@lostgradient/weft 0.24.0 → 0.24.2

package/dist/core/engine/storage-io.js

@@ -1,5 +1,6 @@
 import {
-  KEYS
+  KEYS,
+  storageValuesEqual
 } from "../../storage/interface.js";
 import { encode } from "../codec.js";
 import { buildTimerBatchOperations } from "../scheduler.js";
@@ -8,7 +9,10 @@ import {
   clearPendingAtomicWorkflowCommitSideEffects,
   takePendingAtomicWorkflowCommitSideEffects
 } from "./checkpoint-side-effects.js";
-import { commitFencedEngineWrite } from "./fenced-write.js";
+import {
+  commitFencedEngineWrite,
+  commitFencedEngineWriteAllowingPreconditionFailure
+} from "./fenced-write.js";
 import { getWorkflowExecutionStartedAt } from "./handles.js";
 import { resolveEffectiveScheduleFireAt } from "./schedule-jitter.js";
 import { createScheduleTimerId, decodeWorkflowStartHeaders } from "./state-utilities.js";
@@ -150,8 +154,23 @@ export async function writeScheduleState(internals, state, options) {
   ], includeTimer = options?.includeTimer ?? state.status === "active";
   operations.push(...buildScheduleTimerReplacementOperations(state, includeTimer, options?.replaceTimerFrom));
   operations.push(...options?.additionalOperations ?? []);
+  const extraConditions = options?.extraConditions ?? [];
+  if (extraConditions.length > 0) {
+    await commitScheduleStateWithExtraConditions(internals, state, operations, extraConditions, options?.onExtraConditionsLost);
+    return;
+  }
   await commitFencedEngineWrite(internals, null, operations, [], () => Error(`Schedule state commit for schedule "${state.id}" lost its precondition.`));
 }
+async function commitScheduleStateWithExtraConditions(internals, state, operations, extraConditions, onExtraConditionsLost) {
+  if (await commitFencedEngineWriteAllowingPreconditionFailure(internals, null, operations, extraConditions))
+    return;
+  for (const condition of extraConditions) {
+    const currentValue = await internals.storage.get(condition.key);
+    if (!storageValuesEqual(currentValue, condition.expectedValue))
+      throw onExtraConditionsLost?.() ?? Error(`Schedule state commit for schedule "${state.id}" lost its precondition.`);
+  }
+  throw Error(`Schedule state commit for schedule "${state.id}" lost its precondition.`);
+}
 export async function loadWorkflowStartHeaders(internals, workflowId) {
   const bytes = await internals.storage.get(KEYS.workflowHeaders(workflowId));
   if (!bytes)

package/dist/core/engine/termination/complete.js

@@ -177,7 +177,7 @@ async function releaseWorkflowClaimAfterTerminalSettlement(internals, workflowId
   if (registry.currentEpoch(workflowId) !== capturedEpoch)
     return;
   try {
-    await registry.release(workflowId);
+    await registry.release(workflowId, capturedEpoch);
   } catch {}
 }
 export async function completeWorkflow(internals, workflowId, result, callbacks) {

package/dist/core/engine/termination/finalizer-registration.d.ts

@@ -0,0 +1,18 @@
+import type { EngineInternals } from '../internals.ts';
+import type { RunnableFinalizer } from './finalizer-activity.ts';
+/**
+ * Resolve `type`'s `finalizer` against the workflow instance's own EXACT
+ * pinned `revision` (WFT-17/WFT-19), awaiting a full dynamic-source resolve
+ * when it is `registerSource()`-registered but unresolved on this process —
+ * {@link getResolvedDynamicRegistration}'s sync-only lookup cannot close
+ * that gap. Without this, a type never started/resumed/recovered here after
+ * a fresh restart (only torn down) rearms its `wf-teardown:` timer forever,
+ * since nothing else triggers the resolve `lastResolvedRevisionByName`
+ * needs. Returns `undefined` (rearm) when `type` has no registration at
+ * all, when the pinned revision cannot be resolved on this process
+ * ({@link WorkflowRevisionUnavailableError}), or when the resolve itself
+ * fails ({@link DynamicWorkflowSourceUnavailableError}) — a load failure
+ * here doesn't fail the (already terminal) workflow, it just defers to the
+ * next self-heal attempt.
+ */
+export declare function resolveFinalizerRegistration(internals: EngineInternals, type: string, revision: string | undefined): Promise<RunnableFinalizer | undefined>;

