@agent-native/core 0.212.1 → 0.213.1

package/dist/a2a/anthropic-managed-agents.js

@@ -183,6 +183,7 @@ async function verifyContinuationToken(token, context, options) {
         verified = await verifyA2AToken(token, context.event, {
             includeClaims: true,
             globalSecretOnly: true,
+            allowAnthropicManagedContinuation: true,
         });
     }
     catch (cause) {

package/dist/a2a/caller-auth.js

@@ -1,8 +1,9 @@
-import { getRequestOrgId, getRequestUserEmail, } from "../server/request-context.js";
-import { getGlobalA2ASecret, signA2AOrganizationToken, signA2AToken, } from "./client.js";
+import { getRequestContext, getRequestOrgId, getRequestUserEmail, } from "../server/request-context.js";
+import { getGlobalA2ASecret, signA2AOrgMemberDelegationToken, signA2AOrganizationToken, signA2AToken, } from "./client.js";
 const DEFAULT_A2A_CALLER_TOKEN_TTL = "5m";
 export async function resolveA2ACallerAuth(options) {
     const userEmail = getRequestUserEmail();
+    const isOrgMemberDelegation = getRequestContext()?.a2aIdentityAssurance === "org-member";
     const globalSecret = getGlobalA2ASecret();
     const metadata = {};
     if (userEmail)
@@ -24,6 +25,7 @@ export async function resolveA2ACallerAuth(options) {
         apiKeyAttempts.push(token);
     };
     if (userEmail &&
+        !isOrgMemberDelegation &&
         options?.audience &&
         globalSecret &&
         (options?.userIdentityOnly || !orgId || orgDomain?.trim())) {
@@ -40,6 +42,9 @@ export async function resolveA2ACallerAuth(options) {
         orgDomain &&
         options?.audience &&
         (orgSecret || globalSecret)) {
+        if (userEmail && orgSecret) {
+            addApiKeyAttempt(await signA2AOrgMemberDelegationToken(userEmail, orgDomain, orgSecret, options.audience));
+        }
         addApiKeyAttempt(await signA2AOrganizationToken(orgDomain, orgSecret, undefined, {
             expiresIn: options?.expiresIn ?? DEFAULT_A2A_CALLER_TOKEN_TTL,
             audience: options?.audience,

package/dist/a2a/client.d.ts

@@ -64,6 +64,7 @@ export declare function signA2AOrganizationToken(orgDomain: string | undefined,
     preferGlobalSecret?: boolean;
     extraClaims?: Record<string, unknown>;
 }): Promise<string>;
+export declare function signA2AOrgMemberDelegationToken(email: string, orgDomain: string, orgSecret: string, audience: string | string[]): Promise<string>;
 export declare function shouldPreferGlobalA2ASecret(orgSecret?: string): boolean;
 export declare class A2AClient {
     private baseUrl;

