@ai-matrx/auth 0.1.3 → 0.2.0

package/dist/node.d.cts

@@ -1,3 +1,5 @@
+import { JWK, JwtPayload, AuthError, UserAppMetadata, UserMetadata, SupabaseClient } from '@supabase/supabase-js';
+
 /**
  * Session storage per platform — where a Supabase session lives between runs.
  *
@@ -21,6 +23,120 @@ interface SessionStorage {
     removeItem(key: string): void | Promise<void>;
 }
 
+/**
+ * THE identity read every server and client path shares (moved from the website's
+ * `utils/supabase/{claimsUser,projectSigningKeys,unverifiableSession}.ts`, 2026-10-12).
+ *
+ * Verifies the access token LOCALLY (WebCrypto against the project's JWKS; the live project signs
+ * ES256) and never asks the auth server who the caller is. `getClaims()`, NEVER `getUser()`:
+ * `getUser()` is one auth-server round trip per call, with auth-js retrying a stalled refresh for
+ * up to 30s — on 2026-09-20 and 09-21 that put 504s in front of real people.
+ *
+ * Framework-free: no `next/*`, no `window` at import time. Server doors (`createServerAuth` in
+ * `/next`, `verifyRequest` in `/node`) and the browser's de-duplicated read (`createClaimsCache`)
+ * are thin wrappers over `getClaimsUser`.
+ */
+
+/**
+ * The verified caller, built from the access token's claims. `id` is `sub`; `app_metadata` /
+ * `user_metadata` default to `{}` so a reader never null-checks what `getUser()` always handed it.
+ */
+interface ApiClaimsUser extends JwtPayload {
+    /** The `sub` claim — the user id. */
+    id: string;
+    app_metadata: UserAppMetadata;
+    user_metadata: UserMetadata;
+}
+/** Any Supabase client — the only thing this door needs is `auth.getClaims`. */
+type ClaimsCapableClient = {
+    auth: {
+        getClaims(jwt?: string, options?: {
+            jwks?: {
+                keys: JWK[];
+            };
+        }): Promise<{
+            data: {
+                claims?: JwtPayload;
+            } | null;
+            error: AuthError | null;
+        }>;
+    };
+};
+
+/**
+ * Server identity doors (moved from the website's `utils/supabase/{getServerAuth,resolveUser,
+ * adminClient}.ts`, 2026-10-12). Framework-free: the app injects how it builds its cookie client,
+ * and (for Next) React's `cache()` so one request resolves once. Exported from `/next` and `/node`.
+ */
+
+interface ServerAuthState {
+    /** `true` when the request carries a locally verified access token. */
+    isAuthenticated: boolean;
+    /** The verified caller (claims, `id` = `sub`), or `null` for guests and unresolvable requests. */
+    user: ApiClaimsUser | null;
+    /**
+     * `true` when no verdict could be REACHED (authority/JWKS unreachable, identity budget spent).
+     * The person is NOT signed out: never bounce to sign-in on it. Never set for a token that was
+     * judged bad — that is a settled answer, the same line the proxy draws.
+     */
+    authUnavailable: boolean;
+    /** `true` for a guest (anonymous) session. */
+    isGuest: boolean;
+    /** `isAuthenticated && !isGuest` — the flag account UI keys on. */
+    hasAccount: boolean;
+}
+interface ServerAuthOptions {
+    /** A FRESH cookie-bound client per attempt (the identity budget belongs to the client). */
+    createClient: () => Promise<ClaimsCapableClient> | ClaimsCapableClient;
+    /** The URL the app talks to — decides which pinned keys apply. */
+    supabaseUrl: string | null | undefined;
+    /** React's `cache` on a Next server, so the whole tree shares one resolve per request. */
+    cache?: <F extends (...args: never[]) => unknown>(fn: F) => F;
+    /** Wait before the one retry (default 250ms). */
+    retryAfterMs?: number;
+    /** Where the "could not verify" warnings go (default `console.warn`). */
+    warn?: (message: string) => void;
+}
+/**
+ * Build THE server identity door: claims verified locally, asked twice before it hands anyone
+ * "could not verify" (that is almost always one cold first load spending its budget).
+ *
+ *   export const getServerAuth = createServerAuth({ createClient, supabaseUrl, cache });
+ */
+declare function createServerAuth(options: ServerAuthOptions): () => Promise<ServerAuthState>;
+/** The bit of a request this needs: its headers (a `Request`, a `NextRequest`, a Node shim). */
+interface RequestLike {
+    headers: {
+        get(name: string): string | null;
+    };
+}
+interface VerifyRequestOptions {
+    url: string;
+    /** The publishable key (`sb_publishable_*`). */
+    publishableKey: string;
+    /** The app's cookie-bound client, used when the request carries no Bearer token. */
+    cookieClient?: () => Promise<ClaimsCapableClient> | ClaimsCapableClient;
+}
+/**
+ * Who is calling this API route: a Bearer token (public/mobile/extension/desktop clients) or the
+ * session cookie (browser). `user` is null when the caller is signed out OR could not be verified;
+ * `error` tells the two apart (null = settled signed out).
+ */
+declare function verifyRequest(request: RequestLike, options: VerifyRequestOptions): Promise<{
+    user: ApiClaimsUser | null;
+    error: Error | null;
+}>;
+/**
+ * THE service (secret-key) client — server-only, bypasses row security. The package's browser
+ * clients refuse a secret key by design (`SecretKeyRefusedError`); this is the one door for it.
+ * Never ship it to a browser bundle: it lives in `/node` and `/next` only.
+ */
+declare function createServiceClient<Database = unknown>(options: {
+    url: string | null | undefined;
+    /** `sb_secret_*` (the legacy service-role JWT is banned). */
+    secretKey: string | null | undefined;
+}): SupabaseClient<Database>;
+
 /**
  * @ai-matrx/auth/node — session storage for Node scripts and CLIs: the session survives between
  * runs in one JSON file (mode 0600), so a script signs in once and refreshes after.
@@ -30,4 +146,4 @@ interface SessionStorage {
 
