@agent-native/core 0.212.0 → 0.213.1

package/dist/automations/service.js

@@ -6,6 +6,7 @@ import { deleteAutomationRunsWithDb, ensureAutomationRunHistoryReady, prepareAut
 import { applyJobResourceEdit } from "../jobs/update-job-resource.js";
 import { resolveUserSchedulingTimezone } from "../localization/user-timezone.js";
 import { organizationIdFromResourceOwner, organizationResourceOwner, ensureResourceStoreReady, prepareResourceBatchAssertion, prepareResourceCreate, prepareResourceDelete, prepareResourceUpdate, resourceGetByPath, resourceList, resourcePutWithDb, resourceDelete, SHARED_OWNER, } from "../resources/store.js";
+import { readOrgMemberRole } from "../server/personal-provider-key-policy.js";
 import { isReasoningEffort, } from "../shared/reasoning-effort.js";
 import { deleteAutomationWebhookToken, readAutomationWebhookPath, saveAutomationWebhookToken, } from "../triggers/webhook-store.js";
 import { createAutomationWebhookToken, automationWebhookPath, } from "../triggers/webhook.js";
@@ -61,16 +62,8 @@ function ownerForScope(actor, scope) {
     return organizationResourceOwner(actor.orgId);
 }
 async function readOrganizationMembership(orgId, email) {
-    const result = await getDbExec().execute({
-        sql: `SELECT role FROM org_members
-          WHERE org_id = ? AND LOWER(email) = ?
-            AND federation_removal_pending_at IS NULL
-          LIMIT 1`,
-        args: [orgId, email.toLowerCase()],
-    });
-    if (!result.rows.length)
-        return null;
-    return { role: String(result.rows[0]?.role ?? "").toLowerCase() };
+    const role = await readOrgMemberRole(orgId, email);
+    return role ? { role } : null;
 }
 async function requireOrganizationMembership(actor) {
     if (!actor.orgId) {

package/dist/client/org/hooks.d.ts

@@ -235,6 +235,9 @@ export declare function useSetA2ASecret(): import("@tanstack/react-query").UseMu
     a2aSecret: string;
     previousSecret: string | null;
 }, Error, string | undefined, unknown>;
+export declare function useSetA2AMemberDelegation(): import("@tanstack/react-query").UseMutationResult<{
+    enabled: boolean;
+}, Error, boolean, unknown>;
 export interface SyncA2ASecretResult {
     total: number;
     succeeded: number;

package/dist/client/org/hooks.js

@@ -486,6 +486,18 @@ export function useSetA2ASecret() {
         },
     });
 }
+export function useSetA2AMemberDelegation() {
+    const qc = useQueryClient();
+    return useMutation({
+        mutationFn: (enabled) => apiFetch(`${orgBasePath()}/a2a-member-delegation`, {
+            method: "PUT",
+            body: JSON.stringify({ enabled }),
+        }),
+        onSuccess: async () => {
+            await qc.invalidateQueries({ queryKey: ["org-me"] });
+        },
+    });
+}
 export function useSyncA2ASecret() {
     return useMutation({
         mutationFn: (vars) => apiFetch(`${orgBasePath()}/a2a-secret/sync`, {

package/dist/collab/awareness.d.ts

@@ -38,19 +38,19 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
-    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
+    error?: undefined;
 }>>;
 export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
     users?: undefined;
 } | {
-    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
+    error?: undefined;
 }>>;

package/dist/collab/struct-routes.d.ts

@@ -1,6 +1,6 @@
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/connections/catalog.d.ts

