@lostgradient/weft 0.7.0 → 0.9.0

package/dist/server/operations/create-schedule.d.ts

@@ -6,6 +6,7 @@ declare const createScheduleInput: z.ZodObject<{
     every: z.ZodOptional<z.ZodUnknown>;
     input: z.ZodOptional<z.ZodUnknown>;
     id: z.ZodOptional<z.ZodUnknown>;
+    description: z.ZodOptional<z.ZodUnknown>;
     overlap: z.ZodOptional<z.ZodUnknown>;
     backfill: z.ZodOptional<z.ZodUnknown>;
     jitter: z.ZodOptional<z.ZodUnknown>;
@@ -21,6 +22,7 @@ export declare const createScheduleOperation: import("../operation-catalog.ts").
     every?: unknown;
     input?: unknown;
     id?: unknown;
+    description?: unknown;
     overlap?: unknown;
     backfill?: unknown;
     jitter?: unknown;

package/dist/server/operations/create-schedule.js

@@ -14,6 +14,7 @@ const VALID_SCHEDULE_OVERLAP_POLICIES = new Set([
   every: z.unknown().optional().describe("Interval period (duration string or milliseconds). Supply exactly one of cronExpression or every."),
   input: z.unknown().optional(),
   id: z.unknown().optional(),
+  description: z.unknown().optional().describe("Operator-facing schedule description. Runtime validation requires a string."),
   overlap: z.unknown().optional(),
   backfill: z.unknown().optional(),
   jitter: z.unknown().optional()
@@ -32,6 +33,12 @@ function validateOptionalScheduleFields(input) {
       throw invalidParamsFault('Field "id" must be a non-empty string');
     validatedId = input.id;
   }
+  let validatedDescription;
+  if (input.description !== void 0) {
+    if (typeof input.description !== "string")
+      throw invalidParamsFault('Field "description" must be a string');
+    validatedDescription = input.description;
+  }
   let validatedOverlap;
   if (input.overlap !== void 0) {
     if (typeof input.overlap !== "string" || !isScheduleOverlapPolicy(input.overlap))
@@ -52,14 +59,15 @@ function validateOptionalScheduleFields(input) {
   }
   return {
     id: validatedId,
+    description: validatedDescription,
     overlap: validatedOverlap,
     backfill: validatedBackfill,
     jitter: validatedJitter
   };
 }
 function validateCreateScheduleInput(input) {
-  const { type, spec } = validateRequiredScheduleFields(input), { id, overlap, backfill, jitter } = validateOptionalScheduleFields(input);
-  return { type, spec, id, overlap, backfill, jitter };
+  const { type, spec } = validateRequiredScheduleFields(input), { id, description, overlap, backfill, jitter } = validateOptionalScheduleFields(input);
+  return { type, spec, id, description, overlap, backfill, jitter };
 }
 export const createScheduleOperation = defineOperation({
   name: "weft.schedules.create",
@@ -77,6 +85,7 @@ export const createScheduleOperation = defineOperation({
   invoke: async ({ input, engine }) => {
     const typedEngine = engine, validated = validateCreateScheduleInput(input), options = {
       ...validated.id !== void 0 ? { id: validated.id } : {},
+      ...validated.description !== void 0 ? { description: validated.description } : {},
       ...validated.overlap !== void 0 ? { overlap: validated.overlap } : {},
       ...validated.backfill !== void 0 ? { backfill: validated.backfill } : {},
       ...validated.jitter !== void 0 ? { jitter: validated.jitter } : {}
@@ -102,6 +111,7 @@ export const createScheduleRestBinding = {
     every: { kind: "body-field", bodyField: "every" },
     input: { kind: "body-field", bodyField: "input" },
     id: { kind: "body-field", bodyField: "id" },
+    description: { kind: "body-field", bodyField: "description" },
     overlap: { kind: "body-field", bodyField: "overlap" },
     backfill: { kind: "body-field", bodyField: "backfill" },
     jitter: { kind: "body-field", bodyField: "jitter" }
@@ -124,6 +134,7 @@ export const createScheduleRestBinding = {
       every: Object.hasOwn(record, "every") ? record.every : void 0,
       input: record.input,
       id: record.id,
+      description: record.description,
       overlap: record.overlap,
       backfill: record.backfill,
       jitter: record.jitter

