@agent-native/core 0.201.0-nightly-20261005153421 → 0.201.0

package/dist/client/session-replay.js

@@ -1,4 +1,5 @@
 import { SESSION_REPLAY_IFRAME_ATTRIBUTE, SESSION_REPLAY_IFRAME_PROBE, SESSION_REPLAY_IFRAME_START, SESSION_REPLAY_IFRAME_STOP, } from "../session-replay-iframe-protocol.js";
+import { resolveLaneEndpoint } from "../shared/environment-lanes.js";
 import { loadOptionalPeer, OptionalPeerDependencyError, } from "../shared/optional-peer.js";
 import { isSyntheticTrafficValue } from "../shared/test-traffic.js";
 import { getOrCreateAnalyticsAnonymousId, getOrCreateAnalyticsSessionId, } from "./analytics-session.js";
@@ -535,13 +536,13 @@ function normalizeOptions(options) {
             ?.VITE_AGENT_NATIVE_ANALYTICS_PUBLIC_KEY;
     if (!publicKey)
         return null;
-    const endpoint = options.endpoint ||
+    const endpoint = resolveLaneEndpoint(options.endpoint ||
         readFirstEnvString([
             "VITE_AGENT_NATIVE_ANALYTICS_REPLAY_ENDPOINT",
             "VITE_AGENT_NATIVE_SESSION_REPLAY_ENDPOINT",
             "VITE_SESSION_REPLAY_INGEST_URL",
         ]) ||
-        defaultReplayEndpoint();
+        defaultReplayEndpoint(), typeof window !== "undefined" ? window.location.hostname : undefined);
     const maxDurationMs = options.maxDurationMs ??
         readFirstEnvNumber([
             "VITE_AGENT_NATIVE_SESSION_REPLAY_MAX_DURATION_MS",

package/dist/identity/offboard.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { ensureAuditTables } from "../audit/store.js";
 import { resolveIdentityColumns, sessionUserColumn, } from "./rekey.js";
+import { identityCredentialLockKey } from "./retired-emails.js";
 const quote = (identifier) => `"${identifier.replaceAll('"', '""')}"`;
 const ATTRIBUTION_COLUMNS = new Set([
     "created_by",
@@ -13,11 +14,14 @@ const ATTRIBUTION_COLUMNS = new Set([
  * What offboarding does to one registered column. App declarations state it;
  * framework entries derive it from their mode. `separate` columns have a
  * dedicated step in offboardMember (owner sweep, groups, OAuth, roles,
- * memberships) instead of the generic loop.
+ * memberships) instead of the generic loop. An `owner_email` column with a
+ * non-transfer policy (credentials, grants) leaves the owner sweep for it.
  */
 function offboardAction(entry) {
     if (entry.column === "owner_email")
-        return entry.offboard === "delete" ? "delete" : "separate";
+        return entry.offboard && entry.offboard !== "transfer"
+            ? entry.offboard
+            : "separate";
     if (entry.offboard)
         return entry.offboard;
     if (entry.table === "user" ||
@@ -54,6 +58,12 @@ export async function offboardMember(db, email, options) {
     await ensureAuditTables();
     const run = async (tx) => {
         const orgId = options.orgId?.trim() || null;
+        // Personal issuance has no membership row to wait on; this lock makes an
+        // in-flight issuer commit before the sweep or find its grant swept.
+        await tx.execute({
+            sql: "SELECT pg_advisory_xact_lock(hashtextextended(?, 0::bigint))",
+            args: [identityCredentialLockKey(oldEmail)],
+        });
         const successor = await tx.execute({
             sql: orgId
                 ? `SELECT 1 FROM org_members
@@ -67,6 +77,13 @@ export async function offboardMember(db, email, options) {
             throw new Error(orgId
                 ? "Transfer target must be an active member of the organization"
                 : "Transfer target does not exist");
+        // An earlier issuer may also prepare its credential tables. Take the
+        // authoritative schema snapshot only after its membership fence releases.
+        await tx.execute({
+            sql: `SELECT id FROM org_members WHERE LOWER(email) = ?${orgId ? " AND org_id = ?" : ""}
+            ORDER BY org_id, id FOR UPDATE`,
+            args: orgId ? [oldEmail, orgId] : [oldEmail],
+        });
         const schema = await tx.execute({
             sql: `SELECT table_name, column_name FROM information_schema.columns
             WHERE table_schema = 'public'
@@ -210,6 +227,15 @@ export async function offboardMember(db, email, options) {
                     args: [...match.args, ...scope.args],
                 });
             }
+            else if (action === "revoke") {
+                if (!columns.has("revoked_at"))
+                    throw new Error(`${entry.table}.revoked_at is missing; refusing an offboard that cannot revoke ${entry.table} credentials.`);
+                result = await tx.execute({
+                    sql: `UPDATE ${quote(entry.table)} SET "revoked_at" = ?
+                WHERE LOWER(${column}) = ? AND "revoked_at" IS NULL${scope.sql}`,
+                    args: [Date.now(), oldEmail, ...scope.args],
+                });
+            }
             else if (entry.mode === "owner" ||
                 entry.mode === "typed-scope" ||
                 entry.mode === "custom-scope" ||
@@ -315,5 +341,7 @@ export async function offboardMember(db, email, options) {
         });
         return counts;
     };
-    return db.transaction ? db.transaction(run) : run(db);
+    if (!db.transaction)
+        throw new Error("Interactive transactions are unavailable");
+    return db.transaction(run);
 }

