@voyantjs/workflows 0.107.5 → 0.107.6

package/dist/auth/index.d.ts

@@ -1,4 +1,20 @@
 export declare const AUTH_HEADER: "x-voyant-dispatch-auth";
+/**
+ * HMAC header carried on orchestrator → node-step-container dispatches
+ * (`POST /step`). Signed over the raw request body with the shared
+ * `VOYANT_WORKFLOW_STEP_AUTH_SECRET`. See `createCfContainerStepRunner`
+ * (signing side) and `apps/workflows-node-step-container` (verifying side).
+ */
+export declare const STEP_AUTH_HEADER: "x-voyant-step-auth";
+/**
+ * HMAC header returned by the node-step-container on successful `/step`
+ * responses. Signed over the raw JSON response body with the same
+ * `VOYANT_WORKFLOW_STEP_AUTH_SECRET` so the orchestrator can reject
+ * forged step journal entries before committing run state.
+ */
+export declare const STEP_RESPONSE_AUTH_HEADER: "x-voyant-step-response-auth";
+/** Parse a comma-separated token/origin list env var into trimmed, non-empty entries. */
+export declare function parseTokenList(raw: string | null | undefined): string[];
 /**
  * Returns a verifier that accepts `Authorization: Bearer <token>`
  * where `<token>` matches any of the `validTokens` (case-sensitive,
@@ -10,6 +26,58 @@ export declare const AUTH_HEADER: "x-voyant-dispatch-auth";
  * issue per-tenant, short-lived tokens from a control plane.
  */
 export declare function createBearerVerifier(validTokens: readonly string[]): (req: Request) => void;
+/**
+ * Error thrown by verifiers produced in this module. Carries an HTTP
+ * `status` + machine-readable `code` so HTTP surfaces
+ * (`handleWorkerRequest`, the node dashboard server, step handlers)
+ * can map auth failures to the right response instead of a blanket 401.
+ */
+export declare class RequestAuthError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message: string);
+}
+export type BearerAuthDecision = {
+    ok: true;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+    message: string;
+};
+export interface BearerAuthOptions {
+    /** Accepted bearer tokens. Empty/undefined = no auth configured. */
+    tokens?: readonly string[];
+    /**
+     * Explicit local-dev opt-out. When `true` AND no tokens are
+     * configured, requests are allowed through with a loud warning.
+     * When `false`/unset and no tokens are configured, every request is
+     * rejected with 503 `auth_not_configured` (fail closed).
+     */
+    allowUnauthenticated?: boolean;
+    /** Warning sink for the unauthenticated opt-out. Defaults to `console.warn`. */
+    warn?: (message: string) => void;
+}
+/**
+ * Build a transport-agnostic bearer authorizer from a raw
+ * `Authorization` header value. Fail-closed semantics:
+ *
+ *   - tokens configured     → exact (constant-time) Bearer match or 401
+ *   - no tokens + opt-out   → always allowed (warns loudly once, at creation)
+ *   - no tokens, no opt-out → always 503 `auth_not_configured`
+ */
+export declare function createBearerAuthorizer(opts: BearerAuthOptions): (authorizationHeader: string | null | undefined) => BearerAuthDecision;
+/**
+ * Resolve a `verifyRequest` hook (the dep consumed by
+ * `handleWorkerRequest` / `createStepHandler`) with fail-closed
+ * defaults — the missing-token case yields a verifier that rejects
+ * every request with a 503 `auth_not_configured` `RequestAuthError`
+ * instead of `undefined` (which would skip auth entirely).
+ *
+ * Returns `undefined` (auth skipped) ONLY when no tokens are
+ * configured AND `allowUnauthenticated` is explicitly set.
+ */
+export declare function resolveRequestVerifier(opts: BearerAuthOptions): ((req: Request) => void) | undefined;
 /** Returns a signer: `(body: string) => Promise<string>` (base64 HMAC-SHA256). */
 export declare function createHmacSigner(secret: string): Promise<(body: string) => Promise<string>>;
 /**
@@ -23,4 +91,35 @@ export declare function createHmacSigner(secret: string): Promise<(body: string)
  * passing in.
  */
 export declare function createHmacVerifier(secret: string): Promise<(req: Request) => Promise<void>>;
+/**
+ * Returns a verifier over a raw body string + detached base64 HMAC
+ * signature (the value of `STEP_AUTH_HEADER`). Suitable for servers
+ * that have already buffered the request body (e.g. the node step
+ * container). `crypto.subtle.verify` is constant-time; malformed
+ * base64 or a missing signature simply yields `false`.
+ */
+export declare function createHmacBodyVerifier(secret: string): Promise<(body: string, signatureBase64: string | null | undefined) => Promise<boolean>>;
+export type BundleUrlDecision = {
+    ok: true;
+} | {
+    ok: false;
+    message: string;
+};
+/**
+ * Build an origin allowlist check for caller-supplied `bundle.url`
+ * values (the node step container dynamically `import()`s the fetched
+ * bytes, so an unrestricted URL is remote-code-execution-adjacent —
+ * the SHA-256 hash pin is supplied by the same caller and is not a
+ * security control on its own).
+ *
+ *   - `allowedOrigins` set (e.g. from `VOYANT_BUNDLE_ALLOWED_ORIGINS`):
+ *     the URL's origin must match one of the entries exactly.
+ *     Invalid entries throw at creation time (misconfiguration should
+ *     fail loudly, not silently widen).
+ *   - unset/empty: only HTTPS URLs on `*.r2.cloudflarestorage.com`
+ *     are allowed — the production bundle source.
+ */
+export declare function createBundleUrlPolicy(opts?: {
+    allowedOrigins?: readonly string[];
+}): (url: string) => BundleUrlDecision;
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,WAAW,EAAG,wBAAiC,CAAA;AAE5D;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,CAiB3F;AAWD,kFAAkF;AAClF,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,CAMjG;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAmBjG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,WAAW,EAAG,wBAAiC,CAAA;AAE5D;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAG,oBAA6B,CAAA;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAG,6BAAsC,CAAA;AAE/E,yFAAyF;AACzF,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAKvE;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,CAiB3F;AAoBD;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;gBAET,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAM1D;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAEjE,MAAM,WAAW,iBAAiB;IAChC,oEAAoE;IACpE,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1B;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,gFAAgF;IAChF,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CACjC;AAQD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,iBAAiB,GACtB,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,KAAK,kBAAkB,CA8CxE;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,iBAAiB,GACtB,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,SAAS,CAatC;AAED,kFAAkF;AAClF,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,CAMjG;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAmBjG;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,CAYzF;AAID,MAAM,MAAM,iBAAiB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAW7E;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,CAAC,EAAE;IAC3C,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,iBAAiB,CAsCrC"}

