@ai-matrx/auth 0.1.4 → 0.2.1

package/dist/node.js

@@ -1,3 +1,135 @@
+// src/server-auth.ts
+import { createClient } from "@supabase/supabase-js";
+
+// src/claims.ts
+import {
+  AuthError,
+  AuthSessionMissingError
+} from "@supabase/supabase-js";
+async function getClaimsUser(client, jwt, options) {
+  const { data, error } = options ? await client.auth.getClaims(jwt, options) : await client.auth.getClaims(jwt);
+  if (error) {
+    if (isSignedOutError(error)) return { data: { user: null }, error: null };
+    return { data: { user: null }, error };
+  }
+  if (!data?.claims) return { data: { user: null }, error: null };
+  const user = userFromClaims(data.claims);
+  if (!user) {
+    return {
+      data: { user: null },
+      error: new AuthError("Verified token carries no `sub` claim", 401, "bad_jwt")
+    };
+  }
+  return { data: { user }, error: null };
+}
+var BUDGET_EXHAUSTED_STATUS = 408;
+var BUDGET_EXHAUSTED_CODE = "auth_budget_exhausted";
+function isAuthTransportFailure(error) {
+  if (!error || typeof error !== "object") return false;
+  const name = String(error.name ?? "");
+  if (name === "AuthRetryableFetchError" || name === "TimeoutError" || name === "AbortError") return true;
+  const status = error.status;
+  if (status === 0 || status === 504 || status === 503) return true;
+  return status === BUDGET_EXHAUSTED_STATUS || error.code === BUDGET_EXHAUSTED_CODE;
+}
+function isSignedOutError(error) {
+  return error instanceof AuthSessionMissingError || error.name === "AuthSessionMissingError" || error.code === "session_not_found";
+}
+function userFromClaims(claims) {
+  if (!claims || typeof claims.sub !== "string") return null;
+  return {
+    ...claims,
+    id: claims.sub,
+    app_metadata: claims.app_metadata ?? {},
+    user_metadata: claims.user_metadata ?? {}
+  };
+}
+function accountFlagsFor(claims) {
+  if (!claims) return { isGuest: false, hasAccount: false };
+  const isGuest = claims.is_anonymous === true;
+  return { isGuest, hasAccount: !isGuest };
+}
+var PROJECT_SIGNING_KEY_AUTHORITIES = [
+  "db.matrxserver.com",
+  "brsgrqvjdzwihsvnfqkf.supabase.co"
+];
+var PROJECT_SIGNING_KEYS = [
+  {
+    alg: "ES256",
+    crv: "P-256",
+    ext: true,
+    key_ops: ["verify"],
+    kid: "a00aed0b-202c-483a-91ff-fc74719a3bb2",
+    kty: "EC",
+    use: "sig",
+    x: "guqOsgjJqGVU6g_K0iIXKrzixlkeXKOqkPUQCconp6U",
+    y: "39zQtkzlfQuPf_MtIhYmMdxNQpIR2Pkl11AToywaslY"
+  }
+];
+function pinnedSigningKeysFor(supabaseUrl) {
+  if (!supabaseUrl) return [];
+  let host;
+  try {
+    host = new URL(supabaseUrl).host.toLowerCase();
+  } catch {
+    return [];
+  }
+  return PROJECT_SIGNING_KEY_AUTHORITIES.includes(host) ? PROJECT_SIGNING_KEYS : [];
+}
+
+// src/server-auth.ts
+function createServerAuth(options) {
+  const warn = options.warn ?? ((m) => console.warn(m));
+  const resolveOnce = async () => {
+    const client = await options.createClient();
+    const {
+      data: { user },
+      error
+    } = await getClaimsUser(client, void 0, { jwks: { keys: pinnedSigningKeysFor(options.supabaseUrl) } });
+    const authUnavailable = !user && error !== null && isAuthTransportFailure(error);
+    if (authUnavailable) {
+      warn(
+        `[getServerAuth] identity could not be verified on this attempt \u2014 rendering without a user, NOT as signed out. Cause: ${error?.name ?? "unknown"}: ${error?.message ?? ""}`
+      );
+    }
+    return { isAuthenticated: !!user, user, authUnavailable, ...accountFlagsFor(user) };
+  };
+  const door = async () => {
+    const first = await resolveOnce();
+    if (!first.authUnavailable) return first;
+    await new Promise((resolve) => setTimeout(resolve, options.retryAfterMs ?? 250));