package/dist/a2a/client.js

@@ -8,6 +8,7 @@ import { getRequestContext } from "../server/request-context.js";
 import { SYNTHETIC_TRAFFIC_BETA_E2E, SYNTHETIC_TRAFFIC_HEADER, } from "../shared/test-traffic.js";
 import { canonicalA2AAudience } from "./audience.js";
 import { sanitizeA2ACorrelationMetadata } from "./correlation.js";
+import { A2A_ORG_MEMBER_DELEGATION_TYPE } from "./organization-identity.js";
 import { RemoteAgentCredentialRejectedError } from "./remote-agent-auth.js";
 import { workspacePrivateOrigins } from "./workspace-private-origins.js";
 const DEFAULT_A2A_POLL_REQUEST_TIMEOUT_MS = 15_000;
@@ -172,6 +173,27 @@ export async function signA2AOrganizationToken(orgDomain, orgSecret, orgId, opti
         jwt.setAudience(options.audience);
     return jwt.sign(new TextEncoder().encode(secret));
 }
+export async function signA2AOrgMemberDelegationToken(email, orgDomain, orgSecret, audience) {
+    const normalizedEmail = email.trim().toLowerCase();
+    const normalizedDomain = orgDomain.trim().toLowerCase();
+    const secret = orgSecret.trim();
+    if (!normalizedEmail || !normalizedDomain || !secret || !audience) {
+        throw new Error("A member email, organization domain, organization secret, and audience are required.");
+    }
+    const appUrl = getAppConfig().app.url ?? "http://localhost:3000";
+    return new jose.SignJWT({
+        typ: A2A_ORG_MEMBER_DELEGATION_TYPE,
+        sub: normalizedEmail,
+        org_domain: normalizedDomain,
+    })
+        .setProtectedHeader({ alg: "HS256" })
+        .setIssuer(appUrl)
+        .setIssuedAt()
+        .setJti(randomUUID())
+        .setExpirationTime("5m")
+        .setAudience(audience)
+        .sign(new TextEncoder().encode(secret));
+}
 export function shouldPreferGlobalA2ASecret(orgSecret) {
     return !!getGlobalA2ASecret() || !orgSecret;
 }
@@ -1517,7 +1539,9 @@ async function buildA2AApiKeyAttempts(opts, audience) {
         attempts.push(token);
     };
     const globalSecret = getGlobalA2ASecret();
+    const isOrgMemberDelegation = getRequestContext()?.a2aIdentityAssurance === "org-member";
     if (opts?.userEmail &&
+        !isOrgMemberDelegation &&
         globalSecret &&
         (!opts.orgId || opts.orgDomain?.trim())) {
         add(await signA2AToken(opts.userEmail, opts.orgDomain, undefined, {
@@ -1525,6 +1549,9 @@ async function buildA2AApiKeyAttempts(opts, audience) {
             audience,
         }));
     }
+    if (opts?.userEmail && opts.orgDomain && opts.orgSecret && audience) {
+        add(await signA2AOrgMemberDelegationToken(opts.userEmail, opts.orgDomain, opts.orgSecret, audience));
+    }
     if (opts?.orgDomain && (opts.orgSecret || globalSecret)) {
         add(await signA2AOrganizationToken(opts.orgDomain, opts.orgSecret, undefined, { audience }));
     }

package/dist/a2a/handlers.js

@@ -302,9 +302,11 @@ async function processClaimedA2ATask(taskId, claimed, config, signal, event) {
     const verifiedEmail = processorMeta.verifiedEmail;
     const identityAssurance = processorMeta.identityAssurance === "organization"
         ? "organization"
-        : processorMeta.identityAssurance === "user"
-            ? "user"
-            : undefined;
+        : processorMeta.identityAssurance === "org-member"
+            ? "org-member"
+            : processorMeta.identityAssurance === "user"
+                ? "user"
+                : undefined;
     const orgDomainHint = processorMeta.orgDomainHint;
     const verifiedOrgId = typeof processorMeta.verifiedOrgId === "string"
         ? processorMeta.verifiedOrgId.trim()
@@ -367,6 +369,9 @@ async function processClaimedA2ATask(taskId, claimed, config, signal, event) {
         const { runWithRequestContext } = await import("../server/request-context.js");
         await runWithRequestContext({
             userEmail: verifiedEmail,
+            ...(identityAssurance
+                ? { a2aIdentityAssurance: identityAssurance }
+                : {}),
             ...(resolvedOrgId
                 ? { orgId: resolvedOrgId }
                 : verifiedEmail
@@ -547,12 +552,19 @@ async function withA2ARequestContext(metadata, event, fn) {
     const { runWithRequestContext } = await import("../server/request-context.js");
     const verifiedEmail = event?.context?.__a2aVerifiedEmail ?? undefined;
     const verifiedOrgId = event?.context?.__a2aVerifiedOrgId ?? undefined;
+    const rawIdentityAssurance = event?.context?.__a2aIdentityAssurance;
+    const identityAssurance = rawIdentityAssurance === "user" ||
+        rawIdentityAssurance === "organization" ||
+        rawIdentityAssurance === "org-member"
+        ? rawIdentityAssurance
+        : undefined;
     const requestOrigin = requestOriginForContext(metadata, event);
     if (event?.context && verifiedEmail && !verifiedOrgId) {
         markExplicitPersonalOrgScope(event);
     }
     return runWithRequestContext({
         userEmail: verifiedEmail,
+        ...(identityAssurance ? { a2aIdentityAssurance: identityAssurance } : {}),
         ...(verifiedOrgId
             ? { orgId: verifiedOrgId }
             : verifiedEmail