package/dist/identity/rekey.d.ts

@@ -16,7 +16,12 @@ export type IdentityColumn = {
     orgScope?: IdentityOrgScope;
 };
 export type IdentityEmailChange = "rekey" | "delete" | "retain";
-export type IdentityOffboard = "transfer" | "delete" | "retain";
+/**
+ * `revoke` sets `revoked_at` (epoch milliseconds) on rows not yet revoked. Use
+ * it for credential registries whose readers treat a missing row as "not
+ * revoked", where deleting the row would re-enable the credential.
+ */
+export type IdentityOffboard = "transfer" | "delete" | "revoke" | "retain";
 export type IdentityOrgScope = {
     column: string;
 } | {
@@ -46,6 +51,12 @@ export type AppIdentityColumn = {
     /** Why this policy is right for the data. Required so every declaration is a visible decision. */
     reason: string;
 };
+/**
+ * Framework identity columns. `owner_email` rows transfer to the successor on
+ * offboarding unless the entry says otherwise. Credentials say `delete` or
+ * `revoke`, because a transferred credential lets the removed member act as
+ * the successor. rekey.spec.ts pins that list.
+ */
 export declare const IDENTITY_REKEY_COLUMNS: readonly IdentityColumn[];
 export declare const IDENTITY_REKEY_IGNORED_COLUMNS: Set<string>;
 /**