@@ -65,7 +65,7 @@ export declare const WORKSPACE_CONNECTION_PROVIDERS: readonly [{
         readonly scopes: readonly ["repo", "read:org", "read:user", "user:email"];
     };
     readonly capabilities: readonly ["search", "import", "code", "docs"];
-    readonly recommendedTemplateUses: readonly ["brain", "analytics", "dispatch", "factory"];
+    readonly recommendedTemplateUses: readonly ["brain", "analytics", "content", "dispatch", "factory"];
 }, {
     readonly id: "figma";
     readonly label: "Figma";

package/dist/connections/catalog.js

@@ -59,7 +59,13 @@ export const WORKSPACE_CONNECTION_PROVIDERS = [
             scopes: ["repo", "read:org", "read:user", "user:email"],
         },
         capabilities: ["search", "import", "code", "docs"],
-        recommendedTemplateUses: ["brain", "analytics", "dispatch", "factory"],
+        recommendedTemplateUses: [
+            "brain",
+            "analytics",
+            "content",
+            "dispatch",
+            "factory",
+        ],
     }),
     defineWorkspaceConnectionProvider({
         id: "figma",

package/dist/credentials/index.js

@@ -5,6 +5,7 @@ import { deleteAppSecret, readAppSecret, } from "../secrets/storage.js";
 import { assertCredentialStoreReadable } from "../server/credential-provider.js";
 import { isPersonalCredentialScope, readsOrgCredentialFirst, } from "../server/credential-read-order.js";
 import { isPersonalProviderKeyUseRestricted, isPersonalProviderPolicyKey, readOrgMemberRole, } from "../server/personal-provider-key-policy.js";
+import { getRequestContext } from "../server/request-context.js";
 import { getSetting, putSetting, deleteSetting } from "../settings/store.js";
 const SETTING_PREFIX = "credential:";
 export class CredentialEndpointMismatchError extends Error {
@@ -239,7 +240,20 @@ export async function resolveCredential(key, ctx) {
 export async function describeCredentialScopeGap(keys, ctx) {
     if (!ctx?.userEmail)
         return null;
-    const orgLookup = await resolveEffectiveOrgId(ctx);
+    const requestContext = getRequestContext();
+    const isDelegatedOrgMember = requestContext?.a2aIdentityAssurance === "org-member";
+    const delegatedEmail = requestContext?.userEmail?.trim().toLowerCase();
+    const delegatedOrgId = requestContext?.orgId?.trim();
+    if (isDelegatedOrgMember &&
+        (!delegatedEmail ||
+            delegatedEmail !== ctx.userEmail.trim().toLowerCase() ||
+            !delegatedOrgId ||
+            (ctx.orgId && ctx.orgId.trim() !== delegatedOrgId))) {
+        return null;
+    }
+    const orgLookup = isDelegatedOrgMember
+        ? { orgId: delegatedOrgId, lookupFailed: false }
+        : await resolveEffectiveOrgId(ctx);
     if (orgLookup.lookupFailed || !orgLookup.orgId)
         return null;
     const scopedCtx = { ...ctx, orgId: orgLookup.orgId };
@@ -251,7 +265,9 @@ export async function describeCredentialScopeGap(keys, ctx) {
                 `integration, job, or automation — so it needs "${key}" saved with ` +
                 `Workspace or Organization scope instead.`);
         }
-        const holder = await findMemberOrgHoldingCredential(key, scopedCtx);
+        const holder = isDelegatedOrgMember
+            ? null
+            : await findMemberOrgHoldingCredential(key, scopedCtx);
         if (holder) {
             return (`A "${key}" key is saved in the ${holder} organization, but this ` +
                 `request resolved to a different organization you also belong to. ` +