package/dist/core/engine/termination/finalizer-registration.js

@@ -0,0 +1,21 @@
+import { DynamicWorkflowSourceUnavailableError } from "../dynamic-source-errors.js";
+import {
+  getResolvedDynamicRegistration,
+  resolveExecutableRegistrationForRevision
+} from "../dynamic-source-execution.js";
+import { WorkflowRevisionUnavailableError } from "../revision-errors.js";
+export async function resolveFinalizerRegistration(internals, type, revision) {
+  const eagerOrAlreadyResolved = getResolvedDynamicRegistration(internals, type, revision)?.finalizer;
+  if (eagerOrAlreadyResolved !== void 0)
+    return eagerOrAlreadyResolved;
+  if (!internals.sources.byName.has(type))
+    return;
+  try {
+    const { entry } = await resolveExecutableRegistrationForRevision(internals.engine, internals, type, revision);
+    return entry.finalizer;
+  } catch (error) {
+    if (error instanceof DynamicWorkflowSourceUnavailableError || error instanceof WorkflowRevisionUnavailableError)
+      return;
+    throw error;
+  }
+}

package/dist/core/engine/termination/finalizer.d.ts

@@ -3,29 +3,26 @@
  * Dispatched by the scheduler when a `wf-teardown:` timer fires, it drives a
  * workflow's definition-level `finalizer` to durable completion after a
  * `cancelled`/`timed-out` terminal — claiming the durable teardown marker, running
- * the finalizer activity (via {@link runFinalizerActivity}), and then clearing,
- * backing off, or dead-lettering based on the outcome. The byte-level claim mechanics
- * (CAS, settle, re-arm, dead-letter, the stale horizon and backoff) live in
- * `./finalizer-claim.ts`; this module is the orchestration that decides which to call.
+ * the finalizer activity (via {@link runFinalizerActivity}), and then clearing, backing
+ * off, or dead-lettering based on the outcome. The byte-level claim mechanics (CAS,
+ * settle, re-arm, dead-letter, stale horizon, backoff) live in `./finalizer-claim.ts`;
+ * this module is the orchestration that decides which to call.
  *
- * Concurrency model — a single durable, TIME-based claim:
- * the durable `teardownOwed` marker carries a `{ status, attempts, token, claimedAt }`
- * claim ({@link TeardownClaim}). A holder fenced-CAS's `owed → running` (stamping
- * `claimedAt`) before running, and settle-CAS's the exact `running` bytes it wrote when
- * clearing or rescheduling — so a concurrent reclaimer can never clobber a fresher
- * claim. Liveness is decided purely by the clock: a `running` claim is reclaimable once
- * `claimedAt` is older than {@link teardownStaleThresholdMs} (the finalizer's per-attempt
- * timeout plus a margin). There is NO in-memory liveness set and NO epoch in the record;
- * crash recovery is an ordinary stale-claim retry driven by the timer that survived the
- * terminal batch. The tradeoff is that a finalizer running past the stale threshold may
- * be re-driven concurrently, which is why workflow finalizers must be idempotent (a
- * contract of the #446 design).
+ * Concurrency model — a single durable, TIME-based claim: the durable `teardownOwed`
+ * marker carries a `{ status, attempts, token, claimedAt }` claim ({@link TeardownClaim}).
+ * A holder fenced-CAS's `owed → running` (stamping `claimedAt`) before running, and
+ * settle-CAS's the exact `running` bytes it wrote when clearing or rescheduling — so a
+ * concurrent reclaimer can never clobber a fresher claim. Liveness is decided purely by
+ * the clock: a `running` claim is reclaimable once `claimedAt` is older than
+ * {@link teardownStaleThresholdMs}. There is NO in-memory liveness set and NO epoch in
+ * the record; crash recovery is an ordinary stale-claim retry driven by the timer that
+ * survived the terminal batch — the tradeoff is a finalizer running past the stale
+ * threshold may be re-driven concurrently, which is why finalizers must be idempotent.
  *
  * Self-heal invariant: every exit that does NOT settle the claim (a lost claim CAS, a
  * presumed-live `running` claim, a shutdown-aborted attempt, or a missing registration)
- * re-arms a future `wf-teardown:` timer before returning, because the scheduler deletes
- * the fired timer once this returns without throwing. A non-settling exit that forgot to
- * re-arm would strand the marker with no timer to re-drive it.
+ * re-arms a future `wf-teardown:` timer before returning — the scheduler deletes the fired
+ * timer on return, so a non-settling exit that forgot to re-arm strands the marker.
  *
  * @module core/engine/termination/finalizer
  */

