a2a-exposed 0.8.14 → 0.8.16

package/worker/src/owner-rpc.ts

@@ -1,7 +1,9 @@
 // Hosted owner RPC allowlist. The caller has checked that the account owns the tenant.
 // This list is the only paths that call may run, and it is stricter than
-// the owner HTTP API: routes that mint a peer token, return a setup secret, or accept a plaintext peer
-// token are not here. GET /owner/export is here only because runOwnerRpc redacts it first.
+// the owner HTTP API: routes that mint a peer token or return a setup secret are not here.
+// PUT /owner/outbound-peers/:alias is the one call that accepts a peer token. handleOwner seals it.
+// The response is { ok, alias, hasToken } and the token is not logged.
+// GET /owner/export is here only because runOwnerRpc redacts it first.
 // POST /owner/mcp/send, reply, and mark_working take a checked argument object. A peer token is not one of those arguments.
 // Self-host never calls this.
 
@@ -42,8 +44,8 @@ export interface OwnerRpcRequest {
 	/** Allowlisted query parameters only. */
 	query?: Record<string, string>;
 	/**
-	 * Tool arguments for `POST /owner/mcp/send`, `POST /owner/mcp/reply`, and `POST /owner/mcp/mark_working`.
-	 * Any other call refuses a body.
+	 * Tool arguments for `POST /owner/mcp/send`, `POST /owner/mcp/reply`, and `POST /owner/mcp/mark_working`,
+	 * or `{ url, token }` for `PUT /owner/outbound-peers/:alias`. Any other call refuses a body.
 	 */
 	body?: unknown;
 	/**
@@ -61,7 +63,7 @@ export interface OwnerRpcResult {
 }
 
 export interface OwnerRoute {
-	method: "GET" | "POST" | "DELETE";
+	method: "GET" | "POST" | "DELETE" | "PUT";
 	path: string;
 	search: string;
 	/** Log name. Ids and codes are not included. */
@@ -133,7 +135,7 @@ function exportQuery(q: Record<string, string>): string | null {
 }
 
 interface RouteDef {
-	method: "GET" | "POST" | "DELETE";
+	method: "GET" | "POST" | "DELETE" | "PUT";
 	name: string;
 	take: (seg: string[]) => boolean;
 	search: (q: Record<string, string>) => string | null;
@@ -157,6 +159,7 @@ const ROUTES: RouteDef[] = [
 	{ method: "POST", name: "POST /owner/mcp/reply", take: (s) => s.length === 3 && s[1] === "mcp" && s[2] === "reply", search: noQuery, path: () => "/owner/mcp/reply" },
 	{ method: "POST", name: "POST /owner/mcp/mark_working", take: (s) => s.length === 3 && s[1] === "mcp" && s[2] === "mark_working", search: noQuery, path: () => "/owner/mcp/mark_working" },
 	{ method: "GET", name: "GET /owner/outbound-peers", take: (s) => s.length === 2 && s[1] === "outbound-peers", search: noQuery, path: () => "/owner/outbound-peers" },
+	{ method: "PUT", name: "PUT /owner/outbound-peers/:alias", take: (s) => s.length === 3 && s[1] === "outbound-peers" && ALIAS.test(s[2]!) && s[2] !== "." && s[2] !== "..", search: noQuery, path: (s) => `/owner/outbound-peers/${s[2]}` },
 	{ method: "DELETE", name: "DELETE /owner/outbound-peers/:alias", take: (s) => s.length === 3 && s[1] === "outbound-peers" && ALIAS.test(s[2]!) && s[2] !== "." && s[2] !== "..", search: noQuery, path: (s) => `/owner/outbound-peers/${s[2]}` },
 	{ method: "GET", name: "GET /owner/facade", take: (s) => s.length === 2 && s[1] === "facade", search: noQuery, path: () => "/owner/facade" },
 	{ method: "POST", name: "POST /owner/facade/verify", take: (s) => s.length === 3 && s[1] === "facade" && s[2] === "verify", search: noQuery, path: () => "/owner/facade/verify" },
@@ -169,7 +172,7 @@ const ROUTES: RouteDef[] = [
 
 /** Method + path (+ query) on the owner RPC allowlist, or why it is not. */
 export function matchOwnerRpc(method: unknown, path: unknown, query: unknown): OwnerMatch {
-	if (method !== "GET" && method !== "POST" && method !== "DELETE") return { ok: false, reason: "path" };
+	if (method !== "GET" && method !== "POST" && method !== "DELETE" && method !== "PUT") return { ok: false, reason: "path" };
 	const seg = segments(path);
 	if (!seg) return { ok: false, reason: "path" };
 	const def = ROUTES.find((r) => r.method === method && r.take(seg));
@@ -203,12 +206,34 @@ function mcpArgOk(key: string, value: string): string | null {
 	return "body is not allowed";
 }
 
