@agent-native/core 0.144.3 → 0.145.1

package/dist/framework-tools.d.ts

@@ -0,0 +1,126 @@
+import { type DatabaseToolsOption } from "./scripts/db/tool-mode.js";
+/**
+ * Optional framework tool groups an app can turn off through `frameworkTools`.
+ *
+ * Each name is also stamped onto the group's actions as
+ * `ActionEntry.frameworkGroup`. That tag is what lets a single filter subtract a
+ * group from every agent tool surface at once: `agent-chat-plugin.ts` spreads
+ * these registries at thirteen separate composition sites (interactive chat,
+ * dev, MCP-full, A2A, background jobs, triggers), and a per-site condition would
+ * be the same omission waiting to happen thirteen times.
+ *
+ * The tag has a second job: framework-tagged actions are excluded from the
+ * DEFAULT first-request tool list, so an app pays for the ~40 kit schemas only
+ * when it names them in `initialToolNames`. They stay in the searchable registry
+ * either way.
+ */
+export declare const FRAMEWORK_TOOL_GROUPS: readonly ["sharing", "review", "history", "featureFlags", "localization", "audit", "contextXray", "userProfile", "automation", "docs", "resources", "web", "workspaceApps", "chat", "email"];
+export type FrameworkToolGroup = (typeof FRAMEWORK_TOOL_GROUPS)[number];
+/**
+ * Per-group switches for the framework's own agent tools. Every group defaults
+ * to today's behavior, so omitting this option leaves the tool surface
+ * byte-identical.
+ *
+ * Turning a group off removes it from the agent surfaces only — interactive
+ * chat, MCP, A2A, and background runs. The matching HTTP action routes stay
+ * mounted (see `httpActions` in `agent-chat-plugin.ts`) because the UI reaches
+ * them through client hooks; a flag meant to trim the model's tool list must not
+ * 404 the share dialog.
+ *
+ * Note the parity cost before disabling one: the framework's contract is that
+ * anything the UI can do, the agent can do. `sharing: false` on an app that
+ * still renders `ShareButton` breaks that on purpose, and only makes sense when
+ * the app has no such surface at all.
+ */
+export interface FrameworkToolsOption {
+    /** Raw SQL tools. `"read"` (default) exposes `db-schema`/`db-query`;
+     *  `"write"` adds `db-exec`/`db-patch`; `"off"` exposes neither. */
+    database?: DatabaseToolsOption;
+    /** Extension management (`create-extension`, `update-extension`, …).
+     *  Defaults to false — only apps that intentionally let the agent build
+     *  sandboxed mini-apps should enable it. */
+    extensions?: boolean;
+    /** `share-resource`, `unshare-resource`, `list-resource-shares`,
+     *  `set-resource-visibility`, `create-agent-resource-link`. */
+    sharing?: boolean;
+    /** The inline review/comment kit (`list-review-comments`,
+     *  `create-review-comment`, `resolve-review-thread`, …). */
+    review?: boolean;
+    /** Version snapshots and restore (`create-resource-version`,
+     *  `list-resource-versions`, `restore-resource-version`, …). */
+    history?: boolean;
+    /** `get-feature-flags`, `list-feature-flags`, `set-feature-flag`. */
+    featureFlags?: boolean;
+    /** `get-localization-preference`, `set-localization-preference`. */
+    localization?: boolean;
+    /** `list-audit-events`, `get-audit-event`, `export-audit-events`. */
+    audit?: boolean;
+    /** Context X-Ray (`context-manifest-get`, `context-pin`, `context-evict`, …). */
+    contextXray?: boolean;
