@btravstack/temporal-worker 0.14.0 → 0.16.0

package/dist/index.cjs

@@ -151,7 +151,17 @@ const activityUnits = (host, observers, unit) => (invocation, next) => {
 *
 * The workflow id becomes the `traceId` — minted outside this process and steady
 * across every retry, so all attempts join up in a log. An activity with no
-* workflow falls back to the activity id.
+* workflow falls back to the activity id; `workflowExecution` is optional
+* because Temporal's own `Info` declares it so, "not set if the activity was
+* not started by a Workflow", which a worker polling a task queue never sees.
+*
+* **A REUSED workflow id merges its runs into one trace**, and that is the
+* trade rather than an oversight: Temporal allows an id again once the previous
+* execution closed, so `order-42` run twice is one `traceId` over two runs.
+* `runId` would separate them and is the wrong correlation for this transport —
+* server-minted, opaque, and not what an operator greps for. A deployment that
+* needs per-run traces gives its workflows unique ids, which is what a Schedule
+* already does.
 */
 const metaFor = () => {
 	const info = (0, _temporalio_activity.activityInfo)();
@@ -165,9 +175,9 @@ const metaFor = () => {
 //#region src/temporal-runtime.ts
 /**
 * Where the Temporal service is, as a service: `temporal()` binds it from the
-* environment — `TEMPORAL_ADDRESS` (default `127.0.0.1:7233`) and
-* `TEMPORAL_NAMESPACE` (default `default`) — unless pinned, and anything else
-* in the graph may read it.
+* environment — `TEMPORAL_ADDRESS` (default `127.0.0.1:7233`),
+* `TEMPORAL_NAMESPACE` (default `default`) and the shutdown budgets below —
+* unless pinned, and anything else in the graph may read it.
 */
 var TemporalConfig = class extends (0, _btravstack_di.Port)("TemporalConfig") {};
 /**
@@ -206,14 +216,14 @@ const DEFAULT_FORCE_MS = 15e3;
 const durationMs = (duration) => duration === void 0 ? void 0 : (0, _temporalio_common.msToNumber)(duration);
 /**
 * The Temporal starter: a module providing the runtime, its configuration
-* (bound from `TEMPORAL_ADDRESS` / `TEMPORAL_NAMESPACE` unless pinned) and the
-* connection (a resource opened with the scope and closed with it; a service
-* that will not answer is a modeled `TemporalUnreachable`). Import it next to
-* the application, export `TemporalRuntime`, provide the activities — the
+* (bound from the `TEMPORAL_*` variables unless pinned) and the connection (a
+* resource opened with the scope and closed with it; a service that will not
+* answer is a modeled `TemporalUnreachable`). Import it next to the
+* application, export `TemporalRuntime`, provide the activities — the
 * activities port is a need of this module.
 *
-* With both configuration fields pinned the module reads nothing from the
-* environment; pin only one and the other still comes from it.
+* Each configuration field is pinned on its own: a pinned field reads nothing
+* from the environment, and a field left unpinned still does.
 */
 const temporal = (options) => {
 	const { address, namespace } = options;
@@ -289,26 +299,39 @@ const createWorker = (host, connection, config, activities, options, observers)
 		shutdownForceTime: config.forceAfterMs
 	}), startFailed)).map((worker) => poll(worker, taskQueue, namespace));
 };
+/**
+* The `Serving` over a started worker.
+*
+* @internal Exported for `temporal-runtime.spec.ts` alone: the `stopped`
+* channel is about a worker's `run()` REJECTING mid-flight, and there is no way
+* to make a real one do that without taking the shared Temporal server down for
+* every other spec. A stub worker is what reaches that arm.
