@agent-native/core 0.212.1 → 0.213.1

package/dist/org/context.js

@@ -7,6 +7,7 @@ import { getDbExec, isTransientDatabaseError } from "../db/client.js";
 import { isAnonymousWaitlistSessionEmail } from "../server/anonymous-identity.js";
 import { crossSiteCookieAttrs, getSession } from "../server/auth.js";
 import { shouldWriteFirstRunOnboardingEligibility } from "../server/first-run-onboarding-build-mode.js";
+import { effectiveOrgMemberRole, readOrgMemberRole, } from "../server/personal-provider-key-policy.js";
 import { getVerifiedServiceIdentityFromEvent, getRequestContext, hasExplicitPersonalOrgScope, } from "../server/request-context.js";
 import { getSetting } from "../settings/store.js";
 import { getUserSetting } from "../settings/user-settings.js";
@@ -46,6 +47,32 @@ function normalizeOrgRole(value) {
         ? value
         : null;
 }
+function delegatedOrgMemberScope(email) {
+    const requestContext = getRequestContext();
+    if (requestContext?.a2aIdentityAssurance !== "org-member")
+        return undefined;
+    const requestEmail = requestContext.userEmail?.trim().toLowerCase();
+    const requestOrgId = requestContext.orgId?.trim();
+    if (!requestEmail ||
+        !requestOrgId ||
+        (email && email.trim().toLowerCase() !== requestEmail)) {
+        return null;
+    }
+    return requestOrgId;
+}
+function scopeMembershipsForDelegatedIdentity(email, memberships) {
+    const scopedOrgId = delegatedOrgMemberScope(email);
+    if (scopedOrgId === undefined || memberships === null)
+        return memberships;
+    if (!scopedOrgId)
+        return [];
+    return memberships.flatMap((membership) => {
+        if (membership.orgId !== scopedOrgId)
+            return [];
+        const role = effectiveOrgMemberRole(membership.role, scopedOrgId, email);
+        return role ? [{ ...membership, role }] : [];
+    });
+}
 function emailDomainOf(email) {
     return email.split("@")[1]?.toLowerCase() || null;
 }
@@ -94,10 +121,13 @@ async function refreshFederatedMemberships(event, email, memberships, selectedOr
     if (!result.active) {
         return memberships.filter((item) => item.orgId !== selected.orgId);
     }
-    if (result.role === selected.role) {
+    const role = effectiveOrgMemberRole(result.role, selected.orgId, email);
+    if (!role)
+        return memberships.filter((item) => item.orgId !== selected.orgId);
+    if (role === selected.role) {
         return memberships;
     }
-    return memberships.map((item) => item.orgId === selected.orgId ? { ...item, role: result.role } : item);
+    return memberships.map((item) => item.orgId === selected.orgId ? { ...item, role } : item);
 }
 const MEMBERSHIPS_CACHE_KEY = "__anOrgMembershipsCache";
 const ACTIVE_ORG_SETTING_CACHE_KEY = "__anActiveOrgSettingCache";
@@ -143,12 +173,19 @@ export function markActiveOrgSelectionChanged(event) {
     });
 }
 function loadMembershipsForEvent(event, email) {
+    const scopedOrgId = delegatedOrgMemberScope(email);
+    if (scopedOrgId === null)
+        return Promise.resolve([]);
     const ctx = event.context;
     const cache = (ctx[MEMBERSHIPS_CACHE_KEY] ??
         (ctx[MEMBERSHIPS_CACHE_KEY] = new Map()));
     let promise = cache.get(email);
     if (!promise) {
-        promise = loadMemberships(email).catch((err) => {
+        promise = loadMemberships(email)
+            .then((memberships) => scopedOrgId === undefined
+            ? memberships
+            : scopeMembershipsForDelegatedIdentity(email, memberships))
+            .catch((err) => {
             cache.delete(email);
             throw err;
         });
@@ -166,17 +203,25 @@ async function resolveOrgContextUncached(event) {
     const email = session?.email;
     if (!email)
         return EMPTY_CONTEXT;
+    const requestContext = getRequestContext();
+    const isDelegatedOrgMember = requestContext?.a2aIdentityAssurance === "org-member";
+    const delegatedOrgId = delegatedOrgMemberScope(email);
+    if (isDelegatedOrgMember && !delegatedOrgId) {
+        return { email, orgId: null, orgName: null, role: null };
+    }
     if (isAnonymousWaitlistSessionEmail(email)) {
         return { email, orgId: null, orgName: null, role: null };
     }
-    if (hasExplicitPersonalOrgScope(event)) {
