@agent-native/core 0.122.4 → 0.123.0

package/src/org/context.ts

@@ -1,9 +1,11 @@
 import type { H3Event } from "h3";
 
-import { getDbExec } from "../db/client.js";
+import { warnAgent } from "../agent/action-warnings.js";
+import { getDbExec, isTransientDatabaseError } from "../db/client.js";
 import { getSession } from "../server/auth.js";
 import { getSetting } from "../settings/store.js";
-import { getUserSetting, putUserSetting } from "../settings/user-settings.js";
+import { getUserSetting } from "../settings/user-settings.js";
+import { setActiveOrgId } from "./active-org.js";
 import { autoJoinDomainMatchingOrgs } from "./auto-join-domain.js";
 import type { OrgContext, OrgRole } from "./types.js";
 
@@ -14,6 +16,33 @@ const EMPTY_CONTEXT: OrgContext = {
   role: null,
 };
 
+/**
+ * The single way to read `org_members`, so no two call sites can pick opposite
+ * defaults for the same failure. A transient database failure is NOT an answer
+ * and propagates: a caller that turns it into "no memberships" silently drops
+ * org scope, which hides every org-scoped credential behind a
+ * permanent-sounding "not configured".
+ *
+ * `null` is every non-transient failure, not only the intended one (org tables
+ * absent on a fresh install before migrations). A permanently unreadable table
+ * — a role without SELECT, say — still reports as "no rows" here. Narrowing
+ * that further means classifying "no database configured" as readable-absent,
+ * which is load-bearing for CLI/script/test contexts that legitimately run
+ * without a store; see `assertCredentialStoreReadable`.
+ */
+export async function queryOrgMembers(query: {
+  sql: string;
+  args: unknown[];
+}): Promise<Record<string, unknown>[] | null> {
+  try {
+    const { rows } = await getDbExec().execute(query);
+    return rows as Record<string, unknown>[];
+  } catch (err) {
+    if (isTransientDatabaseError(err)) throw err;
+    return null;
+  }
+}
+
 function normalizeOrgRole(value: unknown): OrgRole | null {
   return value === "owner" || value === "admin" || value === "member"
     ? value
@@ -79,7 +108,14 @@ export async function getOrgContext(event: H3Event): Promise<OrgContext> {
   const ctx = event.context as {
     __anOrgContextCache?: Promise<OrgContext>;
   };
-  return (ctx.__anOrgContextCache ??= resolveOrgContextUncached(event));
+  // Evict on failure. A memoized failure would otherwise answer every later
+  // caller in this request with the wrong org.
+  return (ctx.__anOrgContextCache ??= resolveOrgContextUncached(event).catch(
+    (err) => {
+      delete ctx.__anOrgContextCache;
+      throw err;
+    },
+  ));
 }
 
 type MembershipRow = {
@@ -127,7 +163,6 @@ function loadActiveOrgSettingForEvent(
  */
 function loadMembershipsForEvent(
   event: H3Event,
-  exec: ReturnType<typeof getDbExec>,
   email: string,
 ): Promise<MembershipRow[] | null> {
   const ctx = event.context as Record<string, unknown>;
@@ -140,7 +175,12 @@ function loadMembershipsForEvent(
     >())) as Map<string, Promise<MembershipRow[] | null>>;
   let promise = cache.get(email);
   if (!promise) {
-    promise = loadMemberships(exec, email);
+    // A failed read is evicted rather than memoized: caching it would make one
+    // transient error answer every later lookup in this request.
+    promise = loadMemberships(email).catch((err) => {
+      cache.delete(email);
+      throw err;
+    });
     cache.set(email, promise);
   }
   return promise;
@@ -170,7 +210,22 @@ async function resolveOrgContextUncached(event: H3Event): Promise<OrgContext> {
 
   const exec = getDbExec();
 