+    /** `get-user-profile`, `update-user-profile`, `change-appearance`. */
+    userProfile?: boolean;
+    /** Recurring jobs, automations, notifications, and progress runs. */
+    automation?: boolean;
+    /** `docs-search` over the bundled framework documentation. */
+    docs?: boolean;
+    /** The `resources` tool — workspace notes, memory, and context files. */
+    resources?: boolean;
+    /** `web-request` and `web-search`. */
+    web?: boolean;
+    /** `describe-workspace-apps` and `call-agent` for cross-app delegation. */
+    workspaceApps?: boolean;
+    /** `chat-history`, `manage-agent-engine`, `manage-agent-loop-settings`. */
+    chat?: boolean;
+    /** `core-send-email`. */
+    email?: boolean;
+    /** `"minimal"` turns every group above off, for voice-first and
+     *  single-purpose apps that want the template's own actions and nothing else.
+     *  Any explicit group key wins over the preset, so
+     *  `{ preset: "minimal", resources: true }` keeps exactly one group. */
+    preset?: "minimal";
+}
+export type FrameworkToolsConfig = FrameworkToolsOption | "minimal";
+export interface FrameworkToolsInput {
+    frameworkTools?: FrameworkToolsConfig;
+    /** @deprecated Use `frameworkTools.database`. */
+    databaseTools?: DatabaseToolsOption;
+    /** @deprecated Use `frameworkTools.extensions`. */
+    extensionTools?: boolean;
+}
+export interface ResolvedFrameworkTools {
+    /** Pass-through for `normalizeDatabaseToolsMode`; `undefined` means default. */
+    database: DatabaseToolsOption | undefined;
+    extensions: boolean;
+    disabledGroups: ReadonlySet<FrameworkToolGroup>;
+    isEnabled(group: FrameworkToolGroup): boolean;
+}
+/**
+ * Resolve the public option surface into one shape the plugin threads inward.
+ *
+ * Legacy `databaseTools` / `extensionTools` remain accepted for one minor. When
+ * both forms are present and disagree we throw at plugin init rather than
+ * picking a winner: an app that boots with a tool surface nobody chose is how a
+ * "why can't the agent see db-query" report ends up unexplainable.
+ */
+export declare function resolveFrameworkTools(input: FrameworkToolsInput | undefined): ResolvedFrameworkTools;
+/** Structural view of the one field these helpers read, so tagging utilities
+ *  stay free of an import cycle with `ActionEntry`. */
+interface FrameworkGrouped {
+    frameworkGroup?: FrameworkToolGroup;
+}
+/**
+ * Drop every action belonging to a disabled group. Returns the input untouched
+ * when nothing is disabled so the default path allocates nothing.
+ */
+export declare function filterFrameworkToolGroups<T extends FrameworkGrouped>(actions: Record<string, T>, disabledGroups: ReadonlySet<FrameworkToolGroup>): Record<string, T>;
+/** True for actions the framework contributes rather than the app's own. */
+export declare function isFrameworkGroupedAction(entry: FrameworkGrouped): boolean;
+/**
+ * Whether a group is live, for prompt builders that only receive the disabled
+ * set. Prompt text and tool schemas must agree: a prompt that names a tool the
+ * request does not carry makes the model try it, fail, and often report the
+ * capability as nonexistent — so every block naming a group's tool by name has
+ * to be gated on the same set that gates the registry.
+ */
+export declare function frameworkGroupEnabled(disabledGroups: ReadonlySet<FrameworkToolGroup> | undefined, group: FrameworkToolGroup): boolean;
+export {};

