@dudousxd/nestjs-durable 0.50.0 → 0.52.0

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { WorkflowCtx, SearchAttributes, WorkflowClass, StandardSchemaV1, StepError, OnErrorInput, WorkflowRef, SingletonConfig, ConcurrencyConfig, SearchAttributesSchema, StateStore, Transport, NamedTransport, ControlPlane, StalledRunInfo, ScheduledWorkflow, RetentionPolicy, QueueConfig, AdmissionBackend, WorkflowInputOf, StartOptions, RunResult, RunGateway, WorkflowEngine, EntityHandler, DurableTopology, RunDetailOptions, RunDetail, FanPageQuery, FanPage, RunQuery, RunListItem, RunFacetQuery, RunFacetRow, RunValueAxis, RunValueFacetOptions, RunValueFacetRow, GroupHealth, RunWaiting, EngineEvent, RunRequest, RunReply, StepInvocation, WorkflowRun, TenantEvent } from '@dudousxd/nestjs-durable-core';
-export { AttributeFilter, DynamicWorkflowCtx, EngineEvent, InferSearchAttributes, OnErrorInput, RunDetail, RunGateway, RunListItem, RunQuery, RunStatus, RunWaiting, SearchAttributes, SearchAttributesSchema, StepCheckpoint, StepEvent, StepLogger, WorkflowCtx, WorkflowEngine, WorkflowHandler, WorkflowRun, readSearchAttributes } from '@dudousxd/nestjs-durable-core';
+import { WorkflowCtx, SearchAttributes, WorkflowClass, StandardSchemaV1, StepError, OnErrorInput, WorkflowRef, SingletonConfig, ConcurrencyConfig, SearchAttributesSchema, StateStore, Transport, NamedTransport, ControlPlane, StalledRunInfo, ScheduledWorkflow, RetentionPolicy, QueueConfig, AdmissionBackend, TenantVerifier, TenantTokenSource, WorkflowInputOf, StartOptions, RunResult, RunGateway, WorkflowEngine, EntityHandler, DurableTopology, RunDetailOptions, RunDetail, FanPageQuery, FanPage, RunQuery, RunListItem, RunFacetQuery, RunFacetRow, RunValueAxis, RunValueFacetOptions, RunValueFacetRow, GroupHealth, RunWaiting, EngineEvent, RunRequest, RunReply, StepInvocation, WorkflowRun, TenantEvent } from '@dudousxd/nestjs-durable-core';
+export { AttributeFilter, DynamicWorkflowCtx, EngineEvent, InferSearchAttributes, OnErrorInput, RunDetail, RunGateway, RunListItem, RunQuery, RunSchedulesOptions, RunStatus, RunWaiting, ScheduledWorkflow, SearchAttributes, SearchAttributesSchema, StepCheckpoint, StepEvent, StepLogger, TenantTokenSource, TenantVerifier, VerifiedTenant, WorkflowCtx, WorkflowEngine, WorkflowHandler, WorkflowRun, hmacTenantVerifier, prevCronFireMs, readSearchAttributes, runSchedules, scheduleRunIdAt, scheduledRunId, signTenantToken } from '@dudousxd/nestjs-durable-core';
 import { z } from 'zod';
 import { ConcurrencyOption, StartRunDeps, RunRedisWorkerOptions, RunningWorker, DurableWorkerRuntime } from '@dudousxd/durable-worker';
 import { DynamicModule, InjectionToken, OnModuleInit, OnApplicationBootstrap, OnApplicationShutdown, Provider } from '@nestjs/common';
@@ -242,14 +242,16 @@ interface WorkflowOptions {
     inputSchema?: IoSchema;
     /**
      * A custom check at `start` (throw to reject) for a rule a schema can't express — a cross-field
-     * invariant, an async lookup. It sees the input as it was sent, and runs after `input` parses.
+     * invariant, an async lookup. It runs after `input` parses and receives the parsed value (the input
+     * as sent when there is no `input` schema).
      */
     validateInput?: (input: unknown) => void | Promise<void>;
     /**
      * Validate this workflow's {@link WorkflowCtx.upsertSearchAttributes} writes against a **Standard
      * Schema** (https://standardschema.dev — zod 3.24+, valibot, arktype, …). `ctx.upsertSearchAttributes`
      * validates the MERGED result (existing attributes shallow-merged with the patch) on every call —
-     * an invalid merge throws, naming this workflow, the offending key(s), and the schema's issues. The
+     * an invalid merge throws a `SchemaValidationError` (code `schema_validation`) naming this workflow,
+     * with the schema's issues. The
      * schema's inferred output must be search-attribute-shaped (flat `string`/`number`/`boolean` values
      * only) — a schema whose output has a nested object/array is a compile-time error here. Omit for
      * the prior unvalidated behavior.
@@ -788,6 +790,26 @@ interface DurableModuleOptions {
     /** Timeout for a thin worker's `RunGateway` round-trip over `transport` before it rejects. Defaults
      *  to 10_000ms inside `ProxyRunGateway`. Ignored for an operator (bound to `StoreRunGateway`). */
     runGatewayTimeoutMs?: number;
+    /**
+     * **Operator.** Verifies the signed tenant token a store-less tenant worker presents in the wire
+     * `tenant` field of every run request and start-run message, and DERIVES the tenant from it,
+     * discarding the wire claim. An invalid, tampered or absent token is rejected: a run request gets
+     * an `unauthorized` error reply, a start-run creates nothing. Use `hmacTenantVerifier(secret)`
+     * (tokens minted by `signTenantToken`, wire-compatible with Agora) or supply your own.
+     *
+     * Optional. Absent: the wire `tenant` is trusted verbatim (prefix/network isolation only), exactly
+     * as before. An explicit `topology: { role: 'control-plane' }` without a verifier logs a warning
+     * at boot; a plain operator (`store` + `transport`, no `topology`) boots silently.
+     */
+    verifyTenant?: TenantVerifier;
+    /**
