@agent-native/core 0.212.1 → 0.214.0

package/dist/a2a/anthropic-managed-agents.js

@@ -183,6 +183,7 @@ async function verifyContinuationToken(token, context, options) {
         verified = await verifyA2AToken(token, context.event, {
             includeClaims: true,
             globalSecretOnly: true,
+            allowAnthropicManagedContinuation: true,
         });
     }
     catch (cause) {

package/dist/a2a/caller-auth.js

@@ -1,8 +1,9 @@
-import { getRequestOrgId, getRequestUserEmail, } from "../server/request-context.js";
-import { getGlobalA2ASecret, signA2AOrganizationToken, signA2AToken, } from "./client.js";
+import { getRequestContext, getRequestOrgId, getRequestUserEmail, } from "../server/request-context.js";
+import { getGlobalA2ASecret, signA2AOrgMemberDelegationToken, signA2AOrganizationToken, signA2AToken, } from "./client.js";
 const DEFAULT_A2A_CALLER_TOKEN_TTL = "5m";
 export async function resolveA2ACallerAuth(options) {
     const userEmail = getRequestUserEmail();
+    const isOrgMemberDelegation = getRequestContext()?.a2aIdentityAssurance === "org-member";
     const globalSecret = getGlobalA2ASecret();
     const metadata = {};
     if (userEmail)
@@ -24,6 +25,7 @@ export async function resolveA2ACallerAuth(options) {
         apiKeyAttempts.push(token);
     };
     if (userEmail &&
+        !isOrgMemberDelegation &&
         options?.audience &&
         globalSecret &&
         (options?.userIdentityOnly || !orgId || orgDomain?.trim())) {
@@ -40,6 +42,9 @@ export async function resolveA2ACallerAuth(options) {
         orgDomain &&
         options?.audience &&
         (orgSecret || globalSecret)) {
+        if (userEmail && orgSecret) {
+            addApiKeyAttempt(await signA2AOrgMemberDelegationToken(userEmail, orgDomain, orgSecret, options.audience));
+        }
         addApiKeyAttempt(await signA2AOrganizationToken(orgDomain, orgSecret, undefined, {
             expiresIn: options?.expiresIn ?? DEFAULT_A2A_CALLER_TOKEN_TTL,
             audience: options?.audience,

package/dist/a2a/client.d.ts

@@ -64,6 +64,7 @@ export declare function signA2AOrganizationToken(orgDomain: string | undefined,
     preferGlobalSecret?: boolean;
     extraClaims?: Record<string, unknown>;
 }): Promise<string>;
+export declare function signA2AOrgMemberDelegationToken(email: string, orgDomain: string, orgSecret: string, audience: string | string[]): Promise<string>;
 export declare function shouldPreferGlobalA2ASecret(orgSecret?: string): boolean;
 export declare class A2AClient {
     private baseUrl;

