@temporalio/core-bridge 1.13.2 → 1.14.0

package/sdk-core/{client → crates/client}/src/workflow_handle/mod.rs

@@ -1,7 +1,7 @@
 use crate::WorkflowService;
 use anyhow::{anyhow, bail};
 use std::{fmt::Debug, marker::PhantomData};
-use temporal_sdk_core_protos::{
+use temporalio_common::protos::{
     coresdk::FromPayloadsExt,
     temporal::api::{
         common::v1::{Payload, WorkflowExecution},
@@ -47,12 +47,12 @@ where
 
 /// Options for fetching workflow results
 #[derive(Debug, Clone, Copy)]
-pub struct GetWorkflowResultOpts {
+pub struct GetWorkflowResultOptions {
     /// If true (the default), follows to the next workflow run in the execution chain while
     /// retrieving results.
     pub follow_runs: bool,
 }
-impl Default for GetWorkflowResultOpts {
+impl Default for GetWorkflowResultOptions {
     fn default() -> Self {
         Self { follow_runs: true }
     }
@@ -118,7 +118,7 @@ where
     /// Await the result of the workflow execution
     pub async fn get_workflow_result(
         &self,
-        opts: GetWorkflowResultOpts,
+        opts: GetWorkflowResultOptions,
     ) -> Result<WorkflowExecutionResult<RT>, anyhow::Error> {
         let mut next_page_tok = vec![];
         let mut run_id = self.info.run_id.clone().unwrap_or_default();

package/sdk-core/{core-api → crates/common}/Cargo.toml

@@ -1,10 +1,10 @@
 [package]
-name = "temporal-sdk-core-api"
+name = "temporalio-common"
 version = "0.1.0"
 edition = "2024"
-authors = ["Spencer Judge <spencer@temporal.io>"]
+authors = ["Temporal Technologies Inc. <sdk@temporal.io>"]
 license-file = { workspace = true }
-description = "Interface definitions for the Temporal Core SDK"
+description = "Common functionality for the Temporal SDK Core, Client, and Rust SDK"
 homepage = "https://temporal.io/"
 repository = "https://github.com/temporalio/sdk-core"
 keywords = ["temporal", "workflow"]
@@ -13,28 +13,37 @@ categories = ["development-tools"]
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [features]
+history_builders = ["rand"]
 otel_impls = ["dep:opentelemetry"]
-envconfig = ["dep:toml", "dep:serde", "dep:dirs"]
+envconfig = ["dep:toml", "dep:dirs"]
+serde_serialize = []
+test-utilities = ["history_builders"]
 
 [dependencies]
+anyhow = "1.0"
 async-trait = "0.1"
+base64 = "0.22"
 dirs = { version = "6.0", optional = true }
 derive_builder = { workspace = true }
 derive_more = { workspace = true }
 opentelemetry = { workspace = true, optional = true }
 prost = { workspace = true }
-serde = { version = "1.0", features = ["derive"], optional = true }
+prost-wkt = "0.7"
+prost-types = { workspace = true }
+rand = { version = "0.9", optional = true }
+serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 thiserror = { workspace = true }
 toml = { version = "0.9", optional = true }
 tonic = { workspace = true }
+tonic-prost = { workspace = true }
 tracing = "0.1"
 tracing-core = "0.1"
 url = "2.5"
+uuid = { version = "1.18", features = ["v4"] }
 
-[dependencies.temporal-sdk-core-protos]
-path = "../sdk-core-protos"
-version = "0.1"
+[build-dependencies]
+tonic-prost-build = { workspace = true }
 
 [lints]
 workspace = true

package/sdk-core/crates/common/protos/api_cloud_upstream/VERSION

@@ -0,0 +1 @@
+v0.8.0

package/sdk-core/{sdk-core-protos → crates/common}/protos/api_cloud_upstream/temporal/api/cloud/account/v1/message.proto

