@agent-native/core 0.209.2 → 0.209.3-nightly-20261016212700

package/dist/jobs/scheduler-health.d.ts

@@ -1,4 +1,4 @@
-import { type MigrationEntry } from "../db/migrations.js";
+import type { MigrationEntry } from "../db/migrations.js";
 export declare const AUTOMATION_SCHEDULER_LEASE_MS: number;
 export declare const AUTOMATION_SCHEDULER_LEASE_RENEWAL_MS = 60000;
 export declare class AutomationSchedulerLeaseLostError extends Error {
@@ -6,7 +6,8 @@ export declare class AutomationSchedulerLeaseLostError extends Error {
     constructor(cause?: unknown);
 }
 export declare const AUTOMATION_SCHEDULER_HEALTH_MIGRATIONS: MigrationEntry[];
-export declare function runAutomationSchedulerHealthMigrations(nitroApp: unknown): Promise<void>;
+/** Kept for callers of the public export; the store owns these migrations. */
+export declare function runAutomationSchedulerHealthMigrations(_nitroApp?: unknown): Promise<void>;
 export interface AutomationSchedulerHealth {
     appId: string;
     orgId: string | null;

package/dist/jobs/scheduler-health.js

@@ -1,8 +1,8 @@
 import { randomUUID } from "node:crypto";
 import { getDbExec } from "../db/client.js";
 import { ensureColumnExists, ensureIndexExists, ensureTableExists, } from "../db/ddl-guard.js";
-import { runMigrations } from "../db/migrations.js";
 import { defineStore } from "../db/store-registry.js";
+import { fromMigrationEntries } from "../db/versioned-store-migrations.js";
 import { automationRecoveryMessagesForLocale } from "../localization/automation-recovery-messages.js";
 const TABLE = "automation_scheduler_health";
 const DEFAULT_APP_ID = "default";
@@ -50,10 +50,9 @@ export const AUTOMATION_SCHEDULER_HEALTH_MIGRATIONS = [
     `,
     },
 ];
-export async function runAutomationSchedulerHealthMigrations(nitroApp) {
-    await runMigrations(AUTOMATION_SCHEDULER_HEALTH_MIGRATIONS, {
-        table: "_automation_scheduler_health_migrations",
-    })(nitroApp);
+/** Kept for callers of the public export; the store owns these migrations. */
+export async function runAutomationSchedulerHealthMigrations(_nitroApp) {
+    await schedulerHealthStore.ready();
 }
 function normalizeAppId(appId) {
     const normalized = appId?.trim();
@@ -96,6 +95,7 @@ export const schedulerHealthStore = defineStore({
                 await ensureIndexExists(`idx_${TABLE}_updated`, indexSql);
             },
         },
+        ...fromMigrationEntries("_automation_scheduler_health_migrations", AUTOMATION_SCHEDULER_HEALTH_MIGRATIONS),
     ],
 });
 export function ensureHealthTable() {

package/dist/mcp/build-server.d.ts

@@ -156,6 +156,9 @@ export declare class McpIdentityVerificationUnavailableError extends Error {
     readonly cause: unknown;
     constructor(cause: unknown);
 }
+export declare class McpIdentityVerificationRefusedError extends Error {
+    constructor();
+}
 export type VerifyAuthResult = {
     authed: boolean;
     identity?: MCPCallerIdentity;

