@voyantjs/workflows-orchestrator-cloudflare 0.107.4 → 0.107.6

package/dist/cf-container-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cf-container-runner.d.ts","sourceRoot":"","sources":["../src/cf-container-runner.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAoB,UAAU,EAAE,MAAM,6BAA6B,CAAA;AAE/E;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,QAAQ,IAAI,MAAM,CAAA;KAAE,CAAA;IAChD,GAAG,CAAC,EAAE,EAAE;QAAE,QAAQ,IAAI,MAAM,CAAA;KAAE,GAAG;QAAE,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;KAAE,CAAA;CAChF;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;;;;;OAMG;IACH,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,CAAA;IACjC;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;QACrB,KAAK,EAAE,MAAM,CAAA;QACb,UAAU,EAAE,MAAM,CAAA;QAClB,eAAe,EAAE,MAAM,CAAA;QACvB,SAAS,EAAE,MAAM,CAAA;QACjB,cAAc,EAAE,MAAM,CAAA;KACvB,KAAK,OAAO,CAAC,cAAc,CAAC,GAAG,cAAc,CAAA;IAC9C;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;OAIG;IACH,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;IACjD,kCAAkC;IAClC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/E;;;;;OAKG;IACH,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE;QACnB,KAAK,EAAE,MAAM,CAAA;QACb,UAAU,EAAE,MAAM,CAAA;QAClB,eAAe,EAAE,MAAM,CAAA;QACvB,MAAM,EAAE,MAAM,CAAA;QACd,OAAO,EAAE,MAAM,CAAA;KAChB,KAAK,MAAM,CAAA;CACb;AA2BD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,qBAAqB,GAAG,UAAU,CA2HnF"}
+{"version":3,"file":"cf-container-runner.d.ts","sourceRoot":"","sources":["../src/cf-container-runner.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAoB,UAAU,EAAE,MAAM,6BAA6B,CAAA;AAI/E;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,QAAQ,IAAI,MAAM,CAAA;KAAE,CAAA;IAChD,GAAG,CAAC,EAAE,EAAE;QAAE,QAAQ,IAAI,MAAM,CAAA;KAAE,GAAG;QAAE,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;KAAE,CAAA;CAChF;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;;;;;OAMG;IACH,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,CAAA;IACjC;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;QACrB,KAAK,EAAE,MAAM,CAAA;QACb,UAAU,EAAE,MAAM,CAAA;QAClB,eAAe,EAAE,MAAM,CAAA;QACvB,SAAS,EAAE,MAAM,CAAA;QACjB,cAAc,EAAE,MAAM,CAAA;KACvB,KAAK,OAAO,CAAC,cAAc,CAAC,GAAG,cAAc,CAAA;IAC9C;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;OAIG;IACH,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;IACjD,kCAAkC;IAClC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/E;;;;;OAKG;IACH,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE;QACnB,KAAK,EAAE,MAAM,CAAA;QACb,UAAU,EAAE,MAAM,CAAA;QAClB,eAAe,EAAE,MAAM,CAAA;QACvB,MAAM,EAAE,MAAM,CAAA;QACd,OAAO,EAAE,MAAM,CAAA;KAChB,KAAK,MAAM,CAAA;CACb;AA2BD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,qBAAqB,GAAG,UAAU,CAuInF"}