package/dist/core/engine/termination/finalizer.js

@@ -18,6 +18,7 @@ import {
   teardownStaleThresholdMs,
   teardownTimerOperations
 } from "./finalizer-claim.js";
+import { resolveFinalizerRegistration } from "./finalizer-registration.js";
 export { teardownStaleThresholdMs } from "./finalizer-claim.js";
 const TERMINAL_STATUSES_OWED_TEARDOWN = new Set([
   "cancelled",
@@ -53,10 +54,9 @@ async function resolveTeardownDrive(internals, workflowId, token, callbacks) {
   const state = await callbacks.loadWorkflowState(workflowId);
   if (state === null || !TERMINAL_STATUSES_OWED_TEARDOWN.has(state.status))
     return clearOrRearm(internals, workflowId, token, markerBytes);
-  const registeredFinalizer = internals.registrations.get(state.type)?.finalizer;
-  if (registeredFinalizer === void 0)
+  const finalizer = await resolveFinalizerRegistration(internals, state.type, state.revision);
+  if (finalizer === void 0)
     return { kind: "rearm", token };
-  const finalizer = registeredFinalizer;
   if (!runningClaimIsStale(internals, claim, finalizer))
     return { kind: "rearm", token };
   const finalizerStateBytes = await internals.storage.get(KEYS.finalizerState(workflowId));

package/dist/core/engine/termination/suspend.js

@@ -6,6 +6,7 @@ import { dropQueuedInlineWorkflowStart } from "../inline-launch-queue.js";
 import { buildWorkflowVisibilityIndexTransition } from "../workflow-indexes.js";
 import { evictSuspendedWorkflowWaiters } from "./cleanup.js";
 export async function suspendWorkflow(internals, workflowId, callbacks) {
+  const capturedClaimEpochForForget = internals.workflowClaimRegistry?.currentEpoch(workflowId) ?? null;
   if (!await callbacks.runSerializedWorkflowStateWrite(workflowId, async () => {
     const state = await callbacks.loadWorkflowState(workflowId);
     if (!state || state.status !== "running")
@@ -26,6 +27,8 @@ export async function suspendWorkflow(internals, workflowId, callbacks) {
     return !0;
   }))
     return;
+  if (internals.workflowClaimRegistry !== null && capturedClaimEpochForForget !== null && internals.workflowClaimRegistry.currentEpoch(workflowId) === capturedClaimEpochForForget)
+    internals.workflowClaimRegistry.forgetLocalClaim(workflowId);
   const event = new WorkflowSuspendedEvent(workflowId);
   callbacks.dispatchEvent(event);
   callbacks.forwardEventToHandle(workflowId, event);

package/dist/core/engine/time-operation-callbacks.d.ts

@@ -0,0 +1,32 @@
+/**
+ * {@link TimeOperationCallbacks} — the callback bundle `operations-time.ts`'s
+ * timer-fire handlers (delayed start, sleep, deadline, schedule) take. Split
+ * out of that file, which has no headroom under the repository's 500-line
+ * implementation-file ceiling for this type inline.
+ *
+ * @module core/engine/time-operation-callbacks
+ */
+import type { Checkpoint, Duration, TimerEntry, WorkflowState } from '../types.ts';
+import type { WorkflowVersionTuple } from '../workflow-version-tuple.ts';
+import type { ExecutableRegistration } from './dynamic-source-execution.ts';
+type RegistrationEntry = ExecutableRegistration['entry'];
+export type TimeOperationCallbacks = {
+    completeOperation: (workflowId: string, value: unknown) => void;
+    dispatchEvent: (event: Event) => void;
+    loadWorkflowState: (workflowId: string) => Promise<WorkflowState | null>;
+    failWorkflow: (workflowId: string, error: Error) => Promise<void>;
+    runSerializedWorkflowStateWrite: <Result>(workflowId: string, writeOperation: () => Promise<Result>) => Promise<Result>;
+    beginWorkflowExecution: (workflowId: string, workflowExecutionToken: string | undefined, workflowType: string, revision: string | undefined, input: unknown, checkpoint: Checkpoint, executionDeadline: number | undefined, executionStateOwnerId: string, registration: RegistrationEntry) => void;
+    workflowVersionTupleFromState: (state: WorkflowState) => WorkflowVersionTuple;
+    setWorkflowStartHeaders: (workflowId: string, headers: Map<string, string> | undefined) => void;
+    loadWorkflowStartHeaders: (workflowId: string) => Promise<Map<string, string> | undefined>;
+    parseStartOptionDuration: (value: Duration, fieldName: 'options.executionTimeout' | 'options.startAfter') => number;
+    runDeferredTerminalCleanup: (workflowId: string, timerId: string) => Promise<void>;
+    runWorkflowFinalizer: (workflowId: string, timerId: string) => Promise<void>;
+    handleScheduleTimer: (entry: TimerEntry) => Promise<void>;
+    timeout: (workflowId: string) => Promise<void>;
+    handleCleanupError: (source: string, error: unknown, workflowId: string) => void;
+    /** Resolve `type` against an EXACT pinned `WorkflowState.revision` (WFT-17, `undefined` for a legacy record) — never the catalog's active pointer. Used by a delayed-start fire, matching `resumeWorkflowFromStorage()`. */
+    resolveExecutableRegistrationForRevision: (type: string, revision: string | undefined) => Promise<ExecutableRegistration>;
+};
+export {};

