@lostgradient/weft 0.23.1 → 0.24.0

package/dist/server/operations/install-workflow-revision.js

@@ -0,0 +1,46 @@
+import { z } from "zod";
+import { defineOperation } from "../operation-registry.js";
+import {
+  readWorkflowCatalogRestBody,
+  throwWorkflowCatalogOperationFault,
+  validateManifestField,
+  workflowsAdminAccess
+} from "./workflow-catalog-operation-helpers.js";
+const installWorkflowRevisionInput = z.object({
+  manifest: z.unknown().describe("An untrusted WorkflowRevisionManifest, validated at invoke time.")
+}), installWorkflowRevisionOutput = z.unknown();
+export const installWorkflowRevisionOperation = defineOperation({
+  name: "weft.workflows.revisions.install",
+  mcpExposable: !1,
+  summary: "Durably install a workflow revision manifest",
+  description: "Validate and durably install a `WorkflowRevisionManifest` for a workflow the engine already has an in-process definition for. Idempotent on a byte-identical reinstall of the same (name, revision). Faults with InvalidParams when the manifest fails validation or names a workflow with no in-process definition, and Conflict when (name, revision) is already installed with different contract content. Does not check `manifest.workflowVersion` " + "against the in-process definition's own version \u2014 that mismatch is a normal " + "activation-time `incompatible` refusal, not an install-time error. Never changes which in-process handler `engine.start()` dispatches to.",
+  destructive: !1,
+  tags: ["Workflow Catalog"],
+  inputSchema: installWorkflowRevisionInput,
+  outputSchema: installWorkflowRevisionOutput,
+  access: workflowsAdminAccess,
+  producibleFaults: ["InvalidParams", "Conflict"],
+  discoverable: !0,
+  transports: { http: !0, jsonRpcHttp: !0, jsonRpcWebSocket: !0, jsonRpcStdio: !0 },
+  unknownKeyPolicy: { http: "strip", jsonRpc: "reject" },
+  invoke: async ({ input, engine }) => {
+    const e = engine, manifest = await validateManifestField(input.manifest);
+    try {
+      return await e.workflows.install(manifest);
+    } catch (error) {
+      return throwWorkflowCatalogOperationFault(error);
+    }
+  }
+}), installWorkflowRevisionRestBinding = {
+  method: "POST",
+  path: "/v1/registry/revisions",
+  pathParamNames: [],
+  operationName: "weft.workflows.revisions.install",
+  inputSources: {
+    manifest: { kind: "body-field", bodyField: "manifest" }
+  },
+  extractInput: async (request, _pathParams, context) => {
+    return { manifest: (await readWorkflowCatalogRestBody(request, context)).manifest };
+  },
+  success: { kind: "json", status: 201 }
+};

package/dist/server/operations/list-workflow-revisions.d.ts

@@ -0,0 +1,20 @@
+/**
+ * `weft.workflows.revisions.list` operation + REST binding.
+ *
+ * Lists every durably installed revision of one workflow name.
+ *
+ * @module server/operations/list-workflow-revisions
+ */
+import { z } from 'zod';
+import type { WorkflowRevisionRecord } from '../../core/catalog/index.ts';
+import type { UnknownRestBinding } from '../rest-bindings.ts';
+declare const listWorkflowRevisionsInput: z.ZodObject<{
+    name: z.ZodUnknown;
+}, z.core.$strip>;
+export type ListWorkflowRevisionsInput = z.infer<typeof listWorkflowRevisionsInput>;
+export type ListWorkflowRevisionsOutput = readonly WorkflowRevisionRecord[];
+export declare const listWorkflowRevisionsOperation: import("../operation-catalog.ts").OperationDefinition<{
+    name: unknown;
+}, ListWorkflowRevisionsOutput, unknown>;
+export declare const listWorkflowRevisionsRestBinding: UnknownRestBinding;
+export {};

