npm - @agent-native/core - Versions diffs - 0.121.2 → 0.122.0 - Mend

@agent-native/core 0.121.2 → 0.122.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (460) hide show

package/dist/org/auto-join-domain.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auto-join-domain.js","sourceRoot":"","sources":["../../src/org/auto-join-domain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9E,MAAM,MAAM,GAAG,GAAW,EAAE,CAC1B,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;~~AAgBhE~~;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,QAAgB,EAChB,OAAO,GAA0B,EAAE;IAEnC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAErD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAEtD,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IAEvB,IAAI,OAAO,GAA6B,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;YAC3B,GAAG,EAAE;;;;;;;;;sCAS2B;YAChC,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;SACtB,CAAC,CAAC;QACH,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YAClC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;SACnC,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,uCAAuC;QACvC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAEnE,MAAM,MAAM,GAAmC,EAAE,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,OAAO,CAAC;gBACf,GAAG,EAAE,4FAA4F;gBACjG,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aAC7C,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,kEAAkE;YAClE,kDAAkD;QACpD,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,0DAA0D;IAC1D,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;~~QACd~~,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YAC9D,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC3C,IAAI,OAAO,CAAC,iBAAiB,KAAK,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;gBACzD,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;gBAC9B,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACjC,CAAC","sourcesContent":["import { getDbExec } from \"../db/client.js\";\nimport { getUserSetting, putUserSetting } from \"../settings/user-settings.js\";\n\nconst nanoid = (): string =>\n globalThis.crypto?.randomUUID?.().replace(/-/g, \"\") ??\n Math.random().toString(36).slice(2) + Date.now().toString(36);\n\nexport interface AutoJoinDomainResult {\n joined: Array<{ orgId: string }>;\n activeOrgId: string \| null;\n}\n\nexport interface AutoJoinDomainOptions {\n /*\n The signup hook should not clobber an org selected by an invite flow, but\n * request-time org resolution may need to move an existing account from a\n * personal workspace into its newly matched company org.\n /\n activateJoinedOrg?: \"if-missing\" \| \"always\";\n}\n\n/\n Auto-join a newly-signed-up user into every org whose `allowed_domain`\n * matches their email domain.\n \n Called from the Better Auth `user.create.after` hook so that e.g. a new\n * `@builder.io` signup lands inside the existing Builder.io org on first\n * page load instead of starting in Personal and having to find the join\n * CTA. The org's owner opts into this by setting\n * `organizations.allowed_domain` — the column already gated the manual\n * \"Join your team\" UI in the picker; we use the same opt-in to drive\n * automatic join.\n \n Idempotent — skips orgs the user is already a member of and, by default,\n * never overwrites an existing `active-org-id` setting.\n \n Safe to call when the org tables don't exist (some templates don't use\n * the org module): it swallows the \"no such table\" error and returns\n * empty. Never throws — the caller is a signup hook and we don't want to\n * block a user from creating their account because of an org-tier issue.\n */\nexport async function autoJoinDomainMatchingOrgs(\n rawEmail: string,\n options: AutoJoinDomainOptions = {},\n): Promise<AutoJoinDomainResult> {\n const email = rawEmail.trim().toLowerCase();\n if (!email) return { joined: [], activeOrgId: null };\n\n const domain = email.split(\"@\")[1]?.toLowerCase();\n if (!domain) return { joined: [], activeOrgId: null };\n\n const db = getDbExec();\n\n let matches: Array<{ orgId: string }> = [];\n try {\n const res = await db.execute({\n sql: `SELECT o.id AS \"orgId\"\n FROM organizations o\n WHERE LOWER(o.allowed_domain) = ?\n AND NOT EXISTS (\n SELECT 1\n FROM org_members m\n WHERE m.org_id = o.id\n AND LOWER(m.email) = ?\n )\n ORDER BY o.created_at ASC`,\n args: [domain, email],\n });\n matches = res.rows.map((r: any) => ({\n orgId: String(r.orgId ?? r.org_id),\n }));\n } catch {\n // Template without org tables (or `allowed_domain` column not yet\n // migrated). Not fatal — return empty.\n return { joined: [], activeOrgId: null };\n }\n\n if (matches.length === 0) return { joined: [], activeOrgId: null };\n\n const joined: AutoJoinDomainResult[\"joined\"] = [];\n for (const m of matches) {\n try {\n await db.execute({\n sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, 'member', ?)`,\n args: [nanoid(), m.orgId, email, Date.now()],\n });\n joined.push({ orgId: m.orgId });\n } catch {\n // Race with a parallel join (e.g. user accepted an invite to the\n // same org milliseconds earlier). The unique constraint keeps the\n // existing membership intact; just skip this org.\n }\n }\n\n // Set active-org-id to the first match only if the user doesn't already have\n // one, unless the caller is request-time org resolution intentionally moving\n // an existing account into its newly matched company org.\n let activeOrgId: string \| null = null;\n if (joined[0]) {\n try {\n const existing = await getUserSetting(email, \"active-org-id\");\n const hasActive = Boolean(existing?.orgId);\n if (options.activateJoinedOrg === \"always\" \|\| !hasActive) {\n activeOrgId = joined[0].orgId;\n await putUserSetting(email, \"active-org-id\", { orgId: activeOrgId });\n }\n } catch {\n // settings table missing — not fatal.\n }\n }\n\n return { joined, activeOrgId };\n}\n"]}
1	+ {"version":3,"file":"auto-join-domain.js","sourceRoot":"","sources":["../../src/org/auto-join-domain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9E,MAAM,MAAM,GAAG,GAAW,EAAE,CAC1B,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAiBhE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,QAAgB,EAChB,OAAO,GAA0B,EAAE;IAEnC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAErD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAEtD,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IAEvB,IAAI,OAAO,GAA6B,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;YAC3B,GAAG,EAAE;;;;;;;;;sCAS2B;YAChC,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;SACtB,CAAC,CAAC;QACH,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YAClC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;SACnC,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,uCAAuC;QACvC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAEnE,MAAM,MAAM,GAAmC,EAAE,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,OAAO,CAAC;gBACf,GAAG,EAAE,4FAA4F;gBACjG,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aAC7C,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,kEAAkE;YAClE,kDAAkD;QACpD,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,0DAA0D;IAC1D,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,iBAAiB,KAAK,OAAO,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YAC9D,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC3C,IAAI,OAAO,CAAC,iBAAiB,KAAK,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;gBACzD,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;gBAC9B,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACjC,CAAC","sourcesContent":["import { getDbExec } from \"../db/client.js\";\nimport { getUserSetting, putUserSetting } from \"../settings/user-settings.js\";\n\nconst nanoid = (): string =>\n globalThis.crypto?.randomUUID?.().replace(/-/g, \"\") ??\n Math.random().toString(36).slice(2) + Date.now().toString(36);\n\nexport interface AutoJoinDomainResult {\n joined: Array<{ orgId: string }>;\n activeOrgId: string \| null;\n}\n\nexport interface AutoJoinDomainOptions {\n /*\n The signup hook should not clobber an org selected by an invite flow, but\n * request-time org resolution may need to move an existing account from a\n * personal workspace into its newly matched company org. `\"never\"` joins\n * without touching `active-org-id` — the caller decides activation itself.\n /\n activateJoinedOrg?: \"if-missing\" \| \"always\" \| \"never\";\n}\n\n/\n Auto-join a newly-signed-up user into every org whose `allowed_domain`\n * matches their email domain.\n \n Called from the Better Auth `user.create.after` hook so that e.g. a new\n * `@builder.io` signup lands inside the existing Builder.io org on first\n * page load instead of starting in Personal and having to find the join\n * CTA. The org's owner opts into this by setting\n * `organizations.allowed_domain` — the column already gated the manual\n * \"Join your team\" UI in the picker; we use the same opt-in to drive\n * automatic join.\n \n Idempotent — skips orgs the user is already a member of and, by default,\n * never overwrites an existing `active-org-id` setting.\n \n Safe to call when the org tables don't exist (some templates don't use\n * the org module): it swallows the \"no such table\" error and returns\n * empty. Never throws — the caller is a signup hook and we don't want to\n * block a user from creating their account because of an org-tier issue.\n */\nexport async function autoJoinDomainMatchingOrgs(\n rawEmail: string,\n options: AutoJoinDomainOptions = {},\n): Promise<AutoJoinDomainResult> {\n const email = rawEmail.trim().toLowerCase();\n if (!email) return { joined: [], activeOrgId: null };\n\n const domain = email.split(\"@\")[1]?.toLowerCase();\n if (!domain) return { joined: [], activeOrgId: null };\n\n const db = getDbExec();\n\n let matches: Array<{ orgId: string }> = [];\n try {\n const res = await db.execute({\n sql: `SELECT o.id AS \"orgId\"\n FROM organizations o\n WHERE LOWER(o.allowed_domain) = ?\n AND NOT EXISTS (\n SELECT 1\n FROM org_members m\n WHERE m.org_id = o.id\n AND LOWER(m.email) = ?\n )\n ORDER BY o.created_at ASC`,\n args: [domain, email],\n });\n matches = res.rows.map((r: any) => ({\n orgId: String(r.orgId ?? r.org_id),\n }));\n } catch {\n // Template without org tables (or `allowed_domain` column not yet\n // migrated). Not fatal — return empty.\n return { joined: [], activeOrgId: null };\n }\n\n if (matches.length === 0) return { joined: [], activeOrgId: null };\n\n const joined: AutoJoinDomainResult[\"joined\"] = [];\n for (const m of matches) {\n try {\n await db.execute({\n sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, 'member', ?)`,\n args: [nanoid(), m.orgId, email, Date.now()],\n });\n joined.push({ orgId: m.orgId });\n } catch {\n // Race with a parallel join (e.g. user accepted an invite to the\n // same org milliseconds earlier). The unique constraint keeps the\n // existing membership intact; just skip this org.\n }\n }\n\n // Set active-org-id to the first match only if the user doesn't already have\n // one, unless the caller is request-time org resolution intentionally moving\n // an existing account into its newly matched company org.\n let activeOrgId: string \| null = null;\n if (joined[0] && options.activateJoinedOrg !== \"never\") {\n try {\n const existing = await getUserSetting(email, \"active-org-id\");\n const hasActive = Boolean(existing?.orgId);\n if (options.activateJoinedOrg === \"always\" \|\| !hasActive) {\n activeOrgId = joined[0].orgId;\n await putUserSetting(email, \"active-org-id\", { orgId: activeOrgId });\n }\n } catch {\n // settings table missing — not fatal.\n }\n }\n\n return { joined, activeOrgId };\n}\n"]}

package/dist/org/context.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/org/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAOlC,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;~~AAiCtD~~;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAOvE;~~AAoND~~;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAsBxB;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAkBxB;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,OAAiB,GACtB,OAAO,CAAC;IACT,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CAqBD;AAqLD;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAaxE;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAa3E;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAaxB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAepD"}
1	+ {"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/org/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAOlC,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAsDtD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAOvE;AAoQD;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAsBxB;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAkBxB;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,OAAiB,GACtB,OAAO,CAAC;IACT,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CAqBD;AAqLD;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAaxE;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAa3E;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAaxB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAepD"}

