@dudousxd/nestjs-durable 0.51.0 → 0.52.0

package/dist/index.cjs

@@ -58,7 +58,7 @@ __export(index_exports, {
   ProxyRunGateway: () => ProxyRunGateway,
   RUN_GATEWAY: () => RUN_GATEWAY,
   RUN_REDIS_WORKER: () => RUN_REDIS_WORKER,
-  RunGateway: () => import_nestjs_durable_core18.RunGateway,
+  RunGateway: () => import_nestjs_durable_core19.RunGateway,
   RunRequestResponder: () => RunRequestResponder,
   STEP_INTERCEPTOR_METADATA: () => STEP_INTERCEPTOR_METADATA,
   Step: () => Step,
@@ -71,7 +71,7 @@ __export(index_exports, {
   UNSUPPORTED_RUN_REQUEST: () => UNSUPPORTED_RUN_REQUEST,
   WORKFLOW_METADATA: () => WORKFLOW_METADATA,
   Workflow: () => Workflow,
-  WorkflowEngine: () => import_nestjs_durable_core18.WorkflowEngine,
+  WorkflowEngine: () => import_nestjs_durable_core19.WorkflowEngine,
   WorkflowService: () => WorkflowService,
   attributesOf: () => attributesOf,
   entityConfigFor: () => entityConfigFor,
@@ -79,17 +79,19 @@ __export(index_exports, {
   getEntityMeta: () => getEntityMeta,
   getOnEvents: () => getOnEvents,
   getWorkflowMeta: () => getWorkflowMeta,
+  hmacTenantVerifier: () => import_nestjs_durable_core19.hmacTenantVerifier,
   inAppWorkerProviders: () => inAppWorkerProviders,
   isDeadLetterHandler: () => isDeadLetterHandler,
   isDrivingOperator: () => isDrivingOperator,
   isOperatorRole: () => isOperatorRole,
   isStepInterceptor: () => isStepInterceptor,
   onErrorCodesOf: () => onErrorCodesOf,
-  prevCronFireMs: () => import_nestjs_durable_core18.prevCronFireMs,
-  readSearchAttributes: () => import_nestjs_durable_core18.readSearchAttributes,
-  runSchedules: () => import_nestjs_durable_core18.runSchedules,
-  scheduleRunIdAt: () => import_nestjs_durable_core18.scheduleRunIdAt,
-  scheduledRunId: () => import_nestjs_durable_core18.scheduledRunId,
+  prevCronFireMs: () => import_nestjs_durable_core19.prevCronFireMs,
+  readSearchAttributes: () => import_nestjs_durable_core19.readSearchAttributes,
+  runSchedules: () => import_nestjs_durable_core19.runSchedules,
+  scheduleRunIdAt: () => import_nestjs_durable_core19.scheduleRunIdAt,
+  scheduledRunId: () => import_nestjs_durable_core19.scheduledRunId,
+  signTenantToken: () => import_nestjs_durable_core19.signTenantToken,
   thinWorkerProviders: () => thinWorkerProviders,
   unavailableRunGateway: () => unavailableRunGateway
 });
@@ -416,7 +418,9 @@ var DurableStartClient = class {
   async start(workflow, input, runId = globalThis.crypto.randomUUID(), opts) {
     const name = (0, import_nestjs_durable_core3.workflowName)(workflow);
     await startRun(this.options.connection, {
-      tenant: this.tenant,
+      // The signed token (when configured) rides in the `tenant` field, as on every run request; an
+      // operator with `verifyTenant` derives the run's namespace from it.
+      tenant: this.options.tenantToken !== void 0 ? await (0, import_nestjs_durable_core3.resolveTenantToken)(this.options.tenantToken) : this.tenant,
       workflow: name,
       input,
       runId,
@@ -917,7 +921,7 @@ function unavailableRunGateway() {
 __name(unavailableRunGateway, "unavailableRunGateway");
 
 // src/durable.module.ts
-var import_nestjs_durable_core17 = require("@dudousxd/nestjs-durable-core");
+var import_nestjs_durable_core18 = require("@dudousxd/nestjs-durable-core");
 var import_common12 = require("@nestjs/common");
 var import_core5 = require("@nestjs/core");
 
@@ -1253,10 +1257,11 @@ function inAppWorkerProviders() {
 __name(inAppWorkerProviders, "inAppWorkerProviders");
 
 // src/proxy-run-gateway.ts
-var import_nestjs_durable_core10 = require("@dudousxd/nestjs-durable-core");
+var import_nestjs_durable_core11 = require("@dudousxd/nestjs-durable-core");
 var import_common6 = require("@nestjs/common");
 