+    const second = await resolveOnce();
+    if (!second.authUnavailable) warn("[getServerAuth] identity verified on the retry \u2014 the first attempt's budget was spent.");
+    return second;
+  };
+  return options.cache ? options.cache(door) : door;
+}
+async function verifyRequest(request, options) {
+  const header = request.headers.get("Authorization") ?? request.headers.get("authorization");
+  if (header?.startsWith("Bearer ")) {
+    const token = header.slice(7);
+    const client2 = createClient(options.url, options.publishableKey, {
+      global: { headers: { Authorization: `Bearer ${token}` } },
+      auth: { persistSession: false, autoRefreshToken: false }
+    });
+    const { data: data2, error: error2 } = await getClaimsUser(client2, token, {
+      jwks: { keys: pinnedSigningKeysFor(options.url) }
+    });
+    return { user: data2.user, error: error2 };
+  }
+  if (!options.cookieClient) return { user: null, error: null };
+  const client = await options.cookieClient();
+  const { data, error } = await getClaimsUser(client, void 0, { jwks: { keys: pinnedSigningKeysFor(options.url) } });
+  return { user: data.user, error };
+}
+function createServiceClient(options) {
+  const url = options.url?.trim();
+  const key = options.secretKey?.trim();
+  if (!url) throw new Error("createServiceClient: the Supabase URL is not configured");
+  if (!key) throw new Error("createServiceClient: the secret key (SUPABASE_SECRET_KEY) is not configured");
+  return createClient(url, key, { auth: { persistSession: false, autoRefreshToken: false } });
+}
+
 // src/node.ts
 function builtin(name) {
   const get = globalThis.process?.getBuiltinModule;
@@ -32,5 +164,8 @@ function fileStorage(path) {
   };
 }
 export {
-  fileStorage
+  createServerAuth,
+  createServiceClient,
+  fileStorage,
+  verifyRequest
 };

package/dist/organizations.cjs

@@ -20,20 +20,50 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/organizations.ts
 var organizations_exports = {};
 __export(organizations_exports, {
+  LINK_ORGANIZATION_QUERY_KEY: () => LINK_ORGANIZATION_QUERY_KEY,
+  MEMBERSHIPS_URL: () => MEMBERSHIPS_URL,
+  NOT_A_MEMBER_RECHECK_GAP_MS: () => NOT_A_MEMBER_RECHECK_GAP_MS,
   NoActiveOrganizationError: () => NoActiveOrganizationError,
   NotAMemberError: () => NotAMemberError,
+  ORGANIZATION_CONTEXT_REQUIRED_CODE: () => ORGANIZATION_CONTEXT_REQUIRED_CODE,
   ORGANIZATION_ENTITY_TYPE: () => ORGANIZATION_ENTITY_TYPE,
+  ORGANIZATION_REQUIRED_CODE: () => ORGANIZATION_REQUIRED_CODE,
+  ORGANIZATION_REQUIRED_WIRE_CODE: () => ORGANIZATION_REQUIRED_WIRE_CODE,
+  ORGANIZATION_RESOLUTION_TIMEOUT_MS: () => ORGANIZATION_RESOLUTION_TIMEOUT_MS,
+  OrganizationRequiredServerError: () => OrganizationRequiredServerError,
+  adminSeatReplacesUserContext: () => adminSeatReplacesUserContext,
+  classifyLinkOrganizationValue: () => classifyLinkOrganizationValue,
   classifyOrganizationRefusal: () => classifyOrganizationRefusal,
   createActiveOrganization: () => createActiveOrganization,
+  createNotAMemberRefusalNotice: () => createNotAMemberRefusalNotice,
+  createOrganizationBootstrapGate: () => createOrganizationBootstrapGate,
+  decideLinkOrganization: () => decideLinkOrganization,
+  extractOrganizationHoldMemberships: () => extractOrganizationHoldMemberships,
+  isNotAMemberRefusal: () => isNotAMemberRefusal,
+  isOrganizationRequiredEnvelope: () => isOrganizationRequiredEnvelope,
+  isOrganizationRequiredError: () => isOrganizationRequiredError,
+  isOrganizationRequiredServerError: () => isOrganizationRequiredServerError,
+  linkOrganizationMalformedMessage: () => linkOrganizationMalformedMessage,
+  linkOrganizationNotAMemberMessage: () => linkOrganizationNotAMemberMessage,