package/dist/cf-container-runner.js

@@ -23,6 +23,7 @@
 // `@voyantjs/workflows/handler`'s `executeWorkflowStep` with the
 // workflow registry already loaded. See
 // `apps/workflows-node-step-container/` for the reference image.
+const STEP_RESPONSE_AUTH_HEADER = "x-voyant-step-response-auth";
 /**
  * Build a `StepRunner` that dispatches each step invocation to a
  * Cloudflare Container in the given namespace.
@@ -124,6 +125,13 @@ export function createCfContainerStepRunner(deps) {
             });
             return failed(attempt, startedAt, "CONTAINER_HTTP_ERROR", new Error(`container returned HTTP ${response.status}: ${text}`));
         }
+        if (deps.sign) {
+            const signature = response.headers.get(STEP_RESPONSE_AUTH_HEADER);
+            const expected = await deps.sign(text);
+            if (!signature || !constantTimeEquals(signature, expected)) {
+                return failed(attempt, startedAt, "CONTAINER_RESPONSE_SIGNATURE_INVALID", new Error("container response signature is missing or invalid"));
+            }
+        }
         try {
             const entry = JSON.parse(text);
             // Trust the container's own timestamps; they reflect the actual
@@ -135,6 +143,14 @@ export function createCfContainerStepRunner(deps) {
         }
     };
 }
+function constantTimeEquals(a, b) {
+    const length = Math.max(a.length, b.length, 1);
+    let diff = a.length === b.length ? 0 : 1;
+    for (let i = 0; i < length; i++) {
+        diff |= (a.charCodeAt(i) | 0) ^ (b.charCodeAt(i) | 0);
+    }
+    return diff === 0;
+}
 function failed(attempt, startedAt, code, err) {
     const e = err instanceof Error ? err : new Error(String(err));
     return {

package/dist/cloudflare-edge-driver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflare-edge-driver.d.ts","sourceRoot":"","sources":["../src/cloudflare-edge-driver.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EACV,eAAe,EAOhB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EACV,aAAa,EAOd,MAAM,4BAA4B,CAAA;AAUnC,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,wBAAwB,CAAA;AAE/B,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAA;AAI7D,MAAM,WAAW,2BAA2B;IAC1C,uDAAuD;IACvD,qBAAqB,EAAE,0BAA0B,CAAA;IACjD,uFAAuF;IACvF,oBAAoB,CAAC,EAAE,0BAA0B,CAAA;IACjD,iDAAiD;IACjD,UAAU,EAAE,eAAe,CAAA;IAC3B;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,yEAAyE;IACzE,kBAAkB,CAAC,EAAE,eAAe,CAAA;IACpC,uFAAuF;IACvF,UAAU,CAAC,EAAE;QACX,QAAQ,EAAE,MAAM,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;QACjB,cAAc,EAAE,MAAM,CAAA;KACvB,CAAA;IACD,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,MAAM,CAAA;IAC1B,sEAAsE;IACtE,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CAChF;AAUD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,2BAA2B,GAAG,aAAa,CAqa3F"}
+{"version":3,"file":"cloudflare-edge-driver.d.ts","sourceRoot":"","sources":["../src/cloudflare-edge-driver.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACV,eAAe,EAOhB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EACV,aAAa,EAOd,MAAM,4BAA4B,CAAA;AAUnC,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,wBAAwB,CAAA;AAE/B,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAA;AAI7D,MAAM,WAAW,2BAA2B;IAC1C,uDAAuD;IACvD,qBAAqB,EAAE,0BAA0B,CAAA;IACjD,uFAAuF;IACvF,oBAAoB,CAAC,EAAE,0BAA0B,CAAA;IACjD,iDAAiD;IACjD,UAAU,EAAE,eAAe,CAAA;IAC3B;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,yEAAyE;IACzE,kBAAkB,CAAC,EAAE,eAAe,CAAA;IACpC,uFAAuF;IACvF,UAAU,CAAC,EAAE;QACX,QAAQ,EAAE,MAAM,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;QACjB,cAAc,EAAE,MAAM,CAAA;KACvB,CAAA;IACD,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,MAAM,CAAA;IAC1B,sEAAsE;IACtE,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CAChF;AAiED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,2BAA2B,GAAG,aAAa,CAqa3F"}

