@a2a-exposed/control-core 0.7.33 → 0.8.1

package/dist/index.js

@@ -1,6 +1,6 @@
 /* @a2a-exposed/control-core */
 
-// src/auth/origin.ts
+// src/tenants/approval.ts
 function httpsOrigin(value) {
   const raw = (value || "").trim();
   if (!raw) return "";
@@ -12,10 +12,6 @@ function httpsOrigin(value) {
     return "";
   }
 }
-
-// src/oidc/issuer.ts
-var CODE_TTL_MS = 10 * 60 * 1e3;
-var COOKIE_TTL_S = 10 * 60;
 function bytes(size) {
   const out = new Uint8Array(size);
   crypto.getRandomValues(out);
@@ -775,160 +771,537 @@ var routes = {
   tenants: "/api/v1/tenants"
 };
 
-// src/provision/cloudflare-api.ts
-var API = "https://api.cloudflare.com/client/v4";
-var SECRET_PARAM = /\b(?:id_token|access_token|refresh_token|client_secret|authorization|code|token)\s*(?:=|%3d|:)\s*\S/i;
-var JWT_SHAPED = /\beyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/;
-function sanitizeCloudflareText(value) {
-  const cleaned = value.replace(/[\u0000-\u001f]/g, " ").replace(/\s+/g, " ").trim().slice(0, 300);
-  if (!cleaned) return "";
-  if (SECRET_PARAM.test(cleaned) || /bearer\s+\S/i.test(cleaned) || JWT_SHAPED.test(cleaned)) return "redacted";
-  return cleaned;
+// src/provision/grant.ts
+var TOKEN = "https://dash.cloudflare.com/oauth2/token";
+var INFO2 = "cloudflare-refresh v1";
+var SALT2 = "a2a-exposed";
+var MAX_REFRESH = 4096;
+var LOCK_MS = 15e3;
+function b642(bytes2) {
+  let raw = "";
+  for (let i = 0; i < bytes2.length; i += 32768) raw += String.fromCharCode(...bytes2.subarray(i, i + 32768));
+  return btoa(raw);
 }
-function headerSafeToken(token) {
-  return token.replace(/[\r\n\u0000]/g, "").trim();
+function unb642(value) {
+  return Uint8Array.from(atob(value), (char) => char.charCodeAt(0));
 }
-function numericCode(value) {
-  return typeof value === "number" && Number.isFinite(value) ? value : null;
+async function derive2(secret, userId) {
+  if (secret.length < 32 || !userId) return null;
+  const base = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), "HKDF", false, ["deriveKey"]);
+  return crypto.subtle.deriveKey(
+    { name: "HKDF", hash: "SHA-256", salt: new TextEncoder().encode(SALT2), info: new TextEncoder().encode(`${INFO2}\0${userId}`) },
+    base,
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["encrypt", "decrypt"]
+  );
 }
-function errorText(item) {
-  const record = item;
-  const parts = [];
-  if (typeof record.message === "string") parts.push(record.message);
-  if (Array.isArray(record.error_chain)) {
-    for (const link of record.error_chain) {
-      if (!link || typeof link !== "object") continue;
-      const message = link.message;
-      if (typeof message === "string") parts.push(message);
-    }
-  }
-  return sanitizeCloudflareText(parts.join(" \u2014 "));
+async function sealCloudflareRefresh(secret, userId, token) {
+  if (!token || token.length > MAX_REFRESH) return null;
+  const key = await derive2(secret, userId);
+  if (!key) return null;
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const ct = new Uint8Array(await crypto.subtle.encrypt(
+    { name: "AES-GCM", iv, additionalData: new TextEncoder().encode(userId) },
+    key,
+    new TextEncoder().encode(token)
+  ));
+  return `v1.${b642(iv)}.${b642(ct)}`;
 }
-function cloudflareErrors(body) {
-  if (!body || typeof body !== "object") return [];
-  const errors = body.errors;
-  if (!Array.isArray(errors)) return [];
-  const out = [];
-  for (const item of errors.slice(0, 8)) {
-    if (!item || typeof item !== "object") continue;
-    out.push({ code: numericCode(item.code), message: errorText(item) });
+async function openCloudflareRefresh(secret, userId, sealed) {
+  if (!sealed) return null;
+  const key = await derive2(secret, userId);
+  if (!key) return null;
+  const [version, iv, ct, extra] = sealed.split(".");
+  if (version !== "v1" || !iv || !ct || extra !== void 0) return null;
+  try {
+    const plain = new TextDecoder().decode(await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: unb642(iv), additionalData: new TextEncoder().encode(userId) },
+      key,
+      unb642(ct)
+    ));
+    if (!plain || plain.length > MAX_REFRESH) return null;
+    return plain;
+  } catch {
+    return null;
   }
-  return out;
 }
-function failureFrom(status, body, thrown) {
-  const errors = cloudflareErrors(body);
-  return { ok: false, status, code: errors.find((error) => error.code != null)?.code ?? null, errors, ...thrown ? { thrown } : {} };
+function expiresAt(expiresIn, now) {
+  const seconds = typeof expiresIn === "number" ? expiresIn : typeof expiresIn === "string" ? Number(expiresIn) : NaN;
+  if (!Number.isFinite(seconds) || seconds <= 0 || seconds > 365 * 24 * 60 * 60) return null;
+  return new Date(now + seconds * 1e3).toISOString();
 }
-function thrownFailure(error) {
-  const name = error instanceof Error && error.name ? error.name.slice(0, 80) : "Error";
-  const message = sanitizeCloudflareText(error instanceof Error ? error.message : "");
-  return { ok: false, status: 0, code: null, errors: [], thrown: { name, message } };
+async function saveCloudflareGrant(db, secret, input) {
+  const now = input.now ?? Date.now();
+  const stamp = new Date(now).toISOString();
+  const refresh = input.refreshToken ? await sealCloudflareRefresh(secret, input.userId, input.refreshToken) : null;
+  await db.prepare(
+    `INSERT INTO cloudflare_grant ("userId", "accountId", choice, host, requested_scope, granted_scope, refresh_enc, access_expires_at, created_at, updated_at)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+		 ON CONFLICT ("userId") DO UPDATE SET
+		   "accountId" = excluded."accountId",
+		   choice = excluded.choice,
+		   host = excluded.host,
+		   requested_scope = excluded.requested_scope,
+		   granted_scope = excluded.granted_scope,
+		   refresh_enc = excluded.refresh_enc,
+		   access_expires_at = excluded.access_expires_at,
+		   updated_at = excluded.updated_at`
+  ).bind(
+    input.userId,
+    input.accountId,
+    input.choice,
+    input.host,
+    input.requestedScope,
+    input.grantedScope,
+    refresh,
+    expiresAt(input.expiresIn, now),
+    stamp,
+    stamp
+  ).run();
 }
-var PERMISSION_CODES = /* @__PURE__ */ new Set([1e4, 7403]);
-var NO_ACCESS = "no access to the specified resource";
-function permissionNotReady(failure) {
-  if (failure.code != null && PERMISSION_CODES.has(failure.code)) return true;
-  return failure.errors.some((error) => error.code != null && PERMISSION_CODES.has(error.code) || error.message.toLowerCase().includes(NO_ACCESS));
+async function readCloudflareGrant(db, userId) {
+  if (!userId) return null;
+  return db.prepare(
+    `SELECT "userId" AS userId, "accountId" AS accountId, choice, host, requested_scope, granted_scope, refresh_enc, access_expires_at
+		 FROM cloudflare_grant WHERE "userId" = ?`
+  ).bind(userId).first();
 }
-function subdomainMissing(failure) {
-  if (failure.status === 404) return true;
-  return failure.errors.some((error) => error.code === 10063 || error.code === 10007 || /workers\.dev/i.test(error.message) && /subdomain|register|not found|does not have/i.test(error.message));
+async function deleteCloudflareGrant(db, userId) {
+  if (!userId) return;
+  await db.prepare(`DELETE FROM cloudflare_grant WHERE "userId" = ?`).bind(userId).run();
 }
-function describeCfFailure(failure) {
-  if (failure.thrown) {
-    const detail = failure.thrown.message && failure.thrown.message !== "redacted" ? `${failure.thrown.name}: ${failure.thrown.message}` : failure.thrown.name;
-    return `The request stops before Cloudflare answers (${detail}).`;
-  }
-  const parts = [];
-  for (const error of failure.errors) {
-    if (error.message === "redacted") {
-      parts.push(error.code != null ? `code ${error.code}. Cloudflare's message is hidden because it contains a secret.` : "Cloudflare's message is hidden because it contains a secret.");
-    } else if (error.code != null && error.message) parts.push(`code ${error.code}: ${error.message}`);
-    else if (error.code != null) parts.push(`code ${error.code}`);
-    else if (error.message) parts.push(error.message);
-  }
-  if (parts.length) return `Cloudflare says ${parts.join("; ")}.`;
-  if (failure.status) return `Cloudflare answers HTTP ${failure.status}.`;
-  return "The request stops before Cloudflare answers.";
+function randomId() {
+  const buf = new Uint8Array(16);
+  crypto.getRandomValues(buf);
+  return [...buf].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
-function callFetch(fetchImpl, url, init) {
-  return fetchImpl.call(globalThis, url, init);
+async function claimLock(db, userId, holder, now) {
+  const result = await db.prepare(
+    `INSERT INTO control_locks (name, holder, expires_ms) VALUES (?, ?, ?)
+		 ON CONFLICT(name) DO UPDATE SET holder = excluded.holder, expires_ms = excluded.expires_ms
+		 WHERE control_locks.expires_ms <= ?`
+  ).bind(`cf-refresh:${userId}`, holder, now + LOCK_MS, now).run();
+  return result.meta?.changes === 1;
 }
-async function cfCall(input) {
-  const method = input.method.toUpperCase();
-  let body;
-  const headers = new Headers({ accept: "application/json" });
-  try {
-    headers.set("authorization", `Bearer ${headerSafeToken(input.token)}`);
-  } catch (error) {
-    return thrownFailure(error);
-  }
-  if (input.raw) {
-    headers.set("content-type", input.raw.contentType);
-    body = input.raw.body;
-  } else if (input.json !== void 0) {
-    headers.set("content-type", "application/json");
-    body = JSON.stringify(input.json);
-  }
-  const init = {
-    method,
-    headers,
-    redirect: "manual",
-    signal: AbortSignal.timeout(input.fetchMs)
+async function releaseLock(db, userId, holder) {
+  await db.prepare(
+    `UPDATE control_locks SET holder = '', expires_ms = 0 WHERE name = ? AND holder = ?`
+  ).bind(`cf-refresh:${userId}`, holder).run();
+}
+async function clearRefresh(db, userId, now) {
+  await db.prepare(
+    `UPDATE cloudflare_grant SET refresh_enc = NULL, updated_at = ? WHERE "userId" = ?`
+  ).bind(new Date(now).toISOString(), userId).run();
+}
+async function postRefresh(body, fetchMs, fetchImpl) {
+  const timeout = AbortSignal.timeout(fetchMs);
+  let rejectDeadline = () => {
   };
-  if (body !== void 0 && method !== "GET" && method !== "HEAD") init.body = body;
-  let response;
+  const deadline = new Promise((_, reject) => {
+    rejectDeadline = reject;
+  });
+  const timer = setTimeout(() => rejectDeadline(new DOMException("The operation was aborted", "TimeoutError")), fetchMs);
   try {
-    response = await callFetch(input.fetchImpl, `${API}${input.path}`, init);
-  } catch (error) {
-    return thrownFailure(error);
-  }
-  if (response.status >= 300 && response.status < 400) {
-    void response.body?.cancel().catch(() => {
-    });
-    return failureFrom(response.status, null);
-  }
-  const text = await response.text().catch(() => "");
-  let parsed = null;
-  if (text) {
+    const request = fetchImpl(TOKEN, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+      body,
+      signal: timeout
+    }).then(
+      (response) => ({ response, failed: false }),
+      () => ({ response: null, failed: true })
+    );
+    let winner;
     try {
-      parsed = JSON.parse(text);
+      winner = await Promise.race([request, deadline]);
     } catch {
-      parsed = null;
+      return { kind: "deadline" };
+    }
+    if (winner.failed || !winner.response) return timeout.aborted ? { kind: "deadline" } : { kind: "failed" };
+    if (!winner.response.ok) {
+      const status = winner.response.status;
+      void winner.response.body?.cancel().catch(() => {
+      });
+      return status === 400 || status === 401 ? { kind: "rejected", status } : { kind: "failed" };
+    }
+    try {
+      const parsed = await Promise.race([
+        winner.response.json().then((body2) => ({ body: body2, failed: false }), () => ({ body: void 0, failed: true })),
+        deadline
+      ]);
+      if (parsed.failed) return timeout.aborted ? { kind: "deadline" } : { kind: "failed" };
+      return { kind: "ok", body: parsed.body };
+    } catch {
+      return { kind: "deadline" };
     }
+  } finally {
+    clearTimeout(timer);
   }
-  const success = parsed && typeof parsed === "object" ? parsed.success : void 0;
-  if (!response.ok || success === false) return failureFrom(response.status, parsed);
-  return { ok: true, status: response.status, body: parsed };
-}
-function resultObject(body) {
-  if (!body || typeof body !== "object") return null;
-  const result = body.result;
-  return result && typeof result === "object" && !Array.isArray(result) ? result : null;
-}
-async function listWorkerNames(input) {
-  const read = await cfCall({
-    fetchImpl: input.fetchImpl,
-    token: input.token,
-    method: "GET",
-    path: `/accounts/${input.accountId}/workers/scripts?per_page=100`,
-    fetchMs: input.fetchMs
-  });
-  if (!read.ok) return { ok: false };
-  const names = resultList(read.body).map((row) => typeof row.id === "string" ? row.id : "").filter((name) => name.length > 0 && name.length <= 64);
-  const info = read.body && typeof read.body === "object" ? read.body.result_info : void 0;
-  const total = typeof info?.total_count === "number" ? info.total_count : names.length;
-  if (total > names.length) return { ok: false };
-  return { ok: true, names };
 }
-function resultList(body) {
-  if (!body || typeof body !== "object") return [];
-  const result = body.result;
-  if (!Array.isArray(result)) return [];
