@agent-native/core 0.205.0 → 0.206.0-nightly-20261009011246

package/dist/mcp/build-server.js

@@ -6,6 +6,7 @@ import { isActionContractError, isActionExposedToExternalAgents, isActionHiddenF
 import { describeToolResultImages, extractAgentImagesFromActionResult, } from "../agent/tool-result-images.js";
 import { getAppConfig } from "../app-config/store.js";
 import { isMcpActionResult } from "../mcp-client/app-result.js";
+import { implicitServiceOrgRole } from "../org/service-identity.js";
 import { assertServicePrincipalMayCall, assertServicePrincipalMayRun, recordServicePrincipalDenial, ServicePrincipalRefusedError, } from "../org/service-principal-guard.js";
 import { isActionGranted } from "../org/service-principal-policy.js";
 import { writeActionChangeMarker } from "../server/action-change-marker-write.js";
@@ -21,7 +22,7 @@ import { consumeMcpApprovalGrant, createMcpApprovalGrant, } from "./approval-sto
 import { getBuiltinCrossAppTools } from "./builtin-tools.js";
 import { MCP_CONNECT_OAUTH_CLIENT_ID, MCP_CONNECT_SCOPE, } from "./connect-store.js";
 import { MCP_APP_REQUEST_ORIGIN_CSP_SOURCE } from "./embed-app.js";
-import { hasMcpOAuthScope, parseMcpOAuthOrgIdClaim, verifyMcpOAuthAccessToken, } from "./oauth-token.js";
+import { MCP_OAUTH_TOKEN_TYPE, hasMcpOAuthScope, parseMcpOAuthOrgIdClaim, verifyMcpOAuthAccessToken, } from "./oauth-token.js";
 import { mcpToolInputSchema } from "./tool-input-schema.js";
 const PRESERVE_MCP_OBJECT_RESULT = Symbol("preserveMcpObjectResult");
 // A GET action is a query, so its result is the payload the model asked for
@@ -32,6 +33,18 @@ function returnsQueryPayload(entry) {
     return (entry.readOnly === true ||
         (entry.http !== false && entry.http?.method === "GET"));
 }
+function verifiedServiceIdentityForRequest(identity, requestOrgId) {
+    const userEmail = identity?.userEmail?.trim();
+    const orgId = identity?.orgId;
+    if (identity?.identityAssurance !== "service" ||
+        !userEmail ||
+        typeof orgId !== "string" ||
+        orgId !== requestOrgId ||
+        !implicitServiceOrgRole({ email: userEmail, orgId, requestOrgId })) {
+        return undefined;
+    }
+    return { userEmail, orgId };
+}
 function hasVerifiedMcpUserIdentity(identity) {
     return (identity?.identityAssurance === "user" &&
         Boolean(identity.userEmail?.trim()));
@@ -1628,9 +1641,11 @@ export async function createMCPServerForRequest(config, identity, requestMeta) {
     const scopeVisibleActions = Object.fromEntries(Object.entries(actions).filter(([, entry]) => isActionVisibleForOAuthScope(entry, effectiveIdentity?.oauthScopes)));
     const orgIdPromise = resolveMcpIdentityOrgId(effectiveIdentity);
     const orgId = await orgIdPromise;
+    const verifiedServiceIdentity = verifiedServiceIdentityForRequest(effectiveIdentity, orgId);
     const visibleActions = await runWithRequestContext({
         userEmail: effectiveIdentity?.userEmail,
         orgId,
+        ...(verifiedServiceIdentity ? { verifiedServiceIdentity } : {}),
         ...(effectiveIdentity?.orgId === null
             ? { orgScope: "personal" }
             : {}),
@@ -1754,6 +1769,7 @@ export async function createMCPServerForRequest(config, identity, requestMeta) {
         return runWithRequestContext({
             userEmail: effectiveIdentity?.userEmail,
             orgId,
+            ...(verifiedServiceIdentity ? { verifiedServiceIdentity } : {}),
             ...(effectiveIdentity?.orgId === null
                 ? { orgScope: "personal" }
                 : {}),
@@ -2584,9 +2600,6 @@ async function verifyA2AJwtForMcp(token, resourceUrl) {
     if (globalSecret) {
         const payload = await verifyWithSecret(globalSecret);
         if (payload) {
-            const tokenScope = typeof payload.scope === "string" ? payload.scope : undefined;
-            const firstPartyMcp = payload.agent_native_first_party_mcp === true;
-            const locallyIssuedConnectToken = tokenScope === MCP_CONNECT_SCOPE && !firstPartyMcp;
             if (orgDomain) {
                 let organization;
                 try {
@@ -2597,19 +2610,18 @@ async function verifyA2AJwtForMcp(token, resourceUrl) {
                 catch (error) {
                     throw new McpIdentityVerificationUnavailableError(error);
                 }
-                // Locally issued connect identities are admitted below only after
-                // their active JTI row confirms the stored owner and organization.
