND 500)
+    AND outcome IN ('success', 'denied')
+    AND (reason IS NULL OR octet_length(reason) BETWEEN 1 AND 200)
+    AND (ip_address IS NULL OR octet_length(ip_address) BETWEEN 1 AND 64)
+    AND (user_agent IS NULL OR octet_length(user_agent) BETWEEN 1 AND 256)
+    AND jsonb_typeof(metadata) = 'object'
+    AND pg_column_size(metadata) <= 4096
+  )
+);
+CREATE INDEX IF NOT EXISTS slotlock_audit_events_recent_idx
+  ON slotlock.audit_events (tenant_ref, occurred_at DESC, id);
+
+-- Each tenant's events form a chain: each holds the SHA-256 of the one before it with its own
+-- content, numbered in the order they were written. Rewriting, removing or reordering an event
+-- (which the serving role cannot do, but an owner of the database could) breaks every hash after
+-- it, and slotlock.verify_audit_chain says where. Events from before the chain have none.
+ALTER TABLE slotlock.audit_events ADD COLUMN IF NOT EXISTS chain_index bigint;
+ALTER TABLE slotlock.audit_events ADD COLUMN IF NOT EXISTS prev_hash bytea;
+ALTER TABLE slotlock.audit_events ADD COLUMN IF NOT EXISTS hash bytea;
+CREATE UNIQUE INDEX IF NOT EXISTS slotlock_audit_events_chain_idx
+  ON slotlock.audit_events (tenant_ref, chain_index);
+
+-- An event as its hash covers it: every field, in a fixed order, separated by the unit separator.
+CREATE OR REPLACE FUNCTION slotlock.audit_event_text(event slotlock.audit_events)
+RETURNS text
+LANGUAGE sql
+STABLE
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_audit_event_text$
+  SELECT concat_ws(chr(31), event.tenant_ref, event.chain_index::text, event.id::text,
+                   (extract(epoch FROM event.occurred_at) * 1000000)::bigint::text, event.action,
+                   event.actor_type, event.actor_ref, coalesce(event.actor_role, ''),
+                   coalesce(event.target_type, ''), coalesce(event.target_ref, ''), event.outcome,
+                   coalesce(event.reason, ''), coalesce(event.ip_address, ''),
+                   coalesce(event.user_agent, ''), event.metadata::text);
+$slotlock_audit_event_text$;
+
+-- Before each insert: the tenant's chain one writer at a time, the event numbered after the last
+-- and hashed with it.
+CREATE OR REPLACE FUNCTION slotlock.chain_audit_event()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_chain_audit_event$
+DECLARE
+  last_index bigint;
+  last_hash bytea;
+BEGIN
+  PERFORM pg_advisory_xact_lock(hashtextextended('slotlock:audit-chain:' || NEW.tenant_ref, 0));
+  SELECT kept.chain_index, kept.hash INTO last_index, last_hash FROM slotlock.audit_events kept
+   WHERE kept.tenant_ref = NEW.tenant_ref AND kept.chain_index IS NOT NULL
+   ORDER BY kept.chain_index DESC LIMIT 1;
+  -- The time is the database's, whatever the insert said: an event dated in the past would have
+  -- retention take the events after it.
+  NEW.occurred_at := statement_timestamp();
+  NEW.chain_index := coalesce(last_index, 0) + 1;
+  NEW.prev_hash := last_hash;
+  NEW.hash := sha256(coalesce(last_hash, ''::bytea) || convert_to(slotlock.audit_event_text(NEW), 'UTF8'));
+  RETURN NEW;
+END
+$slotlock_chain_audit_event$;
+DROP TRIGGER IF EXISTS slotlock_audit_events_chain ON slotlock.audit_events;
+CREATE TRIGGER slotlock_audit_events_chain BEFORE INSERT ON slotlock.audit_events
+  FOR EACH ROW EXECUTE FUNCTION slotlock.chain_audit_event();
+
+-- Whether a tenant's chain holds, from its oldest event kept: how many events it checked, and the
+-- first whose number, link or hash is wrong (null when none is). Run as the serving role, under
+-- the tenant's own row security.
+CREATE OR REPLACE FUNCTION slotlock.verify_audit_chain(requested_tenant text)
+RETURNS TABLE (checked bigint, broken_at bigint)
+LANGUAGE plpgsql
+STABLE
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_verify_audit_chain$
+DECLARE
+  event slotlock.audit_events;
+  expected_index bigint;
+  expected_prev bytea;
+  seen bigint := 0;
+  loose_at timestamptz;
+BEGIN
+  -- An event with no place in the chain, written after the chain began, was taken off it: broken
+  -- where it stood, the first chained event after it (or past the last).
