@zackbart/connecta 0.34.1 → 0.35.0

package/dist/auth/clerk.js

@@ -1,9 +1,14 @@
+import { Effect } from "effect";
 import { authorizationCredential, authorizationRequest, isMachineCredential } from "../inbound-credential.js";
-import { createByteReadingClerkClient } from "./clerk-transport.js";
+import { fromSignal, runEdge } from "../runtime/run.js";
+import { authAll, authCall, authDetached, authFetch, authFlow, authInvoke, authMethod, authProgram, authValue, registerAuth, } from "./native.js";
+// Clerk as the OAuth 2.1 authorization server; connecta is the resource server.
+// Single tenant, no tenant-tag requirement, optional organizationId,
+// allowedDomains, and gate() with ~60s identity caching.
 import { decodeJwt } from "@clerk/backend/jwt";
-import { byteReadResponse } from "../byte-read-response.js";
 import { failureRecord, logFailure } from "../operator-record.js";
 import { assertNoRetiredToolkitOptions } from "../retired-toolkits.js";
+import { createByteReadingClerkClient } from "./clerk-transport.js";
 function logDenial(reason, failure) {
     logFailure(console, "Clerk request denied", failureRecord({ reason }, failure));
 }
@@ -53,6 +58,19 @@ function fapiUrl(publishableKey) {
 }
 const GATE_ALLOWED_TTL_MS = 60 * 1000;
 const GATE_FORBIDDEN_TTL_MS = 30 * 1000;
+const BACKEND_LOOKUP_TIMEOUT_MS = 10_000;
+// Per organization-mode clerkAuth/isolate, shared by membership and the extra
+// opaque verification. Clerk's quota is per instance (100/10s development,
+// 1,000/10s production), not per deployment. These cap bursts, not request
+// rates: ingress rate limiting must protect the shared quota. No queue or
+// request-owned object is retained; only counters and a backoff timestamp.
+const ORGANIZATION_MAX_BACKEND_LOOKUPS = 16;
+const ORGANIZATION_MAX_BACKEND_LOOKUPS_PER_IDENTITY = 2;
+const BACKEND_RETRY_DEFAULT_MS = 10_000;
+const BACKEND_RETRY_MAX_MS = 60_000;
+// A user-filtered membership list holds at most one row, and a token
+// verification describes one token.
+const MAX_BACKEND_RESPONSE_BYTES = 65_536;
 const ACTIVITY_LABEL_TTL_MS = 5 * 60 * 1000;
 const ACTIVITY_LABEL_MISS_TTL_MS = 30 * 1000;
 const ACTIVITY_LABEL_LOOKUP_TIMEOUT_MS = 1_250;
@@ -170,6 +188,168 @@ function normalizeOAuthClientIds(value) {
     }
     return new Set(value);
 }
+/**
+ * Checked at construction because the ID becomes a Backend API path segment,
+ * and a typo would otherwise refuse every person at request time.
+ */
+function normalizeOrganizationId(value, allowedOAuthClientIds) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "string" || !/^org_[A-Za-z0-9_]{27}$/.test(value)) {
+        throw new Error("clerkAuth: `organizationId` is not a Clerk organization ID. Copy it from " +
+            "the Clerk dashboard: `org_` followed by 27 letters and digits.");
+    }
+    // On a shared instance every deployment's OAuth clients and tokens come
+    // from one issuer, so the resource-bound audience is what keeps a token for
+    // one deployment out of another. An unbound-token fallback removes it.
+    if (allowedOAuthClientIds.size > 0) {
+        throw new Error("clerkAuth: `organizationId` requires resource-bound OAuth tokens. Remove " +
+            "`allowedOAuthClientIds` and enable Clerk's resource audiences.");
+    }
+    return value;
+}
+/**
+ * Is this user a member of the organization, according to Clerk now? The
+ * given signal and a ten-second deadline bound the call. Any response that is
+ * not a clear answer throws, so the caller refuses.
+ */
+function organizationMember(secretKey, organizationId, userId, signal) {
+    return runEdge(authProgram(organizationMemberNative, [secretKey, organizationId, userId, signal]));
+}
+const organizationMemberNative = /* @__PURE__ */ registerAuth(organizationMember, function (secretKey, organizationId, userId, signal) {
+    return authFlow(function* () {
+        const url = new URL(`https://api.clerk.com/v1/organizations/${encodeURIComponent(organizationId)}/memberships`);
+        url.searchParams.set("user_id", userId);
+        const list = (yield authCall(backendJson, [
+            url,
+            { headers: { Authorization: `Bearer ${secretKey}`, "Clerk-API-Version": "2026-05-12" } },
+            signal,
+        ]));
+        if (!isRecord(list) || !Array.isArray(list.data)) {
+            throw new Error("Organization membership response invalid");
+        }
+        // The filter narrows the list; membership is still read exactly from each
+        // row, so an ignored or widened filter cannot admit someone else's row.
+        return list.data.some((membership) => isRecord(membership) &&
+            membership.object === "organization_membership" &&
+            isRecord(membership.organization) &&
+            membership.organization.id === organizationId &&
+            isRecord(membership.public_user_data) &&
+            membership.public_user_data.user_id === userId);
+    });
+});
+/**
+ * One Backend API request, bounded by the signal, a ten-second deadline, and
+ * `MAX_BACKEND_RESPONSE_BYTES`. A redirect, a non-2xx status, or an unreadable
+ * body throws. Every exit aborts the request and cancels its body, so no
+ * upstream outlives the caller's decision (INV-7).