package/dist/org/context.js CHANGED Viewed

@@ -14,8 +14,30 @@ function normalizeOrgRole(value) {
         ? value
         : null;
 }
-function isLikelyPersonalWorkspace(membership, email, session) {
-    return membership.orgName.trim() === defaultOrgName(email, session);
+function emailDomainOf(email) {
+    return email.split("@")[1]?.toLowerCase() || null;
+}
+/**
+ * A workspace the user owns that nobody else has joined is a default/personal
+ * workspace whatever it happens to be named, so moving the user into their
+ * company org is safe. An org with other members is a team they deliberately
+ * belong to — join the domain org in the background but leave them there.
+ */
+async function isSoloOwnedWorkspace(exec, orgId, memberships) {
+    const membership = memberships.find((m) => m.orgId === orgId);
+    if (!membership || membership.role !== "owner")
+        return false;
+    try {
+        const { rows } = await exec.execute({
+            sql: `SELECT COUNT(*) AS "memberCount" FROM org_members WHERE org_id = ?`,
+            args: [orgId],
+        });
+        const row = rows[0];
+        return Number(row?.memberCount ?? row?.membercount ?? 0) <= 1;
+    }
+    catch {
+        return false;
+    }
 }
 function autoCreateDefaultOrgEnabled() {
     const raw = process.env.AUTO_CREATE_DEFAULT_ORG;
@@ -109,16 +131,21 @@ async function resolveOrgContextUncached(event) {
         }
         return { email, orgId: null, orgName: null, role: null };
     }
-    const shouldTryDomainAutoJoin = memberships.length === 0 ||
-        (memberships.length === 1 &&
-            isLikelyPersonalWorkspace(memberships[0], email, session));
     const activeOrgSetting = await loadActiveOrgSettingForEvent(event, email);
-    if (activeOrgSetting?.orgId === null) {
-        return { email, orgId: null, orgName: null, role: null };
-    }
-    if (activeOrgSetting?.orgId) {
+    const explicitPersonal = activeOrgSetting?.orgId === null;
+    const emailDomain = emailDomainOf(email);
+    // Membership in a domain-matched org is the only durable "already joined"
+    // signal. Recognizing the personal workspace by its *name* instead breaks the
+    // moment the provider display name or the workspace name changes, which
+    // strands an existing user in Personal with no way into their company org.
+    const shouldTryDomainAutoJoin = !explicitPersonal &&
+        emailDomain !== null &&
+        !memberships.some((m) => m.allowedDomain?.toLowerCase() === emailDomain);
+    if (!explicitPersonal &&
+        activeOrgSetting?.orgId &&
+        !shouldTryDomainAutoJoin) {
         const active = memberships.find((m) => m.orgId === activeOrgSetting.orgId);
-        if (active && !shouldTryDomainAutoJoin) {
+        if (active) {
             return {
                 email,
                 orgId: active.orgId,
@@ -131,28 +158,52 @@ async function resolveOrgContextUncached(event) {
         ? memberships.find((m) => m.orgId === sessionOrgId)
         : null;
     if (shouldTryDomainAutoJoin) {
+        const membershipsBeforeJoin = memberships;
         const joined = await autoJoinDomainMatchingOrgs(email, {
-            activateJoinedOrg: "always",
+            activateJoinedOrg: "never",
         });
-        if (joined.joined.length > 0) {
+        const joinedOrgId = joined.joined[0]?.orgId ?? null;
+        if (joinedOrgId) {
             const refreshed = await loadMemberships(exec, email);
             if (refreshed !== null) {
                 memberships = refreshed;
                 updateMembershipsForEvent(event, email, refreshed);
             }
-        }
-        if (joined.activeOrgId) {
-            const active = memberships.find((m) => m.orgId === joined.activeOrgId);
-            if (active) {
-                return {
-                    email,
-                    orgId: active.orgId,
-                    orgName: active.orgName,
-                    role: active.role,
-                };
+            const currentOrgId = activeOrgSetting?.orgId ??
+                sessionOrgId ??
+                membershipsBeforeJoin[0]?.orgId ??
+                null;
+            const shouldActivate = !explicitPersonal &&
+                (currentOrgId === null ||
+                    (await isSoloOwnedWorkspace(exec, currentOrgId, membershipsBeforeJoin)));
+            if (shouldActivate) {
+                await putUserSetting(email, "active-org-id", { orgId: joinedOrgId });
+                const active = memberships.find((m) => m.orgId === joinedOrgId);
+                if (active) {
+                    return {
+                        email,
+                        orgId: active.orgId,
+                        orgName: active.orgName,
+                        role: active.role,
+                    };
+                }
             }
         }
     }
+    if (explicitPersonal) {
+        return { email, orgId: null, orgName: null, role: null };
+    }
+    if (activeOrgSetting?.orgId) {
+        const active = memberships.find((m) => m.orgId === activeOrgSetting.orgId);
+        if (active) {
+            return {
+                email,
+                orgId: active.orgId,
+                orgName: active.orgName,
+                role: active.role,
+            };
+        }
+    }
     if (sessionOrgId) {
         const active = sessionMembership ?? memberships.find((m) => m.orgId === sessionOrgId);
         if (active) {
@@ -190,17 +241,22 @@ async function resolveOrgContextUncached(event) {
 async function loadMemberships(exec, email) {
     try {
         const { rows } = await exec.execute({
-            sql: `SELECT m.org_id AS "orgId", m.role AS role, o.name AS "orgName"
+            sql: `SELECT m.org_id AS "orgId", m.role AS role, o.name AS "orgName",
+                   o.allowed_domain AS "allowedDomain"
             FROM org_members m
             INNER JOIN organizations o ON m.org_id = o.id
             WHERE LOWER(m.email) = ?`,
             args: [email.toLowerCase()],
         });
-        return rows.map((r) => ({
-            orgId: String(r.orgId ?? r.org_id),
-            role: String(r.role),
-            orgName: String(r.orgName ?? r.org_name),
-        }));
+        return rows.map((r) => {
+            const domain = r.allowedDomain ?? r.allowed_domain;
+            return {
+                orgId: String(r.orgId ?? r.org_id),
+                role: String(r.role),
+                orgName: String(r.orgName ?? r.org_name),
+                allowedDomain: domain ? String(domain) : null,
+            };
+        });
     }
     catch {
         // Tables may not exist yet on first boot before migrations finish.

