a2a-exposed 0.4.1 → 0.6.0

package/worker/test/migrations.test.ts

@@ -57,7 +57,7 @@ test("migration files: NNNN_name.sql, unique numbers, no gaps, 0002_wake_budget
 test("fresh database: every migration applies in order; a second run applies nothing", () => {
 	const db = new DatabaseSync(":memory:");
 	assert.deepEqual(applyMigrations(db), [...FILES].sort(byNumber));
-	for (const t of ["peers", "tasks", "wakes", "wake_budget", "device_requests", "pairing_rate", "settings", "facade_owners"]) assert.ok(tables(db).includes(t), t);
+	for (const t of ["peers", "tasks", "wakes", "wake_budget", "device_requests", "pairing_rate", "settings", "facade_owners", "oauth_clients", "oauth_codes", "mcp_grants", "outbound_peers", "oauth_client_metadata", "oidc_txns"]) assert.ok(tables(db).includes(t), t);
 	assert.ok(columns(db, "peers").includes("source"));
 	assert.ok(columns(db, "device_requests").includes("replaces_label"));
 	assert.ok(columns(db, "device_requests").includes("replaces_hash"));
@@ -67,15 +67,15 @@ test("fresh database: every migration applies in order; a second run applies not
 test("database from the 0002 fix (0001-0003 recorded): only 0004 and later apply; pending requests keep working", () => {
 	const db = existingDb([sql("0001_init.sql"), sql("0002_wake_budget.sql"), sql("0003_device_pairing.sql")], ["0001_init.sql", "0002_wake_budget.sql", "0003_device_pairing.sql"]);
 	db.prepare("INSERT INTO device_requests (device_hash, user_code, status, created_ms, expires_ms, interval_s) VALUES ('h', 'WDJB4827', 'pending', 1, 2, 5)").run();
-	assert.deepEqual(applyMigrations(db), ["0004_pairing_replace.sql", "0005_facade_owners.sql"]);
+	assert.deepEqual(applyMigrations(db), ["0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql"]);
 	assert.equal((db.prepare("SELECT replaces_label FROM device_requests WHERE device_hash = 'h'").get() as any).replaces_label, null);
 });
 
 test("database from v0.2.0 (0001 and 0003 recorded): 0002 applies as a no-op and keeps the data", () => {
 	const db = existingDb([sql("0001_init.sql"), sql("0003_device_pairing.sql")], ["0001_init.sql", "0003_device_pairing.sql"]);
 	db.prepare("INSERT INTO wake_budget (hour, count) VALUES (1, 7)").run();
-	assert.deepEqual(applyMigrations(db), ["0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql"]);
-	assert.deepEqual(recorded(db), ["0001_init.sql", "0003_device_pairing.sql", "0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql"]);
+	assert.deepEqual(applyMigrations(db), ["0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql"]);
+	assert.deepEqual(recorded(db), ["0001_init.sql", "0003_device_pairing.sql", "0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql"]);
 	assert.equal((db.prepare("SELECT count FROM wake_budget WHERE hour = 1").get() as any).count, 7);
 });
 
@@ -107,7 +107,7 @@ test("database from an earlier build without wake_budget (0001 and 0003 recorded
 		assert.equal(before.data.error?.code, -32603, JSON.stringify(before.data));
 		assert.equal(wakes.length, 0);
 
-		assert.deepEqual(applyMigrations(db), ["0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql"]);
+		assert.deepEqual(applyMigrations(db), ["0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql"]);
 		assert.deepEqual(columns(db, "wake_budget"), ["hour", "count"]);
 		assert.deepEqual(applyMigrations(db), []);
 

package/worker/test/pairing.test.ts

@@ -108,7 +108,7 @@ test("agent card, RFC 8414 metadata and the 401 hint advertise the device flow;
 	const meta = await s.call("GET", "/.well-known/oauth-authorization-server");
 	assert.equal(meta.status, 200);
 	assert.deepEqual([meta.data.issuer, meta.data.device_authorization_endpoint, meta.data.token_endpoint], [BASE, `${BASE}/oauth/device_authorization`, `${BASE}/oauth/token`]);
-	assert.deepEqual(meta.data.grant_types_supported, [GRANT]);
+	assert.deepEqual(meta.data.grant_types_supported, [GRANT, "authorization_code", "refresh_token"], "device flow + the MCP connector's grants");
 	assert.deepEqual(meta.data.token_endpoint_auth_methods_supported, ["none"]);
 
 	for (const [method, v] of [["message/send", "0.3"], ["SendMessage", "1.0"]]) {
@@ -121,6 +121,7 @@ test("agent card, RFC 8414 metadata and the 401 hint advertise the device flow;
 		assert.equal(r.data.error.data.pairing.device_authorization_endpoint, `${BASE}/oauth/device_authorization`);
 		assert.equal(r.data.error.data.pairing.token_endpoint, `${BASE}/oauth/token`);
 		assert.equal(r.data.error.data.pairing.grant_type, GRANT);
+		assert.equal(r.data.error.data.pairing.cli, `npx -y a2a-exposed@latest connect ${BASE}`, "npx, latest, no global install");
 	}
 	const bad = await s.call("POST", "/", { json: { jsonrpc: "2.0", id: "req-7", method: "SendMessage", params: {} }, headers: { authorization: "Bearer nope" } });
 	assert.equal(bad.headers.get("www-authenticate"), `Bearer realm="a2a", resource_metadata="${BASE}/.well-known/oauth-protected-resource", error="invalid_token", error_description="the bearer token is not valid (revoked, rotated or mistyped)"`);
@@ -157,7 +158,16 @@ test("/.well-known/agent.json serves an A2A 0.3 card (url, preferredTransport, p
 });
 
