a2a-exposed 0.7.11 → 0.7.12

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "a2a-exposed",
-	"version": "0.7.11",
+	"version": "0.7.12",
 	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: Cloudflare Worker inbox + wake webhook or scheduled inbox checks",
 	"type": "module",
 	"bin": {

package/worker/src/hosted.ts

@@ -13,13 +13,15 @@
 // Usage push is not in this change. Approval OIDC, when configured (self-host settings, or the pushed tenant
 // `approval` object), uses the same pages as self-host.
 import { DurableObject } from "cloudflare:workers";
-import worker, { cronFlush, dispatch, nextCronAt, onWakeWrite } from "./index.ts";
+import worker, { cronFlush, dispatch, nextCronAt, onWakeWrite, runOwnerRpc } from "./index.ts";
+import { accountIdOf, type OwnerRpcRequest, type OwnerRpcResult } from "./owner-rpc.ts";
 import { doSqlD1, migrateDo, type SqlStorageLike, type TxRunner } from "./storage.ts";
 import { MIGRATIONS } from "./migrations.ts";
 import { bookmarkForTime as readBookmark, exportRows, restoreBookmark as applyBookmark, restartAfterResult, toSql, ExportError, type BookmarkStorage } from "./export.ts";
 import { hostedDailyBackup } from "./backup.ts";
 import { lookupDirectory, pinDirectoryRegion, tenantNameFromHost, tenantRegion, TENANT_NAME, type DirectoryEntry } from "./directory.ts";
 import { hostedTenantContext, namespaceForRegion, parseGates, type WorkerBindings } from "./tenancy.ts";
+import { WAKE_SECRET_KEYS, openWakeSecrets } from "./wake-secrets.ts";
 
 export { clearDirectoryCache, directoryKey, lookupDirectory, parseDirectoryEntry, pinDirectoryRegion, tenantNameFromHost, tenantRegion, TENANT_NAME } from "./directory.ts";
 export type { DirectoryEntry };
@@ -32,7 +34,7 @@ const gone = () => Response.json({ error: "this agent is gone" }, { status: 410,
 
 const TENANT_ID = /^[A-Za-z0-9._:-]{1,128}$/;
 
-/** Versioned config pushed by the control plane. `secretsEnc` is stored and not decrypted here. */
+/** Versioned config pushed by the control plane. `secretsEnc` is decrypted into the wake credentials when the context is built. */
 export interface TenantConfigPush {
 	version: number;
 	tenantId: string;
@@ -151,14 +153,29 @@ export class TenantStore extends DurableObject<WorkerBindings> {
 		});
 	}
 
-	#tenant(fallbackOrigin = "") {
+	async #tenant(fallbackOrigin = "") {
 		const row = this.#row;
 		if (!row) return null;
-		const domain = parseGates(this.env).gates.tenantDomain;
+		const parsed = parseGates(this.env);
+		const domain = parsed.gates.tenantDomain;
 		const publicUrl = domain ? `https://${row.name}.${domain}` : (fallbackOrigin || this.env.PUBLIC_URL || "");
+		const config = { ...row.config };
+		// Once a ciphertext is stored, the secret wake fields come only from it. A plaintext copy in
+		// config_json is ignored, and a blob that cannot be opened leaves those fields unset.
+		if (row.secretsEnc) {
+			const opened = await openWakeSecrets(parsed.secretsKey || "", row.tenantId, row.secretsEnc);
+			if (!opened) {
+				console.log(JSON.stringify({ ts: new Date().toISOString(), event: "wake_secrets_unreadable", tenant: row.tenantId }));
+			}
+			for (const key of WAKE_SECRET_KEYS) {
+				const value = opened?.[key];
+				if (value) config[key] = value;
+				else delete config[key];
+			}
+		}
 		return hostedTenantContext(this.env, {
 			id: row.tenantId, db: this.#db, publicUrl, ownerTokenHash: row.ownerTokenHash,
-			config: row.config, limits: row.limits, approval: row.approval, status: row.status,
+			config, limits: row.limits, approval: row.approval, status: row.status,
 		});
 	}
 
@@ -198,7 +215,7 @@ export class TenantStore extends DurableObject<WorkerBindings> {
 				await storage.deleteAlarm();
 				return;
 			}
-			const tenant = this.#tenant();
+			const tenant = await this.#tenant();
 			if (!tenant) return;
 			const at = await nextCronAt(tenant);
 			if (at == null || !Number.isFinite(at)) {
@@ -226,7 +243,7 @@ export class TenantStore extends DurableObject<WorkerBindings> {
 	}
 
 	async #runAlarm(): Promise<void> {
-		const tenant = this.#row?.status === "active" ? this.#tenant() : null;
+		const tenant = this.#row?.status === "active" ? await this.#tenant() : null;
 		if (tenant) {
 			try { await cronFlush(tenant, this.#ectx()); }
 			catch (e) { console.log(JSON.stringify({ ts: new Date().toISOString(), event: "alarm_failed", error: String(e).slice(0, 200) })); }
@@ -337,6 +354,27 @@ export class TenantStore extends DurableObject<WorkerBindings> {
 		return out;
 	}
 
+	/**
+	 * Control-plane owner call. The caller has already checked that `accountId` owns this tenant.
+	 * The path is an allowlist, the account id is logged, and a response that contains a peer token
+	 * or a decrypted secret is withheld. The network owner API is unchanged and still needs the owner token.
+	 * An object with no config row answers 404 and writes nothing.
+	 */
+	async owner(input: OwnerRpcRequest): Promise<OwnerRpcResult> {
+		if (!this.#row) {
+			const accountId = accountIdOf(input && typeof input === "object" ? (input as { accountId?: unknown }).accountId : undefined);
+			if (!accountId) {
+				console.log(JSON.stringify({ ts: new Date().toISOString(), event: "owner_rpc_refused", tenant: null, reason: "account" }));
+				return { status: 400, body: { error: "accountId is invalid" } };
+			}
+			console.log(JSON.stringify({ ts: new Date().toISOString(), event: "owner_rpc_refused", tenant: null, accountId, reason: "absent" }));
+			return { status: 404, body: { error: "no such agent" } };
+		}
+		const tenant = await this.#tenant();
+		if (!tenant) return { status: 404, body: { error: "no such agent" } };
+		return runOwnerRpc(tenant, this.#ectx(), input);
+	}
+
 	async fetch(req: Request): Promise<Response> {
 		const row = this.#row;
 		if (!row) return notFound();
@@ -346,7 +384,7 @@ export class TenantStore extends DurableObject<WorkerBindings> {
 			if (row.status === "deleting") return gone();
 			return notFound();
 		}
-		const tenant = this.#tenant(new URL(req.url).origin);
+		const tenant = await this.#tenant(new URL(req.url).origin);
 		if (!tenant) return notFound();
 		// Do not arm from the rows visible here. sendWake runs in waitUntil and, on 429/503, inserts the retry
 		// after this response returns. requeueWake arms in that insert. Arm again when those tasks finish so a