+    if (!isDelegatedOrgMember && hasExplicitPersonalOrgScope(event)) {
         return { email, orgId: null, orgName: null, role: null };
     }
-    const sessionOrgId = typeof session.orgId === "string" && session.orgId.trim()
-        ? session.orgId.trim()
-        : null;
-    const sessionOrgRole = normalizeOrgRole(session.orgRole);
-    const requestContext = getRequestContext();
+    const sessionOrgId = delegatedOrgId ??
+        (typeof session.orgId === "string" && session.orgId.trim()
+            ? session.orgId.trim()
+            : null);
+    const sessionOrgRole = isDelegatedOrgMember
+        ? "member"
+        : normalizeOrgRole(session.orgRole);
     const verifiedServiceIdentity = getVerifiedServiceIdentityFromEvent(event);
     const serviceRole = implicitServiceOrgRole({
         email,
@@ -209,7 +254,9 @@ async function resolveOrgContextUncached(event) {
         }
     }
     const exec = getDbExec();
-    const activeOrgSettingPromise = loadActiveOrgSettingForEvent(event, email);
+    const activeOrgSettingPromise = isDelegatedOrgMember
+        ? Promise.resolve(null)
+        : loadActiveOrgSettingForEvent(event, email);
     activeOrgSettingPromise.catch(() => { });
     let memberships;
     try {
@@ -219,6 +266,10 @@ async function resolveOrgContextUncached(event) {
         // A transient membership read must not downgrade an authenticated request
         // to a private/solo scope when the session already carries its org.
         if (sessionOrgId && isTransientDatabaseError(err)) {
+            if (isDelegatedOrgMember) {
+                markOrgScopeResolutionUnavailable(event);
+                return { email, orgId: null, orgName: null, role: null };
+            }
             return {
                 email,
                 orgId: sessionOrgId,
@@ -231,6 +282,9 @@ async function resolveOrgContextUncached(event) {
     if (memberships === null) {
         // A null membership read is unavailable scope, not proof of a solo user.
         markOrgScopeResolutionUnavailable(event);
+        if (isDelegatedOrgMember) {
+            return { email, orgId: null, orgName: null, role: null };
+        }
         if (sessionOrgId) {
             return {
                 email,
@@ -242,16 +296,18 @@ async function resolveOrgContextUncached(event) {
         return { email, orgId: null, orgName: null, role: null };
     }
     const activeOrgSetting = await activeOrgSettingPromise;
-    const explicitPersonal = activeOrgSetting?.orgId === null;
-    const selectedMembership = explicitPersonal
-        ? undefined
-        : ((activeOrgSetting?.orgId
-            ? memberships.find((membership) => membership.orgId === activeOrgSetting.orgId)
-            : undefined) ??
-            (sessionOrgId
-                ? memberships.find((membership) => membership.orgId === sessionOrgId)
+    const explicitPersonal = !isDelegatedOrgMember && activeOrgSetting?.orgId === null;
+    const selectedMembership = isDelegatedOrgMember
+        ? memberships.find((membership) => membership.orgId === delegatedOrgId)
+        : explicitPersonal
+            ? undefined
+            : ((activeOrgSetting?.orgId
+                ? memberships.find((membership) => membership.orgId === activeOrgSetting.orgId)
                 : undefined) ??
-            memberships[0]);
+                (sessionOrgId
+                    ? memberships.find((membership) => membership.orgId === sessionOrgId)
+                    : undefined) ??
+                memberships[0]);
     const selectedOrgId = selectedMembership?.orgId ?? null;
     const selectedWasFederated = Boolean(selectedMembership?.identityAuthority || selectedMembership?.identityId);
     const refreshedMemberships = await refreshFederatedMemberships(event, email, memberships, selectedOrgId);
@@ -268,7 +324,8 @@ async function resolveOrgContextUncached(event) {
         markFederationMembershipValidated(event, email, selectedOrgId);
     }
     const emailDomain = emailDomainOf(email);
-    const shouldTryDomainAutoJoin = !explicitPersonal &&
+    const shouldTryDomainAutoJoin = !isDelegatedOrgMember &&
+        !explicitPersonal &&
         session.emailVerified === true &&
         emailDomain !== null &&
         !isFreeEmailProvider(emailDomain) &&
