@lostgradient/weft 0.3.0 → 0.4.0

package/dist/server/operations/update-workflow.d.ts

@@ -22,6 +22,6 @@ export declare const updateWorkflowOperation: import("../operation-catalog.ts").
 }, {
     updateId: string;
     result: unknown;
-}>;
+}, unknown>;
 export declare const updateWorkflowRestBinding: UnknownRestBinding;
 export {};

package/dist/server/operations/update-workflow.js

@@ -5,6 +5,7 @@ import {
   WorkflowTerminalError
 } from "../../core/updates.js";
 import { defineOperation } from "../operation-registry.js";
+import { readRestJsonBody } from "../rest-body.js";
 import { isOperationFault, shapeRestFault } from "./operation-helpers.js";
 const DEFAULT_UPDATE_TIMEOUT_MS = 30000, updateWorkflowInput = z.object({
   workflowId: z.string().min(1),
@@ -85,17 +86,20 @@ export const updateWorkflowOperation = defineOperation({
     timeout: { kind: "body-field", bodyField: "timeout" },
     idempotencyKey: { kind: "body-field", bodyField: "idempotencyKey" }
   },
-  extractInput: async (request, pathParams) => {
+  extractInput: async (request, pathParams, context) => {
     let payload, timeout, idempotencyKey;
     try {
-      const body = await request.json();
+      const body = await readRestJsonBody(request, context);
       if (typeof body === "object" && body !== null) {
         const record = body;
         payload = record.payload;
         timeout = record.timeout;
         idempotencyKey = record.idempotencyKey;
       }
-    } catch {}
+    } catch (error) {
+      if (isOperationFault(error))
+        throw error;
+    }
     return {
       workflowId: pathParams.id ?? "",
       updateName: pathParams.name ?? "",

package/dist/server/operations/worker-drain.d.ts

@@ -37,31 +37,31 @@ type WorkerDrainOperationOptions = {
 export declare function createDrainWorkerOperation(options?: WorkerDrainOperationOptions): import("../operation-catalog.ts").OperationDefinition<{
     workerId: string;
     reason?: string | undefined;
-}, WorkerDrainMutationResult>;
+}, WorkerDrainMutationResult, unknown>;
 export declare function createClearWorkerDrainOperation(options?: WorkerDrainOperationOptions): import("../operation-catalog.ts").OperationDefinition<{
     workerId: string;
-}, WorkerDrainMutationResult>;
+}, WorkerDrainMutationResult, unknown>;
 export declare function createDrainDeploymentOperation(options?: WorkerDrainOperationOptions): import("../operation-catalog.ts").OperationDefinition<{
     deploymentName: string;
     reason?: string | undefined;
-}, WorkerDrainMutationResult>;
+}, WorkerDrainMutationResult, unknown>;
 export declare function createClearDeploymentDrainOperation(options?: WorkerDrainOperationOptions): import("../operation-catalog.ts").OperationDefinition<{
     deploymentName: string;
-}, WorkerDrainMutationResult>;
+}, WorkerDrainMutationResult, unknown>;
 export declare const drainWorkerOperation: import("../operation-catalog.ts").OperationDefinition<{
     workerId: string;
     reason?: string | undefined;
-}, WorkerDrainMutationResult>;
+}, WorkerDrainMutationResult, unknown>;
 export declare const clearWorkerDrainOperation: import("../operation-catalog.ts").OperationDefinition<{
     workerId: string;
-}, WorkerDrainMutationResult>;
+}, WorkerDrainMutationResult, unknown>;
 export declare const drainDeploymentOperation: import("../operation-catalog.ts").OperationDefinition<{
     deploymentName: string;
     reason?: string | undefined;
-}, WorkerDrainMutationResult>;
+}, WorkerDrainMutationResult, unknown>;
 export declare const clearDeploymentDrainOperation: import("../operation-catalog.ts").OperationDefinition<{
     deploymentName: string;
-}, WorkerDrainMutationResult>;
+}, WorkerDrainMutationResult, unknown>;
 export declare function createDrainWorkerRestBinding(): UnknownRestBinding;
 export declare function createClearWorkerDrainRestBinding(): UnknownRestBinding;
 export declare function createDrainDeploymentRestBinding(): UnknownRestBinding;

