render-lab-triggers 0.1.0__tar.gz

render_lab_triggers-0.1.0/.gitignore

@@ -0,0 +1,11 @@
+.venv/
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+dist/
+*.egg-info/
+.env
+.env.*
+!.env.example

render_lab_triggers-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Render Lab
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

render_lab_triggers-0.1.0/PKG-INFO

@@ -0,0 +1,72 @@
+Metadata-Version: 2.5
+Name: render-lab-triggers
+Version: 0.1.0
+Summary: HTTP, webhook, and cron dispatch for Render workflows
+License-Expression: MIT
+License-File: LICENSE
+Requires-Python: >=3.12
+Requires-Dist: render==1.0.1
+Requires-Dist: uvicorn<1,>=0.35
+Description-Content-Type: text/markdown
+
+# render-lab-triggers
+
+Registration-free HTTP, webhook, and cron dispatch to a separate Render Workflow.
+
+```python
+from render_lab_triggers import create_dispatch_server
+
+app = create_dispatch_server()
+# uvicorn main:app --host 0.0.0.0 --port 3000
+```
+
+`GET /healthz` returns `ok`. `POST /tasks/{namespace.task}` requires
+`Authorization: Bearer <DISPATCH_TOKEN>` and accepts JSON positional arguments
+(an array), a single JSON value, or an empty body (`[{}]`). It returns HTTP 202
+with `runId`. Add `?wait=1` for a bounded wait: HTTP 200 with status/results on
+completion or HTTP 202 when the wait expires. The default wait is 25 seconds.
+
+`create_dispatch_server` accepts `workflow_slug`, `token`, `dispatcher`,
+`webhooks`, `wait_timeout_ms`, and `max_body_bytes`. Bodies are capped at 1 MiB
+by counting streamed bytes, regardless of Content-Length. Oversized bodies
+return 413 before signature verification. The ASGI server owns connection cleanup.
+
+Vendor adapters live in `render_lab_tasks_<vendor>.webhooks`; mount them in the
+`webhooks` mapping at `/webhooks/{name}`. Their `verify` function sees the exact
+raw UTF-8 body and lowercase headers before JSON parsing. `map` returns a
+`{"task": ..., "args": [...]}` dispatch or `None` to acknowledge and ignore.
+As in the pinned TS server, webhook bodies must be JSON. Twilio form-encoded
+signatures can be verified with its standalone adapter, but form dispatch needs
+a custom endpoint that decodes the form after verification.
+
+```python
+from render_lab_triggers import run_cron
+
+# In an async cron entry point:
+# result = await run_cron(task="report.daily", args=[{}])
+```
+
+`run_cron` defaults to asynchronous dispatch. `wait=True` waits at most five
+minutes; `wait_timeout_ms` overrides it. `render_dispatcher(slug=...)` starts via
+the pinned Render SDK and consumes its public SSE event iterator. It closes
+streams on completion, timeout, and cancellation, without adding retries.
+`client=` injects a RenderAsync-compatible client; the caller owns that client.
+`serve_dispatch_server(port=..., **options)` runs Uvicorn until shutdown.
+
+## Environment
+
+- `WORKFLOW_SLUG`: target Workflow slug, unless provided explicitly.
+- `DISPATCH_TOKEN`: bearer token for `/tasks/*`; unset rejects all such requests.
+- `RENDER_API_KEY`: Render SDK credential, read when dispatching.
+- `CRON_TASK`: default cron task name.
+- `CRON_INPUT`: JSON cron input; an array is positional arguments.
+- `PORT`: serving port, default 3000.
+
+Imports never read credentials or register tasks. Tests inject dispatchers and
+SDK event streams; live cross-service dispatch remains in the testing backlog.
+
+## Installation
+
+```sh
+pip install render-lab-triggers==0.1.0
+```