package/worker/src/index.ts

@@ -10,6 +10,7 @@ import { renderWake, redact, cloudflareErrorHint, defaultDebounceSeconds, defaul
 import { fetchCheckedWake } from "./wake-target.ts";
 import * as P from "./pairing.ts";
 import * as M from "./mcp.ts";
+import { accountIdOf, matchOwnerRpc, ownerResponseLeaks, type OwnerRpcRequest, type OwnerRpcResult } from "./owner-rpc.ts";
 import { resolveTenant, type TenantContext, type WorkerBindings } from "./tenancy.ts";
 import { exportRows, toSql } from "./export.ts";
 import { backupDatabase, DAILY_CRON } from "./backup.ts";
@@ -898,7 +899,8 @@ function ownerTaskView(t: Json): Json {
 }
 
 async function handleOwner(req: Request, ctx: TenantContext, ectx: ExecutionContext, path: string, url: URL, trusted = false): Promise<Response> {
-	// trusted: an in-process call from an MCP tool (fixed, allowlisted paths; see ownerCall), never from the network
+	// trusted: an in-process call. MCP tools use ownerCall (paths fixed in the tool code). The hosted
+	// owner() RPC uses runOwnerRpc, which has its own allowlist. A request from the network is never trusted.
 	if (!trusted && !(await isOwner(ctx, req.headers.get("authorization")))) return json({ error: "unauthorized" }, 401);
 	const m = req.method;
 	const seg = path.split("/").filter(Boolean).slice(1); // after "owner"
@@ -2073,6 +2075,51 @@ async function mcpGrantOf(ctx: TenantContext, header: string | null): Promise<Js
 	return await ctx.DB.prepare("SELECT * FROM mcp_grants WHERE access_hash = ? AND revoked_at IS NULL AND access_expires_ms > ?").bind(await A.sha256(m[1]), Date.now()).first();
 }
 
+/**
+ * Hosted owner RPC. The control plane has already checked that `accountId` owns this tenant.
+ * Only an allowlisted path runs, and the response is withheld when it contains a peer token or a secret.
+ * Self-host (`mode` single) is refused here; its owner API stays the bearer check in `handleOwner`.
+ */
+export async function runOwnerRpc(ctx: TenantContext, ectx: ExecutionContext, input: OwnerRpcRequest): Promise<OwnerRpcResult> {
+	const raw = input && typeof input === "object" ? input as OwnerRpcRequest & { body?: unknown } : null;
+	const accountId = accountIdOf(raw?.accountId);
+	const tenant = ctx.id || null;
+	const refuse = (status: number, error: string, reason: string): OwnerRpcResult => {
+		log("owner_rpc_refused", { tenant, ...(accountId ? { accountId } : {}), reason });
+		return { status, body: { error } };
+	};
+	if (!accountId) return refuse(400, "accountId is invalid", "account");
+	if (ctx.mode !== "host") return refuse(404, "not found", "tenancy");
+	if (ctx.status !== "active") {
+		const status = ctx.status === "suspended" ? 403 : ctx.status === "deleting" ? 410 : 404;
+		const error = ctx.status === "suspended" ? "this agent is suspended" : ctx.status === "deleting" ? "this agent is gone" : "no such agent";
+		return refuse(status, error, "status");
+	}
+	const matched = matchOwnerRpc(raw?.method, raw?.path, raw?.query);
+	if (!matched.ok) return refuse(matched.reason === "query" ? 400 : 404, matched.reason === "query" ? "query is not allowed" : "not found", matched.reason);
+	if (raw?.body !== undefined && raw.body !== null) return refuse(400, "this call takes no body", "body");
+	let origin = "https://tenant.invalid";
+	try {
+		const u = new URL(ctx.PUBLIC_URL);
+		if (u.protocol === "https:" || u.protocol === "http:") origin = u.origin;
+	} catch { /* the handler reads the path, not this origin */ }
+	const url = new URL(origin + matched.route.path + matched.route.search);
+	const req = new Request(url, { method: matched.route.method, headers: { "content-type": "application/json" } });
+	let res: Response;
+	try { res = await handleOwner(req, ctx, ectx, url.pathname, url, true); }
+	catch (e: any) {
+		const status = e instanceof HttpError ? e.status : 400;
+		const error = String(e?.message || "bad request").slice(0, 200);
+		if (ownerResponseLeaks(error)) return refuse(500, "response withheld", "secret");
+		log("owner_rpc", { tenant, accountId, method: matched.route.method, route: matched.route.name, status });
+		return { status, body: { error } };
+	}
+	const data = await res.json().catch(() => null);
+	if (data === null || ownerResponseLeaks(data)) return refuse(500, "response withheld", "secret");
+	log("owner_rpc", { tenant, accountId, method: matched.route.method, route: matched.route.name, status: res.status });
+	return { status: res.status, body: data };
+}
+
 /** Call an owner API route in-process (MCP tools only; the paths are fixed in the tool code). */
 async function ownerCall(ctx: TenantContext, ectx: ExecutionContext, method: string, path: string, body?: Json): Promise<{ status: number; data: Json }> {
 	const url = new URL(ctx.PUBLIC_URL.replace(/\/$/, "") + path);