package/dist/server/operations/worker-drain.js

@@ -1,7 +1,8 @@
 import { z } from "zod";
 import { shapeOperationFaultAsJson } from "../operation-fault.js";
 import { defineOperation } from "../operation-registry.js";
-import { invalidParamsFault } from "./operation-helpers.js";
+import { readRestTextBody } from "../rest-body.js";
+import { invalidParamsFault, isOperationFault } from "./operation-helpers.js";
 const drainReasonSchema = z.string().min(1).max(256).optional(), workerDrainInput = z.object({
   workerId: z.string().min(1),
   reason: drainReasonSchema
@@ -153,9 +154,9 @@ function createWorkerDrainRestBinding(method, operationName) {
       workerId: { kind: "path", pathParam: "workerId" },
       ...method === "POST" ? { reason: { kind: "body-field", bodyField: "reason" } } : {}
     },
-    extractInput: async (request, pathParams) => ({
+    extractInput: async (request, pathParams, context) => ({
       workerId: pathParams.workerId ?? "",
-      ...method === "POST" ? await readDrainBody(request) : {}
+      ...method === "POST" ? await readDrainBody(request, context) : {}
     }),
     success: { kind: "json", status: 200 },
     shapeSuccess: shapeDrainSuccess,
@@ -172,9 +173,9 @@ function createDeploymentDrainRestBinding(method, operationName) {
       deploymentName: { kind: "path", pathParam: "deploymentName" },
       ...method === "POST" ? { reason: { kind: "body-field", bodyField: "reason" } } : {}
     },
-    extractInput: async (request, pathParams) => ({
+    extractInput: async (request, pathParams, context) => ({
       deploymentName: pathParams.deploymentName ?? "",
-      ...method === "POST" ? await readDrainBody(request) : {}
+      ...method === "POST" ? await readDrainBody(request, context) : {}
     }),
     success: { kind: "json", status: 200 },
     shapeSuccess: shapeDrainSuccess,
@@ -187,14 +188,16 @@ function shapeDrainSuccess(output) {
     headers: { "Content-Type": "application/json" }
   });
 }
-async function readDrainBody(request) {
-  const text = await request.text();
+async function readDrainBody(request, context) {
+  const text = await readRestTextBody(request, context);
   if (text.trim().length === 0)
     return {};
   let parsed;
   try {
     parsed = JSON.parse(text);
-  } catch {
+  } catch (error) {
+    if (isOperationFault(error))
+      throw error;
     throw invalidParamsFault("Drain request body must be valid JSON");
   }
   if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))

package/dist/server/operations/workflow-events-subscription.d.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { type EventEnvelope } from '../workflow-event-feed.ts';
 declare const workflowEventsSubscriptionInput: z.ZodObject<{
     workflowId: z.ZodString;
     selector: z.ZodDefault<z.ZodOptional<z.ZodEnum<{
@@ -28,13 +29,11 @@ export type WorkflowEventsSubscriptionEnvelope = z.infer<typeof workflowEventsSu
  * subscriptions. This is documented as a known v1 constraint; per-event
  * filtering is a planned future refinement.
  *
- * Access is `scoped: { workflows:read }` (NOT optionalAuth, NOT public).
- * Anonymous callers and authenticated callers without `workflows:read` are
- * both denied. The earlier policies allowed unauthenticated clients to
- * subscribe to arbitrary workflow event streams — a real exposure the
- * security committee flagged. Operators running `serve({ engine })`
- * without auth must add an authentication layer before exposing this
- * endpoint to untrusted networks.
+ * Access is selector-specific: event envelopes require `events:read`, while
+ * token-stream envelopes require `streams:read`. Anonymous callers and
+ * authenticated callers without the matching scope are denied. Operators
+ * running `serve({ engine })` without auth must add an authentication layer
+ * before exposing this endpoint to untrusted networks.
  */
 export declare const workflowEventsSubscriptionOperation: import("../operation-catalog.ts").OperationDefinition<{
     workflowId: string;
@@ -43,5 +42,5 @@ export declare const workflowEventsSubscriptionOperation: import("../operation-c
 }, {
     subscriptionId: string;
     cursor: string;
-}>;
+}, EventEnvelope>;
 export {};