package/dist/a2a/organization-identity.d.ts

@@ -1,4 +1,5 @@
 import type { JWTPayload } from "jose";
+export declare const A2A_ORG_MEMBER_DELEGATION_TYPE = "agent-native-org-member-delegation";
 export interface VerifiedA2AOrganizationIdentity {
     orgId: string;
     orgDomain: string | null;
@@ -6,10 +7,12 @@ export interface VerifiedA2AOrganizationIdentity {
 export interface A2AOrganizationCredential extends VerifiedA2AOrganizationIdentity {
     orgDomain: string;
     secret: string;
+    a2aMemberDelegationEnabled?: boolean;
 }
 /**
  * An organization secret authenticates an organization principal. Its JWT
- * subject is caller-controlled data and must never become a user identity.
+ * subject is caller-controlled data unless it is an opted-in, audience-bound
+ * member delegation verified against the receiver's current roster.
  */
 export declare function organizationPrincipalClaims(payload: JWTPayload, organization: A2AOrganizationCredential): JWTPayload | null;
 /**

package/dist/a2a/organization-identity.js

@@ -1,6 +1,8 @@
+export const A2A_ORG_MEMBER_DELEGATION_TYPE = "agent-native-org-member-delegation";
 /**
  * An organization secret authenticates an organization principal. Its JWT
- * subject is caller-controlled data and must never become a user identity.
+ * subject is caller-controlled data unless it is an opted-in, audience-bound
+ * member delegation verified against the receiver's current roster.
  */
 export function organizationPrincipalClaims(payload, organization) {
     const orgDomain = typeof payload.org_domain === "string"

package/dist/a2a/server.d.ts

@@ -2,16 +2,15 @@ import * as jose from "jose";
 import "../authorization/check-action.js";
 import type { A2AConfig, AgentSkill } from "./types.js";
 /**
- * Result of verifying an inbound A2A JWT. `email` is present only when a
- * deployment-secret user assertion verifies; org-secret tokens carry an
- * organization principal and never supply a user identity. `orgDomain` and
- * `orgId` are bound to local organization metadata when present.
+ * Result of verifying an inbound A2A JWT. `email` is present for deployment
+ * user assertions or an explicitly opted-in org-member delegation. `orgDomain`
+ * and `orgId` are bound to local organization metadata when present.
  */
 export interface A2ATokenPayload {
     email: string | null;
     orgDomain: string | null;
     orgId?: string;
-    identityAssurance?: "user" | "organization";
+    identityAssurance?: "user" | "organization" | "org-member";
     claims?: jose.JWTPayload;
 }
 export declare class A2AIdentityVerificationUnavailableError extends Error {
@@ -47,6 +46,8 @@ export declare function verifyA2AToken(token: string, event?: any, audienceOptio
     globalSecretOnly?: boolean;
     /** Only use this explicitly configured credential; never fall back. */
     verificationSecret?: string;
+    /** Dedicated verifier for the typed Anthropic continuation credential. */
+    allowAnthropicManagedContinuation?: boolean;
     requireAudience?: boolean;
 }): Promise<A2ATokenPayload>;
 export type A2ATokenFailureCause = "malformed" | "secret-missing" | "audience-unresolvable" | "audience" | "issuer" | "expired" | "signature" | "invalid-claims" | "mcp-credential" | "missing-subject" | "org-binding" | "org-lookup-failed" | "undetermined";

