a2a-exposed 0.8.34 → 0.8.35

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "a2a-exposed",
-	"version": "0.8.34",
+	"version": "0.8.35",
 	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: a Cloudflare Worker, a wake webhook, or scheduled checks",
 	"type": "module",
 	"bin": {

package/worker/src/hosted.ts

@@ -163,9 +163,6 @@ export class TenantStore extends DurableObject<WorkerBindings> {
 		// config_json is ignored, and a blob that cannot be opened leaves those fields unset.
 		if (row.secretsEnc) {
 			const opened = await openWakeSecrets(parsed.secretsKey || "", row.tenantId, row.secretsEnc);
-			if (!opened) {
-				console.log(JSON.stringify({ ts: new Date().toISOString(), event: "wake_secrets_unreadable", tenant: row.tenantId }));
-			}
 			for (const key of WAKE_SECRET_KEYS) {
 				const value = opened?.[key];
 				if (value) config[key] = value;

package/worker/src/index.ts

@@ -1233,14 +1233,21 @@ async function withMovedHeader(ctx: TenantContext, res: Response): Promise<Respo
 	return new Response(res.body, { status: res.status, statusText: res.statusText, headers });
 }
 
+/** Every hosted credential sealed by peerKey must retain the previous key during rotation. */
+async function openPeerSecret(ctx: TenantContext, aad: string, sealed: string): Promise<string | null> {
+	for (const key of await ctx.peerReadKeys()) {
+		const opened = await M.openPeerTokenWithKey(key, aad, sealed);
+		if (opened !== null) return opened;
+	}
+	return null;
+}
+
 type PairingIdentity = { publicKey: string; privateKey: string };
 
 async function readIdentity(ctx: TenantContext): Promise<PairingIdentity | null | "unreadable"> {
 	const row: Json = await ctx.DB.prepare("SELECT value FROM settings WHERE key = ?").bind(Addr.IDENTITY_SETTING).first();
 	if (!row?.value) return null;
-	const key = await ctx.peerKey();
-	if (!key) return "unreadable";
-	const opened = await M.openPeerTokenWithKey(key, Addr.IDENTITY_AAD, row.value);
+	const opened = await openPeerSecret(ctx, Addr.IDENTITY_AAD, row.value);
 	if (!opened) return "unreadable";
 	try {
 		const parsed = JSON.parse(opened);
@@ -1411,8 +1418,7 @@ async function planReverse(ctx: TenantContext, alias: string): Promise<{ kind: "
 async function openReverse(ctx: TenantContext, label: string): Promise<string | null> {
 	const row: Json = await ctx.DB.prepare("SELECT token_enc, source, revoked_at FROM peers WHERE label = ?").bind(label).first();
 	if (!row || row.revoked_at || row.source !== "reverse" || !row.token_enc) return null;
-	const key = await ctx.peerKey();
-	return key ? await M.openPeerTokenWithKey(key, label, row.token_enc) : null;
+	return openPeerSecret(ctx, label, row.token_enc);
 }
 
 async function storeReverse(ctx: TenantContext, label: string, token: string, clientName: string, reissue = false): Promise<void> {
@@ -1544,8 +1550,7 @@ async function replyPeer(ctx: TenantContext, label: string): Promise<{ alias: st
 		 WHERE o.alias = ? AND o.token_enc IS NOT NULL AND p.revoked_at IS NULL`,
 	).bind(label).first();
 	if (!row) return null;
-	const key = await ctx.peerKey();
-	const token = key ? await M.openPeerTokenWithKey(key, row.alias, row.token_enc) : null;
+	const token = await openPeerSecret(ctx, row.alias, row.token_enc);
 	return token ? { alias: row.alias, url: row.url, token, identityKey: Addr.cleanPublicKey(row.identity_key), announced: row.source === "announce" } : null;
 }
 
