a2a-exposed 0.5.0 → 0.6.0

package/worker/test/hosted.test.ts

@@ -0,0 +1,221 @@
+// Hosted router and TenantStore, in workerd via Miniflare. Self-host behaviour is the node suite (and the
+// gates-unset case below). Run: npm test
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+import { Miniflare, convertV4MiniflareOptions } from "miniflare";
+import worker from "../src/index.ts";
+import { sha256 } from "../src/a2a.ts";
+import { d1 } from "./d1.ts";
+
+const require = createRequire(new URL("../package.json", import.meta.url));
+const MIGRATIONS = new URL("../migrations/", import.meta.url);
+const ectx = { waitUntil(_p: Promise<unknown>) {}, passThroughOnException() {} };
+
+function bundleHosted(): Promise<string> {
+	const { build } = require("esbuild") as typeof import("esbuild");
+	return build({
+		entryPoints: [fileURLToPath(new URL("../src/hosted.ts", import.meta.url))],
+		bundle: true,
+		format: "esm",
+		write: false,
+		platform: "neutral",
+		external: ["cloudflare:*"],
+		target: "es2022",
+		logLevel: "silent",
+		plugins: [{
+			name: "sql-raw",
+			setup(b) {
+				b.onResolve({ filter: /\.sql\?raw$/ }, (args) => ({
+					path: path.resolve(args.resolveDir, args.path.replace(/\?raw$/, "")),
+					namespace: "sql-raw",
+				}));
+				b.onLoad({ filter: /.*/, namespace: "sql-raw" }, (args) => ({
+					contents: `export default ${JSON.stringify(fs.readFileSync(args.path, "utf8"))};`,
+					loader: "js",
+				}));
+			},
+		}],
+	}).then((built) => {
+		const file = built.outputFiles?.[0];
+		if (!file) throw new Error("hosted bundle was empty");
+		return file.text;
+	});
+}
+
+const SCRIPT = bundleHosted();
+
+async function start(opts: Record<string, unknown>) {
+	const mf = new Miniflare(convertV4MiniflareOptions({
+		name: "a2a",
+		modules: true,
+		script: await SCRIPT,
+		compatibilityDate: "2026-10-06",
+		d1Databases: { DB: `db-${Math.random().toString(36).slice(2)}` },
+		...opts,
+	} as never));
+	return mf;
+}
+
+function sqlStatements(sql: string): string[] {
+	return sql.split("\n").map((l) => l.replace(/--.*$/, "")).join("\n").split(";").map((s) => s.trim()).filter(Boolean);
+}
+
+async function migrateD1(mf: Miniflare) {
+	const db = await mf.getD1Database("DB");
+	for (const name of fs.readdirSync(MIGRATIONS).filter((n) => n.endsWith(".sql")).sort()) {
+		const stmts = sqlStatements(fs.readFileSync(new URL(name, MIGRATIONS), "utf8"));
+		if (stmts.length) await db.batch(stmts.map((q) => db.prepare(q)));
+	}
+}
+
+async function text(res: Response): Promise<string> {
+	return await res.text();
+}
+
+test("gates unset: the hosted entry matches the self-host handler, including TENANCY=host without TENANT_DO", async (t) => {
+	const base = "https://agent.example.com";
+	const nodeEnv = { DB: d1(MIGRATIONS), PUBLIC_URL: base, OWNER_TOKEN: "owner-secret" };
+	const nodeHealth = await text(await worker.fetch(new Request(base + "/health"), nodeEnv as never, ectx as never));
+	const nodeDenied = await text(await worker.fetch(new Request(base + "/", {
+		method: "POST", headers: { "content-type": "application/json" },
+		body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "message/send", params: {} }),
+	}), nodeEnv as never, ectx as never));
+
+	const plain = await start({ bindings: { PUBLIC_URL: base, OWNER_TOKEN: "owner-secret" }, durableObjects: { TENANT_DO: { className: "TenantStore", useSQLite: true } } });
+	t.after(() => plain.dispose());
+	await plain.ready;
+	await migrateD1(plain);
+	assert.equal(await text(await plain.dispatchFetch(base + "/health")), nodeHealth);
+	assert.equal(await text(await plain.dispatchFetch(base + "/", {
+		method: "POST", headers: { "content-type": "application/json" },
+		body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "message/send", params: {} }),
+	})), nodeDenied);
+	const issued = await (await plain.dispatchFetch(base + "/owner/peers", {
+		method: "POST", headers: { authorization: "Bearer owner-secret", "content-type": "application/json" },
+		body: JSON.stringify({ label: "ada" }),
+	})).json() as { token: string };
+	assert.match(issued.token, /^a2aow_/);
+	const peers = await (await plain.getD1Database("DB")).prepare("SELECT label FROM peers").all();
+	assert.deepEqual(peers.results?.map((r) => (r as { label: string }).label), ["ada"]);
+	assert.deepEqual(await plain.listDurableObjectIds("TENANT_DO"), [], "the flag is off, so the object is never addressed");
+
+	// TENANCY=host but no TENANT_DO binding: still the self-host path. The class is registered unbound so the
+	// script can load; the router only switches when the binding is present.
+	const hostOnly = await start({
+		bindings: { TENANCY: "host", TENANT_DOMAIN: "example.com", TENANT_SECRETS_KEY: "platform-secret", PUBLIC_URL: base, OWNER_TOKEN: "owner-secret" },
+		additionalUnboundDurableObjects: [{ className: "TenantStore", useSQLite: true }],
+	});
+	t.after(() => hostOnly.dispose());
+	await hostOnly.ready;
+	await migrateD1(hostOnly);
+	assert.equal(await text(await hostOnly.dispatchFetch(base + "/health")), nodeHealth);
+	const again = await (await hostOnly.dispatchFetch(base + "/owner/peers", {
+		method: "POST", headers: { authorization: "Bearer owner-secret", "content-type": "application/json" },
+		body: JSON.stringify({ label: "ada" }),
+	})).json() as { token?: string; error?: string };
+	assert.equal(again.error, undefined);
+	assert.match(again.token ?? "", /^a2aow_/);
+});
+
+test("per-tenant SQLite: directory, config push, and isolation", async (t) => {
+	const mf = await start({
+		bindings: {
+			TENANCY: "host",
+			TENANT_DOMAIN: "example.com",
+			TENANT_SECRETS_KEY: "platform-secret",
+			OWNER_TOKEN: "platform-owner",
+			DATA_REGION: "",
+		},
+		kvNamespaces: { TENANT_DIRECTORY: "tenants" },
+		durableObjects: { TENANT_DO: { className: "TenantStore", useSQLite: true } },
+	});
+	t.after(() => mf.dispose());
+	await mf.ready;
+	const kv = await mf.getKVNamespace("TENANT_DIRECTORY");
+	const ns = await mf.getDurableObjectNamespace("TENANT_DO") as DurableObjectNamespace & {
+		jurisdiction(loc: string): DurableObjectNamespace;
+	};
+	const tokenA = "owner-alice";