+const PEER_URL_MAX = 2048;
+const PEER_TOKEN_MAX = 4096;
+
+/** `{ url, token }` for a synced outbound peer. `token` may be omitted when the peer takes none. No other keys. */
+function outboundPeerBody(body: unknown): { ok: true; value: Record<string, string> } | { ok: false; error: string } {
+	if (body == null || typeof body !== "object" || Array.isArray(body)) return { ok: false, error: "body must be an object" };
+	const keys = Object.keys(body);
+	if (keys.length > 2 || keys.some((key) => key !== "url" && key !== "token")) return { ok: false, error: "body is not allowed" };
+	const url = (body as Record<string, unknown>).url;
+	if (typeof url !== "string" || !url.trim()) return { ok: false, error: "url is required" };
+	if (url.length > PEER_URL_MAX) return { ok: false, error: "url is invalid" };
+	const value: Record<string, string> = { url };
+	if (Object.prototype.hasOwnProperty.call(body, "token")) {
+		const token = (body as Record<string, unknown>).token;
+		if (typeof token !== "string" || !token || token.length > PEER_TOKEN_MAX) return { ok: false, error: "token is invalid" };
+		value.token = token;
+	}
+	return { ok: true, value };
+}
+
 /**
  * Body allowed on this owner RPC route.
  * MCP send, reply, and mark_working receive a flat object of tool arguments.
+ * PUT /owner/outbound-peers/:alias receives `{ url, token }`. The token is sealed before any log line.
  * Every other route accepts only an absent body.
  */
 export function ownerRpcBody(routeName: string, body: unknown): { ok: true; value?: Record<string, string> } | { ok: false; error: string } {
+	if (routeName === "PUT /owner/outbound-peers/:alias") return outboundPeerBody(body);
 	const spec = MCP_ARGS[routeName];
 	if (!spec) {
 		if (body !== undefined && body !== null) return { ok: false, error: "this call takes no body" };

package/worker/src/tenancy.ts

@@ -399,6 +399,10 @@ export class TenantContext implements ConfigFields {
 	readonly #approvalClientSecret?: string;
 	/** Service binding for the issuer. Not a secret. Absent on a self-host deploy. */
 	readonly #controlService?: ControlFetcher;
+	/** Hosted name directory. Absent on a self-host deploy, so same-zone calls stay on public fetch. */
+	readonly #tenantDirectory?: KvNamespace;
+	/** Hosted Durable Object namespace. Absent on a self-host deploy. */
+	readonly #tenantNamespace?: DoNamespace;
 	#peerKey: Promise<CryptoKey | null> | null = null;
 
 	constructor(init: {
@@ -406,6 +410,7 @@ export class TenantContext implements ConfigFields {
 		gates: FeatureGates; limits: Record<string, unknown>; approval: Record<string, unknown>;
 		config: ConfigFields; ownerToken?: string; ownerTokenHash?: string; secretsKey?: string;
 		approvalClientSecret?: string; controlService?: ControlFetcher;
+		tenantDirectory?: KvNamespace; tenantNamespace?: DoNamespace;
 	}) {
 		this.id = init.id;
 		this.mode = init.mode;
@@ -420,6 +425,8 @@ export class TenantContext implements ConfigFields {
 		this.#secretsKey = init.secretsKey;
 		this.#approvalClientSecret = init.approvalClientSecret;
 		this.#controlService = init.controlService;
+		this.#tenantDirectory = init.tenantDirectory;
+		this.#tenantNamespace = init.tenantNamespace;
 		Object.assign(this, init.config);
 	}
 
@@ -433,6 +440,16 @@ export class TenantContext implements ConfigFields {
 		return this.#controlService;
 	}
 
+	/** Name directory for other tenants on this deployment. Undefined on a self-host deploy. */
+	tenantDirectory(): KvNamespace | undefined {
+		return this.#tenantDirectory;
+	}
+
+	/** Durable Object namespace for other tenants on this deployment. Undefined on a self-host deploy. */
+	tenantNamespace(): DoNamespace | undefined {
+		return this.#tenantNamespace;
+	}
+
 	/**
 	 * Bucket id for feedback rate limits. Hosted mode sends the stored owner-token hash (already SHA-256).
 	 * Self-host has no separate hash to send and returns "".
@@ -514,5 +531,7 @@ export function hostedTenantContext(env: WorkerBindings, overlay: HostedOverlay)
 		config, ownerTokenHash: hash || undefined, secretsKey: parsed.secretsKey,
 		approvalClientSecret: approval.clientSecret,
 		controlService: env.CONTROL_SERVICE,
+		tenantDirectory: env.TENANT_DIRECTORY,
+		tenantNamespace: env.TENANT_DO,
 	});
 }

package/worker/src/version.ts

@@ -1,2 +1,2 @@
 /** Inbox build. Keep this equal to `version` in cli/package.json. */
-export const VERSION = "0.8.14";
+export const VERSION = "0.8.16";

package/worker/test/facade.test.ts

@@ -268,6 +268,54 @@ test("proxy mode: JSON-RPC is forwarded with the façade's credential, never the
 	assert.equal((s.DB.db.prepare("SELECT COUNT(*) AS n FROM tasks").get() as any).n, 0);
 });
 
