@ai-matrx/auth 0.2.3 → 0.2.5

package/CHANGELOG.md

@@ -1,6 +1,34 @@
 # Changelog — @ai-matrx/auth
 
+## 0.2.5
+
+Automatic changed-only republish (docs/metadata drift since the last tag — see
+`git diff npm/auth/v0.2.4..npm/auth/v0.2.5 -- apps/shared/auth`).
+No source changes intended and no consumer action required.
+
+## 0.2.4
+### active organization options (round 2)
+
+All options default to today's behaviour. `createActiveOrganization`:
+- `accountChoices` — the snapshot carries `favourites` and `startupOrganizationId` (always present: `[]` / null when off); when on,
+  `memberships` is ordered favourites-first and a failed favourites read leaves them out. New `setFavourite(id, on)` (optimistic,
+  rolled back and rethrown on failure) and `setStartup(id | null)`.
+- `cached` `{ userId, read, write? }` — a new `unchecked` status: the memberships could not be read, so the host's cached last answer
+  (or the list already on screen) is shown unverified. `current()` / `ensureOrgId()` answer in `unchecked`.
+- `onLapse({ was, now })` — the organization the person was in is no longer a membership and the ladder chose another.
+- `refreshGapMs` + `refresh({ force? })` — a throttled re-read.
+- `holdResolved` (default true) — false: the ladder's own answer is never written as the held choice; only `switchTo` writes it
+  (the extension's rule).
+- `ActiveOrganizationSnapshot` gains `favourites` and `startupOrganizationId`; new types `CachedActiveOrganization`, `OrganizationLapse`.
+Tests: `active-organization.test.ts` (+9).
+
 ## 0.2.3
+
+Automatic changed-only republish (docs/metadata drift since the last tag — see
+`git diff npm/auth/v0.2.2..npm/auth/v0.2.3 -- apps/shared/auth`).
+No source changes intended and no consumer action required.
+
+## 0.2.2
 ### extension/desktop options (round 2)
 
 - `readMemberships(db, userId, { archived: "active" | "archived" | "all" })` — archived filter (default
@@ -26,7 +54,7 @@
   attaches (bounded wait, one retry after the session re-resolves, a foreign-authority token is signed out
   and never retried, every firing reported). Host-neutral: the host injects `report`, `isAnonymousByDesign`,
   `bypassesSessionWait`, `endUnverifiable`. From the website's `utils/supabase/sessionBarrier.ts`.
-- `/guest` (new section) — `createGuestHandover(...)`: a visitor's guest data survives sign-in (claim into the
+- `/guest` (new section) — `createGuestHandover(...)` (the host injects `readGuestClaims`; the section builds no Supabase client): a visitor's guest data survives sign-in (claim into the
   account the session ends in, cookie kept on failure so the next sign-in retries) and sign-up (the same
   account is promoted in place); `guestClientCookieOptions` (the guest client's own cookie name, injected);
   `createGuestSessionEnsurer` (mint a guest once per tab/browser). From the website's `lib/guest/*`.
@@ -45,7 +73,8 @@ Tests: `session-barrier.test.ts`, `guest.test.ts`.
   (injectable `messages`), `resolveOrganizationWithLink` (the one ladder + the link, share admission injected).
 - `organization-gate` — `createOrganizationBootstrapGate`, `isNotAMemberRefusal`, `createNotAMemberRefusalNotice`,
   `resolveChildOrganizationId`, `resolveAdminSeat`, `adminSeatReplacesUserContext`.
-Tests: active-organization (+5), organization-gate (9).
+- `readMembershipRows(db, containerType)` — the paged `mbr_for_user` raw-row read (any container type), returning the failing page's `{error,status}` so a host can wrap it in its own session retry.
+Tests: active-organization (+5), organization-gate (11).
 
 ## 0.2.0
 

package/dist/{active-organization-CIvSdboO.d.cts → active-organization-DHitxVeN.d.cts}

@@ -515,7 +515,11 @@ interface HeldOrganizationStore {
     write(userId: string, organizationId: string): void | Promise<void>;
     clear(): void | Promise<void>;
 }
-type ActiveOrganizationStatus = "idle" | "resolving" | "ready" | "none" | "error";
+/**
+ * `unchecked`: the memberships could not be read, and the answer shown is the host's cached last answer
+ * (`options.cached`), not verified against the database. Only ever produced when `cached` is given.
+ */
+type ActiveOrganizationStatus = "idle" | "resolving" | "ready" | "none" | "error" | "unchecked";
 interface ActiveOrganizationSnapshot {
     readonly status: ActiveOrganizationStatus;
     readonly userId: string | null;
@@ -525,6 +529,25 @@ interface ActiveOrganizationSnapshot {
     /** Which ladder rung answered (or "switched" after a person's click). */
     readonly rung: OrganizationRung | "switched" | "link" | null;
     readonly error: string | null;
+    /**
+     * The account's favourite organization ids. Read only when `options.accountChoices` is on; `[]`
+     * otherwise. When on, `memberships` is ordered favourites, then own, then the rest.
+     */
+    readonly favourites: readonly string[];
+    /** The account's start-up organization setting. Read only when `options.accountChoices` is on; null otherwise. */
+    readonly startupOrganizationId: string | null;
+}
+/** What a host keeps so a launch with no network can still show the last answer (`options.cached`). */
+interface CachedActiveOrganization {
+    readonly memberships: readonly OrganizationMembership[];
+    readonly organizationId: string | null;
+    readonly favourites: readonly string[];
+    readonly startupOrganizationId: string | null;
+}
+/** A held organization that is no longer a membership, and the one the ladder chose instead. */
+interface OrganizationLapse {
+    readonly was: OrganizationMembership;
+    readonly now: OrganizationMembership;
 }
 declare class NoActiveOrganizationError extends Error {
     readonly reason: "signed-out" | "no-memberships" | "unreadable";
@@ -542,6 +565,14 @@ interface ActiveOrganization {
     /** The active organization id now, or null while resolving / with none. Sync (api's getter). */
     current(): string | null;
     /** THE HELD REQUEST: the record's own organization, else the active one once resolved. */
+    /** Re-read, unless `options.refreshGapMs` has not elapsed since the last read (`force` always reads). */
+    refresh(options?: {
+        readonly force?: boolean;
+    }): Promise<ActiveOrganizationSnapshot>;
+    /** Save the account's start-up organization (null: the first). Needs `accountChoices`; throws on refusal. */
+    setStartup(organizationId: string | null): Promise<void>;
+    /** Add or remove a favourite and re-order. Optimistic; rolled back and rethrown if the save fails. */
+    setFavourite(organizationId: string, favourite: boolean): Promise<void>;
     ensureOrgId(recordOrganizationId?: string | null): Promise<string>;
     /** A person's click: switch, remember for this tab, save as last active for the next load. */
     switchTo(organizationId: string): Promise<void>;
@@ -582,6 +613,31 @@ interface CreateActiveOrganizationOptions {
     readonly refusalRecheckGapMs?: number | undefined;
     /** Load as soon as it is created (default true). */
     readonly autoLoad?: boolean | undefined;
+    /**
+     * Read the account's favourites and start-up organization with the memberships, expose both in
+     * the snapshot and order `memberships` favourites-first. A failed favourites read leaves them out
+     * (the list still shows). Default false.
+     */
+    readonly accountChoices?: boolean | undefined;
+    /**
+     * Offline answer. When the memberships cannot be read and nothing is shown yet, the cached answer
+     * is published as `unchecked` if its organization is the held one (or the cached one). `userId`
+     * says whose cache to read when the person cannot be verified; `write` is called after each good read.
+     */
+    readonly cached?: {
+        readonly userId: () => string | null | undefined;
+        readonly read: (userId: string) => CachedActiveOrganization | null | Promise<CachedActiveOrganization | null>;
+        readonly write?: ((userId: string, answer: CachedActiveOrganization) => void | Promise<void>) | undefined;
+    } | undefined;
+    /** Called once when the organization the person was in is no longer a membership and the ladder chose another. */
+    readonly onLapse?: ((lapse: OrganizationLapse) => void) | undefined;
+    /** `refresh()` without `force` does nothing within this many ms of the last read. Default 0 (always reads). */
+    readonly refreshGapMs?: number | undefined;
+    /**
+     * Write the ladder's own answer back as the held organization. Default true. False: only an
+     * explicit `switchTo` writes the held choice (the extension's rule: a computed answer is never a choice).
+     */
+    readonly holdResolved?: boolean | undefined;
 }
 /** A held store over a `Storage` (browser `sessionStorage` = per tab), identity-keyed. */
 declare function storageHeldOrganization(storage: Pick<Storage, "getItem" | "setItem" | "removeItem">, key?: string): Omit<HeldOrganizationStore, "read"> & {
@@ -591,4 +647,4 @@ declare function storageHeldOrganization(storage: Pick<Storage, "getItem" | "set
 declare function memoryHeldOrganization(): HeldOrganizationStore;
 declare function createActiveOrganization(options: CreateActiveOrganizationOptions): ActiveOrganization;
 
