@lostgradient/weft 0.2.1 → 0.4.0

package/dist/server/runtime/websocket-stream.js

@@ -1,12 +1,24 @@
+import { decode } from "../../core/codec.js";
+import { loadStoredStreamTailSequence } from "../../core/engine/stream-chunk-loading.js";
 import { KEYS } from "../../storage/interface.js";
-const TOKEN_EVENT_TYPE = "stream:token";
+const TOKEN_EVENT_TYPE = "stream:token", STREAM_CONNECTION_POLICY_CLOSE_CODE = 1008, MAX_WATCH_REPLAY_EVENTS = 1000, MAX_PENDING_WATCH_REPLAY_MESSAGES = 1000;
+export const DEFAULT_MAX_STREAM_CONNECTIONS_PER_WORKFLOW = 100;
 export function sendStreamMessage(ws, sequence, message) {
-  if (sequence <= (ws.data.lastDeliveredSequence ?? -1))
+  if (sequence <= (ws.data.streamLastDeliveredSequence ?? -1))
     return;
   ws.send(message);
-  ws.data.lastDeliveredSequence = sequence;
+  ws.data.streamLastDeliveredSequence = sequence;
+}
+export function sendWatchMessage(ws, sequence, message) {
+  if (sequence <= (ws.data.watchLastDeliveredSequence ?? -1))
+    return;
+  ws.send(message);
+  ws.data.watchLastDeliveredSequence = sequence;
 }
 export async function getHighestStoredStreamSequence(engine, workflowId, key) {
+  const tailSequence = await loadStoredStreamTailSequence(engine.storage, workflowId, key);
+  if (tailSequence !== null)
+    return tailSequence;
   const prefix = KEYS.streamChunkPrefix(workflowId, key);
   for await (const [storageKey] of engine.storage.scan(prefix, { reverse: !0, limit: 1 })) {
     const sequenceText = storageKey.slice(prefix.length), sequence = Number.parseInt(sequenceText, 10);
@@ -15,13 +27,37 @@ export async function getHighestStoredStreamSequence(engine, workflowId, key) {
   }
   return -1;
 }
+export async function getHighestStoredWatchSequence(engine, workflowId) {
+  const prefix = KEYS.eventPrefix(workflowId);
+  for await (const [storageKey] of engine.storage.scan(prefix, { reverse: !0, limit: 50 })) {
+    const sequence = parseSequenceFromEventKey(prefix, storageKey);
+    if (sequence === null)
+      continue;
+    return sequence;
+  }
+  return -1;
+}
 export function addStreamSocket(context, workflowId, ws) {
+  if (!addWorkflowStreamConnection(context, workflowId, ws))
+    return !1;
   let sockets = context.streamSockets.get(workflowId);
   if (!sockets) {
     sockets = new Set;
     context.streamSockets.set(workflowId, sockets);
   }
   sockets.add(ws);
+  return !0;
+}
+export function addWatchSocket(context, workflowId, ws) {
+  if (!addWorkflowStreamConnection(context, workflowId, ws))
+    return !1;
+  let sockets = context.watchSockets.get(workflowId);
+  if (!sockets) {
+    sockets = new Set;
+    context.watchSockets.set(workflowId, sockets);
+  }
+  sockets.add(ws);
+  return !0;
 }
 export function removeStreamSocket(context, ws) {
   const workflowId = ws.data.workflowId;
@@ -34,6 +70,39 @@ export function removeStreamSocket(context, ws) {
   if (sockets.size === 0)
     context.streamSockets.delete(workflowId);
 }
+export function removeWatchSocket(context, ws) {
+  const workflowId = ws.data.workflowId;
+  if (!workflowId)
+    return;
+  const sockets = context.watchSockets.get(workflowId);
+  if (!sockets)
+    return;
+  sockets.delete(ws);
+  if (sockets.size === 0)
+    context.watchSockets.delete(workflowId);
+}
+export function removeWorkflowStreamConnection(context, ws) {
+  const workflowId = ws.data.workflowId;
+  if (!workflowId || !ws.data.workflowStreamConnectionAccepted)
+    return;
+  ws.data.workflowStreamConnectionAccepted = !1;
+  const currentCount = context.workflowStreamConnectionCounts.get(workflowId);
+  if (currentCount === void 0 || currentCount <= 1) {
+    context.workflowStreamConnectionCounts.delete(workflowId);
+    return;
+  }
+  context.workflowStreamConnectionCounts.set(workflowId, currentCount - 1);
+}
+function addWorkflowStreamConnection(context, workflowId, ws) {
+  const currentCount = context.workflowStreamConnectionCounts.get(workflowId) ?? 0, maxConnections = context.maxStreamConnectionsPerWorkflow;
+  if (currentCount >= maxConnections) {
+    ws.close(STREAM_CONNECTION_POLICY_CLOSE_CODE, `maximum stream connections per workflow (${maxConnections}) exceeded`);
+    return !1;
+  }
+  context.workflowStreamConnectionCounts.set(workflowId, currentCount + 1);
+  ws.data.workflowStreamConnectionAccepted = !0;
+  return !0;
+}
 export function flushPendingStreamMessages(_context, ws) {
   const pendingMessages = ws.data.pendingStreamMessages ?? [];
   pendingMessages.sort((left, right) => left.sequence - right.sequence);
@@ -41,12 +110,19 @@ export function flushPendingStreamMessages(_context, ws) {
     sendStreamMessage(ws, pending.sequence, pending.message);
   ws.data.pendingStreamMessages = [];
 }
+export function flushPendingWatchMessages(_context, ws) {
+  const pendingMessages = ws.data.pendingWatchMessages ?? [];
+  pendingMessages.sort((left, right) => left.sequence - right.sequence);
+  for (const pending of pendingMessages)
+    sendWatchMessage(ws, pending.sequence, pending.message);
+  ws.data.pendingWatchMessages = [];
+}
 export function publishTokenMessage(context, workflowId, sequence, message) {
   const sockets = context.streamSockets.get(workflowId);
   if (!sockets)
