@agent-native/core 0.201.0-nightly-20261005153421 → 0.201.0

package/dist/mcp/build-server.js

@@ -1985,38 +1985,117 @@ function mcpAudienceList(resource) {
     }
     return out;
 }
-async function isConnectTokenAllowed(jti) {
+/**
+ * Null while the connect token is active. A revoked or jti-less token is
+ * refused, and unreadable revocation state answers a retryable 503.
+ */
+async function refuseInactiveConnectToken(jti) {
     if (!jti)
-        return false;
+        return { authed: false };
+    const { isJtiRevoked } = await import("./connect-store.js");
     try {
-        const { isJtiRevoked, touchTokenUsed } = await import("./connect-store.js");
-        if (await isJtiRevoked(jti))
-            return false;
+        return (await isJtiRevoked(jti)) ? { authed: false } : null;
+    }
+    catch (error) {
+        console.error("[mcp] Connect-token revocation check failed; refusing the token:", error);
+        return { authed: false, unavailable: true };
+    }
+}
+/**
+ * Records a connect token's use once the request is admitted, so a refused
+ * call (revoked, removed member, membership check unavailable) never moves
+ * `last_used_at`.
+ */
+async function markConnectTokenUsed(jti) {
+    if (!jti)
+        return;
+    try {
+        const { touchTokenUsed } = await import("./connect-store.js");
         void touchTokenUsed(jti);
     }
     catch {
-        // Store import / lookup failed — fail open. Signature verification already
-        // passed; this only gates explicit revokes.
+        // coercion-ok: last_used_at is informational; failing to record it must not refuse an admitted request.
     }
-    return true;
 }
-async function resolveConnectTokenOrgId(jti, claimedOrgId) {
+/**
+ * `connectJti` is set only for connect tokens. Any other token without an
+ * `org_id` claim is `unclaimed`, and its org is resolved later from
+ * `org_domain` or the caller's email.
+ */
+async function resolveConnectTokenOrgId(connectJti, claimedOrgId) {
+    let stored;
+    if (connectJti) {
+        const { lookupConnectTokenOrg } = await import("./connect-store.js");
+        stored = await lookupConnectTokenOrg(connectJti);
+        if (stored.status === "unavailable")
+            return stored;
+    }
     if (claimedOrgId !== undefined) {
-        return { status: "claimed", orgId: claimedOrgId };
+        return {
+            status: "claimed",
+            orgId: claimedOrgId,
+            ...(stored?.status === "found" ? { storedConnectToken: stored } : {}),
+        };
     }
-    if (!jti)
-        return { status: "missing" };
-    const { lookupConnectTokenOrg } = await import("./connect-store.js");
-    return lookupConnectTokenOrg(jti);
+    return stored ?? { status: "unclaimed" };
 }
 function orgIdFromConnectTokenResolution(resolution) {
-    if (resolution.status === "claimed")
-        return resolution.orgId;
-    if (resolution.status === "found") {
+    if (resolution.status === "claimed" || resolution.status === "found") {
         return resolution.orgId;
     }
+    // A connect token with no row here was not issued for any org this app
+    // knows. Its `org_domain` claim must not grant that domain's org, so it
+    // runs Personal.
+    if (resolution.status === "missing")
+        return null;
     return undefined;
 }
+/**
+ * Credentials this app issues (MCP OAuth access tokens and connect tokens)
+ * carry the organization chosen when they were issued: the signed `org_id`
+ * claim, or the stored org of a connect token. Membership can end after
+ * issuance, so that org is admitted only while the subject is still a member
+ * here. The action-route bearer path reuses verifyAuth and gets the same
+ * check.
+ *
+ * They also carry the subject's address, which an email change retires; a
+ * credential signed for it before the change is refused, Personal or not.
+ *
+ * Cross-app A2A JWTs, first-party MCP tokens included, are not checked: their
+ * `org_id`, like `org_domain`, is the signing app's assertion, and the caller
+ * may have no membership row in this app's database.
