@lostgradient/weft 0.7.0 → 0.8.0

package/dist/server/runtime/websocket-worker.js

@@ -74,11 +74,16 @@ function registerWorker(context, options, ws, message) {
     rejectRegistration(ws, "invalid_registration", "Worker registration requires the workers:write scope", message.protocolVersion);
     return;
   }
-  const rawConcurrency = message.concurrency ?? DEFAULT_WORKER_CONCURRENCY, clampedConcurrency = Math.min(Math.max(1, Math.floor(rawConcurrency)), MAX_WORKER_CONCURRENCY), queue = ws.data.queue ?? "default", pendingRequeue = context.pendingWorkerRequeues.get(message.workerId);
-  if (pendingRequeue !== void 0) {
+  const rawConcurrency = message.concurrency ?? DEFAULT_WORKER_CONCURRENCY, clampedConcurrency = Math.min(Math.max(1, Math.floor(rawConcurrency)), MAX_WORKER_CONCURRENCY), queue = ws.data.queue ?? "default", pendingRequeue = context.pendingWorkerRequeues.get(message.workerId), isGracePeriodReconnect = pendingRequeue !== void 0;
+  if (isGracePeriodReconnect) {
     clearTimeout(pendingRequeue);
     context.pendingWorkerRequeues.delete(message.workerId);
   }
+  const existingSocket = context.workerSockets.get(message.workerId);
+  if (!isGracePeriodReconnect && existingSocket !== void 0 && existingSocket !== ws) {
+    rejectRegistration(ws, "invalid_registration", "workerId is already registered to an active connection", message.protocolVersion);
+    return;
+  }
   ws.data.workerId = message.workerId;
   ws.data.workerRegistered = !0;
   ws.data.workerProtocolVersion = message.protocolVersion;

package/dist/server/serve-internals.d.ts

@@ -11,6 +11,27 @@ import type { WebSocketData } from './json-rpc-websocket-runtime.ts';
 import { createServerWebSocketHandlers } from './runtime/authentication-bridge.ts';
 import type { ServerContext } from './runtime/context.ts';
 import { type EventBroadcastingHandle } from './runtime/event-broadcasting.ts';
+/**
+ * Hard ceiling on the raw WebSocket frame size for every connection (worker
+ * stream, `/watch`, token `/stream`, and JSON-RPC). Bun's default is 16 MiB;
+ * this caps the frame at the transport layer before any JSON parse, so a
+ * malicious peer cannot force a 16 MiB parse per message. A bounded 4 MiB parse
+ * is not a CPU-burn, so this constant ceiling fully closes the DoS on its own.
+ *
+ * This is deliberately NOT derived from `payloadSize.maxBytes`. That option is
+ * an application-level admission policy measured on the codec-encoded (msgpack)
+ * byte length of the bare value, whereas `maxPayloadLength` bounds the raw
+ * UTF-8 JSON frame (envelope plus JSON-serialized value) — different units.
+ * Tightening the frame limit down to a smaller `payloadSize.maxBytes` would
+ * reject legitimate frames whose value is within the admission cap (JSON and
+ * envelope overhead inflate the frame past the msgpack value size) with an
+ * opaque transport close instead of a clean `PayloadSizeExceededError`, across
+ * every shared WebSocket endpoint — for no additional DoS protection. Value
+ * size stays enforced by the post-parse admission check.
+ *
+ * @internal Exported only for test assertions.
+ */
+export declare const WEBSOCKET_MAX_PAYLOAD_BYTES: number;
 /**
  * @internal
  *
@@ -77,6 +98,13 @@ export declare function cleanupWorkflowIndex(context: ServerContext, operationId
 /**
  * Assembles the `Bun.serve()` options object. Separating this avoids a
  * conditional spread (`...(tlsOptions ? { tls } : {})`) inside `serve()`.
+ *
+ * Sets a constant `maxPayloadLength` of `WEBSOCKET_MAX_PAYLOAD_BYTES` (4 MiB)
+ * so Bun rejects oversized frames at the transport layer before any JSON parse
+ * occurs. The cap is intentionally a fixed transport-safety ceiling, not
+ * derived from `payloadSize.maxBytes` (see that constant's docs for why mixing
+ * the raw-frame limit with the application value-size policy would cause false
+ * rejections in the wrong unit).
  */
 export declare function buildBunServeConfig(port: number, hostname: string, development: boolean, routes: Bun.Serve.Routes<WebSocketData, string>, tlsOptions: ReturnType<typeof buildTLSOptions>, fetchHandler: (request: Request) => Promise<Response | undefined>, websocketCallbacks: ReturnType<typeof createServerWebSocketHandlers>): Parameters<typeof Bun.serve<WebSocketData>>[0];
 /**

