a2a-exposed 0.7.10 → 0.7.12

package/lib/main.mjs

@@ -126,7 +126,11 @@ Pairing (OAuth 2.0 device flow, RFC 8628: agents connect without pasting tokens
                           peer then swaps the old token for the new one under the same label (older peers
                           keep the old token until their owner revokes it). --card-url: the card to name in
                           the request (default: this deployment's); a *.ts.net / LAN card is sent as
-                          informational (flagged "not publicly reachable"), a non-https one is left out
+                          informational (flagged "not publicly reachable"), a non-https one is left out.
+                          The name sent is the card named in the request (--card-url, otherwise this
+                          deployment's). --name overrides it. If that card can't be read, the name is the
+                          configured agent name, the worker name, or the public host's first label. The
+                          other inbox labels the token from that name and adds -2, -3, … when it is taken
   pair set-password --web [--ttl MIN] [--json]
                           one-time link (default 15 min, single use) where your human sets or changes the
                           approval password on a web page. Send it to them privately; never open or fill it

package/lib/pair.mjs

@@ -193,6 +193,39 @@ export function deviceEndpointsFromCard(card) {
 const slug = (s) => String(s || "").replace(/[^A-Za-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 32).replace(/-+$/, "").toLowerCase();
 const sleep = (s) => new Promise((r) => setTimeout(r, s * 1000 * Number(process.env.A2A_POLL_SCALE || 1)));
 
+/** First DNS label of this deployment's public URL, or "" for loopback and an unusable host. */
+export function hostAlias(ownUrl) {
+	if (!ownUrl) return "";
+	try {
+		const host = new URL(ownUrl).hostname;
+		if (host === "localhost" || host === "127.0.0.1" || host === "[::1]") return "";
+		return slug(host.split(".")[0]);
+	} catch { return ""; }
+}
+
+/**
+ * client_name for a pairing request. An explicit `--name` wins, then the card named in the request
+ * (`--card-url`, otherwise this deployment's card), then the configured agent name, then the local
+ * alias (worker name, else the public host's first label).
+ */
+export function pairingClientName({ explicit = "", cardName = "", agentName = "", workerName = "", ownUrl = "" } = {}) {
+	const text = (v) => String(v || "").replace(/\s+/g, " ").trim().slice(0, 64);
+	for (const v of [explicit, cardName, agentName, workerName, hostAlias(ownUrl)]) {
+		const t = text(v);
+		if (t) return t;
+	}
+	return "a2a-exposed agent";
+}
+
+/** Name on a card URL, or "" when the card can't be read. */
+async function readCardName(url) {
+	if (!url) return "";
+	try {
+		const { status, data } = await httpJson(url, { timeout: 3000 });
+		return status === 200 && data && typeof data.name === "string" ? data.name : "";
+	} catch { return ""; }
+}
+
 async function postForm(url, params, bearer = null) {
 	let r;
 	const headers = { "content-type": "application/x-www-form-urlencoded", accept: "application/json" };
@@ -315,16 +348,19 @@ A different agent at the same URL? Pass another --alias.`);
 		`Resuming the pairing request to ${peerName} (code ${st.userCode}, link ${st.verificationUriComplete}).`);
 	else {
 		const own = baseUrl();
-		const params = { client_name: o.name || C.get("A2A_AGENT_NAME") || C.get("A2A_WORKER_NAME") || "a2a-exposed agent", client_id: C.get("A2A_WORKER_NAME") || alias };
-		const card = cardUrlToSend(o["card-url"], own, o.json);
-		if (card) params.agent_card_url = card;
+		const sentCard = cardUrlToSend(o["card-url"], own, o.json);
+		// The name is the card this request actually names. --card-url (a Tailnet card, before a public
+		// deployment exists) wins. With no override, read this deployment's card, including an http one.
+		const nameUrl = sentCard || (!o["card-url"] && /^https?:\/\//.test(own || "") ? `${own.replace(/\/$/, "")}/.well-known/agent-card.json` : "");
+		const params = { client_name: pairingClientName({ explicit: o.name, cardName: await readCardName(nameUrl), agentName: C.get("A2A_AGENT_NAME"), workerName: C.get("A2A_WORKER_NAME"), ownUrl: own }), client_id: C.get("A2A_WORKER_NAME") || alias };
+		if (sentCard) params.agent_card_url = sentCard;
 		// replacing: present the old token, so a peer that supports it swaps the token under the same label (no orphan)
 		const r = await postForm(ep.device, params, replace && oldToken ? oldToken : null);
 		if (r.status !== 200 || !r.data.device_code || !r.data.user_code) {
 			const why = r.data.error_description || r.data.error || `HTTP ${r.status}`;
-			const privateCard = !!card && (() => { try { return isPrivateHost(new URL(card).hostname); } catch { return false; } })();
+			const privateCard = !!sentCard && (() => { try { return isPrivateHost(new URL(sentCard).hostname); } catch { return false; } })();
 			die(r.status === 429 ? `${peerName} is not accepting more pairing requests right now: ${why}` : r.status === 404 ? `${peerName} has device-flow pairing disabled (${why}); ask its owner for a token`
-				: `pairing request to ${peerName} failed: ${why}${privateCard && r.status === 400 ? `. The card URL sent (${new URL(card).host}) is not publicly reachable, and inboxes may accept only public https cards: retry with --card-url set to a public card, or expose your agent through a public façade first (setup skill: "Already have A2A on a Tailnet or LAN")` : ""}`);
+				: `pairing request to ${peerName} failed: ${why}${privateCard && r.status === 400 ? `. The card URL sent (${new URL(sentCard).host}) is not publicly reachable, and inboxes may accept only public https cards: retry with --card-url set to a public card, or expose your agent through a public façade first (setup skill: "Already have A2A on a Tailnet or LAN")` : ""}`);
 		}
 		st = { base, alias, device: ep.device, token: ep.token, deviceCode: r.data.device_code, userCode: r.data.user_code,
 			verificationUri: r.data.verification_uri || "", verificationUriComplete: r.data.verification_uri_complete || r.data.verification_uri || "",

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "a2a-exposed",
-	"version": "0.7.10",
+	"version": "0.7.12",
 	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: Cloudflare Worker inbox + wake webhook or scheduled inbox checks",
 	"type": "module",
 	"bin": {

package/worker/src/hosted.ts

@@ -13,13 +13,15 @@
 // Usage push is not in this change. Approval OIDC, when configured (self-host settings, or the pushed tenant
 // `approval` object), uses the same pages as self-host.
 import { DurableObject } from "cloudflare:workers";
-import worker, { cronFlush, dispatch, nextCronAt, onWakeWrite } from "./index.ts";
+import worker, { cronFlush, dispatch, nextCronAt, onWakeWrite, runOwnerRpc } from "./index.ts";
+import { accountIdOf, type OwnerRpcRequest, type OwnerRpcResult } from "./owner-rpc.ts";
 import { doSqlD1, migrateDo, type SqlStorageLike, type TxRunner } from "./storage.ts";
 import { MIGRATIONS } from "./migrations.ts";
 import { bookmarkForTime as readBookmark, exportRows, restoreBookmark as applyBookmark, restartAfterResult, toSql, ExportError, type BookmarkStorage } from "./export.ts";
 import { hostedDailyBackup } from "./backup.ts";
 import { lookupDirectory, pinDirectoryRegion, tenantNameFromHost, tenantRegion, TENANT_NAME, type DirectoryEntry } from "./directory.ts";
 import { hostedTenantContext, namespaceForRegion, parseGates, type WorkerBindings } from "./tenancy.ts";
+import { WAKE_SECRET_KEYS, openWakeSecrets } from "./wake-secrets.ts";
 
 export { clearDirectoryCache, directoryKey, lookupDirectory, parseDirectoryEntry, pinDirectoryRegion, tenantNameFromHost, tenantRegion, TENANT_NAME } from "./directory.ts";
 export type { DirectoryEntry };
@@ -32,7 +34,7 @@ const gone = () => Response.json({ error: "this agent is gone" }, { status: 410,
 
 const TENANT_ID = /^[A-Za-z0-9._:-]{1,128}$/;
 
-/** Versioned config pushed by the control plane. `secretsEnc` is stored and not decrypted here. */
+/** Versioned config pushed by the control plane. `secretsEnc` is decrypted into the wake credentials when the context is built. */
 export interface TenantConfigPush {
 	version: number;
 	tenantId: string;
@@ -151,14 +153,29 @@ export class TenantStore extends DurableObject<WorkerBindings> {
 		});
 	}
 
-	#tenant(fallbackOrigin = "") {
+	async #tenant(fallbackOrigin = "") {
 		const row = this.#row;
 		if (!row) return null;
-		const domain = parseGates(this.env).gates.tenantDomain;
+		const parsed = parseGates(this.env);
+		const domain = parsed.gates.tenantDomain;
 		const publicUrl = domain ? `https://${row.name}.${domain}` : (fallbackOrigin || this.env.PUBLIC_URL || "");
+		const config = { ...row.config };
+		// Once a ciphertext is stored, the secret wake fields come only from it. A plaintext copy in
+		// config_json is ignored, and a blob that cannot be opened leaves those fields unset.
+		if (row.secretsEnc) {
+			const opened = await openWakeSecrets(parsed.secretsKey || "", row.tenantId, row.secretsEnc);
+			if (!opened) {
+				console.log(JSON.stringify({ ts: new Date().toISOString(), event: "wake_secrets_unreadable", tenant: row.tenantId }));
+			}
+			for (const key of WAKE_SECRET_KEYS) {
+				const value = opened?.[key];
+				if (value) config[key] = value;
+				else delete config[key];
+			}
+		}
 		return hostedTenantContext(this.env, {
 			id: row.tenantId, db: this.#db, publicUrl, ownerTokenHash: row.ownerTokenHash,
-			config: row.config, limits: row.limits, approval: row.approval, status: row.status,
+			config, limits: row.limits, approval: row.approval, status: row.status,
 		});
 	}
 
