a2a-exposed 0.4.1 → 0.6.0

package/lib/status.mjs

@@ -3,12 +3,11 @@
 // itself, so agents need no curl (some agent sandboxes flag *.dev URLs in shell commands).
 import fs from "node:fs";
 import * as C from "./config.mjs";
-import { cardUrlProblem, cfErrorCode, describeHttp, die, fingerprint, httpJson } from "./a2a.mjs";
+import { CLI, cardUrlProblem, cfErrorCode, describeHttp, die, fingerprint, httpJson } from "./a2a.mjs";
 import { baseUrl, owner, ownerTry } from "./commands.mjs";
 import * as D from "./deploy.mjs";
 import * as T from "./tunnel.mjs";
 
-const CLI = "a2a-exposed";
 /** Presets whose webhook usually listens only locally: wakes need the tunnel (or another reverse proxy). */
 export const LOCAL_PRESETS = ["openclaw-wake", "openclaw-agent", "hermes"];
 
@@ -202,7 +201,8 @@ export async function collect() {
 				const pr = await owner("GET", "/owner/pairing");
 				if (pr && typeof pr === "object" && ["human", "agent", "off"].includes(pr.mode))
 					s.pairing = { mode: pr.mode, passwordSet: !!pr.passwordSet, passwordSetAt: pr.passwordSetAt || null, passwordSetVia: pr.passwordSetVia || null,
-						setupLinkExpiresAt: pr.setupLinkExpiresAt || null, pending: (pr.pending || []).length };
+						setupLinkExpiresAt: pr.setupLinkExpiresAt || null, pending: (pr.pending || []).length,
+						...(typeof pr.oidcIssuer === "string" && pr.oidcIssuer ? { oidcIssuer: pr.oidcIssuer } : {}) };
 			} catch { /* older Worker (no pairing yet): leave unknown */ }
 			if (s.upstream) {
 				try { s.facade = await owner("GET", "/owner/facade"); }
@@ -303,7 +303,7 @@ export async function status(o) {
 			if (s.zones) rows.push(["zones", s.zones.length ? s.zones.join(", ") : "none on this account"]);
 			const pg = s.pairing;
 			if (pg) rows.push(["pairing", pg.mode === "off" ? "off (token issue only)"
-				: `${pg.mode} approval; approval password ${pg.passwordSet ? `set${pg.passwordSetAt ? ` ${pg.passwordSetAt}` : ""}${pg.passwordSetVia ? ` (via ${pg.passwordSetVia})` : ""}` : `NOT SET${pg.setupLinkExpiresAt ? ` (a setup link is open until ${pg.setupLinkExpiresAt})` : ""}`}${pg.pending ? `; ${pg.pending} pending request(s): ${CLI} pair list` : ""}`]);
+				: `${pg.mode} approval; approval password ${pg.passwordSet ? `set${pg.passwordSetAt ? ` ${pg.passwordSetAt}` : ""}${pg.passwordSetVia ? ` (via ${pg.passwordSetVia})` : ""}` : `NOT SET${pg.setupLinkExpiresAt ? ` (a setup link is open until ${pg.setupLinkExpiresAt})` : ""}`}${pg.oidcIssuer ? `; OpenID Connect (${pg.oidcIssuer})` : ""}${pg.pending ? `; ${pg.pending} pending request(s): ${CLI} pair list` : ""}`]);
 		}
 		rows.push(["next step", next.text]);
 		for (const a of next.also || []) rows.push(["also", a]);

package/lib/tunnel.mjs

@@ -10,7 +10,7 @@ import path from "node:path";
 import crypto from "node:crypto";
 import { spawnSync } from "node:child_process";
 import * as C from "./config.mjs";
-import { CliError, die, fingerprint, httpJson } from "./a2a.mjs";
+import { CLI, CliError, die, fingerprint, httpJson } from "./a2a.mjs";
 import { owner } from "./commands.mjs";
 import * as D from "./deploy.mjs";
 
@@ -63,7 +63,7 @@ export function noZoneHelp(zones) {
 			: "this Cloudflare account has no domain (zone).",
 		"The wake tunnel needs a zone anywhere on the account for its hostname and Access app (whether the inbox is on workers.dev or a custom hostname).",
 		"Without one, use scheduled polling: the inbox works as it is (setup skill: \"Agents without inbound webhooks: polling\").",
-		"To use the tunnel later, add a domain to the account and run `a2a-exposed tunnel create` (no redeploy needed).",
+		`To use the tunnel later, add a domain to the account and run \`${CLI} tunnel create\` (no redeploy needed).`,
 	].join("\n");
 }
 
@@ -215,9 +215,9 @@ export function listZones(dir) {
 
 // ------------------------------------------------------------------ commands
 function needDeployment(o) {
-	if (!C.get("A2A_D1_ID") || !C.get("A2A_WORKER_NAME")) die("no saved deployment; run `a2a-exposed init` first");
+	if (!C.get("A2A_D1_ID") || !C.get("A2A_WORKER_NAME")) die(`no saved deployment; run \`${CLI} init\` first`);
 	const dir = D.workerDir(o);
-	if (!fs.existsSync(dir)) die(`worker project not found at ${dir}; run \`a2a-exposed deploy\` once`);
+	if (!fs.existsSync(dir)) die(`worker project not found at ${dir}; run \`${CLI} deploy\` once`);
 	return dir;
 }
 