package/dist/framework-tools.js

@@ -0,0 +1,114 @@
+import { normalizeDatabaseToolsMode, } from "./scripts/db/tool-mode.js";
+/**
+ * Optional framework tool groups an app can turn off through `frameworkTools`.
+ *
+ * Each name is also stamped onto the group's actions as
+ * `ActionEntry.frameworkGroup`. That tag is what lets a single filter subtract a
+ * group from every agent tool surface at once: `agent-chat-plugin.ts` spreads
+ * these registries at thirteen separate composition sites (interactive chat,
+ * dev, MCP-full, A2A, background jobs, triggers), and a per-site condition would
+ * be the same omission waiting to happen thirteen times.
+ *
+ * The tag has a second job: framework-tagged actions are excluded from the
+ * DEFAULT first-request tool list, so an app pays for the ~40 kit schemas only
+ * when it names them in `initialToolNames`. They stay in the searchable registry
+ * either way.
+ */
+export const FRAMEWORK_TOOL_GROUPS = [
+    "sharing",
+    "review",
+    "history",
+    "featureFlags",
+    "localization",
+    "audit",
+    "contextXray",
+    "userProfile",
+    "automation",
+    "docs",
+    "resources",
+    "web",
+    "workspaceApps",
+    "chat",
+    "email",
+];
+function normalizeFrameworkToolsConfig(config) {
+    if (config === "minimal")
+        return { option: {}, minimal: true };
+    if (!config || typeof config !== "object") {
+        return { option: {}, minimal: false };
+    }
+    const { preset, ...option } = config;
+    return { option, minimal: preset === "minimal" };
+}
+function conflict(key, legacyKey, legacyValue, nestedValue) {
+    throw new Error(`[agent-native] Conflicting agent-chat options: \`${legacyKey}: ${JSON.stringify(legacyValue)}\` ` +
+        `and \`frameworkTools.${key}: ${JSON.stringify(nestedValue)}\` disagree. ` +
+        `Remove the deprecated \`${legacyKey}\` and keep \`frameworkTools.${key}\`.`);
+}
+/**
+ * Resolve the public option surface into one shape the plugin threads inward.
+ *
+ * Legacy `databaseTools` / `extensionTools` remain accepted for one minor. When
+ * both forms are present and disagree we throw at plugin init rather than
+ * picking a winner: an app that boots with a tool surface nobody chose is how a
+ * "why can't the agent see db-query" report ends up unexplainable.
+ */
+export function resolveFrameworkTools(input) {
+    const { option, minimal } = normalizeFrameworkToolsConfig(input?.frameworkTools);
+    const legacyDatabase = input?.databaseTools;
+    if (legacyDatabase !== undefined) {
+        if (option.database !== undefined &&
+            normalizeDatabaseToolsMode(legacyDatabase) !==
+                normalizeDatabaseToolsMode(option.database)) {
+            conflict("database", "databaseTools", legacyDatabase, option.database);
+        }
+        console.warn("[agent-native] `databaseTools` is deprecated — use `frameworkTools: { database: … }`.");
+    }
+    const legacyExtensions = input?.extensionTools;
+    if (legacyExtensions !== undefined) {
+        if (option.extensions !== undefined &&
+            (legacyExtensions === true) !== (option.extensions === true)) {
+            conflict("extensions", "extensionTools", legacyExtensions, option.extensions);
+        }
+        console.warn("[agent-native] `extensionTools` is deprecated — use `frameworkTools: { extensions: … }`.");
+    }
+    const database = option.database ?? legacyDatabase ?? (minimal ? "off" : undefined);
+    const extensions = option.extensions ?? legacyExtensions ?? false;
+    const disabledGroups = new Set();
+    for (const group of FRAMEWORK_TOOL_GROUPS) {
+        const explicit = option[group];
+        if (explicit === false || (explicit === undefined && minimal)) {
+            disabledGroups.add(group);
+        }
+    }
+    return {
+        database,
+        extensions,
+        disabledGroups,
+        isEnabled: (group) => !disabledGroups.has(group),
+    };
+}
+/**
+ * Drop every action belonging to a disabled group. Returns the input untouched
+ * when nothing is disabled so the default path allocates nothing.
+ */
+export function filterFrameworkToolGroups(actions, disabledGroups) {
+    if (disabledGroups.size === 0)
+        return actions;
+    return Object.fromEntries(Object.entries(actions).filter(([, entry]) => entry.frameworkGroup === undefined ||
+        !disabledGroups.has(entry.frameworkGroup)));
+}
+/** True for actions the framework contributes rather than the app's own. */
+export function isFrameworkGroupedAction(entry) {
+    return entry.frameworkGroup !== undefined;
+}
+/**
+ * Whether a group is live, for prompt builders that only receive the disabled
+ * set. Prompt text and tool schemas must agree: a prompt that names a tool the
+ * request does not carry makes the model try it, fail, and often report the
+ * capability as nonexistent — so every block naming a group's tool by name has
+ * to be gated on the same set that gates the registry.
+ */
+export function frameworkGroupEnabled(disabledGroups, group) {
+    return !disabledGroups?.has(group);
+}