-  return result.filter((row) => Boolean(row) && typeof row === "object");
-}
-function d1Rows(body) {
-  const list = resultList(body);
+async function refreshCloudflareGrant(input) {
+  const now = input.now ?? Date.now();
+  const row = await readCloudflareGrant(input.database, input.userId);
+  if (!row) return { ok: false, error: "no_grant" };
+  if (!row.refresh_enc) return { ok: false, error: "no_refresh" };
+  const holder = randomId();
+  const claimed = await claimLock(input.database, input.userId, holder, now);
+  if (!claimed) return { ok: false, error: "busy" };
+  try {
+    const current = await readCloudflareGrant(input.database, input.userId);
+    const token = await openCloudflareRefresh(input.secret, input.userId, current?.refresh_enc);
+    if (!token) return { ok: false, error: "no_refresh" };
+    const read = await postRefresh(new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: token,
+      client_id: input.clientId,
+      client_secret: input.clientSecret
+    }), input.fetchMs ?? 5e3, input.fetchImpl ?? fetch);
+    if (read.kind === "deadline") return { ok: false, error: "uncertain" };
+    if (read.kind === "rejected") {
+      await clearRefresh(input.database, input.userId, now);
+      return { ok: false, error: "invalid_grant" };
+    }
+    if (read.kind === "failed") return { ok: false, error: "failed" };
+    const body = read.body && typeof read.body === "object" ? read.body : null;
+    const accessToken = typeof body?.access_token === "string" ? body.access_token : "";
+    if (!accessToken) return { ok: false, error: "failed" };
+    const next = typeof body?.refresh_token === "string" ? body.refresh_token : "";
+    const sealed = next ? await sealCloudflareRefresh(input.secret, input.userId, next) : null;
+    if (next && !sealed) {
+      await clearRefresh(input.database, input.userId, now);
+      return { ok: false, error: "unreadable" };
+    }
+    const scope = typeof body?.scope === "string" ? body.scope : current?.requested_scope ?? "";
+    await input.database.prepare(
+      `UPDATE cloudflare_grant SET refresh_enc = ?, granted_scope = COALESCE(?, granted_scope), access_expires_at = ?, updated_at = ? WHERE "userId" = ?`
+    ).bind(
+      sealed,
+      typeof body?.scope === "string" ? body.scope : null,
+      expiresAt(body?.expires_in, now),
+      new Date(now).toISOString(),
+      input.userId
+    ).run();
+    return { ok: true, accessToken, scope };
+  } finally {
+    await releaseLock(input.database, input.userId, holder).catch(() => {
+    });
+  }
+}
+
+// src/provision/setup.ts
+var USER_DETAILS_READ = "user-details.read";
+var ACCOUNT_SETTINGS_READ = "account-settings.read";
+var WORKERS_SCRIPTS_ADMIN = "workers-scripts.admin";
+var D1_WRITE = "d1.write";
+var WORKERS_ROUTES_WRITE = "workers-routes.write";
+var DNS_WRITE = "dns.write";
+var ZONE_READ = "zone.read";
+var TUNNEL_WRITE = "argotunnel.write";
+var OFFLINE_ACCESS = "offline_access";
+var SETUP_NOT_PROVISIONED = "Nothing has been created in your Cloudflare account yet.";
+var TUNNEL_CONNECTOR_LATER = "This page stores the fa\xE7ade choice. Tunnel creation is not implemented on this page.";
+var EVERY_PLAN = "This is available on every plan.";
+var AUTHORIZE = "https://dash.cloudflare.com/oauth2/auth";
+function parseSetupChoice(value) {
+  return value === "inbox" || value === "facade" || value === "both" ? value : null;
+}
+function parseSetupHost(value) {
+  return value === "workers" || value === "zone" ? value : null;
+}
+function includesInbox(choice) {
+  return choice === "inbox" || choice === "both";
+}
+function includesFacade(choice) {
+  return choice === "facade" || choice === "both";
+}
+function variant(choice) {
+  if (choice === "inbox") return "a new inbox";
+  if (choice === "facade") return "the fa\xE7ade";
+  return "the new inbox and the fa\xE7ade";
+}
+function setupSummary(choice, host) {
+  const what = choice === "inbox" ? "give your agent a public A2A address" : choice === "facade" ? "make an agent you already run reachable by other agents" : "give your agent a public A2A address and make an agent you already run reachable";
+  const where = host === "workers" ? "a free Cloudflare address such as my-agent.yourname.workers.dev" : "your own domain, such as agent.example.com";
+  return `You chose to ${what}, on ${where}.`;
+}
+function setupScopes(choice, host) {
+  const inbox = includesInbox(choice);
+  const facade = includesFacade(choice);
+  const zone = host === "zone";
+  const scopes = [
+    {
+      id: USER_DETAILS_READ,
+      name: "User Details Read",
+      why: "Confirms which Cloudflare user this is.",
+      declined: "Without User Details Read, Cloudflare did not confirm the user. Choose the setup again."
+    },
+    {
+      id: ACCOUNT_SETTINGS_READ,
+      name: "Account Settings Read",
+      why: "Reads the Cloudflare account you pick on the consent screen.",
+      declined: "Without Account Settings Read, this dashboard cannot see which Cloudflare account you picked, so this setup cannot continue."
+    },
+    {
+      id: WORKERS_SCRIPTS_ADMIN,
+      name: "Workers Admin",
+      why: facade && !inbox ? "Uploads the fa\xE7ade Worker into your account." : facade ? "Uploads the inbox Worker and the fa\xE7ade Worker into your account." : "Uploads the inbox Worker into your account.",
+      declined: `Without Workers Admin, the Worker cannot be uploaded. Connect again to grant it. That blocks ${variant(choice)}.`
+    },
+    {
+      id: D1_WRITE,
+      name: "D1 Write",
+      why: "Creates the D1 database that Worker uses.",
+      declined: `Without D1 Write, the database cannot be created. That blocks ${variant(choice)}.`
+    }
+  ];
+  if (zone) {
+    scopes.push(
+      {
+        id: WORKERS_ROUTES_WRITE,
+        name: "Workers Routes Write",
+        why: "Attaches the Worker to a hostname on a domain you already have in Cloudflare.",
+        declined: "Without Workers Routes Write, the Worker cannot be attached to a hostname on your domain. That blocks a setup on your own domain. A free address is set up with the permissions that address needs."
+      },
+      {
+        id: DNS_WRITE,
+        name: "DNS Write",
+        why: "Creates the DNS record for that hostname.",
+        declined: "Without DNS Write, the DNS record for your domain cannot be created. That blocks a setup on your own domain. A free address is set up with the permissions that address needs."
+      },
+      {
+        id: ZONE_READ,
+        name: "Zone Read",
+        why: "Lists the domains on the Cloudflare account you pick, so this page can check that your address is on one of them.",
+        declined: "Without Zone Read, the domains on your Cloudflare account cannot be listed. That blocks a setup on your own domain. A free address is set up with the permissions that address needs."
+      }
+    );
+  }
+  if (facade) {
+    scopes.push({
+      id: TUNNEL_WRITE,
+      name: "Cloudflare Tunnel Write",
+      why: "Creates a tunnel from the fa\xE7ade Worker to your existing agent. You still run cloudflared on a machine you control.",
+      declined: inbox ? "Without Cloudflare Tunnel Write, a tunnel cannot be created. That blocks the fa\xE7ade. The inbox is created without a tunnel." : "Without Cloudflare Tunnel Write, a tunnel cannot be created. That blocks the fa\xE7ade."
+    });
+  }
+  scopes.push({
+    id: OFFLINE_ACCESS,
+    name: "Refresh token (offline access)",
+    why: "Lets this dashboard continue the setup after you leave this page. The token is stored encrypted. Cloudflare treats it as single-use.",
+    declined: "Connect again and keep the refresh token to continue after you leave this page. Nothing has been created in your Cloudflare account."
+  });
+  return scopes;
+}
+function consentScope(choice, host) {
+  return setupScopes(choice, host).map((scope) => scope.id).join(" ");
+}
+function cloudflareAuthorizeUrl(input) {
+  const url = new URL(AUTHORIZE);
+  url.searchParams.set("client_id", input.clientId);
+  url.searchParams.set("redirect_uri", input.redirectUri);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("scope", input.scope);
+  url.searchParams.set("state", input.state);
+  url.searchParams.set("code_challenge", input.codeChallenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  return url.href;
+}
+function grantedScopeSet(scope) {
+  if (scope == null) return { known: false, granted: /* @__PURE__ */ new Set() };
+  const granted = new Set(scope.split(/[\s,]+/).map((part) => part.trim()).filter(Boolean));
+  return { known: true, granted };
+}
+function inboxCanProvision(row) {
+  const choice = parseSetupChoice(row.choice);
+  const host = parseSetupHost(row.host);
+  if (!choice || !host) return false;
+  return grantCoversInbox(row, choice, host);
+}
+function grantCoversInbox(row, choice, host) {
+  if (!includesInbox(choice) || !row.refresh_enc) return false;
+  const { known, granted } = grantedScopeSet(row.granted_scope);
+  if (!known) return false;
+  return setupScopes(choice, host).every((scope) => scope.id === TUNNEL_WRITE || granted.has(scope.id));
+}
+function describeSetupGrant(row) {
+  const choice = parseSetupChoice(row.choice);
+  const host = parseSetupHost(row.host);
+  if (!choice || !host) return null;
+  const requested = setupScopes(choice, host);
+  const { known, granted } = grantedScopeSet(row.granted_scope);
+  const lines = requested.map((scope) => ({
+    name: scope.name,
+    why: scope.why,
+    state: !known ? "unknown" : granted.has(scope.id) ? "granted" : "declined"
+  }));
+  const blocked = !known ? ["Cloudflare did not say which permissions were granted, so this setup is not confirmed."] : requested.filter((scope) => !granted.has(scope.id)).map((scope) => scope.declined);
+  return {
+    summary: setupSummary(choice, host),
+    lines,
+    blocked,
+    refreshSaved: Boolean(row.refresh_enc),
+    facade: includesFacade(choice),
+    inbox: includesInbox(choice),
+    host,
+    needsReconnect: !known || !granted.has(WORKERS_SCRIPTS_ADMIN)
+  };
+}
+
+// src/provision/cloudflare-api.ts
+var API = "https://api.cloudflare.com/client/v4";
+var SECRET_PARAM = /\b(?:id_token|access_token|refresh_token|client_secret|authorization|code|token)\s*(?:=|%3d|:)\s*\S/i;
+var JWT_SHAPED = /\beyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/;
+function sanitizeCloudflareText(value) {
+  const cleaned = value.replace(/[\u0000-\u001f]/g, " ").replace(/\s+/g, " ").trim().slice(0, 300);
+  if (!cleaned) return "";
+  if (SECRET_PARAM.test(cleaned) || /bearer\s+\S/i.test(cleaned) || JWT_SHAPED.test(cleaned)) return "redacted";
+  return cleaned;
+}
+function headerSafeToken(token) {
+  return token.replace(/[\r\n\u0000]/g, "").trim();
+}
+function numericCode(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function errorText(item) {
+  const record = item;
+  const parts = [];
+  if (typeof record.message === "string") parts.push(record.message);
+  if (Array.isArray(record.error_chain)) {
+    for (const link of record.error_chain) {
+      if (!link || typeof link !== "object") continue;
+      const message = link.message;
+      if (typeof message === "string") parts.push(message);
+    }
+  }
+  return sanitizeCloudflareText(parts.join(" \u2014 "));
+}
+function cloudflareErrors(body) {
+  if (!body || typeof body !== "object") return [];
+  const errors = body.errors;
+  if (!Array.isArray(errors)) return [];
+  const out = [];
+  for (const item of errors.slice(0, 8)) {
+    if (!item || typeof item !== "object") continue;
+    out.push({ code: numericCode(item.code), message: errorText(item) });
+  }
+  return out;
+}
+function failureFrom(status, body, thrown) {
+  const errors = cloudflareErrors(body);
+  return { ok: false, status, code: errors.find((error) => error.code != null)?.code ?? null, errors, ...thrown ? { thrown } : {} };
+}
+function thrownFailure(error) {
+  const name = error instanceof Error && error.name ? error.name.slice(0, 80) : "Error";
+  const message = sanitizeCloudflareText(error instanceof Error ? error.message : "");
+  return { ok: false, status: 0, code: null, errors: [], thrown: { name, message } };
+}
+var PERMISSION_CODES = /* @__PURE__ */ new Set([1e4, 7403]);
+var NO_ACCESS = "no access to the specified resource";
+function permissionNotReady(failure) {
+  if (failure.code != null && PERMISSION_CODES.has(failure.code)) return true;
+  return failure.errors.some((error) => error.code != null && PERMISSION_CODES.has(error.code) || error.message.toLowerCase().includes(NO_ACCESS));
+}
+function subdomainMissing(failure) {
+  if (failure.status === 404) return true;
+  return failure.errors.some((error) => error.code === 10063 || error.code === 10007 || /workers\.dev/i.test(error.message) && /subdomain|register|not found|does not have/i.test(error.message));
+}
+function describeCfFailure(failure) {
+  if (failure.thrown) {
+    const detail = failure.thrown.message && failure.thrown.message !== "redacted" ? `${failure.thrown.name}: ${failure.thrown.message}` : failure.thrown.name;
+    return `The request stops before Cloudflare answers (${detail}).`;
+  }
+  const parts = [];
+  for (const error of failure.errors) {
+    if (error.message === "redacted") {
+      parts.push(error.code != null ? `code ${error.code}. Cloudflare's message is hidden because it contains a secret.` : "Cloudflare's message is hidden because it contains a secret.");
+    } else if (error.code != null && error.message) parts.push(`code ${error.code}: ${error.message}`);