package/dist/cloudflare-edge-driver.js

@@ -1,4 +1,5 @@
 // Mode 1 driver — Cloudflare edge composition.
+// agent-quality: file-size exception -- Public edge driver factory currently owns manifest, trigger, event-ingest, concurrency, and admin wiring; split only with a dedicated driver-surface refactor.
 //
 // `createApp({ workflows: { driver: createCloudflareEdgeDriver({ ... }) } })`
 // is the entry point for any deployment that runs the orchestrator on
@@ -24,6 +25,42 @@ const DEFAULT_TENANT_META = {
     projectId: "default",
     organizationId: "default",
 };
+function serializeWorkflowManifest(manifest) {
+    return { ...manifest };
+}
+function deserializeWorkflowManifest(manifest) {
+    const { schemaVersion, projectId, versionId, builtAt, builderVersion, capabilities, workflows, eventFilters, bindings, environments, } = manifest;
+    if (schemaVersion !== 1 ||
+        typeof projectId !== "string" ||
+        typeof versionId !== "string" ||
+        typeof builtAt !== "number" ||
+        typeof builderVersion !== "string" ||
+        !isStringArray(capabilities) ||
+        !Array.isArray(workflows) ||
+        !Array.isArray(eventFilters) ||
+        !isRecord(bindings) ||
+        !isRecord(environments)) {
+        throw new Error("stored workflow manifest has an invalid shape");
+    }
+    return {
+        schemaVersion,
+        projectId,
+        versionId,
+        builtAt,
+        builderVersion,
+        capabilities,
+        workflows: workflows,
+        eventFilters: eventFilters,
+        bindings: bindings,
+        environments: environments,
+    };
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isStringArray(value) {
+    return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
 // ---- Public factory ----
 /**
  * Build the Cloudflare-edge driver factory. The returned `DriverFactory`
@@ -137,14 +174,14 @@ export function createCloudflareEdgeDriver(opts) {
             return manifestStore.registerManifest({
                 environment: args.environment,
                 versionId: args.manifest.versionId,
-                manifest: args.manifest,
+                manifest: serializeWorkflowManifest(args.manifest),
             });
         }
         async function getManifest(args) {
             const envelope = await manifestStore.getCurrent(args.environment);
             if (!envelope)
                 return null;
-            return envelope.manifest;
+            return deserializeWorkflowManifest(envelope.manifest);
         }
         async function trigger(workflow, input, triggerOpts) {
             assertNotShutdown();
@@ -192,7 +229,7 @@ export function createCloudflareEdgeDriver(opts) {
                     message: `No manifest is registered for environment "${args.environment}".`,
                 };
             }
-            const manifest = stored.manifest;
+            const manifest = deserializeWorkflowManifest(stored.manifest);
             const eventId = args.envelope.metadata?.eventId ?? (await deriveStableEventId(args.envelope));
             const routed = routeEvent({
                 manifest,

package/dist/event-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"event-handler.d.ts","sourceRoot":"","sources":["../src/event-handler.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAA;AAI7D,MAAM,WAAW,gBAAgB,CAAC,EAAE,GAAG,OAAO;IAC5C,sDAAsD;IACtD,aAAa,EAAE,eAAe,CAAA;IAC9B,6DAA6D;IAC7D,KAAK,EAAE,0BAA0B,CAAC,EAAE,CAAC,CAAA;IACrC,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,MAAM,CAAA;IAC1B,wBAAwB;IACxB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,sDAAsD;IACtD,UAAU,CAAC,EAAE;QACX,QAAQ,EAAE,MAAM,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;QACjB,cAAc,EAAE,MAAM,CAAA;QACtB,YAAY,CAAC,EAAE,MAAM,CAAA;KACtB,CAAA;IACD,uBAAuB;IACvB,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CAChF;AAqBD,wBAAsB,iBAAiB,CAAC,EAAE,EACxC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAC,GACzB,OAAO,CAAC,QAAQ,CAAC,CAqInB"}
+{"version":3,"file":"event-handler.d.ts","sourceRoot":"","sources":["../src/event-handler.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAA;AAuD7D,MAAM,WAAW,gBAAgB,CAAC,EAAE,GAAG,OAAO;IAC5C,sDAAsD;IACtD,aAAa,EAAE,eAAe,CAAA;IAC9B,6DAA6D;IAC7D,KAAK,EAAE,0BAA0B,CAAC,EAAE,CAAC,CAAA;IACrC,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,MAAM,CAAA;IAC1B,wBAAwB;IACxB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,sDAAsD;IACtD,UAAU,CAAC,EAAE;QACX,QAAQ,EAAE,MAAM,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;QACjB,cAAc,EAAE,MAAM,CAAA;QACtB,YAAY,CAAC,EAAE,MAAM,CAAA;KACtB,CAAA;IACD,uBAAuB;IACvB,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CAChF;AAqBD,wBAAsB,iBAAiB,CAAC,EAAE,EACxC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAC,GACzB,OAAO,CAAC,QAAQ,CAAC,CAqInB"}