 test("PAIRING_APPROVAL=off: no pairing scheme, endpoints 404, plain 401", async (t) => {
-	const s = setup({ PAIRING_APPROVAL: "off" }); t.after(s.restore);
+	// with MCP on (the default) the authorization server stays up for the connector, without the device flow
+	const m = setup({ PAIRING_APPROVAL: "off" }); t.after(m.restore);
+	const meta = await m.call("GET", "/.well-known/oauth-authorization-server");
+	assert.equal(meta.status, 200);
+	assert.equal(meta.data.device_authorization_endpoint, undefined);
+	assert.deepEqual(meta.data.grant_types_supported, ["authorization_code", "refresh_token"]);
+	for (const [mm, p] of [["POST", "/oauth/device_authorization"], ["GET", "/device"]]) assert.equal((await m.call(mm, p, mm === "POST" ? { form: {} } : {})).status, 404, p);
+	assert.equal((await m.call("POST", "/oauth/token", { form: { grant_type: GRANT, device_code: "x" } })).data.error, "unsupported_grant_type");
+	m.restore();
+	const s = setup({ PAIRING_APPROVAL: "off", MCP: "off" }); t.after(s.restore);
 	const card = (await s.call("GET", "/.well-known/agent-card.json")).data;
 	assert.deepEqual(Object.keys(card.securitySchemes), ["bearer"]);
 	assert.deepEqual(card.securityRequirements, [{ schemes: { bearer: { list: [] } } }]);
@@ -194,7 +204,7 @@ test("human approval: pending, slow_down, page approve with the password, single
 	assert.equal(s.wakes.length, 1);
 	const w = s.wakes[0].body;
 	assert.equal(w.kind, "pairing_request");
-	assert.equal(w.hint, "npx a2a-exposed pair list");
+	assert.equal(w.hint, "npx -y a2a-exposed@latest pair list");
 	assert.deepEqual([w.pairing.userCode, w.pairing.verificationUriComplete, w.pairing.approval, w.pairing.clientId], [d.user_code, d.verification_uri_complete, "human", "barry"]);
 	assert.equal(w.pairing.agentCardUrl, "https://barry.example.org/.well-known/agent-card.json");
 	assert.match(w.pairing.instructions, /never approve on your own[\s\S]*give them this link/);
@@ -228,7 +238,7 @@ test("human approval: pending, slow_down, page approve with the password, single
 	assert.equal(g.headers.get("x-frame-options"), "DENY");
 	assert.match(g.headers.get("set-cookie")!, /^a2a_device_csrf=[A-Za-z0-9_-]{24}; Path=\/device; Secure; HttpOnly; SameSite=Strict/);
 	assert.ok(!/<script|src=|href=/i.test(g.text), "no scripts or external assets");
-	assert.match(g.text, /No approval password is set yet[\s\S]*npx a2a-exposed pair set-password/);
+	assert.match(g.text, /No approval password is set yet[\s\S]*npx -y a2a-exposed@latest pair set-password/);
 	assert.ok(!g.text.includes('name="password"'));
 	assert.equal((await s.decidePage(d.user_code, PASSWORD, "approve")).status, 409);
 