@@ -293,12 +293,12 @@ export async function create(o) {
 		console.log(url);
 		console.error(`\ntunnel ready: wakes go to ${url} -> ${origin}${wpath} on the agent's machine`);
 		console.error(connectorInstructions(tokenFile, o["show-token"] ? token : ""));
-		console.error(`\nThen (Worker secrets apply within ~15 s): a2a-exposed tunnel status   and   a2a-exposed wake test`);
+		console.error(`\nThen (Worker secrets apply within ~15 s): ${CLI} tunnel status   and   ${CLI} wake test`);
 		if (!process.env.WAKE_WEBHOOK_KEY && !process.env.WAKE_HMAC_SECRET && preset !== "generic")
 			console.error(`note: no WAKE_WEBHOOK_KEY / WAKE_HMAC_SECRET in the environment; keep the ${preset} webhook's own auth too (export it and run \`wake set\`)`);
 	} catch (e) {
 		console.error(`error: ${e.message}\n==> rolling back what was created`);
-		await remove(o, { quiet: true }).catch((r) => console.error(`rollback incomplete: ${r.message}; re-run \`a2a-exposed tunnel rm\``));
+		await remove(o, { quiet: true }).catch((r) => console.error(`rollback incomplete: ${r.message}; re-run \`${CLI} tunnel rm\``));
 		throw e;
 	}
 }
@@ -335,10 +335,10 @@ export const tunnelComplete = () =>
  *  tunnel must be removed first. */
 async function resume(dir, o) {
 	if (!tunnelComplete())
-		die("a previous `tunnel create` did not finish (some ids are saved, see `a2a-exposed status`); run `a2a-exposed tunnel rm`, then `a2a-exposed tunnel create` again");
+		die(`a previous \`tunnel create\` did not finish (some ids are saved, see \`${CLI} status\`); run \`${CLI} tunnel rm\`, then \`${CLI} tunnel create\` again`);
 	const host = C.get("A2A_TUNNEL_HOSTNAME");
 	if (o["tunnel-hostname"] && o["tunnel-hostname"].toLowerCase() !== host)
-		die(`a tunnel already exists on ${host}; to use another hostname run \`a2a-exposed tunnel rm\` first`);
+		die(`a tunnel already exists on ${host}; to use another hostname run \`${CLI} tunnel rm\` first`);
 	if (!tokenFileOk()) {
 		step(`the connector token file ${C.get("A2A_TUNNEL_TOKEN_FILE")} is missing or empty: downloading the tunnel token again`);
 		fetchTokenFile(dir, C.get("A2A_TUNNEL_ID"));
@@ -356,11 +356,11 @@ async function resume(dir, o) {
 	}
 	const preset = C.get("WAKE_PRESET", "generic");
 	if (p && !p.hasKey && !p.hasHmacSecret && !Object.keys(agentAuth).length && preset !== "generic")
-		console.error(`warning: the Worker has no WAKE_WEBHOOK_KEY / WAKE_HMAC_SECRET, so the ${preset} webhook will reject wakes; export it and run \`a2a-exposed tunnel create\` again`);
+		console.error(`warning: the Worker has no WAKE_WEBHOOK_KEY / WAKE_HMAC_SECRET, so the ${preset} webhook will reject wakes; export it and run \`${CLI} tunnel create\` again`);
 	console.log(url);
 	console.error(`tunnel already set up: wakes go to ${url} -> ${C.get("A2A_TUNNEL_ORIGIN")}${C.get("A2A_TUNNEL_PATH")} (nothing new created; to change it: tunnel rm, then tunnel create)`);
 	console.error(connectorInstructions(C.get("A2A_TUNNEL_TOKEN_FILE")));
-	console.error("Then: a2a-exposed tunnel status   and   a2a-exposed wake test");
+	console.error(`Then: ${CLI} tunnel status   and   ${CLI} wake test`);
 }
 
 function putSecrets(dir, worker, map) {
@@ -370,7 +370,7 @@ function putSecrets(dir, worker, map) {
 export async function status(o) {
 	const dir = needDeployment(o);
 	const host = C.get("A2A_TUNNEL_HOSTNAME");
-	if (!host) return console.log("no tunnel configured (a2a-exposed tunnel create)");
+	if (!host) return console.log(`no tunnel configured (${CLI} tunnel create)`);
 	const info = { hostname: host, wakeUrl: wakeUrl(host, C.get("A2A_TUNNEL_PATH") || "/"), origin: C.get("A2A_TUNNEL_ORIGIN") };
 	const tid = C.get("A2A_TUNNEL_ID");
 	if (tid) {

package/lib/update.mjs

@@ -31,7 +31,7 @@ export function newer(a, b) {
 /** The notice for `current`, given the cache contents (or "" when up to date / unknown). */
 export function notice(current, cache) {
 	if (!cache || !cache.latest || !newer(cache.latest, current)) return "";
-	return `a2a-exposed ${cache.latest} is available (you have ${current}): npm i -g a2a-exposed@latest, then a2a-exposed deploy (updates the Worker; applies new D1 migrations). Silence: A2A_NO_UPDATE_CHECK=1`;
+	return `a2a-exposed ${cache.latest} is available (you have ${current}): run npx -y a2a-exposed@latest deploy (updates the Worker; applies new D1 migrations). With a global install, npm i -g a2a-exposed@latest first. Silence: A2A_NO_UPDATE_CHECK=1`;
 }
 
