@agent-native/core 0.131.7 → 0.132.0

package/dist/org/auto-join-domain.js.map

@@ -1 +1 @@
-{"version":3,"file":"auto-join-domain.js","sourceRoot":"","sources":["../../src/org/auto-join-domain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,MAAM,MAAM,GAAG,GAAW,EAAE,CAC1B,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAiBhE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,QAAgB,EAChB,OAAO,GAA0B,EAAE;IAEnC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAErD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAEtD,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IAEvB,IAAI,OAAO,GAA6B,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;YAC3B,GAAG,EAAE;;;;;;;;;sCAS2B;YAChC,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;SACtB,CAAC,CAAC;QACH,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YAClC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;SACnC,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,uCAAuC;QACvC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAEnE,MAAM,MAAM,GAAmC,EAAE,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,OAAO,CAAC;gBACf,GAAG,EAAE,4FAA4F;gBACjG,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aAC7C,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,kEAAkE;YAClE,kDAAkD;QACpD,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,0DAA0D;IAC1D,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,iBAAiB,KAAK,OAAO,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YAC9D,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC3C,IAAI,OAAO,CAAC,iBAAiB,KAAK,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;gBACzD,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;gBAC9B,MAAM,cAAc,CAClB,KAAK,EACL,WAAW,EACX,gCAAgC,CACjC,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACjC,CAAC","sourcesContent":["import { getDbExec } from \"../db/client.js\";\nimport { getUserSetting } from \"../settings/user-settings.js\";\nimport { setActiveOrgId } from \"./active-org.js\";\n\nconst nanoid = (): string =>\n  globalThis.crypto?.randomUUID?.().replace(/-/g, \"\") ??\n  Math.random().toString(36).slice(2) + Date.now().toString(36);\n\nexport interface AutoJoinDomainResult {\n  joined: Array<{ orgId: string }>;\n  activeOrgId: string | null;\n}\n\nexport interface AutoJoinDomainOptions {\n  /**\n   * The signup hook should not clobber an org selected by an invite flow, but\n   * request-time org resolution may need to move an existing account from a\n   * personal workspace into its newly matched company org. `\"never\"` joins\n   * without touching `active-org-id` — the caller decides activation itself.\n   */\n  activateJoinedOrg?: \"if-missing\" | \"always\" | \"never\";\n}\n\n/**\n * Auto-join a newly-signed-up user into every org whose `allowed_domain`\n * matches their email domain.\n *\n * Called from the Better Auth `user.create.after` hook so that e.g. a new\n * `@builder.io` signup lands inside the existing Builder.io org on first\n * page load instead of starting in Personal and having to find the join\n * CTA. The org's owner opts into this by setting\n * `organizations.allowed_domain` — the column already gated the manual\n * \"Join your team\" UI in the picker; we use the same opt-in to drive\n * automatic join.\n *\n * Idempotent — skips orgs the user is already a member of and, by default,\n * never overwrites an existing `active-org-id` setting.\n *\n * Safe to call when the org tables don't exist (some templates don't use\n * the org module): it swallows the \"no such table\" error and returns\n * empty. Never throws — the caller is a signup hook and we don't want to\n * block a user from creating their account because of an org-tier issue.\n */\nexport async function autoJoinDomainMatchingOrgs(\n  rawEmail: string,\n  options: AutoJoinDomainOptions = {},\n): Promise<AutoJoinDomainResult> {\n  const email = rawEmail.trim().toLowerCase();\n  if (!email) return { joined: [], activeOrgId: null };\n\n  const domain = email.split(\"@\")[1]?.toLowerCase();\n  if (!domain) return { joined: [], activeOrgId: null };\n\n  const db = getDbExec();\n\n  let matches: Array<{ orgId: string }> = [];\n  try {\n    const res = await db.execute({\n      sql: `SELECT o.id AS \"orgId\"\n            FROM organizations o\n            WHERE LOWER(o.allowed_domain) = ?\n              AND NOT EXISTS (\n                SELECT 1\n                FROM org_members m\n                WHERE m.org_id = o.id\n                  AND LOWER(m.email) = ?\n              )\n            ORDER BY o.created_at ASC`,\n      args: [domain, email],\n    });\n    matches = res.rows.map((r: any) => ({\n      orgId: String(r.orgId ?? r.org_id),\n    }));\n  } catch {\n    // Template without org tables (or `allowed_domain` column not yet\n    // migrated). Not fatal — return empty.\n    return { joined: [], activeOrgId: null };\n  }\n\n  if (matches.length === 0) return { joined: [], activeOrgId: null };\n\n  const joined: AutoJoinDomainResult[\"joined\"] = [];\n  for (const m of matches) {\n    try {\n      await db.execute({\n        sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, 'member', ?)`,\n        args: [nanoid(), m.orgId, email, Date.now()],\n      });\n      joined.push({ orgId: m.orgId });\n    } catch {\n      // Race with a parallel join (e.g. user accepted an invite to the\n      // same org milliseconds earlier). The unique constraint keeps the\n      // existing membership intact; just skip this org.\n    }\n  }\n\n  // Set active-org-id to the first match only if the user doesn't already have\n  // one, unless the caller is request-time org resolution intentionally moving\n  // an existing account into its newly matched company org.\n  let activeOrgId: string | null = null;\n  if (joined[0] && options.activateJoinedOrg !== \"never\") {\n    try {\n      const existing = await getUserSetting(email, \"active-org-id\");\n      const hasActive = Boolean(existing?.orgId);\n      if (options.activateJoinedOrg === \"always\" || !hasActive) {\n        activeOrgId = joined[0].orgId;\n        await setActiveOrgId(\n          email,\n          activeOrgId,\n          \"auto-joined domain-matched org\",\n        );\n      }\n    } catch {\n      // settings table missing — not fatal.\n    }\n  }\n\n  return { joined, activeOrgId };\n}\n"]}
+{"version":3,"file":"auto-join-domain.js","sourceRoot":"","sources":["../../src/org/auto-join-domain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AAEvE,MAAM,MAAM,GAAG,GAAW,EAAE,CAC1B,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAiBhE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,QAAgB,EAChB,OAAO,GAA0B,EAAE;IAEnC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAErD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAEtD,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IAEvB,IAAI,OAAO,GAA6B,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;YAC3B,GAAG,EAAE;;;;;;;;;sCAS2B;YAChC,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;SACtB,CAAC,CAAC;QACH,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YAClC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;SACnC,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,uCAAuC;QACvC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAEnE,MAAM,MAAM,GAAmC,EAAE,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,OAAO,CAAC;gBACf,GAAG,EAAE,4FAA4F;gBACjG,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aAC7C,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAChC,6BAA6B,EAAE,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,kEAAkE;YAClE,kDAAkD;QACpD,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,0DAA0D;IAC1D,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,iBAAiB,KAAK,OAAO,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YAC9D,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC3C,IAAI,OAAO,CAAC,iBAAiB,KAAK,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;gBACzD,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;gBAC9B,MAAM,cAAc,CAClB,KAAK,EACL,WAAW,EACX,gCAAgC,CACjC,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACjC,CAAC","sourcesContent":["import { getDbExec } from \"../db/client.js\";\nimport { getUserSetting } from \"../settings/user-settings.js\";\nimport { setActiveOrgId } from \"./active-org.js\";\nimport { invalidateRequestMemberOrgIds } from \"./request-org-cache.js\";\n\nconst nanoid = (): string =>\n  globalThis.crypto?.randomUUID?.().replace(/-/g, \"\") ??\n  Math.random().toString(36).slice(2) + Date.now().toString(36);\n\nexport interface AutoJoinDomainResult {\n  joined: Array<{ orgId: string }>;\n  activeOrgId: string | null;\n}\n\nexport interface AutoJoinDomainOptions {\n  /**\n   * The signup hook should not clobber an org selected by an invite flow, but\n   * request-time org resolution may need to move an existing account from a\n   * personal workspace into its newly matched company org. `\"never\"` joins\n   * without touching `active-org-id` — the caller decides activation itself.\n   */\n  activateJoinedOrg?: \"if-missing\" | \"always\" | \"never\";\n}\n\n/**\n * Auto-join a newly-signed-up user into every org whose `allowed_domain`\n * matches their email domain.\n *\n * Called from the Better Auth `user.create.after` hook so that e.g. a new\n * `@builder.io` signup lands inside the existing Builder.io org on first\n * page load instead of starting in Personal and having to find the join\n * CTA. The org's owner opts into this by setting\n * `organizations.allowed_domain` — the column already gated the manual\n * \"Join your team\" UI in the picker; we use the same opt-in to drive\n * automatic join.\n *\n * Idempotent — skips orgs the user is already a member of and, by default,\n * never overwrites an existing `active-org-id` setting.\n *\n * Safe to call when the org tables don't exist (some templates don't use\n * the org module): it swallows the \"no such table\" error and returns\n * empty. Never throws — the caller is a signup hook and we don't want to\n * block a user from creating their account because of an org-tier issue.\n */\nexport async function autoJoinDomainMatchingOrgs(\n  rawEmail: string,\n  options: AutoJoinDomainOptions = {},\n): Promise<AutoJoinDomainResult> {\n  const email = rawEmail.trim().toLowerCase();\n  if (!email) return { joined: [], activeOrgId: null };\n\n  const domain = email.split(\"@\")[1]?.toLowerCase();\n  if (!domain) return { joined: [], activeOrgId: null };\n\n  const db = getDbExec();\n\n  let matches: Array<{ orgId: string }> = [];\n  try {\n    const res = await db.execute({\n      sql: `SELECT o.id AS \"orgId\"\n            FROM organizations o\n            WHERE LOWER(o.allowed_domain) = ?\n              AND NOT EXISTS (\n                SELECT 1\n                FROM org_members m\n                WHERE m.org_id = o.id\n                  AND LOWER(m.email) = ?\n              )\n            ORDER BY o.created_at ASC`,\n      args: [domain, email],\n    });\n    matches = res.rows.map((r: any) => ({\n      orgId: String(r.orgId ?? r.org_id),\n    }));\n  } catch {\n    // Template without org tables (or `allowed_domain` column not yet\n    // migrated). Not fatal — return empty.\n    return { joined: [], activeOrgId: null };\n  }\n\n  if (matches.length === 0) return { joined: [], activeOrgId: null };\n\n  const joined: AutoJoinDomainResult[\"joined\"] = [];\n  for (const m of matches) {\n    try {\n      await db.execute({\n        sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, 'member', ?)`,\n        args: [nanoid(), m.orgId, email, Date.now()],\n      });\n      joined.push({ orgId: m.orgId });\n      invalidateRequestMemberOrgIds();\n    } catch {\n      // Race with a parallel join (e.g. user accepted an invite to the\n      // same org milliseconds earlier). The unique constraint keeps the\n      // existing membership intact; just skip this org.\n    }\n  }\n\n  // Set active-org-id to the first match only if the user doesn't already have\n  // one, unless the caller is request-time org resolution intentionally moving\n  // an existing account into its newly matched company org.\n  let activeOrgId: string | null = null;\n  if (joined[0] && options.activateJoinedOrg !== \"never\") {\n    try {\n      const existing = await getUserSetting(email, \"active-org-id\");\n      const hasActive = Boolean(existing?.orgId);\n      if (options.activateJoinedOrg === \"always\" || !hasActive) {\n        activeOrgId = joined[0].orgId;\n        await setActiveOrgId(\n          email,\n          activeOrgId,\n          \"auto-joined domain-matched org\",\n        );\n      }\n    } catch {\n      // settings table missing — not fatal.\n    }\n  }\n\n  return { joined, activeOrgId };\n}\n"]}

package/dist/org/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/org/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AASlC,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAStD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,OAAO,EAAE,CAAC;CACjB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,CAQ5C;AA+CD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAcvE;AA4RD;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiBxB;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAYxB;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,OAAiB,GACtB,OAAO,CAAC;IACT,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CAuBD;AAyOD;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAaxE;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAa3E;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAaxB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAepD"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/org/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAalC,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAStD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,OAAO,EAAE,CAAC;CACjB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,CAQ5C;AA+CD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAcvE;AAkSD;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA0BxB;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgBxB;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,OAAiB,GACtB,OAAO,CAAC;IACT,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CAwBD;AA0OD;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAaxE;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAa3E;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAaxB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAepD"}

package/dist/org/context.js

@@ -5,6 +5,7 @@ import { getSetting } from "../settings/store.js";
 import { getUserSetting } from "../settings/user-settings.js";
 import { setActiveOrgId } from "./active-org.js";
 import { autoJoinDomainMatchingOrgs } from "./auto-join-domain.js";
+import { invalidateRequestMemberOrgIds, requestMemberOrgIds, } from "./request-org-cache.js";
 const EMPTY_CONTEXT = {
     email: "",
     orgId: null,
@@ -156,6 +157,11 @@ async function resolveOrgContextUncached(event) {
         : null;
     const sessionOrgRole = normalizeOrgRole(session.orgRole);
     const exec = getDbExec();
+    // Started before the memberships await so the two round trips overlap; the
+    // `catch` only covers the early returns below, the later `await` still
+    // propagates a real failure.
