@lostgradient/weft 0.3.0 → 0.4.0

package/dist/core/worker-inbound-message.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Builders for the `run`/`resume` {@link WorkerInboundMessage} envelopes the
+ * {@link import('./worker-execution-strategy.ts').WorkerExecutionStrategy} sends to a
+ * worker. Extracted as free functions so the strategy stays under the line cap and the
+ * envelope-construction rules (protocol version, turn id, size cap, host-log-sink
+ * stamping) live in one place. The strategy keeps ownership of the turn-id counter and
+ * the assert-and-send; these functions only assemble the message.
+ *
+ * @module core/worker-inbound-message
+ */
+import type { OperationOutcome, WorkerInboundMessage } from './types.ts';
+/** The turn-protocol context every inbound message carries, owned by the strategy. */
+export interface WorkerInboundMessageContext {
+    turnId: number;
+    maxProtocolMessageBytes: number | undefined;
+    /** Whether the engine host installed an `onLog` sink; stamps `hostHasLogSink` (#529). */
+    hasLogSink: boolean;
+}
+/** Build a `run` inbound message from start parameters and the turn context. */
+export declare function buildRunMessage(parameters: {
+    workflowId: string;
+    workflowType: string;
+    input: unknown;
+    checkpoint: ArrayBuffer;
+    executionStateOwnerId?: string;
+    deadline?: number;
+    headers?: [string, string][];
+}, context: WorkerInboundMessageContext): WorkerInboundMessage & {
+    type: 'run';
+};
+/** Build a `resume` inbound message from resume parameters and the turn context. */
+export declare function buildResumeMessage(parameters: {
+    workflowId: string;
+    checkpoint: ArrayBuffer;
+    operationResult: OperationOutcome;
+}, context: WorkerInboundMessageContext): WorkerInboundMessage & {
+    type: 'resume';
+};

package/dist/core/worker-inbound-message.js

@@ -0,0 +1,37 @@
+import { WORKER_PROTOCOL_VERSION } from "./worker-protocol.js";
+export function buildRunMessage(parameters, context) {
+  const message = {
+    type: "run",
+    protocolVersion: WORKER_PROTOCOL_VERSION,
+    turnId: context.turnId,
+    workflowId: parameters.workflowId,
+    workflowType: parameters.workflowType,
+    checkpoint: parameters.checkpoint,
+    input: parameters.input,
+    executionStateOwnerId: parameters.executionStateOwnerId ?? parameters.workflowId
+  };
+  if (context.maxProtocolMessageBytes !== void 0)
+    message.maxProtocolMessageBytes = context.maxProtocolMessageBytes;
+  if (parameters.deadline !== void 0)
+    message.deadline = parameters.deadline;
+  if (parameters.headers)
+    message.headers = parameters.headers;
+  if (context.hasLogSink)
+    message.hostHasLogSink = !0;
+  return message;
+}
+export function buildResumeMessage(parameters, context) {
+  const message = {
+    type: "resume",
+    protocolVersion: WORKER_PROTOCOL_VERSION,
+    turnId: context.turnId,
+    workflowId: parameters.workflowId,
+    checkpoint: parameters.checkpoint,
+    operationResult: parameters.operationResult
+  };
+  if (context.maxProtocolMessageBytes !== void 0)
+    message.maxProtocolMessageBytes = context.maxProtocolMessageBytes;
+  if (context.hasLogSink)
+    message.hostHasLogSink = !0;
+  return message;
+}