 declare function fileStorage(path: string): SessionStorage;
 
-export { fileStorage };
+export { type RequestLike, type ServerAuthOptions, type ServerAuthState, type VerifyRequestOptions, createServerAuth, createServiceClient, fileStorage, verifyRequest };

package/dist/node.d.ts

@@ -1,3 +1,5 @@
+import { JWK, JwtPayload, AuthError, UserAppMetadata, UserMetadata, SupabaseClient } from '@supabase/supabase-js';
+
 /**
  * Session storage per platform — where a Supabase session lives between runs.
  *
@@ -21,6 +23,120 @@ interface SessionStorage {
     removeItem(key: string): void | Promise<void>;
 }
 
+/**
+ * THE identity read every server and client path shares (moved from the website's
+ * `utils/supabase/{claimsUser,projectSigningKeys,unverifiableSession}.ts`, 2026-10-12).
+ *
+ * Verifies the access token LOCALLY (WebCrypto against the project's JWKS; the live project signs
+ * ES256) and never asks the auth server who the caller is. `getClaims()`, NEVER `getUser()`:
+ * `getUser()` is one auth-server round trip per call, with auth-js retrying a stalled refresh for
+ * up to 30s — on 2026-09-20 and 09-21 that put 504s in front of real people.
+ *
+ * Framework-free: no `next/*`, no `window` at import time. Server doors (`createServerAuth` in
+ * `/next`, `verifyRequest` in `/node`) and the browser's de-duplicated read (`createClaimsCache`)
+ * are thin wrappers over `getClaimsUser`.
+ */
+
+/**
+ * The verified caller, built from the access token's claims. `id` is `sub`; `app_metadata` /
+ * `user_metadata` default to `{}` so a reader never null-checks what `getUser()` always handed it.
+ */
+interface ApiClaimsUser extends JwtPayload {
+    /** The `sub` claim — the user id. */
+    id: string;
+    app_metadata: UserAppMetadata;
+    user_metadata: UserMetadata;
+}
+/** Any Supabase client — the only thing this door needs is `auth.getClaims`. */
+type ClaimsCapableClient = {
+    auth: {
+        getClaims(jwt?: string, options?: {
+            jwks?: {
+                keys: JWK[];
+            };
+        }): Promise<{
+            data: {
+                claims?: JwtPayload;
+            } | null;
+            error: AuthError | null;
+        }>;
+    };
+};
+
+/**
+ * Server identity doors (moved from the website's `utils/supabase/{getServerAuth,resolveUser,
+ * adminClient}.ts`, 2026-10-12). Framework-free: the app injects how it builds its cookie client,
+ * and (for Next) React's `cache()` so one request resolves once. Exported from `/next` and `/node`.
+ */
+
+interface ServerAuthState {
+    /** `true` when the request carries a locally verified access token. */
+    isAuthenticated: boolean;
+    /** The verified caller (claims, `id` = `sub`), or `null` for guests and unresolvable requests. */
+    user: ApiClaimsUser | null;
+    /**
+     * `true` when no verdict could be REACHED (authority/JWKS unreachable, identity budget spent).
+     * The person is NOT signed out: never bounce to sign-in on it. Never set for a token that was