package/dist/mcp/build-server.js

@@ -2843,6 +2843,12 @@ export class McpIdentityVerificationUnavailableError extends Error {
         this.cause = cause;
     }
 }
+export class McpIdentityVerificationRefusedError extends Error {
+    constructor() {
+        super("MCP identity verification was refused");
+        this.name = "McpIdentityVerificationRefusedError";
+    }
+}
 async function verifyA2AJwtForMcp(token, resourceUrl) {
     const jose = await import("jose");
     let unverifiedPayload = null;
@@ -3245,6 +3251,9 @@ export async function verifyAuth(authHeader, ownerEmailHeader, options = {}) {
         if (error instanceof McpIdentityVerificationUnavailableError) {
             return { authed: false, unavailable: true };
         }
+        if (error instanceof McpIdentityVerificationRefusedError) {
+            return { authed: false, refusal: "invalid" };
+        }
         throw error;
     }
     if (payload) {
@@ -3321,21 +3330,29 @@ async function matchStaticAccessToken(token, accessTokens, ownerEmailHeader) {
 export async function resolveOrgIdFromDomain(orgDomain) {
     if (!orgDomain)
         return undefined;
+    const { lookupOrgByDomain } = await import("../org/context.js");
+    let result;
     try {
-        const { resolveOrgByDomain } = await import("../org/context.js");
-        const org = await resolveOrgByDomain(orgDomain);
-        return org?.orgId ?? undefined;
+        result = await lookupOrgByDomain(orgDomain);
     }
-    catch {
-        return undefined;
+    catch (cause) {
+        throw new McpIdentityVerificationUnavailableError(cause);
+    }
+    if (result.status === "ambiguous") {
+        throw new McpIdentityVerificationRefusedError();
     }
+    return result.status === "found" ? result.org.orgId : undefined;
 }
 export async function resolveMcpIdentityOrgId(identity) {
     if (identity?.orgId !== undefined)
         return identity.orgId ?? undefined;
-    const orgIdFromDomain = await resolveOrgIdFromDomain(identity?.orgDomain);
-    if (orgIdFromDomain)
+    if (identity?.orgDomain !== undefined) {
+        const orgIdFromDomain = await resolveOrgIdFromDomain(identity.orgDomain);
+        if (!orgIdFromDomain) {
+            throw new McpIdentityVerificationRefusedError();
+        }
         return orgIdFromDomain;
+    }
     const userEmail = identity?.userEmail?.trim();
     if (!userEmail)
         return undefined;

package/dist/mcp/server.js

@@ -8,7 +8,7 @@ import { getH3App } from "../server/framework-request-handler.js";
 import { getOrigin } from "../server/google-oauth.js";
 import { readBody } from "../server/h3-helpers.js";
 import { trackMcpInitialize } from "./analytics.js";
-import { createMCPServerForRequest, verifyAuth, McpIdentityVerificationUnavailableError, getAccessTokens, resolveOrgIdFromDomain, buildLinkArtifacts, McpDirectoryProfileValidationError, validateMcpDirectoryProfile, validateMcpDirectoryWidgetDomain, selectMcpActionSurface, selectMcpDirectoryWidgetReadActions, selectMcpDirectoryWidgetWriteActions, } from "./build-server.js";
+import { createMCPServerForRequest, verifyAuth, McpIdentityVerificationUnavailableError, McpIdentityVerificationRefusedError, getAccessTokens, resolveOrgIdFromDomain, resolveMcpIdentityOrgId, buildLinkArtifacts, McpDirectoryProfileValidationError, validateMcpDirectoryProfile, validateMcpDirectoryWidgetDomain, selectMcpActionSurface, selectMcpDirectoryWidgetReadActions, selectMcpDirectoryWidgetWriteActions, } from "./build-server.js";
 import { buildMcpOAuthChallenge, getMcpOAuthAudiences, getMcpOAuthIssuer, getMcpOAuthProtectedResourceMetadataUrl, getMcpOAuthResource, } from "./oauth-route.js";
 import { MCP_DIRECTORY_ROUTE_PREFIX, MCP_PUBLIC_ROUTE_PREFIX, MCP_ROUTE_PREFIXES, joinMcpRoute, } from "./route-paths.js";
 export { createMCPServerForRequest, verifyAuth, getAccessTokens, resolveOrgIdFromDomain, buildLinkArtifacts, selectMcpDirectoryWidgetReadActions, selectMcpDirectoryWidgetWriteActions, };
@@ -183,6 +183,19 @@ function directoryProfileUnavailable(event, validationError) {
         message: "The MCP directory is unavailable because its profile or widget origin is invalid.",
     };
 }
+function identityVerificationUnavailable(event) {
+    setResponseStatus(event, 503);
+    setResponseHeader(event, "Retry-After", "5");
+    return {
+        error: "Service Unavailable",
+        message: CREDENTIAL_MEMBERSHIP_UNAVAILABLE_MESSAGE,
+    };
+}
+function identityVerificationRefused(event, routePath) {
+    setResponseStatus(event, 401);
+    setResponseHeader(event, "WWW-Authenticate", buildMcpOAuthChallenge(event, routePath, "invalid"));
+    return buildUnauthorizedBody(event, routePath, "invalid");
+}
 // ---------------------------------------------------------------------------
 // handleMcpRequest — runtime-agnostic MCP request handler
 // ---------------------------------------------------------------------------
@@ -245,14 +258,13 @@ async function handleMcpRequestInternal(event, config, routePath = MCP_PUBLIC_RO
         });
     }
     catch (error) {
-        if (!(error instanceof McpIdentityVerificationUnavailableError))
-            throw error;
-        setResponseStatus(event, 503);
-        setResponseHeader(event, "Retry-After", "5");
-        return {
-            error: "Service Unavailable",
-            message: CREDENTIAL_MEMBERSHIP_UNAVAILABLE_MESSAGE,
-        };
+        if (error instanceof McpIdentityVerificationUnavailableError) {
+            return identityVerificationUnavailable(event);
+        }
+        if (error instanceof McpIdentityVerificationRefusedError) {
+            return identityVerificationRefused(event, routePath);
+        }
+        throw error;
     }
     if (!authResult.authed && authResult.unavailable) {
         // The token is valid but its org membership could not be checked. No auth
@@ -270,6 +282,25 @@ async function handleMcpRequestInternal(event, config, routePath = MCP_PUBLIC_RO
         setResponseHeader(event, "WWW-Authenticate", buildMcpOAuthChallenge(event, routePath, authResult.refusal));
         return buildUnauthorizedBody(event, routePath, authResult.refusal);
     }
+    if (authResult.identity?.orgId === undefined &&
+        authResult.identity?.orgDomain !== undefined) {
+        try {
+            const orgId = await resolveMcpIdentityOrgId(authResult.identity);
+            authResult = {
+                ...authResult,
+                identity: { ...authResult.identity, orgId },
+            };
+        }
+        catch (error) {
+            if (error instanceof McpIdentityVerificationUnavailableError) {
+                return identityVerificationUnavailable(event);
+            }
+            if (error instanceof McpIdentityVerificationRefusedError) {
+                return identityVerificationRefused(event, routePath);
+            }
+            throw error;
+        }
+    }
     const body = method === "POST" ? await readBody(event) : undefined;
     onMcpMethod?.(directoryLogMethod(body) ?? method);
     const initializeRequest = body