+	const tokenB = "owner-bobby";
+	const hashA = await sha256(tokenA);
+	const hashB = await sha256(tokenB);
+
+	const before = await mf.listDurableObjectIds("TENANT_DO");
+	assert.equal((await mf.dispatchFetch("https://nope.example.com/health")).status, 404);
+	assert.equal((await mf.dispatchFetch("https://example.com/health")).status, 404);
+	assert.equal((await mf.dispatchFetch("https://a.b.example.com/health")).status, 404);
+	assert.deepEqual(await mf.listDurableObjectIds("TENANT_DO"), before, "unknown names do not create an object");
+
+	await kv.put("tenant:paused", JSON.stringify({ id: "id-paused", status: "suspended", region: "", version: 1 }));
+	assert.equal((await mf.dispatchFetch("https://paused.example.com/health")).status, 403);
+	assert.deepEqual(await mf.listDurableObjectIds("TENANT_DO"), before, "suspended is answered from the directory");
+
+	await kv.put("tenant:dave", JSON.stringify({ id: "id-dave", status: "active", region: "", version: 1 }));
+	assert.equal((await mf.dispatchFetch("https://dave.example.com/health")).status, 404);
+	assert.equal((await kv.get("tenant:dave", "json") as { region: string }).region, "default", "an empty region is pinned before the object is addressed");
+	const dave = ns.get(ns.idFromName("id-dave")) as unknown as { storageStatus(): Promise<{ configured: boolean; tables: string[] }> };
+	const daveStatus = await dave.storageStatus();
+	assert.equal(daveStatus.configured, false);
+	assert.deepEqual(daveStatus.tables, [], "a fetch before pushConfig writes no tables");
+
+	type Push = { version: number; applied: boolean };
+	const push = async (id: string, body: Record<string, unknown>, target: DurableObjectNamespace = ns) => {
+		const stub = target.get(target.idFromName(id)) as unknown as { pushConfig(b: Record<string, unknown>): Promise<Push>; fetch(r: Request): Promise<Response> };
+		return { stub, result: await stub.pushConfig(body) };
+	};
+
+	const alice = await push("id-alice", { version: 1, tenantId: "id-alice", name: "alice", status: "active", ownerTokenHash: hashA, config: { AGENT_NAME: "Alice" } });
+	assert.equal(alice.result.applied, true, JSON.stringify(alice.result));
+	const stale = await alice.stub.pushConfig({ version: 1, tenantId: "id-alice", name: "alice", status: "active", ownerTokenHash: hashA, config: { AGENT_NAME: "Stale" } });
+	assert.equal(stale.version, 1);
+	assert.equal(stale.applied, false);
+	await kv.put("tenant:alice", JSON.stringify({ id: "id-alice", status: "active", region: "", version: 1 }));
+
+	const bobPush = await push("id-bobby", { version: 1, tenantId: "id-bobby", name: "bobby", status: "active", ownerTokenHash: hashB, config: { AGENT_NAME: "Bob" } });
+	assert.equal(bobPush.result.applied, true, JSON.stringify(bobPush.result));
+	await kv.put("tenant:bobby", JSON.stringify({ id: "id-bobby", status: "active", region: "", version: 1 }));
+
+	const card = async (name: string, headers?: HeadersInit) => (await mf.dispatchFetch(`https://${name}.example.com/.well-known/agent-card.json`, { headers })).json() as Promise<{ name: string }>;
+	assert.equal((await card("alice")).name, "Alice");
+	assert.equal((await card("bobby")).name, "Bob");
+	assert.equal((await card("alice", { "x-a2a-tenant": JSON.stringify({ name: "bob", config: { AGENT_NAME: "Bob" } }) })).name, "Alice");
+
+	const bumped = await alice.stub.pushConfig({ version: 3, tenantId: "id-alice", name: "alice", status: "active", ownerTokenHash: hashA, config: { AGENT_NAME: "Alice 3" } });
+	assert.equal(bumped.version, 3);
+	assert.equal(bumped.applied, true);
+	const rolled = await alice.stub.pushConfig({ version: 2, tenantId: "id-alice", name: "alice", status: "active", ownerTokenHash: hashA, config: { AGENT_NAME: "Rolled" } });
+	assert.equal(rolled.version, 3);
+	assert.equal(rolled.applied, false);
+	assert.equal((await card("alice")).name, "Alice 3");
+
+	const call = (url: string, method: string, auth: string, json?: unknown) => mf.dispatchFetch(url, {
+		method, headers: { authorization: auth, "content-type": "application/json" }, body: json === undefined ? undefined : JSON.stringify(json),
+	});
+	assert.equal((await call("https://alice.example.com/owner/peers", "GET", "Bearer platform-owner")).status, 401, "the platform OWNER_TOKEN is not a tenant owner");
+	const issued = await (await call("https://alice.example.com/owner/peers", "POST", `Bearer ${tokenA}`, { label: "ada" })).json() as { token: string };
+	assert.match(issued.token, /^a2aow_/);
+	const sent = await call("https://alice.example.com/", "POST", `Bearer ${issued.token}`, {
+		jsonrpc: "2.0", id: 1, method: "message/send",
+		params: { message: { kind: "message", role: "user", messageId: "m1", parts: [{ kind: "text", text: "hello alice" }] } },
+	});
+	assert.equal(sent.status, 200, await sent.clone().text());
+	assert.equal((await call("https://bobby.example.com/", "POST", `Bearer ${issued.token}`, {
+		jsonrpc: "2.0", id: 1, method: "message/send",
+		params: { message: { kind: "message", role: "user", messageId: "m2", parts: [{ kind: "text", text: "for bob?" }] } },
+	})).status, 401);
+	assert.equal((await call("https://bobby.example.com/owner/peers", "GET", `Bearer ${tokenA}`)).status, 401);
+	const bobInbox = await (await call("https://bobby.example.com/owner/inbox", "GET", `Bearer ${tokenB}`)).json() as unknown[];
+	assert.deepEqual(bobInbox, []);
+	const aliceInbox = await (await call("https://alice.example.com/owner/inbox?all=1", "GET", `Bearer ${tokenA}`)).json() as { text: string }[];
+	assert.equal(aliceInbox.length, 1);
+	assert.match(aliceInbox[0]!.text, /hello alice/);
+
+	// workerd's local runtime throws "Jurisdiction restrictions are not implemented" on namespace.jurisdiction().
+	// namespaceForRegion() is covered in tenancy.test.ts; production Durable Objects do honour eu / fedramp.
+	await alice.stub.pushConfig({ version: 4, tenantId: "id-alice", name: "alice", status: "suspended", ownerTokenHash: hashA, config: { AGENT_NAME: "Alice 3" } });
+	assert.equal((await mf.dispatchFetch("https://alice.example.com/health")).status, 403, "the object enforces a newer status than the directory cache");
+});

