a2a-exposed 0.5.0 → 0.7.0

package/worker/src/mcp.ts

@@ -3,6 +3,7 @@
 // metadata. Pure helpers live here; the routes (D1, approval password, owner API) are in index.ts.
 import { esc } from "./pairing.ts";
 import { isPrivateHost } from "./a2a.ts";
+import { derivePeerKey } from "./tenancy.ts";
 
 export const SCOPE = "inbox";
 /** Modern (stateless, per-request _meta) versions: no initialize, server/discover, resultType, Mcp-Method / Mcp-Name headers. */
@@ -169,6 +170,10 @@ export type ConsentModel = {
 	params: Record<string, string>; // the authorization request, posted back in hidden fields
 	passwordSet: boolean;
 	notice?: { kind: "ok" | "error" | "info"; text: string };
+	/** Set only when OpenID Connect approval is offered. Absent keeps the consent HTML unchanged. */
+	oidc?: { label: string };
+	/** False hides the password field. Absent means the password field is shown as before. */
+	passwordEnabled?: boolean;
 };
 
 export function consentBody(m: ConsentModel): string {
@@ -184,41 +189,54 @@ export function consentBody(m: ConsentModel): string {
 	const idRow = m.clientIdHost ? `<tr><th>Client identity published at</th><td>${esc(m.clientIdHost)}</td></tr>` : "";
 	const table = `<table><tr><th>Client (as it calls itself)</th><td>${esc(m.clientName || "(no name given)")}</td></tr>${idRow}<tr><th>Returns to</th><td>${esc(host)}</td></tr></table>`;
 	const scope = `<h2>It will be able to</h2><ul>${can.map((x) => `<li>${esc(x)}</li>`).join("")}</ul><h2>It will not be able to</h2><ul>${cannot.map((x) => `<li>${esc(x)}</li>`).join("")}</ul>`;
-	const form = m.passwordSet
+	const passwordOn = m.passwordEnabled !== false;
+	const form = passwordOn && m.passwordSet
 		? `<form method="post" action="/oauth/authorize"><input type="hidden" name="csrf" value="${esc(m.csrf)}">${hidden}
 <label for="pw">Approval password (needed to approve; deny works without it)</label><input id="pw" name="password" type="password" autocomplete="current-password" required maxlength="1024" autofocus>
 <div class="b"><button name="decision" value="approve" type="submit">Approve</button><button name="decision" value="deny" type="submit" class="d" formnovalidate>Deny</button></div></form>`
-		: `<p class="n info">No approval password is set yet: ask your agent to run <code>${esc(m.cli)} pair set-password --web</code> and open the one-time link it sends you, then start connecting again.</p>
-<form method="post" action="/oauth/authorize"><input type="hidden" name="csrf" value="${esc(m.csrf)}">${hidden}<div class="b"><button name="decision" value="deny" type="submit" class="d">Deny</button></div></form>`;
+		: passwordOn
+		? `<p class="n info">No approval password is set yet: ask your agent to run <code>${esc(m.cli)} pair set-password --web</code> and open the one-time link it sends you, then start connecting again.</p>
+<form method="post" action="/oauth/authorize"><input type="hidden" name="csrf" value="${esc(m.csrf)}">${hidden}<div class="b"><button name="decision" value="deny" type="submit" class="d">Deny</button></div></form>`
+		: `<form method="post" action="/oauth/authorize"><input type="hidden" name="csrf" value="${esc(m.csrf)}">${hidden}<div class="b"><button name="decision" value="deny" type="submit" class="d">Deny</button></div></form>`;
+	const oidcForm = m.oidc ? `<form method="post" action="/oauth/authorize"><input type="hidden" name="csrf" value="${esc(m.csrf)}">${hidden}
+<div class="b"><button name="decision" value="oidc" type="submit">Continue with ${esc(m.oidc.label)}</button></div></form>` : "";
 	return `${notice}<p>An MCP client asks to use the inbox of <b>${esc(m.agentName)}</b> as a connector.</p>${table}${loop}${scope}
-<p class="w">Approve only if you are adding this connector right now. The name above is claimed by the client. Revoke access any time: <code>${esc(m.cli)} token list</code>, then <code>${esc(m.cli)} token revoke &lt;label&gt;</code>.</p>${form}`;
+<p class="w">Approve only if you are adding this connector right now. The name above is claimed by the client. Revoke access any time: <code>${esc(m.cli)} token list</code>, then <code>${esc(m.cli)} token revoke &lt;label&gt;</code>.</p>${form}${oidcForm}`;
 }
 
