@lostgradient/weft 0.2.0

package/dist/server/route-model.d.ts

@@ -0,0 +1,268 @@
+/**
+ * Shared direct-route definitions for REST-only HTTP endpoints.
+ *
+ * Operation-backed REST endpoints are modeled by `RestBinding` instances.
+ * These seven endpoints stay direct because they describe or expose the HTTP
+ * server itself rather than a durable workflow operation:
+ *   - `GET /v1/health`    — anonymous liveness probe (no catalog op)
+ *   - `GET /v1/metrics`   — Prometheus text exposition (text/plain, no catalog op)
+ *   - `GET /.well-known/api-catalog` — RFC 9264 service-desc linkset
+ *   - `GET /.well-known/mcp.json` — MCP transport discovery
+ *   - `GET /asyncapi.json` — transport-meta endpoint (self-describing, no catalog op)
+ *   - `GET /openapi.json` — transport-meta endpoint (self-describing, no catalog op)
+ *   - `GET /openrpc.json` — transport-meta endpoint (self-describing, no catalog op)
+ *
+ * @module server/route-model
+ */
+/**
+ * External URL prefix under which the functional HTTP/WebSocket API is served
+ * (REST workflows/schedules/tasks, `/mcp`, `/jsonrpc`, and the workflow/task
+ * WebSocket upgrades). Optional dashboard shells can be mounted at specific
+ * root-level page routes, so the API is namespaced beneath this prefix on the
+ * wire.
+ *
+ * This is purely an *external* (wire) concern. Internal routing — the
+ * `DIRECT_HTTP_ROUTES` table, every `RestBinding`, the WebSocket-upgrade
+ * regexes, and the authentication allowlist — stays canonical and
+ * root-relative. The HTTP front door strips this prefix from incoming requests
+ * before any matching runs, and the spec/discovery generators reattach it via
+ * {@link externalApiPath} when advertising endpoints.
+ *
+ * Root-stable surfaces are deliberately **not** moved under this prefix:
+ * `/v1/health`, `/v1/metrics`, `/openapi.json`, `/openrpc.json`,
+ * `/asyncapi.json`, and `/.well-known/*` remain at the origin root per
+ * RFC 9264 / discovery convention.
+ */
+export declare const API_PREFIX = "/api";
+/**
+ * Map a canonical, root-relative server path to its external (`/api`-prefixed)
+ * form for emission in specs and discovery documents.
+ *
+ * Requires a leading slash and refuses an already-prefixed path so callers can
+ * never produce `/api/api/...`.
+ *
+ * @example
+ * ```ts
+ * import { externalApiPath } from './route-model.ts';
+ * externalApiPath('/v1/workflows'); // '/api/v1/workflows'
+ * externalApiPath('/mcp'); // '/api/mcp'
+ * ```
+ */
+export declare function externalApiPath(canonicalPath: string): string;
+/** HTTP method for a route. */
+export type HttpMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+export type DirectRouteResponseMediaType = 'application/json' | 'application/msgpack' | 'application/linkset+json' | 'text/plain';
+export type DirectRouteResponseSchema = 'object' | 'string';
+export type DirectRouteResponseContent = {
+    /** Media type advertised for this response body. */
+    mediaType: DirectRouteResponseMediaType;
+    /** Minimal OpenAPI schema shape for this response body. */
+    schema: DirectRouteResponseSchema;
+};
+export type DirectRouteResponse = {
+    /** HTTP status emitted by the direct route. */
+    status: number;
+    /** Human-readable response description for OpenAPI. */
+    description: string;
+    /** Response body variants advertised by the direct route, when it has a body. */
+    content?: readonly DirectRouteResponseContent[];
+};
+export type DirectRouteAccess = 'public' | 'authenticated';
+/** A single direct HTTP route definition. */
+export type DirectHttpRouteDefinition = {
+    /** HTTP method. */
+    method: HttpMethod;
+    /**
+     * Express-style path pattern (e.g. `/v1/workflows/:id/signal/:name`).
+     * Used to generate OpenAPI path items and regex patterns.
+     */
+    path: string;
+    /** Internal handler function name. */
+    handler: string;
+    /** Ordered list of path parameter names. */
+    paramNames: string[];
+    /** Human-readable summary for OpenAPI. */
+    summary: string;
+    /** OpenAPI tags for grouping. */
+    tags: string[];
+    /** Response metadata shared by dispatch documentation. */
+    responses: readonly DirectRouteResponse[];
+    /** Direct route access policy for authentication and OpenAPI metadata. */
+    access: DirectRouteAccess;
+};
+/**
+ * Intentionally REST-only routes. These are not in the operation catalog.