package/dist/a2a/client.js

@@ -8,6 +8,7 @@ import { getRequestContext } from "../server/request-context.js";
 import { SYNTHETIC_TRAFFIC_BETA_E2E, SYNTHETIC_TRAFFIC_HEADER, } from "../shared/test-traffic.js";
 import { canonicalA2AAudience } from "./audience.js";
 import { sanitizeA2ACorrelationMetadata } from "./correlation.js";
+import { A2A_ORG_MEMBER_DELEGATION_TYPE } from "./organization-identity.js";
 import { RemoteAgentCredentialRejectedError } from "./remote-agent-auth.js";
 import { workspacePrivateOrigins } from "./workspace-private-origins.js";
 const DEFAULT_A2A_POLL_REQUEST_TIMEOUT_MS = 15_000;
@@ -172,6 +173,27 @@ export async function signA2AOrganizationToken(orgDomain, orgSecret, orgId, opti
         jwt.setAudience(options.audience);
     return jwt.sign(new TextEncoder().encode(secret));
 }
+export async function signA2AOrgMemberDelegationToken(email, orgDomain, orgSecret, audience) {
+    const normalizedEmail = email.trim().toLowerCase();
+    const normalizedDomain = orgDomain.trim().toLowerCase();
+    const secret = orgSecret.trim();
+    if (!normalizedEmail || !normalizedDomain || !secret || !audience) {
+        throw new Error("A member email, organization domain, organization secret, and audience are required.");
+    }
+    const appUrl = getAppConfig().app.url ?? "http://localhost:3000";
+    return new jose.SignJWT({
+        typ: A2A_ORG_MEMBER_DELEGATION_TYPE,
+        sub: normalizedEmail,
+        org_domain: normalizedDomain,
+    })
+        .setProtectedHeader({ alg: "HS256" })
+        .setIssuer(appUrl)
+        .setIssuedAt()
+        .setJti(randomUUID())
+        .setExpirationTime("5m")
+        .setAudience(audience)
+        .sign(new TextEncoder().encode(secret));
+}
 export function shouldPreferGlobalA2ASecret(orgSecret) {
     return !!getGlobalA2ASecret() || !orgSecret;
 }
@@ -1517,7 +1539,9 @@ async function buildA2AApiKeyAttempts(opts, audience) {
         attempts.push(token);
     };
     const globalSecret = getGlobalA2ASecret();
+    const isOrgMemberDelegation = getRequestContext()?.a2aIdentityAssurance === "org-member";
     if (opts?.userEmail &&
+        !isOrgMemberDelegation &&
         globalSecret &&
         (!opts.orgId || opts.orgDomain?.trim())) {
         add(await signA2AToken(opts.userEmail, opts.orgDomain, undefined, {
@@ -1525,6 +1549,9 @@ async function buildA2AApiKeyAttempts(opts, audience) {
             audience,
         }));
     }
+    if (opts?.userEmail && opts.orgDomain && opts.orgSecret && audience) {
+        add(await signA2AOrgMemberDelegationToken(opts.userEmail, opts.orgDomain, opts.orgSecret, audience));
+    }
     if (opts?.orgDomain && (opts.orgSecret || globalSecret)) {
         add(await signA2AOrganizationToken(opts.orgDomain, opts.orgSecret, undefined, { audience }));
     }

package/dist/a2a/handlers.js

@@ -302,9 +302,11 @@ async function processClaimedA2ATask(taskId, claimed, config, signal, event) {
     const verifiedEmail = processorMeta.verifiedEmail;
     const identityAssurance = processorMeta.identityAssurance === "organization"
         ? "organization"
-        : processorMeta.identityAssurance === "user"
-            ? "user"
-            : undefined;
+        : processorMeta.identityAssurance === "org-member"
+            ? "org-member"
+            : processorMeta.identityAssurance === "user"
+                ? "user"
+                : undefined;
     const orgDomainHint = processorMeta.orgDomainHint;
     const verifiedOrgId = typeof processorMeta.verifiedOrgId === "string"
         ? processorMeta.verifiedOrgId.trim()
@@ -367,6 +369,9 @@ async function processClaimedA2ATask(taskId, claimed, config, signal, event) {
         const { runWithRequestContext } = await import("../server/request-context.js");
         await runWithRequestContext({
             userEmail: verifiedEmail,
+            ...(identityAssurance
+                ? { a2aIdentityAssurance: identityAssurance }
+                : {}),
             ...(resolvedOrgId
                 ? { orgId: resolvedOrgId }
                 : verifiedEmail
@@ -547,12 +552,19 @@ async function withA2ARequestContext(metadata, event, fn) {
     const { runWithRequestContext } = await import("../server/request-context.js");
     const verifiedEmail = event?.context?.__a2aVerifiedEmail ?? undefined;
     const verifiedOrgId = event?.context?.__a2aVerifiedOrgId ?? undefined;
+    const rawIdentityAssurance = event?.context?.__a2aIdentityAssurance;
+    const identityAssurance = rawIdentityAssurance === "user" ||
+        rawIdentityAssurance === "organization" ||
+        rawIdentityAssurance === "org-member"
+        ? rawIdentityAssurance
+        : undefined;
     const requestOrigin = requestOriginForContext(metadata, event);
     if (event?.context && verifiedEmail && !verifiedOrgId) {
         markExplicitPersonalOrgScope(event);
     }
     return runWithRequestContext({
         userEmail: verifiedEmail,
+        ...(identityAssurance ? { a2aIdentityAssurance: identityAssurance } : {}),
         ...(verifiedOrgId
             ? { orgId: verifiedOrgId }
             : verifiedEmail

