@a2a-exposed/control-core 0.8.19 → 0.8.21

package/README.md

@@ -10,6 +10,8 @@ Agents that can call out over HTTP and cannot run a public server: hosted assist
 
 ## Quick start
 
+No Cloudflare account, or no preference? Start with a [hosted agent](docs/getting-started.md#hosted-inbox) at `https://<name>.a2a.exposed`. It is in open beta with a Free plan; see [pricing](https://a2a.exposed/pricing).
+
 Claude Code cloud sessions use the [hosted connector](docs/mcp.md#hosted-connector), with no skill install or CLI. Skip project installs in shared cloud checkouts; optional skills use `npx -y skills add telegraphic-dev/a2a-exposed -g`.
 
 Self-hosting requires Node 22.18+. The skills are installed into the project the agent works in. They do not install the CLI. Every command runs through npx.
@@ -22,6 +24,8 @@ Self-hosting requires Node 22.18+. The skills are installed into the project the
 
 2. **Deploy an A2A endpoint** in your Cloudflare account. [Self-hosting](docs/self-hosting.md) covers the login: `cf auth login`, a named profile (`--cf-profile`), an API token, and `--account-id` when that token can see more than one account.
 
+   Before running `init` or another Cloudflare change, the agent shows you the account name/id from `npx cf auth whoami` and the plan: Worker name, D1 database, hostname and any workers.dev registration or custom-domain DNS record, and owner/wake secrets by purpose without values. It waits for your explicit yes; a login is not consent. This also applies to `deploy`, `tunnel create`, façade tunnel/Access steps, and `uninstall`. See the [consent checklist](skills/a2a-exposed-setup/references/deploy.md#before-cloudflare-changes). Ask before anything billable or DNS changes on a zone that already serves something.
+
    ```bash
    npx -y a2a-exposed@latest init --hostname agent.example.com --agent-name "My Agent"
    ```
@@ -41,7 +45,7 @@ After the skill is in the project, you can ask the agent to set this up. It foll
 
 ## Hosted
 
-[a2a.exposed](https://a2a.exposed) hosts the A2A endpoint and is open to everyone. Pricing is at [a2a.exposed/pricing](https://a2a.exposed/pricing). When the CLI cannot run, connect https://a2a.exposed/mcp. Sign-in is the owner identity. The owner token stays on the A2A endpoint. Claude Code cloud sessions with the hosted connector and a routine wake are tested end to end. Other Claude clients and Codex are untested on this address. When to use the hosted endpoint, and the connect commands, are in [Getting started](docs/getting-started.md#hosted-inbox).
+[a2a.exposed](https://a2a.exposed/hosted) hosts the A2A endpoint and is open to everyone. Pricing is at [a2a.exposed/pricing](https://a2a.exposed/pricing). Sign in at https://a2a.exposed/app to create an agent; no Cloudflare account is needed. When the CLI cannot run, connect https://a2a.exposed/mcp. Sign-in is the owner identity. The owner token stays on the A2A endpoint. Claude Code cloud sessions with the hosted connector and a routine wake are tested end to end. Other Claude clients and Codex are untested on this address. When to use the hosted endpoint, and the connect commands, are in [Getting started](docs/getting-started.md#hosted-inbox).
 
 ## Docs
 

package/dist/index.js

@@ -249,8 +249,8 @@ async function flushOutbox(db, plane, now = Date.now()) {
     }
     try {
       if (await deliverOutbox(db, plane, row)) delivered += 1;
-    } catch (error) {
-      console.log(JSON.stringify({ ts: new Date(now).toISOString(), event: "outbox_push_failed", tenant: row.id, error: String(error).slice(0, 200) }));
+    } catch {
+      console.log(JSON.stringify({ ts: new Date(now).toISOString(), event: "outbox_push_failed", tenant: row.id, error: "config_delivery_failed" }));
     }
   }
   const left = await db.prepare("SELECT COUNT(*) AS n FROM config_outbox").first();
@@ -554,15 +554,17 @@ async function tenantForAccount(db, accountId, name) {
 }
 async function saveWakeSettings(db, plane, secretsKey, input) {
   const row = await tenantForAccount(db, input.accountId, input.name);
-  if (!row) return { ok: false, error: "conflict" };
+  if (!row || input.expectedVersion !== void 0 && input.expectedVersion !== row.config_version) return { ok: false, error: "conflict" };
