@agent-native/core 0.212.1 → 0.214.0

package/dist/db/schema-snapshot.generated.js

@@ -16,7 +16,7 @@ export const SCHEMA_SNAPSHOT = {
         'CREATE TABLE "a2a_approvals" (\n  "id" text NOT NULL,\n  "task_id" text NOT NULL,\n  "owner_email" text NOT NULL,\n  "org_id" text,\n  "tool_name" text NOT NULL,\n  "tool_input" text NOT NULL,\n  "approval_key" text NOT NULL,\n  "call_id" text NOT NULL,\n  "status" text DEFAULT \'pending\'::text NOT NULL,\n  "result" text,\n  "expires_at" bigint NOT NULL,\n  "created_at" bigint NOT NULL,\n  "updated_at" bigint NOT NULL\n);',
         'CREATE TABLE "a2a_tasks" (\n  "id" text NOT NULL,\n  "context_id" text,\n  "status_state" text DEFAULT \'submitted\'::text NOT NULL,\n  "status_message" text,\n  "status_timestamp" text NOT NULL,\n  "history" text DEFAULT \'[]\'::text NOT NULL,\n  "artifacts" text DEFAULT \'[]\'::text NOT NULL,\n  "metadata" text,\n  "owner_email" text,\n  "owner_scope" text DEFAULT \'\'::text NOT NULL,\n  "idempotency_key" text,\n  "created_at" bigint NOT NULL,\n  "updated_at" bigint NOT NULL\n);',
         'CREATE TABLE "account" (\n  "id" text NOT NULL,\n  "account_id" text NOT NULL,\n  "provider_id" text NOT NULL,\n  "user_id" text NOT NULL,\n  "access_token" text,\n  "refresh_token" text,\n  "id_token" text,\n  "access_token_expires_at" timestamp with time zone,\n  "refresh_token_expires_at" timestamp with time zone,\n  "scope" text,\n  "password" text,\n  "created_at" timestamp with time zone NOT NULL,\n  "updated_at" timestamp with time zone NOT NULL\n);',
-        'CREATE TABLE "agent_audit_log" (\n  "id" text NOT NULL,\n  "created_at" bigint NOT NULL,\n  "action" text NOT NULL,\n  "caller" text NOT NULL,\n  "actor_kind" text NOT NULL,\n  "actor_email" text,\n  "org_id" text,\n  "thread_id" text,\n  "turn_id" text,\n  "target_type" text,\n  "target_id" text,\n  "status" text DEFAULT \'success\'::text NOT NULL,\n  "summary" text,\n  "input" text,\n  "error_code" text,\n  "owner_email" text,\n  "visibility" text DEFAULT \'private\'::text NOT NULL,\n  "run_id" text,\n  "task_id" text,\n  "parent_task_id" text,\n  "source_kind" text,\n  "source_platform" text,\n  "source_id" text,\n  "source_url" text,\n  "network_protocol" text,\n  "network_id" text,\n  "network_peer" text,\n  "app" text,\n  "reported_client_name" text,\n  "reported_client_version" text,\n  "oauth_client_id" text,\n  "approval" text\n);',
+        'CREATE TABLE "agent_audit_log" (\n  "id" text NOT NULL,\n  "created_at" bigint NOT NULL,\n  "action" text NOT NULL,\n  "caller" text NOT NULL,\n  "actor_kind" text NOT NULL,\n  "actor_email" text,\n  "org_id" text,\n  "thread_id" text,\n  "turn_id" text,\n  "target_type" text,\n  "target_id" text,\n  "status" text DEFAULT \'success\'::text NOT NULL,\n  "summary" text,\n  "input" text,\n  "error_code" text,\n  "owner_email" text,\n  "visibility" text DEFAULT \'private\'::text NOT NULL,\n  "run_id" text,\n  "task_id" text,\n  "parent_task_id" text,\n  "source_kind" text,\n  "source_platform" text,\n  "source_id" text,\n  "source_url" text,\n  "network_protocol" text,\n  "network_id" text,\n  "network_peer" text,\n  "app" text,\n  "reported_client_name" text,\n  "reported_client_version" text,\n  "oauth_client_id" text,\n  "approval" text,\n  "identity_assurance" text\n);',
         'CREATE TABLE "agent_chat_submission_inbox" (\n  "thread_id" text NOT NULL,\n  "message_id" text NOT NULL,\n  "state" text NOT NULL,\n  "actor_email" text NOT NULL,\n  "actor_auth_user_id" text,\n  "actor_identity_authenticated_at_ms" bigint,\n  "actor_name" text,\n  "actor_org_id" text,\n  "actor_org_scope" text,\n  "actor_anonymous" boolean DEFAULT false NOT NULL,\n  "payload_hash" text NOT NULL,\n  "payload_json" text NOT NULL,\n  "interrupt_active_run" boolean DEFAULT false NOT NULL,\n  "submitted_run_id" text,\n  "queue_order" bigint DEFAULT nextval(\'agent_chat_submission_inbox_queue_order_seq\'::regclass) NOT NULL,\n  "move_to_top_at" bigint,\n  "retry_after" bigint,\n  "created_at" bigint NOT NULL,\n  "updated_at" bigint NOT NULL,\n  "interrupt_run_id" text\n);',
         'CREATE TABLE "agent_checkpoints" (\n  "id" text NOT NULL,\n  "thread_id" text NOT NULL,\n  "run_id" text,\n  "commit_sha" text NOT NULL,\n  "message" text DEFAULT \'\'::text NOT NULL,\n  "created_at" bigint NOT NULL\n);',
