a2a-exposed 0.7.34 → 0.8.0

package/lib/account.mjs

@@ -1,4 +1,4 @@
-// Control-plane sign-in (RFC 8628). The CLI is a public client (`a2a-cli`).
+// Device-flow sign-in (RFC 8628). The CLI is a public client (`a2a-cli`).
 // The session token is written to config.env and is never printed.
 import * as C from "./config.mjs";
 import { CLI, die } from "./a2a.mjs";
@@ -6,7 +6,7 @@ import { CLI, die } from "./a2a.mjs";
 export const CLI_CLIENT_ID = "a2a-cli";
 export const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 
-/** https origin with no userinfo, or "" when the value cannot be a control plane. */
+/** https origin with no userinfo, or "" when the value has a path, query, or userinfo. */
 export function controlOrigin(value) {
 	const raw = String(value || "").trim();
 	if (!raw) return "";

package/lib/feedback.mjs

@@ -1,4 +1,4 @@
-// Feedback: post to a hosted control plane when this inbox points at one, otherwise print a GitHub issue link.
+// Feedback: post when this inbox names a feedback URL, otherwise print a GitHub issue link.
 import os from "node:os";
 import readline from "node:readline/promises";
 import { CliError } from "./a2a.mjs";
@@ -29,7 +29,7 @@ export function scrubFeedbackText(value) {
 
 const REPO_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
 
-/** The repository that will receive the issue. The prefilled form is ISSUE_REPO. A hosted post uses the control plane's name. */
+/** The repository that will receive the issue. The prefilled form is ISSUE_REPO. A hosted post uses the name that URL returns. */
 export function publicIssueWarning(repo = ISSUE_REPO) {
 	const name = typeof repo === "string" && REPO_RE.test(repo) && repo.length <= 100 && !repo.includes("..") ? repo : ISSUE_REPO;
 	return `This report is filed as a public GitHub issue on ${name}. Do not include confidential information: secrets, tokens, owner or pairing tokens, private URLs or hostnames, message contents, or personal data.`;
@@ -233,7 +233,7 @@ export async function feedbackPublicRepo(input) {
 	}
 	const body = named && named.ok ? await readJson(named) : null;
 	const repo = namedRepo(body?.repo);
-	if (!repo) throw new CliError("the control plane did not name the public repository; feedback was not sent");
+	if (!repo) throw new CliError("the inbox did not name the public repository; feedback was not sent");
 	return repo;
 }
 

package/lib/main.mjs

@@ -172,41 +172,11 @@ Outbound (agents you call)
   poll --to <alias|url> <taskId> [--proto 0.3|1.0]
   outbound <taskId>       stored state of a task you sent (incl. pushed updates)
 