package/worker/src/owner-rpc.ts

@@ -0,0 +1,175 @@
+// Hosted owner RPC allowlist. The control plane calls TenantStore.owner() after it has checked that
+// the account owns the tenant. This list is the only paths that call may run, and it is stricter than
+// the owner HTTP API: routes that mint a peer token, return a setup secret, accept a plaintext peer
+// token, or dump credential material (export) are not here. Self-host never calls this.
+
+import { ID_RE } from "./a2a.ts";
+import { previewHeaderPlain } from "./wake.ts";
+
+/** Control-plane account id. Slashes and dots are refused so the value cannot be a path. */
+export const ACCOUNT_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
+
+const LABEL = /^[A-Za-z0-9_-]{1,32}$/;
+const MCP_LABEL = /^[A-Za-z0-9_-]{1,64}$/;
+const ALIAS = /^[A-Za-z0-9_.-]{1,64}$/;
+/** Display form WDJB-4827 or the stored form WDJB4827. Vowels and 0/1 are not in a real code. */
+const USER_CODE = /^[BCDFGHJKLMNPQRSTVWXZ]{4}-?[2-9]{4}$/i;
+
+const TOKEN_RE = /^(?:a2aow_|s2a_|a2amcp_|a2amcpr_)[A-Za-z0-9_-]{20,}$/;
+const SETUP_RE = /(?:\?|&)t=[A-Za-z0-9_-]{16,}/;
+const USERINFO_RE = /^[a-z][a-z0-9+.-]*:\/\/[^/?\s]*@/i;
+/** A non-empty string under one of these keys is a secret, even when it is not a token shape. */
+const SECRET_KEYS = new Set([
+	"token", "access_token", "refresh_token", "device_code",
+	"ownertoken", "owner_token", "secretsenc", "secrets_enc",
+	"clientsecret", "client_secret", "pushtoken", "push_token", "authorization",
+]);
+
+export interface OwnerRpcRequest {
+	accountId: string;
+	method: string;
+	path: string;
+	/** Allowlisted query parameters only. */
+	query?: Record<string, string>;
+	/** Refused. The owner HTTP API is where a body is accepted. */
+	body?: unknown;
+}
+
+export interface OwnerRpcResult {
+	status: number;
+	body: unknown;
+}
+
+export interface OwnerRoute {
+	method: "GET" | "POST" | "DELETE";
+	path: string;
+	search: string;
+	/** Log name. Ids and codes are not included. */
+	name: string;
+}
+
+export type OwnerMatch = { ok: true; route: OwnerRoute } | { ok: false; reason: "path" | "query" };
+
+export function accountIdOf(v: unknown): string | null {
+	return typeof v === "string" && ACCOUNT_ID_RE.test(v) ? v : null;
+}
+
+function segments(path: unknown): string[] | null {
+	if (typeof path !== "string" || path.length > 300 || !path.startsWith("/owner/")) return null;
+	if (path.includes("%") || path.includes("\\") || path.includes("?") || path.includes("#") || path.includes("//")) return null;
+	const seg = path.split("/").filter(Boolean);
+	if (seg[0] !== "owner" || seg.some((s) => s === "." || s === "..")) return null;
+	return seg;
+}
+
+function queryRecord(query: unknown): Record<string, string> | null {
+	if (query == null) return {};
+	if (typeof query !== "object" || Array.isArray(query)) return null;
+	const out: Record<string, string> = {};
+	for (const [k, v] of Object.entries(query)) {
+		if (typeof v !== "string" || v.length > 128) return null;
+		out[k] = v;
+	}
+	return out;
+}
+
+function idOk(s: string): boolean {
+	return ID_RE.test(s) && s !== "." && s !== "..";
+}
+
+function noQuery(q: Record<string, string>): string | null {
+	return Object.keys(q).length === 0 ? "" : null;
+}
+
+function inboxQuery(q: Record<string, string>): string | null {
+	for (const k of Object.keys(q)) if (k !== "context" && k !== "all") return null;
+	if (q.context !== undefined && !idOk(q.context)) return null;
+	if (q.all !== undefined && q.all !== "1") return null;
+	const sp = new URLSearchParams();
+	if (q.context) sp.set("context", q.context);
+	if (q.all) sp.set("all", "1");
+	const s = sp.toString();
+	return s ? `?${s}` : "";
+}
+
+function historyQuery(q: Record<string, string>): string | null {
+	for (const k of Object.keys(q)) if (k !== "n") return null;
+	if (q.n === undefined) return "";
+	if (!/^[1-9][0-9]{0,3}$/.test(q.n) || Number(q.n) > 1000) return null;
+	return `?n=${q.n}`;
+}
+
+interface RouteDef {
+	method: "GET" | "POST" | "DELETE";
+	name: string;
+	take: (seg: string[]) => boolean;
+	search: (q: Record<string, string>) => string | null;
+	path: (seg: string[]) => string;
+}
+
+const ROUTES: RouteDef[] = [
+	{ method: "GET", name: "GET /owner/inbox", take: (s) => s.length === 2 && s[1] === "inbox", search: inboxQuery, path: () => "/owner/inbox" },
+	{ method: "GET", name: "GET /owner/tasks/:id", take: (s) => s.length === 3 && s[1] === "tasks" && idOk(s[2]!), search: noQuery, path: (s) => `/owner/tasks/${s[2]}` },
+	{ method: "GET", name: "GET /owner/history/:id", take: (s) => s.length === 3 && s[1] === "history" && idOk(s[2]!), search: historyQuery, path: (s) => `/owner/history/${s[2]}` },
+	{ method: "GET", name: "GET /owner/outbound/:id", take: (s) => s.length === 3 && s[1] === "outbound" && idOk(s[2]!), search: noQuery, path: (s) => `/owner/outbound/${s[2]}` },