 // src/run-request-responder.ts
+var import_nestjs_durable_core10 = require("@dudousxd/nestjs-durable-core");
 var UNSUPPORTED_RUN_REQUEST = "unsupported-request";
 var KNOWN_KINDS = /* @__PURE__ */ new Set([
   "getRunDetail",
@@ -1278,9 +1283,14 @@ var RunRequestResponder = class {
   }
   transport;
   gateway;
-  constructor(transport, gateway) {
+  verifyTenant;
+  constructor(transport, gateway, options = {}) {
     this.transport = transport;
     this.gateway = gateway;
+    this.verifyTenant = options.verifyTenant;
+    if (!this.verifyTenant && options.warnWithoutVerifier !== false) {
+      console.warn("[nestjs-durable] run-request responder started WITHOUT a tenant verifier: the wire `tenant` claim is trusted verbatim (prefix/network isolation only). Any broker client can act as any tenant. Configure `verifyTenant` (e.g. hmacTenantVerifier(secret)) and signed tenant tokens unless your broker is fully isolated per tenant.");
+    }
   }
   /** Register the consumer on the transport. Each request is answered independently; a handler
   *  failure never throws back into the transport (errors are captured into an error reply). */
@@ -1303,7 +1313,24 @@ var RunRequestResponder = class {
       await this.transport.publishRunReply(reply);
     });
   }
-  async handle(msg) {
+  async handle(wire) {
+    const tenant = await (0, import_nestjs_durable_core10.resolveWireTenant)(wire.tenant, this.verifyTenant);
+    if (tenant === null) {
+      return {
+        requestId: wire.requestId,
+        result: {
+          ok: false,
+          error: {
+            message: "invalid or unauthorized tenant token",
+            code: "unauthorized"
+          }
+        }
+      };
+    }
+    const msg = {
+      ...wire,
+      tenant
+    };
     const { body } = msg;
     if (!KNOWN_KINDS.has(body.kind)) {
       return {
@@ -1496,17 +1523,19 @@ var ProxyRunGateway = class {
   tenant;
   timeoutMs;
   capabilityTtlMs;
+  tenantToken;
   pending = /* @__PURE__ */ new Map();
   /** Verb → when to ask the control plane for it again, after it answered that it does not know it.
   *  During a rolling upgrade the control plane is several pods of mixed versions behind one queue,
   *  and a reply does not say which pod sent it, so the whole control plane is assumed old until the
   *  entry expires. */
   unsupportedUntil = /* @__PURE__ */ new Map();
-  constructor(transport, tenant, timeoutMs = 1e4, capabilityTtlMs = 6e4) {
+  constructor(transport, tenant, timeoutMs = 1e4, capabilityTtlMs = 6e4, tenantToken) {
     this.transport = transport;
     this.tenant = tenant;
     this.timeoutMs = timeoutMs;
     this.capabilityTtlMs = capabilityTtlMs;
+    this.tenantToken = tenantToken;
     this.transport.onRunReply?.((reply) => this.handleReply(reply));
   }
   handleReply(reply) {
@@ -1519,7 +1548,10 @@ var ProxyRunGateway = class {
     } else if (reply.result.error.code === UNSUPPORTED_RUN_REQUEST) {
       pending.reject(new UnsupportedRunRequestError(reply.result.error.message));
     } else {
-      pending.reject(new Error(reply.result.error.message));
+      const { message, code } = reply.result.error;
+      pending.reject(code !== void 0 ? Object.assign(new Error(message), {
+        code
+      }) : new Error(message));
     }
   }
   request(body) {
@@ -1534,11 +1566,17 @@ var ProxyRunGateway = class {
         reject,
         timer
       });
-      this.transport.dispatchRunRequest?.({
+      const source = this.tenantToken;
+      const dispatched = typeof source === "function" ? (0, import_nestjs_durable_core11.resolveTenantToken)(source).then((tenant) => this.transport.dispatchRunRequest?.({
+        requestId,
+        tenant,
+        body
+      })) : this.transport.dispatchRunRequest?.({
         requestId,
-        tenant: this.tenant,
+        tenant: source ?? this.tenant,
         body
-      }).catch((error) => {
+      });
+      dispatched?.catch((error) => {
         const stillPending = this.pending.get(requestId);
         if (!stillPending) return;
         clearTimeout(stillPending.timer);
@@ -1568,12 +1606,12 @@ var ProxyRunGateway = class {
     });
     const over = options?.summarizeFansOver;
     if (over === void 0 || !detail || detail.fans !== void 0) return detail;
-    const { timeline, fans } = (0, import_nestjs_durable_core10.summarizeTimeline)(detail.timeline, over);
-    const ids = (0, import_nestjs_durable_core10.childIdsOf)(detail.timeline);
+    const { timeline, fans } = (0, import_nestjs_durable_core11.summarizeTimeline)(detail.timeline, over);
+    const ids = (0, import_nestjs_durable_core11.childIdsOf)(detail.timeline);
     return {
       ...detail,
       timeline,
-      children: ids.slice(0, import_nestjs_durable_core10.SUMMARY_CHILD_LIMIT),
+      children: ids.slice(0, import_nestjs_durable_core11.SUMMARY_CHILD_LIMIT),
       fans,
       childCount: ids.length
     };
@@ -1598,7 +1636,7 @@ var ProxyRunGateway = class {
       kind: "getRunDetail",
       runId
     });
-    return detail ? (0, import_nestjs_durable_core10.pageFan)(detail.timeline, group, query) : null;
+    return detail ? (0, import_nestjs_durable_core11.pageFan)(detail.timeline, group, query) : null;
   }
   knownUnsupported(kind) {
     const until = this.unsupportedUntil.get(kind);
@@ -1696,12 +1734,13 @@ ProxyRunGateway = _ts_decorate6([
     typeof Transport === "undefined" ? Object : Transport,
     String,
     void 0,
-    void 0
+    void 0,
+    typeof TenantTokenSource === "undefined" ? Object : TenantTokenSource
   ])
 ], ProxyRunGateway);
 