package/dist/auth/index.js

@@ -22,6 +22,27 @@
 //   const verify = await createHmacVerifier(env.VOYANT_SIGNING_KEY);
 //   export default { fetch: createStepHandler({ verifyRequest: verify }) };
 export const AUTH_HEADER = "x-voyant-dispatch-auth";
+/**
+ * HMAC header carried on orchestrator → node-step-container dispatches
+ * (`POST /step`). Signed over the raw request body with the shared
+ * `VOYANT_WORKFLOW_STEP_AUTH_SECRET`. See `createCfContainerStepRunner`
+ * (signing side) and `apps/workflows-node-step-container` (verifying side).
+ */
+export const STEP_AUTH_HEADER = "x-voyant-step-auth";
+/**
+ * HMAC header returned by the node-step-container on successful `/step`
+ * responses. Signed over the raw JSON response body with the same
+ * `VOYANT_WORKFLOW_STEP_AUTH_SECRET` so the orchestrator can reject
+ * forged step journal entries before committing run state.
+ */
+export const STEP_RESPONSE_AUTH_HEADER = "x-voyant-step-response-auth";
+/** Parse a comma-separated token/origin list env var into trimmed, non-empty entries. */
+export function parseTokenList(raw) {
+    return (raw ?? "")
+        .split(",")
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+}
 /**
  * Returns a verifier that accepts `Authorization: Bearer <token>`
  * where `<token>` matches any of the `validTokens` (case-sensitive,
@@ -52,15 +73,123 @@ export function createBearerVerifier(validTokens) {
         throw new Error("bearer token does not match any configured value");
     };
 }
+/**
+ * Constant-time string comparison. Does NOT early-return on length
+ * mismatch: the loop always runs over the longer input (out-of-range
+ * `charCodeAt` is NaN, which coerces to 0 under bitwise ops), and a
+ * length mismatch only sets a diff bit. This avoids leaking how many
+ * leading characters of a secret matched, or whether the length matched.
+ */
 function constantTimeEquals(a, b) {
-    if (a.length !== b.length)
-        return false;
-    let diff = 0;
-    for (let i = 0; i < a.length; i++) {
-        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    const length = Math.max(a.length, b.length, 1);
+    let diff = a.length === b.length ? 0 : 1;
+    for (let i = 0; i < length; i++) {
+        diff |= (a.charCodeAt(i) | 0) ^ (b.charCodeAt(i) | 0);
     }
     return diff === 0;
 }
+// ---- Fail-closed bearer auth resolution ----
+/**
+ * Error thrown by verifiers produced in this module. Carries an HTTP
+ * `status` + machine-readable `code` so HTTP surfaces
+ * (`handleWorkerRequest`, the node dashboard server, step handlers)
+ * can map auth failures to the right response instead of a blanket 401.
+ */
+export class RequestAuthError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.name = "RequestAuthError";
+        this.status = status;
+        this.code = code;
+    }
+}
+const UNAUTHENTICATED_WARNING = "[voyant-workflows] AUTH DISABLED: no bearer tokens are configured and " +
+    "VOYANT_WORKFLOWS_ALLOW_UNAUTHENTICATED is set. Every caller can trigger, read, " +
+    "resume, and cancel workflow runs. This mode is for LOCAL DEVELOPMENT ONLY — " +
+    "configure VOYANT_API_TOKENS before deploying.";
+/**
+ * Build a transport-agnostic bearer authorizer from a raw
+ * `Authorization` header value. Fail-closed semantics:
+ *
+ *   - tokens configured     → exact (constant-time) Bearer match or 401
+ *   - no tokens + opt-out   → always allowed (warns loudly once, at creation)
+ *   - no tokens, no opt-out → always 503 `auth_not_configured`
+ */
+export function createBearerAuthorizer(opts) {
+    const tokens = (opts.tokens ?? []).filter((t) => t.length > 0);
+    if (tokens.length === 0) {
+        if (opts.allowUnauthenticated) {
+            ;
+            (opts.warn ?? console.warn)(UNAUTHENTICATED_WARNING);
+            return () => ({ ok: true });
+        }
+        return () => ({
+            ok: false,
+            status: 503,
+            error: "auth_not_configured",
+            message: "no bearer tokens are configured for this workflows API; set VOYANT_API_TOKENS " +
+                "(or pass tokens explicitly), or opt out for local development with " +
+                "VOYANT_WORKFLOWS_ALLOW_UNAUTHENTICATED=1",
+        });
+    }
+    return (header) => {
+        if (!header) {
+            return {
+                ok: false,
+                status: 401,
+                error: "unauthorized",
+                message: "missing Authorization header",
+            };
+        }
+        const match = /^Bearer (.+)$/.exec(header);
+        if (!match) {
+            return {
+                ok: false,
+                status: 401,
+                error: "unauthorized",
+                message: "Authorization header must use the Bearer scheme",
+            };
+        }
+        const presented = match[1];
+        for (const valid of tokens) {
+            if (constantTimeEquals(presented, valid))
+                return { ok: true };
+        }
+        return {
+            ok: false,
+            status: 401,
+            error: "unauthorized",
+            message: "bearer token does not match any configured value",
+        };
+    };
+}
+/**
+ * Resolve a `verifyRequest` hook (the dep consumed by
+ * `handleWorkerRequest` / `createStepHandler`) with fail-closed
+ * defaults — the missing-token case yields a verifier that rejects
+ * every request with a 503 `auth_not_configured` `RequestAuthError`
+ * instead of `undefined` (which would skip auth entirely).
+ *
+ * Returns `undefined` (auth skipped) ONLY when no tokens are
+ * configured AND `allowUnauthenticated` is explicitly set.
+ */
+export function resolveRequestVerifier(opts) {
+    const tokens = (opts.tokens ?? []).filter((t) => t.length > 0);
+    if (tokens.length === 0 && opts.allowUnauthenticated) {
+        ;
+        (opts.warn ?? console.warn)(UNAUTHENTICATED_WARNING);
+        return undefined;
+    }
+    const authorize = createBearerAuthorizer({ ...opts, allowUnauthenticated: false });
+    return (req) => {
+        const decision = authorize(req.headers.get("authorization"));
+        if (!decision.ok) {
+            throw new RequestAuthError(decision.status, decision.error, decision.message);
+        }
+    };
+}
 /** Returns a signer: `(body: string) => Promise<string>` (base64 HMAC-SHA256). */
 export async function createHmacSigner(secret) {
     const key = await importKey(secret, ["sign"]);
@@ -100,12 +229,98 @@ export async function createHmacVerifier(secret) {
         }
     };
 }
+/**
+ * Returns a verifier over a raw body string + detached base64 HMAC
+ * signature (the value of `STEP_AUTH_HEADER`). Suitable for servers
+ * that have already buffered the request body (e.g. the node step
+ * container). `crypto.subtle.verify` is constant-time; malformed
+ * base64 or a missing signature simply yields `false`.
+ */
+export async function createHmacBodyVerifier(secret) {
+    const key = await importKey(secret, ["verify"]);
+    return async (body, signatureBase64) => {
+        if (!signatureBase64)
+            return false;
+        let sig;
+        try {
+            sig = fromBase64(signatureBase64);
+        }
+        catch {
+            return false;
+        }
+        return crypto.subtle.verify("HMAC", key, sig, encode(body));
+    };
+}
+/**
+ * Default bundle source: Cloudflare R2's S3 endpoint
+ * (`<account>.r2.cloudflarestorage.com`), which is where deploy
+ * pipelines stage `container.mjs` and the orchestrator mints
+ * short-lived signed URLs. Anything else must be explicitly
+ * allowlisted via `allowedOrigins`.
+ */
+const R2_HOST_SUFFIX = ".r2.cloudflarestorage.com";
+/**
+ * Build an origin allowlist check for caller-supplied `bundle.url`
+ * values (the node step container dynamically `import()`s the fetched
+ * bytes, so an unrestricted URL is remote-code-execution-adjacent —
+ * the SHA-256 hash pin is supplied by the same caller and is not a
+ * security control on its own).
+ *
+ *   - `allowedOrigins` set (e.g. from `VOYANT_BUNDLE_ALLOWED_ORIGINS`):
+ *     the URL's origin must match one of the entries exactly.
+ *     Invalid entries throw at creation time (misconfiguration should
+ *     fail loudly, not silently widen).
+ *   - unset/empty: only HTTPS URLs on `*.r2.cloudflarestorage.com`
+ *     are allowed — the production bundle source.
+ */
+export function createBundleUrlPolicy(opts) {
+    const entries = (opts?.allowedOrigins ?? []).filter((entry) => entry.length > 0);
+    const allowed = new Set();
+    for (const entry of entries) {
+        let parsed;
+        try {
+            parsed = new URL(entry);
+        }
+        catch {
+            throw new Error(`createBundleUrlPolicy: invalid origin in allowlist: "${entry}"`);
+        }
+        allowed.add(parsed.origin);
+    }
+    return (url) => {
+        let parsed;
+        try {
+            parsed = new URL(url);
+        }
+        catch {
+            return { ok: false, message: `bundle url is not a valid URL: "${url}"` };
+        }
+        if (allowed.size > 0) {
+            if (allowed.has(parsed.origin))
+                return { ok: true };
+            return {
+                ok: false,
+                message: `bundle url origin "${parsed.origin}" is not in the configured allowlist ` +
+                    "(VOYANT_BUNDLE_ALLOWED_ORIGINS)",
+            };
+        }
+        if (parsed.protocol === "https:" && parsed.hostname.endsWith(R2_HOST_SUFFIX)) {
+            return { ok: true };
+        }
+        return {
+            ok: false,
+            message: `bundle url origin "${parsed.origin}" rejected: with no VOYANT_BUNDLE_ALLOWED_ORIGINS ` +
+                `configured, only https://*${R2_HOST_SUFFIX} bundle sources are allowed`,
+        };
+    };
+}
 // ---- Internals ----
 async function importKey(secret, usages) {
     if (secret.length === 0) {
         throw new Error("HMAC secret must be a non-empty string");
     }
-    return crypto.subtle.importKey("raw", encode(secret), { name: "HMAC", hash: "SHA-256" }, false, usages);
+    return crypto.subtle.importKey("raw", encode(secret), { name: "HMAC", hash: "SHA-256" }, false, [
+        ...usages,
+    ]);
 }
 /**
  * Encode to a freshly-allocated ArrayBuffer. TextEncoder's Uint8Array