package/dist/a2a/organization-identity.d.ts

@@ -1,4 +1,5 @@
 import type { JWTPayload } from "jose";
+export declare const A2A_ORG_MEMBER_DELEGATION_TYPE = "agent-native-org-member-delegation";
 export interface VerifiedA2AOrganizationIdentity {
     orgId: string;
     orgDomain: string | null;
@@ -6,10 +7,12 @@ export interface VerifiedA2AOrganizationIdentity {
 export interface A2AOrganizationCredential extends VerifiedA2AOrganizationIdentity {
     orgDomain: string;
     secret: string;
+    a2aMemberDelegationEnabled?: boolean;
 }
 /**
  * An organization secret authenticates an organization principal. Its JWT
- * subject is caller-controlled data and must never become a user identity.
+ * subject is caller-controlled data unless it is an opted-in, audience-bound
+ * member delegation verified against the receiver's current roster.
  */
 export declare function organizationPrincipalClaims(payload: JWTPayload, organization: A2AOrganizationCredential): JWTPayload | null;
 /**

package/dist/a2a/organization-identity.js

@@ -1,6 +1,8 @@
+export const A2A_ORG_MEMBER_DELEGATION_TYPE = "agent-native-org-member-delegation";
 /**
  * An organization secret authenticates an organization principal. Its JWT
- * subject is caller-controlled data and must never become a user identity.
+ * subject is caller-controlled data unless it is an opted-in, audience-bound
+ * member delegation verified against the receiver's current roster.
  */
 export function organizationPrincipalClaims(payload, organization) {
     const orgDomain = typeof payload.org_domain === "string"

package/dist/a2a/server.d.ts

@@ -2,16 +2,15 @@ import * as jose from "jose";
 import "../authorization/check-action.js";
 import type { A2AConfig, AgentSkill } from "./types.js";
 /**
- * Result of verifying an inbound A2A JWT. `email` is present only when a
- * deployment-secret user assertion verifies; org-secret tokens carry an
- * organization principal and never supply a user identity. `orgDomain` and
- * `orgId` are bound to local organization metadata when present.
+ * Result of verifying an inbound A2A JWT. `email` is present for deployment
+ * user assertions or an explicitly opted-in org-member delegation. `orgDomain`
+ * and `orgId` are bound to local organization metadata when present.
  */
 export interface A2ATokenPayload {
     email: string | null;
     orgDomain: string | null;
     orgId?: string;
-    identityAssurance?: "user" | "organization";
+    identityAssurance?: "user" | "organization" | "org-member";
     claims?: jose.JWTPayload;
 }
 export declare class A2AIdentityVerificationUnavailableError extends Error {
@@ -47,6 +46,8 @@ export declare function verifyA2AToken(token: string, event?: any, audienceOptio
     globalSecretOnly?: boolean;
     /** Only use this explicitly configured credential; never fall back. */
     verificationSecret?: string;
+    /** Dedicated verifier for the typed Anthropic continuation credential. */
+    allowAnthropicManagedContinuation?: boolean;
     requireAudience?: boolean;
 }): Promise<A2ATokenPayload>;
 export type A2ATokenFailureCause = "malformed" | "secret-missing" | "audience-unresolvable" | "audience" | "issuer" | "expired" | "signature" | "invalid-claims" | "mcp-credential" | "missing-subject" | "org-binding" | "org-lookup-failed" | "undetermined";