+  linkOrganizationOfferMessage: () => linkOrganizationOfferMessage,
+  linkOrganizationSwitchAnnouncement: () => linkOrganizationSwitchAnnouncement,
   memoryHeldOrganization: () => memoryHeldOrganization,
   oldestMembership: () => oldestMembership,
   orderOrganizations: () => orderOrganizations,
   organizationMatches: () => organizationMatches,
+  organizationRequired: () => organizationRequired,
+  organizationRequiredEnvelope: () => organizationRequiredEnvelope,
+  organizationRequiredResponse: () => organizationRequiredResponse,
   readAccountOrganizationChoices: () => readAccountOrganizationChoices,
+  readCallerMemberships: () => readCallerMemberships,
+  readLinkOrganizationParam: () => readLinkOrganizationParam,
   readMemberships: () => readMemberships,
   readOrganizationFavourites: () => readOrganizationFavourites,
   resolveActiveOrganization: () => resolveActiveOrganization,
   resolveActiveOrganizationLazily: () => resolveActiveOrganizationLazily,
+  resolveAdminSeat: () => resolveAdminSeat,
+  resolveChildOrganizationId: () => resolveChildOrganizationId,
+  resolveOrganizationWithLink: () => resolveOrganizationWithLink,
   setOrganizationFavourite: () => setOrganizationFavourite,
   storageHeldOrganization: () => storageHeldOrganization,
   toAccountOrganizationChoices: () => toAccountOrganizationChoices,
@@ -225,6 +255,209 @@ function onSessionChange(client, cb) {
   return () => data.subscription.unsubscribe();
 }
 
+// src/organization-gate.ts
+var ORGANIZATION_RESOLUTION_TIMEOUT_MS = 1e4;
+function createOrganizationBootstrapGate(defaultTimeoutMs = ORGANIZATION_RESOLUTION_TIMEOUT_MS) {
+  let settled = false;
+  let announce = null;
+  let resolution = new Promise((resolve) => {
+    announce = resolve;
+  });
+  return {
+    isResolved: () => settled,
+    markResolved() {
+      if (settled) return;
+      settled = true;
+      announce?.();
+    },
+    async whenResolved(timeoutMs = defaultTimeoutMs) {
+      if (settled) return;
+      let timer;
+      await Promise.race([
+        resolution,
+        new Promise((resolve) => {
+          timer = setTimeout(resolve, timeoutMs);
+        })
+      ]);
+      if (timer !== void 0) clearTimeout(timer);
+    },
+    reset() {
+      announce?.();
+      settled = false;
+      resolution = new Promise((resolve) => {
+        announce = resolve;
+      });
+    }
+  };
+}
+var NOT_A_MEMBER_CODES = /* @__PURE__ */ new Set(["organization_forbidden", "organization_not_member"]);
+function isNotAMemberRefusal(body) {
+  if (!body || typeof body !== "object") return false;
+  const record = body;
+  if (typeof record.code === "string" && NOT_A_MEMBER_CODES.has(record.code)) return true;
+  const detail = record.detail;
+  return !!detail && typeof detail === "object" && typeof detail.code === "string" && NOT_A_MEMBER_CODES.has(detail.code);
+}
+var NOT_A_MEMBER_RECHECK_GAP_MS = 3e4;
+function createNotAMemberRefusalNotice(recheck, gapMs = NOT_A_MEMBER_RECHECK_GAP_MS) {
+  let last = Number.NEGATIVE_INFINITY;
+  return {
+    notice(body, now = Date.now()) {
+      if (!isNotAMemberRefusal(body)) return false;
+      if (now - last < gapMs) return false;
+      last = now;
+      recheck();
+      return true;
+    },
+    reset() {
+      last = Number.NEGATIVE_INFINITY;
+    }
+  };
+}
+function resolveChildOrganizationId(parent, explicit, label = "child record", onDisagree = (m) => console.warn(m)) {
+  const parentOrg = typeof parent === "string" ? parent : parent?.organization_id ?? null;
+  if (parentOrg) {
+    if (explicit && explicit !== parentOrg) {
+      onDisagree(`[child org] ${label} filed in its parent's organization ${parentOrg}, not ${explicit} \u2014 a child belongs with its parent.`);