+*/
 const poll = (worker, taskQueue, namespace) => {
 	const running = (0, unthrown.fromSafePromise)(worker.run());
 	const stopPolling = () => {
 		if (worker.getState() === "RUNNING") worker.shutdown();
 	};
 	let deadline;
-	const stopped = () => deadline === void 0 ? running : (0, _btravstack_core.releasedBy)(deadline, running);
+	const awaitRun = () => deadline === void 0 ? running : (0, _btravstack_core.releasedBy)(deadline, running);
+	let asked = false;
+	const withdrawn = () => (0, unthrown.fromSafePromise)(new Promise(() => {}));
 	return {
 		info: {
 			taskQueue,
 			namespace
 		},
+		stopped: () => running.recoverDefect(() => (0, unthrown.Ok)(void 0)).flatMap(() => asked ? withdrawn() : (0, unthrown.OkAsync)()),
 		drain: (signal) => {
+			asked = true;
 			deadline = signal;
 			stopPolling();
-			return stopped();
+			return awaitRun();
 		},
 		stop: () => {
+			asked = true;
 			stopPolling();
-			return stopped();
+			return awaitRun();
 		}
 	};
 };

package/dist/index.d.cts

@@ -134,9 +134,9 @@ type WorkflowSource = {
 declare const TemporalConfig_base: import("@btravstack/di").PortClass<"TemporalConfig">;
 /**
  * Where the Temporal service is, as a service: `temporal()` binds it from the
- * environment — `TEMPORAL_ADDRESS` (default `127.0.0.1:7233`) and
- * `TEMPORAL_NAMESPACE` (default `default`) — unless pinned, and anything else
- * in the graph may read it.
+ * environment — `TEMPORAL_ADDRESS` (default `127.0.0.1:7233`),
+ * `TEMPORAL_NAMESPACE` (default `default`) and the shutdown budgets below —
+ * unless pinned, and anything else in the graph may read it.
  */
 export declare class TemporalConfig extends TemporalConfig_base<{
   readonly address: string;
@@ -220,9 +220,10 @@ type TemporalTuning<Unit extends AnyUnitModule | undefined = undefined> = {
   readonly gracePeriod?: Duration;
   /**
    * The unit module the worker forks around every activity attempt it
-   * dispatches, with no seed. Built after the activity is invoked, torn down
-   * when the unit closes — the point where a later phase seeds it with the
-   * workflow's tenant.
+   * dispatches, seeded with the validated input on `ActivityInput(contract)`.
+   * Built after the activity is invoked, before it runs; torn down when the
+   * unit closes. What it exports is what a piece may declare on its own
+   * `unit:` record.
    */
   readonly unit?: {
     readonly activity?: Unit;
@@ -240,14 +241,14 @@ type TemporalOptions<C extends ContractDefinition, Unit extends AnyUnitModule |
 type Provided = TemporalRuntime | TemporalConfig | TemporalConnection;
 /**
  * The Temporal starter: a module providing the runtime, its configuration
- * (bound from `TEMPORAL_ADDRESS` / `TEMPORAL_NAMESPACE` unless pinned) and the
- * connection (a resource opened with the scope and closed with it; a service
- * that will not answer is a modeled `TemporalUnreachable`). Import it next to
- * the application, export `TemporalRuntime`, provide the activities — the
+ * (bound from the `TEMPORAL_*` variables unless pinned) and the connection (a
+ * resource opened with the scope and closed with it; a service that will not
+ * answer is a modeled `TemporalUnreachable`). Import it next to the
+ * application, export `TemporalRuntime`, provide the activities — the
  * activities port is a need of this module.
  *
- * With both configuration fields pinned the module reads nothing from the
- * environment; pin only one and the other still comes from it.
+ * Each configuration field is pinned on its own: a pinned field reads nothing
+ * from the environment, and a field left unpinned still does.