package/dist/server/operations/list-workflow-revisions.js

@@ -0,0 +1,40 @@
+import { z } from "zod";
+import { defineOperation } from "../operation-registry.js";
+import {
+  validateWorkflowNameField,
+  workflowsReadAccess
+} from "./workflow-catalog-operation-helpers.js";
+const listWorkflowRevisionsInput = z.object({
+  name: z.unknown().describe("Workflow name. Runtime validation requires a wire-safe identifier.")
+}), listWorkflowRevisionsOutput = z.unknown();
+export const listWorkflowRevisionsOperation = defineOperation({
+  name: "weft.workflows.revisions.list",
+  mcpExposable: !1,
+  summary: "List every installed revision of a workflow",
+  description: "Read every durably installed revision of `name`, sorted deterministically by revision. Read-only. Returns an empty array for a name with no installed revisions, rather than a " + "NotFound fault \u2014 an empty catalog is not an error.",
+  destructive: !1,
+  tags: ["Workflow Catalog"],
+  inputSchema: listWorkflowRevisionsInput,
+  outputSchema: listWorkflowRevisionsOutput,
+  access: workflowsReadAccess,
+  producibleFaults: ["InvalidParams"],
+  discoverable: !0,
+  transports: { http: !0, jsonRpcHttp: !0, jsonRpcWebSocket: !0, jsonRpcStdio: !0 },
+  unknownKeyPolicy: { http: "strip", jsonRpc: "reject" },
+  invoke: async ({ input, engine }) => {
+    const e = engine, name = validateWorkflowNameField(input.name);
+    return e.workflows.listRevisions(name);
+  }
+}), listWorkflowRevisionsRestBinding = {
+  method: "GET",
+  path: "/v1/registry/workflows/:name/revisions",
+  pathParamNames: ["name"],
+  operationName: "weft.workflows.revisions.list",
+  inputSources: {
+    name: { kind: "path", pathParam: "name" }
+  },
+  extractInput: async (_request, pathParams) => ({
+    name: pathParams.name ?? ""
+  }),
+  success: { kind: "json", status: 200 }
+};

package/dist/server/operations/start-or-signal-workflow.js

@@ -103,7 +103,7 @@ export const startOrSignalWorkflowOperation = defineOperation({
       const { handle, outcome } = await typedEngine.startOrSignal(type, input.input, signal, options);
       return { id: handle.id, outcome };
     } catch (error) {
-      resolveStartOrSignalWorkflowFault(error);
+      return resolveStartOrSignalWorkflowFault(error);
     }
   }
 }), startOrSignalWorkflowRestBinding = {

package/dist/server/operations/start-workflow.js

@@ -77,7 +77,7 @@ export const startWorkflowOperation = defineOperation({
     try {
       return { id: (await typedEngine.start(type, input.input, options)).id };
     } catch (error) {
-      resolveStartWorkflowAccess(error);
+      return resolveStartWorkflowAccess(error);
     }
   }
 }), startWorkflowRestBinding = {

