@agent-native/core 0.122.4 → 0.123.0

package/dist/org/context.js

@@ -1,7 +1,9 @@
-import { getDbExec } from "../db/client.js";
+import { warnAgent } from "../agent/action-warnings.js";
+import { getDbExec, isTransientDatabaseError } from "../db/client.js";
 import { getSession } from "../server/auth.js";
 import { getSetting } from "../settings/store.js";
-import { getUserSetting, putUserSetting } from "../settings/user-settings.js";
+import { getUserSetting } from "../settings/user-settings.js";
+import { setActiveOrgId } from "./active-org.js";
 import { autoJoinDomainMatchingOrgs } from "./auto-join-domain.js";
 const EMPTY_CONTEXT = {
     email: "",
@@ -9,6 +11,31 @@ const EMPTY_CONTEXT = {
     orgName: null,
     role: null,
 };
+/**
+ * The single way to read `org_members`, so no two call sites can pick opposite
+ * defaults for the same failure. A transient database failure is NOT an answer
+ * and propagates: a caller that turns it into "no memberships" silently drops
+ * org scope, which hides every org-scoped credential behind a
+ * permanent-sounding "not configured".
+ *
+ * `null` is every non-transient failure, not only the intended one (org tables
+ * absent on a fresh install before migrations). A permanently unreadable table
+ * — a role without SELECT, say — still reports as "no rows" here. Narrowing
+ * that further means classifying "no database configured" as readable-absent,
+ * which is load-bearing for CLI/script/test contexts that legitimately run
+ * without a store; see `assertCredentialStoreReadable`.
+ */
+export async function queryOrgMembers(query) {
+    try {
+        const { rows } = await getDbExec().execute(query);
+        return rows;
+    }
+    catch (err) {
+        if (isTransientDatabaseError(err))
+            throw err;
+        return null;
+    }
+}
 function normalizeOrgRole(value) {
     return value === "owner" || value === "admin" || value === "member"
         ? value
@@ -65,7 +92,12 @@ export async function getOrgContext(event) {
     // Per-request memoization. Multiple call sites per request (action wrappers,
     // SSR handler, loaders) must not each pay a separate org_members query.
     const ctx = event.context;
-    return (ctx.__anOrgContextCache ??= resolveOrgContextUncached(event));
+    // Evict on failure. A memoized failure would otherwise answer every later
+    // caller in this request with the wrong org.
+    return (ctx.__anOrgContextCache ??= resolveOrgContextUncached(event).catch((err) => {
+        delete ctx.__anOrgContextCache;
+        throw err;
+    }));
 }
 const MEMBERSHIPS_CACHE_KEY = "__anOrgMembershipsCache";
 const ACTIVE_ORG_SETTING_CACHE_KEY = "__anActiveOrgSettingCache";
@@ -93,13 +125,18 @@ function loadActiveOrgSettingForEvent(event, email) {
  * `getOrgContext` need the membership rows; without sharing, every request
  * whose session lacks an orgId pays the query twice.
  */
-function loadMembershipsForEvent(event, exec, email) {
+function loadMembershipsForEvent(event, email) {
     const ctx = event.context;
     const cache = (ctx[MEMBERSHIPS_CACHE_KEY] ??
         (ctx[MEMBERSHIPS_CACHE_KEY] = new Map()));
     let promise = cache.get(email);
     if (!promise) {
-        promise = loadMemberships(exec, email);
+        // A failed read is evicted rather than memoized: caching it would make one
+        // transient error answer every later lookup in this request.
+        promise = loadMemberships(email).catch((err) => {
+            cache.delete(email);
+            throw err;
+        });
         cache.set(email, promise);
     }
     return promise;
@@ -119,7 +156,23 @@ async function resolveOrgContextUncached(event) {
         : null;
     const sessionOrgRole = normalizeOrgRole(session.orgRole);
     const exec = getDbExec();
-    let memberships = await loadMembershipsForEvent(event, exec, email);
+    let memberships;
+    try {
+        memberships = await loadMembershipsForEvent(event, email);
+    }
+    catch (err) {
+        // A transient membership read must not downgrade an authenticated request
+        // to a private/solo scope when the session already carries its org.
+        if (sessionOrgId && isTransientDatabaseError(err)) {
+            return {
+                email,
+                orgId: sessionOrgId,
+                orgName: null,
+                role: sessionOrgRole,
+            };
+        }
+        throw err;
+    }
     if (memberships === null) {
         if (sessionOrgId) {
             return {
@@ -164,7 +217,7 @@ async function resolveOrgContextUncached(event) {
         });
         const joinedOrgId = joined.joined[0]?.orgId ?? null;
         if (joinedOrgId) {
-            const refreshed = await loadMemberships(exec, email);
+            const refreshed = await loadMemberships(email);
             if (refreshed !== null) {
                 memberships = refreshed;
                 updateMembershipsForEvent(event, email, refreshed);
@@ -177,7 +230,7 @@ async function resolveOrgContextUncached(event) {
                 (currentOrgId === null ||
                     (await isSoloOwnedWorkspace(exec, currentOrgId, membershipsBeforeJoin)));
             if (shouldActivate) {
-                await putUserSetting(email, "active-org-id", { orgId: joinedOrgId });
+                await setActiveOrgId(email, joinedOrgId, "joined domain-matched org");
                 const active = memberships.find((m) => m.orgId === joinedOrgId);
                 if (active) {
                     return {
@@ -238,61 +291,58 @@ async function resolveOrgContextUncached(event) {
         role: memberships[0].role,
     };
 }
-async function loadMemberships(exec, email) {
-    try {
-        const { rows } = await exec.execute({
-            sql: `SELECT m.org_id AS "orgId", m.role AS role, o.name AS "orgName",
-                   o.allowed_domain AS "allowedDomain"
-            FROM org_members m
-            INNER JOIN organizations o ON m.org_id = o.id
-            WHERE LOWER(m.email) = ?`,
-            args: [email.toLowerCase()],
-        });
-        return rows.map((r) => {
-            const domain = r.allowedDomain ?? r.allowed_domain;
-            return {
-                orgId: String(r.orgId ?? r.org_id),
-                role: String(r.role),
-                orgName: String(r.orgName ?? r.org_name),
-                allowedDomain: domain ? String(domain) : null,
-            };
-        });
-    }
-    catch {
-        // Tables may not exist yet on first boot before migrations finish.
-        return null;
-    }
+/**
+ * Ordering for every membership lookup that falls back to "first membership".
+ * Without it the fallback is whatever order the plan happens to return, so a
+ * multi-org user's active org can change between two identical requests — and
+ * `getSession` then freezes that arbitrary answer into `session.orgId`.
+ * `org_id` breaks ties so two memberships joined in the same millisecond still
+ * resolve identically.
+ */
+const MEMBERSHIP_FALLBACK_ORDER_BY = `ORDER BY joined_at ASC, org_id ASC`;
+async function loadMemberships(email) {
+    const rows = await queryOrgMembers({
+        sql: `SELECT m.org_id AS "orgId", m.role AS role, o.name AS "orgName",
+                 o.allowed_domain AS "allowedDomain"
+          FROM org_members m
+          INNER JOIN organizations o ON m.org_id = o.id
+          WHERE LOWER(m.email) = ?
+          ${MEMBERSHIP_FALLBACK_ORDER_BY}`,
+        args: [email.toLowerCase()],
+    });
+    return (rows?.map((r) => {
+        const domain = r.allowedDomain ?? r.allowed_domain;
+        return {
+            orgId: String(r.orgId ?? r.org_id),
+            role: String(r.role),
+            orgName: String(r.orgName ?? r.org_name),
+            allowedDomain: domain ? String(domain) : null,
+        };
+    }) ?? null);
 }
 /**
  * Resolve the active org ID for a given email — for non-HTTP contexts like
  * the integration webhook handler where we have an email but no event/session.
  * Picks the user's active-org-id setting if set, including explicit Personal,
- * otherwise the first membership.
+ * otherwise the oldest membership.
  * Returns null if the user has no memberships.
  */
 export async function resolveOrgIdForEmail(email) {
-    const exec = getDbExec();
-    if (!exec)
+    const rows = await queryOrgMembers({
+        sql: `SELECT org_id FROM org_members WHERE LOWER(email) = ?
+          ${MEMBERSHIP_FALLBACK_ORDER_BY}`,
+        args: [email.toLowerCase()],
+    });
+    if (!rows?.length)
         return null;
-    try {
-        const { rows } = await exec.execute({
-            sql: `SELECT org_id FROM org_members WHERE LOWER(email) = ?`,
-            args: [email.toLowerCase()],
-        });
-        if (rows.length === 0)
-            return null;
-        const ids = rows.map((r) => String(r.org_id));
-        const activeOrgSetting = (await getUserSetting(email, "active-org-id"));
-        if (activeOrgSetting?.orgId === null)
-            return null;
-        if (activeOrgSetting?.orgId && ids.includes(activeOrgSetting.orgId)) {
-            return activeOrgSetting.orgId;
-        }
-        return ids[0];
-    }
-    catch {
+    const ids = rows.map((r) => String(r.org_id));
+    const activeOrgSetting = (await getUserSetting(email, "active-org-id"));
+    if (activeOrgSetting?.orgId === null)
         return null;
+    if (activeOrgSetting?.orgId && ids.includes(activeOrgSetting.orgId)) {
+        return activeOrgSetting.orgId;
     }
+    return ids[0];
 }
 /**
  * Event-aware variant of `resolveOrgIdForEmail` for HTTP request paths.
@@ -301,25 +351,17 @@ export async function resolveOrgIdForEmail(email) {
  * in the same request pay ONE org_members round trip, not two.
  */
 export async function resolveOrgIdForEmailViaEvent(event, email) {
-    try {
-        const exec = getDbExec();
-        if (!exec)
-            return null;
-        const memberships = await loadMembershipsForEvent(event, exec, email);
-        if (!memberships || memberships.length === 0)
-            return null;
-        const activeOrgSetting = await loadActiveOrgSettingForEvent(event, email);
-        if (activeOrgSetting?.orgId === null)
-            return null;
-        if (activeOrgSetting?.orgId &&
-            memberships.some((m) => m.orgId === activeOrgSetting.orgId)) {
-            return activeOrgSetting.orgId;
-        }
-        return memberships[0].orgId;
-    }
-    catch {
+    const memberships = await loadMembershipsForEvent(event, email);
+    if (!memberships || memberships.length === 0)
         return null;
+    const activeOrgSetting = await loadActiveOrgSettingForEvent(event, email);
+    if (activeOrgSetting?.orgId === null)
+        return null;
+    if (activeOrgSetting?.orgId &&
+        memberships.some((m) => m.orgId === activeOrgSetting.orgId)) {
+        return activeOrgSetting.orgId;
     }
+    return memberships[0].orgId;
 }
 /**
  * Create a new organization and add the caller as a member with the given
@@ -343,9 +385,55 @@ export async function createOrganization(name, email, role = "owner") {
         sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,
         args: [nanoid(), id, email, role, createdAt],
     });
-    await putUserSetting(email, "active-org-id", { orgId: id });
+    await warnOnAdditionalOrganization(exec, email, id, trimmedName);
+    await setActiveOrgId(email, id, `created organization "${trimmedName}"`);
     return { id, name: trimmedName, role, a2aSecret, createdAt };
 }
+/**
+ * A second organization is the single most expensive accident in this codebase:
+ * vault credentials are scoped per organization, so creating one and activating
+ * it orphans every key synced under the previous org, and the only symptom is a
+ * missing-env-var error somewhere else entirely. The UI warns humans before
+ * they click (`org.createOrgVaultNotice`); this covers the path that actually
+ * did the damage — app code or a migration action calling `createOrganization`
+ * directly, where no notice is ever rendered.