package/worker/test/migrations.test.ts

@@ -57,7 +57,7 @@ test("migration files: NNNN_name.sql, unique numbers, no gaps, 0002_wake_budget
 test("fresh database: every migration applies in order; a second run applies nothing", () => {
 	const db = new DatabaseSync(":memory:");
 	assert.deepEqual(applyMigrations(db), [...FILES].sort(byNumber));
-	for (const t of ["peers", "tasks", "wakes", "wake_budget", "device_requests", "pairing_rate", "settings", "facade_owners", "oauth_clients", "oauth_codes", "mcp_grants", "outbound_peers", "oauth_client_metadata"]) assert.ok(tables(db).includes(t), t);
+	for (const t of ["peers", "tasks", "wakes", "wake_budget", "device_requests", "pairing_rate", "settings", "facade_owners", "oauth_clients", "oauth_codes", "mcp_grants", "outbound_peers", "oauth_client_metadata", "oidc_txns"]) assert.ok(tables(db).includes(t), t);
 	assert.ok(columns(db, "peers").includes("source"));
 	assert.ok(columns(db, "device_requests").includes("replaces_label"));
 	assert.ok(columns(db, "device_requests").includes("replaces_hash"));
@@ -67,15 +67,15 @@ test("fresh database: every migration applies in order; a second run applies not
 test("database from the 0002 fix (0001-0003 recorded): only 0004 and later apply; pending requests keep working", () => {
 	const db = existingDb([sql("0001_init.sql"), sql("0002_wake_budget.sql"), sql("0003_device_pairing.sql")], ["0001_init.sql", "0002_wake_budget.sql", "0003_device_pairing.sql"]);
 	db.prepare("INSERT INTO device_requests (device_hash, user_code, status, created_ms, expires_ms, interval_s) VALUES ('h', 'WDJB4827', 'pending', 1, 2, 5)").run();
-	assert.deepEqual(applyMigrations(db), ["0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql"]);
+	assert.deepEqual(applyMigrations(db), ["0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql"]);
 	assert.equal((db.prepare("SELECT replaces_label FROM device_requests WHERE device_hash = 'h'").get() as any).replaces_label, null);
 });
 
 test("database from v0.2.0 (0001 and 0003 recorded): 0002 applies as a no-op and keeps the data", () => {
 	const db = existingDb([sql("0001_init.sql"), sql("0003_device_pairing.sql")], ["0001_init.sql", "0003_device_pairing.sql"]);
 	db.prepare("INSERT INTO wake_budget (hour, count) VALUES (1, 7)").run();
-	assert.deepEqual(applyMigrations(db), ["0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql"]);
-	assert.deepEqual(recorded(db), ["0001_init.sql", "0003_device_pairing.sql", "0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql"]);
+	assert.deepEqual(applyMigrations(db), ["0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql"]);
+	assert.deepEqual(recorded(db), ["0001_init.sql", "0003_device_pairing.sql", "0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql"]);
 	assert.equal((db.prepare("SELECT count FROM wake_budget WHERE hour = 1").get() as any).count, 7);
 });
 