@@ -358,7 +415,9 @@ async function resolveOrgContextUncached(event) {
         }
         return { email, orgId: null, orgName: null, role: null };
     }
-    if (memberships.length === 0 && autoCreateDefaultOrgEnabled()) {
+    if (!isDelegatedOrgMember &&
+        memberships.length === 0 &&
+        autoCreateDefaultOrgEnabled()) {
         const created = await tryCreateDefaultOrg(exec, email, session, event);
         if (created)
             return created;
@@ -381,7 +440,8 @@ async function loadMemberships(email) {
     return cachedMemberships(email, () => loadMembershipsUncached(email));
 }
 export async function listOrgMemberships(email) {
-    return loadMemberships(email);
+    const memberships = await loadMemberships(email);
+    return scopeMembershipsForDelegatedIdentity(email, memberships);
 }
 export async function listOrgMembershipsForEvent(event, email, selectedOrgId) {
     const memberships = await loadMembershipsForEvent(event, email);
@@ -423,6 +483,15 @@ async function loadMembershipsUncached(email) {
     }) ?? null);
 }
 export async function resolveOrgScopeForEmail(email) {
+    const delegatedOrgId = delegatedOrgMemberScope(email);
+    if (delegatedOrgId !== undefined) {
+        if (!delegatedOrgId)
+            return { status: "unknown" };
+        const role = await readOrgMemberRole(delegatedOrgId, email);
+        return role
+            ? { status: "organization", orgId: delegatedOrgId }
+            : { status: "unknown" };
+    }
     if (getRequestContext()?.orgScope === "personal") {
         return { status: "personal" };
     }
@@ -457,6 +526,13 @@ export async function resolveActiveOrgIdForStorageCredential(email) {
     const normalizedEmail = email.trim().toLowerCase();
     if (!normalizedEmail)
         return null;
+    const delegatedOrgId = delegatedOrgMemberScope(normalizedEmail);
+    if (delegatedOrgId !== undefined) {
+        if (!delegatedOrgId)
+            return null;
+        const role = await readOrgMemberRole(delegatedOrgId, normalizedEmail);
+        return role ? delegatedOrgId : null;
+    }
     const { rows } = await getDbExec().execute({
         sql: `SELECT m.org_id AS "orgId"
           FROM org_members m
@@ -476,6 +552,22 @@ export async function resolveActiveOrgIdForStorageCredential(email) {
     return rows.some((row) => row.orgId === activeOrgId) ? activeOrgId : null;
 }
 export async function resolveOrgIdForEmailViaEvent(event, email) {
+    const delegatedOrgId = delegatedOrgMemberScope(email);
+    if (delegatedOrgId !== undefined) {
+        if (!delegatedOrgId)
+            return null;
+        const memberships = await loadMembershipsForEvent(event, email);
+        if (!memberships || !memberships.some((m) => m.orgId === delegatedOrgId)) {
+            return null;
+        }
+        const refreshed = await refreshFederatedMemberships(event, email, memberships, delegatedOrgId);
+        if (refreshed !== memberships) {
+            updateMembershipsForEvent(event, email, refreshed);
+        }
+        return refreshed.some((m) => m.orgId === delegatedOrgId)
+            ? delegatedOrgId
+            : null;
+    }
     if (getRequestContext()?.orgScope === "personal")
         return null;
     const settingPromise = loadActiveOrgSettingForEvent(event, email);
@@ -842,7 +934,8 @@ export async function resolveA2AOrganizationCredentialsByDomain(domain) {
     if (!normalizedDomain)
         return null;
     const { rows } = await getDbExec().execute({
-        sql: `SELECT id, allowed_domain, a2a_secret
+        sql: `SELECT id, allowed_domain, a2a_secret,
+                 a2a_member_delegation_enabled
           FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 2`,
         args: [normalizedDomain],
     });
@@ -858,7 +951,12 @@ export async function resolveA2AOrganizationCredentialsByDomain(domain) {
     const secret = String(row.a2a_secret ?? "").trim();
     if (!orgId || orgDomain !== normalizedDomain || !secret)
         return null;
-    return { orgId, orgDomain, secret };
+    return {
+        orgId,
+        orgDomain,
+        secret,
+        a2aMemberDelegationEnabled: row.a2a_member_delegation_enabled === true,
+    };
 }
 export async function isSoleOrgDomain(domain) {
     try {