         'CREATE TABLE "agent_eval_datasets" (\n  "id" text NOT NULL,\n  "name" text NOT NULL,\n  "description" text DEFAULT \'\'::text NOT NULL,\n  "entries" text DEFAULT \'[]\'::text NOT NULL,\n  "created_at" bigint NOT NULL,\n  "updated_at" bigint NOT NULL,\n  "user_id" text,\n  "idempotency_key" text\n);',
@@ -121,7 +121,7 @@ export const SCHEMA_SNAPSHOT = {
         'CREATE TABLE "org_members" (\n  "id" text NOT NULL,\n  "org_id" text NOT NULL,\n  "email" text NOT NULL,\n  "role" text NOT NULL,\n  "joined_at" bigint NOT NULL,\n  "federation_removal_pending_at" bigint\n);',
         'CREATE TABLE "org_scim_memberships" (\n  "id" text NOT NULL,\n  "org_id" text NOT NULL,\n  "user_id" text NOT NULL,\n  "created_membership" boolean DEFAULT false NOT NULL,\n  "created_at" bigint NOT NULL,\n  "member_id" text\n);',
         'CREATE TABLE "organization" (\n  "id" text NOT NULL,\n  "name" text NOT NULL,\n  "slug" text NOT NULL,\n  "logo" text,\n  "metadata" text,\n  "created_at" timestamp with time zone NOT NULL,\n  "updated_at" timestamp with time zone NOT NULL\n);',
-        'CREATE TABLE "organizations" (\n  "id" text NOT NULL,\n  "name" text NOT NULL,\n  "created_by" text NOT NULL,\n  "created_at" bigint NOT NULL,\n  "allowed_domain" text,\n  "a2a_secret" text,\n  "workspace_url" text,\n  "required_auth_provider" text,\n  "identity_authority" text,\n  "identity_id" text,\n  "federation_roster_initialized_at" bigint,\n  "icon_json" text,\n  "icon_revision" bigint DEFAULT 0 NOT NULL\n);',
+        'CREATE TABLE "organizations" (\n  "id" text NOT NULL,\n  "name" text NOT NULL,\n  "created_by" text NOT NULL,\n  "created_at" bigint NOT NULL,\n  "allowed_domain" text,\n  "a2a_secret" text,\n  "workspace_url" text,\n  "required_auth_provider" text,\n  "identity_authority" text,\n  "identity_id" text,\n  "federation_roster_initialized_at" bigint,\n  "icon_json" text,\n  "icon_revision" bigint DEFAULT 0 NOT NULL,\n  "a2a_member_delegation_enabled" boolean DEFAULT false NOT NULL\n);',
         'CREATE TABLE "private_icon_assets" (\n  "id" text NOT NULL,\n  "owner_email" text NOT NULL,\n  "org_id" text,\n  "mime_type" text NOT NULL,\n  "filename" text,\n  "alt" text,\n  "size" bigint NOT NULL,\n  "sha256" text NOT NULL,\n  "blob_handle_json" text NOT NULL,\n  "created_at" bigint NOT NULL,\n  "updated_at" bigint NOT NULL\n);',
         'CREATE TABLE "progress_runs" (\n  "id" text NOT NULL,\n  "owner" text NOT NULL,\n  "title" text NOT NULL,\n  "step" text,\n  "percent" bigint,\n  "status" text DEFAULT \'running\'::text NOT NULL,\n  "metadata" text,\n  "started_at" bigint NOT NULL,\n  "updated_at" bigint NOT NULL,\n  "completed_at" bigint\n);',
         'CREATE TABLE "provider_api_cooldowns" (\n  "quota_key" text NOT NULL,\n  "provider_id" text NOT NULL,\n  "scope_key" text NOT NULL,\n  "cooldown_until" bigint NOT NULL,\n  "status" bigint,\n  "reason" text,\n  "updated_at" bigint NOT NULL\n);',
@@ -866,6 +866,7 @@ export const SCHEMA_SNAPSHOT = {
         ["application_state", "baseline", null],
         ["application_state", "indexes", null],
         ["application_state", "widen-bigint", null],
+        ["audit", "a2a-identity-assurance", "5ebfefc25224eaa5"],
         ["audit", "baseline", null],
         ["audit", "mcp-client-attribution", "bc0ea72722e10241"],
         ["auth_sessions", "baseline", null],
@@ -1038,6 +1039,7 @@ export const SCHEMA_SNAPSHOT = {
         ["org", "org-scim-membership-member-id", "cd1c4fb7479507d3"],
         ["org", "org-scim-membership-ownership", "09ca1c03026cda83"],
         ["org", "org-tables-timestamps-bigint", "a71b72b885bd5585"],
+        ["org", "organization-a2a-member-delegation", "3d01bcd4e7c259b0"],
         ["org", "organization-federation-removal-pending", "47fe40eb2ea33753"],
         ["org", "organization-federation-roster-initialized", "3307d4d99818c2f0"],
         ["org", "organization-identity-federation", "e24bac924c2d4c7a"],
@@ -1182,5 +1184,6 @@ export const SCHEMA_SNAPSHOT = {
         ["_org_migrations", 1032, "agent-audit-log-base-table"],
         ["_org_migrations", 1033, "organization-visual-identity"],
         ["_org_migrations", 1034, "private-icon-assets"],
+        ["_org_migrations", 1035, "organization-a2a-member-delegation"],
     ],
 };