package/dist/core/engine/validation/schedule-cadence.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Decode a persisted schedule record's cadence fields (`cronExpression` XOR
+ * `intervalMs`). Split out of `schedule.ts` purely to stay under this
+ * repository's 500-line-per-file ceiling (the same precedent
+ * `lifecycle/start.ts`/`decode-revision.ts` set for WFT-17/18) — there is no
+ * behavioral reason to import this module directly instead of `schedule.ts`,
+ * which re-exports nothing from here because `decodeScheduleCadence` is
+ * consumed only by `decodeScheduleIdentityFields` in that file.
+ *
+ * @module core/engine/validation/schedule-cadence
+ */
+/** Decode the cadence fields (`cronExpression` XOR `intervalMs`) of a persisted schedule record, or `null` (and warn) on a malformed record. */
+export declare function decodeScheduleCadence(decoded: Record<string, unknown>, scheduleId: string): {
+    cronExpression?: string;
+    intervalMs?: number;
+} | null;

package/dist/core/engine/validation/schedule-cadence.js

@@ -0,0 +1,20 @@
+import { parseCronExpression } from "../../schedule.js";
+import { rejectInvalidScheduleRecord } from "./schedule-warnings.js";
+export function decodeScheduleCadence(decoded, scheduleId) {
+  const { cronExpression, intervalMs } = decoded, hasCron = cronExpression !== void 0, hasInterval = intervalMs !== void 0;
+  if (hasCron === hasInterval)
+    return rejectInvalidScheduleRecord(scheduleId, "with conflicting or missing cadence (expected exactly one of cronExpression or intervalMs)");
+  if (hasInterval) {
+    if (typeof intervalMs !== "number" || !Number.isSafeInteger(intervalMs) || intervalMs <= 0)
+      return rejectInvalidScheduleRecord(scheduleId, "with invalid intervalMs");
+    return { intervalMs };
+  }
+  if (typeof cronExpression !== "string")
+    return rejectInvalidScheduleRecord(scheduleId, "with invalid cronExpression");
+  try {
+    parseCronExpression(cronExpression);
+  } catch {
+    return rejectInvalidScheduleRecord(scheduleId, "with invalid cronExpression");
+  }
+  return { cronExpression };
+}

package/dist/core/engine/validation/schedule-options.d.ts

@@ -1,15 +1,18 @@
-import type { ScheduleOptions, ScheduleOverlapPolicy, ScheduleUpdateOptions } from '../../types.ts';
+import type { ScheduleOptions, ScheduleOverlapPolicy, ScheduleRevisionPolicy, ScheduleUpdateOptions } from '../../types.ts';
 export declare const SCHEDULE_OVERLAP_POLICIES: Set<ScheduleOverlapPolicy>;
+export declare const SCHEDULE_REVISION_POLICIES: Set<ScheduleRevisionPolicy>;
 type NormalizedScheduleOptions = Required<Pick<ScheduleOptions, 'overlap' | 'backfill'>> & {
     id?: string;
     description?: string;
     jitterMs?: number;
+    revisionPolicy?: ScheduleRevisionPolicy;
 };
 type NormalizedScheduleUpdateOptions = {
     description?: string;
     overlap?: ScheduleOverlapPolicy;
     backfill?: boolean;
     jitterMs?: number;
+    revisionPolicy?: ScheduleRevisionPolicy;
 };
 export declare function normalizeScheduleOptions(options: ScheduleOptions | undefined): NormalizedScheduleOptions;
 export declare function normalizeScheduleUpdateOptions(options: ScheduleUpdateOptions | undefined): NormalizedScheduleUpdateOptions;