+  SELECT min(loose.occurred_at) INTO loose_at FROM slotlock.audit_events loose
+   WHERE loose.tenant_ref = requested_tenant AND loose.chain_index IS NULL
+     AND loose.occurred_at >= (SELECT min(first.occurred_at) FROM slotlock.audit_events first
+                                WHERE first.tenant_ref = requested_tenant AND first.chain_index IS NOT NULL);
+  IF loose_at IS NOT NULL THEN
+    RETURN QUERY SELECT 0::bigint, coalesce(
+      (SELECT min(after.chain_index) FROM slotlock.audit_events after
+        WHERE after.tenant_ref = requested_tenant AND after.chain_index IS NOT NULL AND after.occurred_at > loose_at),
+      (SELECT max(last.chain_index) + 1 FROM slotlock.audit_events last WHERE last.tenant_ref = requested_tenant));
+    RETURN;
+  END IF;
+  FOR event IN
+    SELECT * FROM slotlock.audit_events kept
+     WHERE kept.tenant_ref = requested_tenant AND kept.chain_index IS NOT NULL
+     ORDER BY kept.chain_index
+  LOOP
+    IF (seen > 0 AND (event.chain_index <> expected_index OR event.prev_hash IS DISTINCT FROM expected_prev))
+       OR event.hash IS DISTINCT FROM
+          sha256(coalesce(event.prev_hash, ''::bytea) || convert_to(slotlock.audit_event_text(event), 'UTF8')) THEN
+      RETURN QUERY SELECT seen, event.chain_index;
+      RETURN;
+    END IF;
+    seen := seen + 1;
+    expected_index := event.chain_index + 1;
+    expected_prev := event.hash;
+  END LOOP;
+  RETURN QUERY SELECT seen, NULL::bigint;
+END
+$slotlock_verify_audit_chain$;
+
+-- A tenant's events past retention. The serving role cannot delete audit events itself: this is
+-- the one way they go, besides erasure, and it reaches only events retention has ended.
+CREATE OR REPLACE FUNCTION slotlock.prune_audit_events(requested_tenant text)
+RETURNS integer
+LANGUAGE plpgsql
+VOLATILE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_prune_audit_events$
+DECLARE
+  pruned integer;
+  kept_days integer;
+BEGIN
+  -- SLOTLOCK_AUDIT_RETENTION_DAYS, or the plan's change history if longer (Team's 400 days).
+  kept_days := greatest(${SLOTLOCK_AUDIT_RETENTION_DAYS}, coalesce(${planChangeRetentionDaysSql('requested_tenant')}, 0));
+  -- The start of the chain only, so what is kept still links up: every event up to the last one
+  -- written before retention's cut, and events from before the chain past it.
+  DELETE FROM slotlock.audit_events gone
+   WHERE gone.tenant_ref = requested_tenant
+     AND ((gone.chain_index IS NULL
+           AND gone.occurred_at < statement_timestamp() - make_interval(days => kept_days))
+          OR gone.chain_index <= (
+            SELECT max(old.chain_index) FROM slotlock.audit_events old
+             WHERE old.tenant_ref = requested_tenant
+               AND old.occurred_at < statement_timestamp() - make_interval(days => kept_days)));
+  GET DIAGNOSTICS pruned = ROW_COUNT;
+  RETURN pruned;
+END
+$slotlock_prune_audit_events$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_DASHBOARD_FUNCTIONS[8]} FROM PUBLIC;
+
+-- A tenant's changes past retention (RFC 0004 D2). The serving role cannot change or delete a
+-- change itself: this is the one way they go, besides erasure. It keeps the store's days
+-- (requested_days, 1 to 3650), or the plan's (SLOTLOCK_CHANGE_RETENTION_BY_PLAN) if longer, so a
+-- serving role cannot cut a hosted tenant's history short. Oldest first in feed order, and only up
+-- to the first change kept (within retention, still owed to an enabled webhook, or later than the
+-- oldest running transaction), so every kept change is after every pruned one and a reader starting
+-- over reads past the gap.
+CREATE OR REPLACE FUNCTION slotlock.prune_changes(requested_tenant text, batch integer, requested_days integer)
+RETURNS integer
+LANGUAGE plpgsql
+VOLATILE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_prune_changes$
+DECLARE
+  kept_days integer;
+  pruned integer;
+BEGIN
+  IF batch IS NULL OR batch < 1 OR batch > 10000 OR requested_days IS NULL OR requested_days < 1
+     OR requested_days > 3650 THEN
+    RAISE EXCEPTION 'Slotlock prunes 1 to 10000 changes at a time, keeping 1 to 3650 days'
+      USING ERRCODE = 'invalid_parameter_value';
+  END IF;
+  -- A role that cannot delete changes itself (the serving role) acts only for the tenant it
+  -- acts in, where row security names one: the function runs as the schema's owner, which row
+  -- security may not bind. The owner, or a library on its connection, needs no tenant context.