package/dist/feature-flags/a2a-action-route.js

@@ -46,6 +46,7 @@ export function createFeatureFlagA2AActionRouteAuth(actionName) {
                 owner: claims.email,
                 orgId,
                 anonymous: false,
+                identityAssurance: claims.identityAssurance,
                 delegationJti: claims.jti,
                 delegationIssuer: claims.issuer,
             };

package/dist/file-upload/actions/upload-image.d.ts

@@ -42,8 +42,8 @@ declare const _default: import("../../action.js").ActionDefinition<{
     url: string;
     id: string;
     provider: string;
-    configured?: undefined;
     error?: undefined;
+    configured?: undefined;
 } | {
     url?: undefined;
     id?: undefined;

package/dist/file-upload/storage-settings.js

@@ -8,8 +8,8 @@
  * keep uploading to the old bucket.
  */
 import { fail } from "../action.js";
-import { getDbExec } from "../db/client.js";
 import { deleteAppSecret, readAppSecrets, writeAppSecret, } from "../secrets/storage.js";
+import { readOrgMemberRole } from "../server/personal-provider-key-policy.js";
 import { getActiveFileUploadProviderForRequest, listFileUploadProviders, } from "./registry.js";
 import { getPrivateStorageReadinessForUser, } from "./storage-readiness.js";
 export const FILE_STORAGE_SECRET_KEYS = {
@@ -46,14 +46,7 @@ export async function resolveFileStorageAccess(ctx) {
     // matching `canMutateWorkspaceScope` in the secrets routes.
     if (!orgId)
         return { scopeId: `solo:${email}`, canManage: true };
-    const { rows } = await getDbExec().execute({
-        sql: `SELECT role FROM org_members
-          WHERE org_id = ? AND LOWER(email) = LOWER(?)
-            AND federation_removal_pending_at IS NULL
-          LIMIT 1`,
-        args: [orgId, email],
-    });
-    const role = rows[0]?.role;
+    const role = await readOrgMemberRole(orgId, email);
     return { scopeId: orgId, canManage: role === "owner" || role === "admin" };
 }
 export function inferFileStorageProvider(endpoint) {

package/dist/framework-tools.js

@@ -165,6 +165,8 @@ export const CORE_ACTION_GROUPS = {
     "change-password": "userProfile",
     "request-privacy-right": "userProfile",
     "change-appearance": "userProfile",
+    "get-theme-family": "userProfile",
+    "set-theme-family": "userProfile",
     "list-audit-events": "audit",
     "get-audit-event": "audit",
     "export-audit-events": "audit",

package/dist/jobs/actions/manage-recurring-job.d.ts

@@ -13,10 +13,10 @@ declare const _default: import("../../action.js").ActionDefinition<{
     enabled?: undefined;
     nextRun?: undefined;
 } | {
+    deleted?: undefined;
     resourceId: string;
     name: string;
     enabled: boolean;
     nextRun: string;
-    deleted?: undefined;
 }>;
 export default _default;