package/dist/org/context.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/org/context.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAGnE,MAAM,aAAa,GAAe;IAChC,KAAK,EAAE,EAAE;IACT,KAAK,EAAE,IAAI;IACX,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,IAAI;CACX,CAAC;AAEF,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ;QACjE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,yBAAyB,CAChC,UAA+B,EAC/B,KAAa,EACb,OAAiC;IAEjC,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,2BAA2B;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAChD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,MAAM,GAAG,GAAW,EAAE,CAC1B,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAc;IAChD,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,GAAG,GAAG,KAAK,CAAC,OAEjB,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC;AACxE,CAAC;AAID,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AACxD,MAAM,4BAA4B,GAAG,2BAA2B,CAAC;AAIjE,SAAS,4BAA4B,CACnC,KAAc,EACd,KAAa;IAEb,MAAM,GAAG,GAAG,KAAK,CAAC,OAAkC,CAAC;IACrD,MAAM,KAAK,GAAG,CAAE,GAAG,CAAC,4BAA4B,CAElC;QACZ,CAAC,GAAG,CAAC,4BAA4B,CAAC,GAAG,IAAI,GAAG,EAGzC,CAAC,CAA2C,CAAC;IAClD,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,cAAc,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YAC9D,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/C,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI;gBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACjD,OAAO,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAC9B,KAAc,EACd,IAAkC,EAClC,KAAa;IAEb,MAAM,GAAG,GAAG,KAAK,CAAC,OAAkC,CAAC;IACrD,MAAM,KAAK,GAAG,CAAE,GAAG,CAAC,qBAAqB,CAE3B;QACZ,CAAC,GAAG,CAAC,qBAAqB,CAAC,GAAG,IAAI,GAAG,EAGlC,CAAC,CAAiD,CAAC;IACxD,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,yBAAyB,CAChC,KAAc,EACd,KAAa,EACb,WAAmC;IAEnC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAkC,CAAC;IACrD,MAAM,KAAK,GAAG,GAAG,CAAC,qBAAqB,CAE1B,CAAC;IACd,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAAc;IACrD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,aAAa,CAAC;IACjC,MAAM,YAAY,GAChB,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE;QACvD,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE;QACtB,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,cAAc,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzD,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IAEzB,IAAI,WAAW,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACpE,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,YAAY;gBACnB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,cAAc;aACrB,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,uBAAuB,GAC3B,WAAW,CAAC,MAAM,KAAK,CAAC;QACxB,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;YACvB,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/D,MAAM,gBAAgB,GAAG,MAAM,4BAA4B,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1E,IAAI,gBAAgB,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,gBAAgB,EAAE,KAAK,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC;YACvC,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,GAAG,YAAY;QACpC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC;QACnD,CAAC,CAAC,IAAI,CAAC;IAET,IAAI,uBAAuB,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,KAAK,EAAE;YACrD,iBAAiB,EAAE,QAAQ;SAC5B,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACrD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,WAAW,GAAG,SAAS,CAAC;gBACxB,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,WAAW,CAAC,CAAC;YACvE,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO;oBACL,KAAK;oBACL,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;iBAClB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,MAAM,GACV,iBAAiB,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC;QACzE,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC;QACJ,CAAC;QACD,OAAO;YACL,KAAK;YACL,KAAK,EAAE,YAAY;YACnB,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,cAAc;SACrB,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,2BAA2B,EAAE,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,4EAA4E;QAC5E,uEAAuE;IACzE,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,OAAO;QACL,KAAK;QACL,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK;QAC3B,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO;QAC/B,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;KAC1B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,IAAkC,EAClC,KAAa;IAMb,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE;;;qCAG0B;YAC/B,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SAC5B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YAC3B,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;YAClC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAY;YAC/B,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC;SACzC,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAa;IAEb,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,uDAAuD;YAC5D,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SAC5B,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACnD,MAAM,gBAAgB,GAAG,CAAC,MAAM,cAAc,CAC5C,KAAK,EACL,eAAe,CAChB,CAAqB,CAAC;QACvB,IAAI,gBAAgB,EAAE,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAClD,IAAI,gBAAgB,EAAE,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YACpE,OAAO,gBAAgB,CAAC,KAAK,CAAC;QAChC,CAAC;QACD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAAc,EACd,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1D,MAAM,gBAAgB,GAAG,MAAM,4BAA4B,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1E,IAAI,gBAAgB,EAAE,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAClD,IACE,gBAAgB,EAAE,KAAK;YACvB,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,KAAK,CAAC,EAC3D,CAAC;YACD,OAAO,gBAAgB,CAAC,KAAK,CAAC;QAChC,CAAC;QACD,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,KAAa,EACb,IAAI,GAAY,OAAO;IAQvB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;IACpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAExD,MAAM,IAAI,CAAC,OAAO,CAAC;QACjB,GAAG,EAAE,iGAAiG;QACtG,IAAI,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC;KACrD,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,OAAO,CAAC;QACjB,GAAG,EAAE,qFAAqF;QAC1F,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC;KAC7C,CAAC,CAAC;IAEH,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IAE5D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,cAAc,CACrB,KAAa,EACb,OAAiC;IAEjC,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACnC,IAAI,IAAI;QAAE,OAAO,GAAG,IAAI,cAAc,CAAC;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,MAAM,GACV,OAAO;SACJ,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAClD,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACvB,OAAO,GAAG,MAAM,cAAc,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAAkC,EAClC,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,qFAAqF;YAC1F,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SAC5B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,0DAA0D;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,IAAkC,EAClC,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,qEAAqE;YAC1E,IAAI,EAAE,CAAC,MAAM,CAAC;SACf,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;sDAIsD;AACtD,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,UAAU,mBAAmB,CAChC,IAAkC,EAClC,KAAa,EACb,OAAiC;IAEjC,sEAAsE;IACtE,mEAAmE;IACnE,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAE7C,MAAM,QAAQ,GAAG,KAAK,KAAK,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAE9D,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvD,sEAAsE;IACtE,qEAAqE;IACrE,mEAAmE;IACnE,yDAAyD;IACzD,IAAI,MAAM,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,GAAG,EAAE,kFAAkF;YACvF,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC;SACnC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,GAAG,EAAE,qFAAqF;YAC1F,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;SAC7C,CAAC,CAAC;QAEH,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAExD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,IAAkC,EAClC,QAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,GAAG,EAAE,gEAAgE;YACrE,IAAI,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC;SACnD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,mDAAmD;QACnD,EAAE;QACF,2DAA2D;QAC3D,iEAAiE;QACjE,iEAAiE;QACjE,kEAAkE;QAClE,iEAAiE;QACjE,0DAA0D;QAC1D,gEAAgE;QAChE,uEAAuE;QACvE,yBAAyB;QACzB,MAAM,cAAc,GAAG,GAAG,GAAG,YAAY,CAAC;QAC1C,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC;YACjC,GAAG,EAAE,iFAAiF;YACtF,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC;SACnE,CAAC,CAA8B,CAAC;QACjC,OAAO,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,IAAkC,EAClC,QAAgB;IAEhB,+DAA+D;IAC/D,qEAAqE;IACrE,kDAAkD;IAClD,MAAM,IAAI;SACP,OAAO,CAAC,EAAE,GAAG,EAAE,oCAAoC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;SACxE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAa;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,+DAA+D;YACpE,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;QAC7D,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,2DAA2D;YAChE,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzD,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,8EAA8E;YACnF,IAAI,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzD,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,4EAA4E;YACjF,IAAI,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO;YACL,KAAK,EAAE,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,IAAI,CAAC;SACvC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\n\nimport { getDbExec } from \"../db/client.js\";\nimport { getSession } from \"../server/auth.js\";\nimport { getSetting } from \"../settings/store.js\";\nimport { getUserSetting, putUserSetting } from \"../settings/user-settings.js\";\nimport { autoJoinDomainMatchingOrgs } from \"./auto-join-domain.js\";\nimport type { OrgContext, OrgRole } from \"./types.js\";\n\nconst EMPTY_CONTEXT: OrgContext = {\n email: \"\",\n orgId: null,\n orgName: null,\n role: null,\n};\n\nfunction normalizeOrgRole(value: unknown): OrgRole \| null {\n return value === \"owner\" \|\| value === \"admin\" \|\| value === \"member\"\n ? value\n : null;\n}\n\nfunction isLikelyPersonalWorkspace(\n membership: { orgName: string },\n email: string,\n session: { name?: string } \| null,\n): boolean {\n return membership.orgName.trim() === defaultOrgName(email, session);\n}\n\nfunction autoCreateDefaultOrgEnabled(): boolean {\n const raw = process.env.AUTO_CREATE_DEFAULT_ORG;\n if (raw === undefined \|\| raw.trim() === \"\") return true;\n return ![\"0\", \"false\", \"no\", \"off\"].includes(raw.trim().toLowerCase());\n}\n\nconst nanoid = (): string =>\n globalThis.crypto?.randomUUID?.().replace(/-/g, \"\") ??\n Math.random().toString(36).slice(2) + Date.now().toString(36);\n\n/*\n Resolve the current user's organization context from their session.\n \n - Honors the user's `active-org-id` setting, including an explicit Personal\n * context represented by `{ orgId: null }`.\n * - Falls back to the user's first membership.\n * - When the authenticated user has zero memberships, provisions a default org\n * named after the user ({name}'s workspace, falling back to the email\n * local-part). Set `AUTO_CREATE_DEFAULT_ORG=0` to opt out.\n \n Per-request memoized on `event.context` — mirrors the `getSession`\n * pattern so multiple callers in the same request (e.g. ssr-handler +\n * a loader) share a single org_members round trip.\n /\nexport async function getOrgContext(event: H3Event): Promise<OrgContext> {\n // Per-request memoization. Multiple call sites per request (action wrappers,\n // SSR handler, loaders) must not each pay a separate org_members query.\n const ctx = event.context as {\n __anOrgContextCache?: Promise<OrgContext>;\n };\n return (ctx.__anOrgContextCache ??= resolveOrgContextUncached(event));\n}\n\ntype MembershipRow = { orgId: string; role: OrgRole; orgName: string };\n\nconst MEMBERSHIPS_CACHE_KEY = \"__anOrgMembershipsCache\";\nconst ACTIVE_ORG_SETTING_CACHE_KEY = \"__anActiveOrgSettingCache\";\n\ntype ActiveOrgSetting = { orgId: string \| null } \| null;\n\nfunction loadActiveOrgSettingForEvent(\n event: H3Event,\n email: string,\n): Promise<ActiveOrgSetting> {\n const ctx = event.context as Record<string, unknown>;\n const cache = ((ctx[ACTIVE_ORG_SETTING_CACHE_KEY] as\n \| Map<string, Promise<ActiveOrgSetting>>\n \| undefined) ??\n (ctx[ACTIVE_ORG_SETTING_CACHE_KEY] = new Map<\n string,\n Promise<ActiveOrgSetting>\n >())) as Map<string, Promise<ActiveOrgSetting>>;\n const normalizedEmail = email.toLowerCase();\n let promise = cache.get(normalizedEmail);\n if (!promise) {\n promise = getUserSetting(email, \"active-org-id\").then((value) => {\n if (!value \|\| !(\"orgId\" in value)) return null;\n if (value.orgId === null) return { orgId: null };\n return typeof value.orgId === \"string\" ? { orgId: value.orgId } : null;\n });\n cache.set(normalizedEmail, promise);\n }\n return promise;\n}\n\n/\n Per-request memoization of the org_members lookup, keyed by email on\n * `event.context`. Both the session org backfill (inside `getSession`) and\n * `getOrgContext` need the membership rows; without sharing, every request\n * whose session lacks an orgId pays the query twice.\n /\nfunction loadMembershipsForEvent(\n event: H3Event,\n exec: ReturnType<typeof getDbExec>,\n email: string,\n): Promise<MembershipRow[] \| null> {\n const ctx = event.context as Record<string, unknown>;\n const cache = ((ctx[MEMBERSHIPS_CACHE_KEY] as\n \| Map<string, Promise<MembershipRow[] \| null>>\n \| undefined) ??\n (ctx[MEMBERSHIPS_CACHE_KEY] = new Map<\n string,\n Promise<MembershipRow[] \| null>\n >())) as Map<string, Promise<MembershipRow[] \| null>>;\n let promise = cache.get(email);\n if (!promise) {\n promise = loadMemberships(exec, email);\n cache.set(email, promise);\n }\n return promise;\n}\n\nfunction updateMembershipsForEvent(\n event: H3Event,\n email: string,\n memberships: MembershipRow[] \| null,\n): void {\n const ctx = event.context as Record<string, unknown>;\n const cache = ctx[MEMBERSHIPS_CACHE_KEY] as\n \| Map<string, Promise<MembershipRow[] \| null>>\n \| undefined;\n cache?.set(email, Promise.resolve(memberships));\n}\n\nasync function resolveOrgContextUncached(event: H3Event): Promise<OrgContext> {\n const session = await getSession(event);\n const email = session?.email;\n if (!email) return EMPTY_CONTEXT;\n const sessionOrgId =\n typeof session.orgId === \"string\" && session.orgId.trim()\n ? session.orgId.trim()\n : null;\n const sessionOrgRole = normalizeOrgRole(session.orgRole);\n\n const exec = getDbExec();\n\n let memberships = await loadMembershipsForEvent(event, exec, email);\n if (memberships === null) {\n if (sessionOrgId) {\n return {\n email,\n orgId: sessionOrgId,\n orgName: null,\n role: sessionOrgRole,\n };\n }\n return { email, orgId: null, orgName: null, role: null };\n }\n\n const shouldTryDomainAutoJoin =\n memberships.length === 0 \|\|\n (memberships.length === 1 &&\n isLikelyPersonalWorkspace(memberships[0], email, session));\n const activeOrgSetting = await loadActiveOrgSettingForEvent(event, email);\n if (activeOrgSetting?.orgId === null) {\n return { email, orgId: null, orgName: null, role: null };\n }\n if (activeOrgSetting?.orgId) {\n const active = memberships.find((m) => m.orgId === activeOrgSetting.orgId);\n if (active && !shouldTryDomainAutoJoin) {\n return {\n email,\n orgId: active.orgId,\n orgName: active.orgName,\n role: active.role,\n };\n }\n }\n\n const sessionMembership = sessionOrgId\n ? memberships.find((m) => m.orgId === sessionOrgId)\n : null;\n\n if (shouldTryDomainAutoJoin) {\n const joined = await autoJoinDomainMatchingOrgs(email, {\n activateJoinedOrg: \"always\",\n });\n if (joined.joined.length > 0) {\n const refreshed = await loadMemberships(exec, email);\n if (refreshed !