-export { decideLinkOrganization as $, type AuthClient as A, NotAMemberError as B, type CreateActiveOrganizationOptions as C, type NotAMemberRefusalNotice as D, ORGANIZATION_RESOLUTION_TIMEOUT_MS as E, type OrganizationBootstrapGate as F, type OrganizationMembership as G, type HeldOrganizationStore as H, type OrganizationRefusal as I, type OrganizationRung as J, type OrganizationsDb as K, LINK_ORGANIZATION_QUERY_KEY as L, type ResolveWithLinkInput as M, NOT_A_MEMBER_RECHECK_GAP_MS as N, ORGANIZATION_ENTITY_TYPE as O, type ParentOrganization as P, type ResolvedOrganization as Q, type ReadMembershipsOptions as R, type SessionSourceLike as S, type ResolvedWithLink as T, type UserCredentialsPort as U, adminSeatReplacesUserContext as V, classifyLinkOrganizationValue as W, classifyOrganizationRefusal as X, createActiveOrganization as Y, createNotAMemberRefusalNotice as Z, createOrganizationBootstrapGate as _, SignInError as a, isNotAMemberRefusal as a0, linkOrganizationMalformedMessage as a1, linkOrganizationNotAMemberMessage as a2, linkOrganizationOfferMessage as a3, linkOrganizationSwitchAnnouncement as a4, memoryHeldOrganization as a5, oldestMembership as a6, orderOrganizations as a7, organizationMatches as a8, readAccountOrganizationChoices as a9, readLinkOrganizationParam as aa, readMemberships as ab, readOrganizationFavourites as ac, resolveActiveOrganization as ad, resolveActiveOrganizationLazily as ae, resolveAdminSeat as af, resolveChildOrganizationId as ag, resolveOrganizationWithLink as ah, setOrganizationFavourite as ai, storageHeldOrganization as aj, toAccountOrganizationChoices as ak, writeLastActiveOrganization as al, writeStartupOrganization as am, getSession as b, signInWithOAuth as c, signInWithPassword as d, signOut as e, userCredentials as f, getPerson as g, type AccountOrganizationChoices as h, invalidatePerson as i, type ActiveOrganization as j, type ActiveOrganizationSnapshot as k, type ActiveOrganizationStatus as l, type AdminSeat as m, type AdminSeatInput as n, onSessionChange as o, type ArchiveFilter as p, type LadderInput as q, refreshSession as r, sessionCredentials as s, type LinkOrganizationDecision as t, updatePerson as u, type LinkOrganizationDecisionInput as v, type LinkOrganizationMembership as w, type LinkOrganizationMessages as x, type LinkOrganizationParam as y, NoActiveOrganizationError as z };
+export { createNotAMemberRefusalNotice as $, type AuthClient as A, NoActiveOrganizationError as B, type CachedActiveOrganization as C, NotAMemberError as D, type NotAMemberRefusalNotice as E, ORGANIZATION_ENTITY_TYPE as F, ORGANIZATION_RESOLUTION_TIMEOUT_MS as G, type HeldOrganizationStore as H, type OrganizationBootstrapGate as I, type OrganizationLapse as J, type OrganizationMembership as K, LINK_ORGANIZATION_QUERY_KEY as L, type OrganizationRefusal as M, NOT_A_MEMBER_RECHECK_GAP_MS as N, type OrganizationsDb as O, type OrganizationRung as P, type ParentOrganization as Q, type ReadMembershipsOptions as R, type SessionSourceLike as S, type ResolveWithLinkInput as T, type UserCredentialsPort as U, type ResolvedOrganization as V, type ResolvedWithLink as W, adminSeatReplacesUserContext as X, classifyLinkOrganizationValue as Y, classifyOrganizationRefusal as Z, createActiveOrganization as _, SignInError as a, createOrganizationBootstrapGate as a0, decideLinkOrganization as a1, isNotAMemberRefusal as a2, linkOrganizationMalformedMessage as a3, linkOrganizationNotAMemberMessage as a4, linkOrganizationOfferMessage as a5, linkOrganizationSwitchAnnouncement as a6, memoryHeldOrganization as a7, oldestMembership as a8, orderOrganizations as a9, organizationMatches as aa, readAccountOrganizationChoices as ab, readLinkOrganizationParam as ac, readMemberships as ad, readOrganizationFavourites as ae, resolveActiveOrganization as af, resolveActiveOrganizationLazily as ag, resolveAdminSeat as ah, resolveChildOrganizationId as ai, resolveOrganizationWithLink as aj, setOrganizationFavourite as ak, storageHeldOrganization as al, toAccountOrganizationChoices as am, writeLastActiveOrganization as an, writeStartupOrganization as ao, getSession as b, signInWithOAuth as c, signInWithPassword as d, signOut as e, userCredentials as f, getPerson as g, type AccountOrganizationChoices as h, invalidatePerson as i, type ActiveOrganization as j, type ActiveOrganizationSnapshot as k, type ActiveOrganizationStatus as l, type AdminSeat as m, type AdminSeatInput as n, onSessionChange as o, type ArchiveFilter as p, type CreateActiveOrganizationOptions as q, refreshSession as r, sessionCredentials as s, type LadderInput as t, updatePerson as u, type LinkOrganizationDecision as v, type LinkOrganizationDecisionInput as w, type LinkOrganizationMembership as x, type LinkOrganizationMessages as y, type LinkOrganizationParam as z };

package/dist/{active-organization-CIvSdboO.d.ts → active-organization-DHitxVeN.d.ts}

@@ -515,7 +515,11 @@ interface HeldOrganizationStore {
     write(userId: string, organizationId: string): void | Promise<void>;
     clear(): void | Promise<void>;
 }
-type ActiveOrganizationStatus = "idle" | "resolving" | "ready" | "none" | "error";
+/**
+ * `unchecked`: the memberships could not be read, and the answer shown is the host's cached last answer
+ * (`options.cached`), not verified against the database. Only ever produced when `cached` is given.
+ */
+type ActiveOrganizationStatus = "idle" | "resolving" | "ready" | "none" | "error" | "unchecked";
 interface ActiveOrganizationSnapshot {
     readonly status: ActiveOrganizationStatus;
     readonly userId: string | null;
@@ -525,6 +529,25 @@ interface ActiveOrganizationSnapshot {
     /** Which ladder rung answered (or "switched" after a person's click). */
     readonly rung: OrganizationRung | "switched" | "link" | null;
     readonly error: string | null;
+    /**
+     * The account's favourite organization ids. Read only when `options.accountChoices` is on; `[]`
+     * otherwise. When on, `memberships` is ordered favourites, then own, then the rest.
+     */
+    readonly favourites: readonly string[];
+    /** The account's start-up organization setting. Read only when `options.accountChoices` is on; null otherwise. */
+    readonly startupOrganizationId: string | null;
+}
+/** What a host keeps so a launch with no network can still show the last answer (`options.cached`). */
+interface CachedActiveOrganization {
+    readonly memberships: readonly OrganizationMembership[];
+    readonly organizationId: string | null;
+    readonly favourites: readonly string[];
+    readonly startupOrganizationId: string | null;
+}
+/** A held organization that is no longer a membership, and the one the ladder chose instead. */
+interface OrganizationLapse {
+    readonly was: OrganizationMembership;
+    readonly now: OrganizationMembership;
 }
 declare class NoActiveOrganizationError extends Error {
     readonly reason: "signed-out" | "no-memberships" | "unreadable";
@@ -542,6 +565,14 @@ interface ActiveOrganization {
     /** The active organization id now, or null while resolving / with none. Sync (api's getter). */
     current(): string | null;
     /** THE HELD REQUEST: the record's own organization, else the active one once resolved. */
+    /** Re-read, unless `options.refreshGapMs` has not elapsed since the last read (`force` always reads). */
+    refresh(options?: {
+        readonly force?: boolean;
+    }): Promise<ActiveOrganizationSnapshot>;
+    /** Save the account's start-up organization (null: the first). Needs `accountChoices`; throws on refusal. */
+    setStartup(organizationId: string | null): Promise<void>;
+    /** Add or remove a favourite and re-order. Optimistic; rolled back and rethrown if the save fails. */
+    setFavourite(organizationId: string, favourite: boolean): Promise<void>;
     ensureOrgId(recordOrganizationId?: string | null): Promise<string>;
     /** A person's click: switch, remember for this tab, save as last active for the next load. */
     switchTo(organizationId: string): Promise<void>;
@@ -582,6 +613,31 @@ interface CreateActiveOrganizationOptions {
     readonly refusalRecheckGapMs?: number | undefined;
     /** Load as soon as it is created (default true). */
     readonly autoLoad?: boolean | undefined;
+    /**
+     * Read the account's favourites and start-up organization with the memberships, expose both in
+     * the snapshot and order `memberships` favourites-first. A failed favourites read leaves them out
+     * (the list still shows). Default false.
+     */
+    readonly accountChoices?: boolean | undefined;
+    /**
+     * Offline answer. When the memberships cannot be read and nothing is shown yet, the cached answer
+     * is published as `unchecked` if its organization is the held one (or the cached one). `userId`
+     * says whose cache to read when the person cannot be verified; `write` is called after each good read.
+     */
+    readonly cached?: {
+        readonly userId: () => string | null | undefined;
+        readonly read: (userId: string) => CachedActiveOrganization | null | Promise<CachedActiveOrganization | null>;
+        readonly write?: ((userId: string, answer: CachedActiveOrganization) => void | Promise<void>) | undefined;
+    } | undefined;
+    /** Called once when the organization the person was in is no longer a membership and the ladder chose another. */
+    readonly onLapse?: ((lapse: OrganizationLapse) => void) | undefined;
+    /** `refresh()` without `force` does nothing within this many ms of the last read. Default 0 (always reads). */
+    readonly refreshGapMs?: number | undefined;
+    /**
+     * Write the ladder's own answer back as the held organization. Default true. False: only an
+     * explicit `switchTo` writes the held choice (the extension's rule: a computed answer is never a choice).
+     */
+    readonly holdResolved?: boolean | undefined;
 }
 /** A held store over a `Storage` (browser `sessionStorage` = per tab), identity-keyed. */
 declare function storageHeldOrganization(storage: Pick<Storage, "getItem" | "setItem" | "removeItem">, key?: string): Omit<HeldOrganizationStore, "read"> & {
@@ -591,4 +647,4 @@ declare function storageHeldOrganization(storage: Pick<Storage, "getItem" | "set
 declare function memoryHeldOrganization(): HeldOrganizationStore;
 declare function createActiveOrganization(options: CreateActiveOrganizationOptions): ActiveOrganization;
 