package/dist/jobs/tools.js

@@ -1,8 +1,8 @@
 import { resolveAutomationAccess } from "../automations/access.js";
 import { DEFAULT_AUTOMATION_SCHEDULE } from "../automations/service.js";
-import { getDbExec } from "../db/client.js";
 import { resolveUserSchedulingTimezone } from "../localization/user-timezone.js";
 import { organizationIdFromResourceOwner, resourcePutIfAbsent, resourceGetByPath, resourceList, resourceDelete, SHARED_OWNER, sharedResourceOwner, } from "../resources/store.js";
+import { readOrgMemberRole } from "../server/personal-provider-key-policy.js";
 import { getRequestUserEmail, getRequestOrgId, getIntegrationRequestContext, } from "../server/request-context.js";
 import { isReasoningEffort, REASONING_EFFORTS, } from "../shared/reasoning-effort.js";
 import { RESUME_AUTOMATION_PATCH } from "./automation-outcome.js";
@@ -27,17 +27,7 @@ async function isCurrentUserOrgAdmin(orgId) {
     if (!email)
         return false;
     try {
-        const client = getDbExec();
-        const { rows } = await client.execute({
-            sql: `SELECT role FROM org_members
-            WHERE org_id = ? AND LOWER(email) = ?
-              AND federation_removal_pending_at IS NULL
-            LIMIT 1`,
-            args: [orgId, email.toLowerCase()],
-        });
-        if (rows.length === 0)
-            return false;
-        const role = String(rows[0].role ?? "").toLowerCase();
+        const role = await readOrgMemberRole(orgId, email);
         return role === "owner" || role === "admin";
     }
     catch {

package/dist/mcp/actions/service-token-access.js

@@ -14,6 +14,8 @@
 import { getDbExec } from "../../db/client.js";
 import { isMissingOrganizationTableError } from "../../org/membership.js";
 import { CREDENTIAL_MEMBERSHIP_UNAVAILABLE_MESSAGE } from "../../server/credential-membership-unavailable.js";
+import { readOrgMemberRole } from "../../server/personal-provider-key-policy.js";
+import { getRequestContext } from "../../server/request-context.js";
 export const SERVICE_TOKEN_MANAGE_FORBIDDEN_MESSAGE = "Only org owners or admins can create or revoke service tokens.";
 export class ServiceTokenError extends Error {
     statusCode;
@@ -24,17 +26,7 @@ export class ServiceTokenError extends Error {
     }
 }
 async function readOrgRole(orgId, email) {
-    const { rows } = await getDbExec().execute({
-        sql: `SELECT role FROM org_members
-          WHERE org_id = ? AND LOWER(email) = ?
-            AND federation_removal_pending_at IS NULL
-          LIMIT 1`,
-        args: [orgId, email.toLowerCase()],
-    });
-    const role = rows[0]?.role;
-    return role === "owner" || role === "admin" || role === "member"
-        ? role
-        : null;
+    return readOrgMemberRole(orgId, email);
 }
 export async function getOrgRoleForEmail(orgId, email) {
     try {
@@ -76,6 +68,18 @@ export async function requireServiceTokenCaller(params) {
         throw new ServiceTokenError("Sign in to manage org service tokens.", 401);
     }
     let orgId = params.orgId?.trim() || "";
+    const requestContext = getRequestContext();
+    if (requestContext?.a2aIdentityAssurance === "org-member") {
+        const delegatedEmail = requestContext.userEmail?.trim().toLowerCase();
+        const delegatedOrgId = requestContext.orgId?.trim();
+        if (!delegatedEmail ||
+            delegatedEmail !== email.toLowerCase() ||
+            !delegatedOrgId ||
+            (orgId && orgId !== delegatedOrgId)) {
+            throw new ServiceTokenError("You are not a member of this organization.", 403);
+        }
+        orgId = delegatedOrgId;
+    }
     if (!orgId) {
         const memberOrgs = await lookupMembership(() => readOrgIds(email), []);
         if (memberOrgs.length === 0) {

package/dist/mcp/credential-issuance.js

@@ -1,5 +1,7 @@
 import { getDbExec } from "../db/client.js";
 import { identityCredentialLockKey, readEmailRetiredAt, } from "../identity/retired-emails.js";
+import { effectiveOrgMemberRole } from "../server/personal-provider-key-policy.js";
+import { getRequestContext } from "../server/request-context.js";
 import { checkCredentialOrgMembership } from "./credential-membership.js";
 export class McpCredentialIssuanceError extends Error {
     reason;
@@ -19,6 +21,11 @@ export async function withMcpCredentialIssuance(input, run) {
     const email = input.email.trim().toLowerCase();
     const human = input.kind !== "service";
     const requiresMembership = orgId !== null && human;
+    if (getRequestContext()?.a2aIdentityAssurance === "org-member") {
+        if (!orgId || !effectiveOrgMemberRole("member", orgId, email)) {
+            throw new McpCredentialIssuanceError("not-member");
+        }
+    }
     if (requiresMembership) {
         // Federation validation may update membership on another connection.
         // Finish it before acquiring the local offboarding lock.
@@ -60,9 +67,9 @@ export async function withMcpCredentialIssuance(input, run) {
                 FOR UPDATE`,
                     args: [orgId, email],
                 });
+                const role = effectiveOrgMemberRole(rows[0]?.role, orgId, email);
                 if (rows.length === 0 ||
-                    (input.roles &&
-                        !input.roles.includes(String(rows[0].role)))) {
+                    (input.roles && !input.roles.includes(role))) {
                     throw new McpCredentialIssuanceError("not-member");
                 }
             }

