slotlock 0.9.0 → 0.10.0

package/dashboard.js

@@ -13,7 +13,13 @@
 // once) and signed-out sessions (a copied cookie stays signed out). `createSlotlockDashboardState`
 // keeps these in Postgres, so they hold on every server that shares the database; the resource cap
 // is held in the database too.
-import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
+import { SLOTLOCK_DASHBOARD_PAGE_CAPABILITIES, SLOTLOCK_DASHBOARD_POST_CAPABILITIES, SLOTLOCK_FRESH_CAPABILITIES, SLOTLOCK_SCOPED_DASHBOARD_PAGES, SLOTLOCK_SCOPED_DASHBOARD_POSTS, SLOTLOCK_WORKSPACE_ROLE_NAMES, SLOTLOCK_WORKSPACE_ROLES, isSlotlockWorkspaceRole, slotlockMemberCan, slotlockRoleCan, slotlockRoleMayGrant, } from './workspace-roles.js';
+import { slotlockDomainRecord, slotlockEmailDomain } from './domains.js';
+import { SLOTLOCK_GOOGLE_ISSUERS, createSlotlockJwksCache, discoverSlotlockOidc, slotlockEntraIssuer, slotlockOidcUrlAllowed, slotlockReadJsonBody, verifySlotlockIdToken, } from './oidc.js';
+import { handleSlotlockScimRequest } from './scim-server.js';
+import { SLOTLOCK_DOMAIN_AUDIT_ACTIONS, slotlockDomainCheckEvent, slotlockJoinRole, } from './workspace-domains.js';
+import { SLOTLOCK_WORKSPACE_DOMAIN_LIMIT } from './ddl-identity.js';
 import { SLOTLOCK_TEST_TENANT_SUFFIX, } from './api-keys.js';
 import { describeSlotlockAgentWrite, invokeSlotlockAgentOperation, slotlockAgentTools, } from './agent-server.js';
 import { SLOTLOCK_ASSISTANT_API_KEY, SLOTLOCK_ASSISTANT_MAX_ACTION_BYTES, SLOTLOCK_ASSISTANT_MAX_MESSAGE, SLOTLOCK_ASSISTANT_MAX_PENDING, SLOTLOCK_ASSISTANT_MAX_PREVIOUS_SECRETS, SLOTLOCK_ASSISTANT_MODEL_NAME, SLOTLOCK_ASSISTANT_PRESETS, SLOTLOCK_ASSISTANT_TOOL_USE, boundSlotlockAssistantEntries, createSlotlockAssistantStore, openSlotlockAssistantKeyWithAny, pendingSlotlockAssistantActions, pruneSlotlockAssistantActions, checkSlotlockAssistantHost, readSlotlockAssistantBaseUrl, slotlockAssistantUrlAllowed, readSlotlockAssistantEntries, runSlotlockAssistantTurn, sealSlotlockAssistantKey, slotlockAssistantProviderMessage, SLOTLOCK_ASSISTANT_DIRECTORY_SIZE, slotlockAssistantSystemPrompt, testSlotlockAssistantModel, listSlotlockAssistantModels, } from './assistant.js';
@@ -21,18 +27,20 @@ import { SLOTLOCK_DASHBOARD_NAME_PATTERN } from './config.js';
 import { createSlotlockRateLimiter } from './rate-limit.js';
 import { createSlotlockGuardedFetch } from './webhooks.js';
 import { lookup as dnsLookup } from 'node:dns/promises';
-import { SLOTLOCK_ASSISTANT_CHAT_ID, SLOTLOCK_DASHBOARD_FORM_LIMIT } from './ddl.js';
+import { SLOTLOCK_ASSISTANT_CHAT_ID, SLOTLOCK_DASHBOARD_FORM_LIMIT, SLOTLOCK_INVITATIONS_PER_ADDRESS } from './ddl.js';
 import { ignoreRejection } from './hooks.js';
 import { SLOTLOCK_BOOKING_RULE_LIMITS } from './booking-rules.js';
 import { SLOTLOCK_DASHBOARD_ICON_SVG } from './dashboard-icon.js';
+import { runSlotlockDashboardRequest, setSlotlockDashboardRequestScope, slotlockDashboardRequestScope, } from './dashboard-scope.js';
 import { SLOTLOCK_SETTINGS_CSS } from './dashboard-settings-ui.js';
 import { renderSlotlockMarkdown } from './dashboard-markdown.js';
 import { SLOTLOCK_ASSISTANT_CSS, slotlockAssistantActionVerb, slotlockAssistantScript, slotlockAssistantStepLabel, } from './dashboard-assistant-ui.js';
 import { SLOTLOCK_PLAN_LIMITS, SLOTLOCK_PLAN_QUOTAS } from './plans.js';
-import { SLOTLOCK_MAX_GROUPS_PER_RESOURCE, SLOTLOCK_MAX_LOCATION_DEPTH, SLOTLOCK_MAX_LOCATIONS, SLOTLOCK_MAX_RESOURCE_GROUPS, SLOTLOCK_RESOURCE_KINDS, SLOTLOCK_RESOURCE_PROFILE_LIMITS, } from './resource-profile.js';
+import { SLOTLOCK_MAX_GROUPS_PER_RESOURCE, SLOTLOCK_MAX_LOCATION_DEPTH, SLOTLOCK_MAX_LOCATIONS, SLOTLOCK_MAX_RESOURCE_GROUPS, SLOTLOCK_RESOURCE_KINDS, SLOTLOCK_RESOURCE_PROFILE_LIMITS, SLOTLOCK_MAX_KEY_SCOPE_REFS, isSlotlockResourceScope, } from './resource-profile.js';
 import { slotlockQuotaPeriod } from './quotas.js';
 import { slotlockUsageMonthToDate, summarizeSlotlockUsage } from './usage.js';
 import { SLOTLOCK_CHANGE_TYPES, } from './event-feed.js';
+import { buildSlotlockTenantExport, } from './store.js';
 import { dayToDate } from './hours.js';
 import { SLOTLOCK_MAX_HOLIDAY_CALENDAR_BYTES } from './holidays.js';
 import { readSlotlockHolidayCalendar } from './holiday-import.js';
@@ -73,6 +81,8 @@ const MAX_REMEMBERED = 10_000;
 const FORM_NONCE = /^([A-Za-z0-9_-]{24})\.([A-Za-z0-9_-]{43})$/;
 const POST_ROUTES = new Set([
     '/sign-out',
+    '/sign-out-everywhere',
+    '/sessions/end',
     '/keys',
     '/keys/rotate',
     '/keys/revoke',
@@ -105,6 +115,38 @@ const POST_ROUTES = new Set([
     '/environment',
     '/teams/enable',
     '/teams/disable',
+    '/teams/create',
+    '/teams/delete',
+    '/teams/restore',
+    '/invite/accept',
+    '/members/invite',
+    '/members/resend',
+    '/members/revoke',
+    '/members/role',
+    '/members/scope',
+    '/members/remove',
+    '/members/leave',
+    '/members/requests',
+    '/join/request',
+    '/identity/domains',
+    '/identity/domains/verify',
+    '/identity/domains/remove',
+    '/identity/domains/policy',
+    '/identity/invites',
+    '/identity/sso',
+    '/identity/sso/test',
+    '/identity/sso/status',
+    '/identity/sso/delete',
+    '/identity/sso/provisioning',
+    '/identity/sso/mapping',
+    '/identity/sso/require',
+    '/identity/scim/enable',
+    '/identity/scim/disable',
+    '/identity/scim/token',
+    '/identity/scim/token/revoke',
+    '/identity/scim/group',
+    '/sso/proof',
+    '/sso/bypass',
     '/assistant',
     '/assistant/stream',
     '/assistant/approve',
@@ -118,11 +160,87 @@ const POST_ROUTES = new Set([
     '/settings/assistant/remove',
     '/plan/upgrade',
     '/plan/manage',
+    '/settings/privacy/export',
+    '/settings/privacy/export/delete',
+    '/settings/privacy/person',
+    '/settings/privacy/person/export',
+    '/settings/privacy/person/erase',
+]);
+/** The forms whose success the audit log records, by the action it records. */
+const AUDITED_ROUTES = Object.freeze({
+    '/keys': 'api_key.created',
+    '/keys/rotate': 'api_key.rotated',
+    '/keys/revoke': 'api_key.revoked',
+    '/keys/limits': 'api_key.limits_changed',
+    '/webhooks': 'webhook.created',
+    '/webhooks/delete': 'webhook.deleted',
+    '/webhooks/enable': 'webhook.enabled',
+    '/contacts/forget': 'contact.forgotten',
+    '/settings/assistant': 'assistant.settings_saved',
+    '/settings/assistant/remove': 'assistant.settings_removed',
+    '/plan/upgrade': 'billing.checkout_started',
+    '/plan/manage': 'billing.portal_opened',
+    '/teams/enable': 'organization.enabled',
+    '/teams/disable': 'organization.disabled',
+    '/sandbox/reset': 'sandbox.reset',
+    '/sign-out-everywhere': 'session.signed_out_everywhere',
+    '/sessions/end': 'session.ended',
+});
+/** What each capability lets a person do, as a refusal says it. */
+const CAPABILITY_WORDS = Object.freeze({
+    'account.use': 'use this account',
+    'workspace.read': 'see this workspace',
+    'usage.read': 'see its usage',
+    'assistant.chat': 'chat with the assistant',
+    'operations.run': 'change bookings, hours or closures',
+    'resources.manage': 'change resources',
+    'sandbox.manage': 'change the test environment',
+    'keys.manage_own': 'create or change API keys',
+    'keys.full': 'create or change Full-access keys',
+    'keys.manage_any': "change a key someone else created",
+    'webhooks.manage': 'change webhooks',
+    'contacts.forget': 'forget contacts',
+    'assistant.settings': "change the assistant's model",
+    'members.manage': 'manage members',
+    'audit.read': 'read the audit log',
+    'privacy.manage': "export the workspace's data or erase a person",
+    'billing.manage': 'change the plan or billing',
+    'workspace.own': 'change who owns this workspace',
+    'identity.manage': "change the team's domains",
+});
+/** What a session signed in through a team's provider alone may not do: anything beyond its team. */
+const SSO_SCOPED_REFUSED = new Set([
+    '/organization',
+    '/teams/create',
+    '/teams/enable',
+    '/teams/disable',
+    '/invite/accept',
+    '/join/request',
+    '/sso/proof',
+    '/sso/bypass',
+    '/sessions/end',
+    '/sign-out-everywhere',
+]);
+/** The pages a sign-in may come back to: one made to confirm it's you, or to open an invitation. */
+const STEP_UP_PAGES = new Set([
+    '/settings/privacy',
+    '/keys',
+    '/webhooks',
+    '/plan',
+    '/settings',
+    '/settings/members',
+    '/settings/team',
+    '/settings/identity',
+    '/teams',
+    '/contacts',
+    '/invite',
 ]);
 const SIGN_IN_AGAIN = 'That sign-in did not finish here, or took too long. Sign in again.';
 const GITHUB_ERROR_CODE = /^[a-z0-9_]{1,64}$/;
 const MAX_COOKIE_CHARACTERS = 4_096;
 const GITHUB_TIMEOUT_MS = 10_000;
+/** The most a team's token endpoint may answer: an ID token and its companions fit well within. */
+const SSO_TOKEN_ANSWER_BYTES = 65_536;
 /** A Google account's subject: ASCII, at most 255 characters (OpenID Connect); Google's are digits. */
 const GOOGLE_SUBJECT = /^[A-Za-z0-9._-]{1,255}$/;
 /** The REST API version GitHub documents for GET /user (docs.github.com, read 2026-10-10). */
@@ -135,6 +253,196 @@ const BASE64URL = /^[A-Za-z0-9_-]+$/;
 const GITHUB_LOGIN = /^[A-Za-z0-9][A-Za-z0-9_-]{0,99}$/;
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const DAY_MS = 86_400_000;
+/** The invitation link being opened, for the sign-in that accepts it: sealed, for 30 minutes. */
+const INVITE_COOKIE = '__Host-slotlock-invite';
+/** A sign-in through a team's identity provider, until its callback. */
+const SSO_COOKIE = '__Host-slotlock-sso';
+const INVITE_LINK_TTL_MS = 30 * 60_000;
+/** An invitation's token: 32 random bytes, base64url. Only its SHA-256 digest is stored. */
+const INVITE_TOKEN = /^[A-Za-z0-9_-]{43}$/;
+/** How long an invitation stays open, and how many a team workspace may send in a day. */
+const INVITATION_DAYS = 7;
+const INVITATION_DAILY_LIMIT = 50;
+/** People in a team workspace on the Free plan, its Owner and open invitations included. */
+const FREE_TEAM_MEMBERS = 3;
+/** Team workspaces on the Free plan each person may create, where plans apply. */
+const FREE_TEAMS_PER_PERSON = 1;
+/** A team workspace's id, as its tenant names it (`team:<id>`). */
+const TEAM_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const EMAIL_ADDRESS = /^[^@\s<>"]{1,64}@[^@\s<>"]+\.[^@\s<>"]+$/;
+/** Audit events a page of the audit log shows, and an export holds at most. */
+const AUDIT_PAGE = 50;
+const AUDIT_EXPORT_MOST = 10_000;
+const AUDIT_EXPORT_EMPTY = Object.freeze({
+    occurred_at: '', action: '', outcome: '', actor_type: '', actor_ref: '', actor_role: '', target_type: '',
+    target_ref: '', reason: '', ip_address: '', user_agent: '', metadata: '', chain_index: '', hash: '',
+});
+/** A CSV cell, quoted; one a spreadsheet would read as a formula starts with an apostrophe. */
+function csvCell(value) {
+    const safe = /^[\s]*[=+\-@]|^[\t\r\n]/.test(value) ? `'${value}` : value;
+    return `"${safe.replaceAll('"', '""')}"`;
+}
+/** What each audited action did, as the audit log says it. */
+const AUDIT_ACTION_WORDS = Object.freeze({
+    'api_key.created': 'created an API key',
+    'api_key.rotated': 'rotated an API key',
+    'api_key.revoked': 'revoked an API key',
+    'api_key.limits_changed': "changed an API key's limits",
+    'webhook.created': 'added a webhook',
+    'webhook.deleted': 'removed a webhook',
+    'webhook.enabled': 'turned a webhook back on',
+    'contact.forgotten': 'forgot a contact',
+    'subject.erased': 'erased a person',
+    'export.created': 'exported the account',
+    'export.downloaded': 'downloaded an export of the account',
+    'subject.exported': "exported a person's data",
+    'assistant.settings_saved': "changed the assistant's model",
+    'assistant.settings_removed': "removed the assistant's model",
+    'billing.checkout_started': 'started a checkout',
+    'billing.portal_opened': 'opened billing',
+    'organization.enabled': 'turned the organization on',
+    'organization.disabled': 'turned the organization off',
+    'sandbox.reset': 'reset the test environment',
+    'session.signed_in': 'signed in',
+    'session.signed_out_everywhere': 'signed out everywhere',
+    'session.ended': 'signed a device out',
+    'audit.exported': 'exported the audit log',
+    'workspace.created': 'created the team',
+    'workspace.deletion_scheduled': 'asked for the team to be deleted',
+    'workspace.deletion_cancelled': 'kept the team',
+    'member.invited': 'invited someone',
+    'invitation.resent': 'sent an invitation again',
+    'invitation.revoked': 'revoked an invitation',
+    'member.joined': 'joined',
+    'member.role_changed': "changed a member's role",
+    'member.scope_changed': 'changed what a member reaches',
+    'member.removed': 'removed a member',
+    'member.left': 'left',
+    'member.join_requested': 'asked to join',
+    'member.join_approved': 'let someone join',
+    'member.join_declined': 'declined a request to join',
+    'domain.claimed': 'added a domain',
+    'domain.verified': 'verified a domain',
+    'domain.record_missing': "found a domain's record gone",
+    'domain.lapsing': 'found a domain lapsing',
+    'domain.restored': 'verified a domain again',
+    'domain.lapsed': 'found a domain lapsed',
+    'domain.released': 'removed a domain',
+    'domain.join_policy_changed': 'changed who may join through a domain',
+    'workspace.invites_restricted': 'held invitations to verified domains',
+    'workspace.invites_unrestricted': 'let invitations go to any address',
+    'sso.connection_saved': 'saved the single sign-on connection',
+    'sso.connection_tested': 'tested single sign-on',
+    'sso.connection_activated': 'turned single sign-on on',
+    'sso.connection_disabled': 'turned single sign-on off',
+    'sso.connection_deleted': 'deleted the single sign-on connection',
+    'sso.provisioning_changed': 'changed who single sign-on adds',
+    'sso.mapping_changed': 'changed a group’s role',
+    'sso.required': 'required single sign-on',
+    'sso.not_required': 'stopped requiring single sign-on',
+    'sso.bypass_used': 'bypassed single sign-on',
+    'sso.signed_in': 'signed in with single sign-on',
+    'sso.linked': 'linked a single sign-on account',
+    'authz.denied': 'was refused',
+});
+const AUDIT_ACTION_GROUPS = Object.freeze([
+    ['API keys', ['api_key.created', 'api_key.rotated', 'api_key.revoked', 'api_key.limits_changed']],
+    ['Webhooks', ['webhook.created', 'webhook.deleted', 'webhook.enabled']],
+    ['People', ['workspace.created', 'workspace.deletion_scheduled', 'workspace.deletion_cancelled', 'member.invited', 'invitation.resent', 'invitation.revoked', 'member.joined', 'member.role_changed', 'member.scope_changed', 'member.removed', 'member.left', 'member.join_requested', 'member.join_approved', 'member.join_declined', 'organization.enabled', 'organization.disabled']],
+    ['Identity', [
+            ...SLOTLOCK_DOMAIN_AUDIT_ACTIONS,
+            'sso.connection_saved', 'sso.connection_tested', 'sso.connection_activated', 'sso.connection_disabled',
+            'sso.connection_deleted', 'sso.provisioning_changed', 'sso.mapping_changed', 'sso.required', 'sso.not_required',
+            'sso.bypass_used', 'sso.signed_in', 'sso.linked',
+        ]],
+    ['Billing', ['billing.checkout_started', 'billing.portal_opened']],
+    ['Sessions', ['session.signed_in', 'session.signed_out_everywhere', 'session.ended']],
+    ['Other', ['contact.forgotten', 'subject.erased', 'subject.exported', 'export.created', 'export.downloaded', 'assistant.settings_saved', 'assistant.settings_removed', 'sandbox.reset', 'audit.exported', 'authz.denied']],
+]);
+const AUDIT_ACTION_NAMES = new Set(AUDIT_ACTION_GROUPS.flatMap(([, actions]) => actions));
+/** What a team change refused says, and its status. */
+const TEAM_REFUSALS = Object.freeze({
+    invalid_handle: { status: 400, text: 'That name gives no usable handle. Try another.' },
+    invalid_name: { status: 400, text: 'Name the team: 1 to 80 characters.' },
+    handle_taken: { status: 409, text: 'That name is taken. Try another.' },
+    team_limit: {
+        status: 403,
+        text: `Each person may create ${String(FREE_TEAMS_PER_PERSON)} team on the Free plan. Upgrade yours to create another.`,
+    },
+    not_found: { status: 404, text: 'That is no longer here.' },
+    not_allowed: { status: 403, text: 'Your role can’t give that role, or change that member.' },
+    already_member: { status: 409, text: 'They are already a member.' },
+    invitation_limit: {
+        status: 429,
+        text: `This team sent ${String(INVITATION_DAILY_LIMIT)} invitations in the last day. Try again tomorrow.`,
+    },
+    recipient_limit: {
+        status: 429,
+        text: `That address was sent ${String(SLOTLOCK_INVITATIONS_PER_ADDRESS)} invitations in the last day. Try again tomorrow.`,
+    },
+    member_cap: {
+        status: 403,
+        text: `A team on the Free plan has up to ${String(FREE_TEAM_MEMBERS)} people, open invitations included. Upgrade it to add more.`,
+    },
+    revoked: { status: 409, text: 'This invitation was withdrawn.' },
+    accepted: { status: 409, text: 'This invitation was already used.' },
+    expired: { status: 409, text: 'This invitation expired. Ask for a new one.' },
+    not_for_you: { status: 403, text: 'This invitation is for another account.' },
+    last_owner: { status: 409, text: 'A team keeps at least one owner. Make someone else an owner first.' },
+    sso_owner: { status: 409, text: 'An owner signs in with GitHub or Google too, for when the team’s provider is down. Ask them to link it first.' },
+    confirm: { status: 400, text: "Type the team's handle to confirm." },
+    subscription_live: { status: 409, text: 'Cancel its Team plan on Usage first.' },
+    owner: { status: 409, text: 'An owner reaches the whole workspace. Change their role first.' },
+    domain_restricted: { status: 403, text: 'Invitations go only to addresses at this team’s verified domains.' },
+});
+/** A handle from a team's name: lower-case letters, digits and dashes; later attempts add a random end. */
+function teamHandleFrom(name, attempt) {
+    const base = name
+        .normalize('NFKD')
+        .replace(/[\u0300-\u036f]/g, '')
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+/, '')
+        .slice(0, 30)
+        .replace(/-+$/, '') || 'team';
+    return attempt === 0 ? base : `${base}-${randomBytes(3).toString('hex')}`;
+}
+/** A browser as people name it, from its User-Agent: `Firefox on macOS`. */
+function deviceOf(agent) {
+    if (!agent)
+        return 'A browser';
+    const browser = /Edg\//.test(agent)
+        ? 'Edge'
+        : /OPR\//.test(agent)
+            ? 'Opera'
+            : /Firefox\//.test(agent)
+                ? 'Firefox'
+                : /Chrome\//.test(agent)
+                    ? 'Chrome'
+                    : /Safari\//.test(agent)
+                        ? 'Safari'
+                        : 'A browser';
+    const system = /iPhone|iPad/.test(agent)
+        ? 'iOS'
+        : /Android/.test(agent)
+            ? 'Android'
+            : /Mac OS X|Macintosh/.test(agent)
+                ? 'macOS'
+                : /Windows/.test(agent)
+                    ? 'Windows'
+                    : /Linux/.test(agent)
+                        ? 'Linux'
+                        : '';
+    return system ? `${browser} on ${system}` : browser;
+}
+/** An address as an invitation shows it before anyone signs in: its first letter and domain. */
+function maskedEmail(email) {
+    const at = email.lastIndexOf('@');
+    if (at < 1)
+        return email;
+    return `${email.slice(0, 1)}${'•'.repeat(Math.min(3, at - 1))}${email.slice(at)}`;
+}
+const tokenDigest = (raw) => createHash('sha256').update(raw).digest();
 const KEY_ACCESS = Object.freeze({
     read: ['read'],
     read_write: ['read', 'write'],
@@ -174,11 +482,34 @@ function policyFor(billing) {
  * The dashboard's resources, in the store under each tenant's row-level security. Adds hold the cap
  * in the database (a READ COMMITTED transaction, under a per-tenant lock).
  */
-export function createSlotlockDashboardResources(store, options = {}) {
+export function createSlotlockDashboardResources(given, options = {}) {
+    // Every transaction keeps to the resources the request's member is limited to, if any.
+    const store = {
+        ...given,
+        withTenant(tenantRef, callback, options) {
+            const scope = slotlockDashboardRequestScope();
+            return given.withTenant(tenantRef, callback, scope ? { ...options, resourceScope: scope } : options);
+        },
+    };
     // Every change here is the dashboard's, made by the person signed in (actor) when known.
     const by = (actor) => actor === undefined ? { origin: 'dashboard' } : { origin: 'dashboard', actor };
     const agentBackend = options.agentBackend;
+    /**
+     * Approvals the request's member may see: every one, or under a scope those whose every resource
+     * the scope reaches (approvals are the tenant's, not a resource's, so the database cannot tell).
+     */
+    const reachable = async (tenant, tenantRef, approvals) => {
+        if (!slotlockDashboardRequestScope())
+            return approvals;
+        const reached = new Set();
+        for (const id of new Set(approvals.flatMap((approval) => approval.resourceIds))) {
+            if (await tenant.getResource({ tenantRef, id }))
+                reached.add(id);
+        }
+        return approvals.filter((approval) => approval.resourceIds.every((id) => reached.has(id)));
+    };
     return {
+        keepsToScope: true,
         sandbox: {
             seed: (tenantRef, scenario) => seedSlotlockSandbox(store, tenantRef, scenario),
             async reset(tenantRef) {
@@ -192,9 +523,18 @@ export function createSlotlockDashboardResources(store, options = {}) {
         ...(agentBackend
             ? {
                 approvals: {
-                    list: (tenantRef, limit) => store.withTenant(tenantRef, (tenant) => tenant.listApprovals({ tenantRef, limit })),
+                    list: (tenantRef, limit) => store.withTenant(tenantRef, async (tenant) => reachable(tenant, tenantRef, await tenant.listApprovals({ tenantRef, limit }))),
                     async decide(tenantRef, id, decision, actor, reason) {
                         const decidedBy = actor ?? 'dashboard';
+                        // A member limited to some resources decides only what asks for theirs alone.
+                        if (slotlockDashboardRequestScope()) {
+                            const found = await store.withTenant(tenantRef, async (tenant) => {
+                                const approval = await tenant.getApproval({ tenantRef, id });
+                                return approval ? (await reachable(tenant, tenantRef, [approval])).length > 0 : false;
+                            });
+                            if (!found)
+                                return { ok: false, code: 'approval_not_found' };
+                        }
                         if (decision === 'decline') {
                             const declined = await store.withTenant(tenantRef, (tenant) => tenant.declineApproval({ tenantRef, id, decidedBy, ...(reason ? { reason } : {}) }), by(actor));
                             if (!declined.ok)
@@ -248,6 +588,22 @@ export function createSlotlockDashboardResources(store, options = {}) {
             const updated = await tenant.setResourceAvailability({ tenantRef, id: target.id, rules });
             return updated ? 1 : 0;
         }, by(actor)),
+        privacy: {
+            async createExport(tenantRef, actor) {
+                const made = await store.withTenant(tenantRef, (tenant) => tenant.createTenantExport({ tenantRef, ...(actor ? { requestedBy: actor } : {}) }), { isolation: 'read committed', ...by(actor) });
+                // Built after the answer; maintenance builds one a stopped server left pending.
+                void buildSlotlockTenantExport(store, tenantRef, made.id);
+                return made;
+            },
+            listExports: (tenantRef) => store.withTenant(tenantRef, (tenant) => tenant.listTenantExports({ tenantRef })),
+            exportPart: (tenantRef, exportId, part) => store.withTenant(tenantRef, (tenant) => tenant.getTenantExportPart({ tenantRef, exportId, part })),
+            deleteExport: (tenantRef, exportId) => store.withTenant(tenantRef, (tenant) => tenant.deleteTenantExport({ tenantRef, exportId })),
+            exportSubject: (tenantRef, subject) => store.withTenant(tenantRef, (tenant) => tenant.exportSubject({ tenantRef, subject, limit: 1_000 })),
+            eraseSubject: (tenantRef, subject, actor) => store.withTenant(tenantRef, (tenant) => tenant.eraseSubject({ tenantRef, subject }), {
+                isolation: 'read committed',
+                ...by(actor),
+            }),
+        },
         contacts: {
             list: (tenantRef, limit, after) => store.withTenant(tenantRef, (tenant) => tenant.listContacts({ tenantRef, limit, ...(after ? { after } : {}) })),
             forget: (tenantRef, ref, actor) => store.withTenant(tenantRef, (tenant) => tenant.deleteContact({ tenantRef, ref }), { isolation: 'read committed', ...by(actor) }),
@@ -344,6 +700,11 @@ export function createSlotlockDashboardResources(store, options = {}) {
             enable: (tenantRef, id, actor) => store.withTenant(tenantRef, (tenant) => tenant.enableWebhookEndpoint({ tenantRef, id }), by(actor)),
         },
         assistant: createSlotlockAssistantStore(store),
+        audit: {
+            verify: (tenantRef) => store.withTenant(tenantRef, (tenant) => tenant.verifyAuditChain({ tenantRef })),
+            record: (tenantRef, event) => store.withTenant(tenantRef, (tenant) => tenant.recordAuditEvent({ tenantRef, event })),
+            list: (tenantRef, params = {}) => store.withTenant(tenantRef, (tenant) => tenant.listAuditEvents({ tenantRef, ...params })),
+        },
     };
 }
 function assertExpiry(expiresAt) {
@@ -547,6 +908,7 @@ const INHERITED_NAMES = Object.freeze({
     pickupTimes: 'Pick-up times',
     returnTimes: 'Return times',
     cancellationFee: 'Cancellation fee',
+    holdPrice: 'Hold price',
     hoursApply: 'Hours hold a hire at',
 });
 /** A rule's value as the dashboard shows it. */
@@ -840,7 +1202,7 @@ function readCookies(request) {
         if (index <= 0)
             continue;
         const name = part.slice(0, index).trim();
-        if (name === SESSION_COOKIE || name === SIGN_IN_COOKIE) {
+        if (name === SESSION_COOKIE || name === SIGN_IN_COOKIE || name === INVITE_COOKIE || name === SSO_COOKIE) {
             cookies.set(name, part.slice(index + 1).trim());
         }
     }
@@ -1045,6 +1407,24 @@ export function createSlotlockDashboard(options) {
     }
     // Teams on Cloud: organizations turned on in the database, beside every person's own tenant.
     const teams = options.organizations === 'enabled' ? (options.teams ?? null) : null;
+    const workspaces = options.workspaces ?? null;
+    // Team workspaces: with the membership store's database, where people have workspaces of their own.
+    const teamStore = options.teamWorkspaces && !served ? (workspaces?.teams ?? null) : null;
+    /** Verified domains: a team workspace's, with the database. */
+    const domainStore = teamStore && options.domains ? (workspaces?.domains ?? null) : null;
+    const domainResolvers = options.domains?.resolvers ?? [];
+    /** Single sign-on: with verified domains and the database. */
+    const ssoStore = domainStore && options.sso ? (workspaces?.sso ?? null) : null;
+    const scimStore = domainStore && options.scim ? (workspaces?.scim ?? null) : null;
+    const ssoFetch = (input, init) => (options.sso?.fetch ?? fetchImpl)(input, init);
+    /** Teams' providers' keys, fetched as their Owners' URLs are: through ssoFetch. */
+    const ssoJwks = createSlotlockJwksCache({ fetch: ssoFetch, now: () => now() });
+    /** A session's team that requires single sign-on, met while it held no proof: to say so. */
+    const ssoRequiredOf = new WeakMap();
+    /** Each session's role in the workspace it acts in, as the database said when it was read. */
+    const roles = new WeakMap();
+    /** Where each request came from, for the audit log. */
+    const origins = new WeakMap();
     // Plans whether or not billing sells them; billing's own reader when only it is given.
     const plans = options.plans ??
         (options.billing
@@ -1066,6 +1446,12 @@ export function createSlotlockDashboard(options) {
     const readsOrganizations = served !== null || teams !== null;
     /** Each session's organizations turned on, read with it (teams mode). */
     const enabledOf = new WeakMap();
+    /** The team workspaces the session's person is a member of, read with their standing. */
+    const teamListOf = new WeakMap();
+    /** When the session's team, being deleted, goes. */
+    const deletingOf = new WeakMap();
+    /** The locations and groups each session's member is limited to (RFC 0004 D1), read with their standing. */
+    const scopes = new WeakMap();
     const brandName = options.name ?? 'Slotlock';
     if (!SLOTLOCK_DASHBOARD_NAME_PATTERN.test(brandName) || brandName.trim() !== brandName) {
         throw new Error('Slotlock dashboard name must be 1-60 characters, without <, > or control or invisible characters');
@@ -1087,7 +1473,8 @@ export function createSlotlockDashboard(options) {
     // A list, or exactly '*': any other string would match ids by substring.
     // A GitHub person by their bare id, a Google one as google:<subject>.
     const allowed = (uid, idp) => options.allowedUsers === '*' ||
-        (Array.isArray(options.allowedUsers) && options.allowedUsers.includes(idp === 'google' ? `google:${uid}` : uid));
+        // A person a team's provider made is no account a list names: only where everyone may sign in.
+        (idp !== 'sso' && Array.isArray(options.allowedUsers) && options.allowedUsers.includes(idp === 'google' ? `google:${uid}` : uid));
     const google = served ? null : (options.google ?? null);
     let signInsInFlight = 0;
     /** Sign-ins in flight by client address. */
@@ -1100,8 +1487,12 @@ export function createSlotlockDashboard(options) {
             // A failing reporter must not change the response.
