@agent-native/core 0.212.1 → 0.214.0

package/dist/org/handlers.d.ts

@@ -62,6 +62,7 @@ export declare const getMyOrgHandler: import("h3").EventHandlerWithFetch<import(
     workspaceAppDefaultVisibility: WorkspaceAppDefaultVisibility;
     signInMethods: import("./sign-in-methods.js").OrgSignInMethods;
     a2aSecretSet: boolean;
+    a2aMemberDelegationEnabled: boolean;
     soloDeploymentAdmin: boolean;
 }>>;
 export declare const retryPendingFederatedRemovalHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
@@ -175,6 +176,9 @@ export declare const setRequiredAuthProviderHandler: import("h3").EventHandlerWi
     revokedLegacySessions: number;
     provider: RequiredAuthProvider;
 }>>;
+export declare const setA2AMemberDelegationHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    enabled: any;
+}>>;
 export declare const revealA2ASecretHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     a2aSecret: string;
 }>>;

package/dist/org/handlers.js

@@ -35,6 +35,8 @@ import { getAppProductionUrl, resolveAppRuntimeUrl, } from "../server/app-url.js
 import { isTrustedSelfHostedRuntime, resolveVercelDeploymentProtectionHeaders, } from "../server/credential-provider.js";
 import { sendEmail, isEmailConfigured } from "../server/email.js";
 import { readBody } from "../server/h3-helpers.js";
+import { effectiveOrgMemberRole } from "../server/personal-provider-key-policy.js";
+import { getRequestContext } from "../server/request-context.js";
 import { resolveDeploymentSignInMethods } from "../server/social-sign-in-providers.js";
 import { getOrgSetting, putOrgSetting } from "../settings/org-settings.js";
 import { isEmailDerivedName } from "../user-profile/shared.js";
@@ -140,37 +142,82 @@ async function getSessionForEvent(event) {
 }
 export const getMyOrgHandler = defineEventHandler(async (event) => {
     const ctx = await getOrgContext(event);
+    const requestContext = getRequestContext();
+    const delegatedOrgMember = requestContext?.a2aIdentityAssurance === "org-member";
+    const delegatedEmail = requestContext?.userEmail?.trim().toLowerCase();
+    const delegatedOrgId = delegatedOrgMember
+        ? requestContext.orgId?.trim()
+        : undefined;
+    const scopedDelegatedOrgId = delegatedEmail &&
+        delegatedEmail === ctx.email.trim().toLowerCase() &&
+        delegatedOrgId &&
+        ctx.orgId === delegatedOrgId
+        ? delegatedOrgId
+        : null;
+    const visibleOrgId = delegatedOrgMember ? scopedDelegatedOrgId : ctx.orgId;
+    const visibleOrgName = visibleOrgId ? ctx.orgName : null;
+    const visibleRole = delegatedOrgMember
+        ? visibleOrgId
+            ? "member"
+            : null
+        : ctx.role;
     const e = await exec();
-    const allOrgsRes = await e.execute({
-        sql: `SELECT m.org_id AS "orgId", m.role AS role, o.name AS "orgName",
-                 o.icon_json AS "iconJson", o.icon_revision AS "iconRevision"
-          FROM org_members m
-          INNER JOIN organizations o ON m.org_id = o.id
-          WHERE LOWER(m.email) = ?
-            AND m.federation_removal_pending_at IS NULL`,
-        args: [ctx.email.toLowerCase()],
-    });
-    const orgs = allOrgsRes.rows.map((r) => ({
-        orgId: String(r.orgId ?? r.org_id),
-        role: String(r.role),
-        orgName: String(r.orgName ?? r.org_name),
-        icon: parseOrganizationIconJson(r.iconJson ?? r.icon_json),
-        iconRevision: Number(r.iconRevision ?? r.icon_revision ?? 0),
-    }));
-    const pendingRemovalRes = await e.execute({
-        sql: `SELECT m.org_id AS "orgId", o.name AS "orgName"
-          FROM org_members m
-          INNER JOIN organizations o ON m.org_id = o.id
-          WHERE LOWER(m.email) = ?
-            AND m.federation_removal_pending_at IS NOT NULL`,
-        args: [ctx.email.toLowerCase()],
+    const allOrgsRes = delegatedOrgMember
+        ? scopedDelegatedOrgId
+            ? await e.execute({
+                sql: `SELECT m.org_id AS "orgId", m.role AS role, o.name AS "orgName",
+                       o.icon_json AS "iconJson", o.icon_revision AS "iconRevision"
+                FROM org_members m
+                INNER JOIN organizations o ON m.org_id = o.id
+                WHERE LOWER(m.email) = ? AND m.org_id = ?
+                  AND m.federation_removal_pending_at IS NULL`,