package/dist/server/operations/workflow-events-subscription.js

@@ -1,9 +1,14 @@
 import { z } from "zod";
 import { defineOperation } from "../operation-registry.js";
-const INITIAL_SUBSCRIPTION_CURSOR = "-1", workflowEventsSubscriptionInput = z.object({
+import { isAuthenticated } from "../principal.js";
+import {
+  decodeCursor
+} from "../workflow-event-feed.js";
+import { invalidParamsFault } from "./operation-helpers.js";
+const INITIAL_SUBSCRIPTION_CURSOR = "-1", MAX_WORKFLOW_SUBSCRIPTION_REPLAY_EVENTS = 1000, workflowEventsSubscriptionInput = z.object({
   workflowId: z.string().min(1),
   selector: z.enum(["events", "tokens"]).optional().default("events"),
-  fromCursor: z.string().optional()
+  fromCursor: z.string().refine((cursor) => decodeCursor(cursor) !== null, { message: "Invalid cursor" }).optional()
 }), workflowEventsSubscriptionEnvelope = z.object({
   subscriptionId: z.string(),
   cursor: z.string()
@@ -13,10 +18,12 @@ export const workflowEventsSubscriptionOperation = defineOperation({
   mcpExposable: !1,
   kind: "subscription",
   summary: "Subscribe to workflow events with replay-from-cursor",
+  description: '`selector: "events"` requires `events:read`; `selector: "tokens"` requires `streams:read`. The grant is checked when the WebSocket subscription starts and remains active until unsubscribe, socket close, or feed termination.',
   destructive: !1,
   tags: ["Events"],
   inputSchema: workflowEventsSubscriptionInput,
   outputSchema: workflowEventsSubscriptionEnvelope,
+  producibleFaults: ["InvalidParams"],
   eventSchema: z.object({
     kind: z.string(),
     workflowId: z.string(),
@@ -26,20 +33,45 @@ export const workflowEventsSubscriptionOperation = defineOperation({
     emittedAtMs: z.number(),
     payload: z.unknown()
   }),
-  access: {
-    kind: "scoped",
-    scopes: { kind: "anyOf", scopes: ["workflows:read"] }
+  access: { kind: "authenticated" },
+  parameterizedAccess: {
+    discriminator: "selector",
+    defaultValue: "events",
+    variants: [
+      {
+        value: "events",
+        access: { kind: "scoped", scopes: { kind: "anyOf", scopes: ["events:read"] } }
+      },
+      {
+        value: "tokens",
+        access: { kind: "scoped", scopes: { kind: "anyOf", scopes: ["streams:read"] } }
+      }
+    ]
+  },
+  authorize: async ({ input, principal }) => {
+    const requiredScope = workflowSubscriptionScope(input.selector);
+    if (!isAuthenticated(principal))
+      return { allowed: !1, classification: "unauthorized", reason: "authentication required" };
+    if (principal.hasScope(requiredScope))
+      return { allowed: !0 };
+    return {
+      allowed: !1,
+      classification: "forbidden",
+      reason: `requires scope: ${requiredScope}`
+    };
   },
   discoverable: !0,
   transports: { http: !1, jsonRpcHttp: !1, jsonRpcWebSocket: !0, jsonRpcStdio: !1 },
   unknownKeyPolicy: { http: "strip", jsonRpc: "reject" },
   invoke: async ({ input, engine }) => {
-    const feed = engine.feed, controller = new AbortController, startingCursor = input.fromCursor ?? INITIAL_SUBSCRIPTION_CURSOR, iterable = feed.subscribe({
+    const feed = engine.feed, controller = new AbortController, startingCursor = input.fromCursor ?? INITIAL_SUBSCRIPTION_CURSOR, subscribeOptions = {
       workflowId: input.workflowId,
       selector: input.selector,
       ...input.fromCursor === void 0 ? {} : { fromCursor: input.fromCursor },
-      signal: controller.signal
-    });
+      signal: controller.signal,
+      replayLimit: MAX_WORKFLOW_SUBSCRIPTION_REPLAY_EVENTS,
+      createReplayLimitError: (count, limit) => invalidParamsFault(`Workflow event replay window is ${count} events; maximum is ${limit}. Supply a more recent fromCursor.`)
+    }, iterable = feed.subscribe(subscribeOptions);
     return {
       envelope: { subscriptionId: `sub_${crypto.randomUUID()}`, cursor: startingCursor },
       iterable,
@@ -49,3 +81,6 @@ export const workflowEventsSubscriptionOperation = defineOperation({
     };
   }
 });
+function workflowSubscriptionScope(selector) {
+  return selector === "tokens" ? "streams:read" : "events:read";
+}