@@ -362,7 +372,7 @@ test("flood control: requests per IP and outstanding requests are capped (no flo
 test("pairing wakes: summary for each preset; requester text only where previews are allowed", async () => {
 	const ev: WakeEvent = { contextId: "pairing", taskId: "none", taskIds: [], from: "Barry", preview: "", kind: "pairing_request", publicUrl: BASE,
 		pairing: { userCode: "WDJB-2345", verificationUriComplete: `${BASE}/device?user_code=WDJB-2345`, approval: "human", clientName: "Barry", clientId: "barry", agentCardUrl: "https://barry.example.org/card", expiresIn: 600 } };
-	const sum = wakeSummary(ev, "npx a2a-exposed");
+	const sum = wakeSummary(ev, "npx -y a2a-exposed@latest");
 	assert.match(sum, /^A2A pairing request: an agent calling itself "Barry" \(claimed card: "https:\/\/barry\.example\.org\/card"\) asks to connect to your inbox \(code WDJB-2345, expires in 10 minutes\)\./);
 	assert.match(sum, /never approve on your own\. Show them the code WDJB-2345 and give them this link: https:\/\/agent\.example\.com\/device\?user_code=WDJB-2345/);
 	const agentSum = wakeSummary({ ...ev, pairing: { ...ev.pairing!, approval: "agent" } }, "a2a");
@@ -581,8 +591,11 @@ test("password setup link: expiry, mismatch, too short, CSRF, a new link invalid
 	for (let i = 0; i < 20; i++) await s.call("GET", "/device/setup?t=nope", { ip: "192.0.2.200" });
 	const limited = await s.call("GET", new URL(l.url).pathname + new URL(l.url).search, { ip: "192.0.2.200" });
 	assert.equal(limited.status, 429);
-	// off mode: no link
+	// pairing off: the link still works while MCP is on (the connector consent needs the password), not with both off
 	s.env.PAIRING_APPROVAL = "off";
+	assert.equal((await s.owner("POST", "/owner/pairing/password-link", {})).status, 200);
+	assert.equal((await s.call("GET", "/device/setup?t=x", { ip: "192.0.2.201" })).status, 404, "reachable (unknown setup token)");
+	s.env.MCP = "off";
 	assert.equal((await s.owner("POST", "/owner/pairing/password-link", {})).status, 409);
 	assert.equal((await s.call("GET", "/device/setup?t=x")).status, 404);
 });
@@ -621,7 +634,7 @@ test("GET /: a browser gets an HTML landing page (strict CSP, no scripts); curl/
 	assert.match(h.text, /A2A \(Agent2Agent\)<\/a> endpoint/);
 	assert.ok(h.text.includes(`href="/.well-known/agent-card.json"`) && h.text.includes(`${BASE}/.well-known/agent-card.json`));
 	assert.ok(h.text.includes(`href="/device"`), "pairing link");
-	assert.ok(h.text.includes(`npx a2a-exposed connect ${BASE}`));
+	assert.ok(h.text.includes(`npx -y a2a-exposed@latest connect ${BASE}`));
 	assert.match(h.text, /1\.0, 0\.3/);
 	// the style block carries the CSP nonce
 	const nonce = /style-src 'nonce-([^']+)'/.exec(csp)![1];

package/worker/test/register-hooks.mjs

@@ -0,0 +1,4 @@
+// Lets `node --test` import `*.sql?raw` the way Vite does at build time. `--import` waits for this module.
+import { register } from "node:module";
+
+await register("./sql-raw-hook.mjs", import.meta.url);

package/worker/test/sql-raw-hook.mjs

@@ -0,0 +1,22 @@
+// Resolve `../migrations/0001_init.sql?raw` to the file text as a default export.
+export async function resolve(specifier, context, nextResolve) {
+	if (typeof specifier === "string" && specifier.includes(".sql?raw")) {
+		const resolved = await nextResolve(specifier.replace(/\?raw$/, ""), context);
+		const url = new URL(resolved.url);
+		url.searchParams.set("raw", "1");
+		return { url: url.href, shortCircuit: true };
+	}
+	return nextResolve(specifier, context);
+}
+
+export async function load(url, context, nextLoad) {
+	const u = new URL(url);
+	if (u.searchParams.get("raw") === "1" && u.pathname.endsWith(".sql")) {
+		const { readFileSync } = await import("node:fs");
+		const { fileURLToPath } = await import("node:url");
+		u.search = "";
+		const text = readFileSync(fileURLToPath(u), "utf8");
+		return { format: "module", source: `export default ${JSON.stringify(text)};\n`, shortCircuit: true };
+	}
+	return nextLoad(url, context);
+}