+	{ method: "GET", name: "GET /owner/peers", take: (s) => s.length === 2 && s[1] === "peers", search: noQuery, path: () => "/owner/peers" },
+	{ method: "DELETE", name: "DELETE /owner/peers/:label", take: (s) => s.length === 3 && s[1] === "peers" && LABEL.test(s[2]!), search: noQuery, path: (s) => `/owner/peers/${s[2]}` },
+	{ method: "GET", name: "GET /owner/pairing", take: (s) => s.length === 2 && s[1] === "pairing", search: noQuery, path: () => "/owner/pairing" },
+	{ method: "POST", name: "POST /owner/pairing/:code/approve", take: (s) => s.length === 4 && s[1] === "pairing" && USER_CODE.test(s[2]!) && s[3] === "approve", search: noQuery, path: (s) => `/owner/pairing/${s[2]}/approve` },
+	{ method: "POST", name: "POST /owner/pairing/:code/deny", take: (s) => s.length === 4 && s[1] === "pairing" && USER_CODE.test(s[2]!) && s[3] === "deny", search: noQuery, path: (s) => `/owner/pairing/${s[2]}/deny` },
+	{ method: "GET", name: "GET /owner/mcp", take: (s) => s.length === 2 && s[1] === "mcp", search: noQuery, path: () => "/owner/mcp" },
+	{ method: "DELETE", name: "DELETE /owner/mcp/:label", take: (s) => s.length === 3 && s[1] === "mcp" && MCP_LABEL.test(s[2]!), search: noQuery, path: (s) => `/owner/mcp/${s[2]}` },
+	{ method: "GET", name: "GET /owner/outbound-peers", take: (s) => s.length === 2 && s[1] === "outbound-peers", search: noQuery, path: () => "/owner/outbound-peers" },
+	{ method: "DELETE", name: "DELETE /owner/outbound-peers/:alias", take: (s) => s.length === 3 && s[1] === "outbound-peers" && ALIAS.test(s[2]!) && s[2] !== "." && s[2] !== "..", search: noQuery, path: (s) => `/owner/outbound-peers/${s[2]}` },
+	{ method: "GET", name: "GET /owner/facade", take: (s) => s.length === 2 && s[1] === "facade", search: noQuery, path: () => "/owner/facade" },
+	{ method: "POST", name: "POST /owner/facade/verify", take: (s) => s.length === 3 && s[1] === "facade" && s[2] === "verify", search: noQuery, path: () => "/owner/facade/verify" },
+	{ method: "GET", name: "GET /owner/wake/preview", take: (s) => s.length === 3 && s[1] === "wake" && s[2] === "preview", search: noQuery, path: () => "/owner/wake/preview" },
+	{ method: "POST", name: "POST /owner/wake/test", take: (s) => s.length === 3 && s[1] === "wake" && s[2] === "test", search: noQuery, path: () => "/owner/wake/test" },
+	{ method: "GET", name: "GET /owner/contexts", take: (s) => s.length === 2 && s[1] === "contexts", search: noQuery, path: () => "/owner/contexts" },
+];
+
+/** Method + path (+ query) on the owner RPC allowlist, or why it is not. */
+export function matchOwnerRpc(method: unknown, path: unknown, query: unknown): OwnerMatch {
+	if (method !== "GET" && method !== "POST" && method !== "DELETE") return { ok: false, reason: "path" };
+	const seg = segments(path);
+	if (!seg) return { ok: false, reason: "path" };
+	const def = ROUTES.find((r) => r.method === method && r.take(seg));
+	if (!def) return { ok: false, reason: "path" };
+	const q = queryRecord(query);
+	if (!q) return { ok: false, reason: "query" };
+	const search = def.search(q);
+	if (search === null) return { ok: false, reason: "query" };
+	return { ok: true, route: { method, path: def.path(seg), search, name: def.name } };
+}
+
+function stringLeaks(value: string, key: string | null): boolean {
+	if (TOKEN_RE.test(value) || SETUP_RE.test(value) || USERINFO_RE.test(value)) return true;
+	return key !== null && SECRET_KEYS.has(key.toLowerCase()) && value.length >= 16;
+}
+
+/** A rendered wake whose credential header was not masked. The header name is the caller's choice. */
+function wakePreviewLeaks(value: object): boolean {
+	const headers = (value as { method?: unknown; headers?: unknown }).headers;
+	if ((value as { method?: unknown }).method !== "POST" || !headers || typeof headers !== "object" || Array.isArray(headers)) return false;
+	for (const [k, v] of Object.entries(headers)) {
+		if (typeof v !== "string" || previewHeaderPlain(k) || v.endsWith("…")) continue;
+		return true;
+	}
+	return false;
+}
+
+/** True when a JSON value carries a peer token, a setup secret, a URL userinfo, or a secret field. */
+export function ownerResponseLeaks(value: unknown, depth = 0, key: string | null = null): boolean {
+	if (depth > 20) return true;
+	if (typeof value === "string") return stringLeaks(value, key);
+	if (typeof value === "number" || typeof value === "boolean" || value == null) return false;
+	if (Array.isArray(value)) return value.some((v) => ownerResponseLeaks(v, depth + 1, null));
+	if (typeof value === "object") {
+		if (wakePreviewLeaks(value)) return true;
+		for (const [k, v] of Object.entries(value)) {
+			if (ownerResponseLeaks(v, depth + 1, k)) return true;
+		}
+		return false;
+	}
+	return true;
+}