@@ -3533,8 +3538,7 @@ async function outboundPeer(ctx: TenantContext, alias: string): Promise<{ alias:
 	if (!r) throw new ToolError(`no peer "${alias}" synced to this A2A endpoint. On the machine with the CLI: ${cliCommand(ctx)} peers sync ${alias}`);
 	let token: string | null = null;
 	if (r.token_enc) {
-		const peerKey = await ctx.peerKey();
-		token = peerKey ? await M.openPeerTokenWithKey(peerKey, alias, r.token_enc) : null;
+		token = await openPeerSecret(ctx, alias, r.token_enc);
 		if (!token) throw new ToolError(`the stored token for "${alias}" can't be read (the owner token was rotated since it was synced): run ${cliCommand(ctx)} peers sync ${alias} again`);
 	}
 	return { alias, url: r.url, token };

package/worker/src/tenancy.ts

@@ -11,6 +11,7 @@
 // and an allowlist are all set (approval-oidc.ts).
 
 import * as A from "./a2a.ts";
+import { tenantSecretsMaterials } from "./wake-secrets.ts";
 
 /** Subset of D1 used by the handlers. A Durable Object adapter satisfies the same shape. */
 export interface SqlDb {
@@ -489,10 +490,20 @@ export class TenantContext implements ConfigFields {
 		return this.#peerKey;
 	}
 
+	/** Read-only keys for hosted outbound tokens during rotation; self-host keeps OWNER_TOKEN semantics. */
+	async peerReadKeys(): Promise<CryptoKey[]> {
+		const active = await this.peerKey();
+		if (!active) return [];
+		if (this.mode === "single") return [active];
+		const previous = tenantSecretsMaterials(this.#secretsKey || "").slice(1);
+		return [active, ...await Promise.all(previous.map((material) => derivePeerKey(material, peerKeyInfoForTenant(this.id))))];
+	}
+
 	async #derivePeerKey(): Promise<CryptoKey | null> {
 		if (this.mode === "single") return this.#ownerToken ? derivePeerKey(this.#ownerToken) : null;
 		if (!this.#secretsKey || !this.id) return null;
-		return derivePeerKey(this.#secretsKey, peerKeyInfoForTenant(this.id));
+		const material = tenantSecretsMaterials(this.#secretsKey)[0];
+		return material ? derivePeerKey(material, peerKeyInfoForTenant(this.id)) : null;
 	}
 }
 

package/worker/src/version.ts

@@ -1,2 +1,2 @@
 /** Inbox build. Keep this equal to `version` in cli/package.json. */
-export const VERSION = "0.8.34";
+export const VERSION = "0.8.35";

package/worker/src/wake-secrets.ts

@@ -36,8 +36,47 @@ export const MAX_WAKE_PLAIN = (() => {
 	return n;
 })();
 
-/** `v1.` + base64(12-byte iv) + `.` + base64(utf-8 plaintext + 16-byte tag). */
-export const MAX_WAKE_SEALED = 3 + 16 + 1 + Math.ceil((MAX_WAKE_PLAIN * 3 + 16) * 4 / 3);
+/** Longest envelope: `v2.<64-char kid>.<iv>.<ciphertext>`. */
+export const MAX_WAKE_SEALED = 3 + 64 + 1 + 16 + 1 + Math.ceil((MAX_WAKE_PLAIN * 3 + 16) * 4 / 3);
+
+/** A bounded keyring lives in the existing secret binding, never in public config. */
+export interface TenantSecretsKeyring {
+	active: string;
+	keys: Record<string, string>;
+	legacy: boolean;
+}
+
+/** Raw keys preserve v1 writes for a reader-first rollout. JSON keyrings enable v2 writes. */
+export function tenantSecretsKeyring(input: string): TenantSecretsKeyring | null {
+	if (!input) return null;
+	if (!input.trimStart().startsWith("{")) return { active: "", keys: { "": input }, legacy: true };
+	if (input.length > 65536) return null;
+	try {
+		const value = JSON.parse(input);
+		if (!value || value.v !== 2 || typeof value.active !== "string" ||
+			!value.keys || typeof value.keys !== "object" || Array.isArray(value.keys) ||
+			Object.keys(value).some((name) => !["v", "active", "keys"].includes(name))) return null;
+		const entries = Object.entries(value.keys);
+		if (entries.length < 1 || entries.length > 2 || !Object.hasOwn(value.keys, value.active)) return null;
+		for (const [kid, key] of entries) {
+			if (!/^[A-Za-z0-9_-]{1,64}$/.test(kid) || typeof key !== "string" || !key.trim() || key.length > 4096) return null;
+		}
+		return { active: value.active, keys: value.keys, legacy: false };
+	} catch { return null; }
+}
+
+/** Current material first, then the single read-only rotation key. No caller may log these values. */
+export function tenantSecretsMaterials(input: string): string[] {
+	const ring = tenantSecretsKeyring(input);
+	if (!ring) return [];
+	return [ring.keys[ring.active], ...Object.entries(ring.keys).filter(([kid]) => kid !== ring.active).map(([, key]) => key)];
+}
+
+function unreadable(): null {
+	// Only a fixed event: ciphertext, key ids, credentials and tenant identifiers never enter logs.
+	console.error(JSON.stringify({ event: "wake_secrets_unreadable", level: "error" }));
+	return null;
+}
 