+ */
+function backendJson(url, init, signal) {
+    return runEdge(authProgram(backendJsonNative, [url, init, signal]));
+}
+const backendJsonNative = /* @__PURE__ */ registerAuth(backendJson, function (url, init, signal) {
+    return authFlow(function* () {
+        const settled = new AbortController();
+        const request = AbortSignal.any([signal, settled.signal, AbortSignal.timeout(BACKEND_LOOKUP_TIMEOUT_MS)]);
+        let response;
+        try {
+            // Workers reject `redirect: "error"`; `manual` returns a redirect
+            // unfollowed, and a redirect is not an answer. Workers and Node return
+            // its 3xx; an `opaqueredirect` has status 0, which `ok` refuses.
+            response = (yield authFetch(url, { ...init, redirect: "manual", signal: request }));
+            if (response.status === 429)
+                throw new BackendRateLimited(backendRetryMs(response.headers.get("Retry-After")));
+            if (response.status >= 300 && response.status < 400)
+                throw new Error("Clerk Backend API request redirected");
+            if (!response.ok)
+                throw new Error("Clerk Backend API request failed");
+            return JSON.parse((yield authCall(boundedText, [response, request])));
+        }
+        finally {
+            settled.abort();
+            void response?.body?.cancel().catch(() => { });
+        }
+    });
+});
+/** Only locally parsed, bounded timing facts leave the response's request. */
+class BackendRateLimited extends Error {
+    retryMs;
+    constructor(retryMs) {
+        super("Clerk Backend API rate limited");
+        this.retryMs = retryMs;
+    }
+}
+class OrganizationLookupBusy extends Error {
+    retrySeconds;
+    constructor(retrySeconds) {
+        super("Clerk organization lookup busy");
+        this.retrySeconds = retrySeconds;
+    }
+}
+/** Clerk sends seconds; accept an HTTP date too. Never trust an unbounded delay. */
+function backendRetryMs(value) {
+    let delay = BACKEND_RETRY_DEFAULT_MS;
+    if (value !== null) {
+        const parsed = /^\d+$/.test(value)
+            ? Number(value) * 1_000
+            : /^[A-Z][a-z]{2}, \d{2} [A-Z][a-z]{2} \d{4} \d{2}:\d{2}:\d{2} GMT$/.test(value)
+                ? Date.parse(value) - Date.now()
+                : NaN;
+        if (!Number.isNaN(parsed))
+            delay = parsed;
+    }
+    return Math.max(1_000, Math.min(BACKEND_RETRY_MAX_MS, delay));
+}
+/**
+ * The body as text, read as bytes (see `byteReadResponse`) and refused past
+ * `MAX_BACKEND_RESPONSE_BYTES`. An abort cancels a read the upstream has
+ * stopped feeding, so the caller's deadline holds while a body stays open.
+ */
+function boundedText(response, signal) {
+    return runEdge(authProgram(boundedTextNative, [response, signal]));
+}
+const boundedTextNative = /* @__PURE__ */ registerAuth(boundedText, function (response, signal) {
+    return authFlow(function* () {
+        const reader = response.body?.getReader();
+        if (!reader)
+            return "";
+        void reader.closed.catch(() => { });
+        const cancel = () => void reader.cancel().catch(() => { });
+        signal.addEventListener("abort", cancel, { once: true });
+        const decoder = new TextDecoder();
+        let size = 0;
+        let text = "";
+        try {
+            while (true) {
+                signal.throwIfAborted();
+                const { done, value } = (yield authInvoke(reader, "read", []));
+                signal.throwIfAborted();
+                if (done)
+                    return text + decoder.decode();
+                size += value.byteLength;
+                if (size > MAX_BACKEND_RESPONSE_BYTES)
+                    throw new Error("Clerk Backend API response too large");
+                text += decoder.decode(value, { stream: true });
+            }
+        }
+        finally {
+            signal.removeEventListener("abort", cancel);
+            reader.releaseLock();
+        }
+    });
+});
+/**
+ * Valid only while the clock reads from the lookup's start to start + ttl.
+ * A step back before the start expires the entry, and a step forward can
+ * only expire it early.
+ */
+function withinTtl(started, ttl) {
+    const age = Date.now() - started;
+    return age >= 0 && age < ttl;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 /** Only verified claims reach this comparison; resource URLs match exactly. */
 function oauthBindingRejection(claims, resource, clientId, allowedClientIds) {
     const bindings = ["aud", "resource"].filter((key) => Object.prototype.hasOwnProperty.call(claims, key));
@@ -190,38 +370,42 @@ function oauthBindingRejection(claims, resource, clientId, allowedClientIds) {
  * endpoint directly after SDK authentication, without a shared response cache
  * or SDK patch. Its subject/client and active verdict must still agree.