+ *
+ * `as const` preserves the literal types of `handler` so consumers can
+ * derive a string-literal union for compile-time exhaustiveness on route
+ * executors.
+ */
+export declare const DIRECT_HTTP_ROUTES: readonly [{
+    readonly method: "GET";
+    readonly path: "/v1/health";
+    readonly handler: "healthCheck";
+    readonly paramNames: [];
+    readonly summary: "Health check";
+    readonly tags: ["System"];
+    readonly responses: readonly [{
+        readonly status: 200;
+        readonly description: "Service health status";
+        readonly content: readonly [{
+            readonly mediaType: "application/json";
+            readonly schema: "object";
+        }, {
+            readonly mediaType: "application/msgpack";
+            readonly schema: "object";
+        }];
+    }];
+    readonly access: "public";
+}, {
+    readonly method: "GET";
+    readonly path: "/v1/metrics";
+    readonly handler: "getMetrics";
+    readonly paramNames: [];
+    readonly summary: "Prometheus metrics export";
+    readonly tags: ["Observability"];
+    readonly responses: readonly [{
+        readonly status: 200;
+        readonly description: "Prometheus metrics exposition";
+        readonly content: readonly [{
+            readonly mediaType: "text/plain";
+            readonly schema: "string";
+        }];
+    }, {
+        readonly status: 503;
+        readonly description: "Metrics exporter failure";
+        readonly content: readonly [{
+            readonly mediaType: "application/json";
+            readonly schema: "object";
+        }];
+    }];
+    readonly access: "public";
+}, {
+    readonly method: "GET";
+    readonly path: "/.well-known/api-catalog";
+    readonly handler: "apiCatalog";
+    readonly paramNames: [];
+    readonly summary: "RFC 9264 API catalog linkset";
+    readonly tags: ["System"];
+    readonly responses: readonly [{
+        readonly status: 200;
+        readonly description: "RFC 9264 API catalog linkset";
+        readonly content: readonly [{
+            readonly mediaType: "application/linkset+json";
+            readonly schema: "object";
+        }];
+    }, {
+        readonly status: 421;
+        readonly description: "Request host rejected by trustedHosts";
+        readonly content: readonly [{
+            readonly mediaType: "application/json";
+            readonly schema: "object";
+        }];
+    }, {
+        readonly status: 503;
+        readonly description: "API catalog origin is not configured";
+        readonly content: readonly [{
+            readonly mediaType: "application/json";
+            readonly schema: "object";
+        }];
+    }];
+    readonly access: "public";
+}, {
+    readonly method: "GET";
+    readonly path: "/.well-known/mcp.json";
+    readonly handler: "mcpDiscovery";
+    readonly paramNames: [];
+    readonly summary: "MCP discovery document";
+    readonly tags: ["System"];
+    readonly responses: readonly [{
+        readonly status: 200;
+        readonly description: "MCP transport discovery document";
+        readonly content: readonly [{
+            readonly mediaType: "application/json";
+            readonly schema: "object";
+        }];
+    }, {
+        readonly status: 421;
+        readonly description: "Request host rejected by trustedHosts";
+        readonly content: readonly [{
+            readonly mediaType: "application/json";
+            readonly schema: "object";
+        }];
+    }, {
+        readonly status: 503;
+        readonly description: "MCP discovery origin is not configured";
+        readonly content: readonly [{
+            readonly mediaType: "application/json";
+            readonly schema: "object";
+        }];
+    }];
+    readonly access: "public";
+}, {
+    readonly method: "GET";
+    readonly path: "/openapi.json";
+    readonly handler: "openApiDocument";
+    readonly paramNames: [];
+    readonly summary: "OpenAPI 3.1 specification";
+    readonly tags: ["System"];
+    readonly responses: readonly [{
+        readonly status: 200;
+        readonly description: "OpenAPI 3.1 specification";
+        readonly content: readonly [{
+            readonly mediaType: "application/json";
+            readonly schema: "object";
+        }];
+    }];
+    readonly access: "public";
+}, {
+    readonly method: "GET";
+    readonly path: "/openrpc.json";
+    readonly handler: "openRpcDocument";
+    readonly paramNames: [];
+    readonly summary: "OpenRPC 1.3.2 specification";
+    readonly tags: ["System"];
+    readonly responses: readonly [{
+        readonly status: 200;
+        readonly description: "OpenRPC 1.3.2 specification";
+        readonly content: readonly [{
+            readonly mediaType: "application/json";
+            readonly schema: "object";
+        }];
+    }];
+    readonly access: "public";
+}, {
+    readonly method: "GET";
+    readonly path: "/asyncapi.json";
+    readonly handler: "asyncApiDocument";
+    readonly paramNames: [];
+    readonly summary: "AsyncAPI 3.0 specification";
+    readonly tags: ["System"];
+    readonly responses: readonly [{
+        readonly status: 200;
+        readonly description: "AsyncAPI 3.0 specification";
+        readonly content: readonly [{
+            readonly mediaType: "application/json";
+            readonly schema: "object";
+        }];
+    }];
+    readonly access: "public";
+}];
+/**
+ * Convert an Express-style path to an OpenAPI path template.