package/worker/test/storage.test.ts

@@ -0,0 +1,74 @@
+// Adapter and migration runner over node:sqlite. The workerd backends are STORAGE_BACKEND=d1|do. Run: npm test
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import { DatabaseSync } from "node:sqlite";
+import { doSqlD1, migrateDo, type SqlStorageLike, type TxRunner } from "../src/storage.ts";
+import { MIGRATIONS } from "../src/migrations.ts";
+
+function asSql(db: DatabaseSync): SqlStorageLike {
+	return {
+		exec(query: string, ...bindings: unknown[]) {
+			const multi = query.includes(";") && !/^\s*select\b/i.test(query);
+			if (bindings.length === 0 && multi) {
+				db.exec(query);
+				return { toArray: () => [], raw: () => [], rowsRead: 0, rowsWritten: 0 };
+			}
+			const stmt = db.prepare(query);
+			if (/^\s*select\b/i.test(query)) {
+				const rows = stmt.all(...(bindings as [])) as Record<string, unknown>[];
+				return { toArray: () => rows, raw: () => rows.map((r) => Object.values(r)), rowsRead: rows.length, rowsWritten: 0 };
+			}
+			const info = stmt.run(...(bindings as []));
+			return { toArray: () => [], raw: () => [], rowsRead: 0, rowsWritten: Number(info.changes) };
+		},
+	};
+}
+
+function txOf(db: DatabaseSync): TxRunner {
+	return (fn) => {
+		db.exec("BEGIN");
+		try { const v = fn(); db.exec("COMMIT"); return v; }
+		catch (e) { db.exec("ROLLBACK"); throw e; }
+	};
+}
+
+test("bundled migrations match worker/migrations", () => {
+	const disk = fs.readdirSync(new URL("../migrations/", import.meta.url)).filter((n) => n.endsWith(".sql")).sort();
+	assert.deepEqual(MIGRATIONS.map((m) => m.name), disk);
+	for (const m of MIGRATIONS) {
+		const file = fs.readFileSync(new URL(`../migrations/${m.name}`, import.meta.url), "utf8");
+		assert.equal(m.sql, file, m.name);
+	}
+});
+
+test("migrateDo applies in numeric order and a later lower number still runs", () => {
+	const db = new DatabaseSync(":memory:");
+	const sql = asSql(db);
+	const tx = txOf(db);
+	const early = MIGRATIONS.filter((m) => m.name === "0001_init.sql" || m.name === "0003_device_pairing.sql");
+	assert.deepEqual(migrateDo(sql, tx, early), ["0001_init.sql", "0003_device_pairing.sql"]);
+	const rest = migrateDo(sql, tx, MIGRATIONS);
+	assert.equal(rest[0], "0002_wake_budget.sql");
+	assert.deepEqual(rest, MIGRATIONS.map((m) => m.name).filter((n) => n !== "0001_init.sql" && n !== "0003_device_pairing.sql"));
+	assert.deepEqual(migrateDo(sql, tx, MIGRATIONS), []);
+	const names = db.prepare("SELECT name FROM d1_migrations ORDER BY id").all().map((r) => (r as { name: string }).name);
+	assert.deepEqual(names, ["0001_init.sql", "0003_device_pairing.sql", ...rest]);
+});
+
+test("doSqlD1 matches D1 binding rules: booleans, undefined, missing columns, batch rollback", async () => {
+	const db = new DatabaseSync(":memory:");
+	const d = doSqlD1(asSql(db), txOf(db));
+	await d.exec("CREATE TABLE t (n INTEGER)");
+	await d.prepare("INSERT INTO t (n) VALUES (?)").bind(true).run();
+	assert.equal((await d.prepare("SELECT n FROM t").first<{ n: number }>())?.n, 1);
+	const wrote = await d.prepare("INSERT INTO t (n) VALUES (?)").bind(4).run();
+	assert.equal(wrote.meta.changes, 1);
+	await assert.rejects(() => d.prepare("SELECT n FROM t WHERE n = ?").bind(undefined).first(), /D1_TYPE_ERROR/);
+	await assert.rejects(() => d.prepare("SELECT n FROM t").first("missing"), /D1_COLUMN_NOTFOUND/);
+	await assert.rejects(() => d.batch([
+		d.prepare("INSERT INTO t (n) VALUES (9)"),
+		d.prepare("INSERT INTO missing (n) VALUES (1)"),
+	]));
+	assert.equal((await d.prepare("SELECT COUNT(*) AS c FROM t WHERE n = 9").first<{ c: number }>())?.c, 0);
+});