package/dist/server/operations/static-registrations.js

@@ -1,3 +1,7 @@
+import {
+  activateWorkflowRevisionOperation,
+  activateWorkflowRevisionRestBinding
+} from "./activate-workflow-revision.js";
 import { addWorkflowTagsOperation, addWorkflowTagsRestBinding } from "./add-workflow-tags.js";
 import {
   aggregateWorkflowsOperation,
@@ -30,6 +34,14 @@ import { createScheduleOperation, createScheduleRestBinding } from "./create-sch
 import { fleetEventsSseOperation, fleetEventsSseRestBinding } from "./fleet-events-sse.js";
 import { fleetEventsSubscriptionOperation } from "./fleet-events-subscription.js";
 import { forkWorkflowOperation, forkWorkflowRestBinding } from "./fork-workflow.js";
+import {
+  getActiveWorkflowRevisionOperation,
+  getActiveWorkflowRevisionRestBinding
+} from "./get-active-workflow-revision.js";
+import {
+  getCatalogDiagnosticsOperation,
+  getCatalogDiagnosticsRestBinding
+} from "./get-catalog-diagnostics.js";
 import { getCheckpointAtOperation, getCheckpointAtRestBinding } from "./get-checkpoint-at.js";
 import { getPrincipalOperation, getPrincipalRestBinding } from "./get-principal.js";
 import { getRegistryOperation, getRegistryRestBinding } from "./get-registry.js";
@@ -55,15 +67,27 @@ import {
 import { getWorkflowEventsOperation, getWorkflowEventsRestBinding } from "./get-workflow-events.js";
 import * as workflowObservability from "./get-workflow-observability.js";
 import { getWorkflowResultOperation, getWorkflowResultRestBinding } from "./get-workflow-result.js";
+import {
+  getWorkflowRevisionOperation,
+  getWorkflowRevisionRestBinding
+} from "./get-workflow-revision.js";
 import {
   getWorkflowTimelineOperation,
   getWorkflowTimelineRestBinding
 } from "./get-workflow-timeline.js";
 import { getWorkflowOperation, getWorkflowRestBinding } from "./get-workflow.js";
+import {
+  installWorkflowRevisionOperation,
+  installWorkflowRevisionRestBinding
+} from "./install-workflow-revision.js";
 import { listAlertsOperation, listAlertsRestBinding } from "./list-alerts.js";
 import { listCheckpointsOperation, listCheckpointsRestBinding } from "./list-checkpoints.js";
 import { listReviewsOperation, listReviewsRestBinding } from "./list-reviews.js";
 import { listSchedulesOperation, listSchedulesRestBinding } from "./list-schedules.js";
+import {
+  listWorkflowRevisionsOperation,
+  listWorkflowRevisionsRestBinding
+} from "./list-workflow-revisions.js";
 import { listWorkflowsOperation, listWorkflowsRestBinding } from "./list-workflows.js";
 import { pauseScheduleOperation, pauseScheduleRestBinding } from "./pause-schedule.js";
 import { purgeWorkflowsOperation, purgeWorkflowsRestBinding } from "./purge-workflows.js";
@@ -130,6 +154,7 @@ export const STATIC_REST_BINDINGS = [
   bulkRetryFailedWorkflowsRestBinding,
   bulkDeleteWorkflowsRestBinding,
   bulkMutateWorkflowTagsRestBinding,
+  getCatalogDiagnosticsRestBinding,
   getWorkflowRestBinding,
   cancelWorkflowRestBinding,
   getWorkflowResultRestBinding,
@@ -151,6 +176,11 @@ export const STATIC_REST_BINDINGS = [
   createScheduleRestBinding,
   updateScheduleRestBinding,
   getRegistryRestBinding,
+  installWorkflowRevisionRestBinding,
+  activateWorkflowRevisionRestBinding,
+  getWorkflowRevisionRestBinding,
+  listWorkflowRevisionsRestBinding,
+  getActiveWorkflowRevisionRestBinding,
   getSystemLeaseRestBinding,
   getRetentionOverviewRestBinding,
   getUpdateResultRestBinding,
@@ -194,6 +224,7 @@ export const STATIC_REST_BINDINGS = [
   bulkRetryFailedWorkflowsOperation,
   bulkDeleteWorkflowsOperation,
   bulkMutateWorkflowTagsOperation,
+  getCatalogDiagnosticsOperation,
   getWorkflowOperation,
   cancelWorkflowOperation,
   getWorkflowResultOperation,
@@ -214,6 +245,11 @@ export const STATIC_REST_BINDINGS = [
   createScheduleOperation,
   updateScheduleOperation,
   getRegistryOperation,
+  installWorkflowRevisionOperation,
+  activateWorkflowRevisionOperation,
+  getWorkflowRevisionOperation,
+  listWorkflowRevisionsOperation,
+  getActiveWorkflowRevisionOperation,
   getSystemLeaseOperation,
   getRetentionOverviewOperation,
   getUpdateResultOperation,

package/dist/server/operations/storage.js

@@ -42,14 +42,14 @@ const rawStorageAccess = {
 }), emptyOutput = z.null(), storageGetOutput = binaryValueSchema.nullable(), storageScanOutput = z.custom((value) => typeof value === "object" && value !== null && (Symbol.asyncIterator in value) && typeof value[Symbol.asyncIterator] === "function", "Storage scan output must be an async iterable."), storageConditionalBatchOutput = z.object({ applied: z.boolean() });
 function resolveAuthorizedStorage(engine, principal, operation) {
   if (!isAuthenticated(principal))
-    raiseFault(operation, {
+    return raiseFault(operation, {
       code: "Unauthorized",
       message: "authentication required",
       data: { reason: "authentication required" }
     });
   if (principal.hasScope("storage:admin"))
     return engine.storage;
-  raiseFault(operation, {
+  return raiseFault(operation, {
     code: "Forbidden",
     message: "Raw storage access requires storage:admin.",
     data: { reason: "Raw storage access requires storage:admin." }