@@ -198,7 +215,7 @@ export class TenantStore extends DurableObject<WorkerBindings> {
 				await storage.deleteAlarm();
 				return;
 			}
-			const tenant = this.#tenant();
+			const tenant = await this.#tenant();
 			if (!tenant) return;
 			const at = await nextCronAt(tenant);
 			if (at == null || !Number.isFinite(at)) {
@@ -226,7 +243,7 @@ export class TenantStore extends DurableObject<WorkerBindings> {
 	}
 
 	async #runAlarm(): Promise<void> {
-		const tenant = this.#row?.status === "active" ? this.#tenant() : null;
+		const tenant = this.#row?.status === "active" ? await this.#tenant() : null;
 		if (tenant) {
 			try { await cronFlush(tenant, this.#ectx()); }
 			catch (e) { console.log(JSON.stringify({ ts: new Date().toISOString(), event: "alarm_failed", error: String(e).slice(0, 200) })); }
@@ -337,6 +354,27 @@ export class TenantStore extends DurableObject<WorkerBindings> {
 		return out;
 	}
 
+	/**
+	 * Control-plane owner call. The caller has already checked that `accountId` owns this tenant.
+	 * The path is an allowlist, the account id is logged, and a response that contains a peer token
+	 * or a decrypted secret is withheld. The network owner API is unchanged and still needs the owner token.
+	 * An object with no config row answers 404 and writes nothing.
+	 */
+	async owner(input: OwnerRpcRequest): Promise<OwnerRpcResult> {
+		if (!this.#row) {
+			const accountId = accountIdOf(input && typeof input === "object" ? (input as { accountId?: unknown }).accountId : undefined);
+			if (!accountId) {
+				console.log(JSON.stringify({ ts: new Date().toISOString(), event: "owner_rpc_refused", tenant: null, reason: "account" }));
+				return { status: 400, body: { error: "accountId is invalid" } };
+			}
+			console.log(JSON.stringify({ ts: new Date().toISOString(), event: "owner_rpc_refused", tenant: null, accountId, reason: "absent" }));
+			return { status: 404, body: { error: "no such agent" } };
+		}
+		const tenant = await this.#tenant();
+		if (!tenant) return { status: 404, body: { error: "no such agent" } };
+		return runOwnerRpc(tenant, this.#ectx(), input);
+	}
+
 	async fetch(req: Request): Promise<Response> {
 		const row = this.#row;
 		if (!row) return notFound();
@@ -346,7 +384,7 @@ export class TenantStore extends DurableObject<WorkerBindings> {
 			if (row.status === "deleting") return gone();
 			return notFound();
 		}
-		const tenant = this.#tenant(new URL(req.url).origin);
+		const tenant = await this.#tenant(new URL(req.url).origin);
 		if (!tenant) return notFound();
 		// Do not arm from the rows visible here. sendWake runs in waitUntil and, on 429/503, inserts the retry
 		// after this response returns. requeueWake arms in that insert. Arm again when those tasks finish so a

package/worker/src/index.ts

@@ -10,6 +10,7 @@ import { renderWake, redact, cloudflareErrorHint, defaultDebounceSeconds, defaul
 import { fetchCheckedWake } from "./wake-target.ts";
 import * as P from "./pairing.ts";
 import * as M from "./mcp.ts";
+import { accountIdOf, matchOwnerRpc, ownerResponseLeaks, type OwnerRpcRequest, type OwnerRpcResult } from "./owner-rpc.ts";
 import { resolveTenant, type TenantContext, type WorkerBindings } from "./tenancy.ts";
 import { exportRows, toSql } from "./export.ts";
 import { backupDatabase, DAILY_CRON } from "./backup.ts";
@@ -898,7 +899,8 @@ function ownerTaskView(t: Json): Json {
 }
 
 async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionContext, path: string, url: URL, trusted = false): Promise<Response> {
-	// trusted: an in-process call from an MCP tool (fixed, allowlisted paths; see ownerCall), never from the network
+	// trusted: an in-process call. MCP tools use ownerCall (paths fixed in the tool code). The hosted
+	// owner() RPC uses runOwnerRpc, which has its own allowlist. A request from the network is never trusted.
 	if (!trusted && !(await isOwner(ctx, req.headers.get("authorization")))) return json({ error: "unauthorized" }, 401);
 	const m = req.method;
 	const seg = path.split("/").filter(Boolean).slice(1); // after "owner"
@@ -2073,6 +2075,51 @@ async function mcpGrantOf(ctx: TenantContext, header: string | null): Promise<Js
 	return await ctx.DB.prepare("SELECT * FROM mcp_grants WHERE access_hash = ? AND revoked_at IS NULL AND access_expires_ms > ?").bind(await A.sha256(m[1]), Date.now()).first();
 }
 
+/**
+ * Hosted owner RPC. The control plane has already checked that `accountId` owns this tenant.
+ * Only an allowlisted path runs, and the response is withheld when it contains a peer token or a secret.
+ * Self-host (`mode` single) is refused here; its owner API stays the bearer check in `handleOwner`.
+ */
+export async function runOwnerRpc(ctx: TenantContext, ectx: ExecutionContext, input: OwnerRpcRequest): Promise<OwnerRpcResult> {
+	const raw = input && typeof input === "object" ? input as OwnerRpcRequest & { body?: unknown } : null;
+	const accountId = accountIdOf(raw?.accountId);
+	const tenant = ctx.id || null;
+	const refuse = (status: number, error: string, reason: string): OwnerRpcResult => {
+		log("owner_rpc_refused", { tenant, ...(accountId ? { accountId } : {}), reason });
+		return { status, body: { error } };
+	};
+	if (!accountId) return refuse(400, "accountId is invalid", "account");
+	if (ctx.mode !== "host") return refuse(404, "not found", "tenancy");
+	if (ctx.status !== "active") {
+		const status = ctx.status === "suspended" ? 403 : ctx.status === "deleting" ? 410 : 404;
+		const error = ctx.status === "suspended" ? "this agent is suspended" : ctx.status === "deleting" ? "this agent is gone" : "no such agent";
+		return refuse(status, error, "status");
+	}
+	const matched = matchOwnerRpc(raw?.method, raw?.path, raw?.query);
+	if (!matched.ok) return refuse(matched.reason === "query" ? 400 : 404, matched.reason === "query" ? "query is not allowed" : "not found", matched.reason);
+	if (raw?.body !== undefined && raw.body !== null) return refuse(400, "this call takes no body", "body");
+	let origin = "https://tenant.invalid";
+	try {
+		const u = new URL(ctx.PUBLIC_URL);
+		if (u.protocol === "https:" || u.protocol === "http:") origin = u.origin;
+	} catch { /* the handler reads the path, not this origin */ }
+	const url = new URL(origin + matched.route.path + matched.route.search);
+	const req = new Request(url, { method: matched.route.method, headers: { "content-type": "application/json" } });
+	let res: Response;
+	try { res = await handleOwner(req, ctx, ectx, url.pathname, url, true); }
+	catch (e: any) {
+		const status = e instanceof HttpError ? e.status : 400;
+		const error = String(e?.message || "bad request").slice(0, 200);
+		if (ownerResponseLeaks(error)) return refuse(500, "response withheld", "secret");
+		log("owner_rpc", { tenant, accountId, method: matched.route.method, route: matched.route.name, status });
+		return { status, body: { error } };
+	}
+	const data = await res.json().catch(() => null);
+	if (data === null || ownerResponseLeaks(data)) return refuse(500, "response withheld", "secret");
+	log("owner_rpc", { tenant, accountId, method: matched.route.method, route: matched.route.name, status: res.status });
+	return { status: res.status, body: data };
+}
+
 /** Call an owner API route in-process (MCP tools only; the paths are fixed in the tool code). */
 async function ownerCall(ctx: TenantContext, ectx: ExecutionContext, method: string, path: string, body?: Json): Promise<{ status: number; data: Json }> {
 	const url = new URL(ctx.PUBLIC_URL.replace(/\/$/, "") + path);