package/dist/identity/rekey.js

@@ -3,6 +3,13 @@ import { jwtVerify } from "jose";
 import { AGENT_AUDIT_LOG_CREATE_SQL } from "../audit/store.js";
 import { decryptSecretValue, encryptSecretValue, isEncryptedSecretValue, } from "../secrets/crypto.js";
 import { createTtlCache } from "../shared/ttl-cache.js";
+import { IDENTITY_RETIRED_EMAILS_CREATE_SQL, identityCredentialLockKey, } from "./retired-emails.js";
+/**
+ * Framework identity columns. `owner_email` rows transfer to the successor on
+ * offboarding unless the entry says otherwise. Credentials say `delete` or
+ * `revoke`, because a transferred credential lets the removed member act as
+ * the successor. rekey.spec.ts pins that list.
+ */
 export const IDENTITY_REKEY_COLUMNS = [
     { table: "user", column: "email" },
     { table: "invitation", column: "email" },
@@ -101,11 +108,28 @@ export const IDENTITY_REKEY_COLUMNS = [
     { table: "integration_remote_push_notifications", column: "owner_email" },
     { table: "integration_conversation_scopes", column: "owner_email" },
     { table: "integration_usage_budgets", column: "owner_email" },
-    { table: "mcp_device_codes", column: "owner_email" },
-    { table: "mcp_connect_tokens", column: "owner_email" },
+    { table: "mcp_device_codes", column: "owner_email", offboard: "delete" },
+    // A missing connect-token row reads as "not revoked", so revoke, never delete.
+    { table: "mcp_connect_tokens", column: "owner_email", offboard: "revoke" },
     { table: "mcp_connect_tokens", column: "created_by" },
-    { table: "mcp_oauth_codes", column: "owner_email" },
-    { table: "mcp_oauth_refresh_tokens", column: "owner_email" },
+    { table: "mcp_oauth_codes", column: "owner_email", offboard: "delete" },
+    {
+        table: "mcp_oauth_codes",
+        column: "issued_for_email",
+        emailChange: "retain",
+        offboard: "retain",
+    },
+    {
+        table: "mcp_oauth_refresh_tokens",
+        column: "owner_email",
+        offboard: "revoke",
+    },
+    {
+        table: "mcp_oauth_refresh_tokens",
+        column: "issued_for_email",
+        emailChange: "retain",
+        offboard: "retain",
+    },
     { table: "notifications", column: "owner", mode: "owner" },
     { table: "progress_runs", column: "owner", mode: "owner" },
     { table: "provider_corpus_jobs", column: "owner_email" },
@@ -167,6 +191,7 @@ export const IDENTITY_REKEY_IGNORED_COLUMNS = new Set([
     "identity_rekeys.old_email",
     "identity_rekeys.new_email",
     "identity_rekeys.actor_email",
+    "identity_retired_emails.email",
     // Actor kind enum ('user' | 'agent' | 'system'), not an address.
     "context_directives.created_by",
     "resources.created_by",
@@ -214,7 +239,9 @@ export function registerIdentityColumns(columns) {
         if (!entry.reason?.trim())
             throw new Error(`Identity column ${key} needs a reason.`);
         if (entry.mode === "secret-scope" &&
-            (entry.emailChange === "delete" || entry.offboard === "transfer"))
+            (entry.emailChange === "delete" ||
+                entry.offboard === "transfer" ||
+                entry.offboard === "revoke"))
             throw new Error(`Identity column ${key} is secret-scoped; it can only be rekeyed or retained on email change and deleted or retained on offboard.`);
         if (core.has(key))
             throw new Error(`Identity column ${key} is owned by the framework registry and cannot be redeclared by an app.`);
@@ -651,6 +678,27 @@ async function rekeyPromotedEvalDatasetKeys(db, oldEmail, newEmail, dryRun) {
         await db.unsafe(`UPDATE agent_eval_datasets SET user_id = $1, idempotency_key = $2 WHERE id = $3`, [newEmail, update.nextKey, update.id]);
     }
 }
+async function rekeyOAuthGrantOwners(db, oldEmail, newEmail, counts, dryRun) {
+    const handled = new Set();
+    for (const table of ["mcp_oauth_codes", "mcp_oauth_refresh_tokens"]) {
+        const available = await columns(db, table);
+        if (!available.has("owner_email") || !available.has("issued_for_email"))
+            continue;
+        const rows = await db.unsafe(`SELECT owner_email, issued_for_email FROM ${quote(table)} WHERE LOWER(owner_email) = LOWER($1) FOR UPDATE`, [oldEmail]);
+        counts[`${table}.owner_email`] = rows.length;
+        counts[`${table}.issued_for_email`] = rows.filter((row) => row.issued_for_email === row.owner_email).length;
+        handled.add(`${table}.owner_email`);
+        handled.add(`${table}.issued_for_email`);
+        if (dryRun || !rows.length)
+            continue;
+        // Invalid or legacy bindings must not become valid merely because the
+        // renamed owner happens to match the stored issuance address.
+        const updated = await db.unsafe(`UPDATE ${quote(table)} SET issued_for_email = CASE WHEN issued_for_email = owner_email THEN $2 ELSE NULL END, owner_email = $2 WHERE LOWER(owner_email) = LOWER($1) RETURNING owner_email`, [oldEmail, newEmail]);
+        if (updated.length !== rows.length)
+            throw new Error("OAuth grant ownership changed during email rekey.");
+    }
+    return handled;
+}
 /** Run inside the caller's PostgreSQL transaction. It deliberately refuses credential and derived-key stores it cannot safely rewrite. */
 export async function rekeyIdentity(db, oldEmailInput, newEmailInput, options = {}) {
     const oldEmail = oldEmailInput.trim().toLowerCase();
@@ -660,10 +708,24 @@ export async function rekeyIdentity(db, oldEmailInput, newEmailInput, options =
         oldEmail.toLowerCase() === newEmail.toLowerCase()) {
         throw new Error("Provide two different valid email addresses.");
     }
+    // Credential issuance takes this lock for its owner before any row lock,
+    // including Personal issuance, which has no membership row to wait on.
+    for (const email of [oldEmail, newEmail].sort())
+        await db.unsafe(`SELECT pg_advisory_xact_lock(hashtextextended($1, 0::bigint))`, [identityCredentialLockKey(email)]);
     const identityColumns = await assertIdentityColumnsRegistered(db);
     const userColumns = await columns(db, "user");
     if (!userColumns.has("id") || !userColumns.has("email"))
         throw new Error("Better Auth user table is unavailable; no identity data was changed.");
+    const membershipColumns = await columns(db, "org_members");
+    if (membershipColumns.has("email")) {
+        const order = ["org_id", "id"].filter((column) => membershipColumns.has(column));
+        if (!order.length)
+            order.push("email");
+        // Issuance and offboarding lock membership before credentials. Hold the
+        // same fence through every scan, including an initially empty grant store.
+        await db.unsafe(`SELECT ${quote(membershipColumns.has("id") ? "id" : "email")} FROM "org_members"
+       WHERE LOWER("email") = LOWER($1) ORDER BY ${order.map(quote).join(", ")} FOR UPDATE`, [oldEmail]);
+    }
     const users = await db.unsafe(`SELECT "id" FROM "user" WHERE LOWER("email") = LOWER($1) FOR UPDATE`, [oldEmail]);
     let userId;
     if (options.accountAlreadyUpdated) {
@@ -683,8 +745,17 @@ export async function rekeyIdentity(db, oldEmailInput, newEmailInput, options =
     const counts = {};
     let oauthRevokedCount = 0;
     counts["user.email"] = 1;
+    if (!options.dryRun) {
+        await db.unsafe(IDENTITY_RETIRED_EMAILS_CREATE_SQL);
+        await db.unsafe(`INSERT INTO identity_retired_emails (email, retired_at) VALUES ($1, $2)
+       ON CONFLICT (email) DO UPDATE
+         SET retired_at = GREATEST(identity_retired_emails.retired_at, EXCLUDED.retired_at)`, [oldEmail, Date.now()]);
+    }
+    const handledGrantOwners = await rekeyOAuthGrantOwners(db, oldEmail, newEmail, counts, options.dryRun === true);
     for (const entry of identityColumns) {
-        if (entry.table === "user" || entry.emailChange === "retain")
+        if (entry.table === "user" ||
+            entry.emailChange === "retain" ||
+            handledGrantOwners.has(`${entry.table}.${entry.column}`))
             continue;
         if (entry.mode === "unsupported-oauth") {
             const oauthColumns = await columns(db, "oauth_tokens");