+    else if (error.code != null) parts.push(`code ${error.code}`);
+    else if (error.message) parts.push(error.message);
+  }
+  if (parts.length) return `Cloudflare says ${parts.join("; ")}.`;
+  if (failure.status) return `Cloudflare answers HTTP ${failure.status}.`;
+  return "The request stops before Cloudflare answers.";
+}
+function callFetch(fetchImpl, url, init) {
+  return fetchImpl.call(globalThis, url, init);
+}
+async function cfCall(input) {
+  const method = input.method.toUpperCase();
+  let body;
+  const headers = new Headers({ accept: "application/json" });
+  try {
+    headers.set("authorization", `Bearer ${headerSafeToken(input.token)}`);
+  } catch (error) {
+    return thrownFailure(error);
+  }
+  if (input.raw) {
+    headers.set("content-type", input.raw.contentType);
+    body = input.raw.body;
+  } else if (input.json !== void 0) {
+    headers.set("content-type", "application/json");
+    body = JSON.stringify(input.json);
+  }
+  const init = {
+    method,
+    headers,
+    redirect: "manual",
+    signal: AbortSignal.timeout(input.fetchMs)
+  };
+  if (body !== void 0 && method !== "GET" && method !== "HEAD") init.body = body;
+  let response;
+  try {
+    response = await callFetch(input.fetchImpl, `${API}${input.path}`, init);
+  } catch (error) {
+    return thrownFailure(error);
+  }
+  if (response.status >= 300 && response.status < 400) {
+    void response.body?.cancel().catch(() => {
+    });
+    return failureFrom(response.status, null);
+  }
+  const text = await response.text().catch(() => "");
+  let parsed = null;
+  if (text) {
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      parsed = null;
+    }
+  }
+  const success = parsed && typeof parsed === "object" ? parsed.success : void 0;
+  if (!response.ok || success === false) return failureFrom(response.status, parsed);
+  return { ok: true, status: response.status, body: parsed };
+}
+function resultObject(body) {
+  if (!body || typeof body !== "object") return null;
+  const result = body.result;
+  return result && typeof result === "object" && !Array.isArray(result) ? result : null;
+}
+async function listWorkerNames(input) {
+  const read = await cfCall({
+    fetchImpl: input.fetchImpl,
+    token: input.token,
+    method: "GET",
+    path: `/accounts/${input.accountId}/workers/scripts?per_page=100`,
+    fetchMs: input.fetchMs
+  });
+  if (!read.ok) return { ok: false };
+  const names = resultList(read.body).map((row) => typeof row.id === "string" ? row.id : "").filter((name) => name.length > 0 && name.length <= 64);
+  const info = read.body && typeof read.body === "object" ? read.body.result_info : void 0;
+  const total = typeof info?.total_count === "number" ? info.total_count : names.length;
+  if (total > names.length) return { ok: false };
+  return { ok: true, names };
+}
+function resultList(body) {
+  if (!body || typeof body !== "object") return [];
+  const result = body.result;
+  if (!Array.isArray(result)) return [];
+  return result.filter((row) => Boolean(row) && typeof row === "object");
+}
+function d1Rows(body) {
+  const list = resultList(body);
   const first = list[0];
   const rows = first?.results;
   if (!Array.isArray(rows)) return [];
@@ -1193,219 +1566,34 @@ async function readInboxById(db, inboxId) {
 }
 async function readCloudflareInboxById(db, userId, inboxId) {
   if (!userId || !inboxId) return null;
-  return db.prepare(
-    `SELECT ${COLUMNS} FROM cloudflare_inbox WHERE id = ? AND "userId" = ?`
-  ).bind(inboxId, userId).first();
-}
-async function readCloudflareInbox(db, userId) {
-  const rows = await listCloudflareInboxes(db, userId);
-  const open = rows.find((row) => row.status === "pending" || row.status === "working");
-  if (open) return open;
-  const ready = rows.filter((row) => row.status === "ready");
-  return ready.at(-1) ?? null;
-}
-async function deleteCloudflareInbox(db, userId, inboxId) {
-  if (!userId || !inboxId) return false;
-  const result = await db.prepare(`DELETE FROM cloudflare_inbox WHERE id = ? AND "userId" = ?`).bind(inboxId, userId).run();
-  return result.meta?.changes === 1;
-}
-function cloudflareHostname(row) {
-  if (row.public_url) {
-    try {
-      const url = new URL(row.public_url);
-      if (url.protocol === "https:" && !url.username && !url.password && url.hostname) return url.hostname;
-    } catch {
-    }
-  }
-  if (row.host === "zone" && row.hostname) return row.hostname;
-  if (row.worker_name && row.workers_subdomain) return `${row.worker_name}.${row.workers_subdomain}.workers.dev`;
-  if (row.worker_name) return row.worker_name;
-  return "Setting up";
-}
-
-// src/auth/cloudflare-grant.ts
-var TOKEN = "https://dash.cloudflare.com/oauth2/token";
-var INFO2 = "cloudflare-refresh v1";
-var SALT2 = "a2a-exposed";
-var MAX_REFRESH = 4096;
-var LOCK_MS = 15e3;
-function b642(bytes2) {
-  let raw = "";
-  for (let i = 0; i < bytes2.length; i += 32768) raw += String.fromCharCode(...bytes2.subarray(i, i + 32768));
-  return btoa(raw);
-}
-function unb642(value) {
-  return Uint8Array.from(atob(value), (char) => char.charCodeAt(0));
-}
-async function derive2(secret, userId) {
-  if (secret.length < 32 || !userId) return null;
-  const base = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), "HKDF", false, ["deriveKey"]);
-  return crypto.subtle.deriveKey(
-    { name: "HKDF", hash: "SHA-256", salt: new TextEncoder().encode(SALT2), info: new TextEncoder().encode(`${INFO2}\0${userId}`) },
-    base,
-    { name: "AES-GCM", length: 256 },
-    false,
-    ["encrypt", "decrypt"]
-  );
-}
-async function sealCloudflareRefresh(secret, userId, token) {
-  if (!token || token.length > MAX_REFRESH) return null;
-  const key = await derive2(secret, userId);
-  if (!key) return null;
-  const iv = crypto.getRandomValues(new Uint8Array(12));
-  const ct = new Uint8Array(await crypto.subtle.encrypt(
-    { name: "AES-GCM", iv, additionalData: new TextEncoder().encode(userId) },
-    key,
-    new TextEncoder().encode(token)
-  ));
-  return `v1.${b642(iv)}.${b642(ct)}`;
-}
-async function openCloudflareRefresh(secret, userId, sealed) {
-  if (!sealed) return null;
-  const key = await derive2(secret, userId);
-  if (!key) return null;
-  const [version, iv, ct, extra] = sealed.split(".");
-  if (version !== "v1" || !iv || !ct || extra !== void 0) return null;
-  try {
-    const plain = new TextDecoder().decode(await crypto.subtle.decrypt(
-      { name: "AES-GCM", iv: unb642(iv), additionalData: new TextEncoder().encode(userId) },
-      key,
-      unb642(ct)
-    ));
-    if (!plain || plain.length > MAX_REFRESH) return null;
-    return plain;
-  } catch {
-    return null;
-  }
-}
-function expiresAt(expiresIn, now) {
-  const seconds = typeof expiresIn === "number" ? expiresIn : typeof expiresIn === "string" ? Number(expiresIn) : NaN;
-  if (!Number.isFinite(seconds) || seconds <= 0 || seconds > 365 * 24 * 60 * 60) return null;
-  return new Date(now + seconds * 1e3).toISOString();
-}
-async function readCloudflareGrant(db, userId) {
-  if (!userId) return null;
-  return db.prepare(
-    `SELECT "userId" AS userId, "accountId" AS accountId, choice, host, requested_scope, granted_scope, refresh_enc, access_expires_at
-		 FROM cloudflare_grant WHERE "userId" = ?`
-  ).bind(userId).first();
-}
-function randomId() {
-  const buf = new Uint8Array(16);
-  crypto.getRandomValues(buf);
-  return [...buf].map((byte) => byte.toString(16).padStart(2, "0")).join("");
-}
-async function claimLock(db, userId, holder, now) {
-  const result = await db.prepare(
-    `INSERT INTO control_locks (name, holder, expires_ms) VALUES (?, ?, ?)
-		 ON CONFLICT(name) DO UPDATE SET holder = excluded.holder, expires_ms = excluded.expires_ms
-		 WHERE control_locks.expires_ms <= ?`
-  ).bind(`cf-refresh:${userId}`, holder, now + LOCK_MS, now).run();
-  return result.meta?.changes === 1;
+  return db.prepare(
+    `SELECT ${COLUMNS} FROM cloudflare_inbox WHERE id = ? AND "userId" = ?`
+  ).bind(inboxId, userId).first();
 }
-async function releaseLock(db, userId, holder) {
-  await db.prepare(
-    `UPDATE control_locks SET holder = '', expires_ms = 0 WHERE name = ? AND holder = ?`
-  ).bind(`cf-refresh:${userId}`, holder).run();
+async function readCloudflareInbox(db, userId) {
+  const rows = await listCloudflareInboxes(db, userId);
+  const open = rows.find((row) => row.status === "pending" || row.status === "working");
+  if (open) return open;
+  const ready = rows.filter((row) => row.status === "ready");
+  return ready.at(-1) ?? null;
 }
-async function clearRefresh(db, userId, now) {
-  await db.prepare(
-    `UPDATE cloudflare_grant SET refresh_enc = NULL, updated_at = ? WHERE "userId" = ?`
-  ).bind(new Date(now).toISOString(), userId).run();
+async function deleteCloudflareInbox(db, userId, inboxId) {
+  if (!userId || !inboxId) return false;
+  const result = await db.prepare(`DELETE FROM cloudflare_inbox WHERE id = ? AND "userId" = ?`).bind(inboxId, userId).run();
+  return result.meta?.changes === 1;
 }
-async function postRefresh(body, fetchMs) {
-  const timeout = AbortSignal.timeout(fetchMs);
-  let rejectDeadline = () => {
-  };
-  const deadline = new Promise((_, reject) => {
-    rejectDeadline = reject;
-  });
-  const timer = setTimeout(() => rejectDeadline(new DOMException("The operation was aborted", "TimeoutError")), fetchMs);
-  try {
-    const request = fetch(TOKEN, {
-      method: "POST",
-      headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
-      body,
-      signal: timeout
-    }).then(
-      (response) => ({ response, failed: false }),
-      () => ({ response: null, failed: true })
-    );
-    let winner;
-    try {
-      winner = await Promise.race([request, deadline]);
-    } catch {
-      return { kind: "deadline" };
-    }
-    if (winner.failed || !winner.response) return timeout.aborted ? { kind: "deadline" } : { kind: "failed" };
-    if (!winner.response.ok) {
-      const status = winner.response.status;
-      void winner.response.body?.cancel().catch(() => {
-      });
-      return status === 400 || status === 401 ? { kind: "rejected", status } : { kind: "failed" };
-    }
+function cloudflareHostname(row) {
+  if (row.public_url) {
     try {
-      const parsed = await Promise.race([
-        winner.response.json().then((body2) => ({ body: body2, failed: false }), () => ({ body: void 0, failed: true })),
-        deadline
-      ]);
-      if (parsed.failed) return timeout.aborted ? { kind: "deadline" } : { kind: "failed" };
-      return { kind: "ok", body: parsed.body };
+      const url = new URL(row.public_url);
+      if (url.protocol === "https:" && !url.username && !url.password && url.hostname) return url.hostname;
     } catch {
-      return { kind: "deadline" };
-    }
-  } finally {
-    clearTimeout(timer);
-  }
-}
-async function refreshCloudflareGrant(input) {
-  const now = input.now ?? Date.now();
-  const row = await readCloudflareGrant(input.database, input.userId);
-  if (!row) return { ok: false, error: "no_grant" };
-  if (!row.refresh_enc) return { ok: false, error: "no_refresh" };
-  const holder = randomId();
-  const claimed = await claimLock(input.database, input.userId, holder, now);
-  if (!claimed) return { ok: false, error: "busy" };
-  try {
-    const current = await readCloudflareGrant(input.database, input.userId);
-    const token = await openCloudflareRefresh(input.secret, input.userId, current?.refresh_enc);
-    if (!token) return { ok: false, error: "no_refresh" };
-    const read = await postRefresh(new URLSearchParams({
-      grant_type: "refresh_token",
-      refresh_token: token,
-      client_id: input.clientId,
-      client_secret: input.clientSecret
-    }), input.fetchMs ?? 5e3);
-    if (read.kind === "deadline") return { ok: false, error: "uncertain" };
-    if (read.kind === "rejected") {
-      await clearRefresh(input.database, input.userId, now);
-      return { ok: false, error: "invalid_grant" };
-    }
-    if (read.kind === "failed") return { ok: false, error: "failed" };
-    const body = read.body && typeof read.body === "object" ? read.body : null;
-    const accessToken = typeof body?.access_token === "string" ? body.access_token : "";
-    if (!accessToken) return { ok: false, error: "failed" };
-    const next = typeof body?.refresh_token === "string" ? body.refresh_token : "";
-    const sealed = next ? await sealCloudflareRefresh(input.secret, input.userId, next) : null;
-    if (next && !sealed) {
-      await clearRefresh(input.database, input.userId, now);
-      return { ok: false, error: "unreadable" };
     }
-    const scope = typeof body?.scope === "string" ? body.scope : current?.requested_scope ?? "";
-    await input.database.prepare(
-      `UPDATE cloudflare_grant SET refresh_enc = ?, granted_scope = COALESCE(?, granted_scope), access_expires_at = ?, updated_at = ? WHERE "userId" = ?`
-    ).bind(
-      sealed,
-      typeof body?.scope === "string" ? body.scope : null,
-      expiresAt(body?.expires_in, now),
-      new Date(now).toISOString(),
-      input.userId
-    ).run();
-    return { ok: true, accessToken, scope };
-  } finally {
-    await releaseLock(input.database, input.userId, holder).catch(() => {
-    });
   }
+  if (row.host === "zone" && row.hostname) return row.hostname;
+  if (row.worker_name && row.workers_subdomain) return `${row.worker_name}.${row.workers_subdomain}.workers.dev`;
+  if (row.worker_name) return row.worker_name;
+  return "Setting up";
 }
 
