@agent-native/core 0.7.12 → 0.7.14

package/dist/org/context.js

@@ -1,19 +1,37 @@
 import { getSession } from "../server/auth.js";
-import { getUserSetting } from "../settings/user-settings.js";
+import { getUserSetting, putUserSetting } from "../settings/user-settings.js";
 import { getDbExec } from "../db/client.js";
+import { getSetting } from "../settings/store.js";
+const EMPTY_CONTEXT = {
+    email: "",
+    orgId: null,
+    orgName: null,
+    role: null,
+};
+const nanoid = () => globalThis.crypto?.randomUUID?.().replace(/-/g, "") ??
+    Math.random().toString(36).slice(2) + Date.now().toString(36);
 /**
  * Resolve the current user's organization context from their session.
  *
- * - Returns `orgId: null` for solo / dev mode (`local@localhost`).
  * - For users in multiple orgs, honors their `active-org-id` user setting.
  * - Falls back to the user's first membership.
+ * - `local@localhost` (dev / no-auth mode) is treated as a regular identity:
+ *   it owns whatever orgs it has created locally.
+ * - When `AUTO_CREATE_DEFAULT_ORG` is set and the authenticated user has
+ *   zero memberships, provisions a default org named after the user
+ *   ({name}'s workspace, falling back to the email local-part). Opt-in
+ *   per deployment so templates that don't use orgs don't accrue phantom
+ *   default orgs in their DB. The <RequireActiveOrg> client guard remains
+ *   the safety net for pre-existing accounts or provisioning failures.
  */
 export async function getOrgContext(event) {
     const session = await getSession(event);
-    const email = session?.email ?? "local@localhost";
-    if (email === "local@localhost") {
-        return { email, orgId: null, orgName: null, role: null };
-    }
+    const email = session?.email;
+    // No `?? "local@localhost"` fallback — if the session is genuinely
+    // missing (misconfigured prod, expired token mid-request) don't
+    // silently promote the caller to the shared dev identity.
+    if (!email)
+        return EMPTY_CONTEXT;
     const exec = getDbExec();
     let memberships = [];
     try {
@@ -34,6 +52,13 @@ export async function getOrgContext(event) {
         // Tables may not exist yet on first boot before migrations finish.
         return { email, orgId: null, orgName: null, role: null };
     }
+    if (memberships.length === 0 && process.env.AUTO_CREATE_DEFAULT_ORG) {
+        const created = await tryCreateDefaultOrg(exec, email, session);
+        if (created)
+            return created;
+        // Creation failed (race / DB error); fall through and let the
+        // RequireActiveOrg client guard prompt the user.
+    }
     if (memberships.length === 0) {
         return { email, orgId: null, orgName: null, role: null };
     }
@@ -58,4 +83,272 @@ export async function getOrgContext(event) {
         role: memberships[0].role,
     };
 }
+/**
+ * Resolve the active org ID for a given email — for non-HTTP contexts like
+ * the integration webhook handler where we have an email but no event/session.
+ * Picks the user's active-org-id setting if set, otherwise the first membership.
+ * Returns null if the user has no memberships.
+ */
+export async function resolveOrgIdForEmail(email) {
+    const exec = getDbExec();
+    if (!exec)
+        return null;
+    try {
+        const { rows } = await exec.execute({
+            sql: `SELECT org_id FROM org_members WHERE LOWER(email) = ?`,
+            args: [email.toLowerCase()],
+        });
+        if (rows.length === 0)
+            return null;
+        const ids = rows.map((r) => String(r.org_id));
+        if (ids.length === 1)
+            return ids[0];
+        const activeOrgSetting = (await getUserSetting(email, "active-org-id"));
+        if (activeOrgSetting?.orgId && ids.includes(activeOrgSetting.orgId)) {
+            return activeOrgSetting.orgId;
+        }
+        return ids[0];
+    }
+    catch {
+        return null;
+    }
+}
+function defaultOrgName(email, session) {
+    const full = session?.name?.trim();
+    if (full)
+        return `${full}'s workspace`;
+    const local = email.split("@")[0] ?? email;
+    const cleaned = local.replace(/[._-]+/g, " ").trim();
+    const titled = cleaned
+        .split(" ")
+        .filter(Boolean)
+        .map((w) => w.charAt(0).toUpperCase() + w.slice(1))
+        .join(" ") || "My";
+    return `${titled}'s workspace`;
+}
+/**
+ * Check whether the user has a pending invitation. If so, auto-create
+ * MUST be skipped — otherwise we'd provision a personal org for them
+ * before they ever see the inviter's org in the RequireActiveOrg
+ * accept-invite pane, and they'd never join the team that invited them.