         }
     }
-    // Bound to the organization too: a page opened before a switch cannot write into the new one.
-    const formMac = (session, nonce, org = session.org ?? '') => createHmac('sha256', secret)
+    /** The workspace a form is bound to: its organization's id, `team:<id>`, or '' for one's own. */
+    function workspaceKeyOf(session) {
+        return session.team !== undefined ? `team:${session.team}` : (session.org ?? '');
+    }
+    // Bound to the workspace too: a page opened before a switch cannot write into the new one.
+    const formMac = (session, nonce, org = workspaceKeyOf(session)) => createHmac('sha256', secret)
         .update(`slotlock-dashboard-form-v2.${session.sid}.${org}.${nonce}`)
         .digest('base64url');
     /** Random, and bound to the session by a MAC: a made-up or another session's value is refused unwritten. */
@@ -1118,8 +1509,13 @@ export function createSlotlockDashboard(options) {
         // Compared as text, like the cookie MACs: decoding would drop the last character's spare bits.
         if (safeEqual(mac, formMac(session, nonce)))
             return 'ok';
-        const other = session.orgs?.some((org) => org.id !== session.org && safeEqual(mac, formMac(session, nonce, org.id)));
-        return other ? 'other_org' : 'bad';
+        const current = workspaceKeyOf(session);
+        const others = [
+            ...(session.orgs ?? []).map((org) => org.id),
+            ...(teamListOf.get(session) ?? []).map((ws) => ws.tenantRef),
+            ...(teamStore ? [''] : []),
+        ].filter((other) => other !== current);
+        return others.some((other) => safeEqual(mac, formMac(session, nonce, other))) ? 'other_org' : 'bad';
     };
     function seal(context, payload) {
         const body = Buffer.from(JSON.stringify(payload), 'utf8').toString('base64url');
@@ -1156,26 +1552,145 @@ export function createSlotlockDashboard(options) {
             typeof payload.uid !== 'string' ||
             typeof payload.login !== 'string' ||
             typeof payload.sid !== 'string' ||
-            (payload.idp !== undefined && (payload.idp !== 'google' || !google)) ||
+            (payload.idp !== undefined && !((payload.idp === 'google' && google) || (payload.idp === 'sso' && ssoStore))) ||
+            (payload.sc !== undefined && (!ssoStore || typeof payload.sc !== 'string' || !UUID_PATTERN.test(payload.sc))) ||
             !allowed(payload.uid, payload.idp) ||
             !organizationsHold(payload) ||
+            !teamHolds(payload) ||
             (payload.env !== undefined && payload.env !== 'test') ||
             (await options.state.sessionEnded(payload.sid, payload.exp))) {
             return null;
         }
-        const session = payload;
+        let session = payload;
         if (teams) {
             // Which of the person's organizations are on now: one turned off since is left at once.
             const enabled = session.orgs?.length ? await teams.enabled(session.orgs.map((org) => org.id)) : new Set();
             if (session.org !== undefined && !enabled.has(session.org)) {
                 const { org: _, ...personal } = session;
-                enabledOf.set(personal, enabled);
-                return personal;
+                session = personal;
             }
             enabledOf.set(session, enabled);
         }
-        return session;
+        return await withStanding(session);
     }
+    /**
+     * The session with the person's role in its workspace as the database says now (workspaces): one
+     * signed out everywhere since it was sealed is refused, and one whose membership ended falls back
+     * to the person's own workspace or, where there is none (a fixed list of organizations), ends.
+     */
+    async function withStanding(session) {
+        if (!workspaces) {
+            roles.set(session, derivedRole(session));
+            return session;
+        }
+        const person = personOf(session);
+        const [standing, listed, alive, deleting, scope] = await Promise.all([
+            workspaces.standing(tenantOf(session), person, session.sid),
+            teamStore ? teamStore.workspacesOf(person) : Promise.resolve([]),
+            workspaces.sessions ? workspaces.sessions.seen(person, session.sid) : Promise.resolve(true),
+            teamStore && session.team !== undefined ? teamStore.deleteAfter(`team:${session.team}`) : Promise.resolve(null),
+            workspaces.scope && sharedWorkspace(session) ? workspaces.scope(tenantOf(session), person) : Promise.resolve(null),
+        ]);
+        if (deleting)
+            deletingOf.set(session, deleting);
+        // Sealed under the person's current epoch, or refused: one from before Sign out everywhere,
+        // from before this store, or of a person erased since (no record, no epoch) never passes; nor
+        // one the person signed out from another device.
+        if (!alive || session.ep === undefined || standing.sessionEpoch === null || session.ep !== standing.sessionEpoch)
+            return null;
+        if (standing.role !== null) {
+            roles.set(session, standing.role);
+            // A session through a team's provider alone knows of no other team the person is in.
+            teamListOf.set(session, session.sc === undefined ? listed : listed.filter((team) => team.tenantRef === `team:${session.team}`));
+            // Limited to some resources: what this request reads for them from now on keeps to those.
+            const limited = scope && standing.role !== 'owner' ? scope : null;
+            if (limited)
+                scopes.set(session, limited);
+            setSlotlockDashboardRequestScope(limited);
+            return session;
+        }
+        // Signed in through a team's provider alone, or as a person it made: no workspace to fall back to.
+        if ((session.org === undefined && session.team === undefined) || served || session.sc !== undefined || session.idp === 'sso')
+            return null;
+        const { org: _, team: _team, ...personal } = session;
+        if (standing.refusal === 'sso_required' && session.team !== undefined) {
+            ssoRequiredOf.set(personal, { tenantRef: `team:${session.team}`, mayBypass: standing.mayBypass === true });
+        }
+        const enabled = enabledOf.get(session);
+        if (enabled)
+            enabledOf.set(personal, enabled);
+        teamListOf.set(personal, listed);
+        roles.set(personal, 'owner');
+        setSlotlockDashboardRequestScope(null);
+        return personal;
+    }
+    /** A team workspace only with team workspaces on, never beside an organization; addresses as kept. */
+    function teamHolds(payload) {
+        if (payload.team !== undefined &&
+            (!teamStore || typeof payload.team !== 'string' || !TEAM_ID.test(payload.team) || payload.org !== undefined)) {
+            return false;
+        }
+        if (payload.hd !== undefined && (payload.idp !== 'google' || typeof payload.hd !== 'string' || payload.hd.length > 253))
+            return false;
+        if (payload.em === undefined)
+            return true;
+        return (Array.isArray(payload.em) &&
+            payload.em.length <= 3 &&
+            payload.em.every((email) => typeof email === 'string' && email.length <= 254));
+    }
+    /** A workspace people share (an organization's or a team's), not a person's own. */
+    const sharedWorkspace = (session) => session.org !== undefined || session.team !== undefined;
+    /** The team workspace the session acts in (`team:<id>`, Live), or undefined. */
+    const teamTenantOf = (session) => (session.team !== undefined ? `team:${session.team}` : undefined);
+    const currentTeam = (session) => session.team === undefined ? undefined : teamListOf.get(session)?.find((ws) => ws.tenantRef === `team:${session.team}`);
+    /** Addresses the person holds verified: their Google account's, or those GitHub confirmed for an invitation. */
+    const verifiedEmails = (session) => 
+    // A session through a team's provider alone holds no address verified for anything else.
+    session.sc !== undefined
+        ? []
+        : session.idp === 'google'
+            ? session.login.includes('@')
+                ? [session.login.toLowerCase()]
+                : []
+            : (session.em ?? []);
+    /**
+     * How those addresses were verified, for joining through a domain: by a Google Workspace account
+     * of the address's own domain (the company controls it now), or once, by Google or GitHub.
+     */
+    const joinEvidence = (session) => {
+        if (session.idp !== 'google')
+            return 'github';
+        const domain = slotlockEmailDomain(session.login);
+        return session.hd !== undefined && domain !== null && domain === slotlockEmailDomain(`x@${session.hd}`) ? 'google_workspace' : 'google';
+    };
+    /**
+     * Without a membership store: the Owner of one's own workspace; in an organization's, its GitHub
+     * owners are Owners and its other members Developers, as GitHub said at sign-in.
+     */
+    function derivedRole(session) {
+        if (session.org === undefined)
+            return 'owner';
+        return session.orgs?.find((org) => org.id === session.org)?.role === 'admin' ? 'owner' : 'developer';
+    }
+    const roleOf = (session) => roles.get(session) ?? derivedRole(session);
+    /**
+     * What the person may do: their role's capabilities, and limited to some resources only those
+     * SLOTLOCK_SCOPED_CAPABILITIES keeps, and only their own account's where the resource adapters
+     * cannot keep a request to their resources.
+     */
+    const can = (session, capability) => {
+        const limited = scopes.has(session);
+        if (limited && !options.resources.keepsToScope && capability !== 'account.use')
+            return false;
+        return slotlockMemberCan(roleOf(session), limited, capability);
+    };
+    /** Whether the person reaches a page: its capability, and limited, the pages a limited member has. */
+    const reaches = (session, page) => {
+        const capability = SLOTLOCK_DASHBOARD_PAGE_CAPABILITIES[page];
+        return capability !== undefined && can(session, capability) && (!scopes.has(session) || SLOTLOCK_SCOPED_DASHBOARD_PAGES.has(page));
+    };
+    /** Signed in within the last 15 minutes: what a fresh capability needs. */
+    const freshlySignedIn = (session) => now() - (session.exp - SESSION_TTL_MS) <= FRESH_SIGN_IN_MS;
     /**
      * With organizations, the session names one the server still serves, from its own list; without
      * them, it names none. A session from the other mode is signed out.
@@ -1200,13 +1715,17 @@ export function createSlotlockDashboard(options) {
         .update(`slotlock-dashboard-csrf-v1.${session.sid}`)
         .digest('base64url');
     /** The tenant the session acts in: the workspace's, or its test environment's (`~test`). */
-    const tenantOf = (session) => `${session.org !== undefined ? `github-org:${session.org}` : personOf(session)}${session.env === 'test' ? SLOTLOCK_TEST_TENANT_SUFFIX : ''}`;
+    const tenantOf = (session) => `${session.team !== undefined
+        ? `team:${session.team}`
+        : session.org !== undefined
+            ? `github-org:${session.org}`
+            : personOf(session)}${session.env === 'test' ? SLOTLOCK_TEST_TENANT_SUFFIX : ''}`;
     /** Who did something, for the record: the person, whatever tenant they act in. */
     function personOf(session) {
-        return session.idp === 'google' ? `google:${session.uid}` : `github:${session.uid}`;
+        return session.idp === 'google' ? `google:${session.uid}` : session.idp === 'sso' ? `sso:${session.uid}` : `github:${session.uid}`;
     }
-    /** How the dashboard shows the person: their GitHub login, or their Google account's email. */
-    const shownAs = (session) => (session.idp === 'google' ? session.login : `@${session.login}`);
+    /** How the dashboard shows the person: their GitHub login, their Google account's email, or their provider's. */
+    const shownAs = (session) => session.idp === 'google' || session.idp === 'sso' || session.sc !== undefined ? session.login : `@${session.login}`;
     function respond(status, body, headers = {}, cookies = []) {
         const response = new Response(String(body), {
             status,
@@ -1246,7 +1765,7 @@ export function createSlotlockDashboard(options) {
             ? [{ section: 'assistant', label: 'Assistant', path: '/assistant', icon: ICONS.assistant }]
             : []),
         ...(plans ? [{ section: 'plan', label: 'Usage', path: '/plan', icon: ICONS.plan }] : []),
-        ...(teams ? [{ section: 'teams', label: 'Teams', path: '/teams', icon: ICONS.teams }] : []),
+        ...(teams || teamStore ? [{ section: 'teams', label: 'Teams', path: '/teams', icon: ICONS.teams }] : []),
         { section: 'settings', label: 'Settings', path: '/settings', icon: ICONS.settings },
     ];
     /** Live or Test (RFC 0003 G9): the same workspace, a tenant of its own for trying things. */
@@ -1257,12 +1776,15 @@ export function createSlotlockDashboard(options) {
     /** The workspace the session acts in: its organization, or the person themselves. */
     function workspace(session) {
         const current = session.orgs?.find((org) => org.id === session.org);
+        const team = currentTeam(session);
         const choices = (session.orgs ?? []).filter((org) => served?.has(org.id));
-        const name = current?.login ?? session.login;
+        const name = team?.name ?? current?.login ?? session.login;
         const badge = html `<span class="avatar" aria-hidden="true">${name.slice(0, 1).toUpperCase()}</span>`;
         const enabled = teams ? (session.orgs ?? []).filter((org) => enabledOf.get(session)?.has(org.id)) : [];
-        if (teams && enabled.length > 0) {
-            return html `<form class="workspace" method="post" action="${root}/organization">${badge}<input type="hidden" name="csrf" value="${csrfToken(session)}"><input type="hidden" name="once" value="${formNonce(session)}"><label class="visually-hidden" for="organization">Workspace</label><select id="organization" name="organization" title="${name}"><option value=""${current ? html `` : html ` selected`}>${shownAs(session)}</option>${enabled.map((org) => html `<option value="${org.id}"${org.id === current?.id ? html ` selected` : html ``}>${org.login}</option>`)}</select><button class="quiet" type="submit">Switch</button></form>`;
+        const listed = teamListOf.get(session) ?? [];
+        if (enabled.length > 0 || listed.length > 0) {
+            const personal = !current && !team;
+            return html `<form class="workspace" method="post" action="${root}/organization">${badge}<input type="hidden" name="csrf" value="${csrfToken(session)}"><input type="hidden" name="once" value="${formNonce(session)}"><label class="visually-hidden" for="organization">Workspace</label><select id="organization" name="organization" title="${name}"><option value=""${personal ? html ` selected` : html ``}>${shownAs(session)}</option>${enabled.map((org) => html `<option value="${org.id}"${org.id === current?.id ? html ` selected` : html ``}>${org.login}</option>`)}${listed.map((ws) => html `<option value="${ws.tenantRef}"${ws.tenantRef === team?.tenantRef ? html ` selected` : html ``}>${ws.name}</option>`)}</select><button class="quiet" type="submit">Switch</button></form>`;
         }
         if (current && choices.length > 1) {
             return html `<form class="workspace" method="post" action="${root}/organization">${badge}<input type="hidden" name="csrf" value="${csrfToken(session)}"><input type="hidden" name="once" value="${formNonce(session)}"><label class="visually-hidden" for="organization">Organization</label><select id="organization" name="organization" title="${current.login}">${choices.map((org) => html `<option value="${org.id}"${org.id === current.id ? html ` selected` : html ``}>${org.login}</option>`)}</select><button class="quiet" type="submit">Switch</button></form>`;
@@ -1296,7 +1818,9 @@ ${live}
 </body>
 </html>`;
         }
-        const links = nav().map((item) => html `<a href="${root}${item.path}"${item.section === section ? html ` aria-current="page"` : html ``}>${item.icon}<span>${item.label}</span></a>`);
+        const links = nav()
+            .filter((item) => reaches(session, item.path || '/'))
+            .map((item) => html `<a href="${root}${item.path}"${item.section === section ? html ` aria-current="page"` : html ``}>${item.icon}<span>${item.label}</span></a>`);
         return html `${head}
 <body>
 ${skip}
@@ -1308,6 +1832,8 @@ ${skip}
 </header>
 <main class="page" id="main">${session.env === 'test'
             ? html `<p class="test-banner">Test environment: its own resources, keys, webhooks and history, on your plan's limits and never billed. Its keys start <code>slk_test_</code>.</p>`
+            : html ``}${deletingOf.has(session)
+            ? html `<p class="test-banner deleting-banner">This team is deleted on ${formatDate(deletingOf.get(session))}; its keys are refused.${can(session, 'workspace.own') ? html ` <a href="${root}/settings/team">Keep it</a>` : html ``}</p>`
             : html ``}${content}</main>
 </div>
 ${live}
@@ -1327,7 +1853,7 @@ ${live}
 <h1>Sign in to ${brandName}</h1>
 <p>Create keys for your agents, add what they book, and watch what they do.</p>
 ${noticeOf(notice, status)}
-<a class="button primary wide" href="${root}/sign-in">${ICONS.github}Continue with GitHub</a>${google ? html `<a class="button wide" href="${root}/sign-in?with=google">${ICONS.google}Continue with Google</a>` : html ``}
+<a class="button primary wide" href="${root}/sign-in">${ICONS.github}Continue with GitHub</a>${google ? html `<a class="button wide" href="${root}/sign-in?with=google">${ICONS.google}Continue with Google</a>` : html ``}${ssoStore ? html `<a class="button wide" href="${root}/sso">Continue with single sign-on</a>` : html ``}
 ${options.termsUrl
             ? html `<p class="fine">By continuing you agree to the <a href="${options.termsUrl}">Terms of Service</a>.${options.privacyUrl
                 ? html ` The <a href="${options.privacyUrl}">Privacy notice</a> says what is kept.`
@@ -1355,7 +1881,7 @@ ${options.termsUrl
     ]
         .filter(Boolean)
         .join(', ');
-    function keyRows(keys, token, session) {
+    function keyRows(keys, token, session, names = new Map()) {
         return keys.map((key) => {
             const expired = key.expiresAt !== null && key.expiresAt.getTime() <= now();
             const status = key.revokedAt ? 'Revoked' : expired ? 'Expired' : 'Active';
@@ -1368,7 +1894,7 @@ ${options.termsUrl
 <form method="post" action="${root}/keys/revoke"><input type="hidden" name="csrf" value="${token}"><input type="hidden" name="once" value="${formNonce(session)}"><input type="hidden" name="id" value="${key.id}"><button class="danger" type="submit">Revoke key</button></form></div></details>`
                 : html ``;
             return html `<tr>
-<td data-label="Name" class="strong"><span class="cell"><span class="truncate" title="${key.name}">${key.name}</span>${session.org !== undefined ? html `<span class="meta">Created by ${key.createdBy === personOf(session) ? 'you' : key.createdBy?.startsWith('github:') ? `GitHub user ${key.createdBy.slice(7)}` : key.createdBy?.startsWith('google:') ? 'a Google user' : 'someone unknown'}</span>` : html ``}</span></td>
+<td data-label="Name" class="strong"><span class="cell"><span class="truncate" title="${key.name}">${key.name}</span>${sharedWorkspace(session) ? html `<span class="meta">Created by ${key.createdBy === personOf(session) ? 'you' : (key.createdBy && names.get(key.createdBy)) ?? (key.createdBy?.startsWith('github:') ? `GitHub user ${key.createdBy.slice(7)}` : key.createdBy?.startsWith('google:') ? 'a Google user' : 'someone unknown')}</span>` : html ``}</span></td>
 <td data-label="Key"><code class="chip">${key.prefix}…</code></td>
 <td data-label="Access">${key.resourceScope || key.limits
                 ? html `<span class="cell"><span>${accessOf(key)}</span>${key.resourceScope ? html `<span class="meta wrap">Only ${[...key.resourceScope.locations, ...key.resourceScope.groups.map((group) => `group ${group}`)].join(', ')}</span>` : html ``}${key.limits ? html `<span class="meta wrap">At most ${keyLimitsText(key.limits)}</span>` : html ``}</span>`
@@ -1533,8 +2059,10 @@ ${options.termsUrl
         const start = new Date(now());
         const window = { start, end: new Date(start.getTime() + AGENDA_DAYS * DAY_MS) };
         const assistant = assistantStore();
+        // A member limited to some resources sees theirs: no keys, plan or setup, which are the workspace's.
+        const limited = scopes.has(session);
         const [keys, resources, agenda, changes, approvals, waitlist, model] = await Promise.all([
-            options.keys.list({ tenantRef }),
+            limited ? Promise.resolve([]) : options.keys.list({ tenantRef }),
             options.resources.list(tenantRef),
             options.resources.agenda?.(tenantRef, window, AGENDA_LIMIT),
             options.resources.recentChanges?.(tenantRef, ACTIVITY_LIMIT),
@@ -1543,7 +2071,7 @@ ${options.termsUrl
             assistant?.getSettings(tenantRef),
         ]);
         // The plan is Live's: the test environment has none of its own.
-        const standing = plans && session.env !== 'test' ? await planStanding(session, 'overview', keys) : null;
+        const standing = plans && session.env !== 'test' && !limited ? await planStanding(session, 'overview', keys) : null;
         const byId = new Map(resources.map((resource) => [resource.id, resource]));
         const active = keys.filter((key) => !key.revokedAt && (key.expiresAt === null || key.expiresAt.getTime() > now()));
         const counted = (count) => agenda && agenda.length >= AGENDA_LIMIT ? `${count}+` : String(count);
@@ -1562,7 +2090,7 @@ ${options.termsUrl
                 : []),
         ];
         const admin = isAdmin(session);
-        const steps = [
+        const steps = limited ? [] : [
             { done: resources.length > 0, title: 'Add a resource', action: { href: `${root}/resources`, label: 'Add resource' } },
             { done: active.length > 0, title: 'Create an API key', action: { href: `${root}/keys#new-key`, label: 'Create key' } },
             // Done once an agent has used a key.
@@ -1578,7 +2106,7 @@ ${options.termsUrl
         const done = steps.filter((step) => step.done).length;
         const next = steps.findIndex((step) => !step.done);
         // Nothing made and nothing happened yet: only the way in.
-        const fresh = resources.length === 0 && active.length === 0 && (changes?.length ?? 0) === 0;
+        const fresh = !limited && resources.length === 0 && active.length === 0 && (changes?.length ?? 0) === 0;
         const setupCard = next === -1
             ? html ``
             : html `<section class="panel setup-card"><div class="panel-head"><h2>Get started</h2><span class="meta">${String(done)} of ${String(steps.length)}</span></div><div class="segments" aria-hidden="true">${steps.map((step) => html `<span${step.done ? html ` class="done"` : html ``}></span>`)}</div><ol class="setup-steps">${steps.map((step, index) => html `<li class="${step.done ? 'done' : index === next ? 'next' : ''}"><span class="check" aria-hidden="true">${step.done ? ICONS.check : html ``}</span><span class="step-title">${step.title}${step.done ? html `<span class="visually-hidden"> (done)</span>` : html ``}</span>${index === next ? html `<a class="button primary" href="${step.action.href}">${step.action.label}</a>` : html ``}</li>`)}</ol></section>`;
@@ -1592,21 +2120,21 @@ ${options.termsUrl
             ...(approvals ? [stat('Waiting for approval', String(waiting), `${root}/approvals`, waiting > 0 ? ' attention-stat' : '')] : []),
             ...(waitlist ? [stat('On the waitlist', String(waitlist.filter((entry) => entry.status !== 'expired').length), `${root}/waitlist`)] : []),
             stat('Resources', String(resources.length), `${root}/resources`),
-            stat('Active keys', String(active.length), `${root}/keys`),
+            ...(limited ? [] : [stat('Active keys', String(active.length), `${root}/keys`)]),
         ].slice(0, 4);
         const planCard = standing
             ? html `<section class="panel plan-card"><div class="panel-head"><h2>${standing.name}</h2><a href="${root}/plan">Usage</a></div><div class="meters stacked">${standing.meters}</div>${standing.canUpgrade && standing.pressing
                 ? html `<a class="button primary" href="${root}/plan#upgrade">Upgrade</a>`
                 : html ``}</section>`
             : html ``;
-        const connectCard = html `<section class="panel" id="connect"><h2>Connect an agent</h2>${connectAgent()}</section>`;
+        const connectCard = limited ? html `` : html `<section class="panel" id="connect"><h2>Connect an agent</h2>${connectAgent()}</section>`;
         const body = fresh
             ? standing
                 ? html `<div class="split">${setupCard}<div class="column">${planCard}</div></div>`
                 : setupCard
             : html `${done * 2 >= steps.length ? setupRow : setupCard}
 <div class="stats">${tiles}</div>
-${session.env === 'test' && options.resources.sandbox ? sandboxPanel(session, resources.length) : html ``}
+${session.env === 'test' && options.resources.sandbox && can(session, 'sandbox.manage') ? sandboxPanel(session, resources.length) : html ``}
 <div class="split">
 <div class="column">
 ${agenda ? html `<section class="panel" id="upcoming"><h2>Upcoming</h2>${agendaPanel(agenda, byId, agenda.length > AGENDA_SHOWN)}</section>` : html ``}
@@ -1617,7 +2145,7 @@ ${changes ? html `<section class="panel"><h2>Activity</h2>${activityPanel(change
         const content = html `${noticeOf(notice, status)}
 ${pageHead('Overview')}
 ${attentionList(attention)}
-${fresh && session.env === 'test' && options.resources.sandbox ? sandboxPanel(session, resources.length) : html ``}
+${fresh && session.env === 'test' && options.resources.sandbox && can(session, 'sandbox.manage') ? sandboxPanel(session, resources.length) : html ``}
 ${body}`;
         return respond(status, layout('Overview', content, session, 'overview'));
     }
@@ -1671,11 +2199,14 @@ ${resourceCount === 0
     async function keysPage(session, status = 200, notice) {
         const tenantRef = tenantOf(session);
         const grouping = options.resources.grouping;
-        const [keys, locations, groups] = await Promise.all([
+        const team = teamTenantOf(session);
+        const [keys, locations, groups, members] = await Promise.all([
             options.keys.list({ tenantRef }),
             grouping?.locations(tenantRef),
             grouping?.groups(tenantRef),
+            teamStore && team !== undefined ? teamStore.members(team) : Promise.resolve([]),
         ]);
+        const names = new Map(members.map((member) => [member.person, memberName(member)]));
         const token = csrfToken(session);
         const paths = locationPaths(locations ?? []);
         // A key limited to locations or groups (RFC 0003 G6), when the tenant has any to choose.
@@ -1704,8 +2235,8 @@ ${limitChoices}
 </section>
 ${keys.length === 0
             ? emptyState(ICONS.keys, 'No keys yet. Give every agent its own, with the least access it needs.', { href: '#key-name', label: 'Create a key' })
-            : html `${session.org !== undefined ? html `<p class="fine">Each key acts in this organization only, and every member can rotate or revoke it.</p>` : html ``}<div class="table"><table><thead><tr><th>Name</th><th>Key</th><th>Access</th><th>Created</th><th>Last used</th><th>Expires</th><th>Status</th><th><span class="visually-hidden">Actions</span></th></tr></thead>
-<tbody>${keyRows(keys, token, session)}</tbody></table></div>`}`;
+            : html `<div class="table"><table><thead><tr><th>Name</th><th>Key</th><th>Access</th><th>Created</th><th>Last used</th><th>Expires</th><th>Status</th><th><span class="visually-hidden">Actions</span></th></tr></thead>
+<tbody>${keyRows(keys, token, session, names)}</tbody></table></div>`}`;
         return respond(status, layout('API keys', content, session, 'keys'));
     }
     /**
@@ -1831,20 +2362,55 @@ ${groups.length === 0
     /** Settings' sections, each its own page: the assistant's form apart from what is only read. */
     const SETTINGS_SECTIONS = Object.freeze([
         { id: 'assistant', label: 'Assistant', path: '/settings' },
+        { id: 'members', label: 'Members', path: '/settings/members' },
+        { id: 'team', label: 'Team', path: '/settings/team' },
+        { id: 'identity', label: 'Identity', path: '/settings/identity' },
+        { id: 'audit', label: 'Audit log', path: '/settings/audit' },
+        { id: 'privacy', label: 'Privacy', path: '/settings/privacy' },
         { id: 'endpoints', label: 'Endpoints', path: '/settings/endpoints' },
         { id: 'hours', label: 'Hours', path: '/settings/hours' },
         { id: 'account', label: 'Account', path: '/settings/account' },
     ]);
-    async function settingsPage(session, status = 200, notice, draft, section = 'assistant') {
+    async function settingsPage(session, status = 200, notice, draft, section = 'assistant', invitation, query, found) {
         const store = assistantStore();
-        const sections = SETTINGS_SECTIONS.filter((entry) => entry.id !== 'assistant' || store);
-        const shown = section === 'assistant' && !store ? 'endpoints' : section;
+        // Members are a team workspace's: its people come from invitations, not from GitHub.
+        const sections = SETTINGS_SECTIONS.filter((entry) => (entry.id !== 'assistant' || store) &&
+            (entry.id !== 'members' || (teamStore && session.team !== undefined)) &&
+            (entry.id !== 'team' || (teamStore && session.team !== undefined && can(session, 'workspace.own'))) &&
+            (entry.id !== 'identity' || (domainStore && session.team !== undefined && can(session, 'identity.manage'))) &&
+            (entry.id !== 'audit' || (options.resources.audit && can(session, 'audit.read'))) &&
+            (entry.id !== 'privacy' || (options.resources.privacy && can(session, 'privacy.manage'))) &&
+            // Limited to some resources: one's account and the team's people, nothing of the workspace's.
+            (!scopes.has(session) || entry.id === 'account' || entry.id === 'members'));
+        const shown = scopes.has(session) && !sections.some((entry) => entry.id === section)
+            ? 'account'
+            : section === 'assistant' && !store
+                ? 'endpoints'
+                : (section === 'members' || section === 'audit' || section === 'team' || section === 'privacy' || section === 'identity') &&
+                    !sections.some((entry) => entry.id === section)
+                    ? 'account'
+                    : section;
         const connected = store ? Boolean(await store.getSettings(tenantOf(session))) : false;
         const nav = html `<nav class="subnav" aria-label="Settings">${sections.map((entry) => html `<a href="${root}${entry.path}"${entry.id === shown ? html ` aria-current="page"` : html ``}>${entry.label}${entry.id === 'assistant' && connected ? html `<span class="nav-dot" aria-hidden="true"></span>` : html ``}</a>`)}</nav>`;
         let body;
         if (shown === 'assistant') {
             body = await assistantSettingsSection(session, status, notice, draft);
         }
+        else if (shown === 'members') {
+            body = await membersSection(session, status, notice, invitation);
+        }
+        else if (shown === 'team') {
+            body = await teamSection(session, status, notice);
+        }
+        else if (shown === 'identity') {
+            body = await identitySection(session, status, notice);
+        }
+        else if (shown === 'audit') {
+            body = await auditSection(session, status, notice, query ?? new URLSearchParams());
+        }
+        else if (shown === 'privacy') {
+            body = await privacySection(session, status, notice, found);
+        }
         else if (shown === 'endpoints') {
             body = html `${noticeOf(notice, status)}<div class="set-card"><div class="row"><span class="row-label">MCP</span><div class="row-value">${copyField('mcp-url', mcpUrl)}</div></div><div class="row"><span class="row-label">A2A</span><div class="row-value">${copyField('a2a-url', a2aUrl)}</div></div></div>`;
         }
@@ -1856,14 +2422,47 @@ ${groups.length === 0
         }
         else {
             const current = session.orgs?.find((org) => org.id === session.org);
+            const team = currentTeam(session);
             const others = (session.orgs ?? []).filter((org) => org.id !== current?.id);
-            body = html `${noticeOf(notice, status)}<div class="set-card"><div class="row"><span class="row-label">Signed in as</span><div class="row-value">${shownAs(session)}</div></div><div class="row"><span class="row-label">${current ? 'Organization' : 'Workspace'}</span><div class="row-value">${current ? current.login : 'Personal'}</div></div>${current && others.length > 0
+            body = html `${noticeOf(notice, status)}<div class="set-card"><div class="row"><span class="row-label">Signed in as</span><div class="row-value">${shownAs(session)}</div></div><div class="row"><span class="row-label">${current ? 'Organization' : team ? 'Team' : 'Workspace'}</span><div class="row-value">${current ? current.login : team ? team.name : 'Personal'}</div></div>${current && others.length > 0
                 ? html `<div class="row"><span class="row-label">Also a member of</span><div class="row-value">${others.map((org) => org.login).join(', ')}</div></div>`
-                : html ``}<div class="row"><span class="row-label">Session ends</span><div class="row-value">${formatDate(new Date(session.exp))}</div></div></div>${current ? html `<p class="fine">Membership is read from GitHub when you sign in.</p>` : html ``}`;
+                : html ``}<div class="row"><span class="row-label">Role</span><div class="row-value">${SLOTLOCK_WORKSPACE_ROLE_NAMES[roleOf(session)]}</div></div><div class="row"><span class="row-label">Session ends</span><div class="row-value">${formatDate(new Date(session.exp))}</div></div>${workspaces && session.sc === undefined
+                ? html `<div class="row"><span class="row-label">Sessions</span><div class="row-value"><form method="post" action="${root}/sign-out-everywhere"><input type="hidden" name="csrf" value="${csrfToken(session)}"><input type="hidden" name="once" value="${formNonce(session)}"><button type="submit">Sign out everywhere</button></form></div></div>`
+                : html ``}</div>${current ? html `<p class="fine">Membership is read from GitHub when you sign in.</p>` : html ``}${await sessionsList(session)}`;
         }
         const content = html `${pageHead('Settings')}<div class="settings">${nav}<div class="settings-body">${body}</div></div>`;
         return respond(status, layout('Settings', content, session, 'settings'));
     }
+    /** Where the person is signed in, each but this one with Sign out. */
+    async function sessionsList(session) {
+        const kept = workspaces?.sessions;
+        if (!kept)
+            return html ``;
+        const person = personOf(session);
+        const mine = kept.idOf(session.sid);
+        // A session through a team's provider alone sees only itself: the person's other sessions (and
+        // where they were signed in from) are beyond its team.