+     * **Tenant worker.** The signed token (see `signTenantToken`) this worker presents, verbatim, in
+     * the `tenant` field of every run request (`ProxyRunGateway`) and start-run (`engine.start`), so
+     * an operator with {@link verifyTenant} can authenticate it. A string, or a function called before
+     * every request (rotation, short-lived tokens). Optional: absent, the raw {@link partition} is
+     * sent, as before. Live-tail stays keyed by the partition, never the token.
+     */
+    tenantToken?: TenantTokenSource;
     /**
      * An explicit preset that NAMES the deployment role instead of leaving it to `store`/`connection`
      * inference, and VALIDATES the axes that are otherwise only prose (see the interface doc's role
@@ -1089,13 +1111,29 @@ declare class ProxyRunGateway implements RunGateway {
     private readonly tenant;
     private readonly timeoutMs;
     private readonly capabilityTtlMs;
+    /**
+     * The tenant's signed token (see `signTenantToken`), presented VERBATIM in the `tenant` field of
+     * every {@link RunRequest} so an operator with `verifyTenant` can authenticate it and derive the
+     * tenant from it. A function is called before every request (rotation / short-lived tokens).
+     * Omit to send the raw `tenant` (prefix/network isolation only). The live-tail channel always
+     * stays keyed by `tenant`, never the token: the operator republishes by the run's namespace.
+     */
+    private readonly tenantToken?;
     private readonly pending;
     /** Verb → when to ask the control plane for it again, after it answered that it does not know it.
      *  During a rolling upgrade the control plane is several pods of mixed versions behind one queue,
      *  and a reply does not say which pod sent it, so the whole control plane is assumed old until the
      *  entry expires. */
     private readonly unsupportedUntil;
-    constructor(transport: Transport, tenant: string, timeoutMs?: number, capabilityTtlMs?: number);
+    constructor(transport: Transport, tenant: string, timeoutMs?: number, capabilityTtlMs?: number, 
+    /**
+     * The tenant's signed token (see `signTenantToken`), presented VERBATIM in the `tenant` field of
+     * every {@link RunRequest} so an operator with `verifyTenant` can authenticate it and derive the
+     * tenant from it. A function is called before every request (rotation / short-lived tokens).
+     * Omit to send the raw `tenant` (prefix/network isolation only). The live-tail channel always
+     * stays keyed by `tenant`, never the token: the operator republishes by the run's namespace.
+     */
+    tenantToken?: TenantTokenSource | undefined);
     private handleReply;
     private request;
     topology(): DurableTopology;
@@ -1163,6 +1201,22 @@ interface RunRequestTransport {
     onRunRequest(handler: (msg: RunRequest) => Promise<void>): void;
     publishRunReply(reply: RunReply): Promise<void>;
 }
+/** Options for {@link RunRequestResponder}. */
+interface RunRequestResponderOptions {
+    /**
+     * Verifies the signed token a tenant presents in the wire `tenant` field and DERIVES the real
+     * tenant from it (see `hmacTenantVerifier`). Present: an invalid, tampered or absent token is
+     * rejected with an `unauthorized` error reply and the wire claim is discarded in favour of the
+     * verified tenant. Absent: the wire `tenant` is trusted verbatim (prefix/network isolation only).
+     */
+    verifyTenant?: TenantVerifier | undefined;
+    /**
+     * Warn at construction when no {@link verifyTenant} is set. Default `true`. `DurableModule` passes
+     * `true` only for an explicit `topology: { role: 'control-plane' }`, so a plain operator app that
+     * never serves tenants boots silently.
+     */
+    warnWithoutVerifier?: boolean | undefined;
+}
 /**
  * Operator-side consumer of a tenant's {@link RunRequest}s: answers each one against a
  * `RunGateway`, enforcing the tenant boundary before touching the run. For every runId-bearing
@@ -1171,11 +1225,17 @@ interface RunRequestTransport {
  * verb, so a tenant can never read or act on another tenant's run. `listRuns` is scoped by
  * overwriting the query's `namespace` with the requester's tenant, ignoring whatever the client
  * sent. This is the security boundary of the tenant run gateway — do not weaken it.
+ *
+ * With {@link RunRequestResponderOptions.verifyTenant}, every request is authenticated FIRST: the
+ * wire `tenant` is treated as a signed token, the real tenant is derived from it, and an invalid
+ * token short-circuits into an `unauthorized` error reply before any run is touched. A verifier
+ * that throws becomes an error reply too.
  */
 declare class RunRequestResponder {
     private readonly transport;
     private readonly gateway;
-    constructor(transport: RunRequestTransport, gateway: RunGateway);
+    private readonly verifyTenant;
+    constructor(transport: RunRequestTransport, gateway: RunGateway, options?: RunRequestResponderOptions);
     /** Register the consumer on the transport. Each request is answered independently; a handler
      *  failure never throws back into the transport (errors are captured into an error reply). */
     start(): void;
@@ -1373,4 +1433,4 @@ declare class WorkflowService {
     }): Promise<number>;
 }
 