-// ------------------------------------------------------------------ outbound peer token encryption (AES-GCM, key from OWNER_TOKEN via HKDF)
+// ------------------------------------------------------------------ outbound peer token encryption (AES-GCM)
+// Self-host: HKDF(OWNER_TOKEN), salt "a2a-exposed", info "outbound-peer-token v1" (existing ciphertext still decrypts).
+// Hosted: TenantContext.peerKey() uses the same HKDF with info bound to the tenant id and IKM TENANT_SECRETS_KEY.
 async function peerKey(ownerToken: string): Promise<CryptoKey> {
-	const base = await crypto.subtle.importKey("raw", new TextEncoder().encode(ownerToken), "HKDF", false, ["deriveKey"]);
-	return crypto.subtle.deriveKey({ name: "HKDF", hash: "SHA-256", salt: new TextEncoder().encode("a2a-exposed"), info: new TextEncoder().encode("outbound-peer-token v1") },
-		base, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+	return derivePeerKey(ownerToken);
 }
 const b64 = (b: Uint8Array) => btoa(String.fromCharCode(...b));
 const unb64 = (s: string) => Uint8Array.from(atob(s), (c) => c.charCodeAt(0));
 
-export async function sealPeerToken(ownerToken: string, alias: string, token: string): Promise<string> {
+export async function sealPeerTokenWithKey(key: CryptoKey, alias: string, token: string): Promise<string> {
 	const iv = crypto.getRandomValues(new Uint8Array(12));
-	const ct = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData: new TextEncoder().encode(alias) }, await peerKey(ownerToken), new TextEncoder().encode(token)));
+	const ct = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData: new TextEncoder().encode(alias) }, key, new TextEncoder().encode(token)));
 	return `v1.${b64(iv)}.${b64(ct)}`;
 }
 
+export async function sealPeerToken(ownerToken: string, alias: string, token: string): Promise<string> {
+	return sealPeerTokenWithKey(await peerKey(ownerToken), alias, token);
+}
+
 /** The token, or null when it can't be decrypted (the owner token was rotated since `peers sync`). */
-export async function openPeerToken(ownerToken: string, alias: string, sealed: string): Promise<string | null> {
+export async function openPeerTokenWithKey(key: CryptoKey, alias: string, sealed: string): Promise<string | null> {
 	const [v, iv, ct] = String(sealed || "").split(".");
 	if (v !== "v1" || !iv || !ct) return null;
 	try {
-		const pt = await crypto.subtle.decrypt({ name: "AES-GCM", iv: unb64(iv), additionalData: new TextEncoder().encode(alias) }, await peerKey(ownerToken), unb64(ct));
+		const pt = await crypto.subtle.decrypt({ name: "AES-GCM", iv: unb64(iv), additionalData: new TextEncoder().encode(alias) }, key, unb64(ct));
 		return new TextDecoder().decode(pt);
 	} catch { return null; }
 }
 
+export async function openPeerToken(ownerToken: string, alias: string, sealed: string): Promise<string | null> {
+	return openPeerTokenWithKey(await peerKey(ownerToken), alias, sealed);
+}
+
 // ------------------------------------------------------------------ A2A client (outbound, from the Worker)
 /** JSON-RPC endpoint + version from a peer card (prefers 1.0), as the CLI's pickEndpoint. */
 export function pickEndpoint(base: string, card: any): [string, string] {