   const url = input.url.trim();
   const preset = input.preset.trim();
   const keyHeader = input.keyHeader.trim();
   const key = input.key.trim();
+  const hmacSecret = (input.hmacSecret ?? "").trim();
   if (wakeUrlProblem(url)) return { ok: false, error: "url" };
   if (!WAKE_PRESETS.includes(preset)) return { ok: false, error: "preset" };
   if (wakeHeaderProblem(keyHeader)) return { ok: false, error: "header" };
-  if (key.length > 4096 || /[\u0000-\u001f]/.test(key)) return { ok: false, error: "key" };
+  if ([key, hmacSecret].some((value) => value.length > 4096 || /[\u0000-\u001f]/.test(value))) return { ok: false, error: "key" };
+  if (url && preset === "openbot" && (key || keyHeader)) return { ok: false, error: keyHeader ? "header" : "key" };
   const config = configFields(row.config_json);
   const plaintext = {};
   for (const secret of WAKE_SECRET_KEYS) {
@@ -570,23 +572,32 @@ async function saveWakeSettings(db, plane, secretsKey, input) {
     if (value) plaintext[secret] = value;
     delete config[secret];
   }
-  if (url) config.WAKE_WEBHOOK_URL = url;
-  else delete config.WAKE_WEBHOOK_URL;
-  config.WAKE_PRESET = preset;
-  if (keyHeader) config.WAKE_KEY_HEADER = keyHeader;
-  else delete config.WAKE_KEY_HEADER;
+  const same = config.WAKE_WEBHOOK_URL === url && config.WAKE_PRESET === preset;
+  const sameKey = same && (config.WAKE_KEY_HEADER ?? "") === keyHeader;
   let secretsEnc = row.secrets_enc;
-  const migrate = !secretsEnc && Object.keys(plaintext).length > 0;
-  if (key || migrate) {
+  const hasSecrets = !!secretsEnc || Object.keys(plaintext).length > 0;
+  if (hasSecrets || key || hmacSecret || url && preset === "openbot") {
     const ikm = secretsKey.trim();
     if (!ikm) return { ok: false, error: "unavailable" };
     const current = secretsEnc ? await openWakeSecrets(ikm, row.id, secretsEnc) : { ...plaintext };
     if (!current) return { ok: false, error: "unreadable" };
-    if (key) current.WAKE_WEBHOOK_KEY = key;
-    const sealed = await sealWakeSecrets(ikm, row.id, current);
-    if (!sealed) return { ok: false, error: "unavailable" };
-    secretsEnc = sealed;
+    const before = JSON.stringify(current);
+    if (!url || !sameKey || preset === "openbot") delete current.WAKE_WEBHOOK_KEY;
+    if (!url || !same) delete current.WAKE_HMAC_SECRET;
+    if (url && key && preset !== "openbot") current.WAKE_WEBHOOK_KEY = key;
+    if (url && hmacSecret) current.WAKE_HMAC_SECRET = hmacSecret;
+    if (url && preset === "openbot" && !current.WAKE_HMAC_SECRET) return { ok: false, error: "key" };
+    if (!secretsEnc || JSON.stringify(current) !== before) {
+      const sealed = await sealWakeSecrets(ikm, row.id, current);
+      if (!sealed) return { ok: false, error: "unavailable" };
+      secretsEnc = sealed;
+    }
   }
+  if (url) config.WAKE_WEBHOOK_URL = url;
+  else delete config.WAKE_WEBHOOK_URL;
+  config.WAKE_PRESET = preset;
+  if (keyHeader && url) config.WAKE_KEY_HEADER = keyHeader;
+  else delete config.WAKE_KEY_HEADER;
   const version = row.config_version + 1;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const configJson = JSON.stringify(config);
@@ -617,8 +628,8 @@ async function saveWakeSettings(db, plane, secretsKey, input) {
   console.log(JSON.stringify({ ts: now, event: "wake_settings", tenant: row.id, accountId: input.accountId, preset }));
   try {
     await deliverOutbox(db, plane, outbox);
-  } catch (error) {
-    console.log(JSON.stringify({ ts: now, event: "outbox_push_failed", tenant: row.id, error: String(error).slice(0, 200) }));
+  } catch {
+    console.log(JSON.stringify({ ts: now, event: "outbox_push_failed", tenant: row.id, error: "wake_delivery_failed" }));
   }
   return { ok: true };
 }
@@ -3021,6 +3032,9 @@ var conversation_owner_default = "-- One owner per context id. The first peer to
 // sql-raw:/home/runner/work/a2a-exposed/a2a-exposed/worker/migrations/0012_conversation_peer_owner.sql