 function b64(bytes: Uint8Array): string {
 	let raw = "";
@@ -77,21 +116,24 @@ function payloadOf(secrets: WakeSecrets): Record<string, string> | null {
 	return payload;
 }
 
-/** `v1.<iv>.<ciphertext>`, or null when the key or a value is unusable. */
+/** `v2.<kid>.<iv>.<ciphertext>` for keyrings; raw keys keep v1 writes until rollout completes. */
 export async function sealWakeSecrets(ikm: string, tenantId: string, secrets: WakeSecrets): Promise<string | null> {
-	const key = await derive(ikm, tenantId);
+	const ring = tenantSecretsKeyring(ikm);
+	const key = ring ? await derive(ring.keys[ring.active], tenantId) : null;
 	const payload = payloadOf(secrets);
 	if (!key || !payload) return null;
 	const json = JSON.stringify(payload);
 	const encoded = new TextEncoder().encode(json);
 	if (json.length > MAX_WAKE_PLAIN || encoded.length > MAX_WAKE_PLAIN * 3) return null;
+	const prefix = ring!.legacy ? "v1" : `v2.${ring!.active}`;
+	const aad = ring!.legacy ? tenantId : `${prefix}\0${tenantId}`;
 	const iv = crypto.getRandomValues(new Uint8Array(12));
 	const ct = new Uint8Array(await crypto.subtle.encrypt(
-		{ name: "AES-GCM", iv, additionalData: new TextEncoder().encode(tenantId) },
+		{ name: "AES-GCM", iv, additionalData: new TextEncoder().encode(aad) },
 		key,
 		encoded,
 	));
-	const sealed = `v1.${b64(iv)}.${b64(ct)}`;
+	const sealed = `${prefix}.${b64(iv)}.${b64(ct)}`;
 	return sealed.length <= MAX_WAKE_SEALED ? sealed : null;
 }
 