-export { decideLinkOrganization as $, type AuthClient as A, NotAMemberError as B, type CreateActiveOrganizationOptions as C, type NotAMemberRefusalNotice as D, ORGANIZATION_RESOLUTION_TIMEOUT_MS as E, type OrganizationBootstrapGate as F, type OrganizationMembership as G, type HeldOrganizationStore as H, type OrganizationRefusal as I, type OrganizationRung as J, type OrganizationsDb as K, LINK_ORGANIZATION_QUERY_KEY as L, type ResolveWithLinkInput as M, NOT_A_MEMBER_RECHECK_GAP_MS as N, ORGANIZATION_ENTITY_TYPE as O, type ParentOrganization as P, type ResolvedOrganization as Q, type ReadMembershipsOptions as R, type SessionSourceLike as S, type ResolvedWithLink as T, type UserCredentialsPort as U, adminSeatReplacesUserContext as V, classifyLinkOrganizationValue as W, classifyOrganizationRefusal as X, createActiveOrganization as Y, createNotAMemberRefusalNotice as Z, createOrganizationBootstrapGate as _, SignInError as a, isNotAMemberRefusal as a0, linkOrganizationMalformedMessage as a1, linkOrganizationNotAMemberMessage as a2, linkOrganizationOfferMessage as a3, linkOrganizationSwitchAnnouncement as a4, memoryHeldOrganization as a5, oldestMembership as a6, orderOrganizations as a7, organizationMatches as a8, readAccountOrganizationChoices as a9, readLinkOrganizationParam as aa, readMemberships as ab, readOrganizationFavourites as ac, resolveActiveOrganization as ad, resolveActiveOrganizationLazily as ae, resolveAdminSeat as af, resolveChildOrganizationId as ag, resolveOrganizationWithLink as ah, setOrganizationFavourite as ai, storageHeldOrganization as aj, toAccountOrganizationChoices as ak, writeLastActiveOrganization as al, writeStartupOrganization as am, getSession as b, signInWithOAuth as c, signInWithPassword as d, signOut as e, userCredentials as f, getPerson as g, type AccountOrganizationChoices as h, invalidatePerson as i, type ActiveOrganization as j, type ActiveOrganizationSnapshot as k, type ActiveOrganizationStatus as l, type AdminSeat as m, type AdminSeatInput as n, onSessionChange as o, type ArchiveFilter as p, type LadderInput as q, refreshSession as r, sessionCredentials as s, type LinkOrganizationDecision as t, updatePerson as u, type LinkOrganizationDecisionInput as v, type LinkOrganizationMembership as w, type LinkOrganizationMessages as x, type LinkOrganizationParam as y, NoActiveOrganizationError as z };
+export { createNotAMemberRefusalNotice as $, type AuthClient as A, NoActiveOrganizationError as B, type CachedActiveOrganization as C, NotAMemberError as D, type NotAMemberRefusalNotice as E, ORGANIZATION_ENTITY_TYPE as F, ORGANIZATION_RESOLUTION_TIMEOUT_MS as G, type HeldOrganizationStore as H, type OrganizationBootstrapGate as I, type OrganizationLapse as J, type OrganizationMembership as K, LINK_ORGANIZATION_QUERY_KEY as L, type OrganizationRefusal as M, NOT_A_MEMBER_RECHECK_GAP_MS as N, type OrganizationsDb as O, type OrganizationRung as P, type ParentOrganization as Q, type ReadMembershipsOptions as R, type SessionSourceLike as S, type ResolveWithLinkInput as T, type UserCredentialsPort as U, type ResolvedOrganization as V, type ResolvedWithLink as W, adminSeatReplacesUserContext as X, classifyLinkOrganizationValue as Y, classifyOrganizationRefusal as Z, createActiveOrganization as _, SignInError as a, createOrganizationBootstrapGate as a0, decideLinkOrganization as a1, isNotAMemberRefusal as a2, linkOrganizationMalformedMessage as a3, linkOrganizationNotAMemberMessage as a4, linkOrganizationOfferMessage as a5, linkOrganizationSwitchAnnouncement as a6, memoryHeldOrganization as a7, oldestMembership as a8, orderOrganizations as a9, organizationMatches as aa, readAccountOrganizationChoices as ab, readLinkOrganizationParam as ac, readMemberships as ad, readOrganizationFavourites as ae, resolveActiveOrganization as af, resolveActiveOrganizationLazily as ag, resolveAdminSeat as ah, resolveChildOrganizationId as ai, resolveOrganizationWithLink as aj, setOrganizationFavourite as ak, storageHeldOrganization as al, toAccountOrganizationChoices as am, writeLastActiveOrganization as an, writeStartupOrganization as ao, getSession as b, signInWithOAuth as c, signInWithPassword as d, signOut as e, userCredentials as f, getPerson as g, type AccountOrganizationChoices as h, invalidatePerson as i, type ActiveOrganization as j, type ActiveOrganizationSnapshot as k, type ActiveOrganizationStatus as l, type AdminSeat as m, type AdminSeatInput as n, onSessionChange as o, type ArchiveFilter as p, type CreateActiveOrganizationOptions as q, refreshSession as r, sessionCredentials as s, type LadderInput as t, updatePerson as u, type LinkOrganizationDecision as v, type LinkOrganizationDecisionInput as w, type LinkOrganizationMembership as x, type LinkOrganizationMessages as y, type LinkOrganizationParam as z };

package/dist/guest.cjs

@@ -28,7 +28,6 @@ __export(guest_exports, {
   looksLikeVisitorId: () => looksLikeVisitorId
 });
 module.exports = __toCommonJS(guest_exports);
-var import_ssr = require("@supabase/ssr");
 var VISITOR_ID = /^[A-Za-z0-9]{16,200}$/;
 function looksLikeVisitorId(id) {
   return typeof id === "string" && !id.startsWith("temp_") && VISITOR_ID.test(id);
@@ -42,21 +41,11 @@ function createGuestHandover(options) {
   const loud = options.log ?? ((m) => console.error(`[session-handover] LOUD: ${m}`));
   const isGuestCookie = (name) => isGuestCookieName(options.guestCookieName, name);
   const msg = (err) => err instanceof Error ? err.message : String(err);
-  async function readClaims(jar) {
-    if (options.readGuestClaims) return options.readGuestClaims(jar);
-    if (!options.supabase) return null;
-    const guest = (0, import_ssr.createServerClient)(options.supabase.url, options.supabase.publishableKey, {
-      cookieOptions: { name: options.guestCookieName },
-      cookies: { getAll: () => jar.getAll(), setAll: () => void 0 }
-    });
-    const { data } = await guest.auth.getClaims();
-    return data?.claims ?? null;
-  }
   async function readGuestPossession(visitorId) {
     const jar = await options.cookies();
     if (jar.getAll().some((c) => isGuestCookie(c.name))) {
       try {
-        const claims = await readClaims(jar);
+        const claims = await options.readGuestClaims(jar);
         if (claims?.sub && claims.is_anonymous === true) return { guestId: claims.sub, proof: "guest_session" };
       } catch (err) {
         loud(`the guest cookie could not be verified: ${msg(err)}`);

package/dist/guest.d.cts

@@ -1,3 +1,25 @@
+/**
+ * @ai-matrx/auth/guest — a visitor's guest data survives sign-up and sign-in (moved from the
+ * website's `lib/guest/{session-handover,guest-supabase-client,ensure-guest-session}.ts`, 2026-10-12).
+ *
+ * A signed-out visitor who saves holds a GUEST session: a real, not-yet-permanent account that lives in
+ * its OWN cookie (never the main auth cookie, so a guest never looks signed in). Every place a session is
+ * REPLACED (password login, OAuth callback, email confirm, dev-login) runs through `handOverSession`:
+ *
+ *   1. read who the browser's guest is BEFORE the replacement (the verified claims of the guest cookie,
+ *      else the visitor id mapped through the registry — the lost-session case);
+ *   2. replace the session;
+ *   3. when the result is a permanent account other than the guest, CLAIM the guest's workspace into it
+ *      (all or nothing) and drop the guest cookie. A failed claim keeps the cookie, so the next replacement
+ *      (or `settlePendingGuestClaim` on a signed-in load) tries again — it screams, never silently.
+ *
+ * Sign-up with email + password keeps the SAME account (`promoteGuest`): revive, promote in place, revive
+ * again, stamp the registry. Never falls back to a fresh account (that would orphan the guest).
+ *
+ * Host-neutral: the host injects the cookie jar, the guest store (admin reads and the claim/revive doors)
+ * and the cookie names. The browser half is `createGuestClientOptions` (the guest client's own cookie name,
+ * injected) and `createGuestSessionEnsurer` (mint a guest once per tab / per browser).
+ */
 type HandoverVia = "password_login" | "oauth_callback" | "email_otp" | "dev_login" | "sign_up";
 interface GuestPossession {
     guestId: string;
@@ -93,15 +115,15 @@ interface GuestHandoverOptions {
     /** Server cookie jar for this request. */
     cookies(): Promise<GuestCookieJar>;
     store: GuestStore;
-    /** Verified claims of the guest cookie. Default: a server client over `supabase` url + key. */
-    readGuestClaims?(jar: GuestCookieJar): Promise<{
+    /**
+     * Verified claims of the guest cookie (the anonymous JWT in this very request is the proof of possession).
+     * The host builds a server client over the guest cookie name and reads `getClaimsUser`; this section builds no
+     * Supabase client of its own.
+     */
+    readGuestClaims(jar: GuestCookieJar): Promise<{
         sub?: string;
         is_anonymous?: boolean;
     } | null>;
-    supabase?: {
-        url: string;
-        publishableKey: string;
-    };
     /** `Secure` on the carrier cookie. */
     secureCookies?: boolean;
     log?(message: string): void;
@@ -137,7 +159,7 @@ declare const DEFAULT_GUEST_CARRIER_COOKIE = "matrx_guest_visitor";
 declare function createGuestHandover(options: GuestHandoverOptions): GuestHandover;
 /**
  * Cookie options for the guest's browser client: its OWN cookie name, never the app singleton's. Pass as
- * `createBrowserClient(url, key, { isSingleton: false, cookieOptions: guestClientCookieOptions(name) })`.
+ * the browser client constructor with `isSingleton: false` and `cookieOptions: guestClientCookieOptions(name)`.
  */
 declare function guestClientCookieOptions(cookieName: string, secure?: boolean): {
     name: string;