+  IF NOT pg_catalog.has_table_privilege(session_user, 'slotlock.outbox', 'DELETE')
+     AND EXISTS (SELECT 1 FROM slotlock.rls_policy_contracts)
+     AND NOT EXISTS (SELECT 1 FROM slotlock.rls_policy_contracts contract
+                      WHERE current_setting(contract.tenant_context_setting, true) = requested_tenant) THEN
+    RAISE EXCEPTION 'Slotlock prunes the history of only the tenant the caller acts in'
+      USING ERRCODE = 'insufficient_privilege';
+  END IF;
+  kept_days := greatest(requested_days, coalesce(${planChangeRetentionDaysSql('requested_tenant')}, 0));
+  WITH head AS MATERIALIZED (
+    SELECT outbox.id, outbox.txid,
+           outbox.occurred_at >= now() - make_interval(days => kept_days)
+           OR EXISTS (
+             SELECT 1 FROM slotlock.webhook_endpoints endpoint
+              WHERE endpoint.tenant_ref = outbox.tenant_ref AND endpoint.disabled_at IS NULL
+                AND (outbox.txid, outbox.id) > (endpoint.cursor_txid, endpoint.cursor_id)
+           ) AS kept
+      FROM slotlock.outbox
+     WHERE outbox.tenant_ref = requested_tenant
+       AND outbox.txid < pg_snapshot_xmin(pg_current_snapshot())
+     ORDER BY outbox.txid, outbox.id
+     LIMIT batch
+  ), doomed AS MATERIALIZED (
+    SELECT change.id, change.txid FROM head change
+     WHERE NOT EXISTS (
+       SELECT 1 FROM head keeper
+        WHERE keeper.kept AND (keeper.txid, keeper.id) <= (change.txid, change.id))
+  ), missed AS (
+    -- A disabled endpoint that had not received one of them has lost it.
+    UPDATE slotlock.webhook_endpoints endpoint SET changes_pruned = true
+     WHERE endpoint.tenant_ref = requested_tenant AND endpoint.disabled_at IS NOT NULL
+       AND NOT endpoint.changes_pruned
+       AND EXISTS (
+         SELECT 1 FROM doomed
+          WHERE (doomed.txid, doomed.id) > (endpoint.cursor_txid, endpoint.cursor_id))
+  ), deleted AS (
+    DELETE FROM slotlock.outbox change USING doomed WHERE change.id = doomed.id RETURNING 1
+  )
+  SELECT count(*)::integer INTO pruned FROM deleted;
+  RETURN pruned;
+END
+$slotlock_prune_changes$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_TENANT_ADMIN_FUNCTIONS[21]} FROM PUBLIC;
+
+-- Taking one person out of a tenant's change history (RFC 0004 D3, slotlock subject erase): the
+-- one edit it allows. A holder's reference and a booking's reference become \`replacement\` (an
+-- \`erased-\` name, the same one everywhere the erasure reached, so what was one booking still reads
+-- as one), and a contact's reference is taken off. Nothing else in a change is touched, and the
+-- serving role can write nothing but such a name. Row security keeps it to the caller's tenant.
+CREATE OR REPLACE FUNCTION slotlock.erase_subject_changes(
+  requested_tenant text, kind text, erased text, replacement text
+)
+RETURNS integer
+LANGUAGE plpgsql
+VOLATILE
+SECURITY DEFINER
+SET search_path = pg_catalog, slotlock, pg_temp
+AS $slotlock_erase_subject_changes$
+DECLARE
+  changed integer;
+BEGIN
+  IF kind IS NULL OR kind NOT IN ('holder', 'contact', 'reference')
+     OR erased IS NULL OR octet_length(erased) NOT BETWEEN 1 AND 500
+     OR (kind <> 'contact' AND (replacement IS NULL OR replacement !~ '^erased-[0-9a-f]{32}$')) THEN
+    RAISE EXCEPTION 'Slotlock erases a holder, a contact or a reference from the history, and names it erased-<32 hex>'
+      USING ERRCODE = 'invalid_parameter_value';
+  END IF;
+  -- A role that cannot update changes itself (the serving role) acts only for the tenant it
+  -- acts in, where row security names one: the function runs as the schema's owner, which row
+  -- security may not bind. The owner, or a library on its connection, needs no tenant context.