  */
 export declare const temporal: <C extends ContractDefinition, Unit extends AnyUnitModule | undefined = undefined>(options: TemporalOptions<C, Unit>) => Module<Provided, ConfigInvalid | TemporalUnreachable, Env | Scope | ActivitiesInstanceOf<C> | UnitNeedsOf<Unit>>;
 //#endregion

package/dist/index.d.mts

@@ -3,7 +3,7 @@ import { ConfigInvalid, Env } from "@btravstack/config";
 import { Runtime, RuntimePort } from "@btravstack/core";
 import { DeclareActivitiesHandlerOptions, EmptyContext } from "@temporal-contract/worker/activity";
 import { Duration } from "@temporalio/common";
-import { NativeConnection, WorkflowBundleWithSourceMap } from "@temporalio/worker";
+import { NativeConnection, Worker, WorkflowBundleWithSourceMap } from "@temporalio/worker";
 import { ContractDefinition } from "@temporal-contract/contract";
 //#region src/unit.d.ts
 /** What a bound unit module exports — the port instances an activity of that kind may read. */
@@ -134,9 +134,9 @@ type WorkflowSource = {
 declare const TemporalConfig_base: import("@btravstack/di").PortClass<"TemporalConfig">;
 /**
  * Where the Temporal service is, as a service: `temporal()` binds it from the
- * environment — `TEMPORAL_ADDRESS` (default `127.0.0.1:7233`) and
- * `TEMPORAL_NAMESPACE` (default `default`) — unless pinned, and anything else
- * in the graph may read it.
+ * environment — `TEMPORAL_ADDRESS` (default `127.0.0.1:7233`),
+ * `TEMPORAL_NAMESPACE` (default `default`) and the shutdown budgets below —
+ * unless pinned, and anything else in the graph may read it.
  */
 export declare class TemporalConfig extends TemporalConfig_base<{
   readonly address: string;
@@ -220,9 +220,10 @@ type TemporalTuning<Unit extends AnyUnitModule | undefined = undefined> = {
   readonly gracePeriod?: Duration;
   /**
    * The unit module the worker forks around every activity attempt it
-   * dispatches, with no seed. Built after the activity is invoked, torn down
-   * when the unit closes — the point where a later phase seeds it with the
-   * workflow's tenant.
+   * dispatches, seeded with the validated input on `ActivityInput(contract)`.
+   * Built after the activity is invoked, before it runs; torn down when the
+   * unit closes. What it exports is what a piece may declare on its own
+   * `unit:` record.
    */
   readonly unit?: {
     readonly activity?: Unit;
@@ -240,14 +241,14 @@ type TemporalOptions<C extends ContractDefinition, Unit extends AnyUnitModule |
 type Provided = TemporalRuntime | TemporalConfig | TemporalConnection;
 /**
  * The Temporal starter: a module providing the runtime, its configuration
- * (bound from `TEMPORAL_ADDRESS` / `TEMPORAL_NAMESPACE` unless pinned) and the
- * connection (a resource opened with the scope and closed with it; a service
- * that will not answer is a modeled `TemporalUnreachable`). Import it next to
- * the application, export `TemporalRuntime`, provide the activities — the
+ * (bound from the `TEMPORAL_*` variables unless pinned) and the connection (a
+ * resource opened with the scope and closed with it; a service that will not
+ * answer is a modeled `TemporalUnreachable`). Import it next to the
+ * application, export `TemporalRuntime`, provide the activities — the
  * activities port is a need of this module.
  *
- * With both configuration fields pinned the module reads nothing from the
- * environment; pin only one and the other still comes from it.
+ * Each configuration field is pinned on its own: a pinned field reads nothing
+ * from the environment, and a field left unpinned still does.