+test("proxy mode: a declared A2A-Version query is forwarded as the header; a headerless call stays headerless", async (t) => {
+	let n = 0;
+	const s = setup({ UPSTREAM_URL: UPSTREAM, UPSTREAM_CARD_URL: "https://agent-upstream.example.net/card-ver.json" }, async (url, init) => {
+		if (url.endsWith(".json")) return Response.json(tailnetCard());
+		const rq = JSON.parse(init.body);
+		const hv = init.headers?.["a2a-version"];
+		const v1 = hv ? hv.startsWith("1") : !String(rq.method).includes("/");
+		const id = `up-task-${++n}`, contextId = `up-ctx-${n}`;
+		const result = v1
+			? { task: { id, contextId, status: { state: "TASK_STATE_SUBMITTED" }, history: [{ role: "ROLE_USER", parts: [{ text: "hi" }] }] } }
+			: { kind: "task", id, contextId, status: { state: "submitted" }, history: [{ kind: "message", role: "user", parts: [{ kind: "text", text: "hi" }] }] };
+		return Response.json({ jsonrpc: "2.0", id: rq.id, result });
+	});
+	t.after(s.restore);
+	const tok = await s.issue("ada");
+	const msg = { message: { role: "user", messageId: "m-ver", parts: [{ kind: "text", text: "hi" }] } };
+	const post = (path: string, method: string, headers: Record<string, string> = {}) =>
+		s.call("POST", path, { token: tok, json: { jsonrpc: "2.0", id: 1, method, params: msg }, headers });
+	const last = () => s.calls.filter((c) => c.url === UPSTREAM).at(-1);
+
+	const q = await post("/?A2A-Version=0.3", "SendMessage");
+	assert.equal(q.status, 200, q.text);
+	assert.equal(last().url, UPSTREAM);
+	assert.equal(last().headers["a2a-version"], "0.3");
+	assert.equal(q.data.result.kind, "task");
+	assert.equal(q.data.result.status.state, "submitted");
+	assert.equal(q.data.result.task, undefined);
+
+	const bare = await post("/", "SendMessage");
+	assert.equal(last().headers["a2a-version"], undefined);
+	assert.equal(bare.data.result.task.status.state, "TASK_STATE_SUBMITTED");
+	assert.equal(bare.data.result.kind, undefined);
+
+	const bare03 = await post("/", "message/send");
+	assert.equal(last().headers["a2a-version"], undefined);
+	assert.equal(bare03.data.result.kind, "task");
+	assert.equal(bare03.data.result.status.state, "submitted");
+
+	const wins = await post("/?A2A-Version=0.3", "SendMessage", { "a2a-version": "1.0" });
+	assert.equal(last().headers["a2a-version"], "1.0");
+	assert.equal(wins.data.result.task.status.state, "TASK_STATE_SUBMITTED");
+
+	const patch = await post("/?A2A-Version=0.3.0", "SendMessage");
+	assert.equal(last().headers["a2a-version"], "0.3");
+	assert.equal(patch.data.result.kind, "task");
+	assert.equal(patch.data.result.status.state, "submitted");
+});
+
 test("proxy mode: peers sharing the upstream identity can't touch each other's tasks or contexts", async (t) => {
 	const s = setup({ UPSTREAM_URL: UPSTREAM, UPSTREAM_CARD_URL: "https://agent-upstream.example.net/card-c.json" });
 	t.after(s.restore);
@@ -309,7 +357,14 @@ test("proxy mode: peers sharing the upstream identity can't touch each other's t
 	// ListTasks would list every peer's tasks; streaming is not proxied yet
 	assert.equal((await s.rpc(a, "ListTasks", {})).data.error?.code, -32004);
 	assert.equal((await s.rpc(a, "SendStreamingMessage", { message: { role: "ROLE_USER", parts: [{ text: "x" }] } })).data.error?.code, -32004);
-	assert.equal((await s.rpc(a, "GetExtendedAgentCard", {})).data.error?.code, -32601);
+	const nCard = s.calls.filter((c) => c.url === UPSTREAM).length;
+	const ext = await s.rpc(a, "GetExtendedAgentCard", {});
+	assert.equal(ext.status, 200);
+	assert.equal(ext.data.error?.code, -32007);
+	assert.equal(ext.data.error?.message, "Extended agent card is not configured");
+	const ext03 = await s.call("POST", "/", { token: a, json: { jsonrpc: "2.0", id: 1, method: "agent/getAuthenticatedExtendedCard", params: {} }, headers: { "a2a-version": "0.3" } });
+	assert.equal(ext03.data.error?.code, -32007);
+	assert.equal(s.calls.filter((c) => c.url === UPSTREAM).length, nCard, "the extended card stays on the façade");
 });
 
 test("proxy mode: push configs never reach the upstream (it would call them from inside the private network)", async (t) => {