package/dist/db/schema-snapshot.generated.js

@@ -16,7 +16,7 @@ export const SCHEMA_SNAPSHOT = {
         'CREATE TABLE "a2a_approvals" (\n  "id" text NOT NULL,\n  "task_id" text NOT NULL,\n  "owner_email" text NOT NULL,\n  "org_id" text,\n  "tool_name" text NOT NULL,\n  "tool_input" text NOT NULL,\n  "approval_key" text NOT NULL,\n  "call_id" text NOT NULL,\n  "status" text DEFAULT \'pending\'::text NOT NULL,\n  "result" text,\n  "expires_at" bigint NOT NULL,\n  "created_at" bigint NOT NULL,\n  "updated_at" bigint NOT NULL\n);',
         'CREATE TABLE "a2a_tasks" (\n  "id" text NOT NULL,\n  "context_id" text,\n  "status_state" text DEFAULT \'submitted\'::text NOT NULL,\n  "status_message" text,\n  "status_timestamp" text NOT NULL,\n  "history" text DEFAULT \'[]\'::text NOT NULL,\n  "artifacts" text DEFAULT \'[]\'::text NOT NULL,\n  "metadata" text,\n  "owner_email" text,\n  "owner_scope" text DEFAULT \'\'::text NOT NULL,\n  "idempotency_key" text,\n  "created_at" bigint NOT NULL,\n  "updated_at" bigint NOT NULL\n);',
         'CREATE TABLE "account" (\n  "id" text NOT NULL,\n  "account_id" text NOT NULL,\n  "provider_id" text NOT NULL,\n  "user_id" text NOT NULL,\n  "access_token" text,\n  "refresh_token" text,\n  "id_token" text,\n  "access_token_expires_at" timestamp with time zone,\n  "refresh_token_expires_at" timestamp with time zone,\n  "scope" text,\n  "password" text,\n  "created_at" timestamp with time zone NOT NULL,\n  "updated_at" timestamp with time zone NOT NULL\n);',
-        'CREATE TABLE "agent_audit_log" (\n  "id" text NOT NULL,\n  "created_at" bigint NOT NULL,\n  "action" text NOT NULL,\n  "caller" text NOT NULL,\n  "actor_kind" text NOT NULL,\n  "actor_email" text,\n  "org_id" text,\n  "thread_id" text,\n  "turn_id" text,\n  "target_type" text,\n  "target_id" text,\n  "status" text DEFAULT \'success\'::text NOT NULL,\n  "summary" text,\n  "input" text,\n  "error_code" text,\n  "owner_email" text,\n  "visibility" text DEFAULT \'private\'::text NOT NULL,\n  "run_id" text,\n  "task_id" text,\n  "parent_task_id" text,\n  "source_kind" text,\n  "source_platform" text,\n  "source_id" text,\n  "source_url" text,\n  "network_protocol" text,\n  "network_id" text,\n  "network_peer" text,\n  "app" text,\n  "reported_client_name" text,\n  "reported_client_version" text,\n  "oauth_client_id" text,\n  "approval" text\n);',
+        'CREATE TABLE "agent_audit_log" (\n  "id" text NOT NULL,\n  "created_at" bigint NOT NULL,\n  "action" text NOT NULL,\n  "caller" text NOT NULL,\n  "actor_kind" text NOT NULL,\n  "actor_email" text,\n  "org_id" text,\n  "thread_id" text,\n  "turn_id" text,\n  "target_type" text,\n  "target_id" text,\n  "status" text DEFAULT \'success\'::text NOT NULL,\n  "summary" text,\n  "input" text,\n  "error_code" text,\n  "owner_email" text,\n  "visibility" text DEFAULT \'private\'::text NOT NULL,\n  "run_id" text,\n  "task_id" text,\n  "parent_task_id" text,\n  "source_kind" text,\n  "source_platform" text,\n  "source_id" text,\n  "source_url" text,\n  "network_protocol" text,\n  "network_id" text,\n  "network_peer" text,\n  "app" text,\n  "reported_client_name" text,\n  "reported_client_version" text,\n  "oauth_client_id" text,\n  "approval" text,\n  "identity_assurance" text\n);',
         'CREATE TABLE "agent_chat_submission_inbox" (\n  "thread_id" text NOT NULL,\n  "message_id" text NOT NULL,\n  "state" text NOT NULL,\n  "actor_email" text NOT NULL,\n  "actor_auth_user_id" text,\n  "actor_identity_authenticated_at_ms" bigint,\n  "actor_name" text,\n  "actor_org_id" text,\n  "actor_org_scope" text,\n  "actor_anonymous" boolean DEFAULT false NOT NULL,\n  "payload_hash" text NOT NULL,\n  "payload_json" text NOT NULL,\n  "interrupt_active_run" boolean DEFAULT false NOT NULL,\n  "submitted_run_id" text,\n  "queue_order" bigint DEFAULT nextval(\'agent_chat_submission_inbox_queue_order_seq\'::regclass) NOT NULL,\n  "move_to_top_at" bigint,\n  "retry_after" bigint,\n  "created_at" bigint NOT NULL,\n  "updated_at" bigint NOT NULL,\n  "interrupt_run_id" text\n);',
         'CREATE TABLE "agent_checkpoints" (\n  "id" text NOT NULL,\n  "thread_id" text NOT NULL,\n  "run_id" text,\n  "commit_sha" text NOT NULL,\n  "message" text DEFAULT \'\'::text NOT NULL,\n  "created_at" bigint NOT NULL\n);',