+     * judged bad — that is a settled answer, the same line the proxy draws.
+     */
+    authUnavailable: boolean;
+    /** `true` for a guest (anonymous) session. */
+    isGuest: boolean;
+    /** `isAuthenticated && !isGuest` — the flag account UI keys on. */
+    hasAccount: boolean;
+}
+interface ServerAuthOptions {
+    /** A FRESH cookie-bound client per attempt (the identity budget belongs to the client). */
+    createClient: () => Promise<ClaimsCapableClient> | ClaimsCapableClient;
+    /** The URL the app talks to — decides which pinned keys apply. */
+    supabaseUrl: string | null | undefined;
+    /** React's `cache` on a Next server, so the whole tree shares one resolve per request. */
+    cache?: <F extends (...args: never[]) => unknown>(fn: F) => F;
+    /** Wait before the one retry (default 250ms). */
+    retryAfterMs?: number;
+    /** Where the "could not verify" warnings go (default `console.warn`). */
+    warn?: (message: string) => void;
+}
+/**
+ * Build THE server identity door: claims verified locally, asked twice before it hands anyone
+ * "could not verify" (that is almost always one cold first load spending its budget).
+ *
+ *   export const getServerAuth = createServerAuth({ createClient, supabaseUrl, cache });
+ */
+declare function createServerAuth(options: ServerAuthOptions): () => Promise<ServerAuthState>;
+/** The bit of a request this needs: its headers (a `Request`, a `NextRequest`, a Node shim). */
+interface RequestLike {
+    headers: {
+        get(name: string): string | null;
+    };
+}
+interface VerifyRequestOptions {
+    url: string;
+    /** The publishable key (`sb_publishable_*`). */
+    publishableKey: string;
+    /** The app's cookie-bound client, used when the request carries no Bearer token. */
+    cookieClient?: () => Promise<ClaimsCapableClient> | ClaimsCapableClient;
+}
+/**
+ * Who is calling this API route: a Bearer token (public/mobile/extension/desktop clients) or the
+ * session cookie (browser). `user` is null when the caller is signed out OR could not be verified;
+ * `error` tells the two apart (null = settled signed out).
+ */
+declare function verifyRequest(request: RequestLike, options: VerifyRequestOptions): Promise<{
+    user: ApiClaimsUser | null;
+    error: Error | null;
+}>;
+/**
+ * THE service (secret-key) client — server-only, bypasses row security. The package's browser
+ * clients refuse a secret key by design (`SecretKeyRefusedError`); this is the one door for it.
+ * Never ship it to a browser bundle: it lives in `/node` and `/next` only.
+ */
+declare function createServiceClient<Database = unknown>(options: {
+    url: string | null | undefined;
+    /** `sb_secret_*` (the legacy service-role JWT is banned). */
+    secretKey: string | null | undefined;
+}): SupabaseClient<Database>;
+
 /**
  * @ai-matrx/auth/node — session storage for Node scripts and CLIs: the session survives between
  * runs in one JSON file (mode 0600), so a script signs in once and refreshes after.
@@ -30,4 +146,4 @@ interface SessionStorage {
 