  */
-async function opaqueOAuthClaims(token, secretKey, userId, clientId, signal) {
-    const response = await fetch("https://api.clerk.com/v1/oauth_applications/access_tokens/verify", {
-        method: "POST",
-        headers: {
-            Authorization: `Bearer ${secretKey}`,
-            "Content-Type": "application/json",
-            "Clerk-API-Version": "2026-05-12",
-        },
-        body: JSON.stringify({ access_token: token }),
-        redirect: "error",
-        signal: AbortSignal.any([signal, AbortSignal.timeout(10_000)]),
-    });
-    if (!response.ok)
-        throw new Error("Opaque OAuth verification failed");
-    const claims = await byteReadResponse(response).json();
-    if (!claims ||
-        typeof claims !== "object" ||
-        Array.isArray(claims) ||
-        !("object" in claims) ||
-        claims.object !== "clerk_idp_oauth_access_token" ||
-        !("subject" in claims) ||
-        claims.subject !== userId ||
-        !("client_id" in claims) ||
-        claims.client_id !== clientId ||
-        !("revoked" in claims) ||
-        claims.revoked !== false ||
-        !("expired" in claims) ||
-        claims.expired !== false) {
-        throw new Error("Opaque OAuth verification response invalid");
-    }
-    return claims;
+function opaqueOAuthClaims(token, secretKey, userId, clientId, signal) {
+    return runEdge(authProgram(opaqueOAuthClaimsNative, [token, secretKey, userId, clientId, signal]));
 }
+const opaqueOAuthClaimsNative = /* @__PURE__ */ registerAuth(opaqueOAuthClaims, function (token, secretKey, userId, clientId, signal) {
+    return authFlow(function* () {
+        const claims = (yield authCall(backendJson, [
+            "https://api.clerk.com/v1/oauth_applications/access_tokens/verify",
+            {
+                method: "POST",
+                headers: {
+                    Authorization: `Bearer ${secretKey}`,
+                    "Content-Type": "application/json",
+                    "Clerk-API-Version": "2026-05-12",
+                },
+                body: JSON.stringify({ access_token: token }),
+            },
+            signal,
+        ]));
+        if (!claims ||
+            typeof claims !== "object" ||
+            Array.isArray(claims) ||
+            !("object" in claims) ||
+            claims.object !== "clerk_idp_oauth_access_token" ||
+            !("subject" in claims) ||
+            claims.subject !== userId ||
+            !("client_id" in claims) ||
+            claims.client_id !== clientId ||
+            !("revoked" in claims) ||
+            claims.revoked !== false ||
+            !("expired" in claims) ||
+            claims.expired !== false) {
+            throw new Error("Opaque OAuth verification response invalid");
+        }
+        return claims;
+    });
+});
 /**
  * The domain of an email address, lowercased for comparison, or null when the
  * address does not have exactly one well-formed domain to read.
@@ -244,7 +428,8 @@ function emailDomain(email) {
 /**
  * Clerk inbound auth.
  *
- * `allowedDomains` and `gate` decide who is admitted; both must pass.
+ * `organizationId`, `allowedDomains`, and `gate` decide who is admitted; each
+ * configured check must pass.
  */
 /** `"/<pool>"` for a pool endpoint path, null for `/mcp` and anything else. */
 function mcpPoolSuffix(pathname) {
@@ -256,12 +441,9 @@ export function clerkAuth(opts) {
     // Before the Clerk client, so a malformed key fails as a connecta
     // configuration error rather than however the SDK happens to treat it.
     const frontendApiUrl = fapiUrl(opts.publishableKey);
-    const clerk = createByteReadingClerkClient({
-        secretKey: opts.secretKey,
-        publishableKey: opts.publishableKey,
-    });
     const allowedDomains = normalizeAllowedDomains(opts.allowedDomains);
     const allowedOAuthClientIds = normalizeOAuthClientIds(opts.allowedOAuthClientIds);
+    const organizationId = normalizeOrganizationId(opts.organizationId, allowedOAuthClientIds);
     const requestedScopes = opts.scopes ?? ["openid", "profile", "email"];
     if (!Array.isArray(requestedScopes) ||
         requestedScopes.some((scope) => typeof scope !== "string" || !/^[\x21\x23-\x5b\x5d-\x7e]+$/.test(scope))) {
@@ -269,8 +451,64 @@ export function clerkAuth(opts) {
     }
     const scopes = [...requestedScopes];
     const gateCache = new Map();
+    const membershipCache = new Map();
+    // Membership lookups started, in order, and the latest start among the
+    // entries the cache has evicted.
+    let membershipLookupsStarted = 0;
+    let evictedMembershipSequence = 0;
+    let activeOrganizationLookups = 0;
+    const organizationLookupsByIdentity = new Map();
+    // Wall-clock end of the current 429 backoff. Like the membership TTLs it
+    // assumes the clock does not step back: a rollback lengthens the remaining
+    // window by the size of the step.
+    let organizationRetryUntil = 0;
+    const organizationLookup = authMethod((userId, signal, lookup) => {
+        return authFlow(function* () {
+            const now = Date.now();
+            if (now < organizationRetryUntil) {
+                throw new OrganizationLookupBusy(Math.ceil((organizationRetryUntil - now) / 1000));
+            }
+            const activeForIdentity = organizationLookupsByIdentity.get(userId) ?? 0;
+            if (activeOrganizationLookups >= ORGANIZATION_MAX_BACKEND_LOOKUPS ||
+                activeForIdentity >= ORGANIZATION_MAX_BACKEND_LOOKUPS_PER_IDENTITY) {
+                throw new OrganizationLookupBusy(1);
+            }
+            signal.throwIfAborted();
+            activeOrganizationLookups++;
+            organizationLookupsByIdentity.set(userId, activeForIdentity + 1);
+            let released = false;
+            const release = () => {
+                if (released)
+                    return;
+                released = true;
+                activeOrganizationLookups--;
+                const remaining = organizationLookupsByIdentity.get(userId) - 1;
+                if (remaining === 0)
+                    organizationLookupsByIdentity.delete(userId);
+                else
+                    organizationLookupsByIdentity.set(userId, remaining);
+            };
+            // workerd may discard the awaited continuation when its caller leaves.