package/dist/event-handler.js

@@ -14,6 +14,39 @@
 import { deriveStableEventId } from "@voyantjs/workflows/events";
 import { routeEvent } from "@voyantjs/workflows-orchestrator";
 const ALLOWED_ENVS = new Set(["production", "preview", "development"]);
+function deserializeWorkflowManifest(manifest) {
+    const { schemaVersion, projectId, versionId, builtAt, builderVersion, capabilities, workflows, eventFilters, bindings, environments, } = manifest;
+    if (schemaVersion !== 1 ||
+        typeof projectId !== "string" ||
+        typeof versionId !== "string" ||
+        typeof builtAt !== "number" ||
+        typeof builderVersion !== "string" ||
+        !isStringArray(capabilities) ||
+        !Array.isArray(workflows) ||
+        !Array.isArray(eventFilters) ||
+        !isRecord(bindings) ||
+        !isRecord(environments)) {
+        throw new Error("stored workflow manifest has an invalid shape");
+    }
+    return {
+        schemaVersion,
+        projectId,
+        versionId,
+        builtAt,
+        builderVersion,
+        capabilities,
+        workflows: workflows,
+        eventFilters: eventFilters,
+        bindings: bindings,
+        environments: environments,
+    };
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isStringArray(value) {
+    return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
 const DEFAULT_TENANT_META = {
     tenantId: "default",
     projectId: "default",
@@ -44,7 +77,7 @@ export async function handleIngestEvent(req, deps) {
             message: `No manifest is registered for environment "${body.environment}".`,
         });
     }
-    const manifest = manifestEnvelope.manifest;
+    const manifest = deserializeWorkflowManifest(manifestEnvelope.manifest);
     // Event id derivation — use the caller-stamped one when present, fall
     // back to a content-derived id so external callers without a forwarder
     // still get sensible idempotency.

package/dist/worker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAE7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAQrE;;;;GAIG;AACH,MAAM,WAAW,0BAA0B,CAAC,EAAE,GAAG,OAAO;IACtD,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,EAAE,CAAA;IAC5B,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG;QAAE,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;KAAE,CAAA;CACxD;AAED,MAAM,WAAW,eAAe,CAAC,EAAE,GAAG,OAAO;IAC3C,KAAK,EAAE,0BAA0B,CAAC,EAAE,CAAC,CAAA;IACrC;;;OAGG;IACH,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACtD,uBAAuB;IACvB,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/E,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,MAAM,CAAA;IAC1B,0CAA0C;IAC1C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,eAAe,CAAA;IAC/B;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,CAAA;IACzC;;;;;OAKG;IACH,UAAU,CAAC,EAAE;QACX,QAAQ,EAAE,MAAM,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;QACjB,cAAc,EAAE,MAAM,CAAA;QACtB,YAAY,CAAC,EAAE,MAAM,CAAA;KACtB,CAAA;CACF;AAED,wBAAsB,mBAAmB,CAAC,EAAE,EAC1C,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC,GACxB,OAAO,CAAC,QAAQ,CAAC,CA4OnB"}
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAE7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAQrE;;;;GAIG;AACH,MAAM,WAAW,0BAA0B,CAAC,EAAE,GAAG,OAAO;IACtD,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,EAAE,CAAA;IAC5B,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG;QAAE,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;KAAE,CAAA;CACxD;AAED,MAAM,WAAW,eAAe,CAAC,EAAE,GAAG,OAAO;IAC3C,KAAK,EAAE,0BAA0B,CAAC,EAAE,CAAC,CAAA;IACrC;;;OAGG;IACH,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACtD,uBAAuB;IACvB,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;IAC/E,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,MAAM,CAAA;IAC1B,0CAA0C;IAC1C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,eAAe,CAAA;IAC/B;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,CAAA;IACzC;;;;;OAKG;IACH,UAAU,CAAC,EAAE;QACX,QAAQ,EAAE,MAAM,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;QACjB,cAAc,EAAE,MAAM,CAAA;QACtB,YAAY,CAAC,EAAE,MAAM,CAAA;KACtB,CAAA;CACF;AAED,wBAAsB,mBAAmB,CAAC,EAAE,EAC1C,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC,GACxB,OAAO,CAAC,QAAQ,CAAC,CA4OnB"}

package/dist/worker.js

@@ -1,3 +1,4 @@
+// agent-quality: file-size exception -- owner: workflows-orchestrator-cloudflare; existing module stays co-located until a dedicated split preserves behavior and tests.
 // Public HTTP surface of the Cloudflare orchestrator. The outer
 // Worker receives a request, resolves the run DO by id (or creates
 // one for a new trigger), and forwards to the DO. This layer owns