package/dist/core/engine/validation/schedule-options.js

@@ -5,6 +5,9 @@ export const SCHEDULE_OVERLAP_POLICIES = new Set([
   "queue",
   "cancel-running",
   "allow"
+]), SCHEDULE_REVISION_POLICIES = new Set([
+  "active-at-fire",
+  "pinned"
 ]);
 export function normalizeScheduleOptions(options) {
   if (options === void 0)
@@ -20,6 +23,9 @@ export function normalizeScheduleOptions(options) {
     },
     ...options.jitter !== void 0 && {
       jitterMs: normalizeScheduleJitter(options.jitter, "options.jitter")
+    },
+    ...options.revisionPolicy !== void 0 && {
+      revisionPolicy: normalizeScheduleRevisionPolicy(options.revisionPolicy, "options.revisionPolicy")
     }
   };
 }
@@ -38,9 +44,17 @@ export function normalizeScheduleUpdateOptions(options) {
     },
     ...options.jitter !== void 0 && {
       jitterMs: normalizeScheduleJitter(options.jitter, "options.jitter")
+    },
+    ...options.revisionPolicy !== void 0 && {
+      revisionPolicy: normalizeScheduleRevisionPolicy(options.revisionPolicy, "options.revisionPolicy")
     }
   };
 }
+function normalizeScheduleRevisionPolicy(value, fieldName) {
+  if (!SCHEDULE_REVISION_POLICIES.has(value))
+    throw Error(`${fieldName} must be one of ${[...SCHEDULE_REVISION_POLICIES].join(", ")}`);
+  return value;
+}
 function normalizeScheduleDescription(description) {
   if (typeof description !== "string")
     throw Error("options.description must be a string when provided");

package/dist/core/engine/validation/schedule-revision.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Decode a persisted schedule record's revision-policy fields
+ * (`revisionPolicy` / `pinnedRevision`, WFT-20). Split out of `schedule.ts`
+ * purely to stay under this repository's 500-line-per-file ceiling — see
+ * that file's own precedent (`lifecycle/start.ts`/`decode-revision.ts` for
+ * WFT-17/18) — there is no behavioral reason to import this module directly
+ * instead of `schedule.ts`, which composes it into `decodeScheduleState`.
+ *
+ * @module core/engine/validation/schedule-revision
+ */
+import type { ScheduleState } from '../../types.ts';
+type ScheduleRevisionFields = Pick<ScheduleState, 'revisionPolicy' | 'pinnedRevision'>;
+/**
+ * Decode `revisionPolicy`/`pinnedRevision` from a persisted schedule record.
+ * A record with NO `revisionPolicy` field predates WFT-20 and decodes as
+ * `'active-at-fire'` — the same "absent means legacy, not corrupt" treatment
+ * `WorkflowState.revision` got (WFT-17/18) — never rejected as malformed. An
+ * explicit but unrecognized `revisionPolicy` string, or a `pinnedRevision`
+ * present while `revisionPolicy !== 'pinned'` (or absent while it IS
+ * `'pinned'`), both reject the whole record via
+ * {@link rejectInvalidScheduleRecord} rather than silently coercing.
+ */
+export declare function decodeScheduleRevisionPolicyFields(decoded: Record<string, unknown>, scheduleId: string): ScheduleRevisionFields | null;
+export {};

package/dist/core/engine/validation/schedule-revision.js

@@ -0,0 +1,21 @@
+import { SCHEDULE_REVISION_POLICIES } from "./schedule-options.js";
+import { rejectInvalidScheduleRecord } from "./schedule-warnings.js";
+export function decodeScheduleRevisionPolicyFields(decoded, scheduleId) {
+  const rawRevisionPolicy = decoded.revisionPolicy;
+  if (rawRevisionPolicy === void 0) {
+    if (decoded.pinnedRevision !== void 0)
+      return rejectInvalidScheduleRecord(scheduleId, "with a pinnedRevision but no revisionPolicy");
+    return { revisionPolicy: "active-at-fire" };
+  }
+  if (!SCHEDULE_REVISION_POLICIES.has(rawRevisionPolicy))
+    return rejectInvalidScheduleRecord(scheduleId, "with invalid revisionPolicy");
+  const revisionPolicy = rawRevisionPolicy, pinnedRevision = decoded.pinnedRevision, hasPinnedRevision = pinnedRevision !== void 0;
+  if (revisionPolicy === "pinned") {
+    if (!hasPinnedRevision || typeof pinnedRevision !== "string" || pinnedRevision.length === 0)
+      return rejectInvalidScheduleRecord(scheduleId, 'with revisionPolicy "pinned" but a missing or invalid pinnedRevision');
+    return { revisionPolicy, pinnedRevision };
+  }
+  if (hasPinnedRevision)
+    return rejectInvalidScheduleRecord(scheduleId, 'with a pinnedRevision but revisionPolicy is not "pinned"');
+  return { revisionPolicy };
+}