+  IF NOT pg_catalog.has_table_privilege(session_user, 'slotlock.outbox', 'UPDATE')
+     AND EXISTS (SELECT 1 FROM slotlock.rls_policy_contracts)
+     AND NOT EXISTS (SELECT 1 FROM slotlock.rls_policy_contracts contract
+                      WHERE current_setting(contract.tenant_context_setting, true) = requested_tenant) THEN
+    RAISE EXCEPTION 'Slotlock erases from the history of only the tenant the caller acts in'
+      USING ERRCODE = 'insufficient_privilege';
+  END IF;
+  IF kind = 'holder' THEN
+    UPDATE slotlock.outbox change
+       SET data = pg_catalog.jsonb_set(change.data, '{holder_ref}', pg_catalog.to_jsonb(replacement))
+     WHERE change.tenant_ref = requested_tenant AND change.data ->> 'holder_ref' = erased;
+  ELSIF kind = 'contact' THEN
+    UPDATE slotlock.outbox change SET data = change.data - 'contact_ref'
+     WHERE change.tenant_ref = requested_tenant AND change.data ->> 'contact_ref' = erased;
+  ELSE
+    -- A booking's changes are named by its reference and carry it.
+    UPDATE slotlock.outbox change
+       SET subject = CASE WHEN change.subject = erased THEN replacement ELSE change.subject END,
+           data = pg_catalog.jsonb_set(change.data, '{reference}', pg_catalog.to_jsonb(replacement))
+     WHERE change.tenant_ref = requested_tenant AND change.data ->> 'reference' = erased;
+  END IF;
+  GET DIAGNOSTICS changed = ROW_COUNT;
+  RETURN changed;
+END
+$slotlock_erase_subject_changes$;
+REVOKE ALL ON FUNCTION ${SLOTLOCK_TENANT_ADMIN_FUNCTIONS[22]} FROM PUBLIC;
+
 -- The tenant a reservation row belongs to: its own, or (a hold) its resource's.
 CREATE OR REPLACE FUNCTION slotlock.outbox_reservation_change()
 RETURNS trigger
@@ -3178,6 +5080,15 @@ BEGIN
       'contact_ref', changed.contact_ref,
       'notify', CASE WHEN NOT changed.notify THEN false END,
       'payment_required', CASE WHEN changed.payment_required THEN true END,
+      -- A paid hold that ended without a booking (expired, let go, or left when another of its
+      -- group was booked): its payment was never applied, and is the integrator's to refund (RFC
+      -- 0004 C3). Booked from (slotlock.ending = 'confirmed') or taken over by an approval, it was.
+      'payment_unapplied', CASE
+        WHEN TG_OP = 'DELETE' AND OLD.status = 'held' AND OLD.payment_ref IS NOT NULL
+             AND COALESCE(current_setting('slotlock.ending', true), '') NOT IN ('confirmed', 'approval')
+        THEN jsonb_strip_nulls(jsonb_build_object(
+          'payment_ref', OLD.payment_ref, 'amount_minor', OLD.paid_amount_minor, 'currency', OLD.paid_currency))
+      END,
       -- A cancellation's fee and an admin's reason for going past a cutoff (RFC 0004 B5).
       'cancellation_fee', CASE WHEN kind = 'reservation.cancelled'
                                THEN NULLIF(current_setting('slotlock.cancellation_fee', true), '')::jsonb END,
@@ -5912,7 +7823,7 @@ CREATE TABLE IF NOT EXISTS slotlock.reminder_dispatches (
   ordinal integer NOT NULL,
   due_at timestamptz NOT NULL,
   dispatched_at timestamptz NOT NULL DEFAULT statement_timestamp(),
-  PRIMARY KEY (event_id, recurrence_id, ordinal),
+  PRIMARY KEY (event_id, recurrence_id, due_at),
   CONSTRAINT slotlock_reminder_dispatches_event_fkey FOREIGN KEY (event_id, tenant_ref)
     REFERENCES slotlock.calendar_events (id, tenant_ref) ON DELETE CASCADE
 );
@@ -5922,6 +7833,11 @@ CREATE INDEX IF NOT EXISTS slotlock_reminder_dispatches_tenant_idx
 -- A booking's reminders (RFC 0004 P3): minutes before its start, at most five; each said once on
 -- the feed as reminder.due, and again if the booking moves.
 ALTER TABLE slotlock.reservations ADD COLUMN IF NOT EXISTS reminder_minutes integer[];
+-- The start a booking or event had when it was moved while cancelling it was already late (past its
+-- cancel cutoff, or inside its fee's window): a later cancellation is judged from it, so moving
+-- cannot take a booking out of what a late cancellation owes (RFC 0004 B5).