package/dist/a2a/server.js

@@ -19,7 +19,7 @@ import { addAgentProfileExamples } from "./app-profile.js";
 import { canonicalA2AAudience } from "./audience.js";
 import { hasConfiguredA2ASecret, isA2AProductionRuntime, } from "./auth-policy.js";
 import { handleJsonRpcH3, processA2ATaskFromQueue } from "./handlers.js";
-import { organizationPrincipalClaims, verifyA2AOrganizationIdentity, } from "./organization-identity.js";
+import { A2A_ORG_MEMBER_DELEGATION_TYPE, organizationPrincipalClaims, verifyA2AOrganizationIdentity, } from "./organization-identity.js";
 import { claimA2AApproval, a2aTaskLeaseThreadId, getA2AApprovalForOwner, settleA2AApproval, } from "./task-store.js";
 let _warnedUnauthA2A = false;
 function warnA2AUnauthOnce() {
@@ -59,7 +59,7 @@ export function isA2AIdentityVerificationUnavailableError(error) {
         (error instanceof Error &&
             error.name === "A2AIdentityVerificationUnavailableError"));
 }
-function identityPayload(payload, audienceOptions, verifiedOrganization) {
+function identityPayload(payload, audienceOptions, verifiedOrganization, identityAssurance) {
     const email = typeof payload.sub === "string" && payload.sub.trim()
         ? payload.sub.trim()
         : null;
@@ -79,9 +79,34 @@ function identityPayload(payload, audienceOptions, verifiedOrganization) {
         ...(!email && verifiedOrganization
             ? { identityAssurance: "organization" }
             : {}),
+        ...(identityAssurance ? { identityAssurance } : {}),
         ...(audienceOptions?.includeClaims ? { claims } : {}),
     };
 }
+function validOrgMemberDelegationClaims(payload) {
+    const email = typeof payload.sub === "string" ? payload.sub.trim() : "";
+    const jti = typeof payload.jti === "string" ? payload.jti.trim() : "";
+    const issuedAt = payload.iat;
+    const expiresAt = payload.exp;
+    const now = Math.floor(Date.now() / 1_000);
+    const audiences = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
+    return (payload.typ === A2A_ORG_MEMBER_DELEGATION_TYPE &&
+        email.length <= 320 &&
+        email.includes("@") &&
+        !/[\u0000-\u001f\u007f]/.test(email) &&
+        jti.length > 0 &&
+        jti.length <= 128 &&
+        !/[\u0000-\u001f\u007f]/.test(jti) &&
+        typeof issuedAt === "number" &&
+        Number.isSafeInteger(issuedAt) &&
+        typeof expiresAt === "number" &&
+        Number.isSafeInteger(expiresAt) &&
+        issuedAt <= now + 60 &&
+        expiresAt > now &&
+        expiresAt > issuedAt &&
+        expiresAt - issuedAt <= 15 * 60 &&
+        audiences.some((audience) => typeof audience === "string" && audience.trim()));
+}
 async function verifyJwtWithSecret(token, secret, options) {
     try {
         const { payload } = await jose.jwtVerify(token, new TextEncoder().encode(secret), options);
@@ -327,6 +352,17 @@ async function verifyA2ATokenInternal(token, event, audienceOptions) {
     if (globalSecret) {
         const payload = await verifyJwtWithSecret(token, globalSecret, verifyOptions);
         if (payload) {
+            // Typed credentials have their own verifier. Only the managed-agent
+            // confirmation verifier may accept its continuation token here.
+            if (typeof payload.typ !== "undefined") {
+                const managedContinuation = payload.typ === "anthropic-managed-continuation" &&
+                    audienceOptions?.globalSecretOnly === true &&
+                    audienceOptions.allowAnthropicManagedContinuation === true &&
+                    audienceOptions.includeClaims === true;
+                if (!managedContinuation) {
+                    return { payload: { email: null, orgDomain: null } };
+                }
+            }
             if (typeof payload.org_domain === "string" && payload.org_domain.trim()) {
                 let organization;
                 try {
@@ -388,12 +424,49 @@ async function verifyA2ATokenInternal(token, event, audienceOptions) {
     }
     if (!organization)
         return { payload: { email: null, orgDomain: null } };
-    const payload = await verifyJwtWithSecret(token, organization.secret, verifyOptions);
+    const orgVerifyOptions = unverifiedPayload?.typ === A2A_ORG_MEMBER_DELEGATION_TYPE
+        ? { ...verifyOptions, algorithms: ["HS256"] }
+        : verifyOptions;
+    const payload = await verifyJwtWithSecret(token, organization.secret, orgVerifyOptions);
     if (!payload)
         return { payload: { email: null, orgDomain: null } };
     const claims = organizationPrincipalClaims(payload, organization);
     if (!claims)
         return { payload: { email: null, orgDomain: null } };
+    if (payload.typ === A2A_ORG_MEMBER_DELEGATION_TYPE) {
+        if (!validOrgMemberDelegationClaims(payload)) {
+            return { payload: { email: null, orgDomain: null } };
+        }
+        if (organization.secret.trim() === globalSecret) {
+            return { payload: { email: null, orgDomain: null } };
+        }
+        let isCurrentMember = false;
+        if (organization.a2aMemberDelegationEnabled) {
+            try {
+                const { isOrgMemberForA2A } = await import("../org/membership.js");
+                isCurrentMember = await isOrgMemberForA2A(organization.orgId, String(payload.sub).trim(), event);
+            }
+            catch (cause) {
+                throw new A2AIdentityVerificationUnavailableError(cause);
+            }
+        }
+        if (isCurrentMember) {
+            return {
+                payload: identityPayload(payload, audienceOptions, organization, "org-member"),
+                verifiedOrgId: organization.orgId,
+            };
+        }
+        return {
+            payload: {
+                email: null,
+                orgDomain: organization.orgDomain,
+                orgId: organization.orgId,
+                identityAssurance: "organization",
+                ...(audienceOptions?.includeClaims ? { claims } : {}),
+            },
+            verifiedOrgId: organization.orgId,
+        };
+    }
     warnUserAssertionDemotedOnce(organization.orgId, payload, "user token verified only with org secret");
     return {
         payload: {
@@ -742,9 +815,9 @@ export function mountA2A(nitroApp, config, routePrefix = "/_agent-native") {
             }
             verifiedCallerEmail = tokenPayload.email;
             verifiedOrgDomain = tokenPayload.orgDomain;
-            verifiedIdentityAssurance = tokenPayload.email
-                ? "user"
-                : tokenPayload.identityAssurance;
+            verifiedIdentityAssurance =
+                tokenPayload.identityAssurance ??
+                    (tokenPayload.email ? "user" : undefined);
             bearerTokenVerified = verifiedIdentityAssurance !== undefined;
             verifiedAudienceBound =
                 bearerTokenVerified && tokenHasAudienceClaim(bearerToken);