+ */
+async function hasPendingInvitation(exec, email) {
+    try {
+        const { rows } = await exec.execute({
+            sql: `SELECT 1 FROM org_invitations WHERE LOWER(email) = ? AND status = 'pending' LIMIT 1`,
+            args: [email.toLowerCase()],
+        });
+        return rows.length > 0;
+    }
+    catch {
+        // If we can't tell, err on the side of NOT auto-creating — the
+        // RequireActiveOrg client guard will surface the situation.
+        return true;
+    }
+}
+async function hasDomainMatch(exec, email) {
+    try {
+        const domain = email.split("@")[1]?.toLowerCase();
+        if (!domain)
+            return false;
+        const { rows } = await exec.execute({
+            sql: `SELECT 1 FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,
+            args: [domain],
+        });
+        return rows.length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+/** Stale-claim threshold. A claim row this old is treated as abandoned
+ *  (process crashed, DELETE failed, etc.) and a new caller may take it
+ *  over. Long enough that two genuine concurrent first-loads don't
+ *  trample each other (those settle in milliseconds), short enough that
+ *  a stuck user recovers on their next navigation. */
+const CLAIM_TTL_MS = 5 * 60 * 1000;
+/**
+ * Attempt to provision a default org + owner membership for a user with
+ * zero memberships.
+ *
+ * Race protection: claims the user's auto-create slot via an atomic
+ * INSERT into the framework `settings` table (PRIMARY KEY (key) — so
+ * concurrent inserts for the same key throw uniqueness violations on
+ * both SQLite and Postgres). Only the request that wins the claim
+ * proceeds to create the org; losers bail. By the time a losing
+ * request retries on a subsequent navigation, the winner's org is in
+ * `org_members` and the auto-create branch is skipped entirely.
+ *
+ * Stuck-state recovery: a stale claim (held longer than CLAIM_TTL_MS)
+ * is reclaimed automatically. So even if the DELETE on the failure
+ * path fails (network blip, DB error), the user isn't stranded — the
+ * next request after the TTL elapses retries cleanly.
+ *
+ * Returns null on any failure so the caller can fall back to the
+ * empty-context / client-guard path.
+ */
+async function tryCreateDefaultOrg(exec, email, session) {
+    // Make sure the framework `settings` table exists before we use it as
+    // a claim primitive. getSetting() ensures the table on first call.
+    await getSetting("__init").catch(() => null);
+    const claimKey = `u:${email.toLowerCase()}:auto-create-claim`;
+    if (!(await acquireClaim(exec, claimKey)))
+        return null;
+    // Pending-invite check happens INSIDE the claim so the window where a
+    // newly-arrived invitation can be missed is narrowed to a single SQL
+    // round-trip. (A still-narrower window would require a transaction
+    // spanning org_invitations and settings — out of scope.)