package/dist/notifications/routes.d.ts

@@ -16,18 +16,18 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
     error?: undefined;
     ok?: undefined;
 } | {
+    count?: undefined;
     updated: number;
     error?: undefined;
     ok?: undefined;
-    count?: undefined;
 } | {
+    count?: undefined;
     updated?: undefined;
     error: string;
     ok?: undefined;
-    count?: undefined;
 } | {
+    count?: undefined;
     updated?: undefined;
     ok: boolean;
     error?: undefined;
-    count?: undefined;
 }>>;

package/dist/org/accept-pending.js

@@ -1,6 +1,6 @@
 import { getDbExec } from "../db/client.js";
 import { setActiveOrgId } from "./active-org.js";
-import { invalidateRequestMemberOrgIds } from "./request-org-cache.js";
+import { invalidateMemberOrgCaches } from "./request-org-cache.js";
 const nanoid = () => globalThis.crypto?.randomUUID?.().replace(/-/g, "") ??
     Math.random().toString(36).slice(2) + Date.now().toString(36);
 /**
@@ -63,7 +63,7 @@ export async function acceptPendingInvitationsForEmail(rawEmail) {
               ON CONFLICT (org_id, LOWER(email)) DO NOTHING`,
                 args: [nanoid(), inv.orgId, email, role, Date.now()],
             });
-            invalidateRequestMemberOrgIds();
+            invalidateMemberOrgCaches();
         }
         await db.execute({
             sql: `UPDATE org_invitations SET status = 'accepted' WHERE id = ?`,

package/dist/org/auth-policy.js

@@ -1,4 +1,5 @@
 import { getDbExec } from "../db/client.js";
+import { invalidateSessionEmailCache } from "../server/session-email-cache.js";
 export const GOOGLE_AUTH_REQUIRED_MESSAGE = "This organization requires Google sign-in.";
 function normalizeEmail(email) {
     return email.trim().toLowerCase();
@@ -152,6 +153,9 @@ export async function setRequiredAuthProvider(orgId, provider) {
         if (!isMissingLegacySessionTable(error))
             throw error;
     }
+    // Revoking a whole org's sessions must land immediately, not after the
+    // resolution cache's TTL.
+    invalidateSessionEmailCache();
     return {
         revokedBetterAuthSessions: Number(betterAuthResult.rowsAffected ?? 0),
         revokedLegacySessions: Number(legacyResult.rowsAffected ?? 0),

package/dist/org/auto-join-domain.d.ts

@@ -4,6 +4,15 @@ export interface AutoJoinDomainResult {
     }>;
     activeOrgId: string | null;
 }
+/**
+ * Call after any write that could make a domain start matching an org —
+ * `organizations.allowed_domain` updates and org creation. Clears every domain
+ * rather than one: the caller knows which org changed, not which domains a
+ * stale negative was recorded for.
+ */
+export declare function invalidateDomainMatchCache(): void;
+/** Test seam — the cache is module state, so suites must be able to clear it. */
+export declare function __resetDomainMatchCacheForTests(): void;
 export interface AutoJoinDomainOptions {
     /**
      * The signup hook should not clobber an org selected by an invite flow, but