         'CREATE TABLE "agent_eval_datasets" (\n  "id" text NOT NULL,\n  "name" text NOT NULL,\n  "description" text DEFAULT \'\'::text NOT NULL,\n  "entries" text DEFAULT \'[]\'::text NOT NULL,\n  "created_at" bigint NOT NULL,\n  "updated_at" bigint NOT NULL,\n  "user_id" text,\n  "idempotency_key" text\n);',
@@ -121,7 +121,7 @@ export const SCHEMA_SNAPSHOT = {
         'CREATE TABLE "org_members" (\n  "id" text NOT NULL,\n  "org_id" text NOT NULL,\n  "email" text NOT NULL,\n  "role" text NOT NULL,\n  "joined_at" bigint NOT NULL,\n  "federation_removal_pending_at" bigint\n);',
         'CREATE TABLE "org_scim_memberships" (\n  "id" text NOT NULL,\n  "org_id" text NOT NULL,\n  "user_id" text NOT NULL,\n  "created_membership" boolean DEFAULT false NOT NULL,\n  "created_at" bigint NOT NULL,\n  "member_id" text\n);',
         'CREATE TABLE "organization" (\n  "id" text NOT NULL,\n  "name" text NOT NULL,\n  "slug" text NOT NULL,\n  "logo" text,\n  "metadata" text,\n  "created_at" timestamp with time zone NOT NULL,\n  "updated_at" timestamp with time zone NOT NULL\n);',
-        'CREATE TABLE "organizations" (\n  "id" text NOT NULL,\n  "name" text NOT NULL,\n  "created_by" text NOT NULL,\n  "created_at" bigint NOT NULL,\n  "allowed_domain" text,\n  "a2a_secret" text,\n  "workspace_url" text,\n  "required_auth_provider" text,\n  "identity_authority" text,\n  "identity_id" text,\n  "federation_roster_initialized_at" bigint,\n  "icon_json" text,\n  "icon_revision" bigint DEFAULT 0 NOT NULL\n);',
+        'CREATE TABLE "organizations" (\n  "id" text NOT NULL,\n  "name" text NOT NULL,\n  "created_by" text NOT NULL,\n  "created_at" bigint NOT NULL,\n  "allowed_domain" text,\n  "a2a_secret" text,\n  "workspace_url" text,\n  "required_auth_provider" text,\n  "identity_authority" text,\n  "identity_id" text,\n  "federation_roster_initialized_at" bigint,\n  "icon_json" text,\n  "icon_revision" bigint DEFAULT 0 NOT NULL,\n  "a2a_member_delegation_enabled" boolean DEFAULT false NOT NULL\n);',
         'CREATE TABLE "private_icon_assets" (\n  "id" text NOT NULL,\n  "owner_email" text NOT NULL,\n  "org_id" text,\n  "mime_type" text NOT NULL,\n  "filename" text,\n  "alt" text,\n  "size" bigint NOT NULL,\n  "sha256" text NOT NULL,\n  "blob_handle_json" text NOT NULL,\n  "created_at" bigint NOT NULL,\n  "updated_at" bigint NOT NULL\n);',
         'CREATE TABLE "progress_runs" (\n  "id" text NOT NULL,\n  "owner" text NOT NULL,\n  "title" text NOT NULL,\n  "step" text,\n  "percent" bigint,\n  "status" text DEFAULT \'running\'::text NOT NULL,\n  "metadata" text,\n  "started_at" bigint NOT NULL,\n  "updated_at" bigint NOT NULL,\n  "completed_at" bigint\n);',
         'CREATE TABLE "provider_api_cooldowns" (\n  "quota_key" text NOT NULL,\n  "provider_id" text NOT NULL,\n  "scope_key" text NOT NULL,\n  "cooldown_until" bigint NOT NULL,\n  "status" bigint,\n  "reason" text,\n  "updated_at" bigint NOT NULL\n);',
@@ -866,6 +866,7 @@ export const SCHEMA_SNAPSHOT = {
         ["application_state", "baseline", null],
         ["application_state", "indexes", null],
         ["application_state", "widen-bigint", null],
+        ["audit", "a2a-identity-assurance", "5ebfefc25224eaa5"],
         ["audit", "baseline", null],
         ["audit", "mcp-client-attribution", "bc0ea72722e10241"],
         ["auth_sessions", "baseline", null],
@@ -1038,6 +1039,7 @@ export const SCHEMA_SNAPSHOT = {
         ["org", "org-scim-membership-member-id", "cd1c4fb7479507d3"],
         ["org", "org-scim-membership-ownership", "09ca1c03026cda83"],
         ["org", "org-tables-timestamps-bigint", "a71b72b885bd5585"],
+        ["org", "organization-a2a-member-delegation", "3d01bcd4e7c259b0"],
         ["org", "organization-federation-removal-pending", "47fe40eb2ea33753"],
         ["org", "organization-federation-roster-initialized", "3307d4d99818c2f0"],
         ["org", "organization-identity-federation", "e24bac924c2d4c7a"],
@@ -1182,5 +1184,6 @@ export const SCHEMA_SNAPSHOT = {
         ["_org_migrations", 1032, "agent-audit-log-base-table"],
         ["_org_migrations", 1033, "organization-visual-identity"],
         ["_org_migrations", 1034, "private-icon-assets"],
+        ["_org_migrations", 1035, "organization-a2a-member-delegation"],
     ],
 };