 // src/retention-poller.ts
-var import_nestjs_durable_core11 = require("@dudousxd/nestjs-durable-core");
+var import_nestjs_durable_core12 = require("@dudousxd/nestjs-durable-core");
 var import_common7 = require("@nestjs/common");
 
 // src/settle-within.ts
@@ -1767,10 +1806,10 @@ function validateRetention(retention) {
     if (policy.maxAge == null && policy.maxCount == null) {
       throw new Error("durable retention: each policy must set maxAge and/or maxCount");
     }
-    if (policy.maxAge != null) (0, import_nestjs_durable_core11.parseDuration)(policy.maxAge);
+    if (policy.maxAge != null) (0, import_nestjs_durable_core12.parseDuration)(policy.maxAge);
     for (const status of policy.statuses) {
-      if (!import_nestjs_durable_core11.TERMINAL_RUN_STATUSES.includes(status)) {
-        throw new Error(`durable retention: status "${status}" is not terminal; only ${import_nestjs_durable_core11.TERMINAL_RUN_STATUSES.join(", ")} can be pruned`);
+      if (!import_nestjs_durable_core12.TERMINAL_RUN_STATUSES.includes(status)) {
+        throw new Error(`durable retention: status "${status}" is not terminal; only ${import_nestjs_durable_core12.TERMINAL_RUN_STATUSES.join(", ")} can be pruned`);
       }
       const key = `${scopeKey}|${status}`;
       if (seen.has(key)) {
@@ -1822,7 +1861,7 @@ var RetentionPoller = class {
       return;
     }
     await this.sweep();
-    const intervalMs = retention.sweepInterval != null ? (0, import_nestjs_durable_core11.parseDuration)(retention.sweepInterval) : DEFAULT_SWEEP_INTERVAL_MS;
+    const intervalMs = retention.sweepInterval != null ? (0, import_nestjs_durable_core12.parseDuration)(retention.sweepInterval) : DEFAULT_SWEEP_INTERVAL_MS;
     if (intervalMs > 0) {
       this.timer = setInterval(() => void this.sweep(), intervalMs);
       this.timer.unref?.();
@@ -1884,8 +1923,8 @@ var RetentionPoller = class {
 };
 RetentionPoller = _ts_decorate7([
   (0, import_common7.Injectable)(),
-  _ts_param4(0, (0, import_common7.Inject)(import_nestjs_durable_core11.STATE_STORE_CANONICAL)),
-  _ts_param4(1, (0, import_common7.Inject)(import_nestjs_durable_core11.DURABLE_OPTIONS_CANONICAL)),
+  _ts_param4(0, (0, import_common7.Inject)(import_nestjs_durable_core12.STATE_STORE_CANONICAL)),
+  _ts_param4(1, (0, import_common7.Inject)(import_nestjs_durable_core12.DURABLE_OPTIONS_CANONICAL)),
   _ts_metadata7("design:type", Function),
   _ts_metadata7("design:paramtypes", [
     Object,
@@ -1894,7 +1933,7 @@ RetentionPoller = _ts_decorate7([
 ], RetentionPoller);
 