package/worker/src/migrations.ts

@@ -0,0 +1,22 @@
+// Inbox migrations bundled into the Worker. Vite inlines each `?raw` import.
+// A new file in worker/migrations/ must be added here; storage tests check the two lists match.
+import m0001 from "../migrations/0001_init.sql?raw";
+import m0002 from "../migrations/0002_wake_budget.sql?raw";
+import m0003 from "../migrations/0003_device_pairing.sql?raw";
+import m0004 from "../migrations/0004_pairing_replace.sql?raw";
+import m0005 from "../migrations/0005_facade_owners.sql?raw";
+import m0006 from "../migrations/0006_mcp.sql?raw";
+import m0007 from "../migrations/0007_cimd.sql?raw";
+import m0008 from "../migrations/0008_oidc_txns.sql?raw";
+import type { Migration } from "./storage.ts";
+
+export const MIGRATIONS: Migration[] = [
+	{ name: "0001_init.sql", sql: m0001 },
+	{ name: "0002_wake_budget.sql", sql: m0002 },
+	{ name: "0003_device_pairing.sql", sql: m0003 },
+	{ name: "0004_pairing_replace.sql", sql: m0004 },
+	{ name: "0005_facade_owners.sql", sql: m0005 },
+	{ name: "0006_mcp.sql", sql: m0006 },
+	{ name: "0007_cimd.sql", sql: m0007 },
+	{ name: "0008_oidc_txns.sql", sql: m0008 },
+];

package/worker/src/pairing.ts

@@ -2,6 +2,10 @@
 // in Workers and in Node's test runner. The HTTP handlers live in index.ts.
 import { isPrivateHost } from "./a2a.ts";
 
+/** How every hint tells an agent to run the CLI: npx, latest release, no global install (agent sandboxes block global
+ *  installs as untrusted code). WAKE_CLI_COMMAND overrides it for the owner's own wake hints only. */
+export const DEFAULT_CLI = "npx -y a2a-exposed@latest";
+
 export const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 export const EXPIRES_S = 600; // device / user code lifetime
 export const INTERVAL_S = 5; // minimum polling interval (slow_down adds 5 s each time)
@@ -179,6 +183,10 @@ export type PageModel = {
 	askCode?: boolean; // show the code entry form
 	passwordSet: boolean;
 	codeValue?: string;
+	/** Set only when OpenID Connect approval is offered. Absent keeps the page HTML unchanged. */
+	oidc?: { label: string };
+	/** False hides the password field. Absent means the password field is shown as before. */
+	passwordEnabled?: boolean;
 };
 
 export function devicePage(m: PageModel, nonce: string): string {
@@ -201,13 +209,18 @@ export function devicePage(m: PageModel, nonce: string): string {
 <div class="b"><button name="decision" value="deny" type="submit" class="d">Deny</button></div>
 </form>`;
 	// Deny needs no password (formnovalidate skips the required field): denying grants nothing
-	const form = r && m.passwordSet ? `<form method="post" action="/device">
+	const passwordOn = m.passwordEnabled !== false;
+	const form = r && passwordOn && m.passwordSet ? `<form method="post" action="/device">
 <input type="hidden" name="csrf" value="${esc(m.csrf)}"><input type="hidden" name="user_code" value="${esc(formatUserCode(r.userCode))}">
 <label for="pw">Approval password (needed to approve; deny works without it)</label><input id="pw" name="password" type="password" autocomplete="current-password" required maxlength="1024" autofocus>
 <div class="b"><button name="decision" value="approve" type="submit">Approve</button><button name="decision" value="deny" type="submit" class="d" formnovalidate>Deny</button></div>
-</form>` : r && !m.passwordSet ? noPassword + denyOnly : "";
+</form>` : r && passwordOn && !m.passwordSet ? noPassword + denyOnly : r ? denyOnly : "";
+	const oidcForm = m.oidc && r ? `<form method="post" action="/device">
+<input type="hidden" name="csrf" value="${esc(m.csrf)}"><input type="hidden" name="user_code" value="${esc(formatUserCode(r.userCode))}">
+<div class="b"><button name="decision" value="oidc" type="submit">Approve with ${esc(m.oidc.label)}</button></div>
+</form>` : "";
 	const ask = m.askCode ? `<form method="get" action="/device"><label for="uc">Code</label><input id="uc" name="user_code" value="${esc(m.codeValue || "")}" placeholder="WDJB-4827" autocomplete="off" autocapitalize="characters" required maxlength="16" autofocus><div class="b"><button type="submit">Continue</button></div></form>` : "";
-	return pageShell(`Connect an agent to ${m.agentName}`, nonce, `${notice}${details}${form}${ask}`);
+	return pageShell(`Connect an agent to ${m.agentName}`, nonce, `${notice}${details}${form}${oidcForm}${ask}`);
 }
 
