@lostgradient/weft 0.2.0 → 0.3.0

package/dist/server/runtime/task-polling.js

@@ -30,12 +30,16 @@ function validateTaskResultBody(body) {
     return Response.json({ error: "Missing required fields: operationId, status" }, { status: 400 });
   if (status !== "completed" && status !== "failed")
     return Response.json({ error: 'status must be "completed" or "failed"' }, { status: 400 });
+  const rawAttemptToken = body.attemptToken;
+  if (rawAttemptToken !== void 0 && (typeof rawAttemptToken !== "string" || rawAttemptToken === ""))
+    return Response.json({ error: "attemptToken must be a non-empty string when present" }, { status: 400 });
   return {
     operationId,
     status,
     workerId: typeof body.workerId === "string" ? body.workerId : void 0,
     value: body.value,
-    error: typeof body.error === "string" ? body.error : void 0
+    error: typeof body.error === "string" ? body.error : void 0,
+    attemptToken: rawAttemptToken
   };
 }
 async function applyTaskResult(context, options, result, inflightRecord) {
@@ -69,6 +73,7 @@ export function createLongPollInflightRecord(queue, task) {
     visibilityTimeout,
     retryPolicy: task.retryPolicy,
     workflowId: task.workflowId,
+    attemptToken: crypto.randomUUID(),
     firstQueuedAt: task.firstQueuedAt ?? task.enqueuedAt ?? now,
     lastQueuedAt: task.lastQueuedAt ?? task.enqueuedAt ?? now,
     lastDispatchedAt: now,
@@ -87,7 +92,10 @@ export async function markTaskClaimedByLongPollWorker(context, options, queue, t
   const normalizedInflightRecord = await transitionQueuedToInflight(options.engine.storage, task.operationId, inflightRecord);
   recordTaskQueueLatencyMetric(context.metricsCollector, normalizedInflightRecord);
   recordTaskBacklogMetric(context.metricsCollector, context.taskQueue);
-  return normalizedInflightRecord.workerId;
+  return {
+    workerId: normalizedInflightRecord.workerId,
+    attemptToken: inflightRecord.attemptToken
+  };
 }
 export async function handleTaskPollRequest(context, options, request, url, principal) {
   if (request.method !== "GET")
@@ -105,8 +113,8 @@ export async function handleTaskPollRequest(context, options, request, url, prin
     return Response.json({ error: 'At least one "activity" query parameter is required' }, { status: 400 });
   const rawTimeout = url.searchParams.get("timeout"), timeout = rawTimeout !== null ? Math.min(Math.max(0, Number(rawTimeout)), MAX_POLL_TIMEOUT) : DEFAULT_POLL_TIMEOUT, task = await context.taskQueue.poll(queue, activities, timeout, request.signal);
   if (task !== null) {
-    const workerId = await markTaskClaimedByLongPollWorker(context, options, queue, task);
-    return Response.json({ ...task, workerId });
+    const claim = await markTaskClaimedByLongPollWorker(context, options, queue, task);
+    return Response.json({ ...task, workerId: claim.workerId, attemptToken: claim.attemptToken });
   }
   return new Response(null, { status: 204 });
 }
@@ -125,8 +133,15 @@ export async function handleTaskResultRequest(context, options, request, url, pr
   if (validated instanceof Response)
     return validated;
   const inflightRecord = await readInflightRecord(options.engine.storage, validated.operationId);
-  if (inflightRecord !== null && (validated.workerId === void 0 || inflightRecord.workerId !== validated.workerId))
+  if (inflightRecord !== null && !isLongPollCompletionAuthorized(inflightRecord, validated))
     return Response.json({ error: "Forbidden" }, { status: 403 });
   await applyTaskResult(context, options, validated, inflightRecord);
   return Response.json({ ok: !0 });
 }
+function isLongPollCompletionAuthorized(inflightRecord, validated) {
+  if (validated.workerId === void 0 || inflightRecord.workerId !== validated.workerId)
+    return !1;
+  if (inflightRecord.attemptToken !== void 0 && validated.attemptToken !== void 0 && validated.attemptToken !== inflightRecord.attemptToken)
+    return !1;
+  return !0;
+}

package/dist/server/runtime/websocket-worker.js

@@ -120,6 +120,14 @@ function onTaskResultMessage(context, options, ws, message, cleanupWorkflowIndex
     });
     return;
   }
+  if (!context.registry.isAssignedToAttempt(operationId, workerId, message.attemptToken)) {
+    sendWorkerProtocolMessage(ws, {
+      type: "protocolError",
+      code: "invalid_message",
+      message: `taskResult for operation "${operationId}" rejected \u2014 stale attempt token`
+    });
+    return;
+  }
   context.registry.completeTask(operationId);
   context.deadlineTracker.remove(operationId);
   cleanupWorkflowIndex(operationId);

package/dist/server/serve-internals.d.ts

@@ -11,6 +11,14 @@ import type { WebSocketData } from './json-rpc-websocket-runtime.ts';
 import { createServerWebSocketHandlers } from './runtime/authentication-bridge.ts';
 import type { ServerContext } from './runtime/context.ts';
 import { type EventBroadcastingHandle } from './runtime/event-broadcasting.ts';
+/**
+ * @internal
+ *
+ * Warning emitted when a server starts with no authentication and no explicit
+ * `unauthenticatedAccess` policy. Exported only for internal tests (see
+ * `tests/auth-warning-filter.test.ts`) and not part of the public API surface.
+ */
+export declare const NO_AUTHENTICATION_WARNING = "[weft] WARNING: server started with NO authentication; all non-public operations are publicly accessible. Configure serve({ auth }) to lock down, or set unauthenticatedAccess: \"reject\" in production to fail closed.";
 /**
  * Clamp a user-supplied `workerReconnectGracePeriodMs` into `[0, 5_000]`.
  * Returns the default when undefined or non-finite.