 // src/store-run-gateway.ts
-var import_nestjs_durable_core12 = require("@dudousxd/nestjs-durable-core");
+var import_nestjs_durable_core13 = require("@dudousxd/nestjs-durable-core");
 var import_common8 = require("@nestjs/common");
 function _ts_decorate8(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -1952,10 +1991,10 @@ var StoreRunGateway = class {
         children
       };
     }
-    if ((0, import_nestjs_durable_core12.aggregatesCheckpoints)(this.store)) {
+    if ((0, import_nestjs_durable_core13.aggregatesCheckpoints)(this.store)) {
       const stats = await this.store.checkpointStats(runId);
-      const etag = (0, import_nestjs_durable_core12.runDetailEtag)(run, stats, over);
-      if ((0, import_nestjs_durable_core12.etagMatches)(options?.ifNoneMatch, etag)) {
+      const etag = (0, import_nestjs_durable_core13.runDetailEtag)(run, stats, over);
+      if ((0, import_nestjs_durable_core13.etagMatches)(options?.ifNoneMatch, etag)) {
         return {
           run,
           timeline: [],
@@ -1966,17 +2005,17 @@ var StoreRunGateway = class {
       }
       return {
         run,
-        ...await (0, import_nestjs_durable_core12.summarizeRunFromStore)(this.store, runId, over, stats),
+        ...await (0, import_nestjs_durable_core13.summarizeRunFromStore)(this.store, runId, over, stats),
         etag
       };
     }
     const full = await this.store.listCheckpoints(runId);
-    const { timeline, fans } = (0, import_nestjs_durable_core12.summarizeTimeline)(full, over);
-    const ids = (0, import_nestjs_durable_core12.childIdsOf)(full);
+    const { timeline, fans } = (0, import_nestjs_durable_core13.summarizeTimeline)(full, over);
+    const ids = (0, import_nestjs_durable_core13.childIdsOf)(full);
     return {
       run,
       timeline,
-      children: ids.slice(0, import_nestjs_durable_core12.SUMMARY_CHILD_LIMIT),
+      children: ids.slice(0, import_nestjs_durable_core13.SUMMARY_CHILD_LIMIT),
       fans,
       childCount: ids.length
     };
@@ -1986,12 +2025,12 @@ var StoreRunGateway = class {
   }
   async getFanMembers(runId, group, query) {
     if (!await this.store.getRun(runId)) return null;
-    if ((0, import_nestjs_durable_core12.aggregatesCheckpoints)(this.store)) {
+    if ((0, import_nestjs_durable_core13.aggregatesCheckpoints)(this.store)) {
       const stats = await this.store.checkpointStats(runId, {
         group
       });
-      const etag = (0, import_nestjs_durable_core12.fanPageEtag)(group, stats, query);
-      if ((0, import_nestjs_durable_core12.etagMatches)(query.ifNoneMatch, etag)) {
+      const etag = (0, import_nestjs_durable_core13.fanPageEtag)(group, stats, query);
+      if ((0, import_nestjs_durable_core13.etagMatches)(query.ifNoneMatch, etag)) {
         return {
           items: [],
           total: 0,
@@ -2000,17 +2039,17 @@ var StoreRunGateway = class {
         };
       }
       return {
-        ...await (0, import_nestjs_durable_core12.pageFanFromStore)(this.store, runId, group, query, stats),
+        ...await (0, import_nestjs_durable_core13.pageFanFromStore)(this.store, runId, group, query, stats),
         etag
       };
     }
-    return (0, import_nestjs_durable_core12.pageFan)(await this.store.listCheckpoints(runId), group, query);
+    return (0, import_nestjs_durable_core13.pageFan)(await this.store.listCheckpoints(runId), group, query);
   }
   async listRuns(query) {
     const runs = await this.store.listRuns(query);
-    const waiterByRun = (0, import_nestjs_durable_core12.indexWaitersByRun)(await (0, import_nestjs_durable_core12.listSignalWaitersOfRuns)(this.store, runs.filter((run) => run.status === "suspended").map((run) => run.id)));
+    const waiterByRun = (0, import_nestjs_durable_core13.indexWaitersByRun)(await (0, import_nestjs_durable_core13.listSignalWaitersOfRuns)(this.store, runs.filter((run) => run.status === "suspended").map((run) => run.id)));
     return runs.map((run) => {
-      const waiting = (0, import_nestjs_durable_core12.resolveRunWaiting)(run, waiterByRun);
+      const waiting = (0, import_nestjs_durable_core13.resolveRunWaiting)(run, waiterByRun);
       return waiting ? {
         ...run,
         waiting
@@ -2026,7 +2065,7 @@ var StoreRunGateway = class {
   async runFacets(query) {
     if (this.store.runFacets) return this.store.runFacets(query);
     const runs = await this.store.listRuns(query);
-    return (0, import_nestjs_durable_core12.mergeRunFacetRows)(runs.map((r) => ({
+    return (0, import_nestjs_durable_core13.mergeRunFacetRows)(runs.map((r) => ({
       status: r.status,
       origin: r.origin,
       count: 1
@@ -2061,13 +2100,13 @@ var StoreRunGateway = class {
           "suspended"
         ]
       }),
-      (0, import_nestjs_durable_core12.listSignalWaitersOfRuns)(this.store, runIds)
+      (0, import_nestjs_durable_core13.listSignalWaitersOfRuns)(this.store, runIds)
     ]);
-    const waiterByRun = (0, import_nestjs_durable_core12.indexWaitersByRun)(waiters);
+    const waiterByRun = (0, import_nestjs_durable_core13.indexWaitersByRun)(waiters);
     const result = {};
     for (const run of suspended) {
       if (!idSet.has(run.id)) continue;
-      const waiting = (0, import_nestjs_durable_core12.resolveRunWaiting)(run, waiterByRun);
+      const waiting = (0, import_nestjs_durable_core13.resolveRunWaiting)(run, waiterByRun);
       if (waiting) result[run.id] = waiting;
     }
     return result;
@@ -2101,11 +2140,11 @@ var StoreRunGateway = class {
 };
 StoreRunGateway = _ts_decorate8([
   (0, import_common8.Injectable)(),
-  _ts_param5(0, (0, import_common8.Inject)(import_nestjs_durable_core12.STATE_STORE_CANONICAL)),
+  _ts_param5(0, (0, import_common8.Inject)(import_nestjs_durable_core13.STATE_STORE_CANONICAL)),
   _ts_metadata8("design:type", Function),
   _ts_metadata8("design:paramtypes", [
     typeof StateStore === "undefined" ? Object : StateStore,
-    typeof import_nestjs_durable_core12.WorkflowEngine === "undefined" ? Object : import_nestjs_durable_core12.WorkflowEngine
+    typeof import_nestjs_durable_core13.WorkflowEngine === "undefined" ? Object : import_nestjs_durable_core13.WorkflowEngine
   ])
 ], StoreRunGateway);
 
@@ -2151,7 +2190,7 @@ var TenantEventRepublisher = class {
 };
 