render_lab_triggers-0.1.0/README.md

@@ -0,0 +1,61 @@
+# render-lab-triggers
+
+Registration-free HTTP, webhook, and cron dispatch to a separate Render Workflow.
+
+```python
+from render_lab_triggers import create_dispatch_server
+
+app = create_dispatch_server()
+# uvicorn main:app --host 0.0.0.0 --port 3000
+```
+
+`GET /healthz` returns `ok`. `POST /tasks/{namespace.task}` requires
+`Authorization: Bearer <DISPATCH_TOKEN>` and accepts JSON positional arguments
+(an array), a single JSON value, or an empty body (`[{}]`). It returns HTTP 202
+with `runId`. Add `?wait=1` for a bounded wait: HTTP 200 with status/results on
+completion or HTTP 202 when the wait expires. The default wait is 25 seconds.
+
+`create_dispatch_server` accepts `workflow_slug`, `token`, `dispatcher`,
+`webhooks`, `wait_timeout_ms`, and `max_body_bytes`. Bodies are capped at 1 MiB
+by counting streamed bytes, regardless of Content-Length. Oversized bodies
+return 413 before signature verification. The ASGI server owns connection cleanup.
+
+Vendor adapters live in `render_lab_tasks_<vendor>.webhooks`; mount them in the
+`webhooks` mapping at `/webhooks/{name}`. Their `verify` function sees the exact
+raw UTF-8 body and lowercase headers before JSON parsing. `map` returns a
+`{"task": ..., "args": [...]}` dispatch or `None` to acknowledge and ignore.
+As in the pinned TS server, webhook bodies must be JSON. Twilio form-encoded
+signatures can be verified with its standalone adapter, but form dispatch needs
+a custom endpoint that decodes the form after verification.
+
+```python
+from render_lab_triggers import run_cron
+
+# In an async cron entry point:
+# result = await run_cron(task="report.daily", args=[{}])
+```
+
+`run_cron` defaults to asynchronous dispatch. `wait=True` waits at most five
+minutes; `wait_timeout_ms` overrides it. `render_dispatcher(slug=...)` starts via
+the pinned Render SDK and consumes its public SSE event iterator. It closes
+streams on completion, timeout, and cancellation, without adding retries.
+`client=` injects a RenderAsync-compatible client; the caller owns that client.
+`serve_dispatch_server(port=..., **options)` runs Uvicorn until shutdown.
+
+## Environment
+
+- `WORKFLOW_SLUG`: target Workflow slug, unless provided explicitly.
+- `DISPATCH_TOKEN`: bearer token for `/tasks/*`; unset rejects all such requests.
+- `RENDER_API_KEY`: Render SDK credential, read when dispatching.
+- `CRON_TASK`: default cron task name.
+- `CRON_INPUT`: JSON cron input; an array is positional arguments.
+- `PORT`: serving port, default 3000.
+
+Imports never read credentials or register tasks. Tests inject dispatchers and
+SDK event streams; live cross-service dispatch remains in the testing backlog.
+
+## Installation
+
+```sh
+pip install render-lab-triggers==0.1.0
+```

render_lab_triggers-0.1.0/pyproject.toml

@@ -0,0 +1,16 @@
+[build-system]
+requires = ["hatchling>=1.27,<2"]
+build-backend = "hatchling.build"
+
+[project]
+name = "render-lab-triggers"
+version = "0.1.0"
+description = "HTTP, webhook, and cron dispatch for Render workflows"
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+requires-python = ">=3.12"
+dependencies = ["render==1.0.1", "uvicorn>=0.35,<1"]
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/render_lab_triggers"]

render_lab_triggers-0.1.0/src/render_lab_triggers/__init__.py

@@ -0,0 +1,6 @@
+"""Registration-free HTTP, webhook, and cron dispatch."""
+
+from .cron import run_cron as run_cron
+from .dispatch import render_dispatcher as render_dispatcher
+from .server import create_dispatch_server as create_dispatch_server
+from .server import serve_dispatch_server as serve_dispatch_server