 declare function fileStorage(path: string): SessionStorage;
 
-export { fileStorage };
+export { type RequestLike, type ServerAuthOptions, type ServerAuthState, type VerifyRequestOptions, createServerAuth, createServiceClient, fileStorage, verifyRequest };

package/dist/node.js

@@ -1,3 +1,135 @@
+// src/server-auth.ts
+import { createClient } from "@supabase/supabase-js";
+
+// src/claims.ts
+import {
+  AuthError,
+  AuthSessionMissingError
+} from "@supabase/supabase-js";
+async function getClaimsUser(client, jwt, options) {
+  const { data, error } = options ? await client.auth.getClaims(jwt, options) : await client.auth.getClaims(jwt);
+  if (error) {
+    if (isSignedOutError(error)) return { data: { user: null }, error: null };
+    return { data: { user: null }, error };
+  }
+  if (!data?.claims) return { data: { user: null }, error: null };
+  const user = userFromClaims(data.claims);
+  if (!user) {
+    return {
+      data: { user: null },
+      error: new AuthError("Verified token carries no `sub` claim", 401, "bad_jwt")
+    };
+  }
+  return { data: { user }, error: null };
+}
+var BUDGET_EXHAUSTED_STATUS = 408;
+var BUDGET_EXHAUSTED_CODE = "auth_budget_exhausted";
+function isAuthTransportFailure(error) {
+  if (!error || typeof error !== "object") return false;
+  const name = String(error.name ?? "");
+  if (name === "AuthRetryableFetchError" || name === "TimeoutError" || name === "AbortError") return true;
+  const status = error.status;
+  if (status === 0 || status === 504 || status === 503) return true;
+  return status === BUDGET_EXHAUSTED_STATUS || error.code === BUDGET_EXHAUSTED_CODE;
+}
+function isSignedOutError(error) {
+  return error instanceof AuthSessionMissingError || error.name === "AuthSessionMissingError" || error.code === "session_not_found";
+}
+function userFromClaims(claims) {
+  if (!claims || typeof claims.sub !== "string") return null;
+  return {
+    ...claims,
+    id: claims.sub,
+    app_metadata: claims.app_metadata ?? {},
+    user_metadata: claims.user_metadata ?? {}
+  };
+}
+function accountFlagsFor(claims) {
+  if (!claims) return { isGuest: false, hasAccount: false };
+  const isGuest = claims.is_anonymous === true;
+  return { isGuest, hasAccount: !isGuest };
+}
+var PROJECT_SIGNING_KEY_AUTHORITIES = [
+  "db.matrxserver.com",
+  "brsgrqvjdzwihsvnfqkf.supabase.co"
+];
+var PROJECT_SIGNING_KEYS = [
+  {
+    alg: "ES256",
+    crv: "P-256",
+    ext: true,
+    key_ops: ["verify"],
+    kid: "a00aed0b-202c-483a-91ff-fc74719a3bb2",
+    kty: "EC",
+    use: "sig",
+    x: "guqOsgjJqGVU6g_K0iIXKrzixlkeXKOqkPUQCconp6U",
+    y: "39zQtkzlfQuPf_MtIhYmMdxNQpIR2Pkl11AToywaslY"
+  }
+];
+function pinnedSigningKeysFor(supabaseUrl) {
+  if (!supabaseUrl) return [];
+  let host;
+  try {
+    host = new URL(supabaseUrl).host.toLowerCase();
+  } catch {
+    return [];
+  }