+    }
+    return parentOrg;
+  }
+  return explicit ?? null;
+}
+function resolveAdminSeat(input) {
+  if (!input || input.laneOpen !== true || !input.organizationId) return null;
+  return { id: input.organizationId, name: input.organizationName ?? null };
+}
+function adminSeatReplacesUserContext(input, personOrganizationId) {
+  const seat = resolveAdminSeat(input);
+  return seat !== null && seat.id !== (personOrganizationId ?? null);
+}
+
+// src/organization-link.ts
+var import_uuid = require("@ai-matrx/kit/uuid");
+var LINK_ORGANIZATION_QUERY_KEY = "org";
+var SLUG = /^[a-z0-9][a-z0-9-]{0,99}$/i;
+function classifyLinkOrganizationValue(raw) {
+  const value = raw.trim();
+  if ((0, import_uuid.isRfc4122Uuid)(value)) return { kind: "named", organizationId: value };
+  if (SLUG.test(value)) return { kind: "addressed", slug: value.toLowerCase() };
+  return { kind: "malformed", raw: value };
+}
+function readLinkOrganizationParam(source) {
+  if (source == null) return { kind: "absent" };
+  let params;
+  if (source instanceof URLSearchParams) {
+    params = source;
+  } else {
+    try {
+      const q = source.includes("?") ? source.slice(source.indexOf("?")) : source;
+      params = new URLSearchParams(q);
+    } catch {
+      return { kind: "absent" };
+    }
+  }
+  if (!params.has(LINK_ORGANIZATION_QUERY_KEY)) return { kind: "absent" };
+  return classifyLinkOrganizationValue(params.get(LINK_ORGANIZATION_QUERY_KEY) ?? "");
+}
+function linkOrganizationNotAMemberMessage(signedInAs) {
+  const account = signedInAs ? `You are signed in as ${signedInAs}.` : "Check which account you are signed in as.";
+  return `The link you followed is for an organization this account is not a member of, so nothing was opened and you were not moved. ${account} Sign in with the account the link was meant for, or ask whoever sent it to give this account access.`;
+}
+function linkOrganizationMalformedMessage(raw) {
+  const quoted = raw.length > 0 ? ` ("${raw}")` : "";
+  return `The link you followed names an organization we cannot read${quoted}, so nothing was switched and you were left where you were. Ask whoever sent it for the link again, or pick the organization you are working in from the avatar menu.`;
+}
+function linkOrganizationSwitchAnnouncement(toName, fromName) {
+  const from = fromName ? ` You were working in ${fromName}.` : "";
+  return `You are now working in ${toName} because the link you followed is filed under it.${from} Switch back any time from the avatar menu.`;
+}
+function linkOrganizationOfferMessage(toName, fromName) {
+  const where = fromName ? `, and you are working in ${fromName}` : "";
+  return `The link you followed is for ${toName}${where}. "Switch organization when a link asks" is turned off in your settings, so nothing changed \u2014 switch to ${toName} to open it.`;
+}
+function decideLinkOrganization(input) {
+  const { param, memberships, currentOrganizationId } = input;
+  const switchWhenALinkAsks = input.switchWhenALinkAsks ?? true;
+  const say = {
+    notAMember: linkOrganizationNotAMemberMessage,
+    malformed: linkOrganizationMalformedMessage,
+    switched: linkOrganizationSwitchAnnouncement,
+    offer: linkOrganizationOfferMessage,
+    offerAction: (name) => `Switch to ${name}`,
+    ...input.messages
+  };
+  if (param.kind === "absent") return { kind: "no-link" };
+  if (param.kind === "malformed") {
+    return {
+      kind: "refused",
+      reason: "malformed",
+      message: say.malformed(param.raw)
+    };
+  }
+  const match = param.kind === "named" ? memberships.find((o) => o.id === param.organizationId) : memberships.find((o) => o.slug?.trim().toLowerCase() === param.slug);
+  if (!match && param.kind === "named" && input.admittedByAShare) {