package/dist/a2a-claims.d.ts

@@ -3,6 +3,7 @@ export interface VerifiedA2AClaims {
     orgId: string;
     orgDomain: string;
     jti: string;
+    identityAssurance?: "user" | "org-member";
     issuer?: string;
     scope: string[];
 }

package/dist/a2a-claims.js

@@ -36,6 +36,7 @@ export async function verifyA2ATokenWithClaims(token, event) {
                 orgId,
                 orgDomain,
                 jti,
+                identityAssurance: identity.identityAssurance === "org-member" ? "org-member" : "user",
                 ...(issuer ? { issuer } : {}),
                 scope: scopes,
             }

package/dist/agent/actions/manage-provider-key-policy.js

@@ -92,7 +92,7 @@ export default defineAction({
             return {
                 ...policy,
                 canManage,
-                affectedMembers: await listPersonalProviderKeyHolders(orgId),
+                affectedMembers: await listPersonalProviderKeyHolders(orgId, email),
                 changed,
             };
         }
@@ -101,7 +101,9 @@ export default defineAction({
             ...policy,
             canManage,
             ...(canManage
-                ? { affectedMembers: await listPersonalProviderKeyHolders(orgId) }
+                ? {
+                    affectedMembers: await listPersonalProviderKeyHolders(orgId, email),
+                }
                 : {}),
         };
     },

package/dist/agent/app-model-defaults.js

@@ -1,4 +1,4 @@
-import { getDbExec } from "../db/client.js";
+import { readOrgMemberRole } from "../server/personal-provider-key-policy.js";
 import { getRequestContext, getRequestOrgId, getRequestUserEmail, } from "../server/request-context.js";
 import { deleteOrgSetting, deleteUserSetting, getOrgSetting, getUserSetting, putOrgSetting, putUserSetting, } from "../settings/index.js";
 export const AGENT_APP_MODEL_DEFAULT_KEY_PREFIX = "agent-app-model-default";
@@ -116,15 +116,7 @@ export async function canUpdateAgentAppModelDefaultSettings(userEmail, orgId, or
     if (!orgId)
         return orgScope === "personal";
     try {
-        const exec = getDbExec();
-        const { rows } = await exec.execute({
-            sql: `SELECT role FROM org_members
-            WHERE org_id = ? AND LOWER(email) = ?
-              AND federation_removal_pending_at IS NULL
-            LIMIT 1`,
-            args: [orgId, userEmail.toLowerCase()],
-        });
-        const role = String(rows[0]?.role ?? "");
+        const role = await readOrgMemberRole(orgId, userEmail);
         return role === "owner" || role === "admin";
     }
     catch {