+ALTER TABLE slotlock.reservations ADD COLUMN IF NOT EXISTS cutoff_anchor timestamptz;
+ALTER TABLE slotlock.calendar_events ADD COLUMN IF NOT EXISTS cutoff_anchor timestamptz;
 DO $slotlock_reservation_reminders$
 BEGIN
   IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'slotlock_reservations_reminders_valid'
@@ -5940,10 +7856,43 @@ CREATE TABLE IF NOT EXISTS slotlock.reservation_reminder_dispatches (
   ordinal integer NOT NULL CHECK (ordinal BETWEEN 0 AND 4),
   due_at timestamptz NOT NULL,
   dispatched_at timestamptz NOT NULL DEFAULT statement_timestamp(),
-  PRIMARY KEY (reservation_id, ordinal),
+  PRIMARY KEY (reservation_id, due_at),
   CONSTRAINT slotlock_reservation_reminder_dispatches_fkey FOREIGN KEY (reservation_id, tenant_ref)
     REFERENCES slotlock.reservations (id, tenant_ref) ON DELETE CASCADE
 );
+-- A reminder said is kept by when it was due, not by its place in the list: one added, removed or
+-- reordered (so every place has another time) says nothing again that was said, and a booking or
+-- occurrence moved has new times, said again. Reminders due at the same time are said once. Kept by
+-- place before, so the key moves, each time said kept once.
+DO $slotlock_reminder_dispatch_keys$
+DECLARE
+  dispatches text;
+  kept_by_place text;
+BEGIN
+  FOREACH dispatches IN ARRAY ARRAY['reminder_dispatches', 'reservation_reminder_dispatches'] LOOP
+    SELECT key.conname INTO kept_by_place
+      FROM pg_catalog.pg_constraint key
+     WHERE key.conrelid = pg_catalog.format('slotlock.%I', dispatches)::regclass AND key.contype = 'p'
+       AND EXISTS (SELECT 1 FROM pg_catalog.pg_attribute column_
+                    WHERE column_.attrelid = key.conrelid AND column_.attnum = ANY (key.conkey)
+                      AND column_.attname = 'ordinal');
+    IF kept_by_place IS NOT NULL THEN
+      IF dispatches = 'reminder_dispatches' THEN
+        DELETE FROM slotlock.reminder_dispatches sent USING slotlock.reminder_dispatches other
+         WHERE other.event_id = sent.event_id AND other.recurrence_id = sent.recurrence_id
+           AND other.due_at = sent.due_at AND other.ordinal < sent.ordinal;
+        EXECUTE pg_catalog.format('ALTER TABLE slotlock.reminder_dispatches DROP CONSTRAINT %I', kept_by_place);
+        ALTER TABLE slotlock.reminder_dispatches ADD PRIMARY KEY (event_id, recurrence_id, due_at);
+      ELSE
+        DELETE FROM slotlock.reservation_reminder_dispatches sent USING slotlock.reservation_reminder_dispatches other
+         WHERE other.reservation_id = sent.reservation_id AND other.due_at = sent.due_at AND other.ordinal < sent.ordinal;
+        EXECUTE pg_catalog.format('ALTER TABLE slotlock.reservation_reminder_dispatches DROP CONSTRAINT %I', kept_by_place);
+        ALTER TABLE slotlock.reservation_reminder_dispatches ADD PRIMARY KEY (reservation_id, due_at);
+      END IF;
+    END IF;
+  END LOOP;
+END
+$slotlock_reminder_dispatch_keys$;
 CREATE INDEX IF NOT EXISTS slotlock_reservation_reminder_dispatches_tenant_idx
   ON slotlock.reservation_reminder_dispatches (tenant_ref, due_at);
 
@@ -5967,6 +7916,24 @@ CREATE TABLE IF NOT EXISTS slotlock.hold_payments (
   CONSTRAINT slotlock_hold_payments_resource_fkey FOREIGN KEY (resource_id, tenant_ref)
     REFERENCES slotlock.resources (id, tenant_ref) ON DELETE CASCADE
 );
+-- Whether a paid hold was booked (RFC 0004 C3): confirmed, or booked from by a write that named it
+-- (booked_at), or taken over by an approval (approval_id) and so booked as that approval goes. A
+-- payment whose hold ended any other way was never applied: markHoldPaid answers it hold_ended, and
+-- the feed's hold.expired or hold.released says so (payment_unapplied), for the payment to be
+-- refunded. Payments recorded before this was kept are taken as applied: none is refunded unasked.
+DO $slotlock_hold_payments_outcome$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM information_schema.columns
+     WHERE table_schema = 'slotlock' AND table_name = 'hold_payments' AND column_name = 'booked_at'
+  ) THEN
+    ALTER TABLE slotlock.hold_payments ADD COLUMN booked_at timestamptz, ADD COLUMN approval_id uuid;
+    UPDATE slotlock.hold_payments payment SET booked_at = payment.paid_at
+     WHERE NOT EXISTS (SELECT 1 FROM slotlock.reservations hold
+                        WHERE hold.id = payment.hold_id AND hold.status = 'held');
+  END IF;
+END
+$slotlock_hold_payments_outcome$;
 -- When each channel's consent was last given or withdrawn, as proof of it.