package/dist/org/auto-join-domain.js

@@ -1,9 +1,46 @@
 import { getDbExec } from "../db/client.js";
 import { getUserSetting } from "../settings/user-settings.js";
+import { createTtlCache } from "../shared/ttl-cache.js";
 import { setActiveOrgId } from "./active-org.js";
-import { invalidateRequestMemberOrgIds } from "./request-org-cache.js";
+import { isFreeEmailProvider } from "./free-email-providers.js";
+import { invalidateMemberOrgCaches } from "./request-org-cache.js";
 const nanoid = () => globalThis.crypto?.randomUUID?.().replace(/-/g, "") ??
     Math.random().toString(36).slice(2) + Date.now().toString(36);
+/**
+ * Negative cache for "no org has this email domain as its `allowed_domain`".
+ *
+ * `resolveOrgContext` calls this function on EVERY authenticated request for
+ * any account that holds no membership in a domain-matched org — which is every
+ * solo user and every user in a team org that never configured domain matching.
+ * The probe finds nothing, changes no state, and runs again on the next
+ * request: production showed 318k of these, ~64% of all authenticated requests,
+ * with no fixed point because not-joining an org is not a state the user can
+ * leave.
+ *
+ * Keyed on the DOMAIN, not the email, so one entry covers every account at that
+ * domain. Only a SUCCESSFUL zero-row read is cached — a failed probe stays on
+ * the uncached path so an unreadable `organizations` table never masquerades as
+ * "no matching org". Invalidated whenever `allowed_domain` is written, so
+ * correctness does not rest on the TTL.
+ */
+const NO_DOMAIN_MATCH_TTL_MS = 60_000;
+const noDomainMatchCache = createTtlCache({
+    ttlMs: NO_DOMAIN_MATCH_TTL_MS,
+    maxEntries: 512,
+});
+/**
+ * Call after any write that could make a domain start matching an org —
+ * `organizations.allowed_domain` updates and org creation. Clears every domain
+ * rather than one: the caller knows which org changed, not which domains a
+ * stale negative was recorded for.
+ */
+export function invalidateDomainMatchCache() {
+    noDomainMatchCache.clear();
+}
+/** Test seam — the cache is module state, so suites must be able to clear it. */
+export function __resetDomainMatchCacheForTests() {
+    noDomainMatchCache.clear();
+}
 /**
  * Auto-join a newly-signed-up user into every org whose `allowed_domain`
  * matches their email domain.
@@ -31,6 +68,14 @@ export async function autoJoinDomainMatchingOrgs(rawEmail, options = {}) {
     const domain = email.split("@")[1]?.toLowerCase();
     if (!domain)
         return { joined: [], activeOrgId: null };
+    // `org/handlers.ts` REFUSES to set `allowed_domain` to a free provider, so no
+    // org can ever match `gmail.com` — every consumer-email account was probing
+    // for a row that is structurally impossible to exist.
+    if (isFreeEmailProvider(domain))
+        return { joined: [], activeOrgId: null };
+    if (noDomainMatchCache.get(domain)) {
+        return { joined: [], activeOrgId: null };
+    }
     const db = getDbExec();
     let matches = [];
     try {
@@ -53,11 +98,15 @@ export async function autoJoinDomainMatchingOrgs(rawEmail, options = {}) {
     }
     catch {
         // Template without org tables (or `allowed_domain` column not yet
-        // migrated). Not fatal — return empty.
+        // migrated). Not fatal — return empty. Deliberately NOT cached: this branch
+        // cannot tell "no org matches" from "the table was unreadable", and caching
+        // it would let one blip answer every later request for a minute.
         return { joined: [], activeOrgId: null };
     }
-    if (matches.length === 0)
+    if (matches.length === 0) {
+        noDomainMatchCache.set(domain, true);
         return { joined: [], activeOrgId: null };
+    }
     const joined = [];
     for (const m of matches) {
         try {
@@ -66,7 +115,7 @@ export async function autoJoinDomainMatchingOrgs(rawEmail, options = {}) {
                 args: [nanoid(), m.orgId, email, Date.now()],
             });
             joined.push({ orgId: m.orgId });
-            invalidateRequestMemberOrgIds();
+            invalidateMemberOrgCaches();
         }
         catch {
             // Race with a parallel join (e.g. user accepted an invite to the