package/dist/server/operations/submit-review-decision.js

@@ -89,7 +89,7 @@ export const submitReviewDecisionOperation = defineOperation({
       await e.submitReview(input.reviewId, reviewOptions);
       return { ok: !0 };
     } catch (error) {
-      mapReviewDecisionError(error, input.reviewId);
+      return mapReviewDecisionError(error, input.reviewId);
     }
   }
 }), submitReviewDecisionRestBinding = {

package/dist/server/operations/workflow-catalog-operation-helpers.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Shared validation and fault mapping for the five `weft.workflows.revisions.*`
+ * / `weft.workflows.active.*` operations (WFT-11): `install-workflow-revision.ts`,
+ * `activate-workflow-revision.ts`, `get-workflow-revision.ts`,
+ * `list-workflow-revisions.ts`, `get-active-workflow-revision.ts`.
+ *
+ * @module server/operations/workflow-catalog-operation-helpers
+ */
+import { type WorkflowCatalogActivationResult } from '../../core/catalog/index.ts';
+import type { WorkflowCompatibilityPolicy } from '../../core/contract/compatibility.ts';
+import type { WorkflowRevisionManifest } from '../../core/contract/types.ts';
+import type { AccessPolicy } from '../authorization.ts';
+import type { OperationFault } from '../operation-fault.ts';
+import type { RestInputContext } from '../rest-binding.ts';
+/** `workflows:admin` — required by `install` and `activate` (mutating). */
+export declare const workflowsAdminAccess: AccessPolicy;
+/** `workflows:read` — required by `get`/`list`/`active.get` (read-only). */
+export declare const workflowsReadAccess: AccessPolicy;
+/**
+ * Validate one `name` field per the wire-safe name grammar, raising the
+ * same `InvalidParams` fault both REST and JSON-RPC callers see for every
+ * other malformed identifier in this operation family. Bounded by
+ * `validateWorkflowOrActivityName` itself (`MAX_CONTRACT_IDENTIFIER_BYTES`).
+ */
+export declare function validateWorkflowNameField(name: unknown): string;
+/** Validate one `revision` field: a non-empty, bounded opaque string. */
+export declare function validateWorkflowRevisionField(revision: unknown): string;
+/** Validate an optional `expectedGeneration` field: a non-negative safe integer. */
+export declare function validateExpectedGenerationField(value: unknown): number | undefined;
+/** Validate an optional `policy` field against the one tunable compatibility axis. */
+export declare function validatePolicyField(value: unknown): WorkflowCompatibilityPolicy | undefined;
+/**
+ * Validate an untrusted `manifest` field via {@link parseWorkflowRevisionManifest} —
+ * the same hostile-input validation path (bounded sizes, recomputed
+ * `contractHash`) every other manifest consumer in this codebase uses.
+ */
+export declare function validateManifestField(value: unknown): Promise<WorkflowRevisionManifest>;
+/**
+ * Map one `applied: false` {@link WorkflowCatalogActivationResult} variant to
+ * the canonical `Conflict` fault. Exhaustive over all four refusal reasons —
+ * adding a fifth is a compile error here, forcing a deliberate wire mapping.
+ */
+export declare function activationRefusalToFault(result: Extract<WorkflowCatalogActivationResult, {
+    applied: false;
+}>): OperationFault;
+/**
+ * Map an error thrown by `engine.workflows.install()`/`activate()` to the
+ * canonical operation fault, or rethrow unchanged when it is neither typed
+ * error this family can produce (letting the operation pipeline's generic
+ * `EngineFailure` wrapping handle anything else).
+ */
+export declare function throwWorkflowCatalogOperationFault(error: unknown): never;
+/**
+ * Read a REST request body as a JSON object, raising `InvalidParams` for
+ * malformed JSON or a non-object top-level value — shared by
+ * `install-workflow-revision.ts` (body-only) and
+ * `activate-workflow-revision.ts` (path `name` plus body fields).
+ */
+export declare function readWorkflowCatalogRestBody(request: Request, context: RestInputContext): Promise<Record<string, unknown>>;