  */
 export declare const temporal: <C extends ContractDefinition, Unit extends AnyUnitModule | undefined = undefined>(options: TemporalOptions<C, Unit>) => Module<Provided, ConfigInvalid | TemporalUnreachable, Env | Scope | ActivitiesInstanceOf<C> | UnitNeedsOf<Unit>>;
 //#endregion

package/dist/index.mjs

@@ -4,7 +4,7 @@ import { Observers, RuntimePort, RuntimeStartFailed, noObserver, observe, releas
 import { declareActivitiesHandler } from "@temporal-contract/worker/activity";
 import { msToNumber } from "@temporalio/common";
 import { NativeConnection, Worker } from "@temporalio/worker";
-import { TaggedError, fromPromise, fromSafePromise, fromThrowable } from "unthrown";
+import { Ok, OkAsync, TaggedError, fromPromise, fromSafePromise, fromThrowable } from "unthrown";
 import { activityInfo } from "@temporalio/activity";
 //#region src/unit.ts
 /**
@@ -150,7 +150,17 @@ const activityUnits = (host, observers, unit) => (invocation, next) => {
 *
 * The workflow id becomes the `traceId` — minted outside this process and steady
 * across every retry, so all attempts join up in a log. An activity with no
-* workflow falls back to the activity id.
+* workflow falls back to the activity id; `workflowExecution` is optional
+* because Temporal's own `Info` declares it so, "not set if the activity was
+* not started by a Workflow", which a worker polling a task queue never sees.
+*
+* **A REUSED workflow id merges its runs into one trace**, and that is the
+* trade rather than an oversight: Temporal allows an id again once the previous
+* execution closed, so `order-42` run twice is one `traceId` over two runs.
+* `runId` would separate them and is the wrong correlation for this transport —
+* server-minted, opaque, and not what an operator greps for. A deployment that
+* needs per-run traces gives its workflows unique ids, which is what a Schedule
+* already does.
 */
 const metaFor = () => {
 	const info = activityInfo();
@@ -164,9 +174,9 @@ const metaFor = () => {
 //#region src/temporal-runtime.ts
 /**
 * Where the Temporal service is, as a service: `temporal()` binds it from the
-* environment — `TEMPORAL_ADDRESS` (default `127.0.0.1:7233`) and
-* `TEMPORAL_NAMESPACE` (default `default`) — unless pinned, and anything else
-* in the graph may read it.
+* environment — `TEMPORAL_ADDRESS` (default `127.0.0.1:7233`),
+* `TEMPORAL_NAMESPACE` (default `default`) and the shutdown budgets below —
+* unless pinned, and anything else in the graph may read it.
 */
 var TemporalConfig = class extends Port("TemporalConfig") {};
 /**
@@ -205,14 +215,14 @@ const DEFAULT_FORCE_MS = 15e3;
 const durationMs = (duration) => duration === void 0 ? void 0 : msToNumber(duration);
 /**
 * The Temporal starter: a module providing the runtime, its configuration
-* (bound from `TEMPORAL_ADDRESS` / `TEMPORAL_NAMESPACE` unless pinned) and the
-* connection (a resource opened with the scope and closed with it; a service
-* that will not answer is a modeled `TemporalUnreachable`). Import it next to
-* the application, export `TemporalRuntime`, provide the activities — the
+* (bound from the `TEMPORAL_*` variables unless pinned) and the connection (a
+* resource opened with the scope and closed with it; a service that will not
+* answer is a modeled `TemporalUnreachable`). Import it next to the
+* application, export `TemporalRuntime`, provide the activities — the
 * activities port is a need of this module.
 *
-* With both configuration fields pinned the module reads nothing from the
-* environment; pin only one and the other still comes from it.
+* Each configuration field is pinned on its own: a pinned field reads nothing
+* from the environment, and a field left unpinned still does.
 */
 const temporal = (options) => {
 	const { address, namespace } = options;
@@ -288,26 +298,39 @@ const createWorker = (host, connection, config, activities, options, observers)
 		shutdownForceTime: config.forceAfterMs
 	}), startFailed)).map((worker) => poll(worker, taskQueue, namespace));
 };
+/**
+* The `Serving` over a started worker.