package/dist/org/context.js

@@ -5,7 +5,8 @@ import { getSetting } from "../settings/store.js";
 import { getUserSetting } from "../settings/user-settings.js";
 import { setActiveOrgId } from "./active-org.js";
 import { autoJoinDomainMatchingOrgs } from "./auto-join-domain.js";
-import { invalidateRequestMemberOrgIds, requestMemberOrgIds, } from "./request-org-cache.js";
+import { isFreeEmailProvider } from "./free-email-providers.js";
+import { cachedMemberships, invalidateMemberOrgCaches, requestMemberOrgIds, } from "./request-org-cache.js";
 const EMPTY_CONTEXT = {
     email: "",
     orgId: null,
@@ -197,8 +198,13 @@ async function resolveOrgContextUncached(event) {
     // signal. Recognizing the personal workspace by its *name* instead breaks the
     // moment the provider display name or the workspace name changes, which
     // strands an existing user in Personal with no way into their company org.
+    // `isFreeEmailProvider` short-circuits before the round trip rather than
+    // relying on the negative cache inside `autoJoinDomainMatchingOrgs`: a
+    // consumer-email domain can NEVER match (see `org/handlers.ts`, which refuses
+    // to set `allowed_domain` to a free provider), so it needs no TTL at all.
     const shouldTryDomainAutoJoin = !explicitPersonal &&
         emailDomain !== null &&
+        !isFreeEmailProvider(emailDomain) &&
         !memberships.some((m) => m.allowedDomain?.toLowerCase() === emailDomain);
     if (!explicitPersonal &&
         activeOrgSetting?.orgId &&
@@ -307,6 +313,9 @@ async function resolveOrgContextUncached(event) {
  */
 const MEMBERSHIP_FALLBACK_ORDER_BY = `ORDER BY joined_at ASC, org_id ASC`;
 async function loadMemberships(email) {
+    return cachedMemberships(email, () => loadMembershipsUncached(email));
+}
+async function loadMembershipsUncached(email) {
     const rows = await queryOrgMembers({
         sql: `SELECT m.org_id AS "orgId", m.role AS role, o.name AS "orgName",
                  o.allowed_domain AS "allowedDomain"
@@ -403,7 +412,7 @@ export async function createOrganization(name, email, role = "owner") {
         sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,
         args: [nanoid(), id, email, role, createdAt],
     });
-    invalidateRequestMemberOrgIds();
+    invalidateMemberOrgCaches();
     await warnOnAdditionalOrganization(exec, email, id, trimmedName);
     await setActiveOrgId(email, id, `created organization "${trimmedName}"`);
     return { id, name: trimmedName, role, a2aSecret, createdAt };
@@ -558,7 +567,7 @@ async function tryCreateDefaultOrg(exec, email, session) {
             sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,
             args: [nanoid(), orgId, email, "owner", now],
         });
-        invalidateRequestMemberOrgIds();
+        invalidateMemberOrgCaches();
         await setActiveOrgId(email, orgId, "auto-created default organization");
         return { email, orgId, orgName, role: "owner" };
     }