+  return PROJECT_SIGNING_KEY_AUTHORITIES.includes(host) ? PROJECT_SIGNING_KEYS : [];
+}
+
+// src/server-auth.ts
+function createServerAuth(options) {
+  const warn = options.warn ?? ((m) => console.warn(m));
+  const resolveOnce = async () => {
+    const client = await options.createClient();
+    const {
+      data: { user },
+      error
+    } = await getClaimsUser(client, void 0, { jwks: { keys: pinnedSigningKeysFor(options.supabaseUrl) } });
+    const authUnavailable = !user && error !== null && isAuthTransportFailure(error);
+    if (authUnavailable) {
+      warn(
+        `[getServerAuth] identity could not be verified on this attempt \u2014 rendering without a user, NOT as signed out. Cause: ${error?.name ?? "unknown"}: ${error?.message ?? ""}`
+      );
+    }
+    return { isAuthenticated: !!user, user, authUnavailable, ...accountFlagsFor(user) };
+  };
+  const door = async () => {
+    const first = await resolveOnce();
+    if (!first.authUnavailable) return first;
+    await new Promise((resolve) => setTimeout(resolve, options.retryAfterMs ?? 250));
+    const second = await resolveOnce();
+    if (!second.authUnavailable) warn("[getServerAuth] identity verified on the retry \u2014 the first attempt's budget was spent.");
+    return second;
+  };
+  return options.cache ? options.cache(door) : door;
+}
+async function verifyRequest(request, options) {
+  const header = request.headers.get("Authorization") ?? request.headers.get("authorization");
+  if (header?.startsWith("Bearer ")) {
+    const token = header.slice(7);
+    const client2 = createClient(options.url, options.publishableKey, {
+      global: { headers: { Authorization: `Bearer ${token}` } },
+      auth: { persistSession: false, autoRefreshToken: false }
+    });
+    const { data: data2, error: error2 } = await getClaimsUser(client2, token, {
+      jwks: { keys: pinnedSigningKeysFor(options.url) }
+    });
+    return { user: data2.user, error: error2 };
+  }
+  if (!options.cookieClient) return { user: null, error: null };
+  const client = await options.cookieClient();
+  const { data, error } = await getClaimsUser(client, void 0, { jwks: { keys: pinnedSigningKeysFor(options.url) } });
+  return { user: data.user, error };
+}
+function createServiceClient(options) {
+  const url = options.url?.trim();
+  const key = options.secretKey?.trim();
+  if (!url) throw new Error("createServiceClient: the Supabase URL is not configured");
+  if (!key) throw new Error("createServiceClient: the secret key (SUPABASE_SECRET_KEY) is not configured");
+  return createClient(url, key, { auth: { persistSession: false, autoRefreshToken: false } });
+}
+
 // src/node.ts
 function builtin(name) {
   const get = globalThis.process?.getBuiltinModule;
@@ -32,5 +164,8 @@ function fileStorage(path) {
   };
 }
 export {
-  fileStorage
+  createServerAuth,
+  createServiceClient,
+  fileStorage,
+  verifyRequest
 };