package/dist/server/rest-binding.d.ts

@@ -12,6 +12,7 @@
  */
 import { WeftError } from '../core/weft-error.ts';
 import type { OperationFault } from './operation-fault.ts';
+import type { RestBodyReadOptions } from './rest-body.ts';
 import type { HttpMethod } from './route-model.ts';
 /**
  * Thrown by `bindingPathMatches` when a URL path parameter contains malformed
@@ -59,6 +60,7 @@ export type ResponseShape = {
     readonly kind: 'streaming';
     readonly mediaType: 'text/event-stream' | 'application/octet-stream' | 'application/x-ndjson';
 };
+export type RestInputContext = RestBodyReadOptions;
 /**
  * Binds a REST mount point to an `OperationDefinition`. Generic over
  * `Input` / `Output` so `extractInput` returns a value the operation's
@@ -91,7 +93,7 @@ export type RestBinding<Input, Output> = {
      * Called before `executeOperation`; the returned value is what the
      * pipeline's schema parse step sees.
      */
-    readonly extractInput: (request: Request, pathParams: Record<string, string>) => Promise<Input>;
+    readonly extractInput: (request: Request, pathParams: Record<string, string>, context: RestInputContext) => Promise<Input>;
     /** Canonical response shape — OpenAPI reads this, handler may override via `shapeSuccess`. */
     readonly success: ResponseShape;
     /**

package/dist/server/rest-bindings.js

@@ -25,6 +25,10 @@ import {
   bulkMutateWorkflowTagsOperation,
   bulkMutateWorkflowTagsRestBinding
 } from "./operations/bulk-mutate-workflow-tags.js";
+import {
+  bulkRetryFailedWorkflowsOperation,
+  bulkRetryFailedWorkflowsRestBinding
+} from "./operations/bulk-retry-failed-workflows.js";
 import {
   bulkSignalWorkflowsOperation,
   bulkSignalWorkflowsRestBinding
@@ -41,6 +45,7 @@ import {
   createScheduleOperation,
   createScheduleRestBinding
 } from "./operations/create-schedule.js";
+import { fleetEventsSubscriptionOperation } from "./operations/fleet-events-subscription.js";
 import { forkWorkflowOperation, forkWorkflowRestBinding } from "./operations/fork-workflow.js";
 import {
   getCheckpointAtOperation,
@@ -62,6 +67,8 @@ import {
   createGetSystemMetricsRestBinding
 } from "./operations/get-system-metrics.js";
 import {
+  clearTaskDeadLetterOperation,
+  clearTaskDeadLetterRestBinding,
   createGetTaskDiagnosticsOperation,
   getTaskDiagnosticsOperation,
   getTaskDiagnosticsRestBinding
@@ -206,6 +213,7 @@ export const REST_BINDINGS = [
   purgeWorkflowsRestBinding,
   bulkCancelWorkflowsRestBinding,
   bulkSignalWorkflowsRestBinding,
+  bulkRetryFailedWorkflowsRestBinding,
   bulkDeleteWorkflowsRestBinding,
   bulkMutateWorkflowTagsRestBinding,
   getWorkflowRestBinding,
@@ -243,6 +251,7 @@ export const REST_BINDINGS = [
   getStreamChunksRestBinding,
   streamWorkflowSseRestBinding,
   getTaskDiagnosticsRestBinding,
+  clearTaskDeadLetterRestBinding,
   listSchedulesRestBinding,
   getScheduleRestBinding,
   replayWorkflowRestBinding,
@@ -331,6 +340,7 @@ export function createLiveOperationRegistry(options) {
     purgeWorkflowsOperation,
     bulkCancelWorkflowsOperation,
     bulkSignalWorkflowsOperation,
+    bulkRetryFailedWorkflowsOperation,
     bulkDeleteWorkflowsOperation,
     bulkMutateWorkflowTagsOperation,
     getWorkflowOperation,
@@ -367,7 +377,9 @@ export function createLiveOperationRegistry(options) {
     getStreamChunksOperation,
     streamWorkflowSseOperation,
     workflowEventsSubscriptionOperation,
+    fleetEventsSubscriptionOperation,
     buildTaskDiagnosticsOperationForRegistry(resolved),
+    clearTaskDeadLetterOperation,
     listSchedulesOperation,
     getScheduleOperation,
     replayWorkflowOperation,