@@ -101,28 +143,47 @@ export async function sealWakeSecrets(ikm: string, tenantId: string, secrets: Wa
  */
 export async function openWakeSecrets(ikm: string, tenantId: string, sealed: string | null | undefined): Promise<WakeSecrets | null> {
 	if (sealed == null || sealed === "") return {};
-	if (sealed.length > MAX_WAKE_SEALED) return null;
-	const key = await derive(ikm, tenantId);
-	if (!key) return null;
-	const [version, iv, ct, extra] = sealed.split(".");
-	if (version !== "v1" || !iv || !ct || extra !== undefined) return null;
-	try {
-		const plain = new TextDecoder().decode(await crypto.subtle.decrypt(
-			{ name: "AES-GCM", iv: unb64(iv), additionalData: new TextEncoder().encode(tenantId) },
-			key,
-			unb64(ct),
-		));
-		if (plain.length > MAX_WAKE_PLAIN) return null;
-		const parsed = JSON.parse(plain) as unknown;
-		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-		const out: WakeSecrets = {};
-		for (const name of WAKE_SECRET_KEYS) {
-			const value = (parsed as Record<string, unknown>)[name];
-			if (typeof value !== "string" || !value || value.length > MAX_WAKE_VALUE) continue;
-			out[name] = value;
-		}
-		return out;
-	} catch {
-		return null;
+	if (typeof sealed !== "string" || sealed.length > MAX_WAKE_SEALED) return unreadable();
+	const ring = tenantSecretsKeyring(ikm);
+	if (!ring || !tenantId) return unreadable();
+	const parts = sealed.split(".");
+	const version = parts[0];
+	const kid = version === "v2" ? parts[1] : "";
+	if (version !== "v1" && version !== "v2") return unreadable();
+	if (parts.length !== (version === "v2" ? 4 : 3)) return unreadable();
+	const [iv, ct] = parts.slice(version === "v2" ? 2 : 1);
+	if (!iv || !ct || (version === "v2" && (ring.legacy || !Object.hasOwn(ring.keys, kid)))) return unreadable();
+	const materials = version === "v2" ? [ring.keys[kid]] : tenantSecretsMaterials(ikm);
+	const aad = version === "v2" ? `v2.${kid}\0${tenantId}` : tenantId;
+	for (const material of materials) {
+		try {
+			const key = await derive(material, tenantId);
+			if (!key) continue;
+			const ivBytes = unb64(iv);
+			if (ivBytes.length !== 12) return unreadable();
+			const plain = new TextDecoder().decode(await crypto.subtle.decrypt(
+				{ name: "AES-GCM", iv: ivBytes, additionalData: new TextEncoder().encode(aad) },
+				key,
+				unb64(ct),
+			));
+			if (plain.length > MAX_WAKE_PLAIN) return unreadable();
+			const parsed = JSON.parse(plain) as unknown;
+			if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return unreadable();
+			const out: WakeSecrets = {};
+			for (const name of WAKE_SECRET_KEYS) {
+				const value = (parsed as Record<string, unknown>)[name];
+				if (typeof value !== "string" || !value || value.length > MAX_WAKE_VALUE) continue;
+				out[name] = value;
+			}
+			return out;
+		} catch { /* Try the previous key only for an unlabelled v1 blob. */ }
 	}
+	return unreadable();
+}
+
+/** Pure maintenance helper. The caller must CAS the original blob and queue the new tenant config. */
+export async function rewrapWakeSecrets(ikm: string, tenantId: string, sealed: string): Promise<string | null> {
+	if (!sealed) return null;
+	const secrets = await openWakeSecrets(ikm, tenantId, sealed);
+	return secrets ? sealWakeSecrets(ikm, tenantId, secrets) : null;
 }

package/worker/test/address.test.ts

@@ -7,6 +7,7 @@ import { dispatch, runOwnerRpc } from "../src/index.ts";
 import { redactExport, exportRows } from "../src/export.ts";
 import { hostedTenantContext, type DoNamespace, type KvNamespace, type TenantContext, type WorkerBindings } from "../src/tenancy.ts";
 import { d1 } from "./d1.ts";
+import { openPeerTokenWithKey } from "../src/mcp.ts";
 
 const MIGRATIONS = new URL("../migrations/", import.meta.url);
 const ectx = { waitUntil(p: Promise<unknown>) { p.catch(() => {}); }, passThroughOnException() {} };
@@ -70,7 +71,14 @@ async function world(t: { after: (fn: () => void) => void }) {
 	};
 	const owner = (ctx: TenantContext, accountId: string, method: string, path: string, body?: unknown) =>
 		runOwnerRpc(ctx, ectx as never, { accountId, method, path, ...(body === undefined ? {} : { body }) });
-	return { alice, bob, carol, call, owner };
+	const rotate = async (agent: typeof alice, secretsKey: string) => {
+		agent.ctx = hostedTenantContext({ ...env, TENANT_SECRETS_KEY: secretsKey }, {
+			id: agent.ctx.id, db: agent.db, publicUrl: agent.ctx.PUBLIC_URL,
+			ownerTokenHash: await sha256(agent.ownerToken), status: "active", config: { AGENT_NAME: "fixture" },
+		});
+		byId.set(agent.ctx.id, agent.ctx);
+	};
+	return { alice, bob, carol, call, owner, rotate };
 }
 