package/worker/src/owner-rpc.ts

@@ -0,0 +1,175 @@
+// Hosted owner RPC allowlist. The control plane calls TenantStore.owner() after it has checked that
+// the account owns the tenant. This list is the only paths that call may run, and it is stricter than
+// the owner HTTP API: routes that mint a peer token, return a setup secret, accept a plaintext peer
+// token, or dump credential material (export) are not here. Self-host never calls this.
+
+import { ID_RE } from "./a2a.ts";
+import { previewHeaderPlain } from "./wake.ts";
+
+/** Control-plane account id. Slashes and dots are refused so the value cannot be a path. */
+export const ACCOUNT_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
+
+const LABEL = /^[A-Za-z0-9_-]{1,32}$/;
+const MCP_LABEL = /^[A-Za-z0-9_-]{1,64}$/;
+const ALIAS = /^[A-Za-z0-9_.-]{1,64}$/;
+/** Display form WDJB-4827 or the stored form WDJB4827. Vowels and 0/1 are not in a real code. */
+const USER_CODE = /^[BCDFGHJKLMNPQRSTVWXZ]{4}-?[2-9]{4}$/i;
+
+const TOKEN_RE = /^(?:a2aow_|s2a_|a2amcp_|a2amcpr_)[A-Za-z0-9_-]{20,}$/;
+const SETUP_RE = /(?:\?|&)t=[A-Za-z0-9_-]{16,}/;
+const USERINFO_RE = /^[a-z][a-z0-9+.-]*:\/\/[^/?\s]*@/i;
+/** A non-empty string under one of these keys is a secret, even when it is not a token shape. */
+const SECRET_KEYS = new Set([
+	"token", "access_token", "refresh_token", "device_code",
+	"ownertoken", "owner_token", "secretsenc", "secrets_enc",
+	"clientsecret", "client_secret", "pushtoken", "push_token", "authorization",
+]);
+
+export interface OwnerRpcRequest {
+	accountId: string;
+	method: string;
+	path: string;
+	/** Allowlisted query parameters only. */
+	query?: Record<string, string>;
+	/** Refused. The owner HTTP API is where a body is accepted. */
+	body?: unknown;
+}
+
+export interface OwnerRpcResult {
+	status: number;
+	body: unknown;
+}
+
+export interface OwnerRoute {
+	method: "GET" | "POST" | "DELETE";
+	path: string;
+	search: string;
+	/** Log name. Ids and codes are not included. */
+	name: string;
+}
+
+export type OwnerMatch = { ok: true; route: OwnerRoute } | { ok: false; reason: "path" | "query" };
+
+export function accountIdOf(v: unknown): string | null {
+	return typeof v === "string" && ACCOUNT_ID_RE.test(v) ? v : null;
+}
+
+function segments(path: unknown): string[] | null {
+	if (typeof path !== "string" || path.length > 300 || !path.startsWith("/owner/")) return null;
+	if (path.includes("%") || path.includes("\\") || path.includes("?") || path.includes("#") || path.includes("//")) return null;
+	const seg = path.split("/").filter(Boolean);
+	if (seg[0] !== "owner" || seg.some((s) => s === "." || s === "..")) return null;
+	return seg;
+}
+
+function queryRecord(query: unknown): Record<string, string> | null {
+	if (query == null) return {};
+	if (typeof query !== "object" || Array.isArray(query)) return null;
+	const out: Record<string, string> = {};
+	for (const [k, v] of Object.entries(query)) {
+		if (typeof v !== "string" || v.length > 128) return null;
+		out[k] = v;
+	}
+	return out;
+}
+
+function idOk(s: string): boolean {
+	return ID_RE.test(s) && s !== "." && s !== "..";
+}
+
+function noQuery(q: Record<string, string>): string | null {
+	return Object.keys(q).length === 0 ? "" : null;
+}
+
+function inboxQuery(q: Record<string, string>): string | null {
+	for (const k of Object.keys(q)) if (k !== "context" && k !== "all") return null;
+	if (q.context !== undefined && !idOk(q.context)) return null;
+	if (q.all !== undefined && q.all !== "1") return null;
+	const sp = new URLSearchParams();
+	if (q.context) sp.set("context", q.context);
+	if (q.all) sp.set("all", "1");
+	const s = sp.toString();
+	return s ? `?${s}` : "";
+}
+
+function historyQuery(q: Record<string, string>): string | null {
+	for (const k of Object.keys(q)) if (k !== "n") return null;
+	if (q.n === undefined) return "";
+	if (!/^[1-9][0-9]{0,3}$/.test(q.n) || Number(q.n) > 1000) return null;
+	return `?n=${q.n}`;
+}
+
+interface RouteDef {
+	method: "GET" | "POST" | "DELETE";
+	name: string;
+	take: (seg: string[]) => boolean;
+	search: (q: Record<string, string>) => string | null;
+	path: (seg: string[]) => string;
+}
+
+const ROUTES: RouteDef[] = [
+	{ method: "GET", name: "GET /owner/inbox", take: (s) => s.length === 2 && s[1] === "inbox", search: inboxQuery, path: () => "/owner/inbox" },
+	{ method: "GET", name: "GET /owner/tasks/:id", take: (s) => s.length === 3 && s[1] === "tasks" && idOk(s[2]!), search: noQuery, path: (s) => `/owner/tasks/${s[2]}` },
+	{ method: "GET", name: "GET /owner/history/:id", take: (s) => s.length === 3 && s[1] === "history" && idOk(s[2]!), search: historyQuery, path: (s) => `/owner/history/${s[2]}` },
+	{ method: "GET", name: "GET /owner/outbound/:id", take: (s) => s.length === 3 && s[1] === "outbound" && idOk(s[2]!), search: noQuery, path: (s) => `/owner/outbound/${s[2]}` },
+	{ method: "GET", name: "GET /owner/peers", take: (s) => s.length === 2 && s[1] === "peers", search: noQuery, path: () => "/owner/peers" },
+	{ method: "DELETE", name: "DELETE /owner/peers/:label", take: (s) => s.length === 3 && s[1] === "peers" && LABEL.test(s[2]!), search: noQuery, path: (s) => `/owner/peers/${s[2]}` },
+	{ method: "GET", name: "GET /owner/pairing", take: (s) => s.length === 2 && s[1] === "pairing", search: noQuery, path: () => "/owner/pairing" },
+	{ method: "POST", name: "POST /owner/pairing/:code/approve", take: (s) => s.length === 4 && s[1] === "pairing" && USER_CODE.test(s[2]!) && s[3] === "approve", search: noQuery, path: (s) => `/owner/pairing/${s[2]}/approve` },
+	{ method: "POST", name: "POST /owner/pairing/:code/deny", take: (s) => s.length === 4 && s[1] === "pairing" && USER_CODE.test(s[2]!) && s[3] === "deny", search: noQuery, path: (s) => `/owner/pairing/${s[2]}/deny` },
+	{ method: "GET", name: "GET /owner/mcp", take: (s) => s.length === 2 && s[1] === "mcp", search: noQuery, path: () => "/owner/mcp" },
+	{ method: "DELETE", name: "DELETE /owner/mcp/:label", take: (s) => s.length === 3 && s[1] === "mcp" && MCP_LABEL.test(s[2]!), search: noQuery, path: (s) => `/owner/mcp/${s[2]}` },
+	{ method: "GET", name: "GET /owner/outbound-peers", take: (s) => s.length === 2 && s[1] === "outbound-peers", search: noQuery, path: () => "/owner/outbound-peers" },
+	{ method: "DELETE", name: "DELETE /owner/outbound-peers/:alias", take: (s) => s.length === 3 && s[1] === "outbound-peers" && ALIAS.test(s[2]!) && s[2] !== "." && s[2] !== "..", search: noQuery, path: (s) => `/owner/outbound-peers/${s[2]}` },
+	{ method: "GET", name: "GET /owner/facade", take: (s) => s.length === 2 && s[1] === "facade", search: noQuery, path: () => "/owner/facade" },
+	{ method: "POST", name: "POST /owner/facade/verify", take: (s) => s.length === 3 && s[1] === "facade" && s[2] === "verify", search: noQuery, path: () => "/owner/facade/verify" },
+	{ method: "GET", name: "GET /owner/wake/preview", take: (s) => s.length === 3 && s[1] === "wake" && s[2] === "preview", search: noQuery, path: () => "/owner/wake/preview" },
+	{ method: "POST", name: "POST /owner/wake/test", take: (s) => s.length === 3 && s[1] === "wake" && s[2] === "test", search: noQuery, path: () => "/owner/wake/test" },
+	{ method: "GET", name: "GET /owner/contexts", take: (s) => s.length === 2 && s[1] === "contexts", search: noQuery, path: () => "/owner/contexts" },
+];
+
+/** Method + path (+ query) on the owner RPC allowlist, or why it is not. */
+export function matchOwnerRpc(method: unknown, path: unknown, query: unknown): OwnerMatch {
+	if (method !== "GET" && method !== "POST" && method !== "DELETE") return { ok: false, reason: "path" };
+	const seg = segments(path);
+	if (!seg) return { ok: false, reason: "path" };
+	const def = ROUTES.find((r) => r.method === method && r.take(seg));
+	if (!def) return { ok: false, reason: "path" };
+	const q = queryRecord(query);
+	if (!q) return { ok: false, reason: "query" };
+	const search = def.search(q);
+	if (search === null) return { ok: false, reason: "query" };
+	return { ok: true, route: { method, path: def.path(seg), search, name: def.name } };
+}
+
+function stringLeaks(value: string, key: string | null): boolean {
+	if (TOKEN_RE.test(value) || SETUP_RE.test(value) || USERINFO_RE.test(value)) return true;
+	return key !== null && SECRET_KEYS.has(key.toLowerCase()) && value.length >= 16;
+}
+
+/** A rendered wake whose credential header was not masked. The header name is the caller's choice. */
+function wakePreviewLeaks(value: object): boolean {
+	const headers = (value as { method?: unknown; headers?: unknown }).headers;
+	if ((value as { method?: unknown }).method !== "POST" || !headers || typeof headers !== "object" || Array.isArray(headers)) return false;
+	for (const [k, v] of Object.entries(headers)) {
+		if (typeof v !== "string" || previewHeaderPlain(k) || v.endsWith("…")) continue;
+		return true;
+	}
+	return false;
+}
+
+/** True when a JSON value carries a peer token, a setup secret, a URL userinfo, or a secret field. */
+export function ownerResponseLeaks(value: unknown, depth = 0, key: string | null = null): boolean {
+	if (depth > 20) return true;
+	if (typeof value === "string") return stringLeaks(value, key);
+	if (typeof value === "number" || typeof value === "boolean" || value == null) return false;
+	if (Array.isArray(value)) return value.some((v) => ownerResponseLeaks(v, depth + 1, null));
+	if (typeof value === "object") {
+		if (wakePreviewLeaks(value)) return true;
+		for (const [k, v] of Object.entries(value)) {
+			if (ownerResponseLeaks(v, depth + 1, k)) return true;
+		}
+		return false;
+	}
+	return true;
+}

package/worker/src/pairing.ts

@@ -1,6 +1,7 @@
 // Device-flow pairing (OAuth 2.0 Device Authorization Grant, RFC 8628): pure helpers (Web Crypto only), so they run
 // in Workers and in Node's test runner. The HTTP handlers live in index.ts.
 import { isPrivateHost } from "./a2a.ts";
+import { pageStyle } from "./theme.ts";
 
