@agent-native/core 0.201.0 → 0.201.1

package/dist/a2a/handlers.js

@@ -5,14 +5,14 @@ import { trackingIdentityProperties } from "../observability/tracking-identity.j
 import { findWorkspaceDispatchAgent } from "../server/agent-discovery.js";
 import { withConfiguredAppBasePath } from "../server/app-base-path.js";
 import { getOrigin, isConfiguredAppOrigin } from "../server/google-oauth.js";
+import { markExplicitPersonalOrgScope } from "../server/request-context.js";
 import { fireInternalDispatch } from "../server/self-dispatch.js";
 import { agentChat } from "../shared/agent-chat.js";
 import { track } from "../tracking/registry.js";
 import { hasConfiguredA2ASecret, isA2AProductionRuntime, } from "./auth-policy.js";
 import { callAction } from "./client.js";
 import { sanitizeA2ACorrelationMetadata } from "./correlation.js";
-import { createTask, createOrReuseTask, getTask, getTaskOwnership, updateTask, claimA2ATaskForProcessing, getA2ATaskDispatchState, failStuckA2ATask, failStuckQueuedA2ATask, settleProcessingA2ATask, touchQueuedA2ATaskDispatch, touchProcessingA2ATask, pauseProcessingA2ATask, MAX_A2A_IDEMPOTENCY_KEY_CHARS, A2A_PERSONAL_OWNER_SCOPE, } from "./task-store.js";
-const getA2ASecretByDomain = (...args) => import("../org/context.js").then(({ getA2ASecretByDomain }) => getA2ASecretByDomain(...args));
+import { createTask, createOrReuseTask, getTask, getTaskOwnership, updateTask, claimA2ATaskForProcessing, getA2ATaskDispatchState, failStuckA2ATask, failStuckQueuedA2ATask, settleProcessingA2ATask, touchQueuedA2ATaskDispatch, touchProcessingA2ATask, pauseProcessingA2ATask, MAX_A2A_IDEMPOTENCY_KEY_CHARS, A2A_PERSONAL_OWNER_SCOPE, A2A_ORG_ID_OWNER_SCOPE_PREFIX, } from "./task-store.js";
 const A2A_PROCESS_TASK_PATH = "/_agent-native/a2a/_process-task";
 const PORTABLE_FALLBACK_HANDOFF_TIMEOUT_MS = 1_000;
 const A2A_QUEUED_DISPATCH_STUCK_AFTER_MS = 10_000;
@@ -94,12 +94,15 @@ async function trustedSourceContext(value, event) {
     if (!dispatch)
         return undefined;
     const orgDomain = event?.context?.__a2aOrgDomain;
+    const verifiedOrgId = event?.context?.__a2aVerifiedOrgId;
     let orgSecret;
     if (orgDomain) {
-        try {
-            orgSecret = (await getA2ASecretByDomain(orgDomain)) ?? undefined;
+        const { resolveA2AOrganizationCredentialsByDomain } = await import("../org/context.js");
+        const organization = await resolveA2AOrganizationCredentialsByDomain(orgDomain);
+        if (!verifiedOrgId || organization?.orgId !== verifiedOrgId) {
+            return undefined;
         }
-        catch { }
+        orgSecret = organization.secret;
     }
     try {
         const result = await callAction(dispatch.url, "resolve-integration-source-context", { integrationTaskId: reference.integrationTaskId }, {
@@ -252,6 +255,9 @@ export async function processA2ATaskFromQueue(taskId, config, event) {
     const processorMeta = (meta.__a2a_processor ?? {});
     const verifiedEmail = processorMeta.verifiedEmail;
     const orgDomainHint = processorMeta.orgDomainHint;
+    const verifiedOrgId = typeof processorMeta.verifiedOrgId === "string"
+        ? processorMeta.verifiedOrgId.trim()
+        : undefined;
     const requestOrigin = requestOriginFromMetadata(processorMeta) ?? requestOriginFromEvent(event);
     const contextId = processorMeta.contextId ?? undefined;
     const callerMetadata = processorMeta.callerMetadata ?? undefined;
@@ -259,7 +265,17 @@ export async function processA2ATaskFromQueue(taskId, config, event) {