+            // Release in that request's own abort handler too; finally is idempotent.
+            // The same caller signal cancels backendJson's request-owned upstream.
+            signal.addEventListener("abort", release, { once: true });
+            try {
+                return (yield authCall(lookup, []));
+            }
+            catch (error) {
+                if (error instanceof BackendRateLimited) {
+                    organizationRetryUntil = Math.max(organizationRetryUntil, Date.now() + error.retryMs);
+                    throw new OrganizationLookupBusy(Math.ceil((organizationRetryUntil - Date.now()) / 1000));
+                }
+                throw error;
+            }
+            finally {
+                signal.removeEventListener("abort", release);
+                release();
+            }
+        });
+    });
     const activityLabelCache = new Map();
-    const pendingActivityLabels = new Map();
     const inFlightActivityLabelIds = new Set();
     let activeActivityLabelLookups = 0;
     const resolveBase = (baseUrl) => opts.publicUrl ?? baseUrl;
@@ -280,58 +518,57 @@ export function clerkAuth(opts) {
             exp: Date.now() + (label ? ACTIVITY_LABEL_TTL_MS : ACTIVITY_LABEL_MISS_TTL_MS),
         });
     };
-    const resolveActivityLabel = async (userId) => {
-        const cached = readIdentityCache(activityLabelCache, userId);
-        if (cached)
-            return cached.label;
-        const existing = pendingActivityLabels.get(userId);
-        if (existing)
-            return existing;
-        // The Clerk SDK's getUser call has no AbortSignal. Keep the real upstream
-        // concurrency bounded even when requests hang forever: do not queue more
-        // identities in memory, and do not start a duplicate for an id whose raw
-        // lookup outlived its caller-facing deadline.
-        if (inFlightActivityLabelIds.has(userId) || activeActivityLabelLookups >= ACTIVITY_LABEL_MAX_IN_FLIGHT) {
-            cacheActivityLabel(userId, undefined);
-            return undefined;
-        }
-        activeActivityLabelLookups++;
-        inFlightActivityLabelIds.add(userId);
-        const upstream = clerk.users
-            .getUser(userId)
-            .then((user) => {
-            const label = activityLabelForUser(user);
-            cacheActivityLabel(userId, label);
-            return label;
-        })
-            .catch(() => {
-            cacheActivityLabel(userId, undefined);
-            return undefined;
-        })
-            .finally(() => {
-            activeActivityLabelLookups--;
-            inFlightActivityLabelIds.delete(userId);
-        });
-        const lookup = new Promise((resolve) => {
-            let settled = false;
-            const finish = (label) => {
-                if (settled)
-                    return;
-                settled = true;
+    const resolveActivityLabel = authMethod((userId, owner) => {
+        return authFlow(function* () {
+            if (owner?.aborted)
+                return undefined;
+            const cached = readIdentityCache(activityLabelCache, userId);
+            if (cached)
+                return cached.label;
+            // Each reader owns its lookup and transport. Keep raw concurrency bounded
+            // even if a custom transport fails to settle after cancellation.
+            if (inFlightActivityLabelIds.has(userId) || activeActivityLabelLookups >= ACTIVITY_LABEL_MAX_IN_FLIGHT) {
+                return undefined;
+            }
+            const ended = new AbortController();
+            const signal = owner ? AbortSignal.any([owner, ended.signal]) : ended.signal;
+            activeActivityLabelLookups++;
+            inFlightActivityLabelIds.add(userId);
+            const lookup = authFlow(function* () {
+                try {
+                    signal.throwIfAborted();
+                    const user = (yield authInvoke(createByteReadingClerkClient(opts, signal).users, "getUser", [
+                        userId,
+                    ]));
+                    if (signal.aborted)
+                        return undefined;
+                    const label = activityLabelForUser(user);
+                    cacheActivityLabel(userId, label);
+                    return label;
+                }
+                catch {
+                    if (!signal.aborted)
+                        cacheActivityLabel(userId, undefined);
+                    return undefined;
+                }
+                finally {
+                    activeActivityLabelLookups--;
+                    inFlightActivityLabelIds.delete(userId);
+                }
+            });
+            const timer = setTimeout(() => ended.abort(), ACTIVITY_LABEL_LOOKUP_TIMEOUT_MS);
+            try {
+                return (yield Effect.raceFirst(authDetached(lookup), fromSignal(signal)));
+            }
+            catch {
+                return undefined;
+            }
+            finally {
                 clearTimeout(timer);
-                resolve(label);
-            };
-            const timer = setTimeout(() => {
-                cacheActivityLabel(userId, undefined);
-                finish(undefined);
-            }, ACTIVITY_LABEL_LOOKUP_TIMEOUT_MS);
-            void upstream.then(finish);
-        }).finally(() => {
-            pendingActivityLabels.delete(userId);
+                ended.abort();
+            }
         });
-        pendingActivityLabels.set(userId, lookup);
-        return lookup;
-    };
+    });
     const challenge = (request, baseUrl) => {
         const tokenPresent = authorizationCredential(request).kind !== "absent";
         const error = tokenPresent ? `error="invalid_token", ` : "";
@@ -356,67 +593,181 @@ export function clerkAuth(opts) {
         status: 403,
         headers: { "Content-Type": "application/json" },
     });
+    const organizationBusy = (error) => {
+        logDenial("organization_lookup_busy");
+        return Response.json({
+            error: {
+                code: "organization_lookup_busy",
+                message: "Organization admission is temporarily busy. Retry later.",
+                retryable: true,
+            },
+        }, { status: 503, headers: { "Retry-After": String(error.retrySeconds) } });
+    };
     /**
      * The domain half of admission. Fails CLOSED on every uncertainty — no
      * primary email, an unverified one, a malformed address, or the lookup
      * itself failing — because "we could not tell" and "they belong here" must
-     * not be the same answer for a membership rule.