package/dist/org/federation.d.ts

@@ -52,7 +52,7 @@ export declare function validateFederatedOrganizationMembership(event: H3Event |
 export declare function validateFederatedOrganizationMembershipForCurrentRequest(input: {
     orgId: string;
     email: string;
-}): Promise<FederatedMembershipValidation>;
+}, event?: H3Event): Promise<FederatedMembershipValidation>;
 export declare function syncOrganizationToIdentityHub(event: H3Event, input: FederatedOrganizationSyncInput): Promise<boolean>;
 export declare function provisionFederatedOrganization(identity: FederatedOrganizationIdentity, options?: {
     /** The signing-in caller's request; see `setActiveOrgId`. */

package/dist/org/federation.js

@@ -408,8 +408,8 @@ export async function validateFederatedOrganizationMembership(event, input) {
     }
     return { active: true, role: body.memberRole };
 }
-export async function validateFederatedOrganizationMembershipForCurrentRequest(input) {
-    return validateFederatedOrganizationMembership(requestEventFromContext(), input);
+export async function validateFederatedOrganizationMembershipForCurrentRequest(input, event) {
+    return validateFederatedOrganizationMembership(event ?? requestEventFromContext(), input);
 }
 export async function syncOrganizationToIdentityHub(event, input) {
     const rollout = await federationRolloutState(input.email, input.id);

package/dist/org/handlers.d.ts

@@ -62,6 +62,7 @@ export declare const getMyOrgHandler: import("h3").EventHandlerWithFetch<import(
     workspaceAppDefaultVisibility: WorkspaceAppDefaultVisibility;
     signInMethods: import("./sign-in-methods.js").OrgSignInMethods;
     a2aSecretSet: boolean;
+    a2aMemberDelegationEnabled: boolean;
     soloDeploymentAdmin: boolean;
 }>>;
 export declare const retryPendingFederatedRemovalHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
@@ -175,6 +176,9 @@ export declare const setRequiredAuthProviderHandler: import("h3").EventHandlerWi
     revokedLegacySessions: number;
     provider: RequiredAuthProvider;
 }>>;
+export declare const setA2AMemberDelegationHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    enabled: any;
+}>>;
 export declare const revealA2ASecretHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     a2aSecret: string;
 }>>;