-Control plane account (the hosted dashboard is https://a2a.exposed)
-  signup --control-url https://control.example
-  login  --control-url https://control.example
-                                device-flow sign-in. Prints a code and a page. Type that code
-                                on the page; the link alone does not approve. The session is saved
-                                as CONTROL_TOKEN in config.env and is not printed. signup and login
-                                are the same flow; signup is how the first account is created.
-                                --json prints the control origin and email, not the token.
-                                A browser sign-in that does not complete returns to /app?error=<code>.
-                                The page allows each enabled provider origin in form-action, so the
-                                browser can follow the redirect. Buttons say Continue with that
-                                provider. Until the check finishes they stay muted and the page says
-                                Waiting for the check…. A reused token says The check expired. Please try again.
-                                After sign-in, /app shows the account and its agents. Each agent is listed
-                                by its hostname. A hosted name opens
-                                that agent's page: MCP connectors (revoke needs a recent sign-in), a
-                                message log of recent history. Opening this log leaves a pending wake in place until you list the inbox. The SQL download
-                                is a redacted copy and replaces a pasted owner token. Peer times are labeled UTC. A pairing
-                                token shows its code. An empty outbound list says peers added with the CLI
-                                on your machine stay in that CLI. Sign out is on that
-                                page. Creating an agent shows the owner token once. The agent page rotates
-                                that token after a confirmation and a recent sign-in. The new token is
-                                shown once on that agent's page. The previous one stops working immediately.
-                                The token is shown only when the stored hash is still that token. A Copy button sits next to it. Without JavaScript the value still copies.
-                                Deleting an agent asks for its name and a recent sign-in. The account page says how many hosted slots remain. A self-hosted inbox has no such delete.
-                                That page is not stored.
-                                FREE_AGENT_LIMIT=2 caps a free account at 2 hosted agents. A Cloudflare agent stays outside that count. An account's own limit overrides it.
-                                Unset, there is no limit. The database rejects another hosted insert.
-                                SIGNUP_ALLOWLIST, when set, admits only those verified emails. Unset, sign-in stays open.
-                                Sign-in uses GitHub, Google, or email. Connect Cloudflare from the account page after you sign in.
-                                A refusal returns to /app?error=invite and the page says Sign-in is invite-only for now.
-                                The control Worker logs social_sign_in_failed before the
-                                provider page, social_sign_in_timeout when that sign-in does not
-                                return, and oauth_callback_failed when the provider sends the browser
-                                back
+Owner
+  One inbox. The owner token from init authenticates inbox, reply, export, and the other owner
+  commands. GET / in a browser shows the agent card. /device approves or denies a pairing request.
+  pair set-password sets the approval password. pair set-oidc adds OpenID Connect on /device and
+  the MCP consent page when the issuer, client id, client secret, and allowlist are all set.
 
 Feedback
   feedback "message" [--kind bug|idea|other] [--contact x]
@@ -215,15 +185,15 @@ Feedback
             [--connection webhook|proxy|polling] [--yes]
                                 report a bug or an idea. A bug needs --steps.
                                 The report is a public GitHub issue. The warning names
-                                the repository before it sends. A hosted inbox uses the
-                                control plane's FEEDBACK_REPO. Otherwise the link opens
+                                the repository before it sends. A hosted inbox names
+                                that repository. Otherwise the link opens
                                 the form on telegraphic-dev/a2a-exposed. Do not include
                                 confidential information: secrets, tokens, owner or pairing
                                 tokens, private URLs or hostnames, message contents, or
                                 personal data. Prints that warning and asks before sending,
                                 unless --yes is set. Off a terminal, --yes is required.
-                                Posts to the control plane when this inbox is hosted and that
-                                plane accepts feedback. Otherwise prints a link to the bug
+                                Posts when this inbox names a feedback URL.
+                                Otherwise prints a link to the bug
                                 report form and does not open a browser. The CLI adds its
                                 version, the inbox Worker version when the inbox reports it,
                                 the OS, the Node version, the connection (webhook, proxy, or

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "a2a-exposed",
-	"version": "0.7.34",
+	"version": "0.8.0",
 	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: Cloudflare Worker inbox + wake webhook or scheduled inbox checks",
 	"type": "module",
 	"bin": {

package/worker/cloudflare.config.ts

@@ -46,10 +46,7 @@ const plain: Record<string, string> = {
 	// Access (never a Tailnet / LAN URL: the Worker can't reach those, and they never appear in the public card)
 	UPSTREAM_URL: v("A2A_UPSTREAM_URL"),
 	UPSTREAM_CARD_URL: v("A2A_UPSTREAM_CARD_URL"), // default <upstream origin>/.well-known/agent-card.json
-	// Hosted multi-tenant gates. All empty by default, and empty is omitted, so a self-host deploy is unchanged.
-	// TENANCY=host switches the entrypoint to src/hosted.ts and adds TENANT_DO + TENANT_DIRECTORY below.
-	// QUOTAS, USAGE_SINK, SIGNUP_URL and BRANDING are parsed and reserved.
-	// FEEDBACK_URL is an https origin. Only a hosted tenant posts feedback there. Unset on a self-hosted inbox.
+	// Optional gates. Empty values are omitted, so a deploy of one inbox is unchanged.
 	// WAKE_TARGET_POLICY=public-https refuses a wake that is not public https. The socket opens to an address from that check, and TLS names the hostname (see wake-target.ts).
 	// APPROVAL_OIDC_* turn on OpenID Connect approval when issuer, client id, secret and allowlist are all set.
 	TENANCY: v("TENANCY"),
@@ -78,8 +75,8 @@ if (hosted) {
 	envBindings.TENANT_DO = bindings.durableObject({ worker: name, exportName: "TenantStore" });
 	envBindings.TENANT_DIRECTORY = bindings.kv();
 }
-// Optional service binding to the control Worker. Unset: OpenID Connect keeps using fetch, which is
-// what a self-host deploy needs for an external issuer. Set A2A_CONTROL_SERVICE to that Worker's name
+// Optional service binding for OpenID Connect discovery, token, and JWKS when the issuer shares
+// the tenant zone. Unset: those calls use fetch. Set A2A_CONTROL_SERVICE to the issuer Worker's name
 // so a tenant on the same zone does not fetch the issuer through the public route.
 const controlService = v("A2A_CONTROL_SERVICE");
 if (controlService) envBindings.CONTROL_SERVICE = bindings.worker({ worker: controlService });