+ */
+async function warnOnAdditionalOrganization(exec, email, newOrgId, newOrgName) {
+    try {
+        const { rows } = await exec.execute({
+            sql: `SELECT 1 FROM org_members WHERE LOWER(email) = ? AND org_id <> ? LIMIT 1`,
+            args: [email.toLowerCase(), newOrgId],
+        });
+        if (rows.length === 0)
+            return;
+    }
+    catch {
+        // "Couldn't tell" is not "it didn't" — swallowing the failed probe here made
+        // the function whose entire job is to not be silent, silent.
+        warnAgent({
+            severity: "critical",
+            code: "org-additional-org-membership-unreadable",
+            message: `Created an organization "${newOrgName}" (${newOrgId}) and made it the account's active org, ` +
+                `but could not read whether that account already belonged to another organization. If it did, ` +
+                `every vault credential synced under the previous organization is now unreadable for it, and ` +
+                `requests will fail with missing-credential errors that name the key rather than this org ` +
+                `change. Confirm the account's memberships before continuing; if this came from a roster, ` +
+                `identity, or user-list migration, add the members to the EXISTING organization instead.`,
+        });
+        return;
+    }
+    warnAgent({
+        severity: "critical",
+        code: "org-additional-organization",
+        message: `Created an ADDITIONAL organization "${newOrgName}" (${newOrgId}) ` +
+            `for an account that already belongs to another organization, and made it their active org. ` +
+            `Vault credentials are scoped per organization and are NOT shared between them: every API key ` +
+            `synced under the previous organization is now unreadable for this account until it is re-saved ` +
+            `in "${newOrgName}". Requests will fail with missing-credential errors that name the key rather ` +
+            `than this org change. If this came from a roster, identity, or user-list migration, add the ` +
+            `members to the EXISTING organization instead of creating a new one.`,
+    });
+}
 function defaultOrgName(email, session) {
     const full = session?.name?.trim();
     if (full)
@@ -451,7 +539,7 @@ async function tryCreateDefaultOrg(exec, email, session) {
             sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,
             args: [nanoid(), orgId, email, "owner", now],
         });
-        await putUserSetting(email, "active-org-id", { orgId });
+        await setActiveOrgId(email, orgId, "auto-created default organization");
         return { email, orgId, orgName, role: "owner" };
     }
     catch {

package/dist/org/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/org/context.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAGnE,MAAM,aAAa,GAAe;IAChC,KAAK,EAAE,EAAE;IACT,KAAK,EAAE,IAAI;IACX,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,IAAI;CACX,CAAC;AAEF,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ;QACjE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAAkC,EAClC,KAAa,EACb,WAA4B;IAE5B,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,oEAAoE;YACzE,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAQ,CAAC;QAC3B,OAAO,MAAM,CAAC,GAAG,EAAE,WAAW,IAAI,GAAG,EAAE,WAAW,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAChD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,MAAM,GAAG,GAAW,EAAE,CAC1B,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAc;IAChD,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,GAAG,GAAG,KAAK,CAAC,OAEjB,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC;AACxE,CAAC;AASD,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AACxD,MAAM,4BAA4B,GAAG,2BAA2B,CAAC;AAIjE,SAAS,4BAA4B,CACnC,KAAc,EACd,KAAa;IAEb,MAAM,GAAG,GAAG,KAAK,CAAC,OAAkC,CAAC;IACrD,MAAM,KAAK,GAAG,CAAE,GAAG,CAAC,4BAA4B,CAElC;QACZ,CAAC,GAAG,CAAC,4BAA4B,CAAC,GAAG,IAAI,GAAG,EAGzC,CAAC,CAA2C,CAAC;IAClD,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,cAAc,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YAC9D,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/C,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI;gBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACjD,OAAO,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAC9B,KAAc,EACd,IAAkC,EAClC,KAAa;IAEb,MAAM,GAAG,GAAG,KAAK,CAAC,OAAkC,CAAC;IACrD,MAAM,KAAK,GAAG,CAAE,GAAG,CAAC,qBAAqB,CAE3B;QACZ,CAAC,GAAG,CAAC,qBAAqB,CAAC,GAAG,IAAI,GAAG,EAGlC,CAAC,CAAiD,CAAC;IACxD,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,yBAAyB,CAChC,KAAc,EACd,KAAa,EACb,WAAmC;IAEnC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAkC,CAAC;IACrD,MAAM,KAAK,GAAG,GAAG,CAAC,qBAAqB,CAE1B,CAAC;IACd,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAAc;IACrD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,aAAa,CAAC;IACjC,MAAM,YAAY,GAChB,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE;QACvD,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE;QACtB,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,cAAc,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzD,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IAEzB,IAAI,WAAW,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACpE,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,YAAY;gBACnB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,cAAc;aACrB,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,4BAA4B,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1E,MAAM,gBAAgB,GAAG,gBAAgB,EAAE,KAAK,KAAK,IAAI,CAAC;IAE1D,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACzC,0EAA0E;IAC1E,8EAA8E;IAC9E,wEAAwE;IACxE,2EAA2E;IAC3E,MAAM,uBAAuB,GAC3B,CAAC,gBAAgB;QACjB,WAAW,KAAK,IAAI;QACpB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,WAAW,EAAE,KAAK,WAAW,CAAC,CAAC;IAE3E,IACE,CAAC,gBAAgB;QACjB,gBAAgB,EAAE,KAAK;QACvB,CAAC,uBAAuB,EACxB,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,GAAG,YAAY;QACpC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC;QACnD,CAAC,CAAC,IAAI,CAAC;IAET,IAAI,uBAAuB,EAAE,CAAC;QAC5B,MAAM,qBAAqB,GAAG,WAAW,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,KAAK,EAAE;YACrD,iBAAiB,EAAE,OAAO;SAC3B,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;QACpD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACrD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,WAAW,GAAG,SAAS,CAAC;gBACxB,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YACrD,CAAC;YAED,MAAM,YAAY,GAChB,gBAAgB,EAAE,KAAK;gBACvB,YAAY;gBACZ,qBAAqB,CAAC,CAAC,CAAC,EAAE,KAAK;gBAC/B,IAAI,CAAC;YACP,MAAM,cAAc,GAClB,CAAC,gBAAgB;gBACjB,CAAC,YAAY,KAAK,IAAI;oBACpB,CAAC,MAAM,oBAAoB,CACzB,IAAI,EACJ,YAAY,EACZ,qBAAqB,CACtB,CAAC,CAAC,CAAC;YAER,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;gBACrE,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC;gBAChE,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO;wBACL,KAAK;wBACL,KAAK,EAAE,MAAM,CAAC,KAAK;wBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;qBAClB,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,gBAAgB,EAAE,KAAK,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,MAAM,GACV,iBAAiB,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC;QACzE,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC;QACJ,CAAC;QACD,OAAO;YACL,KAAK;YACL,KAAK,EAAE,YAAY;YACnB,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,cAAc;SACrB,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,2BAA2B,EAAE,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,4EAA4E;QAC5E,uEAAuE;IACzE,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,OAAO;QACL,KAAK;QACL,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK;QAC3B,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO;QAC/B,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;KAC1B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,IAAkC,EAClC,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE;;;;qCAI0B;YAC/B,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SAC5B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE;YACzB,MAAM,MAAM,GAAG,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,cAAc,CAAC;YACnD,OAAO;gBACL,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;gBAClC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAY;gBAC/B,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC;gBACxC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;aAC9C,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAa;IAEb,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,uDAAuD;YAC5D,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SAC5B,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACnD,MAAM,gBAAgB,GAAG,CAAC,MAAM,cAAc,CAC5C,KAAK,EACL,eAAe,CAChB,CAAqB,CAAC;QACvB,IAAI,gBAAgB,EAAE,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAClD,IAAI,gBAAgB,EAAE,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YACpE,OAAO,gBAAgB,CAAC,KAAK,CAAC;QAChC,CAAC;QACD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAAc,EACd,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1D,MAAM,gBAAgB,GAAG,MAAM,4BAA4B,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1E,IAAI,gBAAgB,EAAE,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAClD,IACE,gBAAgB,EAAE,KAAK;YACvB,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,KAAK,CAAC,EAC3D,CAAC;YACD,OAAO,gBAAgB,CAAC,KAAK,CAAC;QAChC,CAAC;QACD,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,KAAa,EACb,IAAI,GAAY,OAAO;IAQvB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;IACpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAExD,MAAM,IAAI,CAAC,OAAO,CAAC;QACjB,GAAG,EAAE,iGAAiG;QACtG,IAAI,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC;KACrD,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,OAAO,CAAC;QACjB,GAAG,EAAE,qFAAqF;QAC1F,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC;KAC7C,CAAC,CAAC;IAEH,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IAE5D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,cAAc,CACrB,KAAa,EACb,OAAiC;IAEjC,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACnC,IAAI,IAAI;QAAE,OAAO,GAAG,IAAI,cAAc,CAAC;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,MAAM,GACV,OAAO;SACJ,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAClD,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACvB,OAAO,GAAG,MAAM,cAAc,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAAkC,EAClC,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,qFAAqF;YAC1F,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SAC5B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,0DAA0D;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,IAAkC,EAClC,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,qEAAqE;YAC1E,IAAI,EAAE,CAAC,MAAM,CAAC;SACf,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;sDAIsD;AACtD,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,UAAU,mBAAmB,CAChC,IAAkC,EAClC,KAAa,EACb,OAAiC;IAEjC,sEAAsE;IACtE,mEAAmE;IACnE,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAE7C,MAAM,QAAQ,GAAG,KAAK,KAAK,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAE9D,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvD,sEAAsE;IACtE,qEAAqE;IACrE,mEAAmE;IACnE,yDAAyD;IACzD,IAAI,MAAM,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,GAAG,EAAE,kFAAkF;YACvF,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC;SACnC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,GAAG,EAAE,qFAAqF;YAC1F,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;SAC7C,CAAC,CAAC;QAEH,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAExD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,IAAkC,EAClC,QAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,GAAG,EAAE,gEAAgE;YACrE,IAAI,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC;SACnD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,mDAAmD;QACnD,EAAE;QACF,2DAA2D;QAC3D,iEAAiE;QACjE,iEAAiE;QACjE,kEAAkE;QAClE,iEAAiE;QACjE,0DAA0D;QAC1D,gEAAgE;QAChE,uEAAuE;QACvE,yBAAyB;QACzB,MAAM,cAAc,GAAG,GAAG,GAAG,YAAY,CAAC;QAC1C,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC;YACjC,GAAG,EAAE,iFAAiF;YACtF,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC;SACnE,CAAC,CAA8B,CAAC;QACjC,OAAO,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,IAAkC,EAClC,QAAgB;IAEhB,+DAA+D;IAC/D,qEAAqE;IACrE,kDAAkD;IAClD,MAAM,IAAI;SACP,OAAO,CAAC,EAAE,GAAG,EAAE,oCAAoC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;SACxE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAa;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,+DAA+D;YACpE,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;QAC7D,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,2DAA2D;YAChE,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzD,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,8EAA8E;YACnF,IAAI,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzD,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,4EAA4E;YACjF,IAAI,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO;YACL,KAAK,EAAE,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,IAAI,CAAC;SACvC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\n\nimport { getDbExec } from \"../db/client.js\";\nimport { getSession } from \"../server/auth.js\";\nimport { getSetting } from \"../settings/store.js\";\nimport { getUserSetting, putUserSetting } from \"../settings/user-settings.js\";\nimport { autoJoinDomainMatchingOrgs } from \"./auto-join-domain.js\";\nimport type { OrgContext, OrgRole } from \"./types.js\";\n\nconst EMPTY_CONTEXT: OrgContext = {\n  email: \"\",\n  orgId: null,\n  orgName: null,\n  role: null,\n};\n\nfunction normalizeOrgRole(value: unknown): OrgRole | null {\n  return value === \"owner\" || value === \"admin\" || value === \"member\"\n    ? value\n    : null;\n}\n\nfunction emailDomainOf(email: string): string | null {\n  return email.split(\"@\")[1]?.toLowerCase() || null;\n}\n\n/**\n * A workspace the user owns that nobody else has joined is a default/personal\n * workspace whatever it happens to be named, so moving the user into their\n * company org is safe. An org with other members is a team they deliberately\n * belong to — join the domain org in the background but leave them there.\n */\nasync function isSoloOwnedWorkspace(\n  exec: ReturnType<typeof getDbExec>,\n  orgId: string,\n  memberships: MembershipRow[],\n): Promise<boolean> {\n  const membership = memberships.find((m) => m.orgId === orgId);\n  if (!membership || membership.role !== \"owner\") return false;\n  try {\n    const { rows } = await exec.execute({\n      sql: `SELECT COUNT(*) AS \"memberCount\" FROM org_members WHERE org_id = ?`,\n      args: [orgId],\n    });\n    const row = rows[0] as any;\n    return Number(row?.memberCount ?? row?.membercount ?? 0) <= 1;\n  } catch {\n    return false;\n  }\n}\n\nfunction autoCreateDefaultOrgEnabled(): boolean {\n  const raw = process.env.AUTO_CREATE_DEFAULT_ORG;\n  if (raw === undefined || raw.trim() === \"\") return true;\n  return ![\"0\", \"false\", \"no\", \"off\"].includes(raw.trim().toLowerCase());\n}\n\nconst nanoid = (): string =>\n  globalThis.crypto?.randomUUID?.().replace(/-/g, \"\") ??\n  Math.random().toString(36).slice(2) + Date.now().toString(36);\n\n/**\n * Resolve the current user's organization context from their session.\n *\n * - Honors the user's `active-org-id` setting, including an explicit Personal\n *   context represented by `{ orgId: null }`.\n * - Falls back to the user's first membership.\n * - When the authenticated user has zero memberships, provisions a default org\n *   named after the user ({name}'s workspace, falling back to the email\n *   local-part). Set `AUTO_CREATE_DEFAULT_ORG=0` to opt out.\n *\n * Per-request memoized on `event.context` — mirrors the `getSession`\n * pattern so multiple callers in the same request (e.g. ssr-handler +\n * a loader) share a single org_members round trip.\n */\nexport async function getOrgContext(event: H3Event): Promise<OrgContext> {\n  // Per-request memoization. Multiple call sites per request (action wrappers,\n  // SSR handler, loaders) must not each pay a separate org_members query.\n  const ctx = event.context as {\n    __anOrgContextCache?: Promise<OrgContext>;\n  };\n  return (ctx.__anOrgContextCache ??= resolveOrgContextUncached(event));\n}\n\ntype MembershipRow = {\n  orgId: string;\n  role: OrgRole;\n  orgName: string;\n  allowedDomain: string | null;\n};\n\nconst MEMBERSHIPS_CACHE_KEY = \"__anOrgMembershipsCache\";\nconst ACTIVE_ORG_SETTING_CACHE_KEY = \"__anActiveOrgSettingCache\";\n\ntype ActiveOrgSetting = { orgId: string | null } | null;\n\nfunction loadActiveOrgSettingForEvent(\n  event: H3Event,\n  email: string,\n): Promise<ActiveOrgSetting> {\n  const ctx = event.context as Record<string, unknown>;\n  const cache = ((ctx[ACTIVE_ORG_SETTING_CACHE_KEY] as\n    | Map<string, Promise<ActiveOrgSetting>>\n    | undefined) ??\n    (ctx[ACTIVE_ORG_SETTING_CACHE_KEY] = new Map<\n      string,\n      Promise<ActiveOrgSetting>\n    >())) as Map<string, Promise<ActiveOrgSetting>>;\n  const normalizedEmail = email.toLowerCase();\n  let promise = cache.get(normalizedEmail);\n  if (!promise) {\n    promise = getUserSetting(email, \"active-org-id\").then((value) => {\n      if (!value || !(\"orgId\" in value)) return null;\n      if (value.orgId === null) return { orgId: null };\n      return typeof value.orgId === \"string\" ? { orgId: value.orgId } : null;\n    });\n    cache.set(normalizedEmail, promise);\n  }\n  return promise;\n}\n\n/**\n * Per-request memoization of the org_members lookup, keyed by email on\n * `event.context`. Both the session org backfill (inside `getSession`) and\n * `getOrgContext` need the membership rows; without sharing, every request\n * whose session lacks an orgId pays the query twice.\n */\nfunction loadMembershipsForEvent(\n  event: H3Event,\n  exec: ReturnType<typeof getDbExec>,\n  email: string,\n): Promise<MembershipRow[] | null> {\n  const ctx = event.context as Record<string, unknown>;\n  const cache = ((ctx[MEMBERSHIPS_CACHE_KEY] as\n    | Map<string, Promise<MembershipRow[] | null>>\n    | undefined) ??\n    (ctx[MEMBERSHIPS_CACHE_KEY] = new Map<\n      string,\n      Promise<MembershipRow[] | null>\n    >())) as Map<string, Promise<MembershipRow[] | null>>;\n  let promise = cache.get(email);\n  if (!promise) {\n    promise = loadMemberships(exec, email);\n    cache.set(email, promise);\n  }\n  return promise;\n}\n\nfunction updateMembershipsForEvent(\n  event: H3Event,\n  email: string,\n  memberships: MembershipRow[] | null,\n): void {\n  const ctx = event.context as Record<string, unknown>;\n  const cache = ctx[MEMBERSHIPS_CACHE_KEY] as\n    | Map<string, Promise<MembershipRow[] | null>>\n    | undefined;\n  cache?.set(email, Promise.resolve(memberships));\n}\n\nasync function resolveOrgContextUncached(event: H3Event): Promise<OrgContext> {\n  const session = await getSession(event);\n  const email = session?.email;\n  if (!email) return EMPTY_CONTEXT;\n  const sessionOrgId =\n    typeof session.orgId === \"string\" && session.orgId.trim()\n      ? session.orgId.trim()\n      : null;\n  const sessionOrgRole = normalizeOrgRole(session.orgRole);\n\n  const exec = getDbExec();\n\n  let memberships = await loadMembershipsForEvent(event, exec, email);\n  if (memberships === null) {\n    if (sessionOrgId) {\n      return {\n        email,\n        orgId: sessionOrgId,\n        orgName: null,\n        role: sessionOrgRole,\n      };\n    }\n    return { email, orgId: null, orgName: null, role: null };\n  }\n\n  const activeOrgSetting = await loadActiveOrgSettingForEvent(event, email);\n  const explicitPersonal = activeOrgSetting?.orgId === null;\n\n  const emailDomain = emailDomainOf(email);\n  // Membership in a domain-matched org is the only durable \"already joined\"\n  // signal. Recognizing the personal workspace by its *name* instead breaks the\n  // moment the provider display name or the workspace name changes, which\n  // strands an existing user in Personal with no way into their company org.\n  const shouldTryDomainAutoJoin =\n    !explicitPersonal &&\n    emailDomain !== null &&\n    !memberships.some((m) => m.allowedDomain?.toLowerCase() === emailDomain);\n\n  if (\n    !explicitPersonal &&\n    activeOrgSetting?.orgId &&\n    !shouldTryDomainAutoJoin\n  ) {\n    const active = memberships.find((m) => m.orgId === activeOrgSetting.orgId);\n    if (active) {\n      return {\n        email,\n        orgId: active.orgId,\n        orgName: active.orgName,\n        role: active.role,\n      };\n    }\n  }\n\n  const sessionMembership = sessionOrgId\n    ? memberships.find((m) => m.orgId === sessionOrgId)\n    : null;\n\n  if (shouldTryDomainAutoJoin) {\n    const membershipsBeforeJoin = memberships;\n    const joined = await autoJoinDomainMatchingOrgs(email, {\n      activateJoinedOrg: \"never\",\n    });\n    const joinedOrgId = joined.joined[0]?.orgId ?? null;\n    if (joinedOrgId) {\n      const refreshed = await loadMemberships(exec, email);\n      if (refreshed !== null) {\n        memberships = refreshed;\n        updateMembershipsForEvent(event, email, refreshed);\n      }\n\n      const currentOrgId =\n        activeOrgSetting?.orgId ??\n        sessionOrgId ??\n        membershipsBeforeJoin[0]?.orgId ??\n        null;\n      const shouldActivate =\n        !explicitPersonal &&\n        (currentOrgId === null ||\n          (await isSoloOwnedWorkspace(\n            exec,\n            currentOrgId,\n            membershipsBeforeJoin,\n          )));\n\n      if (shouldActivate) {\n        await putUserSetting(email, \"active-org-id\", { orgId: joinedOrgId });\n        const active = memberships.find((m) => m.orgId === joinedOrgId);\n        if (active) {\n          return {\n            email,\n            orgId: active.orgId,\n            orgName: active.orgName,\n            role: active.role,\n          };\n        }\n      }\n    }\n  }\n\n  if (explicitPersonal) {\n    return { email, orgId: null, orgName: null, role: null };\n  }\n\n  if (activeOrgSetting?.orgId) {\n    const active = memberships.find((m) => m.orgId === activeOrgSetting.orgId);\n    if (active) {\n      return {\n        email,\n        orgId: active.orgId,\n        orgName: active.orgName,\n        role: active.role,\n      };\n    }\n  }\n\n  if (sessionOrgId) {\n    const active =\n      sessionMembership ?? memberships.find((m) => m.orgId === sessionOrgId);\n    if (active) {\n      return {\n        email,\n        orgId: active.orgId,\n        orgName: active.orgName,\n        role: active.role,\n      };\n    }\n    return {\n      email,\n      orgId: sessionOrgId,\n      orgName: null,\n      role: sessionOrgRole,\n    };\n  }\n\n  if (memberships.length === 0 && autoCreateDefaultOrgEnabled()) {\n    const created = await tryCreateDefaultOrg(exec, email, session);\n    if (created) return created;\n    // Creation failed (race / DB error); fall through with an empty org context\n    // so non-blocking invite/domain UI can still surface recovery options.\n  }\n\n  if (memberships.length === 0) {\n    return { email, orgId: null, orgName: null, role: null };\n  }\n\n  return {\n    email,\n    orgId: memberships[0].orgId,\n    orgName: memberships[0].orgName,\n    role: memberships[0].role,\n  };\n}\n\nasync function loadMemberships(\n  exec: ReturnType<typeof getDbExec>,\n  email: string,\n): Promise<MembershipRow[] | null> {\n  try {\n    const { rows } = await exec.execute({\n      sql: `SELECT m.org_id AS \"orgId\", m.role AS role, o.name AS \"orgName\",\n                   o.allowed_domain AS \"allowedDomain\"\n            FROM org_members m\n            INNER JOIN organizations o ON m.org_id = o.id\n            WHERE LOWER(m.email) = ?