 /** How every hint tells an agent to run the CLI: npx, latest release, no global install (agent sandboxes block global
  *  installs as untrusted code). WAKE_CLI_COMMAND overrides it for the owner's own wake hints only. */
@@ -223,17 +224,11 @@ export function devicePage(m: PageModel, nonce: string): string {
 	return pageShell(`Connect an agent to ${m.agentName}`, nonce, `${notice}${details}${form}${oidcForm}${ask}`);
 }
 
-const STYLE = `body{font:16px/1.5 system-ui,sans-serif;max-width:34rem;margin:2rem auto;padding:0 1rem;color:#111;background:#fafafa}
-h1{font-size:1.3rem}table{border-collapse:collapse;width:100%;margin:1rem 0}th,td{text-align:left;padding:.35rem .5rem;border-bottom:1px solid #ddd;vertical-align:top;word-break:break-all}th{width:40%;font-weight:600;word-break:normal}
-label{display:block;font-weight:600;margin:.8rem 0 .3rem}input{font:inherit;width:100%;box-sizing:border-box;padding:.5rem;border:1px solid #888;border-radius:4px}
-.b{display:flex;gap:.6rem;margin-top:1rem}button{font:inherit;padding:.5rem 1.2rem;border:0;border-radius:4px;background:#1a5fb4;color:#fff;cursor:pointer}button.d{background:#a51d2d}
-h2{font-size:1.05rem;margin-top:1.5rem}ul{padding-left:1.2rem}a{color:#1a5fb4}.n{padding:.6rem .8rem;border-radius:4px}.ok{background:#e6f4ea}.error{background:#fce8e6}.info{background:#e8f0fe}.w{font-size:.9rem;color:#444}code{background:#eee;padding:0 .2rem}`;
-
 /** The shared page frame: no scripts, no external assets, one nonce'd style block. `title` is escaped here. */
 export function pageShell(title: string, nonce: string, body: string): string {
 	return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="referrer" content="no-referrer">
 <title>${esc(title)}</title><style nonce="${nonce}">
-${STYLE}
+${pageStyle()}
 </style></head><body><h1>${esc(title)}</h1>${body}</body></html>`;
 }
 

package/worker/src/tenancy.ts

@@ -47,8 +47,9 @@ export type ConfigFields = { [K in ConfigKey]?: string };
 
 /**
  * Non-secret platform defaults a hosted tenant inherits when its pushed config omits them.
- * Wake secrets, upstream secrets and OWNER_TOKEN are never inherited: in hosted mode they come only from the
- * tenant overlay (or not at all). Decrypting `secrets_enc` into wake credentials is a follow-up.
+ * Wake secrets, upstream secrets and OWNER_TOKEN are never inherited. In hosted mode the secret wake
+ * fields come from decrypting `secrets_enc` (see the tenant object). A plaintext copy in the pushed
+ * config is used only when that ciphertext is absent.
  */
 const HOSTED_PLATFORM_DEFAULTS: readonly ConfigKey[] = ["MAX_BODY", "RATE_PER_MIN", "PBKDF2_ITERATIONS", "MCP", "PAIRING_APPROVAL"];
 

package/worker/src/theme.ts

@@ -0,0 +1,14 @@
+/**
+ * Neutral CSS for the inbox HTML pages (`/`, `/device`, `/device/setup`, MCP consent).
+ * It is inlined in one nonce'd `<style>` block. There is no external stylesheet.
+ * `WORKER_THEME` (a CSS file path) replaces this module at `cf build`. See `theme-build.mjs`.
+ */
+export const PAGE_STYLE = `body{font:16px/1.5 system-ui,sans-serif;max-width:34rem;margin:2rem auto;padding:0 1rem;color:#111;background:#fafafa}
+h1{font-size:1.3rem}table{border-collapse:collapse;width:100%;margin:1rem 0}th,td{text-align:left;padding:.35rem .5rem;border-bottom:1px solid #ddd;vertical-align:top;word-break:break-all}th{width:40%;font-weight:600;word-break:normal}
+label{display:block;font-weight:600;margin:.8rem 0 .3rem}input{font:inherit;width:100%;box-sizing:border-box;padding:.5rem;border:1px solid #888;border-radius:4px}
+.b{display:flex;gap:.6rem;margin-top:1rem}button{font:inherit;padding:.5rem 1.2rem;border:0;border-radius:4px;background:#1a5fb4;color:#fff;cursor:pointer}button.d{background:#a51d2d}
+h2{font-size:1.05rem;margin-top:1.5rem}ul{padding-left:1.2rem}a{color:#1a5fb4}.n{padding:.6rem .8rem;border-radius:4px}.ok{background:#e6f4ea}.error{background:#fce8e6}.info{background:#e8f0fe}.w{font-size:.9rem;color:#444}code{background:#eee;padding:0 .2rem}`;
+
+export function pageStyle(): string {
+	return PAGE_STYLE;
+}

package/worker/src/wake-secrets.ts

@@ -0,0 +1,113 @@
+// Wake secrets sealed for one hosted tenant. The control plane writes `secrets_enc`; the tenant
+// object decrypts it when it builds the tenant context. Self-host does not use this.
+// Keep control/src/tenants/wake-secrets.ts in step with this file.
+
+const INFO = "tenant-wake-secrets v1";
+const SALT = "a2a-exposed";
+
+/** Secret wake fields. Anything else in the blob is ignored. */
+export const WAKE_SECRET_KEYS = [
+	"WAKE_WEBHOOK_KEY",
+	"WAKE_HMAC_SECRET",
+	"WAKE_ACCESS_CLIENT_ID",
+	"WAKE_ACCESS_CLIENT_SECRET",
+] as const;
+
+export type WakeSecretKey = (typeof WAKE_SECRET_KEYS)[number];
+export type WakeSecrets = Partial<Record<WakeSecretKey, string>>;
+
+/** One secret. The form uses the same cap. */
+export const MAX_WAKE_VALUE = 4096;
+
+/**
+ * Largest JSON payload `sealWakeSecrets` will write. A character can become `\u0000` (six characters),
+ * and every known field may be present. `openWakeSecrets` accepts this and nothing larger.
+ */
+export const MAX_WAKE_PLAIN = (() => {
+	let n = 2;
+	for (let i = 0; i < WAKE_SECRET_KEYS.length; i++) {
+		if (i) n += 1;
+		n += WAKE_SECRET_KEYS[i].length + 5 + MAX_WAKE_VALUE * 6;
+	}
+	return n;
+})();
+
+/** `v1.` + base64(12-byte iv) + `.` + base64(utf-8 plaintext + 16-byte tag). */
+export const MAX_WAKE_SEALED = 3 + 16 + 1 + Math.ceil((MAX_WAKE_PLAIN * 3 + 16) * 4 / 3);
+
+function b64(bytes: Uint8Array): string {
+	let raw = "";
+	for (let i = 0; i < bytes.length; i += 0x8000) raw += String.fromCharCode(...bytes.subarray(i, i + 0x8000));
+	return btoa(raw);
+}
+const unb64 = (s: string) => Uint8Array.from(atob(s), (c) => c.charCodeAt(0));
+
+async function derive(ikm: string, tenantId: string): Promise<CryptoKey | null> {
+	if (!ikm || !tenantId) return null;
+	const base = await crypto.subtle.importKey("raw", new TextEncoder().encode(ikm), "HKDF", false, ["deriveKey"]);
+	return crypto.subtle.deriveKey(
+		{ name: "HKDF", hash: "SHA-256", salt: new TextEncoder().encode(SALT), info: new TextEncoder().encode(`${INFO}\0${tenantId}`) },
+		base, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"],
+	);
+}
+
+function payloadOf(secrets: WakeSecrets): Record<string, string> | null {
+	const payload: Record<string, string> = {};
+	for (const key of WAKE_SECRET_KEYS) {
+		const value = secrets[key];
+		if (value == null || value === "") continue;
+		if (typeof value !== "string" || value.length > MAX_WAKE_VALUE) return null;
+		payload[key] = value;
+	}
+	return payload;
+}
+
+/** `v1.<iv>.<ciphertext>`, or null when the key or a value is unusable. */
+export async function sealWakeSecrets(ikm: string, tenantId: string, secrets: WakeSecrets): Promise<string | null> {
+	const key = await derive(ikm, tenantId);
+	const payload = payloadOf(secrets);
+	if (!key || !payload) return null;
+	const json = JSON.stringify(payload);
+	const encoded = new TextEncoder().encode(json);
+	if (json.length > MAX_WAKE_PLAIN || encoded.length > MAX_WAKE_PLAIN * 3) return null;
+	const iv = crypto.getRandomValues(new Uint8Array(12));
+	const ct = new Uint8Array(await crypto.subtle.encrypt(
+		{ name: "AES-GCM", iv, additionalData: new TextEncoder().encode(tenantId) },
+		key,
+		encoded,
+	));
+	const sealed = `v1.${b64(iv)}.${b64(ct)}`;
+	return sealed.length <= MAX_WAKE_SEALED ? sealed : null;
+}
+
+/**
+ * The sealed fields, `{}` when there is nothing to open, or null when the blob cannot be read.
+ * A null result must not be treated as "no secrets": the caller keeps the previous ciphertext.
+ */
+export async function openWakeSecrets(ikm: string, tenantId: string, sealed: string | null | undefined): Promise<WakeSecrets | null> {
+	if (sealed == null || sealed === "") return {};
+	if (sealed.length > MAX_WAKE_SEALED) return null;
+	const key = await derive(ikm, tenantId);
+	if (!key) return null;
+	const [version, iv, ct, extra] = sealed.split(".");
+	if (version !== "v1" || !iv || !ct || extra !== undefined) return null;
+	try {
+		const plain = new TextDecoder().decode(await crypto.subtle.decrypt(
+			{ name: "AES-GCM", iv: unb64(iv), additionalData: new TextEncoder().encode(tenantId) },
+			key,
+			unb64(ct),
+		));
+		if (plain.length > MAX_WAKE_PLAIN) return null;
+		const parsed = JSON.parse(plain) as unknown;
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+		const out: WakeSecrets = {};
+		for (const name of WAKE_SECRET_KEYS) {
+			const value = (parsed as Record<string, unknown>)[name];
+			if (typeof value !== "string" || !value || value.length > MAX_WAKE_VALUE) continue;
+			out[name] = value;
+		}
+		return out;
+	} catch {
+		return null;
+	}
+}