package/worker/test/tenancy.test.ts

@@ -0,0 +1,217 @@
+// Tenant context: gates default off, self-host owner auth and peer-token key stay compatible, hosted uses a hash
+// and TENANT_SECRETS_KEY. Run: npm test
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import worker from "../src/index.ts";
+import { sha256 } from "../src/a2a.ts";
+import { openPeerToken, openPeerTokenWithKey, sealPeerToken, sealPeerTokenWithKey } from "../src/mcp.ts";
+import { hostedTenantContext, namespaceForRegion, parseGates, resolveTenant, type WorkerBindings } from "../src/tenancy.ts";
+import { d1 } from "./d1.ts";
+
+const dummy = { prepare() { throw new Error("storage should not be touched"); } } as any;
+const BASE = "https://agent.example.com";
+
+function selfEnv(over: Record<string, unknown> = {}): WorkerBindings {
+	return { DB: dummy, PUBLIC_URL: BASE, OWNER_TOKEN: "owner-secret", ...over } as WorkerBindings;
+}
+
+test("gates: unset is single-tenant and every reserved gate is off", () => {
+	const g = parseGates({ DB: dummy } as WorkerBindings).gates;
+	assert.equal(g.tenancy, "single");
+	assert.equal(g.hostedStorage, false);
+	assert.equal(g.quotas, false);
+	assert.equal(g.usageSink, "");
+	assert.equal(g.wakeTargetPolicy, "");
+	assert.equal(g.signupUrl, "");
+	assert.equal(g.branding, "");
+	assert.equal(g.dataRegion, "");
+	assert.equal(g.tenantDomain, "");
+	assert.deepEqual(g.approvalOidc, { issuer: "", clientId: "", hasClientSecret: false, allowedSubjects: [], methods: ["password"], methodsSpecified: false, label: "" });
+});
+
+test("gates: only exact values turn on; typos and non-https URLs stay off", () => {
+	const g = parseGates({
+		DB: dummy, TENANCY: "Host", QUOTAS: "yes", USAGE_SINK: "log", WAKE_TARGET_POLICY: "https",
+		BRANDING: "a2a", DATA_REGION: "us", SIGNUP_URL: "http://example.com", APPROVAL_OIDC_ISSUER: "http://example.com",
+		APPROVAL_METHODS: "magic", TENANT_DOMAIN: ".Example.COM.",
+	} as WorkerBindings).gates;
+	assert.equal(g.tenancy, "single");
+	assert.equal(g.quotas, false);
+	assert.equal(g.usageSink, "");
+	assert.equal(g.wakeTargetPolicy, "");
+	assert.equal(g.branding, "");
+	assert.equal(g.dataRegion, "");
+	assert.equal(g.signupUrl, "");
+	assert.equal(g.approvalOidc.issuer, "");
+	assert.deepEqual(g.approvalOidc.methods, ["password"]);
+	assert.equal(g.approvalOidc.methodsSpecified, false);
+	assert.equal(g.tenantDomain, "example.com");
+
+	const on = parseGates({
+		DB: dummy, TENANCY: "host", TENANT_DO: {} as any, QUOTAS: "on", USAGE_SINK: "d1",
+		WAKE_TARGET_POLICY: "public-https", BRANDING: "hosted", DATA_REGION: "EU",
+		SIGNUP_URL: "https://example.com/start", APPROVAL_OIDC_ISSUER: "https://example.com",
+		APPROVAL_OIDC_CLIENT_ID: "client", APPROVAL_OIDC_CLIENT_SECRET: "secret",
+		APPROVAL_OIDC_ALLOWED_SUBJECTS: " acct_1 , acct_2 ", APPROVAL_METHODS: "oidc,password",
+		TENANT_DOMAIN: "example.com",
+	} as WorkerBindings).gates;
+	assert.equal(on.tenancy, "host");
+	assert.equal(on.hostedStorage, true);
+	assert.equal(on.quotas, true);
+	assert.equal(on.usageSink, "d1");
+	assert.equal(on.wakeTargetPolicy, "public-https");
+	assert.equal(on.branding, "hosted");
+	assert.equal(on.dataRegion, "eu");
+	assert.equal(on.signupUrl, "https://example.com/start");
+	assert.equal(on.approvalOidc.issuer, "https://example.com");
+	assert.equal(on.approvalOidc.hasClientSecret, true);
+	assert.deepEqual(on.approvalOidc.allowedSubjects, ["acct_1", "acct_2"]);
+	assert.deepEqual(on.approvalOidc.methods, ["oidc", "password"]);
+	assert.equal(on.approvalOidc.methodsSpecified, true);
+	assert.equal(on.approvalOidc.label, "");
+});
+
+test("TENANCY=host without TENANT_DO does not flip hostedStorage", () => {
+	assert.equal(parseGates({ DB: dummy, TENANCY: "host" } as WorkerBindings).gates.hostedStorage, false);
+});
+
+test("self-host peer key decrypts tokens sealed from OWNER_TOKEN, and ignores TENANT_SECRETS_KEY", async () => {
+	const sealed = await sealPeerToken("owner-secret", "alpha", "peer-token");
+	const ctx = resolveTenant(selfEnv({ TENANT_SECRETS_KEY: "platform-key-not-used", TENANCY: "host" }));