     return;
   for (const ws of sockets) {
-    if (ws.data.replayInProgress) {
+    if (ws.data.streamReplayInProgress) {
       ws.data.pendingStreamMessages ??= [];
       ws.data.pendingStreamMessages.push({ sequence, message });
       continue;
@@ -54,11 +130,29 @@ export function publishTokenMessage(context, workflowId, sequence, message) {
     sendStreamMessage(ws, sequence, message);
   }
 }
+export function publishWatchMessage(context, workflowId, sequence, message) {
+  const sockets = context.watchSockets.get(workflowId);
+  if (!sockets)
+    return;
+  for (const ws of sockets) {
+    if (ws.data.watchReplayInProgress) {
+      const pendingMessages = ws.data.pendingWatchMessages ?? [];
+      if (pendingMessages.length >= MAX_PENDING_WATCH_REPLAY_MESSAGES) {
+        closeWatchSocketForReplayLimit(context, ws, `watch replay buffer exceeded ${MAX_PENDING_WATCH_REPLAY_MESSAGES} pending messages`);
+        continue;
+      }
+      pendingMessages.push({ sequence, message });
+      ws.data.pendingWatchMessages = pendingMessages;
+      continue;
+    }
+    sendWatchMessage(ws, sequence, message);
+  }
+}
 export async function replayTokenStream(context, engine, ws, workflowId) {
-  ws.data.lastDeliveredSequence = -1;
+  ws.data.streamLastDeliveredSequence = -1;
   try {
     const requestedResumeFrom = ws.data.resumeFrom, after = requestedResumeFrom === void 0 ? -1 : Math.min(requestedResumeFrom, await getHighestStoredStreamSequence(engine, workflowId, "tokens"));
-    ws.data.lastDeliveredSequence = after;
+    ws.data.streamLastDeliveredSequence = after;
     const chunks = after >= 0 ? await engine.getStreamChunks(workflowId, "tokens", { after }) : await engine.getStreamChunks(workflowId, "tokens");
     for (const chunk of chunks) {
       if (typeof chunk.value !== "object" || chunk.value === null)
@@ -73,7 +167,79 @@ export async function replayTokenStream(context, engine, ws, workflowId) {
   } catch (error) {
     console.error(`[weft] Failed to replay token stream for workflow "${workflowId}":`, error);
   } finally {
-    ws.data.replayInProgress = !1;
+    ws.data.streamReplayInProgress = !1;
     flushPendingStreamMessages(context, ws);
   }
 }
+export async function replayWatchEvents(context, engine, ws, workflowId) {
+  ws.data.watchLastDeliveredSequence = -1;
+  let shouldFlushPending = !0, replayedEvents = 0;
+  try {
+    const requestedResumeFrom = ws.data.resumeFrom, after = requestedResumeFrom === void 0 ? -1 : Math.min(requestedResumeFrom, await getHighestStoredWatchSequence(engine, workflowId));
+    ws.data.watchLastDeliveredSequence = after;
+    const prefix = KEYS.eventPrefix(workflowId), scanOptions = after >= 0 ? { gt: KEYS.event(workflowId, after) } : void 0;
+    for await (const [storageKey, value] of engine.storage.scan(prefix, scanOptions)) {
+      const sequence = parseSequenceFromEventKey(prefix, storageKey);
+      if (sequence === null || sequence <= after)
+        continue;
+      const decoded = decodeStoredWatchEvent(value);
+      if (!isStoredWatchEvent(decoded))
+        continue;
+      if (replayedEvents >= MAX_WATCH_REPLAY_EVENTS) {
+        shouldFlushPending = !1;
+        closeWatchSocketForReplayLimit(context, ws, `watch replay window exceeds ${MAX_WATCH_REPLAY_EVENTS} events; reconnect with a newer resumeFrom`);
+        return;
+      }
+      sendWatchMessage(ws, sequence, JSON.stringify({
+        type: decoded.type,
+        timestamp: decoded.timestamp,
+        data: decoded.data,
+        sequence,
+        cursor: String(sequence)
+      }));
+      replayedEvents += 1;
+    }
+  } catch (error) {
+    console.error(`[weft] Failed to replay watch events for workflow "${workflowId}":`, error);
+    shouldFlushPending = !1;
+    closeWatchSocketForReplayLimit(context, ws, "watch replay failed before catch-up completed; reconnect with a newer resumeFrom");
+  } finally {
+    ws.data.watchReplayInProgress = !1;
+    if (shouldFlushPending)
+      flushPendingWatchMessages(context, ws);
+    else
+      ws.data.pendingWatchMessages = [];
+  }
+}
+function closeWatchSocketForReplayLimit(context, ws, reason) {
+  ws.data.pendingWatchMessages = [];
+  ws.data.watchReplayInProgress = !1;
+  ws.close(STREAM_CONNECTION_POLICY_CLOSE_CODE, reason);
+  removeWatchSocket(context, ws);
+  removeWorkflowStreamConnection(context, ws);
+}
+function decodeStoredWatchEvent(value) {
+  try {
+    return decode(value);
+  } catch {
+    return null;
+  }
+}
+function parseSequenceFromEventKey(prefix, storageKey) {
+  if (!storageKey.startsWith(prefix))
+    return null;
+  const rawSequence = storageKey.slice(prefix.length);
+  if (!/^\d+$/.test(rawSequence))
+    return null;
+  const sequence = Number.parseInt(rawSequence, 10);
+  return Number.isSafeInteger(sequence) ? sequence : null;
+}
+function isStoredWatchEvent(value) {
+  if (typeof value !== "object" || value === null)
+    return !1;
+  const record = value;
+  return typeof record.type === "string" && typeof record.timestamp === "number" && Number.isFinite(record.timestamp) && isPlainRecord(record.data);
+}
+function isPlainRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/server/runtime/websocket-upgrade.js