-export { CONTEXT_ACCESSOR, type ContextAccessor, type ContextStore, DEAD_LETTER_METADATA, DURABLE_STEP_METADATA, DURABLE_WORKER_RUNNERS, DURABLE_WORKER_RUNTIME, DeadLetter, type DtoClass, DurableModule, type DurableModuleAsyncOptions, type DurableModuleOptions, type DurableRetentionOptions, DurableStartClient, DurableStep, type DurableStepInterceptor, type DurableStepMeta, ENTITY_METADATA, ENTITY_ON_METADATA, Entity, EntityService, type ErrorClassWithCode, IN_APP_RUN_REDIS_WORKER, IN_APP_WORKER_BINDING, IN_APP_WORKER_RUNNERS, IN_APP_WORKER_RUNTIME, type InAppWorkerBinding, InAppWorkerBootstrap, type IoSchema, ON_ERROR_METADATA, ON_EVENT_METADATA, On, OnDurableEvent, OnError, type OnErrorMethod, OnEvent, ProxyRunGateway, RUN_GATEWAY, RUN_REDIS_WORKER, type RunLookupStore, type RunRedisWorkerFn, RunRequestResponder, type RunRequestTransport, STEP_INTERCEPTOR_METADATA, Step, StepInterceptor, type StepOptions, StoreRunGateway, TenantEventRepublisher, ThinStepRegistrar, ThinWorkerBootstrap, ThinWorkflowRegistrar, UNSUPPORTED_RUN_REQUEST, type UserRef, WORKFLOW_METADATA, Workflow, type WorkflowAttributesOf, type WorkflowMeta, type WorkflowOptions, WorkflowService, attributesOf, entityConfigFor, getDurableStepMeta, getEntityMeta, getOnEvents, getWorkflowMeta, inAppWorkerProviders, isDeadLetterHandler, isDrivingOperator, isOperatorRole, isStepInterceptor, onErrorCodesOf, thinWorkerProviders, unavailableRunGateway };
+export { CONTEXT_ACCESSOR, type ContextAccessor, type ContextStore, DEAD_LETTER_METADATA, DURABLE_STEP_METADATA, DURABLE_WORKER_RUNNERS, DURABLE_WORKER_RUNTIME, DeadLetter, type DtoClass, DurableModule, type DurableModuleAsyncOptions, type DurableModuleOptions, type DurableRetentionOptions, DurableStartClient, DurableStep, type DurableStepInterceptor, type DurableStepMeta, ENTITY_METADATA, ENTITY_ON_METADATA, Entity, EntityService, type ErrorClassWithCode, IN_APP_RUN_REDIS_WORKER, IN_APP_WORKER_BINDING, IN_APP_WORKER_RUNNERS, IN_APP_WORKER_RUNTIME, type InAppWorkerBinding, InAppWorkerBootstrap, type IoSchema, ON_ERROR_METADATA, ON_EVENT_METADATA, On, OnDurableEvent, OnError, type OnErrorMethod, OnEvent, ProxyRunGateway, RUN_GATEWAY, RUN_REDIS_WORKER, type RunLookupStore, type RunRedisWorkerFn, RunRequestResponder, type RunRequestResponderOptions, type RunRequestTransport, STEP_INTERCEPTOR_METADATA, Step, StepInterceptor, type StepOptions, StoreRunGateway, TenantEventRepublisher, ThinStepRegistrar, ThinWorkerBootstrap, ThinWorkflowRegistrar, UNSUPPORTED_RUN_REQUEST, type UserRef, WORKFLOW_METADATA, Workflow, type WorkflowAttributesOf, type WorkflowMeta, type WorkflowOptions, WorkflowService, attributesOf, entityConfigFor, getDurableStepMeta, getEntityMeta, getOnEvents, getWorkflowMeta, inAppWorkerProviders, isDeadLetterHandler, isDrivingOperator, isOperatorRole, isStepInterceptor, onErrorCodesOf, thinWorkerProviders, unavailableRunGateway };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { WorkflowCtx, SearchAttributes, WorkflowClass, StandardSchemaV1, StepError, OnErrorInput, WorkflowRef, SingletonConfig, ConcurrencyConfig, SearchAttributesSchema, StateStore, Transport, NamedTransport, ControlPlane, StalledRunInfo, ScheduledWorkflow, RetentionPolicy, QueueConfig, AdmissionBackend, WorkflowInputOf, StartOptions, RunResult, RunGateway, WorkflowEngine, EntityHandler, DurableTopology, RunDetailOptions, RunDetail, FanPageQuery, FanPage, RunQuery, RunListItem, RunFacetQuery, RunFacetRow, RunValueAxis, RunValueFacetOptions, RunValueFacetRow, GroupHealth, RunWaiting, EngineEvent, RunRequest, RunReply, StepInvocation, WorkflowRun, TenantEvent } from '@dudousxd/nestjs-durable-core';
-export { AttributeFilter, DynamicWorkflowCtx, EngineEvent, InferSearchAttributes, OnErrorInput, RunDetail, RunGateway, RunListItem, RunQuery, RunStatus, RunWaiting, SearchAttributes, SearchAttributesSchema, StepCheckpoint, StepEvent, StepLogger, WorkflowCtx, WorkflowEngine, WorkflowHandler, WorkflowRun, readSearchAttributes } from '@dudousxd/nestjs-durable-core';
+import { WorkflowCtx, SearchAttributes, WorkflowClass, StandardSchemaV1, StepError, OnErrorInput, WorkflowRef, SingletonConfig, ConcurrencyConfig, SearchAttributesSchema, StateStore, Transport, NamedTransport, ControlPlane, StalledRunInfo, ScheduledWorkflow, RetentionPolicy, QueueConfig, AdmissionBackend, TenantVerifier, TenantTokenSource, WorkflowInputOf, StartOptions, RunResult, RunGateway, WorkflowEngine, EntityHandler, DurableTopology, RunDetailOptions, RunDetail, FanPageQuery, FanPage, RunQuery, RunListItem, RunFacetQuery, RunFacetRow, RunValueAxis, RunValueFacetOptions, RunValueFacetRow, GroupHealth, RunWaiting, EngineEvent, RunRequest, RunReply, StepInvocation, WorkflowRun, TenantEvent } from '@dudousxd/nestjs-durable-core';
+export { AttributeFilter, DynamicWorkflowCtx, EngineEvent, InferSearchAttributes, OnErrorInput, RunDetail, RunGateway, RunListItem, RunQuery, RunSchedulesOptions, RunStatus, RunWaiting, ScheduledWorkflow, SearchAttributes, SearchAttributesSchema, StepCheckpoint, StepEvent, StepLogger, TenantTokenSource, TenantVerifier, VerifiedTenant, WorkflowCtx, WorkflowEngine, WorkflowHandler, WorkflowRun, hmacTenantVerifier, prevCronFireMs, readSearchAttributes, runSchedules, scheduleRunIdAt, scheduledRunId, signTenantToken } from '@dudousxd/nestjs-durable-core';
 import { z } from 'zod';
 import { ConcurrencyOption, StartRunDeps, RunRedisWorkerOptions, RunningWorker, DurableWorkerRuntime } from '@dudousxd/durable-worker';
 import { DynamicModule, InjectionToken, OnModuleInit, OnApplicationBootstrap, OnApplicationShutdown, Provider } from '@nestjs/common';
@@ -242,14 +242,16 @@ interface WorkflowOptions {
     inputSchema?: IoSchema;
     /**
      * A custom check at `start` (throw to reject) for a rule a schema can't express — a cross-field
-     * invariant, an async lookup. It sees the input as it was sent, and runs after `input` parses.
+     * invariant, an async lookup. It runs after `input` parses and receives the parsed value (the input
+     * as sent when there is no `input` schema).
      */
     validateInput?: (input: unknown) => void | Promise<void>;
     /**
      * Validate this workflow's {@link WorkflowCtx.upsertSearchAttributes} writes against a **Standard
      * Schema** (https://standardschema.dev — zod 3.24+, valibot, arktype, …). `ctx.upsertSearchAttributes`
      * validates the MERGED result (existing attributes shallow-merged with the patch) on every call —
-     * an invalid merge throws, naming this workflow, the offending key(s), and the schema's issues. The
+     * an invalid merge throws a `SchemaValidationError` (code `schema_validation`) naming this workflow,
+     * with the schema's issues. The