package/dist/server/operations/workflow-catalog-operation-helpers.js

@@ -0,0 +1,135 @@
+import { z } from "zod";
+import {
+  WorkflowCatalogConflictError,
+  WorkflowRevisionNotInstalledError
+} from "../../core/catalog/index.js";
+import { MAX_CONTRACT_IDENTIFIER_BYTES } from "../../core/contract/limits.js";
+import { parseWorkflowRevisionManifest } from "../../core/contract/manifest-parse.js";
+import { WorkflowNotRegisteredError } from "../../core/engine/errors.js";
+import { validateWorkflowOrActivityName } from "../../core/types/name-grammar.js";
+import { readRestJsonBody } from "../rest-body.js";
+import { invalidParamsFault, isOperationFault } from "./operation-helpers.js";
+export const workflowsAdminAccess = {
+  kind: "scoped",
+  scopes: { kind: "anyOf", scopes: ["workflows:admin"] }
+}, workflowsReadAccess = {
+  kind: "scoped",
+  scopes: { kind: "anyOf", scopes: ["workflows:read"] }
+};
+export function validateWorkflowNameField(name) {
+  if (typeof name !== "string" || name.length === 0)
+    throw invalidParamsFault('Field "name" must be a non-empty string');
+  try {
+    validateWorkflowOrActivityName(name, "workflow");
+  } catch (error) {
+    throw invalidParamsFault(error instanceof Error ? error.message : String(error));
+  }
+  return name;
+}
+export function validateWorkflowRevisionField(revision) {
+  if (typeof revision !== "string" || revision.length === 0)
+    throw invalidParamsFault('Field "revision" must be a non-empty string');
+  if (new TextEncoder().encode(revision).byteLength > MAX_CONTRACT_IDENTIFIER_BYTES)
+    throw invalidParamsFault(`Field "revision" exceeds the maximum identifier size of ${String(MAX_CONTRACT_IDENTIFIER_BYTES)} bytes`);
+  return revision;
+}
+export function validateExpectedGenerationField(value) {
+  if (value === void 0)
+    return;
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0)
+    throw invalidParamsFault('Field "expectedGeneration" must be a non-negative integer');
+  return value;
+}
+const compatibilityPolicyShape = z.object({ requireExactRevision: z.boolean().optional() }).strict();
+export function validatePolicyField(value) {
+  if (value === void 0)
+    return;
+  const parsed = compatibilityPolicyShape.safeParse(value);
+  if (!parsed.success)
+    throw invalidParamsFault('Field "policy" must be an object with an optional boolean "requireExactRevision"');
+  return parsed.data.requireExactRevision === void 0 ? {} : { requireExactRevision: parsed.data.requireExactRevision };
+}
+export async function validateManifestField(value) {
+  const result = await parseWorkflowRevisionManifest(value);
+  if (!result.ok)
+    throw manifestValidationFailureFault(result);
+  return result.manifest;
+}
+function manifestValidationFailureFault(failure) {
+  return {
+    code: "InvalidParams",
+    message: failure.message,
+    data: {
+      issues: [
+        {
+          path: failure.path === void 0 ? [] : failure.path.split("."),
+          message: failure.message,
+          code: failure.reason
+        }
+      ]
+    }
+  };
+}
+export function activationRefusalToFault(result) {
+  switch (result.reason) {
+    case "incompatible": {
+      const { verdict } = result, reasons = verdict.compatible ? [] : verdict.reasons;
+      return {
+        code: "Conflict",
+        message: `Candidate revision is incompatible with the currently active revision: ${reasons.join(", ")}`,
+        data: { reason: result.reason, compatibilityReasons: reasons }
+      };
+    }
+    case "stale-generation":
+      return {
+        code: "Conflict",
+        message: `Stale expectedGeneration: the current durable generation is ${String(result.currentGeneration)}`,
+        data: { reason: result.reason, currentGeneration: result.currentGeneration }
+      };
+    case "expected-generation-required":
+      return {
+        code: "Conflict",
+        message: "expectedGeneration is required once a workflow has an active revision \u2014 current " + `generation is ${String(result.currentGeneration)}`,
+        data: { reason: result.reason, currentGeneration: result.currentGeneration }
+      };
+    case "conflict":
+      return {
+        code: "Conflict",
+        message: "Activation lost a concurrent write race; re-read the active pointer and retry",
+        data: { reason: result.reason }
+      };
+    default:
+      throw Error(`Unknown activation refusal reason: ${JSON.stringify(result)}`);
+  }
+}
+export function throwWorkflowCatalogOperationFault(error) {
+  if (error instanceof WorkflowRevisionNotInstalledError)
+    throw {
+      code: "NotFound",
+      message: error.message,
+      data: {
+        resource: "workflow-revision",
+        identifier: `${error.workflowName}:${error.revision}`,
+        weftCode: error.code
+      }
+    };
+  if (error instanceof WorkflowNotRegisteredError)
+    throw invalidParamsFault(error.message, error.code);
+  if (error instanceof WorkflowCatalogConflictError)
+    throw {
+      code: "Conflict",
+      message: error.message,
+      data: { reason: "catalog-conflict", weftCode: error.code }
+    };
+  throw error;
+}
+export async function readWorkflowCatalogRestBody(request, context) {
+  const body = await readRestJsonBody(request, context).catch((error) => {
+    if (isOperationFault(error))
+      throw error;
+    return null;
+  });
+  if (typeof body !== "object" || body === null || Array.isArray(body))
+    throw invalidParamsFault("Request body must be a JSON object.");
+  return body;
+}