package/dist/guest.d.ts

@@ -1,3 +1,25 @@
+/**
+ * @ai-matrx/auth/guest — a visitor's guest data survives sign-up and sign-in (moved from the
+ * website's `lib/guest/{session-handover,guest-supabase-client,ensure-guest-session}.ts`, 2026-10-12).
+ *
+ * A signed-out visitor who saves holds a GUEST session: a real, not-yet-permanent account that lives in
+ * its OWN cookie (never the main auth cookie, so a guest never looks signed in). Every place a session is
+ * REPLACED (password login, OAuth callback, email confirm, dev-login) runs through `handOverSession`:
+ *
+ *   1. read who the browser's guest is BEFORE the replacement (the verified claims of the guest cookie,
+ *      else the visitor id mapped through the registry — the lost-session case);
+ *   2. replace the session;
+ *   3. when the result is a permanent account other than the guest, CLAIM the guest's workspace into it
+ *      (all or nothing) and drop the guest cookie. A failed claim keeps the cookie, so the next replacement
+ *      (or `settlePendingGuestClaim` on a signed-in load) tries again — it screams, never silently.
+ *
+ * Sign-up with email + password keeps the SAME account (`promoteGuest`): revive, promote in place, revive
+ * again, stamp the registry. Never falls back to a fresh account (that would orphan the guest).
+ *
+ * Host-neutral: the host injects the cookie jar, the guest store (admin reads and the claim/revive doors)
+ * and the cookie names. The browser half is `createGuestClientOptions` (the guest client's own cookie name,
+ * injected) and `createGuestSessionEnsurer` (mint a guest once per tab / per browser).
+ */
 type HandoverVia = "password_login" | "oauth_callback" | "email_otp" | "dev_login" | "sign_up";
 interface GuestPossession {
     guestId: string;
@@ -93,15 +115,15 @@ interface GuestHandoverOptions {
     /** Server cookie jar for this request. */
     cookies(): Promise<GuestCookieJar>;
     store: GuestStore;
-    /** Verified claims of the guest cookie. Default: a server client over `supabase` url + key. */
-    readGuestClaims?(jar: GuestCookieJar): Promise<{
+    /**
+     * Verified claims of the guest cookie (the anonymous JWT in this very request is the proof of possession).
+     * The host builds a server client over the guest cookie name and reads `getClaimsUser`; this section builds no
+     * Supabase client of its own.
+     */
+    readGuestClaims(jar: GuestCookieJar): Promise<{
         sub?: string;
         is_anonymous?: boolean;
     } | null>;
-    supabase?: {
-        url: string;
-        publishableKey: string;
-    };
     /** `Secure` on the carrier cookie. */
     secureCookies?: boolean;
     log?(message: string): void;
@@ -137,7 +159,7 @@ declare const DEFAULT_GUEST_CARRIER_COOKIE = "matrx_guest_visitor";
 declare function createGuestHandover(options: GuestHandoverOptions): GuestHandover;
 /**
  * Cookie options for the guest's browser client: its OWN cookie name, never the app singleton's. Pass as
- * `createBrowserClient(url, key, { isSingleton: false, cookieOptions: guestClientCookieOptions(name) })`.
+ * the browser client constructor with `isSingleton: false` and `cookieOptions: guestClientCookieOptions(name)`.
  */
 declare function guestClientCookieOptions(cookieName: string, secure?: boolean): {
     name: string;

package/dist/guest.js

@@ -1,5 +1,4 @@
 // src/guest.ts
-import { createServerClient } from "@supabase/ssr";
 var VISITOR_ID = /^[A-Za-z0-9]{16,200}$/;
 function looksLikeVisitorId(id) {
   return typeof id === "string" && !id.startsWith("temp_") && VISITOR_ID.test(id);
@@ -13,21 +12,11 @@ function createGuestHandover(options) {
   const loud = options.log ?? ((m) => console.error(`[session-handover] LOUD: ${m}`));
   const isGuestCookie = (name) => isGuestCookieName(options.guestCookieName, name);
   const msg = (err) => err instanceof Error ? err.message : String(err);
-  async function readClaims(jar) {
-    if (options.readGuestClaims) return options.readGuestClaims(jar);
-    if (!options.supabase) return null;
-    const guest = createServerClient(options.supabase.url, options.supabase.publishableKey, {
-      cookieOptions: { name: options.guestCookieName },
-      cookies: { getAll: () => jar.getAll(), setAll: () => void 0 }
-    });
-    const { data } = await guest.auth.getClaims();
-    return data?.claims ?? null;
-  }
   async function readGuestPossession(visitorId) {
     const jar = await options.cookies();
     if (jar.getAll().some((c) => isGuestCookie(c.name))) {
       try {
-        const claims = await readClaims(jar);
+        const claims = await options.readGuestClaims(jar);
         if (claims?.sub && claims.is_anonymous === true) return { guestId: claims.sub, proof: "guest_session" };
       } catch (err) {
         loud(`the guest cookie could not be verified: ${msg(err)}`);

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { H as HeldOrganizationStore, A as AuthClient } from './active-organization-CIvSdboO.cjs';
-export { S as SessionSourceLike, a as SignInError, U as UserCredentialsPort, g as getPerson, b as getSession, i as invalidatePerson, o as onSessionChange, r as refreshSession, s as sessionCredentials, c as signInWithOAuth, d as signInWithPassword, e as signOut, u as updatePerson, f as userCredentials } from './active-organization-CIvSdboO.cjs';
+import { H as HeldOrganizationStore, A as AuthClient } from './active-organization-DHitxVeN.cjs';
+export { S as SessionSourceLike, a as SignInError, U as UserCredentialsPort, g as getPerson, b as getSession, i as invalidatePerson, o as onSessionChange, r as refreshSession, s as sessionCredentials, c as signInWithOAuth, d as signInWithPassword, e as signOut, u as updatePerson, f as userCredentials } from './active-organization-DHitxVeN.cjs';
 import { S as SessionStorage, M as MatrxOAuthClient } from './matrx-oauth-_Ji8X5Wm.cjs';
 export { C as ChromeStorageAreaLike, a as StorageUnavailableError, b as browserStorage, e as extensionStorage, k as keyValueStorage, m as memoryStorage } from './matrx-oauth-_Ji8X5Wm.cjs';
 import { SupabaseClient, User } from '@supabase/supabase-js';

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { H as HeldOrganizationStore, A as AuthClient } from './active-organization-CIvSdboO.js';
-export { S as SessionSourceLike, a as SignInError, U as UserCredentialsPort, g as getPerson, b as getSession, i as invalidatePerson, o as onSessionChange, r as refreshSession, s as sessionCredentials, c as signInWithOAuth, d as signInWithPassword, e as signOut, u as updatePerson, f as userCredentials } from './active-organization-CIvSdboO.js';
+import { H as HeldOrganizationStore, A as AuthClient } from './active-organization-DHitxVeN.js';
+export { S as SessionSourceLike, a as SignInError, U as UserCredentialsPort, g as getPerson, b as getSession, i as invalidatePerson, o as onSessionChange, r as refreshSession, s as sessionCredentials, c as signInWithOAuth, d as signInWithPassword, e as signOut, u as updatePerson, f as userCredentials } from './active-organization-DHitxVeN.js';
 import { S as SessionStorage, M as MatrxOAuthClient } from './matrx-oauth-_Ji8X5Wm.js';
 export { C as ChromeStorageAreaLike, a as StorageUnavailableError, b as browserStorage, e as extensionStorage, k as keyValueStorage, m as memoryStorage } from './matrx-oauth-_Ji8X5Wm.js';
 import { SupabaseClient, User } from '@supabase/supabase-js';