 // src/timer-poller.ts
-var import_nestjs_durable_core13 = require("@dudousxd/nestjs-durable-core");
+var import_nestjs_durable_core14 = require("@dudousxd/nestjs-durable-core");
 var import_common9 = require("@nestjs/common");
 function _ts_decorate9(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -2195,7 +2234,7 @@ var TimerPoller = class {
     this.options = options;
   }
   async onApplicationBootstrap() {
-    for (const s of this.options.schedules ?? []) (0, import_nestjs_durable_core13.workflowName)(s.workflow);
+    for (const s of this.options.schedules ?? []) (0, import_nestjs_durable_core14.workflowName)(s.workflow);
     if (!isDrivingOperator(this.options)) return;
     this.unsubscribeEnqueued = this.engine.onEnqueued((runId) => {
       void this.engine.runOne(runId).catch((error) => {
@@ -2265,7 +2304,7 @@ var TimerPoller = class {
       await this.sweep("sweepStalled", async () => this.engine.sweepStalled?.());
       const schedules = this.options.schedules;
       if (schedules && schedules.length > 0) {
-        await this.sweep("schedules", () => (0, import_nestjs_durable_core13.runSchedules)(this.engine, schedules, Date.now()));
+        await this.sweep("schedules", () => (0, import_nestjs_durable_core14.runSchedules)(this.engine, schedules, Date.now()));
       }
       if (this.options.persistedSchedules) {
         await this.sweep("persistedSchedules", () => this.engine.schedules.tick());
@@ -2283,21 +2322,21 @@ var TimerPoller = class {
 };
 TimerPoller = _ts_decorate9([
   (0, import_common9.Injectable)(),
-  _ts_param6(1, (0, import_common9.Inject)(import_nestjs_durable_core13.DURABLE_OPTIONS_CANONICAL)),
+  _ts_param6(1, (0, import_common9.Inject)(import_nestjs_durable_core14.DURABLE_OPTIONS_CANONICAL)),
   _ts_metadata9("design:type", Function),
   _ts_metadata9("design:paramtypes", [
-    typeof import_nestjs_durable_core13.WorkflowEngine === "undefined" ? Object : import_nestjs_durable_core13.WorkflowEngine,
+    typeof import_nestjs_durable_core14.WorkflowEngine === "undefined" ? Object : import_nestjs_durable_core14.WorkflowEngine,
     typeof DurableModuleOptions === "undefined" ? Object : DurableModuleOptions
   ])
 ], TimerPoller);
 
 // src/tokens.ts
-var import_nestjs_durable_core14 = require("@dudousxd/nestjs-durable-core");
+var import_nestjs_durable_core15 = require("@dudousxd/nestjs-durable-core");
 var CONTEXT_ACCESSOR = Symbol.for("@dudousxd/nestjs-context:accessor");
-var RUN_GATEWAY = import_nestjs_durable_core14.RunGateway;
+var RUN_GATEWAY = import_nestjs_durable_core15.RunGateway;
 
 // src/workflow.registrar.ts
-var import_nestjs_durable_core15 = require("@dudousxd/nestjs-durable-core");
+var import_nestjs_durable_core16 = require("@dudousxd/nestjs-durable-core");
 var import_common10 = require("@nestjs/common");
 var import_core4 = require("@nestjs/core");
 