@@ -107,7 +107,7 @@ test("database from an earlier build without wake_budget (0001 and 0003 recorded
 		assert.equal(before.data.error?.code, -32603, JSON.stringify(before.data));
 		assert.equal(wakes.length, 0);
 
-		assert.deepEqual(applyMigrations(db), ["0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql"]);
+		assert.deepEqual(applyMigrations(db), ["0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql"]);
 		assert.deepEqual(columns(db, "wake_budget"), ["hour", "count"]);
 		assert.deepEqual(applyMigrations(db), []);
 

package/worker/test/pairing.test.ts

@@ -121,6 +121,7 @@ test("agent card, RFC 8414 metadata and the 401 hint advertise the device flow;
 		assert.equal(r.data.error.data.pairing.device_authorization_endpoint, `${BASE}/oauth/device_authorization`);
 		assert.equal(r.data.error.data.pairing.token_endpoint, `${BASE}/oauth/token`);
 		assert.equal(r.data.error.data.pairing.grant_type, GRANT);
+		assert.equal(r.data.error.data.pairing.cli, `npx -y a2a-exposed@latest connect ${BASE}`, "npx, latest, no global install");
 	}
 	const bad = await s.call("POST", "/", { json: { jsonrpc: "2.0", id: "req-7", method: "SendMessage", params: {} }, headers: { authorization: "Bearer nope" } });
 	assert.equal(bad.headers.get("www-authenticate"), `Bearer realm="a2a", resource_metadata="${BASE}/.well-known/oauth-protected-resource", error="invalid_token", error_description="the bearer token is not valid (revoked, rotated or mistyped)"`);
@@ -203,7 +204,7 @@ test("human approval: pending, slow_down, page approve with the password, single
 	assert.equal(s.wakes.length, 1);
 	const w = s.wakes[0].body;
 	assert.equal(w.kind, "pairing_request");
-	assert.equal(w.hint, "npx a2a-exposed pair list");
+	assert.equal(w.hint, "npx -y a2a-exposed@latest pair list");
 	assert.deepEqual([w.pairing.userCode, w.pairing.verificationUriComplete, w.pairing.approval, w.pairing.clientId], [d.user_code, d.verification_uri_complete, "human", "barry"]);
 	assert.equal(w.pairing.agentCardUrl, "https://barry.example.org/.well-known/agent-card.json");
 	assert.match(w.pairing.instructions, /never approve on your own[\s\S]*give them this link/);
@@ -237,7 +238,7 @@ test("human approval: pending, slow_down, page approve with the password, single
 	assert.equal(g.headers.get("x-frame-options"), "DENY");
 	assert.match(g.headers.get("set-cookie")!, /^a2a_device_csrf=[A-Za-z0-9_-]{24}; Path=\/device; Secure; HttpOnly; SameSite=Strict/);
 	assert.ok(!/<script|src=|href=/i.test(g.text), "no scripts or external assets");
-	assert.match(g.text, /No approval password is set yet[\s\S]*npx a2a-exposed pair set-password/);
+	assert.match(g.text, /No approval password is set yet[\s\S]*npx -y a2a-exposed@latest pair set-password/);
 	assert.ok(!g.text.includes('name="password"'));
 	assert.equal((await s.decidePage(d.user_code, PASSWORD, "approve")).status, 409);
 
@@ -371,7 +372,7 @@ test("flood control: requests per IP and outstanding requests are capped (no flo
 test("pairing wakes: summary for each preset; requester text only where previews are allowed", async () => {
 	const ev: WakeEvent = { contextId: "pairing", taskId: "none", taskIds: [], from: "Barry", preview: "", kind: "pairing_request", publicUrl: BASE,
 		pairing: { userCode: "WDJB-2345", verificationUriComplete: `${BASE}/device?user_code=WDJB-2345`, approval: "human", clientName: "Barry", clientId: "barry", agentCardUrl: "https://barry.example.org/card", expiresIn: 600 } };
-	const sum = wakeSummary(ev, "npx a2a-exposed");
+	const sum = wakeSummary(ev, "npx -y a2a-exposed@latest");
 	assert.match(sum, /^A2A pairing request: an agent calling itself "Barry" \(claimed card: "https:\/\/barry\.example\.org\/card"\) asks to connect to your inbox \(code WDJB-2345, expires in 10 minutes\)\./);
 	assert.match(sum, /never approve on your own\. Show them the code WDJB-2345 and give them this link: https:\/\/agent\.example\.com\/device\?user_code=WDJB-2345/);
 	const agentSum = wakeSummary({ ...ev, pairing: { ...ev.pairing!, approval: "agent" } }, "a2a");
@@ -633,7 +634,7 @@ test("GET /: a browser gets an HTML landing page (strict CSP, no scripts); curl/
 	assert.match(h.text, /A2A \(Agent2Agent\)<\/a> endpoint/);
 	assert.ok(h.text.includes(`href="/.well-known/agent-card.json"`) && h.text.includes(`${BASE}/.well-known/agent-card.json`));
 	assert.ok(h.text.includes(`href="/device"`), "pairing link");
-	assert.ok(h.text.includes(`npx a2a-exposed connect ${BASE}`));
+	assert.ok(h.text.includes(`npx -y a2a-exposed@latest connect ${BASE}`));
 	assert.match(h.text, /1\.0, 0\.3/);
 	// the style block carries the CSP nonce
 	const nonce = /style-src 'nonce-([^']+)'/.exec(csp)![1];