package/dist/notifications/routes.d.ts

@@ -16,6 +16,6 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
 } | {
     count?: undefined;
     updated?: undefined;
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/oauth-tokens/store.js

@@ -1,8 +1,10 @@
 import { getDbExec } from "../db/client.js";
 import { ensureColumnExists, ensureTableExists } from "../db/ddl-guard.js";
 import { defineStore } from "../db/store-registry.js";
+import { fromMigrationEntries } from "../db/versioned-store-migrations.js";
 import { widenIntColumnsToBigInt } from "../db/widen-columns.js";
 import { encryptSecretValue, decryptSecretValue, isEncryptedSecretValue, } from "../secrets/crypto.js";
+import { OAUTH_TOKEN_MIGRATIONS, OAUTH_TOKEN_MIGRATIONS_TABLE, } from "./migrations.js";
 function serializeTokens(tokens) {
     return encryptSecretValue(JSON.stringify(tokens));
 }
@@ -79,6 +81,7 @@ export const oauthTokensStore = defineStore({
                 await widenIntColumnsToBigInt("oauth_tokens", ["updated_at"], exec);
             },
         },
+        ...fromMigrationEntries(OAUTH_TOKEN_MIGRATIONS_TABLE, OAUTH_TOKEN_MIGRATIONS, { data: [4, 6] }),
     ],
 });
 export function ensureTable() {

package/dist/observability/routes.d.ts

@@ -33,26 +33,26 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     spans?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     message?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
-    error?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     message?: undefined;
     summary?: undefined;
     spans?: undefined;
     traceMissing: true;
     id: string;
-    error?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     message?: undefined;
     summary?: undefined;
     spans?: undefined;
     traceMissing?: undefined;
     id: string;
-    error?: undefined;
     ok?: undefined;
 } | {
     message?: undefined;
@@ -61,9 +61,9 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     error: any;
     ok?: undefined;
 } | {
+    error?: undefined;
     message?: undefined;
     summary?: undefined;
     spans?: undefined;
-    error?: undefined;
     ok: boolean;
 }>>;