+ * `/v1/workflows/:id/signal/:name` → `/v1/workflows/{id}/signal/{name}`
+ */
+export declare function toOpenApiPath(path: string): string;
+/**
+ * Convert an Express-style path to a regex pattern for route matching.
+ *
+ * Each segment is either a literal (with regex metacharacters escaped) or a
+ * parameter placeholder:
+ * - `:step` becomes `(\\d+)` for numeric-only matching (checkpoint routes)
+ * - `:name` becomes `([^/]+)` for any non-slash token
+ *
+ * Escaping the literal segments prevents characters like `.` in paths such as
+ * `/openapi.json` from being treated as wildcards (which would match
+ * `/openapiXjson`).
+ */
+export declare function toRegex(path: string): RegExp;

package/dist/server/route-model.js

@@ -0,0 +1,166 @@
+export const API_PREFIX = "/api";
+export function externalApiPath(canonicalPath) {
+  if (!canonicalPath.startsWith("/"))
+    throw Error(`externalApiPath requires a leading slash, received: ${canonicalPath}`);
+  if (canonicalPath === API_PREFIX || canonicalPath.startsWith(`${API_PREFIX}/`))
+    throw Error(`externalApiPath received an already-prefixed path: ${canonicalPath}`);
+  return `${API_PREFIX}${canonicalPath}`;
+}
+export const DIRECT_HTTP_ROUTES = [
+  {
+    method: "GET",
+    path: "/v1/health",
+    handler: "healthCheck",
+    paramNames: [],
+    summary: "Health check",
+    tags: ["System"],
+    responses: [
+      {
+        status: 200,
+        description: "Service health status",
+        content: [
+          { mediaType: "application/json", schema: "object" },
+          { mediaType: "application/msgpack", schema: "object" }
+        ]
+      }
+    ],
+    access: "public"
+  },
+  {
+    method: "GET",
+    path: "/v1/metrics",
+    handler: "getMetrics",
+    paramNames: [],
+    summary: "Prometheus metrics export",
+    tags: ["Observability"],
+    responses: [
+      {
+        status: 200,
+        description: "Prometheus metrics exposition",
+        content: [{ mediaType: "text/plain", schema: "string" }]
+      },
+      {
+        status: 503,
+        description: "Metrics exporter failure",
+        content: [{ mediaType: "application/json", schema: "object" }]
+      }
+    ],
+    access: "public"
+  },
+  {
+    method: "GET",
+    path: "/.well-known/api-catalog",
+    handler: "apiCatalog",
+    paramNames: [],
+    summary: "RFC 9264 API catalog linkset",
+    tags: ["System"],
+    responses: [
+      {
+        status: 200,
+        description: "RFC 9264 API catalog linkset",
+        content: [{ mediaType: "application/linkset+json", schema: "object" }]
+      },
+      {
+        status: 421,
+        description: "Request host rejected by trustedHosts",
+        content: [{ mediaType: "application/json", schema: "object" }]
+      },
+      {
+        status: 503,
+        description: "API catalog origin is not configured",
+        content: [{ mediaType: "application/json", schema: "object" }]
+      }
+    ],
+    access: "public"
+  },
+  {
+    method: "GET",
+    path: "/.well-known/mcp.json",
+    handler: "mcpDiscovery",
+    paramNames: [],
+    summary: "MCP discovery document",
+    tags: ["System"],
+    responses: [
+      {
+        status: 200,
+        description: "MCP transport discovery document",
+        content: [{ mediaType: "application/json", schema: "object" }]
+      },
+      {
+        status: 421,
+        description: "Request host rejected by trustedHosts",
+        content: [{ mediaType: "application/json", schema: "object" }]
+      },
+      {
+        status: 503,
+        description: "MCP discovery origin is not configured",
+        content: [{ mediaType: "application/json", schema: "object" }]
+      }
+    ],
+    access: "public"
+  },
+  {
+    method: "GET",
+    path: "/openapi.json",
+    handler: "openApiDocument",
+    paramNames: [],
+    summary: "OpenAPI 3.1 specification",
+    tags: ["System"],
+    responses: [
+      {
+        status: 200,
+        description: "OpenAPI 3.1 specification",