package/dist/events/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/events/registry.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAA;AACpE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAI3D;;;;;;;;;;GAUG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,CAAA;IAC3C,qCAAqC;IACrC,QAAQ,CAAC,WAAW,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAA;IACrD,yDAAyD;IACzD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAClC;AAED,UAAU,mBAAmB;IAC3B,GAAG,CAAC,KAAK,EAAE,uBAAuB,GAAG,IAAI,CAAA;IACzC,IAAI,IAAI,uBAAuB,EAAE,CAAA;IACjC,oEAAoE;IACpE,KAAK,IAAI,IAAI,CAAA;CACd;AAgCD,gEAAgE;AAChE,wBAAgB,sBAAsB,IAAI,mBAAmB,CAE5D;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/events/registry.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAA;AACpE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAI3D;;;;;;;;;;GAUG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,CAAA;IAC3C,qCAAqC;IACrC,QAAQ,CAAC,WAAW,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAA;IACrD,yDAAyD;IACzD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAClC;AAED,UAAU,mBAAmB;IAC3B,GAAG,CAAC,KAAK,EAAE,uBAAuB,GAAG,IAAI,CAAA;IACzC,IAAI,IAAI,uBAAuB,EAAE,CAAA;IACjC,oEAAoE;IACpE,KAAK,IAAI,IAAI,CAAA;CACd;AA8BD,gEAAgE;AAChE,wBAAgB,sBAAsB,IAAI,mBAAmB,CAE5D;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD"}

package/dist/handler/index.js

@@ -203,9 +203,15 @@ function parseRequest(raw) {
     if (typeof r.workflowId !== "string" || r.workflowId.length === 0) {
         return { ok: false, message: "`workflowId` must be a non-empty string" };
     }
+    if (typeof r.workflowVersion !== "string" || r.workflowVersion.length === 0) {
+        return { ok: false, message: "`workflowVersion` must be a non-empty string" };
+    }
     if (typeof r.invocationCount !== "number" || r.invocationCount < 1) {
         return { ok: false, message: "`invocationCount` must be >= 1" };
     }
+    if (typeof r.deadline !== "number") {
+        return { ok: false, message: "`deadline` must be a number" };
+    }
     if (!r.journal || typeof r.journal !== "object") {
         return { ok: false, message: "`journal` must be an object" };
     }
@@ -219,7 +225,22 @@ function parseRequest(raw) {
     if (!r.runMeta || typeof r.runMeta !== "object") {
         return { ok: false, message: "`runMeta` must be an object" };
     }
-    return { ok: true, value: r };
+    return {
+        ok: true,
+        value: {
+            protocolVersion: r.protocolVersion,
+            runId: r.runId,
+            workflowId: r.workflowId,
+            workflowVersion: r.workflowVersion,
+            invocationCount: r.invocationCount,
+            input: r.input,
+            journal: r.journal,
+            environment: env,
+            deadline: r.deadline,
+            tenantMeta: r.tenantMeta,
+            runMeta: r.runMeta,
+        },
+    };
 }
 // ---- Helpers ----
 function jsonResponse(status, body) {

package/dist/runtime/ctx.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ctx.d.ts","sourceRoot":"","sources":["../../src/runtime/ctx.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAEnD,OAAO,KAAK,EAAY,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AACvE,OAAO,KAAK,EACV,kBAAkB,EAMlB,aAAa,EAEb,UAAU,EAEV,WAAW,EACX,MAAM,EACN,WAAW,EAOX,eAAe,EAEhB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAkB,KAAK,UAAU,EAAyB,MAAM,kBAAkB,CAAA;AASzF,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAA4B,MAAM,cAAc,CAAA;AAE5F;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+FAA+F;IAC/F,OAAO,CAAC,IAAI,EAAE;QACZ,MAAM,EAAE,MAAM,CAAA;QACd,OAAO,EAAE,MAAM,CAAA;QACf,KAAK,EAAE,OAAO,CAAA;QACd,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,CAAA;QAC7B,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACnB,OAAO,EAAE,WAAW,CAAA;KACrB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAE7B;;;;;OAKG;IACH,iBAAiB,CAAC,IAAI,EAAE;QACtB,MAAM,EAAE,MAAM,CAAA;QACd,MAAM,EAAE,OAAO,CAAA;QACf,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KAC/C,GAAG,IAAI,CAAA;IAER,+EAA+E;IAC/E,iBAAiB,IAAI,MAAM,CAAA;IAE3B;;;;OAIG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,KAAK,CAAC;QAC1C,MAAM,EAAE,MAAM,CAAA;QACd,MAAM,EAAE,OAAO,CAAA;QACf,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KAC/C,CAAC,CAAA;IAEF;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE;QACpB,QAAQ,EAAE,MAAM,CAAA;QAChB,GAAG,EAAE,MAAM,CAAA;QACX,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAA;QACpC,KAAK,EAAE,OAAO,CAAA;QACd,KAAK,EAAE,OAAO,CAAA;KACf,GAAG,IAAI,CAAA;IAER,yEAAyE;IACzE,iBAAiB,CAAC,IAAI,EAAE;QACtB,iBAAiB,EAAE,MAAM,CAAA;QACzB,IAAI,EAAE,aAAa,CAAA;QACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC7B,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,GAAG,IAAI,CAAA;IAER,+EAA+E;IAC/E,YAAY,CAAC,EAAE,EAAE;QACf,EAAE,EAAE,KAAK,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAA;QAC7C,GAAG,EAAE,MAAM,CAAA;QACX,KAAK,CAAC,EAAE,OAAO,CAAA;QACf,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAA;KACpC,GAAG,IAAI,CAAA;IAER,yEAAyE;IACzE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAEhC,mDAAmD;IACnD,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAClD,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAA;IACxC,QAAQ,CAAC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IAC9C,QAAQ,CAAC,YAAY,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CACpD;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,kBAAkB,CAAA;IACvB,OAAO,EAAE,YAAY,CAAA;IACrB,SAAS,EAAE,gBAAgB,CAAA;IAC3B,KAAK,EAAE,UAAU,CAAA;IACjB,MAAM,EAAE,MAAM,MAAM,CAAA;IACpB,oEAAoE;IACpE,aAAa,EAAE;QAAE,OAAO,EAAE,WAAW,GAAG,SAAS,CAAA;KAAE,CAAA;IACnD;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAA;CAC3B;AAoBD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,CAqkBrE;AAsID,YAAY,EAAE,aAAa,EAAE,CAAA"}
+{"version":3,"file":"ctx.d.ts","sourceRoot":"","sources":["../../src/runtime/ctx.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAEnD,OAAO,KAAK,EAAY,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AACvE,OAAO,KAAK,EACV,kBAAkB,EAMlB,aAAa,EAEb,UAAU,EAEV,WAAW,EACX,MAAM,EACN,WAAW,EAOX,eAAe,EAEhB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAkB,KAAK,UAAU,EAAyB,MAAM,kBAAkB,CAAA;AASzF,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAA4B,MAAM,cAAc,CAAA;AAE5F;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+FAA+F;IAC/F,OAAO,CAAC,IAAI,EAAE;QACZ,MAAM,EAAE,MAAM,CAAA;QACd,OAAO,EAAE,MAAM,CAAA;QACf,KAAK,EAAE,OAAO,CAAA;QACd,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,CAAA;QAC7B,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACnB,OAAO,EAAE,WAAW,CAAA;KACrB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAE7B;;;;;OAKG;IACH,iBAAiB,CAAC,IAAI,EAAE;QACtB,MAAM,EAAE,MAAM,CAAA;QACd,MAAM,EAAE,OAAO,CAAA;QACf,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KAC/C,GAAG,IAAI,CAAA;IAER,+EAA+E;IAC/E,iBAAiB,IAAI,MAAM,CAAA;IAE3B;;;;OAIG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,KAAK,CAAC;QAC1C,MAAM,EAAE,MAAM,CAAA;QACd,MAAM,EAAE,OAAO,CAAA;QACf,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KAC/C,CAAC,CAAA;IAEF;;;;OAIG;IACH,eAAe,CAAC,IAAI,EAAE;QACpB,QAAQ,EAAE,MAAM,CAAA;QAChB,GAAG,EAAE,MAAM,CAAA;QACX,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAA;QACpC,KAAK,EAAE,OAAO,CAAA;QACd,KAAK,EAAE,OAAO,CAAA;KACf,GAAG,IAAI,CAAA;IAER,yEAAyE;IACzE,iBAAiB,CAAC,IAAI,EAAE;QACtB,iBAAiB,EAAE,MAAM,CAAA;QACzB,IAAI,EAAE,aAAa,CAAA;QACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC7B,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,GAAG,IAAI,CAAA;IAER,+EAA+E;IAC/E,YAAY,CAAC,EAAE,EAAE;QACf,EAAE,EAAE,KAAK,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAA;QAC7C,GAAG,EAAE,MAAM,CAAA;QACX,KAAK,CAAC,EAAE,OAAO,CAAA;QACf,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAA;KACpC,GAAG,IAAI,CAAA;IAER,yEAAyE;IACzE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAEhC,mDAAmD;IACnD,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAClD,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAA;IACxC,QAAQ,CAAC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IAC9C,QAAQ,CAAC,YAAY,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CACpD;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,kBAAkB,CAAA;IACvB,OAAO,EAAE,YAAY,CAAA;IACrB,SAAS,EAAE,gBAAgB,CAAA;IAC3B,KAAK,EAAE,UAAU,CAAA;IACjB,MAAM,EAAE,MAAM,MAAM,CAAA;IACpB,oEAAoE;IACpE,aAAa,EAAE;QAAE,OAAO,EAAE,WAAW,GAAG,SAAS,CAAA;KAAE,CAAA;IACnD;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAA;CAC3B;AAoBD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,CAikBrE;AAsID,YAAY,EAAE,aAAa,EAAE,CAAA"}