package/dist/server/runtime/websocket-upgrade.js

@@ -69,6 +69,8 @@ function upgradeScope(connectionType) {
     case "generic":
     case void 0:
       return null;
+    default:
+      throw Error(`Unknown WebSocket connection type: ${JSON.stringify(connectionType)}`);
   }
 }
 export function handleWebSocketUpgrade(server, context, options, request, url, authContext) {

package/dist/storage/bun-sql.js

@@ -9,6 +9,21 @@ function requireStorageCapability(storage, capability, featureName) {
   }
 }
 
+// src/storage/key-encoding.ts
+function encodeStorageKeyComponent(value) {
+  return encodeURIComponent(value);
+}
+function formatSortableStorageTimestamp(timestamp) {
+  return String(timestamp).padStart(16, "0");
+}
+
+// src/storage/catalog-keys.ts
+var WORKFLOW_CATALOG_KEYS = {
+  catalogEntry: (name, revision) => `catalog-entry:${encodeStorageKeyComponent(name)}:${encodeStorageKeyComponent(revision)}`,
+  catalogEntryPrefix: (name) => `catalog-entry:${encodeStorageKeyComponent(name)}:`,
+  catalogActive: (name) => `catalog-active:${encodeStorageKeyComponent(name)}`
+};
+
 // src/storage/default-scope.ts
 var DEFAULT_SCOPE = "default";
 
@@ -23,7 +38,7 @@ async function* storageKeysCore(storage, prefix, options) {
 }
 async function storageCountCore(storage, prefix) {
   let count = 0;
-  for await (const _key of storageKeysCore(storage, prefix)) {
+  for await (const _ of storageKeysCore(storage, prefix)) {
     count++;
   }
   return count;
@@ -51,10 +66,35 @@ async function storageDeleteRangeCore(storage, prefix, options) {
   return operations.length;
 }
 