+        const listed = (await kept.list(person)).filter((entry) => session.sc === undefined || entry.id === mine);
+        if (listed.length === 0)
+            return html ``;
+        const rows = listed.map((entry) => html `<tr><td data-label="Device" class="strong">${deviceOf(entry.userAgent)}${entry.id === mine ? html ` <span class="pill active">This device</span>` : html ``}</td><td data-label="Address">${entry.ipAddress ?? '—'}</td><td data-label="Signed in">${formatDate(entry.startedAt)}</td><td data-label="Last seen">${formatDate(entry.lastSeenAt)}</td><td class="actions">${entry.id === mine
+            ? html ``
+            : html `<form class="inline" method="post" action="${root}/sessions/end"><input type="hidden" name="csrf" value="${csrfToken(session)}"><input type="hidden" name="once" value="${formNonce(session)}"><input type="hidden" name="id" value="${entry.id}"><button type="submit">Sign out<span class="visually-hidden"> ${deviceOf(entry.userAgent)}, signed in ${formatDate(entry.startedAt)}</span></button></form>`}</td></tr>`);
+        return html `<h2 class="sessions-head">Signed in</h2><div class="table"><table><thead><tr><th>Device</th><th>Address</th><th>Signed in</th><th>Last seen</th><th><span class="visually-hidden">Actions</span></th></tr></thead><tbody>${rows}</tbody></table></div>`;
+    }
+    async function endSession(session, form) {
+        const kept = workspaces?.sessions;
+        if (!kept)
+            return nothingHere(session);
+        const id = (form.get('id') ?? '').toLowerCase();
+        if (id === kept.idOf(session.sid)) {
+            return settingsPage(session, 400, 'To sign out of this device, use Sign out.', undefined, 'account');
+        }
+        if (!(await kept.end(personOf(session), id))) {
+            return settingsPage(session, 404, 'That session has ended already.', undefined, 'account');
+        }
+        return settingsPage(session, 200, 'Signed out of that device.', undefined, 'account');
+    }
     /** A value to copy: monospace, cut with an ellipsis, with a Copy button (app.js). */
     const copyField = (id, value) => html `<dl class="endpoints"><dd><code id="${id}">${value}</code><button class="quiet" type="button" data-copy="${id}">Copy</button></dd></dl>`;
     /** The tenant's resource with that id and every resource (for names), or null for anything else. */
@@ -1938,11 +2537,12 @@ ${field('defaultDurationMinutes', 'Usual length, offered when none is asked', 'm
 ${field('cancelCutoffMinutes', 'Cancel up to, before the start', 'min')}
 ${field('rescheduleCutoffMinutes', 'Move up to, before the start', 'min')}
 </div>
-${resource.bookingRules?.allowedDurations || resource.bookingRules?.pickupTimes || resource.bookingRules?.returnTimes || resource.bookingRules?.cancellationFee ? html `<p class="fine">Set through the API, and kept when you save: ${[
+${resource.bookingRules?.allowedDurations || resource.bookingRules?.pickupTimes || resource.bookingRules?.returnTimes || resource.bookingRules?.cancellationFee || resource.bookingRules?.holdPrice ? html `<p class="fine">Set through the API, and kept when you save: ${[
                 resource.bookingRules.allowedDurations ? `lengths ${ruleValueText(resource.bookingRules.allowedDurations)} min` : '',
                 resource.bookingRules.pickupTimes ? `pick-up ${ruleValueText(resource.bookingRules.pickupTimes)}` : '',
                 resource.bookingRules.returnTimes ? `return ${ruleValueText(resource.bookingRules.returnTimes)}` : '',
                 resource.bookingRules.cancellationFee ? `cancellation fee ${ruleValueText(resource.bookingRules.cancellationFee)}` : '',
+                resource.bookingRules.holdPrice ? `hold price ${ruleValueText(resource.bookingRules.holdPrice)}` : '',
             ].filter(Boolean).join('; ')}.</p>` : html ``}
 ${toggle('enforceHours', 'enforce_hours', 'Only inside bookable hours')}
 ${toggle('requireCertain', 'require_certain', 'Only in time its calendar syncs have read today')}
@@ -2053,7 +2653,7 @@ ${activity ? html `<section class="panel"><h2>Activity</h2>${activityPanel(activ
         if (requireCertain !== undefined)
             rules.requireCertain = requireCertain;
         // Rules the form does not edit (set through the API) are kept.
-        for (const name of ['allowedDurations', 'pickupTimes', 'returnTimes', 'cancellationFee']) {
+        for (const name of ['allowedDurations', 'pickupTimes', 'returnTimes', 'cancellationFee', 'holdPrice']) {
             const kept = resource.bookingRules?.[name];
             if (kept !== undefined)
                 rules[name] = kept;
@@ -2306,7 +2906,9 @@ ${endpoints.length === 0
         const created = await hooks.create(tenantOf(session), (form.get('url') ?? '').trim(), types.length === 0 ? undefined : types, personOf(session));
         if (!created.ok) {
             const message = created.code === 'webhook_limit_reached'
-                ? `You have ${String(created.limit)} webhooks, as many as ${plans ? 'your plan' : 'Slotlock'} allows. Delete one first${plans ? ', or see Usage' : ''}.`
+                ? plans
+                    ? html `You have ${String(created.limit)} webhooks, as many as your plan allows. Delete one first, or ${await pastLimit(session)}.`
+                    : `You have ${String(created.limit)} webhooks, as many as Slotlock allows. Delete one first.`
                 : created.code === 'invalid_webhook_url'
                     ? 'Give an https URL, with no user name, password or #fragment.'
                     : 'Choose events from the list.';
@@ -2619,11 +3221,17 @@ ${decided.length === 0
     }
     /** Owners of the organization in use may change its assistant; a person always may their own. */
     /** An owner of the workspace: the person in their own, an organization's owner in its. */
-    const isAdmin = (session) => session.org === undefined || session.orgs?.find((org) => org.id === session.org)?.role === 'admin';
+    /** May connect or change the assistant's model (Owner, Admin). */
+    const isAdmin = (session) => can(session, 'assistant.settings');
+    /** May change the plan and open billing (Owner, Billing). */
+    const mayBill = (session) => can(session, 'billing.manage');
+    /** Never more than the person may do: a Viewer's assistant only reads; it never holds admin. */
     const assistantPrincipal = (session) => ({
         subject: assistantActor(session),
         tenantRef: tenantOf(session),
-        scopes: ['read', 'write'],
+        scopes: can(session, 'operations.run') ? ['read', 'write'] : ['read'],
+        // Limited to some resources, as a key limited to them: nothing outside is found.
+        ...(scopes.has(session) ? { resourceScope: scopes.get(session) } : {}),
     });
     /** The fixed list, then the embedder's check: nothing the model sends adds to it. */
     const assistantAuthorize = async (args) => SLOTLOCK_ASSISTANT_TOOL_USE[args.operation] !== 'excluded' &&
@@ -3121,7 +3729,7 @@ ${decided.length === 0
             return { provider: preset.provider, baseUrl: preset.baseUrl };
         return { provider: form.get('provider'), baseUrl: (form.get('base_url') ?? '').trim() };
     }
-    const adminOnly = (session) => settingsPage(session, 403, 'Only an owner of this organization can change the assistant.');
+    const adminOnly = (session) => settingsPage(session, 403, 'Only an owner or an admin of this workspace can change the assistant.');
     async function saveAssistantSettings(session, form) {
         const store = assistantStore();
         if (!store || !assistantOptions)
@@ -3627,7 +4235,7 @@ ${decided.length === 0
             ? summarizeSlotlockUsage(await options.resources.usage(tenantRef, month.from, month.to))
             : null;
         const keyCount = keys.filter((key) => !key.revokedAt && (key.expiresAt === null || key.expiresAt.getTime() > now())).length;
-        const admin = isAdmin(session);
+        const admin = mayBill(session);
         const paying = plan !== null && plan.plan !== 'free';
         const upcoming = !plan && planDefault && planDefault.appliesFrom.getTime() > now() ? planDefault : null;
         const limits = plan?.limits ?? upcoming?.limits;
@@ -3636,8 +4244,10 @@ ${decided.length === 0
         const counted = (value) => value.toLocaleString('en-GB');
         const usagePage = `${root}/plan`;
         const upgradeAt = here === 'usage' ? '#upgrade' : `${usagePage}#upgrade`;
-        const canUpgrade = !paying && admin && Boolean(billing || active.contact);
-        const upgradeHint = paying ? '' : admin ? ' Upgrade for more.' : ' An owner of this organization can upgrade.';
+        // Only where the deployment sells plans (Stripe) or arranges them (a contact) is there an upgrade.
+        const offersPlans = Boolean(billing || active.contact);
+        const canUpgrade = !paying && admin && offersPlans;
+        const upgradeHint = paying || !offersPlans ? '' : admin ? ' Upgrade for more.' : ' An owner of this organization can upgrade.';
         const attention = [];
         // Whether anything is near or past a limit: the overview then offers the upgrade.
         let pressing = false;
@@ -3661,22 +4271,35 @@ ${decided.length === 0
                     attention.push(attentionItem('warn', `You have used this month's ${counted(quota)} ${metric}.${billed ? ` Those past it are billed at ${billing?.overage?.price ?? ''}.` : ''} Slotlock refuses ${refused} past ${counted(stop)}, until ${resets}.${billed ? '' : upgradeHint}`, billed ? undefined : upgrade));
                 }
                 else if (spent * 100 >= quota * 80) {
-                    attention.push(attentionItem('warn', `You have used ${String(Math.floor((spent * 100) / quota))}% of this month's ${metric}. They start again on ${resets}.`, here === 'overview' ? { href: usagePage, label: 'Usage' } : undefined));
+                    attention.push(attentionItem('warn', `You have used ${String(Math.floor((spent * 100) / quota))}% of this month's ${metric}. They start again on ${resets}.`, upgrade));
                 }
             }
         }
+        // What the workspace has against its plan's limits (or the coming plan's): at one, adding another
+        // is refused; past one (a plan that allows less than it has), nothing is removed.
+        const full = limits
+            ? [
+                ['resources', resourceCount, limits.resources],
+                ['active API keys', keyCount, limits.apiKeys],
+                ...(webhooks ? [['webhooks', webhooks.length, limits.webhookEndpoints]] : []),
+            ].filter(([, have, allowed]) => have >= allowed)
+            : [];
+        const over = full.filter(([, have, allowed]) => have > allowed);
+        const holding = full.map(([what, have, allowed]) => `${counted(have)} of ${counted(allowed)} ${what}`).join(' and ');
+        if (full.length > 0)
+            pressing = true;
+        const limitAction = canUpgrade
+            ? { href: upgradeAt, label: 'Upgrade' }
+            : here === 'overview'
+                ? { href: usagePage, label: 'Usage' }
+                : undefined;
         if (upcoming) {
-            // What the workspace has that its coming plan will not allow: nothing is removed; adding stops.
-            const over = [
-                ['resources', resourceCount, upcoming.limits.resources],
-                ['active API keys', keyCount, upcoming.limits.apiKeys],
-                ['webhooks', webhooks?.length ?? 0, upcoming.limits.webhookEndpoints],
-            ].filter(([, have, allowed]) => have > allowed);
-            if (over.length > 0)
-                pressing = true;
-            attention.push(attentionItem(over.length > 0 ? 'warn' : 'info', `From ${formatDate(upcoming.appliesFrom)}, this workspace is on ${PLAN_NAMES[upcoming.plan]}: ${String(upcoming.limits.resources)} resources, ${String(upcoming.limits.apiKeys)} API keys and ${String(upcoming.limits.webhookEndpoints)} webhooks.${over.length > 0
-                ? ` You have ${over.map(([what, have]) => `${String(have)} ${what}`).join(', ')}: nothing is removed, but you cannot add more until you have fewer${paying || !admin ? '' : ', or upgrade'}.`
-                : ''}`, canUpgrade && over.length > 0 ? { href: upgradeAt, label: 'See plans' } : undefined));
+            attention.push(attentionItem(full.length > 0 ? 'warn' : 'info', `From ${formatDate(upcoming.appliesFrom)}, this workspace is on ${PLAN_NAMES[upcoming.plan]}: ${String(upcoming.limits.resources)} resources, ${String(upcoming.limits.apiKeys)} API keys and ${String(upcoming.limits.webhookEndpoints)} webhooks.${full.length > 0
+                ? ` You have ${holding}: ${over.length > 0 ? 'nothing is removed, but ' : ''}from then, adding another is refused.${upgradeHint}`
+                : ''}`, full.length > 0 ? limitAction : undefined));
+        }
+        else if (plan && full.length > 0) {
+            attention.push(attentionItem(over.length > 0 ? 'bad' : 'warn', `On ${PLAN_NAMES[plan.plan]}, you have ${holding}: ${over.length > 0 ? 'nothing is removed, but ' : ''}adding another is refused.${upgradeHint}`, limitAction));
         }
         /** One use against its allowance: a bar, amber from 80%, red at the limit. */
         const meter = (label, value, limit) => {
@@ -3714,6 +4337,17 @@ ${decided.length === 0
             pressing,
         };
     }
+    /**
+     * What resolves an add refused at a plan limit, as a link: the upgrade on Usage, for an owner of a
+     * workspace that does not pay yet where the deployment sells or arranges plans; else Usage.
+     */
+    async function pastLimit(session) {
+        const plan = plans ? await plans.plan(tenantOf(session)).catch(() => null) : null;
+        const paying = plan !== null && plan.plan !== 'free';
+        return !paying && mayBill(session) && Boolean(options.billing || plans?.contact)
+            ? html `<a href="${root}/plan#upgrade">upgrade</a>`
+            : html `see <a href="${root}/plan">Usage</a>`;
+    }
     /** One thing that needs a person: a sentence, its tone, and what resolves it. */
     const attentionItem = (tone, text, action) => html `<li class="attention ${tone}"><span class="attention-text">${text}</span>${action ? html `<a class="attention-action" href="${action.href}">${action.label}</a>` : html ``}</li>`;
     /** The list of things that need a person, or nothing. */
@@ -3739,7 +4373,7 @@ ${decided.length === 0
         const token = csrfToken(session);
         const keyName = new Map(keys.map((key) => [key.id, key.name]));
         // An organization is offered Team (where billing sells it, or by asking); a person, Developer.
-        const offered = session.org !== undefined && (billing ? Boolean(billing.teamPrices) : true) ? 'team' : 'developer';
+        const offered = sharedWorkspace(session) && (billing ? Boolean(billing.teamPrices) : true) ? 'team' : 'developer';
         const contact = plans.contact ?? billing?.contact;
         const manage = billing && plan?.stripeCustomer && admin
             ? html `<form class="inline" method="post" action="${root}/plan/manage"><input type="hidden" name="csrf" value="${token}"><input type="hidden" name="once" value="${formNonce(session)}"><button type="submit">Manage billing</button></form>`
@@ -3803,8 +4437,11 @@ ${contact
             return notFound(session);
         if (session.env === 'test')
             return planPage(session, 400, 'Plans are changed in Live.');
-        if (!isAdmin(session))
-            return planPage(session, 403, 'Only owners of the organization can change its plan.');
+        if (!mayBill(session))
+            return planPage(session, 403, 'Only an owner or a billing manager of this workspace can change its plan.');
+        // A team being deleted takes no plan: kept first, so it is never billed while it waits to go.
+        if (deletingOf.has(session))
+            return planPage(session, 409, 'This team is being deleted. Keep it on Settings, Team before choosing a plan.');
         const interval = form.get('interval') === 'year' ? 'year' : 'month';
         const tenantRef = tenantOf(session);
         const plan = await billing.plan(tenantRef);
@@ -3816,7 +4453,7 @@ ${contact
             url = await billing.checkout({
                 tenantRef,
                 interval,
-                ...(session.org !== undefined && billing.teamPrices ? { plan: 'team' } : {}),
+                ...(sharedWorkspace(session) && billing.teamPrices ? { plan: 'team' } : {}),
                 customer: plan?.stripeCustomer ?? null,
                 successUrl: `${publicRoot}/plan?checkout=done`,
                 cancelUrl: `${publicRoot}/plan`,
@@ -3837,8 +4474,8 @@ ${contact
             return notFound(session);
         if (session.env === 'test')
             return planPage(session, 400, 'Billing is managed in Live.');
-        if (!isAdmin(session))
-            return planPage(session, 403, 'Only owners of the organization can manage its billing.');
+        if (!mayBill(session))
+            return planPage(session, 403, 'Only an owner or a billing manager of this workspace can manage its billing.');
         const plan = await billing.plan(tenantOf(session));
         if (!plan?.stripeCustomer)
             return planPage(session, 409, 'There is no billing to manage yet.');
@@ -3853,33 +4490,226 @@ ${contact
         return redirect(303, url);
     }
     /** The page a form was sent from, to show what went wrong with it. */
-    function pageFor(route) {
+    /** Where a request came from, as the audit log keeps it: the client's address, and its browser. */
+    function requestOrigin(request) {
+        const address = options.clientAddress?.(request);
+        const agent = request.headers.get('user-agent')?.slice(0, 256);
+        return { ...(address ? { ipAddress: address.slice(0, 64) } : {}), ...(agent ? { userAgent: agent } : {}) };
+    }
+    /**
+     * Record what the person did (or was refused) in the workspace's audit log. An action already done
+     * is not undone because its record failed: the failure goes to onError.
+     */
+    async function audit(session, event, tenantRef = tenantOf(session)) {
+        const log = options.resources.audit;
+        if (!log)
+            return;
+        const from = origins.get(session) ?? {};
+        try {
+            await log.record(tenantRef, {
+                actorType: 'person',
+                actorRef: personOf(session),
+                actorRole: roleOf(session),
+                ...from,
+                ...event,
+            });
+        }
+        catch (error) {
+            try {
+                ignoreRejection(options.onError?.(error));
+            }
+            catch {
+                // A failing reporter must not change the response.
+            }
+        }
+    }
+    /** What an audited form changed: its target, and what describes the change (never a secret). */
+    function auditDetails(route, form) {
+        const id = form.get('id') ?? '';
+        if (route === '/keys') {
+            return { targetType: 'api_key', metadata: { access: form.get('access') ?? '', expires: form.get('expires') ?? '' } };
+        }
+        if (route.startsWith('/keys/') && UUID_PATTERN.test(id))
+            return { targetType: 'api_key', targetRef: id };
+        if (route === '/webhooks') {
+            let host = '';
+            try {
+                host = new URL(form.get('url') ?? '').host;
+            }
+            catch {
+                // An address the form refused names no host.
+            }
+            return { targetType: 'webhook', metadata: host ? { host } : {} };
+        }
+        if (route.startsWith('/webhooks/') && UUID_PATTERN.test(id))
+            return { targetType: 'webhook', targetRef: id };
+        if (route.startsWith('/teams/')) {
+            const org = form.get('organization') ?? '';
+            return ORGANIZATION_ID.test(org) ? { targetType: 'organization', targetRef: `github-org:${org}` } : {};
+        }
+        if (route === '/settings/assistant') {
+            return { metadata: { provider: (form.get('provider') ?? '').slice(0, 40), model: (form.get('model') ?? '').slice(0, 120) } };
+        }
+        return {};
+    }
+    /**
+     * Every capability a form needs: its route's, and more where the form decides. A Full-access key
+     * asks `keys.full`; a key someone else created asks `keys.manage_any`; rotating or limiting a
+     * Full-access key asks `keys.full` as well, so a person who lost that power cannot keep it by
+     * rotating, and anyone rotating one signed in recently. An empty list is a route with none.
+     */
+    async function capabilitiesOf(session, route, form) {
+        const base = SLOTLOCK_DASHBOARD_POST_CAPABILITIES[route];
+        if (base === undefined)
+            return [];
+        const needed = [base];
+        if (route === '/keys' && form.get('access') === 'full')
+            needed.push('keys.full');
+        // Giving a role needs its powers: making an Owner `workspace.own`, a Billing manager `billing.manage`.
+        if (route === '/members/invite' || route === '/members/role') {
+            const role = form.get('role');
+            if (role === 'owner')
+                needed.push('workspace.own');
+            if (role === 'billing')
+                needed.push('billing.manage');
+        }
+        if (route === '/keys/rotate' || route === '/keys/revoke' || route === '/keys/limits') {
+            // As PostgreSQL reads a uuid, whatever its case: the key the handler would act on.
+            const id = (form.get('id') ?? '').toLowerCase();
+            if (UUID_PATTERN.test(id)) {
+                const key = (await options.keys.list({ tenantRef: tenantOf(session) })).find((candidate) => candidate.id.toLowerCase() === id);
+                // A key not listed here is not one the person made: only who may change anyone's tries it.
+                if (!key || key.createdBy !== personOf(session))
+                    needed.push('keys.manage_any');
+                if (key?.scopes.includes('admin') && route !== '/keys/revoke')
+                    needed.push('keys.full');
+            }
+        }
+        return needed;
+    }
+    /** The page a form's route belongs to, to go back to. */
+    const backOf = (route) => {
+        if (route.startsWith('/members/'))
+            return '/settings/members';
+        if (route.startsWith('/identity/'))
+            return '/settings/identity';
+        if (route.startsWith('/join/'))
+            return '/teams';
+        if (route === '/teams/delete' || route === '/teams/restore')
+            return '/settings/team';
+        if (route.startsWith('/settings/privacy'))
+            return '/settings/privacy';
+        const first = `/${route.split('/')[1] ?? ''}`;
+        return first === '/' ? '' : first;
+    };
+    /** Refuse a form the person's role does not allow, or ask them to sign in again for a fresh one. */
+    async function authorizePost(session, route, form) {
+        // Signed in through a team's provider alone: the session acts in that team, and reaches no other
+        // (joining, invitations, switching, creating, proving oneself elsewhere). The provider is the
+        // team Owner's, so what it asserts must open nothing outside the team.
+        if (session.sc !== undefined && SSO_SCOPED_REFUSED.has(route)) {
+            await audit(session, { action: 'authz.denied', outcome: 'denied', reason: 'sso_scope', metadata: { route } });
+            return respond(403, layout('Not allowed', html `<p class="notice" role="alert">You signed in with your team’s single sign-on, which reaches this team only. Sign in with GitHub or Google to do that.</p>`, session));
+        }
+        const needed = await capabilitiesOf(session, route, form);
+        const missing = needed.length === 0 ? undefined : needed.find((capability) => !can(session, capability));
+        const outOfScope = scopes.has(session) && !SLOTLOCK_SCOPED_DASHBOARD_POSTS.has(route);
+        if (needed.length === 0 || missing !== undefined || outOfScope) {
+            await audit(session, {
+                action: 'authz.denied',
+                outcome: 'denied',
+                reason: missing ? `needs ${missing}` : needed.length === 0 ? 'not a listed route' : 'limited to locations and groups',
+                metadata: { route },
+            });
+            return deniedPage(session, missing, backOf(route));
+        }
+        const fresh = needed.find((capability) => SLOTLOCK_FRESH_CAPABILITIES.has(capability));
+        if (fresh !== undefined && !freshlySignedIn(session))
+            return confirmPage(session, fresh, backOf(route));
+        return null;
+    }
+    /** Refuse a page the person's role does not reach; a billing manager's overview is Usage. */
+    function authorizePage(session, page) {
+        const capability = SLOTLOCK_DASHBOARD_PAGE_CAPABILITIES[page];
+        if (reaches(session, page))
+            return null;
+        if (page === '/' && plans && can(session, 'usage.read'))
+            return redirect(303, `${root}/plan`);
+        return deniedPage(session, capability, plans && can(session, 'usage.read') ? '/plan' : '');
+    }
+    function deniedPage(session, capability, back) {
+        const role = SLOTLOCK_WORKSPACE_ROLE_NAMES[roleOf(session)];
+        const text = scopes.has(session) && (capability === undefined || slotlockRoleCan(roleOf(session), capability))
+            ? 'Your access to this workspace is limited to some locations and groups, so this is not yours to see or change.'
+            : capability
+                ? `As ${/^[AEIOU]/.test(role) ? 'an' : 'a'} ${role} in this workspace, you can't ${CAPABILITY_WORDS[capability]}.`
+                : 'Nothing is here.';
+        return respond(403, layout('Not allowed', html `<p class="notice" role="alert">${text}</p><p><a href="${root}${back}">Back</a></p>`, session));
+    }
+    /** A fresh capability after more than 15 minutes: sign in again, then come back to the page. */
+    function confirmPage(session, capability, back) {
+        const query = new URLSearchParams({
+            ...(session.idp === 'google' ? { with: 'google' } : {}),
+            ...(STEP_UP_PAGES.has(back) ? { then: back } : {}),
+        }).toString();
+        return respond(403, layout('Confirm it’s you', html `${pageHead('Confirm it’s you')}<p>To ${CAPABILITY_WORDS[capability]}, sign in again: your last sign-in was more than 15 minutes ago.</p><p class="actions"><a class="button primary" href="${root}/sign-in${query ? `?${query}` : ''}">Sign in again</a> <a class="button" href="${root}${back}">Cancel</a></p>`, session));
+    }
+    /**
+     * The page a form's route belongs to, and the page path whose capability reading it needs: the
+     * page rendered, not the one the route names (without the store a page needs, it is the overview).
+     */
+    function pageEntryFor(route) {
         if (route.startsWith('/keys'))
-            return keysPage;
+            return { path: '/keys', page: keysPage };
         if (route.startsWith('/webhooks') && options.resources.webhooks)
-            return webhooksPage;
+            return { path: '/webhooks', page: webhooksPage };
         if (route.startsWith('/waitlist') && options.resources.waitlist)
-            return waitlistPage;
+            return { path: '/waitlist', page: waitlistPage };
         if (route.startsWith('/approvals') && options.resources.approvals)
-            return approvalsPage;
+            return { path: '/approvals', page: approvalsPage };
         if ((route.startsWith('/locations') || route.startsWith('/groups')) && options.resources.grouping) {
-            return locationsPage;
+            return { path: '/locations', page: locationsPage };
         }
         if (route.startsWith('/closures') && options.resources.hours)
-            return closuresPage;
+            return { path: '/closures', page: closuresPage };
         if (route.startsWith('/contacts') && options.resources.contacts)
-            return contactsPage;
+            return { path: '/contacts', page: contactsPage };
         if (route.startsWith('/resources') || route === '/hours')
-            return resourcesPage;
+            return { path: '/resources', page: resourcesPage };
         if (route.startsWith('/assistant') && assistantStore())
-            return assistantPage;
+            return { path: '/assistant', page: assistantPage };
+        if ((route === '/teams/delete' || route === '/teams/restore') && teamStore) {
+            return { path: '/settings/team', page: (session, status, notice) => settingsPage(session, status, notice, undefined, 'team') };
+        }
+        if (route.startsWith('/members/') && teamStore) {
+            return { path: '/settings/members', page: (session, status, notice) => settingsPage(session, status, notice, undefined, 'members') };
+        }
+        if (route.startsWith('/identity/') && domainStore) {
+            return { path: '/settings/identity', page: (session, status, notice) => settingsPage(session, status, notice, undefined, 'identity') };
+        }
+        if (route.startsWith('/join/') && domainStore)
+            return { path: '/teams', page: teamsPage };
         if (route.startsWith('/settings'))
-            return settingsPage;
+            return { path: '/settings', page: settingsPage };
         if (route.startsWith('/plan') && plans)
-            return planPage;
-        if (route.startsWith('/teams') && teams)
-            return teamsPage;
-        return overviewPage;
+            return { path: '/plan', page: planPage };
+        if ((route.startsWith('/teams') || route.startsWith('/invite')) && (teams || teamStore))
+            return { path: '/teams', page: teamsPage };
+        return { path: '/', page: overviewPage };
+    }
+    /**
+     * The page a form's route belongs to, for an answer about the form itself (already sent, too many
+     * forms, another organization's page), only to a person whose role reads the page rendered:
+     * anyone else gets the notice alone. These answers come before the role is checked.
+     */
+    function pageOrNotice(route) {
+        const { path, page } = pageEntryFor(route);
+        return (session, status, notice) => {
+            const capability = SLOTLOCK_DASHBOARD_PAGE_CAPABILITIES[path];
+            if (capability !== undefined && can(session, capability))
+                return page(session, status, notice);
+            return respond(status, layout('Refused', html `<p class="notice" role="alert">${notice}</p>`, session));
+        };
     }
     const isLocationTarget = (target) => typeof target === 'object' && 'location' in target && typeof target.location === 'object';
     /** How many resources keep hours of their own, a few by name, and what saving does to them. */
@@ -3979,6 +4809,7 @@ ${target === 'all' ? ownHoursChoice(state.own ?? []) : html ``}
     }
     const notFound = (session) => respond(404, layout('Not found', html `<p class="notice">That resource is not one of yours.</p>`, session));
     const nothingHere = (session) => respond(404, layout('Not found', html `<p class="notice">Nothing is here.</p>`, session));
+    const nothingHere404 = () => respond(404, layout('Not found', html `<p class="notice">Nothing is here.</p>`, null), { 'Referrer-Policy': 'no-referrer' });
     /** The tenant's resources in use that keep hours of their own, by name. */
     async function ownHoursOf(session) {
         const resources = await options.resources.list(tenantOf(session));
@@ -4332,9 +5163,39 @@ ${org ? html `<p>For the organization <strong>${org.login}</strong>.</p>` : html
      * Teams on Cloud: the person's GitHub organizations, as read at sign-in, each on or off. An owner
      * turns one on or off; a member asks an owner; one that is on is a workspace to switch to.
