@agent-native/core 0.201.0-nightly-20261005153421 → 0.201.0

package/dist/mcp/connect-store.js

@@ -73,6 +73,9 @@ export async function ensureTable() {
     }
     return _initPromise;
 }
+export async function ensureConnectTables() {
+    await ensureTable();
+}
 export function serviceIdentityEmail(serviceName, orgId) {
     return `svc-${normalizeServiceName(serviceName)}@service.${orgId}`;
 }
@@ -96,11 +99,12 @@ export function normalizeServiceName(raw) {
  * Persist a record of a minted token. The token value itself (a signed JWT)
  * is NEVER stored — only its `jti`, so revocation is a cheap SQL lookup.
  */
-export async function recordMintedToken(params) {
-    await ensureTable();
-    const client = getDbExec();
+export async function recordMintedToken(params, exec) {
+    if (!exec)
+        await ensureTable();
+    const client = exec ?? getDbExec();
     const id = randomUUID();
-    await client.execute({
+    const result = await client.execute({
         sql: `INSERT INTO mcp_connect_tokens (id, jti, owner_email, org_id, label, kind, service_name, created_by, created_at, last_used_at, revoked_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
         args: [
             id,
@@ -116,6 +120,9 @@ export async function recordMintedToken(params) {
             null,
         ],
     });
+    if (result.rowsAffected !== 1) {
+        throw new Error("Unexpected affected row count for MCP connect token insert.");
+    }
     return id;
 }
 /**
@@ -124,40 +131,45 @@ export async function recordMintedToken(params) {
  * lock every connected agent out. Signature verification is unaffected — this
  * is only the post-verify revoke check (see `verifyAuth` in build-server.ts).
  */
+/**
+ * Throws when the revocation state can't be read. Answering "not revoked"
+ * instead would let a transient read failure admit a revoked token.
+ */
 export async function isJtiRevoked(jti) {
-    try {
-        await ensureTable();
-        const client = getDbExec();
-        const { rows } = await client.execute({
-            sql: `SELECT revoked_at FROM mcp_connect_tokens WHERE jti = ?`,
-            args: [jti],
-        });
-        if (rows.length === 0)
-            return false;
-        const revokedAt = rows[0].revoked_at ?? rows[0].revokedAt;
-        return revokedAt != null;
-    }
-    catch (err) {
-        // Fail open: a DB blip must not turn every minted token into a 401.
-        // (Signature checks already passed; this only gates explicit revokes.)
-        if (isConnectionError(err))
-            return false;
+    await ensureTable();
+    const client = getDbExec();
+    const { rows } = await client.execute({
+        sql: `SELECT revoked_at FROM mcp_connect_tokens WHERE jti = ?`,
+        args: [jti],
+    });
+    if (rows.length === 0)
         return false;
-    }
+    const revokedAt = rows[0].revoked_at ?? rows[0].revokedAt;
+    return revokedAt != null;
 }
 export async function lookupConnectTokenOrg(jti) {
     try {
         await ensureTable();
         const client = getDbExec();
         const { rows } = await client.execute({
-            sql: `SELECT org_id FROM mcp_connect_tokens WHERE jti = ?`,
+            sql: `SELECT org_id, owner_email, kind FROM mcp_connect_tokens WHERE jti = ?`,
             args: [jti],
         });
         if (rows.length === 0)
             return { status: "missing" };
         const rawOrgId = rows[0].org_id ?? rows[0].orgId;
+        const ownerEmail = rows[0].owner_email ?? rows[0].ownerEmail;
+        const kind = rows[0].kind;