-// src/storage/key-encoding.ts
-function encodeStorageKeyComponent(value) {
-  return encodeURIComponent(value);
-}
+// src/storage/mailbox-keys.ts
+var MAILBOX_KEYS = {
+  applicationMailbox: (namespace, resourceId) => `appmbx:v1:${encodeStorageKeyComponent(namespace)}:${encodeStorageKeyComponent(resourceId)}`,
+  applicationMailboxSinkProbe: (namespace, resourceId, nonce) => `appprobe:v1:${encodeStorageKeyComponent(namespace)}:${encodeStorageKeyComponent(resourceId)}:${encodeStorageKeyComponent(nonce)}`,
+  applicationCommandPrefix: (namespace, resourceId) => `appcmd:v1:${encodeStorageKeyComponent(namespace)}:${encodeStorageKeyComponent(resourceId)}:`,
+  applicationCommand: (namespace, resourceId, commandId) => `appcmd:v1:${encodeStorageKeyComponent(namespace)}:${encodeStorageKeyComponent(resourceId)}:${encodeStorageKeyComponent(commandId)}`,
+  applicationCommandReadyPrefix: (namespace, resourceId) => `appready:v1:${encodeStorageKeyComponent(namespace)}:${encodeStorageKeyComponent(resourceId)}:`,
+  applicationCommandReady: (namespace, resourceId, sequence) => `appready:v1:${encodeStorageKeyComponent(namespace)}:${encodeStorageKeyComponent(resourceId)}:${formatSortableStorageTimestamp(sequence)}`,
+  applicationCommandIdempotency: (namespace, resourceId, key) => `appidem:v1:${encodeStorageKeyComponent(namespace)}:${encodeStorageKeyComponent(resourceId)}:${encodeStorageKeyComponent(key)}`,
+  applicationCommandBySequencePrefix: (namespace, resourceId) => `appseq:v1:${encodeStorageKeyComponent(namespace)}:${encodeStorageKeyComponent(resourceId)}:`,
+  applicationCommandBySequence: (namespace, resourceId, sequence) => `appseq:v1:${encodeStorageKeyComponent(namespace)}:${encodeStorageKeyComponent(resourceId)}:${formatSortableStorageTimestamp(sequence)}`,
+  applicationCommandTerminalPrefix: (namespace, resourceId) => `appterm:v1:${encodeStorageKeyComponent(namespace)}:${encodeStorageKeyComponent(resourceId)}:`,
+  applicationCommandTerminal: (namespace, resourceId, terminalAt, commandId) => `appterm:v1:${encodeStorageKeyComponent(namespace)}:${encodeStorageKeyComponent(resourceId)}:${formatSortableStorageTimestamp(terminalAt)}:${encodeStorageKeyComponent(commandId)}`
+};
+
+// src/storage/outbox-keys.ts
+var OUTBOX_KEYS = {
+  applicationOutbox: (namespace, ownerId) => `appobx:v1:${encodeStorageKeyComponent(namespace)}:${encodeStorageKeyComponent(ownerId)}`,
+  applicationOutboxSinkProbe: (namespace, ownerId, nonce) => `appprobe:v1:outbox:${encodeStorageKeyComponent(namespace)}:${encodeStorageKeyComponent(ownerId)}:${encodeStorageKeyComponent(nonce)}`,
+  applicationDeliveryPrefix: (namespace, ownerId) => `appdlv:v1:${encodeStorageKeyComponent(namespace)}:${encodeStorageKeyComponent(ownerId)}:`,
+  applicationDelivery: (namespace, ownerId, deliveryId) => `appdlv:v1:${encodeStorageKeyComponent(namespace)}:${encodeStorageKeyComponent(ownerId)}:${encodeStorageKeyComponent(deliveryId)}`,
+  applicationDeliveryDuePrefix: (namespace, ownerId) => `appdue:v1:${encodeStorageKeyComponent(namespace)}:${encodeStorageKeyComponent(ownerId)}:`,
+  applicationDeliveryDue: (namespace, ownerId, availableAt, deliveryId) => `appdue:v1:${encodeStorageKeyComponent(namespace)}:${encodeStorageKeyComponent(ownerId)}:${formatSortableStorageTimestamp(availableAt)}:${encodeStorageKeyComponent(deliveryId)}`,
+  applicationDeliveryIdempotency: (namespace, ownerId, key) => `appdidem:v1:${encodeStorageKeyComponent(namespace)}:${encodeStorageKeyComponent(ownerId)}:${encodeStorageKeyComponent(key)}`,
+  applicationDeliveryBySequencePrefix: (namespace, ownerId) => `appdseq:v1:${encodeStorageKeyComponent(namespace)}:${encodeStorageKeyComponent(ownerId)}:`,
+  applicationDeliveryBySequence: (namespace, ownerId, sequence) => `appdseq:v1:${encodeStorageKeyComponent(namespace)}:${encodeStorageKeyComponent(ownerId)}:${formatSortableStorageTimestamp(sequence)}`,
+  applicationDeliveryTerminalPrefix: (namespace, ownerId) => `appdterm:v1:${encodeStorageKeyComponent(namespace)}:${encodeStorageKeyComponent(ownerId)}:`,
+  applicationDeliveryTerminal: (namespace, ownerId, terminalAt, deliveryId) => `appdterm:v1:${encodeStorageKeyComponent(namespace)}:${encodeStorageKeyComponent(ownerId)}:${formatSortableStorageTimestamp(terminalAt)}:${encodeStorageKeyComponent(deliveryId)}`
+};
 