+    if (await hasPendingInvitation(exec, email)) {
+        await releaseClaim(exec, claimKey);
+        return null;
+    }
+    if (await hasDomainMatch(exec, email)) {
+        await releaseClaim(exec, claimKey);
+        return null;
+    }
+    try {
+        const orgId = nanoid();
+        const orgName = defaultOrgName(email, session);
+        const now = Date.now();
+        await exec.execute({
+            sql: `INSERT INTO organizations (id, name, created_by, created_at) VALUES (?, ?, ?, ?)`,
+            args: [orgId, orgName, email, now],
+        });
+        await exec.execute({
+            sql: `INSERT INTO org_members (id, org_id, email, role, joined_at) VALUES (?, ?, ?, ?, ?)`,
+            args: [nanoid(), orgId, email, "owner", now],
+        });
+        await putUserSetting(email, "active-org-id", { orgId });
+        return { email, orgId, orgName, role: "owner" };
+    }
+    catch {
+        await releaseClaim(exec, claimKey);
+        return null;
+    }
+}
+async function acquireClaim(exec, claimKey) {
+    const now = Date.now();
+    try {
+        await exec.execute({
+            sql: `INSERT INTO settings (key, value, updated_at) VALUES (?, ?, ?)`,
+            args: [claimKey, JSON.stringify({ at: now }), now],
+        });
+        return true;
+    }
+    catch {
+        // Conflict — someone else's claim is already in the row. If it's
+        // stale (older than CLAIM_TTL_MS) we take it over.
+        //
+        // CRITICAL: this MUST be a single atomic UPDATE guarded on
+        // `updated_at <= staleThreshold`. A read-then-DELETE-then-INSERT
+        // sequence lets two concurrent reclaimers each observe the stale
+        // timestamp, delete each other's fresh claim, and both think they
+        // won — duplicating org creation. The conditional UPDATE matches
+        // each stale row at most once: only the first writer sees
+        // rowsAffected === 1; the row's updated_at is now `now`, so any
+        // subsequent UPDATE no longer satisfies `updated_at <= staleThreshold`
+        // and matches zero rows.
+        const staleThreshold = now - CLAIM_TTL_MS;
+        const result = (await exec.execute({
+            sql: `UPDATE settings SET value = ?, updated_at = ? WHERE key = ? AND updated_at <= ?`,
+            args: [JSON.stringify({ at: now }), now, claimKey, staleThreshold],
+        }));
+        return (result.rowsAffected ?? 0) > 0;
+    }
+}
+async function releaseClaim(exec, claimKey) {
+    // Best-effort. If this fails (transient network/DB error), the
+    // CLAIM_TTL_MS-based takeover in acquireClaim recovers automatically
+    // on a future request — no permanent stuck state.
+    await exec
+        .execute({ sql: `DELETE FROM settings WHERE key = ?`, args: [claimKey] })
+        .catch(() => { });
+}
+/**
+ * Look up the `allowed_domain` for an org by its ID.
+ * Used when making outbound A2A calls so the JWT includes the
+ * caller's org domain for cross-app org resolution.
+ */
+export async function getOrgDomain(orgId) {
+    try {
+        const exec = getDbExec();
+        const { rows } = await exec.execute({
+            sql: `SELECT allowed_domain FROM organizations WHERE id = ? LIMIT 1`,
+            args: [orgId],
+        });
+        if (!rows[0])
+            return null;
+        const domain = String(rows[0].allowed_domain || "");
+        return domain || null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Look up the org's A2A secret by org ID.
+ * Used when making outbound A2A calls so the JWT is signed with the
+ * org-specific secret rather than the global A2A_SECRET env var.
+ */
+export async function getOrgA2ASecret(orgId) {
+    try {
+        const exec = getDbExec();
+        const { rows } = await exec.execute({
+            sql: `SELECT a2a_secret FROM organizations WHERE id = ? LIMIT 1`,
+            args: [orgId],
+        });
+        if (!rows[0])
+            return null;
+        const secret = String(rows[0].a2a_secret || "");
+        return secret || null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Look up an org's A2A secret by its `allowed_domain`.
+ * Used on the A2A receiving side: the caller's JWT includes `org_domain`,
+ * and the receiver looks up which local org matches that domain to find
+ * the secret used to verify the JWT signature.
+ */
+export async function getA2ASecretByDomain(domain) {
+    try {
+        const exec = getDbExec();
+        const { rows } = await exec.execute({
+            sql: `SELECT a2a_secret FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,
+            args: [domain.toLowerCase()],
+        });
+        if (!rows[0])
+            return null;
+        const secret = String(rows[0].a2a_secret || "");
+        return secret || null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve a local org by its `allowed_domain`.