render_lab_triggers-0.1.0/src/render_lab_triggers/cron.py

@@ -0,0 +1,50 @@
+"""Dispatch one run from a cron job."""
+
+from __future__ import annotations
+
+import json
+import os
+from typing import cast
+
+from .dispatch import render_dispatcher
+from .types import CronResult, Json, WorkflowDispatcher
+
+
+def parse_args(text: str | None) -> list[Json]:
+    if not text:
+        return [{}]
+
+    def invalid(value: str) -> None:
+        raise ValueError(f"Invalid JSON constant: {value}")
+
+    value = cast(Json, json.loads(text, parse_constant=invalid))
+    # Reject overflow to infinity as well as named nonfinite constants.
+    json.dumps(value, allow_nan=False)
+    return value if isinstance(value, list) else [value]
+
+
+async def run_cron(
+    *,
+    workflow_slug: str | None = None,
+    task: str | None = None,
+    args: list[Json] | None = None,
+    dispatcher: WorkflowDispatcher | None = None,
+    wait: bool = False,
+    wait_timeout_ms: float = 300_000,
+) -> CronResult:
+    slug = workflow_slug if workflow_slug is not None else os.getenv("WORKFLOW_SLUG")
+    if not slug:
+        raise ValueError("run_cron: set WORKFLOW_SLUG or pass workflow_slug.")
+    target = task if task is not None else os.getenv("CRON_TASK")
+    if not target:
+        raise ValueError("run_cron: set CRON_TASK or pass task.")
+    inputs = args if args is not None else parse_args(os.getenv("CRON_INPUT"))
+    dispatch = dispatcher if dispatcher is not None else render_dispatcher(slug=slug)
+    if wait:
+        result = await dispatch.run(target, inputs, wait_timeout_ms)
+        out: CronResult = {"runId": result["runId"], "status": result["status"]}
+        if "results" in result:
+            out["results"] = result["results"]
+        return out
+    started = await dispatch.start(target, inputs)
+    return {"runId": started["runId"], "status": "running"}

render_lab_triggers-0.1.0/src/render_lab_triggers/dispatch.py

@@ -0,0 +1,71 @@
+"""Bounded cross-service dispatch using the Render SDK's public SSE iterator."""
+
+from __future__ import annotations
+
+import asyncio
+from collections.abc import AsyncIterator
+from contextlib import asynccontextmanager
+from typing import TYPE_CHECKING, cast
+
+from .types import Json, RunOutcome, StartedRun
+
+if TYPE_CHECKING:
+    from render import RenderAsync
+    from render.client.workflows import WorkflowsService
+
+
+class RenderDispatcher:
+    def __init__(self, slug: str, client: RenderAsync | None = None) -> None:
+        self.slug = slug
+        self._client = client
+
+    @asynccontextmanager
+    async def _service(self) -> AsyncIterator[WorkflowsService]:
+        if self._client is not None:
+            yield self._client.workflows
+            return
+        from render import RenderAsync
+
+        client = RenderAsync()
+        # The generated client owns its HTTP pool; close it after this dispatch.
+        async with client.client.internal:
+            yield client.workflows
+
+    async def start(self, task: str, args: list[Json]) -> StartedRun:
+        async with self._service() as service:
+            started = await service.start_task(f"{self.slug}/{task}", args)
+            return {"runId": started.id}
+
+    async def run(self, task: str, args: list[Json], timeout_ms: float) -> RunOutcome:
+        async with self._service() as service:
+            started = await service.start_task(f"{self.slug}/{task}", args)
+            stream = service.task_run_events([started.id])
+            # aclosing's protocol is stronger than the SDK iterator annotation;
+            # close the public async generator when it exposes aclose.
+            try:
+                async with asyncio.timeout(max(0, timeout_ms) / 1000) as deadline:
+                    async for details in stream:
+                        if details.id != started.id:
+                            continue
+                        status = str(details.status)
+                        if status not in {"succeeded", "completed", "failed", "canceled"}:
+                            continue
+                        return {
+                            "runId": started.id,
+                            "status": status,
+                            "results": cast(Json, details.results),
+                            "timedOut": False,
+                        }
+                    raise RuntimeError("Workflow event stream ended before the run finished")
+            except TimeoutError:
+                if not deadline.expired():
+                    raise
+                return {"runId": started.id, "status": "running", "timedOut": True}
+            finally:
+                close = getattr(stream, "aclose", None)
+                if close is not None:
+                    await close()
+
+
+def render_dispatcher(*, slug: str, client: RenderAsync | None = None) -> RenderDispatcher:
+    return RenderDispatcher(slug, client)