+ */
+async function admitIssuedCredential(result, requestOrigin, orgResolution, issuedAt) {
+    const { checkCredentialEmailRetirement, checkCredentialOrgMembership } = await import("./credential-membership.js");
+    if (result.identity.userEmail) {
+        const retirement = await checkCredentialEmailRetirement({
+            email: result.identity.userEmail,
+            issuedAt,
+        });
+        if (retirement !== "current")
+            return retirement === "unavailable"
+                ? { authed: false, unavailable: true }
+                : { authed: false };
+    }
+    const orgId = result.identity.orgId;
+    if (typeof orgId !== "string" || !orgId)
+        return result;
+    const membership = await checkCredentialOrgMembership({
+        orgId,
+        email: result.identity.userEmail,
+        requestOrigin,
+        ...(orgResolution.status === "found"
+            ? { storedConnectToken: orgResolution }
+            : orgResolution.status === "claimed" && orgResolution.storedConnectToken
+                ? { storedConnectToken: orgResolution.storedConnectToken }
+                : {}),
+    });
+    if (membership === "member")
+        return result;
+    return membership === "unavailable"
+        ? { authed: false, unavailable: true }
+        : { authed: false };
+}
 /**
  * Verify the inbound auth header. Returns:
  *   - { authed: true, identity } when verified — `identity` is derived from
@@ -2038,6 +2117,10 @@ function orgIdFromConnectTokenResolution(resolution) {
  * is consulted ONLY on the static-token / dev-open path (never to influence
  * verified JWT identity), so the install flow runs tools as the configured
  * owner instead of an unscoped anonymous caller.
+ *
+ * A credential this app issued that names an organization is admitted only
+ * while its subject is still a member, and none is admitted for an address an
+ * email change retired after signing (see `admitIssuedCredential`).
  */
 export async function verifyAuth(authHeader, ownerEmailHeader, options = {}) {
     const accessTokens = getAccessTokens();
@@ -2046,18 +2129,19 @@ export async function verifyAuth(authHeader, ownerEmailHeader, options = {}) {
     if (token) {
         const oauthIdentity = await verifyMcpOAuthAccessToken(token, options.resourceUrl);
         if (oauthIdentity) {
-            if (oauthIdentity.clientId === MCP_CONNECT_OAUTH_CLIENT_ID &&
-                !(await isConnectTokenAllowed(oauthIdentity.jti))) {
-                return { authed: false };
+            if (oauthIdentity.clientId === MCP_CONNECT_OAUTH_CLIENT_ID) {
+                const refused = await refuseInactiveConnectToken(oauthIdentity.jti);
+                if (refused)
+                    return refused;
             }
             const orgResolution = await resolveConnectTokenOrgId(oauthIdentity.clientId === MCP_CONNECT_OAUTH_CLIENT_ID
                 ? oauthIdentity.jti
                 : undefined, oauthIdentity.orgId);
             if (orgResolution.status === "unavailable") {
-                return { authed: false };
+                return { authed: false, unavailable: true };
             }
             const orgId = orgIdFromConnectTokenResolution(orgResolution);
-            return {
+            const admitted = await admitIssuedCredential({
                 authed: true,
                 identity: {
                     userEmail: oauthIdentity.userEmail,
@@ -2068,7 +2152,12 @@ export async function verifyAuth(authHeader, ownerEmailHeader, options = {}) {
                 },
                 fullSurface: true,
                 fullCatalog: oauthIdentity.catalogScope === "full",
-            };
+            }, options.requestOrigin, orgResolution, oauthIdentity.issuedAt);
+            if (admitted.authed &&
+                oauthIdentity.clientId === MCP_CONNECT_OAUTH_CLIENT_ID) {
+                await markConnectTokenUsed(oauthIdentity.jti);
+            }
+            return admitted;
         }
     }
     if (accessTokens.length === 0 && !hasA2ASecret && !token) {
@@ -2092,25 +2181,25 @@ export async function verifyAuth(authHeader, ownerEmailHeader, options = {}) {
         // Connect-minted tokens (scope === "mcp-connect") carry a random `jti`
         // and are individually revocable. Only these tokens hit the revoke
         // store — ordinary A2A delegation JWTs skip the DB lookup entirely so
-        // the hot path is unchanged. The signature was already
-        // cryptographically verified, so failing open here only widens the
-        // explicit-revoke gate, never the trust boundary.