package/dist/a2a/server.js

@@ -19,7 +19,7 @@ import { addAgentProfileExamples } from "./app-profile.js";
 import { canonicalA2AAudience } from "./audience.js";
 import { hasConfiguredA2ASecret, isA2AProductionRuntime, } from "./auth-policy.js";
 import { handleJsonRpcH3, processA2ATaskFromQueue } from "./handlers.js";
-import { organizationPrincipalClaims, verifyA2AOrganizationIdentity, } from "./organization-identity.js";
+import { A2A_ORG_MEMBER_DELEGATION_TYPE, organizationPrincipalClaims, verifyA2AOrganizationIdentity, } from "./organization-identity.js";
 import { claimA2AApproval, a2aTaskLeaseThreadId, getA2AApprovalForOwner, settleA2AApproval, } from "./task-store.js";
 let _warnedUnauthA2A = false;
 function warnA2AUnauthOnce() {
@@ -59,7 +59,7 @@ export function isA2AIdentityVerificationUnavailableError(error) {
         (error instanceof Error &&
             error.name === "A2AIdentityVerificationUnavailableError"));
 }
-function identityPayload(payload, audienceOptions, verifiedOrganization) {
+function identityPayload(payload, audienceOptions, verifiedOrganization, identityAssurance) {
     const email = typeof payload.sub === "string" && payload.sub.trim()
         ? payload.sub.trim()
         : null;
@@ -79,9 +79,34 @@ function identityPayload(payload, audienceOptions, verifiedOrganization) {
         ...(!email && verifiedOrganization
             ? { identityAssurance: "organization" }
             : {}),
+        ...(identityAssurance ? { identityAssurance } : {}),
         ...(audienceOptions?.includeClaims ? { claims } : {}),
     };
 }
+function validOrgMemberDelegationClaims(payload) {
+    const email = typeof payload.sub === "string" ? payload.sub.trim() : "";
+    const jti = typeof payload.jti === "string" ? payload.jti.trim() : "";
+    const issuedAt = payload.iat;
+    const expiresAt = payload.exp;
+    const now = Math.floor(Date.now() / 1_000);
+    const audiences = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
+    return (payload.typ === A2A_ORG_MEMBER_DELEGATION_TYPE &&
+        email.length <= 320 &&
+        email.includes("@") &&
+        !/[\u0000-\u001f\u007f]/.test(email) &&
+        jti.length > 0 &&
+        jti.length <= 128 &&
+        !/[\u0000-\u001f\u007f]/.test(jti) &&
+        typeof issuedAt === "number" &&
+        Number.isSafeInteger(issuedAt) &&
+        typeof expiresAt === "number" &&
+        Number.isSafeInteger(expiresAt) &&
+        issuedAt <= now + 60 &&
+        expiresAt > now &&
+        expiresAt > issuedAt &&
+        expiresAt - issuedAt <= 15 * 60 &&
+        audiences.some((audience) => typeof audience === "string" && audience.trim()));
+}
 async function verifyJwtWithSecret(token, secret, options) {
     try {
         const { payload } = await jose.jwtVerify(token, new TextEncoder().encode(secret), options);
@@ -327,6 +352,17 @@ async function verifyA2ATokenInternal(token, event, audienceOptions) {
     if (globalSecret) {
         const payload = await verifyJwtWithSecret(token, globalSecret, verifyOptions);
         if (payload) {
+            // Typed credentials have their own verifier. Only the managed-agent
+            // confirmation verifier may accept its continuation token here.
+            if (typeof payload.typ !== "undefined") {
+                const managedContinuation = payload.typ === "anthropic-managed-continuation" &&
+                    audienceOptions?.globalSecretOnly === true &&
+                    audienceOptions.allowAnthropicManagedContinuation === true &&
+                    audienceOptions.includeClaims === true;
+                if (!managedContinuation) {
+                    return { payload: { email: null, orgDomain: null } };
+                }
+            }
             if (typeof payload.org_domain === "string" && payload.org_domain.trim()) {
                 let organization;
                 try {
@@ -388,12 +424,49 @@ async function verifyA2ATokenInternal(token, event, audienceOptions) {
     }
     if (!organization)
         return { payload: { email: null, orgDomain: null } };
-    const payload = await verifyJwtWithSecret(token, organization.secret, verifyOptions);
+    const orgVerifyOptions = unverifiedPayload?.typ === A2A_ORG_MEMBER_DELEGATION_TYPE
+        ? { ...verifyOptions, algorithms: ["HS256"] }
+        : verifyOptions;
+    const payload = await verifyJwtWithSecret(token, organization.secret, orgVerifyOptions);
     if (!payload)
         return { payload: { email: null, orgDomain: null } };
     const claims = organizationPrincipalClaims(payload, organization);
     if (!claims)
         return { payload: { email: null, orgDomain: null } };
+    if (payload.typ === A2A_ORG_MEMBER_DELEGATION_TYPE) {
+        if (!validOrgMemberDelegationClaims(payload)) {
+            return { payload: { email: null, orgDomain: null } };
+        }
+        if (organization.secret.trim() === globalSecret) {
+            return { payload: { email: null, orgDomain: null } };
+        }
+        let isCurrentMember = false;
+        if (organization.a2aMemberDelegationEnabled) {
+            try {
+                const { isOrgMemberForA2A } = await import("../org/membership.js");
+                isCurrentMember = await isOrgMemberForA2A(organization.orgId, String(payload.sub).trim(), event);
+            }
+            catch (cause) {
+                throw new A2AIdentityVerificationUnavailableError(cause);
+            }
+        }
+        if (isCurrentMember) {
+            return {
+                payload: identityPayload(payload, audienceOptions, organization, "org-member"),
+                verifiedOrgId: organization.orgId,
+            };
+        }
+        return {
+            payload: {
+                email: null,
+                orgDomain: organization.orgDomain,
+                orgId: organization.orgId,
+                identityAssurance: "organization",
+                ...(audienceOptions?.includeClaims ? { claims } : {}),
+            },
+            verifiedOrgId: organization.orgId,
+        };
+    }
     warnUserAssertionDemotedOnce(organization.orgId, payload, "user token verified only with org secret");
     return {
         payload: {
@@ -742,9 +815,9 @@ export function mountA2A(nitroApp, config, routePrefix = "/_agent-native") {
             }
             verifiedCallerEmail = tokenPayload.email;
             verifiedOrgDomain = tokenPayload.orgDomain;
-            verifiedIdentityAssurance = tokenPayload.email
-                ? "user"
-                : tokenPayload.identityAssurance;
+            verifiedIdentityAssurance =
+                tokenPayload.identityAssurance ??
+                    (tokenPayload.email ? "user" : undefined);
             bearerTokenVerified = verifiedIdentityAssurance !== undefined;
             verifiedAudienceBound =
                 bearerTokenVerified && tokenHasAudienceClaim(bearerToken);