package/dist/notifications/routes.d.ts

@@ -1,8 +1,8 @@
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
     count: number;
+    updated?: undefined;
     error?: undefined;
     ok?: undefined;
-    updated?: undefined;
 } | {
     count?: undefined;
     updated: number;
@@ -10,12 +10,12 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
     ok?: undefined;
 } | {
     count?: undefined;
+    updated?: undefined;
     error: string;
     ok?: undefined;
-    updated?: undefined;
 } | {
     count?: undefined;
+    updated?: undefined;
     ok: boolean;
     error?: undefined;
-    updated?: undefined;
 }>>;

package/dist/observability/routes.d.ts

@@ -64,6 +64,6 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     message?: undefined;
     summary?: undefined;
     spans?: undefined;
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/org/actions.d.ts

@@ -2,5 +2,5 @@ import { type ActionRunContext } from "../action.js";
 export declare function requireOrgMember(ctx?: ActionRunContext, admin?: boolean): Promise<{
     email: string;
     orgId: string;
-    role: string;
+    role: import("./types.js").OrgRole;
 }>;

package/dist/org/actions.js

@@ -1,5 +1,5 @@
 import { fail } from "../action.js";
-import { getDbExec } from "../db/client.js";
+import { readOrgMemberRole } from "../server/personal-provider-key-policy.js";
 export async function requireOrgMember(ctx, admin = false) {
     const email = ctx?.userEmail?.trim();
     const orgId = ctx?.orgId?.trim();
@@ -8,11 +8,7 @@ export async function requireOrgMember(ctx, admin = false) {
             errorCode: "unauthorized",
             statusCode: 401,
         });
-    const { rows } = await getDbExec().execute({
-        sql: `SELECT role FROM org_members WHERE org_id = ? AND LOWER(email) = LOWER(?) AND federation_removal_pending_at IS NULL LIMIT 1`,
-        args: [orgId, email],
-    });
-    const role = rows[0]?.role;
+    const role = await readOrgMemberRole(orgId, email);
     if (!role)
         fail("You are not a member of the active organization.", {
             errorCode: "forbidden",
@@ -23,5 +19,5 @@ export async function requireOrgMember(ctx, admin = false) {
             errorCode: "forbidden",
             statusCode: 403,
         });
-    return { email, orgId, role: String(role) };
+    return { email, orgId, role };
 }

package/dist/org/app-roles.js

@@ -1,5 +1,6 @@
 import { getDbExec } from "../db/client.js";
-import { getRequestOrgId, getRequestUserEmail, } from "../server/request-context.js";
+import { effectiveOrgMemberRole } from "../server/personal-provider-key-policy.js";
+import { getRequestContext, getRequestOrgId, getRequestUserEmail, } from "../server/request-context.js";
 import { ForbiddenError } from "../sharing/access.js";
 import { isMissingOrganizationTableError } from "./membership.js";
 const registry = new Map();
@@ -137,6 +138,9 @@ export async function resolveAppRole(descriptor, caller) {
         return { status: "no-identity" };
     if (!orgId)
         return { status: "no-org" };
+    if (!effectiveOrgMemberRole("member", orgId, email)) {
+        return { status: "not-a-member", orgId };
+    }
     let rows;
     try {
         rows = (await getDbExec().execute({
@@ -187,6 +191,11 @@ export async function resolveAppRole(descriptor, caller) {
             return { status: "not-a-member", orgId };
         orgRole = membership.role;
     }
+    const isDelegatedOrgMember = getRequestContext()?.a2aIdentityAssurance === "org-member";
+    orgRole = effectiveOrgMemberRole(orgRole, orgId, email) ?? undefined;
+    if (isDelegatedOrgMember && !orgRole) {
+        return { status: "not-a-member", orgId };
+    }
     const raw = row.roles ?? row.appRoles ?? row.approles;
     const roles = Array.isArray(raw) ? raw.map(String) : [];
     const validRoles = [

package/dist/org/context.d.ts

@@ -85,5 +85,6 @@ export declare function resolveA2AOrganizationCredentialsByDomain(domain: string
     orgId: string;
     orgDomain: string;
     secret: string;
+    a2aMemberDelegationEnabled: boolean;
 } | null>;
 export declare function isSoleOrgDomain(domain: string): Promise<boolean>;