== null) {\n memberships = refreshed;\n updateMembershipsForEvent(event, email, refreshed);\n }\n }\n\n if (joined.activeOrgId) {\n const active = memberships.find((m) => m.orgId === joined.activeOrgId);\n if (active) {\n return {\n email,\n orgId: active.orgId,\n orgName: active.orgName,\n role: active.role,\n };\n }\n }\n }\n\n if (sessionOrgId) {\n const active =\n sessionMembership ?? memberships.find((m) => m.orgId === sessionOrgId);\n if (active) {\n return {\n email,\n orgId: active.orgId,\n orgName: active.orgName,\n role: active.role,\n };\n }\n return {\n email,\n orgId: sessionOrgId,\n orgName: null,\n role: sessionOrgRole,\n };\n }\n\n if (memberships.length === 0 && autoCreateDefaultOrgEnabled()) {\n const created = await tryCreateDefaultOrg(exec, email, session);\n if (created) return created;\n // Creation failed (race / DB error); fall through with an empty org context\n // so non-blocking invite/domain UI can still surface recovery options.\n }\n\n if (memberships.length === 0) {\n return { email, orgId: null, orgName: null, role: null };\n }\n\n return {\n email,\n orgId: memberships[0].orgId,\n orgName: memberships[0].orgName,\n role: memberships[0].role,\n };\n}\n\nasync function loadMemberships(\n exec: ReturnType<typeof getDbExec>,\n email: string,\n): Promise<Array<{\n orgId: string;\n role: OrgRole;\n orgName: string;\n}> \| null> {\n try {\n const { rows } = await exec.execute({\n sql: `SELECT m.org_id AS \"orgId\", m.role AS role, o.name AS \"orgName\"\n FROM org_members m\n INNER JOIN organizations o ON m.org_id = o.id\n WHERE LOWER(m.email) = ?`,\n args: [email.toLowerCase()],\n });\n return rows.map((r: any) => ({\n orgId: String(r.orgId ?? r.org_id),\n role: String(r.role) as OrgRole,\n orgName: String(r.orgName ?? r.org_name),\n }));\n } catch {\n // Tables may not exist yet on first boot before migrations finish.\n return null;\n }\n}\n\n/\n Resolve the active org ID for a given email — for non-HTTP contexts like\n * the integration webhook handler where we have an email but no event/session.\n * Picks the user's active-org-id setting if set, including explicit Personal,\n * otherwise the first membership.\n * Returns null if the user has no memberships.\n /\nexport async function resolveOrgIdForEmail(\n email: string,\n): Promise<string \| null> {\n const exec = getDbExec();\n if (!exec) return null;\n try {\n const { rows } = await exec.execute({\n sql: `SELECT org_id FROM org_members WHERE LOWER(email) = ?`,\n args: [email.toLowerCase()],\n });\n if (rows.length === 0) return null;\n const ids = rows.map((r: any) => String(r.org_id));\n const activeOrgSetting = (await getUserSetting(\n email,\n \"active-org-id\",\n )) as ActiveOrgSetting;\n if (activeOrgSetting?.orgId === null) return null;\n if (activeOrgSetting?.orgId && ids.includes(activeOrgSetting.orgId)) {\n return activeOrgSetting.orgId;\n }\n return ids[0];\n } catch {\n return null;\n }\n}\n\n/\n Event-aware variant of `resolveOrgIdForEmail` for HTTP request paths.\n * Shares the per-request membership lookup with `getOrgContext`, so the\n * session org backfill inside `getSession` and a later `getOrgContext` call\n * in the same request pay ONE org_members round trip, not two.\n /\nexport async function resolveOrgIdForEmailViaEvent(\n event: H3Event,\n email: string,\n): Promise<string \| null> {\n try {\n const exec = getDbExec();\n if (!exec) return null;\n const memberships = await loadMembershipsForEvent(event, exec, email);\n if (!memberships \|\| memberships.length === 0) return null;\n const activeOrgSetting = await loadActiveOrgSettingForEvent(event, email);\n if (activeOrgSetting?.orgId === null) return null;\n if (\n activeOrgSetting?.orgId &&\n memberships.some((m) => m.orgId === activeOrgSetting.orgId)\n ) {\n return activeOrgSetting.orgId;\n }\n return memberships[0].orgId;\n } catch {\n return null;\n }\n}\n\n/\n Create a new organization and add the caller as a member with the given\n * role. Generates a per-org A2A secret for cross-app delegation and writes\n * the caller's `active-org-id` user-setting so the new org is immediately\n * active.\n \n /\nexport async function createOrganization(\n name: string,\n email: string,\n role: OrgRole = \"owner\",\n): Promise<{\n id: string;\n name: string;\n role: OrgRole;\n a2aSecret: string;\n createdAt: number;\n}> {\n const trimmedName = name.trim();\n const exec = getDbExec();\n const id = nanoid();\n const createdAt = Date.now();\n const { randomBytes } = await import(\"node:crypto\");\n const a2aSecret = randomBytes(32).toString(\"base64url\");\n\n await exec.execute({\n sql: `INSERT INTO organizations (id, name, created_by, created_at, a2a_secret) VALUES (?, ?, ?, ?, ?)`,\n args: [id, trimmedName, email, createdAt, a2aSecret],\n });\n\n await exec.execute({\n sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,\n args: [nanoid(), id, email, role, createdAt],\n });\n\n await putUserSetting(email, \"active-org-id\", { orgId: id });\n\n return { id, name: trimmedName, role, a2aSecret, createdAt };\n}\n\nfunction defaultOrgName(\n email: string,\n session: { name?: string } \| null,\n): string {\n const full = session?.name?.trim();\n if (full) return `${full}'s workspace`;\n const local = email.split(\"@\")[0] ?? email;\n const cleaned = local.replace(/[._-]+/g, \" \").trim();\n const titled =\n cleaned\n .split(\" \")\n .filter(Boolean)\n .map((w) => w.charAt(0).toUpperCase() + w.slice(1))\n .join(\" \") \|\| \"My\";\n return `${titled}'s workspace`;\n}\n\n/*\n Check whether the user has a pending invitation. If so, auto-create\n * MUST be skipped — otherwise we'd provision a personal org for them\n * before they ever see the inviter's org in the invitation banner, and they'd\n * never join the team that invited them.\n /\nasync function hasPendingInvitation(\n exec: ReturnType<typeof getDbExec>,\n email: string,\n): Promise<boolean> {\n try {\n const { rows } = await exec.execute({\n sql: `SELECT 1 FROM org_invitations WHERE LOWER(email) = ? AND status = 'pending' LIMIT 1`,\n args: [email.toLowerCase()],\n });\n return rows.length > 0;\n } catch {\n // If we can't tell, err on the side of NOT auto-creating — the\n // invitation banner or team UI can surface the situation.\n return true;\n }\n}\n\nasync function hasDomainMatch(\n exec: ReturnType<typeof getDbExec>,\n email: string,\n): Promise<boolean> {\n try {\n const domain = email.split(\"@\")[1]?.toLowerCase();\n if (!domain) return false;\n const { rows } = await exec.execute({\n sql: `SELECT 1 FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,\n args: [domain],\n });\n return rows.length > 0;\n } catch {\n return false;\n }\n}\n\n/* Stale-claim threshold. A claim row this old is treated as abandoned\n * (process crashed, DELETE failed, etc.) and a new caller may take it\n * over. Long enough that two genuine concurrent first-loads don't\n * trample each other (those settle in milliseconds), short enough that\n * a stuck user recovers on their next navigation. /\nconst CLAIM_TTL_MS = 5 60 * 1000;\n\n/*\n Attempt to provision a default org + owner membership for a user with\n * zero memberships.\n \n Race protection: claims the user's auto-create slot via an atomic\n * INSERT into the framework `settings` table (PRIMARY KEY (key) — so\n * concurrent inserts for the same key throw uniqueness violations on\n * both SQLite and Postgres). Only the request that wins the claim\n * proceeds to create the org; losers bail. By the time a losing\n * request retries on a subsequent navigation, the winner's org is in\n * `org_members` and the auto-create branch is skipped entirely.\n \n Stuck-state recovery: a stale claim (held longer than CLAIM_TTL_MS)\n * is reclaimed automatically. So even if the DELETE on the failure\n * path fails (network blip, DB error), the user isn't stranded — the\n * next request after the TTL elapses retries cleanly.\n \n Returns null on any failure so the caller can fall back to the\n * empty-context / client-guard path.\n /\nasync function tryCreateDefaultOrg(\n exec: ReturnType<typeof getDbExec>,\n email: string,\n session: { name?: string } \| null,\n): Promise<OrgContext \| null> {\n // Make sure the framework `settings` table exists before we use it as\n // a claim primitive. getSetting() ensures the table on first call.\n await getSetting(\"__init\").catch(() => null);\n\n const claimKey = `u:${email.toLowerCase()}:auto-create-claim`;\n\n if (!(await acquireClaim(exec, claimKey))) return null;\n\n // Pending-invite check happens INSIDE the claim so the window where a\n // newly-arrived invitation can be missed is narrowed to a single SQL\n // round-trip. (A still-narrower window would require a transaction\n // spanning org_invitations and settings — out of scope.)\n if (await hasPendingInvitation(exec, email)) {\n await releaseClaim(exec, claimKey);\n return null;\n }\n\n if (await hasDomainMatch(exec, email)) {\n await releaseClaim(exec, claimKey);\n return null;\n }\n\n try {\n const orgId = nanoid();\n const orgName = defaultOrgName(email, session);\n const now = Date.now();\n\n await exec.execute({\n sql: `INSERT INTO organizations (id, name, created_by, created_at) VALUES (?, ?, ?, ?)`,\n args: [orgId, orgName, email, now],\n });\n await exec.execute({\n sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,\n args: [nanoid(), orgId, email, \"owner\", now],\n });\n\n await putUserSetting(email, \"active-org-id\", { orgId });\n\n return { email, orgId, orgName, role: \"owner\" };\n } catch {\n await releaseClaim(exec, claimKey);\n return null;\n }\n}\n\nasync function acquireClaim(\n exec: ReturnType<typeof getDbExec>,\n claimKey: string,\n): Promise<boolean> {\n const now = Date.now();\n try {\n await exec.execute({\n sql: `INSERT INTO settings (key, value, updated_at) VALUES (?, ?, ?)`,\n args: [claimKey, JSON.stringify({ at: now }), now],\n });\n return true;\n } catch {\n // Conflict — someone else's claim is already in the row. If it's\n // stale (older than CLAIM_TTL_MS) we take it over.\n //\n // CRITICAL: this MUST be a single atomic UPDATE guarded on\n // `updated_at <= staleThreshold`. A read-then-DELETE-then-INSERT\n // sequence lets two concurrent reclaimers each observe the stale\n // timestamp, delete each other's fresh claim, and both think they\n // won — duplicating org creation. The conditional UPDATE matches\n // each stale row at most once: only the first writer sees\n // rowsAffected === 1; the row's updated_at is now `now`, so any\n // subsequent UPDATE no longer satisfies `updated_at <= staleThreshold`\n // and matches zero rows.\n const staleThreshold = now - CLAIM_TTL_MS;\n const result = (await exec.execute({\n sql: `UPDATE settings SET value = ?, updated_at = ? WHERE key = ? AND updated_at <= ?`,\n args: [JSON.stringify({ at: now }), now, claimKey, staleThreshold],\n })) as { rowsAffected?: number };\n return (result.rowsAffected ?? 0) > 0;\n }\n}\n\nasync function releaseClaim(\n exec: ReturnType<typeof getDbExec>,\n claimKey: string,\n): Promise<void> {\n // Best-effort. If this fails (transient network/DB error), the\n // CLAIM_TTL_MS-based takeover in acquireClaim recovers automatically\n // on a future request — no permanent stuck state.\n await exec\n .execute({ sql: `DELETE FROM settings WHERE key = ?`, args: [claimKey] })\n .catch(() => {});\n}\n\n/\n Look up the `allowed_domain` for an org by its ID.\n * Used when making outbound A2A calls so the JWT includes the\n * caller's org domain for cross-app org resolution.\n /\nexport async function getOrgDomain(orgId: string): Promise<string \| null> {\n try {\n const exec = getDbExec();\n const { rows } = await exec.execute({\n sql: `SELECT allowed_domain FROM organizations WHERE id = ? LIMIT 1`,\n args: [orgId],\n });\n if (!rows[0]) return null;\n const domain = String((rows[0] as any).allowed_domain \|\| \"\");\n return domain \|\| null;\n } catch {\n return null;\n }\n}\n\n/\n Look up the org's A2A secret by org ID.\n * Used when making outbound A2A calls so the JWT is signed with the\n * org-specific secret rather than the global A2A_SECRET env var.\n /\nexport async function getOrgA2ASecret(orgId: string): Promise<string \| null> {\n try {\n const exec = getDbExec();\n const { rows } = await exec.execute({\n sql: `SELECT a2a_secret FROM organizations WHERE id = ? LIMIT 1`,\n args: [orgId],\n });\n if (!rows[0]) return null;\n const secret = String((rows[0] as any).a2a_secret \|\| \"\");\n return secret \|\| null;\n } catch {\n return null;\n }\n}\n\n/\n Look up an org's A2A secret by its `allowed_domain`.\n * Used on the A2A receiving side: the caller's JWT includes `org_domain`,\n * and the receiver looks up which local org matches that domain to find\n * the secret used to verify the JWT signature.\n /\nexport async function getA2ASecretByDomain(\n domain: string,\n): Promise<string \| null> {\n try {\n const exec = getDbExec();\n const { rows } = await exec.execute({\n sql: `SELECT a2a_secret FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,\n args: [domain.toLowerCase()],\n });\n if (!rows[0]) return null;\n const secret = String((rows[0] as any).a2a_secret \|\| \"\");\n return secret \|\| null;\n } catch {\n return null;\n }\n}\n\n/\n Resolve a local org by its `allowed_domain`.\n * Used on the A2A receiving side: the caller sends `org_domain` in the JWT,\n * and the receiver looks up which local org matches that domain.\n */\nexport async function resolveOrgByDomain(\n domain: string,\n): Promise<{ orgId: string; orgName: string } \| null> {\n try {\n const exec = getDbExec();\n const { rows } = await exec.execute({\n sql: `SELECT id, name FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,\n args: [domain.toLowerCase()],\n });\n if (!rows[0]) return null;\n return {\n orgId: String((rows[0] as any).id),\n orgName: String((rows[0] as any).name),\n };\n } catch {\n return null;\n }\n}\n"]}