package/dist/organizations.cjs

@@ -22,6 +22,7 @@ var organizations_exports = {};
 __export(organizations_exports, {
   LINK_ORGANIZATION_QUERY_KEY: () => LINK_ORGANIZATION_QUERY_KEY,
   MEMBERSHIPS_URL: () => MEMBERSHIPS_URL,
+  MEMBERSHIP_ROWS_PAGE: () => MEMBERSHIP_ROWS_PAGE,
   NOT_A_MEMBER_RECHECK_GAP_MS: () => NOT_A_MEMBER_RECHECK_GAP_MS,
   NoActiveOrganizationError: () => NoActiveOrganizationError,
   NotAMemberError: () => NotAMemberError,
@@ -57,6 +58,7 @@ __export(organizations_exports, {
   readAccountOrganizationChoices: () => readAccountOrganizationChoices,
   readCallerMemberships: () => readCallerMemberships,
   readLinkOrganizationParam: () => readLinkOrganizationParam,
+  readMembershipRows: () => readMembershipRows,
   readMemberships: () => readMemberships,
   readOrganizationFavourites: () => readOrganizationFavourites,
   resolveActiveOrganization: () => resolveActiveOrganization,
@@ -523,7 +525,9 @@ var IDLE = Object.freeze({
   organization: null,
   memberships: Object.freeze([]),
   rung: null,
-  error: null
+  error: null,
+  favourites: Object.freeze([]),
+  startupOrganizationId: null
 });
 function createActiveOrganization(options) {
   const { client } = options;
@@ -534,8 +538,11 @@ function createActiveOrganization(options) {
   let generation = 0;
   let waiters = [];
   let disposed = false;
+  let lastSettled = IDLE;
+  let lastReadAt = Number.NEGATIVE_INFINITY;
   const publish = (next) => {
     current = Object.freeze(next);
+    if (current.status !== "resolving") lastSettled = current;
     if (current.status !== "resolving" && current.status !== "idle") {
       options.bootstrapGate?.markResolved();
       const ready = waiters;
@@ -545,6 +552,7 @@ function createActiveOrganization(options) {
     for (const l of [...listeners]) l();
   };
   const run = async (gen) => {
+    const prior = current.status === "resolving" ? lastSettled : current;
     publish({ ...current, status: "resolving", error: null });
     try {
       const person = await getPerson(client);
@@ -553,8 +561,24 @@ function createActiveOrganization(options) {
         publish({ ...IDLE, status: "none", error: "signed-out" });
         return current;
       }
-      const memberships = await readMemberships(client, person.id);
+      const rawMemberships = await readMemberships(client, person.id);
       if (gen !== generation) return current;
+      let favourites = current.favourites;
+      let startupOrganizationId = current.startupOrganizationId;
+      let account = null;
+      if (options.accountChoices) {
+        const [fav, acct] = await Promise.all([
+          readOrganizationFavourites(client).catch(() => favourites),
+          readAccountOrganizationChoices(client, person.id)
+        ]);
+        favourites = fav;
+        account = acct;
+        startupOrganizationId = acct.startupOrganizationId;
+        if (gen !== generation) return current;
+      }
+      const memberships = options.accountChoices ? orderOrganizations(rawMemberships, favourites) : rawMemberships;
+      const readAccount = () => account ? Promise.resolve(account) : readAccountOrganizationChoices(client, person.id);
+      const before = prior;
       const linkOptions = options.link;
       let resolved;
       let linkDecision = null;
@@ -562,7 +586,7 @@ function createActiveOrganization(options) {
         const r = await resolveOrganizationWithLink({
           memberships,
           held: await held.read(person.id),
-          readAccount: () => readAccountOrganizationChoices(client, person.id),
+          readAccount,
           link: linkOptions.source() ?? null,
           switchWhenALinkAsks: linkOptions.switchWhenALinkAsks?.(),
           signedInAs: linkOptions.signedInAs?.(),
@@ -577,7 +601,7 @@ function createActiveOrganization(options) {
         resolved = await resolveActiveOrganizationLazily({
           memberships,
           held: heldId,
-          readAccount: () => readAccountOrganizationChoices(client, person.id)
+          readAccount
         });
       }
       if (gen !== generation) return current;
@@ -585,7 +609,9 @@ function createActiveOrganization(options) {
         publish({ ...IDLE, status: "none", userId: person.id, error: "no-memberships" });
         return current;
       }
-      await held.write(person.id, resolved.organization.id);
+      if (options.holdResolved ?? true) await held.write(person.id, resolved.organization.id);
+      const wasOrg = before.status === "ready" || before.status === "unchecked" ? before.organization : null;
+      const lapsed = wasOrg && wasOrg.id !== resolved.organization.id && !memberships.some((m) => m.id === wasOrg.id) ? wasOrg : null;
       if (linkDecision && linkDecision.kind !== "no-link") options.link?.onDecision?.(linkDecision);
       publish({
         status: "ready",
@@ -594,12 +620,51 @@ function createActiveOrganization(options) {
         organization: resolved.organization,
         memberships,
         rung: resolved.rung,
-        error: null
+        error: null,
+        favourites,
+        startupOrganizationId
       });
+      if (lapsed) options.onLapse?.({ was: lapsed, now: resolved.organization });
+      lastReadAt = Date.now();
+      if (options.cached?.write) {
+        try {
+          await options.cached.write(person.id, { memberships, organizationId: resolved.organization.id, favourites, startupOrganizationId });
+        } catch {
+        }
+      }
       return current;
     } catch (e) {
       if (gen !== generation) return current;
-      publish({ ...current, status: "error", error: e?.message ?? String(e) });
+      const message = e?.message ?? String(e);
+      if (options.cached && (prior.status === "ready" || prior.status === "unchecked") && prior.organization) {
+        publish({ ...prior, status: "unchecked", error: message });
+        return current;
+      }
+      const cachedUser = options.cached?.userId();
+      if (options.cached && cachedUser) {
+        try {
+          const answer = await options.cached.read(cachedUser);
+          if (gen !== generation) return current;
+          const wanted = await held.read(cachedUser) ?? answer?.organizationId ?? null;
+          const organization = answer?.memberships.find((m) => m.id === wanted) ?? null;
+          if (answer && organization) {
+            publish({
+              status: "unchecked",
+              userId: cachedUser,
+              organizationId: organization.id,
+              organization,
+              memberships: orderOrganizations(answer.memberships, answer.favourites),
+              rung: "held",
+              error: message,
+              favourites: answer.favourites,
+              startupOrganizationId: answer.startupOrganizationId
+            });
+            return current;
+          }
+        } catch {
+        }
+      }
+      publish({ ...current, status: "error", error: message });
       return current;
     }
   };
@@ -643,11 +708,34 @@ function createActiveOrganization(options) {
       };
     },
     load,
-    current: () => current.status === "ready" ? seatFor(current) ?? current.organizationId : null,
+    current: () => current.status === "ready" || current.status === "unchecked" ? seatFor(current) ?? current.organizationId : null,
+    refresh(refreshOptions) {
+      const gap = options.refreshGapMs ?? 0;
+      if (!refreshOptions?.force && gap > 0 && current.status !== "idle" && Date.now() - lastReadAt < gap) return Promise.resolve(current);
+      if (inflight) return inflight;
+      return load();
+    },
+    async setStartup(organizationId) {
+      const snap = await settled();
+      await writeStartupOrganization(client, organizationId);
+      publish({ ...snap, startupOrganizationId: organizationId });
+    },
+    async setFavourite(organizationId, favourite) {
+      const snap = await settled();
+      const before = snap.favourites;
+      const next = favourite ? [...before.filter((f) => f !== organizationId), organizationId] : before.filter((f) => f !== organizationId);
+      publish({ ...snap, favourites: next, memberships: orderOrganizations(snap.memberships, next) });
+      try {
+        await setOrganizationFavourite(client, organizationId, favourite);
+      } catch (e) {
+        publish({ ...current, favourites: before, memberships: orderOrganizations(current.memberships, before) });
+        throw e;
+      }
+    },
     async ensureOrgId(recordOrganizationId) {
       if (recordOrganizationId) return recordOrganizationId;
       const snap = await settled();
-      if (snap.status === "ready" && snap.organizationId) return seatFor(snap) ?? snap.organizationId;
+      if ((snap.status === "ready" || snap.status === "unchecked") && snap.organizationId) return seatFor(snap) ?? snap.organizationId;
       if (snap.status === "error") throw new NoActiveOrganizationError("unreadable", snap.error ?? void 0);
       throw new NoActiveOrganizationError(snap.error === "signed-out" ? "signed-out" : "no-memberships");
     },
@@ -772,3 +860,17 @@ function organizationRequiredEnvelope(error, setOn = "request") {
 function organizationRequiredResponse(error) {
   return Response.json(organizationRequiredEnvelope(error), { status: 400 });
 }
+
+// src/organization-membership-rows.ts
+var MEMBERSHIP_ROWS_PAGE = 500;
+async function readMembershipRows(db, containerType, pageSize = MEMBERSHIP_ROWS_PAGE) {
+  const rows = [];
+  for (let from = 0; ; from += pageSize) {
+    const answer = await db.rpc("mbr_for_user", { p_container_type: containerType }).order("id", { ascending: true }).range(from, from + pageSize - 1);
+    if (answer.error) return { data: null, error: answer.error, status: answer.status };
+    const page = Array.isArray(answer.data) ? answer.data : [];
+    rows.push(...page);
+    if (page.length < pageSize) break;
+  }
+  return { data: rows, error: null };
+}