package/dist/agent/loop-settings.js

@@ -1,4 +1,4 @@
-import { getDbExec } from "../db/client.js";
+import { readOrgMemberRole } from "../server/personal-provider-key-policy.js";
 import { getOrgSetting, putOrgSetting, deleteOrgSetting, getUserSetting, putUserSetting, deleteUserSetting, } from "../settings/index.js";
 export const AGENT_LOOP_SETTINGS_KEY = "agent-loop";
 export const DEFAULT_AGENT_MAX_ITERATIONS = 400;
@@ -169,15 +169,7 @@ export async function canUpdateAgentLoopSettings(userEmail, orgId) {
     if (!orgId)
         return true;
     try {
-        const exec = getDbExec();
-        const { rows } = await exec.execute({
-            sql: `SELECT role FROM org_members
-            WHERE org_id = ? AND LOWER(email) = ?
-              AND federation_removal_pending_at IS NULL
-            LIMIT 1`,
-            args: [orgId, userEmail.toLowerCase()],
-        });
-        const role = String(rows[0]?.role ?? "");
+        const role = await readOrgMemberRole(orgId, userEmail);
         return role === "owner" || role === "admin";
     }
     catch {

package/dist/appearance/actions/get-theme-family.d.ts

@@ -0,0 +1,8 @@
+import { type ThemeFamily } from "../theme-family.js";
+export interface ThemeFamilyPreference {
+    family: ThemeFamily;
+    source: "default" | "user-setting";
+    appId: string | null;
+}
+declare const _default: import("../../action.js").ActionDefinition<Record<string, never>, ThemeFamilyPreference>;
+export default _default;

package/dist/appearance/actions/get-theme-family.js

@@ -0,0 +1,38 @@
+import { z } from "zod";
+import { defineAction, fail } from "../../action.js";
+import { getUserSetting } from "../../settings/user-settings.js";
+import { DEFAULT_THEME_FAMILY, THEME_FAMILIES, themeFamilySettingKey, } from "../theme-family.js";
+export default defineAction({
+    description: "Read the current app's saved theme family, which is independent of light or dark color mode.",
+    schema: z.object({}),
+    http: { method: "GET" },
+    readOnly: true,
+    agentTool: false,
+    run: async (_args, ctx) => {
+        const email = ctx?.userEmail;
+        if (!email)
+            fail("Not authenticated.", { statusCode: 401 });
+        const stored = await getUserSetting(email, themeFamilySettingKey(ctx?.appId));
+        if (stored === null) {
+            return {
+                family: DEFAULT_THEME_FAMILY,
+                source: "default",
+                appId: ctx?.appId ?? null,
+            };
+        }
+        const parsed = z
+            .object({ family: z.enum(THEME_FAMILIES) })
+            .safeParse(stored);
+        if (!parsed.success) {
+            fail("The saved theme family setting is invalid and could not be read.", {
+                errorCode: "theme_family_setting_invalid",
+                statusCode: 500,
+            });
+        }
+        return {
+            family: parsed.data.family,
+            source: "user-setting",
+            appId: ctx?.appId ?? null,
+        };
+    },
+});

package/dist/appearance/actions/set-theme-family.d.ts

@@ -0,0 +1,7 @@
+declare const _default: import("../../action.js").ActionDefinition<{
+    family: "agent-native" | "original";
+}, {
+    family: "agent-native" | "original";
+    appId: string;
+}>;
+export default _default;

package/dist/appearance/actions/set-theme-family.js

@@ -0,0 +1,33 @@
+import { z } from "zod";
+import { defineAction, fail } from "../../action.js";
+import { writeAppState } from "../../application-state/script-helpers.js";
+import { putUserSetting } from "../../settings/user-settings.js";
+import { THEME_FAMILIES, themeFamilyAppStateKey, themeFamilySettingKey, } from "../theme-family.js";
+export default defineAction({
+    description: "Set the current app's theme family to agent-native or original. This is separate from light or dark color mode.",
+    schema: z.object({
+        family: z
+            .enum(THEME_FAMILIES)
+            .describe("Theme family: agent-native or original."),
+    }),
+    http: { method: "POST" },
+    mcpAnnotations: {
+        readOnlyHint: false,
+        destructiveHint: false,
+        openWorldHint: false,
+    },
+    run: async ({ family }, ctx) => {
+        const email = ctx?.userEmail;
+        if (!email)
+            fail("Not authenticated.", { statusCode: 401 });
+        const settingKey = themeFamilySettingKey(ctx?.appId);
+        await putUserSetting(email, settingKey, { family });
+        try {
+            await writeAppState(themeFamilyAppStateKey(ctx?.appId), { family });
+        }
+        catch {
+            fail("The theme family was saved, but the open app could not be synchronized.", { errorCode: "theme_family_sync_failed", statusCode: 503 });
+        }
+        return { family, appId: ctx?.appId ?? null };
+    },
+});