+ * Used on the A2A receiving side: the caller sends `org_domain` in the JWT,
+ * and the receiver looks up which local org matches that domain.
+ */
+export async function resolveOrgByDomain(domain) {
+    try {
+        const exec = getDbExec();
+        const { rows } = await exec.execute({
+            sql: `SELECT id, name FROM organizations WHERE LOWER(allowed_domain) = ? LIMIT 1`,
+            args: [domain.toLowerCase()],
+        });
+        if (!rows[0])
+            return null;
+        return {
+            orgId: String(rows[0].id),
+            orgName: String(rows[0].name),
+        };
+    }
+    catch {
+        return null;
+    }
+}
 //# sourceMappingURL=context.js.map

package/dist/org/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/org/context.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAG5C;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAc;IAChD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,iBAAiB,CAAC;IAElD,IAAI,KAAK,KAAK,iBAAiB,EAAE,CAAC;QAChC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IAEzB,IAAI,WAAW,GAIV,EAAE,CAAC;IACR,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE;;;qCAG0B;YAC/B,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SAC5B,CAAC,CAAC;QACH,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YAClC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;YAClC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAY;YAC/B,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC;SACzC,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,gBAAgB,GAAG,CAAC,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,CAAC,CAE9D,CAAC;QACT,IAAI,gBAAgB,EAAE,KAAK,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,KAAK,CAC1C,CAAC;YACF,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO;oBACL,KAAK;oBACL,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;iBAClB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK;QACL,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK;QAC3B,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO;QAC/B,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;KAC1B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/org/context.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGlD,MAAM,aAAa,GAAe;IAChC,KAAK,EAAE,EAAE;IACT,KAAK,EAAE,IAAI;IACX,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,IAAI;CACX,CAAC;AAEF,MAAM,MAAM,GAAG,GAAW,EAAE,CAC1B,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAEhE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAc;IAChD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;IAC7B,mEAAmE;IACnE,gEAAgE;IAChE,0DAA0D;IAC1D,IAAI,CAAC,KAAK;QAAE,OAAO,aAAa,CAAC;IAEjC,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IAEzB,IAAI,WAAW,GAIV,EAAE,CAAC;IACR,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE;;;qCAG0B;YAC/B,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SAC5B,CAAC,CAAC;QACH,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YAClC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;YAClC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAY;YAC/B,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC;SACzC,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC;QACpE,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,8DAA8D;QAC9D,iDAAiD;IACnD,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,gBAAgB,GAAG,CAAC,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,CAAC,CAE9D,CAAC;QACT,IAAI,gBAAgB,EAAE,KAAK,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,KAAK,CAC1C,CAAC;YACF,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO;oBACL,KAAK;oBACL,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;iBAClB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK;QACL,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK;QAC3B,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO;QAC/B,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;KAC1B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAa;IAEb,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,uDAAuD;YAC5D,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SAC5B,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACnD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,gBAAgB,GAAG,CAAC,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,CAAC,CAE9D,CAAC;QACT,IAAI,gBAAgB,EAAE,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YACpE,OAAO,gBAAgB,CAAC,KAAK,CAAC;QAChC,CAAC;QACD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,KAAa,EACb,OAAiC;IAEjC,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACnC,IAAI,IAAI;QAAE,OAAO,GAAG,IAAI,cAAc,CAAC;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,MAAM,GACV,OAAO;SACJ,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAClD,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACvB,OAAO,GAAG,MAAM,cAAc,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAAkC,EAClC,