@@ -37,7 +37,7 @@ function rejectsCrossOriginUpgrade(context, request) {
   return context.corsPolicy !== null && origin !== null && !isOriginAllowed(context.corsPolicy, origin);
 }
 function resolvePrincipalForUpgrade(connectionType, authContext) {
-  if (connectionType !== "jsonrpc" && connectionType !== "worker")
+  if (connectionType !== "jsonrpc" && connectionType !== "worker" && connectionType !== "watch" && connectionType !== "stream")
     return { ok: !0, principal: void 0 };
   if (authContext === void 0)
     return { ok: !0, principal: void 0 };
@@ -48,10 +48,29 @@ function resolvePrincipalForUpgrade(connectionType, authContext) {
     console.error("[weft] WebSocket upgrade principal resolution failed", error);
     return { ok: !1, response: new Response("Authentication context invalid", { status: 401 }) };
   }
-  if (connectionType === "worker" && isAuthenticated(principal) && !principal.hasScope("workers:write"))
-    return { ok: !1, response: new Response("Insufficient scope", { status: 403 }) };
+  const requiredScope = upgradeScope(connectionType);
+  if (requiredScope !== null) {
+    if (!isAuthenticated(principal))
+      return { ok: !1, response: new Response("Authentication required", { status: 401 }) };
+    if (!principal.hasScope(requiredScope))
+      return { ok: !1, response: new Response("Insufficient scope", { status: 403 }) };
+  }
   return { ok: !0, principal };
 }
+function upgradeScope(connectionType) {
+  switch (connectionType) {
+    case "worker":
+      return "workers:write";
+    case "watch":
+      return "events:read";
+    case "stream":
+      return "streams:read";
+    case "jsonrpc":
+    case "generic":
+    case void 0:
+      return null;
+  }
+}
 export function handleWebSocketUpgrade(server, context, options, request, url, authContext) {
   if (request.headers.get("upgrade") !== "websocket")
     return null;

package/dist/server/runtime/websocket-worker.d.ts

@@ -3,5 +3,5 @@ import type { ServeOptions } from '../index.ts';
 import type { WebSocketData } from '../json-rpc-websocket-runtime.ts';
 import type { ServerContext } from './context.ts';
 export { isInflightRecord } from '../task-state.ts';
-export declare function withRetry<T>(operation: () => Promise<T>, label: string, maxAttempts?: number): Promise<T>;
+export { withRetry } from './retry.ts';
 export declare function handleWorkerWebSocketMessage(context: ServerContext, options: ServeOptions, ws: ServerWebSocket<WebSocketData>, rawMessage: string | Buffer, cleanupWorkflowIndex: (operationId: string) => void): void;