 ALTER TABLE slotlock.contacts ADD COLUMN IF NOT EXISTS consent_at jsonb NOT NULL DEFAULT '{}'::jsonb;
 
@@ -5990,6 +7957,56 @@ CREATE INDEX IF NOT EXISTS slotlock_source_busy_resource_idx
   ON slotlock.source_busy (resource_id, starts_at, ends_at);
 CREATE INDEX IF NOT EXISTS slotlock_source_busy_source_idx
   ON slotlock.source_busy (resource_id, source, starts_at);
+-- Busy time that ended long ago goes in retention (pruneBookingRetention), tenant by tenant.
+CREATE INDEX IF NOT EXISTS slotlock_source_busy_ended_idx
+  ON slotlock.source_busy (tenant_ref, ends_at);
+
+-- A copy of everything a tenant keeps, for it to download (RFC 0004 D3, POST /v1/tenant/exports):
+-- read in one snapshot into parts of NDJSON, one table's rows to a part. Kept for
+-- SLOTLOCK_TENANT_EXPORT_HOURS once it is ready (or since it was asked for, if it never is), then
+-- deleted by maintenance; at once when the tenant deletes it or is erased.
+CREATE TABLE IF NOT EXISTS slotlock.tenant_exports (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_ref text NOT NULL,
+  status text NOT NULL DEFAULT 'pending',
+  requested_by text,
+  created_at timestamptz NOT NULL DEFAULT statement_timestamp(),
+  finished_at timestamptz,
+  expires_at timestamptz NOT NULL,
+  parts integer NOT NULL DEFAULT 0,
+  row_count bigint NOT NULL DEFAULT 0,
+  bytes bigint NOT NULL DEFAULT 0,
+  tables jsonb NOT NULL DEFAULT '{}'::jsonb,
+  error text,
+  CONSTRAINT slotlock_tenant_exports_tenant_key UNIQUE (id, tenant_ref),
+  CONSTRAINT slotlock_tenant_exports_valid CHECK (
+    octet_length(tenant_ref) BETWEEN 1 AND 500
+    AND status IN ('pending', 'ready', 'failed')
+    AND (requested_by IS NULL OR octet_length(requested_by) BETWEEN 1 AND 200)
+    AND (error IS NULL OR octet_length(error) BETWEEN 1 AND 200)
+    AND parts >= 0 AND row_count >= 0 AND bytes >= 0
+    AND jsonb_typeof(tables) = 'object'
+  )
+);
+CREATE INDEX IF NOT EXISTS slotlock_tenant_exports_tenant_idx
+  ON slotlock.tenant_exports (tenant_ref, created_at);
+CREATE INDEX IF NOT EXISTS slotlock_tenant_exports_expiry_idx
+  ON slotlock.tenant_exports (tenant_ref, expires_at);
+CREATE TABLE IF NOT EXISTS slotlock.tenant_export_parts (
+  export_id uuid NOT NULL,
+  tenant_ref text NOT NULL,
+  part integer NOT NULL,
+  table_name text NOT NULL,
+  row_count integer NOT NULL,
+  content text NOT NULL,
+  CONSTRAINT slotlock_tenant_export_parts_pkey PRIMARY KEY (export_id, part),
+  CONSTRAINT slotlock_tenant_export_parts_export_fkey FOREIGN KEY (export_id, tenant_ref)
+    REFERENCES slotlock.tenant_exports (id, tenant_ref) ON DELETE CASCADE,
+  CONSTRAINT slotlock_tenant_export_parts_valid CHECK (
+    octet_length(tenant_ref) BETWEEN 1 AND 500
+    AND part >= 1 AND table_name ~ '^[a-z_]{1,63}$' AND row_count >= 1
+  )
+);
 
 -- A cancelled UID remains terminal. This blocks delayed create delivery after the event row and
 -- its derived reservations have been removed.
@@ -6205,7 +8222,7 @@ CREATE INDEX IF NOT EXISTS slotlock_calendar_event_occurrences_resource_time_idx
   ON slotlock.calendar_event_occurrences (tenant_ref, starts_at, ends_at);
 CREATE INDEX IF NOT EXISTS slotlock_reservations_calendar_event_idx
   ON slotlock.reservations (calendar_event_id) WHERE calendar_event_id IS NOT NULL;
-${SLOTLOCK_OUTBOX_DDL}${SLOTLOCK_API_KEYS_DDL}${SLOTLOCK_PARTNER_DDL}${SLOTLOCK_DASHBOARD_DDL}${SLOTLOCK_TENANT_ADMIN_DDL}${DEPLOYMENT_RECORD_VERSION}`;
+${SLOTLOCK_OUTBOX_DDL}${SLOTLOCK_API_KEYS_DDL}${SLOTLOCK_PARTNER_DDL}${SLOTLOCK_DASHBOARD_DDL}${SLOTLOCK_IDENTITY_DDL}${SLOTLOCK_SSO_DDL}${SLOTLOCK_SCIM_DDL}${SLOTLOCK_TENANT_ADMIN_DDL}${DEPLOYMENT_RECORD_VERSION}`;
 /**
  * Whether the outbox row `row` (a coverage change) is in this release's shape: named by a source_id
  * or src_redacted, in `subject` and `data.source_id` alike, with no `source` or `last_error`.