package/dist/org/handlers.js

@@ -35,6 +35,8 @@ import { getAppProductionUrl, resolveAppRuntimeUrl, } from "../server/app-url.js
 import { isTrustedSelfHostedRuntime, resolveVercelDeploymentProtectionHeaders, } from "../server/credential-provider.js";
 import { sendEmail, isEmailConfigured } from "../server/email.js";
 import { readBody } from "../server/h3-helpers.js";
+import { effectiveOrgMemberRole } from "../server/personal-provider-key-policy.js";
+import { getRequestContext } from "../server/request-context.js";
 import { resolveDeploymentSignInMethods } from "../server/social-sign-in-providers.js";
 import { getOrgSetting, putOrgSetting } from "../settings/org-settings.js";
 import { isEmailDerivedName } from "../user-profile/shared.js";
@@ -140,37 +142,82 @@ async function getSessionForEvent(event) {
 }
 export const getMyOrgHandler = defineEventHandler(async (event) => {
     const ctx = await getOrgContext(event);
+    const requestContext = getRequestContext();
+    const delegatedOrgMember = requestContext?.a2aIdentityAssurance === "org-member";
+    const delegatedEmail = requestContext?.userEmail?.trim().toLowerCase();
+    const delegatedOrgId = delegatedOrgMember
+        ? requestContext.orgId?.trim()
+        : undefined;
+    const scopedDelegatedOrgId = delegatedEmail &&
+        delegatedEmail === ctx.email.trim().toLowerCase() &&
+        delegatedOrgId &&
+        ctx.orgId === delegatedOrgId
+        ? delegatedOrgId
+        : null;
+    const visibleOrgId = delegatedOrgMember ? scopedDelegatedOrgId : ctx.orgId;
+    const visibleOrgName = visibleOrgId ? ctx.orgName : null;
+    const visibleRole = delegatedOrgMember
+        ? visibleOrgId
+            ? "member"
+            : null
+        : ctx.role;
     const e = await exec();
-    const allOrgsRes = await e.execute({
-        sql: `SELECT m.org_id AS "orgId", m.role AS role, o.name AS "orgName",
-                 o.icon_json AS "iconJson", o.icon_revision AS "iconRevision"
-          FROM org_members m
-          INNER JOIN organizations o ON m.org_id = o.id
-          WHERE LOWER(m.email) = ?
-            AND m.federation_removal_pending_at IS NULL`,
-        args: [ctx.email.toLowerCase()],
-    });
-    const orgs = allOrgsRes.rows.map((r) => ({
-        orgId: String(r.orgId ?? r.org_id),
-        role: String(r.role),
-        orgName: String(r.orgName ?? r.org_name),
-        icon: parseOrganizationIconJson(r.iconJson ?? r.icon_json),
-        iconRevision: Number(r.iconRevision ?? r.icon_revision ?? 0),
-    }));
-    const pendingRemovalRes = await e.execute({
-        sql: `SELECT m.org_id AS "orgId", o.name AS "orgName"
-          FROM org_members m
-          INNER JOIN organizations o ON m.org_id = o.id
-          WHERE LOWER(m.email) = ?
-            AND m.federation_removal_pending_at IS NOT NULL`,
-        args: [ctx.email.toLowerCase()],
+    const allOrgsRes = delegatedOrgMember
+        ? scopedDelegatedOrgId
+            ? await e.execute({
+                sql: `SELECT m.org_id AS "orgId", m.role AS role, o.name AS "orgName",
+                       o.icon_json AS "iconJson", o.icon_revision AS "iconRevision"
+                FROM org_members m
+                INNER JOIN organizations o ON m.org_id = o.id
+                WHERE LOWER(m.email) = ? AND m.org_id = ?
+                  AND m.federation_removal_pending_at IS NULL`,
+                args: [ctx.email.toLowerCase(), scopedDelegatedOrgId],
+            })
+            : { rows: [] }
+        : await e.execute({
+            sql: `SELECT m.org_id AS "orgId", m.role AS role, o.name AS "orgName",
+                     o.icon_json AS "iconJson", o.icon_revision AS "iconRevision"
+              FROM org_members m
+              INNER JOIN organizations o ON m.org_id = o.id
+              WHERE LOWER(m.email) = ?
+                AND m.federation_removal_pending_at IS NULL`,
+            args: [ctx.email.toLowerCase()],
+        });
+    const orgs = allOrgsRes.rows.flatMap((r) => {
+        const orgId = String(r.orgId ?? r.org_id);