package/worker/src/wake.ts

@@ -203,7 +203,11 @@ export async function renderWake(cfg: WakeConfig, ev: WakeEvent, opts: { nowMs?:
 			break;
 		case "generic":
 		default: {
-			if (cfg.key) headers[(cfg.keyHeader || "authorization").toLowerCase()] = (cfg.keyPrefix ?? "Bearer ") + cfg.key;
+			// A header the preview shows in full must not carry the key.
+			if (cfg.key) {
+				const requested = (cfg.keyHeader || "authorization").toLowerCase();
+				headers[previewHeaderPlain(requested) ? "authorization" : requested] = (cfg.keyPrefix ?? "Bearer ") + cfg.key;
+			}
 			headers["x-request-id"] = requestId;
 			body = cfg.bodyTemplate ? renderTemplate(cfg.bodyTemplate, ev, cli) : JSON.stringify(wakePayload(ev, cli));
 			if (cfg.hmacSecret) await hermesSign(headers, cfg.hmacSecret, body, nowMs);
@@ -243,11 +247,20 @@ export function cloudflareErrorHint(status: number, body: string): string {
 	return "";
 }
 
+/** Headers a wake preview may show in full. Every other header carries a credential, whatever its name. */
+export const PREVIEW_PLAIN_HEADERS = new Set([
+	"content-type", "user-agent", "x-request-id", "idempotency-key", "anthropic-version", "x-webhook-timestamp",
+]);
+
+export function previewHeaderPlain(name: string): boolean {
+	return PREVIEW_PLAIN_HEADERS.has(name.toLowerCase());
+}
+
 /** Copy of a rendered request with credentials masked (for previews/logs). */
 export function redact(req: WakeRequest): WakeRequest {
 	const h: Record<string, string> = {};
 	for (const [k, v] of Object.entries(req.headers))
-		h[k] = /authorization|key|token|secret|signature|access-client-id/i.test(k) && !/^idempotency-key$/i.test(k) ? v.replace(/(Bearer\s+)?(.{0,4}).*/s, "$1$2…") : v;
+		h[k] = previewHeaderPlain(k) ? v : v.replace(/(Bearer\s+)?(.{0,4}).*/s, "$1$2…");
 	let url = req.url;
 	try { const u = new URL(req.url); url = `${u.protocol}//${u.host}${u.pathname.replace(/\/[^/]{16,}/g, "/…")}`; } catch { /* keep */ }
 	return { ...req, url, headers: h };

package/worker/test/hosted.test.ts

@@ -9,6 +9,7 @@ import { fileURLToPath } from "node:url";
 import { Miniflare, convertV4MiniflareOptions } from "miniflare";
 import worker from "../src/index.ts";
 import { sha256 } from "../src/a2a.ts";
+import { sealWakeSecrets } from "../src/wake-secrets.ts";
 import { d1 } from "./d1.ts";
 
 const require = createRequire(new URL("../package.json", import.meta.url));
@@ -481,3 +482,132 @@ test("an apex issuer is fetched with that Host, and a control worker that does n
 	assert.equal(stalledPost.status, 502);
 	assert.match(await stalledPost.text(), /The identity provider could not be reached/);
 });
+
+test("TenantStore.owner runs an allowlisted owner call and does not return a peer token", async (t) => {
+	const mf = await start({
+		bindings: {
+			TENANCY: "host",
+			TENANT_DOMAIN: "example.com",
+			TENANT_SECRETS_KEY: "platform-secret",
+			OWNER_TOKEN: "platform-owner",
+		},
+		kvNamespaces: { TENANT_DIRECTORY: "tenants-owner-rpc" },
+		durableObjects: { TENANT_DO: { className: "TenantStore", useSQLite: true } },
+	});
+	t.after(() => mf.dispose());
+	await mf.ready;
+	const kv = await mf.getKVNamespace("TENANT_DIRECTORY");
+	const ns = await mf.getDurableObjectNamespace("TENANT_DO");
+	const hash = await sha256("owner-carol");
+	type OwnerStub = {
+		owner(input: { accountId: string; method: string; path: string; query?: Record<string, string>; body?: unknown }): Promise<{ status: number; body: unknown }>;
+		storageStatus(): Promise<{ configured: boolean; tables: string[] }>;
+		pushConfig(body: Record<string, unknown>): Promise<{ applied: boolean }>;
+	};
+	const lines: string[] = [];
+	const orig = console.log;
+	console.log = (...args: unknown[]) => {
+		lines.push(args.map((a) => String(a)).join(" "));
+		orig(...args);
+	};
+	t.after(() => { console.log = orig; });
+	// Workerd delivers console.log on a later turn. A busy runner (the storage-backend jobs) can
+	// return the RPC before that line is in this process.
+	const saw = async (part: string) => {
+		const start = Date.now();
+		while (!lines.some((l) => l.includes(part))) {
+			if (Date.now() - start > 2000) return false;
+			await new Promise((r) => setTimeout(r, 20));
+		}
+		return true;
+	};
+	const empty = ns.get(ns.idFromName("id-empty")) as unknown as OwnerStub;
+	const missing = await empty.owner({ accountId: "acct_carol", method: "GET", path: "/owner/peers" });
+	assert.equal(missing.status, 404);
+	const emptyStatus = await empty.storageStatus();
+	assert.equal(emptyStatus.configured, false);
+	assert.deepEqual(emptyStatus.tables, []);
+	assert.equal(await saw('"reason":"absent"'), true);
+
+	const stub = ns.get(ns.idFromName("id-carol")) as unknown as OwnerStub;
+	await stub.pushConfig({
+		version: 1, tenantId: "id-carol", name: "carol", status: "active", ownerTokenHash: hash,
+		approval: { issuer: "https://idp.example", clientId: "client-1", clientSecret: "tenant-secret-value", allowedSubjects: ["acct_carol"] },
+		config: { AGENT_NAME: "Carol" },
+	});
+	await kv.put("tenant:carol", JSON.stringify({ id: "id-carol", status: "active", region: "", version: 1 }));
+	const http = (method: string, path: string, auth: string, json?: unknown) => mf.dispatchFetch(`https://carol.example.com${path}`, {
+		method, headers: { authorization: auth, "content-type": "application/json" }, body: json === undefined ? undefined : JSON.stringify(json),
+	});
+	assert.equal((await http("POST", "/owner/peers", "Bearer platform-owner", { label: "nope" })).status, 401, "self-host owner token still does not unlock a tenant");
+	const issued = await (await http("POST", "/owner/peers", "Bearer owner-carol", { label: "ada" })).json() as { token?: string };
+	assert.match(issued.token ?? "", /^a2aow_/, "the owner HTTP API still returns the new token");
+
+	const listed = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/peers" });
+	assert.equal(listed.status, 200);
+	const peers = listed.body as { label: string; token?: string }[];
+	assert.deepEqual(peers.map((p) => p.label), ["ada"]);
+	assert.equal(JSON.stringify(listed.body).includes("a2aow_"), false);
+	assert.equal(await saw('"route":"GET /owner/peers"'), true);
+
+	const minted = await stub.owner({ accountId: "acct_carol", method: "POST", path: "/owner/peers", body: { label: "bob" } });
+	assert.equal(minted.status, 404);
+	assert.equal(JSON.stringify(minted.body).includes("a2aow_"), false);
+	const withBody = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/peers", body: { label: "bob" } });
+	assert.equal(withBody.status, 400);
+	const again = await stub.owner({ accountId: "acct_carol", method: "POST", path: "/owner/peers" });
+	assert.equal(again.status, 404);
+	const still = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/peers" });
+	assert.deepEqual((still.body as { label: string }[]).map((p) => p.label), ["ada"], "a refused call does not mint a token");
+
+	const setup = await stub.owner({ accountId: "acct_carol", method: "POST", path: "/owner/pairing/password-link" });
+	assert.equal(setup.status, 404);
+	const dumped = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/export" });
+	assert.equal(dumped.status, 404);
+	const oddQuery = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/inbox", query: { format: "sql" } });
+	assert.equal(oddQuery.status, 400);
+	const pairing = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/pairing" });
+	assert.equal(pairing.status, 200);
+	assert.equal(JSON.stringify(pairing.body).includes("tenant-secret-value"), false);
+	const preview = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/wake/preview" });
+	assert.equal(preview.status, 200);
+	assert.equal(JSON.stringify(preview.body).includes("platform-secret"), false);
+	assert.equal(JSON.stringify(preview.body).includes("tenant-secret-value"), false);
+
+	const wakeKey = "z9Qx-secret-value-0199";
+	const sealed = await sealWakeSecrets("platform-secret", "id-carol", { WAKE_WEBHOOK_KEY: wakeKey });
+	assert.ok(sealed);
+	assert.equal(sealed!.includes(wakeKey), false);
+	await stub.pushConfig({
+		version: 2, tenantId: "id-carol", name: "carol", status: "active", ownerTokenHash: hash,
+		secretsEnc: sealed,
+		config: {
+			AGENT_NAME: "Carol",
+			WAKE_WEBHOOK_URL: "https://hooks.example/wake",
+			WAKE_PRESET: "generic",
+			WAKE_KEY_HEADER: "X-Credential",
+			WAKE_WEBHOOK_KEY: "plaintext-key-should-not-appear",
+		},
+	});
+	const woken = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/wake/preview" });
+	assert.equal(woken.status, 200);
+	const wokenText = JSON.stringify(woken.body);
+	assert.equal(wokenText.includes(wakeKey), false);
+	assert.equal(wokenText.includes("plaintext-key-should-not-appear"), false);
+	assert.equal(wokenText.includes("platform-secret"), false);
+	const wokenBody = woken.body as { hasKey?: boolean; request?: { headers?: Record<string, string> } };
+	assert.equal(wokenBody.hasKey, true);
+	assert.equal(wokenBody.request?.headers?.["x-credential"], "Bearer z9Qx…");
+	const httpPreview = await (await http("GET", "/owner/wake/preview", "Bearer owner-carol")).json() as { hasKey?: boolean };
+	assert.equal(httpPreview.hasKey, true);
+	assert.equal(JSON.stringify(httpPreview).includes(wakeKey), false);
+
+	await stub.pushConfig({ version: 3, tenantId: "id-carol", name: "carol", status: "suspended", ownerTokenHash: hash, config: { AGENT_NAME: "Carol" } });
+	const suspended = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/peers" });
+	assert.equal(suspended.status, 403);
+	assert.equal(await saw('"reason":"status"'), true);
+	const badAccount = await stub.owner({ accountId: "../acct", method: "GET", path: "/owner/peers" });
+	assert.equal(badAccount.status, 400);
+	assert.equal(await saw('"reason":"account"'), true);
+	assert.equal(lines.some((l) => l.includes("../acct")), false);
+});