package/worker/deploy.env.example

@@ -32,26 +32,10 @@ WAKE_PRESET=generic
 # UPSTREAM_ACCESS_CLIENT_ID / UPSTREAM_ACCESS_CLIENT_SECRET) go in a separate chmod-600
 # file passed with `cf deploy --secrets-file <file>`; never commit them.
 #
-# Optional multi-tenant gates. Leave them unset for a self-hosted inbox (`npx -y a2a-exposed@latest init`
-# never sets them). Unset means today's single-tenant Worker on D1, and the build does not export a Durable Object.
-# TENANCY=host switches the entry to the multi-tenant router and adds the TENANT_DO and TENANT_DIRECTORY bindings.
-# QUOTAS, USAGE_SINK, SIGNUP_URL and BRANDING are reserved (parsed, not enforced yet).
-# WAKE_TARGET_POLICY=public-https is enforced: a wake must be https to a public address. The Worker
+# WAKE_TARGET_POLICY=public-https requires a wake to be https to a public address. The Worker
 # connects to an address from that check. A redirect is followed only on the same origin. Leave it
 # unset for a self-hosted inbox.
-# Do not set TENANCY for a self-hosted inbox.
-# TENANCY=
-# TENANT_DOMAIN=example.com
-# DATA_REGION=eu
-# Written onto a directory entry the first time that entry has no region. After that the stored region places the tenant.
-# QUOTAS=on
-# USAGE_SINK=d1
 # WAKE_TARGET_POLICY=public-https
-# SIGNUP_URL=https://example.com
-# BRANDING=hosted
-# https origin, no path. Only a hosted tenant (TENANCY=host) posts feedback there.
-# A self-hosted inbox ignores it and the CLI prints a GitHub issue link instead.
-# FEEDBACK_URL=https://control.example.com
 # OpenID Connect approval (optional). All four of issuer, client id, allowlist and the client secret
 # must be set or the pages stay password-only. APPROVAL_METHODS=oidc hides the password once that
 # config is complete; APPROVAL_METHODS=password keeps the password even if an issuer is set.
@@ -59,11 +43,7 @@ WAKE_PRESET=generic
 # APPROVAL_OIDC_CLIENT_ID=
 # APPROVAL_OIDC_ALLOWED_SUBJECTS=
 # APPROVAL_METHODS=password
-# Secrets (same secrets file, never here): APPROVAL_OIDC_CLIENT_SECRET, and for a hosted deploy TENANT_SECRETS_KEY.
-# Hosted approval uses the tenant's pushed approval object, not these Worker settings.
-# When that issuer is on the same zone as the tenant host, set this to the control Worker's name.
-# Discovery, token and JWKS then use the CONTROL_SERVICE binding. Unset: those calls use fetch.
-# A2A_CONTROL_SERVICE=a2a-exposed-control
+# Secrets (same secrets file, never here): APPROVAL_OIDC_CLIENT_SECRET.
 # Daily SQL snapshots to R2. Unset: no BACKUP_BUCKET binding and no extra cron. The minute wake cron stays A2A_ENABLE_CRON.
 # A2A_BACKUP_BUCKET=1
 # A2A_BACKUP_BUCKET_NAME=a2a-exposed-backups

package/worker/src/approval-oidc.ts

@@ -174,9 +174,9 @@ async function takeBody(res: Response, signal: AbortSignal, max: number): Promis
 