package/dist/server/rest-binding.d.ts

@@ -131,7 +131,7 @@ export type RestBinding<Input, Output> = {
      * detail (for example, `get-workflow-result` returns the custom message
      * `"Timeout waiting for workflow result"` on a `Timeout`, and `get-stream-chunks`
      * handles `InvalidParams` inline). This per-operation hook is the current
-     * contract, not a transitional shim.
+     * contract.
      */
     readonly shapeFault?: (fault: OperationFault) => Response;
 };

package/dist/server/runtime/task-dispatch.js

@@ -74,6 +74,7 @@ async function selectAndReserveWorker(context, options, task, queue, visibilityT
     visibilityTimeout,
     retryPolicy: task.retryPolicy,
     workflowId: task.workflowId,
+    workflowExecutionToken: task.workflowExecutionToken,
     attemptToken
   }, normalizedInflightRecord = await transitionQueuedToInflight(options.engine.storage, task.operationId, inflightRecord, {
     queuedRecord: existingQueuedRecord,
@@ -86,6 +87,9 @@ async function selectAndReserveWorker(context, options, task, queue, visibilityT
     input: task.input === void 0 ? null : task.input,
     attempt: task.attempt ?? 1,
     attemptToken,
+    ...task.workflowExecutionToken !== void 0 && {
+      workflowExecutionToken: task.workflowExecutionToken
+    },
     ...task.headers ? { headers: task.headers } : {}
   }));
   recordTaskQueueLatencyMetric(context.metricsCollector, normalizedInflightRecord);
@@ -116,6 +120,7 @@ async function enqueueTaskForLongPoll(context, options, task, queue, visibilityT
     retryPolicy: task.retryPolicy,
     queuedAt: Date.now(),
     workflowId: task.workflowId,
+    workflowExecutionToken: task.workflowExecutionToken,
     retryCount: Math.max(0, attempt - 1),
     requeueCount: 0
   }, existingQueuedRecord = await readQueuedRecord(options.engine.storage, task.operationId), normalizedQueuedRecord = await markQueued(options.engine.storage, mergeQueuedRecordLifecycle(freshRecord, existingQueuedRecord)), enqueued = context.taskQueue.enqueue(queue, {
@@ -126,6 +131,7 @@ async function enqueueTaskForLongPoll(context, options, task, queue, visibilityT
     retryPolicy: task.retryPolicy,
     visibilityTimeout,
     workflowId: task.workflowId,
+    workflowExecutionToken: task.workflowExecutionToken,
     firstQueuedAt: normalizedQueuedRecord.firstQueuedAt,
     lastQueuedAt: normalizedQueuedRecord.lastQueuedAt,
     lastDispatchedAt: normalizedQueuedRecord.lastDispatchedAt,

package/dist/server/runtime/task-polling.js

@@ -98,6 +98,7 @@ export function createLongPollInflightRecord(queue, task) {
     visibilityTimeout,
     retryPolicy: task.retryPolicy,
     workflowId: task.workflowId,
+    workflowExecutionToken: task.workflowExecutionToken,
     attemptToken: crypto.randomUUID(),
     firstQueuedAt: task.firstQueuedAt ?? task.enqueuedAt ?? now,
     lastQueuedAt: task.lastQueuedAt ?? task.enqueuedAt ?? now,
@@ -139,7 +140,14 @@ export async function handleTaskPollRequest(context, options, request, url, prin
   const rawTimeout = url.searchParams.get("timeout"), timeout = rawTimeout !== null ? Math.min(Math.max(0, Number(rawTimeout)), MAX_POLL_TIMEOUT) : DEFAULT_POLL_TIMEOUT, task = await context.taskQueue.poll(queue, activities, timeout, request.signal);
   if (task !== null) {
     const claim = await markTaskClaimedByLongPollWorker(context, options, queue, task);
-    return Response.json({ ...task, workerId: claim.workerId, attemptToken: claim.attemptToken });
+    return Response.json({
+      ...task,
+      workerId: claim.workerId,
+      attemptToken: claim.attemptToken,
+      ...task.workflowExecutionToken !== void 0 && {
+        workflowExecutionToken: task.workflowExecutionToken
+      }
+    });
   }
   return new Response(null, { status: 204 });
 }