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voyantjs/workflows-orchestrator-cloudflare",
-  "version": "0.107.4",
+  "version": "0.107.6",
   "description": "Cloudflare Worker + Durable Object adapter for @voyantjs/workflows-orchestrator. Dispatches workflow-step requests to tenant Workers via a Workers-for-Platforms dispatch namespace.",
   "license": "Apache-2.0",
   "repository": {
@@ -26,8 +26,8 @@
     "NOTICE"
   ],
   "dependencies": {
-    "@voyantjs/workflows-orchestrator": "^0.107.4",
-    "@voyantjs/workflows": "^0.107.4"
+    "@voyantjs/workflows-orchestrator": "^0.107.6",
+    "@voyantjs/workflows": "^0.107.6"
   },
   "devDependencies": {
     "@cloudflare/vitest-pool-workers": "^0.15.1",

package/src/__tests__/adapter-test-support.ts

@@ -0,0 +1,107 @@
+import { __resetRegistry } from "@voyantjs/workflows"
+import { handleStepRequest } from "@voyantjs/workflows/handler"
+import { beforeEach } from "vitest"
+import {
+  createServiceBindingDispatcher,
+  type DurableObjectNamespaceLike,
+  type DurableObjectStorageLike,
+  handleDurableObjectRequest,
+  type ServiceBindingLike,
+} from "../index.js"
+
+export interface AlarmTrackingStorage extends DurableObjectStorageLike {
+  _alarm: number | null
+  _alarmCalls: number
+  _deleteAlarmCalls: number
+}
+
+export function makeStorage(): AlarmTrackingStorage {
+  const map = new Map<string, unknown>()
+  const s: AlarmTrackingStorage = {
+    _alarm: null,
+    _alarmCalls: 0,
+    _deleteAlarmCalls: 0,
+    async get<T>(key: string): Promise<T | undefined> {
+      return map.get(key) as T | undefined
+    },
+    async put<T>(key: string, value: T): Promise<void> {
+      map.set(key, value)
+    },
+    async delete(key) {
+      return map.delete(key)
+    },
+    async list<T>(options = {}) {
+      const out = new Map<string, T>()
+      for (const [k, v] of map) {
+        if (options.prefix && !k.startsWith(options.prefix)) continue
+        out.set(k, v as T)
+        if (options.limit && out.size >= options.limit) break
+      }
+      return out
+    },
+    async getAlarm() {
+      return s._alarm
+    },
+    async setAlarm(wakeAt) {
+      s._alarm = wakeAt
+      s._alarmCalls += 1
+    },
+    async deleteAlarm() {
+      s._alarm = null
+      s._deleteAlarmCalls += 1
+    },
+  }
+  return s
+}
+
+export function inProcessBinding(): ServiceBindingLike {
+  return {
+    async fetch(req: Request): Promise<Response> {
+      const body = await req.json()
+      const out = await handleStepRequest(body)
+      return new Response(JSON.stringify(out.body), {
+        status: out.status,
+        headers: { "content-type": "application/json" },
+      })
+    },
+  }
+}
+
+export function inProcessRunDONamespace(): DurableObjectNamespaceLike<string> & {
+  _storages: Map<string, DurableObjectStorageLike>
+} {
+  const storages = new Map<string, DurableObjectStorageLike>()
+  const binding = inProcessBinding()
+  return {
+    _storages: storages,
+    idFromName(name) {
+      return name
+    },
+    get(id: string) {
+      let storage = storages.get(id)
+      if (!storage) {
+        storage = makeStorage()
+        storages.set(id, storage)
+      }
+      return {
+        async fetch(req: Request): Promise<Response> {
+          return handleDurableObjectRequest(req, {
+            storage: storage!,
+            dispatcher: createServiceBindingDispatcher({ binding }),
+          })
+        },
+      }
+    },
+  }
+}
+
+export const tenantMeta = {
+  tenantId: "tnt_t",
+  projectId: "prj_t",
+  organizationId: "org_t",
+  tenantScript: "tenant-worker-a",
+}
+
+beforeEach(() => {
+  __resetRegistry()
+})

package/src/cf-container-runner.ts

@@ -26,6 +26,8 @@
 
 import type { StepJournalEntry, StepRunner } from "@voyantjs/workflows/handler"
 
