@a2a-exposed/control-core 0.8.23 → 0.8.25

package/dist/index.js

@@ -293,7 +293,10 @@ var WAKE_SECRET_KEYS = [
   "WAKE_HMAC_SECRET",
   "WAKE_ACCESS_CLIENT_ID",
   "WAKE_ACCESS_CLIENT_SECRET",
-  "EVENT_SECRET"
+  "EVENT_SECRET",
+  "UPSTREAM_TOKEN",
+  "UPSTREAM_ACCESS_CLIENT_ID",
+  "UPSTREAM_ACCESS_CLIENT_SECRET"
 ];
 var MAX_WAKE_VALUE = 4096;
 var MAX_WAKE_PLAIN = (() => {
@@ -560,10 +563,13 @@ async function saveWakeSettings(db, plane, secretsKey, input) {
   const keyHeader = input.keyHeader.trim();
   const key = input.key.trim();
   const hmacSecret = (input.hmacSecret ?? "").trim();
+  const accessClientId = (input.accessClientId ?? "").trim();
+  const accessClientSecret = (input.accessClientSecret ?? "").trim();
   if (wakeUrlProblem(url)) return { ok: false, error: "url" };
   if (!WAKE_PRESETS.includes(preset)) return { ok: false, error: "preset" };
   if (wakeHeaderProblem(keyHeader)) return { ok: false, error: "header" };
-  if ([key, hmacSecret].some((value) => value.length > 4096 || /[\u0000-\u001f]/.test(value))) return { ok: false, error: "key" };
+  if ([key, hmacSecret, accessClientId, accessClientSecret].some((value) => value.length > 4096 || /[\u0000-\u001f]/.test(value))) return { ok: false, error: "key" };
+  if (url && Boolean(accessClientId) !== Boolean(accessClientSecret)) return { ok: false, error: "key" };
   if (url && preset === "openbot" && (key || keyHeader)) return { ok: false, error: keyHeader ? "header" : "key" };
   const config = configFields(row.config_json);
   const plaintext = {};
@@ -576,7 +582,7 @@ async function saveWakeSettings(db, plane, secretsKey, input) {
   const sameKey = same && (config.WAKE_KEY_HEADER ?? "") === keyHeader;
   let secretsEnc = row.secrets_enc;
   const hasSecrets = !!secretsEnc || Object.keys(plaintext).length > 0;
-  if (hasSecrets || key || hmacSecret || url && preset === "openbot") {
+  if (hasSecrets || key || hmacSecret || accessClientId || accessClientSecret || url && preset === "openbot") {
     const ikm = secretsKey.trim();
     if (!ikm) return { ok: false, error: "unavailable" };
     const current = secretsEnc ? await openWakeSecrets(ikm, row.id, secretsEnc) : { ...plaintext };
@@ -584,6 +590,14 @@ async function saveWakeSettings(db, plane, secretsKey, input) {
     const before = JSON.stringify(current);
     if (!url || !sameKey || preset === "openbot") delete current.WAKE_WEBHOOK_KEY;
     if (!url || !same) delete current.WAKE_HMAC_SECRET;
+    if (!url || config.WAKE_WEBHOOK_URL !== url) {
+      delete current.WAKE_ACCESS_CLIENT_ID;
+      delete current.WAKE_ACCESS_CLIENT_SECRET;
+    }
+    if (url && accessClientId && accessClientSecret) {
+      current.WAKE_ACCESS_CLIENT_ID = accessClientId;
+      current.WAKE_ACCESS_CLIENT_SECRET = accessClientSecret;
+    }
     if (url && key && preset !== "openbot") current.WAKE_WEBHOOK_KEY = key;
     if (url && hmacSecret) current.WAKE_HMAC_SECRET = hmacSecret;
     if (url && preset === "openbot" && !current.WAKE_HMAC_SECRET) return { ok: false, error: "key" };
@@ -608,7 +622,7 @@ async function saveWakeSettings(db, plane, secretsKey, input) {
     ).bind(configJson, secretsEnc, version, now, row.id, input.accountId, row.config_version),
     db.prepare(
       `INSERT INTO config_outbox (tenant_id, version, created_at)
-			 SELECT id, ?, ? FROM tenants WHERE id = ? AND owner_account_id = ? AND config_version = ?`
+			 SELECT id, ?, ? FROM tenants WHERE id = ? AND owner_account_id = ? AND config_version = ? AND changes() = 1`
     ).bind(version, now, row.id, input.accountId, version)
   ]);
   if (updated[0]?.meta?.changes !== 1) return { ok: false, error: "conflict" };

package/dist/types/control/src/tenants/wake-secrets.d.ts

@@ -1,5 +1,5 @@
 /** Sealed secret fields. Anything else in the blob is ignored. */
-export declare const WAKE_SECRET_KEYS: readonly ["WAKE_WEBHOOK_KEY", "WAKE_HMAC_SECRET", "WAKE_ACCESS_CLIENT_ID", "WAKE_ACCESS_CLIENT_SECRET", "EVENT_SECRET"];
+export declare const WAKE_SECRET_KEYS: readonly ["WAKE_WEBHOOK_KEY", "WAKE_HMAC_SECRET", "WAKE_ACCESS_CLIENT_ID", "WAKE_ACCESS_CLIENT_SECRET", "EVENT_SECRET", "UPSTREAM_TOKEN", "UPSTREAM_ACCESS_CLIENT_ID", "UPSTREAM_ACCESS_CLIENT_SECRET"];
 export type WakeSecretKey = (typeof WAKE_SECRET_KEYS)[number];
 export type WakeSecrets = Partial<Record<WakeSecretKey, string>>;
 /** One secret. The form uses the same cap. */

package/dist/types/control/src/tenants/wake.d.ts

@@ -7,7 +7,7 @@ export interface WakeSettings {
     preset: string;
     keyHeader: string;
 }
-/** Blank credentials retain a saved value only for the same URL and authentication mode.
+/** Blank webhook/signing credentials retain a saved value only for the same URL and authentication mode.
  * Callers validate public DNS before saving; the Worker enforces its delivery policy separately. */
 export interface WakeSaveInput {
     accountId: string;
@@ -17,6 +17,9 @@ export interface WakeSaveInput {
     keyHeader: string;
     key: string;
     hmacSecret?: string;
+    /** Both fields are required when replacing a tunnel Access service token. */
+    accessClientId?: string;
+    accessClientSecret?: string;
     /** Version of the settings the caller tested. A stale version makes no write. */
     expectedVersion?: number;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@a2a-exposed/control-core",
-	"version": "0.8.23",
+	"version": "0.8.25",
 	"description": "A2A endpoint provisioning, routing, and D1 migrations for a2a-exposed.",
 	"type": "module",
 	"scripts": {