package/dist/appearance/theme-family.d.ts

@@ -0,0 +1,13 @@
+export declare const THEME_FAMILIES: readonly ["agent-native", "original"];
+export type ThemeFamily = (typeof THEME_FAMILIES)[number];
+export declare const DEFAULT_THEME_FAMILY: ThemeFamily;
+export declare const THEME_FAMILY_STORAGE_KEY = "theme-family";
+export declare const THEME_FAMILY_ATTRIBUTE = "data-theme-family";
+export declare const THEME_FAMILY_STATUS_ATTRIBUTE = "data-theme-family-status";
+export declare const THEME_FAMILY_APP_STATE_KEY = "theme-family";
+export declare const THEME_FAMILY_SETTING_PREFIX = "theme-family";
+export declare function isThemeFamily(value: unknown): value is ThemeFamily;
+export declare function themeFamilySettingKey(appId?: string): string;
+export declare function themeFamilyStorageKey(appId?: string): string;
+export declare function themeFamilyAppStateKey(appId?: string): string;
+export declare function getThemeFamilyInitScript(appId?: string | null): string;

package/dist/appearance/theme-family.js

@@ -0,0 +1,38 @@
+export const THEME_FAMILIES = ["agent-native", "original"];
+export const DEFAULT_THEME_FAMILY = "original";
+export const THEME_FAMILY_STORAGE_KEY = "theme-family";
+export const THEME_FAMILY_ATTRIBUTE = "data-theme-family";
+export const THEME_FAMILY_STATUS_ATTRIBUTE = "data-theme-family-status";
+export const THEME_FAMILY_APP_STATE_KEY = "theme-family";
+export const THEME_FAMILY_SETTING_PREFIX = "theme-family";
+export function isThemeFamily(value) {
+    return value === "agent-native" || value === "original";
+}
+export function themeFamilySettingKey(appId) {
+    // Older or standalone action contexts can genuinely omit appId. Keep their
+    // setting isolated under one stable fallback rather than borrowing another app's choice.
+    if (appId === undefined)
+        return `${THEME_FAMILY_SETTING_PREFIX}:__no_app_id__`;
+    const normalizedAppId = appId.trim().toLowerCase();
+    if (!normalizedAppId) {
+        throw new TypeError("Theme family settings require a non-empty appId.");
+    }
+    return `${THEME_FAMILY_SETTING_PREFIX}:${encodeURIComponent(normalizedAppId)}`;
+}
+export function themeFamilyStorageKey(appId) {
+    return themeFamilySettingKey(appId);
+}
+export function themeFamilyAppStateKey(appId) {
+    if (appId === undefined)
+        return `${THEME_FAMILY_APP_STATE_KEY}:__no_app_id__`;
+    const normalizedAppId = appId.trim().toLowerCase();
+    if (!normalizedAppId) {
+        throw new TypeError("Theme family application state requires a non-empty appId.");
+    }
+    const encodedAppId = Array.from(normalizedAppId, (character) => character.codePointAt(0).toString(16)).join("_");
+    return `${THEME_FAMILY_APP_STATE_KEY}:${encodedAppId}`;
+}
+export function getThemeFamilyInitScript(appId) {
+    const storageKey = themeFamilyStorageKey(appId ?? undefined);
+    return `(function(){var root=document.documentElement;var fallback=${JSON.stringify(DEFAULT_THEME_FAMILY)};try{var value=window.localStorage.getItem(${JSON.stringify(storageKey)});if(value===null){root.setAttribute(${JSON.stringify(THEME_FAMILY_ATTRIBUTE)},fallback);root.setAttribute(${JSON.stringify(THEME_FAMILY_STATUS_ATTRIBUTE)},'awaiting-app-setting');return}if(value==='agent-native'||value==='original'){root.setAttribute(${JSON.stringify(THEME_FAMILY_ATTRIBUTE)},value);root.removeAttribute(${JSON.stringify(THEME_FAMILY_STATUS_ATTRIBUTE)});return}root.setAttribute(${JSON.stringify(THEME_FAMILY_ATTRIBUTE)},fallback);root.setAttribute(${JSON.stringify(THEME_FAMILY_STATUS_ATTRIBUTE)},'invalid')}catch(e){root.setAttribute(${JSON.stringify(THEME_FAMILY_ATTRIBUTE)},fallback);root.setAttribute(${JSON.stringify(THEME_FAMILY_STATUS_ATTRIBUTE)},'unreadable')}})();`;
+}