package/dist/server/runtime/websocket-worker.js

@@ -1,4 +1,5 @@
 import { decode, encode } from "../../core/codec.js";
+import { WorkerConnectedEvent } from "../../core/events.js";
 import { KEYS } from "../../storage/interface.js";
 import {
   REMOTE_WORKER_PROTOCOL_VERSION,
@@ -7,35 +8,20 @@ import {
 } from "../../worker/protocol.js";
 import { workerProtocolIncompatibleMessage } from "../../worker/worker-protocol-incompatible-error.js";
 import { isAuthenticated } from "../principal.js";
+import { isInflightRecord, readInflightRecord } from "../task-state.js";
+import { withRetry } from "./retry.js";
+import { recordWorkerCapacitySaturationMetric } from "./task-metrics.js";
 import {
-  isInflightRecord,
-  readInflightRecord,
-  transitionInflightToResolved
-} from "../task-state.js";
-import {
-  recordTaskExecutionLatencyMetric,
-  recordWorkerCapacitySaturationMetric
-} from "./task-metrics.js";
+  taskResultPayloadSizeError,
+  transitionTaskResultToResolvedWithRetry
+} from "./task-result-resolution.js";
 import { WORKER_STREAM_RE } from "./websocket-upgrade.js";
 const MAX_WORKER_CONCURRENCY = 1000, DEFAULT_WORKER_CONCURRENCY = 10, WORKER_PROTOCOL_CLOSE_CODE = 1002, WORKER_REGISTRATION_CLOSE_CODE = 1008;
 function isWorkerConnection(pathname) {
   return WORKER_STREAM_RE.test(pathname);
 }
 export { isInflightRecord } from "../task-state.js";
-export async function withRetry(operation, label, maxAttempts = 2) {
-  let lastError;
-  for (let attempt = 1;attempt <= maxAttempts; attempt++)
-    try {
-      return await operation();
-    } catch (error) {
-      lastError = error;
-      if (attempt < maxAttempts) {
-        console.warn(`[weft] Retrying "${label}" (attempt ${attempt + 1}/${maxAttempts})`);
-        await Bun.sleep(100 * attempt);
-      }
-    }
-  throw lastError;
-}
+export { withRetry } from "./retry.js";
 function sendWorkerProtocolMessage(ws, message) {
   ws.send(JSON.stringify(message));
 }
@@ -83,7 +69,7 @@ function buildWorkerRegistrationInfo(message, queue, concurrency) {
     ...message.capabilities !== void 0 ? { capabilities: message.capabilities } : {}
   };
 }
-function registerWorker(context, ws, message) {
+function registerWorker(context, options, ws, message) {
   if (!principalMayRegisterWorker(ws.data.principal)) {
     rejectRegistration(ws, "invalid_registration", "Worker registration requires the workers:write scope", message.protocolVersion);
     return;
@@ -106,6 +92,7 @@ function registerWorker(context, ws, message) {
     activities: [...message.activities],
     concurrency: clampedConcurrency
   });
+  options.engine.dispatchEvent(new WorkerConnectedEvent(message.workerId, queue, [...message.activities], clampedConcurrency));
 }
 function resolveTaskResultStatus(message) {
   return message.status === "completed" ? "completed" : "failed";
@@ -120,20 +107,49 @@ function onTaskResultMessage(context, options, ws, message, cleanupWorkflowIndex
     });
     return;
   }
+  if (!context.registry.isAssignedToAttempt(operationId, workerId, message.attemptToken)) {
+    sendWorkerProtocolMessage(ws, {
+      type: "protocolError",
+      code: "invalid_message",
+      message: `taskResult for operation "${operationId}" rejected \u2014 stale attempt token`
+    });
+    return;
+  }
+  const resolvedStatus = resolveTaskResultStatus(message), payloadError = taskResultPayloadSizeError({
+    operationId,
+    status: resolvedStatus,
+    resolutionReason: resolvedStatus,
+    ...message.status === "completed" ? { value: message.value } : { error: message.error }
+  }, context.payloadSizeMaxBytes);
   context.registry.completeTask(operationId);
   context.deadlineTracker.remove(operationId);
   cleanupWorkflowIndex(operationId);
   recordWorkerCapacitySaturationMetric(context.metricsCollector, context.registry);
   (async () => {
-    const inflightRecord = await readInflightRecord(options.engine.storage, operationId), resolvedAt = Date.now(), resolvedStatus = resolveTaskResultStatus(message);
-    await transitionInflightToResolved(options.engine.storage, operationId, resolvedStatus, {
-      ...inflightRecord === null ? {} : { record: inflightRecord },
-      resolvedAt,
+    const inflightRecord = await readInflightRecord(options.engine.storage, operationId);
+    if (payloadError !== null) {
+      sendWorkerProtocolMessage(ws, {
+        type: "protocolError",
+        code: "invalid_message",
+        message: payloadError.message
+      });
+      await transitionTaskResultToResolvedWithRetry(context, options, {
+        operationId,
+        status: "failed",
+        resolutionReason: "failed",
+        inflightRecord,
+        error: payloadError.message,
+        skipPayloadSizeCheck: !0
+      });
+      return;
+    }
+    await transitionTaskResultToResolvedWithRetry(context, options, {
+      operationId,
+      status: resolvedStatus,
       resolutionReason: resolvedStatus,
+      inflightRecord,
       ...message.status === "completed" ? { value: message.value } : { error: message.error }
     });
-    if (inflightRecord !== null)
-      recordTaskExecutionLatencyMetric(context.metricsCollector, inflightRecord, resolvedAt);
   })().catch((error) => {
     console.error(`[weft] Failed to transition task "${operationId}" to resolved \u2014 inflight record may leak:`, error);
   });
@@ -207,7 +223,7 @@ export function handleWorkerWebSocketMessage(context, options, ws, rawMessage, c
   }
   switch (message.type) {
     case "register": {
-      registerWorker(context, ws, message);
+      registerWorker(context, options, ws, message);
       break;
     }
     case "taskResult": {