 /**
  * Discovery, token and JWKS for an issuer on this tenant's zone go through CONTROL_SERVICE.
- * A public fetch of that zone can miss the control Worker (wildcard route, 522, or the site Worker).
+ * A public fetch of that zone can miss the issuer (wildcard route, 522, or another Worker on the zone).
  * Any other issuer, and a deploy with the binding unset, uses fetch.
- * The binding request sets Host to the issuer host. Without that header the control Worker on the
+ * The binding request sets Host to the issuer host. Without that header an issuer on the
  * zone apex sees no Host, and the subrequest does not finish. Every call, binding or fetch, stops
  * after FETCH_MS and the page says the provider could not be reached.
  */
@@ -209,7 +209,7 @@ function publicFetch(url: string, init: RequestInit, signal: AbortSignal): Promi
 async function bindingFetch(binding: NonNullable<ReturnType<TenantContext["controlService"]>>, url: string, init: RequestInit, signal: AbortSignal): Promise<Response> {
 	const headers = new Headers(init.headers);
 	// `new Request(url)` does not keep Host across a service binding. The apex issuer is then
-	// a request with no Host, which does not match the control Worker's route or ISSUER, and the
+	// a request with no Host, which does not match the issuer route or ISSUER, and the
 	// subrequest never completes. Set Host to the URL host. `redirect` and `signal` stay off the
 	// Request (they do not cross the binding). `signal` is passed to fetch so the runtime cancels it.
 	headers.set("host", new URL(url).host);

package/worker/src/feedback.ts

@@ -1,4 +1,4 @@
-// Feedback from an owner-only MCP tool. A hosted tenant posts to the control plane.
+// Feedback from an owner-only MCP tool. When a feedback URL is set, the owner posts there.
 // Any other deploy returns a prefilled GitHub issue URL and does not call out.
 import { reachesControl } from "./approval-oidc.ts";
 import { scrubSecretText } from "./export.ts";
@@ -247,7 +247,7 @@ async function postFeedback(ctx: TenantContext, endpoint: string, body: string,
 }
 
 /**
- * File the note when this tenant is hosted and the control plane accepts it.
+ * File the note when this tenant is hosted and the feedback URL accepts it.
  * No endpoint, or a 404, returns the prefilled issue URL and does not throw.
  * Anything else throws a short error with none of the message.
  */

package/worker/src/hosted.ts

@@ -1,17 +1,16 @@
-// Hosted entrypoint. Used only when the deploy sets TENANCY=host (see cloudflare.config.ts).
+// Optional entrypoint. Used only when the deploy sets TENANCY=host (see cloudflare.config.ts).
 // With that set and a TENANT_DO binding, `<name>.<TENANT_DOMAIN>` is looked up in the KV directory and forwarded
-// to that tenant's SQLite Durable Object. The object runs the same inbox as self-host (`dispatch` in index.ts)
-// against its own database. Anything else — TENANCY unset, or no TENANT_DO binding — calls the self-host fetch
+// to that name's SQLite Durable Object. The object runs the same inbox as a single deploy (`dispatch` in index.ts)
+// against its own database. Anything else — TENANCY unset, or no TENANT_DO binding — calls the single-inbox fetch
 // handler on env.DB.
 //
-// Tenant config is a versioned row pushed into the object (`pushConfig`). It does not travel on the request.
+// Config is a versioned row pushed into the object (`pushConfig`). It does not travel on the request.
 // An object with no row answers 404 and does not create application tables.
 //
-// Hosted wake debounce and the cron's housekeeping run from this object's alarm. The Worker minute cron stays a no-op
-// while TENANCY=host, so there is no shared database to flush. Self-host still uses its minute cron.
+// Wake debounce and housekeeping run from this object's alarm. The Worker minute cron stays a no-op
+// while TENANCY=host, so there is no shared database to flush. A single inbox still uses its minute cron.
 // The daily backup cron runs only when BACKUP_BUCKET is bound, and it returns before any flush.
-// Usage push is not in this change. Approval OIDC, when configured (self-host settings, or the pushed tenant
-// `approval` object), uses the same pages as self-host.
+// OpenID Connect approval, when the issuer, client id, client secret, and allowlist are set, uses the same pages.
 import { DurableObject } from "cloudflare:workers";
 import worker, { cronFlush, dispatch, nextCronAt, onWakeWrite, runOwnerRpc } from "./index.ts";
 import { accountIdOf, type OwnerRpcRequest, type OwnerRpcResult } from "./owner-rpc.ts";
@@ -34,7 +33,7 @@ const gone = () => Response.json({ error: "this agent is gone" }, { status: 410,
 