package/dist/server/rest-body.d.ts

@@ -0,0 +1,10 @@
+import type { OperationFault } from './operation-fault.ts';
+export declare const DEFAULT_REST_MAX_BODY_BYTES: number;
+export type RestBodyReadOptions = {
+    readonly maxBodyBytes?: number;
+};
+export declare function payloadTooLargeFault(maxBytes: number): OperationFault;
+export declare function readRestBodyBounded(request: Request, options?: RestBodyReadOptions): Promise<Uint8Array>;
+export declare function readRestTextBody(request: Request, options?: RestBodyReadOptions): Promise<string>;
+export declare function readRestJsonBody(request: Request, options?: RestBodyReadOptions): Promise<unknown>;
+export declare function readOptionalRestJsonBody(request: Request, options?: RestBodyReadOptions): Promise<unknown>;

package/dist/server/rest-body.js

@@ -0,0 +1,80 @@
+export const DEFAULT_REST_MAX_BODY_BYTES = 1048576;
+const CONTENT_LENGTH_PATTERN = /^(0|[1-9]\d*)$/;
+export function payloadTooLargeFault(maxBytes) {
+  return {
+    code: "PayloadTooLarge",
+    message: "Payload Too Large",
+    data: { maxBytes }
+  };
+}
+function invalidContentLengthFault() {
+  return {
+    code: "InvalidParams",
+    message: "Invalid Content-Length header",
+    data: { issues: [] }
+  };
+}
+function resolveMaxBodyBytes(options) {
+  const maxBytes = options?.maxBodyBytes ?? DEFAULT_REST_MAX_BODY_BYTES;
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < 0)
+    throw Error("REST body size limit must be a non-negative safe integer");
+  return maxBytes;
+}
+function assertDeclaredContentLengthWithinLimit(request, maxBytes) {
+  const header = request.headers.get("content-length");
+  if (header === null)
+    return;
+  if (!CONTENT_LENGTH_PATTERN.test(header))
+    throw invalidContentLengthFault();
+  const declared = Number(header);
+  if (!Number.isSafeInteger(declared) || declared < 0)
+    throw invalidContentLengthFault();
+  if (declared > maxBytes)
+    throw payloadTooLargeFault(maxBytes);
+}
+async function cancelReaderAfterPayloadOverflow(reader) {
+  try {
+    await reader.cancel();
+  } catch {}
+}
+export async function readRestBodyBounded(request, options) {
+  const maxBytes = resolveMaxBodyBytes(options);
+  assertDeclaredContentLengthWithinLimit(request, maxBytes);
+  const body = request.body;
+  if (body === null)
+    return new Uint8Array;
+  const reader = body.getReader(), chunks = [];
+  let total = 0;
+  try {
+    while (!0) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      total += value.byteLength;
+      if (total > maxBytes) {
+        await cancelReaderAfterPayloadOverflow(reader);
+        throw payloadTooLargeFault(maxBytes);
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return bytes;
+}
+export async function readRestTextBody(request, options) {
+  return new TextDecoder("utf-8").decode(await readRestBodyBounded(request, options));
+}
+export async function readRestJsonBody(request, options) {
+  return JSON.parse(await readRestTextBody(request, options));
+}
+export async function readOptionalRestJsonBody(request, options) {
+  const text = await readRestTextBody(request, options);
+  return text.trim() === "" ? void 0 : JSON.parse(text);
+}