+     * not be the same answer for a membership rule. A failed or cancelled
+     * lookup is `undefined`, not a verdict, so it refuses without being cached.
      */
-    const checkDomain = async (userId) => {
-        if (!allowedDomains)
-            return true;
-        let email;
-        try {
-            const user = await clerk.users.getUser(userId);
-            const primary = user.emailAddresses?.find((address) => address.id === user.primaryEmailAddressId);
-            if (primary?.verification?.status === "verified") {
-                email = primary.emailAddress;
+    const checkDomain = authMethod((userId, clerk) => {
+        return authFlow(function* () {
+            if (!allowedDomains)
+                return true;
+            let email;
+            try {
+                const user = (yield authInvoke(clerk.users, "getUser", [userId]));
+                const primary = user.emailAddresses?.find((address) => address.id === user.primaryEmailAddressId);
+                if (primary?.verification?.status === "verified") {
+                    email = primary.emailAddress;
+                }
             }
+            catch (error) {
+                logDenial("email_lookup_failed", error);
+                return undefined;
+            }
+            const domain = email ? emailDomain(email) : null;
+            if (!domain) {
+                logDenial("verified_email_invalid");
+                return false;
+            }
+            if (!allowedDomains.has(domain)) {
+                logDenial("email_domain_denied");
+                return false;
+            }
+            return true;
+        });
+    });
+    /** A cached answer still within its TTL, counted from its lookup's start. */
+    const cachedMembership = (key) => {
+        const verdict = membershipCache.get(key);
+        if (verdict?.member === undefined)
+            return undefined;
+        if (!withinTtl(verdict.started, verdict.member ? GATE_ALLOWED_TTL_MS : GATE_FORBIDDEN_TTL_MS)) {
+            membershipCache.set(key, { started: verdict.started, sequence: verdict.sequence });
+            return undefined;
         }
-        catch (error) {
-            logDenial("email_lookup_failed", error);
-            return false;
-        }
-        const domain = email ? emailDomain(email) : null;
-        if (!domain) {
-            logDenial("verified_email_invalid");
-            return false;
-        }
-        if (!allowedDomains.has(domain)) {
-            logDenial("email_domain_denied");
-            return false;
+        membershipCache.delete(key);
+        membershipCache.set(key, verdict);
+        return verdict.member;
+    };
+    /**
+     * Cache a lookup's answer unless a lookup that started later has already
+     * written this key. Evicting an entry raises a floor under every key,
+     * because the evicted entry no longer guards its own: a lookup that started
+     * before it never writes. Either way an older answer never replaces a
+     * newer verdict. A floor-suppressed answer invalidates an older entry for
+     * its own key rather than leaving that older verdict authoritative.
+     */
+    const cacheMembership = (key, verdict) => {
+        const current = membershipCache.get(key);
+        if (current && current.sequence > verdict.sequence)
+            return;
+        if (verdict.sequence <= evictedMembershipSequence) {
+            // The floor may have advanced past both lookups while an older verdict
+            // for this key remained cached. Suppressing the newer answer must not
+            // preserve that older admission. Forget it; the floor still prevents
+            // either lookup (or an evicted, newer one) from being overwritten.
+            if (current && current.sequence < verdict.sequence)
+                membershipCache.delete(key);
+            return;
         }
-        return true;
+        membershipCache.delete(key);
+        membershipCache.set(key, verdict);
+        if (membershipCache.size <= GATE_CACHE_MAX_IDENTITIES)
+            return;
+        const [oldestKey, oldest] = membershipCache.entries().next().value;
+        membershipCache.delete(oldestKey);
+        evictedMembershipSequence = Math.max(evictedMembershipSequence, oldest.sequence);
     };
+    /**
+     * The organization half of admission, checked before the domain allowlist
+     * and `gate`, for every token type and session. No claim answers it or is
+     * read: an OAuth JWT verifies offline and can outlive a removed membership
+     * by a day, and a member's token is audience-bound to this deployment
+     * whichever organization they chose at consent. Membership always comes
+     * from the Backend API, cached per organization and user for 60 seconds
+     * from the start of the lookup that answered (30 for a non-member), since
+     * Clerk answered no earlier. With a clock that does not step back unseen
+     * within the TTL window, every request reaching this check 60 seconds or
+     * more after a member's removal is refused. An unseen rollback within that
+     * window can extend admission beyond 60 seconds of elapsed time.
+     *
+     * Each request that misses the cache runs and owns its own lookup. On
+     * Workers one request may not touch another's fetch, signal, or body, so
+     * concurrent misses within the plain-counter bounds each ask Clerk, and a caller that leaves cancels only
+     * its own lookup. A failed or abandoned lookup is not an answer, so it
+     * refuses without being cached.