package/dist/core/worker-log-abuse-counter.d.ts

@@ -0,0 +1,175 @@
+import type { FailureCategory } from './types.ts';
+import type { WorkflowLogRecord } from './types/workflow-log.ts';
+import type { WorkerExecutionStrategyOptions } from './worker-execution-strategy-options.ts';
+import { type ForwardedWorkerLogOutcome } from './worker-message-helpers.ts';
+import type { WorkerLogMessageCandidate } from './worker-protocol-log.ts';
+/**
+ * The verdict the abuse counter returns after recording one forwarded-log outcome:
+ * whether the strategy should DISCARD the sending worker for sustained abuse.
+ * `'tolerate'` means a single anomaly or an in-budget burst that does not discard.
+ * `'discard'` means a threshold was crossed (flood within the window, or accumulated
+ * lifetime strikes) and the worker should be discarded as the hardened-worker threat
+ * model prescribes.
+ */
+export type WorkerLogAbuseVerdict = 'tolerate' | 'discard';
+/**
+ * Configuration for {@link WorkerLogAbuseCounter}. All three thresholds are internal:
+ * the engine fixes them to generous defaults rather than exposing operator tuning,
+ * because a false discard fails a real user's in-flight workflows (an asymmetric harm).
+ * The flood window/threshold are large so honest high-log workflows never trip them; the
+ * strike threshold is a small constant because oversize/invalid records are never produced
+ * by a well-behaved logger, so a handful in a worker's lifetime already signals abuse.
+ */
+export interface WorkerLogAbuseCounterOptions {
+    /** Fixed/anchored window length in milliseconds for the flood budget. */
+    readonly floodWindowMs: number;
+    /**
+     * Maximum forwarded-log ARRIVALS tolerated per worker within `floodWindowMs`
+     * before the worker is discarded. Counts every `type:'log'` arrival for a worker
+     * — valid, oversize, invalid, or wrong-owner — because the host paid the clone
+     * cost on receipt regardless of the record's fate.
+     */
+    readonly floodThreshold: number;
+    /**
+     * Maximum cumulative anomalous (oversize OR invalid) records tolerated over a
+     * worker's whole lifetime before discard. NOT window-scoped and NOT reset, so a
+     * worker cannot evade by spacing anomalies across windows.
+     */
+    readonly strikeThreshold: number;
+    /** Monotonic-enough wall clock (ms), injected so tests advance time deterministically. */
+    readonly getNow: () => number;
+}
+/**
+ * Per-worker forwarded-log abuse accounting for the hardened worker path (#545).
+ *
+ * The #529 host-sink routing forwards a worker's `ctx.log` records to the engine's
+ * `EngineOptions.onLog` sink through a deliberately LENIENT lane that bypasses the
+ * strict turn watchdog, so a single malformed/oversize/wrong-owner log drops the
+ * record without discarding the worker. That leniency leaves two availability gaps
+ * a compromised or buggy worker can exploit:
+ *
+ * 1. **Flooding** — unlimited valid, in-budget logs apply host CPU / sink-buffer
+ *    pressure without ever tripping the watchdog.
+ * 2. **Repeat oversize/invalid** — each forwarded log is structured-cloned by the
+ *    runtime on receipt (a platform-inherent cost paid before any handler runs), so
+ *    a worker can repeatedly force large/garbage allocations that the lenient lane
+ *    then drops.
+ *
+ * This counter closes both by keeping per-worker state (keyed by the {@link Worker}
+ * reference in a {@link WeakMap}, so a discarded/GC'd worker's state is reclaimed
+ * automatically). It exposes two record paths the strategy calls and returns a
+ * {@link WorkerLogAbuseVerdict} telling the strategy whether to discard:
+ *
+ * - {@link recordArrival} is called for EVERY `type:'log'` message a worker sends,
+ *   at the top of the log branch BEFORE the ownership gate — so a worker flooding
+ *   logs for workflows it does not own is still counted (the host paid the clone
+ *   cost). It drives the windowed flood budget.
+ * - {@link recordOutcome} is called after the ownership gate, with the delivery
+ *   {@link ForwardedWorkerLogOutcome}, to drive the lifetime strike bucket on
+ *   anomalous (oversize/invalid) records.
+ *
+ * Granularity is per-worker (not per-workflow): a pooled worker runs many workflows
+ * over its lifetime, the remediation ({@link Worker} discard) is worker-scoped, and
+ * the threat model treats the whole worker as the adversary, so per-worker both
+ * matches the remediation and defeats spreading abuse thin across many workflows.
+ */
+export declare class WorkerLogAbuseCounter {
+    #private;
+    constructor(options: WorkerLogAbuseCounterOptions);
+    /**
+     * Record one forwarded-log ARRIVAL for `worker` and return whether the worker
+     * should be discarded for flooding. Called for every `type:'log'` message before
+     * the ownership gate. This is a fixed/anchored window (not a true rolling window): an
+     * arrival at or beyond `floodWindowMs` after the window's start anchors a fresh window
+     * (count resets to 1). Within a window, the verdict is `discard` once arrivals exceed
+     * `floodThreshold`. A backwards clock jump (`now < windowStartedAt`, e.g. an NTP step
+     * when `getNow` is wall-clock) also re-anchors the window, so clock regression can never