+    const activeOrgSettingPromise = loadActiveOrgSettingForEvent(event, email);
+    activeOrgSettingPromise.catch(() => { });
     let memberships;
     try {
         memberships = await loadMembershipsForEvent(event, email);
@@ -184,7 +190,7 @@ async function resolveOrgContextUncached(event) {
         }
         return { email, orgId: null, orgName: null, role: null };
     }
-    const activeOrgSetting = await loadActiveOrgSettingForEvent(event, email);
+    const activeOrgSetting = await activeOrgSettingPromise;
     const explicitPersonal = activeOrgSetting?.orgId === null;
     const emailDomain = emailDomainOf(email);
     // Membership in a domain-matched org is the only durable "already joined"
@@ -328,15 +334,23 @@ async function loadMemberships(email) {
  * Returns null if the user has no memberships.
  */
 export async function resolveOrgIdForEmail(email) {
-    const rows = await queryOrgMembers({
-        sql: `SELECT org_id FROM org_members WHERE LOWER(email) = ?
-          ${MEMBERSHIP_FALLBACK_ORDER_BY}`,
-        args: [email.toLowerCase()],
+    const idsPromise = requestMemberOrgIds(email, async () => {
+        const rows = await queryOrgMembers({
+            sql: `SELECT org_id FROM org_members WHERE LOWER(email) = ?
+            ${MEMBERSHIP_FALLBACK_ORDER_BY}`,
+            args: [email.toLowerCase()],
+        });
+        return rows?.map((r) => String(r.org_id)) ?? null;
     });
-    if (!rows?.length)
+    // Both reads depend only on the email, so they overlap instead of queueing.
+    // The `catch` only keeps the early return below from surfacing an unhandled
+    // rejection; the `await` further down still propagates the failure.
+    const settingPromise = getUserSetting(email, "active-org-id");
+    settingPromise.catch(() => { });
+    const ids = await idsPromise;
+    if (!ids?.length)
         return null;
-    const ids = rows.map((r) => String(r.org_id));
-    const activeOrgSetting = (await getUserSetting(email, "active-org-id"));
+    const activeOrgSetting = await settingPromise;
     if (activeOrgSetting?.orgId === null)
         return null;
     if (activeOrgSetting?.orgId && ids.includes(activeOrgSetting.orgId)) {
@@ -351,10 +365,14 @@ export async function resolveOrgIdForEmail(email) {
  * in the same request pay ONE org_members round trip, not two.
  */
 export async function resolveOrgIdForEmailViaEvent(event, email) {
+    // Overlapped, not queued: each is a separate round trip and this pair runs
+    // on the session-backfill path of every authenticated request.
+    const settingPromise = loadActiveOrgSettingForEvent(event, email);
+    settingPromise.catch(() => { });
     const memberships = await loadMembershipsForEvent(event, email);
     if (!memberships || memberships.length === 0)
         return null;
-    const activeOrgSetting = await loadActiveOrgSettingForEvent(event, email);
+    const activeOrgSetting = await settingPromise;
     if (activeOrgSetting?.orgId === null)
         return null;
     if (activeOrgSetting?.orgId &&
@@ -385,6 +403,7 @@ export async function createOrganization(name, email, role = "owner") {
         sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,
         args: [nanoid(), id, email, role, createdAt],
     });
+    invalidateRequestMemberOrgIds();
     await warnOnAdditionalOrganization(exec, email, id, trimmedName);
     await setActiveOrgId(email, id, `created organization "${trimmedName}"`);
     return { id, name: trimmedName, role, a2aSecret, createdAt };
@@ -539,6 +558,7 @@ async function tryCreateDefaultOrg(exec, email, session) {
             sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,
             args: [nanoid(), orgId, email, "owner", now],
         });
+        invalidateRequestMemberOrgIds();
         await setActiveOrgId(email, orgId, "auto-created default organization");
         return { email, orgId, orgName, role: "owner" };
     }

package/dist/org/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/org/context.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAGnE,MAAM,aAAa,GAAe;IAChC,KAAK,EAAE,EAAE;IACT,KAAK,EAAE,IAAI;IACX,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,IAAI;CACX,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAGrC;IACC,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClD,OAAO,IAAiC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,wBAAwB,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ;QACjE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAAkC,EAClC,KAAa,EACb,WAA4B;IAE5B,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,oEAAoE;YACzE,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAQ,CAAC;QAC3B,OAAO,MAAM,CAAC,GAAG,EAAE,WAAW,IAAI,GAAG,EAAE,WAAW,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAChD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,MAAM,GAAG,GAAW,EAAE,CAC1B,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAc;IAChD,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,GAAG,GAAG,KAAK,CAAC,OAEjB,CAAC;IACF,0EAA0E;IAC1E,6CAA6C;IAC7C,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,yBAAyB,CAAC,KAAK,CAAC,CAAC,KAAK,CACxE,CAAC,GAAG,EAAE,EAAE;QACN,OAAO,GAAG,CAAC,mBAAmB,CAAC;QAC/B,MAAM,GAAG,CAAC;IACZ,CAAC,CACF,CAAC,CAAC;AACL,CAAC;AASD,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AACxD,MAAM,4BAA4B,GAAG,2BAA2B,CAAC;AAIjE,SAAS,4BAA4B,CACnC,KAAc,EACd,KAAa;IAEb,MAAM,GAAG,GAAG,KAAK,CAAC,OAAkC,CAAC;IACrD,MAAM,KAAK,GAAG,CAAE,GAAG,CAAC,4BAA4B,CAElC;QACZ,CAAC,GAAG,CAAC,4BAA4B,CAAC,GAAG,IAAI,GAAG,EAGzC,CAAC,CAA2C,CAAC;IAClD,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,cAAc,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YAC9D,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/C,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI;gBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACjD,OAAO,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAC9B,KAAc,EACd,KAAa;IAEb,MAAM,GAAG,GAAG,KAAK,CAAC,OAAkC,CAAC;IACrD,MAAM,KAAK,GAAG,CAAE,GAAG,CAAC,qBAAqB,CAE3B;QACZ,CAAC,GAAG,CAAC,qBAAqB,CAAC,GAAG,IAAI,GAAG,EAGlC,CAAC,CAAiD,CAAC;IACxD,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,2EAA2E;QAC3E,6DAA6D;QAC7D,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC7C,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,yBAAyB,CAChC,KAAc,EACd,KAAa,EACb,WAAmC;IAEnC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAkC,CAAC;IACrD,MAAM,KAAK,GAAG,GAAG,CAAC,qBAAqB,CAE1B,CAAC;IACd,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAAc;IACrD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,aAAa,CAAC;IACjC,MAAM,YAAY,GAChB,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE;QACvD,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE;QACtB,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,cAAc,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzD,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IAEzB,IAAI,WAAmC,CAAC;IACxC,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,oEAAoE;QACpE,IAAI,YAAY,IAAI,wBAAwB,CAAC,GAAG,CAAC,EAAE,CAAC;YAClD,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,YAAY;gBACnB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,cAAc;aACrB,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,YAAY;gBACnB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,cAAc;aACrB,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,4BAA4B,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1E,MAAM,gBAAgB,GAAG,gBAAgB,EAAE,KAAK,KAAK,IAAI,CAAC;IAE1D,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACzC,0EAA0E;IAC1E,8EAA8E;IAC9E,wEAAwE;IACxE,2EAA2E;IAC3E,MAAM,uBAAuB,GAC3B,CAAC,gBAAgB;QACjB,WAAW,KAAK,IAAI;QACpB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,WAAW,EAAE,KAAK,WAAW,CAAC,CAAC;IAE3E,IACE,CAAC,gBAAgB;QACjB,gBAAgB,EAAE,KAAK;QACvB,CAAC,uBAAuB,EACxB,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,GAAG,YAAY;QACpC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC;QACnD,CAAC,CAAC,IAAI,CAAC;IAET,IAAI,uBAAuB,EAAE,CAAC;QAC5B,MAAM,qBAAqB,GAAG,WAAW,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,KAAK,EAAE;YACrD,iBAAiB,EAAE,OAAO;SAC3B,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;QACpD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;YAC/C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,WAAW,GAAG,SAAS,CAAC;gBACxB,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YACrD,CAAC;YAED,MAAM,YAAY,GAChB,gBAAgB,EAAE,KAAK;gBACvB,YAAY;gBACZ,qBAAqB,CAAC,CAAC,CAAC,EAAE,KAAK;gBAC/B,IAAI,CAAC;YACP,MAAM,cAAc,GAClB,CAAC,gBAAgB;gBACjB,CAAC,YAAY,KAAK,IAAI;oBACpB,CAAC,MAAM,oBAAoB,CACzB,IAAI,EACJ,YAAY,EACZ,qBAAqB,CACtB,CAAC,CAAC,CAAC;YAER,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,cAAc,CAAC,KAAK,EAAE,WAAW,EAAE,2BAA2B,CAAC,CAAC;gBACtE,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC;gBAChE,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO;wBACL,KAAK;wBACL,KAAK,EAAE,MAAM,CAAC,KAAK;wBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;qBAClB,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,gBAAgB,EAAE,KAAK,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,MAAM,GACV,iBAAiB,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC;QACzE,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC;QACJ,CAAC;QACD,OAAO;YACL,KAAK;YACL,KAAK,EAAE,YAAY;YACnB,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,cAAc;SACrB,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,2BAA2B,EAAE,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,4EAA4E;QAC5E,uEAAuE;IACzE,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,OAAO;QACL,KAAK;QACL,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK;QAC3B,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO;QAC/B,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;KAC1B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,4BAA4B,GAAG,oCAAoC,CAAC;AAE1E,KAAK,UAAU,eAAe,CAAC,KAAa;IAC1C,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC;QACjC,GAAG,EAAE;;;;;YAKG,4BAA4B,EAAE;QACtC,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;KAC5B,CAAC,CAAC;IACH,OAAO,CACL,IAAI,EAAE,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,cAAc,CAAC;QACnD,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;YAClC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAY;YAC/B,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC;YACxC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;SAC9C,CAAC;IACJ,CAAC,CAAC,IAAI,IAAI,CACX,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAa;IAEb,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC;QACjC,GAAG,EAAE;YACG,4BAA4B,EAAE;QACtC,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,EAAE,MAAM;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,MAAM,gBAAgB,GAAG,CAAC,MAAM,cAAc,CAC5C,KAAK,EACL,eAAe,CAChB,CAAqB,CAAC;IACvB,IAAI,gBAAgB,EAAE,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,gBAAgB,EAAE,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,gBAAgB,CAAC,KAAK,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAAc,EACd,KAAa;IAEb,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAChE,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,gBAAgB,GAAG,MAAM,4BAA4B,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1E,IAAI,gBAAgB,EAAE,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClD,IACE,gBAAgB,EAAE,KAAK;QACvB,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,KAAK,CAAC,EAC3D,CAAC;QACD,OAAO,gBAAgB,CAAC,KAAK,CAAC;IAChC,CAAC;IACD,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,KAAa,EACb,IAAI,GAAY,OAAO;IAQvB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;IACpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAExD,MAAM,IAAI,CAAC,OAAO,CAAC;QACjB,GAAG,EAAE,iGAAiG;QACtG,IAAI,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC;KACrD,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,OAAO,CAAC;QACjB,GAAG,EAAE,qFAAqF;QAC1F,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC;KAC7C,CAAC,CAAC;IAEH,MAAM,4BAA4B,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IAEjE,MAAM,cAAc,CAAC,KAAK,EAAE,EAAE,EAAE,yBAAyB,WAAW,GAAG,CAAC,CAAC;IAEzE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAC/D,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,4BAA4B,CACzC,IAAkC,EAClC,KAAa,EACb,QAAgB,EAChB,UAAkB;IAElB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,0EAA0E;YAC/E,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC;SACtC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;QAC7E,6DAA6D;QAC7D,SAAS,CAAC;YACR,QAAQ,EAAE,UAAU;YACpB,IAAI,EAAE,0CAA0C;YAChD,OAAO,EACL,4BAA4B,UAAU,MAAM,QAAQ,0CAA0C;gBAC9F,+FAA+F;gBAC/F,8FAA8F;gBAC9F,2FAA2F;gBAC3F,2FAA2F;gBAC3F,yFAAyF;SAC5F,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,SAAS,CAAC;QACR,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,6BAA6B;QACnC,OAAO,EACL,uCAAuC,UAAU,MAAM,QAAQ,IAAI;YACnE,6FAA6F;YAC7F,+FAA+F;YAC/F,iGAAiG;YACjG,OAAO,UAAU,gFAAgF;YACjG,8FAA8F;YAC9F,qEAAqE;KACxE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CACrB,KAAa,EACb,OAAiC;IAEjC,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACnC,IAAI,IAAI;QAAE,OAAO,GAAG,IAAI,cAAc,CAAC;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,MAAM,GACV,OAAO;SACJ,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAClD,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACvB,OAAO,GAAG,MAAM,cAAc,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAAkC,EAClC,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,qFAAqF;YAC1F,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SAC5B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,0DAA0D;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,IAAkC,EAClC,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,qEAAqE;YAC1E,IAAI,EAAE,CAAC,MAAM,CAAC;SACf,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;sDAIsD;AACtD,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,UAAU,mBAAmB,CAChC,IAAkC,EAClC,KAAa,EACb,OAAiC;IAEjC,sEAAsE;IACtE,mEAAmE;IACnE,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAE7C,MAAM,QAAQ,GAAG,KAAK,KAAK,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAE9D,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvD,sEAAsE;IACtE,qEAAqE;IACrE,mEAAmE;IACnE,yDAAyD;IACzD,IAAI,MAAM,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,GAAG,EAAE,kFAAkF;YACvF,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC;SACnC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,GAAG,EAAE,qFAAqF;YAC1F,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;SAC7C,CAAC,CAAC;QAEH,MAAM,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,mCAAmC,CAAC,CAAC;QAExE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,IAAkC,EAClC,QAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,GAAG,EAAE,gEAAgE;YACrE,IAAI,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC;SACnD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,mDAAmD;QACnD,EAAE;QACF,2DAA2D;QAC3D,iEAAiE;QACjE,iEAAiE;QACjE,kEAAkE;QAClE,iEAAiE;QACjE,0DAA0D;QAC1D,gEAAgE;QAChE,uEAAuE;QACvE,yBAAyB;QACzB,MAAM,cAAc,GAAG,GAAG,GAAG,YAAY,CAAC;QAC1C,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC;YACjC,GAAG,EAAE,iFAAiF;YACtF,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC;SACnE,CAAC,CAA8B,CAAC;QACjC,OAAO,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,IAAkC,EAClC,QAAgB;IAEhB,+DAA+D;IAC/D,qEAAqE;IACrE,kDAAkD;IAClD,MAAM,IAAI;SACP,OAAO,CAAC,EAAE,GAAG,EAAE,oCAAoC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;SACxE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAa;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,+DAA+D;YACpE,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;QAC7D,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,2DAA2D;YAChE,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzD,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,8EAA8E;YACnF,IAAI,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzD,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,4EAA4E;YACjF,IAAI,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO;YACL,KAAK,EAAE,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,IAAI,CAAC;SACvC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\n\nimport { warnAgent } from \"../agent/action-warnings.js\";\nimport { getDbExec, isTransientDatabaseError } from \"../db/client.js\";\nimport { getSession } from \"../server/auth.js\";\nimport { getSetting } from \"../settings/store.js\";\nimport { getUserSetting } from \"../settings/user-settings.js\";\nimport { setActiveOrgId } from \"./active-org.js\";\nimport { autoJoinDomainMatchingOrgs } from \"./auto-join-domain.js\";\nimport type { OrgContext, OrgRole } from \"./types.js\";\n\nconst EMPTY_CONTEXT: OrgContext = {\n  email: \"\",\n  orgId: null,\n  orgName: null,\n  role: null,\n};\n\n/**\n * The single way to read `org_members`, so no two call sites can pick opposite\n * defaults for the same failure. A transient database failure is NOT an answer\n * and propagates: a caller that turns it into \"no memberships\" silently drops\n * org scope, which hides every org-scoped credential behind a\n * permanent-sounding \"not configured\".\n *\n * `null` is every non-transient failure, not only the intended one (org tables\n * absent on a fresh install before migrations). A permanently unreadable table\n * — a role without SELECT, say — still reports as \"no rows\" here. Narrowing\n * that further means classifying \"no database configured\" as readable-absent,\n * which is load-bearing for CLI/script/test contexts that legitimately run\n * without a store; see `assertCredentialStoreReadable`.\n */\nexport async function queryOrgMembers(query: {\n  sql: string;\n  args: unknown[];\n}): Promise<Record<string, unknown>[] | null> {\n  try {\n    const { rows } = await getDbExec().execute(query);\n    return rows as Record<string, unknown>[];\n  } catch (err) {\n    if (isTransientDatabaseError(err)) throw err;\n    return null;\n  }\n}\n\nfunction normalizeOrgRole(value: unknown): OrgRole | null {\n  return value === \"owner\" || value === \"admin\" || value === \"member\"\n    ? value\n    : null;\n}\n\nfunction emailDomainOf(email: string): string | null {\n  return email.split(\"@\")[1]?.toLowerCase() || null;\n}\n\n/**\n * A workspace the user owns that nobody else has joined is a default/personal\n * workspace whatever it happens to be named, so moving the user into their\n * company org is safe. An org with other members is a team they deliberately\n * belong to — join the domain org in the background but leave them there.\n */\nasync function isSoloOwnedWorkspace(\n  exec: ReturnType<typeof getDbExec>,\n  orgId: string,\n  memberships: MembershipRow[],\n): Promise<boolean> {\n  const membership = memberships.find((m) => m.orgId === orgId);\n  if (!membership || membership.role !== \"owner\") return false;\n  try {\n    const { rows } = await exec.execute({\n      sql: `SELECT COUNT(*) AS \"memberCount\" FROM org_members WHERE org_id = ?`,\n      args: [orgId],\n    });\n    const row = rows[0] as any;\n    return Number(row?.memberCount ?? row?.membercount ?? 0) <= 1;\n  } catch {\n    return false;\n  }\n}\n\nfunction autoCreateDefaultOrgEnabled(): boolean {\n  const raw = process.env.AUTO_CREATE_DEFAULT_ORG;\n  if (raw === undefined || raw.trim() === \"\") return true;\n  return ![\"0\", \"false\", \"no\", \"off\"].includes(raw.trim().toLowerCase());\n}\n\nconst nanoid = (): string =>\n  globalThis.crypto?.randomUUID?.().replace(/-/g, \"\") ??\n  Math.random().toString(36).slice(2) + Date.now().toString(36);\n\n/**\n * Resolve the current user's organization context from their session.\n *\n * - Honors the user's `active-org-id` setting, including an explicit Personal\n *   context represented by `{ orgId: null }`.\n * - Falls back to the user's first membership.\n * - When the authenticated user has zero memberships, provisions a default org\n *   named after the user ({name}'s workspace, falling back to the email\n *   local-part). Set `AUTO_CREATE_DEFAULT_ORG=0` to opt out.\n *\n * Per-request memoized on `event.context` — mirrors the `getSession`\n * pattern so multiple callers in the same request (e.g. ssr-handler +\n * a loader) share a single org_members round trip.\n */\nexport async function getOrgContext(event: H3Event): Promise<OrgContext> {\n  // Per-request memoization. Multiple call sites per request (action wrappers,\n  // SSR handler, loaders) must not each pay a separate org_members query.\n  const ctx = event.context as {\n    __anOrgContextCache?: Promise<OrgContext>;\n  };\n  // Evict on failure. A memoized failure would otherwise answer every later\n  // caller in this request with the wrong org.\n  return (ctx.__anOrgContextCache ??= resolveOrgContextUncached(event).catch(\n    (err) => {\n      delete ctx.__anOrgContextCache;\n      throw err;\n    },\n  ));\n}\n\ntype MembershipRow = {\n  orgId: string;\n  role: OrgRole;\n  orgName: string;\n  allowedDomain: string | null;\n};\n\nconst MEMBERSHIPS_CACHE_KEY = \"__anOrgMembershipsCache\";\nconst ACTIVE_ORG_SETTING_CACHE_KEY = \"__anActiveOrgSettingCache\";\n\ntype ActiveOrgSetting = { orgId: string | null } | null;\n\nfunction loadActiveOrgSettingForEvent(\n  event: H3Event,\n  email: string,\n): Promise<ActiveOrgSetting> {\n  const ctx = event.context as Record<string, unknown>;\n  const cache = ((ctx[ACTIVE_ORG_SETTING_CACHE_KEY] as\n    | Map<string, Promise<ActiveOrgSetting>>\n    | undefined) ??\n    (ctx[ACTIVE_ORG_SETTING_CACHE_KEY] = new Map<\n      string,\n      Promise<ActiveOrgSetting>\n    >())) as Map<string, Promise<ActiveOrgSetting>>;\n  const normalizedEmail = email.toLowerCase();\n  let promise = cache.get(normalizedEmail);\n  if (!promise) {\n    promise = getUserSetting(email, \"active-org-id\").then((value) => {\n      if (!value || !(\"orgId\" in value)) return null;\n      if (value.orgId === null) return { orgId: null };\n      return typeof value.orgId === \"string\" ? { orgId: value.orgId } : null;\n    });\n    cache.set(normalizedEmail, promise);\n  }\n  return promise;\n}\n\n/**\n * Per-request memoization of the org_members lookup, keyed by email on\n * `event.context`. Both the session org backfill (inside `getSession`) and\n * `getOrgContext` need the membership rows; without sharing, every request\n * whose session lacks an orgId pays the query twice.\n */\nfunction loadMembershipsForEvent(\n  event: H3Event,\n  email: string,\n): Promise<MembershipRow[] | null> {\n  const ctx = event.context as Record<string, unknown>;\n  const cache = ((ctx[MEMBERSHIPS_CACHE_KEY] as\n    | Map<string, Promise<MembershipRow[] | null>>\n    | undefined) ??\n    (ctx[MEMBERSHIPS_CACHE_KEY] = new Map<\n      string,\n      Promise<MembershipRow[] | null>\n    >())) as Map<string, Promise<MembershipRow[] | null>>;\n  let promise = cache.get(email);\n  if (!promise) {\n    // A failed read is evicted rather than memoized: caching it would make one\n    // transient error answer every later lookup in this request.\n    promise = loadMemberships(email).catch((err) => {\n      cache.delete(email);\n      throw err;\n    });\n    cache.set(email, promise);\n  }\n  return promise;\n}\n\nfunction updateMembershipsForEvent(\n  event: H3Event,\n  email: string,\n  memberships: MembershipRow[] | null,\n): void {\n  const ctx = event.context as Record<string, unknown>;\n  const cache = ctx[MEMBERSHIPS_CACHE_KEY] as\n    | Map<string, Promise<MembershipRow[] | null>>\n    | undefined;\n  cache?.set(email, Promise.resolve(memberships));\n}\n\nasync function resolveOrgContextUncached(event: H3Event): Promise<OrgContext> {\n  const session = await getSession(event);\n  const email = session?.email;\n  if (!email) return EMPTY_CONTEXT;\n  const sessionOrgId =\n    typeof session.orgId === \"string\" && session.orgId.trim()\n      ? session.orgId.trim()\n      : null;\n  const sessionOrgRole = normalizeOrgRole(session.orgRole);\n\n  const exec = getDbExec();\n\n  let memberships: MembershipRow[] | null;\n  try {\n    memberships = await loadMembershipsForEvent(event, email);\n  } catch (err) {\n    // A transient membership read must not downgrade an authenticated request\n    // to a private/solo scope when the session already carries its org.\n    if (sessionOrgId && isTransientDatabaseError(err)) {\n      return {\n        email,\n        orgId: sessionOrgId,\n        orgName: null,\n        role: sessionOrgRole,\n      };\n    }\n    throw err;\n  }\n  if (memberships === null) {\n    if (sessionOrgId) {\n      return {\n        email,\n        orgId: sessionOrgId,\n        orgName: null,\n        role: sessionOrgRole,\n      };\n    }\n    return { email, orgId: null, orgName: null, role: null };\n  }\n\n  const activeOrgSetting = await loadActiveOrgSettingForEvent(event, email);\n  const explicitPersonal = activeOrgSetting?.orgId === null;\n\n  const emailDomain = emailDomainOf(email);\n  // Membership in a domain-matched org is the only durable \"already joined\"\n  // signal. Recognizing the personal workspace by its *name* instead breaks the\n  // moment the provider display name or the workspace name changes, which\n  // strands an existing user in Personal with no way into their company org.\n  const shouldTryDomainAutoJoin =\n    !explicitPersonal &&\n    emailDomain !== null &&\n    !memberships.some((m) => m.allowedDomain?.toLowerCase() === emailDomain);\n\n  if (\n    !explicitPersonal &&\n    activeOrgSetting?.orgId &&\n    !shouldTryDomainAutoJoin\n  ) {\n    const active = memberships.find((m) => m.orgId === activeOrgSetting.orgId);\n    if (active) {\n      return {\n        email,\n        orgId: active.orgId,\n        orgName: active.orgName,\n        role: active.role,\n      };\n    }\n  }\n\n  const sessionMembership = sessionOrgId\n    ? memberships.find((m) => m.orgId === sessionOrgId)\n    : null;\n\n  if (shouldTryDomainAutoJoin) {\n    const membershipsBeforeJoin = memberships;\n    const joined = await autoJoinDomainMatchingOrgs(email, {\n      activateJoinedOrg: \"never\",\n    });\n    const joinedOrgId = joined.joined[0]?.orgId ?? null;\n    if (joinedOrgId) {\n      const refreshed = await loadMemberships(email);\n      if (refreshed !== null) {\n        memberships = refreshed;\n        updateMembershipsForEvent(event, email, refreshed);\n      }\n\n      const currentOrgId =\n        activeOrgSetting?.orgId ??\n        sessionOrgId ??\n        membershipsBeforeJoin[0]?.orgId ??