package/dist/server/serve-internals.d.ts

@@ -11,12 +11,22 @@ import type { WebSocketData } from './json-rpc-websocket-runtime.ts';
 import { createServerWebSocketHandlers } from './runtime/authentication-bridge.ts';
 import type { ServerContext } from './runtime/context.ts';
 import { type EventBroadcastingHandle } from './runtime/event-broadcasting.ts';
+/**
+ * @internal
+ *
+ * Warning emitted when a server starts with no authentication and no explicit
+ * `unauthenticatedAccess` policy. Exported only for internal tests (see
+ * `tests/auth-warning-filter.test.ts`) and not part of the public API surface.
+ */
+export declare const NO_AUTHENTICATION_WARNING = "[weft] WARNING: server started with NO authentication; all non-public operations are publicly accessible. Configure serve({ auth }) to lock down, or set unauthenticatedAccess: \"reject\" in production to fail closed.";
+export declare const MCP_ORIGIN_CONFIGURATION_WARNING = "[weft] WARNING: MCP HTTP transport is enabled without publicOrigin or trustedHosts. Cross-origin /mcp requests are rejected, and discovery routes that emit absolute URLs return 503. Configure serve({ publicOrigin: \"https://api.example.com\" }) or serve({ trustedHosts: [\"api.example.com\"] }) before exposing the server through a browser or reverse proxy.";
 /**
  * Clamp a user-supplied `workerReconnectGracePeriodMs` into `[0, 5_000]`.
- * Returns the default when undefined or non-finite.
+ * Returns the 2000ms default when undefined or non-finite.
  */
 export declare function clampWorkerReconnectGracePeriod(value: number | undefined): number;
 export declare function assertAuthenticationPosture(options: ServeOptions, environmentRequirement?: string | undefined): void;
+export declare function warnIfMcpOriginConfigurationMissing(options: ServeOptions): void;
 /**
  * A mutable holder for the Bun server instance. The `fetch` handler needs to
  * call back into the server (for WebSocket upgrades) but the server isn't