package/dist/feature-flags/a2a-action-route.js

@@ -46,6 +46,7 @@ export function createFeatureFlagA2AActionRouteAuth(actionName) {
                 owner: claims.email,
                 orgId,
                 anonymous: false,
+                identityAssurance: claims.identityAssurance,
                 delegationJti: claims.jti,
                 delegationIssuer: claims.issuer,
             };

package/dist/file-upload/actions/upload-image.d.ts

@@ -42,8 +42,8 @@ declare const _default: import("../../action.js").ActionDefinition<{
     url: string;
     id: string;
     provider: string;
-    error?: undefined;
     configured?: undefined;
+    error?: undefined;
 } | {
     url?: undefined;
     id?: undefined;

package/dist/file-upload/storage-settings.js

@@ -8,8 +8,8 @@
  * keep uploading to the old bucket.
  */
 import { fail } from "../action.js";
-import { getDbExec } from "../db/client.js";
 import { deleteAppSecret, readAppSecrets, writeAppSecret, } from "../secrets/storage.js";
+import { readOrgMemberRole } from "../server/personal-provider-key-policy.js";
 import { getActiveFileUploadProviderForRequest, listFileUploadProviders, } from "./registry.js";
 import { getPrivateStorageReadinessForUser, } from "./storage-readiness.js";
 export const FILE_STORAGE_SECRET_KEYS = {
@@ -46,14 +46,7 @@ export async function resolveFileStorageAccess(ctx) {
     // matching `canMutateWorkspaceScope` in the secrets routes.
     if (!orgId)
         return { scopeId: `solo:${email}`, canManage: true };
-    const { rows } = await getDbExec().execute({
-        sql: `SELECT role FROM org_members
-          WHERE org_id = ? AND LOWER(email) = LOWER(?)
-            AND federation_removal_pending_at IS NULL
-          LIMIT 1`,
-        args: [orgId, email],
-    });
-    const role = rows[0]?.role;
+    const role = await readOrgMemberRole(orgId, email);
     return { scopeId: orgId, canManage: role === "owner" || role === "admin" };
 }
 export function inferFileStorageProvider(endpoint) {