+        // the hot path is unchanged.
         if (tokenScope === MCP_CONNECT_SCOPE) {
-            if (!(await isConnectTokenAllowed(payload.jti))) {
-                return { authed: false };
-            }
+            const refused = await refuseInactiveConnectToken(payload.jti);
+            if (refused)
+                return refused;
         }
         const orgIdClaim = parseMcpOAuthOrgIdClaim(payload);
         if (!orgIdClaim)
             return { authed: false };
-        const orgResolution = await resolveConnectTokenOrgId(tokenScope === MCP_CONNECT_SCOPE
+        const firstPartyMcp = payload.agent_native_first_party_mcp === true;
+        const orgResolution = await resolveConnectTokenOrgId(tokenScope === MCP_CONNECT_SCOPE &&
+            (!firstPartyMcp || orgIdClaim.orgId === undefined)
             ? payload.jti
             : undefined, orgIdClaim.orgId);
         if (orgResolution.status === "unavailable") {
-            return { authed: false };
+            return { authed: false, unavailable: true };
         }
         const orgId = orgIdFromConnectTokenResolution(orgResolution);
-        return {
+        const verified = {
             authed: true,
             identity: {
                 userEmail: typeof payload.sub === "string" ? payload.sub : undefined,
@@ -2118,13 +2207,20 @@ export async function verifyAuth(authHeader, ownerEmailHeader, options = {}) {
                 orgDomain: typeof payload.org_domain === "string"
                     ? payload.org_domain
                     : undefined,
-                ...(payload.agent_native_first_party_mcp === true
-                    ? { firstPartyMcp: true }
-                    : {}),
+                ...(firstPartyMcp ? { firstPartyMcp: true } : {}),
             },
             fullSurface: true,
             fullCatalog: payload.catalog_scope === "full",
         };
+        // First-party MCP tokens share the connect scope but are minted by a
+        // sibling app per call, so they are cross-app A2A tokens.
+        const admitted = tokenScope === MCP_CONNECT_SCOPE && !firstPartyMcp
+            ? await admitIssuedCredential(verified, options.requestOrigin, orgResolution, typeof payload.iat === "number" ? payload.iat : undefined)
+            : verified;
+        if (admitted.authed && tokenScope === MCP_CONNECT_SCOPE) {
+            await markConnectTokenUsed(payload.jti);
+        }
+        return admitted;
     }
     if (accessTokens.length === 0 && !hasA2ASecret) {
         if (options.allowDevOpen === false) {

package/dist/mcp/connect-route.d.ts

@@ -16,9 +16,10 @@ export interface McpConnectRouteOptions {
  * random `jti` is stored, so the standard revocation path
  * (`isJtiRevoked` in `verifyAuth`) applies to service tokens identically.
  *
- * Authorization is the CALLER'S responsibility: this function does not check
- * org membership/role. The `create-org-service-token` action gates on org
- * owner/admin before calling it.
+ * The `create-org-service-token` action gates on org owner/admin before
+ * calling this. Offboarding can remove that admin before the mint, so the
+ * creator's role is rechecked under the membership lock offboarding takes,
+ * and the token is recorded in the same transaction.
  */
 export declare function mintOrgServiceToken(params: {
     serviceName: string;

package/dist/mcp/connect-route.js

@@ -7,9 +7,12 @@ import { resolveLocaleFromRequest } from "../localization/server.js";
 import { localeDirection, normalizeLocaleCode, } from "../localization/shared.js";
 import { getOrgDomain } from "../org/context.js";
 import { getSession, getConfiguredLoginHtml, isLoopbackRequest, } from "../server/auth.js";
+import { CREDENTIAL_MEMBERSHIP_UNAVAILABLE_MESSAGE } from "../server/credential-membership-unavailable.js";
+import { readDeployCredentialEnv } from "../server/credential-provider.js";
 import { readBody } from "../server/h3-helpers.js";
 import { MCP_CONNECT_MCP_URL_TEMPLATE, getMcpConnectGuides, getMcpStaticTokenFallback, interpolateMcpConnectTemplate, resolveMcpConnectGuideId, } from "../shared/mcp-connect-content.js";