 export const due = (cache, now = Date.now()) => !cache || !(now - (cache.checkedAt || 0) < CHECK_INTERVAL_MS);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "a2a-exposed",
-	"version": "0.4.1",
+	"version": "0.6.0",
 	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: Cloudflare Worker inbox + wake webhook or scheduled inbox checks",
 	"type": "module",
 	"bin": {

package/worker/cloudflare.config.ts

@@ -1,8 +1,9 @@
 // a2a-exposed Worker configuration. Everything deployment-specific comes from environment
-// variables at deploy time (set by `npx a2a-exposed init|deploy`, or export them yourself;
+// variables at deploy time (set by `npx -y a2a-exposed@latest init|deploy`, or export them yourself;
 // see deploy.env.example). Nothing account- or owner-specific is committed here.
-import { bindings, defineConfig, triggers } from "cf/config";
-import * as entrypoint from "./src/index.ts" with { type: "cf-worker" };
+import { bindings, defineConfig, exports, triggers } from "cf/config";
+import * as selfHost from "./src/index.ts" with { type: "cf-worker" };
+import * as hostedEntry from "./src/hosted.ts" with { type: "cf-worker" };
 
 const e: Record<string, string | undefined> = (globalThis as any).process?.env ?? {};
 const v = (k: string) => (e[k] ?? "").trim();
@@ -32,36 +33,78 @@ const plain: Record<string, string> = {
 	WAKE_KEY_HEADER: v("WAKE_KEY_HEADER"), // generic preset (default "authorization")
 	WAKE_KEY_PREFIX: e.WAKE_KEY_PREFIX ?? "", // generic preset; unset = "Bearer "
 	WAKE_BODY_TEMPLATE: v("WAKE_BODY_TEMPLATE"), // generic preset JSON template
-	WAKE_CLI_COMMAND: v("WAKE_CLI_COMMAND"), // how the woken agent runs the CLI (default "npx a2a-exposed")
+	WAKE_CLI_COMMAND: v("WAKE_CLI_COMMAND"), // how the woken agent runs the CLI (default "npx -y a2a-exposed@latest")
 	WAKE_DEBOUNCE_SECONDS: v("WAKE_DEBOUNCE_SECONDS"),
 	WAKE_MAX_PER_HOUR: v("WAKE_MAX_PER_HOUR"),
 	MAX_BODY: v("A2A_MAX_BODY"),
 	RATE_PER_MIN: v("A2A_RATE_PER_MIN"),
 	RETIRED_HOSTNAMES: v("A2A_RETIRED_HOSTNAMES"), // custom domains this agent moved away from (see movedResponse)
 	PAIRING_APPROVAL: v("PAIRING_APPROVAL") || "human", // device-flow pairing: human (approval password on /device) | agent | off
+	MCP: v("A2A_MCP"), // remote MCP server at /mcp (connector for Claude etc.): on unless "off"; never in proxy mode
 	PBKDF2_ITERATIONS: v("A2A_PBKDF2_ITERATIONS"), // approval password hashing; default 100000 (the Workers maximum), at least 50000
 	// proxy / expose mode: forward A2A to an agent that already speaks it, published through a Tunnel hostname behind
 	// Access (never a Tailnet / LAN URL: the Worker can't reach those, and they never appear in the public card)
 	UPSTREAM_URL: v("A2A_UPSTREAM_URL"),
 	UPSTREAM_CARD_URL: v("A2A_UPSTREAM_CARD_URL"), // default <upstream origin>/.well-known/agent-card.json
+	// Hosted multi-tenant gates. All empty by default, and empty is omitted, so a self-host deploy is unchanged.
+	// TENANCY=host switches the entrypoint to src/hosted.ts and adds TENANT_DO + TENANT_DIRECTORY below.
+	// QUOTAS, USAGE_SINK, WAKE_TARGET_POLICY, SIGNUP_URL and BRANDING are parsed and reserved.
+	// APPROVAL_OIDC_* turn on OpenID Connect approval when issuer, client id, secret and allowlist are all set.
+	TENANCY: v("TENANCY"),
+	TENANT_DOMAIN: v("TENANT_DOMAIN"),
+	DATA_REGION: v("DATA_REGION"), // eu | fedramp; unset = Cloudflare's default placement
+	QUOTAS: v("QUOTAS"),
+	USAGE_SINK: v("USAGE_SINK"),
+	WAKE_TARGET_POLICY: v("WAKE_TARGET_POLICY"),
+	SIGNUP_URL: v("SIGNUP_URL"),
+	BRANDING: v("BRANDING"),
+	APPROVAL_OIDC_ISSUER: v("APPROVAL_OIDC_ISSUER"),
+	APPROVAL_OIDC_CLIENT_ID: v("APPROVAL_OIDC_CLIENT_ID"),
+	APPROVAL_OIDC_ALLOWED_SUBJECTS: v("APPROVAL_OIDC_ALLOWED_SUBJECTS"),
+	APPROVAL_METHODS: v("APPROVAL_METHODS"),
 };
+const hosted = v("TENANCY") === "host";
+// Daily R2 snapshots. Unset: no binding and no extra cron, so a self-host deploy stays the single-tenant Worker.
+const backups = v("A2A_BACKUP_BUCKET") === "1";
 const envBindings: Record<string, any> = {
 	DB: bindings.d1(v("A2A_D1_ID") ? { name: v("A2A_D1_NAME") || name, id: v("A2A_D1_ID") } : { name: v("A2A_D1_NAME") || name }),
 };
+// Per-tenant SQLite and the name directory exist only on a hosted deploy. A self-host build does not export the
+// Durable Object class and does not declare these bindings, so `cf deploy` stays the single-tenant Worker on D1.
+if (hosted) {
+	envBindings.TENANT_DO = bindings.durableObject({ worker: name, exportName: "TenantStore" });
+	envBindings.TENANT_DIRECTORY = bindings.kv();
+}
+if (backups) {
+	const region = v("DATA_REGION");
+	const bucketName = v("A2A_BACKUP_BUCKET_NAME");
+	envBindings.BACKUP_BUCKET = bindings.r2({
+		...(bucketName ? { name: bucketName } : {}),
+		...(region === "eu" || region === "fedramp" ? { jurisdiction: region } : {}),
+	});
+}
+const crons = [
+	...(v("A2A_ENABLE_CRON") === "1" ? [triggers.scheduled({ schedule: "* * * * *" })] : []),
+	...(backups ? [triggers.scheduled({ schedule: "0 3 * * *" })] : []),
+];
 for (const [k, val] of Object.entries(plain)) if (val !== "" || (k === "WAKE_KEY_PREFIX" && "WAKE_KEY_PREFIX" in e)) envBindings[k] = bindings.text(val);
 