package/dist/org/handlers.js

@@ -37,9 +37,10 @@ import { sendEmail, isEmailConfigured } from "../server/email.js";
 import { readBody } from "../server/h3-helpers.js";
 import { setActiveOrgId } from "./active-org.js";
 import { setRequiredAuthProvider } from "./auth-policy.js";
+import { invalidateDomainMatchCache } from "./auto-join-domain.js";
 import { getOrgContext, createOrganization } from "./context.js";
 import { isFreeEmailProvider } from "./free-email-providers.js";
-import { invalidateRequestMemberOrgIds } from "./request-org-cache.js";
+import { invalidateMemberOrgCaches } from "./request-org-cache.js";
 import { parseWorkspaceUrl } from "./workspace-url.js";
 function getInviteAppUrl(event) {
     return getAppProductionUrl(event);
@@ -426,7 +427,7 @@ export const acceptInvitationHandler = defineEventHandler(async (event) => {
         sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,
         args: [nanoid(), invOrgId, email, inviteRole, Date.now()],
     });
-    invalidateRequestMemberOrgIds();
+    invalidateMemberOrgCaches();
     await e.execute({
         sql: `UPDATE org_invitations SET status = 'accepted' WHERE id = ?`,
         args: [invitationId],
@@ -487,7 +488,7 @@ export const removeMemberHandler = defineEventHandler(async (event) => {
         sql: `DELETE FROM org_members WHERE org_id = ? AND LOWER(email) = ?`,
         args: [ctx.orgId, memberEmailLower],
     });
-    invalidateRequestMemberOrgIds();
+    invalidateMemberOrgCaches();
     return { success: true };
 });
 /**
@@ -555,6 +556,7 @@ export const changeMemberRoleHandler = defineEventHandler(async (event) => {
         sql: `UPDATE org_members SET role = ? WHERE org_id = ? AND LOWER(email) = ?`,
         args: [role, ctx.orgId, memberEmailLower],
     });
+    invalidateMemberOrgCaches();
     return { email: memberEmailLower, role };
 });
 /** PATCH /_agent-native/org — rename the current organization (owner/admin only) */
@@ -582,6 +584,9 @@ export const updateOrgHandler = defineEventHandler(async (event) => {
         sql: `UPDATE organizations SET name = ? WHERE id = ?`,
         args: [name, ctx.orgId],
     });
+    // `orgName` is joined into the cached membership rows, so a rename that skips
+    // this leaves every member's org context showing the old name for the TTL.
+    invalidateMemberOrgCaches();
     return { orgId: ctx.orgId, name };
 });
 /**
@@ -661,7 +666,7 @@ export const deleteOrgHandler = defineEventHandler(async (event) => {
             message: "Organization deletion requires atomic database support",
         });
     }
-    invalidateRequestMemberOrgIds();
+    invalidateMemberOrgCaches();
     const nextRes = await e.execute({
         sql: `SELECT org_id AS "orgId" FROM org_members WHERE LOWER(email) = ? LIMIT 1`,
         args: [ctx.email.toLowerCase()],
@@ -744,7 +749,7 @@ export const joinByDomainHandler = defineEventHandler(async (event) => {
         sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, 'member', ?)`,
         args: [nanoid(), orgId, email, Date.now()],
     });
-    invalidateRequestMemberOrgIds();
+    invalidateMemberOrgCaches();
     await setActiveOrgId(email, orgId, "joined domain-matched organization");
     return {
         orgId,
@@ -813,6 +818,13 @@ export const setDomainHandler = defineEventHandler(async (event) => {
         sql: `UPDATE organizations SET allowed_domain = ? WHERE id = ?`,
         args: [raw, ctx.orgId],
     });
+    // A domain that previously matched nothing now matches this org. Without this
+    // the negative cache keeps every account at that domain out of it for the
+    // rest of the TTL, right after an owner deliberately turned domain-join on.
+    invalidateDomainMatchCache();
+    // `allowedDomain` is joined into the cached membership rows too, and existing
+    // members read it to decide whether a domain auto-join is still needed.
+    invalidateMemberOrgCaches();
     return { domain: raw };
 });
 /**

package/dist/org/request-org-cache.d.ts

@@ -6,10 +6,32 @@
  */
 export declare function requestMemberOrgIds(email: string, load: () => Promise<string[] | null>): Promise<string[] | null>;
 /**
- * Drop this request's memoized memberships after a write to `org_members`.
+ * Read `email`'s memberships through the process cache, falling back to `load`.
+ *
+ * `load` returning `null`/empty-on-failure is the caller's contract to signal
+ * "unreadable"; pass `cacheable: false` for such a result and it is not stored.
+ */
+export declare function cachedMemberships<T>(email: string, load: () => Promise<T[] | null>): Promise<T[] | null>;
+/**
+ * Drop the memoized memberships after a write to `org_members`, in BOTH the
+ * per-request memo and the cross-request cache.
+ *
  * Clears every email rather than one: deleting an organization or removing a
  * member changes the answer for accounts other than the one being written.
  * Requests already in flight elsewhere keep their own snapshot for the rest of
  * their (short) lifetime, the same tradeoff the settings cache documents.
+ *
+ * Every membership write must route through here. A caller that clears only the
+ * request memo leaves the process cache serving the pre-write answer for the
+ * rest of the TTL — the user joins an org and the app keeps insisting they
+ * haven't.
+ *
+ * "Membership write" is wider than `INSERT`/`DELETE org_members`: the cached
+ * rows are a JOIN, so `org_members.role` and the `organizations.name` /
+ * `organizations.allowed_domain` columns it selects are cached too. Demoting an
+ * admin, renaming an org, or turning domain-join on without calling this keeps
+ * the pre-write answer authorizing and rendering requests until the TTL lapses.
  */
-export declare function invalidateRequestMemberOrgIds(): void;
+export declare function invalidateMemberOrgCaches(): void;
+/** Test seam — the process cache is module state, so suites must clear it. */
+export declare function __resetProcessMemberOrgCacheForTests(): void;