+	assert.equal(ctx.mode, "single");
+	assert.equal(ctx.id, "");
+	const key = await ctx.peerKey();
+	assert.ok(key);
+	assert.equal(await openPeerTokenWithKey(key!, "alpha", sealed), "peer-token");
+	assert.equal(await openPeerToken("owner-secret", "alpha", sealed), "peer-token");
+	assert.equal(await ctx.peerKey(), key, "the key is derived once per context");
+});
+
+test("self-host owner check is OWNER_TOKEN equality and rejects a missing token before accepting anyone", async () => {
+	const ctx = resolveTenant(selfEnv());
+	assert.equal(await ctx.isOwner("Bearer owner-secret"), true);
+	assert.equal(await ctx.isOwner("bearer owner-secret"), true);
+	assert.equal(await ctx.isOwner("Bearer owner-secret "), true);
+	assert.equal(await ctx.isOwner("Bearer other"), false);
+	assert.equal(await ctx.isOwner(null), false);
+	assert.equal(await ctx.isOwner("Basic owner-secret"), false);
+	const none = resolveTenant(selfEnv({ OWNER_TOKEN: undefined }));
+	assert.equal(await none.isOwner("Bearer owner-secret"), false);
+	assert.equal(await none.peerKey(), null);
+});
+
+test("hosted owner check uses the token hash and never the platform OWNER_TOKEN", async () => {
+	const token = "hosted-owner-token";
+	const hash = await sha256(token);
+	const ctx = hostedTenantContext(selfEnv({ TENANT_SECRETS_KEY: "platform-key" }), {
+		id: "ten_a", db: dummy, publicUrl: "https://a.example.com", ownerTokenHash: hash.toUpperCase(),
+	});
+	assert.equal(ctx.mode, "host");
+	assert.equal(await ctx.isOwner(`Bearer ${token}`), true);
+	assert.equal(await ctx.isOwner("Bearer owner-secret"), false, "platform OWNER_TOKEN does not authenticate");
+	assert.equal(await ctx.isOwner("Bearer wrong"), false);
+	const bad = hostedTenantContext(selfEnv(), {
+		id: "ten_a", db: dummy, publicUrl: "https://a.example.com", ownerTokenHash: "not-a-hash",
+	});
+	assert.equal(await bad.isOwner(`Bearer ${token}`), false);
+	const missing = hostedTenantContext(selfEnv(), { id: "ten_a", db: dummy, publicUrl: "https://a.example.com" });
+	assert.equal(await missing.isOwner(`Bearer ${token}`), false);
+});
+
+test("hosted peer key is HKDF(TENANT_SECRETS_KEY, tenant id) and does not open another tenant or a self-host seal", async () => {
+	const env = selfEnv({ TENANT_SECRETS_KEY: "platform-key" });
+	const a = hostedTenantContext(env, { id: "ten_a", db: dummy, publicUrl: "https://a.example.com", ownerTokenHash: "ab".repeat(32) });
+	const b = hostedTenantContext(env, { id: "ten_b", db: dummy, publicUrl: "https://b.example.com", ownerTokenHash: "ab".repeat(32) });
+	const keyA = await a.peerKey();
+	assert.ok(keyA);
+	const sealed = await sealPeerTokenWithKey(keyA!, "alpha", "peer-token");
+	assert.equal(await openPeerTokenWithKey(keyA!, "alpha", sealed), "peer-token");
+	assert.equal(await openPeerTokenWithKey((await b.peerKey())!, "alpha", sealed), null);
+	assert.equal(await openPeerToken("owner-secret", "alpha", sealed), null);
+	assert.equal(await openPeerToken("platform-key", "alpha", sealed), null);
+	const selfSealed = await sealPeerToken("owner-secret", "alpha", "peer-token");
+	assert.equal(await openPeerTokenWithKey(keyA!, "alpha", selfSealed), null);
+	const noKey = hostedTenantContext(selfEnv(), { id: "ten_a", db: dummy, publicUrl: "https://a.example.com" });
+	assert.equal(await noKey.peerKey(), null);
+});
+
+test("hosted config does not inherit Worker secrets; operational caps do inherit and can be overridden", () => {
+	const ctx = hostedTenantContext(selfEnv({
+		WAKE_WEBHOOK_URL: "https://hooks.example.net/wake", WAKE_WEBHOOK_KEY: "hook-key",
+		UPSTREAM_TOKEN: "upstream", RATE_PER_MIN: "60", AGENT_NAME: "Platform name",
+	}), {
+		id: "ten_a", db: dummy, publicUrl: "https://a.example.com",
+		config: { AGENT_NAME: "Tenant A", WAKE_WEBHOOK_URL: "https://hooks.example.net/a" },
+	});
+	assert.equal(ctx.AGENT_NAME, "Tenant A");
+	assert.equal(ctx.PUBLIC_URL, "https://a.example.com");
+	assert.equal(ctx.WAKE_WEBHOOK_URL, "https://hooks.example.net/a");
+	assert.equal(ctx.WAKE_WEBHOOK_KEY, undefined);
+	assert.equal(ctx.UPSTREAM_TOKEN, undefined);
+	assert.equal(ctx.RATE_PER_MIN, "60");