+        if (typeof ownerEmail !== "string" ||
+            !ownerEmail.trim() ||
+            (kind !== "personal" && kind !== "service") ||
+            (rawOrgId != null && (typeof rawOrgId !== "string" || !rawOrgId.trim()))) {
+            return { status: "unavailable" };
+        }
         return {
             status: "found",
+            ownerEmail,
+            kind,
             orgId: typeof rawOrgId === "string" && rawOrgId.trim()
                 ? rawOrgId.trim()
                 : null,
@@ -341,9 +353,10 @@ function mapDeviceRow(r) {
         consumedAt: numOrNull(r.consumed_at ?? r.consumedAt),
     };
 }
-export async function getDeviceCode(deviceCode) {
-    await ensureTable();
-    const client = getDbExec();
+export async function getDeviceCode(deviceCode, exec) {
+    if (!exec)
+        await ensureTable();
+    const client = exec ?? getDbExec();
     const { rows } = await client.execute({
         sql: `SELECT * FROM mcp_device_codes WHERE device_code = ?`,
         args: [deviceCode],
@@ -352,9 +365,10 @@ export async function getDeviceCode(deviceCode) {
         return null;
     return mapDeviceRow(rows[0]);
 }
-export async function getDeviceCodeByUserCode(userCode) {
-    await ensureTable();
-    const client = getDbExec();
+export async function getDeviceCodeByUserCode(userCode, exec) {
+    if (!exec)
+        await ensureTable();
+    const client = exec ?? getDbExec();
     const { rows } = await client.execute({
         sql: `SELECT * FROM mcp_device_codes WHERE user_code = ?`,
         args: [userCode],
@@ -363,10 +377,18 @@ export async function getDeviceCodeByUserCode(userCode) {
         return null;
     return mapDeviceRow(rows[0]);
 }
-export async function approveDeviceCode(userCode, ownerEmail, orgId) {
-    await ensureTable();
-    const client = getDbExec();
-    const row = await getDeviceCodeByUserCode(userCode);
+function deviceCodeMutationSucceeded(rowsAffected) {
+    if (rowsAffected === 1)
+        return true;
+    if (rowsAffected === 0)
+        return false;
+    throw new Error("Unexpected affected row count for MCP device code mutation.");
+}
+export async function approveDeviceCode(userCode, ownerEmail, orgId, exec) {
+    if (!exec)
+        await ensureTable();
+    const client = exec ?? getDbExec();
+    const row = await getDeviceCodeByUserCode(userCode, client);
     if (!row)
         return "not_found";
     if ((row.expiresAt ?? 0) < Date.now())
@@ -374,11 +396,13 @@ export async function approveDeviceCode(userCode, ownerEmail, orgId) {
     if (row.status !== "pending")
         return "already";
     const result = await client.execute({
-        sql: `UPDATE mcp_device_codes SET status = 'approved', owner_email = ?, org_id = ? WHERE user_code = ? AND status = 'pending'`,
-        args: [ownerEmail, orgId, userCode],
+        sql: `UPDATE mcp_device_codes SET status = 'approved', owner_email = ?, org_id = ? WHERE user_code = ? AND status = 'pending' AND expires_at >= ?`,
+        args: [ownerEmail, orgId, userCode, Date.now()],
     });
-    if (result.rowsAffected === 0) {
-        const fresh = await getDeviceCodeByUserCode(userCode);
+    if (!deviceCodeMutationSucceeded(result.rowsAffected)) {
+        const fresh = await getDeviceCodeByUserCode(userCode, client);
+        if (fresh && (fresh.expiresAt ?? 0) < Date.now())
+            return "expired";
         return fresh && fresh.status !== "pending" ? "already" : "not_found";
     }
     return {
@@ -388,49 +412,53 @@ export async function approveDeviceCode(userCode, ownerEmail, orgId) {