package/dist/org/context.js

@@ -7,6 +7,7 @@ import { getDbExec, isTransientDatabaseError } from "../db/client.js";
 import { isAnonymousWaitlistSessionEmail } from "../server/anonymous-identity.js";
 import { crossSiteCookieAttrs, getSession } from "../server/auth.js";
 import { shouldWriteFirstRunOnboardingEligibility } from "../server/first-run-onboarding-build-mode.js";
+import { effectiveOrgMemberRole, readOrgMemberRole, } from "../server/personal-provider-key-policy.js";
 import { getVerifiedServiceIdentityFromEvent, getRequestContext, hasExplicitPersonalOrgScope, } from "../server/request-context.js";
 import { getSetting } from "../settings/store.js";
 import { getUserSetting } from "../settings/user-settings.js";
@@ -46,6 +47,32 @@ function normalizeOrgRole(value) {
         ? value
         : null;
 }
+function delegatedOrgMemberScope(email) {
+    const requestContext = getRequestContext();
+    if (requestContext?.a2aIdentityAssurance !== "org-member")
+        return undefined;
+    const requestEmail = requestContext.userEmail?.trim().toLowerCase();
+    const requestOrgId = requestContext.orgId?.trim();
+    if (!requestEmail ||
+        !requestOrgId ||
+        (email && email.trim().toLowerCase() !== requestEmail)) {
+        return null;
+    }
+    return requestOrgId;
+}
+function scopeMembershipsForDelegatedIdentity(email, memberships) {
+    const scopedOrgId = delegatedOrgMemberScope(email);
+    if (scopedOrgId === undefined || memberships === null)
+        return memberships;
+    if (!scopedOrgId)
+        return [];
+    return memberships.flatMap((membership) => {
+        if (membership.orgId !== scopedOrgId)
+            return [];
+        const role = effectiveOrgMemberRole(membership.role, scopedOrgId, email);
+        return role ? [{ ...membership, role }] : [];
+    });
+}
 function emailDomainOf(email) {
     return email.split("@")[1]?.toLowerCase() || null;
 }
@@ -94,10 +121,13 @@ async function refreshFederatedMemberships(event, email, memberships, selectedOr
     if (!result.active) {
         return memberships.filter((item) => item.orgId !== selected.orgId);
     }
-    if (result.role === selected.role) {
+    const role = effectiveOrgMemberRole(result.role, selected.orgId, email);
+    if (!role)
+        return memberships.filter((item) => item.orgId !== selected.orgId);
+    if (role === selected.role) {
         return memberships;
     }
-    return memberships.map((item) => item.orgId === selected.orgId ? { ...item, role: result.role } : item);
+    return memberships.map((item) => item.orgId === selected.orgId ? { ...item, role } : item);
 }
 const MEMBERSHIPS_CACHE_KEY = "__anOrgMembershipsCache";
 const ACTIVE_ORG_SETTING_CACHE_KEY = "__anActiveOrgSettingCache";
@@ -143,12 +173,19 @@ export function markActiveOrgSelectionChanged(event) {
     });
 }
 function loadMembershipsForEvent(event, email) {
+    const scopedOrgId = delegatedOrgMemberScope(email);
+    if (scopedOrgId === null)
+        return Promise.resolve([]);
     const ctx = event.context;
     const cache = (ctx[MEMBERSHIPS_CACHE_KEY] ??
         (ctx[MEMBERSHIPS_CACHE_KEY] = new Map()));
     let promise = cache.get(email);
     if (!promise) {
-        promise = loadMemberships(email).catch((err) => {
+        promise = loadMemberships(email)
+            .then((memberships) => scopedOrgId === undefined
+            ? memberships
+            : scopeMembershipsForDelegatedIdentity(email, memberships))
+            .catch((err) => {
             cache.delete(email);
             throw err;
         });
@@ -166,17 +203,25 @@ async function resolveOrgContextUncached(event) {
     const email = session?.email;
     if (!email)
         return EMPTY_CONTEXT;
+    const requestContext = getRequestContext();
+    const isDelegatedOrgMember = requestContext?.a2aIdentityAssurance === "org-member";
+    const delegatedOrgId = delegatedOrgMemberScope(email);
+    if (isDelegatedOrgMember && !delegatedOrgId) {
+        return { email, orgId: null, orgName: null, role: null };
+    }
     if (isAnonymousWaitlistSessionEmail(email)) {
         return { email, orgId: null, orgName: null, role: null };
     }
-    if (hasExplicitPersonalOrgScope(event)) {
+    if (!isDelegatedOrgMember && hasExplicitPersonalOrgScope(event)) {
         return { email, orgId: null, orgName: null, role: null };
     }
-    const sessionOrgId = typeof session.orgId === "string" && session.orgId.trim()
-        ? session.orgId.trim()
-        : null;
-    const sessionOrgRole = normalizeOrgRole(session.orgRole);
-    const requestContext = getRequestContext();
+    const sessionOrgId = delegatedOrgId ??
+        (typeof session.orgId === "string" && session.orgId.trim()
+            ? session.orgId.trim()
+            : null);
+    const sessionOrgRole = isDelegatedOrgMember
+        ? "member"
+        : normalizeOrgRole(session.orgRole);
     const verifiedServiceIdentity = getVerifiedServiceIdentityFromEvent(event);
     const serviceRole = implicitServiceOrgRole({
         email,
@@ -209,7 +254,9 @@ async function resolveOrgContextUncached(event) {
         }
     }
     const exec = getDbExec();
-    const activeOrgSettingPromise = loadActiveOrgSettingForEvent(event, email);
+    const activeOrgSettingPromise = isDelegatedOrgMember
+        ? Promise.resolve(null)
+        : loadActiveOrgSettingForEvent(event, email);
     activeOrgSettingPromise.catch(() => { });
     let memberships;
     try {
@@ -219,6 +266,10 @@ async function resolveOrgContextUncached(event) {
         // A transient membership read must not downgrade an authenticated request
         // to a private/solo scope when the session already carries its org.
         if (sessionOrgId && isTransientDatabaseError(err)) {
+            if (isDelegatedOrgMember) {
+                markOrgScopeResolutionUnavailable(event);
+                return { email, orgId: null, orgName: null, role: null };
+            }
             return {
                 email,
                 orgId: sessionOrgId,
@@ -231,6 +282,9 @@ async function resolveOrgContextUncached(event) {
     if (memberships === null) {
         // A null membership read is unavailable scope, not proof of a solo user.
         markOrgScopeResolutionUnavailable(event);
+        if (isDelegatedOrgMember) {
+            return { email, orgId: null, orgName: null, role: null };