+     * hold a window open and accumulate toward a premature discard.
+     */
+    recordArrival(worker: Worker): WorkerLogAbuseVerdict;
+    /**
+     * Record the delivery `outcome` for one forwarded log from `worker` and return
+     * whether the worker should be discarded for accumulated anomalies. An
+     * `accepted-valid` outcome is a no-op (valid logs are accounted only by the flood
+     * budget). An oversize or invalid outcome adds one lifetime strike; the verdict is
+     * `discard` once lifetime strikes reach `strikeThreshold`. The `switch` is exhaustive
+     * (the `never` default) so that adding a future non-strike dropped outcome forces the
+     * strike-vs-no-strike policy decision to be made here rather than defaulting to a strike.
+     */
+    recordOutcome(worker: Worker, outcome: ForwardedWorkerLogOutcome): WorkerLogAbuseVerdict;
+    /** Drop a worker's accounting (called when the worker is discarded/forgotten). */
+    forget(worker: Worker): void;
+}
+/**
+ * Narrow construction config for {@link ForwardedLogGate} — decoupled from
+ * `WorkerExecutionStrategyOptions` so the gate names only what it consumes. The
+ * threshold fields are `| undefined` (the gate applies each default); build this from
+ * a strategy's options with {@link forwardedLogGateFromStrategyOptions}.
+ */
+export interface ForwardedLogGateOptions {
+    readonly onLog: ((record: WorkflowLogRecord) => void) | undefined;
+    readonly maxProtocolMessageBytes: number | undefined;
+    readonly getNow: (() => number) | undefined;
+    readonly floodWindowMs: number | undefined;
+    readonly floodThreshold: number | undefined;
+    readonly strikeThreshold: number | undefined;
+}
+/**
+ * The complete forwarded-log lane for the hardened worker path: #529 delivery
+ * orchestration plus the #545 per-worker abuse counter. Extracted from
+ * `WorkerExecutionStrategy` so the strategy's message branch is a one-line delegate
+ * and this whole concern — counting policy, ownership-gated delivery, discard
+ * decisions — lives in one focused, independently tested module.
+ *
+ * {@link handle} is the single entry point. It counts EVERY arrival toward the flood
+ * budget BEFORE the ownership gate (a worker flooding logs for workflows it does not
+ * own is still counted — the host already paid the structured-clone cost on receipt),
+ * applies the trust-boundary ownership gate (a worker may forward logs only for a
+ * workflow it owns, checked by the injected `ownedByWorker` predicate), delivers
+ * owned records to the sink, and feeds the delivery outcome to the lifetime strike
+ * bucket. It returns a human-readable discard reason when sustained abuse (flooding
+ * OR repeated anomalies) crosses a threshold, or `null` to tolerate. The caller owns
+ * the actual worker discard; this gate only decides.
+ */
+export declare class ForwardedLogGate {
+    #private;
+    /**
+     * Construct from a narrow gate-local config (decoupled from the strategy). Defaults
+     * are applied here so this is the one place every forwarded-log default lives: `getNow`
+     * → `Date.now`, flood window/threshold → the generous worker-protocol constants, strike
+     * threshold → the small non-configurable constant. Build it from a strategy's options
+     * with {@link forwardedLogGateFromStrategyOptions}.
+     */
+    constructor(config: ForwardedLogGateOptions);
+    /** Whether a host `onLog` sink is installed (drives the worker's `hostHasLogSink` flag). */
+    get hasSink(): boolean;
+    /**
+     * Process one forwarded `log` from `worker`. `ownedByWorker` reports whether the
+     * sending worker owns `message.workflowId` (active or parked) — the strategy's
+     * ownership state stays the source of truth. Returns ready-to-use discard options on
+     * sustained abuse (the strategy passes them straight to its worker-discard path), or
+     * `null` to tolerate this occurrence.
+     */
+    handle(worker: Worker, message: WorkerLogMessageCandidate, ownedByWorker: (workflowId: string) => boolean): LogAbuseDiscardOptions | null;
+    /** Drop a worker's accounting (called when the worker is discarded/forgotten). */
+    forget(worker: Worker): void;
+}
+/**
+ * The discard options {@link ForwardedLogGate.handle} returns for an abusive worker —
+ * a `system`-category discard whose target and other failures carry the same reason.
+ * Structurally a subset of the strategy's worker-discard options, so the strategy
+ * passes it straight through.
+ */
+export interface LogAbuseDiscardOptions {
+    readonly targetCategory: FailureCategory;
+    readonly targetError: string;
+    readonly otherCategory: FailureCategory;
+    readonly otherError: string;
+}
+/**
+ * Build a {@link ForwardedLogGate} from a strategy's options. This is the one place that
+ * names {@link WorkerExecutionStrategyOptions} (type-only), so the gate class itself stays
+ * decoupled from the broader strategy surface. `maxProtocolMessageBytes` is passed
+ * separately because the strategy also consumes it for its protocol guard.
+ */
+export declare function forwardedLogGateFromStrategyOptions(options: WorkerExecutionStrategyOptions | undefined, maxProtocolMessageBytes: number | undefined): ForwardedLogGate;

package/dist/core/worker-log-abuse-counter.js

@@ -0,0 +1,107 @@
+import {
+  deliverForwardedWorkerLog
+} from "./worker-message-helpers.js";
+import {
+  DEFAULT_FORWARDED_LOG_FLOOD_THRESHOLD,
+  DEFAULT_FORWARDED_LOG_FLOOD_WINDOW_MS,
+  FORWARDED_LOG_STRIKE_THRESHOLD
+} from "./worker-protocol.js";
+
+export class WorkerLogAbuseCounter {
+  #floodWindowMs;
+  #floodThreshold;
+  #strikeThreshold;
+  #getNow;
+  #stateByWorker = new WeakMap;
+  constructor(options) {
+    this.#floodWindowMs = options.floodWindowMs;
+    this.#floodThreshold = options.floodThreshold;
+    this.#strikeThreshold = options.strikeThreshold;
+    this.#getNow = options.getNow;
+  }
+  recordArrival(worker) {
+    const now = this.#getNow(), state = this.#stateFor(worker), elapsed = now - state.windowStartedAt;
+    if (elapsed >= this.#floodWindowMs || elapsed < 0) {
+      state.windowStartedAt = now;
+      state.arrivalsInWindow = 0;
+    }
+    state.arrivalsInWindow += 1;
+    return state.arrivalsInWindow > this.#floodThreshold ? "discard" : "tolerate";
+  }
+  recordOutcome(worker, outcome) {
+    switch (outcome) {
+      case "accepted-valid":
+        return "tolerate";
+      case "dropped-oversize":
+      case "dropped-invalid": {
+        const state = this.#stateFor(worker);
+        state.lifetimeStrikes += 1;
+        return state.lifetimeStrikes >= this.#strikeThreshold ? "discard" : "tolerate";
+      }
+      default:
+        throw Error(`Unknown forwarded-log outcome: ${String(outcome)}`);
+    }
+  }
+  forget(worker) {
+    this.#stateByWorker.delete(worker);
+  }
+  #stateFor(worker) {
+    let state = this.#stateByWorker.get(worker);
+    if (!state) {
+      state = { windowStartedAt: this.#getNow(), arrivalsInWindow: 0, lifetimeStrikes: 0 };
+      this.#stateByWorker.set(worker, state);
+    }
+    return state;
+  }
+}
+
+export class ForwardedLogGate {
+  #counter;
+  #onLog;
+  #maxProtocolMessageBytes;
+  constructor(config) {
+    this.#onLog = config.onLog;
+    this.#maxProtocolMessageBytes = config.maxProtocolMessageBytes;
+    this.#counter = new WorkerLogAbuseCounter({
+      floodWindowMs: config.floodWindowMs ?? DEFAULT_FORWARDED_LOG_FLOOD_WINDOW_MS,
+      floodThreshold: config.floodThreshold ?? DEFAULT_FORWARDED_LOG_FLOOD_THRESHOLD,
+      strikeThreshold: config.strikeThreshold ?? FORWARDED_LOG_STRIKE_THRESHOLD,
+      getNow: config.getNow ?? Date.now
+    });
+  }
+  get hasSink() {
+    return this.#onLog !== void 0;
+  }
+  handle(worker, message, ownedByWorker) {
+    if (this.#counter.recordArrival(worker) === "discard")
+      return discardForLogAbuse("forwarded-log flooding");
+    if (typeof message.workflowId !== "string" || !ownedByWorker(message.workflowId))
+      return null;
+    const outcome = deliverForwardedWorkerLog(message, this.#onLog, this.#maxProtocolMessageBytes);
+    if (this.#counter.recordOutcome(worker, outcome) === "discard")
+      return discardForLogAbuse("repeated oversize/invalid forwarded logs");
+    return null;
+  }
+  forget(worker) {
+    this.#counter.forget(worker);
+  }
+}
+function discardForLogAbuse(reason) {
+  const error = `Worker discarded for log abuse: ${reason}`;
+  return {
+    targetCategory: "system",
+    targetError: error,
+    otherCategory: "system",
+    otherError: error
+  };
+}
+export function forwardedLogGateFromStrategyOptions(options, maxProtocolMessageBytes) {
+  return new ForwardedLogGate({
+    onLog: options?.onLog,
+    maxProtocolMessageBytes,
+    getNow: options?.getNow,
+    floodWindowMs: options?.forwardedLogFloodWindowMs,
+    floodThreshold: options?.forwardedLogFloodThreshold,
+    strikeThreshold: options?.forwardedLogStrikeThreshold
+  });
+}

