@agent-native/core 0.59.0 → 0.60.0

package/dist/onboarding/default-steps.js

@@ -271,6 +271,107 @@ const emailStep = {
         return false;
     },
 };
+const githubRepositoryStep = {
+    id: "github-repository",
+    order: 50,
+    required: false,
+    title: "Connect a GitHub repository",
+    description: "Optional for cloud/headless repo work. Grants connector-scoped file read and write access without cloning a repo or running code.",
+    methods: [
+        {
+            id: "settings",
+            kind: "link",
+            primary: true,
+            label: "Open GitHub token settings",
+            description: "Save a fine-grained token scoped to the repositories this workspace may access.",
+            payload: {
+                url: "#secrets:GITHUB_TOKEN",
+                external: false,
+            },
+        },
+        {
+            id: "local-env",
+            kind: "form",
+            label: "Use local .env",
+            description: "For local/single-tenant work, save a token and optional default owner/repo.",
+            payload: {
+                writeScope: "workspace",
+                fields: [
+                    {
+                        key: "GITHUB_TOKEN",
+                        label: "GITHUB_TOKEN",
+                        placeholder: "github_pat_...",
+                        secret: true,
+                    },
+                    {
+                        key: "GITHUB_REPOSITORY",
+                        label: "GITHUB_REPOSITORY",
+                        placeholder: "owner/repo",
+                    },
+                ],
+            },
+        },
+    ],
+    isComplete: async (context) => {
+        const userEmail = context?.userEmail;
+        const orgId = context?.orgId ?? null;
+        if (userEmail) {
+            try {
+                const { resolveWorkspaceConnectionCredentialForApp } = await import("../workspace-connections/index.js");
+                const result = await resolveWorkspaceConnectionCredentialForApp({
+                    appId: process.env.AGENT_NATIVE_APP_ID ||
+                        process.env.APP_ID ||
+                        process.env.npm_package_name ||
+                        "app",
+                    provider: "github",
+                    key: "GITHUB_TOKEN",
+                    userEmail,
+                    orgId,
+                });
+                if (result.available)
+                    return true;
+            }
+            catch {
+                // Fall through to local credential stores.
+            }
+            try {
+                const { resolveCredential } = await import("../credentials/index.js");
+                if (await resolveCredential("GITHUB_TOKEN", { userEmail, orgId })) {
+                    return true;
+                }
+            }
+            catch {
+                // Fall through to app_secrets.
+            }
+            try {
+                const { readAppSecretMeta } = await import("../secrets/storage.js");
+                const refs = [{ scope: "user", scopeId: userEmail }];
+                if (orgId) {
+                    refs.push({ scope: "org", scopeId: orgId }, { scope: "workspace", scopeId: orgId });
+                }
+                else {
+                    refs.push({ scope: "workspace", scopeId: `solo:${userEmail}` });
+                }
+                for (const ref of refs) {
+                    const meta = await readAppSecretMeta({
+                        key: "GITHUB_TOKEN",
+                        scope: ref.scope,
+                        scopeId: ref.scopeId,
+                    });
+                    if (meta)
+                        return true;
+                }
+            }
+            catch {
+                // Fall through to local/single-tenant env.
+            }
+        }
+        if (!canUseDeployCredentialFallbackForRequest())
+            return false;
+        return !!(readDeployCredentialEnv("GITHUB_TOKEN") ||
+            readDeployCredentialEnv("GH_TOKEN"));
+    },
+};
 let registered = false;
 /** Idempotent. Safe to call from every plugin-mount call. */
 export function registerDefaultOnboardingSteps() {
@@ -281,5 +382,6 @@ export function registerDefaultOnboardingSteps() {
     registerOnboardingStep(databaseStep);
     registerOnboardingStep(authStep);
     registerOnboardingStep(emailStep);
+    registerOnboardingStep(githubRepositoryStep);
 }
 //# sourceMappingURL=default-steps.js.map

