@a2a-exposed/control-core 0.8.34 → 0.8.35

package/dist/index.js

@@ -307,7 +307,33 @@ var MAX_WAKE_PLAIN = (() => {
   }
   return n;
 })();
-var MAX_WAKE_SEALED = 3 + 16 + 1 + Math.ceil((MAX_WAKE_PLAIN * 3 + 16) * 4 / 3);
+var MAX_WAKE_SEALED = 3 + 64 + 1 + 16 + 1 + Math.ceil((MAX_WAKE_PLAIN * 3 + 16) * 4 / 3);
+function tenantSecretsKeyring(input) {
+  if (!input) return null;
+  if (!input.trimStart().startsWith("{")) return { active: "", keys: { "": input }, legacy: true };
+  if (input.length > 65536) return null;
+  try {
+    const value = JSON.parse(input);
+    if (!value || value.v !== 2 || typeof value.active !== "string" || !value.keys || typeof value.keys !== "object" || Array.isArray(value.keys) || Object.keys(value).some((name) => !["v", "active", "keys"].includes(name))) return null;
+    const entries = Object.entries(value.keys);
+    if (entries.length < 1 || entries.length > 2 || !Object.hasOwn(value.keys, value.active)) return null;
+    for (const [kid, key] of entries) {
+      if (!/^[A-Za-z0-9_-]{1,64}$/.test(kid) || typeof key !== "string" || !key.trim() || key.length > 4096) return null;
+    }
+    return { active: value.active, keys: value.keys, legacy: false };
+  } catch {
+    return null;
+  }
+}
+function tenantSecretsMaterials(input) {
+  const ring = tenantSecretsKeyring(input);
+  if (!ring) return [];
+  return [ring.keys[ring.active], ...Object.entries(ring.keys).filter(([kid]) => kid !== ring.active).map(([, key]) => key)];
+}
+function unreadable() {
+  console.error(JSON.stringify({ event: "wake_secrets_unreadable", level: "error" }));
+  return null;
+}
 function b64(bytes2) {
   let raw = "";
   for (let i = 0; i < bytes2.length; i += 32768) raw += String.fromCharCode(...bytes2.subarray(i, i + 32768));
@@ -336,47 +362,68 @@ function payloadOf(secrets) {
   return payload;
 }
 async function sealWakeSecrets(ikm, tenantId, secrets) {
-  const key = await derive(ikm, tenantId);
+  const ring = tenantSecretsKeyring(ikm);
+  const key = ring ? await derive(ring.keys[ring.active], tenantId) : null;
   const payload = payloadOf(secrets);
   if (!key || !payload) return null;
   const json = JSON.stringify(payload);
   const encoded = new TextEncoder().encode(json);
   if (json.length > MAX_WAKE_PLAIN || encoded.length > MAX_WAKE_PLAIN * 3) return null;
+  const prefix = ring.legacy ? "v1" : `v2.${ring.active}`;
+  const aad = ring.legacy ? tenantId : `${prefix}\0${tenantId}`;
   const iv = crypto.getRandomValues(new Uint8Array(12));
   const ct = new Uint8Array(await crypto.subtle.encrypt(
-    { name: "AES-GCM", iv, additionalData: new TextEncoder().encode(tenantId) },
+    { name: "AES-GCM", iv, additionalData: new TextEncoder().encode(aad) },
     key,
     encoded
   ));
-  const sealed = `v1.${b64(iv)}.${b64(ct)}`;
+  const sealed = `${prefix}.${b64(iv)}.${b64(ct)}`;
   return sealed.length <= MAX_WAKE_SEALED ? sealed : null;
 }
 async function openWakeSecrets(ikm, tenantId, sealed) {
   if (sealed == null || sealed === "") return {};
-  if (sealed.length > MAX_WAKE_SEALED) return null;
-  const key = await derive(ikm, tenantId);
-  if (!key) return null;
-  const [version, iv, ct, extra] = sealed.split(".");
-  if (version !== "v1" || !iv || !ct || extra !== void 0) return null;
-  try {
-    const plain = new TextDecoder().decode(await crypto.subtle.decrypt(
-      { name: "AES-GCM", iv: unb64(iv), additionalData: new TextEncoder().encode(tenantId) },
-      key,
-      unb64(ct)
-    ));
-    if (plain.length > MAX_WAKE_PLAIN) return null;
-    const parsed = JSON.parse(plain);
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-    const out = {};
-    for (const name of WAKE_SECRET_KEYS) {
-      const value = parsed[name];
-      if (typeof value !== "string" || !value || value.length > MAX_WAKE_VALUE) continue;
-      out[name] = value;
+  if (typeof sealed !== "string" || sealed.length > MAX_WAKE_SEALED) return unreadable();
+  const ring = tenantSecretsKeyring(ikm);
+  if (!ring || !tenantId) return unreadable();
+  const parts = sealed.split(".");
+  const version = parts[0];
+  const kid = version === "v2" ? parts[1] : "";
+  if (version !== "v1" && version !== "v2") return unreadable();
+  if (parts.length !== (version === "v2" ? 4 : 3)) return unreadable();
+  const [iv, ct] = parts.slice(version === "v2" ? 2 : 1);
+  if (!iv || !ct || version === "v2" && (ring.legacy || !Object.hasOwn(ring.keys, kid))) return unreadable();
+  const materials = version === "v2" ? [ring.keys[kid]] : tenantSecretsMaterials(ikm);
+  const aad = version === "v2" ? `v2.${kid}\0${tenantId}` : tenantId;
+  for (const material of materials) {
+    try {
+      const key = await derive(material, tenantId);
+      if (!key) continue;
+      const ivBytes = unb64(iv);
+      if (ivBytes.length !== 12) return unreadable();
+      const plain = new TextDecoder().decode(await crypto.subtle.decrypt(
+        { name: "AES-GCM", iv: ivBytes, additionalData: new TextEncoder().encode(aad) },
+        key,
+        unb64(ct)
+      ));
+      if (plain.length > MAX_WAKE_PLAIN) return unreadable();
+      const parsed = JSON.parse(plain);
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return unreadable();
+      const out = {};
+      for (const name of WAKE_SECRET_KEYS) {
+        const value = parsed[name];
+        if (typeof value !== "string" || !value || value.length > MAX_WAKE_VALUE) continue;
+        out[name] = value;
+      }
+      return out;
+    } catch {
     }
-    return out;
-  } catch {
-    return null;
   }
+  return unreadable();
+}
+async function rewrapWakeSecrets(ikm, tenantId, sealed) {
+  if (!sealed) return null;
+  const secrets = await openWakeSecrets(ikm, tenantId, sealed);
+  return secrets ? sealWakeSecrets(ikm, tenantId, secrets) : null;
 }
 