-  let memberships = await loadMembershipsForEvent(event, exec, email);
+  let memberships: MembershipRow[] | null;
+  try {
+    memberships = await loadMembershipsForEvent(event, email);
+  } catch (err) {
+    // A transient membership read must not downgrade an authenticated request
+    // to a private/solo scope when the session already carries its org.
+    if (sessionOrgId && isTransientDatabaseError(err)) {
+      return {
+        email,
+        orgId: sessionOrgId,
+        orgName: null,
+        role: sessionOrgRole,
+      };
+    }
+    throw err;
+  }
   if (memberships === null) {
     if (sessionOrgId) {
       return {
@@ -223,7 +278,7 @@ async function resolveOrgContextUncached(event: H3Event): Promise<OrgContext> {
     });
     const joinedOrgId = joined.joined[0]?.orgId ?? null;
     if (joinedOrgId) {
-      const refreshed = await loadMemberships(exec, email);
+      const refreshed = await loadMemberships(email);
       if (refreshed !== null) {
         memberships = refreshed;
         updateMembershipsForEvent(event, email, refreshed);
@@ -244,7 +299,7 @@ async function resolveOrgContextUncached(event: H3Event): Promise<OrgContext> {
           )));
 
       if (shouldActivate) {
-        await putUserSetting(email, "active-org-id", { orgId: joinedOrgId });
+        await setActiveOrgId(email, joinedOrgId, "joined domain-matched org");
         const active = memberships.find((m) => m.orgId === joinedOrgId);
         if (active) {
           return {
@@ -312,20 +367,28 @@ async function resolveOrgContextUncached(event: H3Event): Promise<OrgContext> {
   };
 }
 
-async function loadMemberships(
-  exec: ReturnType<typeof getDbExec>,
-  email: string,
-): Promise<MembershipRow[] | null> {
-  try {
-    const { rows } = await exec.execute({
-      sql: `SELECT m.org_id AS "orgId", m.role AS role, o.name AS "orgName",
-                   o.allowed_domain AS "allowedDomain"
-            FROM org_members m
-            INNER JOIN organizations o ON m.org_id = o.id
-            WHERE LOWER(m.email) = ?`,
-      args: [email.toLowerCase()],
-    });
-    return rows.map((r: any) => {
+/**
+ * Ordering for every membership lookup that falls back to "first membership".
+ * Without it the fallback is whatever order the plan happens to return, so a
+ * multi-org user's active org can change between two identical requests — and
+ * `getSession` then freezes that arbitrary answer into `session.orgId`.
+ * `org_id` breaks ties so two memberships joined in the same millisecond still
+ * resolve identically.
+ */
+const MEMBERSHIP_FALLBACK_ORDER_BY = `ORDER BY joined_at ASC, org_id ASC`;
+
+async function loadMemberships(email: string): Promise<MembershipRow[] | null> {
+  const rows = await queryOrgMembers({
+    sql: `SELECT m.org_id AS "orgId", m.role AS role, o.name AS "orgName",
+                 o.allowed_domain AS "allowedDomain"
+          FROM org_members m
+          INNER JOIN organizations o ON m.org_id = o.id
+          WHERE LOWER(m.email) = ?
+          ${MEMBERSHIP_FALLBACK_ORDER_BY}`,
+    args: [email.toLowerCase()],
+  });
+  return (
+    rows?.map((r: any) => {
       const domain = r.allowedDomain ?? r.allowed_domain;
       return {
         orgId: String(r.orgId ?? r.org_id),
@@ -333,44 +396,36 @@ async function loadMemberships(
         orgName: String(r.orgName ?? r.org_name),
         allowedDomain: domain ? String(domain) : null,
       };
-    });
-  } catch {
-    // Tables may not exist yet on first boot before migrations finish.
-    return null;
-  }
+    }) ?? null
+  );
 }
 