package/dist/audit/actions/export-audit-events.js

@@ -26,6 +26,7 @@ const CSV_COLUMNS = [
     ["reportedClientVersion", "reported_client_version"],
     ["oauthClientId", "oauth_client_id"],
     ["approval", "approval"],
+    ["identityAssurance", "identity_assurance"],
 ];
 function csvField(value) {
     if (value === null || value === undefined)

package/dist/audit/attribution.d.ts

@@ -1,4 +1,4 @@
-import type { AuditApproval } from "./types.js";
+import type { AuditApproval, AuditIdentityAssurance } from "./types.js";
 declare const auditAttributionBrand: unique symbol;
 interface AuditAttributionFields {
     caller: string;
@@ -16,11 +16,12 @@ interface AuditAttributionFields {
     };
     mcpClientAccepted?: true;
     approval?: AuditApproval;
+    identityAssurance?: AuditIdentityAssurance;
 }
 /**
  * Where an audited call came from and what vouched for it: its source, the
- * MCP client it reported, the OAuth client of its credential, the approval
- * signal, and its run and network ids. `recordActionAudit` requires one and
+ * MCP client it reported, the OAuth client of its credential, verified A2A
+ * identity assurance, the approval signal, and its run and network ids. `recordActionAudit` requires one and
  * only {@link auditAttribution} makes one, so a recorder cannot build its own
  * context and store nulls for a field it forgot.
  */
@@ -38,7 +39,7 @@ export type AuditOverride = Partial<Pick<AuditAttributionFields, "threadId" | "t
  * The run context attribution reads from; an `ActionRunContext` is one.
  * Approval is not read from it: a context can be handed to another action.
  */
-export type AuditAttributionSource = Partial<Omit<AuditAttributionFields, "approval" | "approvedToolCallKey" | "mcpClientAccepted">>;
+export type AuditAttributionSource = Partial<Omit<AuditAttributionFields, "approval" | "approvedToolCallKey" | "mcpClientAccepted" | "identityAssurance">>;
 /** A recorder was given no attribution, or one `auditAttribution` did not make. */
 export declare class AuditAttributionError extends Error {
     constructor(recorder: string);

package/dist/audit/attribution.js

@@ -1,5 +1,5 @@
 import { currentInvocationEvidence } from "../action-frame.js";
-import { getVerifiedMcpCredentialFromEvent } from "../server/request-context.js";
+import { getRequestContext, getVerifiedMcpCredentialFromEvent, } from "../server/request-context.js";
 // Registered, so an attribution made by another loaded copy of this module
 // still passes the check.
 const auditAttributionBrand = Symbol.for("@agent-native/core/audit-attribution");
@@ -40,6 +40,7 @@ export function auditAttribution(ctx) {
         mcpClient: ctx?.mcpClient,
         mcpClientAccepted: evidence?.mcpClientAccepted,
         approval: override?.approval,
+        identityAssurance: getRequestContext()?.a2aIdentityAssurance,
     };
     return { ...fields, [auditAttributionBrand]: true };
 }

package/dist/audit/index.d.ts

@@ -1,4 +1,4 @@
-export type { ActionAuditConfig, AuditActorKind, AuditApproval, AuditCallMeta, AuditEvent, AuditQueryFilters, AuditStatus, AuditTarget, AuditVisibility, } from "./types.js";
+export type { ActionAuditConfig, AuditActorKind, AuditApproval, AuditCallMeta, AuditEvent, AuditIdentityAssurance, AuditQueryFilters, AuditStatus, AuditTarget, AuditVisibility, } from "./types.js";
 export { AGENT_AUDIT_CALLERS, deriveActorKind, isAuditDisabled, normalizeAuditConfig, resolveAuditAttach, shouldRecordAudit, } from "./config.js";
 export { redactArgsToJson } from "./redact.js";
 export { ensureAuditTables, insertAuditEvent, queryAuditEvents, queryAuditEventPage, queryAuditApps, getAuditEventById, deleteOldAuditEvents, type AuditEventPage, type AuditReadScope, type AuditTrail, } from "./store.js";