package/dist/runtime/ctx.js

@@ -1,4 +1,5 @@
 // Builds the `ctx` object passed to the workflow body.
+// agent-quality: file-size exception -- Central ctx API wiring remains together until wait/stream/group runtime slices can be extracted safely.
 //
 // The executor owns the waitpoint-pending queue and the callbacks
 // into the orchestrator; ctx is a thin shell that delegates.
@@ -380,22 +381,21 @@ export function buildCtx(args) {
             throw err;
         }
     }
-    const streamImpl = async (streamId, sourceOrFn) => {
-        const source = typeof sourceOrFn === "function"
-            ? sourceOrFn()
-            : sourceOrFn;
+    const streamImpl = async (streamId, sourceFn) => {
+        const source = sourceFn();
         await consumeStream(streamId, source, inferEncoding(source));
     };
-    streamImpl.text = async (id, source) => {
-        await consumeStream(id, source, "text");
-    };
-    streamImpl.json = async (id, source) => {
-        await consumeStream(id, source, "json");
-    };
-    streamImpl.bytes = async (id, source) => {
-        await consumeStream(id, source, "base64");
-    };
-    const stream = streamImpl;
+    const stream = Object.assign(streamImpl, {
+        text: async (id, source) => {
+            await consumeStream(id, source, "text");
+        },
+        json: async (id, source) => {
+            await consumeStream(id, source, "json");
+        },
+        bytes: async (id, source) => {
+            await consumeStream(id, source, "base64");
+        },
+    });
     // ---- groups ----
     // `ctx.group(name, fn)` creates a compensation scope. Implementation
     // strategy: the outer compensable list is the single source of truth;

package/dist/testing/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,EACL,KAAK,kBAAkB,EAIvB,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC3B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,EACV,YAAY,EAGb,MAAM,uBAAuB,CAAA;AAE9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,EACV,kBAAkB,EAClB,aAAa,EACb,WAAW,EAEX,cAAc,EACf,MAAM,gBAAgB,CAAA;AAGvB,MAAM,WAAW,WAAW,CAAC,IAAI;IAC/B,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;IAC5E;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,EAAE,CAAC,CAAA;IAClD,mCAAmC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACvC,gCAAgC;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACtC,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChC,wEAAwE;IACxE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7B,WAAW,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAA;IACzC,kEAAkE;IAClE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,MAAM,CAAA;IACrB,oEAAoE;IACpE,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAED,MAAM,WAAW,UAAU,CAAC,IAAI;IAC9B,MAAM,EAAE,OAAO,CACb,SAAS,EACT,WAAW,GAAG,QAAQ,GAAG,WAAW,GAAG,aAAa,GAAG,qBAAqB,GAAG,SAAS,CACzF,CAAA;IACD,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,KAAK,CAAC,EAAE;QAAE,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAChF,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,IAAI,GAAG,KAAK,GAAG,SAAS,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,EAAE,CAAA;IAC7F,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,EAAE,CAAA;IACrD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;IACvC,aAAa,EAAE,kBAAkB,EAAE,CAAA;IACnC,iHAAiH;IACjH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;IACtC,WAAW,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,KAAK,CAAC,EAAE;QACN,OAAO,EAAE,YAAY,CAAA;QACrB,iBAAiB,EAAE,qBAAqB,EAAE,CAAA;QAC1C,SAAS,EAAE,MAAM,CAAA;QACjB,eAAe,EAAE,MAAM,CAAA;QACvB,oBAAoB,EAAE,MAAM,CAAA;QAC5B,cAAc,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAAA;KAClF,CAAA;CACF;AAED,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAChD,QAAQ,EAAE,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,EACnC,KAAK,EAAE,GAAG,EACV,IAAI,GAAE,WAAW,CAAC,GAAG,CAAM,GAC1B,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAqL3B;AAED;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAA;AAE1D,MAAM,WAAW,aAAa,CAAC,GAAG,CAAE,SAAQ,WAAW,CAAC,GAAG,CAAC;IAC1D,sGAAsG;IACtG,KAAK,EAAE,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;IAChD,2DAA2D;IAC3D,SAAS,EAAE,kBAAkB,CAAA;CAC9B;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,IAAI,EACnD,QAAQ,EAAE,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,EACnC,KAAK,EAAE,GAAG,EACV,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,GACvB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAwM3B;AAwND,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC1B,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC5B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,EACL,KAAK,kBAAkB,EAIvB,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC3B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,EACV,YAAY,EAGb,MAAM,uBAAuB,CAAA;AAE9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,EACV,kBAAkB,EAClB,aAAa,EACb,WAAW,EAEX,cAAc,EACf,MAAM,gBAAgB,CAAA;AAOvB,MAAM,WAAW,WAAW,CAAC,IAAI;IAC/B,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;IAC5E;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,EAAE,CAAC,CAAA;IAClD,mCAAmC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACvC,gCAAgC;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACtC,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChC,wEAAwE;IACxE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7B,WAAW,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAA;IACzC,kEAAkE;IAClE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,MAAM,CAAA;IACrB,oEAAoE;IACpE,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAED,MAAM,WAAW,UAAU,CAAC,IAAI;IAC9B,MAAM,EAAE,OAAO,CACb,SAAS,EACT,WAAW,GAAG,QAAQ,GAAG,WAAW,GAAG,aAAa,GAAG,qBAAqB,GAAG,SAAS,CACzF,CAAA;IACD,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,KAAK,CAAC,EAAE;QAAE,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAChF,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,IAAI,GAAG,KAAK,GAAG,SAAS,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,EAAE,CAAA;IAC7F,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,EAAE,CAAA;IACrD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;IACvC,aAAa,EAAE,kBAAkB,EAAE,CAAA;IACnC,iHAAiH;IACjH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;IACtC,WAAW,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,KAAK,CAAC,EAAE;QACN,OAAO,EAAE,YAAY,CAAA;QACrB,iBAAiB,EAAE,qBAAqB,EAAE,CAAA;QAC1C,SAAS,EAAE,MAAM,CAAA;QACjB,eAAe,EAAE,MAAM,CAAA;QACvB,oBAAoB,EAAE,MAAM,CAAA;QAC5B,cAAc,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,CAAA;KAClF,CAAA;CACF;AAED,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAChD,QAAQ,EAAE,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,EACnC,KAAK,EAAE,GAAG,EACV,IAAI,GAAE,WAAW,CAAC,GAAG,CAAM,GAC1B,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAqL3B;AAED;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAA;AAE1D,MAAM,WAAW,aAAa,CAAC,GAAG,CAAE,SAAQ,WAAW,CAAC,GAAG,CAAC;IAC1D,sGAAsG;IACtG,KAAK,EAAE,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;IAChD,2DAA2D;IAC3D,SAAS,EAAE,kBAAkB,CAAA;CAC9B;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,IAAI,EACnD,QAAQ,EAAE,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,EACnC,KAAK,EAAE,GAAG,EACV,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,GACvB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAwM3B;AAoND,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC1B,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC5B"}

package/dist/testing/index.js

@@ -2,12 +2,16 @@
 //
 // In-process test harness with mocked steps, waits, and invokes.
 // Contract in docs/sdk-surface.md §11.
+// agent-quality: file-size exception -- legacy test harness stays co-located until pause/resume helpers are split.
 //
 // Drives `executeWorkflowStep` across resumptions. Steps resolve
 // from a user-supplied stub map; waitpoints resolve from fixtures.
 import { executeWorkflowStep, } from "../runtime/executor.js";
 import { emptyJournal } from "../runtime/journal.js";
 import { getWorkflow } from "../workflow.js";
+function workflowForExecutor(def) {
+    return def;
+}
 export async function runWorkflowForTest(workflow, input, opts = {}) {
     const def = workflow;
     const now = opts.now ?? (() => Date.now());
@@ -33,7 +37,7 @@ export async function runWorkflowForTest(workflow, input, opts = {}) {
     const cursors = { event: new Map(), signal: new Map() };
     while (invocationCount < maxInvocations) {
         invocationCount += 1;
-        const response = await executeWorkflowStep(def, {
+        const response = await executeWorkflowStep(workflowForExecutor(def), {
             runId: `run_test_${def.id}`,
             workflowId: def.id,
             workflowVersion: "test",
@@ -219,7 +223,7 @@ export async function resumeWorkflowForTest(workflow, input, opts) {
     let carryover = opts.pause.pendingWaitpoints.filter((w) => w.clientWaitpointId !== matched.clientWaitpointId);
     while (invocationCount < maxInvocations) {
         invocationCount += 1;
-        const response = await executeWorkflowStep(def, {
+        const response = await executeWorkflowStep(workflowForExecutor(def), {
             runId: `run_test_${def.id}`,
             workflowId: def.id,
             workflowVersion: "test",