 const TENANT_ID = /^[A-Za-z0-9._:-]{1,128}$/;
 
-/** Versioned config pushed by the control plane. `secretsEnc` is decrypted into the wake credentials when the context is built. */
+/** Versioned config pushed into the object. `secretsEnc` is decrypted into the wake credentials when the context is built. */
 export interface TenantConfigPush {
 	version: number;
 	tenantId: string;

package/worker/src/index.ts

@@ -108,7 +108,7 @@ async function wakeBudgetOk(ctx: TenantContext): Promise<boolean> {
 
 const wakeWriteHooks = new WeakMap<object, () => Promise<void>>();
 
-/** A hosted tenant registers this so a wake row updates that tenant's alarm in the same turn as the write. */
+/** A caller registers this so a wake row updates the alarm in the same turn as the write. */
 export function onWakeWrite(ectx: object, fn: () => Promise<void>): void {
 	wakeWriteHooks.set(ectx, fn);
 }
@@ -204,7 +204,7 @@ async function wake(ctx: TenantContext, ectx: ExecutionContext, contextId: strin
 	await noteWakeWrite(ectx);
 	const delay = Math.max(0, (cur?.last_sent_ms || now) + deb - now) + 100;
 	// waitUntil can outlive the response by ~30s. Longer windows are flushed by a later request, the optional
-	// self-host cron, or the hosted tenant's alarm (set above).
+	// single-inbox cron, or the registered alarm (set above).
 	if (delay <= 25000) ectx.waitUntil(new Promise((res) => setTimeout(res, delay)).then(() => flushWake(ctx, ectx, contextId)));
 }
 
@@ -255,7 +255,7 @@ async function minMs(ctx: TenantContext, sql: string, shift: (t: number) => numb
 
 /**
  * When the next flush or housekeeping delete becomes due, or null when nothing is waiting.
- * A hosted tenant sets its alarm to this time. Self-host keeps the minute cron and does not call this.
+ * Per-inbox storage sets its alarm to this time. A single inbox keeps the minute cron and does not call this.
  */
 export async function nextCronAt(ctx: TenantContext, now = Date.now()): Promise<number | null> {
 	const times: number[] = [];
@@ -2180,7 +2180,7 @@ async function mcpGrantOf(ctx: TenantContext, header: string | null): Promise<Js
 }
 
 /**
- * Hosted owner RPC. The control plane has already checked that `accountId` owns this tenant.
+ * Hosted owner RPC. The caller has already checked that `accountId` owns this tenant.
  * Only an allowlisted path runs, and the response is withheld when it contains a peer token or a secret.
  * Self-host (`mode` single) is refused here; its owner API stays the bearer check in `handleOwner`.
  */

package/worker/src/owner-rpc.ts

@@ -1,12 +1,12 @@
-// Hosted owner RPC allowlist. The control plane calls TenantStore.owner() after it has checked that
-// the account owns the tenant. This list is the only paths that call may run, and it is stricter than
+// Hosted owner RPC allowlist. The caller has checked that the account owns the tenant.
+// This list is the only paths that call may run, and it is stricter than
 // the owner HTTP API: routes that mint a peer token, return a setup secret, or accept a plaintext peer
 // token are not here. GET /owner/export is here only because runOwnerRpc redacts it first. Self-host never calls this.
 