-import { recordMintedToken, listTokens, revokeToken, normalizeServiceName, serviceIdentityEmail, createDeviceCode, getDeviceCode, getDeviceCodeByUserCode, approveDeviceCode, consumeDeviceCode, claimDeviceCodeForMint, finishDeviceCodeMint, releaseDeviceCodeMint, expireDeviceCode, MCP_CONNECT_OAUTH_CLIENT_ID, MCP_CONNECT_SCOPE, DEFAULT_TOKEN_TTL_DAYS, MIN_TOKEN_TTL_DAYS, MAX_TOKEN_TTL_DAYS, DEVICE_CODE_TTL_MS, } from "./connect-store.js";
+import { ensureConnectTables, recordMintedToken, listTokens, revokeToken, normalizeServiceName, serviceIdentityEmail, createDeviceCode, getDeviceCode, getDeviceCodeByUserCode, approveDeviceCode, consumeDeviceCode, claimDeviceCodeForMint, finishDeviceCodeMint, expireDeviceCode, MCP_CONNECT_OAUTH_CLIENT_ID, MCP_CONNECT_SCOPE, DEFAULT_TOKEN_TTL_DAYS, MIN_TOKEN_TTL_DAYS, MAX_TOKEN_TTL_DAYS, DEVICE_CODE_TTL_MS, } from "./connect-store.js";
+import { McpCredentialIssuanceError, withMcpCredentialIssuance, } from "./credential-issuance.js";
 import { MCP_OAUTH_DEFAULT_SCOPE, signMcpOAuthAccessToken, } from "./oauth-token.js";
 import { resolveMcpOrgChoices } from "./org-choice.js";
 import { MCP_PUBLIC_ROUTE_PREFIX } from "./route-paths.js";
@@ -21,6 +24,22 @@ function json(body, status = 200) {
         headers: { "Content-Type": "application/json" },
     });
 }
+function issuanceErrorResponse(err) {
+    if (err.reason === "not-member") {
+        return json({ error: "Choose an organization you belong to." }, 403);
+    }
+    const response = json({ error: CREDENTIAL_MEMBERSHIP_UNAVAILABLE_MESSAGE }, 503);
+    response.headers.set("Retry-After", "5");
+    return response;
+}
+async function prepareConnectIssuance() {
+    try {
+        await ensureConnectTables();
+    }
+    catch (error) {
+        throw new McpCredentialIssuanceError("unavailable", { cause: error });
+    }
+}
 function html(body, status = 200) {
     return new Response(body, {
         status,
@@ -91,7 +110,7 @@ function canUseDevOpenConnect(event) {
     // by spoofing `Host: localhost`.
     return (isLoopbackRequest(event) &&
         isLoopbackOrigin(deriveOrigin(event)) &&
-        !process.env.A2A_SECRET?.trim() &&
+        !readDeployCredentialEnv("A2A_SECRET")?.trim() &&
         !process.env.ACCESS_TOKEN?.trim() &&
         !process.env.ACCESS_TOKENS?.trim());
 }
@@ -125,26 +144,33 @@ function clampTtlDays(input) {
  */
 async function mintConnectToken(params) {
     const orgDomain = await resolveOrgDomain(params.orgId);
-    const jti = randomUUID();
-    const token = await signConnectToken({
-        ownerEmail: params.email,
+    await prepareConnectIssuance();
+    return withMcpCredentialIssuance({
+        email: params.email,
         orgId: params.orgId,
-        orgDomain,
-        appUrl: params.appUrl,
-        expiresIn: `${params.ttlDays}d`,
-        jti,
-        ...(params.catalogScope === "full" ? { catalogScope: "full" } : {}),
-    });
-    await recordMintedToken({
-        jti,
-        ownerEmail: params.email,
-        orgId: params.orgId ?? null,
-        label: params.label,
+        requestOrigin: params.requestOrigin,
+    }, async (tx) => {
+        const jti = randomUUID();
+        const token = await signConnectToken({
+            ownerEmail: params.email,
+            orgId: params.orgId,
+            orgDomain,
+            appUrl: params.appUrl,
+            expiresIn: `${params.ttlDays}d`,
+            jti,
+            ...(params.catalogScope === "full" ? { catalogScope: "full" } : {}),
+        });
+        await recordMintedToken({
+            jti,
+            ownerEmail: params.email,
+            orgId: params.orgId ?? null,
+            label: params.label,
+        }, tx);
+        return { token, jti };
     });
-    return { token, jti };
 }
 async function signConnectToken(params) {
-    if (process.env.A2A_SECRET?.trim()) {
+    if (readDeployCredentialEnv("A2A_SECRET")?.trim()) {
         return signA2AToken(params.ownerEmail, params.orgDomain, undefined, {
             preferGlobalSecret: true,
             expiresIn: params.expiresIn,
@@ -183,35 +209,44 @@ async function signConnectToken(params) {
  * random `jti` is stored, so the standard revocation path
  * (`isJtiRevoked` in `verifyAuth`) applies to service tokens identically.