-                if (organization?.secret.trim() === globalSecret &&
-                    !locallyIssuedConnectToken) {
+                if (organization?.secret.trim() === globalSecret) {
                     return organizationPrincipalClaims(payload, organization);
                 }
             }
+            const firstPartyMcp = payload.agent_native_first_party_mcp === true;
             const hasOrganizationClaim = Object.prototype.hasOwnProperty.call(payload, "org_id") &&
                 payload.org_id !== null;
             const hasOrganizationDomainClaim = Object.prototype.hasOwnProperty.call(payload, "org_domain") &&
                 payload.org_domain !== null;
-            const unclaimedFirstPartyToken = firstPartyMcp && !hasOrganizationClaim && !hasOrganizationDomainClaim;
-            if (locallyIssuedConnectToken || unclaimedFirstPartyToken) {
+            if (firstPartyMcp &&
+                !hasOrganizationClaim &&
+                !hasOrganizationDomainClaim) {
                 return payload;
             }
             let verifiedOrganization;
@@ -2660,22 +2672,6 @@ function mcpAudienceList(resource) {
     }
     return out;
 }
-/**
- * Null while the connect token is active. A revoked or jti-less token is
- * refused, and unreadable revocation state answers a retryable 503.
- */
-async function refuseInactiveConnectToken(jti) {
-    if (!jti)
-        return { authed: false };
-    const { isJtiRevoked } = await import("./connect-store.js");
-    try {
-        return (await isJtiRevoked(jti)) ? { authed: false } : null;
-    }
-    catch (error) {
-        console.error("[mcp] Connect-token revocation check failed; refusing the token:", error);
-        return { authed: false, unavailable: true };
-    }
-}
 /**
  * Records a connect token's use once the request is admitted, so a refused
  * call (revoked, removed member, membership check unavailable) never moves
@@ -2693,48 +2689,131 @@ async function markConnectTokenUsed(jti) {
     }
 }
 /**
- * `connectJti` is set only for connect tokens. Any other token without an
- * `org_id` claim is `unclaimed`, and its org is resolved later from
- * `org_domain` or the caller's email.
+ * Connect tokens minted before Connect used the MCP OAuth format: an
+ * A2A-shaped JWT with `scope: "mcp-connect"` and no audience, signed with this
+ * deployment's A2A_SECRET. They are this app's own credentials, not cross-app
+ * assertions, so organization secrets and organization-principal rules never
+ * apply to them: their identity is their stored row.
  */
-async function resolveConnectTokenOrgId(connectJti, claimedOrgId) {
-    let stored;
-    if (connectJti) {
-        const { lookupConnectTokenOrg } = await import("./connect-store.js");
-        stored = await lookupConnectTokenOrg(connectJti);
-        if (stored.status === "unavailable")
-            return stored;
+async function verifyLegacyConnectToken(token, claims) {
+    const secret = readDeployCredentialEnv("A2A_SECRET")?.trim();
+    if (!secret || claims.aud !== undefined)
+        return "unverified";
+    const jose = await import("jose");
+    let payload;
+    try {
+        payload = (await jose.jwtVerify(token, new TextEncoder().encode(secret)))
+            .payload;
     }
-    if (claimedOrgId !== undefined) {
-        return {
-            status: "claimed",
-            orgId: claimedOrgId,
-            ...(stored?.status === "found" ? { storedConnectToken: stored } : {}),
-        };
+    catch {
+        // coercion-ok: a bad signature or an expired token is unverified, which verifyAuth refuses unless it is a configured static token.