 var conversation_peer_owner_default = "-- One row per peer. The same context id can be a separate conversation for each peer.\n-- 0011's single-column primary key made a second peer's insert fail, which is how a caller\n-- could tell a fresh id from one another peer already held.\nCREATE TABLE conversation_owners_peer (\n  context_id TEXT NOT NULL,\n  peer TEXT NOT NULL,\n  created_at TEXT NOT NULL,\n  PRIMARY KEY (context_id, peer)\n);\nINSERT INTO conversation_owners_peer (context_id, peer, created_at)\nSELECT context_id, peer, created_at FROM conversation_owners;\nDROP TABLE conversation_owners;\nALTER TABLE conversation_owners_peer RENAME TO conversation_owners;\n";
 
+// sql-raw:/home/runner/work/a2a-exposed/a2a-exposed/worker/migrations/0013_reply_delivery.sql
+var reply_delivery_default = "-- One delivery outcome for one logical owner reply. The key includes the inbound turn and reply content,\n-- so an HTTP/MCP retry is idempotent while a later peer message permits the same words to be sent again.\nCREATE TABLE IF NOT EXISTS reply_deliveries (\n	delivery_key TEXT PRIMARY KEY,\n	task_id TEXT NOT NULL,\n	message_id TEXT NOT NULL,\n	result_json TEXT,\n	created_at TEXT NOT NULL,\n	updated_at TEXT NOT NULL\n);\nCREATE INDEX IF NOT EXISTS reply_deliveries_task ON reply_deliveries(task_id, created_at);\n";
+
 // src/provision/inbox-migrations.ts
 var INBOX_MIGRATIONS = [
   { name: "0001_init.sql", sql: init_default },
@@ -3034,7 +3048,8 @@ var INBOX_MIGRATIONS = [
   { name: "0009_outbound_seen.sql", sql: outbound_seen_default },
   { name: "0010_conversation_peer.sql", sql: conversation_peer_default },
   { name: "0011_conversation_owner.sql", sql: conversation_owner_default },
-  { name: "0012_conversation_peer_owner.sql", sql: conversation_peer_owner_default }
+  { name: "0012_conversation_peer_owner.sql", sql: conversation_peer_owner_default },
+  { name: "0013_reply_delivery.sql", sql: reply_delivery_default }
 ];
 
 // sql-raw:/home/runner/work/a2a-exposed/a2a-exposed/control/migrations/0001_auth.sql

package/dist/types/control/src/core/index.d.ts

@@ -5,7 +5,7 @@ export type { DeleteResult } from "../tenants/delete.js";
 export { rotateOwnerToken } from "../tenants/rotate.js";
 export type { RotateResult } from "../tenants/rotate.js";
 export { WAKE_PRESETS, configFields, saveWakeSettings, tenantForAccount, wakeHeaderProblem, wakeSettingsOf, wakeUrlProblem, } from "../tenants/wake.js";
-export type { WakeSave, WakeSettings } from "../tenants/wake.js";
+export type { WakeSave, WakeSaveInput, WakeSettings } from "../tenants/wake.js";
 export { MAX_WAKE_PLAIN, MAX_WAKE_SEALED, MAX_WAKE_VALUE, WAKE_SECRET_KEYS, openWakeSecrets, sealWakeSecrets, } from "../tenants/wake-secrets.js";
 export type { WakeSecretKey, WakeSecrets } from "../tenants/wake-secrets.js";
 export { RESERVED_NAMES, TENANT_NAME, tenantNameProblem } from "../tenants/reserved.js";

package/dist/types/control/src/tenants/wake.d.ts

@@ -7,6 +7,19 @@ export interface WakeSettings {
     preset: string;
     keyHeader: string;
 }
+/** Blank credentials retain a saved value only for the same URL and authentication mode.
+ * Callers validate public DNS before saving; the Worker enforces its delivery policy separately. */
+export interface WakeSaveInput {
+    accountId: string;
+    name: string;
+    url: string;
+    preset: string;
+    keyHeader: string;
+    key: string;
+    hmacSecret?: string;
+    /** Version of the settings the caller tested. A stale version makes no write. */
+    expectedVersion?: number;
+}
 export type WakeSave = {
     ok: true;
 } | {
@@ -32,12 +45,5 @@ export declare function wakeHeaderProblem(value: string): string;
 export declare function wakeSettingsOf(config: Record<string, string>): WakeSettings;
 /** The signed-in account's agent, or null. Another account's agent is the same result. */
 export declare function tenantForAccount(db: Sql, accountId: string, name: string): Promise<TenantRow | null>;
-export declare function saveWakeSettings(db: Sql, plane: DataPlane, secretsKey: string, input: {
-    accountId: string;
-    name: string;
-    url: string;
-    preset: string;
-    keyHeader: string;
-    key: string;
-}): Promise<WakeSave>;
+export declare function saveWakeSettings(db: Sql, plane: DataPlane, secretsKey: string, input: WakeSaveInput): Promise<WakeSave>;
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@a2a-exposed/control-core",
-	"version": "0.8.19",
+	"version": "0.8.21",
 	"description": "A2A endpoint provisioning, routing, and D1 migrations for a2a-exposed.",
 	"type": "module",
 	"scripts": {