      */
-    async function teamsPage(session, status = 200, notice) {
-        if (!teams)
+    async function teamsPage(session, status = 200, notice, checked = false) {
+        if (!teams && !teamStore)
             return nothingHere(session);
+        const own = teamStore ? await teamWorkspacesSection(session, checked) : html ``;
+        const organizations = teams ? await organizationsSection(session) : html ``;
+        const content = html `${noticeOf(notice, status)}${pageHead('Teams')}${own}${organizations}`;
+        return respond(status, layout('Teams', content, session, 'teams'));
+    }
+    /** The person's team workspaces, the invitations open to them, and creating one. */
+    async function teamWorkspacesSection(session, checked = false) {
+        if (!teamStore)
+            return html ``;
+        const listed = teamListOf.get(session) ?? [];
+        const [offered, atDomain] = await Promise.all([
+            teamStore.pendingFor(personOf(session), verifiedEmails(session)),
+            domainTeamsSection(session, checked),
+        ]);
+        const token = csrfToken(session);
+        const hidden = () => html `<input type="hidden" name="csrf" value="${token}"><input type="hidden" name="once" value="${formNonce(session)}">`;
+        const rows = listed.map((ws) => html `<tr><td data-label="Team" class="strong">${ws.name}</td><td data-label="Handle" class="muted">@${ws.handle}</td><td data-label="You are">${SLOTLOCK_WORKSPACE_ROLE_NAMES[ws.role]}</td><td class="actions">${ws.tenantRef === teamTenantOf(session)
+            ? html `<span class="muted">In use</span>`
+            : html `<form class="inline" method="post" action="${root}/organization">${hidden()}<input type="hidden" name="organization" value="${ws.tenantRef}"><button type="submit">Switch to it</button></form>`}</td></tr>`);
+        const invitations = offered.map((invitation) => html `<tr><td data-label="Team" class="strong">${invitation.workspaceName}</td><td data-label="From">${invitation.inviterDisplay}</td><td data-label="As">${SLOTLOCK_WORKSPACE_ROLE_NAMES[invitation.role]}</td><td class="actions"><form class="inline" method="post" action="${root}/invite/accept">${hidden()}<input type="hidden" name="invitation" value="${invitation.id}"><button class="primary" type="submit">Join ${invitation.workspaceName}</button></form></td></tr>`);
+        return html `<section class="team-workspaces" aria-labelledby="team-workspaces"><h2 id="team-workspaces">Team workspaces</h2>${invitations.length > 0
+            ? html `<div class="table"><table><caption class="visually-hidden">Invitations</caption><thead><tr><th>Invited to</th><th>From</th><th>As</th><th><span class="visually-hidden">Actions</span></th></tr></thead><tbody>${invitations}</tbody></table></div>`
+            : html ``}${atDomain}${rows.length > 0
+            ? html `<div class="table"><table><thead><tr><th>Team</th><th>Handle</th><th>You are</th><th><span class="visually-hidden">Actions</span></th></tr></thead><tbody>${rows}</tbody></table></div>`
+            : html ``}<form class="create-team" method="post" action="${root}/teams/create">${hidden()}<label for="team-name">Name</label><input id="team-name" name="name" maxlength="80" autocomplete="organization" required><button class="primary" type="submit">Create team</button></form></section>`;
+    }
+    /** GitHub organizations turned on for Slotlock (organizations: 'enabled'). */
+    async function organizationsSection(session) {
+        if (!teams)
+            return html ``;
         const orgs = session.orgs ?? [];
         const enabled = orgs.length > 0 ? await teams.enabled(orgs.map((org) => org.id)) : new Set();
         enabledOf.set(session, enabled);
@@ -4353,13 +5214,1661 @@ ${org ? html `<p>For the organization <strong>${org.login}</strong>.</p>` : html
                     : html `<span class="muted">An owner can turn it on</span>`;
             return html `<tr><td data-label="Organization" class="strong">${org.login}</td><td data-label="You are">${owner ? 'Owner' : 'Member'}</td><td data-label="Slotlock"><span class="pill ${on ? 'active' : 'revoked'}">${on ? 'On' : 'Off'}</span></td><td class="actions">${actions}</td></tr>`;
         });
-        const content = html `${noticeOf(notice, status)}${pageHead('Teams')}
+        return html `${teamStore ? html `<h2>GitHub organizations</h2>` : html ``}
 <p>Work with the people in a GitHub organization: once an owner turns Slotlock on for it, every owner and member shares its resources, keys and history, and picks it from the workspace menu. Your own workspace stays yours.</p>
 ${rows.length === 0
             ? emptyState(ICONS.teams, 'Slotlock sees none of your GitHub organizations. It reads them as you sign in: after joining one, sign out and in again. An organization that restricts OAuth apps needs an owner to approve this one.')
             : html `<div class="table"><table><thead><tr><th>Organization</th><th>You are</th><th>Slotlock</th><th><span class="visually-hidden">Actions</span></th></tr></thead><tbody>${rows}</tbody></table></div>
 <p class="fine">Who owns an organization is read from GitHub as you sign in. Leaving one ends your access at your next sign-in.</p>`}`;
-        return respond(status, layout('Teams', content, session, 'teams'));
+    }
+    /** People a team workspace may have, open invitations included: 3 on the Free plan where plans apply. */
+    async function memberCapOf(tenantRef) {
+        if (!plans)
+            return null;
+        const plan = await plans.plan(tenantRef);
+        return plan === null || plan.plan === 'free' || plan.status === 'canceled' ? FREE_TEAM_MEMBERS : null;
+    }
+    /** The session moved into a workspace (its own when `team` is undefined), Live or Test as it was. */
+    function moveTo(session, team, path, cookies = [], keepEmails = true) {
+        const { org: _org, team: _team, em, ...rest } = session;
+        const kept = keepEmails && em !== undefined ? { ...rest, em } : rest;
+        const sealed = seal('slotlock-dashboard-session-v1', team === undefined ? kept : { ...kept, team });
+        const left = Math.max(1, Math.floor((session.exp - now()) / 1000));
+        return redirect(303, `${root}${path}`, [setCookie(SESSION_COOKIE, sealed, left), ...cookies]);
+    }
+    const refusalPage = (session, refusal) => settingsPage(session, TEAM_REFUSALS[refusal].status, TEAM_REFUSALS[refusal].text, undefined, 'members');
+    async function createTeam(session, form) {
+        if (!teamStore)
+            return nothingHere(session);
+        if (session.idp === 'sso' || session.sc !== undefined)
+            return teamsPage(session, 403, 'Sign in with GitHub or Google to create a team.');
+        const name = (form.get('name') ?? '').trim();
+        if (name.length === 0 || name.length > 80 || /\p{Cc}/u.test(name)) {
+            return teamsPage(session, 400, TEAM_REFUSALS.invalid_name.text);
+        }
+        // A name goes into the invitations Slotlock sends: never a web or email address in it.
+        if (/:\/\/|www\.|@|\b[a-z0-9-]+\.(?:[a-z]{2,}|xn--[a-z0-9-]+)\b/i.test(name)) {
+            return teamsPage(session, 400, "A team's name can't hold a web or email address.");
+        }
+        const person = personOf(session);
+        const cap = plans ? FREE_TEAMS_PER_PERSON : null;
+        let made = { refusal: 'handle_taken' };
+        // The handle follows the name; one taken gets a random end.
+        for (let attempt = 0; attempt < 4 && 'refusal' in made && made.refusal === 'handle_taken'; attempt += 1) {
+            made = await teamStore.create(person, name, teamHandleFrom(name, attempt), cap);
+        }
+        if ('refusal' in made)
+            return teamsPage(session, TEAM_REFUSALS[made.refusal].status, TEAM_REFUSALS[made.refusal].text);
+        await audit(session, { action: 'workspace.created', actorRole: 'owner', targetType: 'workspace', targetRef: made.tenantRef }, made.tenantRef);
+        return moveTo(session, made.tenantRef.slice('team:'.length), '/settings/members');
+    }
+    /** A team's people as the others see them: their GitHub login or Google email, as last signed in. */
+    const memberName = (member) => member.display ?? (member.person.startsWith('google:') ? 'A Google account' : 'A GitHub account');
+    async function membersSection(session, status, notice, shown) {
+        const tenantRef = teamTenantOf(session);
+        if (!teamStore || tenantRef === undefined)
+            return noticeOf(notice, status);
+        const manage = can(session, 'members.manage');
+        const me = personOf(session);
+        const mine = roleOf(session);
+        const grouping = options.resources.grouping;
+        // Limiting people to locations and groups: by an Owner or Admin who is not limited themselves.
+        const limits = manage && grouping !== undefined && (mine === 'owner' || mine === 'admin') && !scopes.has(session);
+        const [members, invitations, cap, limited, places, requests, viaDomain] = await Promise.all([
+            teamStore.members(tenantRef),
+            manage ? teamStore.invitations(tenantRef) : Promise.resolve([]),
+            memberCapOf(tenantRef),
+            teamStore.scopes(tenantRef),
+            limits && grouping ? Promise.all([grouping.locations(tenantRef), grouping.groups(tenantRef)]) : Promise.resolve(null),
+            manage && domainStore ? domainStore.requests(tenantRef) : Promise.resolve([]),
+            domainStore ? domainStore.domainMembers(tenantRef) : Promise.resolve(new Map()),
+        ]);
+        const open = invitations.filter((invitation) => invitation.expiresAt.getTime() > now());
+        const seats = members.length + open.length;
+        const full = cap !== null && seats >= cap;
+        const team = currentTeam(session)?.name ?? 'this team';
+        const owners = members.filter((member) => member.role === 'owner').length;
+        const grantable = SLOTLOCK_WORKSPACE_ROLES.filter((role) => slotlockRoleMayGrant(mine, role));
+        const token = csrfToken(session);
+        const hidden = () => html `<input type="hidden" name="csrf" value="${token}"><input type="hidden" name="once" value="${formNonce(session)}">`;
+        const roleOptions = (selected) => grantable.map((role) => html `<option value="${role}"${role === selected ? html ` selected` : html ``}>${SLOTLOCK_WORKSPACE_ROLE_NAMES[role]}</option>`);
+        const invite = !manage
+            ? html ``
+            : full
+                ? html `<p class="seats">${String(seats)} of ${String(cap)} people.${plans && can(session, 'usage.read') ? html ` <a href="${root}/plan">Upgrade</a>` : html ``}</p>`
+                : html `<form class="invite" method="post" action="${root}/members/invite">${hidden()}<label for="invite-email">Email</label><input id="invite-email" name="email" type="email" maxlength="254" autocomplete="off" required${shown ? html `` : html ` autofocus`}><label class="visually-hidden" for="invite-role">Role</label><select id="invite-role" name="role">${roleOptions('member')}</select><button class="primary" type="submit">Invite</button></form>`;
+        const link = shown
+            ? html `<div class="set-card"><div class="row"><span class="row-label">Link for ${shown.to}</span><div class="row-value">${copyField('invite-link', shown.link)}</div></div></div><p class="fine">It works once, for that address, until ${formatDate(shown.expiresAt)}. It is not shown again.</p>`
+            : html ``;
+        const pendingRows = invitations.map((invitation) => {
+            const expired = invitation.expiresAt.getTime() <= now();
+            const to = invitation.email ?? `@${invitation.githubLogin ?? 'GitHub account'}`;
+            return html `<tr><td data-label="Invited" class="strong">${to}</td><td data-label="Role">${SLOTLOCK_WORKSPACE_ROLE_NAMES[invitation.role]}</td><td data-label="By">${invitation.inviterDisplay}</td><td data-label="Expires">${expired ? html `<span class="pill revoked">Expired</span>` : formatDate(invitation.expiresAt)}</td><td class="actions">${slotlockRoleMayGrant(mine, invitation.role)
+                ? html `<form class="inline" method="post" action="${root}/members/resend">${hidden()}<input type="hidden" name="id" value="${invitation.id}"><button type="submit">Send again<span class="visually-hidden"> to ${to}</span></button></form><form class="inline" method="post" action="${root}/members/revoke">${hidden()}<input type="hidden" name="id" value="${invitation.id}"><button class="danger" type="submit">Revoke<span class="visually-hidden"> the invitation to ${to}</span></button></form>`
+                : html ``}</td></tr>`;
+        });
+        const memberRows = members.map((member, index) => {
+            const name = memberName(member);
+            const self = member.person === me;
+            const changeable = manage && slotlockRoleMayGrant(mine, member.role);
+            const role = changeable
+                ? html `<form class="inline" method="post" action="${root}/members/role">${hidden()}<input type="hidden" name="person" value="${member.person}"><label class="visually-hidden" for="role-${String(index)}">Role for ${name}</label><select id="role-${String(index)}" name="role">${roleOptions(member.role)}</select><button type="submit">Save<span class="visually-hidden"> the role for ${name}</span></button></form>`
+                : html `${SLOTLOCK_WORKSPACE_ROLE_NAMES[member.role]}`;
+            let action = html ``;
+            if (self) {
+                action =
+                    member.role === 'owner' && owners <= 1
+                        ? html `<span class="muted">You’re the only owner. Make someone else an owner before leaving.</span>`
+                        : html `<details class="act danger"><summary>Leave</summary><div class="pop"><p>You lose access to ${team} at once. Keys you created keep working until an owner or admin revokes them.</p><form method="post" action="${root}/members/leave">${hidden()}<button class="danger" type="submit">Leave ${team}</button></form></div></details>`;
+            }
+            else if (changeable) {
+                action = html `${member.role !== 'owner' && places ? limitForm(member.person, name, index, limited.get(member.person) ?? null, places[0], places[1], hidden) : html ``}<details class="act danger"><summary>Remove<span class="visually-hidden"> ${name}</span></summary><div class="pop"><p>${name} loses access to ${team} at their next request. Resources, bookings and history stay.</p><form method="post" action="${root}/members/remove">${hidden()}<input type="hidden" name="person" value="${member.person}"><fieldset><legend>Keys ${name} created</legend><label><input type="radio" name="keys" value="revoke" checked> Revoke them</label><label><input type="radio" name="keys" value="keep"> Keep them working</label></fieldset><button class="danger" type="submit">Remove ${name}</button></form></div></details>`;
+            }
+            const reach = member.role === 'owner' ? undefined : limited.get(member.person);
+            const via = viaDomain.get(member.person);
+            return html `<tr><td data-label="Member" class="strong">${name}${self ? html ` <span class="muted">(you)</span>` : html ``}${via ? html ` <span class="muted">via ${via.domain}${via.status === 'verified' ? '' : ', no longer verified'}</span>` : html ``}</td><td data-label="Role">${role}</td><td data-label="Reaches">${reach ? scopeWords(reach) : 'All'}</td><td data-label="Joined">${formatDate(member.joinedAt)}</td><td class="actions">${action}</td></tr>`;
+        });
+        // Requests to join through a verified domain: approved as Viewer, Member or Developer.
+        const joinRoles = ['viewer', 'member', 'developer'].filter((role) => slotlockRoleMayGrant(mine, role));
+        const requestRows = requests.map((request, index) => {
+            const name = request.display ?? request.email;
+            return html `<tr><td data-label="Asked" class="strong">${name}${request.display ? html ` <span class="muted">${request.email}</span>` : html ``} <span class="muted">${JOIN_EVIDENCE_WORDS[request.evidence]}</span></td><td data-label="Asked on">${formatDate(request.createdAt)}</td><td class="actions"><form class="inline" method="post" action="${root}/members/requests">${hidden()}<input type="hidden" name="id" value="${request.id}"><label class="visually-hidden" for="join-role-${String(index)}">Role for ${name}</label><select id="join-role-${String(index)}" name="role">${joinRoles.map((role) => html `<option value="${role}"${role === 'member' ? html ` selected` : html ``}>${SLOTLOCK_WORKSPACE_ROLE_NAMES[role]}</option>`)}</select><button class="primary" type="submit" name="decision" value="approve">Approve<span class="visually-hidden"> ${name}</span></button><button type="submit" name="decision" value="decline">Decline<span class="visually-hidden"> ${name}</span></button></form></td></tr>`;
+        });
+        return html `${noticeOf(notice, status)}<h2>Members · ${String(cap === null ? members.length : seats)}${cap === null ? '' : ` of ${String(cap)}`}</h2>${invite}${link}${requestRows.length > 0
+            ? html `<h3>Asking to join</h3><div class="table"><table><thead><tr><th>Asked</th><th>Asked on</th><th><span class="visually-hidden">Actions</span></th></tr></thead><tbody>${requestRows}</tbody></table></div>`
+            : html ``}${pendingRows.length > 0
+            ? html `<h3>Pending</h3><div class="table"><table><thead><tr><th>Invited</th><th>Role</th><th>By</th><th>Expires</th><th><span class="visually-hidden">Actions</span></th></tr></thead><tbody>${pendingRows}</tbody></table></div>`
+            : html ``}<div class="table"><table><thead><tr><th>Member</th><th>Role</th><th>Reaches</th><th>Joined</th><th><span class="visually-hidden">Actions</span></th></tr></thead><tbody>${memberRows}</tbody></table></div>`;
+    }
+    /** What a limited member reaches, in words. */
+    const scopeWords = (scope) => [
+        scope.locations.length > 0 ? `Locations ${scope.locations.join(', ')}` : '',
+        scope.groups.length > 0 ? `Groups ${scope.groups.join(', ')}` : '',
+    ]
+        .filter(Boolean)
+        .join(' · ');
+    /** Limit a member to locations and groups, or give them all of the workspace. */
+    function limitForm(person, name, index, scope, locations, groups, hidden) {
+        const id = `limit-${String(index)}`;
+        const options_ = (entries, chosen) => entries.map((entry) => html `<option value="${entry.ref}"${chosen.includes(entry.ref) ? html ` selected` : html ``}>${entry.name} (${entry.ref})</option>`);
+        const picker = (field, label, entries, chosen) => entries.length === 0
+            ? html ``
+            : html `<label for="${id}-${field}">${label}</label><select id="${id}-${field}" name="${field}" multiple size="${String(Math.min(6, entries.length))}">${options_(entries, chosen)}</select>`;
+        if (locations.length === 0 && groups.length === 0 && scope === null)
+            return html ``;
+        return html `<details class="act"><summary>Limit<span class="visually-hidden"> ${name}</span></summary><div class="pop"><p>${name} reaches only the resources at these locations (and the locations in them) and in these groups: their bookings, holds, waitlist and approvals. Keys, webhooks, contacts, hours, usage and settings are not theirs.</p><form method="post" action="${root}/members/scope">${hidden()}<input type="hidden" name="person" value="${person}">${picker('locations', 'Locations', locations, scope?.locations ?? [])}${picker('groups', 'Groups', groups, scope?.groups ?? [])}<fieldset><legend>Keys ${name} created</legend><label><input type="radio" name="keys" value="revoke" checked> Revoke them: they reach all of it</label><label><input type="radio" name="keys" value="keep"> Keep them working</label></fieldset><button type="submit" name="access" value="limited">Limit ${name} to these</button>${scope === null ? html `` : html `<button type="submit" name="access" value="all">Give ${name} all of the workspace</button>`}</form></div></details>`;
+    }
+    /** Who did something, as the audit log names them: you, a member by their display, else their account. */
+    function actorName(event, session, names) {
+        if (event.actorType === 'api_key')
+            return `API key ${event.actorRef.replace(/^api_key:/, '').slice(0, 8)}`;
+        if (event.actorType === 'assistant')
+            return 'The assistant';
+        if (event.actorType !== 'person')
+            return 'Slotlock';
+        if (event.actorRef === personOf(session))
+            return 'You';
+        return (names.get(event.actorRef) ??
+            (event.actorRef.startsWith('github:') ? `GitHub user ${event.actorRef.slice(7)}` : event.actorRef.startsWith('google:') ? 'A Google account' : event.actorRef));
+    }
+    /** The ways Privacy finds a person, as the form names them. */
+    const PERSON_KINDS = Object.freeze({
+        email: 'Email address',
+        holder: 'Holder reference',
+        contact: 'Contact reference',
+        reference: 'Booking reference',
+    });
+    /** A person named on a Privacy form, checked: one kind and a value, or null. */
+    function personOf_(form) {
+        const kind = form.get('kind') ?? '';
+        const value = (form.get('value') ?? '').trim();
+        if (!Object.hasOwn(PERSON_KINDS, kind) || value.length === 0 || Buffer.byteLength(value) > 500)
+            return null;
+        const named = kind;
+        return { kind: named, value, subject: { [named]: value } };
+    }
+    /**
+     * Privacy (RFC 0004 D3): an export of everything the workspace keeps, to download for a day; and
+     * one person found by email, holder, contact or booking reference, what is kept about them
+     * downloaded, or them erased. Owners and Admins, signed in within 15 minutes.
+     */
+    async function privacySection(session, status, notice, found) {
+        const privacy = options.resources.privacy;
+        if (!privacy)
+            return noticeOf(notice, status);
+        const exports = await privacy.listExports(tenantOf(session));
+        const hidden = html `<input type="hidden" name="csrf" value="${csrfToken(session)}"><input type="hidden" name="once" value="${formNonce(session)}">`;
+        const rows = exports.map((made) => html `<tr><td data-label="Asked for">${formatDate(made.createdAt)}</td><td data-label="State">${made.status === 'ready'
+            ? html `<span class="pill active">Ready</span>`
+            : made.status === 'pending'
+                ? html `<span class="pill">Being made</span>`
+                : html `<span class="pill revoked">Failed</span>${made.error === 'export_too_large' ? html ` <span class="muted">too large: ask the operator</span>` : html ``}`}</td><td data-label="Rows">${made.status === 'ready' ? String(made.rows) : '—'}</td><td data-label="Deleted">${formatDate(made.expiresAt)}</td><td class="actions">${made.status === 'ready' ? html `<a class="button" href="${root}/settings/privacy/download?id=${made.id}">Download</a> ` : html ``}<form method="post" action="${root}/settings/privacy/export/delete">${hidden}<input type="hidden" name="id" value="${made.id}"><button type="submit">Delete</button></form></td></tr>`);
+        const exportCard = html `<h2>Everything</h2><p>A copy of everything this workspace keeps, every table read at one moment, as JSON lines: one <code>{"table", "row"}</code> a line. Secrets stay out. It is kept for a day, then deleted.</p><form method="post" action="${root}/settings/privacy/export">${hidden}<button type="submit" class="primary">Export the workspace</button></form>${rows.length > 0
+            ? html `<div class="table"><table><thead><tr><th>Asked for</th><th>State</th><th>Rows</th><th>Deleted</th><th><span class="visually-hidden">Actions</span></th></tr></thead><tbody>${rows}</tbody></table></div>`
+            : html ``}`;
+        const kinds = Object.entries(PERSON_KINDS).map(([kind, label]) => html `<option value="${kind}"${found?.kind === kind ? html ` selected` : html ``}>${label}</option>`);
+        const finder = html `<h2>One person</h2><p>For a person who asks what you keep about them, or to be erased. Find them by one thing you know.</p><form class="person-find" method="post" action="${root}/settings/privacy/person">${hidden}<label for="person-kind">By</label><select id="person-kind" name="kind">${kinds}</select><label for="person-value" class="visually-hidden">Value</label><input id="person-value" name="value" maxlength="320" required value="${found?.value ?? ''}"><button type="submit">Find</button></form>`;
+        let person = html ``;
+        if (found) {
+            const counted = Object.entries(found.records).filter(([, rows_]) => rows_.length > 0);
+            const keep = html `<input type="hidden" name="kind" value="${found.kind}"><input type="hidden" name="value" value="${found.value}">`;
+            person =
+                counted.length === 0
+                    ? html `<p class="empty">Nothing kept names them.</p>`
+                    : html `<div class="set-card">${counted.map(([table, rows_]) => html `<div class="row"><span class="row-label">${table.replaceAll('_', ' ')}</span><div class="row-value">${String(rows_.length)}${found.truncated && rows_.length >= 1_000 ? '+' : ''}</div></div>`)}</div><div class="actions"><form method="post" action="${root}/settings/privacy/person/export">${hidden}${keep}<button type="submit">Download what is kept</button></form></div><form method="post" action="${root}/settings/privacy/person/erase" class="danger-zone">${hidden}${keep}<p>Erasing deletes their contacts, attendee and waitlist entries, takes their email out of events and approvals, and replaces their references with a name that is no one's, everywhere, history included. Their bookings stay, as time taken. This cannot be undone.</p><label class="choice"><input type="checkbox" name="confirm" value="yes" required> I understand</label><button type="submit" class="danger">Erase this person</button></form>`;
+        }
+        return html `${noticeOf(notice, status)}${exportCard}${finder}${person}`;
+    }
+    async function askPrivacyExport(session) {
+        const privacy = options.resources.privacy;
+        if (!privacy)
+            return nothingHere(session);
+        const tenantRef = tenantOf(session);
+        try {
+            const made = await privacy.createExport(tenantRef, personOf(session));
+            await audit(session, { action: 'export.created', targetType: 'export', targetRef: made.id });
+            return settingsPage(session, 200, 'Asked for. It is made in a moment: reload this page to download it.', undefined, 'privacy');
+        }
+        catch (error) {
+            const code = error?.code;
+            if (code === 'export_in_progress') {
+                return settingsPage(session, 409, 'One is being made already: wait for it.', undefined, 'privacy');
+            }
+            if (code === 'export_limit_reached') {
+                return settingsPage(session, 409, 'Five exports are kept already: delete one first.', undefined, 'privacy');
+            }
+            throw error;
+        }
+    }
+    async function deletePrivacyExport(session, form) {
+        const privacy = options.resources.privacy;
+        if (!privacy)
+            return nothingHere(session);
+        const id = form.get('id') ?? '';
+        if (!UUID_PATTERN.test(id) || !(await privacy.deleteExport(tenantOf(session), id))) {
+            return settingsPage(session, 404, 'That export is not here.', undefined, 'privacy');
+        }
+        return settingsPage(session, 200, 'Deleted.', undefined, 'privacy');
+    }
+    /**
+     * A ready export as one file of JSON lines, `{"table", "row"}` each, read a part at a time. Only
+     * with a sign-in in the last 15 minutes, as every Privacy action.
+     */
+    async function downloadPrivacyExport(session, query) {
+        const privacy = options.resources.privacy;
+        if (!privacy)
+            return nothingHere(session);
+        if (!freshlySignedIn(session))
+            return confirmPage(session, 'privacy.manage', '/settings/privacy');
+        const id = query.get('id') ?? '';
+        const tenantRef = tenantOf(session);
+        const first = UUID_PATTERN.test(id) ? await privacy.exportPart(tenantRef, id, 1) : null;
+        if (!first || (!first.ok && first.code !== 'export_part_not_found')) {
+            return settingsPage(session, first && !first.ok && first.code === 'export_not_ready' ? 409 : 404, 'That export is not ready, or not here.', undefined, 'privacy');
+        }
+        await audit(session, { action: 'export.downloaded', targetType: 'export', targetRef: id });
+        const encoder = new TextEncoder();
+        let next = first;
+        let part = 1;
+        const body = new ReadableStream({
+            async pull(controller) {
+                const read = next ?? (await privacy.exportPart(tenantRef, id, part));
+                next = null;
+                if (!read.ok) {
+                    controller.close();
+                    return;
+                }
+                controller.enqueue(encoder.encode(read.lines.map((line) => `{"table":${JSON.stringify(read.table)},"row":${line}}\n`).join('')));
+                part += 1;
+            },
+        });
+        return new Response(body, {
+            status: 200,
+            headers: {
+                'Content-Type': 'application/x-ndjson; charset=utf-8',
+                'Content-Disposition': `attachment; filename="slotlock-export-${new Date(now()).toISOString().slice(0, 10)}.ndjson"`,
+                'Cache-Control': 'no-store',
+                'X-Content-Type-Options': 'nosniff',
+                'Content-Security-Policy': "default-src 'none'",
+            },
+        });
+    }
+    async function findPerson(session, form) {
+        const privacy = options.resources.privacy;
+        if (!privacy)
+            return nothingHere(session);
+        const named = personOf_(form);
+        if (!named)
+            return settingsPage(session, 400, 'Choose how to find them, and what you know.', undefined, 'privacy');
+        try {
+            const exported = await privacy.exportSubject(tenantOf(session), named.subject);
+            return settingsPage(session, 200, undefined, undefined, 'privacy', undefined, undefined, {
+                kind: named.kind,
+                value: named.value,
+                records: exported.records,
+                truncated: exported.truncated,
+            });
+        }
+        catch (error) {
+            if (error?.code === 'invalid_subject') {
+                return settingsPage(session, 400, 'That is not one: an email address, or a reference of up to 500 bytes.', undefined, 'privacy');
+            }
+            throw error;
+        }
+    }
+    /** What is kept about one person, as a JSON file: posted, so the person is never in an address. */
+    async function exportPerson(session, form) {
+        const privacy = options.resources.privacy;
+        if (!privacy)
+            return nothingHere(session);
+        const named = personOf_(form);
+        if (!named)
+            return settingsPage(session, 400, 'Choose how to find them, and what you know.', undefined, 'privacy');
+        const exported = await privacy.exportSubject(tenantOf(session), named.subject);
+        await audit(session, { action: 'subject.exported', targetType: 'subject', metadata: { by: named.kind } });
+        return new Response(JSON.stringify(exported, null, 2), {
+            status: 200,
+            headers: {
+                'Content-Type': 'application/json; charset=utf-8',
+                'Content-Disposition': `attachment; filename="slotlock-person-${new Date(now()).toISOString().slice(0, 10)}.json"`,
+                'Cache-Control': 'no-store',
+                'X-Content-Type-Options': 'nosniff',
+                'Content-Security-Policy': "default-src 'none'",
+            },
+        });
+    }
+    async function erasePerson(session, form) {
+        const privacy = options.resources.privacy;
+        if (!privacy)
+            return nothingHere(session);
+        const named = personOf_(form);
+        if (!named)
+            return settingsPage(session, 400, 'Choose how to find them, and what you know.', undefined, 'privacy');
+        if (form.get('confirm') !== 'yes')
+            return settingsPage(session, 400, 'Tick that you understand first.', undefined, 'privacy');
+        const { erased } = await privacy.eraseSubject(tenantOf(session), named.subject, personOf(session));
+        const changed = Object.entries(erased).filter(([, rows]) => rows > 0);
+        // Never the person: how they were named, and what went.
+        await audit(session, { action: 'subject.erased', targetType: 'subject', metadata: { by: named.kind, ...Object.fromEntries(changed) } });
+        const total = changed.reduce((sum, [, rows]) => sum + rows, 0);
+        return settingsPage(session, 200, total === 0 ? 'Nothing kept named them.' : `Erased: ${String(total)} row${total === 1 ? '' : 's'} deleted or changed. Their bookings stay, as time taken.`, undefined, 'privacy');
+    }
+    /** A workspace's audit log, newest first, 50 a page: who did what, refused or done, from where. */
+    async function auditSection(session, status, notice, query) {
+        const log = options.resources.audit;
+        if (!log)
+            return noticeOf(notice, status);
+        const tenantRef = tenantOf(session);
+        const wanted = query.get('action') ?? '';
+        const action = AUDIT_ACTION_NAMES.has(wanted) ? wanted : undefined;
+        const cursor = /^(\d{1,15})\.([0-9a-f-]{36})$/.exec(query.get('before') ?? '');
+        const before = cursor && UUID_PATTERN.test(cursor[2])
+            ? { occurredAt: new Date(Number(cursor[1])), id: cursor[2].toLowerCase() }
+            : undefined;
+        const team = teamTenantOf(session);
+        const [events, members] = await Promise.all([
+            log.list(tenantRef, { limit: AUDIT_PAGE, ...(before ? { before } : {}), ...(action ? { action } : {}) }),
+            teamStore && team !== undefined ? teamStore.members(team) : Promise.resolve([]),
+        ]);
+        const names = new Map(members.map((member) => [member.person, memberName(member)]));
+        const options_ = AUDIT_ACTION_GROUPS.map(([group, actions]) => html `<optgroup label="${group}">${actions.map((name) => html `<option value="${name}"${name === action ? html ` selected` : html ``}>${AUDIT_ACTION_WORDS[name] ?? name}</option>`)}</optgroup>`);
+        const filter = html `<form class="audit-filter" method="get" action="${root}/settings/audit"><label for="audit-action">Action</label><select id="audit-action" name="action"><option value="">Everything</option>${options_}</select><button type="submit">Show</button></form>`;
+        const rows = events.map((event) => {
+            const details = [
+                ...(event.targetRef ? [['Target', `${event.targetType ?? ''} ${event.targetRef}`.trim()]] : []),
+                ...(event.reason ? [['Reason', event.reason]] : []),
+                ...Object.entries(event.metadata).map(([key, value]) => [key, String(value)]),
+                ...(event.ipAddress ? [['Address', event.ipAddress]] : []),
+                ...(event.userAgent ? [['Browser', event.userAgent]] : []),
+            ];
+            return html `<tr><td data-label="When">${formatDate(event.occurredAt)}</td><td data-label="Who" class="strong">${actorName(event, session, names)}${event.actorRole ? html ` <span class="muted">(${SLOTLOCK_WORKSPACE_ROLE_NAMES[event.actorRole]})</span>` : html ``}</td><td data-label="What">${AUDIT_ACTION_WORDS[event.action] ?? event.action}${event.outcome === 'denied' ? html ` <span class="pill revoked">Refused</span>` : html ``}</td><td class="actions">${details.length > 0
+                ? html `<details class="act"><summary>Details</summary><div class="pop"><dl class="audit-details">${details.map(([label, value]) => html `<dt>${label}</dt><dd>${value}</dd>`)}</dl></div></details>`
+                : html ``}</td></tr>`;
+        });
+        const last = events[events.length - 1];
+        const older = last && events.length === AUDIT_PAGE
+            ? `${root}/settings/audit?${new URLSearchParams({ ...(action ? { action } : {}), before: `${String(last.occurredAt.getTime())}.${last.id}` }).toString()}`
+            : null;
+        // The chain, checked on asking: every event kept since the oldest still links to the one before.
