Refactor host transport ownership and remove redundant code

[cnluzhang]

Summary

• Move Durable Object owner routing, process-local hint caching, retry policy, and invoke/connect framing out of generated tenant code and into the binding-scoped host adapter while preserving the public DO API.
• Reserve root module names beginning with _wdl- for generated platform modules and enforce the same rule at deploy and cold-load boundaries.
• Give D1/DO owner headers, owner TTL and drain-timeout syntax, Workflow tick responses, session policy, Redis keys, and content-type parsing explicit shared owners or executable parity guards.
• Remove dead forwarding exports, test-only production surfaces, unused Rust dependencies, stale test plumbing, and unowned test workers; retain manual smoke projects under examples/.
• Replace implementation-shaped checks with executable module-graph, persisted-environment, wire-contract, and internal-dispatch regression coverage.

Why

The tenant DO facade still carried privileged routing machinery after the host proxy became authoritative. Repository-wide audit work also found duplicate cross-tier decisions and test imports that kept otherwise dead production exports alive. This change moves policy back to its owning trust boundary, reduces generated tenant code, and makes the remaining deployment and wire contracts mechanically reviewable.

Behavioral Impact

• The public Durable Object binding contract is unchanged. Owner hints are now held by a shared, bounded process-local host cache; eviction only causes a router lookup on the next request.
• D1_OWNER_TTL_SECONDS, DO_OWNER_TTL_SECONDS, D1_DRAIN_TIMEOUT_MS, and supervisor-side DO_DRAIN_TIMEOUT_MS now accept only canonical positive decimal strings within their documented bounds. Invalid values use the documented fallback.
• Root _wdl-* module names are platform-reserved. New deployments are rejected, and an existing immutable version using that prefix must be renamed and redeployed before it can cold-load on the new runtime.

Rollout

Before rolling the first user-runtime or do-runtime reader, pause Control mutations and verify that retained immutable versions do not contain root _wdl-* modules. Redeploy any affected versions. Keep mutations paused while user-runtime and do-runtime roll first, followed by system-runtime and Control, and resume only after every tier has converged.

Validation

• npm test
• npm run lint:unused
• strict TypeScript checking
• production and local workerd configuration compilation
• staged diff checks

[Copilot]

Pull request overview

Refactors host transport ownership, consolidates cross-tier contracts, removes dead exports/fixtures, and adds executable contract guards.

Changes:

• Moves Durable Object routing and retry policy into host adapters.
• Centralizes environment, protocol, Redis-key, and response contracts.
• Removes unused surfaces and reorganizes manual examples.