package/worker/test/migrations.test.ts

@@ -67,15 +67,15 @@ test("fresh database: every migration applies in order; a second run applies not
 test("database from the 0002 fix (0001-0003 recorded): only 0004 and later apply; pending requests keep working", () => {
 	const db = existingDb([sql("0001_init.sql"), sql("0002_wake_budget.sql"), sql("0003_device_pairing.sql")], ["0001_init.sql", "0002_wake_budget.sql", "0003_device_pairing.sql"]);
 	db.prepare("INSERT INTO device_requests (device_hash, user_code, status, created_ms, expires_ms, interval_s) VALUES ('h', 'WDJB4827', 'pending', 1, 2, 5)").run();
-	assert.deepEqual(applyMigrations(db), ["0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql"]);
+	assert.deepEqual(applyMigrations(db), ["0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql", "0009_outbound_seen.sql"]);
 	assert.equal((db.prepare("SELECT replaces_label FROM device_requests WHERE device_hash = 'h'").get() as any).replaces_label, null);
 });
 
 test("database from v0.2.0 (0001 and 0003 recorded): 0002 applies as a no-op and keeps the data", () => {
 	const db = existingDb([sql("0001_init.sql"), sql("0003_device_pairing.sql")], ["0001_init.sql", "0003_device_pairing.sql"]);
 	db.prepare("INSERT INTO wake_budget (hour, count) VALUES (1, 7)").run();
-	assert.deepEqual(applyMigrations(db), ["0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql"]);
-	assert.deepEqual(recorded(db), ["0001_init.sql", "0003_device_pairing.sql", "0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql"]);
+	assert.deepEqual(applyMigrations(db), ["0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql", "0009_outbound_seen.sql"]);
+	assert.deepEqual(recorded(db), ["0001_init.sql", "0003_device_pairing.sql", "0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql", "0009_outbound_seen.sql"]);
 	assert.equal((db.prepare("SELECT count FROM wake_budget WHERE hour = 1").get() as any).count, 7);
 });
 
@@ -107,7 +107,7 @@ test("database from an earlier build without wake_budget (0001 and 0003 recorded
 		assert.equal(before.data.error?.code, -32603, JSON.stringify(before.data));
 		assert.equal(wakes.length, 0);
 
-		assert.deepEqual(applyMigrations(db), ["0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql"]);
+		assert.deepEqual(applyMigrations(db), ["0002_wake_budget.sql", "0004_pairing_replace.sql", "0005_facade_owners.sql", "0006_mcp.sql", "0007_cimd.sql", "0008_oidc_txns.sql", "0009_outbound_seen.sql"]);
 		assert.deepEqual(columns(db, "wake_budget"), ["hour", "count"]);
 		assert.deepEqual(applyMigrations(db), []);
 