      * schema's inferred output must be search-attribute-shaped (flat `string`/`number`/`boolean` values
      * only) — a schema whose output has a nested object/array is a compile-time error here. Omit for
      * the prior unvalidated behavior.
@@ -788,6 +790,26 @@ interface DurableModuleOptions {
     /** Timeout for a thin worker's `RunGateway` round-trip over `transport` before it rejects. Defaults
      *  to 10_000ms inside `ProxyRunGateway`. Ignored for an operator (bound to `StoreRunGateway`). */
     runGatewayTimeoutMs?: number;
+    /**
+     * **Operator.** Verifies the signed tenant token a store-less tenant worker presents in the wire
+     * `tenant` field of every run request and start-run message, and DERIVES the tenant from it,
+     * discarding the wire claim. An invalid, tampered or absent token is rejected: a run request gets
+     * an `unauthorized` error reply, a start-run creates nothing. Use `hmacTenantVerifier(secret)`
+     * (tokens minted by `signTenantToken`, wire-compatible with Agora) or supply your own.
+     *
+     * Optional. Absent: the wire `tenant` is trusted verbatim (prefix/network isolation only), exactly
+     * as before. An explicit `topology: { role: 'control-plane' }` without a verifier logs a warning
+     * at boot; a plain operator (`store` + `transport`, no `topology`) boots silently.
+     */
+    verifyTenant?: TenantVerifier;
+    /**
+     * **Tenant worker.** The signed token (see `signTenantToken`) this worker presents, verbatim, in
+     * the `tenant` field of every run request (`ProxyRunGateway`) and start-run (`engine.start`), so
+     * an operator with {@link verifyTenant} can authenticate it. A string, or a function called before
+     * every request (rotation, short-lived tokens). Optional: absent, the raw {@link partition} is
+     * sent, as before. Live-tail stays keyed by the partition, never the token.
+     */
+    tenantToken?: TenantTokenSource;
     /**
      * An explicit preset that NAMES the deployment role instead of leaving it to `store`/`connection`
      * inference, and VALIDATES the axes that are otherwise only prose (see the interface doc's role
@@ -1089,13 +1111,29 @@ declare class ProxyRunGateway implements RunGateway {
     private readonly tenant;
     private readonly timeoutMs;
     private readonly capabilityTtlMs;
+    /**
+     * The tenant's signed token (see `signTenantToken`), presented VERBATIM in the `tenant` field of
+     * every {@link RunRequest} so an operator with `verifyTenant` can authenticate it and derive the
+     * tenant from it. A function is called before every request (rotation / short-lived tokens).
+     * Omit to send the raw `tenant` (prefix/network isolation only). The live-tail channel always
+     * stays keyed by `tenant`, never the token: the operator republishes by the run's namespace.
+     */
+    private readonly tenantToken?;
     private readonly pending;
     /** Verb → when to ask the control plane for it again, after it answered that it does not know it.
      *  During a rolling upgrade the control plane is several pods of mixed versions behind one queue,
      *  and a reply does not say which pod sent it, so the whole control plane is assumed old until the
      *  entry expires. */
     private readonly unsupportedUntil;
-    constructor(transport: Transport, tenant: string, timeoutMs?: number, capabilityTtlMs?: number);
+    constructor(transport: Transport, tenant: string, timeoutMs?: number, capabilityTtlMs?: number, 
+    /**
+     * The tenant's signed token (see `signTenantToken`), presented VERBATIM in the `tenant` field of
+     * every {@link RunRequest} so an operator with `verifyTenant` can authenticate it and derive the
+     * tenant from it. A function is called before every request (rotation / short-lived tokens).
+     * Omit to send the raw `tenant` (prefix/network isolation only). The live-tail channel always
+     * stays keyed by `tenant`, never the token: the operator republishes by the run's namespace.
+     */
+    tenantToken?: TenantTokenSource | undefined);
     private handleReply;
     private request;
     topology(): DurableTopology;
@@ -1163,6 +1201,22 @@ interface RunRequestTransport {
     onRunRequest(handler: (msg: RunRequest) => Promise<void>): void;
     publishRunReply(reply: RunReply): Promise<void>;
 }
+/** Options for {@link RunRequestResponder}. */
+interface RunRequestResponderOptions {
+    /**
+     * Verifies the signed token a tenant presents in the wire `tenant` field and DERIVES the real
+     * tenant from it (see `hmacTenantVerifier`). Present: an invalid, tampered or absent token is
+     * rejected with an `unauthorized` error reply and the wire claim is discarded in favour of the
+     * verified tenant. Absent: the wire `tenant` is trusted verbatim (prefix/network isolation only).
+     */
+    verifyTenant?: TenantVerifier | undefined;
+    /**
+     * Warn at construction when no {@link verifyTenant} is set. Default `true`. `DurableModule` passes
+     * `true` only for an explicit `topology: { role: 'control-plane' }`, so a plain operator app that
+     * never serves tenants boots silently.
+     */
+    warnWithoutVerifier?: boolean | undefined;
+}
 /**
  * Operator-side consumer of a tenant's {@link RunRequest}s: answers each one against a
  * `RunGateway`, enforcing the tenant boundary before touching the run. For every runId-bearing
@@ -1171,11 +1225,17 @@ interface RunRequestTransport {
  * verb, so a tenant can never read or act on another tenant's run. `listRuns` is scoped by
  * overwriting the query's `namespace` with the requester's tenant, ignoring whatever the client
  * sent. This is the security boundary of the tenant run gateway — do not weaken it.
+ *
+ * With {@link RunRequestResponderOptions.verifyTenant}, every request is authenticated FIRST: the
+ * wire `tenant` is treated as a signed token, the real tenant is derived from it, and an invalid
+ * token short-circuits into an `unauthorized` error reply before any run is touched. A verifier
+ * that throws becomes an error reply too.
  */
 declare class RunRequestResponder {
     private readonly transport;
     private readonly gateway;
-    constructor(transport: RunRequestTransport, gateway: RunGateway);
+    private readonly verifyTenant;
+    constructor(transport: RunRequestTransport, gateway: RunGateway, options?: RunRequestResponderOptions);
     /** Register the consumer on the transport. Each request is answered independently; a handler
      *  failure never throws back into the transport (errors are captured into an error reply). */
     start(): void;
@@ -1373,4 +1433,4 @@ declare class WorkflowService {
     }): Promise<number>;
 }
 