         ? processorMeta.approvedActions
         : undefined;
     const sourceContext = processorMeta.sourceContext;
-    const resolvedOrgId = await resolveVerifiedA2AOrgId(verifiedEmail, orgDomainHint);
+    const resolvedOrgId = verifiedOrgId || undefined;
+    if (event?.context) {
+        if (verifiedEmail)
+            event.context.__a2aVerifiedEmail = verifiedEmail;
+        if (orgDomainHint)
+            event.context.__a2aOrgDomain = orgDomainHint;
+        if (verifiedOrgId)
+            event.context.__a2aVerifiedOrgId = verifiedOrgId;
+        if (verifiedEmail && !resolvedOrgId)
+            markExplicitPersonalOrgScope(event);
+    }
     const { runWithRequestContext } = await import("../server/request-context.js");
     const heartbeat = setInterval(() => {
         touchProcessingA2ATask(taskId).catch((err) => console.error("[a2a] Failed to heartbeat async task:", err));
@@ -268,7 +284,11 @@ export async function processA2ATaskFromQueue(taskId, config, event) {
     try {
         await runWithRequestContext({
             userEmail: verifiedEmail,
-            orgId: resolvedOrgId,
+            ...(resolvedOrgId
+                ? { orgId: resolvedOrgId }
+                : verifiedEmail
+                    ? { orgScope: "personal" }
+                    : {}),
             ...(requestOrigin ? { requestOrigin } : {}),
         }, () => runHandlerAndPersist(taskId, message, config, contextId, callerMetadata, event, approvedActions, sourceContext));
     }
@@ -378,38 +398,21 @@ function makeHandlerContext(taskId, contextId, metadata, event, approvedActions,
 async function withA2ARequestContext(metadata, event, fn) {
     const { runWithRequestContext } = await import("../server/request-context.js");
     const verifiedEmail = event?.context?.__a2aVerifiedEmail ?? undefined;
-    const orgDomain = event?.context?.__a2aOrgDomain ?? undefined;
-    const resolvedOrgId = await resolveVerifiedA2AOrgId(verifiedEmail, orgDomain);
+    const verifiedOrgId = event?.context?.__a2aVerifiedOrgId ?? undefined;
     const requestOrigin = requestOriginForContext(metadata, event);
+    if (event?.context && verifiedEmail && !verifiedOrgId) {
+        markExplicitPersonalOrgScope(event);
+    }
     return runWithRequestContext({
         userEmail: verifiedEmail,
-        orgId: resolvedOrgId,
+        ...(verifiedOrgId
+            ? { orgId: verifiedOrgId }
+            : verifiedEmail
+                ? { orgScope: "personal" }
+                : {}),
         ...(requestOrigin ? { requestOrigin } : {}),
     }, fn);
 }
-async function resolveVerifiedA2AOrgId(verifiedEmail, verifiedOrgDomain) {
-    if (verifiedOrgDomain) {
-        try {
-            const { resolveOrgByDomain } = await import("../org/context.js");
-            const org = await resolveOrgByDomain(verifiedOrgDomain);
-            if (org)
-                return org.orgId;
-        }
-        catch {
-            // Org tables may not exist — continue without org context
-        }
-    }
-    if (verifiedEmail) {
-        try {
-            const { resolveOrgIdForEmail } = await import("../org/context.js");
-            return (await resolveOrgIdForEmail(verifiedEmail)) ?? undefined;
-        }
-        catch {
-            // Org tables may not exist — continue without org context
-        }
-    }
-    return undefined;
-}
 async function runHandlerAndPersist(taskId, message, config, contextId, metadata, event, approvedActions, sourceContext) {