 // src/provision/remove.ts
@@ -1514,7 +1702,8 @@ async function runRemovalStep(input) {
     clientSecret: input.clientSecret,
     userId: input.userId,
     fetchMs: Math.min(input.fetchMs ?? 1e4, 5e3),
-    now
+    now,
+    fetchImpl: input.fetchImpl
   });
   if (!refreshed.ok) {
     await save(input.database, row, { removing: true, passed: [...passed], failed: step, text: "The saved Cloudflare permission expired. Connect Cloudflare again, then try again.", cloudflare: "" }, now);
@@ -1538,147 +1727,6 @@ async function runRemovalStep(input) {
   return { finished: false, row: await readCloudflareInboxById(input.database, input.userId, row.id) };
 }
 
-// src/auth/cloudflare-setup.ts
-var USER_DETAILS_READ = "user-details.read";
-var ACCOUNT_SETTINGS_READ = "account-settings.read";
-var WORKERS_SCRIPTS_ADMIN = "workers-scripts.admin";
-var D1_WRITE = "d1.write";
-var WORKERS_ROUTES_WRITE = "workers-routes.write";
-var DNS_WRITE = "dns.write";
-var ZONE_READ = "zone.read";
-var TUNNEL_WRITE = "argotunnel.write";
-var OFFLINE_ACCESS = "offline_access";
-function parseSetupChoice(value) {
-  return value === "inbox" || value === "facade" || value === "both" ? value : null;
-}
-function parseSetupHost(value) {
-  return value === "workers" || value === "zone" ? value : null;
-}
-function includesInbox(choice) {
-  return choice === "inbox" || choice === "both";
-}
-function includesFacade(choice) {
-  return choice === "facade" || choice === "both";
-}
-function variant(choice) {
-  if (choice === "inbox") return "a new inbox";
-  if (choice === "facade") return "the fa\xE7ade";
-  return "the new inbox and the fa\xE7ade";
-}
-function setupSummary(choice, host) {
-  const what = choice === "inbox" ? "give your agent a public A2A address" : choice === "facade" ? "make an agent you already run reachable by other agents" : "give your agent a public A2A address and make an agent you already run reachable";
-  const where = host === "workers" ? "a free Cloudflare address such as my-agent.yourname.workers.dev" : "your own domain, such as agent.example.com";
-  return `You chose to ${what}, on ${where}.`;
-}
-function setupScopes(choice, host) {
-  const inbox = includesInbox(choice);
-  const facade = includesFacade(choice);
-  const zone = host === "zone";
-  const scopes = [
-    {
-      id: USER_DETAILS_READ,
-      name: "User Details Read",
-      why: "Confirms which Cloudflare user this is.",
-      declined: "Without User Details Read, Cloudflare did not confirm the user. Choose the setup again."
-    },
-    {
-      id: ACCOUNT_SETTINGS_READ,
-      name: "Account Settings Read",
-      why: "Reads the Cloudflare account you pick on the consent screen.",
-      declined: "Without Account Settings Read, this dashboard cannot see which Cloudflare account you picked, so this setup cannot continue."
-    },
-    {
-      id: WORKERS_SCRIPTS_ADMIN,
-      name: "Workers Admin",
-      why: facade && !inbox ? "Uploads the fa\xE7ade Worker into your account." : facade ? "Uploads the inbox Worker and the fa\xE7ade Worker into your account." : "Uploads the inbox Worker into your account.",
-      declined: `Without Workers Admin, the Worker cannot be uploaded. Connect again to grant it. That blocks ${variant(choice)}.`
-    },
-    {
-      id: D1_WRITE,
-      name: "D1 Write",
-      why: "Creates the D1 database that Worker uses.",
-      declined: `Without D1 Write, the database cannot be created. That blocks ${variant(choice)}.`
-    }
-  ];
-  if (zone) {
-    scopes.push(
-      {
-        id: WORKERS_ROUTES_WRITE,
-        name: "Workers Routes Write",
-        why: "Attaches the Worker to a hostname on a domain you already have in Cloudflare.",
-        declined: "Without Workers Routes Write, the Worker cannot be attached to a hostname on your domain. That blocks a setup on your own domain. A free address is set up with the permissions that address needs."
-      },
-      {
-        id: DNS_WRITE,
-        name: "DNS Write",
-        why: "Creates the DNS record for that hostname.",
-        declined: "Without DNS Write, the DNS record for your domain cannot be created. That blocks a setup on your own domain. A free address is set up with the permissions that address needs."
-      },
-      {
-        id: ZONE_READ,
-        name: "Zone Read",
-        why: "Lists the domains on the Cloudflare account you pick, so this page can check that your address is on one of them.",
-        declined: "Without Zone Read, the domains on your Cloudflare account cannot be listed. That blocks a setup on your own domain. A free address is set up with the permissions that address needs."
-      }
-    );
-  }
-  if (facade) {
-    scopes.push({
-      id: TUNNEL_WRITE,
-      name: "Cloudflare Tunnel Write",
-      why: "Creates a tunnel from the fa\xE7ade Worker to your existing agent. You still run cloudflared on a machine you control.",
-      declined: inbox ? "Without Cloudflare Tunnel Write, a tunnel cannot be created. That blocks the fa\xE7ade. The inbox is created without a tunnel." : "Without Cloudflare Tunnel Write, a tunnel cannot be created. That blocks the fa\xE7ade."
-    });
-  }
-  scopes.push({
-    id: OFFLINE_ACCESS,
-    name: "Refresh token (offline access)",
-    why: "Lets this dashboard continue the setup after you leave this page. The token is stored encrypted. Cloudflare treats it as single-use.",
-    declined: "Connect again and keep the refresh token to continue after you leave this page. Nothing has been created in your Cloudflare account."
-  });
-  return scopes;
-}
-function grantedScopeSet(scope) {
-  if (scope == null) return { known: false, granted: /* @__PURE__ */ new Set() };
-  const granted = new Set(scope.split(/[\s,]+/).map((part) => part.trim()).filter(Boolean));
-  return { known: true, granted };
-}
-function inboxCanProvision(row) {
-  const choice = parseSetupChoice(row.choice);
-  const host = parseSetupHost(row.host);
-  if (!choice || !host) return false;
-  return grantCoversInbox(row, choice, host);
-}
-function grantCoversInbox(row, choice, host) {
-  if (!includesInbox(choice) || !row.refresh_enc) return false;
-  const { known, granted } = grantedScopeSet(row.granted_scope);
-  if (!known) return false;
-  return setupScopes(choice, host).every((scope) => scope.id === TUNNEL_WRITE || granted.has(scope.id));
-}
-function describeSetupGrant(row) {
-  const choice = parseSetupChoice(row.choice);
-  const host = parseSetupHost(row.host);
-  if (!choice || !host) return null;
-  const requested = setupScopes(choice, host);
-  const { known, granted } = grantedScopeSet(row.granted_scope);
-  const lines = requested.map((scope) => ({
-    name: scope.name,
-    why: scope.why,
-    state: !known ? "unknown" : granted.has(scope.id) ? "granted" : "declined"
-  }));
-  const blocked = !known ? ["Cloudflare did not say which permissions were granted, so this setup is not confirmed."] : requested.filter((scope) => !granted.has(scope.id)).map((scope) => scope.declined);
-  return {
-    summary: setupSummary(choice, host),
-    lines,
-    blocked,
-    refreshSaved: Boolean(row.refresh_enc),
-    facade: includesFacade(choice),
-    inbox: includesInbox(choice),
-    host,
-    needsReconnect: !known || !granted.has(WORKERS_SCRIPTS_ADMIN)
-  };
-}
-
 // src/provision/inbox.ts
 var INBOX_COMPATIBILITY_DATE = "2026-10-06";
 var WORKING_MS = 2 * 60 * 1e3;
@@ -2206,7 +2254,8 @@ async function runInboxStep(input) {
         clientSecret: input.clientSecret,
         userId: input.userId,
         fetchMs: Math.min(fetchMs, 5e3),
-        now
+        now,
+        fetchImpl
       });
       if (!refreshed.ok) {
         const problem = refreshProblem(refreshed.error);
@@ -2533,28 +2582,28 @@ async function runVerify(ctx) {
   return wizardNow(ctx);
 }
 