package/dist/a2a-claims.d.ts

@@ -3,6 +3,7 @@ export interface VerifiedA2AClaims {
     orgId: string;
     orgDomain: string;
     jti: string;
+    identityAssurance?: "user" | "org-member";
     issuer?: string;
     scope: string[];
 }

package/dist/a2a-claims.js

@@ -36,6 +36,7 @@ export async function verifyA2ATokenWithClaims(token, event) {
                 orgId,
                 orgDomain,
                 jti,
+                identityAssurance: identity.identityAssurance === "org-member" ? "org-member" : "user",
                 ...(issuer ? { issuer } : {}),
                 scope: scopes,
             }

package/dist/agent/actions/manage-provider-key-policy.js

@@ -92,7 +92,7 @@ export default defineAction({
             return {
                 ...policy,
                 canManage,
-                affectedMembers: await listPersonalProviderKeyHolders(orgId),
+                affectedMembers: await listPersonalProviderKeyHolders(orgId, email),
                 changed,
             };
         }
@@ -101,7 +101,9 @@ export default defineAction({
             ...policy,
             canManage,
             ...(canManage
-                ? { affectedMembers: await listPersonalProviderKeyHolders(orgId) }
+                ? {
+                    affectedMembers: await listPersonalProviderKeyHolders(orgId, email),
+                }
                 : {}),
         };
     },