1	+ {"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/org/context.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAGnE,MAAM,aAAa,GAAe;IAChC,KAAK,EAAE,EAAE;IACT,KAAK,EAAE,IAAI;IACX,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,IAAI;CACX,CAAC;AAEF,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ;QACjE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAAkC,EAClC,KAAa,EACb,WAA4B;IAE5B,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,oEAAoE;YACzE,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAQ,CAAC;QAC3B,OAAO,MAAM,CAAC,GAAG,EAAE,WAAW,IAAI,GAAG,EAAE,WAAW,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAChD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,MAAM,GAAG,GAAW,EAAE,CAC1B,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAc;IAChD,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,GAAG,GAAG,KAAK,CAAC,OAEjB,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC;AACxE,CAAC;AASD,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AACxD,MAAM,4BAA4B,GAAG,2BAA2B,CAAC;AAIjE,SAAS,4BAA4B,CACnC,KAAc,EACd,KAAa;IAEb,MAAM,GAAG,GAAG,KAAK,CAAC,OAAkC,CAAC;IACrD,MAAM,KAAK,GAAG,CAAE,GAAG,CAAC,4BAA4B,CAElC;QACZ,CAAC,GAAG,CAAC,4BAA4B,CAAC,GAAG,IAAI,GAAG,EAGzC,CAAC,CAA2C,CAAC;IAClD,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,cAAc,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YAC9D,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/C,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI;gBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACjD,OAAO,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAC9B,KAAc,EACd,IAAkC,EAClC,KAAa;IAEb,MAAM,GAAG,GAAG,KAAK,CAAC,OAAkC,CAAC;IACrD,MAAM,KAAK,GAAG,CAAE,GAAG,CAAC,qBAAqB,CAE3B;QACZ,CAAC,GAAG,CAAC,qBAAqB,CAAC,GAAG,IAAI,GAAG,EAGlC,CAAC,CAAiD,CAAC;IACxD,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,yBAAyB,CAChC,KAAc,EACd,KAAa,EACb,WAAmC;IAEnC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAkC,CAAC;IACrD,MAAM,KAAK,GAAG,GAAG,CAAC,qBAAqB,CAE1B,CAAC;IACd,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAAc;IACrD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,aAAa,CAAC;IACjC,MAAM,YAAY,GAChB,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE;QACvD,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE;QACtB,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,cAAc,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzD,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IAEzB,IAAI,WAAW,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACpE,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,YAAY;gBACnB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,cAAc;aACrB,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,4BAA4B,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1E,MAAM,gBAAgB,GAAG,gBAAgB,EAAE,KAAK,KAAK,IAAI,CAAC;IAE1D,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACzC,0EAA0E;IAC1E,8EAA8E;IAC9E,wEAAwE;IACxE,2EAA2E;IAC3E,MAAM,uBAAuB,GAC3B,CAAC,gBAAgB;QACjB,WAAW,KAAK,IAAI;QACpB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,WAAW,EAAE,KAAK,WAAW,CAAC,CAAC;IAE3E,IACE,CAAC,gBAAgB;QACjB,gBAAgB,EAAE,KAAK;QACvB,CAAC,uBAAuB,EACxB,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,GAAG,YAAY;QACpC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC;QACnD,CAAC,CAAC,IAAI,CAAC;IAET,IAAI,uBAAuB,EAAE,CAAC;QAC5B,MAAM,qBAAqB,GAAG,WAAW,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,KAAK,EAAE;YACrD,iBAAiB,EAAE,OAAO;SAC3B,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;QACpD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACrD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,WAAW,GAAG,SAAS,CAAC;gBACxB,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YACrD,CAAC;YAED,MAAM,YAAY,GAChB,gBAAgB,EAAE,KAAK;gBACvB,YAAY;gBACZ,qBAAqB,CAAC,CAAC,CAAC,EAAE,KAAK;gBAC/B,IAAI,CAAC;YACP,MAAM,cAAc,GAClB,CAAC,gBAAgB;gBACjB,CAAC,YAAY,KAAK,IAAI;oBACpB,CAAC,MAAM,oBAAoB,CACzB,IAAI,EACJ,YAAY,EACZ,qBAAqB,CACtB,CAAC,CAAC,CAAC;YAER,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;gBACrE,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC;gBAChE,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO;wBACL,KAAK;wBACL,KAAK,EAAE,MAAM,CAAC,KAAK;wBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;qBAClB,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,gBAAgB,EAAE,KAAK,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,MAAM,GACV,iBAAiB,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC;QACzE,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC;QACJ,CAAC;QACD,OAAO;YACL,KAAK;YACL,KAAK,EAAE,YAAY;YACnB,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,cAAc;SACrB,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,2BAA2B,EAAE,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,4EAA4E;QAC5E,uEAAuE;IACzE,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,OAAO;QACL,KAAK;QACL,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK;QAC3B,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO;QAC/B,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;KAC1B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,IAAkC,EAClC,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE;;;;qCAI0B;YAC/B,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SAC5B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE;YACzB,MAAM,MAAM,GAAG,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,cAAc,CAAC;YACnD,OAAO;gBACL,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;gBAClC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAY;gBAC/B,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC;gBACxC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;aAC9C,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAa;IAEb,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,uDAAuD;YAC5D,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SAC5B,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACnD,MAAM,gBAAgB,GAAG,CAAC,MAAM,cAAc,CAC5C,KAAK,EACL,eAAe,CAChB,CAAqB,CAAC;QACvB,IAAI,gBAAgB,EAAE,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAClD,IAAI,gBAAgB,EAAE,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YACpE,OAAO,gBAAgB,CAAC,KAAK,CAAC;QAChC,CAAC;QACD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAAc,EACd,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1D,MAAM,gBAAgB,GAAG,MAAM,4BAA4B,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1E,IAAI,gBAAgB,EAAE,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAClD,IACE,gBAAgB,EAAE,KAAK;YACvB,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,KAAK,CAAC,EAC3D,CAAC;YACD,OAAO,gBAAgB,CAAC,KAAK,CAAC;QAChC,CAAC;QACD,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,KAAa,EACb,IAAI,GAAY,OAAO;IAQvB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;IACpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAExD,MAAM,IAAI,CAAC,OAAO,CAAC;QACjB,GAAG,EAAE,iGAAiG;QACtG,IAAI,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC;KACrD,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,OAAO,CAAC;QACjB,GAAG,EAAE,qFAAqF;QAC1F,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC;KAC7C,CAAC,CAAC;IAEH,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IAE5D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,cAAc,CACrB,KAAa,EACb,OAAiC;IAEjC,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACnC,IAAI,IAAI;QAAE,OAAO,GAAG,IAAI,cAAc,CAAC;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,MAAM,GACV,OAAO;SACJ,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAClD,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACvB,OAAO,GAAG,MAAM,cAAc,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAAkC,EAClC,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,qFAAqF;YAC1F,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SAC5B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,0DAA0D;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,IAAkC,EAClC,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,qEAAqE;YAC1E,IAAI,EAAE,CAAC,MAAM,CAAC;SACf,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;sDAIsD;AACtD,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,UAAU,mBAAmB,CAChC,IAAkC,EAClC,KAAa,EACb,OAAiC;IAEjC,sEAAsE;IACtE,mEAAmE;IACnE,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAE7C,MAAM,QAAQ,GAAG,KAAK,KAAK,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAE9D,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvD,sEAAsE;IACtE,qEAAqE;IACrE,mEAAmE;IACnE,yDAAyD;IACzD,IAAI,MAAM,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,GAAG,EAAE,kFAAkF;YACvF,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC;SACnC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,GAAG,EAAE,qFAAqF;YAC1F,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;SAC7C,CAAC,CAAC;QAEH,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAExD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,IAAkC,EAClC,QAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,GAAG,EAAE,gEAAgE;YACrE,IAAI,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC;SACnD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,mDAAmD;QACnD,EAAE;QACF,2DAA2D;QAC3D,iEAAiE;QACjE,iEAAiE;QACjE,kEAAkE;QAClE,iEAAiE;QACjE,0DAA0D;QAC1D,gEAAgE;QAChE,uEAAuE;QACvE,yBAAyB;QACzB,MAAM,cAAc,GAAG,GAAG,GAAG,YAAY,CAAC;QAC1C,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC;YACjC,GAAG,EAAE,iFAAiF;YACtF,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC;SACnE,CAAC,CAA8B,CAAC;QACjC,OAAO,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,IAAkC,EAClC,QAAgB;IAEhB,+DAA+D;IAC/D,qEAAqE;IACrE,kDAAkD;IAClD,MAAM,IAAI;SACP,OAAO,CAAC,EAAE,GAAG,EAAE,oCAAoC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;SACxE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAa;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,+DAA+D;YACpE,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;QAC7D,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,2DAA2D;YAChE,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzD,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,8EAA8E;YACnF,IAAI,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzD,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,4EAA4E;YACjF,IAAI,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO;YACL,KAAK,EAAE,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,IAAI,CAAC;SACvC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\n\nimport { getDbExec } from \"../db/client.js\";\nimport { getSession } from \"../server/auth.js\";\nimport { getSetting } from \"../settings/store.js\";\nimport { getUserSetting, putUserSetting } from \"../settings/user-settings.js\";\nimport { autoJoinDomainMatchingOrgs } from \"./auto-join-domain.js\";\nimport type { OrgContext, OrgRole } from \"./types.js\";\n\nconst EMPTY_CONTEXT: OrgContext = {\n email: \"\",\n orgId: null,\n orgName: null,\n role: null,\n};\n\nfunction normalizeOrgRole(value: unknown): OrgRole \| null {\n return value === \"owner\" \|\| value === \"admin\" \|\| value === \"member\"\n ? value\n : null;\n}\n\nfunction emailDomainOf(email: string): string \| null {\n return email.split(\"@\")[1]?.toLowerCase() \|\| null;\n}\n\n/*\n A workspace the user owns that nobody else has joined is a default/personal\n * workspace whatever it happens to be named, so moving the user into their\n * company org is safe. An org with other members is a team they deliberately\n * belong to — join the domain org in the background but leave them there.\n /\nasync function isSoloOwnedWorkspace(\n exec: ReturnType<typeof getDbExec>,\n orgId: string,\n memberships: MembershipRow[],\n): Promise<boolean> {\n const membership = memberships.find((m) => m.orgId === orgId);\n if (!membership \|\| membership.role !== \"owner\") return false;\n try {\n const { rows } = await exec.execute({\n sql: `SELECT COUNT() AS \"memberCount\" FROM org_members WHERE org_id = ?`,\n args: [orgId],\n });\n const row = rows[0] as any;\n return Number(row?.memberCount ?? row?.membercount ?? 0) <= 1;\n } catch {\n return false;\n }\n}\n\nfunction autoCreateDefaultOrgEnabled(): boolean {\n const raw = process.env.AUTO_CREATE_DEFAULT_ORG;\n if (raw === undefined \|\| raw.trim() === \"\") return true;\n return ![\"0\", \"false\", \"no\", \"off\"].includes(raw.trim().toLowerCase());\n}\n\nconst nanoid = (): string =>\n globalThis.crypto?.randomUUID?.().replace(/-/g, \"\") ??\n Math.random().toString(36).slice(2) + Date.now().toString(36);\n\n/*\n Resolve the current user's organization context from their session.\n \n - Honors the user's `active-org-id` setting, including an explicit Personal\n * context represented by `{ orgId: null }`.\n * - Falls back to the user's first membership.\n * - When the authenticated user has zero memberships, provisions a default org\n * named after the user ({name}'s workspace, falling back to the email\n * local-part). Set `AUTO_CREATE_DEFAULT_ORG=0` to opt out.\n \n Per-request memoized on `event.context` — mirrors the `getSession`\n * pattern so multiple callers in the same request (e.g. ssr-handler +\n * a loader) share a single org_members round trip.\n /\nexport async function getOrgContext(event: H3Event): Promise<OrgContext> {\n // Per-request memoization. Multiple call sites per request (action wrappers,\n // SSR handler, loaders) must not each pay a separate org_members query.\n const ctx = event.context as {\n __anOrgContextCache?: Promise<OrgContext>;\n };\n return (ctx.__anOrgContextCache ??= resolveOrgContextUncached(event));\n}\n\ntype MembershipRow = {\n orgId: string;\n role: OrgRole;\n orgName: string;\n allowedDomain: string \| null;\n};\n\nconst MEMBERSHIPS_CACHE_KEY = \"__anOrgMembershipsCache\";\nconst ACTIVE_ORG_SETTING_CACHE_KEY = \"__anActiveOrgSettingCache\";\n\ntype ActiveOrgSetting = { orgId: string \| null } \| null;\n\nfunction loadActiveOrgSettingForEvent(\n event: H3Event,\n email: string,\n): Promise<ActiveOrgSetting> {\n const ctx = event.context as Record<string, unknown>;\n const cache = ((ctx[ACTIVE_ORG_SETTING_CACHE_KEY] as\n \| Map<string, Promise<ActiveOrgSetting>>\n \| undefined) ??\n (ctx[ACTIVE_ORG_SETTING_CACHE_KEY] = new Map<\n string,\n Promise<ActiveOrgSetting>\n >())) as Map<string, Promise<ActiveOrgSetting>>;\n const normalizedEmail = email.toLowerCase();\n let promise = cache.get(normalizedEmail);\n if (!promise) {\n promise = getUserSetting(email, \"active-org-id\").then((value) => {\n if (!value \|\| !(\"orgId\" in value)) return null;\n if (value.orgId === null) return { orgId: null };\n return typeof value.orgId === \"string\" ? { orgId: value.orgId } : null;\n });\n cache.set(normalizedEmail, promise);\n }\n return promise;\n}\n\n/\n Per-request memoization of the org_members lookup, keyed by email on\n * `event.context`. Both the session org backfill (inside `getSession`) and\n * `getOrgContext` need the membership rows; without sharing, every request\n * whose session lacks an orgId pays the query twice.\n /\nfunction loadMembershipsForEvent(\n event: H3Event,\n exec: ReturnType<typeof getDbExec>,\n email: string,\n): Promise<MembershipRow[] \| null> {\n const ctx = event.context as Record<string, unknown>;\n const cache = ((ctx[MEMBERSHIPS_CACHE_KEY] as\n \| Map<string, Promise<MembershipRow[] \| null>>\n \| undefined) ??\n (ctx[MEMBERSHIPS_CACHE_KEY] = new Map<\n string,\n Promise<MembershipRow[] \| null>\n >())) as Map<string, Promise<MembershipRow[] \| null>>;\n let promise = cache.get(email);\n if (!promise) {\n promise = loadMemberships(exec, email);\n cache.set(email, promise);\n }\n return promise;\n}\n\nfunction updateMembershipsForEvent(\n event: H3Event,\n email: string,\n memberships: MembershipRow[] \| null,\n): void {\n const ctx = event.context as Record<string, unknown>;\n const cache = ctx[MEMBERSHIPS_CACHE_KEY] as\n \| Map<string, Promise<MembershipRow[] \| null>>\n \| undefined;\n cache?.set(email, Promise.resolve(memberships));\n}\n\nasync function resolveOrgContextUncached(event: H3Event): Promise<OrgContext> {\n const session = await getSession(event);\n const email = session?.email;\n if (!email) return EMPTY_CONTEXT;\n const sessionOrgId =\n typeof session.orgId === \"string\" && session.orgId.trim()\n ? session.orgId.trim()\n : null;\n const sessionOrgRole = normalizeOrgRole(session.orgRole);\n\n const exec = getDbExec();\n\n let memberships = await loadMembershipsForEvent(event, exec, email);\n if (memberships === null) {\n if (sessionOrgId) {\n return {\n email,\n orgId: sessionOrgId,\n orgName: null,\n role: sessionOrgRole,\n };\n }\n return { email, orgId: null, orgName: null, role: null };\n }\n\n const activeOrgSetting = await loadActiveOrgSettingForEvent(event, email);\n const explicitPersonal = activeOrgSetting?.orgId === null;\n\n const emailDomain = emailDomainOf(email);\n // Membership in a domain-matched org is the only durable \"already joined\"\n // signal. Recognizing the personal workspace by its name* instead breaks the\n // moment the provider display name or the workspace name changes, which\n // strands an existing user in Personal with no way into their company org.\n const shouldTryDomainAutoJoin =\n !explicitPersonal &&\n emailDomain !