package/dist/jobs/actions/manage-recurring-job.d.ts

@@ -13,10 +13,10 @@ declare const _default: import("../../action.js").ActionDefinition<{
     enabled?: undefined;
     nextRun?: undefined;
 } | {
+    deleted?: undefined;
     resourceId: string;
     name: string;
     enabled: boolean;
     nextRun: string;
-    deleted?: undefined;
 }>;
 export default _default;

package/dist/jobs/tools.js

@@ -1,8 +1,8 @@
 import { resolveAutomationAccess } from "../automations/access.js";
 import { DEFAULT_AUTOMATION_SCHEDULE } from "../automations/service.js";
-import { getDbExec } from "../db/client.js";
 import { resolveUserSchedulingTimezone } from "../localization/user-timezone.js";
 import { organizationIdFromResourceOwner, resourcePutIfAbsent, resourceGetByPath, resourceList, resourceDelete, SHARED_OWNER, sharedResourceOwner, } from "../resources/store.js";
+import { readOrgMemberRole } from "../server/personal-provider-key-policy.js";
 import { getRequestUserEmail, getRequestOrgId, getIntegrationRequestContext, } from "../server/request-context.js";
 import { isReasoningEffort, REASONING_EFFORTS, } from "../shared/reasoning-effort.js";
 import { RESUME_AUTOMATION_PATCH } from "./automation-outcome.js";
@@ -27,17 +27,7 @@ async function isCurrentUserOrgAdmin(orgId) {
     if (!email)
         return false;
     try {
-        const client = getDbExec();
-        const { rows } = await client.execute({
-            sql: `SELECT role FROM org_members
-            WHERE org_id = ? AND LOWER(email) = ?
-              AND federation_removal_pending_at IS NULL
-            LIMIT 1`,
-            args: [orgId, email.toLowerCase()],
-        });
-        if (rows.length === 0)
-            return false;
-        const role = String(rows[0].role ?? "").toLowerCase();
+        const role = await readOrgMemberRole(orgId, email);
         return role === "owner" || role === "admin";
     }
     catch {

package/dist/mcp/actions/service-token-access.js

@@ -14,6 +14,8 @@
 import { getDbExec } from "../../db/client.js";
 import { isMissingOrganizationTableError } from "../../org/membership.js";
 import { CREDENTIAL_MEMBERSHIP_UNAVAILABLE_MESSAGE } from "../../server/credential-membership-unavailable.js";
+import { readOrgMemberRole } from "../../server/personal-provider-key-policy.js";
+import { getRequestContext } from "../../server/request-context.js";
 export const SERVICE_TOKEN_MANAGE_FORBIDDEN_MESSAGE = "Only org owners or admins can create or revoke service tokens.";
 export class ServiceTokenError extends Error {
     statusCode;
@@ -24,17 +26,7 @@ export class ServiceTokenError extends Error {
     }
 }
 async function readOrgRole(orgId, email) {
-    const { rows } = await getDbExec().execute({
-        sql: `SELECT role FROM org_members
-          WHERE org_id = ? AND LOWER(email) = ?
-            AND federation_removal_pending_at IS NULL
-          LIMIT 1`,
-        args: [orgId, email.toLowerCase()],
-    });
-    const role = rows[0]?.role;
-    return role === "owner" || role === "admin" || role === "member"
-        ? role
-        : null;
+    return readOrgMemberRole(orgId, email);
 }
 export async function getOrgRoleForEmail(orgId, email) {
     try {
@@ -76,6 +68,18 @@ export async function requireServiceTokenCaller(params) {
         throw new ServiceTokenError("Sign in to manage org service tokens.", 401);
     }
     let orgId = params.orgId?.trim() || "";
+    const requestContext = getRequestContext();
+    if (requestContext?.a2aIdentityAssurance === "org-member") {
+        const delegatedEmail = requestContext.userEmail?.trim().toLowerCase();
+        const delegatedOrgId = requestContext.orgId?.trim();
+        if (!delegatedEmail ||
+            delegatedEmail !== email.toLowerCase() ||
+            !delegatedOrgId ||
+            (orgId && orgId !== delegatedOrgId)) {
+            throw new ServiceTokenError("You are not a member of this organization.", 403);
+        }
+        orgId = delegatedOrgId;
+    }
     if (!orgId) {
         const memberOrgs = await lookupMembership(() => readOrgIds(email), []);
         if (memberOrgs.length === 0) {