package/dist/onboarding/default-steps.js.map

@@ -1 +1 @@
-{"version":3,"file":"default-steps.js","sourceRoot":"","sources":["../../src/onboarding/default-steps.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAEvD,OAAO,EACL,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,GAC/B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,wCAAwC,EACxC,uBAAuB,GACxB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAUlD,MAAM,eAAe,GAAmB;IACtC;QACE,QAAQ,EAAE,WAAW;QACrB,EAAE,EAAE,eAAe;QACnB,KAAK,EAAE,WAAW;QAClB,WAAW,EAAE,4CAA4C;KAC1D;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,sCAAsC;KACpD;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,eAAe;QACtB,WAAW,EAAE,4CAA4C;KAC1D;IACD;QACE,QAAQ,EAAE,YAAY;QACtB,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,YAAY;QACnB,WAAW,EAAE,iDAAiD;KAC/D;IACD;QACE,QAAQ,EAAE,MAAM;QAChB,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,MAAM;QACb,WAAW,EAAE,4CAA4C;KAC1D;IACD;QACE,QAAQ,EAAE,SAAS;QACnB,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,SAAS;QAChB,WAAW,EAAE,2CAA2C;KACzD;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,yCAAyC;KACvD;CACF,CAAC;AAEF,MAAM,OAAO,GAAmB;IAC9B,EAAE,EAAE,KAAK;IACT,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,gEAAgE;IAC7E,OAAO,EAAE;QACP;YACE,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,iBAAiB;YACxB,WAAW,EACT,+NAA+N;YACjO,OAAO,EAAE,IAAI;YACb,OAAO,EAAE;gBACP,KAAK,EAAE,KAAK;aACb;SACF;QACD,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE;YACvE,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACzC,OAAO;gBACL,EAAE;gBACF,IAAI,EAAE,MAAe;gBACrB,KAAK;gBACL,WAAW;gBACX,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrC,OAAO,EAAE;oBACP,UAAU,EAAE,WAAoB;oBAChC,MAAM,EAAE;wBACN;4BACE,GAAG,EAAE,IAAI,CAAC,MAAM;4BAChB,KAAK,EAAE,IAAI,CAAC,MAAM;4BAClB,WAAW,EAAE,IAAI,CAAC,WAAW;4BAC7B,MAAM,EAAE,IAAI;yBACb;qBACF;iBACF;aACF,CAAC;QACJ,CAAC,CAAC;KACH;IACD,UAAU,EAAE,KAAK,IAAI,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,EAAE,mCAAmC,EAAE,GAC3C,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;YACnD,IAAI,MAAM,mCAAmC,EAAE;gBAAE,OAAO,IAAI,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;gBACtE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,IAAI,MAAM,2BAA2B,EAAE;gBAAE,OAAO,IAAI,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;QACD,IACE,wCAAwC,EAAE;YAC1C,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,EAC3D,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,OAAO,8BAA8B,CAAC,MAAM,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF,CAAC;AAEF,6EAA6E;AAC7E,MAAM,YAAY,GAAmB;IACnC,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,UAAU;IACjB,WAAW,EACT,+GAA+G;IACjH,OAAO,EAAE;QACP;YACE,EAAE,EAAE,cAAc;YAClB,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,kBAAkB;YACzB,WAAW,EAAE,sDAAsD;YACnE,OAAO,EAAE;gBACP,UAAU,EAAE,WAAW;gBACvB,MAAM,EAAE;oBACN;wBACE,GAAG,EAAE,cAAc;wBACnB,KAAK,EAAE,cAAc;wBACrB,WAAW,EAAE,kDAAkD;qBAChE;oBACD;wBACE,GAAG,EAAE,qBAAqB;wBAC1B,KAAK,EAAE,iCAAiC;wBACxC,WAAW,EAAE,0CAA0C;wBACvD,MAAM,EAAE,IAAI;qBACb;iBACF;aACF;SACF;KACF;IACD,kEAAkE;IAClE,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI;CACvB,CAAC;AAEF,yEAAyE;AACzE,MAAM,QAAQ,GAAmB;IAC/B,EAAE,EAAE,MAAM;IACV,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,gBAAgB;IACvB,WAAW,EACT,qHAAqH;IACvH,OAAO,EAAE;QACP;YACE,EAAE,EAAE,cAAc;YAClB,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,cAAc;YACrB,WAAW,EAAE,6CAA6C;YAC1D,OAAO,EAAE;gBACP,UAAU,EAAE,WAAW;gBACvB,MAAM,EAAE;oBACN,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,EAAE;oBACtD;wBACE,GAAG,EAAE,sBAAsB;wBAC3B,KAAK,EAAE,sBAAsB;wBAC7B,MAAM,EAAE,IAAI;qBACb;iBACF;aACF;SACF;QACD;YACE,EAAE,EAAE,cAAc;YAClB,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,cAAc;YACrB,WAAW,EAAE,6CAA6C;YAC1D,OAAO,EAAE;gBACP,UAAU,EAAE,WAAW;gBACvB,MAAM,EAAE;oBACN,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,EAAE;oBACtD;wBACE,GAAG,EAAE,sBAAsB;wBAC3B,KAAK,EAAE,sBAAsB;wBAC7B,MAAM,EAAE,IAAI;qBACb;iBACF;aACF;SACF;KACF;IACD,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI;CACvB,CAAC;AAEF,6EAA6E;AAC7E,MAAM,SAAS,GAAmB;IAChC,EAAE,EAAE,OAAO;IACX,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,gBAAgB;IACvB,WAAW,EACT,iIAAiI;IACnI,OAAO,EAAE;QACP;YACE,EAAE,EAAE,QAAQ;YACZ,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,QAAQ;YACf,WAAW,EAAE,qCAAqC;YAClD,OAAO,EAAE;gBACP,UAAU,EAAE,WAAW;gBACvB,MAAM,EAAE;oBACN;wBACE,GAAG,EAAE,gBAAgB;wBACrB,KAAK,EAAE,gBAAgB;wBACvB,WAAW,EAAE,QAAQ;wBACrB,MAAM,EAAE,IAAI;qBACb;oBACD;wBACE,GAAG,EAAE,YAAY;wBACjB,KAAK,EAAE,2BAA2B;wBAClC,WAAW,EAAE,uCAAuC;qBACrD;oBACD;wBACE,GAAG,EAAE,UAAU;wBACf,KAAK,EAAE,mCAAmC;wBAC1C,WAAW,EAAE,YAAY;qBAC1B;iBACF;aACF;SACF;QACD;YACE,EAAE,EAAE,UAAU;YACd,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,UAAU;YACjB,WAAW,EAAE,uCAAuC;YACpD,OAAO,EAAE;gBACP,UAAU,EAAE,WAAW;gBACvB,MAAM,EAAE;oBACN;wBACE,GAAG,EAAE,kBAAkB;wBACvB,KAAK,EAAE,kBAAkB;wBACzB,WAAW,EAAE,QAAQ;wBACrB,MAAM,EAAE,IAAI;qBACb;oBACD;wBACE,GAAG,EAAE,YAAY;wBACjB,KAAK,EAAE,2BAA2B;wBAClC,WAAW,EAAE,uCAAuC;qBACrD;iBACF;aACF;SACF;KACF;IACD,UAAU,EAAE,GAAG,EAAE;QACf,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QAC5C,uEAAuE;QACvE,wEAAwE;QACxE,iBAAiB;QACjB,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB;YAAE,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAClE,OAAO,KAAK,CAAC;IACf,CAAC;CACF,CAAC;AAEF,IAAI,UAAU,GAAG,KAAK,CAAC;AAEvB,6DAA6D;AAC7D,MAAM,UAAU,8BAA8B;IAC5C,IAAI,UAAU;QAAE,OAAO;IACvB,UAAU,GAAG,IAAI,CAAC;IAClB,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACrC,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACjC,sBAAsB,CAAC,SAAS,CAAC,CAAC;AACpC,CAAC","sourcesContent":["/**\n * Default framework-level onboarding steps.\n *\n * Registered when `createOnboardingPlugin()` mounts (auto-mount or explicit).\n * Templates can override any step by registering another step with the same\n * `id` after these have been registered.\n */\n\nimport { registerOnboardingStep } from \"./registry.js\";\nimport type { OnboardingStep } from \"./types.js\";\nimport {\n  PROVIDER_ENV_META,\n  PROVIDER_ENV_VARS,\n} from \"../agent/engine/provider-env-vars.js\";\nimport {\n  detectEngineFromUserSecrets,\n  isAgentEngineSettingConfigured,\n} from \"../agent/engine/registry.js\";\nimport {\n  canUseDeployCredentialFallbackForRequest,\n  readDeployCredentialEnv,\n} from \"../server/credential-provider.js\";\nimport { getSetting } from \"../settings/store.js\";\n\ntype LlmKeyMethod = {\n  provider: keyof typeof PROVIDER_ENV_META;\n  id: string;\n  label: string;\n  description: string;\n  primary?: boolean;\n};\n\nconst LLM_KEY_METHODS: LlmKeyMethod[] = [\n  {\n    provider: \"anthropic\",\n    id: \"anthropic-key\",\n    label: \"Anthropic\",\n    description: \"Claude models with your own Anthropic key.\",\n  },\n  {\n    provider: \"openai\",\n    id: \"openai-key\",\n    label: \"OpenAI\",\n    description: \"GPT models with your own OpenAI key.\",\n  },\n  {\n    provider: \"google\",\n    id: \"google-key\",\n    label: \"Google Gemini\",\n    description: \"Gemini models with your own Google AI key.\",\n  },\n  {\n    provider: \"openrouter\",\n    id: \"openrouter-key\",\n    label: \"OpenRouter\",\n    description: \"OpenRouter models with your own OpenRouter key.\",\n  },\n  {\n    provider: \"groq\",\n    id: \"groq-key\",\n    label: \"Groq\",\n    description: \"Groq-hosted models with your own Groq key.\",\n  },\n  {\n    provider: \"mistral\",\n    id: \"mistral-key\",\n    label: \"Mistral\",\n    description: \"Mistral models with your own Mistral key.\",\n  },\n  {\n    provider: \"cohere\",\n    id: \"cohere-key\",\n    label: \"Cohere\",\n    description: \"Cohere models with your own Cohere key.\",\n  },\n];\n\nconst llmStep: OnboardingStep = {\n  id: \"llm\",\n  order: 10,\n  required: true,\n  title: \"Connect an AI engine\",\n  description: \"Use Builder's managed gateway, or bring your own provider key.\",\n  methods: [\n    {\n      id: \"builder\",\n      kind: \"builder-cli-auth\",\n      label: \"Connect Builder\",\n      description:\n        \"Connect the Builder space where this app should run. This unlocks managed LLM credits, web search, browser automation, and file uploads. Cloud code changes appear when Builder Cloud Agents are available for the workspace.\",\n      primary: true,\n      payload: {\n        scope: \"llm\",\n      },\n    },\n    ...LLM_KEY_METHODS.map(({ provider, id, label, description, primary }) => {\n      const meta = PROVIDER_ENV_META[provider];\n      return {\n        id,\n        kind: \"form\" as const,\n        label,\n        description,\n        ...(primary ? { primary: true } : {}),\n        payload: {\n          writeScope: \"workspace\" as const,\n          fields: [\n            {\n              key: meta.envVar,\n              label: meta.envVar,\n              placeholder: meta.placeholder,\n              secret: true,\n            },\n          ],\n        },\n      };\n    }),\n  ],\n  isComplete: async () => {\n    try {\n      const { resolveHasCompleteBuilderConnection } =\n        await import(\"../server/credential-provider.js\");\n      if (await resolveHasCompleteBuilderConnection()) return true;\n    } catch {\n      if (process.env.BUILDER_PRIVATE_KEY && process.env.BUILDER_PUBLIC_KEY) {\n        return true;\n      }\n    }\n    try {\n      if (await detectEngineFromUserSecrets()) return true;\n    } catch {\n      // Fall through to legacy/env detection.\n    }\n    if (\n      canUseDeployCredentialFallbackForRequest() &&\n      PROVIDER_ENV_VARS.some((k) => !!readDeployCredentialEnv(k))\n    ) {\n      return true;\n    }\n    try {\n      return isAgentEngineSettingConfigured(await getSetting(\"agent-engine\"));\n    } catch {\n      return false;\n    }\n  },\n};\n\n/** Step 2 — where application data lives. The default DB is non-blocking. */\nconst databaseStep: OnboardingStep = {\n  id: \"database\",\n  order: 20,\n  required: false,\n  title: \"Database\",\n  description:\n    \"Agent-native stores app data in SQL. Set DATABASE_URL when you want to point this app at a specific database.\",\n  methods: [\n    {\n      id: \"database-url\",\n      kind: \"form\",\n      label: \"Set DATABASE_URL\",\n      description: \"Paste the SQL connection string this app should use.\",\n      payload: {\n        writeScope: \"workspace\",\n        fields: [\n          {\n            key: \"DATABASE_URL\",\n            label: \"DATABASE_URL\",\n            placeholder: \"postgres://..., libsql://..., file:./data/app.db\",\n          },\n          {\n            key: \"DATABASE_AUTH_TOKEN\",\n            label: \"DATABASE_AUTH_TOKEN (if needed)\",\n            placeholder: \"Token for providers such as Turso/libSQL\",\n            secret: true,\n          },\n        ],\n      },\n    },\n  ],\n  // The default local database means this step is always satisfied.\n  isComplete: () => true,\n};\n\n/** Step 3 — how users sign in. Built-in account auth is non-blocking. */\nconst authStep: OnboardingStep = {\n  id: \"auth\",\n  order: 30,\n  required: false,\n  title: \"Authentication\",\n  description:\n    \"Built-in email/password accounts work by default. Add OAuth or access tokens only if you want another sign-in path.\",\n  methods: [\n    {\n      id: \"google-oauth\",\n      kind: \"form\",\n      label: \"Google OAuth\",\n      description: \"Add Google as an optional sign-in provider.\",\n      payload: {\n        writeScope: \"workspace\",\n        fields: [\n          { key: \"GOOGLE_CLIENT_ID\", label: \"GOOGLE_CLIENT_ID\" },\n          {\n            key: \"GOOGLE_CLIENT_SECRET\",\n            label: \"GOOGLE_CLIENT_SECRET\",\n            secret: true,\n          },\n        ],\n      },\n    },\n    {\n      id: \"github-oauth\",\n      kind: \"form\",\n      label: \"GitHub OAuth\",\n      description: \"Add GitHub as an optional sign-in provider.\",\n      payload: {\n        writeScope: \"workspace\",\n        fields: [\n          { key: \"GITHUB_CLIENT_ID\", label: \"GITHUB_CLIENT_ID\" },\n          {\n            key: \"GITHUB_CLIENT_SECRET\",\n            label: \"GITHUB_CLIENT_SECRET\",\n            secret: true,\n          },\n        ],\n      },\n    },\n  ],\n  isComplete: () => true,\n};\n\n/** Step 4 — transactional email (password resets, invitations). Optional. */\nconst emailStep: OnboardingStep = {\n  id: \"email\",\n  order: 40,\n  required: false,\n  title: \"Email delivery\",\n  description:\n    \"Optional for local work. Before deploying with password resets, invitations, or share notifications, connect an email provider.\",\n  methods: [\n    {\n      id: \"resend\",\n      kind: \"form\",\n      label: \"Resend\",\n      description: \"Use Resend for transactional email.\",\n      payload: {\n        writeScope: \"workspace\",\n        fields: [\n          {\n            key: \"RESEND_API_KEY\",\n            label: \"RESEND_API_KEY\",\n            placeholder: \"re_...\",\n            secret: true,\n          },\n          {\n            key: \"EMAIL_FROM\",\n            label: \"EMAIL_FROM (from address)\",\n            placeholder: \"Agent Native <noreply@yourdomain.com>\",\n          },\n          {\n            key: \"APP_NAME\",\n            label: \"APP_NAME (shown in invite emails)\",\n            placeholder: \"Acme Forms\",\n          },\n        ],\n      },\n    },\n    {\n      id: \"sendgrid\",\n      kind: \"form\",\n      label: \"SendGrid\",\n      description: \"Use SendGrid for transactional email.\",\n      payload: {\n        writeScope: \"workspace\",\n        fields: [\n          {\n            key: \"SENDGRID_API_KEY\",\n            label: \"SENDGRID_API_KEY\",\n            placeholder: \"SG....\",\n            secret: true,\n          },\n          {\n            key: \"EMAIL_FROM\",\n            label: \"EMAIL_FROM (from address)\",\n            placeholder: \"Agent Native <noreply@yourdomain.com>\",\n          },\n        ],\n      },\n    },\n  ],\n  isComplete: () => {\n    if (process.env.RESEND_API_KEY) return true;\n    // SendGrid rejects Resend's sandbox sender, so EMAIL_FROM must also be\n    // set — otherwise sendEmail() throws at runtime even though the API key\n    // is configured.\n    if (process.env.SENDGRID_API_KEY) return !!process.env.EMAIL_FROM;\n    return false;\n  },\n};\n\nlet registered = false;\n\n/** Idempotent. Safe to call from every plugin-mount call. */\nexport function registerDefaultOnboardingSteps(): void {\n  if (registered) return;\n  registered = true;\n  registerOnboardingStep(llmStep);\n  registerOnboardingStep(databaseStep);\n  registerOnboardingStep(authStep);\n  registerOnboardingStep(emailStep);\n}\n"]}
+{"version":3,"file":"default-steps.js","sourceRoot":"","sources":["../../src/onboarding/default-steps.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAEvD,OAAO,EACL,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,GAC/B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,wCAAwC,EACxC,uBAAuB,GACxB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAUlD,MAAM,eAAe,GAAmB;IACtC;QACE,QAAQ,EAAE,WAAW;QACrB,EAAE,EAAE,eAAe;QACnB,KAAK,EAAE,WAAW;QAClB,WAAW,EAAE,4CAA4C;KAC1D;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,sCAAsC;KACpD;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,eAAe;QACtB,WAAW,EAAE,4CAA4C;KAC1D;IACD;QACE,QAAQ,EAAE,YAAY;QACtB,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,YAAY;QACnB,WAAW,EAAE,iDAAiD;KAC/D;IACD;QACE,QAAQ,EAAE,MAAM;QAChB,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,MAAM;QACb,WAAW,EAAE,4CAA4C;KAC1D;IACD;QACE,QAAQ,EAAE,SAAS;QACnB,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,SAAS;QAChB,WAAW,EAAE,2CAA2C;KACzD;IACD;QACE,QAAQ,EAAE,QAAQ;QAClB,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,yCAAyC;KACvD;CACF,CAAC;AAEF,MAAM,OAAO,GAAmB;IAC9B,EAAE,EAAE,KAAK;IACT,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,gEAAgE;IAC7E,OAAO,EAAE;QACP;YACE,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,iBAAiB;YACxB,WAAW,EACT,+NAA+N;YACjO,OAAO,EAAE,IAAI;YACb,OAAO,EAAE;gBACP,KAAK,EAAE,KAAK;aACb;SACF;QACD,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE;YACvE,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACzC,OAAO;gBACL,EAAE;gBACF,IAAI,EAAE,MAAe;gBACrB,KAAK;gBACL,WAAW;gBACX,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrC,OAAO,EAAE;oBACP,UAAU,EAAE,WAAoB;oBAChC,MAAM,EAAE;wBACN;4BACE,GAAG,EAAE,IAAI,CAAC,MAAM;4BAChB,KAAK,EAAE,IAAI,CAAC,MAAM;4BAClB,WAAW,EAAE,IAAI,CAAC,WAAW;4BAC7B,MAAM,EAAE,IAAI;yBACb;qBACF;iBACF;aACF,CAAC;QACJ,CAAC,CAAC;KACH;IACD,UAAU,EAAE,KAAK,IAAI,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,EAAE,mCAAmC,EAAE,GAC3C,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;YACnD,IAAI,MAAM,mCAAmC,EAAE;gBAAE,OAAO,IAAI,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;gBACtE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,IAAI,MAAM,2BAA2B,EAAE;gBAAE,OAAO,IAAI,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;QACD,IACE,wCAAwC,EAAE;YAC1C,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,EAC3D,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,OAAO,8BAA8B,CAAC,MAAM,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF,CAAC;AAEF,6EAA6E;AAC7E,MAAM,YAAY,GAAmB;IACnC,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,UAAU;IACjB,WAAW,EACT,+GAA+G;IACjH,OAAO,EAAE;QACP;YACE,EAAE,EAAE,cAAc;YAClB,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,kBAAkB;YACzB,WAAW,EAAE,sDAAsD;YACnE,OAAO,EAAE;gBACP,UAAU,EAAE,WAAW;gBACvB,MAAM,EAAE;oBACN;wBACE,GAAG,EAAE,cAAc;wBACnB,KAAK,EAAE,cAAc;wBACrB,WAAW,EAAE,kDAAkD;qBAChE;oBACD;wBACE,GAAG,EAAE,qBAAqB;wBAC1B,KAAK,EAAE,iCAAiC;wBACxC,WAAW,EAAE,0CAA0C;wBACvD,MAAM,EAAE,IAAI;qBACb;iBACF;aACF;SACF;KACF;IACD,kEAAkE;IAClE,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI;CACvB,CAAC;AAEF,yEAAyE;AACzE,MAAM,QAAQ,GAAmB;IAC/B,EAAE,EAAE,MAAM;IACV,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,gBAAgB;IACvB,WAAW,EACT,qHAAqH;IACvH,OAAO,EAAE;QACP;YACE,EAAE,EAAE,cAAc;YAClB,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,cAAc;YACrB,WAAW,EAAE,6CAA6C;YAC1D,OAAO,EAAE;gBACP,UAAU,EAAE,WAAW;gBACvB,MAAM,EAAE;oBACN,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,EAAE;oBACtD;wBACE,GAAG,EAAE,sBAAsB;wBAC3B,KAAK,EAAE,sBAAsB;wBAC7B,MAAM,EAAE,IAAI;qBACb;iBACF;aACF;SACF;QACD;YACE,EAAE,EAAE,cAAc;YAClB,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,cAAc;YACrB,WAAW,EAAE,6CAA6C;YAC1D,OAAO,EAAE;gBACP,UAAU,EAAE,WAAW;gBACvB,MAAM,EAAE;oBACN,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,EAAE;oBACtD;wBACE,GAAG,EAAE,sBAAsB;wBAC3B,KAAK,EAAE,sBAAsB;wBAC7B,MAAM,EAAE,IAAI;qBACb;iBACF;aACF;SACF;KACF;IACD,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI;CACvB,CAAC;AAEF,6EAA6E;AAC7E,MAAM,SAAS,GAAmB;IAChC,EAAE,EAAE,OAAO;IACX,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,gBAAgB;IACvB,WAAW,EACT,iIAAiI;IACnI,OAAO,EAAE;QACP;YACE,EAAE,EAAE,QAAQ;YACZ,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,QAAQ;YACf,WAAW,EAAE,qCAAqC;YAClD,OAAO,EAAE;gBACP,UAAU,EAAE,WAAW;gBACvB,MAAM,EAAE;oBACN;wBACE,GAAG,EAAE,gBAAgB;wBACrB,KAAK,EAAE,gBAAgB;wBACvB,WAAW,EAAE,QAAQ;wBACrB,MAAM,EAAE,IAAI;qBACb;oBACD;wBACE,GAAG,EAAE,YAAY;wBACjB,KAAK,EAAE,2BAA2B;wBAClC,WAAW,EAAE,uCAAuC;qBACrD;oBACD;wBACE,GAAG,EAAE,UAAU;wBACf,KAAK,EAAE,mCAAmC;wBAC1C,WAAW,EAAE,YAAY;qBAC1B;iBACF;aACF;SACF;QACD;YACE,EAAE,EAAE,UAAU;YACd,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,UAAU;YACjB,WAAW,EAAE,uCAAuC;YACpD,OAAO,EAAE;gBACP,UAAU,EAAE,WAAW;gBACvB,MAAM,EAAE;oBACN;wBACE,GAAG,EAAE,kBAAkB;wBACvB,KAAK,EAAE,kBAAkB;wBACzB,WAAW,EAAE,QAAQ;wBACrB,MAAM,EAAE,IAAI;qBACb;oBACD;wBACE,GAAG,EAAE,YAAY;wBACjB,KAAK,EAAE,2BAA2B;wBAClC,WAAW,EAAE,uCAAuC;qBACrD;iBACF;aACF;SACF;KACF;IACD,UAAU,EAAE,GAAG,EAAE;QACf,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QAC5C,uEAAuE;QACvE,wEAAwE;QACxE,iBAAiB;QACjB,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB;YAAE,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAClE,OAAO,KAAK,CAAC;IACf,CAAC;CACF,CAAC;AAEF,MAAM,oBAAoB,GAAmB;IAC3C,EAAE,EAAE,mBAAmB;IACvB,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,6BAA6B;IACpC,WAAW,EACT,mIAAmI;IACrI,OAAO,EAAE;QACP;YACE,EAAE,EAAE,UAAU;YACd,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,4BAA4B;YACnC,WAAW,EACT,iFAAiF;YACnF,OAAO,EAAE;gBACP,GAAG,EAAE,uBAAuB;gBAC5B,QAAQ,EAAE,KAAK;aAChB;SACF;QACD;YACE,EAAE,EAAE,WAAW;YACf,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,gBAAgB;YACvB,WAAW,EACT,6EAA6E;YAC/E,OAAO,EAAE;gBACP,UAAU,EAAE,WAAW;gBACvB,MAAM,EAAE;oBACN;wBACE,GAAG,EAAE,cAAc;wBACnB,KAAK,EAAE,cAAc;wBACrB,WAAW,EAAE,gBAAgB;wBAC7B,MAAM,EAAE,IAAI;qBACb;oBACD;wBACE,GAAG,EAAE,mBAAmB;wBACxB,KAAK,EAAE,mBAAmB;wBAC1B,WAAW,EAAE,YAAY;qBAC1B;iBACF;aACF;SACF;KACF;IACD,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC5B,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,CAAC;QACrC,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC;QACrC,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,MAAM,EAAE,0CAA0C,EAAE,GAClD,MAAM,MAAM,CAAC,mCAAmC,CAAC,CAAC;gBACpD,MAAM,MAAM,GAAG,MAAM,0CAA0C,CAAC;oBAC9D,KAAK,EACH,OAAO,CAAC,GAAG,CAAC,mBAAmB;wBAC/B,OAAO,CAAC,GAAG,CAAC,MAAM;wBAClB,OAAO,CAAC,GAAG,CAAC,gBAAgB;wBAC5B,KAAK;oBACP,QAAQ,EAAE,QAAQ;oBAClB,GAAG,EAAE,cAAc;oBACnB,SAAS;oBACT,KAAK;iBACN,CAAC,CAAC;gBACH,IAAI,MAAM,CAAC,SAAS;oBAAE,OAAO,IAAI,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,2CAA2C;YAC7C,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;gBACtE,IAAI,MAAM,iBAAiB,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;oBAClE,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,+BAA+B;YACjC,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;gBACpE,MAAM,IAAI,GAGL,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC7C,IAAI,KAAK,EAAE,CAAC;oBACV,IAAI,CAAC,IAAI,CACP,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAChC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,CACvC,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,SAAS,EAAE,EAAE,CAAC,CAAC;gBAClE,CAAC;gBACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;wBACnC,GAAG,EAAE,cAAc;wBACnB,KAAK,EAAE,GAAG,CAAC,KAAK;wBAChB,OAAO,EAAE,GAAG,CAAC,OAAO;qBACrB,CAAC,CAAC;oBACH,IAAI,IAAI;wBAAE,OAAO,IAAI,CAAC;gBACxB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,2CAA2C;YAC7C,CAAC;QACH,CAAC;QAED,IAAI,CAAC,wCAAwC,EAAE;YAAE,OAAO,KAAK,CAAC;QAC9D,OAAO,CAAC,CAAC,CACP,uBAAuB,CAAC,cAAc,CAAC;YACvC,uBAAuB,CAAC,UAAU,CAAC,CACpC,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,IAAI,UAAU,GAAG,KAAK,CAAC;AAEvB,6DAA6D;AAC7D,MAAM,UAAU,8BAA8B;IAC5C,IAAI,UAAU;QAAE,OAAO;IACvB,UAAU,GAAG,IAAI,CAAC;IAClB,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACrC,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACjC,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAClC,sBAAsB,CAAC,oBAAoB,CAAC,CAAC;AAC/C,CAAC","sourcesContent":["/**\n * Default framework-level onboarding steps.\n *\n * Registered when `createOnboardingPlugin()` mounts (auto-mount or explicit).\n * Templates can override any step by registering another step with the same\n * `id` after these have been registered.\n */\n\nimport { registerOnboardingStep } from \"./registry.js\";\nimport type { OnboardingStep } from \"./types.js\";\nimport {\n  PROVIDER_ENV_META,\n  PROVIDER_ENV_VARS,\n} from \"../agent/engine/provider-env-vars.js\";\nimport {\n  detectEngineFromUserSecrets,\n  isAgentEngineSettingConfigured,\n} from \"../agent/engine/registry.js\";\nimport {\n  canUseDeployCredentialFallbackForRequest,\n  readDeployCredentialEnv,\n} from \"../server/credential-provider.js\";\nimport { getSetting } from \"../settings/store.js\";\n\ntype LlmKeyMethod = {\n  provider: keyof typeof PROVIDER_ENV_META;\n  id: string;\n  label: string;\n  description: string;\n  primary?: boolean;\n};\n\nconst LLM_KEY_METHODS: LlmKeyMethod[] = [\n  {\n    provider: \"anthropic\",\n    id: \"anthropic-key\",\n    label: \"Anthropic\",\n    description: \"Claude models with your own Anthropic key.\",\n  },\n  {\n    provider: \"openai\",\n    id: \"openai-key\",\n    label: \"OpenAI\",\n    description: \"GPT models with your own OpenAI key.\",\n  },\n  {\n    provider: \"google\",\n    id: \"google-key\",\n    label: \"Google Gemini\",\n    description: \"Gemini models with your own Google AI key.\",\n  },\n  {\n    provider: \"openrouter\",\n    id: \"openrouter-key\",\n    label: \"OpenRouter\",\n    description: \"OpenRouter models with your own OpenRouter key.\",\n  },\n  {\n    provider: \"groq\",\n    id: \"groq-key\",\n    label: \"Groq\",\n    description: \"Groq-hosted models with your own Groq key.\",\n  },\n  {\n    provider: \"mistral\",\n    id: \"mistral-key\",\n    label: \"Mistral\",\n    description: \"Mistral models with your own Mistral key.\",\n  },\n  {\n    provider: \"cohere\",\n    id: \"cohere-key\",\n    label: \"Cohere\",\n    description: \"Cohere models with your own Cohere key.\",\n  },\n];\n\nconst llmStep: OnboardingStep = {\n  id: \"llm\",\n  order: 10,\n  required: true,\n  title: \"Connect an AI engine\",\n  description: \"Use Builder's managed gateway, or bring your own provider key.\",\n  methods: [\n    {\n      id: \"builder\",\n      kind: \"builder-cli-auth\",\n      label: \"Connect Builder\",\n      description:\n        \"Connect the Builder space where this app should run. This unlocks managed LLM credits, web search, browser automation, and file uploads. Cloud code changes appear when Builder Cloud Agents are available for the workspace.\",\n      primary: true,\n      payload: {\n        scope: \"llm\",\n      },\n    },\n    ...LLM_KEY_METHODS.map(({ provider, id, label, description, primary }) => {\n      const meta = PROVIDER_ENV_META[provider];\n      return {\n        id,\n        kind: \"form\" as const,\n        label,\n        description,\n        ...(primary ? { primary: true } : {}),\n        payload: {\n          writeScope: \"workspace\" as const,\n          fields: [\n            {\n              key: meta.envVar,\n              label: meta.envVar,\n              placeholder: meta.placeholder,\n              secret: true,\n            },\n          ],\n        },\n      };\n    }),\n  ],\n  isComplete: async () => {\n    try {\n      const { resolveHasCompleteBuilderConnection } =\n        await import(\"../server/credential-provider.js\");\n      if (await resolveHasCompleteBuilderConnection()) return true;\n    } catch {\n      if (process.env.BUILDER_PRIVATE_KEY && process.env.BUILDER_PUBLIC_KEY) {\n        return true;\n      }\n    }\n    try {\n      if (await detectEngineFromUserSecrets()) return true;\n    } catch {\n      // Fall through to legacy/env detection.\n    }\n    if (\n      canUseDeployCredentialFallbackForRequest() &&\n      PROVIDER_ENV_VARS.some((k) => !!readDeployCredentialEnv(k))\n    ) {\n      return true;\n    }\n    try {\n      return isAgentEngineSettingConfigured(await getSetting(\"agent-engine\"));\n    } catch {\n      return false;\n    }\n  },\n};\n\n/** Step 2 — where application data lives. The default DB is non-blocking. */\nconst databaseStep: OnboardingStep = {\n  id: \"database\",\n  order: 20,\n  required: false,\n  title: \"Database\",\n  description:\n    \"Agent-native stores app data in SQL. Set DATABASE_URL when you want to point this app at a specific database.\",\n  methods: [\n    {\n      id: \"database-url\",\n      kind: \"form\",\n      label: \"Set DATABASE_URL\",\n      description: \"Paste the SQL connection string this app should use.\",\n      payload: {\n        writeScope: \"workspace\",\n        fields: [\n          {\n            key: \"DATABASE_URL\",\n            label: \"DATABASE_URL\",\n            placeholder: \"postgres://..., libsql://..., file:./data/app.db\",\n          },\n          {\n            key: \"DATABASE_AUTH_TOKEN\",\n            label: \"DATABASE_AUTH_TOKEN (if needed)\",\n            placeholder: \"Token for providers such as Turso/libSQL\",\n            secret: true,\n          },\n        ],\n      },\n    },\n  ],\n  // The default local database means this step is always satisfied.\n  isComplete: () => true,\n};\n\n/** Step 3 — how users sign in. Built-in account auth is non-blocking. */\nconst authStep: OnboardingStep = {\n  id: \"auth\",\n  order: 30,\n  required: false,\n  title: \"Authentication\",\n  description:\n    \"Built-in email/password accounts work by default. Add OAuth or access tokens only if you want another sign-in path.\",\n  methods: [\n    {\n      id: \"google-oauth\",\n      kind: \"form\",\n      label: \"Google OAuth\",\n      description: \"Add Google as an optional sign-in provider.\",\n      payload: {\n        writeScope: \"workspace\",\n        fields: [\n          { key: \"GOOGLE_CLIENT_ID\", label: \"GOOGLE_CLIENT_ID\" },\n          {\n            key: \"GOOGLE_CLIENT_SECRET\",\n            label: \"GOOGLE_CLIENT_SECRET\",\n            secret: true,\n          },\n        ],\n      },\n    },\n    {\n      id: \"github-oauth\",\n      kind: \"form\",\n      label: \"GitHub OAuth\",\n      description: \"Add GitHub as an optional sign-in provider.\",\n      payload: {\n        writeScope: \"workspace\",\n        fields: [\n          { key: \"GITHUB_CLIENT_ID\", label: \"GITHUB_CLIENT_ID\" },\n          {\n            key: \"GITHUB_CLIENT_SECRET\",\n            label: \"GITHUB_CLIENT_SECRET\",\n            secret: true,\n          },\n        ],\n      },\n    },\n  ],\n  isComplete: () => true,\n};\n\n/** Step 4 — transactional email (password resets, invitations). Optional. */\nconst emailStep: OnboardingStep = {\n  id: \"email\",\n  order: 40,\n  required: false,\n  title: \"Email delivery\",\n  description:\n    \"Optional for local work. Before deploying with password resets, invitations, or share notifications, connect an email provider.\",\n  methods: [\n    {\n      id: \"resend\",\n      kind: \"form\",\n      label: \"Resend\",\n      description: \"Use Resend for transactional email.\",\n      payload: {\n        writeScope: \"workspace\",\n        fields: [\n          {\n            key: \"RESEND_API_KEY\",\n            label: \"RESEND_API_KEY\",\n            placeholder: \"re_...\",\n            secret: true,\n          },\n          {\n            key: \"EMAIL_FROM\",\n            label: \"EMAIL_FROM (from address)\",\n            placeholder: \"Agent Native <noreply@yourdomain.com>\",\n          },\n          {\n            key: \"APP_NAME\",\n            label: \"APP_NAME (shown in invite emails)\",\n            placeholder: \"Acme Forms\",\n          },\n        ],\n      },\n    },\n    {\n      id: \"sendgrid\",\n      kind: \"form\",\n      label: \"SendGrid\",\n      description: \"Use SendGrid for transactional email.\",\n      payload: {\n        writeScope: \"workspace\",\n        fields: [\n          {\n            key: \"SENDGRID_API_KEY\",\n            label: \"SENDGRID_API_KEY\",\n            placeholder: \"SG....\",\n            secret: true,\n          },\n          {\n            key: \"EMAIL_FROM\",\n            label: \"EMAIL_FROM (from address)\",\n            placeholder: \"Agent Native <noreply@yourdomain.com>\",\n          },\n        ],\n      },\n    },\n  ],\n  isComplete: () => {\n    if (process.env.RESEND_API_KEY) return true;\n    // SendGrid rejects Resend's sandbox sender, so EMAIL_FROM must also be\n    // set — otherwise sendEmail() throws at runtime even though the API key\n    // is configured.\n    if (process.env.SENDGRID_API_KEY) return !!process.env.EMAIL_FROM;\n    return false;\n  },\n};\n\nconst githubRepositoryStep: OnboardingStep = {\n  id: \"github-repository\",\n  order: 50,\n  required: false,\n  title: \"Connect a GitHub repository\",\n  description:\n    \"Optional for cloud/headless repo work. Grants connector-scoped file read and write access without cloning a repo or running code.\",\n  methods: [\n    {\n      id: \"settings\",\n      kind: \"link\",\n      primary: true,\n      label: \"Open GitHub token settings\",\n      description:\n        \"Save a fine-grained token scoped to the repositories this workspace may access.\",\n      payload: {\n        url: \"#secrets:GITHUB_TOKEN\",\n        external: false,\n      },\n    },\n    {\n      id: \"local-env\",\n      kind: \"form\",\n      label: \"Use local .env\",\n      description:\n        \"For local/single-tenant work, save a token and optional default owner/repo.\",\n      payload: {\n        writeScope: \"workspace\",\n        fields: [\n          {\n            key: \"GITHUB_TOKEN\",\n            label: \"GITHUB_TOKEN\",\n            placeholder: \"github_pat_...\",\n            secret: true,\n          },\n          {\n            key: \"GITHUB_REPOSITORY\",\n            label: \"GITHUB_REPOSITORY\",\n            placeholder: \"owner/repo\",\n          },\n        ],\n      },\n    },\n  ],\n  isComplete: async (context) => {\n    const userEmail = context?.userEmail;\n    const orgId = context?.orgId ?? null;\n    if (userEmail) {\n      try {\n        const { resolveWorkspaceConnectionCredentialForApp } =\n          await import(\"../workspace-connections/index.js\");\n        const result = await resolveWorkspaceConnectionCredentialForApp({\n          appId:\n            process.env.AGENT_NATIVE_APP_ID ||\n            process.env.APP_ID ||\n            process.env.npm_package_name ||\n            \"app\",\n          provider: \"github\",\n          key: \"GITHUB_TOKEN\",\n          userEmail,\n          orgId,\n        });\n        if (result.available) return true;\n      } catch {\n        // Fall through to local credential stores.\n      }\n\n      try {\n        const { resolveCredential } = await import(\"../credentials/index.js\");\n        if (await resolveCredential(\"GITHUB_TOKEN\", { userEmail, orgId })) {\n          return true;\n        }\n      } catch {\n        // Fall through to app_secrets.\n      }\n\n      try {\n        const { readAppSecretMeta } = await import(\"../secrets/storage.js\");\n        const refs: Array<{\n          scope: \"user\" | \"org\" | \"workspace\";\n          scopeId: string;\n        }> = [{ scope: \"user\", scopeId: userEmail }];\n        if (orgId) {\n          refs.push(\n            { scope: \"org\", scopeId: orgId },\n            { scope: \"workspace\", scopeId: orgId },\n          );\n        } else {\n          refs.push({ scope: \"workspace\", scopeId: `solo:${userEmail}` });\n        }\n        for (const ref of refs) {\n          const meta = await readAppSecretMeta({\n            key: \"GITHUB_TOKEN\",\n            scope: ref.scope,\n            scopeId: ref.scopeId,\n          });\n          if (meta) return true;\n        }\n      } catch {\n        // Fall through to local/single-tenant env.\n      }\n    }\n\n    if (!canUseDeployCredentialFallbackForRequest()) return false;\n    return !!(\n      readDeployCredentialEnv(\"GITHUB_TOKEN\") ||\n      readDeployCredentialEnv(\"GH_TOKEN\")\n    );\n  },\n};\n\nlet registered = false;\n\n/** Idempotent. Safe to call from every plugin-mount call. */\nexport function registerDefaultOnboardingSteps(): void {\n  if (registered) return;\n  registered = true;\n  registerOnboardingStep(llmStep);\n  registerOnboardingStep(databaseStep);\n  registerOnboardingStep(authStep);\n  registerOnboardingStep(emailStep);\n  registerOnboardingStep(githubRepositoryStep);\n}\n"]}