+        return "unverified";
+    }
+    const orgIdClaim = parseMcpOAuthOrgIdClaim(payload);
+    if (typeof payload.sub !== "string" || !payload.sub || !orgIdClaim) {
+        return "unverified";
     }
-    return stored ?? { status: "unclaimed" };
+    return {
+        userEmail: payload.sub,
+        orgId: orgIdClaim.orgId,
+        orgDomain: typeof payload.org_domain === "string" ? payload.org_domain : undefined,
+        connect: { jti: typeof payload.jti === "string" ? payload.jti : undefined },
+        ...(payload.catalog_scope === "full"
+            ? { catalogScope: "full" }
+            : {}),
+        issuedAt: typeof payload.iat === "number" ? payload.iat : undefined,
+    };
 }
-function orgIdFromConnectTokenResolution(resolution) {
-    if (resolution.status === "claimed" || resolution.status === "found") {
-        return resolution.orgId;
+/**
+ * Classifies a bearer token by the credential it declares itself to be, then
+ * verifies it as that. A token claiming to be one this app issued never
+ * reaches the A2A checks, even when it fails to verify: that is
+ * `unverified`. Null means it makes no such claim.
+ */
+async function verifyIssuedMcpCredential(token, resourceUrl) {
+    const jose = await import("jose");
+    let claims;
+    try {
+        claims = jose.decodeJwt(token);
+    }
+    catch {
+        // coercion-ok: a token that is not a JWT is not an issued credential; the static-token check still runs.
+        return null;
+    }
+    if (claims.scope === MCP_CONNECT_SCOPE &&
+        claims.agent_native_first_party_mcp !== true) {
+        return verifyLegacyConnectToken(token, claims);
     }
-    // A first-party cross-app token with no row here was not issued for any org
-    // this app knows. Its `org_domain` claim must not grant that domain's org.
-    if (resolution.status === "missing")
+    if (claims.typ !== MCP_OAUTH_TOKEN_TYPE)
         return null;
-    return undefined;
+    const oauth = await verifyMcpOAuthAccessToken(token, resourceUrl);
+    if (!oauth)
+        return "unverified";
+    return {
+        userEmail: oauth.userEmail,
+        orgId: oauth.orgId,
+        orgDomain: oauth.orgDomain,
+        ...(oauth.clientId === MCP_CONNECT_OAUTH_CLIENT_ID
+            ? { connect: { jti: oauth.jti } }
+            : {}),
+        oauthScopes: oauth.scopes,
+        oauthClientId: oauth.clientId,
+        ...(oauth.catalogScope ? { catalogScope: oauth.catalogScope } : {}),
+        issuedAt: oauth.issuedAt,
+    };
 }
-function matchesStoredConnectTokenIdentity(resolution, input) {
-    const stored = resolution.status === "found"
-        ? resolution
-        : resolution.status === "claimed"
-            ? resolution.storedConnectToken
-            : undefined;
-    if (!stored || !input.ownerEmail?.trim())
-        return false;
-    return (stored.ownerEmail.trim().toLowerCase() ===
-        input.ownerEmail.trim().toLowerCase() &&
-        (input.orgId === undefined || stored.orgId === input.orgId));
+/**
+ * The one admission path for MCP credentials this app issued. A connect token
+ * is admitted only while its stored row exists, is unrevoked, and names the
+ * token's subject and org claim; the row also supplies the org of a token
+ * without a claim and marks service identities. Every credential then passes
+ * `admitIssuedCredential`.
+ */
+async function admitIssuedMcpCredential(credential, requestOrigin) {
+    let stored;
+    if (credential.connect) {
+        if (!credential.connect.jti)
+            return { authed: false, refusal: "invalid" };
+        const { lookupConnectTokenOrg } = await import("./connect-store.js");
+        const lookup = await lookupConnectTokenOrg(credential.connect.jti);
+        if (lookup.status === "unavailable") {
+            return { authed: false, unavailable: true };
+        }
+        if (lookup.status === "revoked") {
+            return { authed: false, refusal: "revoked" };
+        }
+        if (lookup.status === "missing") {
+            return { authed: false, refusal: "unknown-connect-token" };
+        }
+        if (lookup.ownerEmail.trim().toLowerCase() !==
+            credential.userEmail.trim().toLowerCase() ||
+            (credential.orgId !== undefined && lookup.orgId !== credential.orgId)) {
+            return { authed: false, refusal: "identity-mismatch" };
+        }
+        stored = lookup;
+    }
+    const orgId = credential.orgId !== undefined ? credential.orgId : stored?.orgId;
+    const admitted = await admitIssuedCredential({
+        authed: true,
+        identity: {
+            userEmail: credential.userEmail,
+            identityAssurance: stored?.kind === "service" ? "service" : "user",
+            ...(orgId !== undefined ? { orgId } : {}),
+            orgDomain: credential.orgDomain,
+            ...(credential.oauthScopes
+                ? { oauthScopes: credential.oauthScopes }
+                : {}),
+            ...(credential.oauthClientId
+                ? { oauthClientId: credential.oauthClientId }
+                : {}),
+        },
+        fullSurface: true,
+        fullCatalog: credential.catalogScope === "full",
+    }, requestOrigin, stored, credential.issuedAt);
+    if (admitted.authed && credential.connect) {
+        await markConnectTokenUsed(credential.connect.jti);
+    }
+    return admitted;
 }
 /**
  * Credentials this app issues (MCP OAuth access tokens and connect tokens)
@@ -2746,14 +2825,9 @@ function matchesStoredConnectTokenIdentity(resolution, input) {
  *
  * They also carry the subject's address, which an email change retires; a
  * credential signed for it before the change is refused, Personal or not.