+        const verified = query.get('verify') === '1' && log.verify ? await log.verify(tenantRef) : null;
+        const chain = verified
+            ? verified.brokenAt === null
+                ? html `<p class="notice done" role="status">The log is unbroken: ${String(verified.checked)} event${verified.checked === 1 ? '' : 's'} checked.</p>`
+                : html `<p class="notice" role="alert">The log was changed outside Slotlock at event ${String(verified.brokenAt)}, after ${String(verified.checked)} that check out.</p>`
+            : html ``;
+        const exportQuery = action ? `&action=${action}` : '';
+        const tools = html `<p class="audit-tools">${log.verify ? html `<a href="${root}/settings/audit?verify=1${exportQuery}">Check the log</a>` : html ``} <a href="${root}/settings/audit/export?format=csv${exportQuery}">Export CSV</a> <a href="${root}/settings/audit/export?format=json${exportQuery}">Export JSON</a></p>`;
+        return html `${noticeOf(notice, status)}${chain}${filter}${tools}${rows.length === 0
+            ? html `<p class="empty">${before ? 'Nothing older.' : 'Nothing recorded yet.'}</p>`
+            : html `<div class="table"><table><thead><tr><th>When</th><th>Who</th><th>What</th><th><span class="visually-hidden">Details</span></th></tr></thead><tbody>${rows}</tbody></table></div>`}<p class="pager">${before ? html `<a href="${root}/settings/audit${action ? `?action=${action}` : ''}">Newest</a>` : html ``}${older ? html ` <a href="${older}">Older</a>` : html ``}</p>`;
+    }
+    /**
+     * A workspace's audit log as a file, filtered as the page was: up to 10,000 events, newest first,
+     * with each event's place in the chain and its hash. On the Team plan where plans apply.
+     */
+    async function exportAudit(session, query) {
+        const log = options.resources.audit;
+        if (!log)
+            return nothingHere(session);
+        const tenantRef = tenantOf(session);
+        if (plans) {
+            const plan = await plans.plan(tenantRef.replace(/~test$/, ''));
+            if (plan?.plan !== 'team' || plan.status === 'canceled') {
+                return settingsPage(session, 403, 'Exports come with the Team plan. Upgrade on Usage.', undefined, 'audit', undefined, query);
+            }
+        }
+        const format = query.get('format') === 'json' ? 'json' : 'csv';
+        const wanted = query.get('action') ?? '';
+        const action = AUDIT_ACTION_NAMES.has(wanted) ? wanted : undefined;
+        const events = [];
+        let before;
+        while (events.length < AUDIT_EXPORT_MOST) {
+            const page = await log.list(tenantRef, { limit: 200, ...(before ? { before } : {}), ...(action ? { action } : {}) });
+            events.push(...page);
+            const last = page[page.length - 1];
+            if (!last || page.length < 200)
+                break;
+            before = { occurredAt: last.occurredAt, id: last.id };
+        }
+        await audit(session, { action: 'audit.exported', metadata: { format, events: events.length, ...(action ? { filter: action } : {}) } });
+        const rows = events.slice(0, AUDIT_EXPORT_MOST).map((event) => ({
+            occurred_at: event.occurredAt.toISOString(),
+            action: event.action,
+            outcome: event.outcome,
+            actor_type: event.actorType,
+            actor_ref: event.actorRef,
+            actor_role: event.actorRole ?? '',
+            target_type: event.targetType ?? '',
+            target_ref: event.targetRef ?? '',
+            reason: event.reason ?? '',
+            ip_address: event.ipAddress ?? '',
+            user_agent: event.userAgent ?? '',
+            metadata: JSON.stringify(event.metadata),
+            chain_index: event.chainIndex === null ? '' : String(event.chainIndex),
+            hash: event.hash ?? '',
+        }));
+        const day = new Date(now()).toISOString().slice(0, 10);
+        const body = format === 'json'
+            ? JSON.stringify(rows.map((row) => ({ ...row, metadata: JSON.parse(row.metadata) })), null, 2)
+            : [
+                Object.keys(rows[0] ?? AUDIT_EXPORT_EMPTY).join(','),
+                ...rows.map((row) => Object.values(row).map(csvCell).join(',')),
+            ].join('\r\n');
+        return new Response(body, {
+            status: 200,
+            headers: {
+                'Content-Type': format === 'json' ? 'application/json; charset=utf-8' : 'text/csv; charset=utf-8',
+                'Content-Disposition': `attachment; filename="slotlock-audit-${day}.${format}"`,
+                'Cache-Control': 'no-store',
+                'X-Content-Type-Options': 'nosniff',
+                'Content-Security-Policy': "default-src 'none'",
+            },
+        });
+    }
+    /** A team's name and handle, and deleting it: what goes with it, the handle typed to confirm. */
+    async function teamSection(session, status, notice) {
+        const tenantRef = teamTenantOf(session);
+        if (!teamStore || tenantRef === undefined)
+            return noticeOf(notice, status);
+        const [info, deleting, members, resources, keys, webhooks] = await Promise.all([
+            teamStore.info(tenantRef),
+            teamStore.deleteAfter(tenantRef),
+            teamStore.members(tenantRef),
+            options.resources.count ? options.resources.count(tenantRef) : options.resources.list(tenantRef).then((list) => list.length),
+            options.keys.list({ tenantRef }),
+            options.resources.webhooks ? options.resources.webhooks.list(tenantRef) : Promise.resolve([]),
+        ]);
+        if (!info)
+            return noticeOf(notice, status);
+        const hidden = html `<input type="hidden" name="csrf" value="${csrfToken(session)}"><input type="hidden" name="once" value="${formNonce(session)}">`;
+        const live = keys.filter((key) => key.revokedAt === null && (key.expiresAt === null || key.expiresAt.getTime() > now())).length;
+        const card = html `<div class="set-card"><div class="row"><span class="row-label">Name</span><div class="row-value">${info.name}</div></div><div class="row"><span class="row-label">Handle</span><div class="row-value">@${info.handle}</div></div></div>`;
+        const danger = deleting
+            ? html `<h2>Being deleted</h2><p>${info.name} and everything in it go on ${formatDate(deleting)}.</p><form method="post" action="${root}/teams/restore">${hidden}<button class="primary" type="submit">Keep ${info.name}</button></form>`
+            : html `<h2>Delete team</h2><p>Its keys stop at once, and seven days later it goes with everything in it: ${String(members.length)} member${members.length === 1 ? '' : 's'}, ${String(resources)} resource${resources === 1 ? '' : 's'} with their bookings and history, ${String(live)} key${live === 1 ? '' : 's'} and ${String(webhooks.length)} webhook${webhooks.length === 1 ? '' : 's'}. Until then any owner can keep it.</p><form class="create-team" method="post" action="${root}/teams/delete">${hidden}<label for="confirm-handle">Type ${info.handle} to confirm</label><input id="confirm-handle" name="confirm" autocomplete="off" required><button class="danger" type="submit">Delete ${info.name}</button></form>`;
+        return html `${noticeOf(notice, status)}${card}${danger}`;
+    }
+    async function deleteTeam(session, form) {
+        const tenantRef = teamTenantOf(session);
+        if (!teamStore || tenantRef === undefined)
+            return nothingHere(session);
+        const refusal = await teamStore.scheduleDeletion(tenantRef, personOf(session), (form.get('confirm') ?? '').trim());
+        if (refusal === 'confirm')
+            return settingsPage(session, 400, "Type the team's handle to confirm.", undefined, 'team');
+        if (refusal === 'subscription_live') {
+            return settingsPage(session, 409, 'Cancel its Team plan on Usage first: deleting the team would not stop the payments.', undefined, 'team');
+        }
+        if (refusal)
+            return settingsPage(session, TEAM_REFUSALS[refusal].status, TEAM_REFUSALS[refusal].text, undefined, 'team');
+        await audit(session, { action: 'workspace.deletion_scheduled', targetType: 'workspace', targetRef: tenantRef }, tenantRef);
+        return redirect(303, `${root}/settings/team`);
+    }
+    async function restoreTeam(session) {
+        const tenantRef = teamTenantOf(session);
+        if (!teamStore || tenantRef === undefined)
+            return nothingHere(session);
+        const refusal = await teamStore.cancelDeletion(tenantRef, personOf(session));
+        if (refusal)
+            return settingsPage(session, TEAM_REFUSALS[refusal].status, TEAM_REFUSALS[refusal].text, undefined, 'team');
+        await audit(session, { action: 'workspace.deletion_cancelled', targetType: 'workspace', targetRef: tenantRef }, tenantRef);
+        return redirect(303, `${root}/settings/team`);
+    }
+    /** What a refused change to a team's domains, or a request to join, says, and its status. */
+    const DOMAIN_REFUSALS = Object.freeze({
+        invalid_domain: { status: 400, text: 'Enter a domain your organization owns, such as acme.com.' },
+        public_suffix: { status: 400, text: 'Nobody owns all of that domain. Enter your own domain under it.' },
+        consumer_domain: { status: 400, text: 'Anyone can get an address at that domain. Enter your organization’s own.' },
+        not_found: { status: 404, text: 'That is no longer here.' },
+        not_allowed: { status: 403, text: 'Only an owner can change the team’s domains.' },
+        already_claimed: { status: 409, text: 'That domain is listed already.' },
+        domain_taken: { status: 409, text: 'Another team holds that domain.' },
+        domain_limit: { status: 403, text: `A team has up to ${String(SLOTLOCK_WORKSPACE_DOMAIN_LIMIT)} domains.` },
+        too_soon: { status: 429, text: 'Checked less than a minute ago. Try again shortly.' },
+        expired: { status: 409, text: 'That record expired after seven days. Add the domain again for a new one.' },
+        restricted: { status: 409, text: 'Invitations go only to verified domains: allow any address before removing the last one.' },
+        no_verified_domain: { status: 409, text: 'Verify a domain first.' },
+        already_member: { status: 409, text: 'You are a member already.' },
+        pending: { status: 409, text: 'You asked already. An owner or admin decides.' },
+        request_limit: { status: 429, text: 'You asked to join 20 teams in the last day. Try again tomorrow.' },
+        member_cap: TEAM_REFUSALS.member_cap,
+        role_not_allowed: { status: 400, text: 'Someone joining through a domain joins as Viewer, Member or Developer.' },
+        domain_not_verified: { status: 409, text: 'That domain is no longer verified, so the request cannot be approved.' },
+    });
+    /** How a request's address was verified, as the people deciding read it. */
+    const JOIN_EVIDENCE_WORDS = Object.freeze({
+        google_workspace: 'verified by Google Workspace',
+        google: 'verified once by Google, not checked since',
+        github: 'verified once by GitHub, not checked since',
+    });
+    /** What a domain lets the people whose verified address is at it do, as the Identity page offers it. */
+    const JOIN_POLICY_WORDS = Object.freeze({
+        request: 'Ask to join',
+        auto: 'Join as Viewer',
+        off: 'Invitations only',
+    });
+    const identityPage = (session, status, notice) => settingsPage(session, status, notice, undefined, 'identity');
+    const domainRefused = (session, refusal) => identityPage(session, DOMAIN_REFUSALS[refusal].status, DOMAIN_REFUSALS[refusal].text);
+    /** A team's domains: each with its record until verified, who may join through it, and invitations. */
+    async function identitySection(session, status, notice) {
+        const tenantRef = teamTenantOf(session);
+        if (!domainStore || tenantRef === undefined)
+            return noticeOf(notice, status);
+        const [listed, restricted] = await Promise.all([domainStore.list(tenantRef), domainStore.invitesRestricted(tenantRef)]);
+        const token = csrfToken(session);
+        const hidden = () => html `<input type="hidden" name="csrf" value="${token}"><input type="hidden" name="once" value="${formNonce(session)}">`;
+        const cards = listed.map((domain, index) => {
+            const name = domain.unicode === domain.ascii ? html `${domain.unicode}` : html `${domain.unicode} <span class="muted">${domain.ascii}</span>`;
+            const [pill, word] = domain.expired
+                ? ['expired', 'Expired']
+                : domain.status === 'verified'
+                    ? ['active', 'Verified']
+                    : domain.status === 'lapsing'
+                        ? ['revoked', 'Record missing']
+                        : ['held', 'Pending'];
+            const record = slotlockDomainRecord(domain.ascii, domain.token);
+            const id = html `<input type="hidden" name="id" value="${domain.id}">`;
+            let rows;
+            if (domain.status === 'verified') {
+                rows = html `<div class="row"><span class="row-label">Who may join</span><div class="row-value"><form class="inline" method="post" action="${root}/identity/domains/policy">${hidden()}${id}<label class="visually-hidden" for="policy-${String(index)}">Who may join through ${domain.unicode}</label><select id="policy-${String(index)}" name="policy">${['request', 'auto', 'off'].map((policy) => html `<option value="${policy}"${policy === domain.joinPolicy ? html ` selected` : html ``}>${JOIN_POLICY_WORDS[policy]}</option>`)}</select><button type="submit">Save<span class="visually-hidden"> who may join through ${domain.unicode}</span></button></form></div></div>`;
+            }
+            else if (domain.expired) {
+                rows = html `<div class="row"><span class="row-label">Record</span><div class="row-value"><form class="inline" method="post" action="${root}/identity/domains">${hidden()}<input type="hidden" name="domain" value="${domain.ascii}"><button type="submit">Get a new record<span class="visually-hidden"> for ${domain.unicode}</span></button></form></div></div>`;
+            }
+            else {
+                rows = html `${domain.status === 'lapsing' && domain.lapseAfter
+                    ? html `<div class="row"><span class="row-label">Lapses</span><div class="row-value">${formatDate(domain.lapseAfter)}, unless this new record is published</div></div>`
+                    : html ``}<div class="row"><span class="row-label">TXT name</span><div class="row-value">${copyField(`record-name-${String(index)}`, record.name)}</div></div><div class="row"><span class="row-label">TXT value</span><div class="row-value">${copyField(`record-value-${String(index)}`, record.value)}</div></div><div class="row"><span class="row-label">Check</span><div class="row-value"><form class="inline" method="post" action="${root}/identity/domains/verify">${hidden()}${id}<button class="primary" type="submit">Verify now<span class="visually-hidden"> ${domain.unicode}</span></button></form></div></div>`;
+            }
+            const remove = html `<details class="act danger"><summary>Remove<span class="visually-hidden"> ${domain.unicode}</span></summary><div class="pop"><p>${domain.status === 'pending' ? 'The claim is withdrawn.' : 'Nobody new joins through it. Members who joined through it stay.'}</p><form method="post" action="${root}/identity/domains/remove">${hidden()}${id}<button class="danger" type="submit">Remove ${domain.unicode}</button></form></div></details>`;
+            return html `<div class="set-card"><div class="row"><span class="row-label">Domain</span><div class="row-value"><span class="strong">${name}</span> <span class="pill ${pill}">${word}</span> ${remove}</div></div>${rows}</div>`;
+        });
+        const add = listed.length >= SLOTLOCK_WORKSPACE_DOMAIN_LIMIT
+            ? html ``
+            : html `<form class="invite" method="post" action="${root}/identity/domains">${hidden()}<label for="domain">Domain</label><input id="domain" name="domain" maxlength="253" autocomplete="off" spellcheck="false" placeholder="acme.com" required><button class="primary" type="submit">Add domain</button></form>`;
+        const verified = listed.some((domain) => domain.status === 'verified');
+        const invites = html `<h2>Invitations</h2><div class="set-card"><div class="row"><span class="row-label">Go to</span><div class="row-value">${restricted ? 'Addresses at verified domains' : 'Any address'} ${restricted || verified
+            ? html `<form class="inline" method="post" action="${root}/identity/invites">${hidden()}<input type="hidden" name="on" value="${restricted ? '0' : '1'}"><button type="submit">${restricted ? 'Allow any address' : 'Only verified domains'}</button></form>`
+            : html ``}</div></div></div>`;
+        return html `${noticeOf(notice, status)}<h2>Domains</h2>${add}${cards}${invites}${await ssoSection(session, tenantRef)}${await scimSection(session, tenantRef)}`;
+    }
+    async function claimDomain(session, form) {
+        const tenantRef = teamTenantOf(session);
+        if (!domainStore || tenantRef === undefined)
+            return nothingHere(session);
+        const claimed = await domainStore.claim(tenantRef, personOf(session), (form.get('domain') ?? '').slice(0, 300));
+        if ('refusal' in claimed)
+            return domainRefused(session, claimed.refusal);
+        const domain = (await domainStore.list(tenantRef)).find((listed) => listed.id === claimed.id);
+        await audit(session, { action: 'domain.claimed', targetType: 'domain', targetRef: claimed.id, metadata: { domain: domain?.ascii ?? '' } }, tenantRef);
+        return redirect(303, `${root}/settings/identity`);
+    }
+    /** What an Owner's "Verify now" found, as the page says it. */
+    const VERIFY_ANSWERS = Object.freeze({
+        verified: { status: 200, text: (domain) => `${domain} is verified.` },
+        restored: { status: 200, text: (domain) => `${domain} is verified again.` },
+        seen: { status: 200, text: (domain) => `${domain} is still verified.` },
+        absent: { status: 409, text: () => 'The record isn’t there yet. Slotlock also checks every hour for three days.' },
+        error: { status: 503, text: () => 'DNS didn’t answer. Try again shortly.' },
+        domain_taken: { status: 409, text: () => 'Another team verified that domain first.' },
+    });
+    async function verifyDomain(session, form) {
+        const tenantRef = teamTenantOf(session);
+        if (!domainStore || tenantRef === undefined)
+            return nothingHere(session);
+        const found = await domainStore.verifyNow(tenantRef, personOf(session), form.get('id') ?? '', domainResolvers);
+        const event = slotlockDomainCheckEvent(found, false);
+        if (event)
+            await audit(session, event, tenantRef);
+        const answer = VERIFY_ANSWERS[found.outcome];
+        if (answer)
+            return identityPage(session, answer.status, answer.text(found.domain ?? 'The domain'));
+        if (found.outcome in DOMAIN_REFUSALS)
+            return domainRefused(session, found.outcome);
+        return identityPage(session, 409, 'The record isn’t there.');
+    }
+    async function releaseDomain(session, form) {
+        const tenantRef = teamTenantOf(session);
+        if (!domainStore || tenantRef === undefined)
+            return nothingHere(session);
+        const id = form.get('id') ?? '';
+        const domain = (await domainStore.list(tenantRef)).find((listed) => listed.id === id);
+        const refusal = await domainStore.release(tenantRef, personOf(session), id);
+        if (refusal)
+            return domainRefused(session, refusal);
+        await audit(session, { action: 'domain.released', targetType: 'domain', targetRef: id, metadata: { domain: domain?.ascii ?? '' } }, tenantRef);
+        return redirect(303, `${root}/settings/identity`);
+    }
+    async function changeJoinPolicy(session, form) {
+        const tenantRef = teamTenantOf(session);
+        if (!domainStore || tenantRef === undefined)
+            return nothingHere(session);
+        const id = form.get('id') ?? '';
+        const policy = form.get('policy') ?? '';
+        if (policy !== 'off' && policy !== 'request' && policy !== 'auto')
+            return identityPage(session, 400, 'Choose who may join.');
+        const domain = (await domainStore.list(tenantRef)).find((listed) => listed.id === id);
+        const refusal = await domainStore.setJoinPolicy(tenantRef, personOf(session), id, policy);
+        if (refusal)
+            return domainRefused(session, refusal);
+        await audit(session, { action: 'domain.join_policy_changed', targetType: 'domain', targetRef: id, metadata: { domain: domain?.ascii ?? '', policy } }, tenantRef);
+        return identityPage(session, 200, `${JOIN_POLICY_WORDS[policy]}: saved for ${domain?.unicode ?? 'the domain'}.`);
+    }
+    async function restrictInvites(session, form) {
+        const tenantRef = teamTenantOf(session);
+        if (!domainStore || tenantRef === undefined)
+            return nothingHere(session);
+        const on = form.get('on') === '1';
+        const refusal = await domainStore.restrictInvites(tenantRef, personOf(session), on);
+        if (refusal)
+            return domainRefused(session, refusal);
+        await audit(session, { action: on ? 'workspace.invites_restricted' : 'workspace.invites_unrestricted', targetType: 'workspace', targetRef: tenantRef }, tenantRef);
+        return redirect(303, `${root}/settings/identity`);
+    }
+    /** Teams at the person's verified addresses' domains: ask to join, or join. */
+    async function domainTeamsSection(session, checked) {
+        if (!domainStore)
+            return html ``;
+        const emails = verifiedEmails(session);
+        const found = emails.length > 0 ? await domainStore.discoverable(personOf(session), emails) : [];
+        if (found.length === 0) {
+            // A GitHub sign-in carries no address until asked: one look with those GitHub verified.
+            if (session.idp === 'google')
+                return html ``;
+            return checked
+                ? html `<p class="muted">No team has verified the domain of an address GitHub verified for you.</p>`
+                : html `<p><a href="${root}/sign-in?then=%2Fteams&amp;email=1">${ICONS.github}Find your organization’s team</a></p>`;
+        }
+        const token = csrfToken(session);
+        const rows = found.map((team) => html `<tr><td data-label="Team" class="strong">${team.name}</td><td data-label="Domain" class="muted">${team.domain}</td><td class="actions">${team.requested
+            ? html `<span class="pill held">Asked</span>`
+            : html `<form class="inline" method="post" action="${root}/join/request"><input type="hidden" name="csrf" value="${token}"><input type="hidden" name="once" value="${formNonce(session)}"><input type="hidden" name="team" value="${team.tenantRef}"><button class="primary" type="submit">${team.joinPolicy === 'auto' && joinEvidence(session) === 'google_workspace'
+                ? html `Join ${team.name}`
+                : html `Ask to join<span class="visually-hidden"> ${team.name}</span>`}</button></form>`}</td></tr>`);
+        return html `<div class="table"><table><caption class="visually-hidden">Teams at your domain</caption><thead><tr><th>At your domain</th><th>Domain</th><th><span class="visually-hidden">Actions</span></th></tr></thead><tbody>${rows}</tbody></table></div>`;
+    }
+    async function requestToJoin(session, form) {
+        if (!domainStore)
+            return nothingHere(session);
+        const team = form.get('team') ?? '';
+        const offered = (await domainStore.discoverable(personOf(session), verifiedEmails(session))).find((found) => found.tenantRef === team);
+        if (!offered)
+            return teamsPage(session, 404, DOMAIN_REFUSALS.not_found.text);
+        const asked = await domainStore.requestToJoin(team, personOf(session), verifiedEmails(session), joinEvidence(session), await memberCapOf(team));
+        if ('refusal' in asked)
+            return teamsPage(session, DOMAIN_REFUSALS[asked.refusal].status, DOMAIN_REFUSALS[asked.refusal].text);
+        const person = personOf(session);
+        if (asked.outcome === 'joined') {
+            await audit(session, { action: 'member.joined', actorRole: 'viewer', targetType: 'person', targetRef: person, metadata: { domain: offered.domainKey } }, team);
+            return moveTo(session, team.slice('team:'.length), '');
+        }
+        await audit(session, { action: 'member.join_requested', actorRole: null, targetType: 'person', targetRef: person, metadata: { domain: offered.domainKey, evidence: joinEvidence(session) } }, team);
+        return teamsPage(session, 200, `Asked to join ${offered.name}. An owner or admin decides.`);
+    }
+    async function decideJoinRequest(session, form) {
+        const tenantRef = teamTenantOf(session);
+        if (!domainStore || tenantRef === undefined)
+            return nothingHere(session);
+        const decision = form.get('decision');
+        if (decision !== 'approve' && decision !== 'decline')
+            return refusalPage(session, 'not_found');
+        const role = slotlockJoinRole(form.get('role'));
+        if (decision === 'approve' && role === null)
+            return settingsPage(session, 400, 'Choose a role.', undefined, 'members');
+        const id = form.get('id') ?? '';
+        const decided = await domainStore.decide({ tenantRef, actor: personOf(session), id, decision, role, memberCap: await memberCapOf(tenantRef) });
+        if (decided.refusal) {
+            const { status, text } = DOMAIN_REFUSALS[decided.refusal];
+            return settingsPage(session, status, text, undefined, 'members');
+        }
+        await audit(session, {
+            action: decision === 'approve' ? 'member.join_approved' : 'member.join_declined',
+            targetType: 'person',
+            ...(decided.person ? { targetRef: decided.person } : {}),
+            ...(role && decision === 'approve' ? { metadata: { role } } : {}),
+        }, tenantRef);
+        return redirect(303, `${root}/settings/members`);
+    }
+    // ---- Single sign-on through a team's own identity provider (teams phase 5.3–5.5) ----
+    /** What a refused single sign-on change or sign-in says, and its status. */
+    const SSO_REFUSALS = Object.freeze({
+        not_found: { status: 404, text: 'That is no longer here.' },
+        not_allowed: { status: 403, text: 'Only an owner can change the team’s single sign-on.' },
+        no_verified_domain: { status: 409, text: 'Verify a domain first: single sign-on trusts addresses only there.' },
+        secret_required: { status: 400, text: 'Enter the client secret.' },
+        conflict: { status: 409, text: 'The connection changed since this page was opened. Reload it.' },
+        stale_config: { status: 409, text: 'The connection changed during the test. Test it again.' },
+        untested: { status: 409, text: 'Test the connection as it is now before turning it on.' },
+        no_breakglass_owner: { status: 409, text: 'Keep an owner who signs in with GitHub or Google first, for when the provider is down.' },
+        role_not_allowed: { status: 400, text: 'People the provider adds join as Viewer, Member or Developer.' },
+        owner_not_mappable: { status: 400, text: 'No group makes an owner: owners are made in Slotlock.' },
+        invalid_value: { status: 400, text: 'Enter the group as the provider sends it.' },
+        mapping_limit: { status: 403, text: 'A team maps up to 50 groups.' },
+        connection_inactive: { status: 409, text: 'That team’s single sign-on is off.' },
+        guest_refused: { status: 403, text: 'Guests of the directory cannot sign in to this team.' },
+        not_member: { status: 403, text: 'You are not a member of this team. Ask an owner to add you.' },
+        identity_taken: { status: 409, text: 'That account is linked to someone else in Slotlock.' },
+        identity_untrusted: { status: 403, text: 'Use your work account at the team’s verified domain.' },
+        hd_mismatch: { status: 403, text: 'Use a Google Workspace account at the team’s verified domain.' },
+        member_cap: TEAM_REFUSALS.member_cap,
+        invalid_max_age: { status: 400, text: 'Sessions last from 1 to 168 hours.' },
+        no_active_connection: { status: 409, text: 'Turn the connection on first.' },
+        stale_sso_proof: { status: 409, text: 'Sign in with the team’s single sign-on first, then turn this on within 10 minutes.' },
+    });
+    /** The providers, as the Identity page names them. */
+    const SSO_KIND_WORDS = Object.freeze({
+        okta: 'Okta',
+        entra: 'Microsoft Entra ID',
+        google_workspace: 'Google Workspace',
+        oidc: 'Other OpenID Connect',
+    });
+    const ssoRedirectUri = (id) => `${publicRoot}/sso/callback/${id}`;
+    const ssoSecretContext = (tenantRef, id) => `${tenantRef}|${id}|v1`;
+    const ssoRefused = (session, refusal) => identityPage(session, SSO_REFUSALS[refusal].status, SSO_REFUSALS[refusal].text);
+    /** The team's connection on its Identity page: set it up, test it, turn it on, and who it lets in. */
+    async function ssoSection(session, tenantRef) {
+        if (!ssoStore)
+            return html ``;
+        const [connection, mappings] = await Promise.all([ssoStore.connection(tenantRef), ssoStore.mappings(tenantRef)]);
+        const token = csrfToken(session);
+        const hidden = () => html `<input type="hidden" name="csrf" value="${token}"><input type="hidden" name="once" value="${formNonce(session)}">`;
+        const kinds = (selected) => ['okta', 'entra', 'google_workspace', 'oidc'].map((kind) => html `<option value="${kind}"${kind === selected ? html ` selected` : html ``}>${SSO_KIND_WORDS[kind]}</option>`);
+        const form = html `<form class="sso-form" method="post" action="${root}/identity/sso">${hidden()}<label for="sso-kind">Provider</label><select id="sso-kind" name="kind">${kinds(connection?.kind ?? 'okta')}</select><label for="sso-issuer">Issuer URL, or Entra tenant ID</label><input id="sso-issuer" name="issuer" maxlength="500" autocomplete="off" spellcheck="false" required value="${connection ? (connection.kind === 'entra' ? (connection.entraTenant ?? '') : connection.issuer) : ''}"><label for="sso-client">Client ID</label><input id="sso-client" name="client_id" maxlength="255" autocomplete="off" spellcheck="false" required value="${connection?.clientId ?? ''}"><label for="sso-secret">Client secret</label><input id="sso-secret" name="client_secret" type="password" maxlength="1024" autocomplete="off"${connection ? html ` placeholder="••••${connection.secretLast4 ?? ''}"` : html ` required`}><button class="primary" type="submit">${connection ? 'Save' : 'Connect'}</button></form>`;
+        if (!connection)
+            return html `<h2>Single sign-on</h2>${form}`;
+        const tested = connection.testedVersion === connection.configVersion;
+        const [pill, word] = connection.status === 'active' ? ['active', 'On'] : connection.status === 'disabled' ? ['revoked', 'Off'] : ['held', tested ? 'Tested' : 'Not tested'];
+        const id = html `<input type="hidden" name="id" value="${connection.id}">`;
+        const claims = connection.lastTestClaims;
+        const testRow = claims
+            ? html `<div class="row"><span class="row-label">Last test</span><div class="row-value"><code>${JSON.stringify(claims)}</code></div></div>`
+            : html ``;
+        const status = html `<div class="set-card"><div class="row"><span class="row-label">${SSO_KIND_WORDS[connection.kind]}</span><div class="row-value"><span class="pill ${pill}">${word}</span> <span class="muted">${connection.issuer}</span></div></div><div class="row"><span class="row-label">Redirect URI</span><div class="row-value">${copyField('sso-redirect', ssoRedirectUri(connection.id))}</div></div>${testRow}<div class="row"><span class="row-label">Check</span><div class="row-value"><form class="inline" method="post" action="${root}/identity/sso/test">${hidden()}${id}<button type="submit">Test sign-in</button></form>${connection.status === 'active'
+            ? html `<form class="inline" method="post" action="${root}/identity/sso/status">${hidden()}${id}<input type="hidden" name="status" value="disabled"><button type="submit">Turn off</button></form>`
+            : html `<form class="inline" method="post" action="${root}/identity/sso/status">${hidden()}${id}<input type="hidden" name="status" value="active"><button class="primary" type="submit"${tested ? html `` : html ` disabled`}>Turn on</button></form>`}</div></div></div>`;
+        const roleOptions = (selected, choices) => choices.map((role) => html `<option value="${role}"${role === selected ? html ` selected` : html ``}>${SLOTLOCK_WORKSPACE_ROLE_NAMES[role]}</option>`);
+        const provisioning = html `<h3>Who joins</h3><form class="sso-form" method="post" action="${root}/identity/sso/provisioning">${hidden()}<label><input type="checkbox" name="jit" value="1"${connection.jitEnabled ? html ` checked` : html ``}> Add people at the verified domains on their first sign-in</label><label for="sso-default-role">As</label><select id="sso-default-role" name="default_role">${roleOptions(connection.defaultRole, ['viewer', 'member', 'developer'])}</select><label for="sso-groups-claim">Groups claim</label><input id="sso-groups-claim" name="groups_claim" maxlength="100" value="${connection.groupsClaim}"><button type="submit">Save</button></form>${mappings.length > 0
+            ? html `<div class="table"><table><thead><tr><th>Group</th><th>Role</th><th><span class="visually-hidden">Actions</span></th></tr></thead><tbody>${mappings.map((mapping) => html `<tr><td data-label="Group" class="strong">${mapping.value}</td><td data-label="Role">${SLOTLOCK_WORKSPACE_ROLE_NAMES[mapping.role]}</td><td class="actions"><form class="inline" method="post" action="${root}/identity/sso/mapping">${hidden()}<input type="hidden" name="value" value="${mapping.value}"><input type="hidden" name="role" value=""><button class="danger" type="submit">Remove<span class="visually-hidden"> ${mapping.value}</span></button></form></td></tr>`)}</tbody></table></div>`
+            : html ``}<form class="invite" method="post" action="${root}/identity/sso/mapping">${hidden()}<label for="sso-group">Group</label><input id="sso-group" name="value" maxlength="255" autocomplete="off" required><label class="visually-hidden" for="sso-group-role">Role</label><select id="sso-group-role" name="role">${roleOptions('member', ['admin', 'developer', 'member', 'viewer', 'billing'])}</select><button type="submit">Map group</button></form>`;