`,\n      args: [email.toLowerCase()],\n    });\n    return rows.map((r: any) => {\n      const domain = r.allowedDomain ?? r.allowed_domain;\n      return {\n        orgId: String(r.orgId ?? r.org_id),\n        role: String(r.role) as OrgRole,\n        orgName: String(r.orgName ?? r.org_name),\n        allowedDomain: domain ? String(domain) : null,\n      };\n    });\n  } catch {\n    // Tables may not exist yet on first boot before migrations finish.\n    return null;\n  }\n}\n\n/**\n * Resolve the active org ID for a given email — for non-HTTP contexts like\n * the integration webhook handler where we have an email but no event/session.\n * Picks the user's active-org-id setting if set, including explicit Personal,\n * otherwise the first membership.\n * Returns null if the user has no memberships.\n */\nexport async function resolveOrgIdForEmail(\n  email: string,\n): Promise<string | null> {\n  const exec = getDbExec();\n  if (!exec) return null;\n  try {\n    const { rows } = await exec.execute({\n      sql: `SELECT org_id FROM org_members WHERE LOWER(email) = ?`,\n      args: [email.toLowerCase()],\n    });\n    if (rows.length === 0) return null;\n    const ids = rows.map((r: any) => String(r.org_id));\n    const activeOrgSetting = (await getUserSetting(\n      email,\n      \"active-org-id\",\n    )) as ActiveOrgSetting;\n    if (activeOrgSetting?.orgId === null) return null;\n    if (activeOrgSetting?.orgId && ids.includes(activeOrgSetting.orgId)) {\n      return activeOrgSetting.orgId;\n    }\n    return ids[0];\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Event-aware variant of `resolveOrgIdForEmail` for HTTP request paths.\n * Shares the per-request membership lookup with `getOrgContext`, so the\n * session org backfill inside `getSession` and a later `getOrgContext` call\n * in the same request pay ONE org_members round trip, not two.\n */\nexport async function resolveOrgIdForEmailViaEvent(\n  event: H3Event,\n  email: string,\n): Promise<string | null> {\n  try {\n    const exec = getDbExec();\n    if (!exec) return null;\n    const memberships = await loadMembershipsForEvent(event, exec, email);\n    if (!memberships || memberships.length === 0) return null;\n    const activeOrgSetting = await loadActiveOrgSettingForEvent(event, email);\n    if (activeOrgSetting?.orgId === null) return null;\n    if (\n      activeOrgSetting?.orgId &&\n      memberships.some((m) => m.orgId === activeOrgSetting.orgId)\n    ) {\n      return activeOrgSetting.orgId;\n    }\n    return memberships[0].orgId;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Create a new organization and add the caller as a member with the given\n * role. Generates a per-org A2A secret for cross-app delegation and writes\n * the caller's `active-org-id` user-setting so the new org is immediately\n * active.\n *\n */\nexport async function createOrganization(\n  name: string,\n  email: string,\n  role: OrgRole = \"owner\",\n): Promise<{\n  id: string;\n  name: string;\n  role: OrgRole;\n  a2aSecret: string;\n  createdAt: number;\n}> {\n  const trimmedName = name.trim();\n  const exec = getDbExec();\n  const id = nanoid();\n  const createdAt = Date.now();\n  const { randomBytes } = await import(\"node:crypto\");\n  const a2aSecret = randomBytes(32).toString(\"base64url\");\n\n  await exec.execute({\n    sql: `INSERT INTO organizations (id, name, created_by, created_at, a2a_secret) VALUES (?, ?, ?, ?, ?)`,\n    args: [id, trimmedName, email, createdAt, a2aSecret],\n  });\n\n  await exec.execute({\n    sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,\n    args: [nanoid(), id, email, role, createdAt],\n  });\n\n  await putUserSetting(email, \"active-org-id\", { orgId: id });\n\n  return { id, name: trimmedName, role, a2aSecret, createdAt };\n}\n\nfunction defaultOrgName(\n  email: string,\n  session: { name?: string } | null,\n): string {\n  const full = session?.name?.trim();\n  if (full) return `${full}'s workspace`;\n  const local = email.split(\"@\")[0] ?? email;\n  const cleaned = local.replace(/[._-]+/g, \" \").trim();\n  const titled =\n    cleaned\n      .split(\" \")\n      .filter(Boolean)\n      .map((w) => w.charAt(0).toUpperCase() + w.slice(1))\n      .join(\" \") || \"My\";\n  return `${titled}'s workspace`;\n}\n\n/**\n * Check whether the user has a pending invitation. If so, auto-create\n * MUST be skipped — otherwise we'd provision a personal org for them\n * before they ever see the inviter's org in the invitation banner, and they'd\n * never join the team that invited them.\n */\nasync function hasPendingInvitation(\n  exec: ReturnType<typeof getDbExec>,\n  email: string,\n): Promise<boolean> {\n  try {\n    const { rows } = await exec.execute({\n      sql: `SELECT 1 FROM org_invitations WHERE LOWER(email) = ? AND status = 'pending' LIMIT 1`,\n      args: [email.toLowerCase()],\n    });\n    return rows.length > 0;\n  } catch {\n    // If we can't tell, err on the side of NOT auto-creating — the\n    // invitation banner or team UI can surface the situation.\n    return true;\n  }\n}\n\nasync function hasDomainMatch(\n  exec: ReturnType<typeof getDbExec>,\n  email: string,\n): Promise<boolean> {\n  try {\n    const domain = email.split(\"@\")[1]?.toLowerCase();\n    if (!domain) return false;\n    const { rows } = await exec.execute({\n      sql: `SELECT 1 FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,\n      args: [domain],\n    });\n    return rows.length > 0;\n  } catch {\n    return false;\n  }\n}\n\n/** Stale-claim threshold. A claim row this old is treated as abandoned\n *  (process crashed, DELETE failed, etc.) and a new caller may take it\n *  over. Long enough that two genuine concurrent first-loads don't\n *  trample each other (those settle in milliseconds), short enough that\n *  a stuck user recovers on their next navigation. */\nconst CLAIM_TTL_MS = 5 * 60 * 1000;\n\n/**\n * Attempt to provision a default org + owner membership for a user with\n * zero memberships.\n *\n * Race protection: claims the user's auto-create slot via an atomic\n * INSERT into the framework `settings` table (PRIMARY KEY (key) — so\n * concurrent inserts for the same key throw uniqueness violations on\n * both SQLite and Postgres). Only the request that wins the claim\n * proceeds to create the org; losers bail. By the time a losing\n * request retries on a subsequent navigation, the winner's org is in\n * `org_members` and the auto-create branch is skipped entirely.\n *\n * Stuck-state recovery: a stale claim (held longer than CLAIM_TTL_MS)\n * is reclaimed automatically. So even if the DELETE on the failure\n * path fails (network blip, DB error), the user isn't stranded — the\n * next request after the TTL elapses retries cleanly.\n *\n * Returns null on any failure so the caller can fall back to the\n * empty-context / client-guard path.\n */\nasync function tryCreateDefaultOrg(\n  exec: ReturnType<typeof getDbExec>,\n  email: string,\n  session: { name?: string } | null,\n): Promise<OrgContext | null> {\n  // Make sure the framework `settings` table exists before we use it as\n  // a claim primitive. getSetting() ensures the table on first call.\n  await getSetting(\"__init\").catch(() => null);\n\n  const claimKey = `u:${email.toLowerCase()}:auto-create-claim`;\n\n  if (!(await acquireClaim(exec, claimKey))) return null;\n\n  // Pending-invite check happens INSIDE the claim so the window where a\n  // newly-arrived invitation can be missed is narrowed to a single SQL\n  // round-trip. (A still-narrower window would require a transaction\n  // spanning org_invitations and settings — out of scope.)\n  if (await hasPendingInvitation(exec, email)) {\n    await releaseClaim(exec, claimKey);\n    return null;\n  }\n\n  if (await hasDomainMatch(exec, email)) {\n    await releaseClaim(exec, claimKey);\n    return null;\n  }\n\n  try {\n    const orgId = nanoid();\n    const orgName = defaultOrgName(email, session);\n    const now = Date.now();\n\n    await exec.execute({\n      sql: `INSERT INTO organizations (id, name, created_by, created_at) VALUES (?, ?, ?, ?)`,\n      args: [orgId, orgName, email, now],\n    });\n    await exec.execute({\n      sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,\n      args: [nanoid(), orgId, email, \"owner\", now],\n    });\n\n    await putUserSetting(email, \"active-org-id\", { orgId });\n\n    return { email, orgId, orgName, role: \"owner\" };\n  } catch {\n    await releaseClaim(exec, claimKey);\n    return null;\n  }\n}\n\nasync function acquireClaim(\n  exec: ReturnType<typeof getDbExec>,\n  claimKey: string,\n): Promise<boolean> {\n  const now = Date.now();\n  try {\n    await exec.execute({\n      sql: `INSERT INTO settings (key, value, updated_at) VALUES (?, ?, ?)`,\n      args: [claimKey, JSON.stringify({ at: now }), now],\n    });\n    return true;\n  } catch {\n    // Conflict — someone else's claim is already in the row. If it's\n    // stale (older than CLAIM_TTL_MS) we take it over.\n    //\n    // CRITICAL: this MUST be a single atomic UPDATE guarded on\n    // `updated_at <= staleThreshold`. A read-then-DELETE-then-INSERT\n    // sequence lets two concurrent reclaimers each observe the stale\n    // timestamp, delete each other's fresh claim, and both think they\n    // won — duplicating org creation. The conditional UPDATE matches\n    // each stale row at most once: only the first writer sees\n    // rowsAffected === 1; the row's updated_at is now `now`, so any\n    // subsequent UPDATE no longer satisfies `updated_at <= staleThreshold`\n    // and matches zero rows.\n    const staleThreshold = now - CLAIM_TTL_MS;\n    const result = (await exec.execute({\n      sql: `UPDATE settings SET value = ?, updated_at = ? WHERE key = ? AND updated_at <= ?`,\n      args: [JSON.stringify({ at: now }), now, claimKey, staleThreshold],\n    })) as { rowsAffected?: number };\n    return (result.rowsAffected ?? 0) > 0;\n  }\n}\n\nasync function releaseClaim(\n  exec: ReturnType<typeof getDbExec>,\n  claimKey: string,\n): Promise<void> {\n  // Best-effort. If this fails (transient network/DB error), the\n  // CLAIM_TTL_MS-based takeover in acquireClaim recovers automatically\n  // on a future request — no permanent stuck state.\n  await exec\n    .execute({ sql: `DELETE FROM settings WHERE key = ?`, args: [claimKey] })\n    .catch(() => {});\n}\n\n/**\n * Look up the `allowed_domain` for an org by its ID.\n * Used when making outbound A2A calls so the JWT includes the\n * caller's org domain for cross-app org resolution.\n */\nexport async function getOrgDomain(orgId: string): Promise<string | null> {\n  try {\n    const exec = getDbExec();\n    const { rows } = await exec.execute({\n      sql: `SELECT allowed_domain FROM organizations WHERE id = ? LIMIT 1`,\n      args: [orgId],\n    });\n    if (!rows[0]) return null;\n    const domain = String((rows[0] as any).allowed_domain || \"\");\n    return domain || null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Look up the org's A2A secret by org ID.\n * Used when making outbound A2A calls so the JWT is signed with the\n * org-specific secret rather than the global A2A_SECRET env var.\n */\nexport async function getOrgA2ASecret(orgId: string): Promise<string | null> {\n  try {\n    const exec = getDbExec();\n    const { rows } = await exec.execute({\n      sql: `SELECT a2a_secret FROM organizations WHERE id = ? LIMIT 1`,\n      args: [orgId],\n    });\n    if (!rows[0]) return null;\n    const secret = String((rows[0] as any).a2a_secret || \"\");\n    return secret || null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Look up an org's A2A secret by its `allowed_domain`.