📦 Vendor pinned Cloudflare DOFS source

.oxfmtrc.json

@@ -4,5 +4,10 @@
   // the exact indentation the rule tests assert on.
   // `packages/*/npm` is generated dnt output, written by a test while the
   // battery runs; format-checking it fails on a file nobody wrote by hand.
-  "ignorePatterns": ["**/*.md", "scripts/tests/fixtures/**", "**/npm/**"]
+  "ignorePatterns": [
+    "**/*.md",
+    "scripts/tests/fixtures/**",
+    "**/npm/**",
+    "packages/workflow/vendor/cloudflare-computer-dofs/**"
+  ]
 }

AGENTS.md

@@ -50,7 +50,7 @@ then runs every build phase offline — including a release compile for
 the content and modes of `node_modules`, the cache's dependency roots, and
 `deno.lock` after each one. It then changes `site/` in that clone on purpose,
 takes the changed tree as its baseline, and runs the battery once with the site
-pair applying — all ten commands together, selected by a real change rather
+pair applying — every command together, selected by a real change rather
 than by a fixture.
 
 Builds and checks are held to different claims there. A build is cache-pure:
@@ -131,11 +131,13 @@ here:
   root `deno.json`. Its `exclude` list holds the paths that must stay
   unchecked: the deliberately-malformed `scripts/tests/fixtures`; `.xmd-eval`,
   where a running document writes the `.ts` files its eval blocks compile to;
-  and `**/npm`, the dnt build's output, which a test rewrites while the battery
-  runs. All three are generated and belong to whichever command is producing
-  them — type-checking one mid-write fails on a partial file, and fails the
-  whole workspace check for a file nobody committed. The same output is skipped
-  by `lint` and `fmt`, for the same reason.
+  `**/npm`, the dnt build's output, which a test rewrites while the battery
+  runs; and the pinned Cloudflare DOFS TypeScript inputs and declarations whose
+  deterministic JavaScript and declaration output is checked instead. Generated
+  paths belong to whichever command is producing them — type-checking one
+  mid-write fails on a partial file, and fails the whole workspace check for a
+  file nobody committed. The exact Cloudflare DOFS snapshot is skipped by
+  `lint` and `fmt` because its drift verifier owns byte identity.
 - `test:node` and `test:bun` derive the same corpus through
   `scripts/lib/test-files.ts`, which walks `tests/` beneath each workspace
   member plus `scripts/tests/` — that boundary, and nothing else. A new

deno.json

@@ -1,6 +1,12 @@
 {
   "workspace": ["packages/*", "site"],
-  "exclude": ["scripts/tests/fixtures", ".xmd-eval", "**/npm"],
+  "exclude": [
+    "scripts/tests/fixtures",
+    ".xmd-eval",
+    "**/npm",
+    "packages/workflow/vendor/cloudflare-computer-dofs/upstream",
+    "packages/workflow/vendor/cloudflare-computer-dofs/generated/**/*.d.ts"
+  ],
   "nodeModulesDir": "auto",
   "lock": {
     "frozen": true
@@ -52,6 +58,7 @@
     "bump": "deno run -A scripts/bump-version.ts",
     "test": "deno test --allow-all --frozen",
     "verify": "deno run --allow-all --node-modules-dir=none --cached-only --frozen scripts/preflight.ts scripts/verify.ts",
+    "vendor:verify": "deno run --allow-read --allow-write=/tmp --allow-env --allow-run --cached-only --frozen scripts/verify-cloudflare-dofs.ts",
     "check": "deno check --frozen",
     "check:jsr": "deno publish --dry-run --allow-dirty",
     "review": "deno run --allow-all packages/cli/src/deno.ts run .reviews/ReviewPR.md --component-dir .reviews/components --component-dir .reviews/policies --component-dir packages/core/components -j .reviews/journal.jsonl",

package.json

@@ -71,7 +71,7 @@
     "test:node": "tsx scripts/runtime-tests.ts node",
     "test:bun": "bun scripts/runtime-tests.ts bun",
     "test:deno": "deno task test",
-    "lint": "oxlint -c .oxlintrc.json --ignore-pattern 'scripts/tests/fixtures/**' --ignore-pattern '**/npm/**' packages scripts && oxfmt --check packages scripts",
+    "lint": "oxlint -c .oxlintrc.json --ignore-pattern 'scripts/tests/fixtures/**' --ignore-pattern '**/npm/**' --ignore-pattern 'packages/workflow/vendor/cloudflare-computer-dofs/**' packages scripts && oxfmt --check packages scripts",
     "fmt": "oxfmt --write packages scripts"
   },
   "workspaces": [

packages/workflow/deno.json

@@ -4,5 +4,8 @@
   "exports": {
     ".": "./mod.ts",
     "./deno": "./deno.ts"
+  },
+  "publish": {
+    "exclude": ["!vendor/cloudflare-computer-dofs/generated/**/*.d.ts"]
   }
 }

packages/workflow/vendor/cloudflare-computer-dofs/LICENSE

@@ -0,0 +1,21 @@
+MIT License Copyright (c) 2026 Cloudflare, Inc.
+
+Permission is hereby granted, free of
+charge, to any person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the Software without
+restriction, including without limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to the
+following conditions:
+
+The above copyright notice and this permission notice
+(including the next paragraph) shall be included in all copies or substantial
+portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO
+EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.