-// sql-raw:/workspace/cc/worker/migrations/0001_init.sql
+// sql-raw:/home/runner/work/a2a-exposed/a2a-exposed/worker/migrations/0001_init.sql
 var init_default = "-- a2a-over-webhook schema\nCREATE TABLE IF NOT EXISTS peers (\n  label TEXT PRIMARY KEY,\n  token_hash TEXT NOT NULL UNIQUE,\n  created_at TEXT NOT NULL,\n  revoked_at TEXT\n);\nCREATE TABLE IF NOT EXISTS tasks (\n  id TEXT PRIMARY KEY,\n  context_id TEXT NOT NULL,\n  peer TEXT NOT NULL,\n  state TEXT NOT NULL,\n  protocol TEXT NOT NULL,\n  created_at TEXT NOT NULL,\n  updated_at TEXT NOT NULL,\n  status_json TEXT NOT NULL,          -- TaskStatus (internal 0.3 shape)\n  artifacts_json TEXT NOT NULL DEFAULT '[]',\n  metadata_json TEXT,\n  push_configs_json TEXT NOT NULL DEFAULT '[]'\n);\nCREATE INDEX IF NOT EXISTS tasks_state ON tasks(state, updated_at);\nCREATE INDEX IF NOT EXISTS tasks_ctx ON tasks(context_id);\nCREATE INDEX IF NOT EXISTS tasks_peer ON tasks(peer, updated_at);\nCREATE TABLE IF NOT EXISTS messages (\n  seq INTEGER PRIMARY KEY AUTOINCREMENT,\n  message_id TEXT NOT NULL,\n  task_id TEXT NOT NULL,\n  context_id TEXT NOT NULL,\n  role TEXT NOT NULL,\n  ts TEXT NOT NULL,\n  message_json TEXT NOT NULL\n);\nCREATE INDEX IF NOT EXISTS messages_task ON messages(task_id, seq);\nCREATE TABLE IF NOT EXISTS history (\n  seq INTEGER PRIMARY KEY AUTOINCREMENT,\n  context_id TEXT NOT NULL,\n  ts TEXT NOT NULL,\n  dir TEXT NOT NULL,                  -- in | out | local\n  peer TEXT,\n  task_id TEXT,\n  role TEXT,\n  state TEXT,\n  event TEXT,\n  text TEXT,\n  data_json TEXT\n);\nCREATE INDEX IF NOT EXISTS history_ctx ON history(context_id, seq);\nCREATE TABLE IF NOT EXISTS outbound (\n  task_id TEXT PRIMARY KEY,\n  context_id TEXT NOT NULL,\n  peer TEXT NOT NULL,\n  endpoint TEXT,\n  protocol TEXT,\n  push_token_hash TEXT,\n  sent_at TEXT NOT NULL,\n  task_json TEXT,\n  updates_json TEXT NOT NULL DEFAULT '[]'\n);\nCREATE TABLE IF NOT EXISTS wakes (\n  context_id TEXT PRIMARY KEY,\n  last_sent_ms INTEGER NOT NULL DEFAULT 0,\n  pending_json TEXT,\n  pending_since_ms INTEGER\n);\nCREATE TABLE IF NOT EXISTS rate (\n  peer TEXT NOT NULL,\n  minute INTEGER NOT NULL,\n  count INTEGER NOT NULL,\n  PRIMARY KEY (peer, minute)\n);\nCREATE TABLE IF NOT EXISTS wake_budget (\n  hour INTEGER PRIMARY KEY,           -- unix hour\n  count INTEGER NOT NULL\n);\n";
 