+	const capped = hostedTenantContext(selfEnv({ RATE_PER_MIN: "60" }), {
+		id: "ten_a", db: dummy, publicUrl: "https://a.example.com", config: { RATE_PER_MIN: "10" },
+	});
+	assert.equal(capped.RATE_PER_MIN, "10");
+});
+
+test("DATA_REGION selects a DO jurisdiction only for eu and fedramp", () => {
+	const calls: string[] = [];
+	const ns = { id: "default", jurisdiction(loc: string) { calls.push(loc); return { id: loc, jurisdiction: ns.jurisdiction }; } };
+	assert.equal(namespaceForRegion(ns, "").id, "default");
+	assert.equal(namespaceForRegion(ns, "eu").id, "eu");
+	assert.equal(namespaceForRegion(ns, "fedramp").id, "fedramp");
+	assert.equal(namespaceForRegion(ns, "us").id, "default");
+	assert.deepEqual(calls, ["eu", "fedramp"]);
+	assert.equal(namespaceForRegion({ id: "plain" }, "eu").id, "plain");
+});
+
+test("hosted approval comes from the tenant overlay and ignores Worker APPROVAL_OIDC_*", () => {
+	const platform = selfEnv({
+		APPROVAL_OIDC_ISSUER: "https://platform.example", APPROVAL_OIDC_CLIENT_ID: "platform",
+		APPROVAL_OIDC_CLIENT_SECRET: "platform-secret", APPROVAL_OIDC_ALLOWED_SUBJECTS: "platform-user",
+		APPROVAL_METHODS: "oidc",
+	});
+	const ctx = hostedTenantContext(platform, {
+		id: "ten_a", db: dummy, publicUrl: "https://a.example.com",
+		approval: { issuer: "https://idp.example", clientId: "tenant-client", clientSecret: "tenant-secret", allowedSubjects: ["owner-1"], label: "Example IdP" },
+	});
+	assert.equal(ctx.gates.approvalOidc.issuer, "https://idp.example");
+	assert.equal(ctx.gates.approvalOidc.clientId, "tenant-client");
+	assert.deepEqual(ctx.gates.approvalOidc.allowedSubjects, ["owner-1"]);
+	assert.equal(ctx.gates.approvalOidc.label, "Example IdP");
+	assert.equal(ctx.gates.approvalOidc.hasClientSecret, true);
+	assert.equal(ctx.approvalClientSecret(), "tenant-secret");
+	assert.equal(JSON.stringify(ctx.approval).includes("tenant-secret"), false);
+	assert.equal(ctx.gates.approvalOidc.methodsSpecified, false, "omitted methods stay unspecified so both password and OIDC are offered");
+	const empty = hostedTenantContext(platform, { id: "ten_a", db: dummy, publicUrl: "https://a.example.com" });
+	assert.equal(empty.gates.approvalOidc.issuer, "");
+	assert.equal(empty.approvalClientSecret(), "");
+	assert.equal(empty.gates.approvalOidc.hasClientSecret, false);
+});
+
+test("fetch path: gates set or unset, the self-host Worker still answers from OWNER_TOKEN and env.DB", async () => {
+	const DB = d1(new URL("../migrations/", import.meta.url));
+	const base = { DB, PUBLIC_URL: BASE, OWNER_TOKEN: "owner-secret", AGENT_NAME: "Test Inbox" };
+	const gates = {
+		TENANCY: "host", TENANT_SECRETS_KEY: "platform-key", TENANT_DOMAIN: "example.com", DATA_REGION: "eu",
+		QUOTAS: "on", USAGE_SINK: "d1", WAKE_TARGET_POLICY: "public-https", SIGNUP_URL: "https://example.com",
+		BRANDING: "hosted", APPROVAL_OIDC_ISSUER: "https://example.com", APPROVAL_OIDC_CLIENT_ID: "client",
+		APPROVAL_OIDC_CLIENT_SECRET: "secret", APPROVAL_OIDC_ALLOWED_SUBJECTS: "acct_1", APPROVAL_METHODS: "oidc",
+	};
+	const call = async (env: Record<string, unknown>, path: string, headers: Record<string, string> = {}) => {
+		const res = await worker.fetch(new Request(BASE + path, { headers }) as any, env as any, { waitUntil() {}, passThroughOnException() {} } as any);
+		return { status: res.status, data: await res.json() as any };
+	};
+	const plain = await call(base, "/health");
+	const reserved = await call({ ...base, ...gates }, "/health");
+	const empty = await call({ ...base, TENANCY: "", QUOTAS: "", DATA_REGION: "", SIGNUP_URL: "" }, "/health");
+	assert.deepEqual(plain.data, { ok: true, publicUrl: BASE, mode: "inbox", mcp: true });
+	assert.deepEqual(reserved.data, plain.data);
+	assert.deepEqual(empty.data, plain.data);
+
+	const own = await call({ ...base, ...gates }, "/owner/inbox", { authorization: "Bearer owner-secret" });
+	assert.equal(own.status, 200, JSON.stringify(own.data));
+	const no = await call({ ...base, ...gates }, "/owner/inbox", { authorization: "Bearer platform-key" });
+	assert.equal(no.status, 401);
+});