package/worker/test/register-hooks.mjs

@@ -0,0 +1,4 @@
+// Lets `node --test` import `*.sql?raw` the way Vite does at build time. `--import` waits for this module.
+import { register } from "node:module";
+
+await register("./sql-raw-hook.mjs", import.meta.url);

package/worker/test/sql-raw-hook.mjs

@@ -0,0 +1,22 @@
+// Resolve `../migrations/0001_init.sql?raw` to the file text as a default export.
+export async function resolve(specifier, context, nextResolve) {
+	if (typeof specifier === "string" && specifier.includes(".sql?raw")) {
+		const resolved = await nextResolve(specifier.replace(/\?raw$/, ""), context);
+		const url = new URL(resolved.url);
+		url.searchParams.set("raw", "1");
+		return { url: url.href, shortCircuit: true };
+	}
+	return nextResolve(specifier, context);
+}
+
+export async function load(url, context, nextLoad) {
+	const u = new URL(url);
+	if (u.searchParams.get("raw") === "1" && u.pathname.endsWith(".sql")) {
+		const { readFileSync } = await import("node:fs");
+		const { fileURLToPath } = await import("node:url");
+		u.search = "";
+		const text = readFileSync(fileURLToPath(u), "utf8");
+		return { format: "module", source: `export default ${JSON.stringify(text)};\n`, shortCircuit: true };
+	}
+	return nextLoad(url, context);
+}

package/worker/test/storage.test.ts

@@ -0,0 +1,74 @@
+// Adapter and migration runner over node:sqlite. The workerd backends are STORAGE_BACKEND=d1|do. Run: npm test
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import { DatabaseSync } from "node:sqlite";
+import { doSqlD1, migrateDo, type SqlStorageLike, type TxRunner } from "../src/storage.ts";
+import { MIGRATIONS } from "../src/migrations.ts";
+
+function asSql(db: DatabaseSync): SqlStorageLike {
+	return {
+		exec(query: string, ...bindings: unknown[]) {
+			const multi = query.includes(";") && !/^\s*select\b/i.test(query);
+			if (bindings.length === 0 && multi) {
+				db.exec(query);
+				return { toArray: () => [], raw: () => [], rowsRead: 0, rowsWritten: 0 };
+			}
+			const stmt = db.prepare(query);
+			if (/^\s*select\b/i.test(query)) {
+				const rows = stmt.all(...(bindings as [])) as Record<string, unknown>[];
+				return { toArray: () => rows, raw: () => rows.map((r) => Object.values(r)), rowsRead: rows.length, rowsWritten: 0 };
+			}
+			const info = stmt.run(...(bindings as []));
+			return { toArray: () => [], raw: () => [], rowsRead: 0, rowsWritten: Number(info.changes) };
+		},
+	};
+}
+
+function txOf(db: DatabaseSync): TxRunner {
+	return (fn) => {
+		db.exec("BEGIN");
+		try { const v = fn(); db.exec("COMMIT"); return v; }
+		catch (e) { db.exec("ROLLBACK"); throw e; }
+	};
+}
+
+test("bundled migrations match worker/migrations", () => {
+	const disk = fs.readdirSync(new URL("../migrations/", import.meta.url)).filter((n) => n.endsWith(".sql")).sort();
+	assert.deepEqual(MIGRATIONS.map((m) => m.name), disk);
+	for (const m of MIGRATIONS) {
+		const file = fs.readFileSync(new URL(`../migrations/${m.name}`, import.meta.url), "utf8");
+		assert.equal(m.sql, file, m.name);
+	}
+});
+
+test("migrateDo applies in numeric order and a later lower number still runs", () => {
+	const db = new DatabaseSync(":memory:");
+	const sql = asSql(db);
+	const tx = txOf(db);
+	const early = MIGRATIONS.filter((m) => m.name === "0001_init.sql" || m.name === "0003_device_pairing.sql");
+	assert.deepEqual(migrateDo(sql, tx, early), ["0001_init.sql", "0003_device_pairing.sql"]);
+	const rest = migrateDo(sql, tx, MIGRATIONS);
+	assert.equal(rest[0], "0002_wake_budget.sql");
+	assert.deepEqual(rest, MIGRATIONS.map((m) => m.name).filter((n) => n !== "0001_init.sql" && n !== "0003_device_pairing.sql"));
+	assert.deepEqual(migrateDo(sql, tx, MIGRATIONS), []);
+	const names = db.prepare("SELECT name FROM d1_migrations ORDER BY id").all().map((r) => (r as { name: string }).name);
+	assert.deepEqual(names, ["0001_init.sql", "0003_device_pairing.sql", ...rest]);
+});
+
+test("doSqlD1 matches D1 binding rules: booleans, undefined, missing columns, batch rollback", async () => {
+	const db = new DatabaseSync(":memory:");
+	const d = doSqlD1(asSql(db), txOf(db));
+	await d.exec("CREATE TABLE t (n INTEGER)");
+	await d.prepare("INSERT INTO t (n) VALUES (?)").bind(true).run();
+	assert.equal((await d.prepare("SELECT n FROM t").first<{ n: number }>())?.n, 1);
+	const wrote = await d.prepare("INSERT INTO t (n) VALUES (?)").bind(4).run();
+	assert.equal(wrote.meta.changes, 1);
+	await assert.rejects(() => d.prepare("SELECT n FROM t WHERE n = ?").bind(undefined).first(), /D1_TYPE_ERROR/);
+	await assert.rejects(() => d.prepare("SELECT n FROM t").first("missing"), /D1_COLUMN_NOTFOUND/);
+	await assert.rejects(() => d.batch([
+		d.prepare("INSERT INTO t (n) VALUES (9)"),
+		d.prepare("INSERT INTO missing (n) VALUES (1)"),
+	]));
+	assert.equal((await d.prepare("SELECT COUNT(*) AS c FROM t WHERE n = 9").first<{ c: number }>())?.c, 0);
+});