@@ -10,6 +10,7 @@ option ruby_package = "Temporalio::Api::Cloud::Account::V1";
 option csharp_namespace = "Temporalio.Api.Cloud.Account.V1";
 
 import "temporal/api/cloud/resource/v1/message.proto";
+import "temporal/api/cloud/sink/v1/message.proto";
 
 message MetricsSpec {
     // The ca cert(s) in PEM format that clients connecting to the metrics endpoint can use for authentication.
@@ -44,3 +45,20 @@ message Account {
     // Information related to metrics.
     Metrics metrics = 6;
 }
+
+// AuditLogSinkSpec is only used by Audit Log
+message AuditLogSinkSpec {
+  // Name of the sink e.g. "audit_log_01"
+  string name = 1;
+
+  oneof sink_type {
+    // The KinesisSpec when destination_type is Kinesis
+    api.cloud.sink.v1.KinesisSpec kinesis_sink = 2;
+
+    // The PubSubSpec when destination_type is PubSub
+    api.cloud.sink.v1.PubSubSpec pub_sub_sink = 3;
+  }
+
+  // Enabled indicates whether the sink is enabled or not.
+  bool enabled = 4;
+}

package/sdk-core/{sdk-core-protos → crates/common}/protos/api_cloud_upstream/temporal/api/cloud/cloudservice/v1/request_response.proto

@@ -22,7 +22,7 @@ import "temporal/api/cloud/connectivityrule/v1/message.proto";
 
 message GetUsersRequest {
     // The requested size of the page to retrieve - optional.
-    // Cannot exceed 1000. Defaults to 100. 
+    // Cannot exceed 1000. Defaults to 100.
     int32 page_size = 1;
     // The page token if this is continuing from another response - optional.
     string page_token = 2;
@@ -144,8 +144,8 @@ message CreateNamespaceResponse {
 
 message GetNamespacesRequest {
     // The requested size of the page to retrieve.
-    // Cannot exceed 1000. 
-    // Optional, defaults to 100. 
+    // Cannot exceed 1000.
+    // Optional, defaults to 100.
     int32 page_size = 1;
     // The page token if this is continuing from another response.
     // Optional, defaults to empty.
@@ -387,7 +387,7 @@ message DeleteApiKeyResponse {
 
 message GetNexusEndpointsRequest {
     // The requested size of the page to retrieve - optional.
-    // Cannot exceed 1000. Defaults to 100. 
+    // Cannot exceed 1000. Defaults to 100.
     int32 page_size = 1;
 
     // The page token if this is continuing from another response - optional.
@@ -694,6 +694,25 @@ message UpdateServiceAccountResponse {
     temporal.api.cloud.operation.v1.AsyncOperation async_operation = 1;
 }
 
+message SetServiceAccountNamespaceAccessRequest {
+    // The ID of the service account to update.
+    string service_account_id = 1;
+    // The namespace to set permissions for.
+    string namespace = 2;
+    // The namespace access to assign the service account.
+    temporal.api.cloud.identity.v1.NamespaceAccess access = 3;
+    // The version of the service account for which this update is intended for.
+    // The latest version can be found in the GetServiceAccount response.
+    string resource_version = 4;
+    // The ID to use for this async operation - optional.
+    string async_operation_id = 5;
+}
+
+message SetServiceAccountNamespaceAccessResponse {
+    // The async operation.
+    temporal.api.cloud.operation.v1.AsyncOperation async_operation = 1;
+}
+
 message DeleteServiceAccountRequest {
     // The ID of the service account to delete;
     string service_account_id = 1;
@@ -715,18 +734,18 @@ message GetUsageRequest {
     // Must be: within the last 90 days from the current date.
     // Must be: midnight UTC time.
     google.protobuf.Timestamp start_time_inclusive = 1;
-    
+
     // Filter for UTC time < - optional.
     // Defaults to: start of the next UTC day.
     // Must be: within the last 90 days from the current date.
     // Must be: midnight UTC time.
     google.protobuf.Timestamp end_time_exclusive = 2;
-    
+
     // The requested size of the page to retrieve - optional.
     // Each count corresponds to a single object - per day per namespace
     // Cannot exceed 1000. Defaults to 100.
     int32 page_size = 3;
-    
+
     // The page token if this is continuing from another response - optional.
     string page_token = 4;
 }
@@ -853,11 +872,11 @@ message ValidateNamespaceExportSinkResponse {
 message UpdateNamespaceTagsRequest {
     // The namespace to set tags for.
     string namespace = 1;
-    // A list of tags to add or update. 
-    // If a key of an existing tag is added, the tag's value is updated. 
+    // A list of tags to add or update.
+    // If a key of an existing tag is added, the tag's value is updated.
     // At least one of tags_to_upsert or tags_to_remove must be specified.
     map<string, string> tags_to_upsert = 2;
-    // A list of tag keys to remove. 
+    // A list of tag keys to remove.
     // If a tag key doesn't exist, it is silently ignored.
     // At least one of tags_to_upsert or tags_to_remove must be specified.
     repeated string tags_to_remove = 3;
@@ -868,7 +887,7 @@ message UpdateNamespaceTagsRequest {
 message UpdateNamespaceTagsResponse {
     // The async operation.
     temporal.api.cloud.operation.v1.AsyncOperation async_operation = 1;
-} 
+}
 