package/dist/organizations.d.cts

@@ -1,4 +1,5 @@
-export { h as AccountOrganizationChoices, j as ActiveOrganization, k as ActiveOrganizationSnapshot, l as ActiveOrganizationStatus, m as AdminSeat, n as AdminSeatInput, p as ArchiveFilter, C as CreateActiveOrganizationOptions, H as HeldOrganizationStore, L as LINK_ORGANIZATION_QUERY_KEY, q as LadderInput, t as LinkOrganizationDecision, v as LinkOrganizationDecisionInput, w as LinkOrganizationMembership, x as LinkOrganizationMessages, y as LinkOrganizationParam, N as NOT_A_MEMBER_RECHECK_GAP_MS, z as NoActiveOrganizationError, B as NotAMemberError, D as NotAMemberRefusalNotice, O as ORGANIZATION_ENTITY_TYPE, E as ORGANIZATION_RESOLUTION_TIMEOUT_MS, F as OrganizationBootstrapGate, G as OrganizationMembership, I as OrganizationRefusal, J as OrganizationRung, K as OrganizationsDb, P as ParentOrganization, R as ReadMembershipsOptions, M as ResolveWithLinkInput, Q as ResolvedOrganization, T as ResolvedWithLink, V as adminSeatReplacesUserContext, W as classifyLinkOrganizationValue, X as classifyOrganizationRefusal, Y as createActiveOrganization, Z as createNotAMemberRefusalNotice, _ as createOrganizationBootstrapGate, $ as decideLinkOrganization, a0 as isNotAMemberRefusal, a1 as linkOrganizationMalformedMessage, a2 as linkOrganizationNotAMemberMessage, a3 as linkOrganizationOfferMessage, a4 as linkOrganizationSwitchAnnouncement, a5 as memoryHeldOrganization, a6 as oldestMembership, a7 as orderOrganizations, a8 as organizationMatches, a9 as readAccountOrganizationChoices, aa as readLinkOrganizationParam, ab as readMemberships, ac as readOrganizationFavourites, ad as resolveActiveOrganization, ae as resolveActiveOrganizationLazily, af as resolveAdminSeat, ag as resolveChildOrganizationId, ah as resolveOrganizationWithLink, ai as setOrganizationFavourite, aj as storageHeldOrganization, ak as toAccountOrganizationChoices, al as writeLastActiveOrganization, am as writeStartupOrganization } from './active-organization-CIvSdboO.cjs';
+import { O as OrganizationsDb } from './active-organization-DHitxVeN.cjs';
+export { h as AccountOrganizationChoices, j as ActiveOrganization, k as ActiveOrganizationSnapshot, l as ActiveOrganizationStatus, m as AdminSeat, n as AdminSeatInput, p as ArchiveFilter, C as CachedActiveOrganization, q as CreateActiveOrganizationOptions, H as HeldOrganizationStore, L as LINK_ORGANIZATION_QUERY_KEY, t as LadderInput, v as LinkOrganizationDecision, w as LinkOrganizationDecisionInput, x as LinkOrganizationMembership, y as LinkOrganizationMessages, z as LinkOrganizationParam, N as NOT_A_MEMBER_RECHECK_GAP_MS, B as NoActiveOrganizationError, D as NotAMemberError, E as NotAMemberRefusalNotice, F as ORGANIZATION_ENTITY_TYPE, G as ORGANIZATION_RESOLUTION_TIMEOUT_MS, I as OrganizationBootstrapGate, J as OrganizationLapse, K as OrganizationMembership, M as OrganizationRefusal, P as OrganizationRung, Q as ParentOrganization, R as ReadMembershipsOptions, T as ResolveWithLinkInput, V as ResolvedOrganization, W as ResolvedWithLink, X as adminSeatReplacesUserContext, Y as classifyLinkOrganizationValue, Z as classifyOrganizationRefusal, _ as createActiveOrganization, $ as createNotAMemberRefusalNotice, a0 as createOrganizationBootstrapGate, a1 as decideLinkOrganization, a2 as isNotAMemberRefusal, a3 as linkOrganizationMalformedMessage, a4 as linkOrganizationNotAMemberMessage, a5 as linkOrganizationOfferMessage, a6 as linkOrganizationSwitchAnnouncement, a7 as memoryHeldOrganization, a8 as oldestMembership, a9 as orderOrganizations, aa as organizationMatches, ab as readAccountOrganizationChoices, ac as readLinkOrganizationParam, ad as readMemberships, ae as readOrganizationFavourites, af as resolveActiveOrganization, ag as resolveActiveOrganizationLazily, ah as resolveAdminSeat, ai as resolveChildOrganizationId, aj as resolveOrganizationWithLink, ak as setOrganizationFavourite, al as storageHeldOrganization, am as toAccountOrganizationChoices, an as writeLastActiveOrganization, ao as writeStartupOrganization } from './active-organization-DHitxVeN.cjs';
 import '@supabase/supabase-js';
 
 /**
@@ -107,4 +108,26 @@ declare function organizationRequiredEnvelope(error: OrganizationRequiredServerE
 /** The standard `Response` (status 400) a route answers the refusal with — no framework needed. */
 declare function organizationRequiredResponse(error: OrganizationRequiredServerError): Response;
 
-export { MEMBERSHIPS_URL, type MembershipReadClient, ORGANIZATION_CONTEXT_REQUIRED_CODE, ORGANIZATION_REQUIRED_CODE, ORGANIZATION_REQUIRED_WIRE_CODE, type OrganizationHoldDetails, type OrganizationHoldSetOn, type OrganizationMembershipSummary, type OrganizationRequiredEnvelope, OrganizationRequiredServerError, type OrganizationRequiredWireMembership, extractOrganizationHoldMemberships, isOrganizationRequiredEnvelope, isOrganizationRequiredError, isOrganizationRequiredServerError, organizationRequired, organizationRequiredEnvelope, organizationRequiredResponse, readCallerMemberships };
+/**
+ * The person's raw membership rows for ONE container type, PAGED — the canonical `mbr_for_user`
+ * door (moved from the website's membershipsService). PostgREST caps one answer at its max-rows
+ * (1000): a person in 1,043 organizations lost the last 43, so the read pages in stable id order
+ * until a short page.
+ *
+ * It does NOT throw: it returns the first failing page's `{ error, status }` so a host can wrap
+ * the whole read in its own session retry (a 401 on a recovering session) and map the error its
+ * own way.
+ */
+
+declare const MEMBERSHIP_ROWS_PAGE = 500;
+interface MembershipRowsAnswer<Row> {
+    readonly data: Row[] | null;
+    readonly error: {
+        message: string;
+        code?: string;
+    } | null;
+    readonly status?: number | undefined;
+}
+declare function readMembershipRows<Row = Record<string, unknown>>(db: OrganizationsDb, containerType: string, pageSize?: number): Promise<MembershipRowsAnswer<Row>>;
+
+export { MEMBERSHIPS_URL, MEMBERSHIP_ROWS_PAGE, type MembershipReadClient, type MembershipRowsAnswer, ORGANIZATION_CONTEXT_REQUIRED_CODE, ORGANIZATION_REQUIRED_CODE, ORGANIZATION_REQUIRED_WIRE_CODE, type OrganizationHoldDetails, type OrganizationHoldSetOn, type OrganizationMembershipSummary, type OrganizationRequiredEnvelope, OrganizationRequiredServerError, type OrganizationRequiredWireMembership, OrganizationsDb, extractOrganizationHoldMemberships, isOrganizationRequiredEnvelope, isOrganizationRequiredError, isOrganizationRequiredServerError, organizationRequired, organizationRequiredEnvelope, organizationRequiredResponse, readCallerMemberships, readMembershipRows };

package/dist/organizations.d.ts

@@ -1,4 +1,5 @@
-export { h as AccountOrganizationChoices, j as ActiveOrganization, k as ActiveOrganizationSnapshot, l as ActiveOrganizationStatus, m as AdminSeat, n as AdminSeatInput, p as ArchiveFilter, C as CreateActiveOrganizationOptions, H as HeldOrganizationStore, L as LINK_ORGANIZATION_QUERY_KEY, q as LadderInput, t as LinkOrganizationDecision, v as LinkOrganizationDecisionInput, w as LinkOrganizationMembership, x as LinkOrganizationMessages, y as LinkOrganizationParam, N as NOT_A_MEMBER_RECHECK_GAP_MS, z as NoActiveOrganizationError, B as NotAMemberError, D as NotAMemberRefusalNotice, O as ORGANIZATION_ENTITY_TYPE, E as ORGANIZATION_RESOLUTION_TIMEOUT_MS, F as OrganizationBootstrapGate, G as OrganizationMembership, I as OrganizationRefusal, J as OrganizationRung, K as OrganizationsDb, P as ParentOrganization, R as ReadMembershipsOptions, M as ResolveWithLinkInput, Q as ResolvedOrganization, T as ResolvedWithLink, V as adminSeatReplacesUserContext, W as classifyLinkOrganizationValue, X as classifyOrganizationRefusal, Y as createActiveOrganization, Z as createNotAMemberRefusalNotice, _ as createOrganizationBootstrapGate, $ as decideLinkOrganization, a0 as isNotAMemberRefusal, a1 as linkOrganizationMalformedMessage, a2 as linkOrganizationNotAMemberMessage, a3 as linkOrganizationOfferMessage, a4 as linkOrganizationSwitchAnnouncement, a5 as memoryHeldOrganization, a6 as oldestMembership, a7 as orderOrganizations, a8 as organizationMatches, a9 as readAccountOrganizationChoices, aa as readLinkOrganizationParam, ab as readMemberships, ac as readOrganizationFavourites, ad as resolveActiveOrganization, ae as resolveActiveOrganizationLazily, af as resolveAdminSeat, ag as resolveChildOrganizationId, ah as resolveOrganizationWithLink, ai as setOrganizationFavourite, aj as storageHeldOrganization, ak as toAccountOrganizationChoices, al as writeLastActiveOrganization, am as writeStartupOrganization } from './active-organization-CIvSdboO.js';
+import { O as OrganizationsDb } from './active-organization-DHitxVeN.js';
+export { h as AccountOrganizationChoices, j as ActiveOrganization, k as ActiveOrganizationSnapshot, l as ActiveOrganizationStatus, m as AdminSeat, n as AdminSeatInput, p as ArchiveFilter, C as CachedActiveOrganization, q as CreateActiveOrganizationOptions, H as HeldOrganizationStore, L as LINK_ORGANIZATION_QUERY_KEY, t as LadderInput, v as LinkOrganizationDecision, w as LinkOrganizationDecisionInput, x as LinkOrganizationMembership, y as LinkOrganizationMessages, z as LinkOrganizationParam, N as NOT_A_MEMBER_RECHECK_GAP_MS, B as NoActiveOrganizationError, D as NotAMemberError, E as NotAMemberRefusalNotice, F as ORGANIZATION_ENTITY_TYPE, G as ORGANIZATION_RESOLUTION_TIMEOUT_MS, I as OrganizationBootstrapGate, J as OrganizationLapse, K as OrganizationMembership, M as OrganizationRefusal, P as OrganizationRung, Q as ParentOrganization, R as ReadMembershipsOptions, T as ResolveWithLinkInput, V as ResolvedOrganization, W as ResolvedWithLink, X as adminSeatReplacesUserContext, Y as classifyLinkOrganizationValue, Z as classifyOrganizationRefusal, _ as createActiveOrganization, $ as createNotAMemberRefusalNotice, a0 as createOrganizationBootstrapGate, a1 as decideLinkOrganization, a2 as isNotAMemberRefusal, a3 as linkOrganizationMalformedMessage, a4 as linkOrganizationNotAMemberMessage, a5 as linkOrganizationOfferMessage, a6 as linkOrganizationSwitchAnnouncement, a7 as memoryHeldOrganization, a8 as oldestMembership, a9 as orderOrganizations, aa as organizationMatches, ab as readAccountOrganizationChoices, ac as readLinkOrganizationParam, ad as readMemberships, ae as readOrganizationFavourites, af as resolveActiveOrganization, ag as resolveActiveOrganizationLazily, ah as resolveAdminSeat, ai as resolveChildOrganizationId, aj as resolveOrganizationWithLink, ak as setOrganizationFavourite, al as storageHeldOrganization, am as toAccountOrganizationChoices, an as writeLastActiveOrganization, ao as writeStartupOrganization } from './active-organization-DHitxVeN.js';
 import '@supabase/supabase-js';
 