- *
- * Shared-secret A2A org claims must resolve against local metadata before they
- * become request scope. A sibling app's user roster is not this app's roster;
- * locally issued connect credentials instead use their stored JTI owner and
- * organization.
  */
-async function admitIssuedCredential(result, requestOrigin, orgResolution, issuedAt) {
-    const admitted = await checkIssuedCredential(result, requestOrigin, orgResolution, issuedAt);
+async function admitIssuedCredential(result, requestOrigin, storedConnectToken, issuedAt) {
+    const admitted = await checkIssuedCredential(result, requestOrigin, storedConnectToken, issuedAt);
     return admitted.authed ? admitServicePrincipal(admitted) : admitted;
 }
 /**
@@ -2785,10 +2859,10 @@ async function admitServicePrincipal(result) {
         }
         return error.statusCode === 503
             ? { authed: false, unavailable: true }
-            : { authed: false };
+            : { authed: false, refusal: "service-principal-inactive" };
     }
 }
-async function checkIssuedCredential(result, requestOrigin, orgResolution, issuedAt) {
+async function checkIssuedCredential(result, requestOrigin, storedConnectToken, issuedAt) {
     const { checkCredentialEmailRetirement, checkCredentialOrgMembership } = await import("./credential-membership.js");
     if (result.identity.userEmail) {
         const retirement = await checkCredentialEmailRetirement({
@@ -2798,7 +2872,7 @@ async function checkIssuedCredential(result, requestOrigin, orgResolution, issue
         if (retirement !== "current")
             return retirement === "unavailable"
                 ? { authed: false, unavailable: true }
-                : { authed: false };
+                : { authed: false, refusal: "email-retired" };
     }
     const orgId = result.identity.orgId;
     if (typeof orgId !== "string" || !orgId)
@@ -2807,90 +2881,54 @@ async function checkIssuedCredential(result, requestOrigin, orgResolution, issue
         orgId,
         email: result.identity.userEmail,
         requestOrigin,
-        ...(orgResolution.status === "found"
-            ? { storedConnectToken: orgResolution }
-            : orgResolution.status === "claimed" && orgResolution.storedConnectToken
-                ? { storedConnectToken: orgResolution.storedConnectToken }
-                : {}),
+        ...(storedConnectToken ? { storedConnectToken } : {}),
     });
     if (membership === "member")
         return result;
     return membership === "unavailable"
         ? { authed: false, unavailable: true }
-        : { authed: false };
+        : { authed: false, refusal: "not-member" };
 }
 /**
  * Verify the inbound auth header. Returns:
- *   - { authed: true, identity } when verified. A deployment-secret JWT may
+ *   - { authed: true, identity } when verified. A credential this app issued
+ *     (an MCP OAuth access token or a connect token) supplies its subject and
+ *     org, checked against live membership. A deployment-secret A2A JWT may
  *     supply its asserted user (`sub`), while an org-secret JWT supplies only
- *     verified organization scope. Legacy connect tokens recover stored org
- *     scope. Static-token auth gets identity from `AGENT_NATIVE_OWNER_EMAIL`
- *     or `X-Agent-Native-Owner-Email` (the `agent-native mcp install` flow).
- *     `identity` is undefined only for true dev-open with no owner hint.
- *   - { authed: false } on rejection.