-// sql-raw:/workspace/cc/worker/migrations/0002_wake_budget.sql
+// sql-raw:/home/runner/work/a2a-exposed/a2a-exposed/worker/migrations/0002_wake_budget.sql
 var wake_budget_default = "-- wake_budget (hourly wake cap) for databases whose 0001_init.sql predates the table.\n-- D1 records migrations by file name, so a database created by an earlier build with its own\n-- 0001_init.sql (e.g. the s2a2a prototype) never gets wake_budget from the current 0001.\n-- Idempotent: a no-op on databases created from the current 0001_init.sql.\nCREATE TABLE IF NOT EXISTS wake_budget (\n  hour INTEGER PRIMARY KEY,           -- unix hour\n  count INTEGER NOT NULL\n);\n";
 
-// sql-raw:/workspace/cc/worker/migrations/0003_device_pairing.sql
+// sql-raw:/home/runner/work/a2a-exposed/a2a-exposed/worker/migrations/0003_device_pairing.sql
 var device_pairing_default = '-- Device-flow pairing (OAuth 2.0 Device Authorization Grant, RFC 8628): a peer agent asks for a token, the inbox\n-- owner approves it (human: /device page + approval password; agent: owner API), the peer redeems it once.\n-- Numbered 0003 so it never collides with a 0002 migration from another branch; D1 applies unapplied files by name.\nCREATE TABLE IF NOT EXISTS device_requests (\n  device_hash TEXT PRIMARY KEY,         -- sha256(device_code); the device code itself is never stored\n  user_code TEXT NOT NULL UNIQUE,       -- normalised (no dash), e.g. WDJB4827\n  client_id TEXT,\n  client_name TEXT,\n  agent_card_url TEXT,\n  ip TEXT,\n  country TEXT,\n  status TEXT NOT NULL,                 -- pending | approved | denied (| redeemed, just before the row is deleted)\n  created_ms INTEGER NOT NULL,\n  expires_ms INTEGER NOT NULL,\n  interval_s INTEGER NOT NULL,\n  last_poll_ms INTEGER NOT NULL DEFAULT 0,\n  failed_attempts INTEGER NOT NULL DEFAULT 0,\n  label TEXT,                           -- peer label chosen at approval\n  decided_ms INTEGER,\n  decided_by TEXT                       -- human | agent | owner | lockout\n);\nCREATE INDEX IF NOT EXISTS device_requests_status ON device_requests(status, expires_ms);\n-- fixed-window counters: device requests per IP / globally, wrong approval passwords per IP / globally, token polls\nCREATE TABLE IF NOT EXISTS pairing_rate (\n  key TEXT NOT NULL,\n  window_start INTEGER NOT NULL,\n  count INTEGER NOT NULL,\n  expires_ms INTEGER NOT NULL,\n  PRIMARY KEY (key, window_start)\n);\n-- owner settings; approval_password = {"alg":"pbkdf2-sha256","iterations":..,"salt":..,"hash":..,"setAt":..}\nCREATE TABLE IF NOT EXISTS settings (\n  key TEXT PRIMARY KEY,\n  value TEXT NOT NULL\n);\n-- where a peer token came from: NULL = `token issue`, \'pairing\' = device flow (with the user code it was approved under)\nALTER TABLE peers ADD COLUMN source TEXT;\nALTER TABLE peers ADD COLUMN user_code TEXT;\nALTER TABLE peers ADD COLUMN client_name TEXT;\n';
 
-// sql-raw:/workspace/cc/worker/migrations/0004_pairing_replace.sql
+// sql-raw:/home/runner/work/a2a-exposed/a2a-exposed/worker/migrations/0004_pairing_replace.sql
 var pairing_replace_default = '-- Re-pairing: a requester that presents its current active token (Authorization: Bearer) replaces that token on\n-- approval. The new token takes over the label, so no orphan token or "-2" label is left. replaces_hash binds the\n-- request to the token that was presented: if the owner rotates or revokes that token before redemption, the swap\n-- is refused and a fresh label is used instead (a holder of a compromised old token cannot overwrite a rotated one).\nALTER TABLE device_requests ADD COLUMN replaces_label TEXT;\nALTER TABLE device_requests ADD COLUMN replaces_hash TEXT;\n';
 
-// sql-raw:/workspace/cc/worker/migrations/0005_facade_owners.sql
+// sql-raw:/home/runner/work/a2a-exposed/a2a-exposed/worker/migrations/0005_facade_owners.sql
 var facade_owners_default = "-- Proxy / expose mode (UPSTREAM_URL): which peer label created each upstream task and context, so peers that share\n-- the fa\xE7ade's one upstream credential can't read, cancel or continue each other's tasks. Unused in inbox mode.\nCREATE TABLE IF NOT EXISTS facade_owners (\n	kind TEXT NOT NULL,        -- 'task' | 'context'\n	id TEXT NOT NULL,          -- the upstream's task / context id\n	peer TEXT NOT NULL,        -- peer label (peers.label) that created it through the fa\xE7ade\n	created_at TEXT NOT NULL,\n	PRIMARY KEY (kind, id)\n);\n";
 
-// sql-raw:/workspace/cc/worker/migrations/0006_mcp.sql
+// sql-raw:/home/runner/work/a2a-exposed/a2a-exposed/worker/migrations/0006_mcp.sql
 var mcp_default = "-- Remote MCP server (/mcp): OAuth 2.1 clients (dynamic registration), one-time authorization codes, and the grants\n-- (owner-approved, inbox-scoped tokens) that `token list` shows and `token revoke` ends. Peer tokens stay in `peers`\n-- and are never accepted on /mcp; MCP tokens are never accepted on the A2A endpoint or /owner/*.\nCREATE TABLE IF NOT EXISTS oauth_clients (\n	client_id TEXT PRIMARY KEY,\n	client_name TEXT,\n	redirect_uris_json TEXT NOT NULL,\n	created_ms INTEGER NOT NULL,\n	ip TEXT\n);\nCREATE TABLE IF NOT EXISTS oauth_codes (\n	code_hash TEXT PRIMARY KEY,\n	client_id TEXT NOT NULL,\n	redirect_uri TEXT NOT NULL,\n	code_challenge TEXT NOT NULL,\n	scope TEXT NOT NULL,\n	resource TEXT NOT NULL,\n	created_ms INTEGER NOT NULL,\n	expires_ms INTEGER NOT NULL\n);\nCREATE TABLE IF NOT EXISTS mcp_grants (\n	label TEXT PRIMARY KEY,\n	client_id TEXT NOT NULL,\n	client_name TEXT,\n	redirect_host TEXT,\n	scope TEXT NOT NULL,\n	access_hash TEXT UNIQUE,\n	access_expires_ms INTEGER,\n	refresh_hash TEXT UNIQUE,\n	refresh_expires_ms INTEGER,\n	created_at TEXT NOT NULL,\n	last_used_at TEXT,\n	revoked_at TEXT\n);\n-- Peers this inbox sends to from the Worker (MCP `send` / `poll_outbound`), uploaded by `peers sync`. The token is\n-- AES-GCM ciphertext under a key derived from the Worker's OWNER_TOKEN secret, so a D1 export alone doesn't reveal it.\nCREATE TABLE IF NOT EXISTS outbound_peers (\n	alias TEXT PRIMARY KEY,\n	url TEXT NOT NULL,\n	token_enc TEXT,\n	created_at TEXT NOT NULL,\n	updated_at TEXT NOT NULL\n);\n";
 