@@ -6336,6 +8353,7 @@ export const SLOTLOCK_TENANT_TABLES = Object.freeze([
     'assistant_settings',
     'assistant_conversations',
     'assistant_chats',
+    'audit_events',
     'locations',
     'resource_groups',
     'resource_group_members',
@@ -6351,6 +8369,8 @@ export const SLOTLOCK_TENANT_TABLES = Object.freeze([
     'reservation_reminder_dispatches',
     'hold_payments',
     'source_busy',
+    'tenant_exports',
+    'tenant_export_parts',
 ]);
 const POSTGRES_SETTING_NAME = /^[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)+$/;
 const POSTGRES_ROLE_NAME = /^[a-z_][a-z0-9_]{0,62}$/;
@@ -6366,9 +8386,15 @@ export function createSlotlockApplicationRoleGrantsDdl(role) {
     if (!POSTGRES_ROLE_NAME.test(role) || RESERVED_ROLE_NAMES.has(role) || role.startsWith('pg_')) {
         throw Object.assign(new Error('Slotlock application role must be a lowercase, non-reserved PostgreSQL role name'), { code: 'invalid_role_name' });
     }
-    const tables = SLOTLOCK_TENANT_TABLES.map((table) => `slotlock.${table}`).join(', ');
+    const appendOnly = SLOTLOCK_APPEND_ONLY_TABLES;
+    const tables = SLOTLOCK_TENANT_TABLES.filter((table) => !appendOnly.includes(table))
+        .map((table) => `slotlock.${table}`)
+        .join(', ');
+    const added = SLOTLOCK_APPEND_ONLY_TABLES.map((table) => `slotlock.${table}`).join(', ');
     return `GRANT USAGE ON SCHEMA slotlock TO "${role}";
 GRANT SELECT, INSERT, UPDATE, DELETE ON ${tables} TO "${role}";
+GRANT SELECT, INSERT ON ${added} TO "${role}";
+REVOKE UPDATE, DELETE ON ${added} FROM "${role}";
 GRANT EXECUTE ON FUNCTION ${SLOTLOCK_DEFINER_FUNCTIONS.join(', ')} TO "${role}";
 `;
 }
@@ -6471,6 +8497,8 @@ ALTER TABLE slotlock.assistant_conversations ENABLE ROW LEVEL SECURITY;
 ALTER TABLE slotlock.assistant_conversations FORCE ROW LEVEL SECURITY;
 ALTER TABLE slotlock.assistant_chats ENABLE ROW LEVEL SECURITY;
 ALTER TABLE slotlock.assistant_chats FORCE ROW LEVEL SECURITY;
+ALTER TABLE slotlock.audit_events ENABLE ROW LEVEL SECURITY;
+ALTER TABLE slotlock.audit_events FORCE ROW LEVEL SECURITY;
 ALTER TABLE slotlock.locations ENABLE ROW LEVEL SECURITY;
 ALTER TABLE slotlock.locations FORCE ROW LEVEL SECURITY;
 ALTER TABLE slotlock.resource_groups ENABLE ROW LEVEL SECURITY;
@@ -6501,6 +8529,10 @@ ALTER TABLE slotlock.holiday_calendars ENABLE ROW LEVEL SECURITY;
 ALTER TABLE slotlock.holiday_calendars FORCE ROW LEVEL SECURITY;
 ALTER TABLE slotlock.source_busy ENABLE ROW LEVEL SECURITY;
 ALTER TABLE slotlock.source_busy FORCE ROW LEVEL SECURITY;
+ALTER TABLE slotlock.tenant_exports ENABLE ROW LEVEL SECURITY;
+ALTER TABLE slotlock.tenant_exports FORCE ROW LEVEL SECURITY;
+ALTER TABLE slotlock.tenant_export_parts ENABLE ROW LEVEL SECURITY;
+ALTER TABLE slotlock.tenant_export_parts FORCE ROW LEVEL SECURITY;
 
 -- One database must have one tenant-context contract. Re-applying with an adapter-specific
 -- setting deliberately rebinds the stable policies instead of silently keeping a prior setting.