package/dist/core/worker-message-helpers.d.ts

@@ -1,5 +1,52 @@
 import type { WorkerOutboundMessage } from './types.ts';
+import type { WorkflowLogRecord } from './types/workflow-log.ts';
+import { type WorkerLogMessageCandidate } from './worker-protocol-log.ts';
+/**
+ * The outcome of attempting to deliver one forwarded worker `ctx.log` (#545), produced
+ * by {@link deliverForwardedWorkerLog} and consumed by the abuse counter, which
+ * classifies each forwarded log by this outcome to feed its two buckets independently:
+ *
+ * - `accepted-valid`: a structurally valid, in-budget record. Counted toward the flood
+ *   budget (every owned arrival is) but never a strike. Returned even when no host sink
+ *   is installed — a valid log still consumes flood budget, because the host already
+ *   paid the structured-clone cost on receipt regardless of the sink.
+ * - `dropped-oversize`: the record exceeded the protocol size cap. An anomaly — a
+ *   well-behaved worker-side logger never emits oversize records — so it is a strike.
+ * - `dropped-invalid`: the record is not a structurally valid {@link WorkflowLogRecord},
+ *   or its `workflowId` does not match the envelope. Also a strike: a legitimate logger
+ *   always emits a well-formed record whose id matches the workflow it owns.
+ *
+ * `dropped-oversize` and `dropped-invalid` both feed the SAME lifetime strike bucket;
+ * the distinction is retained only for diagnostics/console fidelity.
+ */
+export type ForwardedWorkerLogOutcome = 'accepted-valid' | 'dropped-oversize' | 'dropped-invalid';
 export declare function emitWorkerMessageToEngine(handler: ((message: WorkerOutboundMessage) => void | Promise<void>) | null, message: WorkerOutboundMessage): boolean | Promise<boolean>;
 export declare function isParkableWaitSignalCheckpoint(message: Extract<WorkerOutboundMessage, {
     type: 'checkpoint';
 }>): boolean;
+/**
+ * Deliver a forwarded worker `ctx.log` to the host `onLog` sink (#529), AFTER the
+ * caller has verified the sending worker owns `message.workflowId` (the trust-boundary
+ * ownership gate stays inline in the strategy). This is the mechanical tail: DROP unless
+ * the message is within the size cap AND the record is a structurally valid
+ * {@link WorkflowLogRecord} whose `workflowId` matches the envelope; then deliver to
+ * `onLog`. The log lane is non-fatal per delivery — malformed, identity-mismatched,
+ * oversize, throwing-sink — so a SINGLE occurrence never throws and never discards the
+ * worker. A throwing host sink falls back to the console via the shared
+ * {@link logRecordToConsole}, mirroring the inline sink, so a logging error can never
+ * fail the workflow.
+ *
+ * The size check is intentionally performed BEFORE the structural check so that a huge
+ * but otherwise-encodable malformed record is classified `dropped-oversize` rather than
+ * `dropped-invalid` (#545): the dominant abuse cost of an oversize record — the runtime's
+ * structured clone on receipt — is paid regardless of whether the payload is well-formed.
+ * Only a genuine size-cap breach ({@link WorkerProtocolMessageSizeError}) is oversize; the
+ * estimator's other throw (cyclic / non-cloneable payloads) is classified `dropped-invalid`.
+ *
+ * The returned {@link ForwardedWorkerLogOutcome} is what the strategy feeds to the
+ * per-worker abuse counter (#545): `accepted-valid` counts a delivered (or, with no
+ * sink, would-be-delivered) record; `dropped-oversize`/`dropped-invalid` are anomalies
+ * that accumulate lifetime strikes. The helper still NEVER discards a worker — that
+ * remediation decision belongs to the counter and the strategy.
+ */
+export declare function deliverForwardedWorkerLog(message: WorkerLogMessageCandidate, onLog: ((record: WorkflowLogRecord) => void) | undefined, maxProtocolMessageBytes: number | undefined): ForwardedWorkerLogOutcome;