 async function pair(bob: { ctx: TenantContext; ownerToken: string }, call: (ctx: TenantContext, path: string, init?: RequestInit) => Promise<{ status: number; data: any }>, identity?: string) {
@@ -474,3 +482,53 @@ test("export omits the sealed pairing identity and a stored return token", async
 	assert.equal(JSON.stringify(redacted).includes(ident.privateKey), false);
 	assert.equal(JSON.stringify(redacted).includes("sealed-return"), false);
 });
+
+
+test("hosted key rotation preserves identity proofs, reverse tokens and direct replies", async (t) => {
+	const { alice, carol, call, owner, rotate } = await world(t as never);
+	const ident = await Addr.generateIdentity();
+	const putIdentity = () => call(alice.ctx, "/owner/identity", {
+		method: "PUT", headers: { authorization: `Bearer ${alice.ownerToken}`, "content-type": "application/json" },
+		body: JSON.stringify(ident),
+	});
+	assert.equal((await putIdentity()).status, 200);
+	const paired = await pair(carol, call, ident.publicKey);
+	assert.equal((await owner(alice.ctx, "acct-alice", "PUT", `/owner/outbound-peers/${paired.label}`, { url: carol.ctx.PUBLIC_URL, token: paired.access })).status, 200);
+	const announce = () => owner(alice.ctx, "acct-alice", "POST", "/owner/peers/announce", { to: paired.label });
+	const firstAnnouncement = await announce();
+	assert.equal(firstAnnouncement.body.results[0].status, "updated", JSON.stringify(firstAnnouncement.body));
+	const reverseBefore = await alice.db.prepare("SELECT token_hash, token_enc FROM peers WHERE label = ? AND source = 'reverse'").bind(paired.label).first() as { token_hash: string; token_enc: string };
+	assert.ok(reverseBefore.token_enc);
+	const identityBefore = await alice.db.prepare("SELECT value FROM settings WHERE key = ?").bind(Addr.IDENTITY_SETTING).first() as { value: string };
+	const ring = JSON.stringify({ v: 2, active: "current", keys: { previous: "platform-key", current: "new-platform-key" } });
+	await rotate(alice, ring);
+	await rotate(carol, ring);
+	const cardUrl = Addr.cardUrlFor(alice.ctx.PUBLIC_URL);
+	const card = await call(alice.ctx, "/.well-known/agent-card.json");
+	assert.equal(await Addr.cardProves(card.data, ident.publicKey, cardUrl), true, "the stored old-key identity still signs the card");
+	assert.deepEqual(await alice.db.prepare("SELECT value FROM settings WHERE key = ?").bind(Addr.IDENTITY_SETTING).first(), identityBefore, "a public read never rewrites identity storage");
+	const taskId = await send(carol.ctx, paired.access, "rotation question", "ctx-rotation");
+	const reply = await owner(carol.ctx, "acct-carol", "POST", "/owner/mcp/reply", { taskId, text: "rotation answer", state: "completed" });
+	assert.equal(reply.body.structuredContent.status, "delivered", JSON.stringify(reply.body));
+	assert.equal((await announce()).body.results[0].status, "updated", "the old-key identity and outbound token remain usable");
+	const reverseAfter = await alice.db.prepare("SELECT token_hash, token_enc FROM peers WHERE label = ? AND source = 'reverse'").bind(paired.label).first() as typeof reverseBefore;
+	assert.equal(reverseAfter.token_hash, reverseBefore.token_hash, "rotation must preserve the existing return token");
+	assert.notEqual(reverseAfter.token_enc, reverseBefore.token_enc);
+	assert.ok(await openPeerTokenWithKey((await alice.ctx.peerKey())!, paired.label, reverseAfter.token_enc), "authorized announcement reseals the same reverse token with the active key");
+	// Existing owner-only identity installation reseals the SAME validated identity; it never regenerates it.
+	const unauthorized = await call(alice.ctx, "/owner/identity", { method: "PUT", headers: { "content-type": "application/json" }, body: JSON.stringify(ident) });
+	assert.equal(unauthorized.status, 401);
+	const resealed = await putIdentity();
+	assert.equal(resealed.status, 200);
+	assert.equal(resealed.data.publicKey, ident.publicKey);
+	assert.equal(JSON.stringify(resealed.data).includes(ident.privateKey), false);
+	const onlyCurrent = JSON.stringify({ v: 2, active: "current", keys: { current: "new-platform-key" } });
+	await rotate(alice, onlyCurrent);
+	const retiredCard = await call(alice.ctx, "/.well-known/agent-card.json");
+	assert.equal(await Addr.cardProves(retiredCard.data, ident.publicKey, cardUrl), true, "owner reseal keeps the identity readable after retirement");
+	const identityAfter = await alice.db.prepare("SELECT value FROM settings WHERE key = ?").bind(Addr.IDENTITY_SETTING).first() as { value: string };
+	assert.notEqual(identityAfter.value, identityBefore.value);
+	const other = await Addr.generateIdentity();
+	const replacement = await call(alice.ctx, "/owner/identity", { method: "PUT", headers: { authorization: `Bearer ${alice.ownerToken}`, "content-type": "application/json" }, body: JSON.stringify(other) });
+	assert.equal(replacement.status, 409, "rotation never authorizes replacing the identity");
+});