package/dist/org/auto-join-domain.d.ts

@@ -4,6 +4,14 @@ export interface AutoJoinDomainResult {
     }>;
     activeOrgId: string | null;
 }
+export interface AutoJoinDomainOptions {
+    /**
+     * The signup hook should not clobber an org selected by an invite flow, but
+     * request-time org resolution may need to move an existing account from a
+     * personal workspace into its newly matched company org.
+     */
+    activateJoinedOrg?: "if-missing" | "always";
+}
 /**
  * Auto-join a newly-signed-up user into every org whose `allowed_domain`
  * matches their email domain.
@@ -16,13 +24,13 @@ export interface AutoJoinDomainResult {
  * "Join your team" UI in the picker; we use the same opt-in to drive
  * automatic join.
  *
- * Idempotent — skips orgs the user is already a member of and never
- * overwrites an existing `active-org-id` setting.
+ * Idempotent — skips orgs the user is already a member of and, by default,
+ * never overwrites an existing `active-org-id` setting.
  *
  * Safe to call when the org tables don't exist (some templates don't use
  * the org module): it swallows the "no such table" error and returns
  * empty. Never throws — the caller is a signup hook and we don't want to
  * block a user from creating their account because of an org-tier issue.
  */
-export declare function autoJoinDomainMatchingOrgs(rawEmail: string): Promise<AutoJoinDomainResult>;
+export declare function autoJoinDomainMatchingOrgs(rawEmail: string, options?: AutoJoinDomainOptions): Promise<AutoJoinDomainResult>;
 //# sourceMappingURL=auto-join-domain.d.ts.map

package/dist/org/auto-join-domain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auto-join-domain.d.ts","sourceRoot":"","sources":["../../src/org/auto-join-domain.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,0BAA0B,CAC9C,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,oBAAoB,CAAC,CAmE/B"}
+{"version":3,"file":"auto-join-domain.d.ts","sourceRoot":"","sources":["../../src/org/auto-join-domain.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,YAAY,GAAG,QAAQ,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,0BAA0B,CAC9C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAoE/B"}

package/dist/org/auto-join-domain.js

@@ -14,15 +14,15 @@ const nanoid = () => globalThis.crypto?.randomUUID?.().replace(/-/g, "") ??
  * "Join your team" UI in the picker; we use the same opt-in to drive
  * automatic join.
  *
- * Idempotent — skips orgs the user is already a member of and never
- * overwrites an existing `active-org-id` setting.
+ * Idempotent — skips orgs the user is already a member of and, by default,
+ * never overwrites an existing `active-org-id` setting.
  *
  * Safe to call when the org tables don't exist (some templates don't use
  * the org module): it swallows the "no such table" error and returns
  * empty. Never throws — the caller is a signup hook and we don't want to
  * block a user from creating their account because of an org-tier issue.
  */
-export async function autoJoinDomainMatchingOrgs(rawEmail) {
+export async function autoJoinDomainMatchingOrgs(rawEmail, options = {}) {
     const email = rawEmail.trim().toLowerCase();
     if (!email)
         return { joined: [], activeOrgId: null };
@@ -71,14 +71,15 @@ export async function autoJoinDomainMatchingOrgs(rawEmail) {
             // existing membership intact; just skip this org.
         }
     }
-    // Set active-org-id to the first match only if the user doesn't
-    // already have one (a pending invite that ran first may have set it).
+    // Set active-org-id to the first match only if the user doesn't already have
+    // one, unless the caller is request-time org resolution intentionally moving
+    // an existing account into its newly matched company org.
     let activeOrgId = null;
     if (joined[0]) {
         try {
             const existing = await getUserSetting(email, "active-org-id");
             const hasActive = Boolean(existing?.orgId);
-            if (!hasActive) {
+            if (options.activateJoinedOrg === "always" || !hasActive) {
                 activeOrgId = joined[0].orgId;
                 await putUserSetting(email, "active-org-id", { orgId: activeOrgId });
             }

package/dist/org/auto-join-domain.js.map

@@ -1 +1 @@
-{"version":3,"file":"auto-join-domain.js","sourceRoot":"","sources":["../../src/org/auto-join-domain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9E,MAAM,MAAM,GAAG,GAAW,EAAE,CAC1B,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAOhE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,QAAgB;IAEhB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAErD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAEtD,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IAEvB,IAAI,OAAO,GAA6B,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;YAC3B,GAAG,EAAE;;;;;;;;;sCAS2B;YAChC,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;SACtB,CAAC,CAAC;QACH,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YAClC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;SACnC,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,uCAAuC;QACvC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAEnE,MAAM,MAAM,GAAmC,EAAE,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,OAAO,CAAC;gBACf,GAAG,EAAE,4FAA4F;gBACjG,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aAC7C,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,kEAAkE;YAClE,kDAAkD;QACpD,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,sEAAsE;IACtE,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YAC9D,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC3C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;gBAC9B,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACjC,CAAC","sourcesContent":["import { getDbExec } from \"../db/client.js\";\nimport { getUserSetting, putUserSetting } from \"../settings/user-settings.js\";\n\nconst nanoid = (): string =>\n  globalThis.crypto?.randomUUID?.().replace(/-/g, \"\") ??\n  Math.random().toString(36).slice(2) + Date.now().toString(36);\n\nexport interface AutoJoinDomainResult {\n  joined: Array<{ orgId: string }>;\n  activeOrgId: string | null;\n}\n\n/**\n * Auto-join a newly-signed-up user into every org whose `allowed_domain`\n * matches their email domain.\n *\n * Called from the Better Auth `user.create.after` hook so that e.g. a new\n * `@builder.io` signup lands inside the existing Builder.io org on first\n * page load instead of starting in Personal and having to find the join\n * CTA. The org's owner opts into this by setting\n * `organizations.allowed_domain` — the column already gated the manual\n * \"Join your team\" UI in the picker; we use the same opt-in to drive\n * automatic join.\n *\n * Idempotent — skips orgs the user is already a member of and never\n * overwrites an existing `active-org-id` setting.\n *\n * Safe to call when the org tables don't exist (some templates don't use\n * the org module): it swallows the \"no such table\" error and returns\n * empty. Never throws — the caller is a signup hook and we don't want to\n * block a user from creating their account because of an org-tier issue.\n */\nexport async function autoJoinDomainMatchingOrgs(\n  rawEmail: string,\n): Promise<AutoJoinDomainResult> {\n  const email = rawEmail.trim().toLowerCase();\n  if (!email) return { joined: [], activeOrgId: null };\n\n  const domain = email.split(\"@\")[1]?.toLowerCase();\n  if (!domain) return { joined: [], activeOrgId: null };\n\n  const db = getDbExec();\n\n  let matches: Array<{ orgId: string }> = [];\n  try {\n    const res = await db.execute({\n      sql: `SELECT o.id AS \"orgId\"\n            FROM organizations o\n            WHERE LOWER(o.allowed_domain) = ?\n              AND NOT EXISTS (\n                SELECT 1\n                FROM org_members m\n                WHERE m.org_id = o.id\n                  AND LOWER(m.email) = ?\n              )\n            ORDER BY o.created_at ASC`,\n      args: [domain, email],\n    });\n    matches = res.rows.map((r: any) => ({\n      orgId: String(r.orgId ?? r.org_id),\n    }));\n  } catch {\n    // Template without org tables (or `allowed_domain` column not yet\n    // migrated). Not fatal — return empty.\n    return { joined: [], activeOrgId: null };\n  }\n\n  if (matches.length === 0) return { joined: [], activeOrgId: null };\n\n  const joined: AutoJoinDomainResult[\"joined\"] = [];\n  for (const m of matches) {\n    try {\n      await db.execute({\n        sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, 'member', ?)`,\n        args: [nanoid(), m.orgId, email, Date.now()],\n      });\n      joined.push({ orgId: m.orgId });\n    } catch {\n      // Race with a parallel join (e.g. user accepted an invite to the\n      // same org milliseconds earlier). The unique constraint keeps the\n      // existing membership intact; just skip this org.\n    }\n  }\n\n  // Set active-org-id to the first match only if the user doesn't\n  // already have one (a pending invite that ran first may have set it).\n  let activeOrgId: string | null = null;\n  if (joined[0]) {\n    try {\n      const existing = await getUserSetting(email, \"active-org-id\");\n      const hasActive = Boolean(existing?.orgId);\n      if (!hasActive) {\n        activeOrgId = joined[0].orgId;\n        await putUserSetting(email, \"active-org-id\", { orgId: activeOrgId });\n      }\n    } catch {\n      // settings table missing — not fatal.\n    }\n  }\n\n  return { joined, activeOrgId };\n}\n"]}
+{"version":3,"file":"auto-join-domain.js","sourceRoot":"","sources":["../../src/org/auto-join-domain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9E,MAAM,MAAM,GAAG,GAAW,EAAE,CAC1B,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAgBhE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,QAAgB,EAChB,UAAiC,EAAE;IAEnC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAErD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAEtD,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IAEvB,IAAI,OAAO,GAA6B,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;YAC3B,GAAG,EAAE;;;;;;;;;sCAS2B;YAChC,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;SACtB,CAAC,CAAC;QACH,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YAClC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;SACnC,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,uCAAuC;QACvC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAEnE,MAAM,MAAM,GAAmC,EAAE,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,OAAO,CAAC;gBACf,GAAG,EAAE,4FAA4F;gBACjG,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aAC7C,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,kEAAkE;YAClE,kDAAkD;QACpD,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,0DAA0D;IAC1D,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YAC9D,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC3C,IAAI,OAAO,CAAC,iBAAiB,KAAK,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;gBACzD,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;gBAC9B,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACjC,CAAC","sourcesContent":["import { getDbExec } from \"../db/client.js\";\nimport { getUserSetting, putUserSetting } from \"../settings/user-settings.js\";\n\nconst nanoid = (): string =>\n  globalThis.crypto?.randomUUID?.().replace(/-/g, \"\") ??\n  Math.random().toString(36).slice(2) + Date.now().toString(36);\n\nexport interface AutoJoinDomainResult {\n  joined: Array<{ orgId: string }>;\n  activeOrgId: string | null;\n}\n\nexport interface AutoJoinDomainOptions {\n  /**\n   * The signup hook should not clobber an org selected by an invite flow, but\n   * request-time org resolution may need to move an existing account from a\n   * personal workspace into its newly matched company org.\n   */\n  activateJoinedOrg?: \"if-missing\" | \"always\";\n}\n\n/**\n * Auto-join a newly-signed-up user into every org whose `allowed_domain`\n * matches their email domain.\n *\n * Called from the Better Auth `user.create.after` hook so that e.g. a new\n * `@builder.io` signup lands inside the existing Builder.io org on first\n * page load instead of starting in Personal and having to find the join\n * CTA. The org's owner opts into this by setting\n * `organizations.allowed_domain` — the column already gated the manual\n * \"Join your team\" UI in the picker; we use the same opt-in to drive\n * automatic join.\n *\n * Idempotent — skips orgs the user is already a member of and, by default,\n * never overwrites an existing `active-org-id` setting.\n *\n * Safe to call when the org tables don't exist (some templates don't use\n * the org module): it swallows the \"no such table\" error and returns\n * empty. Never throws — the caller is a signup hook and we don't want to\n * block a user from creating their account because of an org-tier issue.\n */\nexport async function autoJoinDomainMatchingOrgs(\n  rawEmail: string,\n  options: AutoJoinDomainOptions = {},\n): Promise<AutoJoinDomainResult> {\n  const email = rawEmail.trim().toLowerCase();\n  if (!email) return { joined: [], activeOrgId: null };\n\n  const domain = email.split(\"@\")[1]?.toLowerCase();\n  if (!domain) return { joined: [], activeOrgId: null };\n\n  const db = getDbExec();\n\n  let matches: Array<{ orgId: string }> = [];\n  try {\n    const res = await db.execute({\n      sql: `SELECT o.id AS \"orgId\"\n            FROM organizations o\n            WHERE LOWER(o.allowed_domain) = ?\n              AND NOT EXISTS (\n                SELECT 1\n                FROM org_members m\n                WHERE m.org_id = o.id\n                  AND LOWER(m.email) = ?\n              )\n            ORDER BY o.created_at ASC`,\n      args: [domain, email],\n    });\n    matches = res.rows.map((r: any) => ({\n      orgId: String(r.orgId ?? r.org_id),\n    }));\n  } catch {\n    // Template without org tables (or `allowed_domain` column not yet\n    // migrated). Not fatal — return empty.\n    return { joined: [], activeOrgId: null };\n  }\n\n  if (matches.length === 0) return { joined: [], activeOrgId: null };\n\n  const joined: AutoJoinDomainResult[\"joined\"] = [];\n  for (const m of matches) {\n    try {\n      await db.execute({\n        sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, 'member', ?)`,\n        args: [nanoid(), m.orgId, email, Date.now()],\n      });\n      joined.push({ orgId: m.orgId });\n    } catch {\n      // Race with a parallel join (e.g. user accepted an invite to the\n      // same org milliseconds earlier). The unique constraint keeps the\n      // existing membership intact; just skip this org.\n    }\n  }\n\n  // Set active-org-id to the first match only if the user doesn't already have\n  // one, unless the caller is request-time org resolution intentionally moving\n  // an existing account into its newly matched company org.\n  let activeOrgId: string | null = null;\n  if (joined[0]) {\n    try {\n      const existing = await getUserSetting(email, \"active-org-id\");\n      const hasActive = Boolean(existing?.orgId);\n      if (options.activateJoinedOrg === \"always\" || !hasActive) {\n        activeOrgId = joined[0].orgId;\n        await putUserSetting(email, \"active-org-id\", { orgId: activeOrgId });\n      }\n    } catch {\n      // settings table missing — not fatal.\n    }\n  }\n\n  return { joined, activeOrgId };\n}\n"]}