package/dist/core/engine/validation/schedule-warnings.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The shared "ignore this malformed persisted schedule record" warning
+ * helper, split into its own leaf module so both `schedule.ts` and its
+ * decode helpers (`schedule-cadence.ts`, `schedule-revision.ts`) can import
+ * it without an import cycle — `schedule.ts` re-exports it so every existing
+ * caller keeps importing it from there.
+ *
+ * @module core/engine/validation/schedule-warnings
+ */
+/** Warn and return `null` for a persisted schedule record that failed decode validation. */
+export declare function rejectInvalidScheduleRecord(scheduleId: string | undefined, message: string): null;

package/dist/core/engine/validation/schedule-warnings.js

@@ -0,0 +1,5 @@
+export function rejectInvalidScheduleRecord(scheduleId, message) {
+  const prefix = scheduleId === void 0 ? "[weft] Ignoring malformed schedule record" : `[weft] Ignoring malformed schedule "${scheduleId}"`;
+  console.warn(`${prefix} ${message}.`);
+  return null;
+}

package/dist/core/engine/validation/schedule.d.ts

@@ -1,11 +1,37 @@
-import type { ScheduleFilter, ScheduleOverlapPolicy, ScheduleSpec, ScheduleState, ScheduleStatus } from '../../types.ts';
-export { normalizeScheduleOptions, normalizeScheduleUpdateOptions, SCHEDULE_OVERLAP_POLICIES, } from './schedule-options.ts';
+import type { ScheduleFilter, ScheduleOverlapPolicy, ScheduleRevisionPolicy, ScheduleSpec, ScheduleState, ScheduleStatus } from '../../types.ts';
+export { normalizeScheduleOptions, normalizeScheduleUpdateOptions, SCHEDULE_OVERLAP_POLICIES, SCHEDULE_REVISION_POLICIES, } from './schedule-options.ts';
+export { rejectInvalidScheduleRecord } from './schedule-warnings.ts';
 export declare const SCHEDULE_STATUSES: Set<ScheduleStatus>;
 export declare function isValidScheduleTimestamp(value: unknown): value is number;
 export declare function isValidScheduleStatus(value: unknown): value is ScheduleStatus;
 export declare function isValidScheduleOverlapPolicy(value: unknown): value is ScheduleOverlapPolicy;
+export declare function isValidScheduleRevisionPolicy(value: unknown): value is ScheduleRevisionPolicy;
+/**
+ * Whether `value` is a schedule-related workflow id that decoded persisted
+ * data may still carry. Deliberately reuses the pre-WFT-95 decode predicate
+ * (not the fresh-admission `.`/`..` rejection), because every caller of this
+ * function — `decodeScheduleIdentityFields`, `decodeScheduleRunMetadata`,
+ * and the persisted `currentWorkflowId`/`queuedRuns[].workflowId` fields in
+ * this module — reads already-persisted data. A schedule created before
+ * WFT-95 with `id: '.'` or `'..'` must remain decodable and keep firing
+ * after upgrade.
+ */
 export declare function isValidScheduleIdentifier(value: unknown): value is string;
-export declare function coerceScheduleId(scheduleId: string, fieldName: string): string;
+/**
+ * Coerce a caller-supplied `scheduleId` used to look up or control an
+ * already-persisted schedule — `getSchedule`, `pauseSchedule`,
+ * `resumeSchedule`, `cancelSchedule`, and `updateSchedule` all call this,
+ * never schedule creation (that admission path is
+ * `normalizeScheduleOptions`'s direct `coerceStartWorkflowId(options.id, …)`
+ * call, which keeps the strict `.`/`..` rejection). Deliberately uses the
+ * decode-compatible `assertDecodableWorkflowId`, not the admission-only
+ * `.`/`..` rejection (WFT-95 review): a schedule created before that
+ * rejection landed may already carry `id: '.'` or `'..'`, and callers must
+ * still be able to inspect, pause, resume, cancel, or update it instead of
+ * having every control operation reject a schedule they can't otherwise
+ * reach.
+ */
+export declare function coerceScheduleId(scheduleId: unknown, fieldName: string): string;
 /**
  * A recurrence specification normalized into the discriminated cadence the
  * engine persists. Interval periods are resolved to whole milliseconds.
@@ -24,7 +50,6 @@ export type NormalizedScheduleSpec = {
  */
 export declare function normalizeScheduleSpec(spec: string | ScheduleSpec): NormalizedScheduleSpec;
 export declare function normalizeScheduleFilter(filter: ScheduleFilter | undefined): ScheduleFilter | undefined;
-export declare function rejectInvalidScheduleRecord(scheduleId: string | undefined, message: string): null;
 export declare function decodeScheduleIdentityFields(decoded: Record<string, unknown>): (Pick<ScheduleState, 'id' | 'workflowType' | 'status' | 'overlap'> & {
     cronExpression?: string;
     intervalMs?: number;

