feat(iroh): add isolated v2 worker boundary

[azooz2003-bit]

Problem

The IROH v2 contracts and client code had no isolated Cloudflare Worker entrypoint, so /v2/ behavior could not be exercised without touching the original implementation session.

Changes

• add an isolated cmux-iroh-v2 Worker with /v2/ route gating and /healthz
• authenticate Stack access or scoped cached tickets before deriving one Durable Object per environment/project/team
• activate the DO schema under blockConcurrencyWhile, share HTTP and WebSocket dispatch, and consume enrollment challenges with EndpointID proof
• add staging and production Wrangler environment bindings
• add boundary and enrollment tests

Validation

• bun run test (19 passing)
• bun run typecheck
• bun run contracts:check
• bunx wrangler deploy --dry-run --env staging

This V3 branch is an isolated continuation of the active IROH v2 work and does not modify its worktree or surface.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Adds an isolated cmux-iroh-v2 Cloudflare Worker so IROH v2 behavior can run without touching the existing implementation session. The Worker authenticates Stack access or scoped cached tickets, then routes to one Durable Object per environment/project/team for HTTP and WebSocket control operations.

Worker boundary

• Adds /v2/ route gating with an unauthenticated /healthz.
• Applies Drizzle SQLite migrations under blockConcurrencyWhile and adds replay protection for device proofs.
• Generates Swift and TypeScript wire models from shared Zod schemas via quicktype.
• Adds staging and production Wrangler environments with separate Stack projects.

Client transport

• Adds V2ControlService, an actor owning the control socket, request map, and credential renewal lifecycle.
• Adds V2WireSigningCodec for canonical JSON and Ed25519 signatures matching the Worker verifier.
• Persists v2 identity and cache in a dedicated keychain service and file store, never importing legacy state.

^{Written for commit 133021b. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
cmux166	Ready	Preview	Sep 11, 2026 4:47am UTC
cmux41	Canceled		Sep 11, 2026 4:47am UTC

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​types/​bun@​1.4.2
	npm/​quicktype-core@​26.0.0
	npm/​@​planetscale/​database@​1.20.1
	npm/​drizzle-orm@​0.45.2
	npm/​typescript@​7.0.2
	npm/​wrangler@​4.131.0
	npm/​drizzle-kit@​0.31.10
	npm/​@​cloudflare/​workers-types@​5.20260911.1
	npm/​miniflare@​5.20260910.0-alpha
	npm/​zod@​4.6.2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm drizzle-orm is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: workers/iroh-v2/package.json → npm/drizzle-orm@0.45.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/drizzle-orm@0.45.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report