     const { context, artifacts } = makeHandlerContext(taskId, contextId, metadata, event, approvedActions, sourceContext);
     try {
@@ -464,15 +467,24 @@ function taskFailureMessage(error, fallback) {
 }
 function verifiedTaskOwner(event) {
     const ownerEmail = event?.context?.__a2aVerifiedEmail ?? null;
+    const verifiedOrgId = event?.context?.__a2aVerifiedOrgId
+        ?.trim()
+        .toLowerCase() ?? "";
     return {
         ownerEmail,
         ownerScope: ownerEmail
-            ? (event?.context?.__a2aOrgDomain
-                ?.trim()
-                .toLowerCase() ?? A2A_PERSONAL_OWNER_SCOPE)
+            ? verifiedOrgId
+                ? `${A2A_ORG_ID_OWNER_SCOPE_PREFIX}${verifiedOrgId}`
+                : A2A_PERSONAL_OWNER_SCOPE
             : null,
     };
 }
+function hasUnboundVerifiedOrgIdentity(event) {
+    const verifiedEmail = event?.context?.__a2aVerifiedEmail?.trim() ?? "";
+    const verifiedOrgDomain = event?.context?.__a2aOrgDomain?.trim() ?? "";
+    const verifiedOrgId = event?.context?.__a2aVerifiedOrgId?.trim() ?? "";
+    return Boolean(verifiedEmail && verifiedOrgDomain && !verifiedOrgId);
+}
 async function handleSend(params, config, event) {
     const message = params.message;
     if (!message || !message.role || !Array.isArray(message.parts)) {
@@ -481,6 +493,12 @@ async function handleSend(params, config, event) {
             _id: 0,
         };
     }
+    if (hasUnboundVerifiedOrgIdentity(event)) {
+        return {
+            ...jsonRpcError(0, -32001, "A stable verified organization identity is required"),
+            _id: 0,
+        };
+    }
     const contextId = params.contextId;
     const metadata = params.metadata;
     const approvedActions = trustedApprovedActions(params.approvedActions, event);
@@ -538,6 +556,9 @@ async function handleSend(params, config, event) {
             __a2a_processor: {
                 verifiedEmail,
                 orgDomainHint,
+                ...(typeof event?.context?.__a2aVerifiedOrgId === "string"
+                    ? { verifiedOrgId: event.context.__a2aVerifiedOrgId }
+                    : {}),
                 ...(requestOrigin ? { requestOrigin } : {}),
                 contextId: contextId ?? null,
                 callerMetadata: safeMetadata ?? null,
@@ -638,6 +659,11 @@ async function handleStream(params, config, res, event) {
         res.end();
         return;
     }
+    if (hasUnboundVerifiedOrgIdentity(event)) {
+        res.write(`data: ${JSON.stringify(jsonRpcError(0, -32001, "A stable verified organization identity is required"))}\n\n`);
+        res.end();
+        return;
+    }
     const contextId = params.contextId;
     const metadata = params.metadata;
     const approvedActions = trustedApprovedActions(params.approvedActions, event);
@@ -754,17 +780,39 @@ function authorizeTaskAccess(taskOwnerEmail, taskOwnerScope, event, config) {
         if (verifiedEmail.toLowerCase() !== taskOwnerEmail.toLowerCase()) {
             return jsonRpcError(0, -32001, "Task not found");
         }
-        if (taskOwnerScope) {
-            const verifiedScope = event?.context?.__a2aOrgDomain
-                ?.trim()
-                .toLowerCase() ?? A2A_PERSONAL_OWNER_SCOPE;
-            if (verifiedScope !== taskOwnerScope.toLowerCase()) {
+        const storedScope = taskOwnerScope?.trim().toLowerCase() ?? "";
+        if (!storedScope) {
+            // Legacy empty scopes cannot distinguish personal tasks from org tasks.