\n        null;\n      const shouldActivate =\n        !explicitPersonal &&\n        (currentOrgId === null ||\n          (await isSoloOwnedWorkspace(\n            exec,\n            currentOrgId,\n            membershipsBeforeJoin,\n          )));\n\n      if (shouldActivate) {\n        await setActiveOrgId(email, joinedOrgId, \"joined domain-matched org\");\n        const active = memberships.find((m) => m.orgId === joinedOrgId);\n        if (active) {\n          return {\n            email,\n            orgId: active.orgId,\n            orgName: active.orgName,\n            role: active.role,\n          };\n        }\n      }\n    }\n  }\n\n  if (explicitPersonal) {\n    return { email, orgId: null, orgName: null, role: null };\n  }\n\n  if (activeOrgSetting?.orgId) {\n    const active = memberships.find((m) => m.orgId === activeOrgSetting.orgId);\n    if (active) {\n      return {\n        email,\n        orgId: active.orgId,\n        orgName: active.orgName,\n        role: active.role,\n      };\n    }\n  }\n\n  if (sessionOrgId) {\n    const active =\n      sessionMembership ?? memberships.find((m) => m.orgId === sessionOrgId);\n    if (active) {\n      return {\n        email,\n        orgId: active.orgId,\n        orgName: active.orgName,\n        role: active.role,\n      };\n    }\n    return {\n      email,\n      orgId: sessionOrgId,\n      orgName: null,\n      role: sessionOrgRole,\n    };\n  }\n\n  if (memberships.length === 0 && autoCreateDefaultOrgEnabled()) {\n    const created = await tryCreateDefaultOrg(exec, email, session);\n    if (created) return created;\n    // Creation failed (race / DB error); fall through with an empty org context\n    // so non-blocking invite/domain UI can still surface recovery options.\n  }\n\n  if (memberships.length === 0) {\n    return { email, orgId: null, orgName: null, role: null };\n  }\n\n  return {\n    email,\n    orgId: memberships[0].orgId,\n    orgName: memberships[0].orgName,\n    role: memberships[0].role,\n  };\n}\n\n/**\n * Ordering for every membership lookup that falls back to \"first membership\".\n * Without it the fallback is whatever order the plan happens to return, so a\n * multi-org user's active org can change between two identical requests — and\n * `getSession` then freezes that arbitrary answer into `session.orgId`.\n * `org_id` breaks ties so two memberships joined in the same millisecond still\n * resolve identically.\n */\nconst MEMBERSHIP_FALLBACK_ORDER_BY = `ORDER BY joined_at ASC, org_id ASC`;\n\nasync function loadMemberships(email: string): Promise<MembershipRow[] | null> {\n  const rows = await queryOrgMembers({\n    sql: `SELECT m.org_id AS \"orgId\", m.role AS role, o.name AS \"orgName\",\n                 o.allowed_domain AS \"allowedDomain\"\n          FROM org_members m\n          INNER JOIN organizations o ON m.org_id = o.id\n          WHERE LOWER(m.email) = ?\n          ${MEMBERSHIP_FALLBACK_ORDER_BY}`,\n    args: [email.toLowerCase()],\n  });\n  return (\n    rows?.map((r: any) => {\n      const domain = r.allowedDomain ?? r.allowed_domain;\n      return {\n        orgId: String(r.orgId ?? r.org_id),\n        role: String(r.role) as OrgRole,\n        orgName: String(r.orgName ?? r.org_name),\n        allowedDomain: domain ? String(domain) : null,\n      };\n    }) ?? null\n  );\n}\n\n/**\n * Resolve the active org ID for a given email — for non-HTTP contexts like\n * the integration webhook handler where we have an email but no event/session.\n * Picks the user's active-org-id setting if set, including explicit Personal,\n * otherwise the oldest membership.\n * Returns null if the user has no memberships.\n */\nexport async function resolveOrgIdForEmail(\n  email: string,\n): Promise<string | null> {\n  const rows = await queryOrgMembers({\n    sql: `SELECT org_id FROM org_members WHERE LOWER(email) = ?\n          ${MEMBERSHIP_FALLBACK_ORDER_BY}`,\n    args: [email.toLowerCase()],\n  });\n  if (!rows?.length) return null;\n  const ids = rows.map((r: any) => String(r.org_id));\n  const activeOrgSetting = (await getUserSetting(\n    email,\n    \"active-org-id\",\n  )) as ActiveOrgSetting;\n  if (activeOrgSetting?.orgId === null) return null;\n  if (activeOrgSetting?.orgId && ids.includes(activeOrgSetting.orgId)) {\n    return activeOrgSetting.orgId;\n  }\n  return ids[0];\n}\n\n/**\n * Event-aware variant of `resolveOrgIdForEmail` for HTTP request paths.\n * Shares the per-request membership lookup with `getOrgContext`, so the\n * session org backfill inside `getSession` and a later `getOrgContext` call\n * in the same request pay ONE org_members round trip, not two.\n */\nexport async function resolveOrgIdForEmailViaEvent(\n  event: H3Event,\n  email: string,\n): Promise<string | null> {\n  const memberships = await loadMembershipsForEvent(event, email);\n  if (!memberships || memberships.length === 0) return null;\n  const activeOrgSetting = await loadActiveOrgSettingForEvent(event, email);\n  if (activeOrgSetting?.orgId === null) return null;\n  if (\n    activeOrgSetting?.orgId &&\n    memberships.some((m) => m.orgId === activeOrgSetting.orgId)\n  ) {\n    return activeOrgSetting.orgId;\n  }\n  return memberships[0].orgId;\n}\n\n/**\n * Create a new organization and add the caller as a member with the given\n * role. Generates a per-org A2A secret for cross-app delegation and writes\n * the caller's `active-org-id` user-setting so the new org is immediately\n * active.\n *\n */\nexport async function createOrganization(\n  name: string,\n  email: string,\n  role: OrgRole = \"owner\",\n): Promise<{\n  id: string;\n  name: string;\n  role: OrgRole;\n  a2aSecret: string;\n  createdAt: number;\n}> {\n  const trimmedName = name.trim();\n  const exec = getDbExec();\n  const id = nanoid();\n  const createdAt = Date.now();\n  const { randomBytes } = await import(\"node:crypto\");\n  const a2aSecret = randomBytes(32).toString(\"base64url\");\n\n  await exec.execute({\n    sql: `INSERT INTO organizations (id, name, created_by, created_at, a2a_secret) VALUES (?, ?, ?, ?, ?)`,\n    args: [id, trimmedName, email, createdAt, a2aSecret],\n  });\n\n  await exec.execute({\n    sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,\n    args: [nanoid(), id, email, role, createdAt],\n  });\n\n  await warnOnAdditionalOrganization(exec, email, id, trimmedName);\n\n  await setActiveOrgId(email, id, `created organization \"${trimmedName}\"`);\n\n  return { id, name: trimmedName, role, a2aSecret, createdAt };\n}\n\n/**\n * A second organization is the single most expensive accident in this codebase:\n * vault credentials are scoped per organization, so creating one and activating\n * it orphans every key synced under the previous org, and the only symptom is a\n * missing-env-var error somewhere else entirely. The UI warns humans before\n * they click (`org.createOrgVaultNotice`); this covers the path that actually\n * did the damage — app code or a migration action calling `createOrganization`\n * directly, where no notice is ever rendered.\n */\nasync function warnOnAdditionalOrganization(\n  exec: ReturnType<typeof getDbExec>,\n  email: string,\n  newOrgId: string,\n  newOrgName: string,\n): Promise<void> {\n  try {\n    const { rows } = await exec.execute({\n      sql: `SELECT 1 FROM org_members WHERE LOWER(email) = ? AND org_id <> ? LIMIT 1`,\n      args: [email.toLowerCase(), newOrgId],\n    });\n    if (rows.length === 0) return;\n  } catch {\n    // \"Couldn't tell\" is not \"it didn't\" — swallowing the failed probe here made\n    // the function whose entire job is to not be silent, silent.\n    warnAgent({\n      severity: \"critical\",\n      code: \"org-additional-org-membership-unreadable\",\n      message:\n        `Created an organization \"${newOrgName}\" (${newOrgId}) and made it the account's active org, ` +\n        `but could not read whether that account already belonged to another organization. If it did, ` +\n        `every vault credential synced under the previous organization is now unreadable for it, and ` +\n        `requests will fail with missing-credential errors that name the key rather than this org ` +\n        `change. Confirm the account's memberships before continuing; if this came from a roster, ` +\n        `identity, or user-list migration, add the members to the EXISTING organization instead.`,\n    });\n    return;\n  }\n\n  warnAgent({\n    severity: \"critical\",\n    code: \"org-additional-organization\",\n    message:\n      `Created an ADDITIONAL organization \"${newOrgName}\" (${newOrgId}) ` +\n      `for an account that already belongs to another organization, and made it their active org. ` +\n      `Vault credentials are scoped per organization and are NOT shared between them: every API key ` +\n      `synced under the previous organization is now unreadable for this account until it is re-saved ` +\n      `in \"${newOrgName}\". Requests will fail with missing-credential errors that name the key rather ` +\n      `than this org change. If this came from a roster, identity, or user-list migration, add the ` +\n      `members to the EXISTING organization instead of creating a new one.`,\n  });\n}\n\nfunction defaultOrgName(\n  email: string,\n  session: { name?: string } | null,\n): string {\n  const full = session?.name?.trim();\n  if (full) return `${full}'s workspace`;\n  const local = email.split(\"@\")[0] ?? email;\n  const cleaned = local.replace(/[._-]+/g, \" \").trim();\n  const titled =\n    cleaned\n      .split(\" \")\n      .filter(Boolean)\n      .map((w) => w.charAt(0).toUpperCase() + w.slice(1))\n      .join(\" \") || \"My\";\n  return `${titled}'s workspace`;\n}\n\n/**\n * Check whether the user has a pending invitation. If so, auto-create\n * MUST be skipped — otherwise we'd provision a personal org for them\n * before they ever see the inviter's org in the invitation banner, and they'd\n * never join the team that invited them.\n */\nasync function hasPendingInvitation(\n  exec: ReturnType<typeof getDbExec>,\n  email: string,\n): Promise<boolean> {\n  try {\n    const { rows } = await exec.execute({\n      sql: `SELECT 1 FROM org_invitations WHERE LOWER(email) = ? AND status = 'pending' LIMIT 1`,\n      args: [email.toLowerCase()],\n    });\n    return rows.length > 0;\n  } catch {\n    // If we can't tell, err on the side of NOT auto-creating — the\n    // invitation banner or team UI can surface the situation.\n    return true;\n  }\n}\n\nasync function hasDomainMatch(\n  exec: ReturnType<typeof getDbExec>,\n  email: string,\n): Promise<boolean> {\n  try {\n    const domain = email.split(\"@\")[1]?.toLowerCase();\n    if (!domain) return false;\n    const { rows } = await exec.execute({\n      sql: `SELECT 1 FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,\n      args: [domain],\n    });\n    return rows.length > 0;\n  } catch {\n    return false;\n  }\n}\n\n/** Stale-claim threshold. A claim row this old is treated as abandoned\n *  (process crashed, DELETE failed, etc.) and a new caller may take it\n *  over. Long enough that two genuine concurrent first-loads don't\n *  trample each other (those settle in milliseconds), short enough that\n *  a stuck user recovers on their next navigation. */\nconst CLAIM_TTL_MS = 5 * 60 * 1000;\n\n/**\n * Attempt to provision a default org + owner membership for a user with\n * zero memberships.\n *\n * Race protection: claims the user's auto-create slot via an atomic\n * INSERT into the framework `settings` table (PRIMARY KEY (key) — so\n * concurrent inserts for the same key throw uniqueness violations on\n * both SQLite and Postgres). Only the request that wins the claim\n * proceeds to create the org; losers bail. By the time a losing\n * request retries on a subsequent navigation, the winner's org is in\n * `org_members` and the auto-create branch is skipped entirely.\n *\n * Stuck-state recovery: a stale claim (held longer than CLAIM_TTL_MS)\n * is reclaimed automatically. So even if the DELETE on the failure\n * path fails (network blip, DB error), the user isn't stranded — the\n * next request after the TTL elapses retries cleanly.\n *\n * Returns null on any failure so the caller can fall back to the\n * empty-context / client-guard path.\n */\nasync function tryCreateDefaultOrg(\n  exec: ReturnType<typeof getDbExec>,\n  email: string,\n  session: { name?: string } | null,\n): Promise<OrgContext | null> {\n  // Make sure the framework `settings` table exists before we use it as\n  // a claim primitive. getSetting() ensures the table on first call.\n  await getSetting(\"__init\").catch(() => null);\n\n  const claimKey = `u:${email.toLowerCase()}:auto-create-claim`;\n\n  if (!(await acquireClaim(exec, claimKey))) return null;\n\n  // Pending-invite check happens INSIDE the claim so the window where a\n  // newly-arrived invitation can be missed is narrowed to a single SQL\n  // round-trip. (A still-narrower window would require a transaction\n  // spanning org_invitations and settings — out of scope.)\n  if (await hasPendingInvitation(exec, email)) {\n    await releaseClaim(exec, claimKey);\n    return null;\n  }\n\n  if (await hasDomainMatch(exec, email)) {\n    await releaseClaim(exec, claimKey);\n    return null;\n  }\n\n  try {\n    const orgId = nanoid();\n    const orgName = defaultOrgName(email, session);\n    const now = Date.now();\n\n    await exec.execute({\n      sql: `INSERT INTO organizations (id, name, created_by, created_at) VALUES (?, ?, ?, ?)