package/dist/agent/app-model-defaults.js

@@ -1,4 +1,4 @@
-import { getDbExec } from "../db/client.js";
+import { readOrgMemberRole } from "../server/personal-provider-key-policy.js";
 import { getRequestContext, getRequestOrgId, getRequestUserEmail, } from "../server/request-context.js";
 import { deleteOrgSetting, deleteUserSetting, getOrgSetting, getUserSetting, putOrgSetting, putUserSetting, } from "../settings/index.js";
 export const AGENT_APP_MODEL_DEFAULT_KEY_PREFIX = "agent-app-model-default";
@@ -116,15 +116,7 @@ export async function canUpdateAgentAppModelDefaultSettings(userEmail, orgId, or
     if (!orgId)
         return orgScope === "personal";
     try {
-        const exec = getDbExec();
-        const { rows } = await exec.execute({
-            sql: `SELECT role FROM org_members
-            WHERE org_id = ? AND LOWER(email) = ?
-              AND federation_removal_pending_at IS NULL
-            LIMIT 1`,
-            args: [orgId, userEmail.toLowerCase()],
-        });
-        const role = String(rows[0]?.role ?? "");
+        const role = await readOrgMemberRole(orgId, userEmail);
         return role === "owner" || role === "admin";
     }
     catch {

package/dist/agent/loop-settings.js

@@ -1,4 +1,4 @@
-import { getDbExec } from "../db/client.js";
+import { readOrgMemberRole } from "../server/personal-provider-key-policy.js";
 import { getOrgSetting, putOrgSetting, deleteOrgSetting, getUserSetting, putUserSetting, deleteUserSetting, } from "../settings/index.js";
 export const AGENT_LOOP_SETTINGS_KEY = "agent-loop";
 export const DEFAULT_AGENT_MAX_ITERATIONS = 400;
@@ -169,15 +169,7 @@ export async function canUpdateAgentLoopSettings(userEmail, orgId) {
     if (!orgId)
         return true;
     try {
-        const exec = getDbExec();
-        const { rows } = await exec.execute({
-            sql: `SELECT role FROM org_members
-            WHERE org_id = ? AND LOWER(email) = ?
-              AND federation_removal_pending_at IS NULL
-            LIMIT 1`,
-            args: [orgId, userEmail.toLowerCase()],
-        });
-        const role = String(rows[0]?.role ?? "");
+        const role = await readOrgMemberRole(orgId, userEmail);
         return role === "owner" || role === "admin";
     }
     catch {

package/dist/audit/actions/export-audit-events.js

@@ -26,6 +26,7 @@ const CSV_COLUMNS = [
     ["reportedClientVersion", "reported_client_version"],
     ["oauthClientId", "oauth_client_id"],
     ["approval", "approval"],
+    ["identityAssurance", "identity_assurance"],
 ];
 function csvField(value) {
     if (value === null || value === undefined)

package/dist/audit/attribution.d.ts

@@ -1,4 +1,4 @@
-import type { AuditApproval } from "./types.js";
+import type { AuditApproval, AuditIdentityAssurance } from "./types.js";
 declare const auditAttributionBrand: unique symbol;
 interface AuditAttributionFields {
     caller: string;
@@ -16,11 +16,12 @@ interface AuditAttributionFields {
     };
     mcpClientAccepted?: true;
     approval?: AuditApproval;
+    identityAssurance?: AuditIdentityAssurance;
 }
 /**
  * Where an audited call came from and what vouched for it: its source, the
- * MCP client it reported, the OAuth client of its credential, the approval
- * signal, and its run and network ids. `recordActionAudit` requires one and
+ * MCP client it reported, the OAuth client of its credential, verified A2A
+ * identity assurance, the approval signal, and its run and network ids. `recordActionAudit` requires one and
  * only {@link auditAttribution} makes one, so a recorder cannot build its own
  * context and store nulls for a field it forgot.
  */
@@ -38,7 +39,7 @@ export type AuditOverride = Partial<Pick<AuditAttributionFields, "threadId" | "t
  * The run context attribution reads from; an `ActionRunContext` is one.
  * Approval is not read from it: a context can be handed to another action.
  */
-export type AuditAttributionSource = Partial<Omit<AuditAttributionFields, "approval" | "approvedToolCallKey" | "mcpClientAccepted">>;
+export type AuditAttributionSource = Partial<Omit<AuditAttributionFields, "approval" | "approvedToolCallKey" | "mcpClientAccepted" | "identityAssurance">>;
 /** A recorder was given no attribution, or one `auditAttribution` did not make. */
 export declare class AuditAttributionError extends Error {
     constructor(recorder: string);