render_lab_triggers-0.1.0/src/render_lab_triggers/server.py

@@ -0,0 +1,185 @@
+"""Small ASGI dispatch application with bounded request bodies."""
+
+from __future__ import annotations
+
+import hmac
+import json
+import os
+from collections.abc import Awaitable, Callable, Mapping
+from typing import Any
+from urllib.parse import parse_qs
+
+from .cron import parse_args
+from .dispatch import render_dispatcher
+from .types import Json, WebhookAdapter, WorkflowDispatcher
+
+type Message = dict[str, Any]
+type Receive = Callable[[], Awaitable[Message]]
+type Send = Callable[[Message], Awaitable[None]]
+
+
+async def _body(receive: Receive, maximum: int) -> str | None:
+    chunks: list[bytes] = []
+    size = 0
+    while True:
+        message = await receive()
+        if message["type"] == "http.disconnect":
+            raise ConnectionError("Client disconnected")
+        chunk: bytes = message.get("body", b"")
+        size += len(chunk)
+        if size > maximum:
+            return None
+        chunks.append(chunk)
+        if not message.get("more_body", False):
+            return b"".join(chunks).decode("utf-8", errors="replace")
+
+
+async def _respond(send: Send, status: int, body: Json = None, *, text: bool = False) -> None:
+    data = (
+        b""
+        if status == 204
+        else (
+            str(body).encode()
+            if text
+            else json.dumps(body, allow_nan=False, separators=(",", ":")).encode()
+        )
+    )
+    content_type = b"text/plain; charset=UTF-8" if text else b"application/json"
+    await send(
+        {
+            "type": "http.response.start",
+            "status": status,
+            "headers": [
+                (b"content-type", content_type),
+                (b"content-length", str(len(data)).encode()),
+            ],
+        }
+    )
+    await send({"type": "http.response.body", "body": data})
+
+
+class DispatchServer:
+    def __init__(
+        self,
+        *,
+        workflow_slug: str | None = None,
+        token: str | None = None,
+        webhooks: Mapping[str, WebhookAdapter] | None = None,
+        dispatcher: WorkflowDispatcher | None = None,
+        wait_timeout_ms: float = 25_000,
+        max_body_bytes: int = 1_048_576,
+    ) -> None:
+        if max_body_bytes < 0:
+            raise ValueError("max_body_bytes must be nonnegative")
+        self.slug = workflow_slug if workflow_slug is not None else os.getenv("WORKFLOW_SLUG")
+        self.token = token if token is not None else os.getenv("DISPATCH_TOKEN")
+        self.webhooks = dict(webhooks or {})
+        self.dispatcher = (
+            dispatcher if dispatcher is not None else render_dispatcher(slug=self.slug or "")
+        )
+        self.wait_timeout_ms = wait_timeout_ms
+        self.max_body_bytes = max_body_bytes
+
+    async def __call__(self, scope: Message, receive: Receive, send: Send) -> None:
+        if scope["type"] == "lifespan":
+            while True:
+                message = await receive()
+                if message["type"] == "lifespan.startup":
+                    await send({"type": "lifespan.startup.complete"})
+                elif message["type"] == "lifespan.shutdown":
+                    await send({"type": "lifespan.shutdown.complete"})
+                    return
+        if scope["type"] != "http":
+            raise ValueError("Only HTTP and lifespan ASGI scopes are supported")
+        path = scope["path"]
+        if path == "/healthz" and scope["method"] == "GET":
+            await _respond(send, 200, "ok", text=True)
+            return
+        parts = path.split("/")
+        generic = len(parts) == 3 and parts[1] == "tasks" and bool(parts[2])
+        adapter = (
+            self.webhooks.get(parts[2]) if len(parts) == 3 and parts[1] == "webhooks" else None
+        )
+        if scope["method"] != "POST" or not (generic or adapter):
+            await _respond(send, 404, {"error": "not found"})
+            return
+        headers = {
+            k.decode("latin1").lower(): v.decode("latin1") for k, v in scope.get("headers", [])
+        }
+        if generic:
+            header = headers.get("authorization", "")
+            if (
+                not self.token
+                or not header.startswith("Bearer ")
+                or not hmac.compare_digest(header[7:].encode(), self.token.encode())
+            ):
+                await _respond(send, 401, {"error": "unauthorized"})
+                return
+        if not self.slug:
+            await _respond(send, 500, {"error": "WORKFLOW_SLUG not configured"})
+            return
+        raw = await _body(receive, self.max_body_bytes)
+        if raw is None:
+            await _respond(send, 413, {"error": "payload too large"})
+            return
+        if adapter is not None and not adapter.verify({"headers": headers, "rawBody": raw}):
+            await _respond(send, 401, {"error": "invalid signature"})
+            return
+        try:
+            args = parse_args(raw)
+            body = json.loads(raw) if raw else {}
+        except (ValueError, TypeError):
+            await _respond(send, 400, {"error": "invalid JSON body"})
+            return
+        task = parts[2]
+        if adapter is not None:
+            mapped = adapter.map({"headers": headers, "body": body})
+            if mapped is None:
+                await _respond(send, 204)
+                return
+            task, args = mapped["task"], mapped["args"]
+        try:
+            wait = parse_qs(scope.get("query_string", b"").decode()).get("wait", [""])[0]
+            if generic and wait in {"1", "true"}:
+                result = await self.dispatcher.run(task, args, self.wait_timeout_ms)
+                output: dict[str, Json] = {"runId": result["runId"], "status": result["status"]}
+                if result["timedOut"]:
+                    output["status"] = "running"
+                elif "results" in result:
+                    output["results"] = result["results"]
+                await _respond(send, 202 if result["timedOut"] else 200, output)
+            else:
+                started = await self.dispatcher.start(task, args)
+                await _respond(send, 202, {"runId": started["runId"]})
+        except Exception as error:
+            await _respond(send, 502, {"error": "dispatch failed", "detail": str(error)})
+
+
+def create_dispatch_server(
+    *,
+    workflow_slug: str | None = None,
+    token: str | None = None,
+    webhooks: Mapping[str, WebhookAdapter] | None = None,
+    dispatcher: WorkflowDispatcher | None = None,
+    wait_timeout_ms: float = 25_000,
+    max_body_bytes: int = 1_048_576,
+) -> DispatchServer:
+    return DispatchServer(
+        workflow_slug=workflow_slug,
+        token=token,
+        webhooks=webhooks,
+        dispatcher=dispatcher,
+        wait_timeout_ms=wait_timeout_ms,
+        max_body_bytes=max_body_bytes,
+    )
+
+
+def serve_dispatch_server(*, port: int | None = None, **options: Any) -> None:
+    """Serve until shutdown; Python's Uvicorn runner owns the event loop."""
+    import uvicorn
+
+    uvicorn.run(
+        create_dispatch_server(**options),
+        host="0.0.0.0",
+        port=port if port is not None else int(os.getenv("PORT", "3000")),
+    )