package/dist/server/serve-internals.js

@@ -1,4 +1,5 @@
 import { decode } from "../core/codec.js";
+import { getEnginePayloadSizeMaxBytes } from "../core/engine/payload-size-policy.js";
 import { createMcpSessionManager } from "../mcp/session.js";
 import { createMetricsCollectorExporter, MetricsCollector } from "../observability/metrics.js";
 import { WorkerRegistry } from "../worker/registry.js";
@@ -11,6 +12,7 @@ import {
 } from "./authentication.js";
 import { DeadlineTracker } from "./deadline-tracker.js";
 import { createEngineEventFeedBackend } from "./engine-event-feed-backend.js";
+import { createFleetEventFeed } from "./fleet-event-feed.js";
 import { closeJsonRpcSessionsForShutdown } from "./json-rpc-websocket-runtime.js";
 import { createLiveOperationRegistry, createLiveRestBindings } from "./rest-bindings.js";
 import {
@@ -22,11 +24,15 @@ import { resolveCorsPolicy, validateCorsOptions } from "./runtime/cors.js";
 import {
   registerWorkflowEventLifecycle
 } from "./runtime/event-broadcasting.js";
+import { shutdownAllWorkers } from "./runtime/shutdown.js";
 import { reconcileOrphanedRecords, scanExpiredTasks } from "./runtime/task-reconciliation.js";
+import { DEFAULT_MAX_STREAM_CONNECTIONS_PER_WORKFLOW } from "./runtime/websocket-stream.js";
 import { isInflightRecord, withRetry } from "./runtime/websocket-worker.js";
 import { TaskQueue } from "./task-queue.js";
 import { createWorkflowEventFeed } from "./workflow-event-feed.js";
-const RECONCILIATION_MULTIPLIER = 12, DEFAULT_WORKER_RECONNECT_GRACE_PERIOD_MS = 100, MAX_WORKER_RECONNECT_GRACE_PERIOD_MS = 5000, AUTHENTICATION_REQUIRED_ENVIRONMENT_VARIABLE = "WEFT_SERVER_AUTHENTICATION_REQUIRED", NO_AUTHENTICATION_WARNING = '[weft] WARNING: server started with NO authentication; all non-public operations are publicly accessible. Configure serve({ auth }) to lock down, or set unauthenticatedAccess: "reject" in production to fail closed.', NO_AUTHENTICATION_REJECT_ERROR = '[weft] Refusing to start server with no authentication. Configure serve({ auth }) or set unauthenticatedAccess: "allow" only for trusted local development.', NO_AUTHENTICATION_ENVIRONMENT_ERROR = "[weft] Refusing to start server with no authentication because WEFT_SERVER_AUTHENTICATION_REQUIRED requires authentication. Configure serve({ auth }) or unset WEFT_SERVER_AUTHENTICATION_REQUIRED only for trusted local development.", TRUTHY_AUTHENTICATION_REQUIREMENT_VALUES = new Set(["1", "true", "yes", "on"]), FALSY_AUTHENTICATION_REQUIREMENT_VALUES = new Set(["0", "false", "no", "off"]);
+const RECONCILIATION_MULTIPLIER = 12, DEFAULT_WORKER_RECONNECT_GRACE_PERIOD_MS = 2000, MAX_WORKER_RECONNECT_GRACE_PERIOD_MS = 5000, AUTHENTICATION_REQUIRED_ENVIRONMENT_VARIABLE = "WEFT_SERVER_AUTHENTICATION_REQUIRED";
+export const NO_AUTHENTICATION_WARNING = '[weft] WARNING: server started with NO authentication; all non-public operations are publicly accessible. Configure serve({ auth }) to lock down, or set unauthenticatedAccess: "reject" in production to fail closed.', MCP_ORIGIN_CONFIGURATION_WARNING = '[weft] WARNING: MCP HTTP transport is enabled without publicOrigin or trustedHosts. Cross-origin /mcp requests are rejected, and discovery routes that emit absolute URLs return 503. Configure serve({ publicOrigin: "https://api.example.com" }) or serve({ trustedHosts: ["api.example.com"] }) before exposing the server through a browser or reverse proxy.';
+const NO_AUTHENTICATION_REJECT_ERROR = '[weft] Refusing to start server with no authentication. Configure serve({ auth }) or set unauthenticatedAccess: "allow" only for trusted local development.', NO_AUTHENTICATION_ENVIRONMENT_ERROR = "[weft] Refusing to start server with no authentication because WEFT_SERVER_AUTHENTICATION_REQUIRED requires authentication. Configure serve({ auth }) or unset WEFT_SERVER_AUTHENTICATION_REQUIRED only for trusted local development.", TRUTHY_AUTHENTICATION_REQUIREMENT_VALUES = new Set(["1", "true", "yes", "on"]), FALSY_AUTHENTICATION_REQUIREMENT_VALUES = new Set(["0", "false", "no", "off"]);