package/dist/audit/attribution.js

@@ -1,5 +1,5 @@
 import { currentInvocationEvidence } from "../action-frame.js";
-import { getVerifiedMcpCredentialFromEvent } from "../server/request-context.js";
+import { getRequestContext, getVerifiedMcpCredentialFromEvent, } from "../server/request-context.js";
 // Registered, so an attribution made by another loaded copy of this module
 // still passes the check.
 const auditAttributionBrand = Symbol.for("@agent-native/core/audit-attribution");
@@ -40,6 +40,7 @@ export function auditAttribution(ctx) {
         mcpClient: ctx?.mcpClient,
         mcpClientAccepted: evidence?.mcpClientAccepted,
         approval: override?.approval,
+        identityAssurance: getRequestContext()?.a2aIdentityAssurance,
     };
     return { ...fields, [auditAttributionBrand]: true };
 }

package/dist/audit/index.d.ts

@@ -1,4 +1,4 @@
-export type { ActionAuditConfig, AuditActorKind, AuditApproval, AuditCallMeta, AuditEvent, AuditQueryFilters, AuditStatus, AuditTarget, AuditVisibility, } from "./types.js";
+export type { ActionAuditConfig, AuditActorKind, AuditApproval, AuditCallMeta, AuditEvent, AuditIdentityAssurance, AuditQueryFilters, AuditStatus, AuditTarget, AuditVisibility, } from "./types.js";
 export { AGENT_AUDIT_CALLERS, deriveActorKind, isAuditDisabled, normalizeAuditConfig, resolveAuditAttach, shouldRecordAudit, } from "./config.js";
 export { redactArgsToJson } from "./redact.js";
 export { ensureAuditTables, insertAuditEvent, queryAuditEvents, queryAuditEventPage, queryAuditApps, getAuditEventById, deleteOldAuditEvents, type AuditEventPage, type AuditReadScope, type AuditTrail, } from "./store.js";

package/dist/audit/ocsf.js

@@ -177,6 +177,7 @@ export function auditEventToOcsf(event) {
     keep("reported_client_version", event.reportedClientVersion);
     keep("oauth_client_id", event.oauthClientId);
     keep("approval", event.approval);
+    keep("identity_assurance", event.identityAssurance);
     const resource = event.targetType || event.targetId
         ? [
             {

package/dist/audit/read-scope.js

@@ -4,9 +4,9 @@
  * decided on the server from `org_members`, never from anything the caller
  * sends.
  */
-import { getDbExec } from "../db/client.js";
 import { isMissingOrganizationTableError } from "../org/membership.js";
 import { canManageOrg } from "../org/permissions.js";
+import { readOrgMemberRole } from "../server/personal-provider-key-policy.js";
 export class AuditAccessError extends Error {
     statusCode = 403;
     constructor(message) {
@@ -16,17 +16,7 @@ export class AuditAccessError extends Error {
 }
 async function readOrgRole(orgId, email) {
     try {
-        const { rows } = await getDbExec().execute({
-            sql: `SELECT role FROM org_members
-            WHERE org_id = ? AND LOWER(email) = ?
-              AND federation_removal_pending_at IS NULL
-            LIMIT 1`,
-            args: [orgId, email.toLowerCase()],
-        });
-        const role = rows[0]?.role;
-        return role === "owner" || role === "admin" || role === "member"
-            ? role
-            : null;
+        return await readOrgMemberRole(orgId, email);
     }
     catch (error) {
         // No org tables means no organization to administer. Any other failure