+    return { kind: "admitted", organizationId: param.organizationId };
+  }
+  if (!match) {
+    return {
+      kind: "refused",
+      reason: "not-a-member",
+      message: say.notAMember(input.signedInAs)
+    };
+  }
+  if (currentOrganizationId === match.id) {
+    return { kind: "already-current", organizationId: match.id };
+  }
+  const fromName = currentOrganizationId ? input.currentOrganizationName ?? memberships.find((o) => o.id === currentOrganizationId)?.name ?? null : null;
+  if (currentOrganizationId && !switchWhenALinkAsks) {
+    return {
+      kind: "offered",
+      organizationId: match.id,
+      organizationName: match.name,
+      message: say.offer(match.name, fromName),
+      actionLabel: say.offerAction(match.name)
+    };
+  }
+  return {
+    kind: "honoured",
+    organizationId: match.id,
+    organizationName: match.name,
+    // Nothing to announce on a cold arrival: they were working nowhere, so
+    // they were not moved. A move, however, is always announced.
+    announcement: currentOrganizationId ? say.switched(match.name, fromName) : null
+  };
+}
+async function resolveOrganizationWithLink(input) {
+  const ladder = await resolveActiveOrganizationLazily({
+    memberships: input.memberships,
+    held: input.held ?? null,
+    readAccount: input.readAccount,
+    ...input.first ? { first: input.first } : {}
+  });
+  if (!ladder) return null;
+  const param = typeof input.link === "string" ? input.link.includes("=") ? readLinkOrganizationParam(input.link) : classifyLinkOrganizationValue(input.link) : readLinkOrganizationParam(input.link ?? null);
+  const decisionInput = {
+    param,
+    memberships: input.memberships.map((o) => ({ id: o.id, name: o.name, slug: o.slug ?? null })),
+    currentOrganizationId: ladder.organization.id,
+    currentOrganizationName: ladder.organization.name,
+    ...input.switchWhenALinkAsks === void 0 ? {} : { switchWhenALinkAsks: input.switchWhenALinkAsks },
+    ...input.signedInAs === void 0 ? {} : { signedInAs: input.signedInAs },
+    ...input.messages ? { messages: input.messages } : {}
+  };
+  let link = decideLinkOrganization(decisionInput);
+  if (link.kind === "refused" && link.reason === "not-a-member" && param.kind === "named" && input.admittedByAShare) {
+    if (await input.admittedByAShare(param.organizationId)) {
+      link = decideLinkOrganization({ ...decisionInput, admittedByAShare: true });
+    }
+  }
+  if (link.kind === "honoured") {
+    const organization = input.memberships.find((m) => m.id === link.organizationId);
+    if (organization) return { organization, rung: "link", link };
+  }
+  return { organization: ladder.organization, rung: ladder.rung, link };
+}
+
 // src/active-organization.ts
 var NoActiveOrganizationError = class extends Error {
   constructor(reason, detail) {
@@ -302,6 +535,7 @@ function createActiveOrganization(options) {
   const publish = (next) => {
     current = Object.freeze(next);
     if (current.status !== "resolving" && current.status !== "idle") {
+      options.bootstrapGate?.markResolved();
       const ready = waiters;
       waiters = [];
       for (const w of ready) w();
@@ -319,19 +553,38 @@ function createActiveOrganization(options) {
       }
       const memberships = await readMemberships(client, person.id);
       if (gen !== generation) return current;
-      const linked = options.linked?.() ?? null;
-      const heldId = (linked && memberships.some((m) => m.id === linked) ? linked : null) ?? await held.read(person.id);
-      const resolved = await resolveActiveOrganizationLazily({
-        memberships,
-        held: heldId,
-        readAccount: () => readAccountOrganizationChoices(client, person.id)