 message CreateConnectivityRuleRequest {
     // The connectivity rule specification.
@@ -928,3 +947,11 @@ message DeleteConnectivityRuleResponse {
     // The async operation
     temporal.api.cloud.operation.v1.AsyncOperation async_operation = 1;
 }
+
+message ValidateAccountAuditLogSinkRequest {
+  // The audit log sink spec that will be validated
+  temporal.api.cloud.account.v1.AuditLogSinkSpec spec = 1;
+}
+
+message ValidateAccountAuditLogSinkResponse {
+}

package/sdk-core/{sdk-core-protos → crates/common}/protos/api_cloud_upstream/temporal/api/cloud/cloudservice/v1/service.proto

@@ -21,7 +21,7 @@ service CloudService {
             get: "/cloud/users",
         };
     }
-    
+
     // Get a user
     rpc GetUser(GetUserRequest) returns (GetUserResponse) {
         option (google.api.http) = {
@@ -192,7 +192,7 @@ service CloudService {
             get: "/cloud/nexus/endpoints",
         };
     }
-    
+
     // Get a nexus endpoint
     rpc GetNexusEndpoint(GetNexusEndpointRequest) returns (GetNexusEndpointResponse) {
         option (google.api.http) = {
@@ -320,6 +320,14 @@ service CloudService {
         };
     }
 
+    // Set a service account's access to a namespace.
+    rpc SetServiceAccountNamespaceAccess(SetServiceAccountNamespaceAccessRequest) returns (SetServiceAccountNamespaceAccessResponse) {
+        option (google.api.http) = {
+            post: "/cloud/namespaces/{namespace}/service-accounts/{service_account_id}/access",
+            body: "*"
+        };
+    }
+
     // Delete a service account.
     rpc DeleteServiceAccount(DeleteServiceAccountRequest) returns (DeleteServiceAccountResponse) {
         option (google.api.http) = {
@@ -358,7 +366,7 @@ service CloudService {
         };
     }
 
-    // Get an export sink 
+    // Get an export sink
     rpc GetNamespaceExportSink(GetNamespaceExportSinkRequest) returns (GetNamespaceExportSinkResponse) {
         option (google.api.http) = {
             get: "/cloud/namespaces/{namespace}/export-sinks/{name}"
@@ -432,4 +440,13 @@ service CloudService {
             delete: "/cloud/connectivity-rules/{connectivity_rule_id}"
         };
     }
-}
+
+    // Validate customer audit log sink is accessible from Temporal's workflow by delivering an empty file to the specified sink.
+    // The operation verifies that the sink is correctly configured, accessible and ready to receive audit logs.
+    rpc ValidateAccountAuditLogSink(ValidateAccountAuditLogSinkRequest) returns (ValidateAccountAuditLogSinkResponse) {
+        option (google.api.http) = {
+            post: "/cloud/account/audit-logs/sink/validate",
+            body: "*"
+        };
+    }
+}

package/sdk-core/{sdk-core-protos → crates/common}/protos/api_cloud_upstream/temporal/api/cloud/operation/v1/message.proto

@@ -41,12 +41,12 @@ message AsyncOperation {
     google.protobuf.Timestamp finished_time = 8;
 
     enum State {
-	STATE_UNSPECIFIED = 0;
-	STATE_PENDING = 1;     // The operation is pending.
-	STATE_IN_PROGRESS = 2; // The operation is in progress.
-	STATE_FAILED = 3;      // The operation failed, check failure_reason for more details.
-	STATE_CANCELLED = 4;   // The operation was cancelled.
-	STATE_FULFILLED = 5;   // The operation was fulfilled.
+        STATE_UNSPECIFIED = 0;
+        STATE_PENDING = 1;     // The operation is pending.
+        STATE_IN_PROGRESS = 2; // The operation is in progress.
+        STATE_FAILED = 3;      // The operation failed, check failure_reason for more details.
+        STATE_CANCELLED = 4;   // The operation was cancelled.
+        STATE_FULFILLED = 5;   // The operation was fulfilled.
         STATE_REJECTED = 6;    // The operation was rejected.
     }
 }

package/sdk-core/{sdk-core-protos → crates/common}/protos/api_cloud_upstream/temporal/api/cloud/sink/v1/message.proto