 export function clampWorkerReconnectGracePeriod(value) {
   if (value === void 0 || !Number.isFinite(value))
     return DEFAULT_WORKER_RECONNECT_GRACE_PERIOD_MS;
@@ -59,6 +65,11 @@ export function assertAuthenticationPosture(options, environmentRequirement = Bu
     return;
   console.warn(NO_AUTHENTICATION_WARNING);
 }
+export function warnIfMcpOriginConfigurationMissing(options) {
+  if (options.publicOrigin !== void 0 || options.trustedHosts !== void 0)
+    return;
+  console.warn(MCP_ORIGIN_CONFIGURATION_WARNING);
+}
 export function resolveNetworkConfig(options) {
   if (options.auth)
     validateAuthConfig(options.auth);
@@ -67,6 +78,7 @@ export function resolveNetworkConfig(options) {
   if (options.cors)
     validateCorsOptions(options.cors, options.auth !== void 0);
   assertAuthenticationPosture(options);
+  warnIfMcpOriginConfigurationMissing(options);
   const port = options.port ?? 7233, hostname = options.hostname ?? "0.0.0.0", development = options.development ?? !1, serverMetricsCollector = new MetricsCollector, prometheusExporter = options.prometheusExporter ?? createMetricsCollectorExporter(serverMetricsCollector), serverOptions = { ...options, prometheusExporter }, tlsOptions = buildTLSOptions(options.auth);
   return { port, hostname, development, tlsOptions, serverOptions, serverMetricsCollector };
 }
@@ -77,6 +89,9 @@ export function buildServerContext(options, serverMetricsCollector) {
     taskQueue,
     workerSockets: new Map,
     streamSockets: new Map,
+    watchSockets: new Map,
+    workflowStreamConnectionCounts: new Map,
+    maxStreamConnectionsPerWorkflow: options.maxStreamConnectionsPerWorkflow ?? DEFAULT_MAX_STREAM_CONNECTIONS_PER_WORKFLOW,
     workerAffinity: new Map,
     workflowOperations: new Map,
     operationToWorkflow: new Map,
@@ -93,12 +108,14 @@ export function buildServerContext(options, serverMetricsCollector) {
     metricsCollector: serverMetricsCollector,
     eventFeedBackend,
     workflowEventFeed: createWorkflowEventFeed(eventFeedBackend),
+    fleetEventFeed: createFleetEventFeed(options.engine.storage),
     activeJsonRpcSessions: new Set,
     mcpSessionManager: createMcpSessionManager(options.engine),
     authenticatorPromise: options.auth ? createAuthenticator(options.auth) : null,
     rateLimiter: options.rateLimit ? createRateLimiter(options.rateLimit) : null,
     visibilityPollMs: options.visibilityPollIntervalMs ?? 5000,
     workerReconnectGracePeriodMs: clampWorkerReconnectGracePeriod(options.workerReconnectGracePeriodMs),
+    payloadSizeMaxBytes: getEnginePayloadSizeMaxBytes(options.engine),
     pendingWorkerRequeues: new Map,
     scanRunning: !1,
     processingOperations: new Set,
@@ -146,6 +163,7 @@ export function registerStackDisposers(stack, context, options, broadcastingHand
   });
   stack.defer(() => context.mcpSessionManager[Symbol.asyncDispose]());
   stack.defer(registerWorkflowEventLifecycle(options.engine, context, broadcastingHandle));
+  stack.defer(() => shutdownAllWorkers(context, options.workerShutdownTimeoutMs === void 0 ? void 0 : { timeoutMs: options.workerShutdownTimeoutMs, stopWaitingWhenIdle: !0 }));
   const visibilityPollHandle = setInterval(() => {
     scanExpiredTasks(context, options, onOperationCleanup);
   }, context.visibilityPollMs), reconciliationIntervalMs = context.visibilityPollMs * RECONCILIATION_MULTIPLIER, reconciliationHandle = setInterval(() => {
@@ -179,7 +197,7 @@ export function restoreInflightTasks(context, options) {
         continue;
       }
       const remaining = record.deadline - now;
-      context.registry.assignTask(record.workerId, record.operationId, remaining);
+      context.registry.assignTask(record.workerId, record.operationId, remaining, void 0, record.attemptToken);
       context.deadlineTracker.add({ operationId: record.operationId, deadline: record.deadline });
       const tracked = context.registry.getWorkerTasks(record.workerId).find((t) => t.operationId === record.operationId);
       if (tracked)