package/dist/server/serve-internals.js

@@ -30,7 +30,9 @@ import { DEFAULT_MAX_STREAM_CONNECTIONS_PER_WORKFLOW } from "./runtime/websocket
 import { isInflightRecord, withRetry } from "./runtime/websocket-worker.js";
 import { TaskQueue } from "./task-queue.js";
 import { createWorkflowEventFeed } from "./workflow-event-feed.js";
-const RECONCILIATION_MULTIPLIER = 12, DEFAULT_WORKER_RECONNECT_GRACE_PERIOD_MS = 2000, MAX_WORKER_RECONNECT_GRACE_PERIOD_MS = 5000, AUTHENTICATION_REQUIRED_ENVIRONMENT_VARIABLE = "WEFT_SERVER_AUTHENTICATION_REQUIRED";
+const RECONCILIATION_MULTIPLIER = 12, DEFAULT_WORKER_RECONNECT_GRACE_PERIOD_MS = 2000, MAX_WORKER_RECONNECT_GRACE_PERIOD_MS = 5000;
+export const WEBSOCKET_MAX_PAYLOAD_BYTES = 4194304;
+const AUTHENTICATION_REQUIRED_ENVIRONMENT_VARIABLE = "WEFT_SERVER_AUTHENTICATION_REQUIRED";
 export const NO_AUTHENTICATION_WARNING = '[weft] WARNING: server started with NO authentication; all non-public operations are publicly accessible. Configure serve({ auth }) to lock down, or set unauthenticatedAccess: "reject" in production to fail closed.', MCP_ORIGIN_CONFIGURATION_WARNING = '[weft] WARNING: MCP HTTP transport is enabled without publicOrigin or trustedHosts. Cross-origin /mcp requests are rejected, and discovery routes that emit absolute URLs return 503. Configure serve({ publicOrigin: "https://api.example.com" }) or serve({ trustedHosts: ["api.example.com"] }) before exposing the server through a browser or reverse proxy.';
 const NO_AUTHENTICATION_REJECT_ERROR = '[weft] Refusing to start server with no authentication. Configure serve({ auth }) or set unauthenticatedAccess: "allow" only for trusted local development.', NO_AUTHENTICATION_ENVIRONMENT_ERROR = "[weft] Refusing to start server with no authentication because WEFT_SERVER_AUTHENTICATION_REQUIRED requires authentication. Configure serve({ auth }) or unset WEFT_SERVER_AUTHENTICATION_REQUIRED only for trusted local development.", TRUTHY_AUTHENTICATION_REQUIREMENT_VALUES = new Set(["1", "true", "yes", "on"]), FALSY_AUTHENTICATION_REQUIREMENT_VALUES = new Set(["0", "false", "no", "off"]);
 export function clampWorkerReconnectGracePeriod(value) {
@@ -149,7 +151,7 @@ export function buildBunServeConfig(port, hostname, development, routes, tlsOpti
     development,
     routes,
     fetch: fetchHandler,
-    websocket: websocketCallbacks
+    websocket: { ...websocketCallbacks, maxPayloadLength: WEBSOCKET_MAX_PAYLOAD_BYTES }
   };
   if (tlsOptions)
     config.tls = tlsOptions;