package/dist/server/runtime/task-reconciliation.js

@@ -68,7 +68,8 @@ function createRequeuedTaskDispatch(record, nextAttempt) {
     queue: record.queue,
     attempt: nextAttempt,
     visibilityTimeout: record.visibilityTimeout,
-    workflowId: record.workflowId
+    workflowId: record.workflowId,
+    workflowExecutionToken: record.workflowExecutionToken
   };
   if (record.retryPolicy !== void 0)
     taskDispatch.retryPolicy = record.retryPolicy;

package/dist/server/runtime/websocket-worker.js

@@ -74,11 +74,16 @@ function registerWorker(context, options, ws, message) {
     rejectRegistration(ws, "invalid_registration", "Worker registration requires the workers:write scope", message.protocolVersion);
     return;
   }
-  const rawConcurrency = message.concurrency ?? DEFAULT_WORKER_CONCURRENCY, clampedConcurrency = Math.min(Math.max(1, Math.floor(rawConcurrency)), MAX_WORKER_CONCURRENCY), queue = ws.data.queue ?? "default", pendingRequeue = context.pendingWorkerRequeues.get(message.workerId);
-  if (pendingRequeue !== void 0) {
+  const rawConcurrency = message.concurrency ?? DEFAULT_WORKER_CONCURRENCY, clampedConcurrency = Math.min(Math.max(1, Math.floor(rawConcurrency)), MAX_WORKER_CONCURRENCY), queue = ws.data.queue ?? "default", pendingRequeue = context.pendingWorkerRequeues.get(message.workerId), isGracePeriodReconnect = pendingRequeue !== void 0;
+  if (isGracePeriodReconnect) {
     clearTimeout(pendingRequeue);
     context.pendingWorkerRequeues.delete(message.workerId);
   }
+  const existingSocket = context.workerSockets.get(message.workerId);
+  if (!isGracePeriodReconnect && existingSocket !== void 0 && existingSocket !== ws) {
+    rejectRegistration(ws, "invalid_registration", "workerId is already registered to an active connection", message.protocolVersion);
+    return;
+  }
   ws.data.workerId = message.workerId;
   ws.data.workerRegistered = !0;
   ws.data.workerProtocolVersion = message.protocolVersion;

package/dist/server/serve-internals.d.ts

@@ -11,6 +11,27 @@ import type { WebSocketData } from './json-rpc-websocket-runtime.ts';
 import { createServerWebSocketHandlers } from './runtime/authentication-bridge.ts';
 import type { ServerContext } from './runtime/context.ts';
 import { type EventBroadcastingHandle } from './runtime/event-broadcasting.ts';
+/**
+ * Hard ceiling on the raw WebSocket frame size for every connection (worker
+ * stream, `/watch`, token `/stream`, and JSON-RPC). Bun's default is 16 MiB;
+ * this caps the frame at the transport layer before any JSON parse, so a
+ * malicious peer cannot force a 16 MiB parse per message. A bounded 4 MiB parse
+ * is not a CPU-burn, so this constant ceiling fully closes the DoS on its own.
+ *
+ * This is deliberately NOT derived from `payloadSize.maxBytes`. That option is
+ * an application-level admission policy measured on the codec-encoded (msgpack)
+ * byte length of the bare value, whereas `maxPayloadLength` bounds the raw
+ * UTF-8 JSON frame (envelope plus JSON-serialized value) — different units.
+ * Tightening the frame limit down to a smaller `payloadSize.maxBytes` would
+ * reject legitimate frames whose value is within the admission cap (JSON and
+ * envelope overhead inflate the frame past the msgpack value size) with an
+ * opaque transport close instead of a clean `PayloadSizeExceededError`, across
+ * every shared WebSocket endpoint — for no additional DoS protection. Value
+ * size stays enforced by the post-parse admission check.
+ *
+ * @internal Exported only for test assertions.
+ */
+export declare const WEBSOCKET_MAX_PAYLOAD_BYTES: number;
 /**
  * @internal
  *
@@ -77,6 +98,13 @@ export declare function cleanupWorkflowIndex(context: ServerContext, operationId
 /**
  * Assembles the `Bun.serve()` options object. Separating this avoids a
  * conditional spread (`...(tlsOptions ? { tls } : {})`) inside `serve()`.
+ *
+ * Sets a constant `maxPayloadLength` of `WEBSOCKET_MAX_PAYLOAD_BYTES` (4 MiB)
+ * so Bun rejects oversized frames at the transport layer before any JSON parse
+ * occurs. The cap is intentionally a fixed transport-safety ceiling, not
+ * derived from `payloadSize.maxBytes` (see that constant's docs for why mixing
+ * the raw-frame limit with the application value-size policy would cause false
+ * rejections in the wrong unit).
  */
 export declare function buildBunServeConfig(port: number, hostname: string, development: boolean, routes: Bun.Serve.Routes<WebSocketData, string>, tlsOptions: ReturnType<typeof buildTLSOptions>, fetchHandler: (request: Request) => Promise<Response | undefined>, websocketCallbacks: ReturnType<typeof createServerWebSocketHandlers>): Parameters<typeof Bun.serve<WebSocketData>>[0];
 /**