render_lab_triggers-0.1.0/src/render_lab_triggers/types.py

@@ -0,0 +1,57 @@
+"""Registration-free trigger contracts."""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+from dataclasses import dataclass
+from typing import NotRequired, Protocol, TypedDict
+
+type Json = None | bool | int | float | str | list[Json] | dict[str, Json]
+
+
+class StartedRun(TypedDict):
+    runId: str
+
+
+class RunOutcome(StartedRun):
+    status: str
+    results: NotRequired[Json]
+    timedOut: bool
+
+
+class WorkflowDispatcher(Protocol):
+    async def start(self, task: str, args: list[Json]) -> StartedRun: ...
+    async def run(self, task: str, args: list[Json], timeout_ms: float) -> RunOutcome: ...
+
+
+class WebhookRequest(TypedDict):
+    headers: dict[str, str]
+    rawBody: str
+
+
+class WebhookContext(TypedDict):
+    headers: dict[str, str]
+    body: Json
+
+
+class WebhookDispatch(TypedDict):
+    task: str
+    args: list[Json]
+
+
+class WebhookAdapter(Protocol):
+    def verify(self, request: WebhookRequest) -> bool: ...
+    def map(self, context: WebhookContext) -> WebhookDispatch | None: ...
+
+
+@dataclass(frozen=True)
+class Adapter:
+    """A pair of pure signature and event mapping functions."""
+
+    verify: Callable[[WebhookRequest], bool]
+    map: Callable[[WebhookContext], WebhookDispatch | None]
+
+
+class CronResult(StartedRun):
+    status: str
+    results: NotRequired[Json]