package/dist/org/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/org/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAKlC,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAmBtD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAOvE;AAqGD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqBxB;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,OAAiB,GACtB,OAAO,CAAC;IACT,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CAqBD;AAqLD;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAaxE;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAa3E;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAaxB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAepD"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/org/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAMlC,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AA2BtD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAOvE;AA6ID;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqBxB;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,OAAiB,GACtB,OAAO,CAAC;IACT,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CAqBD;AAqLD;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAaxE;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAa3E;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAaxB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAepD"}

package/dist/org/context.js

@@ -2,6 +2,7 @@ import { getSession } from "../server/auth.js";
 import { getUserSetting, putUserSetting } from "../settings/user-settings.js";
 import { getDbExec } from "../db/client.js";
 import { getSetting } from "../settings/store.js";
+import { autoJoinDomainMatchingOrgs } from "./auto-join-domain.js";
 const EMPTY_CONTEXT = {
     email: "",
     orgId: null,
@@ -13,6 +14,9 @@ function normalizeOrgRole(value) {
         ? value
         : null;
 }
+function isLikelyPersonalWorkspace(membership, email, session) {
+    return membership.orgName.trim() === defaultOrgName(email, session);
+}
 const nanoid = () => globalThis.crypto?.randomUUID?.().replace(/-/g, "") ??
     Math.random().toString(36).slice(2) + Date.now().toString(36);
 /**
@@ -47,23 +51,8 @@ async function resolveOrgContextUncached(event) {
         : null;
     const sessionOrgRole = normalizeOrgRole(session.orgRole);
     const exec = getDbExec();
-    let memberships = [];
-    try {
-        const { rows } = await exec.execute({
-            sql: `SELECT m.org_id AS "orgId", m.role AS role, o.name AS "orgName"
-            FROM org_members m
-            INNER JOIN organizations o ON m.org_id = o.id
-            WHERE LOWER(m.email) = ?`,
-            args: [email.toLowerCase()],
-        });
-        memberships = rows.map((r) => ({
-            orgId: String(r.orgId ?? r.org_id),
-            role: String(r.role),
-            orgName: String(r.orgName ?? r.org_name),
-        }));
-    }
-    catch {
-        // Tables may not exist yet on first boot before migrations finish.
+    let memberships = await loadMemberships(exec, email);
+    if (memberships === null) {
         if (sessionOrgId) {
             return {
                 email,
@@ -74,8 +63,49 @@ async function resolveOrgContextUncached(event) {
         }
         return { email, orgId: null, orgName: null, role: null };
     }
+    if (memberships.length > 1) {
+        const activeOrgSetting = (await getUserSetting(email, "active-org-id"));
+        if (activeOrgSetting?.orgId) {
+            const active = memberships.find((m) => m.orgId === activeOrgSetting.orgId);
+            if (active) {
+                return {
+                    email,
+                    orgId: active.orgId,
+                    orgName: active.orgName,
+                    role: active.role,
+                };
+            }
+        }
+    }
+    const sessionMembership = sessionOrgId
+        ? memberships.find((m) => m.orgId === sessionOrgId)
+        : null;
+    const shouldTryDomainAutoJoin = memberships.length === 0 ||
+        (memberships.length === 1 &&
+            isLikelyPersonalWorkspace(memberships[0], email, session));
+    if (shouldTryDomainAutoJoin) {
+        const joined = await autoJoinDomainMatchingOrgs(email, {
+            activateJoinedOrg: "always",
+        });
+        if (joined.joined.length > 0) {
+            const refreshed = await loadMemberships(exec, email);
+            if (refreshed !== null)
+                memberships = refreshed;
+        }
+        if (joined.activeOrgId) {
+            const active = memberships.find((m) => m.orgId === joined.activeOrgId);
+            if (active) {
+                return {
+                    email,
+                    orgId: active.orgId,
+                    orgName: active.orgName,
+                    role: active.role,
+                };
+            }
+        }
+    }
     if (sessionOrgId) {
-        const active = memberships.find((m) => m.orgId === sessionOrgId);
+        const active = sessionMembership ?? memberships.find((m) => m.orgId === sessionOrgId);
         if (active) {
             return {
                 email,
@@ -101,20 +131,6 @@ async function resolveOrgContextUncached(event) {
     if (memberships.length === 0) {
         return { email, orgId: null, orgName: null, role: null };
     }
-    if (memberships.length > 1) {
-        const activeOrgSetting = (await getUserSetting(email, "active-org-id"));
-        if (activeOrgSetting?.orgId) {
-            const active = memberships.find((m) => m.orgId === activeOrgSetting.orgId);
-            if (active) {
-                return {
-                    email,
-                    orgId: active.orgId,
-                    orgName: active.orgName,
-                    role: active.role,
-                };
-            }
-        }
-    }
     return {
         email,
         orgId: memberships[0].orgId,
@@ -122,6 +138,26 @@ async function resolveOrgContextUncached(event) {
         role: memberships[0].role,
     };
 }
+async function loadMemberships(exec, email) {
+    try {
+        const { rows } = await exec.execute({
+            sql: `SELECT m.org_id AS "orgId", m.role AS role, o.name AS "orgName"
+            FROM org_members m
+            INNER JOIN organizations o ON m.org_id = o.id
+            WHERE LOWER(m.email) = ?`,
+            args: [email.toLowerCase()],
+        });
+        return rows.map((r) => ({
+            orgId: String(r.orgId ?? r.org_id),
+            role: String(r.role),
+            orgName: String(r.orgName ?? r.org_name),
+        }));
+    }
+    catch {
+        // Tables may not exist yet on first boot before migrations finish.
+        return null;
+    }
+}
 /**
  * Resolve the active org ID for a given email — for non-HTTP contexts like
  * the integration webhook handler where we have an email but no event/session.