+            return jsonRpcError(0, -32001, "Task not found");
+        }
+        const verifiedOrgId = event?.context?.__a2aVerifiedOrgId
+            ?.trim()
+            .toLowerCase() ?? "";
+        const verifiedOrgDomain = event?.context?.__a2aOrgDomain?.trim() ?? "";
+        if (storedScope.startsWith(A2A_ORG_ID_OWNER_SCOPE_PREFIX)) {
+            if (!verifiedOrgId ||
+                storedScope !== `${A2A_ORG_ID_OWNER_SCOPE_PREFIX}${verifiedOrgId}`) {
                 return jsonRpcError(0, -32001, "Task not found");
             }
         }
+        else if (storedScope === A2A_PERSONAL_OWNER_SCOPE &&
+            !verifiedOrgId &&
+            !verifiedOrgDomain) {
+            // A verified identity with no organization is in its personal scope.
+        }
+        else {
+            // Legacy domain scopes cannot be safely rebound after a domain change.
+            return jsonRpcError(0, -32001, "Task not found");
+        }
     }
     return null;
 }
+function taskAccessScope(ownership, event) {
+    const verifiedEmail = event?.context?.__a2aVerifiedEmail?.trim() ?? "";
+    if (!ownership.ownerEmail || !verifiedEmail)
+        return undefined;
+    return { ownerEmail: verifiedEmail, ownerScope: ownership.ownerScope };
+}
 async function handleGet(params, event, config) {
     const id = params.id;
     if (!id) {
@@ -774,7 +822,8 @@ async function handleGet(params, event, config) {
     const denied = authorizeTaskAccess(ownership.ownerEmail, ownership.ownerScope, event, config);
     if (denied)
         return denied;
-    const task = await getTask(id);
+    const accessScope = taskAccessScope(ownership, event);
+    const task = await getTask(id, accessScope);
     if (!task) {
         return jsonRpcError(0, -32001, "Task not found");
     }
@@ -783,7 +832,7 @@ async function handleGet(params, event, config) {
         return false;
     });
     if (taskChanged) {
-        const updated = await getTask(id);
+        const updated = await getTask(id, accessScope);
         if (updated)
             return jsonRpcResult(0, sanitizeTaskForResponse(updated));
     }
@@ -837,7 +886,7 @@ async function handleCancel(params, event, config) {
     const denied = authorizeTaskAccess(ownership.ownerEmail, ownership.ownerScope, event, config);
     if (denied)
         return denied;
-    const task = await updateTask(id, { state: "canceled" });
+    const task = await updateTask(id, { state: "canceled" }, taskAccessScope(ownership, event));
     if (!task) {
         return jsonRpcError(0, -32001, "Task not found");
     }
@@ -869,6 +918,9 @@ async function handleInvokeReadOnlyAction(params, event, config) {
         event?.context?.__a2aAudienceVerified !== true) {
         return jsonRpcError(0, -32001, "A verified, audience-bound user identity is required for direct action invocation");
     }
+    if (hasUnboundVerifiedOrgIdentity(event)) {
+        return jsonRpcError(0, -32001, "A stable verified organization identity is required for direct action invocation");
+    }
     if (!config.executeReadOnlyAction) {
         return jsonRpcError(0, -32601, "Direct action invocation not supported");
     }

package/dist/a2a/organization-identity.d.ts

@@ -0,0 +1,9 @@
+export interface VerifiedA2AOrganizationIdentity {
+    orgId: string;
+    orgDomain: string | null;
+}
+/**
+ * Bind shared-secret organization claims to this receiver's organization
+ * metadata before they can become request or action scope.
+ */
+export declare function verifyA2AOrganizationIdentity(payload: Record<string, unknown>): Promise<VerifiedA2AOrganizationIdentity | null | undefined>;

package/dist/a2a/organization-identity.js

@@ -0,0 +1,34 @@
+/**
+ * Bind shared-secret organization claims to this receiver's organization
+ * metadata before they can become request or action scope.