 import { ID_RE } from "./a2a.ts";
 import { credentialIsMasked, previewHeaderPlain } from "./wake.ts";
 
-/** Control-plane account id. Slashes and dots are refused so the value cannot be a path. */
+/** Account id. Slashes and dots are refused so the value cannot be a path. */
 export const ACCOUNT_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
 
 const LABEL = /^[A-Za-z0-9_-]{1,32}$/;
@@ -42,7 +42,7 @@ export interface OwnerRpcRequest {
 	/** Refused. The owner HTTP API is where a body is accepted. */
 	body?: unknown;
 	/**
-	 * Dashboard approve or deny after the control plane has checked a recent sign-in.
+	 * Approve or deny after a recent sign-in.
 	 * Any other value is refused. Absent keeps the owner HTTP API's actor (`agent` or `owner`).
 	 */
 	actor?: "human";

package/worker/src/storage.ts

@@ -1,6 +1,6 @@
 // D1-shaped database over a Durable Object's SQLite (`ctx.storage.sql`).
 // Handlers keep calling prepare().bind().first()/all()/run() and batch(). Self-host keeps the real D1 binding;
-// a hosted tenant uses this adapter on its own object. `migrateDo` matches `cf d1 migrations apply`: the same
+// a per-inbox Durable Object uses this adapter on its own object. `migrateDo` matches `cf d1 migrations apply`: the same
 // `d1_migrations` table, unrecorded files in numeric order, one transaction per file.
 
 /** The slice of the Workers `SqlStorage` API this adapter uses. Tests can implement it over node:sqlite. */

package/worker/src/tenancy.ts

@@ -1,15 +1,14 @@
-// Tenant context for the data-plane Worker.
+// Context for one inbox.
 //
-// Self-host (TENANCY unset, the default): one implicit tenant, config and OWNER_TOKEN taken from the Worker env.
+// Default (TENANCY unset): one inbox. Config and OWNER_TOKEN come from the Worker env.
 // Handlers receive this object instead of reading env.* themselves. With every gate unset, owner checks and the
 // outbound peer-token key are the same operations as before (existing ciphertext still decrypts).
 //
-// Hosted (a TenantContext built with a pushed tenant overlay): owner auth is a constant-time compare against
-// owner_token_hash, and the peer-token key is derived from TENANT_SECRETS_KEY and the tenant id. The Worker
-// fetch path does not build that overlay; the hosted router does, and only when TENANCY=host and TENANT_DO are
-// both set. Settings below are parsed either way. Nothing here turns on quotas, metering, wake policy, branding
-// those stay reserved until a later change reads ctx.gates. Approval OIDC is enforced by the approval pages when
-// the issuer, client id, client secret and an allowlist are all set (approval-oidc.ts).
+// When a pushed config is set, and only when TENANCY is "host" and TENANT_DO is bound, owner auth compares a
+// token hash and the peer-token key is derived from TENANT_SECRETS_KEY and the inbox id. The fetch path does not
+// build that overlay. Settings below are parsed either way. Some of them stay unused until a caller reads
+// ctx.gates. OpenID Connect approval is enforced by the approval pages when the issuer, client id, client secret,
+// and an allowlist are all set (approval-oidc.ts).
 
 import * as A from "./a2a.ts";
 
@@ -46,9 +45,9 @@ export type ConfigKey = (typeof CONFIG_KEYS)[number];
 export type ConfigFields = { [K in ConfigKey]?: string };
 