 // Secrets are uploaded separately (never in this file): OWNER_TOKEN, WAKE_WEBHOOK_URL, WAKE_WEBHOOK_KEY, WAKE_HMAC_SECRET,
 // and in proxy mode UPSTREAM_TOKEN, UPSTREAM_ACCESS_CLIENT_ID, UPSTREAM_ACCESS_CLIENT_SECRET.
 // They are declared only in development mode (`cf dev`), so local dev reads them from .dev.vars while
 // production deploys never fail because an optional wake secret is unset.
-const SECRETS = ["OWNER_TOKEN", "WAKE_WEBHOOK_URL", "WAKE_WEBHOOK_KEY", "WAKE_HMAC_SECRET", "UPSTREAM_TOKEN", "UPSTREAM_ACCESS_CLIENT_ID", "UPSTREAM_ACCESS_CLIENT_SECRET"];
+const SECRETS = ["OWNER_TOKEN", "WAKE_WEBHOOK_URL", "WAKE_WEBHOOK_KEY", "WAKE_HMAC_SECRET", "UPSTREAM_TOKEN", "UPSTREAM_ACCESS_CLIENT_ID", "UPSTREAM_ACCESS_CLIENT_SECRET",
+	// Declared for `cf dev` only when a deploy asks for them, so a self-host .dev.vars without these still starts.
+	...(v("TENANCY") === "host" ? ["TENANT_SECRETS_KEY"] : []),
+	...(v("TENANCY") === "host" || v("APPROVAL_OIDC_ISSUER") ? ["APPROVAL_OIDC_CLIENT_SECRET"] : [])];
 
 export default defineConfig((ctx) => ({
 	...(v("CLOUDFLARE_ACCOUNT_ID") ? { accountId: v("CLOUDFLARE_ACCOUNT_ID") } : {}),
 	worker: {
 		name,
 		compatibilityDate: "2026-10-06",
-		entrypoint,
+		entrypoint: hosted ? hostedEntry : selfHost,
+		...(hosted ? { exports: { TenantStore: exports.durableObject({ storage: "sqlite" }) } } : {}),
 		...(hostname ? { domains: [hostname] } : {}),
 		workersDev,
 		// Optional persisted Workers Logs (A2A_WORKERS_LOGS=1, `init|deploy --workers-logs`): the JSON event lines plus
@@ -70,6 +113,7 @@ export default defineConfig((ctx) => ({
 		env: ctx.mode === "development" ? { ...envBindings, ...Object.fromEntries(SECRETS.map((k) => [k, bindings.secret()])) } : envBindings,
 		// Optional cron flush of debounced wakes (the Worker also flushes opportunistically on every request).
 		// Requires a workers.dev subdomain on the account (always the case for workers.dev deployments).
-		...(v("A2A_ENABLE_CRON") === "1" ? { triggers: [triggers.scheduled({ schedule: "* * * * *" })] } : {}),
+		// A2A_BACKUP_BUCKET=1 adds a second trigger, 03:00 UTC, which writes SQL snapshots and does not flush wakes.
+		...(crons.length ? { triggers: crons } : {}),
 	},
 }));

