a2a-exposed 0.7.1 → 0.7.3

package/lib/account.mjs

@@ -0,0 +1,94 @@
+// Control-plane sign-in (RFC 8628). The CLI is a public client (`a2a-cli`).
+// The session token is written to config.env and is never printed.
+import * as C from "./config.mjs";
+import { CLI, die } from "./a2a.mjs";
+
+export const CLI_CLIENT_ID = "a2a-cli";
+export const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+
+/** https origin with no userinfo, or "" when the value cannot be a control plane. */
+export function controlOrigin(value) {
+	const raw = String(value || "").trim();
+	if (!raw) return "";
+	try {
+		const url = new URL(raw);
+		if (url.protocol !== "https:" || url.username || url.password) return "";
+		if (url.pathname !== "/" && url.pathname !== "") return "";
+		if (url.search || url.hash) return "";
+		return url.origin;
+	} catch {
+		return "";
+	}
+}
+
+function scale() {
+	const n = Number(process.env.A2A_POLL_SCALE);
+	return Number.isFinite(n) && n > 0 && n <= 1 ? n : 1;
+}
+
+async function readJson(response) {
+	const text = await response.text();
+	try { return text ? JSON.parse(text) : {}; } catch { return { error: "invalid_response" }; }
+}
+
+/**
+ * Run the device flow and store CONTROL_URL plus CONTROL_TOKEN.
+ * `fetchImpl` and `sleep` are for tests. The token is not included in the result.
+ */
+export async function deviceLogin({
+	controlUrl,
+	intent = "login",
+	fetchImpl = fetch,
+	sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+	write = (line) => console.error(line),
+	save = (updates) => C.saveConfig(updates),
+} = {}) {
+	const origin = controlOrigin(controlUrl);
+	if (!origin) die(`--control-url must be an https origin with no path (example: --control-url https://control.example)`);
+	const codeResponse = await fetchImpl(`${origin}/api/auth/device/code`, {
+		method: "POST",
+		headers: { "content-type": "application/json", accept: "application/json" },
+		body: JSON.stringify({ client_id: CLI_CLIENT_ID }),
+	});
+	const started = await readJson(codeResponse);
+	if (!codeResponse.ok || !started.device_code || !started.user_code || !started.verification_uri_complete) {
+		const reason = typeof started.error === "string" ? started.error : `HTTP ${codeResponse.status}`;
+		die(reason === "not_found" || codeResponse.status === 404
+			? `login is not turned on at ${origin}`
+			: `could not start sign-in at ${origin} (${reason})`);
+	}
+	const verb = intent === "signup" ? "Create an account and approve" : "Sign in and approve";
+	write(`${verb} this code:\n${started.user_code}\n${started.verification_uri_complete}`);
+	const interval = Math.max(1, Number(started.interval) || 5);
+	const deadline = Date.now() + Math.max(1, Number(started.expires_in) || 600) * 1000;
+	let wait = interval;
+	while (Date.now() < deadline) {
+		await sleep(wait * 1000 * scale());
+		const tokenResponse = await fetchImpl(`${origin}/api/auth/device/token`, {
+			method: "POST",
+			headers: { "content-type": "application/json", accept: "application/json" },
+			body: JSON.stringify({ grant_type: DEVICE_GRANT, device_code: started.device_code, client_id: CLI_CLIENT_ID }),
+		});
+		const body = await readJson(tokenResponse);
+		if (tokenResponse.ok && typeof body.access_token === "string" && body.access_token) {
+			save({ CONTROL_URL: origin, CONTROL_TOKEN: body.access_token });
+			const sessionResponse = await fetchImpl(`${origin}/api/auth/get-session`, {
+				headers: { accept: "application/json", authorization: `Bearer ${body.access_token}` },
+			});
+			const session = await readJson(sessionResponse);
+			const email = typeof session?.user?.email === "string" ? session.user.email : "";
+			write(email ? `Signed in as ${email}.` : "Signed in.");
+			return { controlUrl: origin, email };
+		}
+		const error = typeof body.error === "string" ? body.error : "";
+		if (error === "authorization_pending") continue;
+		if (error === "slow_down") {
+			wait += 5;
+			continue;
+		}
+		if (error === "access_denied") die("sign-in was denied");
+		if (error === "expired_token") die("that code expired; run the command again");
+		die(`sign-in failed (${error || `HTTP ${tokenResponse.status}`})`);
+	}
+	die("that code expired; run the command again");
+}

package/lib/main.mjs

@@ -7,6 +7,7 @@ import * as dep from "./deploy.mjs";
 import * as tun from "./tunnel.mjs";
 import * as st from "./status.mjs";
 import * as pair from "./pair.mjs";
+import * as account from "./account.mjs";
 import * as upd from "./update.mjs";
 
 const VERSION = JSON.parse(fs.readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
@@ -161,6 +162,18 @@ Outbound (agents you call)
   poll --to <alias|url> <taskId> [--proto 0.3|1.0]
   outbound <taskId>       stored state of a task you sent (incl. pushed updates)
 
+Control plane account (only when that deployment's login is on)
+  signup --control-url https://control.example
+  login  --control-url https://control.example
+                                device-flow sign-in. Prints a code and a page. Type that code
+                                on the page; the link alone does not approve. The session is saved
+                                as CONTROL_TOKEN in config.env and is not printed. signup and login
+                                are the same flow; signup is how the first account is created.
+                                --json prints the control origin and email, not the token.
+                                A browser sign-in that does not complete returns to /app?error=<code>.
+                                The control Worker logs social_sign_in_failed before the provider
+                                page, and oauth_callback_failed when the provider sends the browser back
+
 Presets: grok-bot | claude-code | openclaw-wake | openclaw-agent | hermes | generic
 Config: ${C.CONFIG_FILE}  (override dir with --config-dir DIR or A2A_CONFIG_DIR; env vars override file values)
 Update notice: at most a daily background check of the npm registry; off with A2A_NO_UPDATE_CHECK=1 (or DO_NOT_TRACK=1)`;
@@ -184,6 +197,8 @@ const SPEC = {
 	export: { sql: B },
 	upstream: { json: B },
 	connect: { alias: S, name: S, json: B, "no-wait": B, replace: B, force: B, "card-url": S },
+	signup: { "control-url": S, json: B },
+	login: { "control-url": S, json: B },
 	pair: { json: B, web: B, ttl: S, issuer: S, "client-id": S, subjects: S, methods: S, "secret-stdin": B },
 };
 const STATES = ["completed", "input-required", "failed", "rejected", "working"];
@@ -250,6 +265,12 @@ export async function main(argv) {
 		case "export": return cmd.exportInbox(o);
 		case "token": return cmd.token(need(p[0], "token issue|list|revoke|rotate [label]"), p[1], o);
 		case "peers": return cmd.peers(p[0] || "list", p.slice(1), o);
+		case "signup":
+		case "login": {
+			const result = await account.deviceLogin({ controlUrl: o["control-url"] || C.get("CONTROL_URL"), intent: name });
+			if (o.json) console.log(JSON.stringify({ control_url: result.controlUrl, email: result.email }));
+			return;
+		}
 		case "connect": return pair.connect(need(p[0], "connect <base-or-card-url> [--alias A] [--no-wait] [--json]"), o);
 		case "pair": {
 			const sub = need(p[0], "pair set-password|set-oidc|list|approve <code>|deny <code>");

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "a2a-exposed",
-	"version": "0.7.1",
+	"version": "0.7.3",
 	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: Cloudflare Worker inbox + wake webhook or scheduled inbox checks",
 	"type": "module",
 	"bin": {