package/dist/core/worker-message-helpers.js

@@ -1,3 +1,9 @@
+import { logRecordToConsole } from "./context/workflow-logger.js";
+import { isValidWorkerLogRecord } from "./worker-protocol-log.js";
+import {
+  assertWorkerProtocolMessageWithinLimit,
+  WorkerProtocolMessageSizeError
+} from "./worker-protocol.js";
 export function emitWorkerMessageToEngine(handler, message) {
   try {
     const emitResult = handler?.(message);
@@ -12,3 +18,23 @@ export function isParkableWaitSignalCheckpoint(message) {
   const operationRequest = message.operationRequest;
   return operationRequest.type === "wait-signal" || operationRequest.kind === "signal-wait";
 }
+export function deliverForwardedWorkerLog(message, onLog, maxProtocolMessageBytes) {
+  if (maxProtocolMessageBytes !== void 0)
+    try {
+      assertWorkerProtocolMessageWithinLimit(message, maxProtocolMessageBytes);
+    } catch (error) {
+      return error instanceof WorkerProtocolMessageSizeError ? "dropped-oversize" : "dropped-invalid";
+    }
+  if (!isValidWorkerLogRecord(message.record))
+    return "dropped-invalid";
+  const record = message.record;
+  if (record.workflowId !== message.workflowId)
+    return "dropped-invalid";
+  if (onLog !== void 0)
+    try {
+      onLog(record);
+    } catch {
+      logRecordToConsole(record);
+    }
+  return "accepted-valid";
+}

package/dist/core/worker-protocol-guard.js

@@ -49,7 +49,7 @@ export class WorkerProtocolGuard {
     const turn = this.#turnWatchdog.get(worker);
     if (!turn)
       throw new WorkerProtocolError("Worker message arrived outside an active turn");
-    if (message.turnId !== turn.turnId || message.workflowId !== turn.workflowId)
+    if ((message.type === "log" ? void 0 : message.turnId) !== turn.turnId || message.workflowId !== turn.workflowId)
       throw new WorkerProtocolError("Worker message did not match the active turn");
   }
 }

package/dist/core/worker-protocol-log.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Pure structural validators for worker `log` protocol messages (#529). These have
+ * NO dependency on the rest of `worker-protocol.ts` — they are leaf predicates so
+ * `worker-protocol.ts` (which owns `WorkerProtocolError` and the strict asserters)
+ * can import them without an import cycle. The strict, throwing path
+ * (`assertWorkerLogOutbound` in `worker-protocol.ts`) wraps {@link isValidWorkerLogRecord},
+ * and the host's lenient delivery path routes on {@link isWorkerLogMessage}, so both
+ * paths share one definition of "valid worker log".
+ *
+ * The `log` lane is intentionally version-tolerant: a `log` carries no turn-protocol
+ * state and is best-effort observability, so it bypasses the strict protocol-version
+ * negotiation that gates state-changing messages. That is safe while only protocol v1
+ * exists; a future incompatible protocol would still send `type: 'log'` and have its
+ * record validated structurally here rather than rejected on version. This is the one
+ * place that decision lives — see {@link isWorkerLogMessage}.
+ *
+ * @module core/worker-protocol-log
+ */
+import type { WorkflowLogRecord } from './types/workflow-log.ts';
+/**
+ * A candidate `log` outbound message: every field is `unknown` because this lane
+ * accepts the message by `type` ALONE and validates the payload separately. Narrowing
+ * to this (rather than the final `Extract<WorkerOutboundMessage, { type: 'log' }>`)
+ * keeps {@link isWorkerLogMessage} a SOUND predicate — it promises only what it
+ * checks. The record is treated as a {@link WorkflowLogRecord} only after
+ * {@link isValidWorkerLogRecord} succeeds.
+ */
+export interface WorkerLogMessageCandidate {
+    readonly type: 'log';
+    readonly protocolVersion?: unknown;
+    readonly workflowId?: unknown;
+    readonly record?: unknown;
+}
+/**
+ * Whether `record` is a structurally complete {@link WorkflowLogRecord} — the single
+ * source of truth for "valid worker log payload", shared by the strict-protocol
+ * asserter (which throws) and the host's lenient delivery path (which drops). Because
+ * the host sink is typed to receive a `WorkflowLogRecord`, this validates the FULL
+ * envelope an untrusted worker must supply: `level` (allowed literal), `message`,
+ * `workflowId`, `workflowType` (strings), `timestamp` (finite number), and — when
+ * present — `attributes` (a plain object). A record missing any required field or
+ * carrying a wrong-typed field is rejected so a malformed wire payload can never reach
+ * a strongly typed host sink.
+ */
+export declare function isValidWorkerLogRecord(record: unknown): record is WorkflowLogRecord;
+/**
+ * Structural type-guard that routes a message into the host's LENIENT log lane: any
+ * message whose `type` is `'log'`. It matches on `type` ALONE and narrows only to
+ * {@link WorkerLogMessageCandidate} (all payload fields `unknown`) — payload validity
+ * is decided later by {@link isValidWorkerLogRecord}, so a malformed log is DROPPED,
+ * not sent to the strict accept-or-discard gate. A `log` is best-effort observability
+ * and carries no turn-protocol state, so no malformed/oversize/out-of-turn log may
+ * ever discard the worker. A non-`log` message returns `false` and flows on to the
+ * strict gate unchanged.
+ */
+export declare function isWorkerLogMessage(message: unknown): message is WorkerLogMessageCandidate;