package/dist/workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../src/workflow.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,KAAK,EACV,QAAQ,EACR,eAAe,EACf,WAAW,EACX,aAAa,EACb,WAAW,EACX,SAAS,EACT,UAAU,EACX,MAAM,YAAY,CAAA;AAInB,MAAM,WAAW,cAAc,CAAC,MAAM,GAAG,OAAO,EAAE,OAAO,GAAG,OAAO;IACjE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,cAAc,CAAC,MAAM,EAAE,OAAO;IAC7C,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,GAAG,mBAAmB,EAAE,CAAA;IACtD,WAAW,CAAC,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAA;IACvC,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,OAAO,CAAC,EAAE,QAAQ,CAAA;IAClB,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CACvE;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB,CAAC,MAAM,GAAG,OAAO,EAAE,OAAO,GAAG,OAAO,CACrE,SAAQ,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjD;AAED,MAAM,MAAM,mBAAmB,GAAG,CAC9B;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,KAAK,EAAE,QAAQ,CAAA;CAAE,GACnB;IAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CACxB,GAAG;IACF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;IACpD,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAA;IACpC,YAAY,CAAC,EAAE,eAAe,EAAE,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,CAAA;AAED,MAAM,WAAW,iBAAiB,CAAC,MAAM;IACvC,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC,CAAA;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,OAAO,GAAG,oBAAoB,GAAG,eAAe,GAAG,aAAa,CAAA;CAC5E;AAkBD,wDAAwD;AACxD,wBAAgB,QAAQ,CAAC,MAAM,GAAG,OAAO,EAAE,OAAO,GAAG,OAAO,EAC1D,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,GACtC,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAqBrC;AAED,qDAAqD;AACrD,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAEtE;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,kBAAkB,EAAE,CAEhE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,IAAI,CAEtC;AAID,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,UAAU,CAAA;IACvB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IACvB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,eAAe,CAAA;IACrB,GAAG,CAAC,EAAE;QACJ,MAAM,EAAE,MAAM,CAAA;QACd,MAAM,EAAE,MAAM,CAAA;QACd,EAAE,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAA;KACrC,CAAA;CACF;AAED,MAAM,WAAW,eAAe,CAAC,OAAO,GAAG,OAAO;IAChD,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAClD,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAA;IACxC,QAAQ,CAAC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IAC9C,QAAQ,CAAC,YAAY,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACnD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAE5B;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAA;IAElC,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5C,YAAY,EAAE,eAAe,CAAA;IAC7B,aAAa,EAAE,gBAAgB,CAAA;IAC/B,YAAY,EAAE,eAAe,CAAA;IAC7B,MAAM,EAAE,SAAS,CAAA;IACjB,QAAQ,EAAE,WAAW,CAAA;IACrB,MAAM,EAAE,SAAS,CAAA;IACjB,KAAK,EAAE,QAAQ,CAAA;IACf,UAAU,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,CAAA;IAChC,QAAQ,EAAE,WAAW,CAAA;IAErB,GAAG,EAAE,MAAM,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,MAAM,CAAA;IAExB,QAAQ,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAA;CACxC;AAID,MAAM,WAAW,OAAO;IACtB,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAC1C,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;CACjE;AAED,MAAM,MAAM,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,CAAA;AAE5D,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,WAAW,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CAC5E;AAED,MAAM,WAAW,WAAW,CAAC,CAAC,GAAG,OAAO;IACtC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IACzB,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB,OAAO,CAAC,EAAE,QAAQ,CAAA;IAClB,KAAK,CAAC,EAAE,WAAW,GAAG;QAAE,GAAG,EAAE,CAAC,CAAA;KAAE,CAAA;IAChC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACzC,SAAS,CAAC,EAAE,aAAa,CAAA;IACzB,OAAO,CAAC,EAAE,SAAS,CAAA;IACnB,QAAQ,CAAC,EAAE,SAAS,CAAA;IACpB,MAAM,CAAC,EAAE,SAAS,CAAA;CACnB;AAID,MAAM,WAAW,QAAQ,CAAC,CAAC,CAAE,SAAQ,WAAW,CAAC,CAAC,GAAG,IAAI,CAAC;IACxD,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,qBAAqB,CAAC,CAAC,CAAC,CAAA;IAClD,KAAK,IAAI,IAAI,CAAA;CACd;AAED,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,GAAG,OAAO,EACxC,SAAS,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC,KAC1B,QAAQ,CAAC,CAAC,CAAC,CAAA;AAEhB,MAAM,WAAW,mBAAmB,CAAC,CAAC;IACpC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,OAAO,CAAC,CAAA;IAC9C,OAAO,CAAC,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAC7B;AAED,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,GAAG,OAAO,EACzC,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,oBAAoB,CAAC,CAAC,CAAC,KAC3B,QAAQ,CAAC,CAAC,CAAC,CAAA;AAChB,MAAM,WAAW,oBAAoB,CAAC,CAAC,CAAE,SAAQ,mBAAmB,CAAC,CAAC,CAAC;CAAG;AAE1E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;AACnG,MAAM,WAAW,mBAAmB,CAAC,EAAE;IACrC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,QAAQ,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AACD,MAAM,WAAW,SAAS,CAAC,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;CAC9B;AAID,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,IAAI,EAChC,QAAQ,EAAE,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,EACnC,KAAK,EAAE,GAAG,EACV,IAAI,CAAC,EAAE,aAAa,KACjB,OAAO,CAAC,IAAI,CAAC,CAAA;AAElB,MAAM,WAAW,aAAa;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,EAAE,CAAC,EAC7B,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,EAC1C,IAAI,CAAC,EAAE,eAAe,KACnB,OAAO,CAAC,CAAC,EAAE,CAAC,CAAA;AAEjB,MAAM,WAAW,eAAe;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAID,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpE,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClE;AAID,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAA;AAC7F,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,OAAO,CAAA;IACb,UAAU,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,CAAA;CACjC;AAID,MAAM,MAAM,aAAa,GACrB,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ,aAAa,EAAE,GACf;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CAAA;CAAE,CAAA;AAEpC,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI,CAAA;IAC5C,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzC,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAA;IACtC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,MAAM,WAAW,WAAY,SAAQ,qBAAqB;IACxD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACtB,MAAM,CAAC,EAAE,qBAAqB,CAAA;IAC9B,IAAI,CAAC,EAAE,qBAAqB,CAAA;CAC7B;AAED,YAAY,EAAE,SAAS,EAAE,CAAA"}
+{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../src/workflow.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,KAAK,EACV,QAAQ,EACR,eAAe,EACf,WAAW,EACX,aAAa,EACb,WAAW,EACX,SAAS,EACT,UAAU,EACX,MAAM,YAAY,CAAA;AAInB,MAAM,WAAW,cAAc,CAAC,MAAM,GAAG,OAAO,EAAE,OAAO,GAAG,OAAO;IACjE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,cAAc,CAAC,MAAM,EAAE,OAAO;IAC7C,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,mBAAmB,GAAG,mBAAmB,EAAE,CAAA;IACtD,WAAW,CAAC,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAA;IACvC,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,OAAO,CAAC,EAAE,QAAQ,CAAA;IAClB,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CACvE;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB,CAAC,MAAM,GAAG,OAAO,EAAE,OAAO,GAAG,OAAO,CACrE,SAAQ,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjD;AAED,MAAM,MAAM,mBAAmB,GAAG,CAC9B;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,KAAK,EAAE,QAAQ,CAAA;CAAE,GACnB;IAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CACxB,GAAG;IACF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;IACpD,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAA;IACpC,YAAY,CAAC,EAAE,eAAe,EAAE,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,CAAA;AAED,MAAM,WAAW,iBAAiB,CAAC,MAAM;IACvC,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC,CAAA;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,OAAO,GAAG,oBAAoB,GAAG,eAAe,GAAG,aAAa,CAAA;CAC5E;AAgBD,wDAAwD;AACxD,wBAAgB,QAAQ,CAAC,MAAM,GAAG,OAAO,EAAE,OAAO,GAAG,OAAO,EAC1D,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,GACtC,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAqBrC;AAED,qDAAqD;AACrD,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAEtE;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,kBAAkB,EAAE,CAEhE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,IAAI,CAEtC;AAID,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,UAAU,CAAA;IACvB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IACvB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,eAAe,CAAA;IACrB,GAAG,CAAC,EAAE;QACJ,MAAM,EAAE,MAAM,CAAA;QACd,MAAM,EAAE,MAAM,CAAA;QACd,EAAE,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAA;KACrC,CAAA;CACF;AAED,MAAM,WAAW,eAAe,CAAC,OAAO,GAAG,OAAO;IAChD,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAClD,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAA;IACxC,QAAQ,CAAC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IAC9C,QAAQ,CAAC,YAAY,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACnD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAE5B;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAA;IAElC,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5C,YAAY,EAAE,eAAe,CAAA;IAC7B,aAAa,EAAE,gBAAgB,CAAA;IAC/B,YAAY,EAAE,eAAe,CAAA;IAC7B,MAAM,EAAE,SAAS,CAAA;IACjB,QAAQ,EAAE,WAAW,CAAA;IACrB,MAAM,EAAE,SAAS,CAAA;IACjB,KAAK,EAAE,QAAQ,CAAA;IACf,UAAU,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,CAAA;IAChC,QAAQ,EAAE,WAAW,CAAA;IAErB,GAAG,EAAE,MAAM,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,MAAM,CAAA;IAExB,QAAQ,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAA;CACxC;AAID,MAAM,WAAW,OAAO;IACtB,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IAC1C,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;CACjE;AAED,MAAM,MAAM,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,CAAA;AAE5D,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,WAAW,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;CAC5E;AAED,MAAM,WAAW,WAAW,CAAC,CAAC,GAAG,OAAO;IACtC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IACzB,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB,OAAO,CAAC,EAAE,QAAQ,CAAA;IAClB,KAAK,CAAC,EAAE,WAAW,GAAG;QAAE,GAAG,EAAE,CAAC,CAAA;KAAE,CAAA;IAChC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACzC,SAAS,CAAC,EAAE,aAAa,CAAA;IACzB,OAAO,CAAC,EAAE,SAAS,CAAA;IACnB,QAAQ,CAAC,EAAE,SAAS,CAAA;IACpB,MAAM,CAAC,EAAE,SAAS,CAAA;CACnB;AAID,MAAM,WAAW,QAAQ,CAAC,CAAC,CAAE,SAAQ,WAAW,CAAC,CAAC,GAAG,IAAI,CAAC;IACxD,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,qBAAqB,CAAC,CAAC,CAAC,CAAA;IAClD,KAAK,IAAI,IAAI,CAAA;CACd;AAED,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,GAAG,OAAO,EACxC,SAAS,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC,KAC1B,QAAQ,CAAC,CAAC,CAAC,CAAA;AAEhB,MAAM,WAAW,mBAAmB,CAAC,CAAC;IACpC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,OAAO,CAAC,CAAA;IAC9C,OAAO,CAAC,EAAE,QAAQ,CAAA;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAC7B;AAED,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,GAAG,OAAO,EACzC,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,oBAAoB,CAAC,CAAC,CAAC,KAC3B,QAAQ,CAAC,CAAC,CAAC,CAAA;AAChB,MAAM,WAAW,oBAAoB,CAAC,CAAC,CAAE,SAAQ,mBAAmB,CAAC,CAAC,CAAC;CAAG;AAE1E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;AACnG,MAAM,WAAW,mBAAmB,CAAC,EAAE;IACrC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,QAAQ,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AACD,MAAM,WAAW,SAAS,CAAC,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;CAC9B;AAID,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,IAAI,EAChC,QAAQ,EAAE,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,EACnC,KAAK,EAAE,GAAG,EACV,IAAI,CAAC,EAAE,aAAa,KACjB,OAAO,CAAC,IAAI,CAAC,CAAA;AAElB,MAAM,WAAW,aAAa;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,EAAE,CAAC,EAC7B,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,EAC1C,IAAI,CAAC,EAAE,eAAe,KACnB,OAAO,CAAC,CAAC,EAAE,CAAC,CAAA;AAEjB,MAAM,WAAW,eAAe;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAID,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpE,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClE;AAID,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAA;AAC7F,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,OAAO,CAAA;IACb,UAAU,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,CAAA;CACjC;AAID,MAAM,MAAM,aAAa,GACrB,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ,aAAa,EAAE,GACf;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CAAA;CAAE,CAAA;AAEpC,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI,CAAA;IAC5C,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzC,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAA;IACtC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,MAAM,WAAW,WAAY,SAAQ,qBAAqB;IACxD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACtB,MAAM,CAAC,EAAE,qBAAqB,CAAA;IAC9B,IAAI,CAAC,EAAE,qBAAqB,CAAA;CAC7B;AAED,YAAY,EAAE,SAAS,EAAE,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voyantjs/workflows",
-  "version": "0.107.5",
+  "version": "0.107.6",
   "description": "Authoring SDK for Voyant Workflows — durable, step-based orchestrations for Voyant Cloud.",
   "license": "Apache-2.0",
   "repository": {