+        const enforcement = html `<h3>Require single sign-on</h3><form class="sso-form" method="post" action="${root}/identity/sso/require">${hidden()}<input type="hidden" name="on" value="${connection.requireSso ? '0' : '1'}"><label for="sso-max-age">Sign in again every (hours)</label><input id="sso-max-age" name="max_age" type="number" min="1" max="168" value="${String(connection.maxAgeHours)}"><button type="submit"${connection.status === 'active' || connection.requireSso ? html `` : html ` disabled`}>${connection.requireSso ? 'Stop requiring it' : 'Require it'}</button></form>${connection.status === 'active' && !connection.requireSso && session.sc === undefined
+            ? html `<form class="inline" method="post" action="${root}/sso/proof">${hidden()}<input type="hidden" name="team" value="${tenantRef}"><button type="submit">Sign in with single sign-on</button></form>`
+            : html ``}`;
+        const remove = html `<details class="act danger"><summary>Delete connection</summary><div class="pop"><p>People who sign in only through it are erased with it.</p><form method="post" action="${root}/identity/sso/delete">${hidden()}${id}<button class="danger" type="submit">Delete connection</button></form></div></details>`;
+        return html `<h2>Single sign-on</h2>${status}${form}${provisioning}${enforcement}${remove}`;
+    }
+    async function saveSsoConnection(session, form) {
+        const tenantRef = teamTenantOf(session);
+        if (!ssoStore || !options.sso || tenantRef === undefined)
+            return nothingHere(session);
+        const kind = form.get('kind');
+        if (kind !== 'okta' && kind !== 'entra' && kind !== 'google_workspace' && kind !== 'oidc')
+            return identityPage(session, 400, 'Choose the provider.');
+        const typed = (form.get('issuer') ?? '').trim();
+        const clientId = (form.get('client_id') ?? '').trim();
+        const secret = form.get('client_secret') ?? '';
+        if (clientId.length === 0 || clientId.length > 255 || /\s/.test(clientId))
+            return identityPage(session, 400, 'Enter the client ID.');
+        let issuer;
+        let entraTenant = null;
+        if (kind === 'entra') {
+            const pinned = slotlockEntraIssuer(typed);
+            if (!pinned)
+                return identityPage(session, 400, 'Enter your Entra tenant ID (a GUID): common, organizations and consumers are not one tenant.');
+            issuer = pinned;
+            entraTenant = typed.toLowerCase();
+        }
+        else if (kind === 'google_workspace') {
+            issuer = 'https://accounts.google.com';
+        }
+        else {
+            if (!slotlockOidcUrlAllowed(typed))
+                return identityPage(session, 400, 'Enter the issuer URL: https, on a public host name.');
+            issuer = typed;
+        }
+        let provider;
+        try {
+            provider = await discoverSlotlockOidc(issuer, { fetch: ssoFetch });
+        }
+        catch (error) {
+            return identityPage(session, 502, `The issuer’s discovery document did not check out: ${error instanceof Error ? error.message : 'no answer'}.`);
+        }
+        const existing = await ssoStore.connection(tenantRef);
+        const id = existing?.id ?? randomUUID();
+        if (!existing && secret.length === 0)
+            return ssoRefused(session, 'secret_required');
+        if (secret.length > 1024 || /[\r\n]/.test(secret))
+            return identityPage(session, 400, 'That is not a client secret.');
+        const sealed = secret.length > 0 ? await options.sso.secretBox.seal(secret, ssoSecretContext(tenantRef, id)) : null;
+        const saved = await ssoStore.save({
+            tenantRef,
+            actor: personOf(session),
+            id,
+            kind,
+            issuer: provider.issuer,
+            clientId,
+            secretSealed: sealed,
+            secretLast4: secret.length > 0 ? secret.slice(-4) : null,
+            authorizationEndpoint: provider.authorizationEndpoint,
+            tokenEndpoint: provider.tokenEndpoint,
+            jwksUri: provider.jwksUri,
+            algorithms: provider.algorithms,
+            issParameter: provider.issParameter,
+            entraTenant,
+        });
+        if ('refusal' in saved)
+            return ssoRefused(session, saved.refusal);
+        await audit(session, { action: 'sso.connection_saved', targetType: 'sso_connection', targetRef: saved.id, metadata: { kind, issuer: provider.issuer } }, tenantRef);
+        if (saved.enforcementOff) {
+            await audit(session, { action: 'sso.not_required', targetType: 'workspace', targetRef: tenantRef, metadata: { reason: 'connection_changed' } }, tenantRef);
+        }
+        return redirect(303, `${root}/settings/identity`);
+    }
+    async function setSsoStatus(session, form) {
+        const tenantRef = teamTenantOf(session);
+        if (!ssoStore || tenantRef === undefined)
+            return nothingHere(session);
+        const status = form.get('status') === 'active' ? 'active' : 'disabled';
+        const id = form.get('id') ?? '';
+        const refusal = await ssoStore.setStatus(tenantRef, personOf(session), id, status);
+        if (refusal)
+            return ssoRefused(session, refusal);
+        await audit(session, { action: status === 'active' ? 'sso.connection_activated' : 'sso.connection_disabled', targetType: 'sso_connection', targetRef: id }, tenantRef);
+        return redirect(303, `${root}/settings/identity`);
+    }
+    async function deleteSsoConnection(session, form) {
+        const tenantRef = teamTenantOf(session);
+        if (!ssoStore || tenantRef === undefined)
+            return nothingHere(session);
+        const id = form.get('id') ?? '';
+        const refusal = await ssoStore.remove(tenantRef, personOf(session), id);
+        if (refusal)
+            return ssoRefused(session, refusal);
+        await audit(session, { action: 'sso.connection_deleted', targetType: 'sso_connection', targetRef: id }, tenantRef);
+        return redirect(303, `${root}/settings/identity`);
+    }
+    async function setSsoProvisioning(session, form) {
+        const tenantRef = teamTenantOf(session);
+        if (!ssoStore || tenantRef === undefined)
+            return nothingHere(session);
+        const jit = form.get('jit') === '1';
+        const defaultRole = form.get('default_role') ?? '';
+        const groupsClaim = (form.get('groups_claim') ?? '').trim();
+        if (groupsClaim !== '' && !/^[A-Za-z0-9_:./-]{1,100}$/.test(groupsClaim))
+            return identityPage(session, 400, 'Enter the groups claim as the provider names it.');
+        const refusal = await ssoStore.setProvisioning(tenantRef, personOf(session), jit, defaultRole, groupsClaim);
+        if (refusal)
+            return ssoRefused(session, refusal);
+        await audit(session, { action: 'sso.provisioning_changed', targetType: 'workspace', targetRef: tenantRef, metadata: { jit, defaultRole } }, tenantRef);
+        return redirect(303, `${root}/settings/identity`);
+    }
+    async function setSsoMapping(session, form) {
+        const tenantRef = teamTenantOf(session);
+        if (!ssoStore || tenantRef === undefined)
+            return nothingHere(session);
+        const value = (form.get('value') ?? '').trim();
+        const role = form.get('role') || null;
+        const refusal = await ssoStore.setMapping(tenantRef, personOf(session), value, role);
+        if (refusal)
+            return ssoRefused(session, refusal);
+        await audit(session, { action: 'sso.mapping_changed', targetType: 'workspace', targetRef: tenantRef, metadata: { group: value.slice(0, 100), role: role ?? 'none' } }, tenantRef);
+        return redirect(303, `${root}/settings/identity`);
+    }
+    async function setRequireSso(session, form) {
+        const tenantRef = teamTenantOf(session);
+        if (!ssoStore || tenantRef === undefined)
+            return nothingHere(session);
+        const on = form.get('on') === '1';
+        const maxAge = Number(form.get('max_age') ?? '');
+        const refusal = await ssoStore.requireSso(tenantRef, personOf(session), session.sid, on, Number.isSafeInteger(maxAge) ? maxAge : 0);
+        if (refusal)
+            return ssoRefused(session, refusal);
+        await audit(session, { action: on ? 'sso.required' : 'sso.not_required', targetType: 'workspace', targetRef: tenantRef, metadata: { maxAgeHours: maxAge } }, tenantRef);
+        return redirect(303, `${root}/settings/identity`);
+    }
+    /** The page a member meets at a team that requires single sign-on: sign in through it, or (an Owner) bypass. */
+    function ssoRequiredPage(session, tenantRef, name, mayBypass) {
+        const token = csrfToken(session);
+        const hidden = () => html `<input type="hidden" name="csrf" value="${token}"><input type="hidden" name="once" value="${formNonce(session)}"><input type="hidden" name="team" value="${tenantRef}">`;
+        const content = html `${pageHead(name)}<p>${name} requires single sign-on.</p><p class="actions"><form class="inline" method="post" action="${root}/sso/proof">${hidden()}<button class="primary" type="submit">Sign in with single sign-on</button></form>${mayBypass
+            ? html `<form class="inline" method="post" action="${root}/sso/bypass">${hidden()}<button type="submit">Use owner bypass</button></form>`
+            : html ``}</p>${mayBypass ? html `<p class="fine">An owner’s bypass lasts an hour, in this browser, and every other owner can see it in the audit log.</p>` : html ``}`;
+        return respond(403, layout(name, content, session));
+    }
+    /** Start a sign-in through a team's provider: to sign in alone, prove oneself (or link) while signed in, or test it. */
+    async function startSsoSignIn(connection, purpose, person, version) {
+        const state = randomBytes(32).toString('base64url');
+        const verifier = randomBytes(32).toString('base64url');
+        const nonce = randomBytes(24).toString('base64url');
+        const target = new URL(connection.authorizationEndpoint);
+        target.search = new URLSearchParams({
+            client_id: connection.clientId,
+            redirect_uri: ssoRedirectUri(connection.id),
+            response_type: 'code',
+            scope: 'openid email profile',
+            state,
+            nonce,
+            code_challenge: createHash('sha256').update(verifier).digest('base64url'),
+            code_challenge_method: 'S256',
+            ...(purpose === 'test' ? { prompt: 'login' } : {}),
+        }).toString();
+        const sealed = seal('slotlock-dashboard-sso-v1', {
+            state,
+            verifier,
+            nonce,
+            conn: connection.id,
+            purpose,
+            exp: now() + SIGN_IN_TTL_MS,
+            ...(person !== undefined ? { person } : {}),
+            ...(version !== undefined ? { version } : {}),
+        });
+        return redirect(302, target.href, [setCookie(SSO_COOKIE, sealed, SIGN_IN_TTL_MS / 1000)]);
+    }
+    async function testSsoConnection(session) {
+        const tenantRef = teamTenantOf(session);
+        if (!ssoStore || tenantRef === undefined)
+            return nothingHere(session);
+        const connection = await ssoStore.connection(tenantRef);
+        if (!connection)
+            return ssoRefused(session, 'not_found');
+        return startSsoSignIn({ ...connection, tenantRef }, 'test', personOf(session), connection.configVersion);
+    }
+    /** A signed-in member's sign-in through their team's provider: to link it, or prove themselves to a team that requires it. */
+    async function startSsoProof(session, form) {
+        if (!ssoStore)
+            return nothingHere(session);
+        const team = form.get('team') ?? '';
+        const connection = TEAM_ID.test(team.replace(/^team:/, '')) ? await ssoStore.connection(team) : null;
+        if (!connection || connection.status !== 'active')
+            return teamsPage(session, 409, SSO_REFUSALS.connection_inactive.text);
+        return startSsoSignIn({ ...connection, tenantRef: team }, 'proof', personOf(session));
+    }
+    const SCIM_REFUSALS = Object.freeze({
+        not_found: { status: 404, text: 'That is no longer here.' },
+        not_allowed: { status: 403, text: 'Only an owner can change the team’s provisioning.' },
+        not_enabled: { status: 409, text: 'Turn on SCIM first.' },
+        no_verified_domain: { status: 409, text: 'Verify a domain first: the directory adds people only there.' },
+        key_policy: { status: 400, text: 'Choose what happens to a deactivated member’s API keys.' },
+        token_limit: { status: 403, text: 'A team keeps two tokens. Revoke one first.' },
+        bad_token: { status: 401, text: 'That token is not this team’s.' },
+        wrong_workspace: { status: 401, text: 'That token is not this team’s.' },
+        domain_not_verified: { status: 400, text: 'The directory adds people at the verified domains only.' },
+        uniqueness: { status: 409, text: 'That name is taken.' },
+        owner_protected: { status: 409, text: 'The directory never changes an owner.' },
+        invalid_member: { status: 400, text: 'That member is not in the directory.' },
+        owner_not_mappable: { status: 400, text: 'No group makes an owner: owners are made in Slotlock.' },
+        role_not_allowed: { status: 400, text: 'Choose a role.' },
+    });
+    const scimRefused = (session, refusal) => identityPage(session, SCIM_REFUSALS[refusal].status, SCIM_REFUSALS[refusal].text);
+    /** A token just made: shown on the page that answers, once. */
+    const scimTokenShown = new WeakMap();
+    const scimBaseUrl = (tenantRef) => `${publicRoot}/scim/v2/${tenantRef.slice('team:'.length)}`;
+    /** A team's SCIM provisioning on its Identity page: off with the Owner's choice of key policy, or its address, tokens and groups. */
+    async function scimSection(session, tenantRef) {
+        if (!scimStore)
+            return html ``;
+        const state = await scimStore.state(tenantRef);
+        const hidden = () => html `<input type="hidden" name="csrf" value="${csrfToken(session)}"><input type="hidden" name="once" value="${formNonce(session)}">`;
+        if (!state.enabled) {
+            return html `<h2>Provisioning</h2><form class="sso-form" method="post" action="${root}/identity/scim/enable">${hidden()}<fieldset><legend>When the directory deactivates someone, their API keys</legend><label><input type="radio" name="keys" value="revoke" required> Are revoked</label><label><input type="radio" name="keys" value="keep" required> Keep working</label></fieldset><button class="primary" type="submit">Turn on SCIM</button></form>`;
+        }
+        const shown = scimTokenShown.get(session);
+        const tokens = state.tokens.map((token) => html `<tr><td data-label="Token" class="strong"><code>${token.prefix}…</code></td><td data-label="Made">${formatDate(token.createdAt)}</td><td data-label="Last used">${token.lastUsedAt ? formatDate(token.lastUsedAt) : 'Never'}</td><td class="actions"><form class="inline" method="post" action="${root}/identity/scim/token/revoke">${hidden()}<input type="hidden" name="id" value="${token.id}"><button class="danger" type="submit">Revoke<span class="visually-hidden"> ${token.prefix}</span></button></form></td></tr>`);
+        const card = html `<div class="set-card"><div class="row"><span class="row-label">SCIM URL</span><div class="row-value">${copyField('scim-url', scimBaseUrl(tenantRef))}</div></div>${shown ? html `<div class="row"><span class="row-label">New token</span><div class="row-value">${copyField('scim-token', shown)}</div></div>` : html ``}<div class="row"><span class="row-label">Deactivated members’ keys</span><div class="row-value">${state.keyPolicy === 'revoke' ? 'Revoked' : 'Keep working'}</div></div></div>`;
+        const tokenTable = tokens.length > 0
+            ? html `<div class="table"><table><thead><tr><th>Token</th><th>Made</th><th>Last used</th><th><span class="visually-hidden">Actions</span></th></tr></thead><tbody>${tokens}</tbody></table></div>`
+            : html ``;
+        const { groups } = await scimStore.groups(tenantRef, null, 1, 100);
+        const roleChoices = ['admin', 'developer', 'member', 'viewer', 'billing'];
+        const reserved = (name) => /^slotlock-role-(admin|developer|member|viewer|billing)$/i.test(name);
+        const groupRows = groups.map((group) => html `<tr><td data-label="Group" class="strong">${group.displayName}</td><td data-label="People">${String(group.members.length)}</td><td data-label="Role">${reserved(group.displayName)
+            ? SLOTLOCK_WORKSPACE_ROLE_NAMES[group.displayName.slice('slotlock-role-'.length).toLowerCase()]
+            : html `<form class="inline" method="post" action="${root}/identity/scim/group">${hidden()}<input type="hidden" name="id" value="${group.id}"><label class="visually-hidden" for="scim-group-${group.id}">Role for ${group.displayName}</label><select id="scim-group-${group.id}" name="role"><option value="">None</option>${roleChoices.map((role) => html `<option value="${role}"${group.role === role ? html ` selected` : html ``}>${SLOTLOCK_WORKSPACE_ROLE_NAMES[role]}</option>`)}</select><button type="submit">Save</button></form>`}</td></tr>`);
+        const groupTable = groupRows.length > 0
+            ? html `<h3>Groups</h3><div class="table"><table><thead><tr><th>Group</th><th>People</th><th>Role</th></tr></thead><tbody>${groupRows}</tbody></table></div>`
+            : html ``;
+        const off = html `<details class="act danger"><summary>Turn off SCIM</summary><div class="pop"><p>Its tokens stop working. Members it added stay.</p><form method="post" action="${root}/identity/scim/disable">${hidden()}<button class="danger" type="submit">Turn off SCIM</button></form></div></details>`;
+        return html `<h2>Provisioning</h2>${card}${tokenTable}<form class="inline" method="post" action="${root}/identity/scim/token">${hidden()}<button type="submit">New token</button></form>${groupTable}${off}`;
+    }
+    async function enableScim(session, form) {
+        const tenantRef = teamTenantOf(session);
+        if (!scimStore || tenantRef === undefined)
+            return nothingHere(session);
+        const keys = form.get('keys');
+        if (keys !== 'keep' && keys !== 'revoke')
+            return scimRefused(session, 'key_policy');
+        const refusal = await scimStore.enable(tenantRef, personOf(session), keys);
+        if (refusal)
+            return scimRefused(session, refusal);
+        await audit(session, { action: 'scim.enabled', targetType: 'workspace', targetRef: tenantRef, metadata: { keys } }, tenantRef);
+        return redirect(303, `${root}/settings/identity`);
+    }
+    async function disableScim(session) {
+        const tenantRef = teamTenantOf(session);
+        if (!scimStore || tenantRef === undefined)
+            return nothingHere(session);
+        const refusal = await scimStore.disable(tenantRef, personOf(session));
+        if (refusal)
+            return scimRefused(session, refusal);
+        await audit(session, { action: 'scim.disabled', targetType: 'workspace', targetRef: tenantRef }, tenantRef);
+        return redirect(303, `${root}/settings/identity`);
+    }
+    async function createScimToken(session) {
+        const tenantRef = teamTenantOf(session);
+        if (!scimStore || tenantRef === undefined)
+            return nothingHere(session);
+        const made = await scimStore.createToken(tenantRef, personOf(session));
+        if ('refusal' in made)
+            return scimRefused(session, made.refusal);
+        await audit(session, { action: 'scim.token_created', targetType: 'scim_token', targetRef: made.prefix }, tenantRef);
+        scimTokenShown.set(session, made.token);
+        return identityPage(session, 201, 'Copy the token into your identity provider now: it is not shown again.');
+    }
+    async function revokeScimToken(session, form) {
+        const tenantRef = teamTenantOf(session);
+        if (!scimStore || tenantRef === undefined)
+            return nothingHere(session);
+        const id = form.get('id') ?? '';
+        const refusal = await scimStore.revokeToken(tenantRef, personOf(session), id);
+        if (refusal)
+            return scimRefused(session, refusal);
+        await audit(session, { action: 'scim.token_revoked', targetType: 'scim_token', targetRef: id }, tenantRef);
+        return redirect(303, `${root}/settings/identity`);
+    }
+    async function mapScimGroup(session, form) {
+        const tenantRef = teamTenantOf(session);
+        if (!scimStore || tenantRef === undefined)
+            return nothingHere(session);
+        const id = form.get('id') ?? '';
+        const role = form.get('role') || null;
+        const refusal = await scimStore.mapGroup(tenantRef, personOf(session), id, role);
+        if (refusal)
+            return scimRefused(session, refusal);
+        await audit(session, { action: 'scim.group_mapped', targetType: 'scim_group', targetRef: id, metadata: { role } }, tenantRef);
+        return redirect(303, `${root}/settings/identity`);
+    }
+    async function useSsoBypass(session, form) {
+        if (!ssoStore)
+            return nothingHere(session);
+        const team = form.get('team') ?? '';
+        if (!TEAM_ID.test(team.replace(/^team:/, '')))
+            return nothingHere(session);
+        // As fresh as any Owner's power: a sign-in in the last 15 minutes.
+        if (!freshlySignedIn(session))
+            return confirmPage(session, 'workspace.own', '/teams');
+        const refusal = await ssoStore.bypass(team, personOf(session), session.sid);
+        if (refusal)
+            return teamsPage(session, 403, 'Only an owner who signs in with GitHub or Google can bypass single sign-on.');
+        await audit(session, { action: 'sso.bypass_used', actorRole: 'owner', targetType: 'workspace', targetRef: team }, team);
+        return moveTo(session, team.slice('team:'.length), '');
+    }
+    /** The claims a test sign-in shows the Owner: what decides who someone is and what they get, no token. */
+    function ssoTestClaims(claims, groupsClaim) {
+        const pick = (name) => (claims[name] === undefined ? {} : { [name]: claims[name] });
+        const groups = claims[groupsClaim];
+        return {
+            ...pick('iss'),
+            ...pick('sub'),
+            ...pick('tid'),
+            ...pick('oid'),
+            ...pick('email'),
+            ...pick('email_verified'),
+            ...pick('xms_edov'),
+            ...pick('hd'),
+            ...pick('acct'),
+            ...(Array.isArray(groups) ? { groups: groups.slice(0, 20) } : isRecord(claims._claim_names) ? { groups: 'overage' } : {}),
+        };
+    }
+    /** The callback of a team's provider: the code exchanged, the ID token checked, then the purpose served. */
+    async function finishSsoSignIn(request, url, connectionId) {
+        const clear = setCookie(SSO_COOKIE, '', 0);
+        const pending = unseal('slotlock-dashboard-sso-v1', readCookies(request).get(SSO_COOKIE));
+        const code = url.searchParams.get('code');
+        const state = url.searchParams.get('state');
+        if (!ssoStore ||
+            !options.sso ||
+            url.searchParams.has('error') ||
+            !pending ||
+            pending.conn !== connectionId ||
+            typeof pending.state !== 'string' ||
+            typeof pending.verifier !== 'string' ||
+            typeof pending.nonce !== 'string' ||
+            code === null ||
+            code.length === 0 ||
+            code.length > 2048 ||
+            state === null ||
+            !safeEqual(state, pending.state)) {
+            return signedOutPage(400, SIGN_IN_AGAIN, [clear]);
+        }
+        const connection = await ssoStore.connectionById(connectionId);
+        if (!connection || (pending.purpose !== 'test' && connection.status !== 'active')) {
+            return signedOutPage(409, SSO_REFUSALS.connection_inactive.text, [clear]);
+        }
+        // RFC 9207: the issuer that answered, when it says, must be this connection's (mix-up defence).
+        const answeredBy = url.searchParams.get('iss');
+        if ((answeredBy !== null || connection.issParameter) && answeredBy !== connection.issuer) {
+            return signedOutPage(400, SIGN_IN_AGAIN, [clear]);
+        }
+        if (!(await options.state.use('sign_in', `sso.${pending.state}`, pending.exp)))
+            return signedOutPage(400, SIGN_IN_AGAIN, [clear]);
+        const secret = connection.secretSealed ? await options.sso.secretBox.open(connection.secretSealed, ssoSecretContext(connection.tenantRef, connection.id)) : null;
+        if (secret === null) {
+            report('Single sign-on refused: the client secret does not open');
+            return signedOutPage(502, `${connection.name}’s single sign-on did not complete. Try again.`, [clear]);
+        }
+        let checked = null;
+        try {
+            // Okta and other providers take the client's secret by HTTP Basic (RFC 6749 2.3.1); Entra and
+            // Google, in the body.
+            const basic = connection.kind === 'okta' || connection.kind === 'oidc';
+            const body = new URLSearchParams({
+                grant_type: 'authorization_code',
+                code,
+                redirect_uri: ssoRedirectUri(connection.id),
+                code_verifier: pending.verifier,
+                ...(basic ? {} : { client_id: connection.clientId, client_secret: secret }),
+            });
+            if (!slotlockOidcUrlAllowed(connection.tokenEndpoint))
+                throw new Error('token endpoint');
+            const response = await ssoFetch(connection.tokenEndpoint, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                    Accept: 'application/json',
+                    ...(basic
+                        ? { Authorization: `Basic ${btoa(`${encodeURIComponent(connection.clientId)}:${encodeURIComponent(secret)}`)}` }
+                        : {}),
+                },
+                body: body.toString(),
+                redirect: 'manual',
+                signal: AbortSignal.timeout(GITHUB_TIMEOUT_MS),
+            });
+            // Read to 64 KB at most: the endpoint is the Owner's to choose, and a token answer is small.
+            const answer = response.ok ? await slotlockReadJsonBody(response, SSO_TOKEN_ANSWER_BYTES).catch(() => null) : null;
+            if (!response.ok)
+                await response.body?.cancel().catch(() => undefined);
+            const token = answer !== null && typeof answer.id_token === 'string' ? answer.id_token : null;
+            if (token !== null) {
+                checked = await verifySlotlockIdToken(token, {
+                    issuers: connection.kind === 'google_workspace' ? SLOTLOCK_GOOGLE_ISSUERS : [connection.issuer],
+                    clientId: connection.clientId,
+                    algorithms: connection.algorithms,
+                    keys: ssoJwks.lookup(connection.jwksUri),
+                    nonce: pending.nonce,
+                    now: now(),
+                });
+            }
+            else {
+                report(`Single sign-on token exchange failed: HTTP ${response.status}`);
+            }
+        }
+        catch (error) {
+            report(`Single sign-on failed: ${error instanceof Error ? error.name : 'unknown error'}`);
+        }
+        if (!checked || 'refusal' in checked) {
+            if (checked)
+                report(`Single sign-on refused: the ID token did not check out (${checked.refusal})`);
+            return signedOutPage(502, `${connection.name}’s single sign-on did not complete. Try again.`, [clear]);
+        }
+        const claims = checked.claims;
+        const subject = claims.sub;
+        // Entra: the token's tenant is the one pinned, the object id is the stable key, guests stay out,
+        // and an email counts only when Entra says the domain's owner verified it (xms_edov).
+        if (connection.kind === 'entra' && (claims.tid !== connection.entraTenant || typeof claims.oid !== 'string')) {
+            return signedOutPage(403, `${connection.name}’s single sign-on did not complete. Try again.`, [clear]);
+        }
+        // The team's verified domains: an email is trusted only there, and a Google account only of one.
+        const verifiedDomains = domainStore
+            ? (await domainStore.list(connection.tenantRef)).filter((claim) => claim.status === 'verified').map((claim) => claim.ascii)
+            : [];
+        const hostedDomain = typeof claims.hd === 'string' ? slotlockEmailDomain(`x@${claims.hd}`) : null;
+        if (connection.kind === 'google_workspace' && (hostedDomain === null || !verifiedDomains.includes(hostedDomain))) {
+            // Any Google account can pass an "External" OAuth client: only the team's Workspace counts.
+            const refused = SSO_REFUSALS.hd_mismatch;
+            if (pending.purpose === 'signin')
+                return signedOutPage(refused.status, refused.text, [clear]);
+            const session = await readSession(request);
+            if (!session)
+                return signedOutPage(400, SIGN_IN_AGAIN, [clear]);
+            return pending.purpose === 'test' ? identityPage(session, refused.status, refused.text) : teamsPage(session, refused.status, refused.text);
+        }
+        const email = typeof claims.email === 'string' && claims.email.length <= 254 && !/[<>\p{Cc}]/u.test(claims.email) ? claims.email.toLowerCase() : null;
+        const emailDomain = email === null ? null : slotlockEmailDomain(email);
+        const emailOk = email !== null &&
+            (connection.kind === 'entra'
+                ? claims.xms_edov === true || claims.xms_edov === 'true' || claims.xms_edov === 1
+                : connection.kind === 'google_workspace'
+                    ? (claims.email_verified === true || claims.email_verified === 'true') && emailDomain !== null && emailDomain === hostedDomain
+                    : // Okta and other providers: the team's directory vouches for its own domain's addresses,
+                        // unless the token itself says the address is unverified.
+                        claims.email_verified !== false && claims.email_verified !== 'false');
+        const groupsValue = claims[connection.groupsClaim];
+        const groups = Array.isArray(groupsValue) ? groupsValue.filter((group) => typeof group === 'string').slice(0, 200) : [];
+        const overage = isRecord(claims._claim_names) && 'groups' in claims._claim_names;
+        const guest = connection.kind === 'entra' && (claims.acct === 1 || claims.acct === '1');
+        const entra = connection.kind === 'entra' ? { tid: claims.tid, oid: claims.oid } : null;
+        const session = pending.purpose === 'signin' ? null : await readSession(request);
+        if (pending.purpose === 'test') {
+            if (!session || personOf(session) !== pending.person || typeof pending.version !== 'number')
+                return signedOutPage(400, SIGN_IN_AGAIN, [clear]);
+            const shown = { ...ssoTestClaims(claims, connection.groupsClaim), trusted_email: emailOk };
+            const refusal = await ssoStore.recordTest(connection.tenantRef, personOf(session), connection.id, pending.version, shown);
+            if (refusal)
+                return identityPage(session, SSO_REFUSALS[refusal].status, SSO_REFUSALS[refusal].text);
+            await audit(session, { action: 'sso.connection_tested', targetType: 'sso_connection', targetRef: connection.id }, connection.tenantRef);
+            return redirect(303, `${root}/settings/identity`, [clear]);
+        }
+        if (pending.purpose === 'proof') {
+            // A session through one team's provider alone proves nothing to another's, nor links to it.
+            if (!session || personOf(session) !== pending.person || session.sc !== undefined)
+                return signedOutPage(400, SIGN_IN_AGAIN, [clear]);
+            const result = await ssoStore.signIn({
+                connectionId: connection.id,
+                issuer: connection.issuer,
+                subject,
+                entraTid: entra?.tid ?? null,
+                entraOid: entra?.oid ?? null,
+                email,
+                emailOk,
+                groups,
+                overage,
+                guest,
+                sessionPerson: personOf(session),
+                memberCap: null,
+            });
+            if (result.refusal)
+                return teamsPage(session, SSO_REFUSALS[result.refusal].status, SSO_REFUSALS[result.refusal].text);
+            // Recorded only while the connection is on as it was: turned off meanwhile, no proof.
+            if (!(await ssoStore.recordProof(session.sid, personOf(session), connection.id, false, connection.configVersion))) {
+                return teamsPage(session, SSO_REFUSALS.connection_inactive.status, SSO_REFUSALS.connection_inactive.text);
+            }
+            // The team's own provider vouched for the address: the directory's user there is this person.
+            if (scimStore && emailOk && email !== null && emailDomain !== null && verifiedDomains.includes(emailDomain)) {
+                await scimStore.bind(personOf(session), [email], plans ? FREE_TEAM_MEMBERS : null);
+            }
+            if (result.outcome === 'linked') {
+                await audit(session, { action: 'sso.linked', targetType: 'sso_connection', targetRef: connection.id }, connection.tenantRef);
+            }
+            return moveTo(session, connection.tenantRef.slice('team:'.length), '', [clear]);
+        }
+        // Through the provider alone.
+        const result = await ssoStore.signIn({
+            connectionId: connection.id,
+            issuer: connection.issuer,
+            subject,
+            entraTid: entra?.tid ?? null,
+            entraOid: entra?.oid ?? null,
+            email,
+            emailOk,
+            groups,
+            overage,
+            guest,
+            sessionPerson: null,
+            memberCap: await memberCapOf(connection.tenantRef),
+        });
+        if (result.refusal || result.person === null) {
+            const refusal = result.refusal ?? 'not_member';
+            return signedOutPage(SSO_REFUSALS[refusal].status, SSO_REFUSALS[refusal].text, [clear]);
+        }
+        const person = result.person;
+        const [idp, uid] = person.startsWith('github:')
+            ? [undefined, person.slice('github:'.length)]
+            : person.startsWith('google:')
+                ? ['google', person.slice('google:'.length)]
+                : ['sso', person.slice('sso:'.length)];
+        if (!allowed(uid, idp))
+            return signedOutPage(403, 'This Slotlock server does not let that account sign in.', [clear]);
+        const epoch = workspaces ? await workspaces.signedIn(person) : undefined;
+        // Named by the provider's email only where the team trusts it: at a domain it verified.