  *
- * Authorization is the CALLER'S responsibility: this function does not check
- * org membership/role. The `create-org-service-token` action gates on org
- * owner/admin before calling it.
+ * The `create-org-service-token` action gates on org owner/admin before
+ * calling this. Offboarding can remove that admin before the mint, so the
+ * creator's role is rechecked under the membership lock offboarding takes,
+ * and the token is recorded in the same transaction.
  */
 export async function mintOrgServiceToken(params) {
     const serviceName = normalizeServiceName(params.serviceName);
     const serviceEmail = serviceIdentityEmail(serviceName, params.orgId);
     const orgDomain = await resolveOrgDomain(params.orgId);
     const ttlDays = clampTtlDays(params.ttlDays ?? DEFAULT_TOKEN_TTL_DAYS);
-    const jti = randomUUID();
-    const token = await signConnectToken({
-        ownerEmail: serviceEmail,
+    await prepareConnectIssuance();
+    return withMcpCredentialIssuance({
+        email: params.createdBy,
         orgId: params.orgId,
-        orgDomain,
-        appUrl: params.appUrl,
-        expiresIn: `${ttlDays}d`,
-        jti,
-        includeOrgIdClaim: true,
-    });
-    const id = await recordMintedToken({
-        jti,
-        ownerEmail: serviceEmail,
-        orgId: params.orgId,
-        label: `Service token: ${serviceName}`,
-        kind: "service",
-        serviceName,
-        createdBy: params.createdBy,
+        requestOrigin: params.appUrl,
+        roles: ["owner", "admin"],
+    }, async (tx) => {
+        const jti = randomUUID();
+        const token = await signConnectToken({
+            ownerEmail: serviceEmail,
+            orgId: params.orgId,
+            orgDomain,
+            appUrl: params.appUrl,
+            expiresIn: `${ttlDays}d`,
+            jti,
+            includeOrgIdClaim: true,
+        });
+        const id = await recordMintedToken({
+            jti,
+            ownerEmail: serviceEmail,
+            orgId: params.orgId,
+            label: `Service token: ${serviceName}`,
+            kind: "service",
+            serviceName,
+            createdBy: params.createdBy,
+        }, tx);
+        return { token, jti, id, serviceName, serviceEmail, ttlDays };
     });
-    return { token, jti, id, serviceName, serviceEmail, ttlDays };
 }
 function mcpResultPayload(appUrl, options, auth) {
     const mcpUrl = mcpResourceUrl(appUrl);
@@ -1124,7 +1159,8 @@ export async function handleMcpConnect(event, subpath, options = {}) {
         const session = await getSession(event);
         if (!session?.email)
             return json({ error: "Unauthorized" }, 401);
-        if (!process.env.A2A_SECRET?.trim() && canUseDevOpenConnect(event)) {
+        if (!readDeployCredentialEnv("A2A_SECRET")?.trim() &&
+            canUseDevOpenConnect(event)) {
             return json(mcpResultPayload(appUrl, options, { ownerEmail: session.email }));
         }
         const body = ((await readBody(event).catch(() => ({}))) ?? {});
@@ -1143,11 +1179,14 @@ export async function handleMcpConnect(event, subpath, options = {}) {
                 label,
                 ttlDays,
                 appUrl,
+                requestOrigin: origin,
                 ...(catalogScope ? { catalogScope } : {}),
             });
             return json(mcpResultPayload(appUrl, options, { token }));
         }
-        catch {
+        catch (err) {
+            if (err instanceof McpCredentialIssuanceError)
+                return issuanceErrorResponse(err);
             return json({ error: "Failed to mint token." }, 500);
         }
     }
@@ -1207,7 +1246,20 @@ export async function handleMcpConnect(event, subpath, options = {}) {
             return json({ error: "Choose an organization you belong to." }, 403);
         }
         const selectedOrgId = requestedOrgId ?? defaultOrganizationId ?? null;
-        const result = await approveDeviceCode(userCode, session.email, selectedOrgId);
+        let result;
+        try {
+            await prepareConnectIssuance();
+            result = await withMcpCredentialIssuance({
+                email: session.email,
+                orgId: selectedOrgId,
+                requestOrigin: origin,
+            }, (tx) => approveDeviceCode(userCode, session.email, selectedOrgId, tx));
+        }
+        catch (err) {
+            if (err instanceof McpCredentialIssuanceError)
+                return issuanceErrorResponse(err);
+            return json({ error: "Failed to mint token." }, 500);
+        }
         if (result === "not_found") {
             return json({ error: "Unknown device code." }, 404);
         }
@@ -1242,35 +1294,43 @@ export async function handleMcpConnect(event, subpath, options = {}) {
             !row.ownerEmail) {