render_lab_triggers-0.1.0/tests/test_triggers.py

@@ -0,0 +1,195 @@
+import asyncio
+from types import SimpleNamespace
+
+import httpx
+import pytest
+from render_lab_triggers import create_dispatch_server, render_dispatcher, run_cron
+from render_lab_triggers.types import Adapter
+
+
+class Dispatcher:
+    def __init__(self, *, timeout=False, failure=False):
+        self.calls = []
+        self.timeout = timeout
+        self.failure = failure
+
+    async def start(self, task, args):
+        self.calls.append((task, args))
+        if self.failure:
+            raise RuntimeError("vendor unavailable")
+        return {"runId": "run-1"}
+
+    async def run(self, task, args, timeout_ms):
+        self.calls.append((task, args, timeout_ms))
+        return {"runId": "run-1", "status": "succeeded", "results": [3], "timedOut": self.timeout}
+
+
+@pytest.mark.parametrize(
+    "body,args", [(b"", [{}]), (b'{"a":1}', [{"a": 1}]), (b"[1,2]", [1, 2]), (b"null", [None])]
+)
+async def test_dispatch_args_and_auth(body, args):
+    dispatcher = Dispatcher()
+    app = create_dispatch_server(workflow_slug="workflow", token="secret", dispatcher=dispatcher)
+    async with httpx.AsyncClient(
+        transport=httpx.ASGITransport(app), base_url="http://test"
+    ) as client:
+        assert (await client.get("/healthz")).text == "ok"
+        assert (await client.post("/tasks/demo.run", content=body)).status_code == 401
+        response = await client.post(
+            "/tasks/demo.run", content=body, headers={"Authorization": "Bearer secret"}
+        )
+        assert response.status_code == 202
+        assert response.json() == {"runId": "run-1"}
+    assert dispatcher.calls == [("demo.run", args)]
+
+
+@pytest.mark.parametrize("timed_out,status", [(False, 200), (True, 202)])
+async def test_bounded_wait_response(timed_out, status):
+    dispatcher = Dispatcher(timeout=timed_out)
+    app = create_dispatch_server(
+        workflow_slug="w", token="t", dispatcher=dispatcher, wait_timeout_ms=17
+    )
+    async with httpx.AsyncClient(
+        transport=httpx.ASGITransport(app), base_url="http://test"
+    ) as client:
+        response = await client.post(
+            "/tasks/a?wait=true", json={}, headers={"Authorization": "Bearer t"}
+        )
+    assert response.status_code == status
+    assert response.json() == (
+        {"runId": "run-1", "status": "running"}
+        if timed_out
+        else {"runId": "run-1", "status": "succeeded", "results": [3]}
+    )
+    assert dispatcher.calls == [("a", [{}], 17)]
+
+
+async def test_stream_body_limit_precedes_signature_and_ignores_content_length():
+    verified = []
+    adapter = Adapter(lambda request: verified.append(request) or True, lambda context: None)
+    app = create_dispatch_server(workflow_slug="w", webhooks={"vendor": adapter}, max_body_bytes=4)
+    chunks = iter([b"123", b"45", b"must not be read"])
+    reads, sent = [], []
+
+    async def receive():
+        chunk = next(chunks)
+        reads.append(chunk)
+        return {"type": "http.request", "body": chunk, "more_body": True}
+
+    async def send(message):
+        sent.append(message)
+
+    await app(
+        {
+            "type": "http",
+            "method": "POST",
+            "path": "/webhooks/vendor",
+            "headers": [(b"content-length", b"1")],
+        },
+        receive,
+        send,
+    )
+    assert sent[0]["status"] == 413
+    assert reads == [b"123", b"45"]
+    assert not verified
+
+
+async def test_signature_before_json_then_mapping_and_errors():
+    dispatcher = Dispatcher()
+    adapter = Adapter(
+        lambda request: request["headers"].get("x-signature") == "valid",
+        lambda context: (
+            {"task": "events.handle", "args": [context["body"]]} if context["body"] else None
+        ),
+    )
+    app = create_dispatch_server(