package/dist/identity/retired-emails.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Credentials this app signs (MCP OAuth access JWTs, connect tokens) are
+ * stateless, so an email rekey cannot recall the ones already issued for the
+ * old address. Rekey records the address here inside its own transaction.
+ * Admission then refuses credentials for it signed no later than that, and
+ * issuance refuses the address until an account holds it again.
+ */
+import type { DbExec } from "../db/client.js";
+export declare const IDENTITY_RETIRED_EMAILS_CREATE_SQL = "CREATE TABLE IF NOT EXISTS identity_retired_emails (\n  -- guard:allow-identity-column \u2014 the retired address itself; rekey and offboarding never rewrite it\n  email TEXT PRIMARY KEY,\n  retired_at BIGINT NOT NULL\n)";
+export declare function ensureTable(): Promise<void>;
+/**
+ * Key for `pg_advisory_xact_lock(hashtextextended(key, 0))`. Rekey takes it
+ * for both addresses, offboarding for the removed member, and credential
+ * issuance for its owner, each before any row lock, so issuance cannot write
+ * a grant for an address mid-rekey or mid-offboard.
+ */
+export declare function identityCredentialLockKey(email: string): string;
+/**
+ * Epoch milliseconds of the latest rekey away from `email`, or null when no
+ * rekey has. A database no rekey has touched has no table, which is the same
+ * answer.
+ */
+export declare function readEmailRetiredAt(exec: DbExec, email: string): Promise<number | null>;