+ */
+export async function verifyA2AOrganizationIdentity(payload) {
+    const hasOrgId = Object.prototype.hasOwnProperty.call(payload, "org_id");
+    const hasOrgDomain = Object.prototype.hasOwnProperty.call(payload, "org_domain");
+    const rawOrgId = payload.org_id;
+    const rawOrgDomain = payload.org_domain;
+    if (!hasOrgId && !hasOrgDomain)
+        return undefined;
+    if ((hasOrgId &&
+        rawOrgId !== null &&
+        (typeof rawOrgId !== "string" || !rawOrgId.trim())) ||
+        (hasOrgDomain && (typeof rawOrgDomain !== "string" || !rawOrgDomain.trim()))) {
+        return null;
+    }
+    const orgId = typeof rawOrgId === "string" ? rawOrgId.trim() : "";
+    const orgDomain = typeof rawOrgDomain === "string" ? rawOrgDomain.trim().toLowerCase() : "";
+    if (!orgId && !orgDomain)
+        return undefined;
+    const context = await import("../org/context.js");
+    const organization = orgDomain
+        ? await context.resolveA2AOrganizationMetadataByDomain(orgDomain)
+        : await context.resolveA2AOrganizationMetadataById(orgId);
+    if (!organization || (orgId && organization.orgId !== orgId))
+        return null;
+    const email = typeof payload.sub === "string" ? payload.sub.trim() : "";
+    if (!email)
+        return null;
+    // A shared deployment secret is the cross-app trust grant. The receiver's
+    // membership list is not authoritative for a sibling app's user roster.
+    return organization;
+}

package/dist/a2a/server.d.ts

@@ -4,9 +4,8 @@ import type { A2AConfig, AgentSkill } from "./types.js";
 /**
  * Result of verifying an inbound A2A JWT. `email` is the caller identity from
  * the token's `sub` claim (null when verification fails), `orgDomain` mirrors
- * the verified `org_domain` claim when present, and `orgId` mirrors the
- * optional verified `org_id` claim used when a sender knows its exact org but
- * cannot resolve that org's domain.
+ * locally resolved organization metadata when present, and `orgId` is the
+ * matching local organization bound to the token's organization claims.
  */
 export interface A2ATokenPayload {
     email: string | null;
@@ -14,15 +13,22 @@ export interface A2ATokenPayload {
     orgId?: string;
     claims?: jose.JWTPayload;
 }
+export declare class A2AIdentityVerificationUnavailableError extends Error {
+    readonly cause: unknown;
+    constructor(cause: unknown);
+}
+export declare function isA2AIdentityVerificationUnavailableError(error: unknown): error is A2AIdentityVerificationUnavailableError;
 /**
  * Verify an inbound A2A bearer token (HS256) exactly as the
  * `/_agent-native/a2a` endpoint does: it peeks at the unverified `org_domain`
- * claim to build an ordered candidate-secret set (`process.env.A2A_SECRET`
- * plus any org-level secret for that domain), then verifies the JWT — checking
+ * claim to locate an org credential after trying the global credential, then
+ * verifies the JWT — checking
  * `aud`/`iss` when the token carries them and `exp` always. Returns the
  * caller's email (`sub`) and org domain on success, or `{ email: null,
- * orgDomain: null }` on any failure (malformed, bad signature, expired, no
- * secret configured, or an MCP credential), never throwing.
+ * orgDomain: null }` for an invalid token or absent credential. If the
+ * organization credential or membership evidence cannot be read, throws
+ * `A2AIdentityVerificationUnavailableError` so callers cannot treat an
+ * unreadable authorization lookup as an unauthenticated fallback.
  *
  * Exported so workspaces can accept A2A callers on the HTTP action route with
  * the same routine — including org-level fallback secrets — instead of