package/dist/organizations.cjs

@@ -20,16 +20,29 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/organizations.ts
 var organizations_exports = {};
 __export(organizations_exports, {
+  MEMBERSHIPS_URL: () => MEMBERSHIPS_URL,
   NoActiveOrganizationError: () => NoActiveOrganizationError,
   NotAMemberError: () => NotAMemberError,
+  ORGANIZATION_CONTEXT_REQUIRED_CODE: () => ORGANIZATION_CONTEXT_REQUIRED_CODE,
   ORGANIZATION_ENTITY_TYPE: () => ORGANIZATION_ENTITY_TYPE,
+  ORGANIZATION_REQUIRED_CODE: () => ORGANIZATION_REQUIRED_CODE,
+  ORGANIZATION_REQUIRED_WIRE_CODE: () => ORGANIZATION_REQUIRED_WIRE_CODE,
+  OrganizationRequiredServerError: () => OrganizationRequiredServerError,
   classifyOrganizationRefusal: () => classifyOrganizationRefusal,
   createActiveOrganization: () => createActiveOrganization,
+  extractOrganizationHoldMemberships: () => extractOrganizationHoldMemberships,
+  isOrganizationRequiredEnvelope: () => isOrganizationRequiredEnvelope,
+  isOrganizationRequiredError: () => isOrganizationRequiredError,
+  isOrganizationRequiredServerError: () => isOrganizationRequiredServerError,
   memoryHeldOrganization: () => memoryHeldOrganization,
   oldestMembership: () => oldestMembership,
   orderOrganizations: () => orderOrganizations,
   organizationMatches: () => organizationMatches,
+  organizationRequired: () => organizationRequired,
+  organizationRequiredEnvelope: () => organizationRequiredEnvelope,
+  organizationRequiredResponse: () => organizationRequiredResponse,
   readAccountOrganizationChoices: () => readAccountOrganizationChoices,
+  readCallerMemberships: () => readCallerMemberships,
   readMemberships: () => readMemberships,
   readOrganizationFavourites: () => readOrganizationFavourites,
   resolveActiveOrganization: () => resolveActiveOrganization,
@@ -182,10 +195,43 @@ function check(door, data, error) {
   if (error) throw new SignInError(door, error.message, error.status, error.code);
   return data;
 }
+var personCache = /* @__PURE__ */ new WeakMap();
+function personEntry(client) {
+  let entry = personCache.get(client);
+  if (!entry) {
+    const fresh = { read: null, epoch: 0 };
+    entry = fresh;
+    personCache.set(client, fresh);
+    const subscribe = client.auth?.onAuthStateChange;
+    if (typeof subscribe === "function") {
+      subscribe.call(client.auth, async (event) => {
+        if (event === "SIGNED_IN" || event === "SIGNED_OUT" || event === "USER_UPDATED") invalidatePerson(client);
+      });
+    }
+  }
+  return entry;
+}
+function invalidatePerson(client) {
+  const entry = personCache.get(client);
+  if (!entry) return;
+  entry.epoch += 1;
+  entry.read = null;
+}
 async function getPerson(client) {
-  const { data, error } = await client.auth.getUser();
-  if (error && (error.name === "AuthSessionMissingError" || error.status === 401)) return null;
-  return check("getPerson", data, error).user;
+  const entry = personEntry(client);
+  if (entry.read) return entry.read;
+  const epoch = entry.epoch;
+  const read = (async () => {
+    const { data, error } = await client.auth.getUser();
+    if (error && (error.name === "AuthSessionMissingError" || error.status === 401)) return null;
+    return check("getPerson", data, error).user;
+  })();
+  entry.read = read;
+  const settle = (keep) => {
+    if (entry.epoch === epoch && entry.read === read && !keep) entry.read = null;
+  };
+  read.then((user) => settle(user !== null), () => settle(false));
+  return read;
 }
 function onSessionChange(client, cb) {
   const { data } = client.auth.onAuthStateChange(cb);
@@ -318,6 +364,7 @@ function createActiveOrganization(options) {
   const load = () => {
     if (disposed) return Promise.resolve(current);
     generation += 1;
+    invalidatePerson(client);
     inflight = run(generation).finally(() => {
       inflight = null;
     });
@@ -362,6 +409,7 @@ function createActiveOrganization(options) {
       const organization = snap.memberships.find((m) => m.id === organizationId);
       if (!organization || !snap.userId) throw new NotAMemberError(organizationId);