package/worker/test/outbound-push.test.ts

@@ -0,0 +1,342 @@
+// Push registration and inbox acknowledgement.
+// A connector send attaches a push config only when the peer card advertises it, and stores the token
+// hash before SendMessage returns. Inbox marks a reply seen only when the stored update is still the
+// snapshot that response returned, on every storage backend this file runs against.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { sha256 } from "../src/a2a.ts";
+import { dispatch, runOwnerRpc } from "../src/index.ts";
+import { hostedTenantContext, resolveTenant, type WorkerBindings } from "../src/tenancy.ts";
+import { d1 } from "./d1.ts";
+
+const MIGRATIONS = new URL("../migrations/", import.meta.url);
+const ectx = { waitUntil(_p: Promise<unknown>) {}, passThroughOnException() {} };
+const OWNER = "owner-secret";
+
+type Row = { taskId?: string; contextId?: string; text?: string; kind?: string; state?: string | null };
+type Hist = { event?: string; text?: string; state?: string | null };
+type SendBody = { text?: string; isError?: boolean };
+
+function reqUrl(input: RequestInfo | URL): string {
+	if (typeof input === "string") return input;
+	if (input instanceof URL) return input.href;
+	return input.url;
+}
+
+function single(url: string) {
+	const db = d1(MIGRATIONS);
+	const ctx = resolveTenant({ DB: db, PUBLIC_URL: url, OWNER_TOKEN: OWNER, AGENT_NAME: "Owner" } as WorkerBindings);
+	return { db, ctx };
+}
+
+async function owner(ctx: ReturnType<typeof resolveTenant>, method: string, path: string, body?: unknown) {
+	const res = await dispatch(new Request(ctx.PUBLIC_URL + path, {
+		method, headers: { authorization: `Bearer ${OWNER}`, "content-type": "application/json" },
+		body: body === undefined ? undefined : JSON.stringify(body),
+	}), ctx, ectx as never);
+	const text = await res.text();
+	let data: unknown = text;
+	try { data = JSON.parse(text); } catch { /* plain */ }
+	return { status: res.status, data, text };
+}
+
+function card(url: string, version: string, push: boolean | undefined) {
+	const body: Record<string, unknown> = {
+		name: "Peer",
+		url: `${url}/`,
+		supportedInterfaces: [{ url: `${url}/`, protocolBinding: "JSONRPC", protocolVersion: version }],
+	};
+	if (push !== undefined) body.capabilities = { pushNotifications: push };
+	return body;
+}
+
+function taskResult(id: string, contextId: string, version: string) {
+	const task = { id, contextId, status: { state: version.startsWith("1") ? "TASK_STATE_COMPLETED" : "completed" } };
+	return version.startsWith("1") ? { task } : task;
+}
+
+/** Run `inject` after the inbox's outbound read returns and before that read's caller continues. */
+function duringOutboundRead(db: { prepare: (sql: string) => any }, inject: () => Promise<void>) {
+	const orig = db.prepare.bind(db);
+	let fired = false;
+	db.prepare = (sql: string) => {
+		const built = orig(sql);
+		if (fired || !sql.includes("FROM outbound WHERE updates_json")) return built;
+		const wrap = (s: any): any => {
+			const origAll = s.all.bind(s);
+			const origBind = s.bind.bind(s);
+			s.bind = (...a: unknown[]) => wrap(origBind(...a));
+			s.all = async () => {
+				const rows = await origAll();
+				if (fired) return rows;
+				fired = true;
+				db.prepare = orig;
+				await inject();
+				return rows;
+			};
+			return s;
+		};
+		return wrap(built);
+	};
+}
+
+async function seedReply(db: { prepare: (sql: string) => any }, taskId: string, contextId: string, token: string, text: string) {
+	const updates = JSON.stringify([{
+		receivedAt: "2026-01-01T00:00:00.000Z",
+		payload: { task: { id: taskId, contextId, status: { state: "completed", message: { parts: [{ text }] } } } },
+	}]);
+	await db.prepare(
+		`INSERT INTO outbound (task_id, context_id, peer, endpoint, protocol, push_token_hash, sent_at, updates_json, updates_seen)
+		 VALUES (?, ?, 'ada', 'https://ada.example.net/', '1.0', ?, '2026-01-01T00:00:00.000Z', ?, 0)`,
+	).bind(taskId, contextId, await sha256(token), updates).run();
+	await db.prepare("INSERT INTO wakes (context_id, last_sent_ms) VALUES (?, ?)").bind(contextId, Date.now()).run();
+}
+
+test("a push between the inbox read and the seen mark stays unseen", async () => {
+	const { db, ctx } = single("https://owner.example.net");
+	const token = "push-token-seen";
+	await seedReply(db, "task-seen", "ctx-seen", token, "first reply");
+	duringOutboundRead(db, async () => {
+		const push = await dispatch(new Request("https://owner.example.net/push", {
+			method: "POST",
+			headers: { "content-type": "application/json", "x-a2a-notification-token": token },
+			body: JSON.stringify({ task: { id: "task-seen", contextId: "ctx-seen", status: { state: "completed", message: { parts: [{ text: "newer reply" }] } } } }),
+		}), ctx, ectx as never);
+		assert.equal(push.status, 200);
+	});
+	const first = await owner(ctx, "GET", "/owner/inbox");
+	assert.equal(first.status, 200, first.text);
+	const shown = (first.data as Row[]).find((r) => r.kind === "outbound" && r.taskId === "task-seen");
+	assert.equal(shown?.text, "first reply");