package/dist/server/runtime/authentication-bridge.d.ts

@@ -11,6 +11,7 @@ type ServerFetchOptions = {
     discoveryInfo?: import('../discovery-info.ts').DiscoveryInfo;
     publicOrigin?: string;
     trustedHosts?: ReadonlyArray<string>;
+    maxRequestBodyBytes?: number;
 };
 export declare function deriveSupportedOpenApiSecuritySchemes(auth: AuthConfig | undefined): ReadonlySet<OpenApiSecuritySchemeName>;
 export declare function handleServerFetchRequest(server: ReturnType<typeof Bun.serve>, context: ServerContext, options: ServerFetchOptions, originalRequest: Request): Promise<Response | undefined>;

package/dist/server/runtime/authentication-bridge.js

@@ -1,4 +1,5 @@
 import { decode } from "../../core/codec.js";
+import { WorkerDisconnectedEvent } from "../../core/events.js";
 import { handleMcpHttpRequest } from "../../mcp/http.js";
 import { KEYS } from "../../storage/interface.js";
 import { authContextToPrincipal, handleRequest } from "../handler.js";
@@ -13,7 +14,15 @@ import { buildPreflightResponse, decorateResponseWithCors, isPreflightRequest }
 import { gateRequest } from "./request-gate.js";
 import { handleTaskPollRequest, handleTaskResultRequest } from "./task-polling.js";
 import { reassignOrExpireTask } from "./task-reconciliation.js";
-import { addStreamSocket, removeStreamSocket, replayTokenStream } from "./websocket-stream.js";
+import {
+  addStreamSocket,
+  addWatchSocket,
+  removeStreamSocket,
+  removeWatchSocket,
+  removeWorkflowStreamConnection,
+  replayTokenStream,
+  replayWatchEvents
+} from "./websocket-stream.js";
 import { handleWebSocketUpgrade } from "./websocket-upgrade.js";
 import { handleWorkerWebSocketMessage, isInflightRecord } from "./websocket-worker.js";
 export function deriveSupportedOpenApiSecuritySchemes(auth) {
@@ -72,7 +81,8 @@ async function dispatchServerFetchRequest(server, context, options, originalRequ
       request,
       registry: context.liveOperationRegistry,
       engine: options.engine,
-      authContext: authentication.authContext
+      authContext: authentication.authContext,
+      ...options.maxRequestBodyBytes !== void 0 ? { maxBodyBytes: options.maxRequestBodyBytes } : {}
     });
   return handleRequest(request, options.engine, buildHandlerOptions(context, options, authentication));
 }
@@ -83,6 +93,7 @@ function buildHandlerOptions(context, options, authentication) {
     ...options.discoveryInfo !== void 0 ? { discoveryInfo: options.discoveryInfo } : {},
     ...options.publicOrigin !== void 0 ? { publicOrigin: options.publicOrigin } : {},
     ...options.trustedHosts !== void 0 ? { trustedHosts: options.trustedHosts } : {},
+    ...options.maxRequestBodyBytes !== void 0 ? { maxRequestBodyBytes: options.maxRequestBodyBytes } : {},
     operationRegistry: context.liveOperationRegistry,
     restBindings: context.liveRestBindings,
     supportedAuthenticationSchemes: context.supportedAuthenticationSchemes
@@ -92,12 +103,20 @@ export function createServerWebSocketHandlers(context, options, cleanupWorkflowI
   return {
     open(ws) {
       const { pathname, connectionType, workflowId } = ws.data;
-      if (pathname && connectionType !== "stream" && connectionType !== "jsonrpc")
+      if (connectionType === "watch" && workflowId && !addWatchSocket(context, workflowId, ws))
+        return;
+      if (connectionType === "watch" && workflowId) {
+        ws.data.watchReplayInProgress = !0;
+        ws.data.pendingWatchMessages = [];
+        replayWatchEvents(context, options.engine, ws, workflowId);
+      }
+      if (pathname && connectionType !== "stream" && connectionType !== "watch" && connectionType !== "jsonrpc")
         ws.subscribe(pathname);
       if (connectionType === "stream" && workflowId) {
-        ws.data.replayInProgress = !0;
+        ws.data.streamReplayInProgress = !0;
         ws.data.pendingStreamMessages = [];
-        addStreamSocket(context, workflowId, ws);
+        if (!addStreamSocket(context, workflowId, ws))
+          return;
         replayTokenStream(context, options.engine, ws, workflowId);
       }
       if (connectionType === "jsonrpc") {
@@ -106,6 +125,7 @@ export function createServerWebSocketHandlers(context, options, cleanupWorkflowI
           registry: context.liveOperationRegistry,
           engine: options.engine,
           feed: context.workflowEventFeed,
+          fleetFeed: context.fleetEventFeed,
           activeSessions: context.activeJsonRpcSessions
         });
         return;
@@ -133,8 +153,14 @@ export function createServerWebSocketHandlers(context, options, cleanupWorkflowI
         });
         return;
       }
-      if (ws.data.connectionType === "stream")
+      if (ws.data.connectionType === "stream") {
         removeStreamSocket(context, ws);
+        removeWorkflowStreamConnection(context, ws);
+      }
+      if (ws.data.connectionType === "watch") {
+        removeWatchSocket(context, ws);
+        removeWorkflowStreamConnection(context, ws);
+      }
       const workerId = ws.data.workerId;
       if (workerId) {
         if (context.workerSockets.get(workerId) !== ws) {
@@ -167,6 +193,7 @@ function runWorkerDisconnectRequeue(context, options, workerId, _ws, cleanupWork
   }
   context.registry.unregister(workerId);
   context.workerSockets.delete(workerId);
+  options.engine.dispatchEvent(new WorkerDisconnectedEvent(workerId, inFlightTasks.length));
   for (const [workflowId, affinityWorkerId] of context.workerAffinity)
     if (affinityWorkerId === workerId)
       context.workerAffinity.delete(workflowId);