package/dist/observability/store.js

@@ -2,6 +2,8 @@ import { z } from "zod";
 import { getDbExec } from "../db/client.js";
 import { ensureTableExists, ensureColumnExists, ensureIndexExists, } from "../db/ddl-guard.js";
 import { defineStore } from "../db/store-registry.js";
+import { fromMigrationEntries } from "../db/versioned-store-migrations.js";
+import { OBSERVABILITY_MIGRATIONS, OBSERVABILITY_MIGRATIONS_TABLE, } from "./migrations.js";
 import { sanitizeToolErrorMessage, TOOL_ERROR_CAPTURE_METADATA_KEY, TOOL_ERROR_DETAIL_METADATA_KEY, } from "./trace-error.js";
 import { redactSensitiveFields } from "./trace-redaction.js";
 import { observabilityReviewThreadKey } from "./types.js";
@@ -118,6 +120,7 @@ function withUserFilter(baseWhere, baseArgs, userId, orgId) {
 }
 export const observabilityStore = defineStore({
     id: "observability",
+    after: ["chat_threads"],
     migrations: [
         {
             name: "baseline",
@@ -334,6 +337,7 @@ export const observabilityStore = defineStore({
                 await ensureIndexExists("idx_experiment_results_exp", `CREATE INDEX IF NOT EXISTS idx_experiment_results_exp ON agent_experiment_results (experiment_id)`);
             },
         },
+        ...fromMigrationEntries(OBSERVABILITY_MIGRATIONS_TABLE, OBSERVABILITY_MIGRATIONS, { data: [1, 2, 3] }),
     ],
 });
 export function ensureObservabilityTables() {

package/dist/org/auto-join-domain.js

@@ -59,24 +59,32 @@ export async function autoJoinDomainMatchingOrgs(rawEmail, options = {}) {
     try {
         const res = await db.execute({
             sql: `SELECT o.id AS "orgId", o.identity_authority AS "identityAuthority",
-                   o.identity_id AS "identityId"
+                   o.identity_id AS "identityId",
+                   EXISTS (
+                     SELECT 1 FROM org_members m
+                     WHERE m.org_id = o.id
+                       AND LOWER(m.email) = ?
+                       AND m.federation_removal_pending_at IS NULL
+                   ) AS "isMember"
             FROM organizations o
             WHERE LOWER(o.allowed_domain) = ?
-              AND NOT EXISTS (
-                SELECT 1
-                FROM org_members m
-                WHERE m.org_id = o.id
-                  AND LOWER(m.email) = ?
-                  AND m.federation_removal_pending_at IS NULL
-              )
-            ORDER BY o.created_at ASC`,
-            args: [domain, email],
+            LIMIT 2`,
+            args: [email, domain],
         });
-        matches = res.rows.map((r) => ({
-            orgId: String(r.orgId ?? r.org_id),
-            federated: Boolean(String(r.identityAuthority ?? r.identity_authority ?? "").trim() &&
-                String(r.identityId ?? r.identity_id ?? "").trim()),
-        }));
+        if (res.rows.length > 1)
+            return { joined: [], activeOrgId: null };
+        if (res.rows.length === 1) {
+            const row = res.rows[0];
+            if (Boolean(row.isMember ?? row.is_member)) {
+                return { joined: [], activeOrgId: null };
+            }
+            matches = [
+                {
+                    orgId: String(row.orgId ?? row.org_id),
+                    federated: Boolean(String(row.identityAuthority ?? row.identity_authority ?? "").trim() && String(row.identityId ?? row.identity_id ?? "").trim()),
+                },
+            ];
+        }
     }
     catch {
         return { joined: [], activeOrgId: null };

package/dist/org/context.d.ts

@@ -56,6 +56,18 @@ export declare function bootstrapAdminOrganization(rawEmail: string, event?: H3E
 export declare function getOrgDomain(orgId: string): Promise<string | null>;
 export declare function getOrgA2ASecret(orgId: string): Promise<string | null>;
 export declare function getA2ASecretByDomain(domain: string): Promise<string | null>;
+export type OrgDomainLookup = {
+    status: "found";
+    org: {
+        orgId: string;
+        orgName: string;
+    };
+} | {
+    status: "not-found";
+} | {
+    status: "ambiguous";
+};
+export declare function lookupOrgByDomain(domain: string): Promise<OrgDomainLookup>;
 export declare function resolveOrgByDomain(domain: string): Promise<{
     orgId: string;
     orgName: string;