package/dist/org/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/org/context.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGlD,MAAM,aAAa,GAAe;IAChC,KAAK,EAAE,EAAE;IACT,KAAK,EAAE,IAAI;IACX,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,IAAI;CACX,CAAC;AAEF,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ;QACjE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,MAAM,GAAG,GAAW,EAAE,CAC1B,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAc;IAChD,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,GAAG,GAAG,KAAK,CAAC,OAEjB,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAAc;IACrD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,aAAa,CAAC;IACjC,MAAM,YAAY,GAChB,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE;QACvD,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE;QACtB,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,cAAc,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzD,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IAEzB,IAAI,WAAW,GAIV,EAAE,CAAC;IACR,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE;;;qCAG0B;YAC/B,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SAC5B,CAAC,CAAC;QACH,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YAClC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;YAClC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAY;YAC/B,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC;SACzC,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,YAAY;gBACnB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,cAAc;aACrB,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC;QACjE,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC;QACJ,CAAC;QACD,OAAO;YACL,KAAK;YACL,KAAK,EAAE,YAAY;YACnB,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,cAAc;SACrB,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC;QACpE,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,8DAA8D;QAC9D,iDAAiD;IACnD,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,gBAAgB,GAAG,CAAC,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,CAAC,CAE9D,CAAC;QACT,IAAI,gBAAgB,EAAE,KAAK,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,KAAK,CAC1C,CAAC;YACF,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO;oBACL,KAAK;oBACL,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;iBAClB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK;QACL,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK;QAC3B,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO;QAC/B,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;KAC1B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAa;IAEb,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,uDAAuD;YAC5D,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SAC5B,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACnD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,gBAAgB,GAAG,CAAC,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,CAAC,CAE9D,CAAC;QACT,IAAI,gBAAgB,EAAE,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YACpE,OAAO,gBAAgB,CAAC,KAAK,CAAC;QAChC,CAAC;QACD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,KAAa,EACb,OAAgB,OAAO;IAQvB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;IACpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAExD,MAAM,IAAI,CAAC,OAAO,CAAC;QACjB,GAAG,EAAE,iGAAiG;QACtG,IAAI,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC;KACrD,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,OAAO,CAAC;QACjB,GAAG,EAAE,qFAAqF;QAC1F,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC;KAC7C,CAAC,CAAC;IAEH,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IAE5D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,cAAc,CACrB,KAAa,EACb,OAAiC;IAEjC,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACnC,IAAI,IAAI;QAAE,OAAO,GAAG,IAAI,cAAc,CAAC;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,MAAM,GACV,OAAO;SACJ,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAClD,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACvB,OAAO,GAAG,MAAM,cAAc,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAAkC,EAClC,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,qFAAqF;YAC1F,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SAC5B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,4DAA4D;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,IAAkC,EAClC,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,qEAAqE;YAC1E,IAAI,EAAE,CAAC,MAAM,CAAC;SACf,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;sDAIsD;AACtD,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,UAAU,mBAAmB,CAChC,IAAkC,EAClC,KAAa,EACb,OAAiC;IAEjC,sEAAsE;IACtE,mEAAmE;IACnE,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAE7C,MAAM,QAAQ,GAAG,KAAK,KAAK,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAE9D,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvD,sEAAsE;IACtE,qEAAqE;IACrE,mEAAmE;IACnE,yDAAyD;IACzD,IAAI,MAAM,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,GAAG,EAAE,kFAAkF;YACvF,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC;SACnC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,GAAG,EAAE,qFAAqF;YAC1F,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;SAC7C,CAAC,CAAC;QAEH,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAExD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,IAAkC,EAClC,QAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,GAAG,EAAE,gEAAgE;YACrE,IAAI,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC;SACnD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,mDAAmD;QACnD,EAAE;QACF,2DAA2D;QAC3D,iEAAiE;QACjE,iEAAiE;QACjE,kEAAkE;QAClE,iEAAiE;QACjE,0DAA0D;QAC1D,gEAAgE;QAChE,uEAAuE;QACvE,yBAAyB;QACzB,MAAM,cAAc,GAAG,GAAG,GAAG,YAAY,CAAC;QAC1C,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC;YACjC,GAAG,EAAE,iFAAiF;YACtF,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC;SACnE,CAAC,CAA8B,CAAC;QACjC,OAAO,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,IAAkC,EAClC,QAAgB;IAEhB,+DAA+D;IAC/D,qEAAqE;IACrE,kDAAkD;IAClD,MAAM,IAAI;SACP,OAAO,CAAC,EAAE,GAAG,EAAE,oCAAoC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;SACxE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAa;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,+DAA+D;YACpE,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;QAC7D,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,2DAA2D;YAChE,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzD,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,8EAA8E;YACnF,IAAI,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzD,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,4EAA4E;YACjF,IAAI,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO;YACL,KAAK,EAAE,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,IAAI,CAAC;SACvC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\nimport { getSession } from \"../server/auth.js\";\nimport { getUserSetting, putUserSetting } from \"../settings/user-settings.js\";\nimport { getDbExec } from \"../db/client.js\";\nimport { getSetting } from \"../settings/store.js\";\nimport type { OrgContext, OrgRole } from \"./types.js\";\n\nconst EMPTY_CONTEXT: OrgContext = {\n  email: \"\",\n  orgId: null,\n  orgName: null,\n  role: null,\n};\n\nfunction normalizeOrgRole(value: unknown): OrgRole | null {\n  return value === \"owner\" || value === \"admin\" || value === \"member\"\n    ? value\n    : null;\n}\n\nconst nanoid = (): string =>\n  globalThis.crypto?.randomUUID?.().replace(/-/g, \"\") ??\n  Math.random().toString(36).slice(2) + Date.now().toString(36);\n\n/**\n * Resolve the current user's organization context from their session.\n *\n * - For users in multiple orgs, honors their `active-org-id` user setting.\n * - Falls back to the user's first membership.\n * - When `AUTO_CREATE_DEFAULT_ORG` is set and the authenticated user has\n *   zero memberships, provisions a default org named after the user\n *   ({name}'s workspace, falling back to the email local-part). Opt-in\n *   per deployment so templates that don't use orgs don't accrue phantom\n *   default orgs in their DB. The <RequireActiveOrg> client guard remains\n *   the safety net for pre-existing accounts or provisioning failures.\n *\n * Per-request memoized on `event.context` — mirrors the `getSession`\n * pattern so multiple callers in the same request (e.g. ssr-handler +\n * a loader) share a single org_members round trip.\n */\nexport async function getOrgContext(event: H3Event): Promise<OrgContext> {\n  // Per-request memoization. Multiple call sites per request (action wrappers,\n  // SSR handler, loaders) must not each pay a separate org_members query.\n  const ctx = event.context as {\n    __anOrgContextCache?: Promise<OrgContext>;\n  };\n  return (ctx.__anOrgContextCache ??= resolveOrgContextUncached(event));\n}\n\nasync function resolveOrgContextUncached(event: H3Event): Promise<OrgContext> {\n  const session = await getSession(event);\n  const email = session?.email;\n  if (!email) return EMPTY_CONTEXT;\n  const sessionOrgId =\n    typeof session.orgId === \"string\" && session.orgId.trim()\n      ? session.orgId.trim()\n      : null;\n  const sessionOrgRole = normalizeOrgRole(session.orgRole);\n\n  const exec = getDbExec();\n\n  let memberships: Array<{\n    orgId: string;\n    role: OrgRole;\n    orgName: string;\n  }> = [];\n  try {\n    const { rows } = await exec.execute({\n      sql: `SELECT m.org_id AS \"orgId\", m.role AS role, o.name AS \"orgName\"\n            FROM org_members m\n            INNER JOIN organizations o ON m.org_id = o.id\n            WHERE LOWER(m.email) = ?`,\n      args: [email.toLowerCase()],\n    });\n    memberships = rows.map((r: any) => ({\n      orgId: String(r.orgId ?? r.org_id),\n      role: String(r.role) as OrgRole,\n      orgName: String(r.orgName ?? r.org_name),\n    }));\n  } catch {\n    // Tables may not exist yet on first boot before migrations finish.\n    if (sessionOrgId) {\n      return {\n        email,\n        orgId: sessionOrgId,\n        orgName: null,\n        role: sessionOrgRole,\n      };\n    }\n    return { email, orgId: null, orgName: null, role: null };\n  }\n\n  if (sessionOrgId) {\n    const active = memberships.find((m) => m.orgId === sessionOrgId);\n    if (active) {\n      return {\n        email,\n        orgId: active.orgId,\n        orgName: active.orgName,\n        role: active.role,\n      };\n    }\n    return {\n      email,\n      orgId: sessionOrgId,\n      orgName: null,\n      role: sessionOrgRole,\n    };\n  }\n\n  if (memberships.length === 0 && process.env.AUTO_CREATE_DEFAULT_ORG) {\n    const created = await tryCreateDefaultOrg(exec, email, session);\n    if (created) return created;\n    // Creation failed (race / DB error); fall through and let the\n    // RequireActiveOrg client guard prompt the user.\n  }\n\n  if (memberships.length === 0) {\n    return { email, orgId: null, orgName: null, role: null };\n  }\n\n  if (memberships.length > 1) {\n    const activeOrgSetting = (await getUserSetting(email, \"active-org-id\")) as {\n      orgId: string;\n    } | null;\n    if (activeOrgSetting?.orgId) {\n      const active = memberships.find(\n        (m) => m.orgId === activeOrgSetting.orgId,\n      );\n      if (active) {\n        return {\n          email,\n          orgId: active.orgId,\n          orgName: active.orgName,\n          role: active.role,\n        };\n      }\n    }\n  }\n\n  return {\n    email,\n    orgId: memberships[0].orgId,\n    orgName: memberships[0].orgName,\n    role: memberships[0].role,\n  };\n}\n\n/**\n * Resolve the active org ID for a given email — for non-HTTP contexts like\n * the integration webhook handler where we have an email but no event/session.\n * Picks the user's active-org-id setting if set, otherwise the first membership.\n * Returns null if the user has no memberships.\n */\nexport async function resolveOrgIdForEmail(\n  email: string,\n): Promise<string | null> {\n  const exec = getDbExec();\n  if (!exec) return null;\n  try {\n    const { rows } = await exec.execute({\n      sql: `SELECT org_id FROM org_members WHERE LOWER(email) = ?`,\n      args: [email.toLowerCase()],\n    });\n    if (rows.length === 0) return null;\n    const ids = rows.map((r: any) => String(r.org_id));\n    if (ids.length === 1) return ids[0];\n    const activeOrgSetting = (await getUserSetting(email, \"active-org-id\")) as {\n      orgId: string;\n    } | null;\n    if (activeOrgSetting?.orgId && ids.includes(activeOrgSetting.orgId)) {\n      return activeOrgSetting.orgId;\n    }\n    return ids[0];\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Create a new organization and add the caller as a member with the given\n * role. Generates a per-org A2A secret for cross-app delegation and writes\n * the caller's `active-org-id` user-setting so the new org is immediately\n * active.\n *\n */\nexport async function createOrganization(\n  name: string,\n  email: string,\n  role: OrgRole = \"owner\",\n): Promise<{\n  id: string;\n  name: string;\n  role: OrgRole;\n  a2aSecret: string;\n  createdAt: number;\n}> {\n  const trimmedName = name.trim();\n  const exec = getDbExec();\n  const id = nanoid();\n  const createdAt = Date.now();\n  const { randomBytes } = await import(\"node:crypto\");\n  const a2aSecret = randomBytes(32).toString(\"base64url\");\n\n  await exec.execute({\n    sql: `INSERT INTO organizations (id, name, created_by, created_at, a2a_secret) VALUES (?, ?, ?, ?, ?)`,\n    args: [id, trimmedName, email, createdAt, a2aSecret],\n  });\n\n  await exec.execute({\n    sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,\n    args: [nanoid(), id, email, role, createdAt],\n  });\n\n  await putUserSetting(email, \"active-org-id\", { orgId: id });\n\n  return { id, name: trimmedName, role, a2aSecret, createdAt };\n}\n\nfunction defaultOrgName(\n  email: string,\n  session: { name?: string } | null,\n): string {\n  const full = session?.name?.trim();\n  if (full) return `${full}'s workspace`;\n  const local = email.split(\"@\")[0] ?? email;\n  const cleaned = local.replace(/[._-]+/g, \" \").trim();\n  const titled =\n    cleaned\n      .split(\" \")\n      .filter(Boolean)\n      .map((w) => w.charAt(0).toUpperCase() + w.slice(1))\n      .join(\" \") || \"My\";\n  return `${titled}'s workspace`;\n}\n\n/**\n * Check whether the user has a pending invitation. If so, auto-create\n * MUST be skipped — otherwise we'd provision a personal org for them\n * before they ever see the inviter's org in the RequireActiveOrg\n * accept-invite pane, and they'd never join the team that invited them.\n */\nasync function hasPendingInvitation(\n  exec: ReturnType<typeof getDbExec>,\n  email: string,\n): Promise<boolean> {\n  try {\n    const { rows } = await exec.execute({\n      sql: `SELECT 1 FROM org_invitations WHERE LOWER(email) = ? AND status = 'pending' LIMIT 1`,\n      args: [email.toLowerCase()],\n    });\n    return rows.length > 0;\n  } catch {\n    // If we can't tell, err on the side of NOT auto-creating — the\n    // RequireActiveOrg client guard will surface the situation.\n    return true;\n  }\n}\n\nasync function hasDomainMatch(\n  exec: ReturnType<typeof getDbExec>,\n  email: string,\n): Promise<boolean> {\n  try {\n    const domain = email.split(\"@\")[1]?.toLowerCase();\n    if (!domain) return false;\n    const { rows } = await exec.execute({\n      sql: `SELECT 1 FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,\n      args: [domain],\n    });\n    return rows.length > 0;\n  } catch {\n    return false;\n  }\n}\n\n/** Stale-claim threshold. A claim row this old is treated as abandoned\n *  (process crashed, DELETE failed, etc.) and a new caller may take it\n *  over. Long enough that two genuine concurrent first-loads don't\n *  trample each other (those settle in milliseconds), short enough that\n *  a stuck user recovers on their next navigation. */\nconst CLAIM_TTL_MS = 5 * 60 * 1000;\n\n/**\n * Attempt to provision a default org + owner membership for a user with\n * zero memberships.\n *\n * Race protection: claims the user's auto-create slot via an atomic\n * INSERT into the framework `settings` table (PRIMARY KEY (key) — so\n * concurrent inserts for the same key throw uniqueness violations on\n * both SQLite and Postgres). Only the request that wins the claim\n * proceeds to create the org; losers bail. By the time a losing\n * request retries on a subsequent navigation, the winner's org is in\n * `org_members` and the auto-create branch is skipped entirely.