package/dist/server/task-state.d.ts

@@ -20,6 +20,8 @@ export type TaskState = 'queued' | 'inflight' | 'resolved';
 export type TaskRequeueReason = 'visibility-timeout' | 'worker-disconnect';
 /** Final reason captured when a task reaches the resolved state. */
 export type TaskResolutionReason = 'completed' | 'failed' | 'cancelled' | 'max-attempts-exceeded';
+/** Why a task-result transition was moved to the operator dead-letter guard. */
+export type TaskDeadLetterReason = 'result-resolution-storage-exhausted';
 /** Lifecycle evidence persisted with task records for diagnostics. */
 export interface TaskLifecycleFields {
     /** First time this operation entered a task queue. */
@@ -67,6 +69,14 @@ export interface InflightRecord extends TaskLifecycleFields {
     retryPolicy?: RetryPolicy | undefined;
     /** Workflow that dispatched this activity. Present when the dispatch included a workflowId. */
     workflowId?: string | undefined;
+    /**
+     * Unique, unguessable token identifying this dispatch attempt. Rotated on every
+     * (re-)dispatch because each dispatch writes a fresh InflightRecord. The
+     * long-poll completion handler rejects a result whose echoed token does not
+     * match this value. Optional for back-compatible decoding of records written
+     * before this field existed; a missing token disables the check for that record.
+     */
+    attemptToken?: string | undefined;
 }
 /** Persisted record for a task in the resolved state. */
 export interface ResolvedRecord {
@@ -95,6 +105,24 @@ export interface ResolvedRecord {
     queueLatencyMs?: number | undefined;
     executionLatencyMs?: number | undefined;
 }
+/** Durable operator guard for a task result whose resolved write exhausted retries. */
+export interface DeadLetteredTaskRecord {
+    operationId: string;
+    reason: TaskDeadLetterReason;
+    deadLetteredAt: number;
+    errorMessage: string;
+    retryAttempts: number;
+    status: 'completed' | 'failed';
+    activityName?: string | undefined;
+    queue?: string | undefined;
+    workerId?: string | undefined;
+    attempt?: number | undefined;
+    visibilityTimeout?: number | undefined;
+    workflowId?: string | undefined;
+    retryCount?: number | undefined;
+    requeueCount?: number | undefined;
+    lastRequeueReason?: TaskRequeueReason | undefined;
+}
 export interface TransitionInflightToResolvedOptions {
     resolutionReason?: TaskResolutionReason;
     resolvedAt?: number;
@@ -123,10 +151,20 @@ export declare function isQueuedRecord(value: unknown): value is QueuedRecord;
 export declare function isInflightRecord(value: unknown): value is InflightRecord;
 /** Type guard for decoded storage records in the resolved state. */
 export declare function isResolvedRecord(value: unknown): value is ResolvedRecord;
+/** Type guard for decoded task-result dead-letter records. */
+export declare function isDeadLetteredTaskRecord(value: unknown): value is DeadLetteredTaskRecord;
 /** Decode the queued record for an operation, returning null when absent or malformed. */
 export declare function readQueuedRecord(storage: Storage, operationId: string): Promise<QueuedRecord | null>;
 /** Decode the inflight record for an operation, returning null when absent or malformed. */
 export declare function readInflightRecord(storage: Storage, operationId: string): Promise<InflightRecord | null>;
+/** Decode the task-result dead-letter record for an operation. */
+export declare function readDeadLetteredTaskRecord(storage: Storage, operationId: string): Promise<DeadLetteredTaskRecord | null>;
+/** True when reconciliation should not re-dispatch the operation. */
+export declare function isTaskDeadLettered(storage: Storage, operationId: string): Promise<boolean>;
+/** Persist a task-result dead-letter guard. */
+export declare function writeDeadLetteredTaskRecord(storage: Storage, record: DeadLetteredTaskRecord): Promise<void>;
+/** Clear a task-result dead-letter guard so reconciliation may handle the inflight record again. */
+export declare function clearDeadLetteredTaskRecord(storage: Storage, operationId: string): Promise<void>;
 export declare function calculateQueueLatencyMs(record: TaskLifecycleFields): number | undefined;
 export declare function calculateExecutionLatencyMs(record: TaskLifecycleFields, completedAt: number): number | undefined;
 export declare function calculateHeartbeatAgeMs(record: TaskLifecycleFields & {

package/dist/server/task-state.js

@@ -49,6 +49,12 @@ export function isResolvedRecord(value) {
   const record = value;
   return typeof record.operationId === "string" && (record.status === "completed" || record.status === "failed") && typeof record.resolvedAt === "number";
 }
+export function isDeadLetteredTaskRecord(value) {
+  if (value === null || typeof value !== "object")
+    return !1;
+  const record = value;
+  return typeof record.operationId === "string" && record.reason === "result-resolution-storage-exhausted" && typeof record.deadLetteredAt === "number" && typeof record.errorMessage === "string" && typeof record.retryAttempts === "number" && (record.status === "completed" || record.status === "failed");
+}
 export async function readQueuedRecord(storage, operationId) {
   const value = await storage.get(KEYS.operationQueued(operationId));
   if (value === null)
@@ -63,6 +69,28 @@ export async function readInflightRecord(storage, operationId) {
   const decoded = decode(value);
   return isInflightRecord(decoded) ? decoded : null;
 }
+export async function readDeadLetteredTaskRecord(storage, operationId) {
+  const value = await storage.get(KEYS.operationDeadLetter(operationId));
+  if (value === null)
+    return null;
+  const decoded = decode(value);
+  return isDeadLetteredTaskRecord(decoded) ? decoded : null;
+}
+export async function isTaskDeadLettered(storage, operationId) {
+  return await readDeadLetteredTaskRecord(storage, operationId) !== null;
+}
+export async function writeDeadLetteredTaskRecord(storage, record) {
+  await storage.batch([
+    {
+      type: "put",
+      key: KEYS.operationDeadLetter(record.operationId),
+      value: encode(record)
+    }
+  ]);
+}
+export async function clearDeadLetteredTaskRecord(storage, operationId) {
+  await storage.delete(KEYS.operationDeadLetter(operationId));
+}
 function normalizeQueuedRecordLifecycle(record, previous) {
   const normalized = {
     ...record,