package/worker/test/tenancy.test.ts

@@ -0,0 +1,217 @@
+// Tenant context: gates default off, self-host owner auth and peer-token key stay compatible, hosted uses a hash
+// and TENANT_SECRETS_KEY. Run: npm test
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import worker from "../src/index.ts";
+import { sha256 } from "../src/a2a.ts";
+import { openPeerToken, openPeerTokenWithKey, sealPeerToken, sealPeerTokenWithKey } from "../src/mcp.ts";
+import { hostedTenantContext, namespaceForRegion, parseGates, resolveTenant, type WorkerBindings } from "../src/tenancy.ts";
+import { d1 } from "./d1.ts";
+
+const dummy = { prepare() { throw new Error("storage should not be touched"); } } as any;
+const BASE = "https://agent.example.com";
+
+function selfEnv(over: Record<string, unknown> = {}): WorkerBindings {
+	return { DB: dummy, PUBLIC_URL: BASE, OWNER_TOKEN: "owner-secret", ...over } as WorkerBindings;
+}
+
+test("gates: unset is single-tenant and every reserved gate is off", () => {
+	const g = parseGates({ DB: dummy } as WorkerBindings).gates;
+	assert.equal(g.tenancy, "single");
+	assert.equal(g.hostedStorage, false);
+	assert.equal(g.quotas, false);
+	assert.equal(g.usageSink, "");
+	assert.equal(g.wakeTargetPolicy, "");
+	assert.equal(g.signupUrl, "");
+	assert.equal(g.branding, "");
+	assert.equal(g.dataRegion, "");
+	assert.equal(g.tenantDomain, "");
+	assert.deepEqual(g.approvalOidc, { issuer: "", clientId: "", hasClientSecret: false, allowedSubjects: [], methods: ["password"], methodsSpecified: false, label: "" });
+});
+
+test("gates: only exact values turn on; typos and non-https URLs stay off", () => {
+	const g = parseGates({
+		DB: dummy, TENANCY: "Host", QUOTAS: "yes", USAGE_SINK: "log", WAKE_TARGET_POLICY: "https",
+		BRANDING: "a2a", DATA_REGION: "us", SIGNUP_URL: "http://example.com", APPROVAL_OIDC_ISSUER: "http://example.com",
+		APPROVAL_METHODS: "magic", TENANT_DOMAIN: ".Example.COM.",
+	} as WorkerBindings).gates;
+	assert.equal(g.tenancy, "single");
+	assert.equal(g.quotas, false);
+	assert.equal(g.usageSink, "");
+	assert.equal(g.wakeTargetPolicy, "");
+	assert.equal(g.branding, "");
+	assert.equal(g.dataRegion, "");
+	assert.equal(g.signupUrl, "");
+	assert.equal(g.approvalOidc.issuer, "");
+	assert.deepEqual(g.approvalOidc.methods, ["password"]);
+	assert.equal(g.approvalOidc.methodsSpecified, false);
+	assert.equal(g.tenantDomain, "example.com");
+
+	const on = parseGates({
+		DB: dummy, TENANCY: "host", TENANT_DO: {} as any, QUOTAS: "on", USAGE_SINK: "d1",
+		WAKE_TARGET_POLICY: "public-https", BRANDING: "hosted", DATA_REGION: "EU",
+		SIGNUP_URL: "https://example.com/start", APPROVAL_OIDC_ISSUER: "https://example.com",
+		APPROVAL_OIDC_CLIENT_ID: "client", APPROVAL_OIDC_CLIENT_SECRET: "secret",
+		APPROVAL_OIDC_ALLOWED_SUBJECTS: " acct_1 , acct_2 ", APPROVAL_METHODS: "oidc,password",
+		TENANT_DOMAIN: "example.com",
+	} as WorkerBindings).gates;
+	assert.equal(on.tenancy, "host");
+	assert.equal(on.hostedStorage, true);
+	assert.equal(on.quotas, true);
+	assert.equal(on.usageSink, "d1");
+	assert.equal(on.wakeTargetPolicy, "public-https");
+	assert.equal(on.branding, "hosted");
+	assert.equal(on.dataRegion, "eu");
+	assert.equal(on.signupUrl, "https://example.com/start");
+	assert.equal(on.approvalOidc.issuer, "https://example.com");
+	assert.equal(on.approvalOidc.hasClientSecret, true);
+	assert.deepEqual(on.approvalOidc.allowedSubjects, ["acct_1", "acct_2"]);
+	assert.deepEqual(on.approvalOidc.methods, ["oidc", "password"]);
+	assert.equal(on.approvalOidc.methodsSpecified, true);
+	assert.equal(on.approvalOidc.label, "");
+});
+
+test("TENANCY=host without TENANT_DO does not flip hostedStorage", () => {
+	assert.equal(parseGates({ DB: dummy, TENANCY: "host" } as WorkerBindings).gates.hostedStorage, false);
+});
+
+test("self-host peer key decrypts tokens sealed from OWNER_TOKEN, and ignores TENANT_SECRETS_KEY", async () => {
+	const sealed = await sealPeerToken("owner-secret", "alpha", "peer-token");
+	const ctx = resolveTenant(selfEnv({ TENANT_SECRETS_KEY: "platform-key-not-used", TENANCY: "host" }));