+     */
+    const checkOrganization = authMethod((userId, signal) => {
+        return authFlow(function* () {
+            if (!organizationId)
+                return true;
+            const key = `${organizationId}/${userId}`;
+            const cached = cachedMembership(key);
+            if (cached !== undefined)
+                return cached;
+            const started = Date.now();
+            const sequence = ++membershipLookupsStarted;
+            let member;
+            try {
+                member = (yield authCall(organizationLookup, [
+                    userId,
+                    signal,
+                    authMethod(() => {
+                        return authCall(organizationMember, [opts.secretKey, organizationId, userId, signal]);
+                    }),
+                ]));
+            }
+            catch (error) {
+                if (error instanceof OrganizationLookupBusy)
+                    return organizationBusy(error);
+                logDenial("organization_lookup_failed");
+                return false;
+            }
+            cacheMembership(key, { member, started, sequence });
+            if (!member)
+                logDenial("organization_membership_denied");
+            return member;
+        });
+    });
     /**
      * Is this authenticated user admitted? The domain allowlist and `gate` both
      * have to say yes, and the allowlist runs first so an outsider never reaches
      * operator gate code. One cached verdict covers both, so composing them costs
      * no more Clerk calls than `gate` alone did.
      */
-    const checkGate = async (userId) => {
-        if (!opts.gate && !allowedDomains)
-            return true;
-        const hit = readIdentityCache(gateCache, userId);
-        if (hit)
-            return hit.allowed;
-        let allowed = false;
-        try {
-            const domainAllowed = await checkDomain(userId);
-            allowed = domainAllowed && (opts.gate ? await opts.gate(userId, clerk) : true);
-            if (domainAllowed && !allowed)
-                logDenial("gate_denied");
-        }
-        catch {
-            logDenial("gate_failed");
-            allowed = false;
-        }
-        writeIdentityCache(gateCache, userId, {
-            allowed,
-            exp: Date.now() + (allowed ? GATE_ALLOWED_TTL_MS : GATE_FORBIDDEN_TTL_MS),
+    const checkGate = authMethod((userId, clerk, signal) => {
+        return authFlow(function* () {
+            if (!opts.gate && !allowedDomains)
+                return true;
+            const hit = readIdentityCache(gateCache, userId);
+            if (hit)
+                return hit.allowed;
+            let allowed;
+            try {
+                const domainAllowed = (yield authCall(checkDomain, [userId, clerk]));
+                if (domainAllowed === undefined)
+                    return false;
+                signal.throwIfAborted();
+                allowed = domainAllowed && (opts.gate ? (yield authInvoke(opts, "gate", [userId, clerk])) : true);
+                // `clerk` is bound to this signal; a gate may turn its cancelled
+                // lookup into `false`. Only a completed, uncancelled verdict is cached.
+                signal.throwIfAborted();
+                if (domainAllowed && !allowed)
+                    logDenial("gate_denied");
+            }
+            catch {
+                logDenial("gate_failed");
+                return false;
+            }
+            writeIdentityCache(gateCache, userId, {
+                allowed,
+                exp: Date.now() + (allowed ? GATE_ALLOWED_TTL_MS : GATE_FORBIDDEN_TTL_MS),
+            });
+            return allowed;
         });
-        return allowed;
-    };
+    });
     return {
         kind: "clerk",
         interactiveOperator: true,
@@ -436,126 +787,182 @@ export function clerkAuth(opts) {
             ...(opts.signInUrl ? { signInUrl: opts.signInUrl } : {}),
             ...(opts.signUpUrl ? { signUpUrl: opts.signUpUrl } : {}),
         },
-        async handleMetadata(request, baseUrl) {
-            const { pathname } = new URL(request.url);
-            const protectedResource = pathname === "/.well-known/oauth-protected-resource" ||
-                pathname === "/.well-known/oauth-protected-resource/mcp" ||
-                /^\/\.well-known\/oauth-protected-resource\/mcp\/[a-z0-9_-]+$/.test(pathname);
-            if (!protectedResource)
-                return null;
-            if (request.method !== "GET" && request.method !== "HEAD" && request.method !== "OPTIONS") {
-                return new Response(null, { status: 405, headers: { ...CORS_HEADERS, Allow: "GET, HEAD, OPTIONS" } });
-            }
-            if (request.method === "OPTIONS") {
-                return new Response(null, { status: 204, headers: CORS_HEADERS });
-            }
-            const base = resolveBase(baseUrl);
-            const pool = pathname.startsWith("/.well-known/oauth-protected-resource/mcp/")
-                ? mcpPoolSuffix(pathname.slice("/.well-known/oauth-protected-resource".length))
-                : null;
-            if (pathname === "/.well-known/oauth-protected-resource" ||
-                pathname === "/.well-known/oauth-protected-resource/mcp" ||
-                pool) {
-                return Response.json({
-                    resource: `${base}/mcp${pool ?? ""}`,
-                    authorization_servers: [frontendApiUrl],
-                    bearer_methods_supported: ["header"],
-                    scopes_supported: scopes,
-                }, { headers: CORS_HEADERS });
-            }
-            return null;
-        },
-        async authorize(request, baseUrl) {
-            const credential = authorizationCredential(request);
-            const tokenPresent = credential.kind !== "absent";
-            if (credential.kind === "invalid" || isMachineCredential(request)) {
-                logDenial("authorization_header_invalid");
-                return { ok: false, response: unauthorized(baseUrl, tokenPresent, request) };
-            }
-            const browserOAuthRoute = /^\/(?:connect|oauth\/callback)\//.test(new URL(request.url).pathname);
-            let userId;
-            let sessionCookies;
-            try {
-                const pathname = new URL(request.url).pathname;
-                const isMcp = pathname === "/mcp" || pathname.startsWith("/mcp/");
-                const state = await clerk.authenticateRequest(authorizationRequest(request), {
-                    acceptsToken: isMcp ? "oauth_token" : "session_token",
-                });
-                const browserOAuth = !tokenPresent && browserOAuthRoute;
-                // Consent can outlast Clerk's session JWT. Preserve the SDK's browser
-                // handshake, which returns here with a refreshed, verified session.