+ *     verified organization scope. Static-token auth gets identity from
+ *     `AGENT_NATIVE_OWNER_EMAIL` or `X-Agent-Native-Owner-Email` (the
+ *     `agent-native mcp install` flow). `identity` is undefined only for true
+ *     dev-open with no owner hint.
+ *   - { authed: false, refusal? } on rejection; `refusal` is set whenever a
+ *     presented token was refused.
  *
- * A deployment-secret A2A JWT can supply its trusted `sub` (caller email).
- * An org-secret JWT never supplies a user identity; both paths bind
- * `org_domain` to local organization metadata. Legacy connect tokens can use
- * a stored-org fallback. The MCP endpoint wraps tool runs in
- * `runWithRequestContext({ userEmail, orgId })`. Without that wrap, the
- * MCP endpoint loses tenant identity and downstream `accessFilter` /
- * `resolveCredential` calls fall back to platform-wide defaults.
+ * Credentials this app issued are recognized and verified before any A2A
+ * rule runs, so a change to cross-app trust cannot reclassify them. Both A2A
+ * paths bind `org_domain` to local organization metadata. The MCP endpoint
+ * wraps tool runs in `runWithRequestContext({ userEmail, orgId })`. Without
+ * that wrap, the MCP endpoint loses tenant identity and downstream
+ * `accessFilter` / `resolveCredential` calls fall back to platform-wide
+ * defaults.
  *
  * `ownerEmailHeader` is the forwarded `X-Agent-Native-Owner-Email` value; it
  * is consulted ONLY on the static-token / dev-open path (never to influence
  * verified JWT identity), so the install flow runs tools as the configured
  * owner instead of an unscoped anonymous caller.
- *
- * A credential this app issued that names an organization is admitted only
- * while its subject is still a member, and none is admitted for an address an
- * email change retired after signing (see `admitIssuedCredential`).
  */
 export async function verifyAuth(authHeader, ownerEmailHeader, options = {}) {
     const accessTokens = getAccessTokens();
     const hasA2ASecret = !!readDeployCredentialEnv("A2A_SECRET")?.trim();
     const token = getBearerToken(authHeader);
     if (token) {
-        const oauthIdentity = await verifyMcpOAuthAccessToken(token, options.resourceUrl);
-        if (oauthIdentity) {
-            if (oauthIdentity.clientId === MCP_CONNECT_OAUTH_CLIENT_ID) {
-                const refused = await refuseInactiveConnectToken(oauthIdentity.jti);
-                if (refused)
-                    return refused;
-            }
-            const orgResolution = await resolveConnectTokenOrgId(oauthIdentity.clientId === MCP_CONNECT_OAUTH_CLIENT_ID
-                ? oauthIdentity.jti
-                : undefined, oauthIdentity.orgId);
-            if (orgResolution.status === "unavailable") {
-                return { authed: false, unavailable: true };
-            }
-            if (oauthIdentity.clientId === MCP_CONNECT_OAUTH_CLIENT_ID &&
-                !matchesStoredConnectTokenIdentity(orgResolution, {
-                    ownerEmail: oauthIdentity.userEmail,
-                    orgId: oauthIdentity.orgId,
-                })) {
-                return { authed: false };
-            }
-            const orgId = orgIdFromConnectTokenResolution(orgResolution);
-            const admitted = await admitIssuedCredential({
-                authed: true,
-                identity: {
-                    userEmail: oauthIdentity.userEmail,
-                    identityAssurance: "user",
-                    ...(orgId !== undefined ? { orgId } : {}),
-                    orgDomain: oauthIdentity.orgDomain,
-                    oauthScopes: oauthIdentity.scopes,
-                    oauthClientId: oauthIdentity.clientId,
-                },
-                fullSurface: true,
-                fullCatalog: oauthIdentity.catalogScope === "full",
-            }, options.requestOrigin, orgResolution, oauthIdentity.issuedAt);
-            if (admitted.authed &&
-                oauthIdentity.clientId === MCP_CONNECT_OAUTH_CLIENT_ID) {
-                await markConnectTokenUsed(oauthIdentity.jti);
-            }
-            return admitted;
+        const issued = await verifyIssuedMcpCredential(token, options.resourceUrl);
+        if (issued === "unverified") {
+            return ((await matchStaticAccessToken(token, accessTokens, ownerEmailHeader)) ?? {
+                authed: false,
+                refusal: "invalid",
+            });
         }
+        if (issued)
+            return admitIssuedMcpCredential(issued, options.requestOrigin);
     }
     if (accessTokens.length === 0 && !hasA2ASecret && !token) {
         if (options.allowDevOpen === false) {
@@ -2915,58 +2953,33 @@ export async function verifyAuth(authHeader, ownerEmailHeader, options = {}) {
         throw error;
     }
     if (payload) {
+        // Connect tokens this app minted never reach here, so a connect-scoped
+        // token is a sibling app's per-call first-party MCP token.