package/dist/core/engine/validation/schedule.js

@@ -2,13 +2,18 @@ import { decode } from "../../codec.js";
 import { isRecord } from "../../debug-output.js";
 import { parseCronExpression } from "../../schedule.js";
 import { parseDuration } from "../../scheduler.js";
-import { coerceStartWorkflowId } from "../../start-workflow-validation.js";
-import { SCHEDULE_OVERLAP_POLICIES } from "./schedule-options.js";
+import { assertDecodableWorkflowId, isDecodableWorkflowId } from "../../workflow-identifiers.js";
+import { decodeScheduleCadence } from "./schedule-cadence.js";
+import { SCHEDULE_OVERLAP_POLICIES, SCHEDULE_REVISION_POLICIES } from "./schedule-options.js";
+import { decodeScheduleRevisionPolicyFields } from "./schedule-revision.js";
+import { rejectInvalidScheduleRecord } from "./schedule-warnings.js";
 export {
   normalizeScheduleOptions,
   normalizeScheduleUpdateOptions,
-  SCHEDULE_OVERLAP_POLICIES
+  SCHEDULE_OVERLAP_POLICIES,
+  SCHEDULE_REVISION_POLICIES
 } from "./schedule-options.js";
+export { rejectInvalidScheduleRecord } from "./schedule-warnings.js";
 export const SCHEDULE_STATUSES = new Set(["active", "paused", "cancelled"]);
 export function isValidScheduleTimestamp(value) {
   return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
@@ -19,18 +24,15 @@ export function isValidScheduleStatus(value) {
 export function isValidScheduleOverlapPolicy(value) {
   return typeof value === "string" && SCHEDULE_OVERLAP_POLICIES.has(value);
 }
+export function isValidScheduleRevisionPolicy(value) {
+  return typeof value === "string" && SCHEDULE_REVISION_POLICIES.has(value);
+}
 export function isValidScheduleIdentifier(value) {
-  if (typeof value !== "string")
-    return !1;
-  try {
-    coerceStartWorkflowId(value, "schedule id");
-    return !0;
-  } catch {
-    return !1;
-  }
+  return typeof value === "string" && isDecodableWorkflowId(value);
 }
 export function coerceScheduleId(scheduleId, fieldName) {
-  return coerceStartWorkflowId(scheduleId, fieldName);
+  assertDecodableWorkflowId(scheduleId, fieldName);
+  return scheduleId;
 }
 function normalizeIntervalEvery(every) {
   if (typeof every !== "string" && typeof every !== "number")
@@ -94,29 +96,6 @@ export function normalizeScheduleFilter(filter) {
   validateScheduleFilterBound(filter.offset, "offset");
   return filter;
 }
-export function rejectInvalidScheduleRecord(scheduleId, message) {
-  const prefix = scheduleId === void 0 ? "[weft] Ignoring malformed schedule record" : `[weft] Ignoring malformed schedule "${scheduleId}"`;
-  console.warn(`${prefix} ${message}.`);
-  return null;
-}
-function decodeScheduleCadence(decoded, scheduleId) {
-  const { cronExpression, intervalMs } = decoded, hasCron = cronExpression !== void 0, hasInterval = intervalMs !== void 0;
-  if (hasCron === hasInterval)
-    return rejectInvalidScheduleRecord(scheduleId, "with conflicting or missing cadence (expected exactly one of cronExpression or intervalMs)");
-  if (hasInterval) {
-    if (typeof intervalMs !== "number" || !Number.isSafeInteger(intervalMs) || intervalMs <= 0)
-      return rejectInvalidScheduleRecord(scheduleId, "with invalid intervalMs");
-    return { intervalMs };
-  }
-  if (typeof cronExpression !== "string")
-    return rejectInvalidScheduleRecord(scheduleId, "with invalid cronExpression");
-  try {
-    parseCronExpression(cronExpression);
-  } catch {
-    return rejectInvalidScheduleRecord(scheduleId, "with invalid cronExpression");
-  }
-  return { cronExpression };
-}
 export function decodeScheduleIdentityFields(decoded) {
   const id = decoded.id;
   if (!isValidScheduleIdentifier(id))
@@ -307,9 +286,13 @@ export function decodeScheduleState(bytes) {
   const runtime = decodeScheduleRuntimeFields(decoded, identity.id);
   if (!runtime)
     return null;
+  const revisionFields = decodeScheduleRevisionPolicyFields(decoded, identity.id);
+  if (!revisionFields)
+    return null;
   return {
     ...identity,
     input: decoded.input,
-    ...runtime
+    ...runtime,
+    ...revisionFields
   };
 }