package/src/auth/index.ts

@@ -24,6 +24,30 @@
 
 export const AUTH_HEADER = "x-voyant-dispatch-auth" as const
 
+/**
+ * HMAC header carried on orchestrator → node-step-container dispatches
+ * (`POST /step`). Signed over the raw request body with the shared
+ * `VOYANT_WORKFLOW_STEP_AUTH_SECRET`. See `createCfContainerStepRunner`
+ * (signing side) and `apps/workflows-node-step-container` (verifying side).
+ */
+export const STEP_AUTH_HEADER = "x-voyant-step-auth" as const
+
+/**
+ * HMAC header returned by the node-step-container on successful `/step`
+ * responses. Signed over the raw JSON response body with the same
+ * `VOYANT_WORKFLOW_STEP_AUTH_SECRET` so the orchestrator can reject
+ * forged step journal entries before committing run state.
+ */
+export const STEP_RESPONSE_AUTH_HEADER = "x-voyant-step-response-auth" as const
+
+/** Parse a comma-separated token/origin list env var into trimmed, non-empty entries. */
+export function parseTokenList(raw: string | null | undefined): string[] {
+  return (raw ?? "")
+    .split(",")
+    .map((s) => s.trim())
+    .filter((s) => s.length > 0)
+}
+
 /**
  * Returns a verifier that accepts `Authorization: Bearer <token>`
  * where `<token>` matches any of the `validTokens` (case-sensitive,
@@ -53,15 +77,151 @@ export function createBearerVerifier(validTokens: readonly string[]): (req: Requ
   }
 }
 
+/**
+ * Constant-time string comparison. Does NOT early-return on length
+ * mismatch: the loop always runs over the longer input (out-of-range
+ * `charCodeAt` is NaN, which coerces to 0 under bitwise ops), and a
+ * length mismatch only sets a diff bit. This avoids leaking how many
+ * leading characters of a secret matched, or whether the length matched.
+ */
 function constantTimeEquals(a: string, b: string): boolean {
-  if (a.length !== b.length) return false
-  let diff = 0
-  for (let i = 0; i < a.length; i++) {
-    diff |= a.charCodeAt(i) ^ b.charCodeAt(i)
+  const length = Math.max(a.length, b.length, 1)
+  let diff = a.length === b.length ? 0 : 1
+  for (let i = 0; i < length; i++) {
+    diff |= (a.charCodeAt(i) | 0) ^ (b.charCodeAt(i) | 0)
   }
   return diff === 0
 }
 