+        content: [{ mediaType: "application/json", schema: "object" }]
+      }
+    ],
+    access: "public"
+  },
+  {
+    method: "GET",
+    path: "/openrpc.json",
+    handler: "openRpcDocument",
+    paramNames: [],
+    summary: "OpenRPC 1.3.2 specification",
+    tags: ["System"],
+    responses: [
+      {
+        status: 200,
+        description: "OpenRPC 1.3.2 specification",
+        content: [{ mediaType: "application/json", schema: "object" }]
+      }
+    ],
+    access: "public"
+  },
+  {
+    method: "GET",
+    path: "/asyncapi.json",
+    handler: "asyncApiDocument",
+    paramNames: [],
+    summary: "AsyncAPI 3.0 specification",
+    tags: ["System"],
+    responses: [
+      {
+        status: 200,
+        description: "AsyncAPI 3.0 specification",
+        content: [{ mediaType: "application/json", schema: "object" }]
+      }
+    ],
+    access: "public"
+  }
+];
+export function toOpenApiPath(path) {
+  return path.replace(/:([^/]+)/g, "{$1}");
+}
+function escapeRegexLiteral(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+export function toRegex(path) {
+  const regexStr = path.split("/").map((segment) => {
+    if (segment === ":step")
+      return "(\\d+)";
+    if (segment.startsWith(":"))
+      return "([^/]+)";
+    return escapeRegexLiteral(segment);
+  }).join("/");
+  return new RegExp(`^${regexStr}$`);
+}

package/dist/server/runtime/authentication-bridge.d.ts

@@ -0,0 +1,22 @@
+import type { ServerWebSocket } from 'bun';
+import type { Engine } from '../../core/engine.ts';
+import type { PrometheusExporter } from '../../observability/metrics.ts';
+import type { AuthConfig } from '../authentication.ts';
+import { type WebSocketData } from '../json-rpc-websocket-runtime.ts';
+import type { OpenApiSecuritySchemeName } from '../openapi.ts';
+import type { ServerContext } from './context.ts';
+type ServerFetchOptions = {
+    engine: Engine;
+    prometheusExporter?: PrometheusExporter;
+    discoveryInfo?: import('../discovery-info.ts').DiscoveryInfo;
+    publicOrigin?: string;
+    trustedHosts?: ReadonlyArray<string>;
+};
+export declare function deriveSupportedOpenApiSecuritySchemes(auth: AuthConfig | undefined): ReadonlySet<OpenApiSecuritySchemeName>;
+export declare function handleServerFetchRequest(server: ReturnType<typeof Bun.serve>, context: ServerContext, options: ServerFetchOptions, originalRequest: Request): Promise<Response | undefined>;
+export declare function createServerWebSocketHandlers(context: ServerContext, options: ServerFetchOptions, cleanupWorkflowIndex: (operationId: string) => void): {
+    open: (ws: ServerWebSocket<WebSocketData>) => void;
+    message: (ws: ServerWebSocket<WebSocketData>, rawMessage: string | Buffer) => void;
+    close: (ws: ServerWebSocket<WebSocketData>) => void;
+};
+export {};

package/dist/server/runtime/authentication-bridge.js

@@ -0,0 +1,194 @@
+import { decode } from "../../core/codec.js";
+import { handleMcpHttpRequest } from "../../mcp/http.js";
+import { KEYS } from "../../storage/interface.js";
+import { authContextToPrincipal, handleRequest } from "../handler.js";
+import { handleJsonRpcHttpRequestSafely } from "../json-rpc-transport-helpers.js";
+import {
+  closeJsonRpcWebSocketSession,
+  handleJsonRpcWebSocketMessage,
+  openJsonRpcWebSocketSession
+} from "../json-rpc-websocket-runtime.js";
+import { API_PREFIX } from "../route-model.js";
+import { buildPreflightResponse, decorateResponseWithCors, isPreflightRequest } from "./cors.js";
+import { gateRequest } from "./request-gate.js";
+import { handleTaskPollRequest, handleTaskResultRequest } from "./task-polling.js";
+import { reassignOrExpireTask } from "./task-reconciliation.js";
+import { addStreamSocket, removeStreamSocket, replayTokenStream } from "./websocket-stream.js";
+import { handleWebSocketUpgrade } from "./websocket-upgrade.js";
+import { handleWorkerWebSocketMessage, isInflightRecord } from "./websocket-worker.js";
+export function deriveSupportedOpenApiSecuritySchemes(auth) {
+  const schemes = new Set;