package/dist/server/serve-internals.js

@@ -30,7 +30,9 @@ import { DEFAULT_MAX_STREAM_CONNECTIONS_PER_WORKFLOW } from "./runtime/websocket
 import { isInflightRecord, withRetry } from "./runtime/websocket-worker.js";
 import { TaskQueue } from "./task-queue.js";
 import { createWorkflowEventFeed } from "./workflow-event-feed.js";
-const RECONCILIATION_MULTIPLIER = 12, DEFAULT_WORKER_RECONNECT_GRACE_PERIOD_MS = 2000, MAX_WORKER_RECONNECT_GRACE_PERIOD_MS = 5000, AUTHENTICATION_REQUIRED_ENVIRONMENT_VARIABLE = "WEFT_SERVER_AUTHENTICATION_REQUIRED";
+const RECONCILIATION_MULTIPLIER = 12, DEFAULT_WORKER_RECONNECT_GRACE_PERIOD_MS = 2000, MAX_WORKER_RECONNECT_GRACE_PERIOD_MS = 5000;
+export const WEBSOCKET_MAX_PAYLOAD_BYTES = 4194304;
+const AUTHENTICATION_REQUIRED_ENVIRONMENT_VARIABLE = "WEFT_SERVER_AUTHENTICATION_REQUIRED";
 export const NO_AUTHENTICATION_WARNING = '[weft] WARNING: server started with NO authentication; all non-public operations are publicly accessible. Configure serve({ auth }) to lock down, or set unauthenticatedAccess: "reject" in production to fail closed.', MCP_ORIGIN_CONFIGURATION_WARNING = '[weft] WARNING: MCP HTTP transport is enabled without publicOrigin or trustedHosts. Cross-origin /mcp requests are rejected, and discovery routes that emit absolute URLs return 503. Configure serve({ publicOrigin: "https://api.example.com" }) or serve({ trustedHosts: ["api.example.com"] }) before exposing the server through a browser or reverse proxy.';
 const NO_AUTHENTICATION_REJECT_ERROR = '[weft] Refusing to start server with no authentication. Configure serve({ auth }) or set unauthenticatedAccess: "allow" only for trusted local development.', NO_AUTHENTICATION_ENVIRONMENT_ERROR = "[weft] Refusing to start server with no authentication because WEFT_SERVER_AUTHENTICATION_REQUIRED requires authentication. Configure serve({ auth }) or unset WEFT_SERVER_AUTHENTICATION_REQUIRED only for trusted local development.", TRUTHY_AUTHENTICATION_REQUIREMENT_VALUES = new Set(["1", "true", "yes", "on"]), FALSY_AUTHENTICATION_REQUIREMENT_VALUES = new Set(["0", "false", "no", "off"]);
 export function clampWorkerReconnectGracePeriod(value) {
@@ -149,7 +151,7 @@ export function buildBunServeConfig(port, hostname, development, routes, tlsOpti
     development,
     routes,
     fetch: fetchHandler,
-    websocket: websocketCallbacks
+    websocket: { ...websocketCallbacks, maxPayloadLength: WEBSOCKET_MAX_PAYLOAD_BYTES }
   };
   if (tlsOptions)
     config.tls = tlsOptions;