+                args: [ctx.email.toLowerCase(), scopedDelegatedOrgId],
+            })
+            : { rows: [] }
+        : await e.execute({
+            sql: `SELECT m.org_id AS "orgId", m.role AS role, o.name AS "orgName",
+                     o.icon_json AS "iconJson", o.icon_revision AS "iconRevision"
+              FROM org_members m
+              INNER JOIN organizations o ON m.org_id = o.id
+              WHERE LOWER(m.email) = ?
+                AND m.federation_removal_pending_at IS NULL`,
+            args: [ctx.email.toLowerCase()],
+        });
+    const orgs = allOrgsRes.rows.flatMap((r) => {
+        const orgId = String(r.orgId ?? r.org_id);
+        const role = delegatedOrgMember
+            ? effectiveOrgMemberRole(r.role, orgId, ctx.email)
+            : String(r.role);
+        return role
+            ? [
+                {
+                    orgId,
+                    role,
+                    orgName: String(r.orgName ?? r.org_name),
+                    icon: parseOrganizationIconJson(r.iconJson ?? r.icon_json),
+                    iconRevision: Number(r.iconRevision ?? r.icon_revision ?? 0),
+                },
+            ]
+            : [];
     });
+    const pendingRemovalRes = delegatedOrgMember
+        ? { rows: [] }
+        : await e.execute({
+            sql: `SELECT m.org_id AS "orgId", o.name AS "orgName"
+              FROM org_members m
+              INNER JOIN organizations o ON m.org_id = o.id
+              WHERE LOWER(m.email) = ?
+                AND m.federation_removal_pending_at IS NOT NULL`,
+            args: [ctx.email.toLowerCase()],
+        });
     const pendingRemovals = pendingRemovalRes.rows.map((r) => ({
         orgId: String(r.orgId ?? r.org_id),
         orgName: String(r.orgName ?? r.org_name),
     }));
     let domainMatches = [];
-    const domain = ctx.email.split("@")[1]?.toLowerCase();
+    const domain = delegatedOrgMember
+        ? undefined
+        : ctx.email.split("@")[1]?.toLowerCase();
     if (domain) {
         try {
             const dmRes = await e.execute({
@@ -199,14 +246,16 @@ export const getMyOrgHandler = defineEventHandler(async (event) => {
     let workspaceUrl = null;
     let requiredAuthProvider = null;
     let a2aSecretSet = false;
+    let a2aMemberDelegationEnabled = false;
     let icon = null;
     let iconRevision = 0;
-    if (ctx.orgId) {
+    if (visibleOrgId) {
         const adRes = await e.execute({
-            sql: `SELECT allowed_domain, a2a_secret, workspace_url, required_auth_provider,
+            sql: `SELECT allowed_domain, a2a_secret, a2a_member_delegation_enabled,
+                   workspace_url, required_auth_provider,
                    icon_json, icon_revision
             FROM organizations WHERE id = ? LIMIT 1`,
-            args: [ctx.orgId],
+            args: [visibleOrgId],
         });
         if (adRes.rows[0]) {
             allowedDomain =
@@ -214,35 +263,49 @@ export const getMyOrgHandler = defineEventHandler(async (event) => {
             workspaceUrl = String(adRes.rows[0].workspace_url ?? "") || null;
             requiredAuthProvider = parseRequiredAuthProvider(adRes.rows[0].required_auth_provider ?? null);
             a2aSecretSet = Boolean(String(adRes.rows[0].a2a_secret ?? "").trim());
+            a2aMemberDelegationEnabled =
+                adRes.rows[0].a2a_member_delegation_enabled === true;
             icon = parseOrganizationIconJson(adRes.rows[0].icon_json);
             iconRevision = Number(adRes.rows[0].icon_revision ?? 0);
         }
     }
-    const isOwnerOrAdmin = ctx.role === "owner" || ctx.role === "admin";
+    const isOwnerOrAdmin = visibleRole === "owner" || visibleRole === "admin";
     let workspaceAppDefaultVisibility = "org";
-    if (ctx.orgId) {
-        const setting = await getOrgSetting(ctx.orgId, WORKSPACE_APP_DEFAULT_VISIBILITY_KEY);
+    if (visibleOrgId) {
+        const setting = await getOrgSetting(visibleOrgId, WORKSPACE_APP_DEFAULT_VISIBILITY_KEY);
         workspaceAppDefaultVisibility = normalizeWorkspaceAppDefaultVisibility(setting?.visibility);
     }
-    const invitesRes = await e.execute({
-        sql: `SELECT i.id AS id, i.org_id AS "orgId", o.name AS "orgName", i.invited_by AS "invitedBy"
-          FROM org_invitations i
-          INNER JOIN organizations o ON i.org_id = o.id
-          WHERE LOWER(i.email) = ? AND i.status = 'pending'`,