             return json({ status: "pending" });
         }
-        if (!process.env.A2A_SECRET?.trim() && canUseDevOpenConnect(event)) {
-            const consumed = await consumeDeviceCode(deviceCode, `dev-open-${randomUUID()}`);
-            if (!consumed) {
-                const fresh = await getDeviceCode(deviceCode);
-                if (fresh?.status === "consumed")
-                    return json({ status: "consumed" });
-                return json({ status: "pending" });
-            }
-            return json({
-                status: "approved",
-                ...mcpResultPayload(appUrl, options, {
-                    ownerEmail: row.ownerEmail,
-                    catalogScope: row.catalogScope,
-                }),
-            });
-        }
         try {
-            const jti = randomUUID();
-            const claimed = await claimDeviceCodeForMint(deviceCode, jti);
-            if (!claimed) {
-                const fresh = await getDeviceCode(deviceCode);
-                if (fresh?.status === "consumed")
-                    return json({ status: "consumed" });
-                return json({ status: "pending" });
-            }
-            let token;
-            try {
-                const orgDomain = await resolveOrgDomain(claimed.orgId ?? undefined);
-                token = await signConnectToken({
+            const devOpen = !readDeployCredentialEnv("A2A_SECRET")?.trim() &&
+                canUseDevOpenConnect(event);
+            const orgDomain = await resolveOrgDomain(row.orgId ?? undefined);
+            await prepareConnectIssuance();
+            return await withMcpCredentialIssuance({
+                email: row.ownerEmail,
+                orgId: row.orgId,
+                requestOrigin: origin,
+            }, async (tx) => {
+                const jti = randomUUID();
+                const claimed = devOpen
+                    ? await consumeDeviceCode(deviceCode, jti, tx)
+                    : await claimDeviceCodeForMint(deviceCode, jti, tx);
+                if (!claimed) {
+                    const fresh = await getDeviceCode(deviceCode, tx);
+                    if (fresh?.status === "consumed")
+                        return json({ status: "consumed" });
+                    if (fresh?.status === "expired" ||
+                        (fresh?.expiresAt != null && fresh.expiresAt < Date.now()))
+                        return json({ status: "expired" });
+                    return json({ status: "pending" });
+                }
+                if (claimed.ownerEmail !== row.ownerEmail ||
+                    claimed.orgId !== row.orgId) {
+                    throw new McpCredentialIssuanceError("not-member");
+                }
+                if (devOpen) {
+                    return json({
+                        status: "approved",
+                        ...mcpResultPayload(appUrl, options, {
+                            ownerEmail: row.ownerEmail,
+                            catalogScope: claimed.catalogScope,
+                        }),
+                    });
+                }
+                const token = await signConnectToken({
                     ownerEmail: claimed.ownerEmail,
                     orgId: claimed.orgId,
                     orgDomain,
@@ -1286,21 +1346,19 @@ export async function handleMcpConnect(event, subpath, options = {}) {
                     ownerEmail: claimed.ownerEmail,
                     orgId: claimed.orgId,
                     label: "Device connection",
-                });
-                if (!(await finishDeviceCodeMint(deviceCode, jti))) {
-                    return json({ status: "pending" });
+                }, tx);
+                if (!(await finishDeviceCodeMint(deviceCode, jti, tx))) {
+                    throw new McpCredentialIssuanceError("unavailable");
                 }
-            }
-            catch (err) {
-                await releaseDeviceCodeMint(deviceCode, jti);
-                throw err;
-            }
-            return json({
-                status: "approved",
-                ...mcpResultPayload(appUrl, options, { token }),
+                return json({
+                    status: "approved",
+                    ...mcpResultPayload(appUrl, options, { token }),
+                });
             });
         }
-        catch {
+        catch (err) {
+            if (err instanceof McpCredentialIssuanceError)
+                return issuanceErrorResponse(err);
             return json({ status: "error", error: "Failed to mint token." }, 500);
         }
     }

package/dist/mcp/connect-store.d.ts

@@ -16,6 +16,7 @@
  * like an absent authorization. `CREATE TABLE IF NOT EXISTS` only — strictly
  * additive, never DROP / ALTER (shared prod DB rule).