package/worker/test/wake-retry.test.ts

@@ -0,0 +1,74 @@
+// A wake endpoint that answers 429 / 503 (e.g. a Claude Code routine over its fire limit): the wake is kept pending and
+// re-sent after Retry-After, at most 3 times. Run: npm test
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import worker, { nextCronAt } from "../src/index.ts";
+import { d1 } from "./d1.ts";
+import { resolveTenant } from "../src/tenancy.ts";
+
+const BASE = "https://agent.example.com";
+const realNow = Date.now;
+let offset = 0;
+Date.now = () => realNow() + offset;
+
+test("429 with Retry-After: the wake is re-sent after the wait, merged with newer tasks, and dropped after 3 retries", async (t) => {
+	const env: any = { DB: d1(new URL("../migrations/", import.meta.url)), PUBLIC_URL: BASE, OWNER_TOKEN: "owner-secret", WAKE_PRESET: "claude-code",
+		WAKE_WEBHOOK_URL: "https://api.anthropic.com/v1/claude_code/routines/trig_x/fire", WAKE_WEBHOOK_KEY: "rt", WAKE_DEBOUNCE_SECONDS: "20" };
+	const sent: any[] = [];
+	let answer = 429;
+	const orig = globalThis.fetch;
+	globalThis.fetch = (async (_u: any, init: any) => { sent.push(JSON.parse(init.body)); return new Response("{}", { status: answer, headers: { "retry-after": "120" } }); }) as any;
+	t.after(() => { globalThis.fetch = orig; Date.now = realNow; });
+	const call = async (method: string, path: string, json?: any, auth = "Bearer owner-secret") => {
+		const pending: Promise<unknown>[] = [];
+		const res = await worker.fetch(new Request(BASE + path, { method, headers: { "content-type": "application/json", authorization: auth }, body: json ? JSON.stringify(json) : undefined }) as any,
+			env, { waitUntil: (p: Promise<unknown>) => pending.push(p), passThroughOnException() {} } as any);
+		// settle the request's background work (the 20 s debounce timer is never needed here)
+		await Promise.race([Promise.allSettled(pending), new Promise((r) => setTimeout(r, 200))]);
+		return res.json().catch(() => null);
+	};
+	const tok = (await call("POST", "/owner/peers", { label: "barry" })).token;
+	const msg = (text: string) => call("POST", "/", { jsonrpc: "2.0", id: 1, method: "message/send", params: { message: { kind: "message", role: "user", messageId: crypto.randomUUID(), contextId: "ctx-r", parts: [{ kind: "text", text }] } } }, `Bearer ${tok}`);
+	await msg("one");
+	assert.equal(sent.length, 1);
+	const row = () => env.DB.db.prepare("SELECT * FROM wakes WHERE context_id = 'ctx-r'").get() as any;
+	assert.ok(row().pending_json, "kept pending after the 429");
+	offset += 60_000;
+	await call("GET", "/health");
+	assert.equal(sent.length, 1, "not before Retry-After");
+	offset += 61_000;
+	await call("GET", "/health");
+	assert.equal(sent.length, 2, "re-sent after Retry-After");
+	assert.equal(JSON.parse(row().pending_json).attempts, 2);
+	for (let i = 0; i < 3; i++) { offset += 121_000; await call("GET", "/health"); }
+	assert.equal(sent.length, 4, "3 retries, then dropped");
+	assert.equal(row().pending_json, null);
+	// a success clears it for good
+	answer = 200;
+	offset += 3_600_000;
+	await msg("two");
+	assert.equal(sent.length, 5);
+	assert.equal(row().pending_json, null);
+});
+
+test("a 429 is due at Retry-After when the debounce is longer", async (t) => {
+	const env: any = { DB: d1(new URL("../migrations/", import.meta.url)), PUBLIC_URL: BASE, OWNER_TOKEN: "owner-secret", WAKE_PRESET: "generic",
+		WAKE_WEBHOOK_URL: "https://example.com/hook", WAKE_WEBHOOK_KEY: "k", WAKE_DEBOUNCE_SECONDS: "120" };
+	const sent: any[] = [];
+	const orig = globalThis.fetch;
+	globalThis.fetch = (async () => { sent.push(1); return new Response("{}", { status: 429, headers: { "retry-after": "30" } }); }) as any;
+	t.after(() => { globalThis.fetch = orig; });
+	const pending: Promise<unknown>[] = [];
+	const ectx = { waitUntil: (p: Promise<unknown>) => pending.push(p), passThroughOnException() {} };
+	const call = async (method: string, path: string, json?: any, auth = "Bearer owner-secret") => {
+		const res = await worker.fetch(new Request(BASE + path, { method, headers: { "content-type": "application/json", authorization: auth }, body: json ? JSON.stringify(json) : undefined }) as any, env, ectx as any);
+		await Promise.race([Promise.allSettled(pending), new Promise((r) => setTimeout(r, 200))]);
+		return res.json().catch(() => null);
+	};
+	const tok = (await call("POST", "/owner/peers", { label: "barry" })).token;
+	const before = Date.now();
+	await call("POST", "/", { jsonrpc: "2.0", id: 1, method: "message/send", params: { message: { kind: "message", role: "user", messageId: "m1", contextId: "ctx-long", parts: [{ kind: "text", text: "one" }] } } }, `Bearer ${tok}`);
+	assert.equal(sent.length, 1);
+	const at = await nextCronAt(resolveTenant(env), Date.now());
+	assert.ok(at != null && at >= before + 25_000 && at <= before + 35_000, `alarm ${at} is Retry-After, not the 120s debounce`);
+});

package/worker/test/wake.test.ts

@@ -30,6 +30,24 @@ test("claude-code: anthropic-version + text body", async () => {
 	assert.deepEqual(Object.keys(b), ["text"]);
 	assert.match(b.text, /2 new messages from peer "peer-a"/);
 	assert.match(b.text, /untrusted/);
+	// a fresh routine session learns what it needs and what to do when setup is missing
+	assert.match(b.text, /A2A_BASE_URL and A2A_OWNER_TOKEN/);
+	assert.match(b.text, /a2a-exposed connector \(MCP tools/, "the connector comes first");
+	assert.ok(b.text.indexOf("connector") < b.text.indexOf("A2A_OWNER_TOKEN"), "the CLI is the fallback");
+	assert.match(b.text, /never ask for the token in chat/);
+	assert.match(b.text, /npx -y a2a-exposed@latest inbox/, "the default hint runs the CLI through npx");
+	assert.match(b.text, /run as `npx -y a2a-exposed@latest`, no global install/);
+	assert.ok(!/npm i(nstall)? -g/.test(b.text), "never asks for a global install");
+	assert.ok(!b.text.includes("Bearer rt") && !b.text.includes(" rt "), "no secret in the text");
+});
+
+test("claude-code: a human-approved pairing wake stays CLI-free (no cold-start note)", async () => {
+	const pe = { ...ev, kind: "pairing_request" as const, taskIds: [], pairing: { userCode: "WDJB-4827", verificationUriComplete: "https://agent.example.com/device?user_code=WDJB-4827",
+		approval: "human" as const, clientName: "Peer", clientId: "", agentCardUrl: "", expiresIn: 600 } };
+	const r = (await renderWake({ preset: "claude-code", url: "https://api.anthropic.com/v1/claude_code/routines/trig_x/fire", key: "rt" }, pe))!;
+	const b = JSON.parse(r.body);
+	assert.match(b.text, /WDJB-4827/);
+	assert.ok(!b.text.includes("A2A_OWNER_TOKEN"), "human pairing needs no CLI or owner token");
 });
 
 test("openclaw-wake: no peer text, mode now, agentId", async () => {