package/dist/identity/retired-emails.js

@@ -0,0 +1,55 @@
+import { ensureTableExists } from "../db/ddl-guard.js";
+export const IDENTITY_RETIRED_EMAILS_CREATE_SQL = `CREATE TABLE IF NOT EXISTS identity_retired_emails (
+  -- guard:allow-identity-column — the retired address itself; rekey and offboarding never rewrite it
+  email TEXT PRIMARY KEY,
+  retired_at BIGINT NOT NULL
+)`;
+let _initPromise;
+export async function ensureTable() {
+    if (!_initPromise) {
+        _initPromise = ensureTableExists("identity_retired_emails", IDENTITY_RETIRED_EMAILS_CREATE_SQL)
+            .then(() => undefined)
+            .catch((error) => {
+            _initPromise = undefined;
+            throw error;
+        });
+    }
+    return _initPromise;
+}
+/**
+ * Key for `pg_advisory_xact_lock(hashtextextended(key, 0))`. Rekey takes it
+ * for both addresses, offboarding for the removed member, and credential
+ * issuance for its owner, each before any row lock, so issuance cannot write
+ * a grant for an address mid-rekey or mid-offboard.
+ */
+export function identityCredentialLockKey(email) {
+    return `identity-credentials:${email.trim().toLowerCase()}`;
+}
+/**
+ * Epoch milliseconds of the latest rekey away from `email`, or null when no
+ * rekey has. A database no rekey has touched has no table, which is the same
+ * answer.
+ */
+export async function readEmailRetiredAt(exec, email) {
+    // Probe the catalog instead of catching a missing relation: inside an
+    // issuance transaction a failed statement would abort the transaction.
+    const probe = await exec.execute({
+        sql: `SELECT to_regclass('identity_retired_emails') IS NOT NULL AS present`,
+        args: [],
+    });
+    const present = probe.rows[0]?.present;
+    if (present === false)
+        return null;
+    if (present !== true)
+        throw new Error("Could not determine whether identity_retired_emails exists.");
+    const { rows } = await exec.execute({
+        sql: `SELECT retired_at FROM identity_retired_emails WHERE email = ?`,
+        args: [email.trim().toLowerCase()],
+    });
+    if (!rows.length)
+        return null;
+    const retiredAt = Number(rows[0].retired_at);
+    if (!Number.isSafeInteger(retiredAt) || retiredAt <= 0)
+        throw new Error("identity_retired_emails.retired_at is unreadable.");
+    return retiredAt;
+}

package/dist/mcp/actions/create-org-service-token.js

@@ -18,9 +18,11 @@
 import { z } from "zod";
 import { defineAction } from "../../action.js";
 import { getAppProductionUrl } from "../../server/app-url.js";
+import { CREDENTIAL_MEMBERSHIP_UNAVAILABLE_MESSAGE } from "../../server/credential-membership-unavailable.js";
 import { getRequestContext } from "../../server/request-context.js";
 import { mintOrgServiceToken } from "../connect-route.js";
-import { requireServiceTokenCaller, ServiceTokenError, } from "./service-token-access.js";
+import { McpCredentialIssuanceError } from "../credential-issuance.js";
+import { requireServiceTokenCaller, SERVICE_TOKEN_MANAGE_FORBIDDEN_MESSAGE, ServiceTokenError, } from "./service-token-access.js";
 export default defineAction({
     description: "Create a named, org-scoped service token (for CI like PR Visual Recap's PLAN_RECAP_TOKEN). The token acts as a service principal owned by the organization, not a person. Org owner/admin only. The token value is returned ONCE and never stored — copy it immediately.",
     schema: z.object({
@@ -48,13 +50,23 @@ export default defineAction({
         if (!appUrl && !process.env.A2A_SECRET?.trim()) {
             throw new ServiceTokenError("Could not determine the app URL needed to mint a token. Set APP_URL on the deployment.", 500);
         }
-        const minted = await mintOrgServiceToken({
-            serviceName: args.name,
-            orgId: caller.orgId,
-            createdBy: caller.email,
-            ttlDays: args.ttlDays,
-            appUrl,
-        });
+        let minted;
+        try {
+            minted = await mintOrgServiceToken({
+                serviceName: args.name,
+                orgId: caller.orgId,
+                createdBy: caller.email,
+                ttlDays: args.ttlDays,
+                appUrl,
+            });
+        }
+        catch (error) {
+            if (!(error instanceof McpCredentialIssuanceError))
+                throw error;
+            throw error.reason === "not-member"
+                ? new ServiceTokenError(SERVICE_TOKEN_MANAGE_FORBIDDEN_MESSAGE, 403)
+                : new ServiceTokenError(CREDENTIAL_MEMBERSHIP_UNAVAILABLE_MESSAGE, 503);
+        }
         return {
             // The ONLY place the secret ever appears. Never stored, never logged.
             token: minted.token,