         orgId,
     };
 }
-export async function consumeDeviceCode(deviceCode, tokenJti) {
-    await ensureTable();
-    const client = getDbExec();
-    const row = await getDeviceCode(deviceCode);
+export async function consumeDeviceCode(deviceCode, tokenJti, exec) {
+    if (!exec)
+        await ensureTable();
+    const client = exec ?? getDbExec();
+    const row = await getDeviceCode(deviceCode, client);
     if (!row)
         return null;
-    if (row.status !== "approved")
+    if (row.status !== "approved" || (row.expiresAt ?? 0) < Date.now())
         return null;
     const result = await client.execute({
-        sql: `UPDATE mcp_device_codes SET status = 'consumed', token_jti = ?, consumed_at = ? WHERE device_code = ? AND status = 'approved'`,
-        args: [tokenJti, Date.now(), deviceCode],
+        sql: `UPDATE mcp_device_codes SET status = 'consumed', token_jti = ?, consumed_at = ? WHERE device_code = ? AND status = 'approved' AND expires_at >= ?`,
+        args: [tokenJti, Date.now(), deviceCode, Date.now()],
     });
-    if (result.rowsAffected === 0)
+    if (!deviceCodeMutationSucceeded(result.rowsAffected))
         return null;
     return row;
 }
-export async function claimDeviceCodeForMint(deviceCode, tokenJti) {
-    await ensureTable();
-    const client = getDbExec();
-    const row = await getDeviceCode(deviceCode);
-    if (!row || row.status !== "approved")
+export async function claimDeviceCodeForMint(deviceCode, tokenJti, exec) {
+    if (!exec)
+        await ensureTable();
+    const client = exec ?? getDbExec();
+    const row = await getDeviceCode(deviceCode, client);
+    if (!row || row.status !== "approved" || (row.expiresAt ?? 0) < Date.now())
         return null;
     const result = await client.execute({
-        sql: `UPDATE mcp_device_codes SET status = 'minting', token_jti = ?, consumed_at = ? WHERE device_code = ? AND status = 'approved'`,
-        args: [tokenJti, Date.now(), deviceCode],
+        sql: `UPDATE mcp_device_codes SET status = 'minting', token_jti = ?, consumed_at = ? WHERE device_code = ? AND status = 'approved' AND expires_at >= ?`,
+        args: [tokenJti, Date.now(), deviceCode, Date.now()],
     });
-    if (result.rowsAffected === 0)
+    if (!deviceCodeMutationSucceeded(result.rowsAffected))
         return null;
     return row;
 }
-export async function finishDeviceCodeMint(deviceCode, tokenJti) {
-    await ensureTable();
-    const client = getDbExec();
+export async function finishDeviceCodeMint(deviceCode, tokenJti, exec) {
+    if (!exec)
+        await ensureTable();
+    const client = exec ?? getDbExec();
     const result = await client.execute({
         sql: `UPDATE mcp_device_codes SET status = 'consumed' WHERE device_code = ? AND status = 'minting' AND token_jti = ?`,
         args: [deviceCode, tokenJti],
     });
-    return result.rowsAffected > 0;
+    return deviceCodeMutationSucceeded(result.rowsAffected);
 }
-export async function releaseDeviceCodeMint(deviceCode, tokenJti) {
+export async function releaseDeviceCodeMint(deviceCode, tokenJti, exec) {
     try {
-        await ensureTable();
-        const client = getDbExec();
+        if (!exec)
+            await ensureTable();
+        const client = exec ?? getDbExec();
         await client.execute({
             sql: `UPDATE mcp_device_codes SET status = 'approved', token_jti = NULL, consumed_at = NULL WHERE device_code = ? AND status = 'minting' AND token_jti = ?`,
             args: [deviceCode, tokenJti],