+        workflow_slug="w", token="t", dispatcher=dispatcher, webhooks={"vendor": adapter}
+    )
+    async with httpx.AsyncClient(
+        transport=httpx.ASGITransport(app), base_url="http://test"
+    ) as client:
+        assert (await client.post("/webhooks/vendor", content="bad")).status_code == 401
+        assert (
+            await client.post("/webhooks/vendor", content="bad", headers={"X-Signature": "valid"})
+        ).status_code == 400
+        assert (
+            await client.post("/webhooks/vendor", json={}, headers={"X-Signature": "valid"})
+        ).status_code == 204
+        assert (
+            await client.post(
+                "/webhooks/vendor", json={"event": 1}, headers={"X-Signature": "valid"}
+            )
+        ).status_code == 202
+        dispatcher.failure = True
+        assert (
+            await client.post("/tasks/a", headers={"Authorization": "Bearer t"})
+        ).status_code == 502
+        for body in ["NaN", "1e999"]:
+            assert (
+                await client.post("/tasks/a", content=body, headers={"Authorization": "Bearer t"})
+            ).status_code == 400
+    assert dispatcher.calls[0] == ("events.handle", [{"event": 1}])
+
+
+async def test_cron_env_and_explicit_empty_args(monkeypatch):
+    monkeypatch.setenv("WORKFLOW_SLUG", "w")
+    monkeypatch.setenv("CRON_TASK", "cron.run")
+    monkeypatch.setenv("CRON_INPUT", '{"a":1}')
+    dispatcher = Dispatcher()
+    assert await run_cron(dispatcher=dispatcher) == {"runId": "run-1", "status": "running"}
+    assert dispatcher.calls[-1] == ("cron.run", [{"a": 1}])
+    result = await run_cron(dispatcher=dispatcher, args=[], wait=True, wait_timeout_ms=31)
+    assert result["results"] == [3]
+    assert dispatcher.calls[-1] == ("cron.run", [], 31)
+    with pytest.raises(ValueError, match="WORKFLOW_SLUG"):
+        await run_cron(workflow_slug="", dispatcher=dispatcher)
+
+
+class Service:
+    def __init__(self, mode):
+        self.mode = mode
+        self.closed = False
+        self.calls = []
+        self.entered = asyncio.Event()
+
+    async def start_task(self, slug, args):
+        self.calls.append((slug, args))
+        return SimpleNamespace(id="run-1")
+
+    async def task_run_events(self, ids):
+        assert ids == ["run-1"]
+        self.entered.set()
+        try:
+            if self.mode == "timeout":
+                await asyncio.Event().wait()
+            if self.mode == "network_timeout":
+                raise TimeoutError("upstream timeout")
+            if self.mode == "end":
+                return
+            yield SimpleNamespace(id="other", status="failed", results=[])
+            yield SimpleNamespace(id="run-1", status="running", results=[])
+            yield SimpleNamespace(id="run-1", status="succeeded", results=[{"ok": True}])
+        finally:
+            self.closed = True
+
+
+@pytest.mark.parametrize("mode", ["success", "timeout", "end", "network_timeout", "cancel"])
+async def test_sdk_dispatch_wait_cleanup(mode):
+    service = Service(mode if mode != "cancel" else "timeout")
+    dispatcher = render_dispatcher(slug="workflow", client=SimpleNamespace(workflows=service))
+    if mode == "cancel":
+        task = asyncio.create_task(dispatcher.run("demo.run", [3], 10000))
+        await service.entered.wait()
+        task.cancel()
+        with pytest.raises(asyncio.CancelledError):
+            await task
+    elif mode in {"end", "network_timeout"}:
+        with pytest.raises((RuntimeError, TimeoutError)):
+            await dispatcher.run("demo.run", [3], 10000)
+    else:
+        result = await dispatcher.run("demo.run", [3], 1 if mode == "timeout" else 10000)
+        assert result["timedOut"] is (mode == "timeout")
+        if mode == "success":
+            assert result["results"] == [{"ok": True}]
+    assert service.calls == [("workflow/demo.run", [3])]
+    assert service.closed