@@ -2407,11 +2446,11 @@ var WorkflowRegistrar = class {
       const body = io.wrap((ctx, input) => workflow.run(ctx, input));
       const eventBatch = meta.debounce ? {
         mode: "debounce",
-        windowMs: (0, import_nestjs_durable_core15.parseDuration)(meta.debounce)
+        windowMs: (0, import_nestjs_durable_core16.parseDuration)(meta.debounce)
       } : meta.batch ? {
         mode: "batch",
         maxSize: meta.batch.maxSize,
-        windowMs: (0, import_nestjs_durable_core15.parseDuration)(meta.batch.within)
+        windowMs: (0, import_nestjs_durable_core16.parseDuration)(meta.batch.within)
       } : void 0;
       const workflowCtor = workflow.constructor;
       const onError = onErrorHandlersOf(meta, workflow, this.metadataScanner);
@@ -2445,11 +2484,11 @@ var WorkflowRegistrar = class {
         // so a turn dispatched under the wrong token would never be consumed. Absent → the inline fast
         // path (unchanged).
         ...this.inAppWorker ? {
-          group: (0, import_nestjs_durable_core15.tenantGroup)((0, import_nestjs_durable_core15.sanitizeQueueToken)(meta.name), this.inAppWorker.partition),
-          executor: new import_nestjs_durable_core15.RemoteWorkflowExecutor(this.inAppWorker.transport, meta.name, this.inAppWorker.partition)
+          group: (0, import_nestjs_durable_core16.tenantGroup)((0, import_nestjs_durable_core16.sanitizeQueueToken)(meta.name), this.inAppWorker.partition),
+          executor: new import_nestjs_durable_core16.RemoteWorkflowExecutor(this.inAppWorker.transport, meta.name, this.inAppWorker.partition)
         } : {}
       });
-      (0, import_nestjs_durable_core15.bindWorkflowClass)(workflowCtor, {
+      (0, import_nestjs_durable_core16.bindWorkflowClass)(workflowCtor, {
         start: /* @__PURE__ */ __name((name, input, runId, opts) => this.engine.start(name, input, runId, opts), "start"),
         waitForRun: /* @__PURE__ */ __name((runId, opts) => this.engine.waitForRun(runId, opts), "waitForRun")
       });
@@ -2464,7 +2503,7 @@ var WorkflowRegistrar = class {
         });
         deadLetterByWorkflow.set(meta.name, dlqName);
       } else if (meta.deadLetterWorkflow) {
-        deadLetterByWorkflow.set(meta.name, (0, import_nestjs_durable_core15.workflowName)(meta.deadLetterWorkflow));
+        deadLetterByWorkflow.set(meta.name, (0, import_nestjs_durable_core16.workflowName)(meta.deadLetterWorkflow));
       }
     });
     this.reportUnattributed(unattributed);
@@ -2512,7 +2551,7 @@ var WorkflowRegistrar = class {
   * a `dlq:<runId>` id, so re-recovery never double-dispatches.
   */
   installDeadLetterRouting(byWorkflow) {
-    const fallback = this.options.deadLetterWorkflow ? (0, import_nestjs_durable_core15.workflowName)(this.options.deadLetterWorkflow) : void 0;
+    const fallback = this.options.deadLetterWorkflow ? (0, import_nestjs_durable_core16.workflowName)(this.options.deadLetterWorkflow) : void 0;
     if (byWorkflow.size === 0 && !fallback) return;
     this.engine.onDead((run) => {
       const target = byWorkflow.get(run.workflow) ?? fallback;
@@ -2537,14 +2576,14 @@ var WorkflowRegistrar = class {
 };
 WorkflowRegistrar = _ts_decorate10([
   (0, import_common10.Injectable)(),
-  _ts_param7(3, (0, import_common10.Inject)(import_nestjs_durable_core15.STATE_STORE_CANONICAL)),
-  _ts_param7(4, (0, import_common10.Inject)(import_nestjs_durable_core15.DURABLE_OPTIONS_CANONICAL)),
+  _ts_param7(3, (0, import_common10.Inject)(import_nestjs_durable_core16.STATE_STORE_CANONICAL)),
+  _ts_param7(4, (0, import_common10.Inject)(import_nestjs_durable_core16.DURABLE_OPTIONS_CANONICAL)),
   _ts_param7(5, (0, import_common10.Inject)(IN_APP_WORKER_BINDING)),
   _ts_metadata10("design:type", Function),
   _ts_metadata10("design:paramtypes", [
     typeof import_core4.DiscoveryService === "undefined" ? Object : import_core4.DiscoveryService,
     typeof import_core4.MetadataScanner === "undefined" ? Object : import_core4.MetadataScanner,
-    typeof import_nestjs_durable_core15.WorkflowEngine === "undefined" ? Object : import_nestjs_durable_core15.WorkflowEngine,
+    typeof import_nestjs_durable_core16.WorkflowEngine === "undefined" ? Object : import_nestjs_durable_core16.WorkflowEngine,
     Object,
     typeof DurableModuleOptions === "undefined" ? Object : DurableModuleOptions,
     Object
@@ -2553,7 +2592,7 @@ WorkflowRegistrar = _ts_decorate10([
 
 // src/workflow.service.ts
 var import_node_crypto = require("crypto");
-var import_nestjs_durable_core16 = require("@dudousxd/nestjs-durable-core");
+var import_nestjs_durable_core17 = require("@dudousxd/nestjs-durable-core");
 var import_common11 = require("@nestjs/common");
 function _ts_decorate11(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -2624,7 +2663,7 @@ WorkflowService = _ts_decorate11([
   (0, import_common11.Injectable)(),
   _ts_metadata11("design:type", Function),
   _ts_metadata11("design:paramtypes", [
-    typeof import_nestjs_durable_core16.WorkflowEngine === "undefined" ? Object : import_nestjs_durable_core16.WorkflowEngine
+    typeof import_nestjs_durable_core17.WorkflowEngine === "undefined" ? Object : import_nestjs_durable_core17.WorkflowEngine
   ])
 ], WorkflowService);
 