 // src/storage/ownership-keys.ts
 var OWNERSHIP_CLAIM_KEYS = {
@@ -132,7 +172,7 @@ async function storageConditionalBatch(storage, conditions, operations) {
   }
   return storage.conditionalBatch(conditions, operations);
 }
-var formatSortableTimestamp = (timestamp) => String(timestamp).padStart(16, "0");
+var formatSortableTimestamp = formatSortableStorageTimestamp;
 var SIGNAL_SORT_CLASS_START = "0";
 var SIGNAL_SORT_CLASS_NORMAL = "1";
 var signalStorageKey = (workflowId, name, id, sortClass) => `sig:${encodeStorageKeyComponent(workflowId)}:${encodeStorageKeyComponent(name)}:${sortClass}:${encodeStorageKeyComponent(id)}`;
@@ -195,7 +235,10 @@ var KEYS = {
   leasePrefix: () => "lease:",
   leaseEpoch: () => "lease:epoch",
   leaseHolder: () => "lease:holder",
+  ...MAILBOX_KEYS,
+  ...OUTBOX_KEYS,
   ...OWNERSHIP_CLAIM_KEYS,
+  ...WORKFLOW_CATALOG_KEYS,
   budget: (namespace, period, date) => `budget:${namespace}:${period}:${date}`,
   review: (workflowId, reviewId) => `review:${encodeStorageKeyComponent(workflowId)}:${reviewId}`,
   workflowHeaders: (workflowId) => `wf-headers:${encodeStorageKeyComponent(workflowId)}`,

package/dist/storage/catalog-keys.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Storage key builders for the durable workflow catalog (WFT-9/WFT-10).
+ *
+ * Spread into `KEYS` in `interface.ts` rather than declared there, mirroring
+ * `ownership-keys.ts`'s pattern — the catalog keyspace can carry its full
+ * rationale without pushing `interface.ts` past its documented line ceiling.
+ * Callers reach these through `KEYS`, which keeps one import contract for
+ * storage keys.
+ *
+ * `catalog-entry:<name>:<revision>` is one immutable record per installed
+ * `(name, revision)` pair, never overwritten once written. `catalog-active:<name>`
+ * is the single mutable `{ revision, generation, activatedAt }` pointer per
+ * workflow name, written only through `conditionalBatch` CAS — the exact
+ * store-wide-singleton precedent `ownership-mode-marker.ts` establishes for
+ * `KEYS.ownershipModeMarker()`.
+ *
+ * @module storage/catalog-keys
+ */
+/**
+ * Workflow catalog key builders. Spread into `KEYS`; not intended to be
+ * imported directly by engine code.
+ */
+export declare const WORKFLOW_CATALOG_KEYS: {
+    /**
+     * One immutable installed-revision record for `name`. The initial write
+     * IS `conditionalBatch` CAS-guarded ({@link import('../core/catalog/storage-io.ts').writeCatalogEntry}),
+     * not a plain `put` — a caller-supplied, non-content-derived `revision`
+     * (`buildWorkflowRevisionManifest`'s `options.revision` escape hatch)
+     * means two racing writers are not guaranteed to agree on this key's
+     * content, so the write must fail closed on a genuine conflict rather than
+     * last-write-win. This key is also deleted, CAS-guarded on its own exact
+     * bytes, by `removeCatalogEntry` (WFT-12) once a revision is no longer
+     * active and no longer referenced.
+     */
+    readonly catalogEntry: (name: string, revision: string) => string;
+    /** Scan prefix for every installed revision of `name`. */
+    readonly catalogEntryPrefix: (name: string) => string;
+    /**
+     * The active-revision pointer for `name`: a single mutable
+     * `{ revision, generation, activatedAt }` record, written only through
+     * `conditionalBatch` — the same CAS/store-wide-singleton precedent
+     * `KEYS.ownershipModeMarker()` uses.
+     */
+    readonly catalogActive: (name: string) => string;
+};

package/dist/storage/catalog-keys.js

@@ -0,0 +1,6 @@
+import { encodeStorageKeyComponent } from "./key-encoding.js";
+export const WORKFLOW_CATALOG_KEYS = {
+  catalogEntry: (name, revision) => `catalog-entry:${encodeStorageKeyComponent(name)}:${encodeStorageKeyComponent(revision)}`,
+  catalogEntryPrefix: (name) => `catalog-entry:${encodeStorageKeyComponent(name)}:`,
+  catalogActive: (name) => `catalog-active:${encodeStorageKeyComponent(name)}`
+};