package/worker/deploy.env.example

@@ -18,7 +18,7 @@ WAKE_PRESET=generic
 # WAKE_KEY_HEADER=authorization
 # WAKE_KEY_PREFIX=Bearer 
 # WAKE_BODY_TEMPLATE={"text":"{{summary}}"}
-# Command shown in wake hints (CLI: --cli-command; default "npx a2a-exposed"). Until the CLI is on npm:
+# Command shown in wake hints (CLI: --cli-command; default "npx -y a2a-exposed@latest"). For a source checkout:
 # WAKE_CLI_COMMAND=node /path/to/a2a-exposed/cli/bin/a2a-exposed.mjs
 # WAKE_DEBOUNCE_SECONDS=10
 # WAKE_MAX_PER_HOUR=0
@@ -31,3 +31,30 @@ WAKE_PRESET=generic
 # Cloudflare Access WAKE_ACCESS_CLIENT_ID / WAKE_ACCESS_CLIENT_SECRET; in proxy mode UPSTREAM_TOKEN,
 # UPSTREAM_ACCESS_CLIENT_ID / UPSTREAM_ACCESS_CLIENT_SECRET) go in a separate chmod-600
 # file passed with `cf deploy --secrets-file <file>`; never commit them.
+#
+# Optional multi-tenant gates. Leave them unset for a self-hosted inbox (`npx -y a2a-exposed@latest init`
+# never sets them). Unset means today's single-tenant Worker on D1, and the build does not export a Durable Object.
+# TENANCY=host switches the entry to the multi-tenant router and adds the TENANT_DO and TENANT_DIRECTORY bindings.
+# The other values are reserved (parsed, not enforced yet). Do not set TENANCY for a self-hosted inbox.
+# TENANCY=
+# TENANT_DOMAIN=example.com
+# DATA_REGION=eu
+# Written onto a directory entry the first time that entry has no region. After that the stored region places the tenant.
+# QUOTAS=on
+# USAGE_SINK=d1
+# WAKE_TARGET_POLICY=public-https
+# SIGNUP_URL=https://example.com
+# BRANDING=hosted
+# OpenID Connect approval (optional). All four of issuer, client id, allowlist and the client secret
+# must be set or the pages stay password-only. APPROVAL_METHODS=oidc hides the password once that
+# config is complete; APPROVAL_METHODS=password keeps the password even if an issuer is set.
+# APPROVAL_OIDC_ISSUER=https://example.com
+# APPROVAL_OIDC_CLIENT_ID=
+# APPROVAL_OIDC_ALLOWED_SUBJECTS=
+# APPROVAL_METHODS=password
+# Secrets (same secrets file, never here): APPROVAL_OIDC_CLIENT_SECRET, and for a hosted deploy TENANT_SECRETS_KEY.
+# Hosted approval uses the tenant's pushed approval object, not these Worker settings.
+# Daily SQL snapshots to R2. Unset: no BACKUP_BUCKET binding and no extra cron. The minute wake cron stays A2A_ENABLE_CRON.
+# A2A_BACKUP_BUCKET=1
+# A2A_BACKUP_BUCKET_NAME=a2a-exposed-backups
+# With DATA_REGION=eu or fedramp the bucket is created in that jurisdiction. Objects are kept 30 days.

package/worker/migrations/0006_mcp.sql

@@ -0,0 +1,43 @@
+-- Remote MCP server (/mcp): OAuth 2.1 clients (dynamic registration), one-time authorization codes, and the grants
+-- (owner-approved, inbox-scoped tokens) that `token list` shows and `token revoke` ends. Peer tokens stay in `peers`
+-- and are never accepted on /mcp; MCP tokens are never accepted on the A2A endpoint or /owner/*.
+CREATE TABLE IF NOT EXISTS oauth_clients (
+	client_id TEXT PRIMARY KEY,
+	client_name TEXT,
+	redirect_uris_json TEXT NOT NULL,
+	created_ms INTEGER NOT NULL,
+	ip TEXT
+);
+CREATE TABLE IF NOT EXISTS oauth_codes (
+	code_hash TEXT PRIMARY KEY,
+	client_id TEXT NOT NULL,
+	redirect_uri TEXT NOT NULL,
+	code_challenge TEXT NOT NULL,
+	scope TEXT NOT NULL,
+	resource TEXT NOT NULL,
+	created_ms INTEGER NOT NULL,
+	expires_ms INTEGER NOT NULL
+);
+CREATE TABLE IF NOT EXISTS mcp_grants (
+	label TEXT PRIMARY KEY,
+	client_id TEXT NOT NULL,
+	client_name TEXT,
+	redirect_host TEXT,
+	scope TEXT NOT NULL,
+	access_hash TEXT UNIQUE,
+	access_expires_ms INTEGER,
+	refresh_hash TEXT UNIQUE,
+	refresh_expires_ms INTEGER,
+	created_at TEXT NOT NULL,
+	last_used_at TEXT,
+	revoked_at TEXT
+);
+-- Peers this inbox sends to from the Worker (MCP `send` / `poll_outbound`), uploaded by `peers sync`. The token is
+-- AES-GCM ciphertext under a key derived from the Worker's OWNER_TOKEN secret, so a D1 export alone doesn't reveal it.
+CREATE TABLE IF NOT EXISTS outbound_peers (
+	alias TEXT PRIMARY KEY,
+	url TEXT NOT NULL,
+	token_enc TEXT,
+	created_at TEXT NOT NULL,
+	updated_at TEXT NOT NULL
+);

package/worker/migrations/0007_cimd.sql

@@ -0,0 +1,10 @@
+-- MCP authorization (2026-07-28): OAuth Client ID Metadata Documents. A client_id that is an https URL names a JSON
+-- document the Worker fetches (SSRF-guarded, 5 KB, 5 s) and validates; valid documents are cached here for their
+-- Cache-Control max-age (60 s - 24 h, default 1 h). Errors and invalid documents are never cached.
+CREATE TABLE IF NOT EXISTS oauth_client_metadata (
+	client_id TEXT PRIMARY KEY,
+	client_name TEXT,
+	redirect_uris_json TEXT NOT NULL,
+	fetched_ms INTEGER NOT NULL,
+	expires_ms INTEGER NOT NULL
+);