@@ -2821,7 +2860,15 @@ var RunGatewayBootstrap = class RunGatewayBootstrap2 {
         onRunRequest: onRunRequest.bind(this.transport),
         publishRunReply: publishRunReply.bind(this.transport)
       };
-      new RunRequestResponder(runRequestTransport, this.gateway).start();
+      new RunRequestResponder(runRequestTransport, this.gateway, {
+        verifyTenant: this.options.verifyTenant,
+        // Mirrors Agora's rule (`warnWithoutVerifier: role === 'control-plane'`): only a deployment
+        // that EXPLICITLY names itself the control plane is told it runs without tenant auth. A plain
+        // operator (role inferred from `store`) is Agora's `standalone`: anyone with broker access
+        // can already enqueue steps and results there, so the warning would be noise on every boot
+        // of an app that never serves tenants.
+        warnWithoutVerifier: this.options.topology?.role === "control-plane"
+      }).start();
     }
     if (typeof publishTenantEvent === "function") {
       const republisher = new TenantEventRepublisher(store, publishTenantEvent.bind(this.transport));
@@ -2836,14 +2883,14 @@ var RunGatewayBootstrap = class RunGatewayBootstrap2 {
 };
 RunGatewayBootstrap = _ts_decorate12([
   (0, import_common12.Injectable)(),
-  _ts_param8(1, (0, import_common12.Inject)(import_nestjs_durable_core17.TRANSPORT_CANONICAL)),
-  _ts_param8(3, (0, import_common12.Inject)(import_nestjs_durable_core17.STATE_STORE_CANONICAL)),
-  _ts_param8(4, (0, import_common12.Inject)(import_nestjs_durable_core17.DURABLE_OPTIONS_CANONICAL)),
+  _ts_param8(1, (0, import_common12.Inject)(import_nestjs_durable_core18.TRANSPORT_CANONICAL)),
+  _ts_param8(3, (0, import_common12.Inject)(import_nestjs_durable_core18.STATE_STORE_CANONICAL)),
+  _ts_param8(4, (0, import_common12.Inject)(import_nestjs_durable_core18.DURABLE_OPTIONS_CANONICAL)),
   _ts_metadata12("design:type", Function),
   _ts_metadata12("design:paramtypes", [
-    typeof import_nestjs_durable_core17.WorkflowEngine === "undefined" ? Object : import_nestjs_durable_core17.WorkflowEngine,
+    typeof import_nestjs_durable_core18.WorkflowEngine === "undefined" ? Object : import_nestjs_durable_core18.WorkflowEngine,
     Object,
-    typeof import_nestjs_durable_core17.RunGateway === "undefined" ? Object : import_nestjs_durable_core17.RunGateway,
+    typeof import_nestjs_durable_core18.RunGateway === "undefined" ? Object : import_nestjs_durable_core18.RunGateway,
     Object,
     typeof DurableModuleOptions === "undefined" ? Object : DurableModuleOptions
   ])
@@ -2855,13 +2902,13 @@ var DurableModule = class _DurableModule {
   static forRoot(options) {
     _DurableModule.assertValid(options);
     return _DurableModule.build({
-      provide: import_nestjs_durable_core17.DURABLE_OPTIONS_CANONICAL,
+      provide: import_nestjs_durable_core18.DURABLE_OPTIONS_CANONICAL,
       useValue: resolveTopology(options)
     });
   }
   static forRootAsync(options) {
     return _DurableModule.build({
-      provide: import_nestjs_durable_core17.DURABLE_OPTIONS_CANONICAL,
+      provide: import_nestjs_durable_core18.DURABLE_OPTIONS_CANONICAL,
       useFactory: /* @__PURE__ */ __name(async (...args) => {
         const resolved = await options.useFactory(...args);
         _DurableModule.assertValid(resolved);
@@ -2894,41 +2941,41 @@ var DurableModule = class _DurableModule {
       providers: [
         optionsProvider,
         {
-          provide: import_nestjs_durable_core17.STATE_STORE_CANONICAL,
+          provide: import_nestjs_durable_core18.STATE_STORE_CANONICAL,
           useFactory: /* @__PURE__ */ __name((options) => options.store !== void 0 ? scopedStore(options.store, options) : null, "useFactory"),
           inject: [
-            import_nestjs_durable_core17.DURABLE_OPTIONS_CANONICAL
+            import_nestjs_durable_core18.DURABLE_OPTIONS_CANONICAL
           ]
         },
         {
-          provide: import_nestjs_durable_core17.TRANSPORT_CANONICAL,
+          provide: import_nestjs_durable_core18.TRANSPORT_CANONICAL,
           // With a POOL (`transports`) and no singular `transport`, the canonical transport is the
           // pool's PRIMARY — the same one the engine dispatches on first. Leaving it null starved
           // the step registrar / in-app worker of a transport, so a pool-configured operator
           // registered NO step handlers and its own steps parked in `wait` with no consumer.
           useFactory: /* @__PURE__ */ __name((options) => options.transport ?? options.transports?.[0]?.transport ?? null, "useFactory"),
           inject: [
-            import_nestjs_durable_core17.DURABLE_OPTIONS_CANONICAL
+            import_nestjs_durable_core18.DURABLE_OPTIONS_CANONICAL
           ]
         },
         // Legacy back-compat aliases (deprecated tokens still resolve to the same instances):
         {
-          provide: import_nestjs_durable_core17.STATE_STORE,
-          useExisting: import_nestjs_durable_core17.STATE_STORE_CANONICAL
+          provide: import_nestjs_durable_core18.STATE_STORE,
+          useExisting: import_nestjs_durable_core18.STATE_STORE_CANONICAL
         },
         {
-          provide: import_nestjs_durable_core17.TRANSPORT,
-          useExisting: import_nestjs_durable_core17.TRANSPORT_CANONICAL
+          provide: import_nestjs_durable_core18.TRANSPORT,
+          useExisting: import_nestjs_durable_core18.TRANSPORT_CANONICAL
         },
         {
-          provide: import_nestjs_durable_core17.DURABLE_OPTIONS,
-          useExisting: import_nestjs_durable_core17.DURABLE_OPTIONS_CANONICAL