package/worker/src/tenancy.ts

@@ -47,8 +47,9 @@ export type ConfigFields = { [K in ConfigKey]?: string };
 
 /**
  * Non-secret platform defaults a hosted tenant inherits when its pushed config omits them.
- * Wake secrets, upstream secrets and OWNER_TOKEN are never inherited: in hosted mode they come only from the
- * tenant overlay (or not at all). Decrypting `secrets_enc` into wake credentials is a follow-up.
+ * Wake secrets, upstream secrets and OWNER_TOKEN are never inherited. In hosted mode the secret wake
+ * fields come from decrypting `secrets_enc` (see the tenant object). A plaintext copy in the pushed
+ * config is used only when that ciphertext is absent.
  */
 const HOSTED_PLATFORM_DEFAULTS: readonly ConfigKey[] = ["MAX_BODY", "RATE_PER_MIN", "PBKDF2_ITERATIONS", "MCP", "PAIRING_APPROVAL"];
 

package/worker/src/wake-secrets.ts

@@ -0,0 +1,113 @@
+// Wake secrets sealed for one hosted tenant. The control plane writes `secrets_enc`; the tenant
+// object decrypts it when it builds the tenant context. Self-host does not use this.
+// Keep control/src/tenants/wake-secrets.ts in step with this file.
+
+const INFO = "tenant-wake-secrets v1";
+const SALT = "a2a-exposed";
+
+/** Secret wake fields. Anything else in the blob is ignored. */
+export const WAKE_SECRET_KEYS = [
+	"WAKE_WEBHOOK_KEY",
+	"WAKE_HMAC_SECRET",
+	"WAKE_ACCESS_CLIENT_ID",
+	"WAKE_ACCESS_CLIENT_SECRET",
+] as const;
+
+export type WakeSecretKey = (typeof WAKE_SECRET_KEYS)[number];
+export type WakeSecrets = Partial<Record<WakeSecretKey, string>>;
+
+/** One secret. The form uses the same cap. */
+export const MAX_WAKE_VALUE = 4096;
+
+/**
+ * Largest JSON payload `sealWakeSecrets` will write. A character can become `\u0000` (six characters),
+ * and every known field may be present. `openWakeSecrets` accepts this and nothing larger.
+ */
+export const MAX_WAKE_PLAIN = (() => {
+	let n = 2;
+	for (let i = 0; i < WAKE_SECRET_KEYS.length; i++) {
+		if (i) n += 1;
+		n += WAKE_SECRET_KEYS[i].length + 5 + MAX_WAKE_VALUE * 6;
+	}
+	return n;
+})();
+
+/** `v1.` + base64(12-byte iv) + `.` + base64(utf-8 plaintext + 16-byte tag). */
+export const MAX_WAKE_SEALED = 3 + 16 + 1 + Math.ceil((MAX_WAKE_PLAIN * 3 + 16) * 4 / 3);
+
+function b64(bytes: Uint8Array): string {
+	let raw = "";
+	for (let i = 0; i < bytes.length; i += 0x8000) raw += String.fromCharCode(...bytes.subarray(i, i + 0x8000));
+	return btoa(raw);
+}
+const unb64 = (s: string) => Uint8Array.from(atob(s), (c) => c.charCodeAt(0));
+
+async function derive(ikm: string, tenantId: string): Promise<CryptoKey | null> {
+	if (!ikm || !tenantId) return null;
+	const base = await crypto.subtle.importKey("raw", new TextEncoder().encode(ikm), "HKDF", false, ["deriveKey"]);
+	return crypto.subtle.deriveKey(
+		{ name: "HKDF", hash: "SHA-256", salt: new TextEncoder().encode(SALT), info: new TextEncoder().encode(`${INFO}\0${tenantId}`) },
+		base, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"],
+	);
+}
+
+function payloadOf(secrets: WakeSecrets): Record<string, string> | null {
+	const payload: Record<string, string> = {};
+	for (const key of WAKE_SECRET_KEYS) {
+		const value = secrets[key];
+		if (value == null || value === "") continue;
+		if (typeof value !== "string" || value.length > MAX_WAKE_VALUE) return null;
+		payload[key] = value;
+	}
+	return payload;
+}
+
+/** `v1.<iv>.<ciphertext>`, or null when the key or a value is unusable. */
+export async function sealWakeSecrets(ikm: string, tenantId: string, secrets: WakeSecrets): Promise<string | null> {
+	const key = await derive(ikm, tenantId);
+	const payload = payloadOf(secrets);
+	if (!key || !payload) return null;
+	const json = JSON.stringify(payload);
+	const encoded = new TextEncoder().encode(json);
+	if (json.length > MAX_WAKE_PLAIN || encoded.length > MAX_WAKE_PLAIN * 3) return null;
+	const iv = crypto.getRandomValues(new Uint8Array(12));
+	const ct = new Uint8Array(await crypto.subtle.encrypt(
+		{ name: "AES-GCM", iv, additionalData: new TextEncoder().encode(tenantId) },
+		key,
+		encoded,
+	));
+	const sealed = `v1.${b64(iv)}.${b64(ct)}`;
+	return sealed.length <= MAX_WAKE_SEALED ? sealed : null;
+}
+
+/**
+ * The sealed fields, `{}` when there is nothing to open, or null when the blob cannot be read.
+ * A null result must not be treated as "no secrets": the caller keeps the previous ciphertext.
+ */
+export async function openWakeSecrets(ikm: string, tenantId: string, sealed: string | null | undefined): Promise<WakeSecrets | null> {
+	if (sealed == null || sealed === "") return {};
+	if (sealed.length > MAX_WAKE_SEALED) return null;
+	const key = await derive(ikm, tenantId);
+	if (!key) return null;
+	const [version, iv, ct, extra] = sealed.split(".");
+	if (version !== "v1" || !iv || !ct || extra !== undefined) return null;
+	try {
+		const plain = new TextDecoder().decode(await crypto.subtle.decrypt(
+			{ name: "AES-GCM", iv: unb64(iv), additionalData: new TextEncoder().encode(tenantId) },
+			key,
+			unb64(ct),
+		));
+		if (plain.length > MAX_WAKE_PLAIN) return null;
+		const parsed = JSON.parse(plain) as unknown;
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+		const out: WakeSecrets = {};
+		for (const name of WAKE_SECRET_KEYS) {
+			const value = (parsed as Record<string, unknown>)[name];
+			if (typeof value !== "string" || !value || value.length > MAX_WAKE_VALUE) continue;
+			out[name] = value;
+		}
+		return out;
+	} catch {
+		return null;
+	}
+}

package/worker/src/wake.ts

@@ -203,7 +203,11 @@ export async function renderWake(cfg: WakeConfig, ev: WakeEvent, opts: { nowMs?:
 			break;
 		case "generic":
 		default: {
-			if (cfg.key) headers[(cfg.keyHeader || "authorization").toLowerCase()] = (cfg.keyPrefix ?? "Bearer ") + cfg.key;
+			// A header the preview shows in full must not carry the key.
+			if (cfg.key) {
+				const requested = (cfg.keyHeader || "authorization").toLowerCase();
+				headers[previewHeaderPlain(requested) ? "authorization" : requested] = (cfg.keyPrefix ?? "Bearer ") + cfg.key;
+			}
 			headers["x-request-id"] = requestId;
 			body = cfg.bodyTemplate ? renderTemplate(cfg.bodyTemplate, ev, cli) : JSON.stringify(wakePayload(ev, cli));
 			if (cfg.hmacSecret) await hermesSign(headers, cfg.hmacSecret, body, nowMs);
@@ -243,11 +247,20 @@ export function cloudflareErrorHint(status: number, body: string): string {
 	return "";
 }
 
+/** Headers a wake preview may show in full. Every other header carries a credential, whatever its name. */
+export const PREVIEW_PLAIN_HEADERS = new Set([
+	"content-type", "user-agent", "x-request-id", "idempotency-key", "anthropic-version", "x-webhook-timestamp",
+]);
+
+export function previewHeaderPlain(name: string): boolean {
+	return PREVIEW_PLAIN_HEADERS.has(name.toLowerCase());
+}
+
 /** Copy of a rendered request with credentials masked (for previews/logs). */
 export function redact(req: WakeRequest): WakeRequest {
 	const h: Record<string, string> = {};
 	for (const [k, v] of Object.entries(req.headers))
-		h[k] = /authorization|key|token|secret|signature|access-client-id/i.test(k) && !/^idempotency-key$/i.test(k) ? v.replace(/(Bearer\s+)?(.{0,4}).*/s, "$1$2…") : v;
+		h[k] = previewHeaderPlain(k) ? v : v.replace(/(Bearer\s+)?(.{0,4}).*/s, "$1$2…");
 	let url = req.url;
 	try { const u = new URL(req.url); url = `${u.protocol}//${u.host}${u.pathname.replace(/\/[^/]{16,}/g, "/…")}`; } catch { /* keep */ }
 	return { ...req, url, headers: h };