+  if (auth?.jwt !== void 0)
+    schemes.add("bearerAuth");
+  if ((auth?.apiKeys?.length ?? 0) > 0 || auth?.resolveApiKeyPrincipal !== void 0)
+    schemes.add("apiKeyAuth");
+  return schemes;
+}
+function stripApiPrefix(request) {
+  const url = new URL(request.url), prefixedRoot = `${API_PREFIX}/`, nextChar = url.pathname[prefixedRoot.length];
+  if (!url.pathname.startsWith(prefixedRoot) || nextChar === void 0 || nextChar === "/")
+    return request;
+  url.pathname = url.pathname.slice(API_PREFIX.length);
+  return new Request(url, request);
+}
+function resolveTaskPrincipal(authContext, url) {
+  if (authContext === void 0 || !url.pathname.startsWith("/v1/tasks/"))
+    return;
+  return authContextToPrincipal(authContext);
+}
+export async function handleServerFetchRequest(server, context, options, originalRequest) {
+  if (context.corsPolicy !== null && isPreflightRequest(originalRequest))
+    return buildPreflightResponse(context.corsPolicy, originalRequest);
+  const response = await dispatchServerFetchRequest(server, context, options, originalRequest);
+  if (context.corsPolicy !== null && response !== void 0)
+    return decorateResponseWithCors(context.corsPolicy, originalRequest, response);
+  return response;
+}
+async function dispatchServerFetchRequest(server, context, options, originalRequest) {
+  const request = stripApiPrefix(originalRequest), url = new URL(request.url), gate = await gateRequest(server, context, request, originalRequest);
+  if (gate.response !== null)
+    return gate.response;
+  const authentication = gate.authentication, websocketResponse = handleWebSocketUpgrade(server, context, options, originalRequest, url, authentication.authContext);
+  if (websocketResponse !== null)
+    return websocketResponse;
+  if (url.pathname === "/mcp")
+    return handleMcpHttpRequest({
+      request,
+      engine: options.engine,
+      sessionManager: context.mcpSessionManager,
+      authRequired: context.authenticatorPromise !== null,
+      ...authentication.authContext !== void 0 ? { principal: authContextToPrincipal(authentication.authContext) } : {},
+      ...options.publicOrigin !== void 0 ? { publicOrigin: options.publicOrigin } : {},
+      ...options.trustedHosts !== void 0 ? { trustedHosts: options.trustedHosts } : {}
+    });
+  const taskPrincipal = resolveTaskPrincipal(authentication.authContext, url), taskPollResponse = await handleTaskPollRequest(context, options, request, url, taskPrincipal);
+  if (taskPollResponse !== null)
+    return taskPollResponse;
+  const taskResultResponse = await handleTaskResultRequest(context, options, request, url, taskPrincipal);
+  if (taskResultResponse !== null)
+    return taskResultResponse;
+  if (url.pathname === "/jsonrpc")
+    return handleJsonRpcHttpRequestSafely({
+      request,
+      registry: context.liveOperationRegistry,
+      engine: options.engine,
+      authContext: authentication.authContext
+    });
+  return handleRequest(request, options.engine, buildHandlerOptions(context, options, authentication));
+}
+function buildHandlerOptions(context, options, authentication) {
+  return {
+    ...authentication.authContext !== void 0 ? { authContext: authentication.authContext } : {},
+    ...options.prometheusExporter !== void 0 ? { prometheusExporter: options.prometheusExporter } : {},
+    ...options.discoveryInfo !== void 0 ? { discoveryInfo: options.discoveryInfo } : {},
+    ...options.publicOrigin !== void 0 ? { publicOrigin: options.publicOrigin } : {},
+    ...options.trustedHosts !== void 0 ? { trustedHosts: options.trustedHosts } : {},
+    operationRegistry: context.liveOperationRegistry,
+    restBindings: context.liveRestBindings,
+    supportedAuthenticationSchemes: context.supportedAuthenticationSchemes
+  };
+}
+export function createServerWebSocketHandlers(context, options, cleanupWorkflowIndex) {
+  return {
+    open(ws) {
+      const { pathname, connectionType, workflowId } = ws.data;
+      if (pathname && connectionType !== "stream" && connectionType !== "jsonrpc")