 /**
@@ -107,4 +108,26 @@ declare function organizationRequiredEnvelope(error: OrganizationRequiredServerE
 /** The standard `Response` (status 400) a route answers the refusal with — no framework needed. */
 declare function organizationRequiredResponse(error: OrganizationRequiredServerError): Response;
 
-export { MEMBERSHIPS_URL, type MembershipReadClient, ORGANIZATION_CONTEXT_REQUIRED_CODE, ORGANIZATION_REQUIRED_CODE, ORGANIZATION_REQUIRED_WIRE_CODE, type OrganizationHoldDetails, type OrganizationHoldSetOn, type OrganizationMembershipSummary, type OrganizationRequiredEnvelope, OrganizationRequiredServerError, type OrganizationRequiredWireMembership, extractOrganizationHoldMemberships, isOrganizationRequiredEnvelope, isOrganizationRequiredError, isOrganizationRequiredServerError, organizationRequired, organizationRequiredEnvelope, organizationRequiredResponse, readCallerMemberships };
+/**
+ * The person's raw membership rows for ONE container type, PAGED — the canonical `mbr_for_user`
+ * door (moved from the website's membershipsService). PostgREST caps one answer at its max-rows
+ * (1000): a person in 1,043 organizations lost the last 43, so the read pages in stable id order
+ * until a short page.
+ *
+ * It does NOT throw: it returns the first failing page's `{ error, status }` so a host can wrap
+ * the whole read in its own session retry (a 401 on a recovering session) and map the error its
+ * own way.
+ */
+
+declare const MEMBERSHIP_ROWS_PAGE = 500;
+interface MembershipRowsAnswer<Row> {
+    readonly data: Row[] | null;
+    readonly error: {
+        message: string;
+        code?: string;
+    } | null;
+    readonly status?: number | undefined;
+}
+declare function readMembershipRows<Row = Record<string, unknown>>(db: OrganizationsDb, containerType: string, pageSize?: number): Promise<MembershipRowsAnswer<Row>>;
+
+export { MEMBERSHIPS_URL, MEMBERSHIP_ROWS_PAGE, type MembershipReadClient, type MembershipRowsAnswer, ORGANIZATION_CONTEXT_REQUIRED_CODE, ORGANIZATION_REQUIRED_CODE, ORGANIZATION_REQUIRED_WIRE_CODE, type OrganizationHoldDetails, type OrganizationHoldSetOn, type OrganizationMembershipSummary, type OrganizationRequiredEnvelope, OrganizationRequiredServerError, type OrganizationRequiredWireMembership, OrganizationsDb, extractOrganizationHoldMemberships, isOrganizationRequiredEnvelope, isOrganizationRequiredError, isOrganizationRequiredServerError, organizationRequired, organizationRequiredEnvelope, organizationRequiredResponse, readCallerMemberships, readMembershipRows };

package/dist/organizations.js

@@ -449,7 +449,9 @@ var IDLE = Object.freeze({
   organization: null,
   memberships: Object.freeze([]),
   rung: null,
-  error: null
+  error: null,
+  favourites: Object.freeze([]),
+  startupOrganizationId: null
 });
 function createActiveOrganization(options) {
   const { client } = options;
@@ -460,8 +462,11 @@ function createActiveOrganization(options) {
   let generation = 0;
   let waiters = [];
   let disposed = false;
+  let lastSettled = IDLE;
+  let lastReadAt = Number.NEGATIVE_INFINITY;
   const publish = (next) => {
     current = Object.freeze(next);
+    if (current.status !== "resolving") lastSettled = current;
     if (current.status !== "resolving" && current.status !== "idle") {
       options.bootstrapGate?.markResolved();
       const ready = waiters;
@@ -471,6 +476,7 @@ function createActiveOrganization(options) {
     for (const l of [...listeners]) l();
   };
   const run = async (gen) => {
+    const prior = current.status === "resolving" ? lastSettled : current;
     publish({ ...current, status: "resolving", error: null });
     try {
       const person = await getPerson(client);
@@ -479,8 +485,24 @@ function createActiveOrganization(options) {
         publish({ ...IDLE, status: "none", error: "signed-out" });
         return current;
       }
-      const memberships = await readMemberships(client, person.id);
+      const rawMemberships = await readMemberships(client, person.id);
       if (gen !== generation) return current;
+      let favourites = current.favourites;
+      let startupOrganizationId = current.startupOrganizationId;
+      let account = null;
+      if (options.accountChoices) {
+        const [fav, acct] = await Promise.all([
+          readOrganizationFavourites(client).catch(() => favourites),
+          readAccountOrganizationChoices(client, person.id)
+        ]);
+        favourites = fav;
+        account = acct;
+        startupOrganizationId = acct.startupOrganizationId;
+        if (gen !== generation) return current;
+      }
+      const memberships = options.accountChoices ? orderOrganizations(rawMemberships, favourites) : rawMemberships;
+      const readAccount = () => account ? Promise.resolve(account) : readAccountOrganizationChoices(client, person.id);
+      const before = prior;
       const linkOptions = options.link;
       let resolved;
       let linkDecision = null;
@@ -488,7 +510,7 @@ function createActiveOrganization(options) {
         const r = await resolveOrganizationWithLink({
           memberships,
           held: await held.read(person.id),
-          readAccount: () => readAccountOrganizationChoices(client, person.id),
+          readAccount,
           link: linkOptions.source() ?? null,
           switchWhenALinkAsks: linkOptions.switchWhenALinkAsks?.(),
           signedInAs: linkOptions.signedInAs?.(),
@@ -503,7 +525,7 @@ function createActiveOrganization(options) {
         resolved = await resolveActiveOrganizationLazily({
           memberships,
           held: heldId,
-          readAccount: () => readAccountOrganizationChoices(client, person.id)
+          readAccount
         });
       }
       if (gen !== generation) return current;
@@ -511,7 +533,9 @@ function createActiveOrganization(options) {
         publish({ ...IDLE, status: "none", userId: person.id, error: "no-memberships" });
         return current;
       }
-      await held.write(person.id, resolved.organization.id);
+      if (options.holdResolved ?? true) await held.write(person.id, resolved.organization.id);
+      const wasOrg = before.status === "ready" || before.status === "unchecked" ? before.organization : null;
+      const lapsed = wasOrg && wasOrg.id !== resolved.organization.id && !memberships.some((m) => m.id === wasOrg.id) ? wasOrg : null;
       if (linkDecision && linkDecision.kind !== "no-link") options.link?.onDecision?.(linkDecision);
       publish({
         status: "ready",
@@ -520,12 +544,51 @@ function createActiveOrganization(options) {
         organization: resolved.organization,
         memberships,
         rung: resolved.rung,
-        error: null
+        error: null,
+        favourites,
+        startupOrganizationId
       });
+      if (lapsed) options.onLapse?.({ was: lapsed, now: resolved.organization });
+      lastReadAt = Date.now();
+      if (options.cached?.write) {
+        try {
+          await options.cached.write(person.id, { memberships, organizationId: resolved.organization.id, favourites, startupOrganizationId });
+        } catch {
+        }
+      }
       return current;
     } catch (e) {
       if (gen !== generation) return current;
-      publish({ ...current, status: "error", error: e?.message ?? String(e) });
+      const message = e?.message ?? String(e);
+      if (options.cached && (prior.status === "ready" || prior.status === "unchecked") && prior.organization) {
+        publish({ ...prior, status: "unchecked", error: message });
+        return current;
+      }
+      const cachedUser = options.cached?.userId();
+      if (options.cached && cachedUser) {
+        try {
+          const answer = await options.cached.read(cachedUser);
+          if (gen !== generation) return current;
+          const wanted = await held.read(cachedUser) ?? answer?.organizationId ?? null;
+          const organization = answer?.memberships.find((m) => m.id === wanted) ?? null;
+          if (answer && organization) {
+            publish({
+              status: "unchecked",
+              userId: cachedUser,
+              organizationId: organization.id,
+              organization,
+              memberships: orderOrganizations(answer.memberships, answer.favourites),
+              rung: "held",
+              error: message,
+              favourites: answer.favourites,
+              startupOrganizationId: answer.startupOrganizationId
+            });
+            return current;
+          }
+        } catch {
+        }
+      }
+      publish({ ...current, status: "error", error: message });
       return current;
     }
   };
@@ -569,11 +632,34 @@ function createActiveOrganization(options) {
       };
     },
     load,
-    current: () => current.status === "ready" ? seatFor(current) ?? current.organizationId : null,
+    current: () => current.status === "ready" || current.status === "unchecked" ? seatFor(current) ?? current.organizationId : null,
+    refresh(refreshOptions) {
+      const gap = options.refreshGapMs ?? 0;
+      if (!refreshOptions?.force && gap > 0 && current.status !== "idle" && Date.now() - lastReadAt < gap) return Promise.resolve(current);
+      if (inflight) return inflight;
+      return load();
+    },
+    async setStartup(organizationId) {
+      const snap = await settled();
+      await writeStartupOrganization(client, organizationId);
+      publish({ ...snap, startupOrganizationId: organizationId });
+    },
+    async setFavourite(organizationId, favourite) {
+      const snap = await settled();
+      const before = snap.favourites;
+      const next = favourite ? [...before.filter((f) => f !== organizationId), organizationId] : before.filter((f) => f !== organizationId);
+      publish({ ...snap, favourites: next, memberships: orderOrganizations(snap.memberships, next) });
+      try {
+        await setOrganizationFavourite(client, organizationId, favourite);
+      } catch (e) {
+        publish({ ...current, favourites: before, memberships: orderOrganizations(current.memberships, before) });
+        throw e;
+      }
+    },
     async ensureOrgId(recordOrganizationId) {
       if (recordOrganizationId) return recordOrganizationId;
       const snap = await settled();
-      if (snap.status === "ready" && snap.organizationId) return seatFor(snap) ?? snap.organizationId;
+      if ((snap.status === "ready" || snap.status === "unchecked") && snap.organizationId) return seatFor(snap) ?? snap.organizationId;
       if (snap.status === "error") throw new NoActiveOrganizationError("unreadable", snap.error ?? void 0);
       throw new NoActiveOrganizationError(snap.error === "signed-out" ? "signed-out" : "no-memberships");
     },
@@ -698,9 +784,24 @@ function organizationRequiredEnvelope(error, setOn = "request") {
 function organizationRequiredResponse(error) {
   return Response.json(organizationRequiredEnvelope(error), { status: 400 });
 }
+
+// src/organization-membership-rows.ts
+var MEMBERSHIP_ROWS_PAGE = 500;
+async function readMembershipRows(db, containerType, pageSize = MEMBERSHIP_ROWS_PAGE) {
+  const rows = [];
+  for (let from = 0; ; from += pageSize) {
+    const answer = await db.rpc("mbr_for_user", { p_container_type: containerType }).order("id", { ascending: true }).range(from, from + pageSize - 1);
+    if (answer.error) return { data: null, error: answer.error, status: answer.status };
+    const page = Array.isArray(answer.data) ? answer.data : [];
+    rows.push(...page);
+    if (page.length < pageSize) break;
+  }
+  return { data: rows, error: null };
+}
 export {
   LINK_ORGANIZATION_QUERY_KEY,
   MEMBERSHIPS_URL,
+  MEMBERSHIP_ROWS_PAGE,
   NOT_A_MEMBER_RECHECK_GAP_MS,
   NoActiveOrganizationError,
   NotAMemberError,
@@ -736,6 +837,7 @@ export {
   readAccountOrganizationChoices,
   readCallerMemberships,
   readLinkOrganizationParam,
+  readMembershipRows,
   readMemberships,
   readOrganizationFavourites,
   resolveActiveOrganization,