Reviewed changes

Copilot reviewed 153 out of 160 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
types/workerd-embedded.d.ts	Updates embedded source declarations.
tsconfig.json	Maps the scoped-request module.
tests/unit/secret-envelope.test.js	Imports base64 from its owner.
tests/unit/runtime-wrapper-generate.test.js	Guards generated helper exports.
tests/unit/runtime-load.test.js	Tests injection graph closure.
tests/unit/runtime-internal-auth.test.js	Removes obsolete binding stubs.
tests/unit/runtime-dispatch-workflows.test.js	Tests workflow owners directly.
tests/unit/runtime-dispatch-handlers.test.js	Uses replay-cache owner directly.
tests/unit/runtime-d1-stub.test.js	Adds shared D1 contracts.
tests/unit/runtime-bindings-do.test.js	Loads scoped-request codec.
tests/unit/respond.test.js	Tests content-type normalization.
tests/unit/owner-lease.test.js	Tests TTL overflow bound.
tests/unit/integration-pool.test.js	Removes redundant environment assertion.
tests/unit/integration-environment.test.js	Guards shared image builds.
tests/unit/gateway-index.test.js	Adds worker-contract replacement.
tests/unit/env.test.js	Tests canonical environment parsing.
tests/unit/do-runtime-protocol.test.js	Imports split DO protocol owners.
tests/unit/do-owner-registry.test.js	Tests canonical owner TTLs.
tests/unit/d1-router.test.js	Adds query-wire replacement.
tests/unit/d1-protocol.test.js	Tests shared D1 contracts.
tests/unit/d1-owner-registry.test.js	Tests TTL and drain parsing.
tests/unit/control-logs-tail.test.js	Checks Redis key parity.
tests/unit/control-lib.test.js	Checks workflow key parity.
tests/unit/control-deploy-watch.test.js	Imports budget constant directly.
tests/unit/auth-lib.test.js	Imports token helpers directly.
tests/integration/workflows-runtime-scheduler.test.js	Validates tick response fields.
tests/integration/helpers/workflows-scenarios.js	Re-exports tick helper.
tests/integration/helpers/workflow-tick.js	Adds tick response validator.
tests/integration/helpers/index.js	Exports tick helper.
tests/integration/helpers/durable-objects.js	Aligns alarm hashing.
tests/integration/gateway.test.js	Simplifies metrics coverage.
tests/integration/durable-objects-ownership.test.js	Renames host ownership tests.
tests/integration/durable-objects-alarms.test.js	Validates alarm tick responses.
tests/helpers/style-contract-scanner.js	Removes unused scanner helper.
tests/helpers/source-scan.js	Adds AST module scanning.
tests/helpers/runtime-injection-sources.js	Mirrors injection dependencies.
tests/helpers/load-runtime-dispatch.js	Simplifies module rewrites.
tests/helpers/load-runtime-ai-binding.js	Imports test owners directly.
tests/helpers/load-do-protocol.js	Loads split DO codec/errors.
tests/helpers/load-do-owner-registry.js	Exposes TTL parser.
tests/helpers/load-do-host-actor.js	Adds worker-contract replacement.
tests/helpers/load-d1-protocol.js	Adds response helper replacement.
tests/helpers/load-d1-owner-registry.js	Exposes drain parser.
tests/helpers/load-d1-owner-client.js	Adds response helper mapping.
tests/helpers/load-d1-actor.js	Adds content-type helper mapping.
tests/helpers/load-auth-lib.js	Removes obsolete token rewrite.
tests/helpers/load-auth-index.js	Removes obsolete token rewrite.
tests/helpers/control-shared-stub.js	Removes dead error export.
tests/fixtures/workflow-tick-response.json	Defines tick response shape.
tests/fixtures/redis-key-parity.json	Defines cross-language Redis keys.
tests/fixtures/owner-ttl-env.json	Defines owner TTL syntax.
tests/fixtures/d1-drain-timeout-env.json	Defines drain timeout syntax.
test-workers/queue-writer/wrangler.toml	Removes unowned queue fixture.
test-workers/queue-writer/src/index.js	Removes queue producer fixture.
test-workers/queue-writer/package.json	Removes fixture package.
test-workers/queue-sink/wrangler.toml	Removes queue consumer fixture.
test-workers/queue-sink/src/index.js	Removes queue sink fixture.
test-workers/queue-sink/package.json	Removes fixture package.
test-workers/cron-writer/wrangler.toml	Removes cron producer fixture.
test-workers/cron-writer/src/index.js	Removes cron worker fixture.
test-workers/cron-writer/package.json	Removes fixture package.
test-workers/cron-sink/wrangler.toml	Removes cron sink fixture.
test-workers/cron-sink/src/index.js	Removes cron sink worker.
test-workers/cron-sink/package.json	Removes fixture package.
terraform/README.md	Updates example path.
shared/secret-envelope.js	Removes redundant base64 export.
shared/respond.js	Adds content-type essence helper.
shared/redis.js	Narrows Redis barrel exports.
shared/owner-lease.js	Centralizes bounded owner TTL parsing.
shared/env.js	Adds canonical integer parsing.
shared/d1-query-wire.js	Owns D1 routing constants.
shared/auth-token.js	Clarifies sanitizer ownership.