+        const trusted = emailOk && emailDomain !== null && verifiedDomains.includes(emailDomain);
+        if (scimStore && trusted && email !== null)
+            await scimStore.bind(person, [email], plans ? FREE_TEAM_MEMBERS : null);
+        const login = trusted && email !== null ? email : 'SSO account';
+        if (teamStore && idp === 'sso')
+            await teamStore.setDisplay(person, login === 'SSO account' ? null : login);
+        const sid = randomBytes(24).toString('base64url');
+        const expires = now() + SESSION_TTL_MS;
+        await workspaces?.sessions?.started(person, sid, new Date(expires), requestOrigin(request));
+        // Scoped to this team for the session's life: the provider reaches nothing else of the person's.
+        if (!(await ssoStore.recordProof(sid, person, connection.id, true, connection.configVersion))) {
+            await workspaces?.sessions?.end(person, workspaces.sessions.idOf(sid));
+            return signedOutPage(409, SSO_REFUSALS.connection_inactive.text, [clear]);
+        }
+        const sealedSession = seal('slotlock-dashboard-session-v1', {
+            uid,
+            login,
+            sid,
+            exp: expires,
+            ...(idp !== undefined ? { idp } : {}),
+            ...(epoch !== undefined ? { ep: epoch } : {}),
+            team: connection.tenantRef.slice('team:'.length),
+            sc: connection.id,
+        });
+        if (options.resources.audit) {
+            await options.resources.audit
+                .record(connection.tenantRef, {
+                action: result.outcome === 'joined' ? 'member.joined' : 'sso.signed_in',
+                actorType: 'person',
+                actorRef: person,
+                actorRole: result.role,
+                ...requestOrigin(request),
+                ...(overage ? { metadata: { groups: 'overage' } } : {}),
+            })
+                .catch((error) => ignoreRejection(options.onError?.(error)));
+        }
+        return redirect(303, root, [clear, setCookie(SESSION_COOKIE, sealedSession, SESSION_TTL_MS / 1000)]);
+    }
+    /**
+     * Where single sign-on starts without a session: the team's handle, or an address at its verified
+     * domain. A link only names the team; the person continues to its provider by a button here (a
+     * same-origin POST), so another site can neither sign someone in to a team they did not choose
+     * nor send them on to a provider's address through this one.
+     */
+    async function ssoStartPage(url, handle) {
+        if (!ssoStore)
+            return nothingHere404();
+        const email = (url.searchParams.get('email') ?? '').trim();
+        const team = (handle ?? url.searchParams.get('team') ?? '').trim();
+        if (team !== '' || email !== '') {
+            const domain = email === '' ? null : slotlockEmailDomain(email);
+            const route = await ssoStore.route(team !== '' ? { handle: team } : domain !== null ? { domain } : {});
+            if (route) {
+                const provider = new URL(route.authorizationEndpoint).host;
+                const content = html `<section class="sign-in"><span class="sign-in-mark">${ICONS.mark}</span><h1>Sign in to ${route.name}</h1><form method="post" action="${root}/sso/start"><input type="hidden" name="team" value="${route.handle}"><button class="primary wide" type="submit">Continue to ${provider}</button></form><p class="fine"><a href="${root}">Other ways to sign in</a></p></section>`;
+                return respond(200, layout('Single sign-on', content, null));
+            }
+        }
+        const asked = team !== '' || email !== '';
+        const content = html `<section class="sign-in"><span class="sign-in-mark">${ICONS.mark}</span><h1>Single sign-on</h1>${asked ? html `<p class="notice" role="alert">No team signs in that way. Check the address, or ask your team’s owner.</p>` : html ``}<form method="get" action="${root}/sso"><label for="sso-email">Work email</label><input id="sso-email" name="email" type="email" maxlength="254" autocomplete="email" required><button class="primary wide" type="submit">Continue</button></form><p class="fine"><a href="${root}">Other ways to sign in</a></p></section>`;
+        return respond(asked ? 404 : 200, layout('Single sign-on', content, null));
+    }
+    /** Send an invitation's link where a sender is set: whether it went. The link is shown either way. */
+    async function deliverInvitation(session, to, role, link, expiresAt) {
+        if (!options.invitations)
+            return false;
+        try {
+            await options.invitations.send({
+                to,
+                workspace: currentTeam(session)?.name ?? 'a team',
+                inviter: shownAs(session),
+                role: SLOTLOCK_WORKSPACE_ROLE_NAMES[role],
+                link,
+                expiresAt,
+            });
+            return true;
+        }
+        catch (error) {
+            // The sender's own message names the provider and its status, never the address.
+            const known = error instanceof Error && error.name === 'SlotlockInvitationEmailError';
+            report(`Invitation email failed: ${known ? error.message : error instanceof Error ? error.name : 'unknown error'}`);
+            return false;
+        }
+    }
+    async function inviteMember(session, form) {
+        const tenantRef = teamTenantOf(session);
+        if (!teamStore || tenantRef === undefined)
+            return nothingHere(session);
+        const email = (form.get('email') ?? '').trim().toLowerCase();
+        const role = form.get('role') ?? '';
+        if (email.length > 254 || !EMAIL_ADDRESS.test(email)) {
+            return settingsPage(session, 400, 'Enter an email address.', undefined, 'members');
+        }
+        if (!isSlotlockWorkspaceRole(role))
+            return settingsPage(session, 400, 'Choose a role.', undefined, 'members');
+        const raw = randomBytes(32).toString('base64url');
+        const sent = await teamStore.invite({
+            tenantRef,
+            inviter: personOf(session),
+            to: { email },
+            role,
+            tokenSha256: tokenDigest(raw),
+            days: INVITATION_DAYS,
+            dailyLimit: INVITATION_DAILY_LIMIT,
+            memberCap: await memberCapOf(tenantRef),
+        });
+        if ('refusal' in sent)
+            return refusalPage(session, sent.refusal);
+        await audit(session, { action: 'member.invited', targetType: 'invitation', targetRef: sent.id, metadata: { role } }, tenantRef);
+        const link = `${publicRoot}/invite?t=${raw}`;
+        const expiresAt = new Date(now() + INVITATION_DAYS * DAY_MS);
+        const delivered = await deliverInvitation(session, email, role, link, expiresAt);
+        return settingsPage(session, 200, delivered ? `Invitation sent to ${email}.` : `Invitation made for ${email}. Send them the link.`, undefined, 'members', { link, to: email, expiresAt });
+    }
+    async function resendInvitation(session, form) {
+        const tenantRef = teamTenantOf(session);
+        if (!teamStore || tenantRef === undefined)
+            return nothingHere(session);
+        const id = (form.get('id') ?? '').toLowerCase();
+        const invitation = (await teamStore.invitations(tenantRef)).find((candidate) => candidate.id === id);
+        if (!invitation)
+            return refusalPage(session, 'not_found');
+        const raw = randomBytes(32).toString('base64url');
+        const refusal = await teamStore.resend(tenantRef, personOf(session), id, tokenDigest(raw), INVITATION_DAYS, INVITATION_DAILY_LIMIT, await memberCapOf(tenantRef));
+        if (refusal)
+            return refusalPage(session, refusal);
+        await audit(session, { action: 'invitation.resent', targetType: 'invitation', targetRef: id }, tenantRef);
+        const to = invitation.email ?? `@${invitation.githubLogin ?? 'GitHub account'}`;
+        const link = `${publicRoot}/invite?t=${raw}`;
+        const expiresAt = new Date(now() + INVITATION_DAYS * DAY_MS);
+        const delivered = invitation.email !== null && (await deliverInvitation(session, invitation.email, invitation.role, link, expiresAt));
+        return settingsPage(session, 200, delivered ? `Invitation sent to ${to} again. The old link no longer works.` : `A new link for ${to}. The old one no longer works.`, undefined, 'members', { link, to, expiresAt });
+    }
+    async function revokeInvitation(session, form) {
+        const tenantRef = teamTenantOf(session);
+        if (!teamStore || tenantRef === undefined)
+            return nothingHere(session);
+        const id = (form.get('id') ?? '').toLowerCase();
+        if (!(await teamStore.revoke(tenantRef, personOf(session), id)))
+            return refusalPage(session, 'not_found');
+        await audit(session, { action: 'invitation.revoked', targetType: 'invitation', targetRef: id }, tenantRef);
+        return settingsPage(session, 200, 'Invitation revoked: its link no longer works.', undefined, 'members');
+    }
+    async function changeMemberRole(session, form) {
+        const tenantRef = teamTenantOf(session);
+        if (!teamStore || tenantRef === undefined)
+            return nothingHere(session);
+        const person = form.get('person') ?? '';
+        const role = form.get('role') ?? '';
+        if (!isSlotlockWorkspaceRole(role))
+            return settingsPage(session, 400, 'Choose a role.', undefined, 'members');
+        const members = await teamStore.members(tenantRef);
+        const member = members.find((candidate) => candidate.person === person);
+        if (!member)
+            return refusalPage(session, 'not_found');
+        if (member.role === role)
+            return settingsPage(session, 200, 'Nothing changed.', undefined, 'members');
+        const refusal = await teamStore.changeRole(tenantRef, personOf(session), person, role);
+        if (refusal)
+            return refusalPage(session, refusal);
+        await audit(session, { action: 'member.role_changed', targetType: 'person', targetRef: person, metadata: { from: member.role, to: role } }, tenantRef);
+        // One's own role changed: the page is read again under the new one.
+        if (person === personOf(session))
+            return redirect(303, `${root}/settings/members`);
+        return settingsPage(session, 200, `${memberName(member)} is now ${SLOTLOCK_WORKSPACE_ROLE_NAMES[role]}.`, undefined, 'members');
+    }
+    /** Revoke the keys a member created in a team's Live and Test environments: how many were. */
+    async function revokeKeysOf(tenantRef, person, actor) {
+        let revoked = 0;
+        for (const tenant of [tenantRef, `${tenantRef}${SLOTLOCK_TEST_TENANT_SUFFIX}`]) {
+            for (const key of await options.keys.list({ tenantRef: tenant })) {
+                if (key.createdBy !== person || key.revokedAt !== null)
+                    continue;
+                if (await options.keys.revoke({ tenantRef: tenant, actor, origin: 'dashboard', id: key.id }))
+                    revoked += 1;
+            }
+        }
+        return revoked;
+    }
+    /**
+     * Limit a member to locations and groups (RFC 0004 D1), or give them all of the workspace again.
+     * Keys they created reach all of it, so limiting them revokes those unless the form keeps them.
+     */
+    async function limitMember(session, form) {
+        const tenantRef = teamTenantOf(session);
+        const grouping = options.resources.grouping;
+        if (!teamStore || tenantRef === undefined || !grouping)
+            return nothingHere(session);
+        const me = personOf(session);
+        const person = form.get('person') ?? '';
+        const member = (await teamStore.members(tenantRef)).find((candidate) => candidate.person === person);
+        if (!member)
+            return refusalPage(session, 'not_found');
+        let scope = null;
+        if (form.get('access') !== 'all') {
+            const chosen = { locations: [...new Set(form.getAll('locations'))].sort(), groups: [...new Set(form.getAll('groups'))].sort() };
+            if (chosen.locations.length + chosen.groups.length === 0) {
+                return settingsPage(session, 400, 'Choose at least one location or group, or all of the workspace.', undefined, 'members');
+            }
+            if (chosen.locations.length > SLOTLOCK_MAX_KEY_SCOPE_REFS || chosen.groups.length > SLOTLOCK_MAX_KEY_SCOPE_REFS) {
+                return settingsPage(session, 400, `Choose up to ${String(SLOTLOCK_MAX_KEY_SCOPE_REFS)} locations and ${String(SLOTLOCK_MAX_KEY_SCOPE_REFS)} groups.`, undefined, 'members');
+            }
+            // Each one the workspace has.
+            const [locations, groups] = await Promise.all([grouping.locations(tenantRef), grouping.groups(tenantRef)]);
+            const known = (refs, kept) => refs.every((ref) => kept.some((entry) => entry.ref === ref));
+            if (!isSlotlockResourceScope(chosen) || !known(chosen.locations, locations) || !known(chosen.groups, groups)) {
+                return settingsPage(session, 400, 'Choose locations and groups this workspace has.', undefined, 'members');
+            }
+            scope = chosen;
+        }
+        const refusal = await teamStore.setScope(tenantRef, me, person, scope);
+        if (refusal)
+            return refusalPage(session, refusal);
+        const keep = scope === null || form.get('keys') === 'keep';
+        const revoked = keep ? 0 : await revokeKeysOf(tenantRef, person, me);
+        await audit(session, {
+            action: 'member.scope_changed',
+            targetType: 'person',
+            targetRef: person,
+            metadata: scope
+                ? { locations: scope.locations, groups: scope.groups, keys: keep ? 'kept' : 'revoked', revoked }
+                : { reaches: 'all' },
+        }, tenantRef);
+        const name = memberName(member);
+        const team = currentTeam(session)?.name ?? 'this team';
+        return settingsPage(session, 200, scope
+            ? `${name} now reaches only the resources at those locations and in those groups${revoked > 0 ? `, and ${String(revoked)} key${revoked === 1 ? '' : 's'} they created ${revoked === 1 ? 'was' : 'were'} revoked` : ''}.`
+            : `${name} now reaches all of ${team}.`, undefined, 'members');
+    }
+    async function removeMember(session, form) {
+        const tenantRef = teamTenantOf(session);
+        if (!teamStore || tenantRef === undefined)
+            return nothingHere(session);
+        const me = personOf(session);
+        const person = form.get('person') ?? '';
+        if (person === me)
+            return settingsPage(session, 400, 'To leave this team, use Leave.', undefined, 'members');
+        const member = (await teamStore.members(tenantRef)).find((candidate) => candidate.person === person);
+        if (!member)
+            return refusalPage(session, 'not_found');
+        const refusal = await teamStore.remove(tenantRef, me, person);
+        if (refusal)
+            return refusalPage(session, refusal);
+        // Keys they created, Live and Test: revoked unless the form keeps them.
+        const keep = form.get('keys') === 'keep';
+        const revoked = keep ? 0 : await revokeKeysOf(tenantRef, person, me);
+        await audit(session, { action: 'member.removed', targetType: 'person', targetRef: person, metadata: { keys: keep ? 'kept' : 'revoked', revoked } }, tenantRef);
+        return settingsPage(session, 200, `${memberName(member)} was removed${revoked > 0 ? `, and ${String(revoked)} key${revoked === 1 ? '' : 's'} they created revoked` : ''}.`, undefined, 'members');
+    }
+    async function leaveTeam(session) {
+        const tenantRef = teamTenantOf(session);
+        if (!teamStore || tenantRef === undefined)
+            return nothingHere(session);
+        const me = personOf(session);
+        const refusal = await teamStore.remove(tenantRef, me, me);
+        if (refusal)
+            return refusalPage(session, refusal);
+        await audit(session, { action: 'member.left', targetType: 'person', targetRef: me }, tenantRef);
+        return moveTo(session, undefined, '');
+    }
+    /** The invitation link being opened in this browser: its token, or null. */
+    function inviteTokenOf(request) {
+        const opened = unseal('slotlock-dashboard-invite-v1', readCookies(request).get(INVITE_COOKIE));
+        return opened &&
+            typeof opened.t === 'string' &&
+            INVITE_TOKEN.test(opened.t) &&
+            typeof opened.exp === 'number' &&
+            opened.exp > now()
+            ? opened.t
+            : null;
+    }
+    /** An invitation's own page: what it is for, and joining, in the states it can be in. Never consumes it. */
+    async function invitePage(session, raw, status = 200, notice, checked = false) {
+        const preview = raw && teamStore ? await teamStore.preview(tokenDigest(raw)) : null;
+        const headers = { 'Referrer-Policy': 'no-referrer' };
+        if (!preview) {
+            const content = html `${noticeOf(notice, status)}${pageHead('Invitation')}<p>This invitation link can’t be used here. Open the link you were sent again, in this browser.</p>`;
+            return respond(status === 200 ? 404 : status, layout('Invitation', content, session), headers);
+        }
+        const name = preview.workspaceName;
+        const role = SLOTLOCK_WORKSPACE_ROLE_NAMES[preview.role];
+        const forWhom = preview.email !== null ? maskedEmail(preview.email) : `@${preview.githubLogin ?? 'a GitHub account'}`;
+        let body;
+        if (preview.state !== 'pending') {
+            body = html `<p>${preview.state === 'expired'
+                ? `This invitation expired. Ask ${preview.inviterDisplay} to send it again.`
+                : preview.state === 'revoked'
+                    ? 'This invitation was withdrawn.'
+                    : 'This invitation was already used.'}</p>`;
+        }
+        else if (!session) {
+            const then = new URLSearchParams({ then: '/invite' }).toString();
+            // An invitation by email asks GitHub for the person's verified addresses on the way in.
+            const github = preview.email !== null ? `${then}&email=1` : then;
+            body = html `<p>${preview.inviterDisplay} invited ${forWhom} as ${role}.</p><p class="actions"><a class="button primary" href="${root}/sign-in?${github}">${ICONS.github}Continue with GitHub</a>${google && preview.email !== null
+                ? html ` <a class="button" href="${root}/sign-in?with=google&amp;${then}">${ICONS.google}Continue with Google</a>`
+                : html ``}</p>`;
+        }
+        else if ((teamListOf.get(session) ?? []).some((ws) => ws.tenantRef === preview.tenantRef)) {
+            body = html `<p>You’re already a member of ${name}.</p><form method="post" action="${root}/organization"><input type="hidden" name="csrf" value="${csrfToken(session)}"><input type="hidden" name="once" value="${formNonce(session)}"><input type="hidden" name="organization" value="${preview.tenantRef}"><button class="primary" type="submit">Open ${name}</button></form>`;
+        }
+        else {
+            const person = personOf(session);
+            const bound = (preview.githubRef !== null && preview.githubRef === person) ||
+                (preview.email !== null && verifiedEmails(session).includes(preview.email));
+            if (bound) {
+                body = html `<p>${preview.inviterDisplay} invited you as ${role}.</p><form method="post" action="${root}/invite/accept"><input type="hidden" name="csrf" value="${csrfToken(session)}"><input type="hidden" name="once" value="${formNonce(session)}"><button class="primary" type="submit">Join as ${shownAs(session)}</button></form>`;
+            }
+            else if (preview.email !== null && session.idp !== 'google') {
+                // A GitHub account shows its addresses only when asked: once, for this invitation.
+                body = html `<p>${preview.inviterDisplay} invited ${forWhom} as ${role}.${checked ? html ` None of the addresses GitHub verified for ${shownAs(session)} is it.` : html ``}</p><p class="actions"><a class="button primary" href="${root}/sign-in?then=%2Finvite&amp;email=1">${ICONS.github}Confirm the address with GitHub</a></p>`;
+            }
+            else {
+                body = html `<p>This invitation is for ${forWhom}, and you’re signed in as ${shownAs(session)}. Sign out, then open the link again and sign in as that account.</p>`;
+            }
+        }
+        const content = html `${noticeOf(notice, status)}${pageHead(`Join ${name}`)}${body}`;
+        return respond(status, layout(`Join ${name}`, content, session), headers);
+    }
+    async function acceptInvitation(session, form, request) {
+        if (!teamStore)
+            return nothingHere(session);
+        const person = personOf(session);
+        const emails = verifiedEmails(session);
+        const id = (form.get('invitation') ?? '').toLowerCase();
+        let accepted;
+        let role;
+        let raw = null;
+        if (id !== '') {
+            // One offered on Teams: an invitation open to this person, found again here.
+            const offered = (await teamStore.pendingFor(person, emails)).find((invitation) => invitation.id === id);
+            if (!offered)
+                return teamsPage(session, 404, 'That invitation is no longer open to you.');
+            role = offered.role;
+            accepted = await teamStore.accept({ id: offered.id, person, emails, memberCap: await memberCapOf(offered.tenantRef) });
+        }
+        else {
+            raw = inviteTokenOf(request);
+            const preview = raw ? await teamStore.preview(tokenDigest(raw)) : null;
+            if (!raw || !preview)
+                return invitePage(session, null, 400);
+            role = preview.role;
+            accepted = await teamStore.accept({ tokenSha256: tokenDigest(raw), person, emails, memberCap: await memberCapOf(preview.tenantRef) });
+        }
+        if ('refusal' in accepted) {
+            const { status, text } = TEAM_REFUSALS[accepted.refusal];
+            return id !== '' ? teamsPage(session, status, text) : invitePage(session, raw, status, text);
+        }
+        await audit(session, { action: 'member.joined', actorRole: role, targetType: 'person', targetRef: person }, accepted.tenantRef);
+        // Into the team joined; the link is spent, and the addresses kept for it go.
+        return moveTo(session, accepted.tenantRef.slice('team:'.length), '', [setCookie(INVITE_COOKIE, '', 0)], false);
     }
     async function changeTeam(session, form, on) {
         if (!teams)
@@ -4369,6 +6878,10 @@ ${rows.length === 0
             return teamsPage(session, 400, 'That is not one of your organizations.');
         if (org.role !== 'admin')
             return teamsPage(session, 403, `Only an owner of ${org.login} can turn Slotlock ${on ? 'on' : 'off'} for it.`);
+        // And an Owner of its workspace in Slotlock: a GitHub owner Slotlock gave a lesser role may not.
+        if (workspaces && (await workspaces.standing(`github-org:${org.id}`, personOf(session), session.sid)).role !== 'owner') {
+            return teamsPage(session, 403, `Only an owner of ${org.login}'s workspace can turn Slotlock ${on ? 'on' : 'off'} for it.`);
+        }
         // Who owns it was read as the person signed in: only a recent sign-in is trusted to say so.
         if (now() - (session.exp - SESSION_TTL_MS) > FRESH_SIGN_IN_MS) {
             return teamsPage(session, 403, `To turn Slotlock ${on ? 'on' : 'off'} for ${org.login}, sign out and in again: who owns it is read from GitHub as you sign in.`);
@@ -4384,13 +6897,28 @@ ${rows.length === 0
     }
     async function switchOrganization(session, form) {
         const wanted = form.get('organization') ?? '';
+        const teamId = /^team:(.+)$/.exec(wanted)?.[1];
+        if (teamStore && (teamId !== undefined || (wanted === '' && !teams))) {
+            // Their own tenant, or a team workspace they are a member of now.
+            if (teamId !== undefined) {
+                const standing = TEAM_ID.test(teamId) && workspaces ? await workspaces.standing(wanted, personOf(session), session.sid) : null;
+                if (standing?.refusal === 'sso_required') {
+                    const name = teamListOf.get(session)?.find((ws) => ws.tenantRef === wanted)?.name ?? 'This team';
+                    return ssoRequiredPage(session, wanted, name, standing.mayBypass === true);
+                }
+                if (!standing || standing.role === null) {
+                    return respond(400, layout('Refused', html `<p class="notice">You are not a member of that team.</p>`, session));
+                }
+            }
+            return moveTo(session, teamId, '');
+        }
         if (teams) {
             // Their own tenant, or an organization of theirs that is turned on now.
             const org = session.orgs?.find((candidate) => candidate.id === wanted);
             if (wanted !== '' && (!org || !(await teams.enabled([wanted])).has(wanted))) {
                 return respond(400, layout('Refused', html `<p class="notice">You cannot act for that organization. An owner turns it on from Teams.</p>`, session));
             }
-            const { org: _, ...personal } = session;
+            const { org: _, team: _team, ...personal } = session;
             const sealed = seal('slotlock-dashboard-session-v1', wanted === '' ? personal : { ...personal, org: wanted });
             const left = Math.max(1, Math.floor((session.exp - now()) / 1000));
             return redirect(303, root, [setCookie(SESSION_COOKIE, sealed, left)]);
@@ -4403,7 +6931,7 @@ ${rows.length === 0
         const left = Math.max(1, Math.floor((session.exp - now()) / 1000));
         return redirect(303, root, [setCookie(SESSION_COOKIE, sealed, left)]);
     }
-    async function startSignIn() {
+    async function startSignIn(then, emails = false) {
         const state = randomBytes(32).toString('base64url');
         const verifier = randomBytes(32).toString('base64url');
         const challenge = createHash('sha256').update(verifier).digest('base64url');
@@ -4415,12 +6943,17 @@ ${rows.length === 0
             code_challenge: challenge,
             code_challenge_method: 'S256',
             // Reading organization membership needs read:org; a personal tenant needs no scope at all.
-            ...(readsOrganizations ? { scope: 'read:org' } : {}),
+            // Accepting an invitation by email asks GitHub for the person's verified addresses, then only.
+            ...(readsOrganizations || emails
+                ? { scope: [...(readsOrganizations ? ['read:org'] : []), ...(emails ? ['user:email'] : [])].join(' ') }
+                : {}),
         }).toString();
         const sealed = seal('slotlock-dashboard-sign-in-v1', {
             state,
             verifier,
             exp: now() + SIGN_IN_TTL_MS,
+            ...(then ? { then } : {}),
+            ...(emails ? { emails: true } : {}),
         });
         return redirect(302, target.href, [setCookie(SIGN_IN_COOKIE, sealed, SIGN_IN_TTL_MS / 1000)]);
     }
@@ -4482,6 +7015,30 @@ ${rows.length === 0
         }
         return { uid: String(body.id), login: body.login };
     }
+    /** The addresses GitHub verified for the token's person, lower-cased; none when it does not say. */
+    async function readGitHubEmails(token) {
+        const response = await fetchImpl(`${userUrl}/emails`, {
+            headers: {
+                Authorization: `Bearer ${token}`,
+                Accept: 'application/vnd.github+json',
+                'X-GitHub-Api-Version': GITHUB_API_VERSION,
+                'User-Agent': USER_AGENT,
+            },
+            redirect: 'manual',
+            signal: AbortSignal.timeout(GITHUB_TIMEOUT_MS),
+        });
+        if (!response.ok) {
+            report(`GitHub email lookup failed: HTTP ${response.status}`);
+            return [];
+        }
+        const body = await response.json().catch(() => null);
+        if (!Array.isArray(body))
+            return [];
+        return body
+            .slice(0, 100)
+            .filter((entry) => isRecord(entry) && entry.verified === true && typeof entry.email === 'string' && entry.email.length <= 254)
+            .map((entry) => entry.email.toLowerCase());
+    }
     /**
      * The served organizations the token's person is an active member of, by login, or null when
      * GitHub does not answer. Only `state: active` counts; at most MAX_SESSION_ORGANIZATIONS.
@@ -4530,7 +7087,7 @@ ${rows.length === 0
             .slice(0, MAX_SESSION_ORGANIZATIONS);
     }
     /** Google's sign-in (OpenID Connect, code flow with PKCE and a nonce), back to the same callback. */
-    async function startGoogleSignIn(provider) {
+    async function startGoogleSignIn(provider, then) {
         const state = randomBytes(32).toString('base64url');
         const verifier = randomBytes(32).toString('base64url');
         const nonce = randomBytes(24).toString('base64url');
@@ -4551,54 +7108,12 @@ ${rows.length === 0
             nonce,
             idp: 'google',
             exp: now() + SIGN_IN_TTL_MS,
+            ...(then ? { then } : {}),
         });
         return redirect(302, target.href, [setCookie(SIGN_IN_COOKIE, sealed, SIGN_IN_TTL_MS / 1000)]);
     }
-    /** Google's signing keys by key id, kept for as long as its answer says (an hour by default). */
-    let googleKeys = null;
-    async function readGoogleKeys(provider, refresh) {
-        if (googleKeys && !refresh && googleKeys.until > now())
-            return googleKeys.keys;
-        const response = await fetchImpl(provider.jwksUrl ?? 'https://www.googleapis.com/oauth2/v3/certs', {
-            headers: { Accept: 'application/json' },
-            redirect: 'manual',
-            signal: AbortSignal.timeout(GITHUB_TIMEOUT_MS),
-        });
-        if (!response.ok)
-            throw new Error(`Google keys answered HTTP ${response.status}`);
-        const body = await response.json();
-        const keys = new Map();
-        for (const jwk of isRecord(body) && Array.isArray(body.keys) ? body.keys : []) {
-            if (!isRecord(jwk) || jwk.kty !== 'RSA' || typeof jwk.kid !== 'string' || (jwk.alg !== undefined && jwk.alg !== 'RS256'))
-                continue;
-            const key = await globalThis.crypto.subtle
-                .importKey('jwk', { kty: 'RSA', n: jwk.n, e: jwk.e, alg: 'RS256', ext: true }, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, false, ['verify'])
-                .catch(() => null);
-            if (key)
-                keys.set(jwk.kid, key);
-        }
-        const maxAge = Number(/max-age=(\d+)/.exec(response.headers.get('cache-control') ?? '')?.[1]);
-        googleKeys = { keys, until: now() + (Number.isFinite(maxAge) && maxAge > 0 ? Math.min(maxAge * 1000, 86_400_000) : GOOGLE_KEYS_DEFAULT_TTL_MS) };
-        return keys;
-    }
-    /** Whether an ID token's signature is Google's: RS256, by a key id Google publishes (read again once when unknown, as Google rotates them). */
-    async function googleSigned(provider, header, payload, signature) {
-        let parsed;
-        try {
-            parsed = JSON.parse(Buffer.from(header, 'base64url').toString('utf8'));
-        }
-        catch {
-            return false;
-        }
-        if (!isRecord(parsed) || parsed.alg !== 'RS256' || typeof parsed.kid !== 'string')
-            return false;
-        let key = (await readGoogleKeys(provider, false)).get(parsed.kid);
-        if (!key)
-            key = (await readGoogleKeys(provider, true)).get(parsed.kid);
-        if (!key)
-            return false;
-        return globalThis.crypto.subtle.verify('RSASSA-PKCS1-v1_5', key, Buffer.from(signature, 'base64url'), Buffer.from(`${header}.${payload}`, 'ascii'));
-    }
+    /** Issuers' signing keys (Google's, and teams' identity providers'), by JWKS URL (oidc.ts). */
+    const jwks = createSlotlockJwksCache({ fetch: fetchImpl, now });
     /**
      * The person Google signed in, from the ID token its token endpoint returned for this code. The
      * token's signature is checked against Google's published keys, and its issuer, audience (and
@@ -4626,48 +7141,45 @@ ${rows.length === 0
             }
             const body = await response.json().catch(() => null);
             const token = isRecord(body) && typeof body.id_token === 'string' ? body.id_token : null;
-            const [header, payload, signature, ...extra] = token?.split('.') ?? [];
-            if (!header || !payload || !signature || extra.length > 0 || ![header, payload, signature].every((part) => BASE64URL.test(part))) {
+            if (token === null)
                 return null;
-            }
-            // Signed by Google, with one of the keys it publishes (RS256), whichever way the token came.
-            if (!(await googleSigned(provider, header, payload, signature))) {
-                report('Google sign-in refused: the ID token is not signed by Google');
+            // Signed by Google with a key it publishes (RS256), for this client, unexpired, with this
+            // sign-in's nonce (oidc.ts verifySlotlockIdToken: OpenID Connect Core 1.0, 3.1.3.7).
+            const checked = await verifySlotlockIdToken(token, {
+                issuers: SLOTLOCK_GOOGLE_ISSUERS,
+                clientId: provider.clientId,
+                algorithms: ['RS256'],
+                keys: jwks.lookup(provider.jwksUrl ?? 'https://www.googleapis.com/oauth2/v3/certs'),
+                nonce,
+                now: now(),
+            });
+            if ('refusal' in checked) {
+                report(`Google sign-in refused: the ID token did not check out (${checked.refusal})`);
                 return null;
             }
-            const claims = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
-            if (!isRecord(claims))
-                return null;
-            const audience = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
-            if ((claims.iss !== 'https://accounts.google.com' && claims.iss !== 'accounts.google.com') ||
-                !audience.includes(provider.clientId) ||
-                (audience.length > 1 && claims.azp !== provider.clientId) ||
-                typeof claims.exp !== 'number' ||
-                claims.exp * 1000 <= now() ||
-                typeof claims.nonce !== 'string' ||
-                !safeEqual(claims.nonce, nonce) ||
-                typeof claims.sub !== 'string' ||
-                !GOOGLE_SUBJECT.test(claims.sub)) {
-                report('Google sign-in refused: the ID token did not check out');
+            const claims = checked.claims;
+            if (typeof claims.sub !== 'string' || !GOOGLE_SUBJECT.test(claims.sub))
                 return null;
-            }
             // The email names the person on the page only, and only once Google has verified it.