package/worker/test/hosted.test.ts

@@ -9,6 +9,7 @@ import { fileURLToPath } from "node:url";
 import { Miniflare, convertV4MiniflareOptions } from "miniflare";
 import worker from "../src/index.ts";
 import { sha256 } from "../src/a2a.ts";
+import { sealWakeSecrets } from "../src/wake-secrets.ts";
 import { d1 } from "./d1.ts";
 
 const require = createRequire(new URL("../package.json", import.meta.url));
@@ -481,3 +482,132 @@ test("an apex issuer is fetched with that Host, and a control worker that does n
 	assert.equal(stalledPost.status, 502);
 	assert.match(await stalledPost.text(), /The identity provider could not be reached/);
 });
+
+test("TenantStore.owner runs an allowlisted owner call and does not return a peer token", async (t) => {
+	const mf = await start({
+		bindings: {
+			TENANCY: "host",
+			TENANT_DOMAIN: "example.com",
+			TENANT_SECRETS_KEY: "platform-secret",
+			OWNER_TOKEN: "platform-owner",
+		},
+		kvNamespaces: { TENANT_DIRECTORY: "tenants-owner-rpc" },
+		durableObjects: { TENANT_DO: { className: "TenantStore", useSQLite: true } },
+	});
+	t.after(() => mf.dispose());
+	await mf.ready;
+	const kv = await mf.getKVNamespace("TENANT_DIRECTORY");
+	const ns = await mf.getDurableObjectNamespace("TENANT_DO");
+	const hash = await sha256("owner-carol");
+	type OwnerStub = {
+		owner(input: { accountId: string; method: string; path: string; query?: Record<string, string>; body?: unknown }): Promise<{ status: number; body: unknown }>;
+		storageStatus(): Promise<{ configured: boolean; tables: string[] }>;
+		pushConfig(body: Record<string, unknown>): Promise<{ applied: boolean }>;
+	};
+	const lines: string[] = [];
+	const orig = console.log;
+	console.log = (...args: unknown[]) => {
+		lines.push(args.map((a) => String(a)).join(" "));
+		orig(...args);
+	};
+	t.after(() => { console.log = orig; });
+	// Workerd delivers console.log on a later turn. A busy runner (the storage-backend jobs) can
+	// return the RPC before that line is in this process.
+	const saw = async (part: string) => {
+		const start = Date.now();
+		while (!lines.some((l) => l.includes(part))) {
+			if (Date.now() - start > 2000) return false;
+			await new Promise((r) => setTimeout(r, 20));
+		}
+		return true;
+	};
+	const empty = ns.get(ns.idFromName("id-empty")) as unknown as OwnerStub;
+	const missing = await empty.owner({ accountId: "acct_carol", method: "GET", path: "/owner/peers" });
+	assert.equal(missing.status, 404);
+	const emptyStatus = await empty.storageStatus();
+	assert.equal(emptyStatus.configured, false);
+	assert.deepEqual(emptyStatus.tables, []);
+	assert.equal(await saw('"reason":"absent"'), true);
+
+	const stub = ns.get(ns.idFromName("id-carol")) as unknown as OwnerStub;
+	await stub.pushConfig({
+		version: 1, tenantId: "id-carol", name: "carol", status: "active", ownerTokenHash: hash,
+		approval: { issuer: "https://idp.example", clientId: "client-1", clientSecret: "tenant-secret-value", allowedSubjects: ["acct_carol"] },
+		config: { AGENT_NAME: "Carol" },
+	});
+	await kv.put("tenant:carol", JSON.stringify({ id: "id-carol", status: "active", region: "", version: 1 }));
+	const http = (method: string, path: string, auth: string, json?: unknown) => mf.dispatchFetch(`https://carol.example.com${path}`, {
+		method, headers: { authorization: auth, "content-type": "application/json" }, body: json === undefined ? undefined : JSON.stringify(json),
+	});
+	assert.equal((await http("POST", "/owner/peers", "Bearer platform-owner", { label: "nope" })).status, 401, "self-host owner token still does not unlock a tenant");
+	const issued = await (await http("POST", "/owner/peers", "Bearer owner-carol", { label: "ada" })).json() as { token?: string };
+	assert.match(issued.token ?? "", /^a2aow_/, "the owner HTTP API still returns the new token");
+
+	const listed = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/peers" });
+	assert.equal(listed.status, 200);
+	const peers = listed.body as { label: string; token?: string }[];
+	assert.deepEqual(peers.map((p) => p.label), ["ada"]);
+	assert.equal(JSON.stringify(listed.body).includes("a2aow_"), false);
+	assert.equal(await saw('"route":"GET /owner/peers"'), true);
+
+	const minted = await stub.owner({ accountId: "acct_carol", method: "POST", path: "/owner/peers", body: { label: "bob" } });
+	assert.equal(minted.status, 404);
+	assert.equal(JSON.stringify(minted.body).includes("a2aow_"), false);
+	const withBody = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/peers", body: { label: "bob" } });
+	assert.equal(withBody.status, 400);
+	const again = await stub.owner({ accountId: "acct_carol", method: "POST", path: "/owner/peers" });
+	assert.equal(again.status, 404);
+	const still = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/peers" });
+	assert.deepEqual((still.body as { label: string }[]).map((p) => p.label), ["ada"], "a refused call does not mint a token");
+
+	const setup = await stub.owner({ accountId: "acct_carol", method: "POST", path: "/owner/pairing/password-link" });
+	assert.equal(setup.status, 404);
+	const dumped = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/export" });
+	assert.equal(dumped.status, 404);
+	const oddQuery = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/inbox", query: { format: "sql" } });
+	assert.equal(oddQuery.status, 400);
+	const pairing = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/pairing" });
+	assert.equal(pairing.status, 200);
+	assert.equal(JSON.stringify(pairing.body).includes("tenant-secret-value"), false);
+	const preview = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/wake/preview" });
+	assert.equal(preview.status, 200);
+	assert.equal(JSON.stringify(preview.body).includes("platform-secret"), false);
+	assert.equal(JSON.stringify(preview.body).includes("tenant-secret-value"), false);
+
+	const wakeKey = "z9Qx-secret-value-0199";
+	const sealed = await sealWakeSecrets("platform-secret", "id-carol", { WAKE_WEBHOOK_KEY: wakeKey });
+	assert.ok(sealed);
+	assert.equal(sealed!.includes(wakeKey), false);
+	await stub.pushConfig({
+		version: 2, tenantId: "id-carol", name: "carol", status: "active", ownerTokenHash: hash,
+		secretsEnc: sealed,
+		config: {
+			AGENT_NAME: "Carol",
+			WAKE_WEBHOOK_URL: "https://hooks.example/wake",
+			WAKE_PRESET: "generic",
+			WAKE_KEY_HEADER: "X-Credential",
+			WAKE_WEBHOOK_KEY: "plaintext-key-should-not-appear",
+		},
+	});
+	const woken = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/wake/preview" });
+	assert.equal(woken.status, 200);
+	const wokenText = JSON.stringify(woken.body);
+	assert.equal(wokenText.includes(wakeKey), false);
+	assert.equal(wokenText.includes("plaintext-key-should-not-appear"), false);
+	assert.equal(wokenText.includes("platform-secret"), false);
+	const wokenBody = woken.body as { hasKey?: boolean; request?: { headers?: Record<string, string> } };
+	assert.equal(wokenBody.hasKey, true);
+	assert.equal(wokenBody.request?.headers?.["x-credential"], "Bearer z9Qx…");
+	const httpPreview = await (await http("GET", "/owner/wake/preview", "Bearer owner-carol")).json() as { hasKey?: boolean };
+	assert.equal(httpPreview.hasKey, true);
+	assert.equal(JSON.stringify(httpPreview).includes(wakeKey), false);
+
+	await stub.pushConfig({ version: 3, tenantId: "id-carol", name: "carol", status: "suspended", ownerTokenHash: hash, config: { AGENT_NAME: "Carol" } });
+	const suspended = await stub.owner({ accountId: "acct_carol", method: "GET", path: "/owner/peers" });
+	assert.equal(suspended.status, 403);
+	assert.equal(await saw('"reason":"status"'), true);
+	const badAccount = await stub.owner({ accountId: "../acct", method: "GET", path: "/owner/peers" });
+	assert.equal(badAccount.status, 400);
+	assert.equal(await saw('"reason":"account"'), true);
+	assert.equal(lines.some((l) => l.includes("../acct")), false);
+});