+const STEP_RESPONSE_AUTH_HEADER = "x-voyant-step-response-auth"
+
 /**
  * Minimal subset of `DurableObjectNamespace` that the runner actually
  * uses. Matches the shape exposed by `@cloudflare/containers`'
@@ -256,6 +258,18 @@ export function createCfContainerStepRunner(deps: CfContainerRunnerDeps): StepRu
         new Error(`container returned HTTP ${response.status}: ${text}`),
       )
     }
+    if (deps.sign) {
+      const signature = response.headers.get(STEP_RESPONSE_AUTH_HEADER)
+      const expected = await deps.sign(text)
+      if (!signature || !constantTimeEquals(signature, expected)) {
+        return failed(
+          attempt,
+          startedAt,
+          "CONTAINER_RESPONSE_SIGNATURE_INVALID",
+          new Error("container response signature is missing or invalid"),
+        )
+      }
+    }
     try {
       const entry = JSON.parse(text) as StepJournalEntry
       // Trust the container's own timestamps; they reflect the actual
@@ -272,6 +286,15 @@ export function createCfContainerStepRunner(deps: CfContainerRunnerDeps): StepRu
   }
 }
 
+function constantTimeEquals(a: string, b: string): boolean {
+  const length = Math.max(a.length, b.length, 1)
+  let diff = a.length === b.length ? 0 : 1
+  for (let i = 0; i < length; i++) {
+    diff |= (a.charCodeAt(i) | 0) ^ (b.charCodeAt(i) | 0)
+  }
+  return diff === 0
+}
+
 function failed(attempt: number, startedAt: number, code: string, err: unknown): StepJournalEntry {
   const e = err instanceof Error ? err : new Error(String(err))
   return {

package/src/cloudflare-edge-driver.ts

@@ -1,4 +1,5 @@
 // Mode 1 driver — Cloudflare edge composition.
+// agent-quality: file-size exception -- Public edge driver factory currently owns manifest, trigger, event-ingest, concurrency, and admin wiring; split only with a dedicated driver-surface refactor.
 //
 // `createApp({ workflows: { driver: createCloudflareEdgeDriver({ ... }) } })`
 // is the entry point for any deployment that runs the orchestrator on
@@ -91,6 +92,61 @@ const DEFAULT_TENANT_META = {
   organizationId: "default",
 }
 
+function serializeWorkflowManifest(manifest: WorkflowManifest): Record<string, unknown> {
+  return { ...manifest }
+}
+
+function deserializeWorkflowManifest(manifest: Record<string, unknown>): WorkflowManifest {
+  const {
+    schemaVersion,
+    projectId,
+    versionId,
+    builtAt,
+    builderVersion,
+    capabilities,
+    workflows,
+    eventFilters,
+    bindings,
+    environments,
+  } = manifest
+
+  if (
+    schemaVersion !== 1 ||
+    typeof projectId !== "string" ||
+    typeof versionId !== "string" ||
+    typeof builtAt !== "number" ||
+    typeof builderVersion !== "string" ||
+    !isStringArray(capabilities) ||
+    !Array.isArray(workflows) ||
+    !Array.isArray(eventFilters) ||
+    !isRecord(bindings) ||
+    !isRecord(environments)
+  ) {
+    throw new Error("stored workflow manifest has an invalid shape")
+  }
+
+  return {
+    schemaVersion,
+    projectId,
+    versionId,
+    builtAt,
+    builderVersion,
+    capabilities,
+    workflows: workflows as WorkflowManifest["workflows"],
+    eventFilters: eventFilters as WorkflowManifest["eventFilters"],
+    bindings: bindings as WorkflowManifest["bindings"],
+    environments: environments as WorkflowManifest["environments"],
+  }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+}
+
+function isStringArray(value: unknown): value is string[] {
+  return Array.isArray(value) && value.every((item) => typeof item === "string")
+}
+
 // ---- Public factory ----
 