package/dist/react.cjs

@@ -182,7 +182,9 @@ var SERVER_ACTIVE = Object.freeze({
   organization: null,
   memberships: Object.freeze([]),
   rung: null,
-  error: null
+  error: null,
+  favourites: Object.freeze([]),
+  startupOrganizationId: null
 });
 function useActiveOrganization(store) {
   return (0, import_react.useSyncExternalStore)(store.subscribe, store.snapshot, () => SERVER_ACTIVE);

package/dist/react.d.cts

@@ -90,7 +90,11 @@ type OrganizationRung = "held" | "last-active" | "startup" | "first";
  * the last person's organization, and a sign-out resets the store.
  */
 
-type ActiveOrganizationStatus = "idle" | "resolving" | "ready" | "none" | "error";
+/**
+ * `unchecked`: the memberships could not be read, and the answer shown is the host's cached last answer
+ * (`options.cached`), not verified against the database. Only ever produced when `cached` is given.
+ */
+type ActiveOrganizationStatus = "idle" | "resolving" | "ready" | "none" | "error" | "unchecked";
 interface ActiveOrganizationSnapshot {
     readonly status: ActiveOrganizationStatus;
     readonly userId: string | null;
@@ -100,6 +104,13 @@ interface ActiveOrganizationSnapshot {
     /** Which ladder rung answered (or "switched" after a person's click). */
     readonly rung: OrganizationRung | "switched" | "link" | null;
     readonly error: string | null;
+    /**
+     * The account's favourite organization ids. Read only when `options.accountChoices` is on; `[]`
+     * otherwise. When on, `memberships` is ordered favourites, then own, then the rest.
+     */
+    readonly favourites: readonly string[];
+    /** The account's start-up organization setting. Read only when `options.accountChoices` is on; null otherwise. */
+    readonly startupOrganizationId: string | null;
 }
 interface ActiveOrganization {
     snapshot(): ActiveOrganizationSnapshot;
@@ -109,6 +120,14 @@ interface ActiveOrganization {
     /** The active organization id now, or null while resolving / with none. Sync (api's getter). */
     current(): string | null;
     /** THE HELD REQUEST: the record's own organization, else the active one once resolved. */
+    /** Re-read, unless `options.refreshGapMs` has not elapsed since the last read (`force` always reads). */
+    refresh(options?: {
+        readonly force?: boolean;
+    }): Promise<ActiveOrganizationSnapshot>;
+    /** Save the account's start-up organization (null: the first). Needs `accountChoices`; throws on refusal. */
+    setStartup(organizationId: string | null): Promise<void>;
+    /** Add or remove a favourite and re-order. Optimistic; rolled back and rethrown if the save fails. */
+    setFavourite(organizationId: string, favourite: boolean): Promise<void>;
     ensureOrgId(recordOrganizationId?: string | null): Promise<string>;
     /** A person's click: switch, remember for this tab, save as last active for the next load. */
     switchTo(organizationId: string): Promise<void>;

package/dist/react.d.ts

@@ -90,7 +90,11 @@ type OrganizationRung = "held" | "last-active" | "startup" | "first";
  * the last person's organization, and a sign-out resets the store.
  */
 
-type ActiveOrganizationStatus = "idle" | "resolving" | "ready" | "none" | "error";
+/**
+ * `unchecked`: the memberships could not be read, and the answer shown is the host's cached last answer
+ * (`options.cached`), not verified against the database. Only ever produced when `cached` is given.
+ */
+type ActiveOrganizationStatus = "idle" | "resolving" | "ready" | "none" | "error" | "unchecked";
 interface ActiveOrganizationSnapshot {
     readonly status: ActiveOrganizationStatus;
     readonly userId: string | null;
@@ -100,6 +104,13 @@ interface ActiveOrganizationSnapshot {
     /** Which ladder rung answered (or "switched" after a person's click). */
     readonly rung: OrganizationRung | "switched" | "link" | null;
     readonly error: string | null;
+    /**
+     * The account's favourite organization ids. Read only when `options.accountChoices` is on; `[]`
+     * otherwise. When on, `memberships` is ordered favourites, then own, then the rest.
+     */
+    readonly favourites: readonly string[];
+    /** The account's start-up organization setting. Read only when `options.accountChoices` is on; null otherwise. */
+    readonly startupOrganizationId: string | null;
 }
 interface ActiveOrganization {
     snapshot(): ActiveOrganizationSnapshot;
@@ -109,6 +120,14 @@ interface ActiveOrganization {
     /** The active organization id now, or null while resolving / with none. Sync (api's getter). */
     current(): string | null;
     /** THE HELD REQUEST: the record's own organization, else the active one once resolved. */
+    /** Re-read, unless `options.refreshGapMs` has not elapsed since the last read (`force` always reads). */
+    refresh(options?: {
+        readonly force?: boolean;
+    }): Promise<ActiveOrganizationSnapshot>;
+    /** Save the account's start-up organization (null: the first). Needs `accountChoices`; throws on refusal. */
+    setStartup(organizationId: string | null): Promise<void>;
+    /** Add or remove a favourite and re-order. Optimistic; rolled back and rethrown if the save fails. */
+    setFavourite(organizationId: string, favourite: boolean): Promise<void>;
     ensureOrgId(recordOrganizationId?: string | null): Promise<string>;
     /** A person's click: switch, remember for this tab, save as last active for the next load. */
     switchTo(organizationId: string): Promise<void>;

package/dist/react.js

@@ -157,7 +157,9 @@ var SERVER_ACTIVE = Object.freeze({
   organization: null,
   memberships: Object.freeze([]),
   rung: null,
-  error: null
+  error: null,
+  favourites: Object.freeze([]),
+  startupOrganizationId: null
 });
 function useActiveOrganization(store) {
   return useSyncExternalStore(store.subscribe, store.snapshot, () => SERVER_ACTIVE);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-matrx/auth",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "AI Matrx sign-in, session and organizations for every app: sign in/out, session storage and refresh per platform (browser, Next.js, extension, desktop, Node), the current person, their organizations and favourites, the one active organization (held requests, never a list filter), and the credentials @ai-matrx/data and @ai-matrx/api read.",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -211,5 +211,5 @@
     "test": "vitest run",
     "verify:tarball": "node ./scripts/verify-tarball.mjs"
   },
-  "gitHead": "2d910d0280828c62bf8f52534665eba32abe02ad"
+  "gitHead": "9517977774bcd6e3ed1018bd331ca397a8e7ddfd"
 }