 /**
- * Non-secret platform defaults a hosted tenant inherits when its pushed config omits them.
- * Wake secrets, upstream secrets and OWNER_TOKEN are never inherited. In hosted mode the secret wake
- * fields come from decrypting `secrets_enc` (see the tenant object). A plaintext copy in the pushed
+ * Non-secret defaults used when a pushed config omits them.
+ * Wake secrets, upstream secrets, and OWNER_TOKEN are never copied. Secret wake
+ * fields come from decrypting `secrets_enc`. A plaintext copy in the pushed
  * config is used only when that ciphertext is absent.
  */
 const HOSTED_PLATFORM_DEFAULTS: readonly ConfigKey[] = ["MAX_BODY", "RATE_PER_MIN", "PBKDF2_ITERATIONS", "MCP", "PAIRING_APPROVAL"];
@@ -86,17 +85,17 @@ export interface WorkerBindings extends ConfigFields {
 	TENANT_DO?: DoNamespace;
 	/** unset | eu | fedramp. Applied as a DO jurisdiction when the hosted router addresses a tenant. */
 	DATA_REGION?: string;
-	/** "on" reserves quota enforcement (not applied yet). */
+	/** Parsed and unused by this Worker. */
 	QUOTAS?: string;
-	/** "d1" reserves usage metering (not applied yet). */
+	/** Parsed and unused by this Worker. */
 	USAGE_SINK?: string;
 	/** "public-https" refuses non-https, private, and metadata wake targets. Anything else is unset. */
 	WAKE_TARGET_POLICY?: string;
-	/** https URL shown later on the landing page and over-quota errors. Parsed, not rendered yet. */
+	/** https URL. Parsed and unused by this Worker. */
 	SIGNUP_URL?: string;
-	/** https origin, no path. A hosted tenant posts feedback there. Ignored on a self-hosted inbox. */
+	/** https origin, no path. Posts go there when this deploy sets the URL. */
 	FEEDBACK_URL?: string;
-	/** "hosted" reserves footer / plan badge. Parsed, not rendered yet. */
+	/** Parsed string. Not rendered by this Worker. */
 	BRANDING?: string;
 	APPROVAL_OIDC_ISSUER?: string;
 	APPROVAL_OIDC_CLIENT_ID?: string;
@@ -106,8 +105,8 @@ export interface WorkerBindings extends ConfigFields {
 	/** Comma-separated: password, oidc. Unset keeps the password and also offers OIDC once it is fully configured. */
 	APPROVAL_METHODS?: string;
 	/**
-	 * Service binding to the control Worker. Used for OpenID Connect discovery, token and JWKS
-	 * when the issuer is on this tenant's zone. Unset: those calls use `fetch` (self-host, and any other issuer).
+	 * Service binding for OpenID Connect discovery, token, and JWKS when the issuer is on this
+	 * tenant's zone. Unset: those calls use `fetch`.
 	 */
 	CONTROL_SERVICE?: ControlFetcher;
 }
@@ -145,15 +144,15 @@ export interface ApprovalOidcGate {
 	methods: string[];
 	/** True only when the setting listed at least one of password or oidc. Unset is false. */
 	methodsSpecified: boolean;
-	/** Short button label from hosted approval config, or "". */
+	/** Short button label from the pushed approval config, or "". */
 	label: string;
 }
 
 export interface FeatureGates {
 	tenancy: TenancyMode;
 	/**
-	 * True only when TENANCY is exactly "host" and TENANT_DO is bound. That is the switch for per-tenant storage.
-	 * Any other combination, including TENANCY=host alone, keeps the self-host path on env.DB.
+	 * True only when TENANCY is exactly "host" and TENANT_DO is bound. That switches storage off env.DB.
+	 * Any other combination, including TENANCY=host alone, keeps the single-inbox path on env.DB.
 	 */
 	hostedStorage: boolean;
 	quotas: boolean;
@@ -161,20 +160,20 @@ export interface FeatureGates {
 	wakeTargetPolicy: "" | "public-https";
 	signupUrl: string;
 	branding: "" | "hosted";
-	/** https origin of a control plane that accepts POST /api/feedback, or "". Ignored unless mode is host. */
+	/** https origin that accepts POST /api/feedback, or "". Ignored unless mode is host. */
 	feedbackUrl: string;
 	dataRegion: DataRegion;
 	tenantDomain: string;
 	approvalOidc: ApprovalOidcGate;
 }
 