scripts/_integration-pool.js	Removes redundant variant environment.
rust/workflows/src/keys.rs	Tests Redis key parity.
rust/workflows/src/api/tick.rs	Uses shared tick response.
rust/workflows/Cargo.toml	Enables shared serde support.
rust/supervisor/src/config.rs	Aligns canonical environment parsing.
rust/scheduler/src/workflows.rs	Uses shared tick response shape.
rust/scheduler/src/tasks.rs	Uses extracted polling policy.
rust/redis-proxy/src/logs.rs	Tests log key parity.
rust/redis-proxy/Cargo.toml	Removes unused dependency.
rust/common/src/workflow_tick.rs	Defines shared tick shape.
rust/common/src/lib.rs	Exposes tick module.
rust/common/src/env.rs	Adds bounded decimal parser.
rust/common/Cargo.toml	Adds optional serde feature.
rust/Cargo.lock	Updates Rust dependencies.
runtime/load/wrapper-generate.js	Removes unused wrapper helper.
runtime/load/module-rewrite.js	Reuses historical DO module slot.
runtime/load/injection-sources.js	Injects only scoped DO codec.
runtime/load/code-budget.js	Updates injected module accounting.
runtime/load.js	Uses shared content-type parsing.
runtime/internal.js	Removes redundant adapter exports.
runtime/do-client.js	Reduces tenant DO facade transport.
runtime/dispatch/workflow-json.js	Removes test-only exports.
runtime/dispatch.js	Removes forwarding test exports.
runtime/config-user.capnp	Embeds host/scoped DO modules.
runtime/config-system.capnp	Updates embedded module graph.
runtime/bindings/do.js	Reads scoped requests host-side.
runtime/bindings/d1.js	Uses shared D1 contracts.
runtime/bindings/ai.js	Uses owned helpers directly.
runtime/bindings/ai-websocket.js	Improves record type narrowing.
runtime/bindings/ai-provider.js	Simplifies narrowed records.
runtime/bindings/ai-capacity.js	Marks test-only hooks.
runtime/_wdl-owner-hint-cache.js	Makes cache host-only.
runtime/_wdl-owner-endpoint.js	Updates ownership comment.
runtime/_wdl-do-transport.js	Retains host routing transport.
runtime/_wdl-do-scoped-request.js	Adds tenant-safe request codec.
README.zh.md	Updates example paths.
README.md	Updates example paths.
gateway/index.js	Uses canonical session policy.
examples/ws-echo/wrangler.toml	Adds smoke manifest.
examples/ws-echo/src/index.js	Refines WebSocket smoke worker.
examples/ws-echo/README.md	Documents smoke usage.
examples/ws-echo/package.json	Adds example package.
examples/hello-jsonc/wrangler.jsonc	Updates example comment.
examples/hello-jsonc/src/index.js	Adds hello worker.
examples/hello-jsonc/README.md	Documents hello example.
examples/hello-jsonc/package.json	Adds example package.
docs/testing.zh.md	Documents analysis boundaries.
docs/testing.md	Documents analysis boundaries.
docs/source-map.zh.md	Updates source ownership map.
docs/source-map.md	Updates source ownership map.
docs/rust-sidecar-standards.zh.md	Documents shared wire shapes.
docs/rust-sidecar-standards.md	Documents shared wire shapes.
docs/protocol-contracts.zh.md	Updates protocol ownership.
docs/protocol-contracts.md	Updates protocol ownership.
docs/modules/runtime.zh.md	Clarifies ASSETS behavior.
docs/modules/runtime.md	Clarifies ASSETS behavior.
docs/modules/queues-cron.zh.md	Documents discovery backfill.
docs/modules/queues-cron.md	Documents discovery backfill.
docs/modules/durable-objects.zh.md	Documents host DO ownership.
docs/modules/durable-objects.md	Documents host DO ownership.
docs/modules/d1.zh.md	Documents environment syntax.
docs/modules/d1.md	Documents environment syntax.
docs/modules/control-auth.zh.md	Clarifies deploy/auth ownership.
docs/modules/control-auth.md	Clarifies deploy/auth ownership.
do-runtime/protocol.js	Centralizes fence headers and parsing.
do-runtime/owner-registry.js	Uses shared TTL parser.
do-runtime/owner-client.js	Uses canonical fence headers.
do-runtime/index.js	Uses canonical fence headers.
do-runtime/config.capnp	Embeds scoped-request codec.
do-runtime/actor.js	Uses canonical session policy.
d1-runtime/router.js	Uses shared owner headers.
d1-runtime/protocol.js	Uses shared protocol contracts.
d1-runtime/owner-registry.js	Uses canonical environment parsing.
d1-runtime/owner-client.js	Uses shared content-type parsing.
d1-runtime/actor.js	Uses shared content-type parsing.
control/worker-code-budget.js	Removes redundant constant export.
control/shared.js	Narrows shared export surface.
control/json-body.js	Makes default limit private.
control/errors.js	Makes log helper private.
control/d1-runtime-client.js	Uses shared D1 headers.
control/d1-model.js	Removes redundant regex export.
CHANGELOG.md	Records host transport refactor.
auth/runtime.js	Makes hash prefix private.
auth/lib.js	Removes token helper re-exports.
.github/codeql/codeql-config.yml	Removes obsolete CodeQL config.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 164 out of 171 changed files in this pull request and generated no new comments.