refactor: Read org_id claim instead of organization_id for agent access tokens

src/agents/agents.spec.ts

@@ -15,7 +15,7 @@ const ACCESS_TOKEN_PAYLOAD = {
   aud: 'proj_123',
   sub: 'agent_reg_01EHZNVPK3SFK441A1RGBFSHRT',
   jti: '01EHZNVPK3SFK441A1RGBFSHRT',
-  organization_id: 'org_01EHZNVPK3SFK441A1RGBFSHRT',
+  org_id: 'org_01EHZNVPK3SFK441A1RGBFSHRT',
   scope: 'read write',
   exp: 4102444800, // 2100-01-01T00:00:00Z
   iat: 1689646039,
@@ -225,7 +225,7 @@ describe('Agents', () => {
 
       it('reports invalid for a token missing the agent identity claims', async () => {
         // A token signed by the same JWKS with the right audience but without
-        // the agent claims (sub/jti/organization_id) is not an agent credential.
+        // the agent claims (sub/jti/org_id) is not an agent credential.
         const { sub, ...withoutSub } = ACCESS_TOKEN_PAYLOAD;
         jest
           .mocked(jose.jwtVerify)

src/agents/agents.ts

@@ -30,7 +30,7 @@ function hasRequiredAgentClaims(
     (typeof payload.aud === 'string' || Array.isArray(payload.aud)) &&
     typeof payload.sub === 'string' &&
     typeof payload.jti === 'string' &&
-    typeof payload.organization_id === 'string' &&
+    typeof payload.org_id === 'string' &&
     typeof payload.exp === 'number' &&
     typeof payload.iat === 'number'
   );

src/agents/interfaces/validate-agent-credential.interface.ts

@@ -79,7 +79,7 @@ export interface SerializedAgentAccessTokenClaims {
   aud: string | string[];
   sub: string;
   jti: string;
-  organization_id: string;
+  org_id: string;
   exp: number;
   iat: number;
   scope?: string;

src/agents/serializers/validate-agent-credential.serializer.ts

@@ -50,7 +50,7 @@ export function deserializeAgentAccessTokenClaims(
     audience: payload.aud,
     registrationId: payload.sub,
     jti: payload.jti,
-    organizationId: payload.organization_id,
+    organizationId: payload.org_id,
     scope: payload.scope,
     actor: payload.act,
     expiresAt: payload.exp,