+        }
         if (sessionOrgId) {
             return {
                 email,
@@ -242,16 +296,18 @@ async function resolveOrgContextUncached(event) {
         return { email, orgId: null, orgName: null, role: null };
     }
     const activeOrgSetting = await activeOrgSettingPromise;
-    const explicitPersonal = activeOrgSetting?.orgId === null;
-    const selectedMembership = explicitPersonal
-        ? undefined
-        : ((activeOrgSetting?.orgId
-            ? memberships.find((membership) => membership.orgId === activeOrgSetting.orgId)
-            : undefined) ??
-            (sessionOrgId
-                ? memberships.find((membership) => membership.orgId === sessionOrgId)
+    const explicitPersonal = !isDelegatedOrgMember && activeOrgSetting?.orgId === null;
+    const selectedMembership = isDelegatedOrgMember
+        ? memberships.find((membership) => membership.orgId === delegatedOrgId)
+        : explicitPersonal
+            ? undefined
+            : ((activeOrgSetting?.orgId
+                ? memberships.find((membership) => membership.orgId === activeOrgSetting.orgId)
                 : undefined) ??
-            memberships[0]);
+                (sessionOrgId
+                    ? memberships.find((membership) => membership.orgId === sessionOrgId)
+                    : undefined) ??
+                memberships[0]);
     const selectedOrgId = selectedMembership?.orgId ?? null;
     const selectedWasFederated = Boolean(selectedMembership?.identityAuthority || selectedMembership?.identityId);
     const refreshedMemberships = await refreshFederatedMemberships(event, email, memberships, selectedOrgId);
@@ -268,7 +324,8 @@ async function resolveOrgContextUncached(event) {
         markFederationMembershipValidated(event, email, selectedOrgId);
     }
     const emailDomain = emailDomainOf(email);
-    const shouldTryDomainAutoJoin = !explicitPersonal &&
+    const shouldTryDomainAutoJoin = !isDelegatedOrgMember &&
+        !explicitPersonal &&
         session.emailVerified === true &&
         emailDomain !== null &&
         !isFreeEmailProvider(emailDomain) &&
@@ -358,7 +415,9 @@ async function resolveOrgContextUncached(event) {
         }
         return { email, orgId: null, orgName: null, role: null };
     }
-    if (memberships.length === 0 && autoCreateDefaultOrgEnabled()) {
+    if (!isDelegatedOrgMember &&
+        memberships.length === 0 &&
+        autoCreateDefaultOrgEnabled()) {
         const created = await tryCreateDefaultOrg(exec, email, session, event);
         if (created)
             return created;
@@ -381,7 +440,8 @@ async function loadMemberships(email) {
     return cachedMemberships(email, () => loadMembershipsUncached(email));
 }
 export async function listOrgMemberships(email) {
-    return loadMemberships(email);
+    const memberships = await loadMemberships(email);
+    return scopeMembershipsForDelegatedIdentity(email, memberships);
 }
 export async function listOrgMembershipsForEvent(event, email, selectedOrgId) {
     const memberships = await loadMembershipsForEvent(event, email);
@@ -423,6 +483,15 @@ async function loadMembershipsUncached(email) {
     }) ?? null);
 }
 export async function resolveOrgScopeForEmail(email) {
+    const delegatedOrgId = delegatedOrgMemberScope(email);
+    if (delegatedOrgId !== undefined) {
+        if (!delegatedOrgId)
+            return { status: "unknown" };
+        const role = await readOrgMemberRole(delegatedOrgId, email);
+        return role
+            ? { status: "organization", orgId: delegatedOrgId }
+            : { status: "unknown" };
+    }
     if (getRequestContext()?.orgScope === "personal") {
         return { status: "personal" };
     }
@@ -457,6 +526,13 @@ export async function resolveActiveOrgIdForStorageCredential(email) {
     const normalizedEmail = email.trim().toLowerCase();
     if (!normalizedEmail)
         return null;
+    const delegatedOrgId = delegatedOrgMemberScope(normalizedEmail);
+    if (delegatedOrgId !== undefined) {
+        if (!delegatedOrgId)
+            return null;
+        const role = await readOrgMemberRole(delegatedOrgId, normalizedEmail);
+        return role ? delegatedOrgId : null;
+    }
     const { rows } = await getDbExec().execute({
         sql: `SELECT m.org_id AS "orgId"
           FROM org_members m
@@ -476,6 +552,22 @@ export async function resolveActiveOrgIdForStorageCredential(email) {
     return rows.some((row) => row.orgId === activeOrgId) ? activeOrgId : null;
 }
 export async function resolveOrgIdForEmailViaEvent(event, email) {
+    const delegatedOrgId = delegatedOrgMemberScope(email);
+    if (delegatedOrgId !== undefined) {
+        if (!delegatedOrgId)
+            return null;
+        const memberships = await loadMembershipsForEvent(event, email);
+        if (!memberships || !memberships.some((m) => m.orgId === delegatedOrgId)) {
+            return null;
+        }
+        const refreshed = await refreshFederatedMemberships(event, email, memberships, delegatedOrgId);
+        if (refreshed !== memberships) {
+            updateMembershipsForEvent(event, email, refreshed);
+        }
+        return refreshed.some((m) => m.orgId === delegatedOrgId)
+            ? delegatedOrgId
+            : null;
+    }
     if (getRequestContext()?.orgScope === "personal")
         return null;
     const settingPromise = loadActiveOrgSettingForEvent(event, email);
@@ -842,7 +934,8 @@ export async function resolveA2AOrganizationCredentialsByDomain(domain) {
     if (!normalizedDomain)
         return null;
     const { rows } = await getDbExec().execute({
-        sql: `SELECT id, allowed_domain, a2a_secret
+        sql: `SELECT id, allowed_domain, a2a_secret,
+                 a2a_member_delegation_enabled
           FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 2`,
         args: [normalizedDomain],
     });
@@ -858,7 +951,12 @@ export async function resolveA2AOrganizationCredentialsByDomain(domain) {
     const secret = String(row.a2a_secret ?? "").trim();
     if (!orgId || orgDomain !== normalizedDomain || !secret)
         return null;
-    return { orgId, orgDomain, secret };
+    return {
+        orgId,
+        orgDomain,
+        secret,
+        a2aMemberDelegationEnabled: row.a2a_member_delegation_enabled === true,
+    };
 }
 export async function isSoleOrgDomain(domain) {
     try {