+        ws.subscribe(pathname);
+      if (connectionType === "stream" && workflowId) {
+        ws.data.replayInProgress = !0;
+        ws.data.pendingStreamMessages = [];
+        addStreamSocket(context, workflowId, ws);
+        replayTokenStream(context, options.engine, ws, workflowId);
+      }
+      if (connectionType === "jsonrpc") {
+        openJsonRpcWebSocketSession({
+          ws,
+          registry: context.liveOperationRegistry,
+          engine: options.engine,
+          feed: context.workflowEventFeed,
+          activeSessions: context.activeJsonRpcSessions
+        });
+        return;
+      }
+    },
+    message(ws, rawMessage) {
+      switch (ws.data.connectionType) {
+        case "jsonrpc":
+          handleJsonRpcWebSocketMessage(ws, rawMessage);
+          return;
+        case "worker":
+          handleWorkerWebSocketMessage(context, options, ws, rawMessage, cleanupWorkflowIndex);
+          return;
+        case "stream":
+        case "watch":
+        case "generic":
+          return;
+      }
+    },
+    close(ws) {
+      if (ws.data.connectionType === "jsonrpc") {
+        closeJsonRpcWebSocketSession({
+          session: ws.data.jsonRpcSession,
+          activeSessions: context.activeJsonRpcSessions
+        });
+        return;
+      }
+      if (ws.data.connectionType === "stream")
+        removeStreamSocket(context, ws);
+      const workerId = ws.data.workerId;
+      if (workerId) {
+        if (context.workerSockets.get(workerId) !== ws) {
+          console.warn(`[weft] Ignoring stale socket close for worker "${workerId}" \u2014 already reconnected`);
+          return;
+        }
+        if (context.workerReconnectGracePeriodMs <= 0) {
+          runWorkerDisconnectRequeue(context, options, workerId, ws, cleanupWorkflowIndex);
+          return;
+        }
+        const existing = context.pendingWorkerRequeues.get(workerId);
+        if (existing !== void 0)
+          clearTimeout(existing);
+        const timer = setTimeout(() => {
+          context.pendingWorkerRequeues.delete(workerId);
+          if (context.workerSockets.get(workerId) !== ws)
+            return;
+          runWorkerDisconnectRequeue(context, options, workerId, ws, cleanupWorkflowIndex);
+        }, context.workerReconnectGracePeriodMs);
+        context.pendingWorkerRequeues.set(workerId, timer);
+      }
+    }
+  };
+}
+function runWorkerDisconnectRequeue(context, options, workerId, _ws, cleanupWorkflowIndex) {
+  const inFlightTasks = context.registry.getWorkerTasks(workerId);
+  for (const task of inFlightTasks) {
+    context.registry.completeTask(task.operationId);
+    context.deadlineTracker.remove(task.operationId);
+  }
+  context.registry.unregister(workerId);
+  context.workerSockets.delete(workerId);
+  for (const [workflowId, affinityWorkerId] of context.workerAffinity)
+    if (affinityWorkerId === workerId)
+      context.workerAffinity.delete(workflowId);
+  for (const task of inFlightTasks)
+    cleanupWorkflowIndex(task.operationId);
+  for (const task of inFlightTasks)
+    (async () => {
+      try {
+        const inflightKey = KEYS.operationInflight(task.operationId), existing = await options.engine.storage.get(inflightKey);
+        if (existing) {
+          const record = decode(existing);
+          if (!isInflightRecord(record)) {
+            console.error(`[weft] Corrupt inflight record for task "${task.operationId}" \u2014 skipping reassignment`);
+            return;
+          }
+          await reassignOrExpireTask(context, options, task.operationId, record, "worker-disconnect");
+        } else {
+          console.warn(`[weft] No inflight record found in storage for task "${task.operationId}" \u2014 skipping reassignment`);
+          await options.engine.storage.delete(inflightKey);
+        }
+      } catch (error) {
+        console.error(`[weft] Failed to reassign task "${task.operationId}" from worker "${workerId}":`, error);
+      }
+    })();
+}