         const tokenScope = typeof payload.scope === "string" ? payload.scope : undefined;
         if (tokenScope && tokenScope !== MCP_CONNECT_SCOPE) {
-            return { authed: false };
-        }
-        // Connect-minted tokens (scope === "mcp-connect") carry a random `jti`
-        // and are individually revocable. Only these tokens hit the revoke
-        // store — ordinary A2A delegation JWTs skip the DB lookup entirely so
-        // the hot path is unchanged.
-        if (tokenScope === MCP_CONNECT_SCOPE) {
-            const refused = await refuseInactiveConnectToken(payload.jti);
-            if (refused)
-                return refused;
+            return { authed: false, refusal: "invalid" };
         }
         const orgIdClaim = parseMcpOAuthOrgIdClaim(payload);
         if (!orgIdClaim)
-            return { authed: false };
+            return { authed: false, refusal: "invalid" };
         const firstPartyMcp = payload.agent_native_first_party_mcp === true;
-        const orgResolution = await resolveConnectTokenOrgId(tokenScope === MCP_CONNECT_SCOPE &&
-            (!firstPartyMcp || orgIdClaim.orgId === undefined)
-            ? payload.jti
-            : undefined, orgIdClaim.orgId);
-        if (orgResolution.status === "unavailable") {
-            return { authed: false, unavailable: true };
-        }
-        if (tokenScope === MCP_CONNECT_SCOPE && !firstPartyMcp) {
-            if (!matchesStoredConnectTokenIdentity(orgResolution, {
-                ownerEmail: typeof payload.sub === "string" ? payload.sub : undefined,
-                orgId: orgIdClaim.orgId,
-            })) {
-                return { authed: false };
-            }
-        }
-        const orgId = orgIdFromConnectTokenResolution(orgResolution);
-        const storedConnectToken = orgResolution.status === "found"
-            ? orgResolution
-            : orgResolution.status === "claimed"
-                ? orgResolution.storedConnectToken
+        // A first-party token without an org claim was not issued for any org
+        // this app knows. Its `org_domain` or caller email must not grant one.
+        const orgId = orgIdClaim.orgId !== undefined
+            ? orgIdClaim.orgId
+            : tokenScope === MCP_CONNECT_SCOPE
+                ? null
                 : undefined;
-        const verified = {
+        return admitServicePrincipal({
             authed: true,
             identity: {
                 userEmail: typeof payload.sub === "string" ? payload.sub : undefined,
-                ...(tokenScope === MCP_CONNECT_SCOPE &&
-                    !firstPartyMcp &&
-                    storedConnectToken?.kind === "service"
-                    ? { identityAssurance: "service" }
-                    : typeof payload.sub === "string"
-                        ? { identityAssurance: "user" }
-                        : typeof payload.org_id === "string" ||
-                            typeof payload.org_domain === "string"
-                            ? { identityAssurance: "organization" }
-                            : {}),
+                ...(typeof payload.sub === "string"
+                    ? { identityAssurance: "user" }
+                    : typeof payload.org_id === "string" ||
+                        typeof payload.org_domain === "string"
+                        ? { identityAssurance: "organization" }
+                        : {}),
                 ...(orgId !== undefined ? { orgId } : {}),
                 orgDomain: typeof payload.org_domain === "string"
                     ? payload.org_domain
@@ -2975,45 +2988,40 @@ export async function verifyAuth(authHeader, ownerEmailHeader, options = {}) {
             },
             fullSurface: true,
             fullCatalog: payload.catalog_scope === "full",
-        };
-        // First-party MCP tokens share the connect scope but are minted by a
-        // sibling app per call, so they are cross-app A2A tokens.