package/dist/mcp/actions/service-token-access.d.ts

@@ -1,4 +1,5 @@
 import type { OrgRole } from "../../org/types.js";
+export declare const SERVICE_TOKEN_MANAGE_FORBIDDEN_MESSAGE = "Only org owners or admins can create or revoke service tokens.";
 export declare class ServiceTokenError extends Error {
     statusCode: number;
     constructor(message: string, statusCode: number);

package/dist/mcp/actions/service-token-access.js

@@ -12,6 +12,9 @@
  * tokens or revoke others — the role lookup simply finds no membership.
  */
 import { getDbExec } from "../../db/client.js";
+import { isMissingOrganizationTableError } from "../../org/membership.js";
+import { CREDENTIAL_MEMBERSHIP_UNAVAILABLE_MESSAGE } from "../../server/credential-membership-unavailable.js";
+export const SERVICE_TOKEN_MANAGE_FORBIDDEN_MESSAGE = "Only org owners or admins can create or revoke service tokens.";
 export class ServiceTokenError extends Error {
     statusCode;
     constructor(message, statusCode) {
@@ -20,37 +23,51 @@ export class ServiceTokenError extends Error {
         this.statusCode = statusCode;
     }
 }
+async function readOrgRole(orgId, email) {
+    const { rows } = await getDbExec().execute({
+        sql: `SELECT role FROM org_members
+          WHERE org_id = ? AND LOWER(email) = ?
+            AND federation_removal_pending_at IS NULL
+          LIMIT 1`,
+        args: [orgId, email.toLowerCase()],
+    });
+    const role = rows[0]?.role;
+    return role === "owner" || role === "admin" || role === "member"
+        ? role
+        : null;
+}
 export async function getOrgRoleForEmail(orgId, email) {
     try {
-        const { rows } = await getDbExec().execute({
-            sql: `SELECT role FROM org_members
-            WHERE org_id = ? AND LOWER(email) = ?
-              AND federation_removal_pending_at IS NULL
-            LIMIT 1`,
-            args: [orgId, email.toLowerCase()],
-        });
-        const role = rows[0]?.role;
-        return role === "owner" || role === "admin" || role === "member"
-            ? role
-            : null;
+        return await readOrgRole(orgId, email);
     }
     catch {
         // org tables not provisioned (template without orgs) → no membership.
         return null;
     }
 }
-async function getOrgIdsForEmail(email) {
+async function readOrgIds(email) {
+    const { rows } = await getDbExec().execute({
+        sql: `SELECT org_id FROM org_members
+          WHERE LOWER(email) = ?
+            AND federation_removal_pending_at IS NULL`,
+        args: [email.toLowerCase()],
+    });
+    return rows.map((r) => String(r.org_id)).filter(Boolean);
+}
+/**
+ * A template without orgs has no org tables, which is no membership. Any
+ * other failure is an outage, and answering it with a 400/403 would tell an
+ * admin they lost a role they still hold.
+ */
+async function lookupMembership(read, absent) {
     try {
-        const { rows } = await getDbExec().execute({
-            sql: `SELECT org_id FROM org_members
-            WHERE LOWER(email) = ?
-              AND federation_removal_pending_at IS NULL`,
-            args: [email.toLowerCase()],
-        });
-        return rows.map((r) => String(r.org_id)).filter(Boolean);
+        return await read();
     }
-    catch {
-        return [];
+    catch (error) {
+        if (isMissingOrganizationTableError(error))
+            return absent;
+        console.error("[service-tokens] Membership lookup failed:", error);
+        throw new ServiceTokenError(CREDENTIAL_MEMBERSHIP_UNAVAILABLE_MESSAGE, 503);
     }
 }
 export async function requireServiceTokenCaller(params) {
@@ -60,7 +77,7 @@ export async function requireServiceTokenCaller(params) {
     }
     let orgId = params.orgId?.trim() || "";
     if (!orgId) {
-        const memberOrgs = await getOrgIdsForEmail(email);
+        const memberOrgs = await lookupMembership(() => readOrgIds(email), []);
         if (memberOrgs.length === 0) {
             throw new ServiceTokenError("No active organization. Service tokens are org-scoped — join or create an organization first.", 400);
         }
@@ -70,12 +87,12 @@ export async function requireServiceTokenCaller(params) {
         }
         orgId = memberOrgs[0];
     }
-    const role = await getOrgRoleForEmail(orgId, email);
+    const role = await lookupMembership(() => readOrgRole(orgId, email), null);
     if (!role) {
         throw new ServiceTokenError("You are not a member of this organization.", 403);
     }
     if (params.level === "manage" && role === "member") {
-        throw new ServiceTokenError("Only org owners or admins can create or revoke service tokens.", 403);
+        throw new ServiceTokenError(SERVICE_TOKEN_MANAGE_FORBIDDEN_MESSAGE, 403);
     }
     return { email, orgId, role };
 }

