@a2a-exposed/control-core 0.8.22 → 0.8.24

package/dist/index.js

@@ -293,7 +293,10 @@ var WAKE_SECRET_KEYS = [
   "WAKE_HMAC_SECRET",
   "WAKE_ACCESS_CLIENT_ID",
   "WAKE_ACCESS_CLIENT_SECRET",
-  "EVENT_SECRET"
+  "EVENT_SECRET",
+  "UPSTREAM_TOKEN",
+  "UPSTREAM_ACCESS_CLIENT_ID",
+  "UPSTREAM_ACCESS_CLIENT_SECRET"
 ];
 var MAX_WAKE_VALUE = 4096;
 var MAX_WAKE_PLAIN = (() => {
@@ -560,10 +563,13 @@ async function saveWakeSettings(db, plane, secretsKey, input) {
   const keyHeader = input.keyHeader.trim();
   const key = input.key.trim();
   const hmacSecret = (input.hmacSecret ?? "").trim();
+  const accessClientId = (input.accessClientId ?? "").trim();
+  const accessClientSecret = (input.accessClientSecret ?? "").trim();
   if (wakeUrlProblem(url)) return { ok: false, error: "url" };
   if (!WAKE_PRESETS.includes(preset)) return { ok: false, error: "preset" };
   if (wakeHeaderProblem(keyHeader)) return { ok: false, error: "header" };
-  if ([key, hmacSecret].some((value) => value.length > 4096 || /[\u0000-\u001f]/.test(value))) return { ok: false, error: "key" };
+  if ([key, hmacSecret, accessClientId, accessClientSecret].some((value) => value.length > 4096 || /[\u0000-\u001f]/.test(value))) return { ok: false, error: "key" };
+  if (url && Boolean(accessClientId) !== Boolean(accessClientSecret)) return { ok: false, error: "key" };
   if (url && preset === "openbot" && (key || keyHeader)) return { ok: false, error: keyHeader ? "header" : "key" };
   const config = configFields(row.config_json);
   const plaintext = {};
@@ -576,7 +582,7 @@ async function saveWakeSettings(db, plane, secretsKey, input) {
   const sameKey = same && (config.WAKE_KEY_HEADER ?? "") === keyHeader;
   let secretsEnc = row.secrets_enc;
   const hasSecrets = !!secretsEnc || Object.keys(plaintext).length > 0;
-  if (hasSecrets || key || hmacSecret || url && preset === "openbot") {
+  if (hasSecrets || key || hmacSecret || accessClientId || accessClientSecret || url && preset === "openbot") {
     const ikm = secretsKey.trim();
     if (!ikm) return { ok: false, error: "unavailable" };
     const current = secretsEnc ? await openWakeSecrets(ikm, row.id, secretsEnc) : { ...plaintext };
@@ -584,6 +590,14 @@ async function saveWakeSettings(db, plane, secretsKey, input) {
     const before = JSON.stringify(current);
     if (!url || !sameKey || preset === "openbot") delete current.WAKE_WEBHOOK_KEY;
     if (!url || !same) delete current.WAKE_HMAC_SECRET;
+    if (!url || config.WAKE_WEBHOOK_URL !== url) {
+      delete current.WAKE_ACCESS_CLIENT_ID;
+      delete current.WAKE_ACCESS_CLIENT_SECRET;
+    }
+    if (url && accessClientId && accessClientSecret) {
+      current.WAKE_ACCESS_CLIENT_ID = accessClientId;
+      current.WAKE_ACCESS_CLIENT_SECRET = accessClientSecret;
+    }
     if (url && key && preset !== "openbot") current.WAKE_WEBHOOK_KEY = key;
     if (url && hmacSecret) current.WAKE_HMAC_SECRET = hmacSecret;
     if (url && preset === "openbot" && !current.WAKE_HMAC_SECRET) return { ok: false, error: "key" };
@@ -3035,6 +3049,12 @@ var conversation_peer_owner_default = "-- One row per peer. The same context id
 // sql-raw:/home/runner/work/a2a-exposed/a2a-exposed/worker/migrations/0013_reply_delivery.sql
 var reply_delivery_default = "-- One delivery outcome for one logical owner reply. The key includes the inbound turn and reply content,\n-- so an HTTP/MCP retry is idempotent while a later peer message permits the same words to be sent again.\nCREATE TABLE IF NOT EXISTS reply_deliveries (\n	delivery_key TEXT PRIMARY KEY,\n	task_id TEXT NOT NULL,\n	message_id TEXT NOT NULL,\n	result_json TEXT,\n	created_at TEXT NOT NULL,\n	updated_at TEXT NOT NULL\n);\nCREATE INDEX IF NOT EXISTS reply_deliveries_task ON reply_deliveries(task_id, created_at);\n";
 