package/worker/test/owner-rpc.test.ts

@@ -0,0 +1,72 @@
+// Owner RPC allowlist and response filter. No Durable Object: the hosted test calls TenantStore.owner.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { accountIdOf, matchOwnerRpc, ownerResponseLeaks } from "../src/owner-rpc.ts";
+
+test("owner RPC allowlist is the management reads and the calls that do not return a secret", () => {
+	const ok = (method: string, path: string, query?: Record<string, string>) => {
+		const m = matchOwnerRpc(method, path, query);
+		assert.equal(m.ok, true, `${method} ${path}`);
+		return m.ok ? m.route : null;
+	};
+	assert.equal(ok("GET", "/owner/inbox")?.name, "GET /owner/inbox");
+	assert.equal(ok("GET", "/owner/inbox", { context: "ctx-1", all: "1" })?.search, "?context=ctx-1&all=1");
+	assert.equal(ok("GET", "/owner/tasks/task-1")?.path, "/owner/tasks/task-1");
+	assert.equal(ok("GET", "/owner/history/ctx-1", { n: "50" })?.search, "?n=50");
+	assert.equal(ok("GET", "/owner/outbound/task-1")?.name, "GET /owner/outbound/:id");
+	assert.equal(ok("GET", "/owner/peers")?.name, "GET /owner/peers");
+	assert.equal(ok("DELETE", "/owner/peers/ada")?.path, "/owner/peers/ada");
+	assert.equal(ok("GET", "/owner/pairing")?.name, "GET /owner/pairing");
+	assert.equal(ok("POST", "/owner/pairing/WDJB-4827/approve")?.name, "POST /owner/pairing/:code/approve");
+	assert.equal(ok("POST", "/owner/pairing/wdjb4827/deny")?.name, "POST /owner/pairing/:code/deny");
+	assert.equal(ok("GET", "/owner/mcp")?.name, "GET /owner/mcp");
+	assert.equal(ok("DELETE", "/owner/mcp/mcp-claude")?.path, "/owner/mcp/mcp-claude");
+	assert.equal(ok("GET", "/owner/outbound-peers")?.name, "GET /owner/outbound-peers");
+	assert.equal(ok("DELETE", "/owner/outbound-peers/ada.bot")?.path, "/owner/outbound-peers/ada.bot");
+	assert.equal(ok("GET", "/owner/facade")?.name, "GET /owner/facade");
+	assert.equal(ok("POST", "/owner/facade/verify")?.name, "POST /owner/facade/verify");
+	assert.equal(ok("GET", "/owner/wake/preview")?.name, "GET /owner/wake/preview");
+	assert.equal(ok("POST", "/owner/wake/test")?.name, "POST /owner/wake/test");
+	assert.equal(ok("GET", "/owner/contexts")?.name, "GET /owner/contexts");
+
+	const refused = (method: string, path: string, query?: Record<string, string>) => matchOwnerRpc(method, path, query);
+	assert.deepEqual(refused("POST", "/owner/peers"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("POST", "/owner/pairing/password-link"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("PUT", "/owner/pairing/password"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("PUT", "/owner/outbound-peers/ada"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("GET", "/owner/export"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("POST", "/owner/purge"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("POST", "/owner/tasks/task-1/reply"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("POST", "/owner/history"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("GET", "/owner/peers/../export"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("GET", "/owner/%2e%2e/peers"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("GET", "/owner/inbox?all=1"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("POST", "/owner/pairing/AEIO-4827/approve"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("GET", "/owner/inbox", { format: "sql" }), { ok: false, reason: "query" });
+	assert.deepEqual(refused("GET", "/owner/history/ctx-1", { n: "1001" }), { ok: false, reason: "query" });
+	assert.deepEqual(refused("GET", "/owner/history/.."), { ok: false, reason: "path" });
+	assert.equal(accountIdOf("acct_carol"), "acct_carol");
+	assert.equal(accountIdOf("../acct"), null);
+	assert.equal(accountIdOf(""), null);
+});
+
+test("owner RPC withholds peer tokens and decrypted secrets", () => {
+	const token = "a2aow_" + "a".repeat(43);
+	assert.equal(ownerResponseLeaks({ label: "ada", revoked_at: null }), false);
+	assert.equal(ownerResponseLeaks([{ text: "hello" }]), false);
+	assert.equal(ownerResponseLeaks({ token }), true);
+	assert.equal(ownerResponseLeaks({ nested: { access_token: "a2amcp_" + "b".repeat(30) } }), true);
+	assert.equal(ownerResponseLeaks({ url: "https://agent.example/device/setup?t=" + "c".repeat(20) }), true);
+	assert.equal(ownerResponseLeaks({ clientSecret: "tenant-secret-value" }), true);
+	assert.equal(ownerResponseLeaks({ secretsEnc: "v1.ciphertext-value" }), true);
+	assert.equal(ownerResponseLeaks("https://user:pass@hooks.example/wake"), true);
+	assert.equal(ownerResponseLeaks({ authorization: "Bearer abcd…" }), false);
+	assert.equal(ownerResponseLeaks({
+		request: { method: "POST", url: "https://hooks.example/wake", headers: { "x-credential": "supersecretvalue", "content-type": "application/json" }, body: "{}" },
+	}), true);
+	assert.equal(ownerResponseLeaks({
+		request: { method: "POST", url: "https://hooks.example/wake", headers: { "x-credential": "supe…", "content-type": "application/json", "x-request-id": "req-1" }, body: "{}" },
+	}), false);
+	assert.equal(ownerResponseLeaks({ fingerprints: { url: "0123456789ab", key: null } }), false);
+	assert.equal(ownerResponseLeaks({ token_hash: "ab".repeat(32) }), false);
+});

package/worker/test/pairing.test.ts

@@ -288,6 +288,25 @@ test("human approval: pending, slow_down, page approve with the password, single
 	assert.equal((await s.call("POST", "/", { json: { jsonrpc: "2.0", id: 1, method: "GetTask", params: { id: "x" } }, headers: { authorization: `Bearer ${p.data.access_token}` } })).status, 401);
 });
 
