Share one crew across the install, keep user memory per user

Bots, workspaces and computers now belong to the install. Users reach
workers only through bot_users (assigned by a super admin or admin) and
workspace_users; the coordinator and main computer are one per install,
and only the super admin sees the coordinator. Conversations are per
user (bot_sessions.user_id), jobs run for the session's user, and live
updates go only to who should see them.

A bot's core memory is now general knowledge shared by every user it
works for; what it learns about a user lives in bot_user_memories.

One-off scripts move existing installs over: move-bot-memory-to-owners
(run first), then share-crew.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/utils/rbac/can-manage-crew.ts

@@ -0,0 +1,15 @@
+import type { BUN_SQLITE_COBBLE_USER_TYPES } from "@/db/types/db";
+import crewRole from "./crew-role";
+
+type Params = {
+    user_types?: Pick<BUN_SQLITE_COBBLE_USER_TYPES, "user_type">[] | null;
+};
+
+/**
+ * Whether the user creates, edits and deletes workers and workspaces, and
+ * assigns them to users: super admins and admins. Only the super admin
+ * edits the coordinator.
+ */
+export default function canManageCrew({ user_types }: Params): boolean {
+    return crewRole({ user_types }) != "member";
+}

src/utils/rbac/crew-role.ts

@@ -0,0 +1,23 @@
+import type { BUN_SQLITE_COBBLE_USER_TYPES } from "@/db/types/db";
+
+type Params = {
+    user_types?: Pick<BUN_SQLITE_COBBLE_USER_TYPES, "user_type">[] | null;
+};
+
+export type CrewRole = "super_admin" | "admin" | "member";
+
+/**
+ * How a user reaches the crew. `super_admin`: everything, the coordinator
+ * included (no one else ever reaches it). `admin`: every worker and
+ * workspace, and hands out access. `member` (everyone else): only the
+ * workers assigned to them (`bot_users`) and the workspaces they were
+ * added to (`workspace_users`).
+ */
+export default function crewRole({ user_types }: Params): CrewRole {
+    const types = new Set(user_types?.map((ut) => ut.user_type));
+
+    if (types.has("super_admin")) return "super_admin";
+    if (types.has("admin")) return "admin";
+
+    return "member";
+}

src/utils/rbac/index.ts

@@ -5,4 +5,5 @@ export { default as canManageUserTypes } from "./can-manage-user-types";
 export { default as canRevokeUser } from "./can-revoke-user";
 export { default as canUpdateUser } from "./can-update-user";
 export { default as filterAssignableUserTypes } from "./filter-assignable-user-types";
-export { default as isPassThroughUser } from "./is-pass-through-user";
+export { default as isPassThroughUser } from "./is-pass-through-user";export { default as crewRole } from "./crew-role";
+export { default as canManageCrew } from "./can-manage-crew";