+// sql-raw:/home/runner/work/a2a-exposed/a2a-exposed/worker/migrations/0014_peer_address.sql
+var peer_address_default = "-- Pairing identity and the last verified callback address. Existing rows stay valid: every new column is nullable,\n-- so a peer paired before this migration keeps its token and has no callback until it announces one.\nALTER TABLE peers ADD COLUMN identity_key TEXT;\nALTER TABLE peers ADD COLUMN card_url TEXT;\nALTER TABLE peers ADD COLUMN previous_card_url TEXT;\nALTER TABLE peers ADD COLUMN previous_until_ms INTEGER;\n-- Sealed copy of a return token this inbox minted (source = 'reverse'). Null for every other peer.\n-- The owner API never selects this column. Export omits it.\nALTER TABLE peers ADD COLUMN token_enc TEXT;\nALTER TABLE device_requests ADD COLUMN identity_key TEXT;\n";
+
+// sql-raw:/home/runner/work/a2a-exposed/a2a-exposed/worker/migrations/0015_outbound_source.sql
+var outbound_source_default = "-- Who created an outbound peer. NULL is an owner upload (`peers sync`). `announce` is a row this\n-- inbox created from a verified PeerAddressUpdate. An announcement must not repoint any other row.\nALTER TABLE outbound_peers ADD COLUMN source TEXT;\n";
+
 // src/provision/inbox-migrations.ts
 var INBOX_MIGRATIONS = [
   { name: "0001_init.sql", sql: init_default },
@@ -3049,7 +3069,9 @@ var INBOX_MIGRATIONS = [
   { name: "0010_conversation_peer.sql", sql: conversation_peer_default },
   { name: "0011_conversation_owner.sql", sql: conversation_owner_default },
   { name: "0012_conversation_peer_owner.sql", sql: conversation_peer_owner_default },
-  { name: "0013_reply_delivery.sql", sql: reply_delivery_default }
+  { name: "0013_reply_delivery.sql", sql: reply_delivery_default },
+  { name: "0014_peer_address.sql", sql: peer_address_default },
+  { name: "0015_outbound_source.sql", sql: outbound_source_default }
 ];
 
 // sql-raw:/home/runner/work/a2a-exposed/a2a-exposed/control/migrations/0001_auth.sql

package/dist/types/control/src/tenants/push.d.ts

@@ -25,8 +25,9 @@ export interface OwnerCall {
     /** Allowlisted query parameters only. */
     query?: Record<string, string>;
     /**
-     * Tool arguments for `POST /owner/mcp/send`, `POST /owner/mcp/reply`, and `POST /owner/mcp/mark_working`.
-     * Any other call refuses a body.
+     * Tool arguments for `POST /owner/mcp/send`, `POST /owner/mcp/reply`, `POST /owner/mcp/mark_working`,
+     * and `POST /owner/mcp/announce_address`. `PUT /owner/outbound-peers/:alias`, `PUT /owner/address-forward`,
+     * and `POST /owner/peers/announce` also take a body. Any other call refuses a body.
      */
     body?: unknown;
     /** Approve or deny after a recent sign-in. */

package/dist/types/control/src/tenants/wake-secrets.d.ts

@@ -1,5 +1,5 @@
 /** Sealed secret fields. Anything else in the blob is ignored. */
-export declare const WAKE_SECRET_KEYS: readonly ["WAKE_WEBHOOK_KEY", "WAKE_HMAC_SECRET", "WAKE_ACCESS_CLIENT_ID", "WAKE_ACCESS_CLIENT_SECRET", "EVENT_SECRET"];
+export declare const WAKE_SECRET_KEYS: readonly ["WAKE_WEBHOOK_KEY", "WAKE_HMAC_SECRET", "WAKE_ACCESS_CLIENT_ID", "WAKE_ACCESS_CLIENT_SECRET", "EVENT_SECRET", "UPSTREAM_TOKEN", "UPSTREAM_ACCESS_CLIENT_ID", "UPSTREAM_ACCESS_CLIENT_SECRET"];
 export type WakeSecretKey = (typeof WAKE_SECRET_KEYS)[number];
 export type WakeSecrets = Partial<Record<WakeSecretKey, string>>;
 /** One secret. The form uses the same cap. */

package/dist/types/control/src/tenants/wake.d.ts

@@ -7,7 +7,7 @@ export interface WakeSettings {
     preset: string;
     keyHeader: string;
 }
-/** Blank credentials retain a saved value only for the same URL and authentication mode.
+/** Blank webhook/signing credentials retain a saved value only for the same URL and authentication mode.
  * Callers validate public DNS before saving; the Worker enforces its delivery policy separately. */
 export interface WakeSaveInput {
     accountId: string;
@@ -17,6 +17,9 @@ export interface WakeSaveInput {
     keyHeader: string;
     key: string;
     hmacSecret?: string;
+    /** Both fields are required when replacing a tunnel Access service token. */
+    accessClientId?: string;
+    accessClientSecret?: string;
     /** Version of the settings the caller tested. A stale version makes no write. */
     expectedVersion?: number;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@a2a-exposed/control-core",
-	"version": "0.8.22",
+	"version": "0.8.24",
 	"description": "A2A endpoint provisioning, routing, and D1 migrations for a2a-exposed.",
 	"type": "module",
 	"scripts": {