`,\n      args: [orgId, orgName, email, now],\n    });\n    await exec.execute({\n      sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,\n      args: [nanoid(), orgId, email, \"owner\", now],\n    });\n\n    await setActiveOrgId(email, orgId, \"auto-created default organization\");\n\n    return { email, orgId, orgName, role: \"owner\" };\n  } catch {\n    await releaseClaim(exec, claimKey);\n    return null;\n  }\n}\n\nasync function acquireClaim(\n  exec: ReturnType<typeof getDbExec>,\n  claimKey: string,\n): Promise<boolean> {\n  const now = Date.now();\n  try {\n    await exec.execute({\n      sql: `INSERT INTO settings (key, value, updated_at) VALUES (?, ?, ?)`,\n      args: [claimKey, JSON.stringify({ at: now }), now],\n    });\n    return true;\n  } catch {\n    // Conflict — someone else's claim is already in the row. If it's\n    // stale (older than CLAIM_TTL_MS) we take it over.\n    //\n    // CRITICAL: this MUST be a single atomic UPDATE guarded on\n    // `updated_at <= staleThreshold`. A read-then-DELETE-then-INSERT\n    // sequence lets two concurrent reclaimers each observe the stale\n    // timestamp, delete each other's fresh claim, and both think they\n    // won — duplicating org creation. The conditional UPDATE matches\n    // each stale row at most once: only the first writer sees\n    // rowsAffected === 1; the row's updated_at is now `now`, so any\n    // subsequent UPDATE no longer satisfies `updated_at <= staleThreshold`\n    // and matches zero rows.\n    const staleThreshold = now - CLAIM_TTL_MS;\n    const result = (await exec.execute({\n      sql: `UPDATE settings SET value = ?, updated_at = ? WHERE key = ? AND updated_at <= ?`,\n      args: [JSON.stringify({ at: now }), now, claimKey, staleThreshold],\n    })) as { rowsAffected?: number };\n    return (result.rowsAffected ?? 0) > 0;\n  }\n}\n\nasync function releaseClaim(\n  exec: ReturnType<typeof getDbExec>,\n  claimKey: string,\n): Promise<void> {\n  // Best-effort. If this fails (transient network/DB error), the\n  // CLAIM_TTL_MS-based takeover in acquireClaim recovers automatically\n  // on a future request — no permanent stuck state.\n  await exec\n    .execute({ sql: `DELETE FROM settings WHERE key = ?`, args: [claimKey] })\n    .catch(() => {});\n}\n\n/**\n * Look up the `allowed_domain` for an org by its ID.\n * Used when making outbound A2A calls so the JWT includes the\n * caller's org domain for cross-app org resolution.\n */\nexport async function getOrgDomain(orgId: string): Promise<string | null> {\n  try {\n    const exec = getDbExec();\n    const { rows } = await exec.execute({\n      sql: `SELECT allowed_domain FROM organizations WHERE id = ? LIMIT 1`,\n      args: [orgId],\n    });\n    if (!rows[0]) return null;\n    const domain = String((rows[0] as any).allowed_domain || \"\");\n    return domain || null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Look up the org's A2A secret by org ID.\n * Used when making outbound A2A calls so the JWT is signed with the\n * org-specific secret rather than the global A2A_SECRET env var.\n */\nexport async function getOrgA2ASecret(orgId: string): Promise<string | null> {\n  try {\n    const exec = getDbExec();\n    const { rows } = await exec.execute({\n      sql: `SELECT a2a_secret FROM organizations WHERE id = ? LIMIT 1`,\n      args: [orgId],\n    });\n    if (!rows[0]) return null;\n    const secret = String((rows[0] as any).a2a_secret || \"\");\n    return secret || null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Look up an org's A2A secret by its `allowed_domain`.\n * Used on the A2A receiving side: the caller's JWT includes `org_domain`,\n * and the receiver looks up which local org matches that domain to find\n * the secret used to verify the JWT signature.\n */\nexport async function getA2ASecretByDomain(\n  domain: string,\n): Promise<string | null> {\n  try {\n    const exec = getDbExec();\n    const { rows } = await exec.execute({\n      sql: `SELECT a2a_secret FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,\n      args: [domain.toLowerCase()],\n    });\n    if (!rows[0]) return null;\n    const secret = String((rows[0] as any).a2a_secret || \"\");\n    return secret || null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Resolve a local org by its `allowed_domain`.\n * Used on the A2A receiving side: the caller sends `org_domain` in the JWT,\n * and the receiver looks up which local org matches that domain.\n */\nexport async function resolveOrgByDomain(\n  domain: string,\n): Promise<{ orgId: string; orgName: string } | null> {\n  try {\n    const exec = getDbExec();\n    const { rows } = await exec.execute({\n      sql: `SELECT id, name FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,\n      args: [domain.toLowerCase()],\n    });\n    if (!rows[0]) return null;\n    return {\n      orgId: String((rows[0] as any).id),\n      orgName: String((rows[0] as any).name),\n    };\n  } catch {\n    return null;\n  }\n}\n"]}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/org/context.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EACL,6BAA6B,EAC7B,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAGhC,MAAM,aAAa,GAAe;IAChC,KAAK,EAAE,EAAE;IACT,KAAK,EAAE,IAAI;IACX,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,IAAI;CACX,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAGrC;IACC,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClD,OAAO,IAAiC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,wBAAwB,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ;QACjE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAAkC,EAClC,KAAa,EACb,WAA4B;IAE5B,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,oEAAoE;YACzE,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAQ,CAAC;QAC3B,OAAO,MAAM,CAAC,GAAG,EAAE,WAAW,IAAI,GAAG,EAAE,WAAW,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAChD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,MAAM,GAAG,GAAW,EAAE,CAC1B,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAc;IAChD,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,GAAG,GAAG,KAAK,CAAC,OAEjB,CAAC;IACF,0EAA0E;IAC1E,6CAA6C;IAC7C,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,yBAAyB,CAAC,KAAK,CAAC,CAAC,KAAK,CACxE,CAAC,GAAG,EAAE,EAAE;QACN,OAAO,GAAG,CAAC,mBAAmB,CAAC;QAC/B,MAAM,GAAG,CAAC;IACZ,CAAC,CACF,CAAC,CAAC;AACL,CAAC;AASD,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AACxD,MAAM,4BAA4B,GAAG,2BAA2B,CAAC;AAIjE,SAAS,4BAA4B,CACnC,KAAc,EACd,KAAa;IAEb,MAAM,GAAG,GAAG,KAAK,CAAC,OAAkC,CAAC;IACrD,MAAM,KAAK,GAAG,CAAE,GAAG,CAAC,4BAA4B,CAElC;QACZ,CAAC,GAAG,CAAC,4BAA4B,CAAC,GAAG,IAAI,GAAG,EAGzC,CAAC,CAA2C,CAAC;IAClD,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,cAAc,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YAC9D,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/C,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI;gBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACjD,OAAO,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAC9B,KAAc,EACd,KAAa;IAEb,MAAM,GAAG,GAAG,KAAK,CAAC,OAAkC,CAAC;IACrD,MAAM,KAAK,GAAG,CAAE,GAAG,CAAC,qBAAqB,CAE3B;QACZ,CAAC,GAAG,CAAC,qBAAqB,CAAC,GAAG,IAAI,GAAG,EAGlC,CAAC,CAAiD,CAAC;IACxD,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,2EAA2E;QAC3E,6DAA6D;QAC7D,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC7C,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,yBAAyB,CAChC,KAAc,EACd,KAAa,EACb,WAAmC;IAEnC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAkC,CAAC;IACrD,MAAM,KAAK,GAAG,GAAG,CAAC,qBAAqB,CAE1B,CAAC;IACd,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAAc;IACrD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,aAAa,CAAC;IACjC,MAAM,YAAY,GAChB,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE;QACvD,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE;QACtB,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,cAAc,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzD,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IAEzB,2EAA2E;IAC3E,uEAAuE;IACvE,6BAA6B;IAC7B,MAAM,uBAAuB,GAAG,4BAA4B,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC3E,uBAAuB,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAExC,IAAI,WAAmC,CAAC;IACxC,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,oEAAoE;QACpE,IAAI,YAAY,IAAI,wBAAwB,CAAC,GAAG,CAAC,EAAE,CAAC;YAClD,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,YAAY;gBACnB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,cAAc;aACrB,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,YAAY;gBACnB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,cAAc;aACrB,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,CAAC;IACvD,MAAM,gBAAgB,GAAG,gBAAgB,EAAE,KAAK,KAAK,IAAI,CAAC;IAE1D,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACzC,0EAA0E;IAC1E,8EAA8E;IAC9E,wEAAwE;IACxE,2EAA2E;IAC3E,MAAM,uBAAuB,GAC3B,CAAC,gBAAgB;QACjB,WAAW,KAAK,IAAI;QACpB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,WAAW,EAAE,KAAK,WAAW,CAAC,CAAC;IAE3E,IACE,CAAC,gBAAgB;QACjB,gBAAgB,EAAE,KAAK;QACvB,CAAC,uBAAuB,EACxB,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,GAAG,YAAY;QACpC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC;QACnD,CAAC,CAAC,IAAI,CAAC;IAET,IAAI,uBAAuB,EAAE,CAAC;QAC5B,MAAM,qBAAqB,GAAG,WAAW,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,KAAK,EAAE;YACrD,iBAAiB,EAAE,OAAO;SAC3B,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;QACpD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;YAC/C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,WAAW,GAAG,SAAS,CAAC;gBACxB,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YACrD,CAAC;YAED,MAAM,YAAY,GAChB,gBAAgB,EAAE,KAAK;gBACvB,YAAY;gBACZ,qBAAqB,CAAC,CAAC,CAAC,EAAE,KAAK;gBAC/B,IAAI,CAAC;YACP,MAAM,cAAc,GAClB,CAAC,gBAAgB;gBACjB,CAAC,YAAY,KAAK,IAAI;oBACpB,CAAC,MAAM,oBAAoB,CACzB,IAAI,EACJ,YAAY,EACZ,qBAAqB,CACtB,CAAC,CAAC,CAAC;YAER,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,cAAc,CAAC,KAAK,EAAE,WAAW,EAAE,2BAA2B,CAAC,CAAC;gBACtE,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC;gBAChE,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO;wBACL,KAAK;wBACL,KAAK,EAAE,MAAM,CAAC,KAAK;wBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;qBAClB,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,gBAAgB,EAAE,KAAK,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC3E,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,MAAM,GACV,iBAAiB,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC;QACzE,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC;QACJ,CAAC;QACD,OAAO;YACL,KAAK;YACL,KAAK,EAAE,YAAY;YACnB,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,cAAc;SACrB,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,2BAA2B,EAAE,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,4EAA4E;QAC5E,uEAAuE;IACzE,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,OAAO;QACL,KAAK;QACL,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK;QAC3B,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO;QAC/B,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;KAC1B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,4BAA4B,GAAG,oCAAoC,CAAC;AAE1E,KAAK,UAAU,eAAe,CAAC,KAAa;IAC1C,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC;QACjC,GAAG,EAAE;;;;;YAKG,4BAA4B,EAAE;QACtC,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;KAC5B,CAAC,CAAC;IACH,OAAO,CACL,IAAI,EAAE,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,cAAc,CAAC;QACnD,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;YAClC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAY;YAC/B,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC;YACxC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;SAC9C,CAAC;IACJ,CAAC,CAAC,IAAI,IAAI,CACX,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAa;IAEb,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC;YACjC,GAAG,EAAE;cACG,4BAA4B,EAAE;YACtC,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SAC5B,CAAC,CAAC;QACH,OAAO,IAAI,EAAE,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC;IACzD,CAAC,CAAC,CAAC;IACH,4EAA4E;IAC5E,4EAA4E;IAC5E,oEAAoE;IACpE,MAAM,cAAc,GAAG,cAAc,CACnC,KAAK,EACL,eAAe,CACa,CAAC;IAC/B,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAE/B,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE,MAAM;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC;IAC9C,IAAI,gBAAgB,EAAE,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,gBAAgB,EAAE,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,gBAAgB,CAAC,KAAK,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAAc,EACd,KAAa;IAEb,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,cAAc,GAAG,4BAA4B,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAClE,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAChE,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC;IAC9C,IAAI,gBAAgB,EAAE,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClD,IACE,gBAAgB,EAAE,KAAK;QACvB,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,KAAK,CAAC,EAC3D,CAAC;QACD,OAAO,gBAAgB,CAAC,KAAK,CAAC;IAChC,CAAC;IACD,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,KAAa,EACb,IAAI,GAAY,OAAO;IAQvB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;IACpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAExD,MAAM,IAAI,CAAC,OAAO,CAAC;QACjB,GAAG,EAAE,iGAAiG;QACtG,IAAI,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC;KACrD,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,OAAO,CAAC;QACjB,GAAG,EAAE,qFAAqF;QAC1F,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC;KAC7C,CAAC,CAAC;IACH,6BAA6B,EAAE,CAAC;IAEhC,MAAM,4BAA4B,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IAEjE,MAAM,cAAc,CAAC,KAAK,EAAE,EAAE,EAAE,yBAAyB,WAAW,GAAG,CAAC,CAAC;IAEzE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAC/D,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,4BAA4B,CACzC,IAAkC,EAClC,KAAa,EACb,QAAgB,EAChB,UAAkB;IAElB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,0EAA0E;YAC/E,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC;SACtC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;QAC7E,6DAA6D;QAC7D,SAAS,CAAC;YACR,QAAQ,EAAE,UAAU;YACpB,IAAI,EAAE,0CAA0C;YAChD,OAAO,EACL,4BAA4B,UAAU,MAAM,QAAQ,0CAA0C;gBAC9F,+FAA+F;gBAC/F,8FAA8F;gBAC9F,2FAA2F;gBAC3F,2FAA2F;gBAC3F,yFAAyF;SAC5F,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,SAAS,CAAC;QACR,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,6BAA6B;QACnC,OAAO,EACL,uCAAuC,UAAU,MAAM,QAAQ,IAAI;YACnE,6FAA6F;YAC7F,+FAA+F;YAC/F,iGAAiG;YACjG,OAAO,UAAU,gFAAgF;YACjG,8FAA8F;YAC9F,qEAAqE;KACxE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CACrB,KAAa,EACb,OAAiC;IAEjC,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACnC,IAAI,IAAI;QAAE,OAAO,GAAG,IAAI,cAAc,CAAC;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,MAAM,GACV,OAAO;SACJ,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAClD,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACvB,OAAO,GAAG,MAAM,cAAc,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAAkC,EAClC,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,qFAAqF;YAC1F,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SAC5B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,0DAA0D;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,IAAkC,EAClC,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,qEAAqE;YAC1E,IAAI,EAAE,CAAC,MAAM,CAAC;SACf,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;sDAIsD;AACtD,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,UAAU,mBAAmB,CAChC,IAAkC,EAClC,KAAa,EACb,OAAiC;IAEjC,sEAAsE;IACtE,mEAAmE;IACnE,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAE7C,MAAM,QAAQ,GAAG,KAAK,KAAK,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAE9D,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvD,sEAAsE;IACtE,qEAAqE;IACrE,mEAAmE;IACnE,yDAAyD;IACzD,IAAI,MAAM,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,GAAG,EAAE,kFAAkF;YACvF,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC;SACnC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,GAAG,EAAE,qFAAqF;YAC1F,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;SAC7C,CAAC,CAAC;QACH,6BAA6B,EAAE,CAAC;QAEhC,MAAM,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,mCAAmC,CAAC,CAAC;QAExE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,IAAkC,EAClC,QAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,GAAG,EAAE,gEAAgE;YACrE,IAAI,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC;SACnD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,mDAAmD;QACnD,EAAE;QACF,2DAA2D;QAC3D,iEAAiE;QACjE,iEAAiE;QACjE,kEAAkE;QAClE,iEAAiE;QACjE,0DAA0D;QAC1D,gEAAgE;QAChE,uEAAuE;QACvE,yBAAyB;QACzB,MAAM,cAAc,GAAG,GAAG,GAAG,YAAY,CAAC;QAC1C,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC;YACjC,GAAG,EAAE,iFAAiF;YACtF,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC;SACnE,CAAC,CAA8B,CAAC;QACjC,OAAO,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,IAAkC,EAClC,QAAgB;IAEhB,+DAA+D;IAC/D,qEAAqE;IACrE,kDAAkD;IAClD,MAAM,IAAI;SACP,OAAO,CAAC,EAAE,GAAG,EAAE,oCAAoC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;SACxE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAa;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,+DAA+D;YACpE,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;QAC7D,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,2DAA2D;YAChE,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzD,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,8EAA8E;YACnF,IAAI,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzD,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,4EAA4E;YACjF,IAAI,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO;YACL,KAAK,EAAE,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,IAAI,CAAC;SACvC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\n\nimport { warnAgent } from \"../agent/action-warnings.js\";\nimport { getDbExec, isTransientDatabaseError } from \"../db/client.js\";\nimport { getSession } from \"../server/auth.js\";\nimport { getSetting } from \"../settings/store.js\";\nimport { getUserSetting } from \"../settings/user-settings.js\";\nimport { setActiveOrgId } from \"./active-org.js\";\nimport { autoJoinDomainMatchingOrgs } from \"./auto-join-domain.js\";\nimport {\n  invalidateRequestMemberOrgIds,\n  requestMemberOrgIds,\n} from \"./request-org-cache.js\";\nimport type { OrgContext, OrgRole } from \"./types.js\";\n\nconst EMPTY_CONTEXT: OrgContext = {\n  email: \"\",\n  orgId: null,\n  orgName: null,\n  role: null,\n};\n\n/**\n * The single way to read `org_members`, so no two call sites can pick opposite\n * defaults for the same failure. A transient database failure is NOT an answer\n * and propagates: a caller that turns it into \"no memberships\" silently drops\n * org scope, which hides every org-scoped credential behind a\n * permanent-sounding \"not configured\".\n *\n * `null` is every non-transient failure, not only the intended one (org tables\n * absent on a fresh install before migrations). A permanently unreadable table\n * — a role without SELECT, say — still reports as \"no rows\" here. Narrowing\n * that further means classifying \"no database configured\" as readable-absent,\n * which is load-bearing for CLI/script/test contexts that legitimately run\n * without a store; see `assertCredentialStoreReadable`.\n */\nexport async function queryOrgMembers(query: {\n  sql: string;\n  args: unknown[];\n}): Promise<Record<string, unknown>[] | null> {\n  try {\n    const { rows } = await getDbExec().execute(query);\n    return rows as Record<string, unknown>[];\n  } catch (err) {\n    if (isTransientDatabaseError(err)) throw err;\n    return null;\n  }\n}\n\nfunction normalizeOrgRole(value: unknown): OrgRole | null {\n  return value === \"owner\" || value === \"admin\" || value === \"member\"\n    ? value\n    : null;\n}\n\nfunction emailDomainOf(email: string): string | null {\n  return email.split(\"@\")[1]?.toLowerCase() || null;\n}\n\n/**\n * A workspace the user owns that nobody else has joined is a default/personal\n * workspace whatever it happens to be named, so moving the user into their\n * company org is safe. An org with other members is a team they deliberately\n * belong to — join the domain org in the background but leave them there.\n */\nasync function isSoloOwnedWorkspace(\n  exec: ReturnType<typeof getDbExec>,\n  orgId: string,\n  memberships: MembershipRow[],\n): Promise<boolean> {\n  const membership = memberships.find((m) => m.orgId === orgId);\n  if (!membership || membership.role !== \"owner\") return false;\n  try {\n    const { rows } = await exec.execute({\n      sql: `SELECT COUNT(*) AS \"memberCount\" FROM org_members WHERE org_id = ?`,\n      args: [orgId],\n    });\n    const row = rows[0] as any;\n    return Number(row?.memberCount ?? row?.membercount ?? 0) <= 1;\n  } catch {\n    return false;\n  }\n}\n\nfunction autoCreateDefaultOrgEnabled(): boolean {\n  const raw = process.env.AUTO_CREATE_DEFAULT_ORG;\n  if (raw === undefined || raw.trim() === \"\") return true;\n  return ![\"0\", \"false\", \"no\", \"off\"].includes(raw.trim().toLowerCase());\n}\n\nconst nanoid = (): string =>\n  globalThis.crypto?.randomUUID?.().replace(/-/g, \"\") ??\n  Math.random().toString(36).slice(2) + Date.now().toString(36);\n\n/**\n * Resolve the current user's organization context from their session.\n *\n * - Honors the user's `active-org-id` setting, including an explicit Personal\n *   context represented by `{ orgId: null }`.\n * - Falls back to the user's first membership.\n * - When the authenticated user has zero memberships, provisions a default org\n *   named after the user ({name}'s workspace, falling back to the email\n *   local-part). Set `AUTO_CREATE_DEFAULT_ORG=0` to opt out.\n *\n * Per-request memoized on `event.context` — mirrors the `getSession`\n * pattern so multiple callers in the same request (e.g. ssr-handler +\n * a loader) share a single org_members round trip.\n */\nexport async function getOrgContext(event: H3Event): Promise<OrgContext> {\n  // Per-request memoization. Multiple call sites per request (action wrappers,\n  // SSR handler, loaders) must not each pay a separate org_members query.\n  const ctx = event.context as {\n    __anOrgContextCache?: Promise<OrgContext>;\n  };\n  // Evict on failure. A memoized failure would otherwise answer every later\n  // caller in this request with the wrong org.\n  return (ctx.__anOrgContextCache ??= resolveOrgContextUncached(event).catch(\n    (err) => {\n      delete ctx.__anOrgContextCache;\n      throw err;\n    },\n  ));\n}\n\ntype MembershipRow = {\n  orgId: string;\n  role: OrgRole;\n  orgName: string;\n  allowedDomain: string | null;\n};\n\nconst MEMBERSHIPS_CACHE_KEY = \"__anOrgMembershipsCache\";\nconst ACTIVE_ORG_SETTING_CACHE_KEY = \"__anActiveOrgSettingCache\";\n\ntype ActiveOrgSetting = { orgId: string | null } | null;\n\nfunction loadActiveOrgSettingForEvent(\n  event: H3Event,\n  email: string,\n): Promise<ActiveOrgSetting> {\n  const ctx = event.context as Record<string, unknown>;\n  const cache = ((ctx[ACTIVE_ORG_SETTING_CACHE_KEY] as\n    | Map<string, Promise<ActiveOrgSetting>>\n    | undefined) ??\n    (ctx[ACTIVE_ORG_SETTING_CACHE_KEY] = new Map<\n      string,\n      Promise<ActiveOrgSetting>\n    >())) as Map<string, Promise<ActiveOrgSetting>>;\n  const normalizedEmail = email.toLowerCase();\n  let promise = cache.get(normalizedEmail);\n  if (!promise) {\n    promise = getUserSetting(email, \"active-org-id\").then((value) => {\n      if (!value || !(\"orgId\" in value)) return null;\n      if (value.orgId === null) return { orgId: null };\n      return typeof value.orgId === \"string\" ? { orgId: value.orgId } : null;\n    });\n    cache.set(normalizedEmail, promise);\n  }\n  return promise;\n}\n\n/**\n * Per-request memoization of the org_members lookup, keyed by email on\n * `event.context`. Both the session org backfill (inside `getSession`) and\n * `getOrgContext` need the membership rows; without sharing, every request\n * whose session lacks an orgId pays the query twice.\n */\nfunction loadMembershipsForEvent(\n  event: H3Event,\n  email: string,\n): Promise<MembershipRow[] | null> {\n  const ctx = event.context as Record<string, unknown>;\n  const cache = ((ctx[MEMBERSHIPS_CACHE_KEY] as\n    | Map<string, Promise<MembershipRow[] | null>>\n    | undefined) ??\n    (ctx[MEMBERSHIPS_CACHE_KEY] = new Map<\n      string,\n      Promise<MembershipRow[] | null>\n    >())) as Map<string, Promise<MembershipRow[] | null>>;\n  let promise = cache.get(email);\n  if (!promise) {\n    // A failed read is evicted rather than memoized: caching it would make one\n    // transient error answer every later lookup in this request.\n    promise = loadMemberships(email).catch((err) => {\n      cache.delete(email);\n      throw err;\n    });\n    cache.set(email, promise);\n  }\n  return promise;\n}\n\nfunction updateMembershipsForEvent(\n  event: H3Event,\n  email: string,\n  memberships: MembershipRow[] | null,\n): void {\n  const ctx = event.context as Record<string, unknown>;\n  const cache = ctx[MEMBERSHIPS_CACHE_KEY] as\n    | Map<string, Promise<MembershipRow[] | null>>\n    | undefined;\n  cache?.set(email, Promise.resolve(memberships));\n}\n\nasync function resolveOrgContextUncached(event: H3Event): Promise<OrgContext> {\n  const session = await getSession(event);\n  const email = session?.email;\n  if (!email) return EMPTY_CONTEXT;\n  const sessionOrgId =\n    typeof session.orgId === \"string\" && session.orgId.trim()\n      ? session.orgId.trim()\n      : null;\n  const sessionOrgRole = normalizeOrgRole(session.orgRole);\n\n  const exec = getDbExec();\n\n  // Started before the memberships await so the two round trips overlap; the\n  // `catch` only covers the early returns below, the later `await` still\n  // propagates a real failure.\n  const activeOrgSettingPromise = loadActiveOrgSettingForEvent(event, email);\n  activeOrgSettingPromise.catch(() => {});\n\n  let memberships: MembershipRow[] | null;\n  try {\n    memberships = await loadMembershipsForEvent(event, email);\n  } catch (err) {\n    // A transient membership read must not downgrade an authenticated request\n    // to a private/solo scope when the session already carries its org.