package/worker/test/hosted.test.ts

@@ -933,8 +933,10 @@ test("self-host workerd: human mode owner token approves, the device poll return
 
 test("sealed upstream and wake Access credentials reach only their tenant context in workerd", async (t) => {
 	const received: { origin: string; bearer: string | null; id: string | null; secret: string | null }[] = [];
+	const keys = { previous: "platform-secret", current: "next-platform-secret" };
+	const keyring = (active: string) => JSON.stringify({ v: 2, active, keys });
 	const mf = await start({
-		bindings: { TENANCY: "host", TENANT_DOMAIN: "example.com", TENANT_SECRETS_KEY: "platform-secret" },
+		bindings: { TENANCY: "host", TENANT_DOMAIN: "example.com", TENANT_SECRETS_KEY: keyring("current") },
 		durableObjects: { TENANT_DO: { className: "TenantStore", useSQLite: true } },
 		outboundService: async (request: Request) => {
 			received.push({ origin: new URL(request.url).origin, bearer: request.headers.get("authorization"), id: request.headers.get("cf-access-client-id"), secret: request.headers.get("cf-access-client-secret") });
@@ -966,9 +968,22 @@ test("sealed upstream and wake Access credentials reach only their tenant contex
 	assert.equal(preview.status, 200);
 	assert.equal((preview.body as { hasAccessServiceToken: boolean }).hasAccessServiceToken, true);
 	for (const value of Object.values(secrets)) assert.equal(JSON.stringify([facade.body, preview.body]).includes(value), false);
+	let version = 1;
+	for (const active of ["previous", "current"]) {
+		const v2 = await sealWakeSecrets(keyring(active), "sealed-tenant", secrets);
+		assert.ok(v2?.startsWith(`v2.${active}.`));
+		assert.equal((await push(++version, v2)).applied, true);
+		const facadeV2 = await stub.owner({ accountId: "dummy-owner", method: "GET", path: "/owner/facade" });
+		assert.equal((facadeV2.body as { hasUpstreamToken: boolean }).hasUpstreamToken, true);
+		assert.equal(received.at(-1)?.bearer, "Bearer dummy-bearer");
+		const wakeV2 = await stub.owner({ accountId: "dummy-owner", method: "GET", path: "/owner/wake/preview" });
+		assert.equal((wakeV2.body as { hasAccessServiceToken: boolean }).hasAccessServiceToken, true);
+		for (const value of Object.values(secrets)) assert.equal(JSON.stringify([facadeV2.body, wakeV2.body]).includes(value), false);
+	}
+
 	const otherTenantBlob = await sealWakeSecrets("platform-secret", "another-tenant", secrets);
 	assert.ok(otherTenantBlob);
-	assert.equal((await push(2, otherTenantBlob)).applied, true);
+	assert.equal((await push(++version, otherTenantBlob)).applied, true);
 	const rejected = await stub.owner({ accountId: "dummy-owner", method: "GET", path: "/owner/facade" });
 	assert.equal((rejected.body as { hasUpstreamToken: boolean }).hasUpstreamToken, false);
 	assert.equal((rejected.body as { hasUpstreamAccessServiceToken: boolean }).hasUpstreamAccessServiceToken, false);