+test("a pairing label comes from the client name, a second one is suffixed, and inbox from uses it", async (t) => {
+	const s = setup({ PAIRING_APPROVAL: "agent" }); t.after(s.restore);
+	const first = (await s.start({ client_name: "tester-alpha", client_id: "other-alias" }, "203.0.113.40")).data;
+	const approved = await s.owner("POST", `/owner/pairing/${first.user_code}/approve`);
+	assert.equal(approved.data.label, "tester-alpha");
+	const token = (await s.poll(first.device_code)).data.access_token;
+	const sent = await s.call("POST", "/", {
+		json: { jsonrpc: "2.0", id: 1, method: "SendMessage", params: { message: { role: "ROLE_USER", parts: [{ text: "hello" }] } } },
+		headers: { authorization: `Bearer ${token}`, "a2a-version": "1.0" },
+	});
+	assert.equal(sent.status, 200, JSON.stringify(sent.data));
+	const inbox = await s.owner("GET", "/owner/inbox");
+	assert.equal(inbox.data.length, 1);
+	assert.equal(inbox.data[0].from, "tester-alpha");
+	assert.equal(inbox.data[0].text, "hello");
+	const second = (await s.start({ client_name: "tester-alpha", client_id: "another" }, "203.0.113.41")).data;
+	assert.equal((await s.owner("POST", `/owner/pairing/${second.user_code}/approve`)).data.label, "tester-alpha-2");
+});
+
 test("labels are deduplicated; denied and expired requests; JSON bodies; bad requests", async (t) => {
 	const s = setup({ PAIRING_APPROVAL: "agent" }); t.after(s.restore);
 	await s.owner("POST", "/owner/peers", { label: "barry" });

package/worker/test/theme.test.ts

@@ -0,0 +1,85 @@
+// Neutral inbox CSS, and the build-time WORKER_THEME check. Run: npm test
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { PAGE_STYLE, pageStyle } from "../src/theme.ts";
+import { pageShell } from "../src/pairing.ts";
+import { applyWorkerTheme, assertInlineCss, cssForChecks } from "../theme-build.mjs";
+
+test("the neutral theme is inlined once and loads nothing", () => {
+	assert.equal(pageStyle(), PAGE_STYLE);
+	assert.equal(PAGE_STYLE.includes("background:#fafafa"), true);
+	assert.equal(PAGE_STYLE.includes("background:#1a5fb4"), true);
+	assert.doesNotThrow(() => assertInlineCss(PAGE_STYLE));
+	const html = pageShell("Inbox", "nonce-1", "<p>Hello</p>");
+	assert.equal(html.includes(`<style nonce="nonce-1">\n${PAGE_STYLE}\n</style>`), true);
+	assert.equal((html.match(/<style/g) || []).length, 1);
+	assert.equal(/<link|<script|<img|url\s*\(|@import/i.test(html), false);
+});
+
+test("WORKER_THEME replaces the module only when the CSS stays inline", () => {
+	const dir = fs.mkdtempSync(path.join(os.tmpdir(), "inbox-theme-"));
+	const file = path.join(dir, "theme.css");
+	const css = "@media (max-width: 40rem) { body { background: #fff; color: \\23 222; } }";
+	fs.writeFileSync(file, css);
+	const next = applyWorkerTheme("/work/src/theme.ts", file);
+	assert.match(next || "", /export const PAGE_STYLE = /);
+	assert.match(next || "", /background: #fff/);
+	assert.match(next || "", /\\\\23 222/);
+	assert.equal(applyWorkerTheme("/work/src/theme.ts", undefined), null);
+	assert.equal(applyWorkerTheme("/work/src/index.ts", file), null);
+
+	for (const bad of [
+		"",
+		"body { background: url(https://example.com/a.png); }",
+		"@import 'other.css';",
+		"@font-face { font-family: x; }",
+		"body { background: red; } </style><script>",
+		"body { background: expression(alert(1)); }",
+		"a { color: javascript:alert(1); }",
+		"body{background:u\\72l(https://example.com/a.png)}",
+		"body{background:\\75\\72\\6c(https://example.com/a.png)}",
+		"body{background:u\\000072l(https://example.com/a.png)}",
+		"@\\69mport \"https://example.com/x.css\"",
+		"@\\69 mport \"https://example.com/x.css\"",
+		"@\\69\\6d\\70\\6f\\72\\74 \"https://example.com/x.css\"",
+		"body{background:url/*x*/(https://example.com/a.png)}",
+		"@font\\2d face { font-family: x; }",
+		"a{\"/*\";background:url(https://example.com/a.png);content:\"*/\"}",
+		"a{content:\"foo\\\"bar\";background:url(https://example.com/a.png)}",
+		"a{content:\"foo\\\nbar\";background:url(https://example.com/a.png)}",
+		"a{content:\"url(https://example.com/a.png)\nbackground:url(https://example.com/b.png)}",
+		"body{background-image:image-set(\"https://example.com/p.png\" 1x)}",
+		"body{background-image:image(\"https://example.com/p.png\")}",
+		"body{background-image:-webkit-image-set(\"https://example.com/p.png\" 1x)}",
+		"body{background-image:image-\\73 et(\"https://example.com/p.png\" 1x)}",
+		"body{background-image:\\69mage(\"https://example.com/p.png\")}",
+		"body{background-image:image-set/*x*/(\"https://example.com/p.png\" 1x)}",
+	]) {
+		fs.writeFileSync(file, bad);
+		assert.throws(() => applyWorkerTheme("/work/src/theme.ts", file), /WORKER_THEME was refused/);
+	}
+	for (const ok of [
+		"/* url(https://example.com/a.png) */ body { color: red }",
+		"a { content: \"url(https://example.com/a.png)\" }",
+		"a { content: \"foo\\\nurl(https://example.com/a.png)\" }",
+		"body { color: \\3c }",
+		"body { background-image: linear-gradient(#fff, #000); }",
+		"a { content: \"image-set(https://example.com/p.png)\" }",
+	]) {
+		fs.writeFileSync(file, ok);
+		assert.doesNotThrow(() => applyWorkerTheme("/work/src/theme.ts", file));
+	}
+	assert.throws(() => applyWorkerTheme("/work/src/theme.ts", path.join(dir, "missing.css")), /could not be read/);
+});
+
+test("the resource check decodes escapes and keeps strings and comments closed", () => {
+	assert.match(cssForChecks("u\\72l(https://example.com/a.png)"), /url\(https:\/\/example.com\/a.png\)/);
+	assert.match(cssForChecks("@\\69 mport \"x.css\""), /@import ""/);
+	assert.equal(/url\s*\(/i.test(cssForChecks("/* url(https://example.com/a.png) */ body{color:red}")), false);
+	assert.equal(/url\s*\(/i.test(cssForChecks("a{content:\"url(https://example.com/a.png)\"}")), false);
+	assert.match(cssForChecks("a{\"/*\";background:url(https://example.com/a.png)}"), /url\(https:\/\/example.com\/a.png\)/);
+	assert.match(cssForChecks("color:\\23 222"), /color:#222/);
+});

package/worker/test/wake-secrets.test.ts

@@ -0,0 +1,49 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { MAX_WAKE_SEALED, MAX_WAKE_VALUE, openWakeSecrets, sealWakeSecrets, WAKE_SECRET_KEYS } from "../src/wake-secrets.ts";
+
+const key = "platform-secret";
+const tenant = "ten_a";
+
+test("wake secrets round-trip for one tenant and stay unreadable for another", async () => {
+	const secrets = { WAKE_WEBHOOK_KEY: "z9Qx-secret-value-0199", WAKE_HMAC_SECRET: "hmac-value" };
+	const sealed = await sealWakeSecrets(key, tenant, secrets);
+	assert.ok(sealed);
+	assert.equal(sealed!.includes("z9Qx-secret-value-0199"), false);
+	assert.equal(sealed!.startsWith("v1."), true);
+	assert.deepEqual(await openWakeSecrets(key, tenant, sealed), secrets);
+	assert.equal(await openWakeSecrets(key, "ten_b", sealed), null);
+	assert.equal(await openWakeSecrets("other-key", tenant, sealed), null);
+	assert.equal(await openWakeSecrets("", tenant, sealed), null);
+	assert.deepEqual(await openWakeSecrets(key, tenant, null), {});
+	assert.equal(await openWakeSecrets(key, tenant, sealed + ".extra"), null);
+	assert.equal(await openWakeSecrets(key, tenant, "v1.not-base64.nope"), null);
+});
+
+test("a wake secret blob keeps only the known fields", async () => {
+	const sealed = await sealWakeSecrets(key, tenant, {
+		WAKE_WEBHOOK_KEY: "hook-key",
+		WAKE_ACCESS_CLIENT_SECRET: "access-secret",
+	});
+	const opened = await openWakeSecrets(key, tenant, sealed);
+	assert.deepEqual(opened, { WAKE_WEBHOOK_KEY: "hook-key", WAKE_ACCESS_CLIENT_SECRET: "access-secret" });
+	assert.equal(await sealWakeSecrets(key, tenant, { WAKE_WEBHOOK_KEY: "x".repeat(4097) }), null);
+});
+
+test("four maximum-length wake secrets round-trip", async () => {
+	const value = "x".repeat(MAX_WAKE_VALUE);
+	const secrets = Object.fromEntries(WAKE_SECRET_KEYS.map((name) => [name, value]));
+	const sealed = await sealWakeSecrets(key, tenant, secrets);
+	assert.ok(sealed);
+	assert.ok(sealed!.length > 16384);
+	assert.ok(sealed!.length <= MAX_WAKE_SEALED);
+	assert.deepEqual(await openWakeSecrets(key, tenant, sealed), secrets);
+	assert.equal(await openWakeSecrets(key, tenant, "v1." + "a".repeat(MAX_WAKE_SEALED)), null);
+
+	const escaped = "\u0000".repeat(MAX_WAKE_VALUE);
+	const worst = Object.fromEntries(WAKE_SECRET_KEYS.map((name) => [name, escaped]));
+	const sealedWorst = await sealWakeSecrets(key, tenant, worst);
+	assert.ok(sealedWorst);
+	assert.ok(sealedWorst!.length <= MAX_WAKE_SEALED);
+	assert.deepEqual(await openWakeSecrets(key, tenant, sealedWorst), worst);
+});

package/worker/test/wake.test.ts

@@ -116,6 +116,22 @@ test("generic custom key header is rendered with prefix and redacted in previews
 	assert.ok(!JSON.stringify(red).includes("supersecretvalue"));
 });
 