+        const role = delegatedOrgMember
+            ? effectiveOrgMemberRole(r.role, orgId, ctx.email)
+            : String(r.role);
+        return role
+            ? [
+                {
+                    orgId,
+                    role,
+                    orgName: String(r.orgName ?? r.org_name),
+                    icon: parseOrganizationIconJson(r.iconJson ?? r.icon_json),
+                    iconRevision: Number(r.iconRevision ?? r.icon_revision ?? 0),
+                },
+            ]
+            : [];
     });
+    const pendingRemovalRes = delegatedOrgMember
+        ? { rows: [] }
+        : await e.execute({
+            sql: `SELECT m.org_id AS "orgId", o.name AS "orgName"
+              FROM org_members m
+              INNER JOIN organizations o ON m.org_id = o.id
+              WHERE LOWER(m.email) = ?
+                AND m.federation_removal_pending_at IS NOT NULL`,
+            args: [ctx.email.toLowerCase()],
+        });
     const pendingRemovals = pendingRemovalRes.rows.map((r) => ({
         orgId: String(r.orgId ?? r.org_id),
         orgName: String(r.orgName ?? r.org_name),
     }));
     let domainMatches = [];
-    const domain = ctx.email.split("@")[1]?.toLowerCase();
+    const domain = delegatedOrgMember
+        ? undefined
+        : ctx.email.split("@")[1]?.toLowerCase();
     if (domain) {
         try {
             const dmRes = await e.execute({
@@ -199,14 +246,16 @@ export const getMyOrgHandler = defineEventHandler(async (event) => {
     let workspaceUrl = null;
     let requiredAuthProvider = null;
     let a2aSecretSet = false;
+    let a2aMemberDelegationEnabled = false;
     let icon = null;
     let iconRevision = 0;
-    if (ctx.orgId) {
+    if (visibleOrgId) {
         const adRes = await e.execute({
-            sql: `SELECT allowed_domain, a2a_secret, workspace_url, required_auth_provider,
+            sql: `SELECT allowed_domain, a2a_secret, a2a_member_delegation_enabled,
+                   workspace_url, required_auth_provider,
                    icon_json, icon_revision
             FROM organizations WHERE id = ? LIMIT 1`,
-            args: [ctx.orgId],
+            args: [visibleOrgId],
         });
         if (adRes.rows[0]) {
             allowedDomain =
@@ -214,35 +263,49 @@ export const getMyOrgHandler = defineEventHandler(async (event) => {
             workspaceUrl = String(adRes.rows[0].workspace_url ?? "") || null;
             requiredAuthProvider = parseRequiredAuthProvider(adRes.rows[0].required_auth_provider ?? null);
             a2aSecretSet = Boolean(String(adRes.rows[0].a2a_secret ?? "").trim());
+            a2aMemberDelegationEnabled =
+                adRes.rows[0].a2a_member_delegation_enabled === true;
             icon = parseOrganizationIconJson(adRes.rows[0].icon_json);
             iconRevision = Number(adRes.rows[0].icon_revision ?? 0);
         }
     }
-    const isOwnerOrAdmin = ctx.role === "owner" || ctx.role === "admin";
+    const isOwnerOrAdmin = visibleRole === "owner" || visibleRole === "admin";
     let workspaceAppDefaultVisibility = "org";
-    if (ctx.orgId) {
-        const setting = await getOrgSetting(ctx.orgId, WORKSPACE_APP_DEFAULT_VISIBILITY_KEY);
+    if (visibleOrgId) {
+        const setting = await getOrgSetting(visibleOrgId, WORKSPACE_APP_DEFAULT_VISIBILITY_KEY);
         workspaceAppDefaultVisibility = normalizeWorkspaceAppDefaultVisibility(setting?.visibility);
     }
-    const invitesRes = await e.execute({
-        sql: `SELECT i.id AS id, i.org_id AS "orgId", o.name AS "orgName", i.invited_by AS "invitedBy"
-          FROM org_invitations i
-          INNER JOIN organizations o ON i.org_id = o.id
-          WHERE LOWER(i.email) = ? AND i.status = 'pending'`,
-        args: [ctx.email.toLowerCase()],
-    });
+    const invitesRes = delegatedOrgMember
+        ? scopedDelegatedOrgId
+            ? await e.execute({
+                sql: `SELECT i.id AS id, i.org_id AS "orgId", o.name AS "orgName", i.invited_by AS "invitedBy"