+*
+* @internal Exported for `temporal-runtime.spec.ts` alone: the `stopped`
+* channel is about a worker's `run()` REJECTING mid-flight, and there is no way
+* to make a real one do that without taking the shared Temporal server down for
+* every other spec. A stub worker is what reaches that arm.
+*/
 const poll = (worker, taskQueue, namespace) => {
 	const running = fromSafePromise(worker.run());
 	const stopPolling = () => {
 		if (worker.getState() === "RUNNING") worker.shutdown();
 	};
 	let deadline;
-	const stopped = () => deadline === void 0 ? running : releasedBy(deadline, running);
+	const awaitRun = () => deadline === void 0 ? running : releasedBy(deadline, running);
+	let asked = false;
+	const withdrawn = () => fromSafePromise(new Promise(() => {}));
 	return {
 		info: {
 			taskQueue,
 			namespace
 		},
+		stopped: () => running.recoverDefect(() => Ok(void 0)).flatMap(() => asked ? withdrawn() : OkAsync()),
 		drain: (signal) => {
+			asked = true;
 			deadline = signal;
 			stopPolling();
-			return stopped();
+			return awaitRun();
 		},
 		stop: () => {
+			asked = true;
 			stopPolling();
-			return stopped();
+			return awaitRun();
 		}
 	};
 };

package/dist/schedule.cjs

@@ -16,24 +16,29 @@ let _temporal_contract_client = require("@temporal-contract/client");
 * This recovers exactly that one error into an `update`. Every other error
 * stays on the channel, still typed.
 *
-* **`spec` is the only field reconciled**, and the rest of an existing
-* schedule is left as it stands. Two different reasons, and they are worth
-* telling apart:
+* **`spec`, the action's `workflowType` and `args`, and `policies` are
+* reconciled**; everything else about an existing schedule is left as it
+* stands.
 *
+* - **`args` and `workflowType` are written, and they are checked on the way
+*   through.** The typed handle's `update` validates the returned action's
+*   `args` against the named workflow's input schema before anything is
+*   persisted, and answers `WorkflowValidationError` — the same error `create`
+*   answers, already on this channel. So a deploy that changed what the
+*   workflow takes is either written or refused, never reported `"updated"`
+*   over a server still holding the old action. `workflowType` rides with them
+*   because it is what selects the schema those args are checked against.
 * - **`state` is deliberately preserved.** A schedule an operator paused stays
 *   paused across a deploy, because unpausing it is a decision a person made
 *   and a deploy is not the place to reverse it.
-* - **`args` and the rest of the action are preserved because this cannot
-*   reconcile them SAFELY.** `create` validates `args` against the workflow's
-*   input schema; the handle's `update` takes Temporal's own
-*   `ScheduleUpdateOptions` and validates nothing, so writing them here would
-*   push unvalidated input at the server through a door the typed client keeps
-*   shut. A deploy that changes what a schedule RUNS — its args, its workflow,
-*   its policies — should say so explicitly: delete the schedule and create it,
-*   or reach `getHandle(id).update(...)` directly and own the shape.
+* - **`memo`, `searchAttributes` and the action's own overrides are
+*   preserved**, because rebuilding the action wholesale means reproducing
+*   `create`'s own assembly here — the task queue off the contract, the search
+*   attribute translation, eight optional overrides — which is a copy that
+*   drifts. A deploy changing one of those deletes the schedule and creates it.
 *
-* So: after this call the schedule FIRES when the arguments say. What it fires
-* with is whatever it already fired with.
+* So: after this call the schedule FIRES when the arguments say, and RUNS what
+* they say.