\n * Used on the A2A receiving side: the caller's JWT includes `org_domain`,\n * and the receiver looks up which local org matches that domain to find\n * the secret used to verify the JWT signature.\n */\nexport async function getA2ASecretByDomain(\n  domain: string,\n): Promise<string | null> {\n  try {\n    const exec = getDbExec();\n    const { rows } = await exec.execute({\n      sql: `SELECT a2a_secret FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,\n      args: [domain.toLowerCase()],\n    });\n    if (!rows[0]) return null;\n    const secret = String((rows[0] as any).a2a_secret || \"\");\n    return secret || null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Resolve a local org by its `allowed_domain`.\n * Used on the A2A receiving side: the caller sends `org_domain` in the JWT,\n * and the receiver looks up which local org matches that domain.\n */\nexport async function resolveOrgByDomain(\n  domain: string,\n): Promise<{ orgId: string; orgName: string } | null> {\n  try {\n    const exec = getDbExec();\n    const { rows } = await exec.execute({\n      sql: `SELECT id, name FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,\n      args: [domain.toLowerCase()],\n    });\n    if (!rows[0]) return null;\n    return {\n      orgId: String((rows[0] as any).id),\n      orgName: String((rows[0] as any).name),\n    };\n  } catch {\n    return null;\n  }\n}\n"]}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/org/context.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAGnE,MAAM,aAAa,GAAe;IAChC,KAAK,EAAE,EAAE;IACT,KAAK,EAAE,IAAI;IACX,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,IAAI;CACX,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAGrC;IACC,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClD,OAAO,IAAiC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,wBAAwB,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ;QACjE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAAkC,EAClC,KAAa,EACb,WAA4B;IAE5B,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,oEAAoE;YACzE,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAQ,CAAC;QAC3B,OAAO,MAAM,CAAC,GAAG,EAAE,WAAW,IAAI,GAAG,EAAE,WAAW,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAChD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,MAAM,GAAG,GAAW,EAAE,CAC1B,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAc;IAChD,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,GAAG,GAAG,KAAK,CAAC,OAEjB,CAAC;IACF,0EAA0E;IAC1E,6CAA6C;IAC7C,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,yBAAyB,CAAC,KAAK,CAAC,CAAC,KAAK,CACxE,CAAC,GAAG,EAAE,EAAE;QACN,OAAO,GAAG,CAAC,mBAAmB,CAAC;QAC/B,MAAM,GAAG,CAAC;IACZ,CAAC,CACF,CAAC,CAAC;AACL,CAAC;AASD,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AACxD,MAAM,4BAA4B,GAAG,2BAA2B,CAAC;AAIjE,SAAS,4BAA4B,CACnC,KAAc,EACd,KAAa;IAEb,MAAM,GAAG,GAAG,KAAK,CAAC,OAAkC,CAAC;IACrD,MAAM,KAAK,GAAG,CAAE,GAAG,CAAC,4BAA4B,CAElC;QACZ,CAAC,GAAG,CAAC,4BAA4B,CAAC,GAAG,IAAI,GAAG,EAGzC,CAAC,CAA2C,CAAC;IAClD,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,cAAc,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YAC9D,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/C,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI;gBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACjD,OAAO,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAC9B,KAAc,EACd,KAAa;IAEb,MAAM,GAAG,GAAG,KAAK,CAAC,OAAkC,CAAC;IACrD,MAAM,KAAK,GAAG,CAAE,GAAG,CAAC,qBAAqB,CAE3B;QACZ,CAAC,GAAG,CAAC,qBAAqB,CAAC,GAAG,IAAI,GAAG,EAGlC,CAAC,CAAiD,CAAC;IACxD,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,2EAA2E;QAC3E,6DAA6D;QAC7D,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC7C,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,yBAAyB,CAChC,KAAc,EACd,KAAa,EACb,WAAmC;IAEnC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAkC,CAAC;IACrD,MAAM,KAAK,GAAG,GAAG,CAAC,qBAAqB,CAE1B,CAAC;IACd,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAAc;IACrD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,aAAa,CAAC;IACjC,MAAM,YAAY,GAChB,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE;QACvD,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE;QACtB,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,cAAc,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzD,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IAEzB,IAAI,WAAmC,CAAC;IACxC,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,oEAAoE;QACpE,IAAI,YAAY,IAAI,wBAAwB,CAAC,GAAG,CAAC,EAAE,CAAC;YAClD,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,YAAY;gBACnB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,cAAc;aACrB,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,YAAY;gBACnB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,cAAc;aACrB,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,4BAA4B,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1E,MAAM,gBAAgB,GAAG,gBAAgB,EAAE,KAAK,KAAK,IAAI,CAAC;IAE1D,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACzC,0EAA0E;IAC1E,8EAA8E;IAC9E,wEAAwE;IACxE,2EAA2E;IAC3E,MAAM,uBAAuB,GAC3B,CAAC,gBAAgB;QACjB,WAAW,KAAK,IAAI;QACpB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,WAAW,EAAE,KAAK,WAAW,CAAC,CAAC;IAE3E,IACE,CAAC,gBAAgB;QACjB,gBAAgB,EAAE,KAAK;QACvB,CAAC,uBAAuB,EACxB,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,GAAG,YAAY;QACpC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC;QACnD,CAAC,CAAC,IAAI,CAAC;IAET,IAAI,uBAAuB,EAAE,CAAC;QAC5B,MAAM,qBAAqB,GAAG,WAAW,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,KAAK,EAAE;YACrD,iBAAiB,EAAE,OAAO;SAC3B,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;QACpD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;YAC/C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,WAAW,GAAG,SAAS,CAAC;gBACxB,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YACrD,CAAC;YAED,MAAM,YAAY,GAChB,gBAAgB,EAAE,KAAK;gBACvB,YAAY;gBACZ,qBAAqB,CAAC,CAAC,CAAC,EAAE,KAAK;gBAC/B,IAAI,CAAC;YACP,MAAM,cAAc,GAClB,CAAC,gBAAgB;gBACjB,CAAC,YAAY,KAAK,IAAI;oBACpB,CAAC,MAAM,oBAAoB,CACzB,IAAI,EACJ,YAAY,EACZ,qBAAqB,CACtB,CAAC,CAAC,CAAC;YAER,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,cAAc,CAAC,KAAK,EAAE,WAAW,EAAE,2BAA2B,CAAC,CAAC;gBACtE,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC;gBAChE,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO;wBACL,KAAK;wBACL,KAAK,EAAE,MAAM,CAAC,KAAK;wBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;qBAClB,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,gBAAgB,EAAE,KAAK,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,MAAM,GACV,iBAAiB,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC;QACzE,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC;QACJ,CAAC;QACD,OAAO;YACL,KAAK;YACL,KAAK,EAAE,YAAY;YACnB,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,cAAc;SACrB,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,2BAA2B,EAAE,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,4EAA4E;QAC5E,uEAAuE;IACzE,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,OAAO;QACL,KAAK;QACL,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK;QAC3B,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO;QAC/B,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;KAC1B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,4BAA4B,GAAG,oCAAoC,CAAC;AAE1E,KAAK,UAAU,eAAe,CAAC,KAAa;IAC1C,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC;QACjC,GAAG,EAAE;;;;;YAKG,4BAA4B,EAAE;QACtC,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;KAC5B,CAAC,CAAC;IACH,OAAO,CACL,IAAI,EAAE,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,cAAc,CAAC;QACnD,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;YAClC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAY;YAC/B,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC;YACxC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;SAC9C,CAAC;IACJ,CAAC,CAAC,IAAI,IAAI,CACX,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAa;IAEb,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC;QACjC,GAAG,EAAE;YACG,4BAA4B,EAAE;QACtC,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,EAAE,MAAM;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,MAAM,gBAAgB,GAAG,CAAC,MAAM,cAAc,CAC5C,KAAK,EACL,eAAe,CAChB,CAAqB,CAAC;IACvB,IAAI,gBAAgB,EAAE,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,gBAAgB,EAAE,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,gBAAgB,CAAC,KAAK,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAAc,EACd,KAAa;IAEb,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAChE,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,gBAAgB,GAAG,MAAM,4BAA4B,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1E,IAAI,gBAAgB,EAAE,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClD,IACE,gBAAgB,EAAE,KAAK;QACvB,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,KAAK,CAAC,EAC3D,CAAC;QACD,OAAO,gBAAgB,CAAC,KAAK,CAAC;IAChC,CAAC;IACD,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,KAAa,EACb,IAAI,GAAY,OAAO;IAQvB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;IACpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAExD,MAAM,IAAI,CAAC,OAAO,CAAC;QACjB,GAAG,EAAE,iGAAiG;QACtG,IAAI,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC;KACrD,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,OAAO,CAAC;QACjB,GAAG,EAAE,qFAAqF;QAC1F,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC;KAC7C,CAAC,CAAC;IAEH,MAAM,4BAA4B,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IAEjE,MAAM,cAAc,CAAC,KAAK,EAAE,EAAE,EAAE,yBAAyB,WAAW,GAAG,CAAC,CAAC;IAEzE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAC/D,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,4BAA4B,CACzC,IAAkC,EAClC,KAAa,EACb,QAAgB,EAChB,UAAkB;IAElB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,0EAA0E;YAC/E,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC;SACtC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;QAC7E,6DAA6D;QAC7D,SAAS,CAAC;YACR,QAAQ,EAAE,UAAU;YACpB,IAAI,EAAE,0CAA0C;YAChD,OAAO,EACL,4BAA4B,UAAU,MAAM,QAAQ,0CAA0C;gBAC9F,+FAA+F;gBAC/F,8FAA8F;gBAC9F,2FAA2F;gBAC3F,2FAA2F;gBAC3F,yFAAyF;SAC5F,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,SAAS,CAAC;QACR,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,6BAA6B;QACnC,OAAO,EACL,uCAAuC,UAAU,MAAM,QAAQ,IAAI;YACnE,6FAA6F;YAC7F,+FAA+F;YAC/F,iGAAiG;YACjG,OAAO,UAAU,gFAAgF;YACjG,8FAA8F;YAC9F,qEAAqE;KACxE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CACrB,KAAa,EACb,OAAiC;IAEjC,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACnC,IAAI,IAAI;QAAE,OAAO,GAAG,IAAI,cAAc,CAAC;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,MAAM,GACV,OAAO;SACJ,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAClD,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACvB,OAAO,GAAG,MAAM,cAAc,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAAkC,EAClC,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,qFAAqF;YAC1F,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SAC5B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,0DAA0D;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,IAAkC,EAClC,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,qEAAqE;YAC1E,IAAI,EAAE,CAAC,MAAM,CAAC;SACf,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;sDAIsD;AACtD,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,UAAU,mBAAmB,CAChC,IAAkC,EAClC,KAAa,EACb,OAAiC;IAEjC,sEAAsE;IACtE,mEAAmE;IACnE,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAE7C,MAAM,QAAQ,GAAG,KAAK,KAAK,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAE9D,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvD,sEAAsE;IACtE,qEAAqE;IACrE,mEAAmE;IACnE,yDAAyD;IACzD,IAAI,MAAM,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,GAAG,EAAE,kFAAkF;YACvF,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC;SACnC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,GAAG,EAAE,qFAAqF;YAC1F,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;SAC7C,CAAC,CAAC;QAEH,MAAM,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,mCAAmC,CAAC,CAAC;QAExE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,IAAkC,EAClC,QAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,GAAG,EAAE,gEAAgE;YACrE,IAAI,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC;SACnD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,mDAAmD;QACnD,EAAE;QACF,2DAA2D;QAC3D,iEAAiE;QACjE,iEAAiE;QACjE,kEAAkE;QAClE,iEAAiE;QACjE,0DAA0D;QAC1D,gEAAgE;QAChE,uEAAuE;QACvE,yBAAyB;QACzB,MAAM,cAAc,GAAG,GAAG,GAAG,YAAY,CAAC;QAC1C,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC;YACjC,GAAG,EAAE,iFAAiF;YACtF,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC;SACnE,CAAC,CAA8B,CAAC;QACjC,OAAO,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,IAAkC,EAClC,QAAgB;IAEhB,+DAA+D;IAC/D,qEAAqE;IACrE,kDAAkD;IAClD,MAAM,IAAI;SACP,OAAO,CAAC,EAAE,GAAG,EAAE,oCAAoC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;SACxE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAa;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,+DAA+D;YACpE,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;QAC7D,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,2DAA2D;YAChE,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzD,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,8EAA8E;YACnF,IAAI,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzD,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,4EAA4E;YACjF,IAAI,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO;YACL,KAAK,EAAE,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,IAAI,CAAC;SACvC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\n\nimport { warnAgent } from \"../agent/action-warnings.js\";\nimport { getDbExec, isTransientDatabaseError } from \"../db/client.js\";\nimport { getSession } from \"../server/auth.js\";\nimport { getSetting } from \"../settings/store.js\";\nimport { getUserSetting } from \"../settings/user-settings.js\";\nimport { setActiveOrgId } from \"./active-org.js\";\nimport { autoJoinDomainMatchingOrgs } from \"./auto-join-domain.js\";\nimport type { OrgContext, OrgRole } from \"./types.js\";\n\nconst EMPTY_CONTEXT: OrgContext = {\n  email: \"\",\n  orgId: null,\n  orgName: null,\n  role: null,\n};\n\n/**\n * The single way to read `org_members`, so no two call sites can pick opposite\n * defaults for the same failure. A transient database failure is NOT an answer\n * and propagates: a caller that turns it into \"no memberships\" silently drops\n * org scope, which hides every org-scoped credential behind a\n * permanent-sounding \"not configured\".\n *\n * `null` is every non-transient failure, not only the intended one (org tables\n * absent on a fresh install before migrations). A permanently unreadable table\n * — a role without SELECT, say — still reports as \"no rows\" here. Narrowing\n * that further means classifying \"no database configured\" as readable-absent,\n * which is load-bearing for CLI/script/test contexts that legitimately run\n * without a store; see `assertCredentialStoreReadable`.\n */\nexport async function queryOrgMembers(query: {\n  sql: string;\n  args: unknown[];\n}): Promise<Record<string, unknown>[] | null> {\n  try {\n    const { rows } = await getDbExec().execute(query);\n    return rows as Record<string, unknown>[];\n  } catch (err) {\n    if (isTransientDatabaseError(err)) throw err;\n    return null;\n  }\n}\n\nfunction normalizeOrgRole(value: unknown): OrgRole | null {\n  return value === \"owner\" || value === \"admin\" || value === \"member\"\n    ? value\n    : null;\n}\n\nfunction emailDomainOf(email: string): string | null {\n  return email.split(\"@\")[1]?.toLowerCase() || null;\n}\n\n/**\n * A workspace the user owns that nobody else has joined is a default/personal\n * workspace whatever it happens to be named, so moving the user into their\n * company org is safe. An org with other members is a team they deliberately\n * belong to — join the domain org in the background but leave them there.\n */\nasync function isSoloOwnedWorkspace(\n  exec: ReturnType<typeof getDbExec>,\n  orgId: string,\n  memberships: MembershipRow[],\n): Promise<boolean> {\n  const membership = memberships.find((m) => m.orgId === orgId);\n  if (!membership || membership.role !== \"owner\") return false;\n  try {\n    const { rows } = await exec.execute({\n      sql: `SELECT COUNT(*) AS \"memberCount\" FROM org_members WHERE org_id = ?`,\n      args: [orgId],\n    });\n    const row = rows[0] as any;\n    return Number(row?.memberCount ?? row?.membercount ?? 0) <= 1;\n  } catch {\n    return false;\n  }\n}\n\nfunction autoCreateDefaultOrgEnabled(): boolean {\n  const raw = process.env.AUTO_CREATE_DEFAULT_ORG;\n  if (raw === undefined || raw.trim() === \"\") return true;\n  return ![\"0\", \"false\", \"no\", \"off\"].includes(raw.trim().toLowerCase());\n}\n\nconst nanoid = (): string =>\n  globalThis.crypto?.randomUUID?.().replace(/-/g, \"\") ??\n  Math.random().toString(36).slice(2) + Date.now().toString(36);\n\n/**\n * Resolve the current user's organization context from their session.\n *\n * - Honors the user's `active-org-id` setting, including an explicit Personal\n *   context represented by `{ orgId: null }`.\n * - Falls back to the user's first membership.\n * - When the authenticated user has zero memberships, provisions a default org\n *   named after the user ({name}'s workspace, falling back to the email\n *   local-part). Set `AUTO_CREATE_DEFAULT_ORG=0` to opt out.\n *\n * Per-request memoized on `event.context` — mirrors the `getSession`\n * pattern so multiple callers in the same request (e.g. ssr-handler +\n * a loader) share a single org_members round trip.\n */\nexport async function getOrgContext(event: H3Event): Promise<OrgContext> {\n  // Per-request memoization. Multiple call sites per request (action wrappers,\n  // SSR handler, loaders) must not each pay a separate org_members query.\n  const ctx = event.context as {\n    __anOrgContextCache?: Promise<OrgContext>;\n  };\n  // Evict on failure. A memoized failure would otherwise answer every later\n  // caller in this request with the wrong org.\n  return (ctx.__anOrgContextCache ??= resolveOrgContextUncached(event).catch(\n    (err) => {\n      delete ctx.__anOrgContextCache;\n      throw err;\n    },\n  ));\n}\n\ntype MembershipRow = {\n  orgId: string;\n  role: OrgRole;\n  orgName: string;\n  allowedDomain: string | null;\n};\n\nconst MEMBERSHIPS_CACHE_KEY = \"__anOrgMembershipsCache\";\nconst ACTIVE_ORG_SETTING_CACHE_KEY = \"__anActiveOrgSettingCache\";\n\ntype ActiveOrgSetting = { orgId: string | null } | null;\n\nfunction loadActiveOrgSettingForEvent(\n  event: H3Event,\n  email: string,\n): Promise<ActiveOrgSetting> {\n  const ctx = event.context as Record<string, unknown>;\n  const cache = ((ctx[ACTIVE_ORG_SETTING_CACHE_KEY] as\n    | Map<string, Promise<ActiveOrgSetting>>\n    | undefined) ??\n    (ctx[ACTIVE_ORG_SETTING_CACHE_KEY] = new Map<\n      string,\n      Promise<ActiveOrgSetting>\n    >())) as Map<string, Promise<ActiveOrgSetting>>;\n  const normalizedEmail = email.toLowerCase();\n  let promise = cache.get(normalizedEmail);\n  if (!promise) {\n    promise = getUserSetting(email, \"active-org-id\").then((value) => {\n      if (!value || !(\"orgId\" in value)) return null;\n      if (value.orgId === null) return { orgId: null };\n      return typeof value.orgId === \"string\" ? { orgId: value.orgId } : null;\n    });\n    cache.set(normalizedEmail, promise);\n  }\n  return promise;\n}\n\n/**\n * Per-request memoization of the org_members lookup, keyed by email on\n * `event.context`. Both the session org backfill (inside `getSession`) and\n * `getOrgContext` need the membership rows; without sharing, every request\n * whose session lacks an orgId pays the query twice.\n */\nfunction loadMembershipsForEvent(\n  event: H3Event,\n  email: string,\n): Promise<MembershipRow[] | null> {\n  const ctx = event.context as Record<string, unknown>;\n  const cache = ((ctx[MEMBERSHIPS_CACHE_KEY] as\n    | Map<string, Promise<MembershipRow[] | null>>\n    | undefined) ??\n    (ctx[MEMBERSHIPS_CACHE_KEY] = new Map<\n      string,\n      Promise<MembershipRow[] | null>\n    >())) as Map<string, Promise<MembershipRow[] | null>>;\n  let promise = cache.get(email);\n  if (!promise) {\n    // A failed read is evicted rather than memoized: caching it would make one\n    // transient error answer every later lookup in this request.\n    promise = loadMemberships(email).catch((err) => {\n      cache.delete(email);\n      throw err;\n    });\n    cache.set(email, promise);\n  }\n  return promise;\n}\n\nfunction updateMembershipsForEvent(\n  event: H3Event,\n  email: string,\n  memberships: MembershipRow[] | null,\n): void {\n  const ctx = event.context as Record<string, unknown>;\n  const cache = ctx[MEMBERSHIPS_CACHE_KEY] as\n    | Map<string, Promise<MembershipRow[] | null>>\n    | undefined;\n  cache?.set(email, Promise.resolve(memberships));\n}\n\nasync function resolveOrgContextUncached(event: H3Event): Promise<OrgContext> {\n  const session = await getSession(event);\n  const email = session?.email;\n  if (!email) return EMPTY_CONTEXT;\n  const sessionOrgId =\n    typeof session.orgId === \"string\" && session.orgId.trim()\n      ? session.orgId.trim()\n      : null;\n  const sessionOrgRole = normalizeOrgRole(session.orgRole);\n\n  const exec = getDbExec();\n\n  let memberships: MembershipRow[] | null;\n  try {\n    memberships = await loadMembershipsForEvent(event, email);\n  } catch (err) {\n    // A transient membership read must not downgrade an authenticated request\n    // to a private/solo scope when the session already carries its org.\n    if (sessionOrgId && isTransientDatabaseError(err)) {\n      return {\n        email,\n        orgId: sessionOrgId,\n        orgName: null,\n        role: sessionOrgRole,\n      };\n    }\n    throw err;\n  }\n  if (memberships === null) {\n    if (sessionOrgId) {\n      return {\n        email,\n        orgId: sessionOrgId,\n        orgName: null,\n        role: sessionOrgRole,\n      };\n    }\n    return { email, orgId: null, orgName: null, role: null };\n  }\n\n  const activeOrgSetting = await loadActiveOrgSettingForEvent(event, email);\n  const explicitPersonal = activeOrgSetting?.orgId === null;\n\n  const emailDomain = emailDomainOf(email);\n  // Membership in a domain-matched org is the only durable \"already joined\"\n  // signal. Recognizing the personal workspace by its *name* instead breaks the\n  // moment the provider display name or the workspace name changes, which\n  // strands an existing user in Personal with no way into their company org.\n  const shouldTryDomainAutoJoin =\n    !explicitPersonal &&\n    emailDomain !== null &&\n    !memberships.some((m) => m.allowedDomain?.toLowerCase() === emailDomain);\n\n  if (\n    !explicitPersonal &&\n    activeOrgSetting?.orgId &&\n    !shouldTryDomainAutoJoin\n  ) {\n    const active = memberships.find((m) => m.orgId === activeOrgSetting.orgId);\n    if (active) {\n      return {\n        email,\n        orgId: active.orgId,\n        orgName: active.orgName,\n        role: active.role,\n      };\n    }\n  }\n\n  const sessionMembership = sessionOrgId\n    ? memberships.find((m) => m.orgId === sessionOrgId)\n    : null;\n\n  if (shouldTryDomainAutoJoin) {\n    const membershipsBeforeJoin = memberships;\n    const joined = await autoJoinDomainMatchingOrgs(email, {\n      activateJoinedOrg: \"never\",\n    });\n    const joinedOrgId = joined.joined[0]?.orgId ?? null;\n    if (joinedOrgId) {\n      const refreshed = await loadMemberships(email);\n      if (refreshed !== null) {\n        memberships = refreshed;\n        updateMembershipsForEvent(event, email, refreshed);\n      }\n\n      const currentOrgId =\n        activeOrgSetting?.orgId ??\n        sessionOrgId ??\n        membershipsBeforeJoin[0]?.orgId ??