package/worker/migrations/0008_oidc_txns.sql

@@ -0,0 +1,12 @@
+-- Short-lived OpenID Connect sign-in (authorization code + PKCE). The callback deletes the row;
+-- expired rows are removed when a new one is stored and by the pairing cleanup.
+CREATE TABLE IF NOT EXISTS oidc_txns (
+	state TEXT PRIMARY KEY,
+	nonce TEXT NOT NULL,
+	verifier TEXT NOT NULL,
+	kind TEXT NOT NULL,
+	csrf TEXT NOT NULL,
+	user_code TEXT,
+	payload_json TEXT NOT NULL,
+	expires_ms INTEGER NOT NULL
+);

package/worker/package.json

@@ -7,13 +7,17 @@
 	"scripts": {
 		"build": "cf build",
 		"deploy": "cf deploy",
-		"test": "node --test test/*.test.ts",
+		"test": "node --import ./test/register-hooks.mjs --test test/*.test.ts",
 		"typecheck": "cf workers types && tsc"
 	},
-	"engines": { "node": ">=22.18" },
+	"engines": {
+		"node": ">=22.18"
+	},
 	"devDependencies": {
 		"@cloudflare/vite-plugin": "beta",
 		"cf": "^1.0.0-beta.13",
+		"esbuild": "^0.28.1",
+		"miniflare": "^5.20261006.0-alpha",
 		"typescript": "^7.0.2",
 		"vite": "^8.3.0"
 	}