-        args: [ctx.email.toLowerCase()],
-    });
+    const invitesRes = delegatedOrgMember
+        ? scopedDelegatedOrgId
+            ? await e.execute({
+                sql: `SELECT i.id AS id, i.org_id AS "orgId", o.name AS "orgName", i.invited_by AS "invitedBy"
+                FROM org_invitations i
+                INNER JOIN organizations o ON i.org_id = o.id
+                WHERE LOWER(i.email) = ? AND i.org_id = ? AND i.status = 'pending'`,
+                args: [ctx.email.toLowerCase(), scopedDelegatedOrgId],
+            })
+            : { rows: [] }
+        : await e.execute({
+            sql: `SELECT i.id AS id, i.org_id AS "orgId", o.name AS "orgName", i.invited_by AS "invitedBy"
+              FROM org_invitations i
+              INNER JOIN organizations o ON i.org_id = o.id
+              WHERE LOWER(i.email) = ? AND i.status = 'pending'`,
+            args: [ctx.email.toLowerCase()],
+        });
     const pendingInvitations = invitesRes.rows.map((r) => ({
         id: String(r.id),
         orgId: String(r.orgId ?? r.org_id),
         orgName: String(r.orgName ?? r.org_name),
         invitedBy: String(r.invitedBy ?? r.invited_by),
     }));
-    scheduleFederatedOrgSync(event, { ...ctx, icon, iconRevision });
+    if (!delegatedOrgMember) {
+        scheduleFederatedOrgSync(event, { ...ctx, icon, iconRevision });
+    }
     return {
-        email: ctx.email,
-        orgId: ctx.orgId,
-        orgName: ctx.orgName,
-        role: ctx.role,
+        email: delegatedOrgMember ? (delegatedEmail ?? "") : ctx.email,
+        orgId: visibleOrgId,
+        orgName: visibleOrgName,
+        role: visibleRole,
         icon,
         iconRevision,
         emailConfigured: await isEmailConfigured(),
@@ -268,8 +331,13 @@ export const getMyOrgHandler = defineEventHandler(async (event) => {
         // so the value would sit in JSON any script on the page can read, and it
         // signs the JWTs peers accept as first-party callers. Reveal is an explicit
         // owner GET on /_agent-native/org/a2a-secret.
-        a2aSecretSet: canManageOrgA2ASecret(ctx.role) ? a2aSecretSet : undefined,
-        soloDeploymentAdmin: ctx.orgId ? undefined : isTrustedSelfHostedRuntime(),
+        a2aSecretSet: canManageOrgA2ASecret(visibleRole) ? a2aSecretSet : undefined,
+        a2aMemberDelegationEnabled: visibleRole === "owner" ? a2aMemberDelegationEnabled : undefined,
+        soloDeploymentAdmin: delegatedOrgMember
+            ? undefined
+            : visibleOrgId
+                ? undefined
+                : isTrustedSelfHostedRuntime(),
     };
 });
 export const retryPendingFederatedRemovalHandler = defineEventHandler(async (event) => {
@@ -1558,6 +1626,33 @@ export const setRequiredAuthProviderHandler = defineEventHandler(async (event) =
     const result = await setRequiredAuthProvider(ctx.orgId, provider);
     return { provider, ...result };
 });
+export const setA2AMemberDelegationHandler = defineEventHandler(async (event) => {
+    const ctx = await getOrgContext(event);
+    if (!ctx.orgId) {
+        throw createError({ statusCode: 400, message: "No active organization" });
+    }
+    if (ctx.role !== "owner") {
+        throw createError({
+            statusCode: 403,
+            message: "Only the organization owner can manage member delegation",
+        });
+    }
+    const body = await readBody(event);
+    if (typeof body?.enabled !== "boolean") {
+        throw createError({
+            statusCode: 400,
+            message: "enabled must be a boolean",
+        });
+    }
+    const e = await exec();
+    await e.execute({
+        sql: `UPDATE organizations
+            SET a2a_member_delegation_enabled = ?
+            WHERE id = ?`,
+        args: [body.enabled, ctx.orgId],
+    });
+    return { enabled: body.enabled };
+});
 export const revealA2ASecretHandler = defineEventHandler(async (event) => {
     const ctx = await getOrgContext(event);
     if (!ctx.orgId) {
@@ -1886,6 +1981,7 @@ export const receiveA2ASecretHandler = defineEventHandler(async (event) => {
         verified = null;
     }
     if (!verified ||
+        verified.identityAssurance !== "organization" ||
         verified.orgId !== localOrgId ||
         verified.orgDomain?.trim().toLowerCase() !== orgDomain) {
         throw createError({