+	const mid = await db.prepare("SELECT updates_seen, updates_json FROM outbound WHERE task_id = ?").bind("task-seen").first() as { updates_seen?: number; updates_json?: string };
+	assert.equal(Number(mid.updates_seen), 0);
+	assert.match(String(mid.updates_json), /newer reply/);
+	const wake = await db.prepare("SELECT pending_json FROM wakes WHERE context_id = ?").bind("ctx-seen").first() as { pending_json?: string } | null;
+	assert.match(String(wake?.pending_json), /outbound_update/);
+	const second = await owner(ctx, "GET", "/owner/inbox");
+	const again = (second.data as Row[]).find((r) => r.kind === "outbound" && r.taskId === "task-seen");
+	assert.equal(again?.text, "newer reply");
+	const done = await db.prepare("SELECT updates_seen FROM outbound WHERE task_id = ?").bind("task-seen").first() as { updates_seen?: number };
+	assert.equal(Number(done.updates_seen), 1);
+	const cleared = await db.prepare("SELECT pending_json FROM wakes WHERE context_id = ?").bind("ctx-seen").first() as { pending_json?: string | null };
+	assert.equal(cleared.pending_json, null);
+});
+
+test("hosted inbox acknowledgement also waits for the returned snapshot", async () => {
+	const db = d1(MIGRATIONS);
+	const hash = await sha256("hosted-owner");
+	const ctx = hostedTenantContext({
+		DB: db, TENANCY: "host", TENANT_SECRETS_KEY: "platform-key", PUBLIC_URL: "https://owner.example.net", OWNER_TOKEN: "platform-owner",
+	} as WorkerBindings, {
+		id: "ten_seen", db, publicUrl: "https://owner.example.net", ownerTokenHash: hash, status: "active", config: { AGENT_NAME: "Owner" },
+	});
+	const token = "push-token-rpc";
+	await seedReply(db, "task-rpc", "ctx-rpc", token, "first reply");
+	duringOutboundRead(db, async () => {
+		const push = await dispatch(new Request("https://owner.example.net/push", {
+			method: "POST",
+			headers: { "content-type": "application/json", "x-a2a-notification-token": token },
+			body: JSON.stringify({ task: { id: "task-rpc", contextId: "ctx-rpc", status: { state: "completed", message: { parts: [{ text: "newer reply" }] } } } }),
+		}), ctx, ectx as never);
+		assert.equal(push.status, 200);
+	});
+	const read = () => runOwnerRpc(ctx, ectx as never, { accountId: "acct_seen", method: "GET", path: "/owner/inbox" });
+	const first = await read();
+	assert.equal(first.status, 200, JSON.stringify(first.body));
+	const shown = (first.body as Row[]).find((r) => r.kind === "outbound" && r.taskId === "task-rpc");
+	assert.equal(shown?.text, "first reply");
+	const mid = await db.prepare("SELECT updates_seen FROM outbound WHERE task_id = ?").bind("task-rpc").first() as { updates_seen?: number };
+	assert.equal(Number(mid.updates_seen), 0);
+	const wake = await db.prepare("SELECT pending_json FROM wakes WHERE context_id = ?").bind("ctx-rpc").first() as { pending_json?: string } | null;
+	assert.match(String(wake?.pending_json), /outbound_update/);
+	const second = await read();
+	const again = (second.body as Row[]).find((r) => r.kind === "outbound" && r.taskId === "task-rpc");
+	assert.equal(again?.text, "newer reply");
+	const done = await db.prepare("SELECT updates_seen FROM outbound WHERE task_id = ?").bind("task-rpc").first() as { updates_seen?: number };
+	assert.equal(Number(done.updates_seen), 1);
+});
+
+test("send omits push unless the peer card advertises it", async (t) => {
+	const { db, ctx } = single("https://owner.example.net");
+	const seen: { host: string; configuration?: Record<string, unknown> }[] = [];
+	const orig = globalThis.fetch;
+	globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+		const url = new URL(reqUrl(input));
+		if (init?.method !== "POST") {
+			const push = url.host === "bea.example.net" ? false : undefined;
+			return new Response(JSON.stringify(card(`https://${url.host}`, "1.0", push)), { status: 200, headers: { "content-type": "application/json" } });
+		}
+		const body = JSON.parse(String(init.body)) as { params?: { configuration?: Record<string, unknown> } };
+		seen.push({ host: url.host, configuration: body.params?.configuration });
+		const pend = await db.prepare("SELECT task_id FROM outbound WHERE task_id LIKE 'pend.%'").all() as { results: unknown[] };
+		assert.equal(pend.results.length, 0);
+		const id = url.host === "bea.example.net" ? "task-false" : "task-missing";
+		return new Response(JSON.stringify({ jsonrpc: "2.0", id: "1", result: taskResult(id, "ctx-nopush", "1.0") }), { status: 200, headers: { "content-type": "application/json" } });
+	}) as typeof fetch;
+	t.after(() => { globalThis.fetch = orig; });
+
+	for (const [alias, url] of [["ada", "https://ada.example.net"], ["bea", "https://bea.example.net"]] as const) {
+		const synced = await owner(ctx, "PUT", `/owner/outbound-peers/${alias}`, { url });
+		assert.equal(synced.status, 200, synced.text);
+	}
+	for (const [alias, taskId] of [["ada", "task-missing"], ["bea", "task-false"]] as const) {
+		const sent = await owner(ctx, "POST", "/owner/mcp/send", { to: alias, text: "hello", contextId: "ctx-nopush" });
+		assert.equal(sent.status, 200, sent.text);
+		assert.equal((sent.data as SendBody).isError, false, sent.text);