\n    if (sessionOrgId && isTransientDatabaseError(err)) {\n      return {\n        email,\n        orgId: sessionOrgId,\n        orgName: null,\n        role: sessionOrgRole,\n      };\n    }\n    throw err;\n  }\n  if (memberships === null) {\n    if (sessionOrgId) {\n      return {\n        email,\n        orgId: sessionOrgId,\n        orgName: null,\n        role: sessionOrgRole,\n      };\n    }\n    return { email, orgId: null, orgName: null, role: null };\n  }\n\n  const activeOrgSetting = await activeOrgSettingPromise;\n  const explicitPersonal = activeOrgSetting?.orgId === null;\n\n  const emailDomain = emailDomainOf(email);\n  // Membership in a domain-matched org is the only durable \"already joined\"\n  // signal. Recognizing the personal workspace by its *name* instead breaks the\n  // moment the provider display name or the workspace name changes, which\n  // strands an existing user in Personal with no way into their company org.\n  const shouldTryDomainAutoJoin =\n    !explicitPersonal &&\n    emailDomain !== null &&\n    !memberships.some((m) => m.allowedDomain?.toLowerCase() === emailDomain);\n\n  if (\n    !explicitPersonal &&\n    activeOrgSetting?.orgId &&\n    !shouldTryDomainAutoJoin\n  ) {\n    const active = memberships.find((m) => m.orgId === activeOrgSetting.orgId);\n    if (active) {\n      return {\n        email,\n        orgId: active.orgId,\n        orgName: active.orgName,\n        role: active.role,\n      };\n    }\n  }\n\n  const sessionMembership = sessionOrgId\n    ? memberships.find((m) => m.orgId === sessionOrgId)\n    : null;\n\n  if (shouldTryDomainAutoJoin) {\n    const membershipsBeforeJoin = memberships;\n    const joined = await autoJoinDomainMatchingOrgs(email, {\n      activateJoinedOrg: \"never\",\n    });\n    const joinedOrgId = joined.joined[0]?.orgId ?? null;\n    if (joinedOrgId) {\n      const refreshed = await loadMemberships(email);\n      if (refreshed !== null) {\n        memberships = refreshed;\n        updateMembershipsForEvent(event, email, refreshed);\n      }\n\n      const currentOrgId =\n        activeOrgSetting?.orgId ??\n        sessionOrgId ??\n        membershipsBeforeJoin[0]?.orgId ??\n        null;\n      const shouldActivate =\n        !explicitPersonal &&\n        (currentOrgId === null ||\n          (await isSoloOwnedWorkspace(\n            exec,\n            currentOrgId,\n            membershipsBeforeJoin,\n          )));\n\n      if (shouldActivate) {\n        await setActiveOrgId(email, joinedOrgId, \"joined domain-matched org\");\n        const active = memberships.find((m) => m.orgId === joinedOrgId);\n        if (active) {\n          return {\n            email,\n            orgId: active.orgId,\n            orgName: active.orgName,\n            role: active.role,\n          };\n        }\n      }\n    }\n  }\n\n  if (explicitPersonal) {\n    return { email, orgId: null, orgName: null, role: null };\n  }\n\n  if (activeOrgSetting?.orgId) {\n    const active = memberships.find((m) => m.orgId === activeOrgSetting.orgId);\n    if (active) {\n      return {\n        email,\n        orgId: active.orgId,\n        orgName: active.orgName,\n        role: active.role,\n      };\n    }\n  }\n\n  if (sessionOrgId) {\n    const active =\n      sessionMembership ?? memberships.find((m) => m.orgId === sessionOrgId);\n    if (active) {\n      return {\n        email,\n        orgId: active.orgId,\n        orgName: active.orgName,\n        role: active.role,\n      };\n    }\n    return {\n      email,\n      orgId: sessionOrgId,\n      orgName: null,\n      role: sessionOrgRole,\n    };\n  }\n\n  if (memberships.length === 0 && autoCreateDefaultOrgEnabled()) {\n    const created = await tryCreateDefaultOrg(exec, email, session);\n    if (created) return created;\n    // Creation failed (race / DB error); fall through with an empty org context\n    // so non-blocking invite/domain UI can still surface recovery options.\n  }\n\n  if (memberships.length === 0) {\n    return { email, orgId: null, orgName: null, role: null };\n  }\n\n  return {\n    email,\n    orgId: memberships[0].orgId,\n    orgName: memberships[0].orgName,\n    role: memberships[0].role,\n  };\n}\n\n/**\n * Ordering for every membership lookup that falls back to \"first membership\".\n * Without it the fallback is whatever order the plan happens to return, so a\n * multi-org user's active org can change between two identical requests — and\n * `getSession` then freezes that arbitrary answer into `session.orgId`.\n * `org_id` breaks ties so two memberships joined in the same millisecond still\n * resolve identically.\n */\nconst MEMBERSHIP_FALLBACK_ORDER_BY = `ORDER BY joined_at ASC, org_id ASC`;\n\nasync function loadMemberships(email: string): Promise<MembershipRow[] | null> {\n  const rows = await queryOrgMembers({\n    sql: `SELECT m.org_id AS \"orgId\", m.role AS role, o.name AS \"orgName\",\n                 o.allowed_domain AS \"allowedDomain\"\n          FROM org_members m\n          INNER JOIN organizations o ON m.org_id = o.id\n          WHERE LOWER(m.email) = ?\n          ${MEMBERSHIP_FALLBACK_ORDER_BY}`,\n    args: [email.toLowerCase()],\n  });\n  return (\n    rows?.map((r: any) => {\n      const domain = r.allowedDomain ?? r.allowed_domain;\n      return {\n        orgId: String(r.orgId ?? r.org_id),\n        role: String(r.role) as OrgRole,\n        orgName: String(r.orgName ?? r.org_name),\n        allowedDomain: domain ? String(domain) : null,\n      };\n    }) ?? null\n  );\n}\n\n/**\n * Resolve the active org ID for a given email — for non-HTTP contexts like\n * the integration webhook handler where we have an email but no event/session.\n * Picks the user's active-org-id setting if set, including explicit Personal,\n * otherwise the oldest membership.\n * Returns null if the user has no memberships.\n */\nexport async function resolveOrgIdForEmail(\n  email: string,\n): Promise<string | null> {\n  const idsPromise = requestMemberOrgIds(email, async () => {\n    const rows = await queryOrgMembers({\n      sql: `SELECT org_id FROM org_members WHERE LOWER(email) = ?\n            ${MEMBERSHIP_FALLBACK_ORDER_BY}`,\n      args: [email.toLowerCase()],\n    });\n    return rows?.map((r: any) => String(r.org_id)) ?? null;\n  });\n  // Both reads depend only on the email, so they overlap instead of queueing.\n  // The `catch` only keeps the early return below from surfacing an unhandled\n  // rejection; the `await` further down still propagates the failure.\n  const settingPromise = getUserSetting(\n    email,\n    \"active-org-id\",\n  ) as Promise<ActiveOrgSetting>;\n  settingPromise.catch(() => {});\n\n  const ids = await idsPromise;\n  if (!ids?.length) return null;\n  const activeOrgSetting = await settingPromise;\n  if (activeOrgSetting?.orgId === null) return null;\n  if (activeOrgSetting?.orgId && ids.includes(activeOrgSetting.orgId)) {\n    return activeOrgSetting.orgId;\n  }\n  return ids[0];\n}\n\n/**\n * Event-aware variant of `resolveOrgIdForEmail` for HTTP request paths.\n * Shares the per-request membership lookup with `getOrgContext`, so the\n * session org backfill inside `getSession` and a later `getOrgContext` call\n * in the same request pay ONE org_members round trip, not two.\n */\nexport async function resolveOrgIdForEmailViaEvent(\n  event: H3Event,\n  email: string,\n): Promise<string | null> {\n  // Overlapped, not queued: each is a separate round trip and this pair runs\n  // on the session-backfill path of every authenticated request.\n  const settingPromise = loadActiveOrgSettingForEvent(event, email);\n  settingPromise.catch(() => {});\n  const memberships = await loadMembershipsForEvent(event, email);\n  if (!memberships || memberships.length === 0) return null;\n  const activeOrgSetting = await settingPromise;\n  if (activeOrgSetting?.orgId === null) return null;\n  if (\n    activeOrgSetting?.orgId &&\n    memberships.some((m) => m.orgId === activeOrgSetting.orgId)\n  ) {\n    return activeOrgSetting.orgId;\n  }\n  return memberships[0].orgId;\n}\n\n/**\n * Create a new organization and add the caller as a member with the given\n * role. Generates a per-org A2A secret for cross-app delegation and writes\n * the caller's `active-org-id` user-setting so the new org is immediately\n * active.\n *\n */\nexport async function createOrganization(\n  name: string,\n  email: string,\n  role: OrgRole = \"owner\",\n): Promise<{\n  id: string;\n  name: string;\n  role: OrgRole;\n  a2aSecret: string;\n  createdAt: number;\n}> {\n  const trimmedName = name.trim();\n  const exec = getDbExec();\n  const id = nanoid();\n  const createdAt = Date.now();\n  const { randomBytes } = await import(\"node:crypto\");\n  const a2aSecret = randomBytes(32).toString(\"base64url\");\n\n  await exec.execute({\n    sql: `INSERT INTO organizations (id, name, created_by, created_at, a2a_secret) VALUES (?, ?, ?, ?, ?)`,\n    args: [id, trimmedName, email, createdAt, a2aSecret],\n  });\n\n  await exec.execute({\n    sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,\n    args: [nanoid(), id, email, role, createdAt],\n  });\n  invalidateRequestMemberOrgIds();\n\n  await warnOnAdditionalOrganization(exec, email, id, trimmedName);\n\n  await setActiveOrgId(email, id, `created organization \"${trimmedName}\"`);\n\n  return { id, name: trimmedName, role, a2aSecret, createdAt };\n}\n\n/**\n * A second organization is the single most expensive accident in this codebase:\n * vault credentials are scoped per organization, so creating one and activating\n * it orphans every key synced under the previous org, and the only symptom is a\n * missing-env-var error somewhere else entirely. The UI warns humans before\n * they click (`org.createOrgVaultNotice`); this covers the path that actually\n * did the damage — app code or a migration action calling `createOrganization`\n * directly, where no notice is ever rendered.\n */\nasync function warnOnAdditionalOrganization(\n  exec: ReturnType<typeof getDbExec>,\n  email: string,\n  newOrgId: string,\n  newOrgName: string,\n): Promise<void> {\n  try {\n    const { rows } = await exec.execute({\n      sql: `SELECT 1 FROM org_members WHERE LOWER(email) = ? AND org_id <> ? LIMIT 1`,\n      args: [email.toLowerCase(), newOrgId],\n    });\n    if (rows.length === 0) return;\n  } catch {\n    // \"Couldn't tell\" is not \"it didn't\" — swallowing the failed probe here made\n    // the function whose entire job is to not be silent, silent.\n    warnAgent({\n      severity: \"critical\",\n      code: \"org-additional-org-membership-unreadable\",\n      message:\n        `Created an organization \"${newOrgName}\" (${newOrgId}) and made it the account's active org, ` +\n        `but could not read whether that account already belonged to another organization. If it did, ` +\n        `every vault credential synced under the previous organization is now unreadable for it, and ` +\n        `requests will fail with missing-credential errors that name the key rather than this org ` +\n        `change. Confirm the account's memberships before continuing; if this came from a roster, ` +\n        `identity, or user-list migration, add the members to the EXISTING organization instead.`,\n    });\n    return;\n  }\n\n  warnAgent({\n    severity: \"critical\",\n    code: \"org-additional-organization\",\n    message:\n      `Created an ADDITIONAL organization \"${newOrgName}\" (${newOrgId}) ` +\n      `for an account that already belongs to another organization, and made it their active org. ` +\n      `Vault credentials are scoped per organization and are NOT shared between them: every API key ` +\n      `synced under the previous organization is now unreadable for this account until it is re-saved ` +\n      `in \"${newOrgName}\". Requests will fail with missing-credential errors that name the key rather ` +\n      `than this org change. If this came from a roster, identity, or user-list migration, add the ` +\n      `members to the EXISTING organization instead of creating a new one.`,\n  });\n}\n\nfunction defaultOrgName(\n  email: string,\n  session: { name?: string } | null,\n): string {\n  const full = session?.name?.trim();\n  if (full) return `${full}'s workspace`;\n  const local = email.split(\"@\")[0] ?? email;\n  const cleaned = local.replace(/[._-]+/g, \" \").trim();\n  const titled =\n    cleaned\n      .split(\" \")\n      .filter(Boolean)\n      .map((w) => w.charAt(0).toUpperCase() + w.slice(1))\n      .join(\" \") || \"My\";\n  return `${titled}'s workspace`;\n}\n\n/**\n * Check whether the user has a pending invitation. If so, auto-create\n * MUST be skipped — otherwise we'd provision a personal org for them\n * before they ever see the inviter's org in the invitation banner, and they'd\n * never join the team that invited them.\n */\nasync function hasPendingInvitation(\n  exec: ReturnType<typeof getDbExec>,\n  email: string,\n): Promise<boolean> {\n  try {\n    const { rows } = await exec.execute({\n      sql: `SELECT 1 FROM org_invitations WHERE LOWER(email) = ? AND status = 'pending' LIMIT 1`,\n      args: [email.toLowerCase()],\n    });\n    return rows.length > 0;\n  } catch {\n    // If we can't tell, err on the side of NOT auto-creating — the\n    // invitation banner or team UI can surface the situation.