package/dist/org/index.d.ts

@@ -159,13 +159,14 @@ export declare const getMyOrgHandler: import("h3").EventHandlerWithFetch<import(
     workspaceAppDefaultVisibility: import("./types.js").WorkspaceAppDefaultVisibility;
     signInMethods: import("./sign-in-methods.js").OrgSignInMethods;
     a2aSecretSet: boolean;
+    a2aMemberDelegationEnabled: boolean;
     soloDeploymentAdmin: boolean;
 }>>;
 export declare const createOrgHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     success: boolean;
+    id?: undefined;
     name?: undefined;
     role?: undefined;
-    id?: undefined;
 } | {
     success?: undefined;
     id: string;

package/dist/org/membership.d.ts

@@ -1,10 +1,12 @@
+import type { H3Event } from "h3";
 export declare function isMissingOrganizationTableError(error: unknown): boolean;
 export declare function isOrgMember(orgId: string, email: string, options?: {
     requireOrganizationMetadata?: boolean;
+    requestEvent?: H3Event;
 }): Promise<boolean>;
 /**
- * Checks membership for an A2A identity authenticated by an organization
- * secret. Unlike legacy callers, this requires readable organization metadata
- * as well as the membership row before the token subject can become an owner.
+ * Checks the live roster for an opted-in org-member A2A assertion. This proves
+ * membership in the asserted org; authorization still caps the identity at
+ * member regardless of the stored owner/admin role.
  */
-export declare function isOrgMemberForA2A(orgId: string, email: string): Promise<boolean>;
+export declare function isOrgMemberForA2A(orgId: string, email: string, requestEvent?: H3Event): Promise<boolean>;