+                FROM org_invitations i
+                INNER JOIN organizations o ON i.org_id = o.id
+                WHERE LOWER(i.email) = ? AND i.org_id = ? AND i.status = 'pending'`,
+                args: [ctx.email.toLowerCase(), scopedDelegatedOrgId],
+            })
+            : { rows: [] }
+        : await e.execute({
+            sql: `SELECT i.id AS id, i.org_id AS "orgId", o.name AS "orgName", i.invited_by AS "invitedBy"
+              FROM org_invitations i
+              INNER JOIN organizations o ON i.org_id = o.id
+              WHERE LOWER(i.email) = ? AND i.status = 'pending'`,
+            args: [ctx.email.toLowerCase()],
+        });
     const pendingInvitations = invitesRes.rows.map((r) => ({
         id: String(r.id),
         orgId: String(r.orgId ?? r.org_id),
         orgName: String(r.orgName ?? r.org_name),
         invitedBy: String(r.invitedBy ?? r.invited_by),
     }));
-    scheduleFederatedOrgSync(event, { ...ctx, icon, iconRevision });
+    if (!delegatedOrgMember) {
+        scheduleFederatedOrgSync(event, { ...ctx, icon, iconRevision });
+    }
     return {
-        email: ctx.email,
-        orgId: ctx.orgId,
-        orgName: ctx.orgName,
-        role: ctx.role,
+        email: delegatedOrgMember ? (delegatedEmail ?? "") : ctx.email,
+        orgId: visibleOrgId,
+        orgName: visibleOrgName,
+        role: visibleRole,
         icon,
         iconRevision,
         emailConfigured: await isEmailConfigured(),
@@ -268,8 +331,13 @@ export const getMyOrgHandler = defineEventHandler(async (event) => {
         // so the value would sit in JSON any script on the page can read, and it
         // signs the JWTs peers accept as first-party callers. Reveal is an explicit
         // owner GET on /_agent-native/org/a2a-secret.
-        a2aSecretSet: canManageOrgA2ASecret(ctx.role) ? a2aSecretSet : undefined,
-        soloDeploymentAdmin: ctx.orgId ? undefined : isTrustedSelfHostedRuntime(),
+        a2aSecretSet: canManageOrgA2ASecret(visibleRole) ? a2aSecretSet : undefined,
+        a2aMemberDelegationEnabled: visibleRole === "owner" ? a2aMemberDelegationEnabled : undefined,
+        soloDeploymentAdmin: delegatedOrgMember
+            ? undefined
+            : visibleOrgId
+                ? undefined
+                : isTrustedSelfHostedRuntime(),
     };
 });
 export const retryPendingFederatedRemovalHandler = defineEventHandler(async (event) => {
@@ -1558,6 +1626,33 @@ export const setRequiredAuthProviderHandler = defineEventHandler(async (event) =
     const result = await setRequiredAuthProvider(ctx.orgId, provider);
     return { provider, ...result };
 });
+export const setA2AMemberDelegationHandler = defineEventHandler(async (event) => {
+    const ctx = await getOrgContext(event);
+    if (!ctx.orgId) {
+        throw createError({ statusCode: 400, message: "No active organization" });
+    }
+    if (ctx.role !== "owner") {
+        throw createError({
+            statusCode: 403,
+            message: "Only the organization owner can manage member delegation",
+        });
+    }
+    const body = await readBody(event);
+    if (typeof body?.enabled !== "boolean") {
+        throw createError({
+            statusCode: 400,
+            message: "enabled must be a boolean",
+        });
+    }
+    const e = await exec();
+    await e.execute({
+        sql: `UPDATE organizations
+            SET a2a_member_delegation_enabled = ?
+            WHERE id = ?`,
+        args: [body.enabled, ctx.orgId],
+    });
+    return { enabled: body.enabled };
+});
 export const revealA2ASecretHandler = defineEventHandler(async (event) => {
     const ctx = await getOrgContext(event);
     if (!ctx.orgId) {
@@ -1886,6 +1981,7 @@ export const receiveA2ASecretHandler = defineEventHandler(async (event) => {
         verified = null;
     }
     if (!verified ||
+        verified.identityAssurance !== "organization" ||
         verified.orgId !== localOrgId ||
         verified.orgDomain?.trim().toLowerCase() !== orgDomain) {
         throw createError({