\n *\n * Stuck-state recovery: a stale claim (held longer than CLAIM_TTL_MS)\n * is reclaimed automatically. So even if the DELETE on the failure\n * path fails (network blip, DB error), the user isn't stranded — the\n * next request after the TTL elapses retries cleanly.\n *\n * Returns null on any failure so the caller can fall back to the\n * empty-context / client-guard path.\n */\nasync function tryCreateDefaultOrg(\n  exec: ReturnType<typeof getDbExec>,\n  email: string,\n  session: { name?: string } | null,\n): Promise<OrgContext | null> {\n  // Make sure the framework `settings` table exists before we use it as\n  // a claim primitive. getSetting() ensures the table on first call.\n  await getSetting(\"__init\").catch(() => null);\n\n  const claimKey = `u:${email.toLowerCase()}:auto-create-claim`;\n\n  if (!(await acquireClaim(exec, claimKey))) return null;\n\n  // Pending-invite check happens INSIDE the claim so the window where a\n  // newly-arrived invitation can be missed is narrowed to a single SQL\n  // round-trip. (A still-narrower window would require a transaction\n  // spanning org_invitations and settings — out of scope.)\n  if (await hasPendingInvitation(exec, email)) {\n    await releaseClaim(exec, claimKey);\n    return null;\n  }\n\n  if (await hasDomainMatch(exec, email)) {\n    await releaseClaim(exec, claimKey);\n    return null;\n  }\n\n  try {\n    const orgId = nanoid();\n    const orgName = defaultOrgName(email, session);\n    const now = Date.now();\n\n    await exec.execute({\n      sql: `INSERT INTO organizations (id, name, created_by, created_at) VALUES (?, ?, ?, ?)`,\n      args: [orgId, orgName, email, now],\n    });\n    await exec.execute({\n      sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,\n      args: [nanoid(), orgId, email, \"owner\", now],\n    });\n\n    await putUserSetting(email, \"active-org-id\", { orgId });\n\n    return { email, orgId, orgName, role: \"owner\" };\n  } catch {\n    await releaseClaim(exec, claimKey);\n    return null;\n  }\n}\n\nasync function acquireClaim(\n  exec: ReturnType<typeof getDbExec>,\n  claimKey: string,\n): Promise<boolean> {\n  const now = Date.now();\n  try {\n    await exec.execute({\n      sql: `INSERT INTO settings (key, value, updated_at) VALUES (?, ?, ?)`,\n      args: [claimKey, JSON.stringify({ at: now }), now],\n    });\n    return true;\n  } catch {\n    // Conflict — someone else's claim is already in the row. If it's\n    // stale (older than CLAIM_TTL_MS) we take it over.\n    //\n    // CRITICAL: this MUST be a single atomic UPDATE guarded on\n    // `updated_at <= staleThreshold`. A read-then-DELETE-then-INSERT\n    // sequence lets two concurrent reclaimers each observe the stale\n    // timestamp, delete each other's fresh claim, and both think they\n    // won — duplicating org creation. The conditional UPDATE matches\n    // each stale row at most once: only the first writer sees\n    // rowsAffected === 1; the row's updated_at is now `now`, so any\n    // subsequent UPDATE no longer satisfies `updated_at <= staleThreshold`\n    // and matches zero rows.\n    const staleThreshold = now - CLAIM_TTL_MS;\n    const result = (await exec.execute({\n      sql: `UPDATE settings SET value = ?, updated_at = ? WHERE key = ? AND updated_at <= ?`,\n      args: [JSON.stringify({ at: now }), now, claimKey, staleThreshold],\n    })) as { rowsAffected?: number };\n    return (result.rowsAffected ?? 0) > 0;\n  }\n}\n\nasync function releaseClaim(\n  exec: ReturnType<typeof getDbExec>,\n  claimKey: string,\n): Promise<void> {\n  // Best-effort. If this fails (transient network/DB error), the\n  // CLAIM_TTL_MS-based takeover in acquireClaim recovers automatically\n  // on a future request — no permanent stuck state.\n  await exec\n    .execute({ sql: `DELETE FROM settings WHERE key = ?`, args: [claimKey] })\n    .catch(() => {});\n}\n\n/**\n * Look up the `allowed_domain` for an org by its ID.\n * Used when making outbound A2A calls so the JWT includes the\n * caller's org domain for cross-app org resolution.\n */\nexport async function getOrgDomain(orgId: string): Promise<string | null> {\n  try {\n    const exec = getDbExec();\n    const { rows } = await exec.execute({\n      sql: `SELECT allowed_domain FROM organizations WHERE id = ? LIMIT 1`,\n      args: [orgId],\n    });\n    if (!rows[0]) return null;\n    const domain = String((rows[0] as any).allowed_domain || \"\");\n    return domain || null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Look up the org's A2A secret by org ID.\n * Used when making outbound A2A calls so the JWT is signed with the\n * org-specific secret rather than the global A2A_SECRET env var.\n */\nexport async function getOrgA2ASecret(orgId: string): Promise<string | null> {\n  try {\n    const exec = getDbExec();\n    const { rows } = await exec.execute({\n      sql: `SELECT a2a_secret FROM organizations WHERE id = ? LIMIT 1`,\n      args: [orgId],\n    });\n    if (!rows[0]) return null;\n    const secret = String((rows[0] as any).a2a_secret || \"\");\n    return secret || null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Look up an org's A2A secret by its `allowed_domain`.\n * Used on the A2A receiving side: the caller's JWT includes `org_domain`,\n * and the receiver looks up which local org matches that domain to find\n * the secret used to verify the JWT signature.\n */\nexport async function getA2ASecretByDomain(\n  domain: string,\n): Promise<string | null> {\n  try {\n    const exec = getDbExec();\n    const { rows } = await exec.execute({\n      sql: `SELECT a2a_secret FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,\n      args: [domain.toLowerCase()],\n    });\n    if (!rows[0]) return null;\n    const secret = String((rows[0] as any).a2a_secret || \"\");\n    return secret || null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Resolve a local org by its `allowed_domain`.\n * Used on the A2A receiving side: the caller sends `org_domain` in the JWT,\n * and the receiver looks up which local org matches that domain.\n */\nexport async function resolveOrgByDomain(\n  domain: string,\n): Promise<{ orgId: string; orgName: string } | null> {\n  try {\n    const exec = getDbExec();\n    const { rows } = await exec.execute({\n      sql: `SELECT id, name FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,\n      args: [domain.toLowerCase()],\n    });\n    if (!rows[0]) return null;\n    return {\n      orgId: String((rows[0] as any).id),\n      orgName: String((rows[0] as any).name),\n    };\n  } catch {\n    return null;\n  }\n}\n"]}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/org/context.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAGnE,MAAM,aAAa,GAAe;IAChC,KAAK,EAAE,EAAE;IACT,KAAK,EAAE,IAAI;IACX,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,IAAI;CACX,CAAC;AAEF,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ;QACjE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,yBAAyB,CAChC,UAA+B,EAC/B,KAAa,EACb,OAAiC;IAEjC,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,MAAM,GAAG,GAAW,EAAE,CAC1B,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAc;IAChD,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,GAAG,GAAG,KAAK,CAAC,OAEjB,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAAc;IACrD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,aAAa,CAAC;IACjC,MAAM,YAAY,GAChB,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE;QACvD,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE;QACtB,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,cAAc,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzD,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IAEzB,IAAI,WAAW,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,YAAY;gBACnB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,cAAc;aACrB,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,gBAAgB,GAAG,CAAC,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,CAAC,CAE9D,CAAC;QACT,IAAI,gBAAgB,EAAE,KAAK,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,KAAK,CAC1C,CAAC;YACF,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO;oBACL,KAAK;oBACL,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;iBAClB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,GAAG,YAAY;QACpC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC;QACnD,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,uBAAuB,GAC3B,WAAW,CAAC,MAAM,KAAK,CAAC;QACxB,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;YACvB,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAE/D,IAAI,uBAAuB,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,KAAK,EAAE;YACrD,iBAAiB,EAAE,QAAQ;SAC5B,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACrD,IAAI,SAAS,KAAK,IAAI;gBAAE,WAAW,GAAG,SAAS,CAAC;QAClD,CAAC;QAED,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,WAAW,CAAC,CAAC;YACvE,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO;oBACL,KAAK;oBACL,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;iBAClB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,MAAM,GACV,iBAAiB,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC;QACzE,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC;QACJ,CAAC;QACD,OAAO;YACL,KAAK;YACL,KAAK,EAAE,YAAY;YACnB,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,cAAc;SACrB,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC;QACpE,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,8DAA8D;QAC9D,iDAAiD;IACnD,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,OAAO;QACL,KAAK;QACL,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK;QAC3B,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO;QAC/B,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;KAC1B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,IAAkC,EAClC,KAAa;IAMb,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE;;;qCAG0B;YAC/B,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SAC5B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YAC3B,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;YAClC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAY;YAC/B,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC;SACzC,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAa;IAEb,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,uDAAuD;YAC5D,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SAC5B,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACnD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,gBAAgB,GAAG,CAAC,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,CAAC,CAE9D,CAAC;QACT,IAAI,gBAAgB,EAAE,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YACpE,OAAO,gBAAgB,CAAC,KAAK,CAAC;QAChC,CAAC;QACD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,KAAa,EACb,OAAgB,OAAO;IAQvB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;IACpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAExD,MAAM,IAAI,CAAC,OAAO,CAAC;QACjB,GAAG,EAAE,iGAAiG;QACtG,IAAI,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC;KACrD,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,OAAO,CAAC;QACjB,GAAG,EAAE,qFAAqF;QAC1F,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC;KAC7C,CAAC,CAAC;IAEH,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IAE5D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,cAAc,CACrB,KAAa,EACb,OAAiC;IAEjC,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACnC,IAAI,IAAI;QAAE,OAAO,GAAG,IAAI,cAAc,CAAC;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,MAAM,GACV,OAAO;SACJ,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAClD,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACvB,OAAO,GAAG,MAAM,cAAc,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAAkC,EAClC,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,qFAAqF;YAC1F,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SAC5B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,4DAA4D;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,IAAkC,EAClC,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,qEAAqE;YAC1E,IAAI,EAAE,CAAC,MAAM,CAAC;SACf,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;sDAIsD;AACtD,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,UAAU,mBAAmB,CAChC,IAAkC,EAClC,KAAa,EACb,OAAiC;IAEjC,sEAAsE;IACtE,mEAAmE;IACnE,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAE7C,MAAM,QAAQ,GAAG,KAAK,KAAK,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAE9D,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvD,sEAAsE;IACtE,qEAAqE;IACrE,mEAAmE;IACnE,yDAAyD;IACzD,IAAI,MAAM,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,GAAG,EAAE,kFAAkF;YACvF,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC;SACnC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,GAAG,EAAE,qFAAqF;YAC1F,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;SAC7C,CAAC,CAAC;QAEH,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAExD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,IAAkC,EAClC,QAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,GAAG,EAAE,gEAAgE;YACrE,IAAI,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC;SACnD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,mDAAmD;QACnD,EAAE;QACF,2DAA2D;QAC3D,iEAAiE;QACjE,iEAAiE;QACjE,kEAAkE;QAClE,iEAAiE;QACjE,0DAA0D;QAC1D,gEAAgE;QAChE,uEAAuE;QACvE,yBAAyB;QACzB,MAAM,cAAc,GAAG,GAAG,GAAG,YAAY,CAAC;QAC1C,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC;YACjC,GAAG,EAAE,iFAAiF;YACtF,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC;SACnE,CAAC,CAA8B,CAAC;QACjC,OAAO,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,IAAkC,EAClC,QAAgB;IAEhB,+DAA+D;IAC/D,qEAAqE;IACrE,kDAAkD;IAClD,MAAM,IAAI;SACP,OAAO,CAAC,EAAE,GAAG,EAAE,oCAAoC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;SACxE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAa;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,+DAA+D;YACpE,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;QAC7D,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,2DAA2D;YAChE,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzD,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,8EAA8E;YACnF,IAAI,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzD,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,4EAA4E;YACjF,IAAI,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO;YACL,KAAK,EAAE,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,IAAI,CAAC;SACvC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\nimport { getSession } from \"../server/auth.js\";\nimport { getUserSetting, putUserSetting } from \"../settings/user-settings.js\";\nimport { getDbExec } from \"../db/client.js\";\nimport { getSetting } from \"../settings/store.js\";\nimport { autoJoinDomainMatchingOrgs } from \"./auto-join-domain.js\";\nimport type { OrgContext, OrgRole } from \"./types.js\";\n\nconst EMPTY_CONTEXT: OrgContext = {\n  email: \"\",\n  orgId: null,\n  orgName: null,\n  role: null,\n};\n\nfunction normalizeOrgRole(value: unknown): OrgRole | null {\n  return value === \"owner\" || value === \"admin\" || value === \"member\"\n    ? value\n    : null;\n}\n\nfunction isLikelyPersonalWorkspace(\n  membership: { orgName: string },\n  email: string,\n  session: { name?: string } | null,\n): boolean {\n  return membership.orgName.trim() === defaultOrgName(email, session);\n}\n\nconst nanoid = (): string =>\n  globalThis.crypto?.randomUUID?.().replace(/-/g, \"\") ??\n  Math.random().toString(36).slice(2) + Date.now().toString(36);\n\n/**\n * Resolve the current user's organization context from their session.\n *\n * - For users in multiple orgs, honors their `active-org-id` user setting.\n * - Falls back to the user's first membership.\n * - When `AUTO_CREATE_DEFAULT_ORG` is set and the authenticated user has\n *   zero memberships, provisions a default org named after the user\n *   ({name}'s workspace, falling back to the email local-part). Opt-in\n *   per deployment so templates that don't use orgs don't accrue phantom\n *   default orgs in their DB. The <RequireActiveOrg> client guard remains\n *   the safety net for pre-existing accounts or provisioning failures.\n *\n * Per-request memoized on `event.context` — mirrors the `getSession`\n * pattern so multiple callers in the same request (e.g. ssr-handler +\n * a loader) share a single org_members round trip.\n */\nexport async function getOrgContext(event: H3Event): Promise<OrgContext> {\n  // Per-request memoization. Multiple call sites per request (action wrappers,\n  // SSR handler, loaders) must not each pay a separate org_members query.