package/dist/core/worker-protocol-log.js

@@ -0,0 +1,18 @@
+const WORKFLOW_LOG_LEVELS = new Set(["debug", "info", "warn", "error"]);
+function isValidLogAttributes(attributes) {
+  if (attributes === void 0)
+    return !0;
+  if (typeof attributes !== "object" || attributes === null)
+    return !1;
+  const prototype = Object.getPrototypeOf(attributes);
+  return prototype === Object.prototype || prototype === null;
+}
+export function isValidWorkerLogRecord(record) {
+  if (typeof record !== "object" || record === null)
+    return !1;
+  const candidate = record;
+  return WORKFLOW_LOG_LEVELS.has(candidate.level) && typeof candidate.message === "string" && typeof candidate.workflowId === "string" && typeof candidate.workflowType === "string" && typeof candidate.timestamp === "number" && Number.isFinite(candidate.timestamp) && isValidLogAttributes(candidate.attributes);
+}
+export function isWorkerLogMessage(message) {
+  return typeof message === "object" && message !== null && message.type === "log";
+}

package/dist/core/worker-protocol.d.ts

@@ -6,6 +6,29 @@ export declare const WORKER_PROTOCOL_VERSION = 1;
 export declare const DEFAULT_WORKER_TURN_TIMEOUT_MS = 1000;
 export declare const DEFAULT_WORKER_PROTOCOL_MESSAGE_BYTES = 1048576;
 export declare const MIN_WORKER_PROTOCOL_MESSAGE_BYTES = 4096;
+/**
+ * Default fixed-window length (ms) for the forwarded-log flood budget (#545). Paired
+ * with {@link DEFAULT_FORWARDED_LOG_FLOOD_THRESHOLD} over this window.
+ */
+export declare const DEFAULT_FORWARDED_LOG_FLOOD_WINDOW_MS = 60000;
+/**
+ * Default maximum forwarded-log arrivals per worker within
+ * {@link DEFAULT_FORWARDED_LOG_FLOOD_WINDOW_MS} before the worker is discarded for
+ * flooding (#545). This budget is AGGREGATE per (pooled) worker, across every workflow
+ * the worker currently owns — not per workflow. Set deliberately high (~83 arrivals/sec
+ * sustained) because the harm is asymmetric: a false discard fails ALL of that worker's
+ * in-flight workflows, while a real flood from a compromised worker runs at thousands per
+ * second and still trips comfortably. Honest high-log workflows stay well under it.
+ */
+export declare const DEFAULT_FORWARDED_LOG_FLOOD_THRESHOLD = 5000;
+/**
+ * Cumulative lifetime anomalous (oversize OR structurally invalid) forwarded-log
+ * records tolerated per worker before discard (#545). A small constant — a well-behaved
+ * worker-side logger never emits oversize or malformed records, so a few in a worker's
+ * whole lifetime already signal abuse, and there is no legitimate-traffic reason to make
+ * this configurable. Not window-scoped and never reset.
+ */
+export declare const FORWARDED_LOG_STRIKE_THRESHOLD = 5;
 export declare class WorkerProtocolError extends Error {
     constructor(message: string);
 }