package/dist/org/context.js

@@ -755,31 +755,35 @@ export async function getOrgA2ASecret(orgId) {
 export async function getA2ASecretByDomain(domain) {
     const exec = getDbExec();
     const { rows } = await exec.execute({
-        sql: `SELECT a2a_secret FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,
+        sql: `SELECT a2a_secret FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 2`,
         args: [domain.toLowerCase()],
     });
-    if (!rows[0])
+    if (rows.length !== 1)
         return null;
     const secret = String(rows[0].a2a_secret || "");
     return secret || null;
 }
-export async function resolveOrgByDomain(domain) {
-    try {
-        const exec = getDbExec();
-        const { rows } = await exec.execute({
-            sql: `SELECT id, name FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,
-            args: [domain.toLowerCase()],
-        });
-        if (!rows[0])
-            return null;
-        return {
+export async function lookupOrgByDomain(domain) {
+    const exec = getDbExec();
+    const { rows } = await exec.execute({
+        sql: `SELECT id, name FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 2`,
+        args: [domain.toLowerCase()],
+    });
+    if (rows.length === 0)
+        return { status: "not-found" };
+    if (rows.length > 1)
+        return { status: "ambiguous" };
+    return {
+        status: "found",
+        org: {
             orgId: String(rows[0].id),
             orgName: String(rows[0].name),
-        };
-    }
-    catch {
-        return null;
-    }
+        },
+    };
+}
+export async function resolveOrgByDomain(domain) {
+    const result = await lookupOrgByDomain(domain);
+    return result.status === "found" ? result.org : null;
 }
 export async function resolveA2AOrganizationMetadataByDomain(domain) {
     const normalizedDomain = domain.trim().toLowerCase();
@@ -787,9 +791,11 @@ export async function resolveA2AOrganizationMetadataByDomain(domain) {
         return null;
     const { rows } = await getDbExec().execute({
         sql: `SELECT id, allowed_domain
-          FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,
+          FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 2`,
         args: [normalizedDomain],
     });
+    if (rows.length !== 1)
+        return null;
     const row = rows[0];
     if (!row)
         return null;
@@ -826,9 +832,11 @@ export async function resolveA2AOrganizationCredentialsByDomain(domain) {
         return null;
     const { rows } = await getDbExec().execute({
         sql: `SELECT id, allowed_domain, a2a_secret
-          FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,
+          FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 2`,
         args: [normalizedDomain],
     });
+    if (rows.length !== 1)
+        return null;
     const row = rows[0];
     if (!row)
         return null;

package/dist/org/handlers.js

@@ -1439,21 +1439,33 @@ export const setDomainHandler = defineEventHandler(async (event) => {
         }
     }
     const e = await exec();
-    if (raw) {
-        const existing = await e.execute({
-            sql: `SELECT id FROM organizations WHERE LOWER(allowed_domain) = ? AND id != ? LIMIT 1`,
-            args: [raw, ctx.orgId],
+    if (!e.transaction) {
+        throw createError({
+            statusCode: 503,
+            message: "Organization domain updates require transaction support",
         });
-        if (existing.rows.length > 0) {
-            throw createError({
-                statusCode: 409,
-                message: "Another organization already uses this domain",
+    }
+    await e.transaction(async (tx) => {
+        if (raw) {
+            await tx.execute({
+                sql: `SELECT pg_advisory_xact_lock(hashtextextended(?, 0::bigint))`,
+                args: [`agent-native:org-domain:${raw}`],
+            });
+            const existing = await tx.execute({
+                sql: `SELECT id FROM organizations WHERE LOWER(allowed_domain) = ? AND id != ? LIMIT 1`,
+                args: [raw, ctx.orgId],
             });
+            if (existing.rows.length > 0) {
+                throw createError({
+                    statusCode: 409,
+                    message: "Another organization already uses this domain",
+                });
+            }
         }
-    }
-    await e.execute({
-        sql: `UPDATE organizations SET allowed_domain = ? WHERE id = ?`,
-        args: [raw, ctx.orgId],
+        await tx.execute({
+            sql: `UPDATE organizations SET allowed_domain = ? WHERE id = ?`,
+            args: [raw, ctx.orgId],
+        });
     });
     invalidateDomainMatchCache();
     invalidateMemberOrgCaches();
@@ -1758,7 +1770,7 @@ export const receiveA2ASecretHandler = defineEventHandler(async (event) => {
     }
     const e = await exec();
     const orgRes = await e.execute({
-        sql: `SELECT id, a2a_secret FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,
+        sql: `SELECT id, a2a_secret FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 2`,
         args: [orgDomain],
     });
     if (orgRes.rows.length === 0) {
@@ -1767,6 +1779,12 @@ export const receiveA2ASecretHandler = defineEventHandler(async (event) => {
             message: "No local org matches that domain",
         });
     }
+    if (orgRes.rows.length > 1) {
+        throw createError({
+            statusCode: 409,
+            message: "Multiple local organizations match that domain",
+        });
+    }
     const row = orgRes.rows[0];
     const localOrgId = String(row.id);
     const existingSecret = String(row.a2a_secret ?? "") || null;