package/dist/org/request-org-cache.js

@@ -1,4 +1,5 @@
 import { getRequestContext } from "../server/request-context.js";
+import { createTtlCache } from "../shared/ttl-cache.js";
 /**
  * Per-request memo of the `org_members` read behind `resolveOrgIdForEmail`,
  * keyed on the active AsyncLocalStorage `RequestContext` (WeakMap → freed with
@@ -50,12 +51,66 @@ export function requestMemberOrgIds(email, load) {
     return pending;
 }
 /**
- * Drop this request's memoized memberships after a write to `org_members`.
+ * Cross-request cache for the full membership rows behind `getOrgContext`.
+ *
+ * The per-request memo above only collapses repeated reads inside ONE request.
+ * Every authenticated request still paid its own `org_members` round trip, and
+ * production showed 494,785 of them — one per request, 1:1 with the session
+ * lookup, for memberships that change on the order of days.
+ *
+ * Only a SUCCESSFUL read is stored. `loadMemberships` returns `null` for an
+ * unreadable `org_members` (no such table on a template that skips the org
+ * module, a role without SELECT); caching that would turn a permissions blip
+ * into a minute of silently org-less requests, which drops org scope and hides
+ * every org-scoped credential behind a permanent-sounding "not configured".
+ */
+const MEMBER_ORGS_TTL_MS = 15_000;
+const processMemberships = createTtlCache({
+    ttlMs: MEMBER_ORGS_TTL_MS,
+    maxEntries: 2_048,
+});
+/**
+ * Read `email`'s memberships through the process cache, falling back to `load`.
+ *
+ * `load` returning `null`/empty-on-failure is the caller's contract to signal
+ * "unreadable"; pass `cacheable: false` for such a result and it is not stored.
+ */
+export async function cachedMemberships(email, load) {
+    const key = email.trim().toLowerCase();
+    const hit = processMemberships.get(key);
+    if (hit)
+        return hit;
+    const rows = await load();
+    // `null` is "unreadable", never "no memberships" — see the doc comment above.
+    if (rows !== null)
+        processMemberships.set(key, rows);
+    return rows;
+}
+/**
+ * Drop the memoized memberships after a write to `org_members`, in BOTH the
+ * per-request memo and the cross-request cache.
+ *
  * Clears every email rather than one: deleting an organization or removing a
  * member changes the answer for accounts other than the one being written.
  * Requests already in flight elsewhere keep their own snapshot for the rest of
  * their (short) lifetime, the same tradeoff the settings cache documents.
+ *
+ * Every membership write must route through here. A caller that clears only the
+ * request memo leaves the process cache serving the pre-write answer for the
+ * rest of the TTL — the user joins an org and the app keeps insisting they
+ * haven't.
+ *
+ * "Membership write" is wider than `INSERT`/`DELETE org_members`: the cached
+ * rows are a JOIN, so `org_members.role` and the `organizations.name` /
+ * `organizations.allowed_domain` columns it selects are cached too. Demoting an
+ * admin, renaming an org, or turning domain-join on without calling this keeps
+ * the pre-write answer authorizing and rendering requests until the TTL lapses.
  */
-export function invalidateRequestMemberOrgIds() {
+export function invalidateMemberOrgCaches() {
     cacheForRequest(false)?.clear();
+    processMemberships.clear();
+}
+/** Test seam — the process cache is module state, so suites must clear it. */
+export function __resetProcessMemberOrgCacheForTests() {
+    processMemberships.clear();
 }