-/** Pushed tenant row (control plane → DO). PR1 tests build a context from this; the DO stores it in PR2. */
+/** Pushed tenant row. Tests build a context from this; the Durable Object stores it. */
 export interface HostedOverlay {
 	id: string;
 	db: SqlDb;
 	publicUrl: string;
 	ownerTokenHash?: string | null;
-	/** Non-secret and, when the control plane includes them, secret config fields. Never OWNER_TOKEN. */
+	/** Non-secret and secret config fields. Never OWNER_TOKEN. */
 	config?: Record<string, string | undefined>;
 	limits?: Record<string, unknown>;
 	approval?: Record<string, unknown>;
@@ -252,7 +251,7 @@ function subjectsOf(v: unknown): string[] {
 	return list.map((s) => s.trim()).filter(Boolean).slice(0, 100);
 }
 
-/** Approval gate from a hosted tenant's pushed `approval` object (camelCase). The client secret is returned beside the gate. */
+/** Approval gate from a pushed `approval` object (camelCase). The client secret is returned beside the gate. */
 export function approvalFromRecord(raw: Record<string, unknown> | undefined): { gate: ApprovalOidcGate; clientSecret: string; publicRecord: Record<string, unknown> } {
 	const { methods, specified } = recognizedMethods(Array.isArray(raw?.methods) ? raw!.methods.map((s) => String(s)) : typeof raw?.methods === "string" ? csv(raw.methods) : []);
 	const clientSecret = typeof raw?.clientSecret === "string" ? raw.clientSecret.trim() : "";
@@ -376,7 +375,7 @@ export class TenantContext implements ConfigFields {
 	readonly #secretsKey?: string;
 	/** OpenID Connect client secret. Never logged and never copied onto `gates`. */
 	readonly #approvalClientSecret?: string;
-	/** Control Worker binding. Not a secret. Absent on a self-host deploy. */
+	/** Service binding for the issuer. Not a secret. Absent on a self-host deploy. */
 	readonly #controlService?: ControlFetcher;
 	#peerKey: Promise<CryptoKey | null> | null = null;
 
@@ -407,7 +406,7 @@ export class TenantContext implements ConfigFields {
 		return this.#approvalClientSecret || "";
 	}
 
-	/** Control Worker binding, or undefined when this deploy has none. */
+	/** Issuer service binding, or undefined when this deploy has none. */
 	controlService(): ControlFetcher | undefined {
 		return this.#controlService;
 	}

package/worker/src/version.ts

@@ -1,2 +1,2 @@
 /** Inbox build. Keep this equal to `version` in cli/package.json. */
-export const VERSION = "0.7.34";
+export const VERSION = "0.8.0";

package/worker/src/wake-secrets.ts

@@ -1,5 +1,5 @@
-// Wake secrets sealed for one hosted tenant. The control plane writes `secrets_enc`; the tenant
-// object decrypts it when it builds the tenant context. Self-host does not use this.
+// Wake secrets sealed for one inbox record. The writer stores `secrets_enc`; the inbox
+// object decrypts it when it builds the context. A single-inbox deploy does not use this.
 // Keep control/src/tenants/wake-secrets.ts in step with this file.
 
 const INFO = "tenant-wake-secrets v1";

package/worker/test/hosted.test.ts

@@ -271,7 +271,7 @@ test("hosted approval reaches a same-zone issuer through CONTROL_SERVICE", async
 				return new Response("missing", { status: 404 });
 			},
 		},
-		// A public fetch of another host on this zone does not reach the control Worker. If it is attempted, answer 522.
+		// A public fetch of another host on this zone does not reach the issuer. If it is attempted, answer 522.
 		outboundService: async (request: Request) => {
 			publicHosts.push(new URL(request.url).hostname);
 			return new Response("origin is unreachable", { status: 522 });
@@ -367,7 +367,7 @@ test("hosted approval reaches a same-zone issuer through CONTROL_SERVICE", async
 	assert.match(await missedPost.text(), /The identity provider could not be reached/);
 });
 
-test("an apex issuer is fetched with that Host, and a control worker that does not answer still returns", async (t) => {
+test("an apex issuer is fetched with that Host, and a binding that does not answer still returns", async (t) => {
 	const issuer = "https://example.com";
 	const tenant = "https://northwind.example.com";
 	const control = `