 /**
  * Resolve the active org ID for a given email — for non-HTTP contexts like
  * the integration webhook handler where we have an email but no event/session.
  * Picks the user's active-org-id setting if set, including explicit Personal,
- * otherwise the first membership.
+ * otherwise the oldest membership.
  * Returns null if the user has no memberships.
  */
 export async function resolveOrgIdForEmail(
   email: string,
 ): Promise<string | null> {
-  const exec = getDbExec();
-  if (!exec) return null;
-  try {
-    const { rows } = await exec.execute({
-      sql: `SELECT org_id FROM org_members WHERE LOWER(email) = ?`,
-      args: [email.toLowerCase()],
-    });
-    if (rows.length === 0) return null;
-    const ids = rows.map((r: any) => String(r.org_id));
-    const activeOrgSetting = (await getUserSetting(
-      email,
-      "active-org-id",
-    )) as ActiveOrgSetting;
-    if (activeOrgSetting?.orgId === null) return null;
-    if (activeOrgSetting?.orgId && ids.includes(activeOrgSetting.orgId)) {
-      return activeOrgSetting.orgId;
-    }
-    return ids[0];
-  } catch {
-    return null;
+  const rows = await queryOrgMembers({
+    sql: `SELECT org_id FROM org_members WHERE LOWER(email) = ?
+          ${MEMBERSHIP_FALLBACK_ORDER_BY}`,
+    args: [email.toLowerCase()],
+  });
+  if (!rows?.length) return null;
+  const ids = rows.map((r: any) => String(r.org_id));
+  const activeOrgSetting = (await getUserSetting(
+    email,
+    "active-org-id",
+  )) as ActiveOrgSetting;
+  if (activeOrgSetting?.orgId === null) return null;
+  if (activeOrgSetting?.orgId && ids.includes(activeOrgSetting.orgId)) {
+    return activeOrgSetting.orgId;
   }
+  return ids[0];
 }
 
 /**
@@ -383,23 +438,17 @@ export async function resolveOrgIdForEmailViaEvent(
   event: H3Event,
   email: string,
 ): Promise<string | null> {
-  try {
-    const exec = getDbExec();
-    if (!exec) return null;
-    const memberships = await loadMembershipsForEvent(event, exec, email);
-    if (!memberships || memberships.length === 0) return null;
-    const activeOrgSetting = await loadActiveOrgSettingForEvent(event, email);
-    if (activeOrgSetting?.orgId === null) return null;
-    if (
-      activeOrgSetting?.orgId &&
-      memberships.some((m) => m.orgId === activeOrgSetting.orgId)
-    ) {
-      return activeOrgSetting.orgId;
-    }
-    return memberships[0].orgId;
-  } catch {
-    return null;
+  const memberships = await loadMembershipsForEvent(event, email);
+  if (!memberships || memberships.length === 0) return null;
+  const activeOrgSetting = await loadActiveOrgSettingForEvent(event, email);
+  if (activeOrgSetting?.orgId === null) return null;
+  if (
+    activeOrgSetting?.orgId &&
+    memberships.some((m) => m.orgId === activeOrgSetting.orgId)
+  ) {
+    return activeOrgSetting.orgId;
   }
+  return memberships[0].orgId;
 }
 
 /**
@@ -437,11 +486,65 @@ export async function createOrganization(
     args: [nanoid(), id, email, role, createdAt],
   });
 
-  await putUserSetting(email, "active-org-id", { orgId: id });
+  await warnOnAdditionalOrganization(exec, email, id, trimmedName);
+
+  await setActiveOrgId(email, id, `created organization "${trimmedName}"`);
 