+// ---- Fail-closed bearer auth resolution ----
+
+/**
+ * Error thrown by verifiers produced in this module. Carries an HTTP
+ * `status` + machine-readable `code` so HTTP surfaces
+ * (`handleWorkerRequest`, the node dashboard server, step handlers)
+ * can map auth failures to the right response instead of a blanket 401.
+ */
+export class RequestAuthError extends Error {
+  readonly status: number
+  readonly code: string
+
+  constructor(status: number, code: string, message: string) {
+    super(message)
+    this.name = "RequestAuthError"
+    this.status = status
+    this.code = code
+  }
+}
+
+export type BearerAuthDecision =
+  | { ok: true }
+  | { ok: false; status: number; error: string; message: string }
+
+export interface BearerAuthOptions {
+  /** Accepted bearer tokens. Empty/undefined = no auth configured. */
+  tokens?: readonly string[]
+  /**
+   * Explicit local-dev opt-out. When `true` AND no tokens are
+   * configured, requests are allowed through with a loud warning.
+   * When `false`/unset and no tokens are configured, every request is
+   * rejected with 503 `auth_not_configured` (fail closed).
+   */
+  allowUnauthenticated?: boolean
+  /** Warning sink for the unauthenticated opt-out. Defaults to `console.warn`. */
+  warn?: (message: string) => void
+}
+
+const UNAUTHENTICATED_WARNING =
+  "[voyant-workflows] AUTH DISABLED: no bearer tokens are configured and " +
+  "VOYANT_WORKFLOWS_ALLOW_UNAUTHENTICATED is set. Every caller can trigger, read, " +
+  "resume, and cancel workflow runs. This mode is for LOCAL DEVELOPMENT ONLY — " +
+  "configure VOYANT_API_TOKENS before deploying."
+
+/**
+ * Build a transport-agnostic bearer authorizer from a raw
+ * `Authorization` header value. Fail-closed semantics:
+ *
+ *   - tokens configured     → exact (constant-time) Bearer match or 401
+ *   - no tokens + opt-out   → always allowed (warns loudly once, at creation)
+ *   - no tokens, no opt-out → always 503 `auth_not_configured`
+ */
+export function createBearerAuthorizer(
+  opts: BearerAuthOptions,
+): (authorizationHeader: string | null | undefined) => BearerAuthDecision {
+  const tokens = (opts.tokens ?? []).filter((t) => t.length > 0)
+  if (tokens.length === 0) {
+    if (opts.allowUnauthenticated) {
+      ;(opts.warn ?? console.warn)(UNAUTHENTICATED_WARNING)
+      return () => ({ ok: true })
+    }
+    return () => ({
+      ok: false,
+      status: 503,
+      error: "auth_not_configured",
+      message:
+        "no bearer tokens are configured for this workflows API; set VOYANT_API_TOKENS " +
+        "(or pass tokens explicitly), or opt out for local development with " +
+        "VOYANT_WORKFLOWS_ALLOW_UNAUTHENTICATED=1",
+    })
+  }
+  return (header) => {
+    if (!header) {
+      return {
+        ok: false,
+        status: 401,
+        error: "unauthorized",
+        message: "missing Authorization header",
+      }
+    }
+    const match = /^Bearer (.+)$/.exec(header)
+    if (!match) {
+      return {
+        ok: false,
+        status: 401,
+        error: "unauthorized",
+        message: "Authorization header must use the Bearer scheme",
+      }
+    }
+    const presented = match[1]!
+    for (const valid of tokens) {
+      if (constantTimeEquals(presented, valid)) return { ok: true }
+    }
+    return {
+      ok: false,
+      status: 401,
+      error: "unauthorized",
+      message: "bearer token does not match any configured value",
+    }
+  }
+}
+
+/**
+ * Resolve a `verifyRequest` hook (the dep consumed by
+ * `handleWorkerRequest` / `createStepHandler`) with fail-closed
+ * defaults — the missing-token case yields a verifier that rejects
+ * every request with a 503 `auth_not_configured` `RequestAuthError`
+ * instead of `undefined` (which would skip auth entirely).
+ *
+ * Returns `undefined` (auth skipped) ONLY when no tokens are
+ * configured AND `allowUnauthenticated` is explicitly set.
+ */
+export function resolveRequestVerifier(
+  opts: BearerAuthOptions,
+): ((req: Request) => void) | undefined {
+  const tokens = (opts.tokens ?? []).filter((t) => t.length > 0)
+  if (tokens.length === 0 && opts.allowUnauthenticated) {
+    ;(opts.warn ?? console.warn)(UNAUTHENTICATED_WARNING)
+    return undefined
+  }
+  const authorize = createBearerAuthorizer({ ...opts, allowUnauthenticated: false })
+  return (req) => {
+    const decision = authorize(req.headers.get("authorization"))
+    if (!decision.ok) {
+      throw new RequestAuthError(decision.status, decision.error, decision.message)
+    }
+  }
+}
+
 /** Returns a signer: `(body: string) => Promise<string>` (base64 HMAC-SHA256). */
 export async function createHmacSigner(secret: string): Promise<(body: string) => Promise<string>> {
   const key = await importKey(secret, ["sign"])
@@ -102,6 +262,98 @@ export async function createHmacVerifier(secret: string): Promise<(req: Request)
   }
 }
 
+/**
+ * Returns a verifier over a raw body string + detached base64 HMAC
+ * signature (the value of `STEP_AUTH_HEADER`). Suitable for servers
+ * that have already buffered the request body (e.g. the node step
+ * container). `crypto.subtle.verify` is constant-time; malformed
+ * base64 or a missing signature simply yields `false`.
+ */
+export async function createHmacBodyVerifier(
+  secret: string,
+): Promise<(body: string, signatureBase64: string | null | undefined) => Promise<boolean>> {
+  const key = await importKey(secret, ["verify"])
+  return async (body, signatureBase64) => {
+    if (!signatureBase64) return false
+    let sig: ArrayBuffer
+    try {
+      sig = fromBase64(signatureBase64)
+    } catch {
+      return false
+    }
+    return crypto.subtle.verify("HMAC", key, sig, encode(body))
+  }
+}
+
+// ---- Bundle URL origin policy ----
+
+export type BundleUrlDecision = { ok: true } | { ok: false; message: string }
+
+/**
+ * Default bundle source: Cloudflare R2's S3 endpoint
+ * (`<account>.r2.cloudflarestorage.com`), which is where deploy
+ * pipelines stage `container.mjs` and the orchestrator mints
+ * short-lived signed URLs. Anything else must be explicitly
+ * allowlisted via `allowedOrigins`.
+ */
+const R2_HOST_SUFFIX = ".r2.cloudflarestorage.com"
+
+/**
+ * Build an origin allowlist check for caller-supplied `bundle.url`
+ * values (the node step container dynamically `import()`s the fetched
+ * bytes, so an unrestricted URL is remote-code-execution-adjacent —
+ * the SHA-256 hash pin is supplied by the same caller and is not a
+ * security control on its own).
+ *
+ *   - `allowedOrigins` set (e.g. from `VOYANT_BUNDLE_ALLOWED_ORIGINS`):
+ *     the URL's origin must match one of the entries exactly.
+ *     Invalid entries throw at creation time (misconfiguration should
+ *     fail loudly, not silently widen).
+ *   - unset/empty: only HTTPS URLs on `*.r2.cloudflarestorage.com`
+ *     are allowed — the production bundle source.
+ */
+export function createBundleUrlPolicy(opts?: {
+  allowedOrigins?: readonly string[]
+}): (url: string) => BundleUrlDecision {
+  const entries = (opts?.allowedOrigins ?? []).filter((entry) => entry.length > 0)
+  const allowed = new Set<string>()
+  for (const entry of entries) {
+    let parsed: URL
+    try {
+      parsed = new URL(entry)
+    } catch {
+      throw new Error(`createBundleUrlPolicy: invalid origin in allowlist: "${entry}"`)
+    }
+    allowed.add(parsed.origin)
+  }
+  return (url) => {
+    let parsed: URL
+    try {
+      parsed = new URL(url)
+    } catch {
+      return { ok: false, message: `bundle url is not a valid URL: "${url}"` }
+    }
+    if (allowed.size > 0) {
+      if (allowed.has(parsed.origin)) return { ok: true }
+      return {
+        ok: false,
+        message:
+          `bundle url origin "${parsed.origin}" is not in the configured allowlist ` +
+          "(VOYANT_BUNDLE_ALLOWED_ORIGINS)",
+      }
+    }
+    if (parsed.protocol === "https:" && parsed.hostname.endsWith(R2_HOST_SUFFIX)) {
+      return { ok: true }
+    }
+    return {
+      ok: false,
+      message:
+        `bundle url origin "${parsed.origin}" rejected: with no VOYANT_BUNDLE_ALLOWED_ORIGINS ` +
+        `configured, only https://*${R2_HOST_SUFFIX} bundle sources are allowed`,
+    }
+  }
+}
+
 // ---- Internals ----
 
 async function importKey(
@@ -111,13 +363,9 @@ async function importKey(
   if (secret.length === 0) {
     throw new Error("HMAC secret must be a non-empty string")
   }
-  return crypto.subtle.importKey(
-    "raw",
-    encode(secret),
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    usages as KeyUsage[],
-  )
+  return crypto.subtle.importKey("raw", encode(secret), { name: "HMAC", hash: "SHA-256" }, false, [
+    ...usages,
+  ])
 }
 
 /**

package/src/events/registry.ts

@@ -44,10 +44,8 @@ interface EventFilterRegistry {
   reset(): void
 }
 
-const globalRef = globalThis as unknown as Record<
-  typeof REGISTRY_KEY,
-  Map<string, EventFilterRuntimeEntry> | undefined
->
+const globalRef = globalThis as typeof globalThis &
+  Record<typeof REGISTRY_KEY, Map<string, EventFilterRuntimeEntry> | undefined>
 
 const REGISTRY: Map<string, EventFilterRuntimeEntry> =
   globalRef[REGISTRY_KEY] ?? new Map<string, EventFilterRuntimeEntry>()

package/src/handler/index.ts

@@ -335,9 +335,15 @@ function parseRequest(
   if (typeof r.workflowId !== "string" || r.workflowId.length === 0) {
     return { ok: false, message: "`workflowId` must be a non-empty string" }
   }
+  if (typeof r.workflowVersion !== "string" || r.workflowVersion.length === 0) {
+    return { ok: false, message: "`workflowVersion` must be a non-empty string" }
+  }
   if (typeof r.invocationCount !== "number" || r.invocationCount < 1) {
     return { ok: false, message: "`invocationCount` must be >= 1" }
   }
+  if (typeof r.deadline !== "number") {
+    return { ok: false, message: "`deadline` must be a number" }
+  }
   if (!r.journal || typeof r.journal !== "object") {
     return { ok: false, message: "`journal` must be an object" }
   }
@@ -351,7 +357,22 @@ function parseRequest(
   if (!r.runMeta || typeof r.runMeta !== "object") {
     return { ok: false, message: "`runMeta` must be an object" }
   }
-  return { ok: true, value: r as unknown as WorkflowStepRequest }
+  return {
+    ok: true,
+    value: {
+      protocolVersion: r.protocolVersion as ProtocolVersion,
+      runId: r.runId,
+      workflowId: r.workflowId,
+      workflowVersion: r.workflowVersion,
+      invocationCount: r.invocationCount,
+      input: r.input,
+      journal: r.journal as JournalSlice,
+      environment: env,
+      deadline: r.deadline,
+      tenantMeta: r.tenantMeta as WorkflowStepRequest["tenantMeta"],
+      runMeta: r.runMeta as WorkflowStepRequest["runMeta"],
+    },
+  }
 }
 