package/dist/mcp/credential-issuance.js

@@ -1,5 +1,7 @@
 import { getDbExec } from "../db/client.js";
 import { identityCredentialLockKey, readEmailRetiredAt, } from "../identity/retired-emails.js";
+import { effectiveOrgMemberRole } from "../server/personal-provider-key-policy.js";
+import { getRequestContext } from "../server/request-context.js";
 import { checkCredentialOrgMembership } from "./credential-membership.js";
 export class McpCredentialIssuanceError extends Error {
     reason;
@@ -19,6 +21,11 @@ export async function withMcpCredentialIssuance(input, run) {
     const email = input.email.trim().toLowerCase();
     const human = input.kind !== "service";
     const requiresMembership = orgId !== null && human;
+    if (getRequestContext()?.a2aIdentityAssurance === "org-member") {
+        if (!orgId || !effectiveOrgMemberRole("member", orgId, email)) {
+            throw new McpCredentialIssuanceError("not-member");
+        }
+    }
     if (requiresMembership) {
         // Federation validation may update membership on another connection.
         // Finish it before acquiring the local offboarding lock.
@@ -60,9 +67,9 @@ export async function withMcpCredentialIssuance(input, run) {
                 FOR UPDATE`,
                     args: [orgId, email],
                 });
+                const role = effectiveOrgMemberRole(rows[0]?.role, orgId, email);
                 if (rows.length === 0 ||
-                    (input.roles &&
-                        !input.roles.includes(String(rows[0].role)))) {
+                    (input.roles && !input.roles.includes(role))) {
                     throw new McpCredentialIssuanceError("not-member");
                 }
             }

package/dist/mcp/screen-memory-stdio.d.ts

@@ -140,13 +140,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
             includeMicrophone?: undefined;
             includeSystemAudio?: undefined;
             requestId?: undefined;
+            count?: undefined;
         };
         required?: undefined;
     };
@@ -171,13 +171,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
             includeMicrophone?: undefined;
             includeSystemAudio?: undefined;
             requestId?: undefined;
+            count?: undefined;
         };
         required?: undefined;
     };
@@ -196,13 +196,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
             includeMicrophone?: undefined;
             includeSystemAudio?: undefined;
             requestId?: undefined;
+            count?: undefined;
         };
         required?: undefined;
     };
@@ -231,13 +231,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             };
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
             includeMicrophone?: undefined;
             includeSystemAudio?: undefined;
             requestId?: undefined;
+            count?: undefined;
         };
     };
 } | {
@@ -260,12 +260,12 @@ export declare function screenMemoryMcpToolDefinitions(): ({
                 description: string;
             };
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             includeMicrophone?: undefined;
             includeSystemAudio?: undefined;
             requestId?: undefined;
+            count?: undefined;
         };
     };
 } | {
@@ -317,7 +317,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt: {
                 type: string;
                 description: string;
@@ -337,6 +336,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
                 type: string;
             };
             requestId?: undefined;
+            count?: undefined;
         };
     };
 } | {
@@ -352,7 +352,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -361,6 +360,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             requestId: {
                 type: string;
             };
+            count?: undefined;
         };
     };
 })[];