   return { id, name: trimmedName, role, a2aSecret, createdAt };
 }
 
+/**
+ * A second organization is the single most expensive accident in this codebase:
+ * vault credentials are scoped per organization, so creating one and activating
+ * it orphans every key synced under the previous org, and the only symptom is a
+ * missing-env-var error somewhere else entirely. The UI warns humans before
+ * they click (`org.createOrgVaultNotice`); this covers the path that actually
+ * did the damage — app code or a migration action calling `createOrganization`
+ * directly, where no notice is ever rendered.
+ */
+async function warnOnAdditionalOrganization(
+  exec: ReturnType<typeof getDbExec>,
+  email: string,
+  newOrgId: string,
+  newOrgName: string,
+): Promise<void> {
+  try {
+    const { rows } = await exec.execute({
+      sql: `SELECT 1 FROM org_members WHERE LOWER(email) = ? AND org_id <> ? LIMIT 1`,
+      args: [email.toLowerCase(), newOrgId],
+    });
+    if (rows.length === 0) return;
+  } catch {
+    // "Couldn't tell" is not "it didn't" — swallowing the failed probe here made
+    // the function whose entire job is to not be silent, silent.
+    warnAgent({
+      severity: "critical",
+      code: "org-additional-org-membership-unreadable",
+      message:
+        `Created an organization "${newOrgName}" (${newOrgId}) and made it the account's active org, ` +
+        `but could not read whether that account already belonged to another organization. If it did, ` +
+        `every vault credential synced under the previous organization is now unreadable for it, and ` +
+        `requests will fail with missing-credential errors that name the key rather than this org ` +
+        `change. Confirm the account's memberships before continuing; if this came from a roster, ` +
+        `identity, or user-list migration, add the members to the EXISTING organization instead.`,
+    });
+    return;
+  }
+
+  warnAgent({
+    severity: "critical",
+    code: "org-additional-organization",
+    message:
+      `Created an ADDITIONAL organization "${newOrgName}" (${newOrgId}) ` +
+      `for an account that already belongs to another organization, and made it their active org. ` +
+      `Vault credentials are scoped per organization and are NOT shared between them: every API key ` +
+      `synced under the previous organization is now unreadable for this account until it is re-saved ` +
+      `in "${newOrgName}". Requests will fail with missing-credential errors that name the key rather ` +
+      `than this org change. If this came from a roster, identity, or user-list migration, add the ` +
+      `members to the EXISTING organization instead of creating a new one.`,
+  });
+}
+
 function defaultOrgName(
   email: string,
   session: { name?: string } | null,
@@ -567,7 +670,7 @@ async function tryCreateDefaultOrg(
       args: [nanoid(), orgId, email, "owner", now],
     });
 
-    await putUserSetting(email, "active-org-id", { orgId });
+    await setActiveOrgId(email, orgId, "auto-created default organization");
 
     return { email, orgId, orgName, role: "owner" };
   } catch {

package/src/org/handlers.ts

@@ -36,14 +36,14 @@ function extractMemberEmail(event: H3Event): string | undefined {
 const nanoid = (): string =>
   globalThis.crypto?.randomUUID?.().replace(/-/g, "") ??
   Math.random().toString(36).slice(2) + Date.now().toString(36);
-import { getDbExec } from "../db/client.js";
+import { getDbExec, isPostgres } from "../db/client.js";
 import { ssrfSafeFetch } from "../extensions/url-safety.js";
 import { getAppProductionUrl } from "../server/app-url.js";
 import { getSession } from "../server/auth.js";
 import { renderInviteEmail } from "../server/email-templates.js";
 import { sendEmail, isEmailConfigured } from "../server/email.js";
 import { readBody } from "../server/h3-helpers.js";
-import { putUserSetting } from "../settings/user-settings.js";
+import { setActiveOrgId } from "./active-org.js";
 import { getOrgContext, createOrganization } from "./context.js";
 import { isFreeEmailProvider } from "./free-email-providers.js";
 import type { OrgRole } from "./types.js";
@@ -108,7 +108,7 @@ export const getMyOrgHandler = defineEventHandler(async (event: H3Event) => {
   }
 
   let allowedDomain: string | null = null;
-  let a2aSecret: string | null = null;
+  let a2aSecretSet = false;
   if (ctx.orgId) {
     try {
       const adRes = await e.execute({
@@ -118,7 +118,9 @@ export const getMyOrgHandler = defineEventHandler(async (event: H3Event) => {
       if (adRes.rows[0]) {
         allowedDomain =
           String((adRes.rows[0] as any).allowed_domain ?? "") || null;
-        a2aSecret = String((adRes.rows[0] as any).a2a_secret ?? "") || null;
+        a2aSecretSet = Boolean(
+          String((adRes.rows[0] as any).a2a_secret ?? "").trim(),
+        );
       }
     } catch {
       // Column may not exist yet
@@ -154,7 +156,11 @@ export const getMyOrgHandler = defineEventHandler(async (event: H3Event) => {
     pendingInvitations,
     domainMatches,
     allowedDomain,
-    a2aSecret: isOwnerOrAdmin ? a2aSecret : undefined,
+    // Never serialize the A2A secret here. This route runs on every page load,
+    // so the value would sit in JSON any script on the page can read, and it
+    // signs the JWTs peers accept as first-party callers. Reveal is an explicit
+    // owner/admin GET on /_agent-native/org/a2a-secret.
+    a2aSecretSet: isOwnerOrAdmin ? a2aSecretSet : undefined,
   };
 });
 