 *
 * ```ts
 * await ensureSchedule(client.for(orderContract).schedule, "sweepStaleOrders", {
@@ -45,7 +50,13 @@ let _temporal_contract_client = require("@temporal-contract/client");
 */
 const ensureSchedule = (schedules, workflow, options) => schedules.create(workflow, options).map(() => "created").flatMapErrCases((matcher) => matcher.with(unthrown.P.tag(_temporal_contract_client.SCHEDULE_ALREADY_EXISTS_ERROR_TAG), () => schedules.getHandle(options.scheduleId).update((previous) => ({
 	...previous,
-	spec: options.spec
+	spec: options.spec,
+	action: {
+		...previous.action,
+		workflowType: workflow,
+		args: [options.args]
+	},
+	...options.policies === void 0 ? {} : { policies: options.policies }
 })).map(() => "updated")).with(unthrown.P.tag("@temporal-contract/WorkflowNotInContractError"), (error) => (0, unthrown.ErrAsync)(error)).with(unthrown.P.tag("@temporal-contract/WorkflowValidationError"), (error) => (0, unthrown.ErrAsync)(error)));
 //#endregion
 exports.ensureSchedule = ensureSchedule;

package/dist/schedule.d.cts

@@ -18,24 +18,29 @@ export type ScheduleOutcome = "created" | "updated";
  * This recovers exactly that one error into an `update`. Every other error
  * stays on the channel, still typed.
  *
- * **`spec` is the only field reconciled**, and the rest of an existing
- * schedule is left as it stands. Two different reasons, and they are worth
- * telling apart:
+ * **`spec`, the action's `workflowType` and `args`, and `policies` are
+ * reconciled**; everything else about an existing schedule is left as it
+ * stands.
  *
+ * - **`args` and `workflowType` are written, and they are checked on the way
+ *   through.** The typed handle's `update` validates the returned action's
+ *   `args` against the named workflow's input schema before anything is
+ *   persisted, and answers `WorkflowValidationError` — the same error `create`
+ *   answers, already on this channel. So a deploy that changed what the
+ *   workflow takes is either written or refused, never reported `"updated"`
+ *   over a server still holding the old action. `workflowType` rides with them
+ *   because it is what selects the schema those args are checked against.
  * - **`state` is deliberately preserved.** A schedule an operator paused stays
  *   paused across a deploy, because unpausing it is a decision a person made
  *   and a deploy is not the place to reverse it.
- * - **`args` and the rest of the action are preserved because this cannot
- *   reconcile them SAFELY.** `create` validates `args` against the workflow's
- *   input schema; the handle's `update` takes Temporal's own
- *   `ScheduleUpdateOptions` and validates nothing, so writing them here would
- *   push unvalidated input at the server through a door the typed client keeps
- *   shut. A deploy that changes what a schedule RUNS — its args, its workflow,
- *   its policies — should say so explicitly: delete the schedule and create it,
- *   or reach `getHandle(id).update(...)` directly and own the shape.
+ * - **`memo`, `searchAttributes` and the action's own overrides are
+ *   preserved**, because rebuilding the action wholesale means reproducing
+ *   `create`'s own assembly here — the task queue off the contract, the search
+ *   attribute translation, eight optional overrides — which is a copy that
+ *   drifts. A deploy changing one of those deletes the schedule and creates it.
  *
- * So: after this call the schedule FIRES when the arguments say. What it fires
- * with is whatever it already fired with.
+ * So: after this call the schedule FIRES when the arguments say, and RUNS what
+ * they say.
  *
  * ```ts
  * await ensureSchedule(client.for(orderContract).schedule, "sweepStaleOrders", {

package/dist/schedule.d.mts

@@ -18,24 +18,29 @@ export type ScheduleOutcome = "created" | "updated";
  * This recovers exactly that one error into an `update`. Every other error
  * stays on the channel, still typed.
  *
- * **`spec` is the only field reconciled**, and the rest of an existing
- * schedule is left as it stands. Two different reasons, and they are worth
- * telling apart:
+ * **`spec`, the action's `workflowType` and `args`, and `policies` are
+ * reconciled**; everything else about an existing schedule is left as it
+ * stands.