package/worker/test/owner-rpc.test.ts

@@ -0,0 +1,72 @@
+// Owner RPC allowlist and response filter. No Durable Object: the hosted test calls TenantStore.owner.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { accountIdOf, matchOwnerRpc, ownerResponseLeaks } from "../src/owner-rpc.ts";
+
+test("owner RPC allowlist is the management reads and the calls that do not return a secret", () => {
+	const ok = (method: string, path: string, query?: Record<string, string>) => {
+		const m = matchOwnerRpc(method, path, query);
+		assert.equal(m.ok, true, `${method} ${path}`);
+		return m.ok ? m.route : null;
+	};
+	assert.equal(ok("GET", "/owner/inbox")?.name, "GET /owner/inbox");
+	assert.equal(ok("GET", "/owner/inbox", { context: "ctx-1", all: "1" })?.search, "?context=ctx-1&all=1");
+	assert.equal(ok("GET", "/owner/tasks/task-1")?.path, "/owner/tasks/task-1");
+	assert.equal(ok("GET", "/owner/history/ctx-1", { n: "50" })?.search, "?n=50");
+	assert.equal(ok("GET", "/owner/outbound/task-1")?.name, "GET /owner/outbound/:id");
+	assert.equal(ok("GET", "/owner/peers")?.name, "GET /owner/peers");
+	assert.equal(ok("DELETE", "/owner/peers/ada")?.path, "/owner/peers/ada");
+	assert.equal(ok("GET", "/owner/pairing")?.name, "GET /owner/pairing");
+	assert.equal(ok("POST", "/owner/pairing/WDJB-4827/approve")?.name, "POST /owner/pairing/:code/approve");
+	assert.equal(ok("POST", "/owner/pairing/wdjb4827/deny")?.name, "POST /owner/pairing/:code/deny");
+	assert.equal(ok("GET", "/owner/mcp")?.name, "GET /owner/mcp");
+	assert.equal(ok("DELETE", "/owner/mcp/mcp-claude")?.path, "/owner/mcp/mcp-claude");
+	assert.equal(ok("GET", "/owner/outbound-peers")?.name, "GET /owner/outbound-peers");
+	assert.equal(ok("DELETE", "/owner/outbound-peers/ada.bot")?.path, "/owner/outbound-peers/ada.bot");
+	assert.equal(ok("GET", "/owner/facade")?.name, "GET /owner/facade");
+	assert.equal(ok("POST", "/owner/facade/verify")?.name, "POST /owner/facade/verify");
+	assert.equal(ok("GET", "/owner/wake/preview")?.name, "GET /owner/wake/preview");
+	assert.equal(ok("POST", "/owner/wake/test")?.name, "POST /owner/wake/test");
+	assert.equal(ok("GET", "/owner/contexts")?.name, "GET /owner/contexts");
+
+	const refused = (method: string, path: string, query?: Record<string, string>) => matchOwnerRpc(method, path, query);
+	assert.deepEqual(refused("POST", "/owner/peers"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("POST", "/owner/pairing/password-link"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("PUT", "/owner/pairing/password"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("PUT", "/owner/outbound-peers/ada"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("GET", "/owner/export"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("POST", "/owner/purge"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("POST", "/owner/tasks/task-1/reply"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("POST", "/owner/history"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("GET", "/owner/peers/../export"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("GET", "/owner/%2e%2e/peers"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("GET", "/owner/inbox?all=1"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("POST", "/owner/pairing/AEIO-4827/approve"), { ok: false, reason: "path" });
+	assert.deepEqual(refused("GET", "/owner/inbox", { format: "sql" }), { ok: false, reason: "query" });
+	assert.deepEqual(refused("GET", "/owner/history/ctx-1", { n: "1001" }), { ok: false, reason: "query" });
+	assert.deepEqual(refused("GET", "/owner/history/.."), { ok: false, reason: "path" });
+	assert.equal(accountIdOf("acct_carol"), "acct_carol");
+	assert.equal(accountIdOf("../acct"), null);
+	assert.equal(accountIdOf(""), null);
+});
+
+test("owner RPC withholds peer tokens and decrypted secrets", () => {
+	const token = "a2aow_" + "a".repeat(43);
+	assert.equal(ownerResponseLeaks({ label: "ada", revoked_at: null }), false);
+	assert.equal(ownerResponseLeaks([{ text: "hello" }]), false);
+	assert.equal(ownerResponseLeaks({ token }), true);
+	assert.equal(ownerResponseLeaks({ nested: { access_token: "a2amcp_" + "b".repeat(30) } }), true);
+	assert.equal(ownerResponseLeaks({ url: "https://agent.example/device/setup?t=" + "c".repeat(20) }), true);
+	assert.equal(ownerResponseLeaks({ clientSecret: "tenant-secret-value" }), true);
+	assert.equal(ownerResponseLeaks({ secretsEnc: "v1.ciphertext-value" }), true);
+	assert.equal(ownerResponseLeaks("https://user:pass@hooks.example/wake"), true);
+	assert.equal(ownerResponseLeaks({ authorization: "Bearer abcd…" }), false);
+	assert.equal(ownerResponseLeaks({
+		request: { method: "POST", url: "https://hooks.example/wake", headers: { "x-credential": "supersecretvalue", "content-type": "application/json" }, body: "{}" },
+	}), true);
+	assert.equal(ownerResponseLeaks({
+		request: { method: "POST", url: "https://hooks.example/wake", headers: { "x-credential": "supe…", "content-type": "application/json", "x-request-id": "req-1" }, body: "{}" },
+	}), false);
+	assert.equal(ownerResponseLeaks({ fingerprints: { url: "0123456789ab", key: null } }), false);
+	assert.equal(ownerResponseLeaks({ token_hash: "ab".repeat(32) }), false);
+});