package/dist/server/task-queue-types.d.ts

@@ -13,6 +13,8 @@ export interface PendingTask extends TaskLifecycleFields {
     headers?: Record<string, string> | undefined;
     /** Workflow that dispatched this activity. Present when the dispatch included a workflowId. */
     workflowId?: string | undefined;
+    /** Durable token for the workflow run that dispatched this activity, when known. */
+    workflowExecutionToken?: string | undefined;
     /**
      * Task priority. Higher values are dequeued first. Tasks with equal priority
      * maintain FIFO order. Default: 0. Agent workflow tasks use priority 10.

package/dist/server/task-state.d.ts

@@ -55,6 +55,8 @@ export interface QueuedRecord extends TaskLifecycleFields {
     queuedAt: number;
     /** Workflow that dispatched this activity. Present when the dispatch included a workflowId. */
     workflowId?: string | undefined;
+    /** Durable token for the workflow run that dispatched this activity, when known. */
+    workflowExecutionToken?: string | undefined;
 }
 /** Persisted record for a task in the inflight state. */
 export interface InflightRecord extends TaskLifecycleFields {
@@ -69,6 +71,8 @@ export interface InflightRecord extends TaskLifecycleFields {
     retryPolicy?: RetryPolicy | undefined;
     /** Workflow that dispatched this activity. Present when the dispatch included a workflowId. */
     workflowId?: string | undefined;
+    /** Durable token for the workflow run that dispatched this activity, when known. */
+    workflowExecutionToken?: string | undefined;
     /**
      * Unique, unguessable token identifying this dispatch attempt. Rotated on every
      * (re-)dispatch because each dispatch writes a fresh InflightRecord. The

package/dist/service-worker/index.d.ts

@@ -7,8 +7,10 @@
  * @module service-worker
  */
 import type { Engine } from '../core/engine';
-import type { ServiceWorkerScheduler } from './scheduler';
+import type { ServiceWorkerScheduler } from './scheduler.ts';
 import type { MinimalExtendableEvent, MinimalFetchEvent, MinimalPeriodicSyncEvent } from './shared.ts';
+export { ServiceWorkerScheduler } from './scheduler.ts';
+export type { ServiceWorkerSchedulerOptions } from './scheduler.ts';
 export { buildDelegatedRequest, DEFAULT_PERIODIC_SYNC_TAG, normalizePathPrefix } from './shared.ts';
 export type { MinimalExtendableEvent, MinimalFetchEvent, MinimalPeriodicSyncEvent, } from './shared.ts';
 /**
@@ -73,21 +75,20 @@ export declare function createFetchHandler(options: ServiceWorkerOptions): (even
  * `event.waitUntil(...)` so the sync extends until the tick promise
  * resolves.
  *
- * Note: `ServiceWorkerScheduler` is the parameter type but is not currently
- * re-exported from `@lostgradient/weft/service-worker` — construct the scheduler in the
- * module that imports it directly (e.g. the dashboard runtime) and pass
- * the instance to this factory.
- *
  * @example
  * ```ts
- * import { createPeriodicSyncHandler } from '@lostgradient/weft/service-worker';
- *
- * // In your Service Worker (with a scheduler from the runtime that imports it):
- * declare const scheduler: { tick(): Promise<void> };
- * const handler = createPeriodicSyncHandler(
- *   scheduler as Parameters<typeof createPeriodicSyncHandler>[0],
- *   'weft-timers',
- * );
+ * import { ServiceWorkerScheduler, createPeriodicSyncHandler } from '@lostgradient/weft/service-worker';
+ * import { MemoryStorage } from '@lostgradient/weft';
+ *
+ * const storage = new MemoryStorage();
+ *
+ * const scheduler = new ServiceWorkerScheduler({
+ *   storage,
+ *   onTimerFired: (entry) => {
+ *     console.log(`Timer ${entry.id} fired.`);
+ *   },
+ * });
+ * const handler = createPeriodicSyncHandler(scheduler, 'weft-timers');
  * // self.addEventListener('periodicsync', handler);
  * console.log(typeof handler); // 'function'
  * ```