  */
+import { type DbExec } from "../db/client.js";
 export declare const MCP_CONNECT_SCOPE = "mcp-connect";
 export declare const MCP_CONNECT_OAUTH_CLIENT_ID = "agent-native-connect";
 export declare const DEVICE_CODE_TTL_MS: number;
@@ -25,6 +26,7 @@ export declare const MAX_TOKEN_TTL_DAYS = 365;
 export declare const DEVICE_START_MAX = 20;
 export declare const DEVICE_START_WINDOW_MS = 60000;
 export declare function ensureTable(): Promise<void>;
+export declare function ensureConnectTables(): Promise<void>;
 export interface MintedTokenRow {
     id: string;
     jti: string;
@@ -53,18 +55,22 @@ export declare function recordMintedToken(params: {
     kind?: "personal" | "service";
     serviceName?: string | null;
     createdBy?: string | null;
-}): Promise<string>;
+}, exec?: DbExec): Promise<string>;
 /**
  * Returns true when the given `jti` corresponds to a token that has been
  * revoked. Fails OPEN on a store/DB error: a transient Neon WS drop must not
  * lock every connected agent out. Signature verification is unaffected — this
  * is only the post-verify revoke check (see `verifyAuth` in build-server.ts).
  */
+/**
+ * Throws when the revocation state can't be read. Answering "not revoked"
+ * instead would let a transient read failure admit a revoked token.
+ */
 export declare function isJtiRevoked(jti: string): Promise<boolean>;
-export type ConnectTokenOrgLookup = {
+export type StoredConnectTokenIdentity = Pick<MintedTokenRow, "kind" | "ownerEmail" | "orgId">;
+export type ConnectTokenOrgLookup = ({
     status: "found";
-    orgId: string | null;
-} | {
+} & StoredConnectTokenIdentity) | {
     status: "missing";
 } | {
     status: "unavailable";
@@ -105,11 +111,11 @@ export interface DeviceCodeRow {
     consumedAt: number | null;
 }
 export declare function createDeviceCode(catalogScope?: "full" | null): Promise<DeviceCodeRow>;
-export declare function getDeviceCode(deviceCode: string): Promise<DeviceCodeRow | null>;
-export declare function getDeviceCodeByUserCode(userCode: string): Promise<DeviceCodeRow | null>;
-export declare function approveDeviceCode(userCode: string, ownerEmail: string, orgId: string | null): Promise<DeviceCodeRow | "not_found" | "expired" | "already">;
-export declare function consumeDeviceCode(deviceCode: string, tokenJti: string): Promise<DeviceCodeRow | null>;
-export declare function claimDeviceCodeForMint(deviceCode: string, tokenJti: string): Promise<DeviceCodeRow | null>;
-export declare function finishDeviceCodeMint(deviceCode: string, tokenJti: string): Promise<boolean>;
-export declare function releaseDeviceCodeMint(deviceCode: string, tokenJti: string): Promise<void>;
+export declare function getDeviceCode(deviceCode: string, exec?: DbExec): Promise<DeviceCodeRow | null>;
+export declare function getDeviceCodeByUserCode(userCode: string, exec?: DbExec): Promise<DeviceCodeRow | null>;
+export declare function approveDeviceCode(userCode: string, ownerEmail: string, orgId: string | null, exec?: DbExec): Promise<DeviceCodeRow | "not_found" | "expired" | "already">;
+export declare function consumeDeviceCode(deviceCode: string, tokenJti: string, exec?: DbExec): Promise<DeviceCodeRow | null>;
+export declare function claimDeviceCodeForMint(deviceCode: string, tokenJti: string, exec?: DbExec): Promise<DeviceCodeRow | null>;
+export declare function finishDeviceCodeMint(deviceCode: string, tokenJti: string, exec?: DbExec): Promise<boolean>;
+export declare function releaseDeviceCodeMint(deviceCode: string, tokenJti: string, exec?: DbExec): Promise<void>;
 export declare function expireDeviceCode(deviceCode: string): Promise<void>;