\n  const ctx = event.context as {\n    __anOrgContextCache?: Promise<OrgContext>;\n  };\n  return (ctx.__anOrgContextCache ??= resolveOrgContextUncached(event));\n}\n\nasync function resolveOrgContextUncached(event: H3Event): Promise<OrgContext> {\n  const session = await getSession(event);\n  const email = session?.email;\n  if (!email) return EMPTY_CONTEXT;\n  const sessionOrgId =\n    typeof session.orgId === \"string\" && session.orgId.trim()\n      ? session.orgId.trim()\n      : null;\n  const sessionOrgRole = normalizeOrgRole(session.orgRole);\n\n  const exec = getDbExec();\n\n  let memberships = await loadMemberships(exec, email);\n  if (memberships === null) {\n    if (sessionOrgId) {\n      return {\n        email,\n        orgId: sessionOrgId,\n        orgName: null,\n        role: sessionOrgRole,\n      };\n    }\n    return { email, orgId: null, orgName: null, role: null };\n  }\n\n  if (memberships.length > 1) {\n    const activeOrgSetting = (await getUserSetting(email, \"active-org-id\")) as {\n      orgId: string;\n    } | null;\n    if (activeOrgSetting?.orgId) {\n      const active = memberships.find(\n        (m) => m.orgId === activeOrgSetting.orgId,\n      );\n      if (active) {\n        return {\n          email,\n          orgId: active.orgId,\n          orgName: active.orgName,\n          role: active.role,\n        };\n      }\n    }\n  }\n\n  const sessionMembership = sessionOrgId\n    ? memberships.find((m) => m.orgId === sessionOrgId)\n    : null;\n  const shouldTryDomainAutoJoin =\n    memberships.length === 0 ||\n    (memberships.length === 1 &&\n      isLikelyPersonalWorkspace(memberships[0], email, session));\n\n  if (shouldTryDomainAutoJoin) {\n    const joined = await autoJoinDomainMatchingOrgs(email, {\n      activateJoinedOrg: \"always\",\n    });\n    if (joined.joined.length > 0) {\n      const refreshed = await loadMemberships(exec, email);\n      if (refreshed !== null) memberships = refreshed;\n    }\n\n    if (joined.activeOrgId) {\n      const active = memberships.find((m) => m.orgId === joined.activeOrgId);\n      if (active) {\n        return {\n          email,\n          orgId: active.orgId,\n          orgName: active.orgName,\n          role: active.role,\n        };\n      }\n    }\n  }\n\n  if (sessionOrgId) {\n    const active =\n      sessionMembership ?? memberships.find((m) => m.orgId === sessionOrgId);\n    if (active) {\n      return {\n        email,\n        orgId: active.orgId,\n        orgName: active.orgName,\n        role: active.role,\n      };\n    }\n    return {\n      email,\n      orgId: sessionOrgId,\n      orgName: null,\n      role: sessionOrgRole,\n    };\n  }\n\n  if (memberships.length === 0 && process.env.AUTO_CREATE_DEFAULT_ORG) {\n    const created = await tryCreateDefaultOrg(exec, email, session);\n    if (created) return created;\n    // Creation failed (race / DB error); fall through and let the\n    // RequireActiveOrg client guard prompt the user.\n  }\n\n  if (memberships.length === 0) {\n    return { email, orgId: null, orgName: null, role: null };\n  }\n\n  return {\n    email,\n    orgId: memberships[0].orgId,\n    orgName: memberships[0].orgName,\n    role: memberships[0].role,\n  };\n}\n\nasync function loadMemberships(\n  exec: ReturnType<typeof getDbExec>,\n  email: string,\n): Promise<Array<{\n  orgId: string;\n  role: OrgRole;\n  orgName: string;\n}> | null> {\n  try {\n    const { rows } = await exec.execute({\n      sql: `SELECT m.org_id AS \"orgId\", m.role AS role, o.name AS \"orgName\"\n            FROM org_members m\n            INNER JOIN organizations o ON m.org_id = o.id\n            WHERE LOWER(m.email) = ?`,\n      args: [email.toLowerCase()],\n    });\n    return rows.map((r: any) => ({\n      orgId: String(r.orgId ?? r.org_id),\n      role: String(r.role) as OrgRole,\n      orgName: String(r.orgName ?? r.org_name),\n    }));\n  } catch {\n    // Tables may not exist yet on first boot before migrations finish.\n    return null;\n  }\n}\n\n/**\n * Resolve the active org ID for a given email — for non-HTTP contexts like\n * the integration webhook handler where we have an email but no event/session.\n * Picks the user's active-org-id setting if set, otherwise the first membership.\n * Returns null if the user has no memberships.\n */\nexport async function resolveOrgIdForEmail(\n  email: string,\n): Promise<string | null> {\n  const exec = getDbExec();\n  if (!exec) return null;\n  try {\n    const { rows } = await exec.execute({\n      sql: `SELECT org_id FROM org_members WHERE LOWER(email) = ?`,\n      args: [email.toLowerCase()],\n    });\n    if (rows.length === 0) return null;\n    const ids = rows.map((r: any) => String(r.org_id));\n    if (ids.length === 1) return ids[0];\n    const activeOrgSetting = (await getUserSetting(email, \"active-org-id\")) as {\n      orgId: string;\n    } | null;\n    if (activeOrgSetting?.orgId && ids.includes(activeOrgSetting.orgId)) {\n      return activeOrgSetting.orgId;\n    }\n    return ids[0];\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Create a new organization and add the caller as a member with the given\n * role. Generates a per-org A2A secret for cross-app delegation and writes\n * the caller's `active-org-id` user-setting so the new org is immediately\n * active.\n *\n */\nexport async function createOrganization(\n  name: string,\n  email: string,\n  role: OrgRole = \"owner\",\n): Promise<{\n  id: string;\n  name: string;\n  role: OrgRole;\n  a2aSecret: string;\n  createdAt: number;\n}> {\n  const trimmedName = name.trim();\n  const exec = getDbExec();\n  const id = nanoid();\n  const createdAt = Date.now();\n  const { randomBytes } = await import(\"node:crypto\");\n  const a2aSecret = randomBytes(32).toString(\"base64url\");\n\n  await exec.execute({\n    sql: `INSERT INTO organizations (id, name, created_by, created_at, a2a_secret) VALUES (?, ?, ?, ?, ?)`,\n    args: [id, trimmedName, email, createdAt, a2aSecret],\n  });\n\n  await exec.execute({\n    sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,\n    args: [nanoid(), id, email, role, createdAt],\n  });\n\n  await putUserSetting(email, \"active-org-id\", { orgId: id });\n\n  return { id, name: trimmedName, role, a2aSecret, createdAt };\n}\n\nfunction defaultOrgName(\n  email: string,\n  session: { name?: string } | null,\n): string {\n  const full = session?.name?.trim();\n  if (full) return `${full}'s workspace`;\n  const local = email.split(\"@\")[0] ?? email;\n  const cleaned = local.replace(/[._-]+/g, \" \").trim();\n  const titled =\n    cleaned\n      .split(\" \")\n      .filter(Boolean)\n      .map((w) => w.charAt(0).toUpperCase() + w.slice(1))\n      .join(\" \") || \"My\";\n  return `${titled}'s workspace`;\n}\n\n/**\n * Check whether the user has a pending invitation. If so, auto-create\n * MUST be skipped — otherwise we'd provision a personal org for them\n * before they ever see the inviter's org in the RequireActiveOrg\n * accept-invite pane, and they'd never join the team that invited them.\n */\nasync function hasPendingInvitation(\n  exec: ReturnType<typeof getDbExec>,\n  email: string,\n): Promise<boolean> {\n  try {\n    const { rows } = await exec.execute({\n      sql: `SELECT 1 FROM org_invitations WHERE LOWER(email) = ? AND status = 'pending' LIMIT 1`,\n      args: [email.toLowerCase()],\n    });\n    return rows.length > 0;\n  } catch {\n    // If we can't tell, err on the side of NOT auto-creating — the\n    // RequireActiveOrg client guard will surface the situation.\n    return true;\n  }\n}\n\nasync function hasDomainMatch(\n  exec: ReturnType<typeof getDbExec>,\n  email: string,\n): Promise<boolean> {\n  try {\n    const domain = email.split(\"@\")[1]?.toLowerCase();\n    if (!domain) return false;\n    const { rows } = await exec.execute({\n      sql: `SELECT 1 FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,\n      args: [domain],\n    });\n    return rows.length > 0;\n  } catch {\n    return false;\n  }\n}\n\n/** Stale-claim threshold. A claim row this old is treated as abandoned\n *  (process crashed, DELETE failed, etc.) and a new caller may take it\n *  over. Long enough that two genuine concurrent first-loads don't\n *  trample each other (those settle in milliseconds), short enough that\n *  a stuck user recovers on their next navigation. */\nconst CLAIM_TTL_MS = 5 * 60 * 1000;\n\n/**\n * Attempt to provision a default org + owner membership for a user with\n * zero memberships.\n *\n * Race protection: claims the user's auto-create slot via an atomic\n * INSERT into the framework `settings` table (PRIMARY KEY (key) — so\n * concurrent inserts for the same key throw uniqueness violations on\n * both SQLite and Postgres). Only the request that wins the claim\n * proceeds to create the org; losers bail. By the time a losing\n * request retries on a subsequent navigation, the winner's org is in\n * `org_members` and the auto-create branch is skipped entirely.\n *\n * Stuck-state recovery: a stale claim (held longer than CLAIM_TTL_MS)\n * is reclaimed automatically. So even if the DELETE on the failure\n * path fails (network blip, DB error), the user isn't stranded — the\n * next request after the TTL elapses retries cleanly.\n *\n * Returns null on any failure so the caller can fall back to the\n * empty-context / client-guard path.\n */\nasync function tryCreateDefaultOrg(\n  exec: ReturnType<typeof getDbExec>,\n  email: string,\n  session: { name?: string } | null,\n): Promise<OrgContext | null> {\n  // Make sure the framework `settings` table exists before we use it as\n  // a claim primitive. getSetting() ensures the table on first call.\n  await getSetting(\"__init\").catch(() => null);\n\n  const claimKey = `u:${email.toLowerCase()}:auto-create-claim`;\n\n  if (!(await acquireClaim(exec, claimKey))) return null;\n\n  // Pending-invite check happens INSIDE the claim so the window where a\n  // newly-arrived invitation can be missed is narrowed to a single SQL\n  // round-trip. (A still-narrower window would require a transaction\n  // spanning org_invitations and settings — out of scope.)\n  if (await hasPendingInvitation(exec, email)) {\n    await releaseClaim(exec, claimKey);\n    return null;\n  }\n\n  if (await hasDomainMatch(exec, email)) {\n    await releaseClaim(exec, claimKey);\n    return null;\n  }\n\n  try {\n    const orgId = nanoid();\n    const orgName = defaultOrgName(email, session);\n    const now = Date.now();\n\n    await exec.execute({\n      sql: `INSERT INTO organizations (id, name, created_by, created_at) VALUES (?, ?, ?, ?)`,\n      args: [orgId, orgName, email, now],\n    });\n    await exec.execute({\n      sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,\n      args: [nanoid(), orgId, email, \"owner\", now],\n    });\n\n    await putUserSetting(email, \"active-org-id\", { orgId });\n\n    return { email, orgId, orgName, role: \"owner\" };\n  } catch {\n    await releaseClaim(exec, claimKey);\n    return null;\n  }\n}\n\nasync function acquireClaim(\n  exec: ReturnType<typeof getDbExec>,\n  claimKey: string,\n): Promise<boolean> {\n  const now = Date.now();\n  try {\n    await exec.execute({\n      sql: `INSERT INTO settings (key, value, updated_at) VALUES (?, ?, ?)`,\n      args: [claimKey, JSON.stringify({ at: now }), now],\n    });\n    return true;\n  } catch {\n    // Conflict — someone else's claim is already in the row. If it's\n    // stale (older than CLAIM_TTL_MS) we take it over.\n    //\n    // CRITICAL: this MUST be a single atomic UPDATE guarded on\n    // `updated_at <= staleThreshold`. A read-then-DELETE-then-INSERT\n    // sequence lets two concurrent reclaimers each observe the stale\n    // timestamp, delete each other's fresh claim, and both think they\n    // won — duplicating org creation. The conditional UPDATE matches\n    // each stale row at most once: only the first writer sees\n    // rowsAffected === 1; the row's updated_at is now `now`, so any\n    // subsequent UPDATE no longer satisfies `updated_at <= staleThreshold`\n    // and matches zero rows.\n    const staleThreshold = now - CLAIM_TTL_MS;\n    const result = (await exec.execute({\n      sql: `UPDATE settings SET value = ?, updated_at = ? WHERE key = ? AND updated_at <= ?`,\n      args: [JSON.stringify({ at: now }), now, claimKey, staleThreshold],\n    })) as { rowsAffected?: number };\n    return (result.rowsAffected ?? 0) > 0;\n  }\n}\n\nasync function releaseClaim(\n  exec: ReturnType<typeof getDbExec>,\n  claimKey: string,\n): Promise<void> {\n  // Best-effort. If this fails (transient network/DB error), the\n  // CLAIM_TTL_MS-based takeover in acquireClaim recovers automatically\n  // on a future request — no permanent stuck state.\n  await exec\n    .execute({ sql: `DELETE FROM settings WHERE key = ?`, args: [claimKey] })\n    .catch(() => {});\n}\n\n/**\n * Look up the `allowed_domain` for an org by its ID.\n * Used when making outbound A2A calls so the JWT includes the\n * caller's org domain for cross-app org resolution.\n */\nexport async function getOrgDomain(orgId: string): Promise<string | null> {\n  try {\n    const exec = getDbExec();\n    const { rows } = await exec.execute({\n      sql: `SELECT allowed_domain FROM organizations WHERE id = ? LIMIT 1`,\n      args: [orgId],\n    });\n    if (!rows[0]) return null;\n    const domain = String((rows[0] as any).allowed_domain || \"\");\n    return domain || null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Look up the org's A2A secret by org ID.\n * Used when making outbound A2A calls so the JWT is signed with the\n * org-specific secret rather than the global A2A_SECRET env var.\n */\nexport async function getOrgA2ASecret(orgId: string): Promise<string | null> {\n  try {\n    const exec = getDbExec();\n    const { rows } = await exec.execute({\n      sql: `SELECT a2a_secret FROM organizations WHERE id = ? LIMIT 1`,\n      args: [orgId],\n    });\n    if (!rows[0]) return null;\n    const secret = String((rows[0] as any).a2a_secret || \"\");\n    return secret || null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Look up an org's A2A secret by its `allowed_domain`.\n * Used on the A2A receiving side: the caller's JWT includes `org_domain`,\n * and the receiver looks up which local org matches that domain to find\n * the secret used to verify the JWT signature.\n */\nexport async function getA2ASecretByDomain(\n  domain: string,\n): Promise<string | null> {\n  try {\n    const exec = getDbExec();\n    const { rows } = await exec.execute({\n      sql: `SELECT a2a_secret FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,\n      args: [domain.toLowerCase()],\n    });\n    if (!rows[0]) return null;\n    const secret = String((rows[0] as any).a2a_secret || \"\");\n    return secret || null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Resolve a local org by its `allowed_domain`.\n * Used on the A2A receiving side: the caller sends `org_domain` in the JWT,\n * and the receiver looks up which local org matches that domain.\n */\nexport async function resolveOrgByDomain(\n  domain: string,\n): Promise<{ orgId: string; orgName: string } | null> {\n  try {\n    const exec = getDbExec();\n    const { rows } = await exec.execute({\n      sql: `SELECT id, name FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,\n      args: [domain.toLowerCase()],\n    });\n    if (!rows[0]) return null;\n    return {\n      orgId: String((rows[0] as any).id),\n      orgName: String((rows[0] as any).name),\n    };\n  } catch {\n    return null;\n  }\n}\n"]}

package/dist/org/migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../src/org/migrations.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;GAoD1B,CAAC"}
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../src/org/migrations.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;GA0D1B,CAAC"}

package/dist/org/migrations.js

@@ -55,5 +55,11 @@ export const ORG_MIGRATIONS = [
         version: 1007,
         sql: `CREATE INDEX IF NOT EXISTS org_members_lower_email_idx ON org_members (LOWER(email))`,
     },
+    {
+        // Domain join and org resolution query `LOWER(allowed_domain)`.
+        // Keep that opt-in lookup indexed before it appears on any request path.
+        version: 1008,
+        sql: `CREATE INDEX IF NOT EXISTS organizations_lower_allowed_domain_idx ON organizations (LOWER(allowed_domain))`,
+    },
 ];
 //# sourceMappingURL=migrations.js.map