package/dist/server/serve-internals.js

@@ -26,7 +26,9 @@ import { reconcileOrphanedRecords, scanExpiredTasks } from "./runtime/task-recon
 import { isInflightRecord, withRetry } from "./runtime/websocket-worker.js";
 import { TaskQueue } from "./task-queue.js";
 import { createWorkflowEventFeed } from "./workflow-event-feed.js";
-const RECONCILIATION_MULTIPLIER = 12, DEFAULT_WORKER_RECONNECT_GRACE_PERIOD_MS = 100, MAX_WORKER_RECONNECT_GRACE_PERIOD_MS = 5000, AUTHENTICATION_REQUIRED_ENVIRONMENT_VARIABLE = "WEFT_SERVER_AUTHENTICATION_REQUIRED", NO_AUTHENTICATION_WARNING = '[weft] WARNING: server started with NO authentication; all non-public operations are publicly accessible. Configure serve({ auth }) to lock down, or set unauthenticatedAccess: "reject" in production to fail closed.', NO_AUTHENTICATION_REJECT_ERROR = '[weft] Refusing to start server with no authentication. Configure serve({ auth }) or set unauthenticatedAccess: "allow" only for trusted local development.', NO_AUTHENTICATION_ENVIRONMENT_ERROR = "[weft] Refusing to start server with no authentication because WEFT_SERVER_AUTHENTICATION_REQUIRED requires authentication. Configure serve({ auth }) or unset WEFT_SERVER_AUTHENTICATION_REQUIRED only for trusted local development.", TRUTHY_AUTHENTICATION_REQUIREMENT_VALUES = new Set(["1", "true", "yes", "on"]), FALSY_AUTHENTICATION_REQUIREMENT_VALUES = new Set(["0", "false", "no", "off"]);
+const RECONCILIATION_MULTIPLIER = 12, DEFAULT_WORKER_RECONNECT_GRACE_PERIOD_MS = 100, MAX_WORKER_RECONNECT_GRACE_PERIOD_MS = 5000, AUTHENTICATION_REQUIRED_ENVIRONMENT_VARIABLE = "WEFT_SERVER_AUTHENTICATION_REQUIRED";
+export const NO_AUTHENTICATION_WARNING = '[weft] WARNING: server started with NO authentication; all non-public operations are publicly accessible. Configure serve({ auth }) to lock down, or set unauthenticatedAccess: "reject" in production to fail closed.';
+const NO_AUTHENTICATION_REJECT_ERROR = '[weft] Refusing to start server with no authentication. Configure serve({ auth }) or set unauthenticatedAccess: "allow" only for trusted local development.', NO_AUTHENTICATION_ENVIRONMENT_ERROR = "[weft] Refusing to start server with no authentication because WEFT_SERVER_AUTHENTICATION_REQUIRED requires authentication. Configure serve({ auth }) or unset WEFT_SERVER_AUTHENTICATION_REQUIRED only for trusted local development.", TRUTHY_AUTHENTICATION_REQUIREMENT_VALUES = new Set(["1", "true", "yes", "on"]), FALSY_AUTHENTICATION_REQUIREMENT_VALUES = new Set(["0", "false", "no", "off"]);
 export function clampWorkerReconnectGracePeriod(value) {
   if (value === void 0 || !Number.isFinite(value))
     return DEFAULT_WORKER_RECONNECT_GRACE_PERIOD_MS;
@@ -179,7 +181,7 @@ export function restoreInflightTasks(context, options) {
         continue;
       }
       const remaining = record.deadline - now;
-      context.registry.assignTask(record.workerId, record.operationId, remaining);
+      context.registry.assignTask(record.workerId, record.operationId, remaining, void 0, record.attemptToken);
       context.deadlineTracker.add({ operationId: record.operationId, deadline: record.deadline });
       const tracked = context.registry.getWorkerTasks(record.workerId).find((t) => t.operationId === record.operationId);
       if (tracked)

package/dist/server/task-state.d.ts

@@ -67,6 +67,14 @@ export interface InflightRecord extends TaskLifecycleFields {
     retryPolicy?: RetryPolicy | undefined;
     /** Workflow that dispatched this activity. Present when the dispatch included a workflowId. */
     workflowId?: string | undefined;
+    /**
+     * Unique, unguessable token identifying this dispatch attempt. Rotated on every
+     * (re-)dispatch because each dispatch writes a fresh InflightRecord. The
+     * long-poll completion handler rejects a result whose echoed token does not
+     * match this value. Optional for back-compatible decoding of records written
+     * before this field existed; a missing token disables the check for that record.
+     */
+    attemptToken?: string | undefined;
 }
 /** Persisted record for a task in the resolved state. */
 export interface ResolvedRecord {