 // src/tenants/create.ts
@@ -3672,6 +3719,7 @@ export {
   resultList,
   resultObject,
   resumeFields,
+  rewrapWakeSecrets,
   rotateOwnerToken,
   routes,
   runInboxStep,

package/dist/types/control/src/core/index.d.ts

@@ -6,7 +6,7 @@ export { rotateOwnerToken } from "../tenants/rotate.js";
 export type { RotateResult } from "../tenants/rotate.js";
 export { WAKE_PRESETS, configFields, saveWakeSettings, tenantForAccount, wakeHeaderProblem, wakeSettingsOf, wakeUrlProblem, } from "../tenants/wake.js";
 export type { WakeSave, WakeSaveInput, WakeSettings } from "../tenants/wake.js";
-export { MAX_WAKE_PLAIN, MAX_WAKE_SEALED, MAX_WAKE_VALUE, WAKE_SECRET_KEYS, openWakeSecrets, sealWakeSecrets, } from "../tenants/wake-secrets.js";
+export { MAX_WAKE_PLAIN, MAX_WAKE_SEALED, MAX_WAKE_VALUE, WAKE_SECRET_KEYS, openWakeSecrets, rewrapWakeSecrets, sealWakeSecrets, } from "../tenants/wake-secrets.js";
 export type { WakeSecretKey, WakeSecrets } from "../tenants/wake-secrets.js";
 export { RESERVED_NAMES, TENANT_NAME, tenantNameProblem } from "../tenants/reserved.js";
 export { httpsOrigin, newApprovalClient } from "../tenants/approval.js";

