-- Team links (2026-10-21): one link shared with a team until a date; each opening
-- makes its own invited identity, never an administrator. Additive only.

CREATE TABLE team_links (
    token_hash  TEXT PRIMARY KEY,
    label       TEXT NOT NULL,             -- what the link is for, shown to whoever opens it
    groups      TEXT NOT NULL DEFAULT '[]', -- JSON array of group slugs granted on each opening
    created_by  TEXT NOT NULL,
    created_at  TEXT NOT NULL,
    expires_at  TEXT NOT NULL,
    max_uses    INTEGER NOT NULL,
    uses        INTEGER NOT NULL DEFAULT 0,
    revoked_at  TEXT
);

-- The team link an identity came from, if any (shown to administrators).
ALTER TABLE identities ADD COLUMN team_link TEXT;