package/dist/mcp/build-server.d.ts

@@ -103,6 +103,19 @@ export declare function conciseToolResultText(name: string, result: unknown, opt
 export declare function createMCPServerForRequest(config: MCPConfig, identity: MCPCallerIdentity | undefined, requestMeta?: MCPRequestMeta): Promise<import("@modelcontextprotocol/server").Server>;
 export declare function getAccessTokens(): string[];
 export declare function getBearerToken(authHeader: string | undefined): string | undefined;
+export type VerifyAuthResult = {
+    authed: boolean;
+    identity?: MCPCallerIdentity;
+    fullSurface?: boolean;
+    fullCatalog?: boolean;
+    /**
+     * The token verified, but its standing could not be checked: the
+     * connect-token revocation or org lookup, the retired-address check, or the
+     * membership check hit a database or identity-authority error. Answer with
+     * a retryable error, not an auth challenge: signing in again would not help.
+     */
+    unavailable?: true;
+};
 /**
  * Verify the inbound auth header. Returns:
  *   - { authed: true, identity } when verified — `identity` is derived from
@@ -124,15 +137,16 @@ export declare function getBearerToken(authHeader: string | undefined): string |
  * is consulted ONLY on the static-token / dev-open path (never to influence
  * verified JWT identity), so the install flow runs tools as the configured
  * owner instead of an unscoped anonymous caller.
+ *
+ * A credential this app issued that names an organization is admitted only
+ * while its subject is still a member, and none is admitted for an address an
+ * email change retired after signing (see `admitIssuedCredential`).
  */
 export declare function verifyAuth(authHeader: string | undefined, ownerEmailHeader?: string, options?: {
     allowDevOpen?: boolean;
     resourceUrl?: string | string[];
-}): Promise<{
-    authed: boolean;
-    identity?: MCPCallerIdentity;
-    fullSurface?: boolean;
-    fullCatalog?: boolean;
-}>;
+    /** This app's public origin; federated orgs need it for the membership check. */
+    requestOrigin?: string;
+}): Promise<VerifyAuthResult>;
 export declare function resolveOrgIdFromDomain(orgDomain: string | undefined): Promise<string | undefined>;
 export declare function resolveMcpIdentityOrgId(identity: MCPCallerIdentity | undefined): Promise<string | undefined>;