@@ -482,7 +488,7 @@ export const acceptInvitationHandler = defineEventHandler(
         sql: `UPDATE org_invitations SET status = 'accepted' WHERE id = ?`,
         args: [invitationId],
       });
-      await putUserSetting(email, "active-org-id", { orgId: invOrgId });
+      await setActiveOrgId(email, invOrgId, "accepted invitation");
       return {
         orgId: invOrgId,
         orgName,
@@ -500,7 +506,7 @@ export const acceptInvitationHandler = defineEventHandler(
       args: [invitationId],
     });
 
-    await putUserSetting(email, "active-org-id", { orgId: invOrgId });
+    await setActiveOrgId(email, invOrgId, "accepted invitation");
 
     return { orgId: invOrgId, orgName, role: inviteRole };
   },
@@ -678,6 +684,105 @@ export const updateOrgHandler = defineEventHandler(async (event: H3Event) => {
   return { orgId: ctx.orgId, name };
 });
 
+/**
+ * DELETE /_agent-native/org — permanently delete the current organization
+ * (owner only). Body: { name: string } must match the org's current name
+ * (trim + case-insensitive) as a confirmation guard against misclicks.
+ *
+ * Deletes org_invitations, org-scoped settings, org_members, and the
+ * organizations row, then repoints the caller's active-org-id to another
+ * membership of theirs (or null for Personal) so they aren't left pointing
+ * at a deleted org.
+ */
+export const deleteOrgHandler = defineEventHandler(async (event: H3Event) => {
+  const ctx = await getOrgContext(event);
+  if (!ctx.orgId) {
+    throw createError({ statusCode: 400, message: "No active organization" });
+  }
+  if (ctx.role !== "owner") {
+    throw createError({
+      statusCode: 403,
+      message: "Only the organization owner can delete an organization",
+    });
+  }
+
+  const body = await readBody(event);
+  const confirmName = String(body?.name ?? "").trim();
+
+  const e = await exec();
+  const orgRes = await e.execute({
+    sql: `SELECT name FROM organizations WHERE id = ? LIMIT 1`,
+    args: [ctx.orgId],
+  });
+  if (orgRes.rows.length === 0) {
+    throw createError({ statusCode: 404, message: "Organization not found" });
+  }
+  const actualName = String((orgRes.rows[0] as any).name ?? "").trim();
+
+  if (confirmName.toLowerCase() !== actualName.toLowerCase()) {
+    throw createError({
+      statusCode: 400,
+      message: "Organization name does not match",
+    });
+  }
+
+  const settingsTable = isPostgres() ? "public.settings" : "settings";
+  const settingsPrefix = `o:${ctx.orgId}:`.replace(
+    /[!%_]/g,
+    (character) => `!${character}`,
+  );
+  const deleteStatements = [
+    {
+      sql: `DELETE FROM org_invitations WHERE org_id = ?`,
+      args: [ctx.orgId],
+    },
+    {
+      sql: `DELETE FROM app_secrets WHERE scope IN ('org', 'workspace') AND scope_id = ?`,
+      args: [ctx.orgId],
+    },
+    {
+      sql: `DELETE FROM ${settingsTable} WHERE key LIKE ? ESCAPE '!'`,
+      args: [`${settingsPrefix}%`],
+    },
+    {
+      sql: `DELETE FROM org_members WHERE org_id = ?`,
+      args: [ctx.orgId],
+    },
+    {
+      sql: `DELETE FROM organizations WHERE id = ?`,
+      args: [ctx.orgId],
+    },
+  ];
+
+  if (e.transaction) {
+    await e.transaction(async (tx) => {
+      for (const statement of deleteStatements) await tx.execute(statement);
+    });
+  } else if (e.atomicBatch) {
+    await e.atomicBatch(deleteStatements);
+  } else {
+    throw createError({
+      statusCode: 503,
+      message: "Organization deletion requires atomic database support",
+    });
+  }
+
+  const nextRes = await e.execute({
+    sql: `SELECT org_id AS "orgId" FROM org_members WHERE LOWER(email) = ? LIMIT 1`,
+    args: [ctx.email.toLowerCase()],
+  });
+  const nextOrgId =
+    nextRes.rows.length > 0
+      ? String(
+          (nextRes.rows[0] as any).orgId ?? (nextRes.rows[0] as any).org_id,
+        )
+      : null;
+
+  await setActiveOrgId(ctx.email, nextOrgId, "deleted active organization");
+
+  return { success: true, orgId: ctx.orgId, nextOrgId };
+});
+
 /** PUT /_agent-native/org/switch — switch the user's active organization */
 export const switchOrgHandler = defineEventHandler(async (event: H3Event) => {
   const session = await getSession(event);
@@ -687,7 +792,7 @@ export const switchOrgHandler = defineEventHandler(async (event: H3Event) => {
   const orgId = body?.orgId;
 