+test("a key header the preview shows in full is not used for the key", async () => {
+	const req = (await renderWake({ preset: "generic", url: "https://hooks.example.com/abc", key: "supersecretvalue", keyHeader: "Content-Type", keyPrefix: "" }, ev))!;
+	assert.equal(req.headers["authorization"], "supersecretvalue");
+	assert.equal(req.headers["content-type"], "application/json");
+	assert.equal(redact(req).headers["authorization"], "supe…");
+});
+
+test("generic key header is redacted even when its name is not a secret word", async () => {
+	const req = (await renderWake({ preset: "generic", url: "https://hooks.example.com/abc", key: "supersecretvalue", keyHeader: "X-Credential", keyPrefix: "" }, ev))!;
+	assert.equal(req.headers["x-credential"], "supersecretvalue");
+	const red = redact(req);
+	assert.equal(red.headers["x-credential"], "supe…");
+	assert.equal(red.headers["content-type"], "application/json");
+	assert.ok(!JSON.stringify(red).includes("supersecretvalue"));
+});
+
 // ---------------------------------------------------------------- Cloudflare Access service token (tunnel wakes)
 const ACCESS = { accessClientId: "abc123.access", accessClientSecret: "s3cr3t-value-0123456789" };
 

package/worker/theme-build.mjs

@@ -0,0 +1,162 @@
+// Build-time check for WORKER_THEME. The Worker inlines the result in a nonce'd style block and
+// does not load a stylesheet, font, or image. Unsafe CSS is refused so the build stops.
+import fs from "node:fs";
+import path from "node:path";
+
+const MAX = 16384;
+
+function isHex(char) {
+	return char !== undefined && ((char >= "0" && char <= "9") || (char >= "a" && char <= "f") || (char >= "A" && char <= "F"));
+}
+
+function isCssSpace(char) {
+	return char === " " || char === "\t" || char === "\n" || char === "\r" || char === "\f";
+}
+
+function isNewline(char) {
+	return char === "\n" || char === "\r" || char === "\f";
+}
+
+function consumeNewline(css, i) {
+	if (css[i] === "\r" && css[i + 1] === "\n") return i + 2;
+	return i + 1;
+}
+
+/**
+ * One CSS escape at a backslash. A backslash before a newline is not an escape (`newline`);
+ * the caller decides whether that pair continues a string or stays in the sheet.
+ * @param {string} css
+ * @param {number} i index of the backslash
+ */
+function consumeEscape(css, i) {
+	i++;
+	if (i >= css.length) return { type: "char", char: "\uFFFD", next: i };
+	if (isNewline(css[i])) return { type: "newline", next: i };
+	if (isHex(css[i])) {
+		let hex = "";
+		while (hex.length < 6 && i < css.length && isHex(css[i])) hex += css[i++];
+		if (i < css.length && isCssSpace(css[i])) i = isNewline(css[i]) ? consumeNewline(css, i) : i + 1;
+		const codePoint = Number.parseInt(hex, 16);
+		const surrogate = codePoint >= 0xd800 && codePoint <= 0xdfff;
+		const char = codePoint === 0 || surrogate || codePoint > 0x10ffff ? "\uFFFD" : String.fromCodePoint(codePoint);
+		return { type: "char", char, next: i };
+	}
+	return { type: "char", char: css[i], next: i + 1 };
+}
+
+/**
+ * Stylesheet text with escapes decoded, comments removed, and string contents removed.
+ * Markers are recognized on the raw text, so a string cannot pretend to be a comment,
+ * and a decoded character is not read again as a quote or a comment.
+ * @param {string} css
+ */
+export function cssForChecks(css) {
+	let out = "";
+	let i = 0;
+	/** @type {"normal" | "comment" | "string"} */
+	let mode = "normal";
+	let quote = "";
+	while (i < css.length) {
+		if (mode === "comment") {
+			if (css[i] === "*" && css[i + 1] === "/") {
+				mode = "normal";
+				i += 2;
+			} else i++;
+			continue;
+		}
+		if (mode === "string") {
+			if (css[i] === "\\") {
+				const esc = consumeEscape(css, i);
+				i = esc.type === "newline" ? consumeNewline(css, esc.next) : esc.next;
+				continue;
+			}
+			if (isNewline(css[i])) {
+				mode = "normal";
+				out += "\n";
+				i = consumeNewline(css, i);
+				continue;
+			}
+			if (css[i] === quote) {
+				mode = "normal";
+				out += quote;
+				i++;
+				continue;
+			}
+			i++;
+			continue;
+		}
+		if (css[i] === "/" && css[i + 1] === "*") {
+			out += " ";
+			mode = "comment";
+			i += 2;
+			continue;
+		}
+		if (css[i] === '"' || css[i] === "'") {
+			quote = css[i];
+			out += quote;
+			mode = "string";
+			i++;
+			continue;
+		}
+		if (css[i] === "\\") {
+			const esc = consumeEscape(css, i);
+			if (esc.type === "newline") {
+				out += "\\";
+				i = esc.next;
+				continue;
+			}
+			out += esc.char;
+			i = esc.next;
+			continue;
+		}
+		out += css[i++];
+	}
+	return out;
+}
+
+/** @param {string} css */
+export function assertInlineCss(css) {
+	if (typeof css !== "string") throw new Error("the theme is not text");
+	const text = css.replace(/^\uFEFF/, "");
+	if (!text.trim()) throw new Error("the theme is empty");
+	if (text.length > MAX) throw new Error("the theme is too long");
+	if (/[<>]/.test(text)) throw new Error("the theme has a tag");
+	const parsed = cssForChecks(text);
+	if (/@import\b/i.test(parsed)) throw new Error("the theme imports a stylesheet");
+	if (/@font-face\b/i.test(parsed)) throw new Error("the theme loads a font");
+	if (/url\s*\(/i.test(parsed)) throw new Error("the theme loads a url");
+	// image() and image-set() take a string as an image source, so the address never appears as url().
+	if (/\bimage-set\s*\(/i.test(parsed) || /\bimage\s*\(/i.test(parsed)) throw new Error("the theme loads an image");
+	if (/expression\s*\(/i.test(parsed) || /javascript\s*:/i.test(parsed)) throw new Error("the theme has a script");
+	if (/-moz-binding\s*:/i.test(parsed) || /behavior\s*:/i.test(parsed)) throw new Error("the theme has a binding");
+	return text;
+}
+
+/** Module source with the same exports as `src/theme.ts`. */
+export function themeModule(css) {
+	const safe = assertInlineCss(css);
+	return `export const PAGE_STYLE = ${JSON.stringify(safe)};\nexport function pageStyle(): string {\n\treturn PAGE_STYLE;\n}\n`;
+}
+
+/**
+ * Replacement for `src/theme.ts` when `file` is set. Null leaves the neutral module in place.
+ * @param {string} id
+ * @param {string | undefined} file
+ */
+export function applyWorkerTheme(id, file) {
+	if (!file) return null;
+	const clean = id.split("?")[0].replaceAll("\\", "/");
+	if (!clean.endsWith("/src/theme.ts")) return null;
+	let css;
+	try {
+		css = fs.readFileSync(path.resolve(file), "utf8");
+	} catch {
+		throw new Error("WORKER_THEME could not be read");
+	}
+	try {
+		return themeModule(css);
+	} catch (error) {
+		const reason = error instanceof Error ? error.message : "the theme was refused";
+		throw new Error(`WORKER_THEME was refused (${reason})`);
+	}
+}

package/worker/vite.config.ts

@@ -1,6 +1,17 @@
 import { cloudflare } from "@cloudflare/vite-plugin";
 import { defineConfig } from "vite";
+import { applyWorkerTheme } from "./theme-build.mjs";
 
 export default defineConfig({
-	plugins: [cloudflare()],
+	plugins: [
+		{
+			name: "inbox-theme",
+			enforce: "pre",
+			transform(_code, id) {
+				const next = applyWorkerTheme(id, process.env.WORKER_THEME);
+				return next ? { code: next, map: null } : null;
+			},
+		},
+		cloudflare(),
+	],
 });