+	assert.equal(ctx.mode, "single");
+	assert.equal(ctx.id, "");
+	const key = await ctx.peerKey();
+	assert.ok(key);
+	assert.equal(await openPeerTokenWithKey(key!, "alpha", sealed), "peer-token");
+	assert.equal(await openPeerToken("owner-secret", "alpha", sealed), "peer-token");
+	assert.equal(await ctx.peerKey(), key, "the key is derived once per context");
+});
+
+test("self-host owner check is OWNER_TOKEN equality and rejects a missing token before accepting anyone", async () => {
+	const ctx = resolveTenant(selfEnv());
+	assert.equal(await ctx.isOwner("Bearer owner-secret"), true);
+	assert.equal(await ctx.isOwner("bearer owner-secret"), true);
+	assert.equal(await ctx.isOwner("Bearer owner-secret "), true);
+	assert.equal(await ctx.isOwner("Bearer other"), false);
+	assert.equal(await ctx.isOwner(null), false);
+	assert.equal(await ctx.isOwner("Basic owner-secret"), false);
+	const none = resolveTenant(selfEnv({ OWNER_TOKEN: undefined }));
+	assert.equal(await none.isOwner("Bearer owner-secret"), false);
+	assert.equal(await none.peerKey(), null);
+});
+
+test("hosted owner check uses the token hash and never the platform OWNER_TOKEN", async () => {
+	const token = "hosted-owner-token";
+	const hash = await sha256(token);
+	const ctx = hostedTenantContext(selfEnv({ TENANT_SECRETS_KEY: "platform-key" }), {
+		id: "ten_a", db: dummy, publicUrl: "https://a.example.com", ownerTokenHash: hash.toUpperCase(),
+	});
+	assert.equal(ctx.mode, "host");
+	assert.equal(await ctx.isOwner(`Bearer ${token}`), true);
+	assert.equal(await ctx.isOwner("Bearer owner-secret"), false, "platform OWNER_TOKEN does not authenticate");
+	assert.equal(await ctx.isOwner("Bearer wrong"), false);
+	const bad = hostedTenantContext(selfEnv(), {
+		id: "ten_a", db: dummy, publicUrl: "https://a.example.com", ownerTokenHash: "not-a-hash",
+	});
+	assert.equal(await bad.isOwner(`Bearer ${token}`), false);
+	const missing = hostedTenantContext(selfEnv(), { id: "ten_a", db: dummy, publicUrl: "https://a.example.com" });
+	assert.equal(await missing.isOwner(`Bearer ${token}`), false);
+});
+
+test("hosted peer key is HKDF(TENANT_SECRETS_KEY, tenant id) and does not open another tenant or a self-host seal", async () => {
+	const env = selfEnv({ TENANT_SECRETS_KEY: "platform-key" });
+	const a = hostedTenantContext(env, { id: "ten_a", db: dummy, publicUrl: "https://a.example.com", ownerTokenHash: "ab".repeat(32) });
+	const b = hostedTenantContext(env, { id: "ten_b", db: dummy, publicUrl: "https://b.example.com", ownerTokenHash: "ab".repeat(32) });
+	const keyA = await a.peerKey();
+	assert.ok(keyA);
+	const sealed = await sealPeerTokenWithKey(keyA!, "alpha", "peer-token");
+	assert.equal(await openPeerTokenWithKey(keyA!, "alpha", sealed), "peer-token");
+	assert.equal(await openPeerTokenWithKey((await b.peerKey())!, "alpha", sealed), null);
+	assert.equal(await openPeerToken("owner-secret", "alpha", sealed), null);
+	assert.equal(await openPeerToken("platform-key", "alpha", sealed), null);
+	const selfSealed = await sealPeerToken("owner-secret", "alpha", "peer-token");
+	assert.equal(await openPeerTokenWithKey(keyA!, "alpha", selfSealed), null);
+	const noKey = hostedTenantContext(selfEnv(), { id: "ten_a", db: dummy, publicUrl: "https://a.example.com" });
+	assert.equal(await noKey.peerKey(), null);
+});
+
+test("hosted config does not inherit Worker secrets; operational caps do inherit and can be overridden", () => {
+	const ctx = hostedTenantContext(selfEnv({
+		WAKE_WEBHOOK_URL: "https://hooks.example.net/wake", WAKE_WEBHOOK_KEY: "hook-key",
+		UPSTREAM_TOKEN: "upstream", RATE_PER_MIN: "60", AGENT_NAME: "Platform name",
+	}), {
+		id: "ten_a", db: dummy, publicUrl: "https://a.example.com",
+		config: { AGENT_NAME: "Tenant A", WAKE_WEBHOOK_URL: "https://hooks.example.net/a" },
+	});
+	assert.equal(ctx.AGENT_NAME, "Tenant A");
+	assert.equal(ctx.PUBLIC_URL, "https://a.example.com");
+	assert.equal(ctx.WAKE_WEBHOOK_URL, "https://hooks.example.net/a");
+	assert.equal(ctx.WAKE_WEBHOOK_KEY, undefined);
+	assert.equal(ctx.UPSTREAM_TOKEN, undefined);
+	assert.equal(ctx.RATE_PER_MIN, "60");