-      });
+      const linkOptions = options.link;
+      let resolved;
+      let linkDecision = null;
+      if (linkOptions) {
+        const r = await resolveOrganizationWithLink({
+          memberships,
+          held: await held.read(person.id),
+          readAccount: () => readAccountOrganizationChoices(client, person.id),
+          link: linkOptions.source() ?? null,
+          switchWhenALinkAsks: linkOptions.switchWhenALinkAsks?.(),
+          signedInAs: linkOptions.signedInAs?.(),
+          messages: linkOptions.messages,
+          admittedByAShare: linkOptions.admittedByAShare
+        });
+        resolved = r;
+        linkDecision = r?.link ?? null;
+      } else {
+        const linked = options.linked?.() ?? null;
+        const heldId = (linked && memberships.some((m) => m.id === linked) ? linked : null) ?? await held.read(person.id);
+        resolved = await resolveActiveOrganizationLazily({
+          memberships,
+          held: heldId,
+          readAccount: () => readAccountOrganizationChoices(client, person.id)
+        });
+      }
       if (gen !== generation) return current;
       if (!resolved) {
         publish({ ...IDLE, status: "none", userId: person.id, error: "no-memberships" });
         return current;
       }
       await held.write(person.id, resolved.organization.id);
+      if (linkDecision && linkDecision.kind !== "no-link") options.link?.onDecision?.(linkDecision);
       publish({
         status: "ready",
         userId: person.id,
@@ -367,6 +620,11 @@ function createActiveOrganization(options) {
     const userId = session.user?.id ?? null;
     if (event === "SIGNED_IN" && userId !== current.userId) void load();
   });
+  const seatFor = (snap) => {
+    const seat = resolveAdminSeat(options.adminSeat?.());
+    return seat && snap.memberships.some((m) => m.id === seat.id) ? seat.id : null;
+  };
+  let lastNotAMemberRecheck = Number.NEGATIVE_INFINITY;
   const settled = async () => {
     if (current.status === "idle") return load();
     if (current.status === "resolving") {
@@ -383,11 +641,11 @@ function createActiveOrganization(options) {
       };
     },
     load,
-    current: () => current.status === "ready" ? current.organizationId : null,
+    current: () => current.status === "ready" ? seatFor(current) ?? current.organizationId : null,
     async ensureOrgId(recordOrganizationId) {
       if (recordOrganizationId) return recordOrganizationId;
       const snap = await settled();
-      if (snap.status === "ready" && snap.organizationId) return snap.organizationId;
+      if (snap.status === "ready" && snap.organizationId) return seatFor(snap) ?? snap.organizationId;
       if (snap.status === "error") throw new NoActiveOrganizationError("unreadable", snap.error ?? void 0);
       throw new NoActiveOrganizationError(snap.error === "signed-out" ? "signed-out" : "no-memberships");
     },
@@ -402,7 +660,16 @@ function createActiveOrganization(options) {
       await writeLastActiveOrganization(client, organizationId);
     },
     async handleRefusal(status, body) {
-      const kind = classifyOrganizationRefusal(status, body);
+      let kind = classifyOrganizationRefusal(status, body);
+      if (kind === null && isNotAMemberRefusal(body)) {
+        const now = Date.now();
+        if (now - lastNotAMemberRecheck >= (options.refusalRecheckGapMs ?? NOT_A_MEMBER_RECHECK_GAP_MS)) {
+          lastNotAMemberRecheck = now;
+          kind = "lapsed";
+        } else {
+          return null;
+        }
+      }
       if (kind === "lapsed") {
         if (current.userId) await held.clear();
         await load();
@@ -422,3 +689,84 @@ function createActiveOrganization(options) {