package/worker/test/owner-mcp.test.ts

@@ -95,6 +95,17 @@ test("hosted control plane send, reply, and mark_working", async (t) => {
 	assert.equal(viaHttp.text.includes("tok-alpha"), false);
 	assert.equal(peerCalls.at(-1)!.body.params.message.parts[0].text, "from the owner token");
 
+	// A hosted rotation keeps stored outbound tokens readable through the actual owner send path.
+	const rotating = hostedTenantContext({ ...env, TENANT_SECRETS_KEY: JSON.stringify({
+		v: 2, active: "next", keys: { old: "platform-key", next: "next-platform-key" },
+	}) }, { id: "ten_carol", db: DB, publicUrl: BASE, ownerTokenHash: hash, status: "active" });
+	const afterRotation = await runOwnerRpc(rotating, ectx as any, {
+		accountId: "acct_carol", method: "POST", path: "/owner/mcp/send", body: { to: "alpha", text: "after rotation" },
+	});
+	assert.equal(afterRotation.status, 200);
+	assert.equal((afterRotation.body as any).isError, false, JSON.stringify(afterRotation.body));
+	assert.equal(peerCalls.at(-1)!.auth, "Bearer tok-alpha");
+
 	const withBody = await runOwnerRpc(ctx, ectx as any, { accountId: "acct_carol", method: "GET", path: "/owner/peers", body: { label: "bob" } });
 	assert.equal(withBody.status, 400);
 	assert.equal((withBody.body as { error?: string }).error, "this call takes no body");

package/worker/test/tenancy.test.ts

@@ -268,3 +268,20 @@ test("fetch path: gates set or unset, the self-host Worker still answers from OW
 	const no = await call({ ...base, ...gates }, "/owner/inbox", { authorization: "Bearer platform-key" });
 	assert.equal(no.status, 401);
 });
+
+test("hosted peer token keys follow the active ring key and keep the previous key for reads", async () => {
+	const make = (key: string, id = "ten_a") => hostedTenantContext(selfEnv({ TENANT_SECRETS_KEY: key }), { id, db: dummy, publicUrl: BASE });
+	const old = make("old-platform-key");
+	const ring = JSON.stringify({ v: 2, active: "current", keys: { previous: "old-platform-key", current: "new-platform-key" } });
+	const rotating = make(ring);
+	const oldToken = await sealPeerTokenWithKey((await old.peerKey())!, "alpha", "fixture-old-token");
+	const keys = await rotating.peerReadKeys();
+	assert.equal(keys.length, 2);
+	assert.equal(await openPeerTokenWithKey(keys[0], "alpha", oldToken), null);
+	assert.equal(await openPeerTokenWithKey(keys[1], "alpha", oldToken), "fixture-old-token");
+	const newToken = await sealPeerTokenWithKey((await rotating.peerKey())!, "alpha", "fixture-new-token");
+	assert.equal(await openPeerTokenWithKey((await make("new-platform-key").peerKey())!, "alpha", newToken), "fixture-new-token");
+	for (const key of await make(ring, "ten_b").peerReadKeys()) assert.equal(await openPeerTokenWithKey(key, "alpha", oldToken), null);
+	assert.deepEqual(await make('{"v":2}').peerReadKeys(), []);
+	assert.equal((await resolveTenant(selfEnv()).peerReadKeys()).length, 1);
+});