package/dist/audit/record.js

@@ -170,6 +170,7 @@ export async function recordActionAudit(input) {
             reportedClientVersion: reportedLabel(attribution.mcpClient?.version),
             oauthClientId: attribution.mcpClient?.oauthClientId ?? null,
             approval: approvalEvidence(attribution),
+            identityAssurance: attribution.identityAssurance ?? null,
         };
         if (integration) {
             if (ctx?.orgId &&

package/dist/audit/store.js

@@ -78,6 +78,12 @@ export const auditStore = defineStore({
                 "ALTER TABLE agent_audit_log ADD COLUMN IF NOT EXISTS approval TEXT",
             ],
         },
+        {
+            name: "a2a-identity-assurance",
+            sql: [
+                "ALTER TABLE agent_audit_log ADD COLUMN IF NOT EXISTS identity_assurance TEXT",
+            ],
+        },
     ],
 });
 export function ensureAuditTables() {
@@ -100,8 +106,8 @@ export async function insertAuditEvent(event) {
        error_code, owner_email, visibility, run_id, task_id, parent_task_id,
        source_kind, source_platform, source_id, source_url, network_protocol,
        network_id, network_peer, app, reported_client_name,
-       reported_client_version, oauth_client_id, approval)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+       reported_client_version, oauth_client_id, approval, identity_assurance)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
         args: [
             event.id,
             event.createdAt,
@@ -135,6 +141,7 @@ export async function insertAuditEvent(event) {
             event.reportedClientVersion ?? null,
             event.oauthClientId ?? null,
             event.approval ?? null,
+            event.identityAssurance ?? null,
         ].map(storableText),
     });
 }
@@ -203,6 +210,8 @@ function mapRow(row) {
         reportedClientVersion: row.reported_client_version ?? null,
         oauthClientId: row.oauth_client_id ?? null,
         approval: (row.approval ?? null),
+        identityAssurance: (row.identity_assurance ??
+            null),
     };
 }
 function sharedVisibilities(scope) {
@@ -252,7 +261,7 @@ const LIST_COLUMNS = "id, created_at, action, caller, actor_kind, actor_email, o
     "error_code, owner_email, visibility, app, run_id, task_id, " +
     "parent_task_id, source_kind, source_platform, source_id, source_url, " +
     "network_protocol, network_id, network_peer, reported_client_name, " +
-    "reported_client_version, oauth_client_id, approval";
+    "reported_client_version, oauth_client_id, approval, identity_assurance";
 function clampLimit(limit) {
     return Math.min(Math.max(1, Math.floor(limit ?? DEFAULT_LIMIT)), MAX_LIMIT);
 }

package/dist/audit/types.d.ts

@@ -7,6 +7,8 @@ export type AuditActorKind = "agent" | "human" | "service" | "system";
  * accepted MCP elicitation response; the server cannot verify who responded.
  */
 export type AuditApproval = "agent-chat" | "a2a-review" | "mcp-client-accepted";
+/** Verified identity provenance for a request authenticated through A2A. */
+export type AuditIdentityAssurance = "user" | "organization" | "org-member";
 /**
  * Who can read an event besides its owner.
  * - `private` — the owner only (the default; personal content stays here).
@@ -80,6 +82,8 @@ export interface AuditEvent {
      * not verify who responded. Rows written before the column existed are null.
      */
     approval?: AuditApproval | null;
+    /** Verified identity provenance; null on older rows or non-A2A calls. */
+    identityAssurance?: AuditIdentityAssurance | null;
 }
 export interface AuditQueryFilters {
     targetType?: string;

package/dist/automation/index.d.ts

@@ -139,8 +139,8 @@ export declare function createAutomationCallbackHandler(runtime: AutomationRunti
     duplicate?: undefined;
     eventId?: undefined;
 } | {
+    error?: undefined;
     accepted: boolean;
     duplicate: boolean;
     eventId: string;
-    error?: undefined;
 }>;