-export { CONTEXT_ACCESSOR, type ContextAccessor, type ContextStore, DEAD_LETTER_METADATA, DURABLE_STEP_METADATA, DURABLE_WORKER_RUNNERS, DURABLE_WORKER_RUNTIME, DeadLetter, type DtoClass, DurableModule, type DurableModuleAsyncOptions, type DurableModuleOptions, type DurableRetentionOptions, DurableStartClient, DurableStep, type DurableStepInterceptor, type DurableStepMeta, ENTITY_METADATA, ENTITY_ON_METADATA, Entity, EntityService, type ErrorClassWithCode, IN_APP_RUN_REDIS_WORKER, IN_APP_WORKER_BINDING, IN_APP_WORKER_RUNNERS, IN_APP_WORKER_RUNTIME, type InAppWorkerBinding, InAppWorkerBootstrap, type IoSchema, ON_ERROR_METADATA, ON_EVENT_METADATA, On, OnDurableEvent, OnError, type OnErrorMethod, OnEvent, ProxyRunGateway, RUN_GATEWAY, RUN_REDIS_WORKER, type RunLookupStore, type RunRedisWorkerFn, RunRequestResponder, type RunRequestTransport, STEP_INTERCEPTOR_METADATA, Step, StepInterceptor, type StepOptions, StoreRunGateway, TenantEventRepublisher, ThinStepRegistrar, ThinWorkerBootstrap, ThinWorkflowRegistrar, UNSUPPORTED_RUN_REQUEST, type UserRef, WORKFLOW_METADATA, Workflow, type WorkflowAttributesOf, type WorkflowMeta, type WorkflowOptions, WorkflowService, attributesOf, entityConfigFor, getDurableStepMeta, getEntityMeta, getOnEvents, getWorkflowMeta, inAppWorkerProviders, isDeadLetterHandler, isDrivingOperator, isOperatorRole, isStepInterceptor, onErrorCodesOf, thinWorkerProviders, unavailableRunGateway };
+export { CONTEXT_ACCESSOR, type ContextAccessor, type ContextStore, DEAD_LETTER_METADATA, DURABLE_STEP_METADATA, DURABLE_WORKER_RUNNERS, DURABLE_WORKER_RUNTIME, DeadLetter, type DtoClass, DurableModule, type DurableModuleAsyncOptions, type DurableModuleOptions, type DurableRetentionOptions, DurableStartClient, DurableStep, type DurableStepInterceptor, type DurableStepMeta, ENTITY_METADATA, ENTITY_ON_METADATA, Entity, EntityService, type ErrorClassWithCode, IN_APP_RUN_REDIS_WORKER, IN_APP_WORKER_BINDING, IN_APP_WORKER_RUNNERS, IN_APP_WORKER_RUNTIME, type InAppWorkerBinding, InAppWorkerBootstrap, type IoSchema, ON_ERROR_METADATA, ON_EVENT_METADATA, On, OnDurableEvent, OnError, type OnErrorMethod, OnEvent, ProxyRunGateway, RUN_GATEWAY, RUN_REDIS_WORKER, type RunLookupStore, type RunRedisWorkerFn, RunRequestResponder, type RunRequestResponderOptions, type RunRequestTransport, STEP_INTERCEPTOR_METADATA, Step, StepInterceptor, type StepOptions, StoreRunGateway, TenantEventRepublisher, ThinStepRegistrar, ThinWorkerBootstrap, ThinWorkflowRegistrar, UNSUPPORTED_RUN_REQUEST, type UserRef, WORKFLOW_METADATA, Workflow, type WorkflowAttributesOf, type WorkflowMeta, type WorkflowOptions, WorkflowService, attributesOf, entityConfigFor, getDurableStepMeta, getEntityMeta, getOnEvents, getWorkflowMeta, inAppWorkerProviders, isDeadLetterHandler, isDrivingOperator, isOperatorRole, isStepInterceptor, onErrorCodesOf, thinWorkerProviders, unavailableRunGateway };