-// sql-raw:/workspace/cc/worker/migrations/0007_cimd.sql
+// sql-raw:/home/runner/work/a2a-exposed/a2a-exposed/worker/migrations/0007_cimd.sql
 var cimd_default = "-- MCP authorization (2026-07-28): OAuth Client ID Metadata Documents. A client_id that is an https URL names a JSON\n-- document the Worker fetches (SSRF-guarded, 5 KB, 5 s) and validates; valid documents are cached here for their\n-- Cache-Control max-age (60 s - 24 h, default 1 h). Errors and invalid documents are never cached.\nCREATE TABLE IF NOT EXISTS oauth_client_metadata (\n	client_id TEXT PRIMARY KEY,\n	client_name TEXT,\n	redirect_uris_json TEXT NOT NULL,\n	fetched_ms INTEGER NOT NULL,\n	expires_ms INTEGER NOT NULL\n);\n";
 
-// sql-raw:/workspace/cc/worker/migrations/0008_oidc_txns.sql
+// sql-raw:/home/runner/work/a2a-exposed/a2a-exposed/worker/migrations/0008_oidc_txns.sql
 var oidc_txns_default = "-- Short-lived OpenID Connect sign-in (authorization code + PKCE). The callback deletes the row;\n-- expired rows are removed when a new one is stored and by the pairing cleanup.\nCREATE TABLE IF NOT EXISTS oidc_txns (\n	state TEXT PRIMARY KEY,\n	nonce TEXT NOT NULL,\n	verifier TEXT NOT NULL,\n	kind TEXT NOT NULL,\n	csrf TEXT NOT NULL,\n	user_code TEXT,\n	payload_json TEXT NOT NULL,\n	expires_ms INTEGER NOT NULL\n);\n";
 
 // src/provision/inbox-migrations.ts
@@ -2569,22 +2618,22 @@ var INBOX_MIGRATIONS = [
   { name: "0008_oidc_txns.sql", sql: oidc_txns_default }
 ];
 
-// sql-raw:/workspace/cc/control/migrations/0001_auth.sql
+// sql-raw:/home/runner/work/a2a-exposed/a2a-exposed/control/migrations/0001_auth.sql
 var auth_default = '-- Better Auth 1.7.7 (SQLite) plus invite codes. Append-only: do not edit this file.\nCREATE TABLE IF NOT EXISTS "user" (\n  "id" text not null primary key,\n  "name" text not null,\n  "email" text not null unique,\n  "emailVerified" integer not null,\n  "image" text,\n  "createdAt" date not null,\n  "updatedAt" date not null\n);\nCREATE TABLE IF NOT EXISTS "session" (\n  "id" text not null primary key,\n  "expiresAt" date not null,\n  "token" text not null unique,\n  "createdAt" date not null,\n  "updatedAt" date not null,\n  "ipAddress" text,\n  "userAgent" text,\n  "userId" text not null references "user" ("id") on delete cascade\n);\nCREATE TABLE IF NOT EXISTS "account" (\n  "id" text not null primary key,\n  "accountId" text not null,\n  "providerId" text not null,\n  "userId" text not null references "user" ("id") on delete cascade,\n  "accessToken" text,\n  "refreshToken" text,\n  "idToken" text,\n  "accessTokenExpiresAt" date,\n  "refreshTokenExpiresAt" date,\n  "scope" text,\n  "password" text,\n  "createdAt" date not null,\n  "updatedAt" date not null\n);\nCREATE TABLE IF NOT EXISTS "verification" (\n  "id" text not null primary key,\n  "identifier" text not null,\n  "value" text not null,\n  "expiresAt" date not null,\n  "createdAt" date not null,\n  "updatedAt" date not null\n);\nCREATE INDEX IF NOT EXISTS "session_userId_idx" ON "session" ("userId");\nCREATE INDEX IF NOT EXISTS "account_userId_idx" ON "account" ("userId");\nCREATE INDEX IF NOT EXISTS "verification_identifier_idx" ON "verification" ("identifier");\n\n-- Invite codes for an invite-only deployment. Unused unless INVITES_REQUIRED=1.\nCREATE TABLE IF NOT EXISTS invites (\n  code TEXT PRIMARY KEY,\n  email TEXT,\n  created_at TEXT NOT NULL,\n  expires_at TEXT,\n  used_at TEXT,\n  used_email TEXT\n);\n';
 
-// sql-raw:/workspace/cc/control/migrations/0002_tenants.sql
+// sql-raw:/home/runner/work/a2a-exposed/a2a-exposed/control/migrations/0002_tenants.sql
 var tenants_default = "-- Tenants and the config outbox. Append-only: do not edit this file.\n-- Control D1 is the only writer. The data plane receives a copy through pushConfig.\nCREATE TABLE IF NOT EXISTS tenants (\n  id TEXT PRIMARY KEY,\n  name TEXT NOT NULL UNIQUE,\n  owner_account_id TEXT NOT NULL,\n  status TEXT NOT NULL,\n  region TEXT NOT NULL,\n  config_json TEXT NOT NULL,\n  limits_json TEXT NOT NULL,\n  approval_json TEXT NOT NULL,\n  owner_token_hash TEXT NOT NULL,\n  secrets_enc TEXT,\n  config_version INTEGER NOT NULL,\n  created_at TEXT NOT NULL,\n  updated_at TEXT NOT NULL\n);\nCREATE INDEX IF NOT EXISTS tenants_owner_idx ON tenants (owner_account_id);\n\nCREATE TABLE IF NOT EXISTS config_outbox (\n  tenant_id TEXT NOT NULL,\n  version INTEGER NOT NULL,\n  created_at TEXT NOT NULL,\n  PRIMARY KEY (tenant_id, version)\n);\n";
 
-// sql-raw:/workspace/cc/control/migrations/0003_oidc.sql
+// sql-raw:/home/runner/work/a2a-exposed/a2a-exposed/control/migrations/0003_oidc.sql
 var oidc_default = '-- OpenID Connect issuer keys and per-tenant clients. Append-only: do not edit this file.\n-- `jwks` matches Better Auth\'s JWT plugin (RS256). The private key is encrypted by that plugin.\nCREATE TABLE IF NOT EXISTS "jwks" (\n  "id" text not null primary key,\n  "publicKey" text not null,\n  "privateKey" text not null,\n  "createdAt" date not null,\n  "expiresAt" date,\n  "alg" text,\n  "crv" text\n);\n\nCREATE TABLE IF NOT EXISTS oauth_client (\n  id TEXT PRIMARY KEY,\n  secret_hash TEXT NOT NULL,\n  owner_account_id TEXT NOT NULL,\n  redirect_uris TEXT NOT NULL,\n  created_at TEXT NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS oauth_code (\n  code_hash TEXT PRIMARY KEY,\n  client_id TEXT NOT NULL,\n  user_id TEXT NOT NULL,\n  redirect_uri TEXT NOT NULL,\n  nonce TEXT NOT NULL,\n  challenge TEXT NOT NULL,\n  expires_at TEXT NOT NULL,\n  used_at TEXT\n);\n';
 
-// sql-raw:/workspace/cc/control/migrations/0004_device.sql
+// sql-raw:/home/runner/work/a2a-exposed/a2a-exposed/control/migrations/0004_device.sql
 var device_default = '-- Device authorization codes for CLI sign-in (Better Auth device-authorization plugin).\n-- Append-only: do not edit this file.\nCREATE TABLE IF NOT EXISTS "deviceCode" (\n  "id" text not null primary key,\n  "deviceCode" text not null unique,\n  "userCode" text not null unique,\n  "userId" text,\n  "expiresAt" date not null,\n  "status" text not null,\n  "lastPolledAt" date,\n  "pollingInterval" integer,\n  "clientId" text,\n  "scope" text\n);\n';
 
-// sql-raw:/workspace/cc/control/migrations/0005_agent_limit.sql
+// sql-raw:/home/runner/work/a2a-exposed/a2a-exposed/control/migrations/0005_agent_limit.sql
 var agent_limit_default = "-- Free plan: two agents per account. The check runs inside the insert, so two\n-- creates cannot both pass a count taken before either write.\n-- Keep the bound in step with AGENT_LIMIT in src/tenants/create.ts.\n-- Append-only: do not edit this file.\nCREATE TRIGGER IF NOT EXISTS tenants_agent_limit\nBEFORE INSERT ON tenants\nFOR EACH ROW\nWHEN (SELECT COUNT(*) FROM tenants WHERE owner_account_id = NEW.owner_account_id) >= 2\nBEGIN\n  SELECT RAISE(ABORT, 'agent_limit');\nEND;\n";
 
-// sql-raw:/workspace/cc/control/migrations/0006_agent_limit_account.sql
+// sql-raw:/home/runner/work/a2a-exposed/a2a-exposed/control/migrations/0006_agent_limit_account.sql
 var agent_limit_account_default = `-- Per-account agent limit. Null uses control_settings.free_agent_limit, which the
 -- app sets from FREE_AGENT_LIMIT. Both null means no limit. Replaces the constant
 -- check in 0005 so a higher plan can raise one account without another migration.
@@ -2615,19 +2664,19 @@ BEGIN
 END;
 `;
 
-// sql-raw:/workspace/cc/control/migrations/0007_outbox_lock.sql
+// sql-raw:/home/runner/work/a2a-exposed/a2a-exposed/control/migrations/0007_outbox_lock.sql
 var outbox_lock_default = "-- One lock for config delivery and agent delete. A flush that already loaded a row must not\n-- write the directory or the tenant object while delete is wiping them, and delete must not\n-- start that wipe while a delivery is still writing. Append-only: do not edit this file.\nCREATE TABLE IF NOT EXISTS control_locks (\n  name TEXT PRIMARY KEY,\n  holder TEXT NOT NULL,\n  expires_ms INTEGER NOT NULL\n);\nINSERT INTO control_locks (name, holder, expires_ms) VALUES ('outbox', '', 0)\nON CONFLICT(name) DO NOTHING;\n";
 