package/dist/mcp/credential-issuance.d.ts

@@ -0,0 +1,23 @@
+import { type DbExec } from "../db/client.js";
+import type { OrgRole } from "../org/types.js";
+export declare class McpCredentialIssuanceError extends Error {
+    /**
+     * `not-member`: the owner lacks the live membership or role the credential
+     * needs, or holds an address an email change retired.
+     */
+    readonly reason: "not-member" | "unavailable";
+    constructor(
+    /**
+     * `not-member`: the owner lacks the live membership or role the credential
+     * needs, or holds an address an email change retired.
+     */
+    reason: "not-member" | "unavailable", options?: ErrorOptions);
+}
+export declare function withMcpCredentialIssuance<T>(input: {
+    email: string;
+    orgId?: string | null;
+    requestOrigin?: string;
+    kind?: "personal" | "service";
+    /** Roles allowed to issue, rechecked under the membership lock. */
+    roles?: readonly OrgRole[];
+}, run: (tx: DbExec) => Promise<T>): Promise<T>;

package/dist/mcp/credential-issuance.js

@@ -0,0 +1,77 @@
+import { getDbExec } from "../db/client.js";
+import { identityCredentialLockKey, readEmailRetiredAt, } from "../identity/retired-emails.js";
+import { checkCredentialOrgMembership } from "./credential-membership.js";
+export class McpCredentialIssuanceError extends Error {
+    reason;
+    constructor(
+    /**
+     * `not-member`: the owner lacks the live membership or role the credential
+     * needs, or holds an address an email change retired.
+     */
+    reason, options) {
+        super(reason, options);
+        this.reason = reason;
+        this.name = "McpCredentialIssuanceError";
+    }
+}
+export async function withMcpCredentialIssuance(input, run) {
+    const orgId = input.orgId?.trim() || null;
+    const email = input.email.trim().toLowerCase();
+    const human = input.kind !== "service";
+    const requiresMembership = orgId !== null && human;
+    if (requiresMembership) {
+        // Federation validation may update membership on another connection.
+        // Finish it before acquiring the local offboarding lock.
+        const membership = await checkCredentialOrgMembership({
+            orgId,
+            email,
+            requestOrigin: input.requestOrigin,
+        });
+        if (membership !== "member") {
+            throw new McpCredentialIssuanceError(membership);
+        }
+    }
+    const db = getDbExec();
+    if (!db.transaction)
+        throw new McpCredentialIssuanceError("unavailable");
+    try {
+        return await db.transaction(async (tx) => {
+            if (human) {
+                // Email rekey takes this lock for both addresses before its row locks.
+                await tx.execute({
+                    sql: "SELECT pg_advisory_xact_lock(hashtextextended(?, 0::bigint))",
+                    args: [identityCredentialLockKey(email)],
+                });
+                if ((await readEmailRetiredAt(tx, email)) !== null) {
+                    const { rows } = await tx.execute({
+                        sql: `SELECT 1 FROM "user" WHERE LOWER("email") = ? LIMIT 1`,
+                        args: [email],
+                    });
+                    if (rows.length === 0) {
+                        throw new McpCredentialIssuanceError("not-member");
+                    }
+                }
+            }
+            if (requiresMembership) {
+                const { rows } = await tx.execute({
+                    sql: `SELECT role FROM org_members
+                WHERE org_id = ? AND LOWER(email) = ?
+                  AND federation_removal_pending_at IS NULL
+                FOR UPDATE`,
+                    args: [orgId, email],
+                });
+                if (rows.length === 0 ||
+                    (input.roles &&
+                        !input.roles.includes(String(rows[0].role)))) {
+                    throw new McpCredentialIssuanceError("not-member");
+                }
+            }
+            return run(tx);
+        });
+    }
+    catch (error) {
+        if (error instanceof McpCredentialIssuanceError)
+            throw error;
+        throw new McpCredentialIssuanceError("unavailable", { cause: error });
+    }
+}