       generation += 1;
+      invalidatePerson(client);
       await held.write(snap.userId, organizationId);
       publish({ ...snap, status: "ready", organizationId, organization, rung: "switched", error: null });
       await writeLastActiveOrganization(client, organizationId);
@@ -387,3 +435,84 @@ function createActiveOrganization(options) {
   if (options.autoLoad ?? true) void load();
   return api;
 }
+
+// src/organization-required.ts
+var ORGANIZATION_REQUIRED_CODE = "organization_required";
+var ORGANIZATION_REQUIRED_WIRE_CODE = ORGANIZATION_REQUIRED_CODE;
+var ORGANIZATION_CONTEXT_REQUIRED_CODE = "organization_context_required";
+var MEMBERSHIPS_URL = "/auth/organizations";
+function isOrganizationRequiredError(err) {
+  if (!(err instanceof Error)) return false;
+  const code = err.code;
+  return code === ORGANIZATION_CONTEXT_REQUIRED_CODE || code === ORGANIZATION_REQUIRED_CODE;
+}
+function isOrganizationRequiredEnvelope(body) {
+  return typeof body === "object" && body !== null && body.code === ORGANIZATION_REQUIRED_CODE;
+}
+function extractOrganizationHoldMemberships(err) {
+  if (!err || typeof err !== "object") return null;
+  if (err.code !== ORGANIZATION_REQUIRED_CODE) return null;
+  const container = err;
+  return readOrganizationsField(container.details) ?? readOrganizationsField(container.serverDetail);
+}
+function readOrganizationsField(details) {
+  if (!details || typeof details !== "object") return null;
+  const organizations = details.organizations;
+  if (!Array.isArray(organizations)) return null;
+  return organizations.filter(
+    (org) => !!org && typeof org === "object" && typeof org.id === "string" && typeof org.name === "string"
+  );
+}
+var OrganizationRequiredServerError = class extends Error {
+  name = "OrganizationRequiredServerError";
+  code = ORGANIZATION_REQUIRED_CODE;
+  /** `null` only when the list could not be read ("could not ask"), distinct from `[]`. */
+  memberships;
+  constructor(message, memberships = null) {
+    super(message);
+    this.memberships = memberships;
+  }
+};
+function isOrganizationRequiredServerError(error) {
+  return error instanceof OrganizationRequiredServerError || error instanceof Error && error.name === "OrganizationRequiredServerError";
+}
+async function readCallerMemberships(client) {
+  try {
+    const { data: claims } = await client.auth.getClaims();
+    const userId = claims?.claims?.sub;
+    if (typeof userId !== "string" || !userId) return null;
+    const query = client.schema("iam").from("memberships").select("organization_id, organizations:organization_id(id,name,abbreviation)");
+    const { data, error } = await query.eq("user_id", userId).eq("container_type", "organization").eq("status", "active").is("deleted_at", null);
+    if (error || !Array.isArray(data)) return null;
+    const rows = data;
+    return rows.map((row) => ({
+      id: row.organizations?.id ?? row.organization_id,
+      name: row.organizations?.name ?? "Untitled organization",
+      ...row.organizations?.abbreviation ? { abbreviation: row.organizations.abbreviation } : {}
+    })).sort((a, b) => a.name.localeCompare(b.name));
+  } catch {
+    return null;
+  }
+}
+async function organizationRequired(client, message) {
+  throw new OrganizationRequiredServerError(message, await readCallerMemberships(client));
+}
+function organizationRequiredEnvelope(error, setOn = "request") {
+  return {
+    error: ORGANIZATION_REQUIRED_CODE,
+    code: ORGANIZATION_REQUIRED_CODE,
+    message: error.message,
+    user_message: "Choose the organization you're working in, then try again.",
+    details: {
+      hold: ORGANIZATION_REQUIRED_CODE,
+      can_choose: true,
+      set_on: setOn,
+      remedy: "Choose the organization you're working in and send it with the request (the X-Organization-Id header), then try again.",
+      organizations: error.memberships,
+      memberships_url: MEMBERSHIPS_URL
+    }
+  };
+}
+function organizationRequiredResponse(error) {
+  return Response.json(organizationRequiredEnvelope(error), { status: 400 });
+}