package/dist/types/control/src/env.d.ts

@@ -32,7 +32,7 @@ export interface ControlEnv extends PlaneEnv {
     SIGNUP_ALLOWLIST?: string;
     /** Default agents per account. Unset or empty: no cap, unless that account sets agent_limit. An explicit non-negative integer sets the cap. */
     FREE_AGENT_LIMIT?: string;
-    /** Same secret as the data-plane Worker. Seals wake secrets. Unset: a new key cannot be saved. */
+    /** Same raw key or JSON rotation keyring as the data-plane Worker. Seals tenant secrets. Unset: a new key cannot be saved. */
     TENANT_SECRETS_KEY?: string;
     /**
      * Fine-grained token with Issues write on FEEDBACK_REPO. A secret.

package/dist/types/control/src/tenants/wake-secrets.d.ts

@@ -9,17 +9,29 @@ export declare const MAX_WAKE_VALUE = 4096;
  * and every known field may be present. `openWakeSecrets` accepts this and nothing larger.
  */
 export declare const MAX_WAKE_PLAIN: number;
-/** `v1.` + base64(12-byte iv) + `.` + base64(utf-8 plaintext + 16-byte tag). */
+/** Longest envelope: `v2.<64-char kid>.<iv>.<ciphertext>`. */
 export declare const MAX_WAKE_SEALED: number;
+/** A bounded keyring lives in the existing secret binding, never in public config. */
+export interface TenantSecretsKeyring {
+    active: string;
+    keys: Record<string, string>;
+    legacy: boolean;
+}
+/** Raw keys preserve v1 writes for a reader-first rollout. JSON keyrings enable v2 writes. */
+export declare function tenantSecretsKeyring(input: string): TenantSecretsKeyring | null;
+/** Current material first, then the single read-only rotation key. No caller may log these values. */
+export declare function tenantSecretsMaterials(input: string): string[];
 /**
  * Config written next to a sealed blob. The sealed fields stay in `secrets_enc`.
  * With no ciphertext, the config is returned unchanged.
  */
 export declare function omitSealedSecrets<T extends Record<string, unknown>>(config: T, secretsEnc: string | null | undefined): T;
-/** `v1.<iv>.<ciphertext>`, or null when the key or a value is unusable. */
+/** `v2.<kid>.<iv>.<ciphertext>` for keyrings; raw keys keep v1 writes until rollout completes. */
 export declare function sealWakeSecrets(ikm: string, tenantId: string, secrets: WakeSecrets): Promise<string | null>;
 /**
  * The sealed fields, `{}` when there is nothing to open, or null when the blob cannot be read.
  * A null result must not be treated as "no secrets": the caller keeps the previous ciphertext.
  */
 export declare function openWakeSecrets(ikm: string, tenantId: string, sealed: string | null | undefined): Promise<WakeSecrets | null>;
+/** Pure maintenance helper. The caller must CAS the original blob and queue the new tenant config. */
+export declare function rewrapWakeSecrets(ikm: string, tenantId: string, sealed: string): Promise<string | null>;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@a2a-exposed/control-core",
-	"version": "0.8.34",
+	"version": "0.8.35",
 	"description": "A2A endpoint provisioning, routing, and D1 migrations for a2a-exposed.",
 	"type": "module",
 	"scripts": {