\n        null;\n      const shouldActivate =\n        !explicitPersonal &&\n        (currentOrgId === null ||\n          (await isSoloOwnedWorkspace(\n            exec,\n            currentOrgId,\n            membershipsBeforeJoin,\n          )));\n\n      if (shouldActivate) {\n        await setActiveOrgId(email, joinedOrgId, \"joined domain-matched org\");\n        const active = memberships.find((m) => m.orgId === joinedOrgId);\n        if (active) {\n          return {\n            email,\n            orgId: active.orgId,\n            orgName: active.orgName,\n            role: active.role,\n          };\n        }\n      }\n    }\n  }\n\n  if (explicitPersonal) {\n    return { email, orgId: null, orgName: null, role: null };\n  }\n\n  if (activeOrgSetting?.orgId) {\n    const active = memberships.find((m) => m.orgId === activeOrgSetting.orgId);\n    if (active) {\n      return {\n        email,\n        orgId: active.orgId,\n        orgName: active.orgName,\n        role: active.role,\n      };\n    }\n  }\n\n  if (sessionOrgId) {\n    const active =\n      sessionMembership ?? memberships.find((m) => m.orgId === sessionOrgId);\n    if (active) {\n      return {\n        email,\n        orgId: active.orgId,\n        orgName: active.orgName,\n        role: active.role,\n      };\n    }\n    return {\n      email,\n      orgId: sessionOrgId,\n      orgName: null,\n      role: sessionOrgRole,\n    };\n  }\n\n  if (memberships.length === 0 && autoCreateDefaultOrgEnabled()) {\n    const created = await tryCreateDefaultOrg(exec, email, session);\n    if (created) return created;\n    // Creation failed (race / DB error); fall through with an empty org context\n    // so non-blocking invite/domain UI can still surface recovery options.\n  }\n\n  if (memberships.length === 0) {\n    return { email, orgId: null, orgName: null, role: null };\n  }\n\n  return {\n    email,\n    orgId: memberships[0].orgId,\n    orgName: memberships[0].orgName,\n    role: memberships[0].role,\n  };\n}\n\n/**\n * Ordering for every membership lookup that falls back to \"first membership\".\n * Without it the fallback is whatever order the plan happens to return, so a\n * multi-org user's active org can change between two identical requests — and\n * `getSession` then freezes that arbitrary answer into `session.orgId`.\n * `org_id` breaks ties so two memberships joined in the same millisecond still\n * resolve identically.\n */\nconst MEMBERSHIP_FALLBACK_ORDER_BY = `ORDER BY joined_at ASC, org_id ASC`;\n\nasync function loadMemberships(email: string): Promise<MembershipRow[] | null> {\n  const rows = await queryOrgMembers({\n    sql: `SELECT m.org_id AS \"orgId\", m.role AS role, o.name AS \"orgName\",\n                 o.allowed_domain AS \"allowedDomain\"\n          FROM org_members m\n          INNER JOIN organizations o ON m.org_id = o.id\n          WHERE LOWER(m.email) = ?\n          ${MEMBERSHIP_FALLBACK_ORDER_BY}`,\n    args: [email.toLowerCase()],\n  });\n  return (\n    rows?.map((r: any) => {\n      const domain = r.allowedDomain ?? r.allowed_domain;\n      return {\n        orgId: String(r.orgId ?? r.org_id),\n        role: String(r.role) as OrgRole,\n        orgName: String(r.orgName ?? r.org_name),\n        allowedDomain: domain ? String(domain) : null,\n      };\n    }) ?? null\n  );\n}\n\n/**\n * Resolve the active org ID for a given email — for non-HTTP contexts like\n * the integration webhook handler where we have an email but no event/session.\n * Picks the user's active-org-id setting if set, including explicit Personal,\n * otherwise the oldest membership.\n * Returns null if the user has no memberships.\n */\nexport async function resolveOrgIdForEmail(\n  email: string,\n): Promise<string | null> {\n  const rows = await queryOrgMembers({\n    sql: `SELECT org_id FROM org_members WHERE LOWER(email) = ?\n          ${MEMBERSHIP_FALLBACK_ORDER_BY}`,\n    args: [email.toLowerCase()],\n  });\n  if (!rows?.length) return null;\n  const ids = rows.map((r: any) => String(r.org_id));\n  const activeOrgSetting = (await getUserSetting(\n    email,\n    \"active-org-id\",\n  )) as ActiveOrgSetting;\n  if (activeOrgSetting?.orgId === null) return null;\n  if (activeOrgSetting?.orgId && ids.includes(activeOrgSetting.orgId)) {\n    return activeOrgSetting.orgId;\n  }\n  return ids[0];\n}\n\n/**\n * Event-aware variant of `resolveOrgIdForEmail` for HTTP request paths.\n * Shares the per-request membership lookup with `getOrgContext`, so the\n * session org backfill inside `getSession` and a later `getOrgContext` call\n * in the same request pay ONE org_members round trip, not two.\n */\nexport async function resolveOrgIdForEmailViaEvent(\n  event: H3Event,\n  email: string,\n): Promise<string | null> {\n  const memberships = await loadMembershipsForEvent(event, email);\n  if (!memberships || memberships.length === 0) return null;\n  const activeOrgSetting = await loadActiveOrgSettingForEvent(event, email);\n  if (activeOrgSetting?.orgId === null) return null;\n  if (\n    activeOrgSetting?.orgId &&\n    memberships.some((m) => m.orgId === activeOrgSetting.orgId)\n  ) {\n    return activeOrgSetting.orgId;\n  }\n  return memberships[0].orgId;\n}\n\n/**\n * Create a new organization and add the caller as a member with the given\n * role. Generates a per-org A2A secret for cross-app delegation and writes\n * the caller's `active-org-id` user-setting so the new org is immediately\n * active.\n *\n */\nexport async function createOrganization(\n  name: string,\n  email: string,\n  role: OrgRole = \"owner\",\n): Promise<{\n  id: string;\n  name: string;\n  role: OrgRole;\n  a2aSecret: string;\n  createdAt: number;\n}> {\n  const trimmedName = name.trim();\n  const exec = getDbExec();\n  const id = nanoid();\n  const createdAt = Date.now();\n  const { randomBytes } = await import(\"node:crypto\");\n  const a2aSecret = randomBytes(32).toString(\"base64url\");\n\n  await exec.execute({\n    sql: `INSERT INTO organizations (id, name, created_by, created_at, a2a_secret) VALUES (?, ?, ?, ?, ?)`,\n    args: [id, trimmedName, email, createdAt, a2aSecret],\n  });\n\n  await exec.execute({\n    sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,\n    args: [nanoid(), id, email, role, createdAt],\n  });\n\n  await warnOnAdditionalOrganization(exec, email, id, trimmedName);\n\n  await setActiveOrgId(email, id, `created organization \"${trimmedName}\"`);\n\n  return { id, name: trimmedName, role, a2aSecret, createdAt };\n}\n\n/**\n * A second organization is the single most expensive accident in this codebase:\n * vault credentials are scoped per organization, so creating one and activating\n * it orphans every key synced under the previous org, and the only symptom is a\n * missing-env-var error somewhere else entirely. The UI warns humans before\n * they click (`org.createOrgVaultNotice`); this covers the path that actually\n * did the damage — app code or a migration action calling `createOrganization`\n * directly, where no notice is ever rendered.\n */\nasync function warnOnAdditionalOrganization(\n  exec: ReturnType<typeof getDbExec>,\n  email: string,\n  newOrgId: string,\n  newOrgName: string,\n): Promise<void> {\n  try {\n    const { rows } = await exec.execute({\n      sql: `SELECT 1 FROM org_members WHERE LOWER(email) = ? AND org_id <> ? LIMIT 1`,\n      args: [email.toLowerCase(), newOrgId],\n    });\n    if (rows.length === 0) return;\n  } catch {\n    // \"Couldn't tell\" is not \"it didn't\" — swallowing the failed probe here made\n    // the function whose entire job is to not be silent, silent.\n    warnAgent({\n      severity: \"critical\",\n      code: \"org-additional-org-membership-unreadable\",\n      message:\n        `Created an organization \"${newOrgName}\" (${newOrgId}) and made it the account's active org, ` +\n        `but could not read whether that account already belonged to another organization. If it did, ` +\n        `every vault credential synced under the previous organization is now unreadable for it, and ` +\n        `requests will fail with missing-credential errors that name the key rather than this org ` +\n        `change. Confirm the account's memberships before continuing; if this came from a roster, ` +\n        `identity, or user-list migration, add the members to the EXISTING organization instead.`,\n    });\n    return;\n  }\n\n  warnAgent({\n    severity: \"critical\",\n    code: \"org-additional-organization\",\n    message:\n      `Created an ADDITIONAL organization \"${newOrgName}\" (${newOrgId}) ` +\n      `for an account that already belongs to another organization, and made it their active org. ` +\n      `Vault credentials are scoped per organization and are NOT shared between them: every API key ` +\n      `synced under the previous organization is now unreadable for this account until it is re-saved ` +\n      `in \"${newOrgName}\". Requests will fail with missing-credential errors that name the key rather ` +\n      `than this org change. If this came from a roster, identity, or user-list migration, add the ` +\n      `members to the EXISTING organization instead of creating a new one.`,\n  });\n}\n\nfunction defaultOrgName(\n  email: string,\n  session: { name?: string } | null,\n): string {\n  const full = session?.name?.trim();\n  if (full) return `${full}'s workspace`;\n  const local = email.split(\"@\")[0] ?? email;\n  const cleaned = local.replace(/[._-]+/g, \" \").trim();\n  const titled =\n    cleaned\n      .split(\" \")\n      .filter(Boolean)\n      .map((w) => w.charAt(0).toUpperCase() + w.slice(1))\n      .join(\" \") || \"My\";\n  return `${titled}'s workspace`;\n}\n\n/**\n * Check whether the user has a pending invitation. If so, auto-create\n * MUST be skipped — otherwise we'd provision a personal org for them\n * before they ever see the inviter's org in the invitation banner, and they'd\n * never join the team that invited them.\n */\nasync function hasPendingInvitation(\n  exec: ReturnType<typeof getDbExec>,\n  email: string,\n): Promise<boolean> {\n  try {\n    const { rows } = await exec.execute({\n      sql: `SELECT 1 FROM org_invitations WHERE LOWER(email) = ? AND status = 'pending' LIMIT 1`,\n      args: [email.toLowerCase()],\n    });\n    return rows.length > 0;\n  } catch {\n    // If we can't tell, err on the side of NOT auto-creating — the\n    // invitation banner or team UI can surface the situation.\n    return true;\n  }\n}\n\nasync function hasDomainMatch(\n  exec: ReturnType<typeof getDbExec>,\n  email: string,\n): Promise<boolean> {\n  try {\n    const domain = email.split(\"@\")[1]?.toLowerCase();\n    if (!domain) return false;\n    const { rows } = await exec.execute({\n      sql: `SELECT 1 FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,\n      args: [domain],\n    });\n    return rows.length > 0;\n  } catch {\n    return false;\n  }\n}\n\n/** Stale-claim threshold. A claim row this old is treated as abandoned\n *  (process crashed, DELETE failed, etc.) and a new caller may take it\n *  over. Long enough that two genuine concurrent first-loads don't\n *  trample each other (those settle in milliseconds), short enough that\n *  a stuck user recovers on their next navigation. */\nconst CLAIM_TTL_MS = 5 * 60 * 1000;\n\n/**\n * Attempt to provision a default org + owner membership for a user with\n * zero memberships.\n *\n * Race protection: claims the user's auto-create slot via an atomic\n * INSERT into the framework `settings` table (PRIMARY KEY (key) — so\n * concurrent inserts for the same key throw uniqueness violations on\n * both SQLite and Postgres). Only the request that wins the claim\n * proceeds to create the org; losers bail. By the time a losing\n * request retries on a subsequent navigation, the winner's org is in\n * `org_members` and the auto-create branch is skipped entirely.