package/dist/org/membership.js

@@ -65,23 +65,25 @@ async function isOrgMemberWithPolicy(orgId, email, options) {
     const validation = await validateFederatedOrganizationMembershipForCurrentRequest({
         orgId,
         email: normalized,
-    });
+    }, options.requestEvent);
     return validation.active;
 }
 export function isOrgMember(orgId, email, options = {}) {
     return isOrgMemberWithPolicy(orgId, email, {
         allowMissingOrganizationTable: !options.requireOrganizationMetadata,
         requireOrganizationRecord: !!options.requireOrganizationMetadata,
+        requestEvent: options.requestEvent,
     });
 }
 /**
- * Checks membership for an A2A identity authenticated by an organization
- * secret. Unlike legacy callers, this requires readable organization metadata
- * as well as the membership row before the token subject can become an owner.
+ * Checks the live roster for an opted-in org-member A2A assertion. This proves
+ * membership in the asserted org; authorization still caps the identity at
+ * member regardless of the stored owner/admin role.
  */
-export function isOrgMemberForA2A(orgId, email) {
+export function isOrgMemberForA2A(orgId, email, requestEvent) {
     return isOrgMemberWithPolicy(orgId, email, {
         allowMissingOrganizationTable: false,
         requireOrganizationRecord: true,
+        requestEvent,
     });
 }

package/dist/org/migrations.js

@@ -284,4 +284,10 @@ export const ORG_MIGRATIONS = [
         ON private_icon_assets (owner_email, org_id, created_at);
     `,
     },
+    {
+        version: 1035,
+        name: "organization-a2a-member-delegation",
+        sql: `ALTER TABLE organizations
+          ADD COLUMN IF NOT EXISTS a2a_member_delegation_enabled BOOLEAN NOT NULL DEFAULT FALSE`,
+    },
 ];

package/dist/org/plugin.d.ts

@@ -24,6 +24,7 @@ type NitroPluginDef = (nitroApp: any) => void | Promise<void>;
  *   PUT    /_agent-native/org/domain                      — set/clear allowed email domain (owner/admin)
  *   PUT    /_agent-native/org/workspace-url               — set/clear the org's workspace origin (owner/admin)
  *   PUT    /_agent-native/org/auth-provider               — require/clear Google sign-in (owner/admin)
+ *   PUT    /_agent-native/org/a2a-member-delegation       — allow org-member A2A assertions (owner only)
  *   PUT    /_agent-native/org/visual-identity              — set/clear workspace icon (owner/admin)
  *   GET    /_agent-native/org/a2a-secret                  — reveal A2A secret on demand (owner/admin)
  *   PUT    /_agent-native/org/a2a-secret                  — regenerate or set A2A secret (owner/admin)