package/dist/mcp/credential-membership.d.ts

@@ -0,0 +1,26 @@
+import type { StoredConnectTokenIdentity } from "./connect-store.js";
+/**
+ * `unavailable` means the check could not run (database or identity-authority
+ * error, or organization tables that don't exist yet). It is neither answer:
+ * callers must refuse the request with a retryable error, and must not revoke
+ * anything on it.
+ */
+export type CredentialOrgMembership = "member" | "not-member" | "unavailable";
+export declare function checkCredentialOrgMembership(input: {
+    orgId: string;
+    email: string | undefined;
+    storedConnectToken?: StoredConnectTokenIdentity;
+    /** This app's public origin; federated orgs need it to reach the identity authority. */
+    requestOrigin?: string;
+}): Promise<CredentialOrgMembership>;
+/**
+ * `retired`: an email change moved this account off the credential's subject
+ * address after the credential was signed. `unavailable` means the same as for
+ * membership: refuse with a retryable error.
+ */
+export type CredentialEmailRetirement = "current" | "retired" | "unavailable";
+export declare function checkCredentialEmailRetirement(input: {
+    email: string;
+    /** The credential's `iat`, in seconds; absent counts as signed before. */
+    issuedAt: number | undefined;
+}): Promise<CredentialEmailRetirement>;

package/dist/mcp/credential-membership.js

@@ -0,0 +1,67 @@
+/**
+ * Live organization-membership check for long-lived MCP credentials.
+ *
+ * MCP OAuth access and refresh tokens, authorization codes, and connect tokens
+ * carry the organization they were issued for (a signed `org_id` claim or the
+ * stored org of a connect token). Removing a member does not touch those
+ * credentials, so the org they name is only an assertion from issuance time.
+ * Every use re-checks it here: two indexed queries (the membership row, then
+ * the organization row), plus a call to the identity authority when the org
+ * is linked. Nothing is cached, so a removal on any instance takes effect on
+ * the next request everywhere.
+ */
+import { getDbExec } from "../db/client.js";
+import { readEmailRetiredAt } from "../identity/retired-emails.js";
+import { isMissingOrganizationTableError, isOrgMember, } from "../org/membership.js";
+import { implicitServiceOrgRole } from "../org/service-identity.js";
+import { getRequestContext, runWithRequestContext, } from "../server/request-context.js";
+export async function checkCredentialOrgMembership(input) {
+    const orgId = input.orgId.trim();
+    const email = input.email?.trim();
+    if (!orgId || !email)
+        return "not-member";
+    // A human OAuth subject can use a service-shaped address. Only the local
+    // record of an authenticated connect token proves it is a service identity.
+    const stored = input.storedConnectToken;
+    if (stored?.kind === "service" &&
+        stored.ownerEmail === email &&
+        stored.orgId === orgId &&
+        implicitServiceOrgRole({ email, orgId, requestOrgId: stored.orgId })) {
+        return "member";
+    }
+    const lookup = () => isOrgMember(orgId, email, { requireOrganizationMetadata: true });
+    const context = getRequestContext();
+    try {
+        const member = !input.requestOrigin || context?.requestOrigin
+            ? await lookup()
+            : await runWithRequestContext({ ...context, requestOrigin: input.requestOrigin }, lookup);
+        return member ? "member" : "not-member";
+    }
+    catch (error) {
+        // Missing organization tables mean a partial migration or a fresh
+        // database, not a removal. Refuse with a retryable error; revoking a
+        // refresh token on this could not be undone.
+        if (isMissingOrganizationTableError(error)) {
+            console.error("[mcp] Organization tables are missing; refusing the credential without revoking it.");
+            return "unavailable";
+        }
+        console.error("[mcp] Organization membership check failed; refusing the credential:", error);
+        return "unavailable";
+    }
+}
+export async function checkCredentialEmailRetirement(input) {
+    try {
+        const retiredAt = await readEmailRetiredAt(getDbExec(), input.email);
+        if (retiredAt === null)
+            return "current";
+        // `iat` truncates to whole seconds, so a credential signed in the same
+        // second as the rekey is refused.
+        return input.issuedAt !== undefined && input.issuedAt * 1000 > retiredAt
+            ? "current"
+            : "retired";
+    }
+    catch (error) {
+        console.error("[mcp] Email retirement check failed; refusing the credential:", error);
+        return "unavailable";
+    }
+}