   if (!orgId) {
-    await putUserSetting(email, "active-org-id", { orgId: null });
+    await setActiveOrgId(email, null, "cleared active organization");
     return { orgId: null, orgName: null, role: null };
   }
 
@@ -707,7 +812,7 @@ export const switchOrgHandler = defineEventHandler(async (event: H3Event) => {
     });
   }
 
-  await putUserSetting(email, "active-org-id", { orgId });
+  await setActiveOrgId(email, orgId, "user switched organization");
 
   const row = membership.rows[0] as any;
   return {
@@ -766,7 +871,7 @@ export const joinByDomainHandler = defineEventHandler(
       args: [nanoid(), orgId, email, Date.now()],
     });
 
-    await putUserSetting(email, "active-org-id", { orgId });
+    await setActiveOrgId(email, orgId, "joined domain-matched organization");
 
     return {
       orgId,
@@ -849,6 +954,39 @@ export const setDomainHandler = defineEventHandler(async (event: H3Event) => {
   return { domain: raw };
 });
 
+/**
+ * GET /_agent-native/org/a2a-secret — reveal the org's A2A secret
+ * (owner/admin only). Separate from `/org/me` so the secret is only ever sent
+ * to the browser when an operator explicitly asks to see or copy it.
+ */
+export const revealA2ASecretHandler = defineEventHandler(
+  async (event: H3Event) => {
+    const ctx = await getOrgContext(event);
+    if (!ctx.orgId) {
+      throw createError({
+        statusCode: 400,
+        message: "No active organization",
+      });
+    }
+    if (ctx.role !== "owner" && ctx.role !== "admin") {
+      throw createError({
+        statusCode: 403,
+        message: "Only owners and admins can read the A2A secret",
+      });
+    }
+
+    const e = await exec();
+    const res = await e.execute({
+      sql: `SELECT a2a_secret FROM organizations WHERE id = ? LIMIT 1`,
+      args: [ctx.orgId],
+    });
+
+    return {
+      a2aSecret: String((res.rows[0] as any)?.a2a_secret ?? "") || null,
+    };
+  },
+);
+
 /** PUT /_agent-native/org/a2a-secret — regenerate or set the org's A2A secret (owner/admin only) */
 export const setA2ASecretHandler = defineEventHandler(
   async (event: H3Event) => {