@@ -6534,6 +8566,7 @@ BEGIN
          'assistant_settings',
          'assistant_conversations',
          'assistant_chats',
+         'audit_events',
          'locations',
          'resource_groups',
          'resource_group_members',
@@ -6548,7 +8581,9 @@ BEGIN
          'reminder_dispatches',
          'reservation_reminder_dispatches',
          'hold_payments',
-         'source_busy'
+         'source_busy',
+         'tenant_exports',
+         'tenant_export_parts'
        )
   LOOP
     EXECUTE format(
@@ -6800,6 +8835,16 @@ BEGIN
       WITH CHECK (tenant_ref = NULLIF(current_setting('${tenantContextSetting}', true), ''));
   END IF;
 
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_policies
+     WHERE schemaname = 'slotlock' AND tablename = 'audit_events'
+       AND policyname = 'tenant_isolation_v1'
+  ) THEN
+    CREATE POLICY tenant_isolation_v1 ON slotlock.audit_events
+      USING (tenant_ref = NULLIF(current_setting('${tenantContextSetting}', true), ''))
+      WITH CHECK (tenant_ref = NULLIF(current_setting('${tenantContextSetting}', true), ''));
+  END IF;
+
   IF NOT EXISTS (
     SELECT 1 FROM pg_policies
      WHERE schemaname = 'slotlock' AND tablename = 'locations'
@@ -6949,6 +8994,26 @@ BEGIN
       USING (tenant_ref = NULLIF(current_setting('${tenantContextSetting}', true), ''))
       WITH CHECK (tenant_ref = NULLIF(current_setting('${tenantContextSetting}', true), ''));
   END IF;
+
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_policies
+     WHERE schemaname = 'slotlock' AND tablename = 'tenant_exports'
+       AND policyname = 'tenant_isolation_v1'
+  ) THEN
+    CREATE POLICY tenant_isolation_v1 ON slotlock.tenant_exports
+      USING (tenant_ref = NULLIF(current_setting('${tenantContextSetting}', true), ''))
+      WITH CHECK (tenant_ref = NULLIF(current_setting('${tenantContextSetting}', true), ''));
+  END IF;
+
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_policies
+     WHERE schemaname = 'slotlock' AND tablename = 'tenant_export_parts'
+       AND policyname = 'tenant_isolation_v1'
+  ) THEN
+    CREATE POLICY tenant_isolation_v1 ON slotlock.tenant_export_parts
+      USING (tenant_ref = NULLIF(current_setting('${tenantContextSetting}', true), ''))
+      WITH CHECK (tenant_ref = NULLIF(current_setting('${tenantContextSetting}', true), ''));
+  END IF;
 END
 $slotlock_rls$;
 
@@ -6994,6 +9059,8 @@ COMMENT ON POLICY tenant_isolation_v1 ON slotlock.assistant_conversations
   IS 'slotlock:tenant-context:${tenantContextSetting}';
 COMMENT ON POLICY tenant_isolation_v1 ON slotlock.assistant_chats
   IS 'slotlock:tenant-context:${tenantContextSetting}';
+COMMENT ON POLICY tenant_isolation_v1 ON slotlock.audit_events
+  IS 'slotlock:tenant-context:${tenantContextSetting}';
 COMMENT ON POLICY tenant_isolation_v1 ON slotlock.locations
   IS 'slotlock:tenant-context:${tenantContextSetting}';
 COMMENT ON POLICY tenant_isolation_v1 ON slotlock.resource_groups
@@ -7024,6 +9091,10 @@ COMMENT ON POLICY tenant_isolation_v1 ON slotlock.holiday_calendars
   IS 'slotlock:tenant-context:${tenantContextSetting}';
 COMMENT ON POLICY tenant_isolation_v1 ON slotlock.source_busy
   IS 'slotlock:tenant-context:${tenantContextSetting}';
+COMMENT ON POLICY tenant_isolation_v1 ON slotlock.tenant_exports
+  IS 'slotlock:tenant-context:${tenantContextSetting}';
+COMMENT ON POLICY tenant_isolation_v1 ON slotlock.tenant_export_parts
+  IS 'slotlock:tenant-context:${tenantContextSetting}';
 ${SLOTLOCK_RESOURCE_SCOPE_POLICIES}
 
 INSERT INTO slotlock.rls_policy_contracts (
@@ -7069,6 +9140,7 @@ WHERE schemaname = 'slotlock'
     'assistant_settings',
     'assistant_conversations',
     'assistant_chats',
+    'audit_events',
     'locations',
     'resource_groups',
     'resource_group_members',
@@ -7083,7 +9155,9 @@ WHERE schemaname = 'slotlock'
     'reminder_dispatches',
     'reservation_reminder_dispatches',
     'hold_payments',
-    'source_busy'
+    'source_busy',
+    'tenant_exports',
+    'tenant_export_parts'
   )
   AND policyname = 'tenant_isolation_v1'
 ON CONFLICT (table_name) DO UPDATE