package/dist/org/index.d.ts

@@ -7,6 +7,7 @@ export declare const getOrgA2ASecret: typeof import("./context.js").getOrgA2ASec
 export declare const getA2ASecretByDomain: typeof import("./context.js").getA2ASecretByDomain;
 export declare const isSoleOrgDomain: typeof import("./context.js").isSoleOrgDomain;
 export declare const resolveOrgByDomain: typeof import("./context.js").resolveOrgByDomain;
+export declare const lookupOrgByDomain: typeof import("./context.js").lookupOrgByDomain;
 export declare const resolveOrgIdForEmail: typeof import("./context.js").resolveOrgIdForEmail;
 export declare const resolveActiveOrgIdForStorageCredential: typeof import("./context.js").resolveActiveOrgIdForStorageCredential;
 export declare const createOrganization: typeof import("./context.js").createOrganization;
@@ -161,9 +162,9 @@ export declare const getMyOrgHandler: import("h3").EventHandlerWithFetch<import(
     soloDeploymentAdmin: boolean;
 }>>;
 export declare const createOrgHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    name?: undefined;
     success: boolean;
     id?: undefined;
-    name?: undefined;
     role?: undefined;
 } | {
     success?: undefined;

package/dist/org/index.js

@@ -21,6 +21,7 @@ export const getOrgA2ASecret = lazyFunction(loadOrgContext, "getOrgA2ASecret");
 export const getA2ASecretByDomain = lazyFunction(loadOrgContext, "getA2ASecretByDomain");
 export const isSoleOrgDomain = lazyFunction(loadOrgContext, "isSoleOrgDomain");
 export const resolveOrgByDomain = lazyFunction(loadOrgContext, "resolveOrgByDomain");
+export const lookupOrgByDomain = lazyFunction(loadOrgContext, "lookupOrgByDomain");
 export const resolveOrgIdForEmail = lazyFunction(loadOrgContext, "resolveOrgIdForEmail");
 export const resolveActiveOrgIdForStorageCredential = lazyFunction(loadOrgContext, "resolveActiveOrgIdForStorageCredential");
 export const createOrganization = lazyFunction(loadOrgContext, "createOrganization");