== null &&\n !memberships.some((m) => m.allowedDomain?.toLowerCase() === emailDomain);\n\n if (\n !explicitPersonal &&\n activeOrgSetting?.orgId &&\n !shouldTryDomainAutoJoin\n ) {\n const active = memberships.find((m) => m.orgId === activeOrgSetting.orgId);\n if (active) {\n return {\n email,\n orgId: active.orgId,\n orgName: active.orgName,\n role: active.role,\n };\n }\n }\n\n const sessionMembership = sessionOrgId\n ? memberships.find((m) => m.orgId === sessionOrgId)\n : null;\n\n if (shouldTryDomainAutoJoin) {\n const membershipsBeforeJoin = memberships;\n const joined = await autoJoinDomainMatchingOrgs(email, {\n activateJoinedOrg: \"never\",\n });\n const joinedOrgId = joined.joined[0]?.orgId ?? null;\n if (joinedOrgId) {\n const refreshed = await loadMemberships(exec, email);\n if (refreshed !== null) {\n memberships = refreshed;\n updateMembershipsForEvent(event, email, refreshed);\n }\n\n const currentOrgId =\n activeOrgSetting?.orgId ??\n sessionOrgId ??\n membershipsBeforeJoin[0]?.orgId ??\n null;\n const shouldActivate =\n !explicitPersonal &&\n (currentOrgId === null \|\|\n (await isSoloOwnedWorkspace(\n exec,\n currentOrgId,\n membershipsBeforeJoin,\n )));\n\n if (shouldActivate) {\n await putUserSetting(email, \"active-org-id\", { orgId: joinedOrgId });\n const active = memberships.find((m) => m.orgId === joinedOrgId);\n if (active) {\n return {\n email,\n orgId: active.orgId,\n orgName: active.orgName,\n role: active.role,\n };\n }\n }\n }\n }\n\n if (explicitPersonal) {\n return { email, orgId: null, orgName: null, role: null };\n }\n\n if (activeOrgSetting?.orgId) {\n const active = memberships.find((m) => m.orgId === activeOrgSetting.orgId);\n if (active) {\n return {\n email,\n orgId: active.orgId,\n orgName: active.orgName,\n role: active.role,\n };\n }\n }\n\n if (sessionOrgId) {\n const active =\n sessionMembership ?? memberships.find((m) => m.orgId === sessionOrgId);\n if (active) {\n return {\n email,\n orgId: active.orgId,\n orgName: active.orgName,\n role: active.role,\n };\n }\n return {\n email,\n orgId: sessionOrgId,\n orgName: null,\n role: sessionOrgRole,\n };\n }\n\n if (memberships.length === 0 && autoCreateDefaultOrgEnabled()) {\n const created = await tryCreateDefaultOrg(exec, email, session);\n if (created) return created;\n // Creation failed (race / DB error); fall through with an empty org context\n // so non-blocking invite/domain UI can still surface recovery options.\n }\n\n if (memberships.length === 0) {\n return { email, orgId: null, orgName: null, role: null };\n }\n\n return {\n email,\n orgId: memberships[0].orgId,\n orgName: memberships[0].orgName,\n role: memberships[0].role,\n };\n}\n\nasync function loadMemberships(\n exec: ReturnType<typeof getDbExec>,\n email: string,\n): Promise<MembershipRow[] \| null> {\n try {\n const { rows } = await exec.execute({\n sql: `SELECT m.org_id AS \"orgId\", m.role AS role, o.name AS \"orgName\",\n o.allowed_domain AS \"allowedDomain\"\n FROM org_members m\n INNER JOIN organizations o ON m.org_id = o.id\n WHERE LOWER(m.email) = ?`,\n args: [email.toLowerCase()],\n });\n return rows.map((r: any) => {\n const domain = r.allowedDomain ?? r.allowed_domain;\n return {\n orgId: String(r.orgId ?? r.org_id),\n role: String(r.role) as OrgRole,\n orgName: String(r.orgName ?? r.org_name),\n allowedDomain: domain ? String(domain) : null,\n };\n });\n } catch {\n // Tables may not exist yet on first boot before migrations finish.\n return null;\n }\n}\n\n/*\n Resolve the active org ID for a given email — for non-HTTP contexts like\n * the integration webhook handler where we have an email but no event/session.\n * Picks the user's active-org-id setting if set, including explicit Personal,\n * otherwise the first membership.\n * Returns null if the user has no memberships.\n /\nexport async function resolveOrgIdForEmail(\n email: string,\n): Promise<string \| null> {\n const exec = getDbExec();\n if (!exec) return null;\n try {\n const { rows } = await exec.execute({\n sql: `SELECT org_id FROM org_members WHERE LOWER(email) = ?`,\n args: [email.toLowerCase()],\n });\n if (rows.length === 0) return null;\n const ids = rows.map((r: any) => String(r.org_id));\n const activeOrgSetting = (await getUserSetting(\n email,\n \"active-org-id\",\n )) as ActiveOrgSetting;\n if (activeOrgSetting?.orgId === null) return null;\n if (activeOrgSetting?.orgId && ids.includes(activeOrgSetting.orgId)) {\n return activeOrgSetting.orgId;\n }\n return ids[0];\n } catch {\n return null;\n }\n}\n\n/\n Event-aware variant of `resolveOrgIdForEmail` for HTTP request paths.\n * Shares the per-request membership lookup with `getOrgContext`, so the\n * session org backfill inside `getSession` and a later `getOrgContext` call\n * in the same request pay ONE org_members round trip, not two.\n /\nexport async function resolveOrgIdForEmailViaEvent(\n event: H3Event,\n email: string,\n): Promise<string \| null> {\n try {\n const exec = getDbExec();\n if (!exec) return null;\n const memberships = await loadMembershipsForEvent(event, exec, email);\n if (!memberships \|\| memberships.length === 0) return null;\n const activeOrgSetting = await loadActiveOrgSettingForEvent(event, email);\n if (activeOrgSetting?.orgId === null) return null;\n if (\n activeOrgSetting?.orgId &&\n memberships.some((m) => m.orgId === activeOrgSetting.orgId)\n ) {\n return activeOrgSetting.orgId;\n }\n return memberships[0].orgId;\n } catch {\n return null;\n }\n}\n\n/\n Create a new organization and add the caller as a member with the given\n * role. Generates a per-org A2A secret for cross-app delegation and writes\n * the caller's `active-org-id` user-setting so the new org is immediately\n * active.\n \n /\nexport async function createOrganization(\n name: string,\n email: string,\n role: OrgRole = \"owner\",\n): Promise<{\n id: string;\n name: string;\n role: OrgRole;\n a2aSecret: string;\n createdAt: number;\n}> {\n const trimmedName = name.trim();\n const exec = getDbExec();\n const id = nanoid();\n const createdAt = Date.now();\n const { randomBytes } = await import(\"node:crypto\");\n const a2aSecret = randomBytes(32).toString(\"base64url\");\n\n await exec.execute({\n sql: `INSERT INTO organizations (id, name, created_by, created_at, a2a_secret) VALUES (?, ?, ?, ?, ?)`,\n args: [id, trimmedName, email, createdAt, a2aSecret],\n });\n\n await exec.execute({\n sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,\n args: [nanoid(), id, email, role, createdAt],\n });\n\n await putUserSetting(email, \"active-org-id\", { orgId: id });\n\n return { id, name: trimmedName, role, a2aSecret, createdAt };\n}\n\nfunction defaultOrgName(\n email: string,\n session: { name?: string } \| null,\n): string {\n const full = session?.name?.trim();\n if (full) return `${full}'s workspace`;\n const local = email.split(\"@\")[0] ?? email;\n const cleaned = local.replace(/[._-]+/g, \" \").trim();\n const titled =\n cleaned\n .split(\" \")\n .filter(Boolean)\n .map((w) => w.charAt(0).toUpperCase() + w.slice(1))\n .join(\" \") \|\| \"My\";\n return `${titled}'s workspace`;\n}\n\n/*\n Check whether the user has a pending invitation. If so, auto-create\n * MUST be skipped — otherwise we'd provision a personal org for them\n * before they ever see the inviter's org in the invitation banner, and they'd\n * never join the team that invited them.\n /\nasync function hasPendingInvitation(\n exec: ReturnType<typeof getDbExec>,\n email: string,\n): Promise<boolean> {\n try {\n const { rows } = await exec.execute({\n sql: `SELECT 1 FROM org_invitations WHERE LOWER(email) = ? AND status = 'pending' LIMIT 1`,\n args: [email.toLowerCase()],\n });\n return rows.length > 0;\n } catch {\n // If we can't tell, err on the side of NOT auto-creating — the\n // invitation banner or team UI can surface the situation.\n return true;\n }\n}\n\nasync function hasDomainMatch(\n exec: ReturnType<typeof getDbExec>,\n email: string,\n): Promise<boolean> {\n try {\n const domain = email.split(\"@\")[1]?.toLowerCase();\n if (!domain) return false;\n const { rows } = await exec.execute({\n sql: `SELECT 1 FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,\n args: [domain],\n });\n return rows.length > 0;\n } catch {\n return false;\n }\n}\n\n/* Stale-claim threshold. A claim row this old is treated as abandoned\n * (process crashed, DELETE failed, etc.) and a new caller may take it\n * over. Long enough that two genuine concurrent first-loads don't\n * trample each other (those settle in milliseconds), short enough that\n * a stuck user recovers on their next navigation. /\nconst CLAIM_TTL_MS = 5 60 * 1000;\n\n/*\n Attempt to provision a default org + owner membership for a user with\n * zero memberships.\n \n Race protection: claims the user's auto-create slot via an atomic\n * INSERT into the framework `settings` table (PRIMARY KEY (key) — so\n * concurrent inserts for the same key throw uniqueness violations on\n * both SQLite and Postgres). Only the request that wins the claim\n * proceeds to create the org; losers bail. By the time a losing\n * request retries on a subsequent navigation, the winner's org is in\n * `org_members` and the auto-create branch is skipped entirely.\n \n Stuck-state recovery: a stale claim (held longer than CLAIM_TTL_MS)\n * is reclaimed automatically. So even if the DELETE on the failure\n * path fails (network blip, DB error), the user isn't stranded — the\n * next request after the TTL elapses retries cleanly.\n \n Returns null on any failure so the caller can fall back to the\n * empty-context / client-guard path.\n /\nasync function tryCreateDefaultOrg(\n exec: ReturnType<typeof getDbExec>,\n email: string,\n session: { name?: string } \| null,\n): Promise<OrgContext \| null> {\n // Make sure the framework `settings` table exists before we use it as\n // a claim primitive. getSetting() ensures the table on first call.\n await getSetting(\"__init\").catch(() => null);\n\n const claimKey = `u:${email.toLowerCase()}:auto-create-claim`;\n\n if (!(await acquireClaim(exec, claimKey))) return null;\n\n // Pending-invite check happens INSIDE the claim so the window where a\n // newly-arrived invitation can be missed is narrowed to a single SQL\n // round-trip. (A still-narrower window would require a transaction\n // spanning org_invitations and settings — out of scope.)\n if (await hasPendingInvitation(exec, email)) {\n await releaseClaim(exec, claimKey);\n return null;\n }\n\n if (await hasDomainMatch(exec, email)) {\n await releaseClaim(exec, claimKey);\n return null;\n }\n\n try {\n const orgId = nanoid();\n const orgName = defaultOrgName(email, session);\n const now = Date.now();\n\n await exec.execute({\n sql: `INSERT INTO organizations (id, name, created_by, created_at) VALUES (?, ?, ?, ?)`,\n args: [orgId, orgName, email, now],\n });\n await exec.execute({\n sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,\n args: [nanoid(), orgId, email, \"owner\", now],\n });\n\n await putUserSetting(email, \"active-org-id\", { orgId });\n\n return { email, orgId, orgName, role: \"owner\" };\n } catch {\n await releaseClaim(exec, claimKey);\n return null;\n }\n}\n\nasync function acquireClaim(\n exec: ReturnType<typeof getDbExec>,\n claimKey: string,\n): Promise<boolean> {\n const now = Date.now();\n try {\n await exec.execute({\n sql: `INSERT INTO settings (key, value, updated_at) VALUES (?, ?, ?)`,\n args: [claimKey, JSON.stringify({ at: now }), now],\n });\n return true;\n } catch {\n // Conflict — someone else's claim is already in the row. If it's\n // stale (older than CLAIM_TTL_MS) we take it over.\n //\n // CRITICAL: this MUST be a single atomic UPDATE guarded on\n // `updated_at <= staleThreshold`. A read-then-DELETE-then-INSERT\n // sequence lets two concurrent reclaimers each observe the stale\n // timestamp, delete each other's fresh claim, and both think they\n // won — duplicating org creation. The conditional UPDATE matches\n // each stale row at most once: only the first writer sees\n // rowsAffected === 1; the row's updated_at is now `now`, so any\n // subsequent UPDATE no longer satisfies `updated_at <= staleThreshold`\n // and matches zero rows.\n const staleThreshold = now - CLAIM_TTL_MS;\n const result = (await exec.execute({\n sql: `UPDATE settings SET value = ?, updated_at = ? WHERE key = ? AND updated_at <= ?`,\n args: [JSON.stringify({ at: now }), now, claimKey, staleThreshold],\n })) as { rowsAffected?: number };\n return (result.rowsAffected ?? 0) > 0;\n }\n}\n\nasync function releaseClaim(\n exec: ReturnType<typeof getDbExec>,\n claimKey: string,\n): Promise<void> {\n // Best-effort. If this fails (transient network/DB error), the\n // CLAIM_TTL_MS-based takeover in acquireClaim recovers automatically\n // on a future request — no permanent stuck state.\n await exec\n .execute({ sql: `DELETE FROM settings WHERE key = ?`, args: [claimKey] })\n .catch(() => {});\n}\n\n/\n Look up the `allowed_domain` for an org by its ID.\n * Used when making outbound A2A calls so the JWT includes the\n * caller's org domain for cross-app org resolution.\n /\nexport async function getOrgDomain(orgId: string): Promise<string \| null> {\n try {\n const exec = getDbExec();\n const { rows } = await exec.execute({\n sql: `SELECT allowed_domain FROM organizations WHERE id = ? LIMIT 1`,\n args: [orgId],\n });\n if (!rows[0]) return null;\n const domain = String((rows[0] as any).allowed_domain \|\| \"\");\n return domain \|\| null;\n } catch {\n return null;\n }\n}\n\n/\n Look up the org's A2A secret by org ID.\n * Used when making outbound A2A calls so the JWT is signed with the\n * org-specific secret rather than the global A2A_SECRET env var.\n /\nexport async function getOrgA2ASecret(orgId: string): Promise<string \| null> {\n try {\n const exec = getDbExec();\n const { rows } = await exec.execute({\n sql: `SELECT a2a_secret FROM organizations WHERE id = ? LIMIT 1`,\n args: [orgId],\n });\n if (!rows[0]) return null;\n const secret = String((rows[0] as any).a2a_secret \|\| \"\");\n return secret \|\| null;\n } catch {\n return null;\n }\n}\n\n/\n Look up an org's A2A secret by its `allowed_domain`.\n * Used on the A2A receiving side: the caller's JWT includes `org_domain`,\n * and the receiver looks up which local org matches that domain to find\n * the secret used to verify the JWT signature.\n /\nexport async function getA2ASecretByDomain(\n domain: string,\n): Promise<string \| null> {\n try {\n const exec = getDbExec();\n const { rows } = await exec.execute({\n sql: `SELECT a2a_secret FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,\n args: [domain.toLowerCase()],\n });\n if (!rows[0]) return null;\n const secret = String((rows[0] as any).a2a_secret \|\| \"\");\n return secret \|\| null;\n } catch {\n return null;\n }\n}\n\n/\n Resolve a local org by its `allowed_domain`.\n * Used on the A2A receiving side: the caller sends `org_domain` in the JWT,\n * and the receiver looks up which local org matches that domain.\n */\nexport async function resolveOrgByDomain(\n domain: string,\n): Promise<{ orgId: string; orgName: string } \| null> {\n try {\n const exec = getDbExec();\n const { rows } = await exec.execute({\n sql: `SELECT id, name FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,\n args: [domain.toLowerCase()],\n });\n if (!rows[0]) return null;\n return {\n orgId: String((rows[0] as any).id),\n orgName: String((rows[0] as any).name),\n };\n } catch {\n return null;\n }\n}\n"]}