-// sql-raw:/workspace/cc/control/migrations/0008_account_provider.sql
+// sql-raw:/home/runner/work/a2a-exposed/a2a-exposed/control/migrations/0008_account_provider.sql
 var account_provider_default = '-- One external account identity belongs to one user. Two connect callbacks can\n-- both insert the same providerId and accountId. Those rows have to go before\n-- the unique index, or this migration fails and deploy stops. Keep the earliest\n-- row (then the lowest id). The user row stays. Append-only: do not edit this file.\nDELETE FROM "account"\nWHERE "id" NOT IN (\n  SELECT "id" FROM "account" AS "candidate"\n  WHERE NOT EXISTS (\n    SELECT 1 FROM "account" AS "earlier"\n    WHERE "earlier"."providerId" = "candidate"."providerId"\n      AND "earlier"."accountId" = "candidate"."accountId"\n      AND (\n        "earlier"."createdAt" < "candidate"."createdAt"\n        OR ("earlier"."createdAt" = "candidate"."createdAt" AND "earlier"."id" < "candidate"."id")\n      )\n  )\n);\nCREATE UNIQUE INDEX IF NOT EXISTS "account_provider_account_idx" ON "account" ("providerId", "accountId");\n';
 
-// sql-raw:/workspace/cc/control/migrations/0009_feedback_rate.sql
+// sql-raw:/home/runner/work/a2a-exposed/a2a-exposed/control/migrations/0009_feedback_rate.sql
 var feedback_rate_default = "-- Per-address and per-owner-token counters for POST /api/feedback.\n-- Append-only: do not edit this file.\nCREATE TABLE IF NOT EXISTS feedback_rate (\n  bucket TEXT NOT NULL,\n  window_start INTEGER NOT NULL,\n  count INTEGER NOT NULL,\n  PRIMARY KEY (bucket, window_start)\n);\n";
 
-// sql-raw:/workspace/cc/control/migrations/0010_cloudflare_grant.sql
+// sql-raw:/home/runner/work/a2a-exposed/a2a-exposed/control/migrations/0010_cloudflare_grant.sql
 var cloudflare_grant_default = '-- Setup consent for "Set me up on Cloudflare". refresh_enc is the sealed\n-- refresh token. The access token is not stored. Append-only: do not edit this file.\nCREATE TABLE IF NOT EXISTS cloudflare_grant (\n  "userId" TEXT NOT NULL PRIMARY KEY REFERENCES "user" ("id") ON DELETE CASCADE,\n  "accountId" TEXT NOT NULL,\n  choice TEXT NOT NULL,\n  host TEXT NOT NULL,\n  requested_scope TEXT NOT NULL,\n  granted_scope TEXT,\n  refresh_enc TEXT,\n  access_expires_at TEXT,\n  created_at TEXT NOT NULL,\n  updated_at TEXT NOT NULL\n);\n';
 
-// sql-raw:/workspace/cc/control/migrations/0011_cloudflare_inbox.sql
+// sql-raw:/home/runner/work/a2a-exposed/a2a-exposed/control/migrations/0011_cloudflare_inbox.sql
 var cloudflare_inbox_default = `-- An inbox this dashboard created in the user's Cloudflare account.
 -- The owner token is stored only as a SHA-256 hash. Append-only: do not edit this file.
 CREATE TABLE IF NOT EXISTS cloudflare_inbox (
@@ -2646,13 +2695,13 @@ CREATE TABLE IF NOT EXISTS cloudflare_inbox (
 );
 `;
 
-// sql-raw:/workspace/cc/control/migrations/0012_cloudflare_inbox_tag.sql
+// sql-raw:/home/runner/work/a2a-exposed/a2a-exposed/control/migrations/0012_cloudflare_inbox_tag.sql
 var cloudflare_inbox_tag_default = "-- Value this page stores before upload and writes into the Worker settings.\n-- A later try replaces a script only when that setting still matches.\n-- Append-only: do not edit this file.\nALTER TABLE cloudflare_inbox ADD COLUMN script_tag TEXT;\n";
 
-// sql-raw:/workspace/cc/control/migrations/0013_cloudflare_inbox_wizard.sql
+// sql-raw:/home/runner/work/a2a-exposed/a2a-exposed/control/migrations/0013_cloudflare_inbox_wizard.sql
 var cloudflare_inbox_wizard_default = "-- Wizard progress for an inbox this page creates.\n-- wizard_step is the last step that passed. step_error is a short sanitised note.\n-- workers_subdomain is the account workers.dev name once it is known.\n-- Append-only: do not edit this file.\nALTER TABLE cloudflare_inbox ADD COLUMN wizard_step TEXT;\nALTER TABLE cloudflare_inbox ADD COLUMN workers_subdomain TEXT;\nALTER TABLE cloudflare_inbox ADD COLUMN step_error TEXT;\n";
 
-// sql-raw:/workspace/cc/control/migrations/0014_cloudflare_inbox_agent.sql
+// sql-raw:/home/runner/work/a2a-exposed/a2a-exposed/control/migrations/0014_cloudflare_inbox_agent.sql
 var cloudflare_inbox_agent_default = '-- An account can have more than one Cloudflare agent. The old primary key was userId.\n-- Those rows keep that value as id. zone_id is the domain this setup attached, when it did.\n-- Append-only: do not edit this file.\nCREATE TABLE cloudflare_inbox_agent (\n  id TEXT NOT NULL PRIMARY KEY,\n  "userId" TEXT NOT NULL REFERENCES "user" ("id") ON DELETE CASCADE,\n  cf_account_id TEXT NOT NULL,\n  worker_name TEXT NOT NULL,\n  d1_name TEXT NOT NULL,\n  d1_id TEXT,\n  public_url TEXT,\n  owner_token_hash TEXT,\n  host TEXT NOT NULL,\n  hostname TEXT,\n  status TEXT NOT NULL,\n  script_tag TEXT,\n  wizard_step TEXT,\n  workers_subdomain TEXT,\n  step_error TEXT,\n  zone_id TEXT,\n  created_at TEXT NOT NULL,\n  updated_at TEXT NOT NULL\n);\n\nINSERT INTO cloudflare_inbox_agent (\n  id, "userId", cf_account_id, worker_name, d1_name, d1_id, public_url, owner_token_hash,\n  host, hostname, status, script_tag, wizard_step, workers_subdomain, step_error, zone_id,\n  created_at, updated_at\n)\nSELECT\n  "userId", "userId", cf_account_id, worker_name, d1_name, d1_id, public_url, owner_token_hash,\n  host, hostname, status, script_tag, wizard_step, workers_subdomain, step_error, NULL,\n  created_at, updated_at\nFROM cloudflare_inbox;\n\nDROP TABLE cloudflare_inbox;\nALTER TABLE cloudflare_inbox_agent RENAME TO cloudflare_inbox;\nCREATE INDEX IF NOT EXISTS cloudflare_inbox_user_idx ON cloudflare_inbox ("userId", created_at);\n';
 
 // src/core/migrations.ts
@@ -2674,8 +2723,12 @@ var CONTROL_MIGRATIONS = [
   { name: "0014_cloudflare_inbox_agent.sql", sql: cloudflare_inbox_agent_default }
 ];
 export {
+  ACCOUNT_SETTINGS_READ,
   CONTROL_MIGRATIONS,
   CONTROL_MIGRATIONS_DIR,
+  D1_WRITE,
+  DNS_WRITE,
+  EVERY_PLAN,
   HOST_RE,
   INBOX_COMPATIBILITY_DATE,
   INBOX_MIGRATIONS,
@@ -2683,24 +2736,34 @@ export {
   MAX_WAKE_PLAIN,
   MAX_WAKE_SEALED,
   MAX_WAKE_VALUE,
+  OFFLINE_ACCESS,
   PERMISSION_DELAYS_MS,
   PERMISSION_TRIES,
   PERMISSION_WAIT,
   PROVISION_TAG_NAME,
   RESERVED_NAMES,
   RUN_WORKER_FIRST,
+  SETUP_NOT_PROVISIONED,
   TENANT_NAME,
+  TUNNEL_CONNECTOR_LATER,
+  TUNNEL_WRITE,
+  USER_DETAILS_READ,
   WAKE_PRESETS,
   WAKE_SECRET_KEYS,
   WIZARD_STEPS,
+  WORKERS_ROUTES_WRITE,
+  WORKERS_SCRIPTS_ADMIN,
+  ZONE_READ,
   accountAgentLimit,
   attachHostname,
   callFetch,
   cfCall,
+  cloudflareAuthorizeUrl,
   cloudflareErrors,
   cloudflareHostname,
   configFields,
   configuredFreeAgentLimit,
+  consentScope,
   createCloudflareAgent,
   createD1,
   createTenant,
@@ -2708,6 +2771,7 @@ export {
   d1Rows,
   dashboardLinks,
   dataPlaneFromEnv,
+  deleteCloudflareGrant,
   deleteCloudflareInbox,
   deleteD1,
   deleteTenant,
@@ -2715,27 +2779,38 @@ export {
   deleteWorkersDomain,
   deliverOutbox,
   describeCfFailure,
+  describeSetupGrant,
   fieldsFromForm,
   findD1,
   flushOutbox,
   getD1,
+  grantCoversInbox,
+  grantedScopeSet,
   hashOwnerToken,
   headerSafeToken,
+  httpsOrigin,
+  inboxCanProvision,
   listAccounts,
   listCloudflareInboxes,
   listTenants,
   listWorkerNames,
   listWorkersDomains,
   listZones,
+  newApprovalClient,
   newOwnerToken,
   normalizeHostname,
+  openCloudflareRefresh,
   openWakeSecrets,
+  parseSetupChoice,
+  parseSetupHost,
   permissionNotReady,
   permissionRetryDue,
   pushFromRow,
+  readCloudflareGrant,
   readCloudflareInbox,
   readCloudflareInboxById,
   readInboxById,
+  refreshCloudflareGrant,
   registerWorkersDevSubdomain,
   removalItems,
   removalSteps,
@@ -2747,9 +2822,13 @@ export {
   runInboxStep,
   runRemovalStep,
   sanitizeCloudflareText,
+  saveCloudflareGrant,
   saveWakeSettings,
+  sealCloudflareRefresh,
   sealWakeSecrets,
   setWorkersDevEnabled,
+  setupScopes,
+  setupSummary,
   sqlStatements,
   subdomainMissing,
   tenantForAccount,