package/dist/notifications/routes.d.ts

@@ -1,21 +1,21 @@
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
-    error?: undefined;
     count: number;
-    ok?: undefined;
     updated?: undefined;
-} | {
     error?: undefined;
+    ok?: undefined;
+} | {
     count?: undefined;
     updated: number;
+    error?: undefined;
     ok?: undefined;
 } | {
     count?: undefined;
+    updated?: undefined;
     error: string;
     ok?: undefined;
-    updated?: undefined;
 } | {
-    error?: undefined;
     count?: undefined;
-    ok: boolean;
     updated?: undefined;
+    ok: boolean;
+    error?: undefined;
 }>>;

package/dist/org/actions.d.ts

@@ -2,5 +2,5 @@ import { type ActionRunContext } from "../action.js";
 export declare function requireOrgMember(ctx?: ActionRunContext, admin?: boolean): Promise<{
     email: string;
     orgId: string;
-    role: string;
+    role: import("./types.js").OrgRole;
 }>;

package/dist/org/actions.js

@@ -1,5 +1,5 @@
 import { fail } from "../action.js";
-import { getDbExec } from "../db/client.js";
+import { readOrgMemberRole } from "../server/personal-provider-key-policy.js";
 export async function requireOrgMember(ctx, admin = false) {
     const email = ctx?.userEmail?.trim();
     const orgId = ctx?.orgId?.trim();
@@ -8,11 +8,7 @@ export async function requireOrgMember(ctx, admin = false) {
             errorCode: "unauthorized",
             statusCode: 401,
         });
-    const { rows } = await getDbExec().execute({
-        sql: `SELECT role FROM org_members WHERE org_id = ? AND LOWER(email) = LOWER(?) AND federation_removal_pending_at IS NULL LIMIT 1`,
-        args: [orgId, email],
-    });
-    const role = rows[0]?.role;
+    const role = await readOrgMemberRole(orgId, email);
     if (!role)
         fail("You are not a member of the active organization.", {
             errorCode: "forbidden",
@@ -23,5 +19,5 @@ export async function requireOrgMember(ctx, admin = false) {
             errorCode: "forbidden",
             statusCode: 403,
         });
-    return { email, orgId, role: String(role) };
+    return { email, orgId, role };
 }

package/dist/org/app-roles.js

@@ -1,5 +1,6 @@
 import { getDbExec } from "../db/client.js";
-import { getRequestOrgId, getRequestUserEmail, } from "../server/request-context.js";
+import { effectiveOrgMemberRole } from "../server/personal-provider-key-policy.js";
+import { getRequestContext, getRequestOrgId, getRequestUserEmail, } from "../server/request-context.js";
 import { ForbiddenError } from "../sharing/access.js";
 import { isMissingOrganizationTableError } from "./membership.js";
 const registry = new Map();
@@ -137,6 +138,9 @@ export async function resolveAppRole(descriptor, caller) {
         return { status: "no-identity" };
     if (!orgId)
         return { status: "no-org" };
+    if (!effectiveOrgMemberRole("member", orgId, email)) {
+        return { status: "not-a-member", orgId };
+    }
     let rows;
     try {
         rows = (await getDbExec().execute({
@@ -187,6 +191,11 @@ export async function resolveAppRole(descriptor, caller) {
             return { status: "not-a-member", orgId };
         orgRole = membership.role;
     }
+    const isDelegatedOrgMember = getRequestContext()?.a2aIdentityAssurance === "org-member";
+    orgRole = effectiveOrgMemberRole(orgRole, orgId, email) ?? undefined;
+    if (isDelegatedOrgMember && !orgRole) {
+        return { status: "not-a-member", orgId };
+    }
     const raw = row.roles ?? row.appRoles ?? row.approles;
     const roles = Array.isArray(raw) ? raw.map(String) : [];
     const validRoles = [

package/dist/org/context.d.ts

@@ -85,5 +85,6 @@ export declare function resolveA2AOrganizationCredentialsByDomain(domain: string
     orgId: string;
     orgDomain: string;
     secret: string;
+    a2aMemberDelegationEnabled: boolean;
 } | null>;
 export declare function isSoleOrgDomain(domain: string): Promise<boolean>;