   if (options.autoLoad ?? true) void load();
   return api;
 }
+
+// src/organization-required.ts
+var ORGANIZATION_REQUIRED_CODE = "organization_required";
+var ORGANIZATION_REQUIRED_WIRE_CODE = ORGANIZATION_REQUIRED_CODE;
+var ORGANIZATION_CONTEXT_REQUIRED_CODE = "organization_context_required";
+var MEMBERSHIPS_URL = "/auth/organizations";
+function isOrganizationRequiredError(err) {
+  if (!(err instanceof Error)) return false;
+  const code = err.code;
+  return code === ORGANIZATION_CONTEXT_REQUIRED_CODE || code === ORGANIZATION_REQUIRED_CODE;
+}
+function isOrganizationRequiredEnvelope(body) {
+  return typeof body === "object" && body !== null && body.code === ORGANIZATION_REQUIRED_CODE;
+}
+function extractOrganizationHoldMemberships(err) {
+  if (!err || typeof err !== "object") return null;
+  if (err.code !== ORGANIZATION_REQUIRED_CODE) return null;
+  const container = err;
+  return readOrganizationsField(container.details) ?? readOrganizationsField(container.serverDetail);
+}
+function readOrganizationsField(details) {
+  if (!details || typeof details !== "object") return null;
+  const organizations = details.organizations;
+  if (!Array.isArray(organizations)) return null;
+  return organizations.filter(
+    (org) => !!org && typeof org === "object" && typeof org.id === "string" && typeof org.name === "string"
+  );
+}
+var OrganizationRequiredServerError = class extends Error {
+  name = "OrganizationRequiredServerError";
+  code = ORGANIZATION_REQUIRED_CODE;
+  /** `null` only when the list could not be read ("could not ask"), distinct from `[]`. */
+  memberships;
+  constructor(message, memberships = null) {
+    super(message);
+    this.memberships = memberships;
+  }
+};
+function isOrganizationRequiredServerError(error) {
+  return error instanceof OrganizationRequiredServerError || error instanceof Error && error.name === "OrganizationRequiredServerError";
+}
+async function readCallerMemberships(client) {
+  try {
+    const { data: claims } = await client.auth.getClaims();
+    const userId = claims?.claims?.sub;
+    if (typeof userId !== "string" || !userId) return null;
+    const query = client.schema("iam").from("memberships").select("organization_id, organizations:organization_id(id,name,abbreviation)");
+    const { data, error } = await query.eq("user_id", userId).eq("container_type", "organization").eq("status", "active").is("deleted_at", null);
+    if (error || !Array.isArray(data)) return null;
+    const rows = data;
+    return rows.map((row) => ({
+      id: row.organizations?.id ?? row.organization_id,
+      name: row.organizations?.name ?? "Untitled organization",
+      ...row.organizations?.abbreviation ? { abbreviation: row.organizations.abbreviation } : {}
+    })).sort((a, b) => a.name.localeCompare(b.name));
+  } catch {
+    return null;
+  }
+}
+async function organizationRequired(client, message) {
+  throw new OrganizationRequiredServerError(message, await readCallerMemberships(client));
+}
+function organizationRequiredEnvelope(error, setOn = "request") {
+  return {
+    error: ORGANIZATION_REQUIRED_CODE,
+    code: ORGANIZATION_REQUIRED_CODE,
+    message: error.message,
+    user_message: "Choose the organization you're working in, then try again.",
+    details: {
+      hold: ORGANIZATION_REQUIRED_CODE,
+      can_choose: true,
+      set_on: setOn,
+      remedy: "Choose the organization you're working in and send it with the request (the X-Organization-Id header), then try again.",
+      organizations: error.memberships,
+      memberships_url: MEMBERSHIPS_URL
+    }
+  };
+}
+function organizationRequiredResponse(error) {
+  return Response.json(organizationRequiredEnvelope(error), { status: 400 });
+}