package/src/org/plugin.ts

@@ -17,6 +17,7 @@ import {
   getMyOrgHandler,
   createOrgHandler,
   updateOrgHandler,
+  deleteOrgHandler,
   switchOrgHandler,
   listMembersHandler,
   removeMemberHandler,
@@ -26,6 +27,7 @@ import {
   acceptInvitationHandler,
   joinByDomainHandler,
   setDomainHandler,
+  revealA2ASecretHandler,
   setA2ASecretHandler,
   syncA2ASecretHandler,
   receiveA2ASecretHandler,
@@ -44,6 +46,7 @@ const ORG_PREFIX = `${FRAMEWORK_PREFIX}/org`;
  *   GET    /_agent-native/org/me                          — current user's active org + invites
  *   POST   /_agent-native/org                             — create organization
  *   PATCH  /_agent-native/org                             — rename organization (owner/admin)
+ *   DELETE /_agent-native/org                             — delete organization (owner only)
  *   PUT    /_agent-native/org/switch                      — switch active org
  *   GET    /_agent-native/org/members                     — list members of active org
  *   DELETE /_agent-native/org/members/:email              — remove member (owner/admin only)
@@ -52,6 +55,7 @@ const ORG_PREFIX = `${FRAMEWORK_PREFIX}/org`;
  *   POST   /_agent-native/org/invitations/:id/accept      — accept an invitation
  *   POST   /_agent-native/org/join-by-domain              — join org via email domain match
  *   PUT    /_agent-native/org/domain                      — set/clear allowed email domain (owner/admin)
+ *   GET    /_agent-native/org/a2a-secret                  — reveal A2A secret on demand (owner/admin)
  *   PUT    /_agent-native/org/a2a-secret                  — regenerate or set A2A secret (owner/admin)
  *   POST   /_agent-native/org/a2a-secret/sync             — push secret to all connected apps (owner/admin)
  *   POST   /_agent-native/org/a2a-secret/receive          — accept a peer's secret push (JWT-auth, no session)
@@ -199,6 +203,7 @@ export function createOrgPlugin(): NitroPluginDef {
           setResponseStatus(event, 405);
           return { error: "Method not allowed" };
         }
+        if (getMethod(event) === "GET") return revealA2ASecretHandler(event);
         if (getMethod(event) !== "PUT") {
           setResponseStatus(event, 405);
           return { error: "Method not allowed" };
@@ -231,13 +236,15 @@ export function createOrgPlugin(): NitroPluginDef {
       }),
     );
 
-    // POST / (create) + PATCH / (rename) — mounted last so the more specific routes match first
+    // POST / (create) + PATCH / (rename) + DELETE / (delete) — mounted last
+    // so the more specific routes match first
     app.use(
       ORG_PREFIX,
       defineEventHandler(async (event: H3Event) => {
         const method = getMethod(event);
         if (method === "POST") return createOrgHandler(event);
         if (method === "PATCH") return updateOrgHandler(event);
+        if (method === "DELETE") return deleteOrgHandler(event);
         setResponseStatus(event, 405);
         return { error: "Method not allowed" };
       }),

package/src/org/types.ts

@@ -38,7 +38,12 @@ export interface OrgInfo {
   pendingInvitations: OrgInvitationSummary[];
   domainMatches: DomainMatchOrg[];
   allowedDomain: string | null;
-  a2aSecret?: string | null;
+  /**
+   * Whether the active org has an A2A secret. The value itself is never part
+   * of this payload — owners/admins fetch it on demand from
+   * `GET /_agent-native/org/a2a-secret`.
+   */
+  a2aSecretSet?: boolean;
 }
 
 export interface OrgMember {

package/src/provider-api/index.ts

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 
 import type { WorkspaceConnectionTemplateUse } from "../connections/catalog.js";
 import {
+  describeCredentialScopeGap,
   resolveCredential,
   type CredentialContext,
 } from "../credentials/index.js";
@@ -3976,10 +3977,14 @@ async function resolveAnyCredential(options: {
     const credential = await resolveOptionalCredential({ ...options, key });
     if (credential?.value) return credential;
   }
+  const scopeGap = await describeCredentialScopeGap(
+    options.keys,
+    options.ctx,
+  ).catch(() => null);
   throw new Error(
     `${options.provider} credential not configured. Tried: ${options.keys.join(
       ", ",
-    )}`,
+    )}${scopeGap ? `. ${scopeGap}` : ""}`,
   );
 }