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,qFAAqF;YAC1F,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SAC5B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,4DAA4D;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,IAAkC,EAClC,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QAClD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,qEAAqE;YAC1E,IAAI,EAAE,CAAC,MAAM,CAAC;SACf,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;sDAIsD;AACtD,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,UAAU,mBAAmB,CAChC,IAAkC,EAClC,KAAa,EACb,OAAiC;IAEjC,sEAAsE;IACtE,mEAAmE;IACnE,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAE7C,MAAM,QAAQ,GAAG,KAAK,KAAK,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAE9D,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvD,sEAAsE;IACtE,qEAAqE;IACrE,mEAAmE;IACnE,yDAAyD;IACzD,IAAI,MAAM,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,GAAG,EAAE,kFAAkF;YACvF,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC;SACnC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,GAAG,EAAE,qFAAqF;YAC1F,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;SAC7C,CAAC,CAAC;QAEH,MAAM,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAExD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,IAAkC,EAClC,QAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC;YACjB,GAAG,EAAE,gEAAgE;YACrE,IAAI,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC;SACnD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,mDAAmD;QACnD,EAAE;QACF,2DAA2D;QAC3D,iEAAiE;QACjE,iEAAiE;QACjE,kEAAkE;QAClE,iEAAiE;QACjE,0DAA0D;QAC1D,gEAAgE;QAChE,uEAAuE;QACvE,yBAAyB;QACzB,MAAM,cAAc,GAAG,GAAG,GAAG,YAAY,CAAC;QAC1C,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC;YACjC,GAAG,EAAE,iFAAiF;YACtF,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC;SACnE,CAAC,CAA8B,CAAC;QACjC,OAAO,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,IAAkC,EAClC,QAAgB;IAEhB,+DAA+D;IAC/D,qEAAqE;IACrE,kDAAkD;IAClD,MAAM,IAAI;SACP,OAAO,CAAC,EAAE,GAAG,EAAE,oCAAoC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;SACxE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAa;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,+DAA+D;YACpE,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;QAC7D,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,2DAA2D;YAChE,IAAI,EAAE,CAAC,KAAK,CAAC;SACd,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzD,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,8EAA8E;YACnF,IAAI,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzD,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE,4EAA4E;YACjF,IAAI,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO;YACL,KAAK,EAAE,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,MAAM,CAAE,IAAI,CAAC,CAAC,CAAS,CAAC,IAAI,CAAC;SACvC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/org/handlers.d.ts

@@ -16,6 +16,12 @@ export declare const getMyOrgHandler: import("h3").EventHandlerWithFetch<import(
         orgName: string;
         invitedBy: string;
     }[];
+    domainMatches: {
+        orgId: string;
+        orgName: string;
+    }[];
+    allowedDomain: string;
+    a2aSecret: string;
 }>>;
 /** POST /_agent-native/org — create a new organization */
 export declare const createOrgHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
@@ -59,10 +65,80 @@ export declare const acceptInvitationHandler: import("h3").EventHandlerWithFetch
 export declare const removeMemberHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     success: boolean;
 }>>;
+/** PATCH /_agent-native/org — rename the current organization (owner/admin only) */
+export declare const updateOrgHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    orgId: string;
+    name: any;
+}>>;
 /** PUT /_agent-native/org/switch — switch the user's active organization */
 export declare const switchOrgHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     orgId: any;
     orgName: string;
     role: OrgRole;
 }>>;
+/** POST /_agent-native/org/join-by-domain — join an org whose allowed_domain matches your email */
+export declare const joinByDomainHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    orgId: any;
+    orgName: string;
+    role: OrgRole;
+}>>;
+/** PUT /_agent-native/org/domain — set or clear the allowed email domain (owner/admin only) */
+export declare const setDomainHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    domain: any;
+}>>;
+/** PUT /_agent-native/org/a2a-secret — regenerate or set the org's A2A secret (owner/admin only) */
+export declare const setA2ASecretHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    a2aSecret: any;
+    previousSecret: string;
+}>>;
+/**
+ * POST /_agent-native/org/a2a-secret/sync — push the org's A2A secret to all
+ * connected apps so cross-app delegation works without manual copy/paste.
+ *
+ * Auth: standard session — owner/admin only.