package/dist/org/plugin.js

@@ -1,13 +1,12 @@
 import { defineEventHandler, setResponseStatus, getMethod, getRequestURL, } from "h3";
-import { runMigrations } from "../db/migrations.js";
 import { registerFeatureFlags } from "../feature-flags/registry.js";
 import { awaitBootstrap, getH3App, FRAMEWORK_PREFIX, markDefaultPluginProvided, } from "../server/framework-request-handler.js";
 import { listAppRolesHandler, setAppRoleHandler, getAppPermissionsHandler, setAppPermissionsHandler, resetAppPermissionHandler, } from "./app-roles-handlers.js";
 import { listSSOProvidersHandler, createSSOProviderHandler, verifySSOProviderHandler, deleteSSOProviderHandler, getSCIMHandler, createSCIMHandler, deleteSCIMHandler, } from "./enterprise-auth-handlers.js";
 import { CROSS_APP_ORG_FEDERATION_FLAG } from "./feature-flags.js";
 import { getMyOrgHandler, createOrgHandler, updateOrgHandler, deleteOrgHandler, switchOrgHandler, listMembersHandler, removeMemberHandler, retryPendingFederatedRemovalHandler, changeMemberRoleHandler, listInvitationsHandler, createInvitationHandler, acceptInvitationHandler, joinByDomainHandler, setDomainHandler, setWorkspaceUrlHandler, setRequiredAuthProviderHandler, revealA2ASecretHandler, setA2ASecretHandler, syncA2ASecretHandler, receiveA2ASecretHandler, setWorkspaceAppDefaultVisibilityHandler, setOrgVisualIdentityHandler, } from "./handlers.js";
-import { ORG_MIGRATIONS } from "./migrations.js";
 import { readWorkspacePrivateIconHandler, uploadWorkspacePrivateIconHandler, } from "./private-icon-handlers.js";
+import { orgStore } from "./schema-store.js";
 const ORG_PREFIX = `${FRAMEWORK_PREFIX}/org`;
 async function workspaceIconUploadResponse(event) {
     try {
@@ -64,12 +63,11 @@ async function workspaceIconUploadResponse(event) {
  *   POST   /_agent-native/org/a2a-secret/receive          — accept a peer's secret push (JWT-auth, no session)
  */
 export function createOrgPlugin() {
-    const migrate = runMigrations(ORG_MIGRATIONS, { table: "_org_migrations" });
     return async (nitroApp) => {
         registerFeatureFlags([CROSS_APP_ORG_FEDERATION_FLAG]);
         markDefaultPluginProvided(nitroApp, "org");
         await awaitBootstrap(nitroApp);
-        await migrate(nitroApp);
+        await orgStore.ready();
         const app = getH3App(nitroApp);
         app.use(`${ORG_PREFIX}/private-icons`, defineEventHandler(async (event) => {
             const tail = getRequestURL(event).pathname || "/";

package/dist/org/schema-store.d.ts

@@ -0,0 +1 @@
+export declare const orgStore: import("../db/store-registry.js").Store;

package/dist/org/schema-store.js

@@ -0,0 +1,13 @@
+import { defineStore } from "../db/store-registry.js";
+import { fromMigrationEntries } from "../db/versioned-store-migrations.js";
+import { ORG_MIGRATIONS } from "./migrations.js";
+export const orgStore = defineStore({
+    id: "org",
+    // Entries 1024 and 1032 touch the review-suggestion and audit tables; on main
+    // every store ran before this list, so keep that order at release.
+    after: ["audit", "review_suggestions"],
+    migrations: fromMigrationEntries("_org_migrations", ORG_MIGRATIONS, {
+        ranAtBoot: true,
+        data: [1009, 1018],
+    }),
+});

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -75,9 +75,8 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         user: "user";
     }>>;
 }, z.core.$strip>>, {
-    id?: undefined;
-    deleted?: undefined;
     message?: undefined;
+    id?: undefined;
     providers: {
         id: string;
         label: string;
@@ -90,31 +89,32 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     count: number;
     provider?: undefined;
     found?: undefined;
+    deleted?: undefined;
     registered?: undefined;
     label?: undefined;
 } | {
+    message?: undefined;
     id?: undefined;
-    deleted?: undefined;
     count?: undefined;
-    message?: undefined;
     providers?: undefined;
     found: boolean;
     provider: import("../custom-registry.js").CustomProviderConfig;
+    deleted?: undefined;
     registered?: undefined;
     label?: undefined;
 } | {
-    deleted?: undefined;
-    count?: undefined;
     message?: undefined;
+    count?: undefined;
     providers?: undefined;
     provider?: undefined;
     found: boolean;
     id: string;
+    deleted?: undefined;
     registered?: undefined;
     label?: undefined;
 } | {
-    count?: undefined;
     message?: undefined;
+    count?: undefined;
     providers?: undefined;
     provider?: undefined;
     found?: undefined;
@@ -123,11 +123,11 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     registered?: undefined;
     label?: undefined;
 } | {
-    deleted?: undefined;
     count?: undefined;
     providers?: undefined;
     provider?: undefined;
     found?: undefined;
+    deleted?: undefined;
     registered: boolean;
     id: string;
     label: string;