-            const email = claims.email_verified === true && typeof claims.email === 'string' && claims.email.length <= 254 && !/[<>\p{Cc}]/u.test(claims.email)
+            const email = (claims.email_verified === true || claims.email_verified === 'true') && typeof claims.email === 'string' && claims.email.length <= 254 && !/[<>\p{Cc}]/u.test(claims.email)
                 ? claims.email
                 : 'Google account';
-            return { uid: claims.sub, login: email, idp: 'google' };
+            // A Google Workspace account names its domain (hd); a consumer account names none.
+            const hd = typeof claims.hd === 'string' && /^[a-z0-9.-]{1,253}$/i.test(claims.hd) ? claims.hd.toLowerCase() : undefined;
+            return { uid: claims.sub, login: email, idp: 'google', ...(hd !== undefined && email.includes('@') ? { hd } : {}) };
         }
         catch (error) {
             report(`Google sign-in failed: ${error instanceof Error ? error.name : 'unknown error'}`);
             return null;
         }
     }
-    async function askGitHub(code, verifier) {
+    async function askGitHub(code, verifier, emails = false) {
         try {
             const token = await exchangeCode(code, verifier);
             if (token === null)
                 return null;
-            const user = await readGitHubUser(token);
+            const found = await readGitHubUser(token);
+            const user = found && emails ? { ...found, emails: await readGitHubEmails(token) } : found;
             if (!user || !readsOrganizations)
                 return user;
             const orgs = await readMemberships(token);
@@ -4715,7 +7227,7 @@ ${rows.length === 0
                     ? google && typeof pending.nonce === 'string'
                         ? await askGoogle(google, code, verifier, pending.nonce)
                         : null
-                    : await askGitHub(code, verifier);
+                    : await askGitHub(code, verifier, pending.emails === true);
         }
         finally {
             signInsInFlight -= 1;
@@ -4737,15 +7249,64 @@ ${rows.length === 0
         if (served && orgs.length === 0) {
             return signedOutPage(403, `@${user.login} is not a member of an organization this Slotlock server serves.`, [clearSignIn]);
         }
+        // The person and, with GitHub, the organizations GitHub lists them in, as memberships now; the
+        // epoch their sessions must carry.
+        const person = user.idp === 'google' ? `google:${user.uid}` : `github:${user.uid}`;
+        const epoch = workspaces
+            ? await workspaces.signedIn(person, user.idp === 'google' || user.orgs === undefined
+                ? undefined
+                : user.orgs.map((org) => ({ id: org.id, role: org.role === 'admin' ? 'admin' : 'member' })))
+            : undefined;
+        // How the person is shown to the others in their teams: their GitHub login, or Google's verified email.
+        if (teamStore) {
+            await teamStore.setDisplay(person, user.idp === 'google' ? (user.login.includes('@') ? user.login : null) : `@${user.login}`);
+        }
+        // Of the addresses GitHub verified, only the invitation being opened's is kept, to accept it.
+        let em;
+        if (teamStore && user.emails) {
+            const raw = inviteTokenOf(request);
+            const invited = raw ? (await teamStore.preview(tokenDigest(raw)))?.email : null;
+            if (invited && user.emails.includes(invited))
+                em = [invited];
+            else if (domainStore && pending.then === '/teams' && pending.emails === true) {
+                // Looking for a team at one's domain: only the addresses at a team one may ask to join.
+                const keys = new Set((await domainStore.discoverable(person, user.emails)).map((found) => found.domainKey));
+                const kept = user.emails.filter((email) => keys.has(slotlockEmailDomain(email) ?? '')).slice(0, 3);
+                if (kept.length > 0)
+                    em = kept;
+            }
+        }
+        // A Google Workspace account of its own domain binds the directory's user at that address (SCIM):
+        // the domain vouches for it. An address GitHub or a consumer Google account verified once does not.
+        if (scimStore && user.idp === 'google' && user.hd !== undefined && user.login.includes('@')) {
+            const address = user.login.toLowerCase();
+            if (slotlockEmailDomain(address) === slotlockEmailDomain(`x@${user.hd}`))
+                await scimStore.bind(person, [address], plans ? FREE_TEAM_MEMBERS : null);
+        }
+        const sealedOrg = served ? orgs[0].id : undefined;
+        const sid = randomBytes(24).toString('base64url');
+        const expires = now() + SESSION_TTL_MS;
+        // Listed on the person's Account page, to sign out from another device.
+        await workspaces?.sessions?.started(person, sid, new Date(expires), requestOrigin(request));
         const session = seal('slotlock-dashboard-session-v1', {
             uid: user.uid,
             login: user.login,
-            sid: randomBytes(24).toString('base64url'),
-            exp: now() + SESSION_TTL_MS,
-            ...(user.idp === 'google' ? { idp: 'google' } : {}),
-            ...(served ? { orgs, org: orgs[0].id } : teams && user.idp !== 'google' ? { orgs } : {}),
+            sid,
+            exp: expires,
+            ...(user.idp === 'google' ? { idp: 'google', ...(user.hd !== undefined ? { hd: user.hd } : {}) } : {}),
+            ...(served ? { orgs, org: sealedOrg } : teams && user.idp !== 'google' ? { orgs } : {}),
+            ...(epoch !== undefined ? { ep: epoch } : {}),
+            ...(em ? { em } : {}),
         });
-        return redirect(303, root, [
+        if (options.resources.audit) {
+            const signedInTo = sealedOrg !== undefined ? `github-org:${sealedOrg}` : person;
+            const from = requestOrigin(request);
+            await options.resources.audit
+                .record(signedInTo, { action: 'session.signed_in', actorType: 'person', actorRef: person, ...from })
+                .catch((error) => ignoreRejection(options.onError?.(error)));
+        }
+        const back = typeof pending.then === 'string' && STEP_UP_PAGES.has(pending.then) ? pending.then : '';
+        return redirect(303, `${root}${back}${(back === '/invite' || back === '/teams') && pending.emails === true ? '?checked=1' : ''}`, [
             clearSignIn,
             setCookie(SESSION_COOKIE, session, SESSION_TTL_MS / 1000),
         ]);
@@ -4844,7 +7405,7 @@ ${rows.length === 0
             }
             if (code === 'api_key_limit_reached') {
                 return keysPage(session, 409, plans
-                    ? 'You have as many active keys as your plan allows. Revoke one first, or see Usage.'
+                    ? html `You have as many active keys as your plan allows. Revoke one first, or ${await pastLimit(session)}.`
                     : 'You have as many keys as Slotlock allows. Revoke one first.');
             }
             throw error;
@@ -4919,7 +7480,7 @@ ${rows.length === 0
             if (code === 'resource_limit_reached') {
                 const limit = error.limit;
                 return resourcesPage(session, 409, typeof limit === 'number' && limit < SLOTLOCK_DASHBOARD_MAX_RESOURCES
-                    ? `You have ${String(limit)} resources, archived ones included, as many as your plan allows. Delete one, or see Usage.`
+                    ? html `You have ${String(limit)} resources, archived ones included, as many as your plan allows. Delete one, or ${await pastLimit(session)}.`
                     : `You have ${SLOTLOCK_DASHBOARD_MAX_RESOURCES} resources, as many as the dashboard allows.`);
             }
             if (code === 'invalid_timezone') {
@@ -4937,6 +7498,13 @@ ${rows.length === 0
         if (request.headers.get('origin') !== origin) {
             return respond(403, layout('Refused', html `<p class="notice">That request did not come from this dashboard.</p>`, null));
         }
+        // Single sign-on continues to the team's provider from its own page, with or without a session.
+        if (route === '/sso/start' && ssoStore) {
+            const form = await readForm(request);
+            const handle = form === null || form === 'too_large' ? '' : (form.get('team') ?? '');
+            const found = /^[a-z0-9]([a-z0-9-]{0,37}[a-z0-9])?$/.test(handle) ? await ssoStore.route({ handle }) : null;
+            return found ? startSsoSignIn(found, 'signin') : ssoStartPage(new URL(`${publicRoot}/sso?team=${encodeURIComponent(handle)}`));
+        }
         const session = await readSession(request);
         if (!session)
             return redirect(303, root);
@@ -4960,6 +7528,7 @@ ${rows.length === 0
         if (!POST_ROUTES.has(route)) {
             return respond(404, layout('Not found', html `<p class="notice">Nothing is here.</p>`, session));
         }
+        origins.set(session, requestOrigin(request));
         // A form sent again (a reload of its result, a double click) must not create or rotate twice.
         // Every form but sign-out carries a single-use value, so leaving it out cannot skip this check
         // or the per-person form limit.
@@ -4970,7 +7539,7 @@ ${rows.length === 0
         if (once !== null) {
             const checked = checkFormNonce(session, once);
             if (checked === 'other_org') {
-                return pageFor(route)(session, 409, 'That page was for another organization. Nothing was changed: check the organization and try again.');
+                return pageOrNotice(route)(session, 409, 'That page was for another workspace. Nothing was changed: check the workspace and try again.');
             }
             let first;
             try {
@@ -4981,7 +7550,7 @@ ${rows.length === 0
             catch (error) {
                 if (error.code !== 'dashboard_form_limit')
                     throw error;
-                return pageFor(route)(session, 429, 'Too many forms sent from this account in the last 12 hours. Try again later.');
+                return pageOrNotice(route)(session, 429, 'Too many forms sent from this account in the last 12 hours. Try again later.');
             }
             if (!first) {
                 // The first one was taken: a second click, a reload or a resend shows what it did.
@@ -4989,17 +7558,41 @@ ${rows.length === 0
                     const chat = chatOf(form.get('chat'));
                     return redirect(303, chat ? `${chatUrl(chat)}#latest` : `${root}/assistant#latest`);
                 }
-                return pageFor(route)(session, 409, 'That form was already sent. Reload the page to start again.');
+                return pageOrNotice(route)(session, 409, 'That form was already sent. Reload the page to start again.');
             }
         }
+        // What the person may do, from their role now: before anything changes, and after the form's
+        // single-use value and the per-person form limit, so refusals cannot flood the audit log.
+        const refused = await authorizePost(session, route, form);
+        if (refused)
+            return refused;
         // A tenant new to plans is put on the default plan before it adds what plans limit.
         if (route === '/keys' || route === '/resources' || route === '/webhooks') {
             await plans?.enrol?.(tenantOf(session));
         }
+        const response = await dispatchPost(session, route, form, request);
+        const action = AUDITED_ROUTES[route];
+        if (action && response.status < 400)
+            await audit(session, { action, ...auditDetails(route, form) });
+        return response;
+    }
+    async function dispatchPost(session, route, form, request) {
         switch (route) {
+            case '/sign-out-everywhere':
+                // Every session of the person, on every device and server, this one included: only with
+                // the membership store, which holds the epoch every session carries.
+                if (!workspaces)
+                    return notFound(session);
+                await workspaces.signOutEverywhere(personOf(session));
+                await workspaces.sessions?.end(personOf(session), null);
+                await options.state.endSession(session.sid, session.exp);
+                return redirect(303, root, [setCookie(SESSION_COOKIE, '', 0)]);
             case '/sign-out':
                 await options.state.endSession(session.sid, session.exp);
+                await workspaces?.sessions?.end(personOf(session), workspaces.sessions.idOf(session.sid));
                 return redirect(303, root, [setCookie(SESSION_COOKIE, '', 0)]);
+            case '/sessions/end':
+                return endSession(session, form);
             case '/keys':
                 return createKey(session, form);
             case '/keys/rotate':
@@ -5022,6 +7615,16 @@ ${rows.length === 0
                 return deleteHolidayCalendar(session, form);
             case '/contacts/forget':
                 return forgetContact(session, form);
+            case '/settings/privacy/export':
+                return askPrivacyExport(session);
+            case '/settings/privacy/export/delete':
+                return deletePrivacyExport(session, form);
+            case '/settings/privacy/person':
+                return findPerson(session, form);
+            case '/settings/privacy/person/export':
+                return exportPerson(session, form);
+            case '/settings/privacy/person/erase':
+                return erasePerson(session, form);
             case '/organization':
                 return switchOrganization(session, form);
             case '/environment':
@@ -5090,6 +7693,70 @@ ${rows.length === 0
                 return changeTeam(session, form, true);
             case '/teams/disable':
                 return changeTeam(session, form, false);
+            case '/teams/create':
+                return createTeam(session, form);
+            case '/teams/delete':
+                return deleteTeam(session, form);
+            case '/teams/restore':
+                return restoreTeam(session);
+            case '/invite/accept':
+                return acceptInvitation(session, form, request);
+            case '/members/invite':
+                return inviteMember(session, form);
+            case '/members/resend':
+                return resendInvitation(session, form);
+            case '/members/revoke':
+                return revokeInvitation(session, form);
+            case '/members/role':
+                return changeMemberRole(session, form);
+            case '/members/scope':
+                return limitMember(session, form);
+            case '/members/remove':
+                return removeMember(session, form);
+            case '/members/leave':
+                return leaveTeam(session);
+            case '/members/requests':
+                return decideJoinRequest(session, form);
+            case '/join/request':
+                return requestToJoin(session, form);
+            case '/identity/domains':
+                return claimDomain(session, form);
+            case '/identity/domains/verify':
+                return verifyDomain(session, form);
+            case '/identity/domains/remove':
+                return releaseDomain(session, form);
+            case '/identity/domains/policy':
+                return changeJoinPolicy(session, form);
+            case '/identity/invites':
+                return restrictInvites(session, form);
+            case '/identity/sso':
+                return saveSsoConnection(session, form);
+            case '/identity/sso/test':
+                return testSsoConnection(session);
+            case '/identity/sso/status':
+                return setSsoStatus(session, form);
+            case '/identity/sso/delete':
+                return deleteSsoConnection(session, form);
+            case '/identity/sso/provisioning':
+                return setSsoProvisioning(session, form);
+            case '/identity/sso/mapping':
+                return setSsoMapping(session, form);
+            case '/identity/sso/require':
+                return setRequireSso(session, form);
+            case '/sso/proof':
+                return startSsoProof(session, form);
+            case '/sso/bypass':
+                return useSsoBypass(session, form);
+            case '/identity/scim/enable':
+                return enableScim(session, form);
+            case '/identity/scim/disable':
+                return disableScim(session);
+            case '/identity/scim/token':
+                return createScimToken(session);
+            case '/identity/scim/token/revoke':
+                return revokeScimToken(session, form);
+            case '/identity/scim/group':
+                return mapScimGroup(session, form);
             default:
                 return respond(404, layout('Not found', html `<p class="notice">Nothing is here.</p>`, session));
         }
@@ -5099,126 +7766,220 @@ ${rows.length === 0
             const { pathname } = new URL(request.url);
             return pathname === root || pathname.startsWith(`${root}/`);
         },
-        async fetch(request) {
-            const url = new URL(request.url);
-            const route = url.pathname.slice(root.length).replace(/\/$/, '') || '/';
-            try {
-                if (request.method === 'GET') {
-                    switch (route) {
-                        case '/': {
-                            const session = await readSession(request);
-                            return session ? await overviewPage(session) : signedOutPage(200);
+        // Each request with its own scope (dashboard-scope.ts), set once the person's standing is read.
+        fetch: (request) => runSlotlockDashboardRequest(() => serve(request)),
+    };
+    async function serve(request) {
+        const url = new URL(request.url);
+        const route = url.pathname.slice(root.length).replace(/\/$/, '') || '/';
+        try {
+            // A team's SCIM endpoint: its identity provider's, by bearer token, never a session or a form.
+            if (scimStore && route.startsWith('/scim/v2/')) {
+                const log = options.resources.audit;
+                return await handleSlotlockScimRequest(request, route.slice('/scim/v2/'.length), {
+                    scim: scimStore,
+                    publicRoot,
+                    documentationUri: 'https://slotlock.pylota.io/docs/dashboard/#scim',
+                    ...(log ? { record: (tenantRef, event) => log.record(tenantRef, event) } : {}),
+                    // Their keys go as the team chose when it turned SCIM on.
+                    deactivated: (tenantRef, person, keyPolicy) => (keyPolicy === 'revoke' ? revokeKeysOf(tenantRef, person, 'scim') : Promise.resolve(0)),
+                });
+            }
+            if (request.method === 'GET') {
+                switch (route) {
+                    case '/': {
+                        const session = await readSession(request);
+                        if (!session)
+                            return signedOutPage(200);
+                        return authorizePage(session, '/') ?? (await overviewPage(session));
+                    }
+                    case '/keys':
+                    case '/resources':
+                    case '/webhooks':
+                    case '/waitlist':
+                    case '/approvals':
+                    case '/assistant':
+                    case '/assistant/chats':
+                    case '/plan':
+                    case '/teams':
+                    case '/settings/endpoints':
+                    case '/settings/hours':
+                    case '/settings/account':
+                    case '/settings/members':
+                    case '/settings/audit':
+                    case '/settings/audit/export':
+                    case '/settings/team':
+                    case '/settings/privacy':
+                    case '/settings/privacy/download':
+                    case '/settings/identity':
+                    case '/settings': {
+                        const session = await readSession(request);
+                        if (!session)
+                            return redirect(303, root);
+                        const denied = authorizePage(session, route);
+                        if (denied)
+                            return denied;
+                        if (route === '/teams')
+                            return await teamsPage(session, 200, undefined, url.searchParams.get('checked') === '1');
+                        if (route === '/plan') {
+                            return await planPage(session, 200, url.searchParams.get('checkout') === 'done'
+                                ? 'Thank you. Your plan changes here once Stripe confirms the payment, usually within a minute.'
+                                : undefined, url.searchParams.get('checkout') === 'done');
                         }
-                        case '/keys':
-                        case '/resources':
-                        case '/webhooks':
-                        case '/waitlist':
-                        case '/approvals':
-                        case '/assistant':
-                        case '/assistant/chats':
-                        case '/plan':
-                        case '/teams':
-                        case '/settings/endpoints':
-                        case '/settings/hours':
-                        case '/settings/account':
-                        case '/settings': {
-                            const session = await readSession(request);
-                            if (!session)
-                                return redirect(303, root);
-                            if (route === '/teams')
-                                return await teamsPage(session);
-                            if (route === '/plan') {
-                                return await planPage(session, 200, url.searchParams.get('checkout') === 'done'
-                                    ? 'Thank you. Your plan changes here once Stripe confirms the payment, usually within a minute.'
-                                    : undefined, url.searchParams.get('checkout') === 'done');
-                            }
-                            if (route === '/keys')
-                                return await keysPage(session);
-                            if (route === '/resources') {
-                                return await resourcesPage(session, 200, undefined, url.searchParams.get('hours') === 'own');
-                            }
-                            if (route === '/webhooks')
-                                return await webhooksPage(session);
-                            if (route === '/waitlist')
-                                return await waitlistPage(session);
-                            if (route === '/approvals')
-                                return await approvalsPage(session);
-                            if (route === '/assistant')
-                                return await assistantPage(session, 200, undefined, url.searchParams.get('c') ?? undefined);
-                            if (route === '/assistant/chats')
-                                return await chatsPage(session);
-                            if (route === '/settings/endpoints')
-                                return await settingsPage(session, 200, undefined, undefined, 'endpoints');
-                            if (route === '/settings/hours')
-                                return await settingsPage(session, 200, undefined, undefined, 'hours');
-                            if (route === '/settings/account')
-                                return await settingsPage(session, 200, undefined, undefined, 'account');
-                            // A provider preset fills the assistant's form; nothing is saved until Save.
-                            const preset = SLOTLOCK_ASSISTANT_PRESETS.find((candidate) => candidate.id === url.searchParams.get('preset'));
-                            return await settingsPage(session, 200, undefined, preset ? { provider: preset.provider, baseUrl: preset.baseUrl } : undefined);
+                        if (route === '/keys')
+                            return await keysPage(session);
+                        if (route === '/resources') {
+                            return await resourcesPage(session, 200, undefined, url.searchParams.get('hours') === 'own');
                         }
-                        case '/style.css':
-                            return asset(DASHBOARD_ASSETS.css, 'text/css; charset=utf-8', url, ASSET_VERSIONS.css);
-                        case '/app.js':
-                            return asset(DASHBOARD_ASSETS.js, 'text/javascript; charset=utf-8', url, ASSET_VERSIONS.js);
-                        case '/favicon.svg':
-                            return asset(SLOTLOCK_DASHBOARD_ICON_SVG, 'image/svg+xml', url, ASSET_VERSIONS.icon);
-                        case '/sign-in':
-                            return google && url.searchParams.get('with') === 'google'
-                                ? await startGoogleSignIn(google)
-                                : await startSignIn();
-                        case '/callback':
-                            return await finishSignIn(request, url);
-                        case '/hours': {
-                            const session = await readSession(request);
-                            return session ? await hoursEditor(session, url) : redirect(303, root);
+                        if (route === '/webhooks')
+                            return await webhooksPage(session);
+                        if (route === '/waitlist')
+                            return await waitlistPage(session);
+                        if (route === '/approvals')
+                            return await approvalsPage(session);
+                        if (route === '/assistant')
+                            return await assistantPage(session, 200, undefined, url.searchParams.get('c') ?? undefined);
+                        if (route === '/assistant/chats')
+                            return await chatsPage(session);
+                        if (route === '/settings/endpoints')
+                            return await settingsPage(session, 200, undefined, undefined, 'endpoints');
+                        if (route === '/settings/hours')
+                            return await settingsPage(session, 200, undefined, undefined, 'hours');
+                        if (route === '/settings/account')
+                            return await settingsPage(session, 200, undefined, undefined, 'account');
+                        if (route === '/settings/members') {
+                            return teamStore && session.team !== undefined
+                                ? await settingsPage(session, 200, undefined, undefined, 'members')
+                                : nothingHere(session);
                         }
-                        case '/closures': {
-                            const session = await readSession(request);
-                            return session ? await closuresPage(session) : redirect(303, root);
+                        if (route === '/settings/audit/export')
+                            return await exportAudit(session, url.searchParams);
+                        if (route === '/settings/privacy') {
+                            return options.resources.privacy
+                                ? await settingsPage(session, 200, undefined, undefined, 'privacy')
+                                : nothingHere(session);
                         }
-                        case '/contacts': {
-                            const session = await readSession(request);
-                            const after = url.searchParams.get('after') ?? undefined;
-                            return session ? await contactsPage(session, 200, undefined, after) : redirect(303, root);
+                        if (route === '/settings/privacy/download')
+                            return await downloadPrivacyExport(session, url.searchParams);
+                        if (route === '/settings/team') {
+                            return teamStore && session.team !== undefined
+                                ? await settingsPage(session, 200, undefined, undefined, 'team')
+                                : nothingHere(session);
                         }
-                        case '/locations': {
-                            const session = await readSession(request);
-                            return session ? await locationsPage(session) : redirect(303, root);
+                        if (route === '/settings/identity') {
+                            return domainStore && session.team !== undefined
+                                ? await settingsPage(session, 200, undefined, undefined, 'identity')
+                                : nothingHere(session);
+                        }
+                        if (route === '/settings/audit') {
+                            return options.resources.audit
+                                ? await settingsPage(session, 200, undefined, undefined, 'audit', undefined, url.searchParams)
+                                : nothingHere(session);
                         }
-                        default: {
-                            const resourceId = RESOURCE_PAGE.exec(route)?.[1];
-                            if (resourceId !== undefined) {
-                                const session = await readSession(request);
-                                return session
-                                    ? await resourceDetailPage(session, resourceId.toLowerCase())
-                                    : redirect(303, root);
-                            }
-                            return respond(404, layout('Not found', html `<p class="notice">Nothing is here.</p>`, null));
+                        // A provider preset fills the assistant's form; nothing is saved until Save.
+                        const preset = SLOTLOCK_ASSISTANT_PRESETS.find((candidate) => candidate.id === url.searchParams.get('preset'));
+                        return await settingsPage(session, 200, undefined, preset ? { provider: preset.provider, baseUrl: preset.baseUrl } : undefined);
+                    }
+                    case '/style.css':
+                        return asset(DASHBOARD_ASSETS.css, 'text/css; charset=utf-8', url, ASSET_VERSIONS.css);
+                    case '/app.js':
+                        return asset(DASHBOARD_ASSETS.js, 'text/javascript; charset=utf-8', url, ASSET_VERSIONS.js);
+                    case '/favicon.svg':
+                        return asset(SLOTLOCK_DASHBOARD_ICON_SVG, 'image/svg+xml', url, ASSET_VERSIONS.icon);
+                    case '/sign-in': {
+                        // After signing in again to confirm it's you, back to the page that asked.
+                        const then = url.searchParams.get('then') ?? '';
+                        const back = STEP_UP_PAGES.has(then) ? then : undefined;
+                        return google && url.searchParams.get('with') === 'google'
+                            ? await startGoogleSignIn(google, back)
+                            : await startSignIn(back, Boolean(teamStore) && (back === '/invite' || (back === '/teams' && Boolean(domainStore))) && url.searchParams.get('email') === '1');
+                    }
+                    case '/invite': {
+                        if (!teamStore)
+                            return nothingHere404();
+                        // An invitation's link: its token (in the query, which request logs leave out) is kept
+                        // in this browser for the sign-in that accepts it, and nothing else; opening it twice
+                        // (a link scanner, a preview) consumes nothing.
+                        const raw = url.searchParams.get('t');
+                        if (raw !== null) {
+                            if (!INVITE_TOKEN.test(raw))
+                                return nothingHere404();
+                            const opened = seal('slotlock-dashboard-invite-v1', { t: raw, exp: now() + INVITE_LINK_TTL_MS });
+                            return respond(303, '', { Location: `${root}/invite`, 'Referrer-Policy': 'no-referrer' }, [
+                                setCookie(INVITE_COOKIE, opened, INVITE_LINK_TTL_MS / 1000),
+                            ]);
                         }
+                        const session = await readSession(request);
+                        return await invitePage(session, inviteTokenOf(request), 200, undefined, url.searchParams.get('checked') === '1');
+                    }
+                    case '/callback':
+                        return await finishSignIn(request, url);
+                    case '/sso':
+                        return await ssoStartPage(url);
+                    case '/hours': {
+                        const session = await readSession(request);
+                        if (!session)
+                            return redirect(303, root);
+                        return authorizePage(session, route) ?? (await hoursEditor(session, url));
+                    }
+                    case '/closures': {
+                        const session = await readSession(request);
+                        if (!session)
+                            return redirect(303, root);
+                        return authorizePage(session, route) ?? (await closuresPage(session));
+                    }
+                    case '/contacts': {
+                        const session = await readSession(request);
+                        const after = url.searchParams.get('after') ?? undefined;
+                        if (!session)
+                            return redirect(303, root);
+                        return authorizePage(session, route) ?? (await contactsPage(session, 200, undefined, after));
+                    }
+                    case '/locations': {
+                        const session = await readSession(request);
+                        if (!session)
+                            return redirect(303, root);
+                        return authorizePage(session, route) ?? (await locationsPage(session));
+                    }
+                    default: {
+                        // A team's provider's callback, by connection; and single sign-on by a team's handle.
+                        const ssoCallback = /^\/sso\/callback\/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/.exec(route)?.[1];
+                        if (ssoCallback !== undefined && ssoStore)
+                            return await finishSsoSignIn(request, url, ssoCallback);
+                        const ssoHandle = /^\/sso\/([a-z0-9]([a-z0-9-]{0,37}[a-z0-9])?)$/.exec(route)?.[1];
+                        if (ssoHandle !== undefined && ssoStore)
+                            return await ssoStartPage(url, ssoHandle);
+                        const resourceId = RESOURCE_PAGE.exec(route)?.[1];
+                        if (resourceId !== undefined) {
+                            const session = await readSession(request);
+                            if (!session)
+                                return redirect(303, root);
+                            return authorizePage(session, '/resources/:id') ?? (await resourceDetailPage(session, resourceId.toLowerCase()));
+                        }
+                        return respond(404, layout('Not found', html `<p class="notice">Nothing is here.</p>`, null));
                     }
                 }
-                if (request.method === 'POST')
-                    return await handlePost(request, route);
-                return respond(405, layout('Not allowed', html `<p class="notice">Use the dashboard's pages and forms.</p>`, null), {
-                    Allow: 'GET, POST',
-                });
             }
-            catch (error) {
-                // A suspended tenant may look, not change: the store refuses its writes.
-                if (error?.code === 'tenant_suspended') {
-                    return respond(403, layout('Suspended', html `<p class="notice">This account is suspended: its data can be seen, not changed.</p>`, null));
-                }
-                try {
-                    ignoreRejection(options.onError?.(error));
-                }
-                catch {
-                    // A failing reporter must not change the response.
-                }
-                return respond(500, layout('Error', html `<p class="notice">Something went wrong. Try again in a moment.</p>`, null));
+            if (request.method === 'POST')
+                return await handlePost(request, route);
+            return respond(405, layout('Not allowed', html `<p class="notice">Use the dashboard's pages and forms.</p>`, null), {
+                Allow: 'GET, POST',
+            });
+        }
+        catch (error) {
+            // A suspended tenant may look, not change: the store refuses its writes.
+            if (error?.code === 'tenant_suspended') {
+                return respond(403, layout('Suspended', html `<p class="notice">This account is suspended: its data can be seen, not changed.</p>`, null));
             }
-        },
-    };
+            try {
+                ignoreRejection(options.onError?.(error));
+            }
+            catch {
+                // A failing reporter must not change the response.
+            }
+            return respond(500, layout('Error', html `<p class="notice">Something went wrong. Try again in a moment.</p>`, null));
+        }
+    }
 }
 // Progressive enhancement only, loaded as a file so the policy needs no inline code: copy buttons
 // (announced in the page's live region), confirmations that close with Escape or a click outside
@@ -5496,6 +8257,29 @@ form .choice { margin: var(--space-1) 0 var(--space-3); }
 .fine + .table, .fine + .empty { margin-top: var(--space-4); }
 .pop label { margin-bottom: var(--space-3); }
 .pop textarea { width: 100%; }
+/* A team being deleted */
+.deleting-banner { background: var(--bad-soft, var(--surface-2)); }
+/* Sessions (Settings, Account) */
+h2.sessions-head { margin-top: var(--space-6); }
+/* Audit log */
+form.audit-filter { display: flex; flex-wrap: wrap; align-items: flex-end; gap: var(--space-2) var(--space-3); margin: 0 0 var(--space-4); }
+form.audit-filter label { flex-basis: 100%; margin: 0; }
+form.audit-filter select { width: auto; }
+dl.audit-details { display: grid; grid-template-columns: auto 1fr; gap: var(--space-1) var(--space-3); margin: 0; font-size: var(--text-sm); }
+dl.audit-details dt { color: var(--ink-2); }
+dl.audit-details dd { margin: 0; overflow-wrap: anywhere; }
+.pager, .audit-tools { display: flex; flex-wrap: wrap; gap: var(--space-4); margin-top: var(--space-4); }
+.audit-tools { margin: 0 0 var(--space-4); }
+/* Teams: one-line forms that create a team or invite to one */
+form.create-team, form.invite { display: flex; flex-wrap: wrap; align-items: flex-end; gap: var(--space-2) var(--space-3); margin: var(--space-5) 0; }
+form.create-team label, form.invite label { flex-basis: 100%; margin: 0; }
+form.create-team input, form.invite input { flex: 1 1 240px; min-width: 0; }
+form.invite select { flex: 0 1 auto; width: auto; }
+.team-workspaces .table + .table { margin-top: var(--space-4); }
+.seats { margin: var(--space-4) 0; color: var(--ink-2); }
+.pop fieldset { border: 0; padding: 0; margin: 0 0 var(--space-3); }
+.pop legend { font-weight: 500; padding: 0; margin-bottom: var(--space-2); }
+.pop fieldset label { display: flex; gap: var(--space-2); align-items: center; margin-bottom: var(--space-1); font-weight: 400; }
 
 /* Buttons */
 button, .button { font: inherit; font-size: var(--text-md); font-weight: 500; height: 36px; padding: 0 var(--space-4); border-radius: var(--radius); border: 1px solid var(--line-strong); background: var(--surface); color: var(--ink); cursor: pointer; display: inline-flex; align-items: center; justify-content: center; gap: var(--space-2); white-space: nowrap; transition: background-color var(--fast) var(--ease), border-color var(--fast) var(--ease), color var(--fast) var(--ease), transform var(--fast) var(--ease); }