\n *\n * Stuck-state recovery: a stale claim (held longer than CLAIM_TTL_MS)\n * is reclaimed automatically. So even if the DELETE on the failure\n * path fails (network blip, DB error), the user isn't stranded — the\n * next request after the TTL elapses retries cleanly.\n *\n * Returns null on any failure so the caller can fall back to the\n * empty-context / client-guard path.\n */\nasync function tryCreateDefaultOrg(\n  exec: ReturnType<typeof getDbExec>,\n  email: string,\n  session: { name?: string } | null,\n): Promise<OrgContext | null> {\n  // Make sure the framework `settings` table exists before we use it as\n  // a claim primitive. getSetting() ensures the table on first call.\n  await getSetting(\"__init\").catch(() => null);\n\n  const claimKey = `u:${email.toLowerCase()}:auto-create-claim`;\n\n  if (!(await acquireClaim(exec, claimKey))) return null;\n\n  // Pending-invite check happens INSIDE the claim so the window where a\n  // newly-arrived invitation can be missed is narrowed to a single SQL\n  // round-trip. (A still-narrower window would require a transaction\n  // spanning org_invitations and settings — out of scope.)\n  if (await hasPendingInvitation(exec, email)) {\n    await releaseClaim(exec, claimKey);\n    return null;\n  }\n\n  if (await hasDomainMatch(exec, email)) {\n    await releaseClaim(exec, claimKey);\n    return null;\n  }\n\n  try {\n    const orgId = nanoid();\n    const orgName = defaultOrgName(email, session);\n    const now = Date.now();\n\n    await exec.execute({\n      sql: `INSERT INTO organizations (id, name, created_by, created_at) VALUES (?, ?, ?, ?)`,\n      args: [orgId, orgName, email, now],\n    });\n    await exec.execute({\n      sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,\n      args: [nanoid(), orgId, email, \"owner\", now],\n    });\n\n    await setActiveOrgId(email, orgId, \"auto-created default organization\");\n\n    return { email, orgId, orgName, role: \"owner\" };\n  } catch {\n    await releaseClaim(exec, claimKey);\n    return null;\n  }\n}\n\nasync function acquireClaim(\n  exec: ReturnType<typeof getDbExec>,\n  claimKey: string,\n): Promise<boolean> {\n  const now = Date.now();\n  try {\n    await exec.execute({\n      sql: `INSERT INTO settings (key, value, updated_at) VALUES (?, ?, ?)`,\n      args: [claimKey, JSON.stringify({ at: now }), now],\n    });\n    return true;\n  } catch {\n    // Conflict — someone else's claim is already in the row. If it's\n    // stale (older than CLAIM_TTL_MS) we take it over.\n    //\n    // CRITICAL: this MUST be a single atomic UPDATE guarded on\n    // `updated_at <= staleThreshold`. A read-then-DELETE-then-INSERT\n    // sequence lets two concurrent reclaimers each observe the stale\n    // timestamp, delete each other's fresh claim, and both think they\n    // won — duplicating org creation. The conditional UPDATE matches\n    // each stale row at most once: only the first writer sees\n    // rowsAffected === 1; the row's updated_at is now `now`, so any\n    // subsequent UPDATE no longer satisfies `updated_at <= staleThreshold`\n    // and matches zero rows.\n    const staleThreshold = now - CLAIM_TTL_MS;\n    const result = (await exec.execute({\n      sql: `UPDATE settings SET value = ?, updated_at = ? WHERE key = ? AND updated_at <= ?`,\n      args: [JSON.stringify({ at: now }), now, claimKey, staleThreshold],\n    })) as { rowsAffected?: number };\n    return (result.rowsAffected ?? 0) > 0;\n  }\n}\n\nasync function releaseClaim(\n  exec: ReturnType<typeof getDbExec>,\n  claimKey: string,\n): Promise<void> {\n  // Best-effort. If this fails (transient network/DB error), the\n  // CLAIM_TTL_MS-based takeover in acquireClaim recovers automatically\n  // on a future request — no permanent stuck state.\n  await exec\n    .execute({ sql: `DELETE FROM settings WHERE key = ?`, args: [claimKey] })\n    .catch(() => {});\n}\n\n/**\n * Look up the `allowed_domain` for an org by its ID.\n * Used when making outbound A2A calls so the JWT includes the\n * caller's org domain for cross-app org resolution.\n */\nexport async function getOrgDomain(orgId: string): Promise<string | null> {\n  try {\n    const exec = getDbExec();\n    const { rows } = await exec.execute({\n      sql: `SELECT allowed_domain FROM organizations WHERE id = ? LIMIT 1`,\n      args: [orgId],\n    });\n    if (!rows[0]) return null;\n    const domain = String((rows[0] as any).allowed_domain || \"\");\n    return domain || null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Look up the org's A2A secret by org ID.\n * Used when making outbound A2A calls so the JWT is signed with the\n * org-specific secret rather than the global A2A_SECRET env var.\n */\nexport async function getOrgA2ASecret(orgId: string): Promise<string | null> {\n  try {\n    const exec = getDbExec();\n    const { rows } = await exec.execute({\n      sql: `SELECT a2a_secret FROM organizations WHERE id = ? LIMIT 1`,\n      args: [orgId],\n    });\n    if (!rows[0]) return null;\n    const secret = String((rows[0] as any).a2a_secret || \"\");\n    return secret || null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Look up an org's A2A secret by its `allowed_domain`.\n * Used on the A2A receiving side: the caller's JWT includes `org_domain`,\n * and the receiver looks up which local org matches that domain to find\n * the secret used to verify the JWT signature.\n */\nexport async function getA2ASecretByDomain(\n  domain: string,\n): Promise<string | null> {\n  try {\n    const exec = getDbExec();\n    const { rows } = await exec.execute({\n      sql: `SELECT a2a_secret FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,\n      args: [domain.toLowerCase()],\n    });\n    if (!rows[0]) return null;\n    const secret = String((rows[0] as any).a2a_secret || \"\");\n    return secret || null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Resolve a local org by its `allowed_domain`.\n * Used on the A2A receiving side: the caller sends `org_domain` in the JWT,\n * and the receiver looks up which local org matches that domain.\n */\nexport async function resolveOrgByDomain(\n  domain: string,\n): Promise<{ orgId: string; orgName: string } | null> {\n  try {\n    const exec = getDbExec();\n    const { rows } = await exec.execute({\n      sql: `SELECT id, name FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,\n      args: [domain.toLowerCase()],\n    });\n    if (!rows[0]) return null;\n    return {\n      orgId: String((rows[0] as any).id),\n      orgName: String((rows[0] as any).name),\n    };\n  } catch {\n    return null;\n  }\n}\n"]}

package/dist/org/handlers.d.ts

@@ -21,7 +21,7 @@ export declare const getMyOrgHandler: import("h3").EventHandlerWithFetch<import(
         orgName: string;
     }[];
     allowedDomain: string;
-    a2aSecret: string;
+    a2aSecretSet: boolean;
 }>>;
 /** POST /_agent-native/org — create a new organization */
 export declare const createOrgHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
@@ -95,6 +95,21 @@ export declare const updateOrgHandler: import("h3").EventHandlerWithFetch<import
     orgId: string;
     name: any;
 }>>;
+/**
+ * DELETE /_agent-native/org — permanently delete the current organization
+ * (owner only). Body: { name: string } must match the org's current name
+ * (trim + case-insensitive) as a confirmation guard against misclicks.
+ *
+ * Deletes org_invitations, org-scoped settings, org_members, and the
+ * organizations row, then repoints the caller's active-org-id to another
+ * membership of theirs (or null for Personal) so they aren't left pointing
+ * at a deleted org.
+ */
+export declare const deleteOrgHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    success: boolean;
+    orgId: string;
+    nextOrgId: string;
+}>>;
 /** PUT /_agent-native/org/switch — switch the user's active organization */
 export declare const switchOrgHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     orgId: any;
@@ -111,6 +126,14 @@ export declare const joinByDomainHandler: import("h3").EventHandlerWithFetch<imp
 export declare const setDomainHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     domain: any;
 }>>;
+/**
+ * GET /_agent-native/org/a2a-secret — reveal the org's A2A secret
+ * (owner/admin only). Separate from `/org/me` so the secret is only ever sent
+ * to the browser when an operator explicitly asks to see or copy it.
+ */
+export declare const revealA2ASecretHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    a2aSecret: string;
+}>>;
 /** PUT /_agent-native/org/a2a-secret — regenerate or set the org's A2A secret (owner/admin only) */
 export declare const setA2ASecretHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     a2aSecret: any;

package/dist/org/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/org/handlers.ts"],"names":[],"mappings":"AAgDA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAkB1C,2FAA2F;AAC3F,eAAO,MAAM,eAAe;;;;;;;cAaA,OAAO;;;;;;;;;;eAIC,MAAM;iBAAW,MAAM;;;;GA0EzD,CAAC;AAEH,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB;;;;GAe3B,CAAC;AAEH,wDAAwD;AACxD,eAAO,MAAM,kBAAkB;;;cA2CH,OAAO;;;;;GAQjC,CAAC;AAqBH,UAAU,kBAAkB;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IACzB,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,mBAAmB;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAsED,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB;;;;GAuEnC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,sBAAsB;;;;;;;;;GAyBlC,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB;;;UAoD8B,OAAO;GAkBxE,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,mBAAmB;;GA2D/B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB;;;GAqEnC,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,gBAAgB;;;GA4B3B,CAAC;AAEH,4EAA4E;AAC5E,eAAO,MAAM,gBAAgB;;;UAkCC,OAAO;GAEnC,CAAC;AAEH,mGAAmG;AACnG,eAAO,MAAM,mBAAmB;;;UAqDR,OAAO;GAG9B,CAAC;AAEF,+FAA+F;AAC/F,eAAO,MAAM,gBAAgB;;GAsE3B,CAAC;AAEH,oGAAoG;AACpG,eAAO,MAAM,mBAAmB;;;GA0C/B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,oBAAoB;;;;;YA2DvB,MAAM;cACJ,MAAM;aACP,MAAM;YACP,OAAO;iBACF,MAAM;gBACP,MAAM;;GA6DnB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB;;;GAgGnC,CAAC"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/org/handlers.ts"],"names":[],"mappings":"AAgDA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAkB1C,2FAA2F;AAC3F,eAAO,MAAM,eAAe;;;;;;;cAaA,OAAO;;;;;;;;;;eAIC,MAAM;iBAAW,MAAM;;;;GAgFzD,CAAC;AAEH,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB;;;;GAe3B,CAAC;AAEH,wDAAwD;AACxD,eAAO,MAAM,kBAAkB;;;cA2CH,OAAO;;;;;GAQjC,CAAC;AAqBH,UAAU,kBAAkB;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IACzB,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,mBAAmB;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAsED,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB;;;;GAuEnC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,sBAAsB;;;;;;;;;GAyBlC,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB;;;UAoD8B,OAAO;GAkBxE,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,mBAAmB;;GA2D/B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB;;;GAqEnC,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,gBAAgB;;;GA4B3B,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB;;;;GAuF3B,CAAC;AAEH,4EAA4E;AAC5E,eAAO,MAAM,gBAAgB;;;UAkCC,OAAO;GAEnC,CAAC;AAEH,mGAAmG;AACnG,eAAO,MAAM,mBAAmB;;;UAqDR,OAAO;GAG9B,CAAC;AAEF,+FAA+F;AAC/F,eAAO,MAAM,gBAAgB;;GAsE3B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;GA0BlC,CAAC;AAEF,oGAAoG;AACpG,eAAO,MAAM,mBAAmB;;;GA0C/B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,oBAAoB;;;;;YA2DvB,MAAM;cACJ,MAAM;aACP,MAAM;YACP,OAAO;iBACF,MAAM;gBACP,MAAM;;GA6DnB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB;;;GAgGnC,CAAC"}