package/worker/src/approval-oidc.ts

@@ -0,0 +1,247 @@
+// Optional OpenID Connect approval for /device and /oauth/authorize.
+// Active only when the issuer (https), client id, client secret and at least one allowed subject are all set,
+// and the method list includes oidc (or APPROVAL_METHODS was left unset). Password stays the default.
+// The client secret is read from TenantContext and is never logged or placed on the gate object.
+import * as A from "./a2a.ts";
+import type { ApprovalOidcGate, TenantContext } from "./tenancy.ts";
+
+export const TXN_TTL_MS = 10 * 60 * 1000;
+const ID_TOKEN_MAX = 8192;
+const SKEW_S = 60;
+const FETCH_MS = 5000;
+
+export type OidcKind = "device" | "mcp";
+
+export interface ApprovalPolicy {
+	oidc: boolean;
+	password: boolean;
+	/** Button label: configured label, otherwise the issuer host. */
+	label: string;
+}
+
+export function issuerHost(issuer: string): string {
+	try { return new URL(issuer).host; } catch { return ""; }
+}
+
+export function issuerBase(issuer: string): string {
+	return issuer.replace(/\/+$/, "");
+}
+
+/**
+ * What the approval pages offer.
+ * OIDC is on when it is fully configured and methods include oidc, or when methods were not specified.
+ * Password stays on unless methods were specified as oidc only AND the OIDC config is complete
+ * (an incomplete `APPROVAL_METHODS=oidc` must not lock the operator out).
+ * `APPROVAL_METHODS=password` keeps the password and does not turn OIDC on.
+ */
+export function approvalPolicy(gate: ApprovalOidcGate): ApprovalPolicy {
+	const configured = !!(gate.issuer && gate.clientId && gate.hasClientSecret && gate.allowedSubjects.length);
+	const oidc = configured && (gate.methods.includes("oidc") || !gate.methodsSpecified);
+	const oidcOnly = gate.methodsSpecified && gate.methods.includes("oidc") && !gate.methods.includes("password");
+	return { oidc, password: !(oidcOnly && configured), label: gate.label || issuerHost(gate.issuer) };
+}
+
+export type StartResult = { ok: true; location: string } | { ok: false; error: string; reason: string };
+export type FinishResult =
+	| { ok: true; userCode: string | null; payload: Record<string, unknown>; subject: string }
+	| { ok: false; error: string; reason: string; userCode: string | null };
+
+const FAIL = "Sign-in could not be verified. Nothing was approved.";
+const UNREACHABLE = "The identity provider could not be reached. Nothing was approved.";
+
+function b64url(bytes: Uint8Array): string {
+	return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+function b64urlDecode(s: string): Uint8Array {
+	if (!/^[A-Za-z0-9_-]+$/.test(s) || s.length > ID_TOKEN_MAX) throw new Error("b64");
+	const pad = "=".repeat((4 - (s.length % 4)) % 4);
+	const bin = atob(s.replace(/-/g, "+").replace(/_/g, "/") + pad);
+	const out = new Uint8Array(bin.length);
+	for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+	return out;
+}
+
+async function pkce(): Promise<{ verifier: string; challenge: string }> {
+	const verifier = b64url(crypto.getRandomValues(new Uint8Array(32)));
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+	return { verifier, challenge: b64url(new Uint8Array(digest)) };
+}
+
+function httpsEndpoint(v: unknown): string {
+	if (typeof v !== "string" || !v) throw new Error("endpoint");
+	const u = new URL(v);
+	if (u.protocol !== "https:" || u.username || u.password) throw new Error("endpoint");
+	return u.toString();
+}
+
+async function readJson(res: Response, max: number): Promise<any> {
+	const len = Number(res.headers.get("content-length") || 0);
+	if (len > max) throw new Error("large");
+	const text = await res.text();
+	if (text.length > max) throw new Error("large");
+	return JSON.parse(text);
+}
+
+async function getJson(url: string): Promise<any> {
+	const res = await fetch(url, { headers: { accept: "application/json" }, redirect: "error", signal: AbortSignal.timeout(FETCH_MS) });
+	if (!res.ok) throw new Error("http");
+	return readJson(res, 65536);
+}
+
+interface Discovery {
+	authorization_endpoint: string;
+	token_endpoint: string;
+	jwks_uri: string;
+}
+
+async function discover(issuer: string): Promise<Discovery> {
+	const doc = await getJson(`${issuerBase(issuer)}/.well-known/openid-configuration`);
+	if (issuerBase(String(doc?.issuer || "")) !== issuerBase(issuer)) throw new Error("issuer");
+	return {
+		authorization_endpoint: httpsEndpoint(doc.authorization_endpoint),
+		token_endpoint: httpsEndpoint(doc.token_endpoint),
+		jwks_uri: httpsEndpoint(doc.jwks_uri),
+	};
+}
+
+/** Begin a sign-in. `userCode` is stored with the state and is not put on the identity provider's URL. */
+export async function startOidc(ctx: TenantContext, o: {
+	kind: OidcKind; redirectUri: string; csrf: string; userCode: string | null; payload: Record<string, unknown>;
+}): Promise<StartResult> {
+	const gate = ctx.gates.approvalOidc;
+	if (!approvalPolicy(gate).oidc || !ctx.approvalClientSecret()) return { ok: false, error: "OpenID Connect approval is not configured.", reason: "config" };
+	let disc: Discovery;
+	try { disc = await discover(gate.issuer); }
+	catch { return { ok: false, error: UNREACHABLE, reason: "discovery" }; }
+	const { verifier, challenge } = await pkce();
+	const state = b64url(crypto.getRandomValues(new Uint8Array(32)));
+	const nonce = b64url(crypto.getRandomValues(new Uint8Array(32)));
+	const payload = JSON.stringify(o.payload);
+	if (payload.length > 16384) return { ok: false, error: "This approval could not be started.", reason: "payload" };
+	const now = Date.now();
+	await ctx.DB.prepare("DELETE FROM oidc_txns WHERE expires_ms < ?").bind(now).run();
+	await ctx.DB.prepare("INSERT INTO oidc_txns (state, nonce, verifier, kind, csrf, user_code, payload_json, expires_ms) VALUES (?, ?, ?, ?, ?, ?, ?, ?)")
+		.bind(state, nonce, verifier, o.kind, o.csrf, o.userCode, payload, now + TXN_TTL_MS).run();
+	const u = new URL(disc.authorization_endpoint);
+	u.searchParams.set("response_type", "code");
+	u.searchParams.set("client_id", gate.clientId);
+	u.searchParams.set("redirect_uri", o.redirectUri);
+	// `email` is required for an email allowlist: providers omit `email` and `email_verified` unless this scope is requested.
+	u.searchParams.set("scope", "openid email");
+	u.searchParams.set("state", state);
+	u.searchParams.set("nonce", nonce);
+	u.searchParams.set("code_challenge", challenge);
+	u.searchParams.set("code_challenge_method", "S256");
+	return { ok: true, location: u.toString() };
+}
+
+function onAllowlist(value: unknown, subjects: string[]): boolean {
+	if (typeof value !== "string") return false;