package/worker/test/wake-secrets.test.ts

@@ -0,0 +1,49 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { MAX_WAKE_SEALED, MAX_WAKE_VALUE, openWakeSecrets, sealWakeSecrets, WAKE_SECRET_KEYS } from "../src/wake-secrets.ts";
+
+const key = "platform-secret";
+const tenant = "ten_a";
+
+test("wake secrets round-trip for one tenant and stay unreadable for another", async () => {
+	const secrets = { WAKE_WEBHOOK_KEY: "z9Qx-secret-value-0199", WAKE_HMAC_SECRET: "hmac-value" };
+	const sealed = await sealWakeSecrets(key, tenant, secrets);
+	assert.ok(sealed);
+	assert.equal(sealed!.includes("z9Qx-secret-value-0199"), false);
+	assert.equal(sealed!.startsWith("v1."), true);
+	assert.deepEqual(await openWakeSecrets(key, tenant, sealed), secrets);
+	assert.equal(await openWakeSecrets(key, "ten_b", sealed), null);
+	assert.equal(await openWakeSecrets("other-key", tenant, sealed), null);
+	assert.equal(await openWakeSecrets("", tenant, sealed), null);
+	assert.deepEqual(await openWakeSecrets(key, tenant, null), {});
+	assert.equal(await openWakeSecrets(key, tenant, sealed + ".extra"), null);
+	assert.equal(await openWakeSecrets(key, tenant, "v1.not-base64.nope"), null);
+});
+
+test("a wake secret blob keeps only the known fields", async () => {
+	const sealed = await sealWakeSecrets(key, tenant, {
+		WAKE_WEBHOOK_KEY: "hook-key",
+		WAKE_ACCESS_CLIENT_SECRET: "access-secret",
+	});
+	const opened = await openWakeSecrets(key, tenant, sealed);
+	assert.deepEqual(opened, { WAKE_WEBHOOK_KEY: "hook-key", WAKE_ACCESS_CLIENT_SECRET: "access-secret" });
+	assert.equal(await sealWakeSecrets(key, tenant, { WAKE_WEBHOOK_KEY: "x".repeat(4097) }), null);
+});
+
+test("four maximum-length wake secrets round-trip", async () => {
+	const value = "x".repeat(MAX_WAKE_VALUE);
+	const secrets = Object.fromEntries(WAKE_SECRET_KEYS.map((name) => [name, value]));
+	const sealed = await sealWakeSecrets(key, tenant, secrets);
+	assert.ok(sealed);
+	assert.ok(sealed!.length > 16384);
+	assert.ok(sealed!.length <= MAX_WAKE_SEALED);
+	assert.deepEqual(await openWakeSecrets(key, tenant, sealed), secrets);
+	assert.equal(await openWakeSecrets(key, tenant, "v1." + "a".repeat(MAX_WAKE_SEALED)), null);
+
+	const escaped = "\u0000".repeat(MAX_WAKE_VALUE);
+	const worst = Object.fromEntries(WAKE_SECRET_KEYS.map((name) => [name, escaped]));
+	const sealedWorst = await sealWakeSecrets(key, tenant, worst);
+	assert.ok(sealedWorst);
+	assert.ok(sealedWorst!.length <= MAX_WAKE_SEALED);
+	assert.deepEqual(await openWakeSecrets(key, tenant, sealedWorst), worst);
+});

package/worker/test/wake.test.ts

@@ -116,6 +116,22 @@ test("generic custom key header is rendered with prefix and redacted in previews
 	assert.ok(!JSON.stringify(red).includes("supersecretvalue"));
 });
 
+test("a key header the preview shows in full is not used for the key", async () => {
+	const req = (await renderWake({ preset: "generic", url: "https://hooks.example.com/abc", key: "supersecretvalue", keyHeader: "Content-Type", keyPrefix: "" }, ev))!;
+	assert.equal(req.headers["authorization"], "supersecretvalue");
+	assert.equal(req.headers["content-type"], "application/json");
+	assert.equal(redact(req).headers["authorization"], "supe…");
+});
+
+test("generic key header is redacted even when its name is not a secret word", async () => {
+	const req = (await renderWake({ preset: "generic", url: "https://hooks.example.com/abc", key: "supersecretvalue", keyHeader: "X-Credential", keyPrefix: "" }, ev))!;
+	assert.equal(req.headers["x-credential"], "supersecretvalue");
+	const red = redact(req);
+	assert.equal(red.headers["x-credential"], "supe…");
+	assert.equal(red.headers["content-type"], "application/json");
+	assert.ok(!JSON.stringify(red).includes("supersecretvalue"));
+});
+
 // ---------------------------------------------------------------- Cloudflare Access service token (tunnel wakes)
 const ACCESS = { accessClientId: "abc123.access", accessClientSecret: "s3cr3t-value-0123456789" };