package/dist/org/index.d.ts

@@ -159,13 +159,14 @@ export declare const getMyOrgHandler: import("h3").EventHandlerWithFetch<import(
     workspaceAppDefaultVisibility: import("./types.js").WorkspaceAppDefaultVisibility;
     signInMethods: import("./sign-in-methods.js").OrgSignInMethods;
     a2aSecretSet: boolean;
+    a2aMemberDelegationEnabled: boolean;
     soloDeploymentAdmin: boolean;
 }>>;
 export declare const createOrgHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     success: boolean;
+    id?: undefined;
     name?: undefined;
     role?: undefined;
-    id?: undefined;
 } | {
     success?: undefined;
     id: string;

package/dist/org/membership.d.ts

@@ -1,10 +1,12 @@
+import type { H3Event } from "h3";
 export declare function isMissingOrganizationTableError(error: unknown): boolean;
 export declare function isOrgMember(orgId: string, email: string, options?: {
     requireOrganizationMetadata?: boolean;
+    requestEvent?: H3Event;
 }): Promise<boolean>;
 /**
- * Checks membership for an A2A identity authenticated by an organization
- * secret. Unlike legacy callers, this requires readable organization metadata
- * as well as the membership row before the token subject can become an owner.
+ * Checks the live roster for an opted-in org-member A2A assertion. This proves
+ * membership in the asserted org; authorization still caps the identity at
+ * member regardless of the stored owner/admin role.
  */
-export declare function isOrgMemberForA2A(orgId: string, email: string): Promise<boolean>;
+export declare function isOrgMemberForA2A(orgId: string, email: string, requestEvent?: H3Event): Promise<boolean>;

package/dist/org/membership.js

@@ -65,23 +65,25 @@ async function isOrgMemberWithPolicy(orgId, email, options) {
     const validation = await validateFederatedOrganizationMembershipForCurrentRequest({
         orgId,
         email: normalized,
-    });
+    }, options.requestEvent);
     return validation.active;
 }
 export function isOrgMember(orgId, email, options = {}) {
     return isOrgMemberWithPolicy(orgId, email, {
         allowMissingOrganizationTable: !options.requireOrganizationMetadata,
         requireOrganizationRecord: !!options.requireOrganizationMetadata,
+        requestEvent: options.requestEvent,
     });
 }
 /**
- * Checks membership for an A2A identity authenticated by an organization
- * secret. Unlike legacy callers, this requires readable organization metadata
- * as well as the membership row before the token subject can become an owner.
+ * Checks the live roster for an opted-in org-member A2A assertion. This proves
+ * membership in the asserted org; authorization still caps the identity at
+ * member regardless of the stored owner/admin role.
  */
-export function isOrgMemberForA2A(orgId, email) {
+export function isOrgMemberForA2A(orgId, email, requestEvent) {
     return isOrgMemberWithPolicy(orgId, email, {
         allowMissingOrganizationTable: false,
         requireOrganizationRecord: true,
+        requestEvent,
     });
 }

package/dist/org/migrations.js

@@ -284,4 +284,10 @@ export const ORG_MIGRATIONS = [
         ON private_icon_assets (owner_email, org_id, created_at);
     `,
     },
+    {
+        version: 1035,
+        name: "organization-a2a-member-delegation",
+        sql: `ALTER TABLE organizations
+          ADD COLUMN IF NOT EXISTS a2a_member_delegation_enabled BOOLEAN NOT NULL DEFAULT FALSE`,
+    },
 ];

package/dist/org/plugin.d.ts

@@ -24,6 +24,7 @@ type NitroPluginDef = (nitroApp: any) => void | Promise<void>;
  *   PUT    /_agent-native/org/domain                      — set/clear allowed email domain (owner/admin)
  *   PUT    /_agent-native/org/workspace-url               — set/clear the org's workspace origin (owner/admin)
  *   PUT    /_agent-native/org/auth-provider               — require/clear Google sign-in (owner/admin)
+ *   PUT    /_agent-native/org/a2a-member-delegation       — allow org-member A2A assertions (owner only)
  *   PUT    /_agent-native/org/visual-identity              — set/clear workspace icon (owner/admin)
  *   GET    /_agent-native/org/a2a-secret                  — reveal A2A secret on demand (owner/admin)
  *   PUT    /_agent-native/org/a2a-secret                  — regenerate or set A2A secret (owner/admin)