  *
+ * - **`args` and `workflowType` are written, and they are checked on the way
+ *   through.** The typed handle's `update` validates the returned action's
+ *   `args` against the named workflow's input schema before anything is
+ *   persisted, and answers `WorkflowValidationError` — the same error `create`
+ *   answers, already on this channel. So a deploy that changed what the
+ *   workflow takes is either written or refused, never reported `"updated"`
+ *   over a server still holding the old action. `workflowType` rides with them
+ *   because it is what selects the schema those args are checked against.
  * - **`state` is deliberately preserved.** A schedule an operator paused stays
  *   paused across a deploy, because unpausing it is a decision a person made
  *   and a deploy is not the place to reverse it.
- * - **`args` and the rest of the action are preserved because this cannot
- *   reconcile them SAFELY.** `create` validates `args` against the workflow's
- *   input schema; the handle's `update` takes Temporal's own
- *   `ScheduleUpdateOptions` and validates nothing, so writing them here would
- *   push unvalidated input at the server through a door the typed client keeps
- *   shut. A deploy that changes what a schedule RUNS — its args, its workflow,
- *   its policies — should say so explicitly: delete the schedule and create it,
- *   or reach `getHandle(id).update(...)` directly and own the shape.
+ * - **`memo`, `searchAttributes` and the action's own overrides are
+ *   preserved**, because rebuilding the action wholesale means reproducing
+ *   `create`'s own assembly here — the task queue off the contract, the search
+ *   attribute translation, eight optional overrides — which is a copy that
+ *   drifts. A deploy changing one of those deletes the schedule and creates it.
  *
- * So: after this call the schedule FIRES when the arguments say. What it fires
- * with is whatever it already fired with.
+ * So: after this call the schedule FIRES when the arguments say, and RUNS what
+ * they say.
  *
  * ```ts
  * await ensureSchedule(client.for(orderContract).schedule, "sweepStaleOrders", {

package/dist/schedule.mjs

@@ -15,24 +15,29 @@ import { SCHEDULE_ALREADY_EXISTS_ERROR_TAG } from "@temporal-contract/client";
 * This recovers exactly that one error into an `update`. Every other error
 * stays on the channel, still typed.
 *
-* **`spec` is the only field reconciled**, and the rest of an existing
-* schedule is left as it stands. Two different reasons, and they are worth
-* telling apart:
+* **`spec`, the action's `workflowType` and `args`, and `policies` are
+* reconciled**; everything else about an existing schedule is left as it
+* stands.
 *
+* - **`args` and `workflowType` are written, and they are checked on the way
+*   through.** The typed handle's `update` validates the returned action's
+*   `args` against the named workflow's input schema before anything is
+*   persisted, and answers `WorkflowValidationError` — the same error `create`
+*   answers, already on this channel. So a deploy that changed what the
+*   workflow takes is either written or refused, never reported `"updated"`
+*   over a server still holding the old action. `workflowType` rides with them
+*   because it is what selects the schema those args are checked against.
 * - **`state` is deliberately preserved.** A schedule an operator paused stays
 *   paused across a deploy, because unpausing it is a decision a person made
 *   and a deploy is not the place to reverse it.
-* - **`args` and the rest of the action are preserved because this cannot
-*   reconcile them SAFELY.** `create` validates `args` against the workflow's
-*   input schema; the handle's `update` takes Temporal's own
-*   `ScheduleUpdateOptions` and validates nothing, so writing them here would
-*   push unvalidated input at the server through a door the typed client keeps
-*   shut. A deploy that changes what a schedule RUNS — its args, its workflow,
-*   its policies — should say so explicitly: delete the schedule and create it,
-*   or reach `getHandle(id).update(...)` directly and own the shape.
+* - **`memo`, `searchAttributes` and the action's own overrides are
+*   preserved**, because rebuilding the action wholesale means reproducing
+*   `create`'s own assembly here — the task queue off the contract, the search
+*   attribute translation, eight optional overrides — which is a copy that
+*   drifts. A deploy changing one of those deletes the schedule and creates it.