package/dist/server/runtime/client-visible-events.d.ts

@@ -0,0 +1,3 @@
+export declare const TOKEN_EVENT_TYPE = "stream:token";
+export declare const EVENTS_READ_EVENT_TYPES: readonly ["workflow:started", "workflow:completed", "workflow:failed", "workflow:cancelled", "workflow:timed-out", "workflow:resumed", "workflow:suspended", "workflow:teardown", "activity:started", "activity:completed", "activity:failed", "activity:async-pending", "task:dead-lettered", "signal:received", "signal:delivered", "attributes:changed", "update:received", "update:completed", "schedule:fired", "schedule:missed-fire", "checkpoint:size-warning", "development:warning", "cleanup:warning", "storage:size-reported", "human-review:requested", "human-review:completed", "alert:fired", "alert:resolved", "constraint:violated", "worker:connected", "worker:disconnected"];
+export declare const CLIENT_VISIBLE_EVENT_TYPES: readonly ["workflow:started", "workflow:completed", "workflow:failed", "workflow:cancelled", "workflow:timed-out", "workflow:resumed", "workflow:suspended", "workflow:teardown", "activity:started", "activity:completed", "activity:failed", "activity:async-pending", "task:dead-lettered", "signal:received", "signal:delivered", "attributes:changed", "update:received", "update:completed", "schedule:fired", "schedule:missed-fire", "checkpoint:size-warning", "development:warning", "cleanup:warning", "storage:size-reported", "human-review:requested", "human-review:completed", "alert:fired", "alert:resolved", "constraint:violated", "worker:connected", "worker:disconnected", "stream:token"];