-                if (browserOAuth && state.status === "handshake" && state.headers.has("location")) {
-                    return {
-                        ok: false,
-                        response: new Response(null, {
-                            status: 307,
-                            headers: state.headers,
-                        }),
-                    };
+        handleMetadata: authMethod(function (request, baseUrl) {
+            return authValue(() => {
+                const { pathname } = new URL(request.url);
+                const protectedResource = pathname === "/.well-known/oauth-protected-resource" ||
+                    pathname === "/.well-known/oauth-protected-resource/mcp" ||
+                    /^\/\.well-known\/oauth-protected-resource\/mcp\/[a-z0-9_-]+$/.test(pathname);
+                if (!protectedResource)
+                    return null;
+                if (request.method !== "GET" && request.method !== "HEAD" && request.method !== "OPTIONS") {
+                    return new Response(null, { status: 405, headers: { ...CORS_HEADERS, Allow: "GET, HEAD, OPTIONS" } });
                 }
-                if (browserOAuth)
-                    sessionCookies = state.headers?.getSetCookie();
-                const auth = state.toAuth();
-                if (!auth?.isAuthenticated) {
-                    logDenial("authentication_failed");
-                    return {
-                        ok: false,
-                        response: unauthorized(baseUrl, tokenPresent, request),
-                    };
+                if (request.method === "OPTIONS") {
+                    return new Response(null, { status: 204, headers: CORS_HEADERS });
                 }
-                if (isMcp) {
-                    const resource = `${resolveBase(baseUrl)}/mcp${mcpPoolSuffix(pathname) ?? ""}`;
-                    if (auth.tokenType !== "oauth_token") {
-                        logDenial("token_type_mismatch");
-                        return { ok: false, response: unauthorized(baseUrl, tokenPresent, request) };
-                    }
-                    const token = await auth.getToken();
-                    let claims;
-                    if (token.startsWith("oat_")) {
-                        try {
-                            claims = await opaqueOAuthClaims(token, opts.secretKey, auth.userId, auth.clientId, request.signal);
+                const base = resolveBase(baseUrl);
+                const pool = pathname.startsWith("/.well-known/oauth-protected-resource/mcp/")
+                    ? mcpPoolSuffix(pathname.slice("/.well-known/oauth-protected-resource".length))
+                    : null;
+                if (pathname === "/.well-known/oauth-protected-resource" ||
+                    pathname === "/.well-known/oauth-protected-resource/mcp" ||
+                    pool) {
+                    return Response.json({
+                        resource: `${base}/mcp${pool ?? ""}`,
+                        authorization_servers: [frontendApiUrl],
+                        bearer_methods_supported: ["header"],
+                        scopes_supported: scopes,
+                    }, { headers: CORS_HEADERS });
+                }
+                return null;
+            });
+        }),
+        authorize: authMethod(function (request, baseUrl) {
+            return authFlow(function* () {
+                const credential = authorizationCredential(request);
+                const tokenPresent = credential.kind !== "absent";
+                if (credential.kind === "invalid" || isMachineCredential(request)) {
+                    logDenial("authorization_header_invalid");
+                    return { ok: false, response: unauthorized(baseUrl, tokenPresent, request) };
+                }
+                const finished = new AbortController();
+                const signal = AbortSignal.any([request.signal, finished.signal]);
+                const timer = setTimeout(() => finished.abort(new Error("Clerk authentication timed out")), BACKEND_LOOKUP_TIMEOUT_MS);
+                const pending = new Set();
+                // SDK-created verification clients, JWKS, handshakes, domain lookups and
+                // gate calls all close over this authorization's signal, never another
+                // request's client. The long-lived client above serves display labels only.
+                const clerk = createByteReadingClerkClient(opts, signal, pending);
+                try {
+                    signal.throwIfAborted();
+                    const browserOAuthRoute = /^\/(?:connect|oauth\/callback)\//.test(new URL(request.url).pathname);
+                    let userId;
+                    let sessionCookies;
+                    try {
+                        const pathname = new URL(request.url).pathname;
+                        const isMcp = pathname === "/mcp" || pathname.startsWith("/mcp/");
+                        const state = (yield authInvoke(clerk, "authenticateRequest", [
+                            authorizationRequest(request),
+                            {
+                                acceptsToken: isMcp ? "oauth_token" : "session_token",
+                            },
+                        ]));
+                        const browserOAuth = !tokenPresent && browserOAuthRoute;
+                        // Consent can outlast Clerk's session JWT. Preserve the SDK's browser
+                        // handshake, which returns here with a refreshed, verified session.