+	const capped = hostedTenantContext(selfEnv({ RATE_PER_MIN: "60" }), {
+		id: "ten_a", db: dummy, publicUrl: "https://a.example.com", config: { RATE_PER_MIN: "10" },
+	});
+	assert.equal(capped.RATE_PER_MIN, "10");
+});
+
+test("DATA_REGION selects a DO jurisdiction only for eu and fedramp", () => {
+	const calls: string[] = [];
+	const ns = { id: "default", jurisdiction(loc: string) { calls.push(loc); return { id: loc, jurisdiction: ns.jurisdiction }; } };
+	assert.equal(namespaceForRegion(ns, "").id, "default");
+	assert.equal(namespaceForRegion(ns, "eu").id, "eu");
+	assert.equal(namespaceForRegion(ns, "fedramp").id, "fedramp");
+	assert.equal(namespaceForRegion(ns, "us").id, "default");
+	assert.deepEqual(calls, ["eu", "fedramp"]);
+	assert.equal(namespaceForRegion({ id: "plain" }, "eu").id, "plain");
+});
+
+test("hosted approval comes from the tenant overlay and ignores Worker APPROVAL_OIDC_*", () => {
+	const platform = selfEnv({
+		APPROVAL_OIDC_ISSUER: "https://platform.example", APPROVAL_OIDC_CLIENT_ID: "platform",
+		APPROVAL_OIDC_CLIENT_SECRET: "platform-secret", APPROVAL_OIDC_ALLOWED_SUBJECTS: "platform-user",
+		APPROVAL_METHODS: "oidc",
+	});
+	const ctx = hostedTenantContext(platform, {
+		id: "ten_a", db: dummy, publicUrl: "https://a.example.com",
+		approval: { issuer: "https://idp.example", clientId: "tenant-client", clientSecret: "tenant-secret", allowedSubjects: ["owner-1"], label: "Example IdP" },
+	});
+	assert.equal(ctx.gates.approvalOidc.issuer, "https://idp.example");
+	assert.equal(ctx.gates.approvalOidc.clientId, "tenant-client");
+	assert.deepEqual(ctx.gates.approvalOidc.allowedSubjects, ["owner-1"]);
+	assert.equal(ctx.gates.approvalOidc.label, "Example IdP");
+	assert.equal(ctx.gates.approvalOidc.hasClientSecret, true);
+	assert.equal(ctx.approvalClientSecret(), "tenant-secret");
+	assert.equal(JSON.stringify(ctx.approval).includes("tenant-secret"), false);
+	assert.equal(ctx.gates.approvalOidc.methodsSpecified, false, "omitted methods stay unspecified so both password and OIDC are offered");
+	const empty = hostedTenantContext(platform, { id: "ten_a", db: dummy, publicUrl: "https://a.example.com" });
+	assert.equal(empty.gates.approvalOidc.issuer, "");
+	assert.equal(empty.approvalClientSecret(), "");
+	assert.equal(empty.gates.approvalOidc.hasClientSecret, false);
+});
+
+test("fetch path: gates set or unset, the self-host Worker still answers from OWNER_TOKEN and env.DB", async () => {
+	const DB = d1(new URL("../migrations/", import.meta.url));
+	const base = { DB, PUBLIC_URL: BASE, OWNER_TOKEN: "owner-secret", AGENT_NAME: "Test Inbox" };
+	const gates = {
+		TENANCY: "host", TENANT_SECRETS_KEY: "platform-key", TENANT_DOMAIN: "example.com", DATA_REGION: "eu",
+		QUOTAS: "on", USAGE_SINK: "d1", WAKE_TARGET_POLICY: "public-https", SIGNUP_URL: "https://example.com",
+		BRANDING: "hosted", APPROVAL_OIDC_ISSUER: "https://example.com", APPROVAL_OIDC_CLIENT_ID: "client",
+		APPROVAL_OIDC_CLIENT_SECRET: "secret", APPROVAL_OIDC_ALLOWED_SUBJECTS: "acct_1", APPROVAL_METHODS: "oidc",
+	};
+	const call = async (env: Record<string, unknown>, path: string, headers: Record<string, string> = {}) => {
+		const res = await worker.fetch(new Request(BASE + path, { headers }) as any, env as any, { waitUntil() {}, passThroughOnException() {} } as any);
+		return { status: res.status, data: await res.json() as any };
+	};
+	const plain = await call(base, "/health");
+	const reserved = await call({ ...base, ...gates }, "/health");
+	const empty = await call({ ...base, TENANCY: "", QUOTAS: "", DATA_REGION: "", SIGNUP_URL: "" }, "/health");
+	assert.deepEqual(plain.data, { ok: true, publicUrl: BASE, mode: "inbox", mcp: true });
+	assert.deepEqual(reserved.data, plain.data);
+	assert.deepEqual(empty.data, plain.data);
+
+	const own = await call({ ...base, ...gates }, "/owner/inbox", { authorization: "Bearer owner-secret" });
+	assert.equal(own.status, 200, JSON.stringify(own.data));
+	const no = await call({ ...base, ...gates }, "/owner/inbox", { authorization: "Bearer platform-key" });
+	assert.equal(no.status, 401);
+});