package/dist/server/runtime/client-visible-events.js

@@ -0,0 +1,65 @@
+import {
+  ActivityAsyncPendingEvent,
+  ActivityCompletedEvent,
+  ActivityFailedEvent,
+  ActivityStartedEvent,
+  AlertFiredEvent,
+  AlertResolvedEvent,
+  AttributesChangedEvent,
+  CheckpointSizeWarningEvent,
+  CleanupWarningEvent,
+  ConstraintViolatedEvent,
+  DevelopmentWarningEvent,
+  ScheduleFiredEvent,
+  ScheduleMissedFireEvent,
+  SignalDeliveredEvent,
+  SignalReceivedEvent,
+  StorageSizeReportedEvent,
+  TaskResultDeadLetteredEvent,
+  UpdateCompletedEvent,
+  UpdateReceivedEvent,
+  WorkerConnectedEvent,
+  WorkerDisconnectedEvent,
+  WorkflowCancelledEvent,
+  WorkflowCompletedEvent,
+  WorkflowFailedEvent,
+  WorkflowResumedEvent,
+  WorkflowStartedEvent,
+  WorkflowSuspendedEvent,
+  WorkflowTeardownEvent,
+  WorkflowTimedOutEvent
+} from "../../core/events.js";
+import { ReviewCompletedEvent, ReviewRequestedEvent } from "../../core/review/events.js";
+export const TOKEN_EVENT_TYPE = "stream:token", EVENTS_READ_EVENT_TYPES = [
+  WorkflowStartedEvent.type,
+  WorkflowCompletedEvent.type,
+  WorkflowFailedEvent.type,
+  WorkflowCancelledEvent.type,
+  WorkflowTimedOutEvent.type,
+  WorkflowResumedEvent.type,
+  WorkflowSuspendedEvent.type,
+  WorkflowTeardownEvent.type,
+  ActivityStartedEvent.type,
+  ActivityCompletedEvent.type,
+  ActivityFailedEvent.type,
+  ActivityAsyncPendingEvent.type,
+  TaskResultDeadLetteredEvent.type,
+  SignalReceivedEvent.type,
+  SignalDeliveredEvent.type,
+  AttributesChangedEvent.type,
+  UpdateReceivedEvent.type,
+  UpdateCompletedEvent.type,
+  ScheduleFiredEvent.type,
+  ScheduleMissedFireEvent.type,
+  CheckpointSizeWarningEvent.type,
+  DevelopmentWarningEvent.type,
+  CleanupWarningEvent.type,
+  StorageSizeReportedEvent.type,
+  ReviewRequestedEvent.type,
+  ReviewCompletedEvent.type,
+  AlertFiredEvent.type,
+  AlertResolvedEvent.type,
+  ConstraintViolatedEvent.type,
+  WorkerConnectedEvent.type,
+  WorkerDisconnectedEvent.type
+], CLIENT_VISIBLE_EVENT_TYPES = [...EVENTS_READ_EVENT_TYPES, TOKEN_EVENT_TYPE];

package/dist/server/runtime/context.d.ts

@@ -5,6 +5,7 @@ import type { WorkerRegistry } from '../../worker/registry.ts';
 import type { Authenticator, RateLimiter } from '../authentication.ts';
 import type { DeadlineTracker } from '../deadline-tracker.ts';
 import type { createEngineEventFeedBackend } from '../engine-event-feed-backend.ts';
+import type { FleetEventFeed } from '../fleet-event-feed.ts';
 import type { WebSocketData } from '../json-rpc-websocket-runtime.ts';
 import type { JsonRpcWebSocketSession } from '../json-rpc-websocket.ts';
 import type { OpenApiSecuritySchemeName } from '../openapi.ts';
@@ -23,6 +24,9 @@ export interface ServerContext {
     readonly taskQueue: TaskQueue;
     readonly workerSockets: Map<string, ServerWebSocket<WebSocketData>>;
     readonly streamSockets: Map<string, Set<ServerWebSocket<WebSocketData>>>;
+    readonly watchSockets: Map<string, Set<ServerWebSocket<WebSocketData>>>;
+    readonly workflowStreamConnectionCounts: Map<string, number>;
+    readonly maxStreamConnectionsPerWorkflow: number;
     /** Tracks per-workflow worker affinity for sticky routing. Maps workflowId to workerId. */
     readonly workerAffinity: Map<string, string>;
     /** Reverse index: workflowId to set of operationIds currently in-flight for that workflow. */
@@ -42,6 +46,7 @@ export interface ServerContext {
     readonly metricsCollector: MetricsCollector;
     readonly eventFeedBackend: ReturnType<typeof createEngineEventFeedBackend>;
     readonly workflowEventFeed: WorkflowEventFeed;
+    readonly fleetEventFeed: FleetEventFeed;
     readonly activeJsonRpcSessions: Set<JsonRpcWebSocketSession>;
     readonly mcpSessionManager: McpSessionManager;
     readonly authenticatorPromise: Promise<Authenticator> | null;
@@ -59,6 +64,8 @@ export interface ServerContext {
      * this window cancels the pending requeue. `0` means inline requeue.
      */
     readonly workerReconnectGracePeriodMs: number;
+    /** Engine-level cap for activity results delivered by remote workers. */
+    readonly payloadSizeMaxBytes: number | null;
     /**
      * Pending requeue timers keyed by `workerId`. A successful re-register clears
      * the timer for that worker, suppressing the deferred requeue.