 *
-* So: after this call the schedule FIRES when the arguments say. What it fires
-* with is whatever it already fired with.
+* So: after this call the schedule FIRES when the arguments say, and RUNS what
+* they say.
 *
 * ```ts
 * await ensureSchedule(client.for(orderContract).schedule, "sweepStaleOrders", {
@@ -44,7 +49,13 @@ import { SCHEDULE_ALREADY_EXISTS_ERROR_TAG } from "@temporal-contract/client";
 */
 const ensureSchedule = (schedules, workflow, options) => schedules.create(workflow, options).map(() => "created").flatMapErrCases((matcher) => matcher.with(P.tag(SCHEDULE_ALREADY_EXISTS_ERROR_TAG), () => schedules.getHandle(options.scheduleId).update((previous) => ({
 	...previous,
-	spec: options.spec
+	spec: options.spec,
+	action: {
+		...previous.action,
+		workflowType: workflow,
+		args: [options.args]
+	},
+	...options.policies === void 0 ? {} : { policies: options.policies }
 })).map(() => "updated")).with(P.tag("@temporal-contract/WorkflowNotInContractError"), (error) => ErrAsync(error)).with(P.tag("@temporal-contract/WorkflowValidationError"), (error) => ErrAsync(error)));
 //#endregion
 export { ensureSchedule };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@btravstack/temporal-worker",
-  "version": "0.14.0",
+  "version": "0.16.0",
   "description": "The Temporal worker runtime for @btravstack/core: one unit per activity attempt, and a drain that honours the kernel's deadline",
   "keywords": [
     "graceful-shutdown",
@@ -54,6 +54,11 @@
     }
   },
   "devDependencies": {
+    "@btravstack/config": "0.16.0",
+    "@btravstack/core": "0.16.0",
+    "@btravstack/di": "0.16.0",
+    "@btravstack/internal-test-infra": "0.0.0",
+    "@btravstack/testing": "0.16.0",
     "@btravstack/tsconfig": "0.4.0",
     "@temporal-contract/client": "8.0.0-beta.9",
     "@temporal-contract/contract": "8.0.0-beta.9",
@@ -70,24 +75,19 @@
     "typescript": "7.0.2",
     "unthrown": "5.8.0",
     "vitest": "4.1.11",
-    "zod": "4.5.4",
-    "@btravstack/config": "0.14.0",
-    "@btravstack/core": "0.14.0",
-    "@btravstack/di": "0.14.0",
-    "@btravstack/internal-test-infra": "0.0.0",
-    "@btravstack/testing": "0.14.0"
+    "zod": "4.5.4"
   },
   "peerDependencies": {
+    "@btravstack/config": "^0.16.0",
+    "@btravstack/core": "^0.16.0",
+    "@btravstack/di": "^0.16.0",
     "@temporal-contract/client": "^8.0.0-beta.9",
     "@temporal-contract/contract": "^8.0.0-beta.9",
     "@temporal-contract/worker": "^8.0.0-beta.9",
     "@temporalio/activity": "^1.22.0",
     "@temporalio/common": "^1.22.0",
     "@temporalio/worker": "^1.22.0",
-    "unthrown": "^5.0.0",
-    "@btravstack/config": "^0.14.0",
-    "@btravstack/core": "^0.14.0",
-    "@btravstack/di": "^0.14.0"
+    "unthrown": "^5.0.0"
   },
   "peerDependenciesMeta": {
     "@temporal-contract/client": {
@@ -101,7 +101,6 @@
     "build": "tsdown src/index.ts src/schedule.ts --format cjs,esm --dts --clean",
     "dev": "tsdown src/index.ts src/schedule.ts --format cjs,esm --dts --watch",
     "test": "vitest run --coverage",
-    "test:types": "tsc --noEmit -p tsconfig.test-d.json",
     "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.test-d.json"
   }
 }