 // ---- Helpers ----

package/src/runtime/ctx.ts

@@ -1,4 +1,5 @@
 // Builds the `ctx` object passed to the workflow body.
+// agent-quality: file-size exception -- Central ctx API wiring remains together until wait/stream/group runtime slices can be extracted safely.
 //
 // The executor owns the waitpoint-pending queue and the callbacks
 // into the orchestrator; ctx is a thin shell that delegates.
@@ -360,7 +361,7 @@ export function buildCtx(args: CtxBuildArgs): WorkflowContext<unknown> {
       let closed = false
       return {
         async next(): Promise<IteratorResult<T>> {
-          if (closed) return { value: undefined as unknown as T, done: true }
+          if (closed) return { value: undefined, done: true }
           checkCancel()
           const iterId = `${iterIdPrefix}:iter:${nextClientId()}`
           const resolvedIter = lookupWaitpoint(iterId)
@@ -373,7 +374,7 @@ export function buildCtx(args: CtxBuildArgs): WorkflowContext<unknown> {
           const payload = resolvedIter.payload as unknown
           if (isStreamEnd(payload)) {
             closed = true
-            return { value: undefined as unknown as T, done: true }
+            return { value: undefined, done: true }
           }
           if (payload === undefined && onTimeout === "throw") {
             throw new Error(`waitpoint ${iterId} timed out`)
@@ -382,7 +383,7 @@ export function buildCtx(args: CtxBuildArgs): WorkflowContext<unknown> {
         },
         async return(): Promise<IteratorResult<T>> {
           closed = true
-          return { value: undefined as unknown as T, done: true }
+          return { value: undefined, done: true }
         },
         [Symbol.asyncIterator]() {
           return this
@@ -611,29 +612,25 @@ export function buildCtx(args: CtxBuildArgs): WorkflowContext<unknown> {
     }
   }
 
-  const streamImpl = async (
+  const streamImpl = async <T>(
     streamId: string,
-    sourceOrFn: AsyncIterable<unknown> | (() => AsyncGenerator<unknown>),
+    sourceFn: () => AsyncGenerator<T>,
   ): Promise<void> => {
-    const source =
-      typeof sourceOrFn === "function"
-        ? (sourceOrFn as () => AsyncGenerator<unknown>)()
-        : sourceOrFn
+    const source = sourceFn()
     await consumeStream(streamId, source, inferEncoding(source))
   }
 
-  // Typed shape variants. Each forwards to consumeStream with a fixed encoding.
-  ;(streamImpl as unknown as { text: StreamApi["text"] }).text = async (id, source) => {
-    await consumeStream(id, source, "text")
-  }
-  ;(streamImpl as unknown as { json: StreamApi["json"] }).json = async (id, source) => {
-    await consumeStream(id, source, "json")
-  }
-  ;(streamImpl as unknown as { bytes: StreamApi["bytes"] }).bytes = async (id, source) => {
-    await consumeStream(id, source, "base64")
-  }
-
-  const stream = streamImpl as unknown as StreamApi
+  const stream: StreamApi = Object.assign(streamImpl, {
+    text: async (id, source) => {
+      await consumeStream(id, source, "text")
+    },
+    json: async (id, source) => {
+      await consumeStream(id, source, "json")
+    },
+    bytes: async (id, source) => {
+      await consumeStream(id, source, "base64")
+    },
+  } satisfies Pick<StreamApi, "text" | "json" | "bytes">)
 
   // ---- groups ----
 
@@ -769,7 +766,7 @@ function normalizeChunk(value: unknown, encoding: "text" | "json" | "base64"): u
 function toBase64(bytes: Uint8Array): string {
   // Node + modern runtimes provide Buffer or btoa. Use Buffer when
   // available for efficiency; fall back to manual encode for isolates.
-  const g = globalThis as unknown as {
+  const g = globalThis as typeof globalThis & {
     Buffer?: { from(b: Uint8Array): { toString(enc: "base64"): string } }
     btoa?: (s: string) => string
   }

package/src/testing/index.ts

@@ -2,6 +2,7 @@
 //
 // In-process test harness with mocked steps, waits, and invokes.
 // Contract in docs/sdk-surface.md §11.
+// agent-quality: file-size exception -- legacy test harness stays co-located until pause/resume helpers are split.
 //
 // Drives `executeWorkflowStep` across resumptions. Steps resolve
 // from a user-supplied stub map; waitpoints resolve from fixtures.
@@ -31,6 +32,10 @@ import type {
 } from "../workflow.js"
 import { getWorkflow } from "../workflow.js"
 
+function workflowForExecutor<TIn, TOut>(def: WorkflowDefinition<TIn, TOut>): WorkflowDefinition {
+  return def as WorkflowDefinition
+}
+
 export interface TestOptions<_TIn> {
   /** Map of stepId → function run in place of the real step body. */
   steps?: Record<string, (stepCtx: StepContext) => unknown | Promise<unknown>>
@@ -128,7 +133,7 @@ export async function runWorkflowForTest<TIn, TOut>(
   while (invocationCount < maxInvocations) {
     invocationCount += 1
 
-    const response = await executeWorkflowStep(def as unknown as WorkflowDefinition, {
+    const response = await executeWorkflowStep(workflowForExecutor(def), {
       runId: `run_test_${def.id}`,
       workflowId: def.id,
       workflowVersion: "test",
@@ -363,7 +368,7 @@ export async function resumeWorkflowForTest<TIn, TOut>(
   while (invocationCount < maxInvocations) {
     invocationCount += 1
 
-    const response = await executeWorkflowStep(def as unknown as WorkflowDefinition, {
+    const response = await executeWorkflowStep(workflowForExecutor(def), {
       runId: `run_test_${def.id}`,
       workflowId: def.id,
       workflowVersion: "test",
@@ -681,23 +686,19 @@ async function resolveWaitpoint(
       at: now(),
       data: { childWorkflowId, input: childInput },
     })
-    const childResult = await runWorkflowForTest(
-      child as unknown as WorkflowHandle<unknown, unknown>,
-      childInput,
-      {
-        steps: opts.steps,
-        waitForEvent: opts.waitForEvent,
-        waitForSignal: opts.waitForSignal,
-        waitForToken: opts.waitForToken,
-        invoke: opts.invoke,
-        env: opts.env,
-        environment: opts.environment,
-        now: opts.now,
-        random: opts.random,
-        maxInvocations: opts.maxInvocations,
-        pauseOnWait: detach || opts.pauseOnWait,
-      },
-    )
+    const childResult = await runWorkflowForTest(child, childInput, {
+      steps: opts.steps,
+      waitForEvent: opts.waitForEvent,
+      waitForSignal: opts.waitForSignal,
+      waitForToken: opts.waitForToken,
+      invoke: opts.invoke,
+      env: opts.env,
+      environment: opts.environment,
+      now: opts.now,
+      random: opts.random,
+      maxInvocations: opts.maxInvocations,
+      pauseOnWait: detach || opts.pauseOnWait,
+    })
     parentEvents.push({
       type: "child.finished",
       at: now(),

package/src/workflow.ts

@@ -72,10 +72,8 @@ export interface ConcurrencyPolicy<TInput> {
  * would create a private map per bundle copy.
  */
 const REGISTRY_KEY = "__voyantWorkflowRegistry" as const
-const globalRef = globalThis as unknown as Record<
-  typeof REGISTRY_KEY,
-  Map<string, WorkflowDefinition> | undefined
->
+const globalRef = globalThis as typeof globalThis &
+  Record<typeof REGISTRY_KEY, Map<string, WorkflowDefinition> | undefined>
 const REGISTRY: Map<string, WorkflowDefinition> =
   globalRef[REGISTRY_KEY] ?? new Map<string, WorkflowDefinition>()
 globalRef[REGISTRY_KEY] = REGISTRY