package/dist/core/engine/validation.js

@@ -1,9 +1,11 @@
 import { decode } from "../codec.js";
 import { isRecord } from "../debug-output.js";
 import { normalizeFailureCategory } from "../failure-categories.js";
-import { coerceStartWorkflowId, parseStartWorkflowDuration } from "../start-workflow-validation.js";
+import { parseStartWorkflowDuration } from "../start-workflow-validation.js";
 import { DEFAULT_WORKFLOW_VERSION } from "../versioning.js";
+import { isDecodableWorkflowId } from "../workflow-identifiers.js";
 import { isWorkflowTagArray } from "../workflow-tags.js";
+import { sanitizeDecodedRevision } from "./decode-revision.js";
 import {
   MAX_TIMELINE_COORDINATOR_DETAILS,
   MAX_TIMELINE_DETAIL_STRING_LENGTH
@@ -30,6 +32,7 @@ const WORKFLOW_STATE_FIELD_NAMES = new Set(defineCompleteWorkflowStateFieldNames
   "failureCategory",
   "terminationReason",
   "versionTuple",
+  "revision",
   "workflowExecutionToken",
   "executionStateOwnerId",
   "parentWorkflowId",
@@ -131,24 +134,18 @@ export function decodeWorkflowState(bytes) {
     else
       state.failureCategory = normalizedFailureCategory;
   }
-  if (state.executionStateOwnerId !== void 0)
-    try {
-      coerceStartWorkflowId(state.executionStateOwnerId, "executionStateOwnerId");
-    } catch {
-      console.warn(`[weft] Decoded workflow state for "${state.id}" has an invalid executionStateOwnerId field; falling back to the workflow id as the execution owner. This usually indicates corruption or tampering of the storage record.`);
-      delete state.executionStateOwnerId;
-    }
+  if (state.executionStateOwnerId !== void 0 && !isDecodableWorkflowId(state.executionStateOwnerId)) {
+    console.warn(`[weft] Decoded workflow state for "${state.id}" has an invalid executionStateOwnerId field; falling back to the workflow id as the execution owner. This usually indicates corruption or tampering of the storage record.`);
+    delete state.executionStateOwnerId;
+  }
   sanitizeDecodedParentLineage(state);
   sanitizeDecodedRestartLineage(state);
+  sanitizeDecodedRevision(state);
   return decodedRecord === void 0 ? state : stripUnknownWorkflowStateFields(state, decodedRecord);
 }
 function sanitizeDecodedParentLineage(state) {
-  if (state.parentWorkflowId !== void 0)
-    try {
-      coerceStartWorkflowId(state.parentWorkflowId, "parentWorkflowId");
-    } catch {
-      delete state.parentWorkflowId;
-    }
+  if (state.parentWorkflowId !== void 0 && !isDecodableWorkflowId(state.parentWorkflowId))
+    delete state.parentWorkflowId;
   if (typeof state.parentWorkflowExecutionToken !== "string" || state.parentWorkflowExecutionToken.length === 0 || state.parentWorkflowId === void 0)
     delete state.parentWorkflowExecutionToken;
 }
@@ -158,9 +155,8 @@ function sanitizeDecodedRestartLineage(state) {
     delete state.restartedFrom;
     return;
   }
-  try {
-    coerceStartWorkflowId(restartedFrom.workflowId, "restartedFrom.workflowId");
-  } catch {
+  const restartWorkflowId = restartedFrom.workflowId;
+  if (typeof restartWorkflowId !== "string" || !isDecodableWorkflowId(restartWorkflowId)) {
     delete state.restartedFrom;
     return;
   }

package/dist/core/engine/workflow-claim-reclaim-target.d.ts

@@ -104,4 +104,4 @@ export declare function createWorkflowClaimReclaimTarget(registry: WorkflowClaim
  * every existing caller/test that does not care about mixed workflow-type
  * fleets keeps working unchanged.
  */
-isTypeRegistered?: (workflowType: string) => boolean): WorkflowClaimReclaimTargetHandle;
+isTypeRegistered?: (workflowType: string, revision: string | undefined) => boolean): WorkflowClaimReclaimTargetHandle;