+                        if (browserOAuth && state.status === "handshake" && state.headers.has("location")) {
+                            return {
+                                ok: false,
+                                response: new Response(null, {
+                                    status: 307,
+                                    headers: state.headers,
+                                }),
+                            };
                         }
-                        catch {
-                            logDenial("oauth_verification_failed");
-                            return { ok: false, response: unauthorized(baseUrl, tokenPresent, request) };
+                        if (browserOAuth)
+                            sessionCookies = state.headers?.getSetCookie();
+                        const auth = state.toAuth();
+                        if (!auth?.isAuthenticated) {
+                            logDenial("authentication_failed");
+                            return {
+                                ok: false,
+                                response: unauthorized(baseUrl, tokenPresent, request),
+                            };
                         }
+                        if (isMcp) {
+                            const resource = `${resolveBase(baseUrl)}/mcp${mcpPoolSuffix(pathname) ?? ""}`;
+                            if (auth.tokenType !== "oauth_token") {
+                                logDenial("token_type_mismatch");
+                                return { ok: false, response: unauthorized(baseUrl, tokenPresent, request) };
+                            }
+                            const token = (yield authInvoke(auth, "getToken", []));
+                            let claims;
+                            if (token.startsWith("oat_")) {
+                                try {
+                                    const verify = authMethod(() => {
+                                        return authCall(opaqueOAuthClaims, [
+                                            token,
+                                            opts.secretKey,
+                                            auth.userId,
+                                            auth.clientId,
+                                            signal,
+                                        ]);
+                                    });
+                                    claims = (yield organizationId
+                                        ? authCall(organizationLookup, [auth.userId ?? "", signal, verify])
+                                        : authCall(verify, []));
+                                }
+                                catch (error) {
+                                    if (error instanceof OrganizationLookupBusy)
+                                        return { ok: false, response: organizationBusy(error) };
+                                    logDenial("oauth_verification_failed");
+                                    return { ok: false, response: unauthorized(baseUrl, tokenPresent, request) };
+                                }
+                            }
+                            else {
+                                claims = decodeJwt(token).payload;
+                            }
+                            const rejection = oauthBindingRejection(claims, resource, auth.clientId, allowedOAuthClientIds);
+                            if (rejection) {
+                                logDenial(rejection);
+                                return { ok: false, response: unauthorized(baseUrl, tokenPresent, request) };
+                            }
+                            // The membership lookup is keyed by subject, so on a shared
+                            // instance the issuer and subject must be this instance's and the
+                            // SDK's. An opaque token's claims come from this instance's Backend
+                            // API, which has already matched the subject and carries no issuer.
+                            if (organizationId &&
+                                !token.startsWith("oat_") &&
+                                (claims.iss !== frontendApiUrl || claims.sub !== auth.userId)) {
+                                logDenial("token_identity_mismatch");
+                                return { ok: false, response: unauthorized(baseUrl, tokenPresent, request) };
+                            }
+                        }
+                        else {
+                            if (auth.tokenType !== "session_token") {
+                                logDenial("token_type_mismatch");
+                                return { ok: false, response: unauthorized(baseUrl, tokenPresent, request) };
+                            }
+                            // Browser session origins retain their existing deployment pin.
+                            const azp = auth.sessionClaims?.azp;
+                            const origin = new URL(resolveBase(baseUrl)).origin;
+                            if (azp && azp !== origin) {
+                                logDenial("session_origin_mismatch");
+                                return { ok: false, response: unauthorized(baseUrl, tokenPresent, request) };
+                            }
+                            // The session's active organization is not read; membership is.
+                            if (organizationId &&
+                                (auth.sessionClaims.iss !== frontendApiUrl || auth.sessionClaims.sub !== auth.userId)) {
+                                logDenial("token_identity_mismatch");
+                                return { ok: false, response: unauthorized(baseUrl, tokenPresent, request) };
+                            }
+                        }
+                        userId = auth.userId ?? undefined;
                     }
-                    else {
-                        claims = decodeJwt(token).payload;
-                    }
-                    const rejection = oauthBindingRejection(claims, resource, auth.clientId, allowedOAuthClientIds);
-                    if (rejection) {
-                        logDenial(rejection);
-                        return { ok: false, response: unauthorized(baseUrl, tokenPresent, request) };
+                    catch {
+                        logDenial("authentication_failed");
+                        return { ok: false, response: unauthorized(baseUrl, true, request) };
                     }
-                }
-                else {
-                    if (auth.tokenType !== "session_token") {
-                        logDenial("token_type_mismatch");
-                        return { ok: false, response: unauthorized(baseUrl, tokenPresent, request) };
+                    if (!userId) {
+                        logDenial("user_missing");
+                        return { ok: false, response: unauthorized(baseUrl, true, request) };
                     }
-                    // Browser session origins retain their existing deployment pin.
-                    const azp = auth.sessionClaims?.azp;
-                    const origin = new URL(resolveBase(baseUrl)).origin;
-                    if (azp && azp !== origin) {
-                        logDenial("session_origin_mismatch");
-                        return { ok: false, response: unauthorized(baseUrl, tokenPresent, request) };
+                    const membership = (yield authCall(checkOrganization, [userId, signal]));
+                    if (membership instanceof Response)
+                        return { ok: false, response: membership };
+                    if (!membership || !(yield authCall(checkGate, [userId, clerk, signal]))) {
+                        return { ok: false, response: forbidden() };
                     }
+                    signal.throwIfAborted();
+                    return { ok: true, userId, ...(sessionCookies?.length ? { sessionCookies } : {}) };
                 }
-                userId = auth.userId ?? undefined;
-            }
-            catch {
-                logDenial("authentication_failed");
-                return { ok: false, response: unauthorized(baseUrl, true, request) };
-            }
-            if (!userId) {
-                logDenial("user_missing");
-                return { ok: false, response: unauthorized(baseUrl, true, request) };
-            }
-            if (!(await checkGate(userId))) {
-                return { ok: false, response: forbidden() };
-            }
-            return { ok: true, userId, ...(sessionCookies?.length ? { sessionCookies } : {}) };
-        },
+                finally {
+                    clearTimeout(timer);
+                    finished.abort();
+                    (yield authAll(pending, true));
+                }
+            });
+        }),
     };
 }