package/dist/org/federation.d.ts

@@ -52,7 +52,7 @@ export declare function validateFederatedOrganizationMembership(event: H3Event |
 export declare function validateFederatedOrganizationMembershipForCurrentRequest(input: {
     orgId: string;
     email: string;
-}): Promise<FederatedMembershipValidation>;
+}, event?: H3Event): Promise<FederatedMembershipValidation>;
 export declare function syncOrganizationToIdentityHub(event: H3Event, input: FederatedOrganizationSyncInput): Promise<boolean>;
 export declare function provisionFederatedOrganization(identity: FederatedOrganizationIdentity, options?: {
     /** The signing-in caller's request; see `setActiveOrgId`. */

package/dist/org/federation.js

@@ -408,8 +408,8 @@ export async function validateFederatedOrganizationMembership(event, input) {
     }
     return { active: true, role: body.memberRole };
 }
-export async function validateFederatedOrganizationMembershipForCurrentRequest(input) {
-    return validateFederatedOrganizationMembership(requestEventFromContext(), input);
+export async function validateFederatedOrganizationMembershipForCurrentRequest(input, event) {
+    return validateFederatedOrganizationMembership(event ?? requestEventFromContext(), input);
 }
 export async function syncOrganizationToIdentityHub(event, input) {
     const rollout = await federationRolloutState(input.email, input.id);