+ *
+ * For each discovered agent, signs a JWT with the org's CURRENT a2a_secret
+ * and POSTs to `<app>/_agent-native/org/a2a-secret/receive` with the same
+ * secret + the org's domain. The receiving app verifies the JWT using its
+ * own copy of the secret (peers must already share a secret to be trusted)
+ * — for the first-ever sync this means at least one peer must already hold
+ * the secret, which is the bootstrap. For ongoing rotation, regenerate
+ * locally and call sync immediately; sync signs with the secret that's
+ * currently in DB, which the peers still have.
+ *
+ * Body (optional): { signSecret?: string } — sign the outbound JWTs with
+ * this secret instead of the org's current secret. Used by the regenerate-
+ * then-sync flow: regenerate stores the NEW secret, but sync needs to
+ * authenticate using the OLD one that peers still hold. Owner/admin only,
+ * gated by the session.
+ */
+export declare const syncA2ASecretHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    total: number;
+    succeeded: number;
+    failed: number;
+    results: {
+        id: string;
+        name: string;
+        url: string;
+        ok: boolean;
+        status?: number;
+        error?: string;
+    }[];
+}>>;
+/**
+ * POST /_agent-native/org/a2a-secret/receive — accept a secret push from a
+ * connected agent-native app. Auth-exempt at the route guard; we verify a
+ * JWT signed by the calling app using OUR copy of the org's a2a_secret. If
+ * verification succeeds the calling app is a trusted peer and we overwrite
+ * our local org's secret with the supplied value.
+ *
+ * Body: { secret: string, orgDomain: string }
+ *
+ * Header: Authorization: Bearer <JWT signed with the existing shared
+ * a2a_secret, with `org_domain` matching the body's orgDomain>.
+ */
+export declare const receiveA2ASecretHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    ok: boolean;
+    orgId: string;
+}>>;
 //# sourceMappingURL=handlers.d.ts.map

package/dist/org/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/org/handlers.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AA2B1C,2FAA2F;AAC3F,eAAO,MAAM,eAAe;;;;;;;cAwBA,OAAO;;;;;;;;;GA0BjC,CAAC;AAEH,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB;;;;GA8B3B,CAAC;AAEH,wDAAwD;AACxD,eAAO,MAAM,kBAAkB;;;cAWH,OAAO;;;GAIjC,CAAC;AAEH,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;GAwEnC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,sBAAsB;;;;;;;;GAqBlC,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB;;;UAiD8B,OAAO;GAkBxE,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,mBAAmB;;GA4C/B,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,gBAAgB;;;UAkCC,OAAO;GAEnC,CAAC"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/org/handlers.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AA2B1C,2FAA2F;AAC3F,eAAO,MAAM,eAAe;;;;;;;cAaA,OAAO;;;;;;;;;;eAIC,MAAM;iBAAW,MAAM;;;;GAoEzD,CAAC;AAEH,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB;;;;GAkC3B,CAAC;AAEH,wDAAwD;AACxD,eAAO,MAAM,kBAAkB;;;cAWH,OAAO;;;GAIjC,CAAC;AAEH,mEAAmE;AACnE,eAAO,MAAM,uBAAuB;;;;;;GA+EnC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,sBAAsB;;;;;;;;GAqBlC,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB;;;UAmD8B,OAAO;GAkBxE,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,mBAAmB;;GA2D/B,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,gBAAgB;;;GA4B3B,CAAC;AAEH,4EAA4E;AAC5E,eAAO,MAAM,gBAAgB;;;UAkCC,OAAO;GAEnC,CAAC;AAEH,mGAAmG;AACnG,eAAO,MAAM,mBAAmB;;;UAqDR,OAAO;GAG9B,CAAC;AAEF,+FAA+F;AAC/F,eAAO,MAAM,gBAAgB;;GA2C3B,CAAC;AAEH,oGAAoG;AACpG,eAAO,MAAM,mBAAmB;;;GA0C/B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,oBAAoB;;;;;YA2DvB,MAAM;cACJ,MAAM;aACP,MAAM;YACP,OAAO;iBACF,MAAM;gBACP,MAAM;;GAyDnB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB;;;GAgGnC,CAAC"}