-        const admitted = tokenScope === MCP_CONNECT_SCOPE && !firstPartyMcp
-            ? await admitIssuedCredential(verified, options.requestOrigin, orgResolution, typeof payload.iat === "number" ? payload.iat : undefined)
-            : await admitServicePrincipal(verified);
-        if (admitted.authed && tokenScope === MCP_CONNECT_SCOPE) {
-            await markConnectTokenUsed(payload.jti);
-        }
-        return admitted;
-    }
-    if (accessTokens.length === 0) {
-        // A supplied bearer that failed JWT verification must not fall through to
-        // dev-open auth or reuse a forwarded owner-email hint.
-        return { authed: false };
-    }
-    // Try ACCESS_TOKEN / ACCESS_TOKENS exact match. Static tokens carry no
-    // per-caller claims, so derive identity from the forwarded owner-email
-    // hint (install flow) — otherwise tools would run unscoped. Compare in
-    // constant time (matching the rest of this subsystem's secret-comparison
-    // discipline); node:crypto is imported dynamically because this module is
-    // bundled into the serverless function and avoids static Node-only imports.
-    if (accessTokens.length > 0) {
-        const { timingSafeEqual } = await import("node:crypto");
-        const candidate = Buffer.from(token, "utf8");
-        const matched = accessTokens.some((configured) => {
-            const expected = Buffer.from(configured, "utf8");
-            return (expected.length === candidate.length &&
-                timingSafeEqual(expected, candidate));
         });
-        if (matched) {
-            return {
-                authed: true,
-                identity: deriveStaticTokenIdentity(ownerEmailHeader),
-                fullSurface: true,
-            };
-        }
     }
-    return { authed: false };
+    // A supplied bearer that failed JWT verification must not fall through to
+    // dev-open auth or reuse a forwarded owner-email hint.
+    return ((await matchStaticAccessToken(token, accessTokens, ownerEmailHeader)) ?? {
+        authed: false,
+        refusal: "invalid",
+    });
+}
+/**
+ * ACCESS_TOKEN / ACCESS_TOKENS exact match. Static tokens carry no per-caller
+ * claims, so identity comes from the forwarded owner-email hint (install flow)
+ * — otherwise tools would run unscoped. Compared in constant time, matching
+ * the rest of this subsystem's secret-comparison discipline; node:crypto is
+ * imported dynamically because this module is bundled into the serverless
+ * function and avoids static Node-only imports.
+ */
+async function matchStaticAccessToken(token, accessTokens, ownerEmailHeader) {
+    if (accessTokens.length === 0)
+        return null;
+    const { timingSafeEqual } = await import("node:crypto");
+    const candidate = Buffer.from(token, "utf8");
+    const matched = accessTokens.some((configured) => {
+        const expected = Buffer.from(configured, "utf8");
+        return (expected.length === candidate.length &&
+            timingSafeEqual(expected, candidate));
+    });
+    if (!matched)
+        return null;
+    return {
+        authed: true,
+        identity: deriveStaticTokenIdentity(ownerEmailHeader),
+        fullSurface: true,
+    };
 }
 export async function resolveOrgIdFromDomain(orgDomain) {
     if (!orgDomain)

package/dist/mcp/connect-route.d.ts

@@ -4,6 +4,14 @@ export interface McpConnectRouteOptions {
     appName?: string;
     serverName?: string;
 }
+/**
+ * Neither the request nor configuration names this app's public URL, so no
+ * audience `verifyAuth` would accept can be resolved. Guessing one would mint a
+ * token the app then refuses.
+ */
+export declare class OrgServiceTokenAppUrlError extends Error {
+    constructor();
+}
 /**
  * Mint an ORG SERVICE token: a connect-scoped, revocable bearer whose subject
  * is the synthetic service identity `svc-<name>@service.<orgId>` instead of a
@@ -14,7 +22,7 @@ export interface McpConnectRouteOptions {
  *
  * The token value is returned exactly once and never persisted — only the
  * random `jti` is stored, so the standard revocation path
- * (`isJtiRevoked` in `verifyAuth`) applies to service tokens identically.
+ * (`lookupConnectTokenOrg` in `verifyAuth`) applies to service tokens identically.
  *
  * The `create-org-service-token` action gates on org owner/admin before
  * calling this. Offboarding can remove that admin before the mint, so the
@@ -27,7 +35,8 @@ export declare function mintOrgServiceToken(params: {
     /** The human minting the token — stored for audit, never used as identity. */
     createdBy: string;
     ttlDays?: number;
-    appUrl: string;
+    /** The caller's request origin, when there is a request. */
+    appUrl: string | undefined;
 }): Promise<{
     token: string;
     jti: string;