package/dist/index.js

@@ -264,7 +264,7 @@ function attributesOf(workflow, run) {
 __name(attributesOf, "attributesOf");
 
 // src/durable-start-client.ts
-import { workflowName } from "@dudousxd/nestjs-durable-core";
+import { resolveTenantToken, workflowName } from "@dudousxd/nestjs-durable-core";
 import { Injectable } from "@nestjs/common";
 
 // src/worker-sdk.ts
@@ -322,7 +322,9 @@ var DurableStartClient = class {
   async start(workflow, input, runId = globalThis.crypto.randomUUID(), opts) {
     const name = workflowName(workflow);
     await startRun(this.options.connection, {
-      tenant: this.tenant,
+      // The signed token (when configured) rides in the `tenant` field, as on every run request; an
+      // operator with `verifyTenant` derives the run's namespace from it.
+      tenant: this.options.tenantToken !== void 0 ? await resolveTenantToken(this.options.tenantToken) : this.tenant,
       workflow: name,
       input,
       runId,
@@ -393,34 +395,20 @@ import { Inject, Injectable as Injectable2 } from "@nestjs/common";
 import { DiscoveryService, MetadataScanner } from "@nestjs/core";
 
 // src/schema-parse.ts
-import { FatalError } from "@dudousxd/nestjs-durable-core";
+import { SchemaValidationError } from "@dudousxd/nestjs-durable-core";
 function schemaParser(schema, kind, label) {
   const code = kind === "input" ? "invalid_input" : "invalid_output";
   if (isStandardSchema(schema)) {
     return async (value) => {
       const result = await schema["~standard"].validate(value);
-      if (result.issues) {
-        const issues = result.issues.map((i) => ({
-          message: i.message,
-          ...i.path ? {
-            path: i.path.map((p) => String(typeof p === "object" ? p.key : p))
-          } : {}
-        }));
-        throw new FatalError(`invalid ${label}: ${formatIssues(issues)}`, code, issues);
-      }
+      if (result.issues) throw new SchemaValidationError(label, result.issues, code);
       return result.value;
     };
   }
   if (isZodLike(schema)) {
     return async (value) => {
       const result = schema.safeParse(value);
-      if (!result.success) {
-        const issues = result.error.issues.map((i) => ({
-          message: i.message,
-          path: i.path.map(String)
-        }));
-        throw new FatalError(`invalid ${label}: ${formatIssues(issues)}`, code, issues);
-      }
+      if (!result.success) throw new SchemaValidationError(label, result.error.issues, code);
       return result.data;
     };
   }
@@ -440,12 +428,11 @@ function classValidatorParser(cls, code, label) {
     }
     if (value === null || typeof value !== "object" || Array.isArray(value)) {
       const got = value === null ? "null" : Array.isArray(value) ? "an array" : typeof value;
-      const message = `expected an object, got ${got}`;
-      throw new FatalError(`invalid ${label}: ${message}`, code, [
+      throw new SchemaValidationError(label, [
         {
-          message
+          message: `expected an object, got ${got}`
         }
-      ]);
+      ], code);
     }
     const instance = ct.plainToInstance(cls, value);
     const errors = await cv.validate(instance, {
@@ -460,8 +447,8 @@ function classValidatorParser(cls, code, label) {
           String(e.property)
         ]
       }));
-      const message = issues.map((i) => i.message).join("; ");
-      throw new FatalError(`invalid ${label}: ${message}`, code, issues);
+      const summary = issues.map((i) => i.message).join("; ");
+      throw new SchemaValidationError(label, issues, code, summary);
     }
     return instance;
   };
@@ -475,10 +462,6 @@ function isZodLike(schema) {
   return typeof schema === "object" && schema !== null && typeof schema.safeParse === "function";
 }
 __name(isZodLike, "isZodLike");
-function formatIssues(issues) {
-  return issues.map((i) => i.path && i.path.length > 0 ? `${i.path.join(".")}: ${i.message}` : i.message).join("; ");
-}
-__name(formatIssues, "formatIssues");
 
 // src/discovery-helpers.ts
 function scanWorkflows(discovery, register) {
@@ -558,8 +541,8 @@ function workflowIo(meta) {
   const validateInput = meta.validateInput;
   return {
     validateAtStart: parseInput || validateInput ? async (input) => {
-      if (parseInput) await parseInput(input);
-      await validateInput?.(input);
+      const parsed = parseInput ? await parseInput(input) : input;
+      await validateInput?.(parsed);
     } : void 0,
     wrap: /* @__PURE__ */ __name((body) => !parseInput && !parseOutput ? body : async (ctx, input) => {
       const output = await body(ctx, parseInput ? await parseInput(input) : input);
@@ -1178,10 +1161,11 @@ function inAppWorkerProviders() {
 __name(inAppWorkerProviders, "inAppWorkerProviders");
 
 // src/proxy-run-gateway.ts
-import { SUMMARY_CHILD_LIMIT, childIdsOf, pageFan, summarizeTimeline } from "@dudousxd/nestjs-durable-core";
+import { SUMMARY_CHILD_LIMIT, childIdsOf, pageFan, resolveTenantToken as resolveTenantToken2, summarizeTimeline } from "@dudousxd/nestjs-durable-core";
 import { Injectable as Injectable6 } from "@nestjs/common";
 