package/dist/core/worker-protocol.js

@@ -1,11 +1,13 @@
+import { copyBytesToArrayBuffer } from "./byte-arrays.js";
 import { encode, validateCloneable } from "./codec.js";
 import {
   WORKER_REPLAY_SIGNATURE_FORMAT
 } from "./types/checkpoint.js";
+import { isValidWorkerLogRecord } from "./worker-protocol-log.js";
 export {
   WORKER_REPLAY_SIGNATURE_FORMAT
 } from "./types/checkpoint.js";
-export const WORKER_PROTOCOL_VERSION = 1, DEFAULT_WORKER_TURN_TIMEOUT_MS = 1000, DEFAULT_WORKER_PROTOCOL_MESSAGE_BYTES = 1048576, MIN_WORKER_PROTOCOL_MESSAGE_BYTES = 4096;
+export const WORKER_PROTOCOL_VERSION = 1, DEFAULT_WORKER_TURN_TIMEOUT_MS = 1000, DEFAULT_WORKER_PROTOCOL_MESSAGE_BYTES = 1048576, MIN_WORKER_PROTOCOL_MESSAGE_BYTES = 4096, DEFAULT_FORWARDED_LOG_FLOOD_WINDOW_MS = 60000, DEFAULT_FORWARDED_LOG_FLOOD_THRESHOLD = 5000, FORWARDED_LOG_STRIKE_THRESHOLD = 5;
 const BINARY_MARKER = "__weftBinaryBytes", DATE_MARKER = "__weftDate", ERROR_MARKER = "__weftError", MAP_MARKER = "__weftMap", SET_MARKER = "__weftSet", MAX_BOUNDED_ERROR_LENGTH = 512, WORKER_SIGNATURE_EXCLUDED_FIELDS = new Set([
   "attempt",
   "callerStack",
@@ -21,6 +23,7 @@ const BINARY_MARKER = "__weftBinaryBytes", DATE_MARKER = "__weftDate", ERROR_MAR
   "activity",
   "archive",
   "child-workflow",
+  "get-version",
   "load",
   "memo",
   "offload",
@@ -107,6 +110,9 @@ function assertWorkerOutboundVariant(record) {
     case "failed":
       assertWorkerFailedOutbound(record);
       return;
+    case "log":
+      assertWorkerLogOutbound(record);
+      return;
     default:
       throw new WorkerProtocolError("Worker outbound message has an unsupported type");
   }
@@ -121,11 +127,15 @@ function assertWorkerFailedOutbound(record) {
   if (typeof record.error !== "string")
     throw new WorkerProtocolError("Worker failed message must include an error string");
 }
+function assertWorkerLogOutbound(record) {
+  if (!isValidWorkerLogRecord(record.record))
+    throw new WorkerProtocolError("Worker log message must include a valid log record");
+}
 export async function createWorkerReplayOperationSignature(operation, maxStableFieldsBytes) {
   const operationType = workerOperationType(operation), stableFields = stableWorkerOperationFields(operation, operationType), encodedStableFields = encode(stableFields);
   if (encodedStableFields.byteLength > maxStableFieldsBytes)
     throw new WorkerProtocolError(`Worker replay signature input is ${encodedStableFields.byteLength} bytes, exceeding limit ${maxStableFieldsBytes}`);
-  const digestBytes = await crypto.subtle.digest("SHA-256", encodedStableFields);
+  const digestBytes = await crypto.subtle.digest("SHA-256", copyBytesToArrayBuffer(encodedStableFields));
   return {
     format: WORKER_REPLAY_SIGNATURE_FORMAT,
     operationType,

package/dist/core/workflow-version-tuple.d.ts

@@ -38,19 +38,13 @@ export type WorkflowVersionDiff = {
 /**
  * Collect sorted `"${name}@${version}"` version strings from a tool array.
  *
- * Each element must expose a flat `name` or the old internal
- * `definition.name` compatibility shape, plus an optional `version`. Missing
- * versions default to `"0.0.0"`. The returned array is sorted alphabetically
- * so comparisons are order-independent.
+ * Each element exposes a `name` plus an optional `version`. Missing versions
+ * default to `"0.0.0"`. The returned array is sorted alphabetically so
+ * comparisons are order-independent.
  */
 export declare function collectToolVersions(tools: Array<{
     name: string;
     version?: string | undefined;
-} | {
-    definition: {
-        name: string;
-    };
-    version?: string | undefined;
 }>): string[];
 /**
  * Compare two {@link WorkflowVersionTuple}s and return structured field-level diffs.

package/dist/core/workflow-version-tuple.js

@@ -1,9 +1,8 @@
 export function collectToolVersions(tools) {
   return tools.map((tool) => {
-    const name = "name" in tool ? tool.name : tool.definition.name;
-    if (!name)
+    if (!tool.name)
       throw Error("collectToolVersions: tool is missing a required name field");
-    return `${name}@${tool.version ?? "0.0.0"}`;
+    return `${tool.name}@${tool.version ?? "0.0.0"}`;
   }).toSorted();
 }
 export function diffWorkflowVersionTuples(stored, registered) {