+	for (const want of subjects) if (A.timingSafeEqualStr(value, want)) return true;
+	return false;
+}
+
+/**
+ * OIDC ID Token validation: `aud` must contain this client. When `aud` has more than one value, `azp` is required
+ * and must be this client id. A present `azp` must match even when there is only one audience.
+ */
+function audienceOk(aud: unknown, azp: unknown, clientId: string): boolean {
+	const raw = typeof aud === "string" ? [aud] : Array.isArray(aud) ? aud : [];
+	if (!onAllowlist(clientId, raw.filter((a): a is string => typeof a === "string"))) return false;
+	const multi = raw.length > 1;
+	if (!multi && azp === undefined) return true;
+	return typeof azp === "string" && A.timingSafeEqualStr(azp, clientId);
+}
+
+/**
+ * Prefer `sub`. An `email` match is a separate path and is ignored unless `email_verified` is boolean true,
+ * so an unverified address cannot approve.
+ */
+function subjectAllowed(claims: { sub?: unknown; email?: unknown; email_verified?: unknown }, subjects: string[]): boolean {
+	if (onAllowlist(claims.sub, subjects)) return true;
+	if (claims.email_verified !== true) return false;
+	return onAllowlist(claims.email, subjects);
+}
+
+async function verifyIdToken(token: string, jwks: { keys?: any[] }, expect: { iss: string; aud: string; nonce: string; subjects: string[] }): Promise<{ subject: string } | { reason: string }> {
+	if (typeof token !== "string" || token.length < 20 || token.length > ID_TOKEN_MAX) return { reason: "token" };
+	const parts = token.split(".");
+	if (parts.length !== 3) return { reason: "token" };
+	let header: any;
+	try { header = JSON.parse(new TextDecoder().decode(b64urlDecode(parts[0]))); }
+	catch { return { reason: "token" }; }
+	// RS256 only. `none` and HMAC (which would use the client secret as a MAC key) are rejected before verification.
+	if (header.alg !== "RS256") return { reason: "alg" };
+	const keys: any[] = Array.isArray(jwks.keys) ? jwks.keys : [];
+	const jwk = header.kid ? keys.find((k) => k && k.kid === header.kid) : keys.length === 1 ? keys[0] : null;
+	if (!jwk || jwk.kty !== "RSA" || !jwk.n || !jwk.e || (jwk.alg && jwk.alg !== "RS256")) return { reason: "key" };
+	let key: CryptoKey;
+	try {
+		key = await crypto.subtle.importKey("jwk", { kty: "RSA", n: jwk.n, e: jwk.e, alg: "RS256", ext: true },
+			{ name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, false, ["verify"]);
+	} catch { return { reason: "key" }; }
+	let sig: Uint8Array;
+	try { sig = b64urlDecode(parts[2]); } catch { return { reason: "sig" }; }
+	const ok = await crypto.subtle.verify({ name: "RSASSA-PKCS1-v1_5" }, key, sig, new TextEncoder().encode(`${parts[0]}.${parts[1]}`));
+	if (!ok) return { reason: "sig" };
+	let claims: any;
+	try { claims = JSON.parse(new TextDecoder().decode(b64urlDecode(parts[1]))); }
+	catch { return { reason: "token" }; }
+	if (issuerBase(String(claims.iss || "")) !== issuerBase(expect.iss)) return { reason: "iss" };
+	if (!audienceOk(claims.aud, claims.azp, expect.aud)) return { reason: "aud" };
+	if (typeof claims.nonce !== "string" || !A.timingSafeEqualStr(claims.nonce, expect.nonce)) return { reason: "nonce" };
+	const nowS = Date.now() / 1000;
+	if (typeof claims.exp !== "number" || !Number.isFinite(claims.exp) || claims.exp + SKEW_S < nowS) return { reason: "exp" };
+	if (typeof claims.nbf === "number" && claims.nbf - SKEW_S > nowS) return { reason: "nbf" };
+	if (!subjectAllowed(claims, expect.subjects)) return { reason: "sub" };
+	return { subject: typeof claims.sub === "string" ? claims.sub : String(claims.email) };
+}
+
+/**
+ * Complete a sign-in. The state row is deleted on every callback, including failure, so it cannot be replayed.
+ * The CSRF cookie is not read here: SameSite=Strict is dropped on the cross-site return from the identity
+ * provider. The start POST already checked that cookie and stored it with this state.
+ */
+export async function finishOidc(ctx: TenantContext, o: {
+	kind: OidcKind; redirectUri: string; state: string; code: string | null; error: string | null;
+}): Promise<FinishResult> {
+	const state = o.state || "";
+	if (!/^[A-Za-z0-9_-]{20,128}$/.test(state)) return { ok: false, error: "This sign-in expired or was already used. Nothing was approved.", reason: "state", userCode: null };
+	const row: any = await ctx.DB.prepare("DELETE FROM oidc_txns WHERE state = ? RETURNING *").bind(state).first();
+	if (!row || row.kind !== o.kind) return { ok: false, error: "This sign-in expired or was already used. Nothing was approved.", reason: "state", userCode: null };
+	const userCode = row.user_code || null;
+	if (Date.now() >= row.expires_ms) return { ok: false, error: "This sign-in expired. Nothing was approved.", reason: "expired", userCode };
+	if (o.error || !o.code) return { ok: false, error: "Sign-in was cancelled. Nothing was approved.", reason: "cancelled", userCode };
+	const gate = ctx.gates.approvalOidc;
+	const secret = ctx.approvalClientSecret();
+	if (!approvalPolicy(gate).oidc || !secret) return { ok: false, error: "OpenID Connect approval is not configured.", reason: "config", userCode };
+	let disc: Discovery;
+	try { disc = await discover(gate.issuer); }
+	catch { return { ok: false, error: UNREACHABLE, reason: "discovery", userCode }; }
+	let idToken = "";
+	try {
+		const body = new URLSearchParams({
+			grant_type: "authorization_code", code: o.code, redirect_uri: o.redirectUri,
+			client_id: gate.clientId, client_secret: secret, code_verifier: row.verifier,
+		});
+		const res = await fetch(disc.token_endpoint, {
+			method: "POST", headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+			body, redirect: "error", signal: AbortSignal.timeout(FETCH_MS),
+		});
+		if (!res.ok) return { ok: false, error: UNREACHABLE, reason: "token", userCode };
+		const tok = await readJson(res, 65536);
+		idToken = typeof tok.id_token === "string" ? tok.id_token : "";
+	} catch { return { ok: false, error: UNREACHABLE, reason: "token", userCode }; }
+	let jwks: { keys?: any[] };
+	try { jwks = await getJson(disc.jwks_uri); }
+	catch { return { ok: false, error: UNREACHABLE, reason: "jwks", userCode }; }
+	const verified = await verifyIdToken(idToken, jwks, { iss: gate.issuer, aud: gate.clientId, nonce: row.nonce, subjects: gate.allowedSubjects });
+	if ("reason" in verified) return { ok: false, error: FAIL, reason: verified.reason, userCode };
+	let payload: Record<string, unknown> = {};
+	try {
+		const parsed = JSON.parse(row.payload_json || "{}");
+		if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) payload = parsed;
+	} catch { /* empty payload */ }
+	return { ok: true, userCode, payload, subject: verified.subject };
+}