\n    return true;\n  }\n}\n\nasync function hasDomainMatch(\n  exec: ReturnType<typeof getDbExec>,\n  email: string,\n): Promise<boolean> {\n  try {\n    const domain = email.split(\"@\")[1]?.toLowerCase();\n    if (!domain) return false;\n    const { rows } = await exec.execute({\n      sql: `SELECT 1 FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,\n      args: [domain],\n    });\n    return rows.length > 0;\n  } catch {\n    return false;\n  }\n}\n\n/** Stale-claim threshold. A claim row this old is treated as abandoned\n *  (process crashed, DELETE failed, etc.) and a new caller may take it\n *  over. Long enough that two genuine concurrent first-loads don't\n *  trample each other (those settle in milliseconds), short enough that\n *  a stuck user recovers on their next navigation. */\nconst CLAIM_TTL_MS = 5 * 60 * 1000;\n\n/**\n * Attempt to provision a default org + owner membership for a user with\n * zero memberships.\n *\n * Race protection: claims the user's auto-create slot via an atomic\n * INSERT into the framework `settings` table (PRIMARY KEY (key) — so\n * concurrent inserts for the same key throw uniqueness violations on\n * both SQLite and Postgres). Only the request that wins the claim\n * proceeds to create the org; losers bail. By the time a losing\n * request retries on a subsequent navigation, the winner's org is in\n * `org_members` and the auto-create branch is skipped entirely.\n *\n * Stuck-state recovery: a stale claim (held longer than CLAIM_TTL_MS)\n * is reclaimed automatically. So even if the DELETE on the failure\n * path fails (network blip, DB error), the user isn't stranded — the\n * next request after the TTL elapses retries cleanly.\n *\n * Returns null on any failure so the caller can fall back to the\n * empty-context / client-guard path.\n */\nasync function tryCreateDefaultOrg(\n  exec: ReturnType<typeof getDbExec>,\n  email: string,\n  session: { name?: string } | null,\n): Promise<OrgContext | null> {\n  // Make sure the framework `settings` table exists before we use it as\n  // a claim primitive. getSetting() ensures the table on first call.\n  await getSetting(\"__init\").catch(() => null);\n\n  const claimKey = `u:${email.toLowerCase()}:auto-create-claim`;\n\n  if (!(await acquireClaim(exec, claimKey))) return null;\n\n  // Pending-invite check happens INSIDE the claim so the window where a\n  // newly-arrived invitation can be missed is narrowed to a single SQL\n  // round-trip. (A still-narrower window would require a transaction\n  // spanning org_invitations and settings — out of scope.)\n  if (await hasPendingInvitation(exec, email)) {\n    await releaseClaim(exec, claimKey);\n    return null;\n  }\n\n  if (await hasDomainMatch(exec, email)) {\n    await releaseClaim(exec, claimKey);\n    return null;\n  }\n\n  try {\n    const orgId = nanoid();\n    const orgName = defaultOrgName(email, session);\n    const now = Date.now();\n\n    await exec.execute({\n      sql: `INSERT INTO organizations (id, name, created_by, created_at) VALUES (?, ?, ?, ?)`,\n      args: [orgId, orgName, email, now],\n    });\n    await exec.execute({\n      sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,\n      args: [nanoid(), orgId, email, \"owner\", now],\n    });\n    invalidateRequestMemberOrgIds();\n\n    await setActiveOrgId(email, orgId, \"auto-created default organization\");\n\n    return { email, orgId, orgName, role: \"owner\" };\n  } catch {\n    await releaseClaim(exec, claimKey);\n    return null;\n  }\n}\n\nasync function acquireClaim(\n  exec: ReturnType<typeof getDbExec>,\n  claimKey: string,\n): Promise<boolean> {\n  const now = Date.now();\n  try {\n    await exec.execute({\n      sql: `INSERT INTO settings (key, value, updated_at) VALUES (?, ?, ?)`,\n      args: [claimKey, JSON.stringify({ at: now }), now],\n    });\n    return true;\n  } catch {\n    // Conflict — someone else's claim is already in the row. If it's\n    // stale (older than CLAIM_TTL_MS) we take it over.\n    //\n    // CRITICAL: this MUST be a single atomic UPDATE guarded on\n    // `updated_at <= staleThreshold`. A read-then-DELETE-then-INSERT\n    // sequence lets two concurrent reclaimers each observe the stale\n    // timestamp, delete each other's fresh claim, and both think they\n    // won — duplicating org creation. The conditional UPDATE matches\n    // each stale row at most once: only the first writer sees\n    // rowsAffected === 1; the row's updated_at is now `now`, so any\n    // subsequent UPDATE no longer satisfies `updated_at <= staleThreshold`\n    // and matches zero rows.\n    const staleThreshold = now - CLAIM_TTL_MS;\n    const result = (await exec.execute({\n      sql: `UPDATE settings SET value = ?, updated_at = ? WHERE key = ? AND updated_at <= ?`,\n      args: [JSON.stringify({ at: now }), now, claimKey, staleThreshold],\n    })) as { rowsAffected?: number };\n    return (result.rowsAffected ?? 0) > 0;\n  }\n}\n\nasync function releaseClaim(\n  exec: ReturnType<typeof getDbExec>,\n  claimKey: string,\n): Promise<void> {\n  // Best-effort. If this fails (transient network/DB error), the\n  // CLAIM_TTL_MS-based takeover in acquireClaim recovers automatically\n  // on a future request — no permanent stuck state.\n  await exec\n    .execute({ sql: `DELETE FROM settings WHERE key = ?`, args: [claimKey] })\n    .catch(() => {});\n}\n\n/**\n * Look up the `allowed_domain` for an org by its ID.\n * Used when making outbound A2A calls so the JWT includes the\n * caller's org domain for cross-app org resolution.\n */\nexport async function getOrgDomain(orgId: string): Promise<string | null> {\n  try {\n    const exec = getDbExec();\n    const { rows } = await exec.execute({\n      sql: `SELECT allowed_domain FROM organizations WHERE id = ? LIMIT 1`,\n      args: [orgId],\n    });\n    if (!rows[0]) return null;\n    const domain = String((rows[0] as any).allowed_domain || \"\");\n    return domain || null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Look up the org's A2A secret by org ID.\n * Used when making outbound A2A calls so the JWT is signed with the\n * org-specific secret rather than the global A2A_SECRET env var.\n */\nexport async function getOrgA2ASecret(orgId: string): Promise<string | null> {\n  try {\n    const exec = getDbExec();\n    const { rows } = await exec.execute({\n      sql: `SELECT a2a_secret FROM organizations WHERE id = ? LIMIT 1`,\n      args: [orgId],\n    });\n    if (!rows[0]) return null;\n    const secret = String((rows[0] as any).a2a_secret || \"\");\n    return secret || null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Look up an org's A2A secret by its `allowed_domain`.\n * Used on the A2A receiving side: the caller's JWT includes `org_domain`,\n * and the receiver looks up which local org matches that domain to find\n * the secret used to verify the JWT signature.\n */\nexport async function getA2ASecretByDomain(\n  domain: string,\n): Promise<string | null> {\n  try {\n    const exec = getDbExec();\n    const { rows } = await exec.execute({\n      sql: `SELECT a2a_secret FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,\n      args: [domain.toLowerCase()],\n    });\n    if (!rows[0]) return null;\n    const secret = String((rows[0] as any).a2a_secret || \"\");\n    return secret || null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Resolve a local org by its `allowed_domain`.\n * Used on the A2A receiving side: the caller sends `org_domain` in the JWT,\n * and the receiver looks up which local org matches that domain.\n */\nexport async function resolveOrgByDomain(\n  domain: string,\n): Promise<{ orgId: string; orgName: string } | null> {\n  try {\n    const exec = getDbExec();\n    const { rows } = await exec.execute({\n      sql: `SELECT id, name FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,\n      args: [domain.toLowerCase()],\n    });\n    if (!rows[0]) return null;\n    return {\n      orgId: String((rows[0] as any).id),\n      orgName: String((rows[0] as any).name),\n    };\n  } catch {\n    return null;\n  }\n}\n"]}

package/dist/org/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/org/handlers.ts"],"names":[],"mappings":"AAgDA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAmB1C,2FAA2F;AAC3F,eAAO,MAAM,eAAe;;;;;;;cAaA,OAAO;;;;;;;;;;eAIC,MAAM;iBAAW,MAAM;;;;;GAoFzD,CAAC;AAEH,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB;;;;GAe3B,CAAC;AAEH,wDAAwD;AACxD,eAAO,MAAM,kBAAkB;;;cA2CH,OAAO;;;;;GAQjC,CAAC;AAqBH,UAAU,kBAAkB;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IACzB,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,mBAAmB;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAsED,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB;;;;GAuEnC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,sBAAsB;;;;;;;;;GAyBlC,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB;;;UAoD8B,OAAO;GAkBxE,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,mBAAmB;;GA2D/B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB;;;GAqEnC,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,gBAAgB;;;GA4B3B,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB;;;;GAuF3B,CAAC;AAEH,4EAA4E;AAC5E,eAAO,MAAM,gBAAgB;;;UAkCC,OAAO;GAEnC,CAAC;AAEH,mGAAmG;AACnG,eAAO,MAAM,mBAAmB;;;UAqDR,OAAO;GAG9B,CAAC;AAEF,+FAA+F;AAC/F,eAAO,MAAM,gBAAgB;;GAsE3B,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB;;GAiClC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;GA0BlC,CAAC;AAEF,oGAAoG;AACpG,eAAO,MAAM,mBAAmB;;;GA0C/B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,oBAAoB;;;;;YA2DvB,MAAM;cACJ,MAAM;aACP,MAAM;YACP,OAAO;iBACF,MAAM;gBACP,MAAM;;GA6DnB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB;;;GAgGnC,CAAC"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/org/handlers.ts"],"names":[],"mappings":"AAiDA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAmB1C,2FAA2F;AAC3F,eAAO,MAAM,eAAe;;;;;;;cAaA,OAAO;;;;;;;;;;eAIC,MAAM;iBAAW,MAAM;;;;;GAoFzD,CAAC;AAEH,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB;;;;GAe3B,CAAC;AAEH,wDAAwD;AACxD,eAAO,MAAM,kBAAkB;;;cA2CH,OAAO;;;;;GAQjC,CAAC;AAqBH,UAAU,kBAAkB;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IACzB,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,mBAAmB;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAsED,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB;;;;GAuEnC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,sBAAsB;;;;;;;;;GAyBlC,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB;;;UAoD8B,OAAO;GAmBxE,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,mBAAmB;;GA4D/B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB;;;GAqEnC,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,gBAAgB;;;GA4B3B,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB;;;;GAyF3B,CAAC;AAEH,4EAA4E;AAC5E,eAAO,MAAM,gBAAgB;;;UAkCC,OAAO;GAEnC,CAAC;AAEH,mGAAmG;AACnG,eAAO,MAAM,mBAAmB;;;UAsDR,OAAO;GAG9B,CAAC;AAEF,+FAA+F;AAC/F,eAAO,MAAM,gBAAgB;;GAsE3B,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB;;GAiClC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;GA0BlC,CAAC;AAEF,oGAAoG;AACpG,eAAO,MAAM,mBAAmB;;;GA0C/B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,oBAAoB;;;;;YA2DvB,MAAM;cACJ,MAAM;aACP,MAAM;YACP,OAAO;iBACF,MAAM;gBACP,MAAM;;GA6DnB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB;;;GAgGnC,CAAC"}

package/dist/org/handlers.js

@@ -37,6 +37,7 @@ import { readBody } from "../server/h3-helpers.js";
 import { setActiveOrgId } from "./active-org.js";
 import { getOrgContext, createOrganization } from "./context.js";
 import { isFreeEmailProvider } from "./free-email-providers.js";
+import { invalidateRequestMemberOrgIds } from "./request-org-cache.js";
 import { parseWorkspaceUrl } from "./workspace-url.js";
 function getInviteAppUrl(event) {
     return getAppProductionUrl(event);
@@ -414,6 +415,7 @@ export const acceptInvitationHandler = defineEventHandler(async (event) => {
         sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,
         args: [nanoid(), invOrgId, email, inviteRole, Date.now()],
     });
+    invalidateRequestMemberOrgIds();
     await e.execute({
         sql: `UPDATE org_invitations SET status = 'accepted' WHERE id = ?`,
         args: [invitationId],
@@ -474,6 +476,7 @@ export const removeMemberHandler = defineEventHandler(async (event) => {
         sql: `DELETE FROM org_members WHERE org_id = ? AND LOWER(email) = ?`,
         args: [ctx.orgId, memberEmailLower],
     });
+    invalidateRequestMemberOrgIds();
     return { success: true };
 });
 /**
@@ -647,6 +650,7 @@ export const deleteOrgHandler = defineEventHandler(async (event) => {
             message: "Organization deletion requires atomic database support",
         });
     }
+    invalidateRequestMemberOrgIds();
     const nextRes = await e.execute({
         sql: `SELECT org_id AS "orgId" FROM org_members WHERE LOWER(email) = ? LIMIT 1`,
         args: [ctx.email.toLowerCase()],
@@ -729,6 +733,7 @@ export const joinByDomainHandler = defineEventHandler(async (event) => {
         sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, 'member', ?)`,
         args: [nanoid(), orgId, email, Date.now()],
     });
+    invalidateRequestMemberOrgIds();
     await setActiveOrgId(email, orgId, "joined domain-matched organization");
     return {
         orgId,