 const STYLE = `body{font:16px/1.5 system-ui,sans-serif;max-width:34rem;margin:2rem auto;padding:0 1rem;color:#111;background:#fafafa}
@@ -243,7 +256,7 @@ export function landingPage(m: LandingModel, nonce: string): string {
 		? `<h2>Skills</h2><ul>${m.skills.slice(0, 20).map((k) => `<li><b>${esc(k.name)}</b>${k.description ? ` &ndash; ${esc(k.description)}` : ""}</li>`).join("")}</ul>${m.skills.length > 20 ? `<p class="w">&hellip;and ${m.skills.length - 20} more in the agent card.</p>` : ""}`
 		: "";
 	const connect = m.pairing
-		? `<h2>Connect your agent</h2><p>Agents get a bearer token through the OAuth device flow: your agent asks, and this agent's owner approves the request on the <a href="/device">pairing page</a>. No secrets go through chat. With the a2a-exposed CLI, your agent runs:</p><p><code>npx a2a-exposed connect ${esc(m.base)}</code></p>`
+		? `<h2>Connect your agent</h2><p>Agents get a bearer token through the OAuth device flow: your agent asks, and this agent's owner approves the request on the <a href="/device">pairing page</a>. No secrets go through chat. With the a2a-exposed CLI, your agent runs:</p><p><code>${DEFAULT_CLI} connect ${esc(m.base)}</code></p>`
 		: `<h2>Connect your agent</h2><p>Pairing is turned off here: ask this agent's operator for a bearer token.</p>`;
 	return pageShell(m.name, nonce, `${desc}
 <p class="n info">This is an <a href="https://a2a-protocol.org/">A2A (Agent2Agent)</a> endpoint, meant for agents rather than people.${m.proxy ? "" : " Messages land in its owner's inbox, which wakes the agent."}</p>

package/worker/src/sql-raw.d.ts

@@ -0,0 +1,5 @@
+/** Vite (`?raw`) and the test loader both turn a `.sql?raw` import into the file's text. */
+declare module "*.sql?raw" {
+	const sql: string;
+	export default sql;
+}