package/dist/org/index.d.ts CHANGED Viewed

@@ -1,6 +1,7 @@
 export type { OrgRole, OrgContext, OrgSummary, OrgInvitationSummary, OrgInfo, OrgMember, OrgPendingInvitation, } from "./types.js";
 export { canInviteOrgMembers, canManageOrg, canManageOrgDomain, orgRoleAtLeast, orgRoleRank, } from "./permissions.js";
 export { getOrgContext, getOrgDomain, getOrgA2ASecret, getA2ASecretByDomain, resolveOrgByDomain, resolveOrgIdForEmail, createOrganization, } from "./context.js";
+export { implicitServiceOrgRole, parseServiceIdentityEmail, } from "./service-identity.js";
 export { acceptPendingInvitationsForEmail } from "./accept-pending.js";
 export type { AcceptPendingResult } from "./accept-pending.js";
 export { autoJoinDomainMatchingOrgs } from "./auto-join-domain.js";

package/dist/org/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/org/index.ts"],"names":[],"mappings":"AAEA,YAAY,EACV,OAAO,EACP,UAAU,EACV,UAAU,EACV,oBAAoB,EACpB,OAAO,EACP,SAAS,EACT,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,aAAa,EACb,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AACvE,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,YAAY,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAElE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAIhE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAIxE,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/org/index.ts"],"names":[],"mappings":"AAEA,YAAY,EACV,OAAO,EACP,UAAU,EACV,UAAU,EACV,oBAAoB,EACpB,OAAO,EACP,SAAS,EACT,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,aAAa,EACb,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AACvE,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,YAAY,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAElE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAIhE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAIxE,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/org/index.js CHANGED Viewed