package/dist/org/plugin.js

@@ -4,7 +4,7 @@ import { awaitBootstrap, getH3App, FRAMEWORK_PREFIX, markDefaultPluginProvided,
 import { listAppRolesHandler, setAppRoleHandler, getAppPermissionsHandler, setAppPermissionsHandler, resetAppPermissionHandler, } from "./app-roles-handlers.js";
 import { listSSOProvidersHandler, createSSOProviderHandler, verifySSOProviderHandler, deleteSSOProviderHandler, getSCIMHandler, createSCIMHandler, deleteSCIMHandler, } from "./enterprise-auth-handlers.js";
 import { CROSS_APP_ORG_FEDERATION_FLAG } from "./feature-flags.js";
-import { getMyOrgHandler, createOrgHandler, updateOrgHandler, deleteOrgHandler, switchOrgHandler, listMembersHandler, removeMemberHandler, retryPendingFederatedRemovalHandler, changeMemberRoleHandler, listInvitationsHandler, createInvitationHandler, acceptInvitationHandler, joinByDomainHandler, setDomainHandler, setWorkspaceUrlHandler, setRequiredAuthProviderHandler, revealA2ASecretHandler, setA2ASecretHandler, syncA2ASecretHandler, receiveA2ASecretHandler, setWorkspaceAppDefaultVisibilityHandler, setOrgVisualIdentityHandler, } from "./handlers.js";
+import { getMyOrgHandler, createOrgHandler, updateOrgHandler, deleteOrgHandler, switchOrgHandler, listMembersHandler, removeMemberHandler, retryPendingFederatedRemovalHandler, changeMemberRoleHandler, listInvitationsHandler, createInvitationHandler, acceptInvitationHandler, joinByDomainHandler, setDomainHandler, setWorkspaceUrlHandler, setRequiredAuthProviderHandler, setA2AMemberDelegationHandler, revealA2ASecretHandler, setA2ASecretHandler, syncA2ASecretHandler, receiveA2ASecretHandler, setWorkspaceAppDefaultVisibilityHandler, setOrgVisualIdentityHandler, } from "./handlers.js";
 import { readWorkspacePrivateIconHandler, uploadWorkspacePrivateIconHandler, } from "./private-icon-handlers.js";
 import { orgStore } from "./schema-store.js";
 const ORG_PREFIX = `${FRAMEWORK_PREFIX}/org`;
@@ -56,6 +56,7 @@ async function workspaceIconUploadResponse(event) {
  *   PUT    /_agent-native/org/domain                      — set/clear allowed email domain (owner/admin)
  *   PUT    /_agent-native/org/workspace-url               — set/clear the org's workspace origin (owner/admin)
  *   PUT    /_agent-native/org/auth-provider               — require/clear Google sign-in (owner/admin)
+ *   PUT    /_agent-native/org/a2a-member-delegation       — allow org-member A2A assertions (owner only)
  *   PUT    /_agent-native/org/visual-identity              — set/clear workspace icon (owner/admin)
  *   GET    /_agent-native/org/a2a-secret                  — reveal A2A secret on demand (owner/admin)
  *   PUT    /_agent-native/org/a2a-secret                  — regenerate or set A2A secret (owner/admin)
@@ -205,6 +206,13 @@ export function createOrgPlugin() {
             }
             return retryPendingFederatedRemovalHandler(event);
         }));
+        app.use(`${ORG_PREFIX}/a2a-member-delegation`, defineEventHandler(async (event) => {
+            if (getMethod(event) !== "PUT") {
+                setResponseStatus(event, 405);
+                return { error: "Method not allowed" };
+            }
+            return setA2AMemberDelegationHandler(event);
+        }));
         app.use(`${ORG_PREFIX}/workspace-app-default-visibility`, defineEventHandler(async (event) => {
             if (getMethod(event) !== "PUT") {
                 setResponseStatus(event, 405);

package/dist/org/private-icon-handlers.js

@@ -3,6 +3,7 @@ import { getDbExec } from "../db/client.js";
 import { getIconAsset, IconUploadBodyError, putIconAsset, readIconUploadFormData, readIconAssetForAuthorizedReference, } from "../icon-assets/index.js";
 import { readFederatedWorkspaceIcon, uploadFederatedWorkspaceIcon, verifyFederatedWorkspaceIconOwner, } from "../icon-assets/workspace-transport.js";
 import { getSession } from "../server/auth.js";
+import { readOrgMemberRole } from "../server/personal-provider-key-policy.js";
 import { runWithRequestContext } from "../server/request-context.js";
 import { getOrgContext } from "./context.js";
 import { validateFederatedOrganizationMembership } from "./federation.js";
@@ -118,20 +119,13 @@ export const readWorkspacePrivateIconHandler = defineEventHandler(async (event)
         });
     }
     const [, library, orgId, assetId] = match;
-    const membership = await getDbExec().execute({
-        sql: `SELECT role FROM org_members
-          WHERE org_id = ? AND LOWER(email) = ?
-            AND federation_removal_pending_at IS NULL LIMIT 1`,
-        args: [orgId, session.email.toLowerCase()],
-    });
-    if (!membership.rows.length)
+    const role = await readOrgMemberRole(orgId, session.email);
+    if (!role)
         throw createError({
             statusCode: 404,
             message: "Workspace icon not found",
         });
-    if (library &&
-        membership.rows[0]?.role !== "owner" &&
-        membership.rows[0]?.role !== "admin") {
+    if (library && role !== "owner" && role !== "admin") {
         throw createError({
             statusCode: 404,
             message: "Workspace icon not found",