 // src/run-request-responder.ts
+import { resolveWireTenant } from "@dudousxd/nestjs-durable-core";
 var UNSUPPORTED_RUN_REQUEST = "unsupported-request";
 var KNOWN_KINDS = /* @__PURE__ */ new Set([
   "getRunDetail",
@@ -1203,9 +1187,14 @@ var RunRequestResponder = class {
   }
   transport;
   gateway;
-  constructor(transport, gateway) {
+  verifyTenant;
+  constructor(transport, gateway, options = {}) {
     this.transport = transport;
     this.gateway = gateway;
+    this.verifyTenant = options.verifyTenant;
+    if (!this.verifyTenant && options.warnWithoutVerifier !== false) {
+      console.warn("[nestjs-durable] run-request responder started WITHOUT a tenant verifier: the wire `tenant` claim is trusted verbatim (prefix/network isolation only). Any broker client can act as any tenant. Configure `verifyTenant` (e.g. hmacTenantVerifier(secret)) and signed tenant tokens unless your broker is fully isolated per tenant.");
+    }
   }
   /** Register the consumer on the transport. Each request is answered independently; a handler
   *  failure never throws back into the transport (errors are captured into an error reply). */
@@ -1228,7 +1217,24 @@ var RunRequestResponder = class {
       await this.transport.publishRunReply(reply);
     });
   }
-  async handle(msg) {
+  async handle(wire) {
+    const tenant = await resolveWireTenant(wire.tenant, this.verifyTenant);
+    if (tenant === null) {
+      return {
+        requestId: wire.requestId,
+        result: {
+          ok: false,
+          error: {
+            message: "invalid or unauthorized tenant token",
+            code: "unauthorized"
+          }
+        }
+      };
+    }
+    const msg = {
+      ...wire,
+      tenant
+    };
     const { body } = msg;
     if (!KNOWN_KINDS.has(body.kind)) {
       return {
@@ -1421,17 +1427,19 @@ var ProxyRunGateway = class {
   tenant;
   timeoutMs;
   capabilityTtlMs;
+  tenantToken;
   pending = /* @__PURE__ */ new Map();
   /** Verb → when to ask the control plane for it again, after it answered that it does not know it.
   *  During a rolling upgrade the control plane is several pods of mixed versions behind one queue,
   *  and a reply does not say which pod sent it, so the whole control plane is assumed old until the
   *  entry expires. */
   unsupportedUntil = /* @__PURE__ */ new Map();
-  constructor(transport, tenant, timeoutMs = 1e4, capabilityTtlMs = 6e4) {
+  constructor(transport, tenant, timeoutMs = 1e4, capabilityTtlMs = 6e4, tenantToken) {
     this.transport = transport;
     this.tenant = tenant;
     this.timeoutMs = timeoutMs;
     this.capabilityTtlMs = capabilityTtlMs;
+    this.tenantToken = tenantToken;
     this.transport.onRunReply?.((reply) => this.handleReply(reply));
   }
   handleReply(reply) {
@@ -1444,7 +1452,10 @@ var ProxyRunGateway = class {
     } else if (reply.result.error.code === UNSUPPORTED_RUN_REQUEST) {
       pending.reject(new UnsupportedRunRequestError(reply.result.error.message));
     } else {
-      pending.reject(new Error(reply.result.error.message));
+      const { message, code } = reply.result.error;
+      pending.reject(code !== void 0 ? Object.assign(new Error(message), {
+        code
+      }) : new Error(message));
     }
   }
   request(body) {
@@ -1459,11 +1470,17 @@ var ProxyRunGateway = class {
         reject,
         timer
       });
-      this.transport.dispatchRunRequest?.({
+      const source = this.tenantToken;
+      const dispatched = typeof source === "function" ? resolveTenantToken2(source).then((tenant) => this.transport.dispatchRunRequest?.({
         requestId,
-        tenant: this.tenant,
+        tenant,
         body
-      }).catch((error) => {
+      })) : this.transport.dispatchRunRequest?.({
+        requestId,
+        tenant: source ?? this.tenant,
+        body
+      });
+      dispatched?.catch((error) => {
         const stillPending = this.pending.get(requestId);
         if (!stillPending) return;
         clearTimeout(stillPending.timer);
@@ -1621,7 +1638,8 @@ ProxyRunGateway = _ts_decorate6([
     typeof Transport === "undefined" ? Object : Transport,
     String,
     void 0,
-    void 0
+    void 0,
+    typeof TenantTokenSource === "undefined" ? Object : TenantTokenSource
   ])
 ], ProxyRunGateway);
 
@@ -2076,7 +2094,7 @@ var TenantEventRepublisher = class {
 };
 
 // src/timer-poller.ts
-import { DURABLE_OPTIONS_CANONICAL as DURABLE_OPTIONS_CANONICAL5, WorkflowEngine as WorkflowEngine3, runSchedules } from "@dudousxd/nestjs-durable-core";
+import { DURABLE_OPTIONS_CANONICAL as DURABLE_OPTIONS_CANONICAL5, WorkflowEngine as WorkflowEngine3, runSchedules, workflowName as workflowName3 } from "@dudousxd/nestjs-durable-core";
 import { Inject as Inject6, Injectable as Injectable9 } from "@nestjs/common";
 function _ts_decorate9(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -2120,6 +2138,7 @@ var TimerPoller = class {
     this.options = options;
   }
   async onApplicationBootstrap() {
+    for (const s of this.options.schedules ?? []) workflowName3(s.workflow);
     if (!isDrivingOperator(this.options)) return;
     this.unsubscribeEnqueued = this.engine.onEnqueued((runId) => {
       void this.engine.runOne(runId).catch((error) => {
@@ -2221,7 +2240,7 @@ var CONTEXT_ACCESSOR = Symbol.for("@dudousxd/nestjs-context:accessor");
 var RUN_GATEWAY = RunGateway;
 