 /**
@@ -251,7 +307,7 @@ export function createCloudflareEdgeDriver(opts: CloudflareEdgeDriverOptions): D
       return manifestStore.registerManifest({
         environment: args.environment,
         versionId: args.manifest.versionId,
-        manifest: args.manifest as unknown as Record<string, unknown>,
+        manifest: serializeWorkflowManifest(args.manifest),
       })
     }
 
@@ -260,7 +316,7 @@ export function createCloudflareEdgeDriver(opts: CloudflareEdgeDriverOptions): D
     }): Promise<WorkflowManifest | null> {
       const envelope = await manifestStore.getCurrent(args.environment)
       if (!envelope) return null
-      return envelope.manifest as unknown as WorkflowManifest
+      return deserializeWorkflowManifest(envelope.manifest)
     }
 
     async function trigger<TIn, TOut>(
@@ -327,7 +383,7 @@ export function createCloudflareEdgeDriver(opts: CloudflareEdgeDriverOptions): D
           message: `No manifest is registered for environment "${args.environment}".`,
         }
       }
-      const manifest = stored.manifest as unknown as WorkflowManifest
+      const manifest = deserializeWorkflowManifest(stored.manifest)
       const eventId = args.envelope.metadata?.eventId ?? (await deriveStableEventId(args.envelope))
       const routed = routeEvent({
         manifest,

package/src/event-handler.ts

@@ -21,6 +21,57 @@ import type { DurableObjectNamespaceLike } from "./worker.js"
 
 const ALLOWED_ENVS = new Set(["production", "preview", "development"])
 
+function deserializeWorkflowManifest(manifest: Record<string, unknown>): WorkflowManifest {
+  const {
+    schemaVersion,
+    projectId,
+    versionId,
+    builtAt,
+    builderVersion,
+    capabilities,
+    workflows,
+    eventFilters,
+    bindings,
+    environments,
+  } = manifest
+
+  if (
+    schemaVersion !== 1 ||
+    typeof projectId !== "string" ||
+    typeof versionId !== "string" ||
+    typeof builtAt !== "number" ||
+    typeof builderVersion !== "string" ||
+    !isStringArray(capabilities) ||
+    !Array.isArray(workflows) ||
+    !Array.isArray(eventFilters) ||
+    !isRecord(bindings) ||
+    !isRecord(environments)
+  ) {
+    throw new Error("stored workflow manifest has an invalid shape")
+  }
+
+  return {
+    schemaVersion,
+    projectId,
+    versionId,
+    builtAt,
+    builderVersion,
+    capabilities,
+    workflows: workflows as WorkflowManifest["workflows"],
+    eventFilters: eventFilters as WorkflowManifest["eventFilters"],
+    bindings: bindings as WorkflowManifest["bindings"],
+    environments: environments as WorkflowManifest["environments"],
+  }
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+}
+
+function isStringArray(value: unknown): value is string[] {
+  return Array.isArray(value) && value.every((item) => typeof item === "string")
+}
+
 export interface EventHandlerDeps<Id = unknown> {
   /** KV-backed manifest store (read-only path here). */
   manifestStore: CfManifestStore
@@ -87,7 +138,7 @@ export async function handleIngestEvent<Id>(
       message: `No manifest is registered for environment "${body.environment}".`,
     })
   }
-  const manifest = manifestEnvelope.manifest as unknown as WorkflowManifest
+  const manifest = deserializeWorkflowManifest(manifestEnvelope.manifest)
 
   // Event id derivation — use the caller-stamped one when present, fall
   // back to a content-derived id so external callers without a forwarder

package/src/worker.ts

@@ -1,3 +1,4 @@
+// agent-quality: file-size exception -- owner: workflows-orchestrator-cloudflare; existing module stays co-located until a dedicated split preserves behavior and tests.
 // Public HTTP surface of the Cloudflare orchestrator. The outer
 // Worker receives a request, resolves the run DO by id (or creates
 // one for a new trigger), and forwards to the DO. This layer owns