package/dist/org/types.d.ts

@@ -63,6 +63,8 @@ export interface OrgInfo {
      * fetches it on demand from `GET /_agent-native/org/a2a-secret`.
      */
     a2aSecretSet?: boolean;
+    /** Owners only; enables current-member assertions signed with the org secret. */
+    a2aMemberDelegationEnabled?: boolean;
     /**
      * Set only when the viewer has no active organization. True on a
      * single-tenant self-hosted deployment, where that viewer manages the

package/dist/org/workspace-app-access.js

@@ -1,11 +1,13 @@
 import { createHmac, randomUUID } from "node:crypto";
 import { canonicalA2AAudience } from "../a2a/audience.js";
 import { isLoopbackAddress } from "../a2a/auth-policy.js";
-import { signA2AToken } from "../a2a/client.js";
+import { signA2AOrgMemberDelegationToken, signA2AToken, } from "../a2a/client.js";
 import { getAppConfig } from "../app-config/index.js";
 import { getDbExec } from "../db/client.js";
 import { readDeployCredentialEnv } from "../server/credential-provider.js";
 import { isHostedWorkspaceRuntime, resolveVercelDeploymentProtectionHeaders, } from "../server/deployment-protection.js";
+import { effectiveOrgMemberRole } from "../server/personal-provider-key-policy.js";
+import { getRequestContext } from "../server/request-context.js";
 import { workspaceUserGroupsIncludeUser } from "../workspace-connections/groups.js";
 import { isMissingOrganizationTableError } from "./membership.js";
 import { getCachedWorkspaceAccess, invalidateMemberOrgCaches, rememberWorkspaceAccess, workspaceAccessGenerationNow, } from "./request-org-cache.js";
@@ -239,25 +241,54 @@ async function resolveHostedWorkspaceAppAuth(configuredDirectory, context, email
         const orgSecret = orgId
             ? (await cachedOrgA2ASecret(orgId))?.trim() || undefined
             : undefined;
-        const signingSecret = orgSecret || readDeployCredentialEnv("A2A_SECRET")?.trim();
+        const deploymentSecret = readDeployCredentialEnv("A2A_SECRET")?.trim();
+        const signingSecret = orgSecret || deploymentSecret;
         if (!signingSecret) {
             return workspaceAppAccessUnavailable("a2a-secret-missing", { audience });
         }
         stage = "token-signing-failed";
-        const token = await signA2AToken(email, normalizedOrgDomain, orgSecret, {
-            expiresIn: "1m",
-            preferGlobalSecret: false,
-            audience,
-            extraClaims: {
-                jti: randomUUID(),
-            },
-        });
+        const requestContext = getRequestContext();
+        let token;
+        if (requestContext?.a2aIdentityAssurance === "org-member") {
+            if (!orgId ||
+                !normalizedOrgDomain ||
+                requestContext.orgId?.trim() !== orgId ||
+                requestContext.userEmail?.trim().toLowerCase() !== email) {
+                return workspaceAppAccessUnavailable("token-signing-failed", {
+                    audience,
+                    detail: "Delegated member identity is missing or out of scope.",
+                });
+            }
+            if (!orgSecret) {
+                return workspaceAppAccessUnavailable("a2a-secret-missing", {
+                    audience,
+                });
+            }
+            if (orgSecret === deploymentSecret) {
+                return workspaceAppAccessUnavailable("token-signing-failed", {
+                    audience,
+                    detail: "Organization and deployment A2A secrets must differ for delegated identity.",
+                });
+            }
+            token = await signA2AOrgMemberDelegationToken(email, normalizedOrgDomain, orgSecret, audience);
+        }
+        else {
+            token = await signA2AToken(email, normalizedOrgDomain, orgSecret, {
+                expiresIn: "1m",
+                preferGlobalSecret: false,
+                audience,
+                extraClaims: {
+                    jti: randomUUID(),
+                },
+            });
+        }
         const protectionHeaders = resolveVercelDeploymentProtectionHeaders(url.toString());
         const requestKey = createHmac("sha256", signingSecret)