package/worker/src/storage.ts

@@ -0,0 +1,100 @@
+// D1-shaped database over a Durable Object's SQLite (`ctx.storage.sql`).
+// Handlers keep calling prepare().bind().first()/all()/run() and batch(). Self-host keeps the real D1 binding;
+// a hosted tenant uses this adapter on its own object. `migrateDo` matches `cf d1 migrations apply`: the same
+// `d1_migrations` table, unrecorded files in numeric order, one transaction per file.
+
+/** The slice of the Workers `SqlStorage` API this adapter uses. Tests can implement it over node:sqlite. */
+export interface SqlStorageLike {
+	exec(query: string, ...bindings: unknown[]): SqlCursor;
+}
+
+export interface SqlCursor {
+	toArray(): Record<string, unknown>[];
+	raw(): Iterable<unknown[]>;
+	rowsRead?: number;
+	rowsWritten?: number;
+}
+
+export type TxRunner = <T>(fn: () => T) => T;
+export type Migration = { name: string; sql: string };
+
+const WRITE = /^\s*(?:insert|update|delete|replace)\b/i;
+
+/** D1 rejects undefined bindings and stores booleans as 1/0. Mirror both so the backends agree. */
+function norm(v: unknown, i: number): unknown {
+	if (v === undefined) throw new Error(`D1_TYPE_ERROR: Type 'undefined' not supported for value at index ${i}`);
+	if (typeof v === "boolean") return v ? 1 : 0;
+	return v;
+}
+
+export interface DoSql {
+	prepare(query: string): DoStmt;
+	batch(statements: DoStmt[]): Promise<{ results?: unknown[]; meta: { changes?: number; last_row_id?: number } }[]>;
+	exec(query: string): Promise<{ count: number; duration: number }>;
+}
+
+export interface DoStmt {
+	__sql: string;
+	__args: unknown[];
+	bind(...values: unknown[]): DoStmt;
+	first<T = unknown>(colName?: string): Promise<T | null>;
+	all<T = unknown>(): Promise<{ results?: T[]; meta: { changes?: number; last_row_id?: number } }>;
+	run(): Promise<{ results?: unknown[]; meta: { changes?: number; last_row_id?: number } }>;
+	raw<T = unknown>(options?: { columnNames?: boolean }): Promise<T[]>;
+}
+
+/** A D1-shaped database over `SqlStorage`. `batch` is one transaction; DO SQL forbids BEGIN/COMMIT, so the caller passes `transactionSync`. */
+export function doSqlD1(sql: SqlStorageLike, tx: TxRunner): DoSql {
+	const changesOf = (q: string) => {
+		let changes = 0, last_row_id = 0;
+		if (WRITE.test(q)) {
+			// `rowsWritten` also counts index writes. Ask SQLite for the D1-equivalent `meta.changes`.
+			const m = sql.exec("SELECT changes() AS c, last_insert_rowid() AS r").toArray()[0] as { c?: unknown; r?: unknown } | undefined;
+			changes = Number(m?.c ?? 0);
+			last_row_id = Number(m?.r ?? 0);
+		}
+		return { changes, last_row_id };
+	};
+	const result = (q: string, args: unknown[]) => {
+		const rows = sql.exec(q, ...args.map(norm)).toArray();
+		return { success: true as const, results: rows, meta: changesOf(q) };
+	};
+	const stmt = (q: string, args: unknown[] = []): DoStmt => ({
+		__sql: q,
+		__args: args,
+		bind: (...a: unknown[]) => stmt(q, a),
+		first: async (col?: string) => {
+			const r = result(q, args).results[0];
+			if (!r) return null;
+			if (col === undefined) return r as never;
+			if (!(col in r)) throw new Error(`D1_COLUMN_NOTFOUND: Column not found (${col})`);
+			return r[col] as never;
+		},
+		// `T` is the caller's row shape. The cursor only knows records, so the cast is the D1 generic.
+		all: async <T>() => result(q, args) as { results: T[]; meta: { changes: number; last_row_id: number } },
+		run: async () => result(q, args),
+		raw: async <T>() => [...sql.exec(q, ...args.map(norm)).raw()] as T[],
+	});
+	return {
+		prepare: (q: string) => stmt(q),
+		batch: async (stmts) => tx(() => stmts.map((s) => result(s.__sql, s.__args))),
+		exec: async (q: string) => { sql.exec(q); return { count: 1, duration: 0 }; },
+	};
+}
+
+const num = (n: string) => parseInt(n.split("_")[0]!, 10);
+const byNumber = (a: Migration, b: Migration) => num(a.name) - num(b.name) || (a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+
+/**
+ * Same bookkeeping as `cf d1 migrations apply`: create `d1_migrations` if needed, apply every unrecorded file in
+ * numeric order, each in its own transaction. A lower number added later still runs when a higher one is already
+ * recorded. Returns the names applied (empty once the object is up to date).
+ * Call this only after the tenant row exists. An unconfigured object must not create tables.
+ */
+export function migrateDo(sql: SqlStorageLike, tx: TxRunner, migrations: Migration[]): string[] {
+	sql.exec("CREATE TABLE IF NOT EXISTS d1_migrations (id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT UNIQUE, applied_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP NOT NULL)");
+	const done = new Set(sql.exec("SELECT name FROM d1_migrations").toArray().map((r) => String(r.name)));
+	const todo = [...migrations].sort(byNumber).filter((m) => !done.has(m.name));
+	for (const m of todo) tx(() => { sql.exec(m.sql); sql.exec("INSERT INTO d1_migrations (name) VALUES (?)", m.name); });
+	return todo.map((m) => m.name);
+}