+		assert.match((sent.data as SendBody).text || "", new RegExp(`task ${taskId}`));
+		const row = await db.prepare("SELECT push_token_hash FROM outbound WHERE task_id = ?").bind(taskId).first() as { push_token_hash?: string | null };
+		assert.equal(row.push_token_hash, null);
+	}
+	assert.equal(seen.length, 2);
+	for (const call of seen) {
+		assert.equal(call.configuration?.returnImmediately, true);
+		assert.equal("taskPushNotificationConfig" in (call.configuration || {}), false);
+		assert.equal("pushNotificationConfig" in (call.configuration || {}), false);
+	}
+});
+
+test("the push hash is stored before SendMessage returns, and a fast callback authenticates", async (t) => {
+	const { db, ctx } = single("https://owner.example.net");
+	const outputs: string[] = [];
+	let token = "";
+	const orig = globalThis.fetch;
+	globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+		const url = new URL(reqUrl(input));
+		if (init?.method !== "POST") {
+			const version = url.host === "cara.example.net" ? "0.3" : "1.0";
+			return new Response(JSON.stringify(card(`https://${url.host}`, version, true)), { status: 200, headers: { "content-type": "application/json" } });
+		}
+		const body = JSON.parse(String(init.body)) as { params?: { configuration?: { taskPushNotificationConfig?: { token?: string }; pushNotificationConfig?: { token?: string } } } };
+		const cfg = body.params?.configuration || {};
+		const push = cfg.taskPushNotificationConfig || cfg.pushNotificationConfig;
+		assert.equal(typeof push?.token, "string");
+		token = push!.token!;
+		if (url.host === "cara.example.net") {
+			assert.equal("taskPushNotificationConfig" in cfg, false);
+			assert.equal(typeof cfg.pushNotificationConfig?.token, "string");
+		} else {
+			assert.equal(typeof cfg.taskPushNotificationConfig?.token, "string");
+		}
+		const pend = await db.prepare("SELECT push_token_hash FROM outbound WHERE task_id LIKE 'pend.%'").all() as { results: { push_token_hash?: string }[] };
+		assert.equal(pend.results.length, 1);
+		assert.equal(pend.results[0]?.push_token_hash, await sha256(token));
+		const taskId = url.host === "cara.example.net" ? "task-03" : "task-race";
+		const contextId = url.host === "cara.example.net" ? "ctx-03" : "ctx-race";
+		if (url.host !== "cara.example.net") {
+			const pushRes = await dispatch(new Request("https://owner.example.net/push", {
+				method: "POST",
+				headers: { "content-type": "application/json", "x-a2a-notification-token": token },
+				body: JSON.stringify({ task: { id: taskId, contextId, status: { state: "completed", message: { parts: [{ text: "raced reply" }] } } } }),
+			}), ctx, ectx as never);
+			const pushText = await pushRes.text();
+			outputs.push(pushText);
+			assert.equal(pushRes.status, 200, pushText);
+		}
+		const version = url.host === "cara.example.net" ? "0.3" : "1.0";
+		return new Response(JSON.stringify({ jsonrpc: "2.0", id: "1", result: taskResult(taskId, contextId, version) }), { status: 200, headers: { "content-type": "application/json" } });
+	}) as typeof fetch;
+	t.after(() => { globalThis.fetch = orig; });
+
+	for (const [alias, url] of [["ada", "https://ada.example.net"], ["cara", "https://cara.example.net"]] as const) {
+		const synced = await owner(ctx, "PUT", `/owner/outbound-peers/${alias}`, { url });
+		assert.equal(synced.status, 200, synced.text);
+	}
+	const raced = await owner(ctx, "POST", "/owner/mcp/send", { to: "ada", text: "hello", contextId: "ctx-race" });
+	outputs.push(raced.text);
+	assert.equal((raced.data as SendBody).isError, false, raced.text);
+	const racedToken = token;
+	const racedRow = await db.prepare("SELECT task_id, push_token_hash, updates_json FROM outbound WHERE task_id = ?").bind("task-race").first() as { push_token_hash?: string; updates_json?: string };
+	assert.equal(racedRow.push_token_hash, await sha256(racedToken));
+	assert.match(String(racedRow.updates_json), /raced reply/);
+	const pend = await db.prepare("SELECT task_id FROM outbound WHERE task_id LIKE 'pend.%'").all() as { results: unknown[] };
+	assert.equal(pend.results.length, 0);
+	const history = await owner(ctx, "GET", "/owner/history/ctx-race");
+	assert.equal((history.data as Hist[]).some((r) => r.event === "push" && r.text === "raced reply"), true, history.text);
+	const inbox = await owner(ctx, "GET", "/owner/inbox");
+	outputs.push(inbox.text);
+	const reply = (inbox.data as Row[]).find((r) => r.kind === "outbound" && r.taskId === "task-race");
+	assert.equal(reply?.text, "raced reply");
+	assert.equal(outputs.join("\n").includes(racedToken), false);
+
+	const older = await owner(ctx, "POST", "/owner/mcp/send", { to: "cara", text: "hello", contextId: "ctx-03" });
+	outputs.push(older.text);
+	assert.equal((older.data as SendBody).isError, false, older.text);
+	const oldRow = await db.prepare("SELECT push_token_hash FROM outbound WHERE task_id = ?").bind("task-03").first() as { push_token_hash?: string };
+	assert.equal(oldRow.push_token_hash, await sha256(token));
+	assert.equal(outputs.join("\n").includes(token), false);
+});
+