             .update(JSON.stringify([
             configuredDirectory,
             email,
             orgId,
+            requestContext?.a2aIdentityAssurance ?? "user",
             normalizedOrgDomain ?? null,
             getAppConfig().app.url ?? "http://localhost:3000",
             protectionHeaders,
@@ -603,7 +634,13 @@ export async function claimWorkspaceAppForOrganization(appId, context) {
         if (!member || !(await isActiveWorkspaceOrgMember(member, orgId, email))) {
             return false;
         }
-        return claimWorkspaceAppOrganization(db, normalizedAppId, orgId, member);
+        const role = effectiveOrgMemberRole(member.role, orgId, email);
+        return role
+            ? claimWorkspaceAppOrganization(db, normalizedAppId, orgId, {
+                ...member,
+                role,
+            })
+            : false;
     }
     catch (error) {
         console.error("[workspace-app-access] organization claim failed", error);
@@ -667,7 +704,13 @@ export async function checkWorkspaceAppAccess(appId, context) {
                 !(await isActiveWorkspaceOrgMember(member, orgId, email))) {
                 return false;
             }
-            return claimWorkspaceAppOrganization(db, normalizedAppId, orgId, member);
+            const role = effectiveOrgMemberRole(member.role, orgId, email);
+            return role
+                ? claimWorkspaceAppOrganization(db, normalizedAppId, orgId, {
+                    ...member,
+                    role,
+                })
+                : false;
         }
         const ownerEmail = normalizedEmail(typeof app.owner_email === "string" ? app.owner_email : "");
         const resourceOrgId = (typeof app.org_id === "string" ? app.org_id : "").trim() || null;
@@ -688,9 +731,14 @@ export async function checkWorkspaceAppAccess(appId, context) {
         if (!member || !(await isActiveWorkspaceOrgMember(member, orgId, email))) {
             return false;
         }
-        const memberRole = member.role;
+        const memberRole = effectiveOrgMemberRole(member.role, orgId, email);
+        if (!memberRole)
+            return false;
         if (canClaimCallerOrg) {
-            if (!(await claimWorkspaceAppOrganization(db, normalizedAppId, orgId, member))) {
+            if (!(await claimWorkspaceAppOrganization(db, normalizedAppId, orgId, {
+                ...member,
+                role: memberRole,
+            }))) {
                 return false;
             }
         }

package/dist/progress/routes.d.ts

@@ -2,6 +2,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -75,7 +75,8 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         user: "user";
     }>>;
 }, z.core.$strip>>, {
-    provider?: undefined;
+    message?: undefined;
+    found?: undefined;
     providers: {
         id: string;
         label: string;
@@ -86,13 +87,13 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         updatedAt: number;
     }[];
     count: number;
-    found?: undefined;
+    provider?: undefined;
     deleted?: undefined;
     registered?: undefined;
     id?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
+    message?: undefined;
     providers?: undefined;
     count?: undefined;
     found: boolean;
@@ -101,32 +102,31 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     registered?: undefined;
     id?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
-    provider?: undefined;
+    message?: undefined;
     providers?: undefined;
     count?: undefined;
+    provider?: undefined;
     found: boolean;
     id: string;
     deleted?: undefined;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
-    provider?: undefined;
+    message?: undefined;
+    found?: undefined;
     providers?: undefined;
     count?: undefined;
-    found?: undefined;
+    provider?: undefined;
     deleted: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
-    provider?: undefined;
+    found?: undefined;
     providers?: undefined;
     count?: undefined;
-    found?: undefined;
+    provider?: undefined;
     deleted?: undefined;
     registered: boolean;
     id: string;