+          provide: import_nestjs_durable_core18.DURABLE_OPTIONS,
+          useExisting: import_nestjs_durable_core18.DURABLE_OPTIONS_CANONICAL
         },
         {
           // Shared token, bound EXACTLY once: a real engine for the operator role, or a store-less
           // `DurableStartClient` facade for a thin worker (no `store`) — either way, `WorkflowService`
           // and app code call `engine.start(...)` unchanged.
-          provide: import_nestjs_durable_core17.WorkflowEngine,
+          provide: import_nestjs_durable_core18.WorkflowEngine,
           useFactory: /* @__PURE__ */ __name(async (options, store, transport, moduleRef) => {
             if (options.store === void 0) {
               return new DurableStartClient(options);
@@ -2949,7 +2996,7 @@ var DurableModule = class _DurableModule {
                 if (t) deferTransportConsumers(t);
               }
             }
-            const engine = new import_nestjs_durable_core17.WorkflowEngine({
+            const engine = new import_nestjs_durable_core18.WorkflowEngine({
               store,
               transport: transport ?? void 0,
               transports: options.transports,
@@ -2973,6 +3020,7 @@ var DurableModule = class _DurableModule {
               context,
               rehydrate: rehydrate || void 0,
               compensationRetries: options.compensationRetries,
+              verifyTenant: options.verifyTenant,
               // A non-driving (dashboard/API) operator must not run workflows: enqueue-only, leaving
               // each `pending` run in the store for a DRIVING instance's poll. A driving operator gets
               // the engine's default in-process dispatcher: for a body registered inline, it runs
@@ -2989,9 +3037,9 @@ var DurableModule = class _DurableModule {
             return engine;
           }, "useFactory"),
           inject: [
-            import_nestjs_durable_core17.DURABLE_OPTIONS_CANONICAL,
-            import_nestjs_durable_core17.STATE_STORE_CANONICAL,
-            import_nestjs_durable_core17.TRANSPORT_CANONICAL,
+            import_nestjs_durable_core18.DURABLE_OPTIONS_CANONICAL,
+            import_nestjs_durable_core18.STATE_STORE_CANONICAL,
+            import_nestjs_durable_core18.TRANSPORT_CANONICAL,
             import_core5.ModuleRef
           ]
         },
@@ -3005,7 +3053,7 @@ var DurableModule = class _DurableModule {
         // or (for a thin worker, no `store`) a `ProxyRunGateway` over `transport` when given, else a
         // gateway whose every method rejects with a clear tenant error.
         {
-          provide: import_nestjs_durable_core17.RunGateway,
+          provide: import_nestjs_durable_core18.RunGateway,
           useFactory: /* @__PURE__ */ __name((options, store, engine) => {
             if (options.store !== void 0) {
               if (!store) {
@@ -3013,12 +3061,12 @@ var DurableModule = class _DurableModule {
               }
               return new StoreRunGateway(store, engine);
             }
-            return options.transport ? new ProxyRunGateway(options.transport, options.partition ?? "default", options.runGatewayTimeoutMs) : unavailableRunGateway();
+            return options.transport ? new ProxyRunGateway(options.transport, options.partition ?? "default", options.runGatewayTimeoutMs, void 0, options.tenantToken) : unavailableRunGateway();
           }, "useFactory"),
           inject: [
-            import_nestjs_durable_core17.DURABLE_OPTIONS_CANONICAL,
-            import_nestjs_durable_core17.STATE_STORE_CANONICAL,
-            import_nestjs_durable_core17.WorkflowEngine
+            import_nestjs_durable_core18.DURABLE_OPTIONS_CANONICAL,
+            import_nestjs_durable_core18.STATE_STORE_CANONICAL,
+            import_nestjs_durable_core18.WorkflowEngine
           ]
         },
         RunGatewayBootstrap,
@@ -3032,13 +3080,13 @@ var DurableModule = class _DurableModule {
       exports: [
         WorkflowService,
         EntityService,
-        import_nestjs_durable_core17.WorkflowEngine,
-        import_nestjs_durable_core17.STATE_STORE,
-        import_nestjs_durable_core17.STATE_STORE_CANONICAL,
-        import_nestjs_durable_core17.TRANSPORT,
-        import_nestjs_durable_core17.TRANSPORT_CANONICAL,
-        import_nestjs_durable_core17.DURABLE_OPTIONS_CANONICAL,
-        import_nestjs_durable_core17.RunGateway
+        import_nestjs_durable_core18.WorkflowEngine,
+        import_nestjs_durable_core18.STATE_STORE,
+        import_nestjs_durable_core18.STATE_STORE_CANONICAL,
+        import_nestjs_durable_core18.TRANSPORT,
+        import_nestjs_durable_core18.TRANSPORT_CANONICAL,
+        import_nestjs_durable_core18.DURABLE_OPTIONS_CANONICAL,
+        import_nestjs_durable_core18.RunGateway
       ]
     };
   }
@@ -3048,7 +3096,7 @@ DurableModule = _ts_decorate12([
 ], DurableModule);
 
 // src/index.ts
-var import_nestjs_durable_core18 = require("@dudousxd/nestjs-durable-core");
+var import_nestjs_durable_core19 = require("@dudousxd/nestjs-durable-core");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   CONTEXT_ACCESSOR,
@@ -3099,6 +3147,7 @@ var import_nestjs_durable_core18 = require("@dudousxd/nestjs-durable-core");
   getEntityMeta,
   getOnEvents,
   getWorkflowMeta,
+  hmacTenantVerifier,
   inAppWorkerProviders,
   isDeadLetterHandler,
   isDrivingOperator,
@@ -3110,6 +3159,7 @@ var import_nestjs_durable_core18 = require("@dudousxd/nestjs-durable-core");
   runSchedules,
   scheduleRunIdAt,
   scheduledRunId,
+  signTenantToken,
   thinWorkerProviders,
   unavailableRunGateway
 });