@@ -1,6 +1,7 @@
 // Public API for the org module.
 export { canInviteOrgMembers, canManageOrg, canManageOrgDomain, orgRoleAtLeast, orgRoleRank, } from "./permissions.js";
 export { getOrgContext, getOrgDomain, getOrgA2ASecret, getA2ASecretByDomain, resolveOrgByDomain, resolveOrgIdForEmail, createOrganization, } from "./context.js";
+export { implicitServiceOrgRole, parseServiceIdentityEmail, } from "./service-identity.js";
 export { acceptPendingInvitationsForEmail } from "./accept-pending.js";
 export { autoJoinDomainMatchingOrgs } from "./auto-join-domain.js";
 export { ORG_MIGRATIONS } from "./migrations.js";

package/dist/org/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/org/index.ts"],"names":[],"mappings":"AAAA,iCAAiC;AAYjC,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,aAAa,EACb,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AAGvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAGnE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEhE,2EAA2E;AAC3E,wDAAwD;AACxD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAExE,8EAA8E;AAC9E,qDAAqD;AACrD,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC","sourcesContent":["// Public API for the org module.\n\nexport type {\n OrgRole,\n OrgContext,\n OrgSummary,\n OrgInvitationSummary,\n OrgInfo,\n OrgMember,\n OrgPendingInvitation,\n} from \"./types.js\";\n\nexport {\n canInviteOrgMembers,\n canManageOrg,\n canManageOrgDomain,\n orgRoleAtLeast,\n orgRoleRank,\n} from \"./permissions.js\";\n\nexport {\n getOrgContext,\n getOrgDomain,\n getOrgA2ASecret,\n getA2ASecretByDomain,\n resolveOrgByDomain,\n resolveOrgIdForEmail,\n createOrganization,\n} from \"./context.js\";\n\nexport { acceptPendingInvitationsForEmail } from \"./accept-pending.js\";\nexport type { AcceptPendingResult } from \"./accept-pending.js\";\n\nexport { autoJoinDomainMatchingOrgs } from \"./auto-join-domain.js\";\nexport type { AutoJoinDomainResult } from \"./auto-join-domain.js\";\n\nexport { ORG_MIGRATIONS } from \"./migrations.js\";\n\nexport { createOrgPlugin, defaultOrgPlugin } from \"./plugin.js\";\n\n// Drizzle schema (re-exported so templates can write typed queries against\n// org tables without redefining the schema themselves).\nexport { organizations, orgMembers, orgInvitations } from \"./schema.js\";\n\n// Individual handlers — exported so templates can compose a custom org plugin\n// while still using the framework-provided handlers.\nexport {\n getMyOrgHandler,\n createOrgHandler,\n updateOrgHandler,\n switchOrgHandler,\n listMembersHandler,\n removeMemberHandler,\n changeMemberRoleHandler,\n listInvitationsHandler,\n createInvitationHandler,\n acceptInvitationHandler,\n setA2ASecretHandler,\n syncA2ASecretHandler,\n receiveA2ASecretHandler,\n} from \"./handlers.js\";\n\nexport { isFreeEmailProvider } from \"./free-email-providers.js\";\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/org/index.ts"],"names":[],"mappings":"AAAA,iCAAiC;AAYjC,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,aAAa,EACb,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,gCAAgC,EAAE,MAAM,qBAAqB,CAAC;AAGvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAGnE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEhE,2EAA2E;AAC3E,wDAAwD;AACxD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAExE,8EAA8E;AAC9E,qDAAqD;AACrD,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC","sourcesContent":["// Public API for the org module.\n\nexport type {\n OrgRole,\n OrgContext,\n OrgSummary,\n OrgInvitationSummary,\n OrgInfo,\n OrgMember,\n OrgPendingInvitation,\n} from \"./types.js\";\n\nexport {\n canInviteOrgMembers,\n canManageOrg,\n canManageOrgDomain,\n orgRoleAtLeast,\n orgRoleRank,\n} from \"./permissions.js\";\n\nexport {\n getOrgContext,\n getOrgDomain,\n getOrgA2ASecret,\n getA2ASecretByDomain,\n resolveOrgByDomain,\n resolveOrgIdForEmail,\n createOrganization,\n} from \"./context.js\";\n\nexport {\n implicitServiceOrgRole,\n parseServiceIdentityEmail,\n} from \"./service-identity.js\";\n\nexport { acceptPendingInvitationsForEmail } from \"./accept-pending.js\";\nexport type { AcceptPendingResult } from \"./accept-pending.js\";\n\nexport { autoJoinDomainMatchingOrgs } from \"./auto-join-domain.js\";\nexport type { AutoJoinDomainResult } from \"./auto-join-domain.js\";\n\nexport { ORG_MIGRATIONS } from \"./migrations.js\";\n\nexport { createOrgPlugin, defaultOrgPlugin } from \"./plugin.js\";\n\n// Drizzle schema (re-exported so templates can write typed queries against\n// org tables without redefining the schema themselves).\nexport { organizations, orgMembers, orgInvitations } from \"./schema.js\";\n\n// Individual handlers — exported so templates can compose a custom org plugin\n// while still using the framework-provided handlers.\nexport {\n getMyOrgHandler,\n createOrgHandler,\n updateOrgHandler,\n switchOrgHandler,\n listMembersHandler,\n removeMemberHandler,\n changeMemberRoleHandler,\n listInvitationsHandler,\n createInvitationHandler,\n acceptInvitationHandler,\n setA2ASecretHandler,\n syncA2ASecretHandler,\n receiveA2ASecretHandler,\n} from \"./handlers.js\";\n\nexport { isFreeEmailProvider } from \"./free-email-providers.js\";\n"]}

package/dist/org/service-identity.d.ts ADDED Viewed

@@ -0,0 +1,43 @@
+/**
+ * Implicit org membership for synthetic service-token identities.
+ *
+ * Org service tokens authenticate as `svc-<name>@service.<orgId>` and are
+ * deliberately never inserted into `org_members` (see
+ * `mcp/actions/service-token-access.ts`), so any template that authorizes by
+ * looking up a physical membership row rejects them. The ownable/sharing layer
+ * already admits them via the signed `org_id` claim; this closes the gap for
+ * the role-lookup layer.
+ *
+ * Two constraints are load-bearing and must survive future edits:
+ *
+ * 1. The implicit role is always `member`, never admin or owner. Member-gated
+ *    actions (create/read org data) work; admin-gated ones (invite/remove
+ *    members, change roles, org settings, minting further service tokens) stay
+ *    closed, so a leaked service token cannot escalate.
+ * 2. `requestOrgId` must independently agree with the target org. The email
+ *    alone is not proof: a human account registered under a `@service.<orgId>`
+ *    address would otherwise mint itself membership. A signed-in user's request
+ *    org id is membership-derived through `getOrgContext`, so a non-member
+ *    cannot present the target org id, while a service token carries it in its
+ *    signed `org_id` claim.
+ */
+import type { OrgRole } from "./types.js";
+/**
+ * Parse `svc-<name>@service.<orgId>` into its parts, or null when the address
+ * is not a service identity. Counterpart to `serviceIdentityEmail()` in
+ * `mcp/connect-store.ts`.
+ */
+export declare function parseServiceIdentityEmail(email: string | null | undefined): {
+    serviceName: string;
+    orgId: string;
+} | null;
+/**
+ * Resolve the implicit org role for a service-token caller, or null when the
+ * caller is not a service identity acting for the org it was minted against.
+ */
+export declare function implicitServiceOrgRole(params: {
+    email: string | null | undefined;
+    orgId: string | null | undefined;
+    requestOrgId: string | null | undefined;
+}): OrgRole | null;
+//# sourceMappingURL=service-identity.d.ts.map

package/dist/org/service-identity.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"service-identity.d.ts","sourceRoot":"","sources":["../../src/org/service-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAI1C;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQ/C;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAC7C,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACjC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACjC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACzC,GAAG,OAAO,GAAG,IAAI,CAOjB"}

package/dist/org/service-identity.js ADDED Viewed

@@ -0,0 +1,34 @@
+const SERVICE_IDENTITY_PATTERN = /^svc-([a-z0-9-]+)@service\.(.+)$/;
+/**
+ * Parse `svc-<name>@service.<orgId>` into its parts, or null when the address
+ * is not a service identity. Counterpart to `serviceIdentityEmail()` in
+ * `mcp/connect-store.ts`.
+ */
+export function parseServiceIdentityEmail(email) {
+    const trimmed = email?.trim();
+    if (!trimmed)
+        return null;
+    const match = SERVICE_IDENTITY_PATTERN.exec(trimmed.toLowerCase());
+    if (!match)
+        return null;
+    const orgId = trimmed.slice(trimmed.length - match[2].length);
+    if (!orgId)
+        return null;
+    return { serviceName: match[1], orgId };
+}
+/**
+ * Resolve the implicit org role for a service-token caller, or null when the
+ * caller is not a service identity acting for the org it was minted against.
+ */
+export function implicitServiceOrgRole(params) {
+    const orgId = params.orgId?.trim();
+    if (!orgId)
+        return null;
+    if (params.requestOrgId?.trim() !== orgId)
+        return null;
+    const parsed = parseServiceIdentityEmail(params.email);
+    if (!parsed || parsed.orgId !== orgId)
+        return null;
+    return "member";
+}
+//# sourceMappingURL=service-identity.js.map

package/dist/org/service-identity.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"service-identity.js","sourceRoot":"","sources":["../../src/org/service-identity.ts"],"names":[],"mappings":"AAyBA,MAAM,wBAAwB,GAAG,kCAAkC,CAAC;AAEpE;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAgC;IAEhC,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAItC;IACC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,MAAM,GAAG,yBAAyB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["/**\n * Implicit org membership for synthetic service-token identities.\n *\n * Org service tokens authenticate as `svc-<name>@service.<orgId>` and are\n * deliberately never inserted into `org_members` (see\n * `mcp/actions/service-token-access.ts`), so any template that authorizes by\n * looking up a physical membership row rejects them. The ownable/sharing layer\n * already admits them via the signed `org_id` claim; this closes the gap for\n * the role-lookup layer.\n *\n * Two constraints are load-bearing and must survive future edits:\n *\n * 1. The implicit role is always `member`, never admin or owner. Member-gated\n * actions (create/read org data) work; admin-gated ones (invite/remove\n * members, change roles, org settings, minting further service tokens) stay\n * closed, so a leaked service token cannot escalate.\n * 2. `requestOrgId` must independently agree with the target org. The email\n * alone is not proof: a human account registered under a `@service.<orgId>`\n * address would otherwise mint itself membership. A signed-in user's request\n * org id is membership-derived through `getOrgContext`, so a non-member\n * cannot present the target org id, while a service token carries it in its\n * signed `org_id` claim.\n */\nimport type { OrgRole } from \"./types.js\";\n\nconst SERVICE_IDENTITY_PATTERN = /^svc-([a-z0-9-]+)@service\\.(.+)$/;\n\n/**\n * Parse `svc-<name>@service.<orgId>` into its parts, or null when the address\n * is not a service identity. Counterpart to `serviceIdentityEmail()` in\n * `mcp/connect-store.ts`.\n */\nexport function parseServiceIdentityEmail(\n email: string | null | undefined,\n): { serviceName: string; orgId: string } | null {\n const trimmed = email?.trim();\n if (!trimmed) return null;\n const match = SERVICE_IDENTITY_PATTERN.exec(trimmed.toLowerCase());\n if (!match) return null;\n const orgId = trimmed.slice(trimmed.length - match[2].length);\n if (!orgId) return null;\n return { serviceName: match[1], orgId };\n}\n\n/**\n * Resolve the implicit org role for a service-token caller, or null when the\n * caller is not a service identity acting for the org it was minted against.\n */\nexport function implicitServiceOrgRole(params: {\n email: string | null | undefined;\n orgId: string | null | undefined;\n requestOrgId: string | null | undefined;\n}): OrgRole | null {\n const orgId = params.orgId?.trim();\n if (!orgId) return null;\n if (params.requestOrgId?.trim() !== orgId) return null;\n const parsed = parseServiceIdentityEmail(params.email);\n if (!parsed || parsed.orgId !== orgId) return null;\n return \"member\";\n}\n"]}

package/dist/provider-api/actions/custom-provider-registration.d.ts CHANGED Viewed

@@ -75,7 +75,11 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         user: "user";
     }>>;
 }, z.core.$strip>>, {
+    message?: undefined;
+    id?: undefined;
+    provider?: undefined;
     deleted?: undefined;
+    found?: undefined;
     providers: {
         id: string;
         label: string;
@@ -86,48 +90,44 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         updatedAt: number;
     }[];
     count: number;
-    provider?: undefined;
-    found?: undefined;
     registered?: undefined;
-    id?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
-    deleted?: undefined;
+    message?: undefined;
     count?: undefined;
+    id?: undefined;
+    deleted?: undefined;
     providers?: undefined;
     found: boolean;
     provider: import("../custom-registry.js").CustomProviderConfig;
     registered?: undefined;
-    id?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
-    deleted?: undefined;
+    message?: undefined;
     count?: undefined;
-    providers?: undefined;
     provider?: undefined;
+    deleted?: undefined;
+    providers?: undefined;
     found: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
+    message?: undefined;
     count?: undefined;
-    providers?: undefined;
     provider?: undefined;
     found?: undefined;
+    providers?: undefined;
     deleted: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
-    deleted?: undefined;
     count?: undefined;
-    providers?: undefined;
     provider?: undefined;
+    deleted?: undefined;
     found?: undefined;
+    providers?: undefined;
     registered: boolean;
     id: string;
     label: string;