 // src/workflow.registrar.ts
-import { DURABLE_OPTIONS_CANONICAL as DURABLE_OPTIONS_CANONICAL6, RemoteWorkflowExecutor, STATE_STORE_CANONICAL as STATE_STORE_CANONICAL3, WorkflowEngine as WorkflowEngine4, bindWorkflowClass, parseDuration as parseDuration2, sanitizeQueueToken, tenantGroup, workflowName as workflowName3 } from "@dudousxd/nestjs-durable-core";
+import { DURABLE_OPTIONS_CANONICAL as DURABLE_OPTIONS_CANONICAL6, RemoteWorkflowExecutor, STATE_STORE_CANONICAL as STATE_STORE_CANONICAL3, WorkflowEngine as WorkflowEngine4, bindWorkflowClass, parseDuration as parseDuration2, sanitizeQueueToken, tenantGroup, workflowName as workflowName4 } from "@dudousxd/nestjs-durable-core";
 import { Inject as Inject7, Injectable as Injectable10 } from "@nestjs/common";
 import { DiscoveryService as DiscoveryService4, MetadataScanner as MetadataScanner4 } from "@nestjs/core";
 
@@ -2388,7 +2407,7 @@ var WorkflowRegistrar = class {
         });
         deadLetterByWorkflow.set(meta.name, dlqName);
       } else if (meta.deadLetterWorkflow) {
-        deadLetterByWorkflow.set(meta.name, workflowName3(meta.deadLetterWorkflow));
+        deadLetterByWorkflow.set(meta.name, workflowName4(meta.deadLetterWorkflow));
       }
     });
     this.reportUnattributed(unattributed);
@@ -2436,7 +2455,7 @@ var WorkflowRegistrar = class {
   * a `dlq:<runId>` id, so re-recovery never double-dispatches.
   */
   installDeadLetterRouting(byWorkflow) {
-    const fallback = this.options.deadLetterWorkflow ? workflowName3(this.options.deadLetterWorkflow) : void 0;
+    const fallback = this.options.deadLetterWorkflow ? workflowName4(this.options.deadLetterWorkflow) : void 0;
     if (byWorkflow.size === 0 && !fallback) return;
     this.engine.onDead((run) => {
       const target = byWorkflow.get(run.workflow) ?? fallback;
@@ -2745,7 +2764,15 @@ var RunGatewayBootstrap = class RunGatewayBootstrap2 {
         onRunRequest: onRunRequest.bind(this.transport),
         publishRunReply: publishRunReply.bind(this.transport)
       };
-      new RunRequestResponder(runRequestTransport, this.gateway).start();
+      new RunRequestResponder(runRequestTransport, this.gateway, {
+        verifyTenant: this.options.verifyTenant,
+        // Mirrors Agora's rule (`warnWithoutVerifier: role === 'control-plane'`): only a deployment
+        // that EXPLICITLY names itself the control plane is told it runs without tenant auth. A plain
+        // operator (role inferred from `store`) is Agora's `standalone`: anyone with broker access
+        // can already enqueue steps and results there, so the warning would be noise on every boot
+        // of an app that never serves tenants.
+        warnWithoutVerifier: this.options.topology?.role === "control-plane"
+      }).start();
     }
     if (typeof publishTenantEvent === "function") {
       const republisher = new TenantEventRepublisher(store, publishTenantEvent.bind(this.transport));
@@ -2897,6 +2924,7 @@ var DurableModule = class _DurableModule {
               context,
               rehydrate: rehydrate || void 0,
               compensationRetries: options.compensationRetries,
+              verifyTenant: options.verifyTenant,
               // A non-driving (dashboard/API) operator must not run workflows: enqueue-only, leaving
               // each `pending` run in the store for a DRIVING instance's poll. A driving operator gets
               // the engine's default in-process dispatcher: for a body registered inline, it runs
@@ -2937,7 +2965,7 @@ var DurableModule = class _DurableModule {
               }
               return new StoreRunGateway(store, engine);
             }
-            return options.transport ? new ProxyRunGateway(options.transport, options.partition ?? "default", options.runGatewayTimeoutMs) : unavailableRunGateway();
+            return options.transport ? new ProxyRunGateway(options.transport, options.partition ?? "default", options.runGatewayTimeoutMs, void 0, options.tenantToken) : unavailableRunGateway();
           }, "useFactory"),
           inject: [
             DURABLE_OPTIONS_CANONICAL7,
@@ -2972,7 +3000,7 @@ DurableModule = _ts_decorate12([
 ], DurableModule);
 
 // src/index.ts
-import { readSearchAttributes as readSearchAttributes2, RunGateway as RunGateway3, WorkflowEngine as WorkflowEngine7 } from "@dudousxd/nestjs-durable-core";
+import { hmacTenantVerifier, prevCronFireMs, readSearchAttributes as readSearchAttributes2, RunGateway as RunGateway3, runSchedules as runSchedules2, scheduledRunId, scheduleRunIdAt, signTenantToken, WorkflowEngine as WorkflowEngine7 } from "@dudousxd/nestjs-durable-core";
 export {
   CONTEXT_ACCESSOR,
   DEAD_LETTER_METADATA,
@@ -3022,13 +3050,19 @@ export {
   getEntityMeta,
   getOnEvents,
   getWorkflowMeta,
+  hmacTenantVerifier,
   inAppWorkerProviders,
   isDeadLetterHandler,
   isDrivingOperator,
   isOperatorRole,
   isStepInterceptor,
   onErrorCodesOf,
+  prevCronFireMs,
   readSearchAttributes2 as readSearchAttributes,
+  runSchedules2 as runSchedules,
+  scheduleRunIdAt,
+  scheduledRunId,
+  signTenantToken,
   thinWorkerProviders,
   unavailableRunGateway
 };