+test("a failed send drops an empty pending push row and keeps a callback that already arrived", async (t) => {
+	const { db, ctx } = single("https://owner.example.net");
+	let mode: "throw" | "push-then-throw" = "throw";
+	const orig = globalThis.fetch;
+	globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+		const url = new URL(reqUrl(input));
+		if (init?.method !== "POST") return new Response(JSON.stringify(card(`https://${url.host}`, "1.0", true)), { status: 200, headers: { "content-type": "application/json" } });
+		const body = JSON.parse(String(init.body)) as { params?: { configuration?: { taskPushNotificationConfig?: { token?: string } } } };
+		const token = body.params?.configuration?.taskPushNotificationConfig?.token || "";
+		const pend = await db.prepare("SELECT push_token_hash FROM outbound WHERE task_id LIKE 'pend.%'").all() as { results: { push_token_hash?: string }[] };
+		assert.equal(pend.results.length, 1);
+		assert.equal(pend.results[0]?.push_token_hash, await sha256(token));
+		if (mode === "push-then-throw") {
+			const push = await dispatch(new Request("https://owner.example.net/push", {
+				method: "POST",
+				headers: { "content-type": "application/json", "x-a2a-notification-token": token },
+				body: JSON.stringify({ message: { taskId: "task-kept", contextId: "ctx-kept", role: "ROLE_AGENT", parts: [{ text: "kept reply" }] } }),
+			}), ctx, ectx as never);
+			assert.equal(push.status, 200);
+		}
+		throw new Error("peer down");
+	}) as typeof fetch;
+	t.after(() => { globalThis.fetch = orig; });
+	const synced = await owner(ctx, "PUT", "/owner/outbound-peers/ada", { url: "https://ada.example.net" });
+	assert.equal(synced.status, 200, synced.text);
+
+	const failed = await owner(ctx, "POST", "/owner/mcp/send", { to: "ada", text: "hello", contextId: "ctx-fail" });
+	assert.equal((failed.data as SendBody).isError, true, failed.text);
+	const gone = await db.prepare("SELECT task_id FROM outbound").all() as { results: unknown[] };
+	assert.equal(gone.results.length, 0);
+
+	mode = "push-then-throw";
+	const raced = await owner(ctx, "POST", "/owner/mcp/send", { to: "ada", text: "hello", contextId: "ctx-kept" });
+	assert.equal((raced.data as SendBody).isError, true, raced.text);
+	const kept = await db.prepare("SELECT task_id, updates_json FROM outbound").all() as { results: { task_id?: string; updates_json?: string }[] };
+	assert.equal(kept.results.length, 1);
+	assert.equal(kept.results[0]?.task_id, "task-kept");
+	assert.match(String(kept.results[0]?.updates_json), /kept reply/);
+	const history = await owner(ctx, "GET", "/owner/history/ctx-kept");
+	assert.equal((history.data as Hist[]).some((r) => r.event === "push" && r.text === "kept reply"), true, history.text);
+});
+
+test("message and artifactUpdate pushes supply inbox text", async () => {
+	const { db, ctx } = single("https://owner.example.net");
+	const cases = [
+		{ id: "t-msg", context: "ctx-msg", token: "tok-msg", text: "from message", state: null as string | null, body: { message: { taskId: "t-msg", contextId: "ctx-msg", role: "ROLE_AGENT", parts: [{ text: "from message" }] } } },
+		{ id: "t-art", context: "ctx-art", token: "tok-art", text: "from artifact", state: null, body: { artifactUpdate: { taskId: "t-art", contextId: "ctx-art", artifact: { artifactId: "a1", parts: [{ text: "from artifact" }] } } } },
+		{ id: "t-raw", context: "ctx-raw", token: "tok-raw", text: "raw artifact", state: null, body: { kind: "artifact-update", taskId: "t-raw", contextId: "ctx-raw", artifact: { artifactId: "a2", parts: [{ kind: "text", text: "raw artifact" }] } } },
+		{ id: "t-st", context: "ctx-st", token: "tok-st", text: "from status", state: "completed", body: { statusUpdate: { taskId: "t-st", contextId: "ctx-st", status: { state: "TASK_STATE_COMPLETED", message: { parts: [{ text: "from status" }] } } } } },
+	];
+	for (const c of cases) {
+		await db.prepare(
+			`INSERT INTO outbound (task_id, context_id, peer, endpoint, protocol, push_token_hash, sent_at, updates_json, updates_seen)
+			 VALUES (?, ?, 'ada', 'https://ada.example.net/', '1.0', ?, ?, '[]', 0)`,
+		).bind(c.id, c.context, await sha256(c.token), `2026-01-01T00:00:0${cases.indexOf(c)}.000Z`).run();
+		const push = await dispatch(new Request("https://owner.example.net/push", {
+			method: "POST",
+			headers: { "content-type": "application/json", "x-a2a-notification-token": c.token },
+			body: JSON.stringify(c.body),
+		}), ctx, ectx as never);
+		assert.equal(push.status, 200, await push.clone().text());
+	}
+	const inbox = await owner(ctx, "GET", "/owner/inbox");
+	assert.equal(inbox.status, 200, inbox.text);
+	for (const c of cases) {
+		const row = (inbox.data as Row[]).find((r) => r.taskId === c.id);
+		assert.ok(row, inbox.text);
+		assert.equal(row.kind, "outbound");
+		assert.equal(row.text, c.text);
+		assert.equal(row.state, c.state);
+		const history = await owner(ctx, "GET", `/owner/history/${c.context}`);
+		assert.equal((history.data as Hist[]).some((r) => r.event === "push" && r.text === c.text && r.state === c.state), true, history.text);
+	}
+});