@@ -38,4 +38,26 @@ message GCSSpec {
 
     // The region of the gcs bucket
     string region = 4;
+}
+
+message KinesisSpec {
+    // The role Temporal Cloud assumes when writing records to Kinesis
+    string role_name = 1;
+
+    // Destination Kinesis endpoint arn for temporal to send data to.
+    string destination_uri = 2;
+
+    // The sink's region.
+    string region = 3;
+}
+
+message PubSubSpec{
+    // The customer service account id that Temporal Cloud impersonates for writing records to customer's pubsub topic
+    string service_account_id = 1;
+
+    // Destination pubsub topic name for us
+    string topic_name = 2;
+
+    // The gcp project id of pubsub topic and service account
+    string gcp_project_id = 3;
 }

package/sdk-core/{sdk-core-protos → crates/common}/protos/api_upstream/.github/workflows/create-release.yml

@@ -20,6 +20,9 @@ on:
         description: An ID used by external tools to identify workflow runs(can be left empty when running manually)
         default: "none"
         type: string
+
+permissions:
+  contents: read
 jobs:
   dispatch:
     runs-on: ubuntu-latest
@@ -130,6 +133,8 @@ jobs:
           gh release create "$TAG" --target "$REF" --latest --generate-notes --notes-start-tag "$BASE_TAG" --draft
 
   release-api-go:
+    permissions:
+      contents: write
     needs: [prepare-inputs, create-release]
     if: |
       !cancelled() &&

package/sdk-core/{core-api → crates/common}/src/envconfig.rs

@@ -8,7 +8,7 @@
 //!
 //! The following environment variables are supported:
 //! - `TEMPORAL_CONFIG_FILE`: Path to the TOML configuration file
-//! - `TEMPORAL_PROFILE`: Profile name to use from the configuration file  
+//! - `TEMPORAL_PROFILE`: Profile name to use from the configuration file
 //! - `TEMPORAL_ADDRESS`: Temporal server address
 //! - `TEMPORAL_NAMESPACE`: Temporal namespace
 //! - `TEMPORAL_API_KEY`: API key for authentication
@@ -131,7 +131,7 @@ pub struct ClientConfigProfile {
 
     /// Client gRPC metadata (aka headers). When loading from TOML and env var, or writing to TOML, the keys are
     /// lowercased and underscores are replaced with hyphens. This is used for deduplicating/overriding too, so manually
-    /// set values that are not normalized may not get overridden with [ClientConfigProfile::apply_env_vars].
+    /// set values that are not normalized may not get overridden when applying environment variables.
     pub grpc_meta: HashMap<String, String>,
 }
 

package/sdk-core/{core-api → crates/common}/src/errors.rs

@@ -1,6 +1,6 @@
 //! Error types exposed by public APIs
 
-use temporal_sdk_core_protos::coresdk::activity_result::ActivityExecutionResult;
+use crate::protos::coresdk::activity_result::ActivityExecutionResult;
 
 /// Errors thrown by [crate::Worker::validate]
 #[derive(thiserror::Error, Debug)]
@@ -40,10 +40,14 @@ pub enum CompleteWfError {
         /// The run associated with the completion
         run_id: String,
     },
+    /// Workflows have not been enabled on this worker.
+    #[error("Workflows are not enabled on this worker")]
+    WorkflowNotEnabled,
 }
 
 /// Errors thrown by [crate::Worker::complete_activity_task]
 #[derive(thiserror::Error, Debug)]
+#[allow(clippy::large_enum_variant)]
 pub enum CompleteActivityError {
     /// Lang SDK sent us a malformed activity completion. This likely means a bug in the lang sdk.
     #[error("Lang SDK sent us a malformed activity completion ({reason}): {completion:?}")]
@@ -53,6 +57,9 @@ pub enum CompleteActivityError {
         /// The completion, which may not be included to avoid unnecessary copies.
         completion: Option<ActivityExecutionResult>,
     },
+    /// Activities have not been enabled on this worker.
+    #[error("Activities are not enabled on this worker")]
+    ActivityNotEnabled,
 }
 
 /// Errors thrown by [crate::Worker::complete_nexus_task]

package/sdk-core/{fsm/rustfsm_trait/src/lib.rs → crates/common/src/fsm_trait.rs}

@@ -30,7 +30,6 @@ pub trait StateMachine: Sized {
 
     /// Returns the current state of the machine
     fn state(&self) -> &Self::State;
-    fn set_state(&mut self, new_state: Self::State);
 
     /// Returns the current shared state of the machine
     fn shared_state(&self) -> &Self::SharedState;
@@ -41,6 +40,7 @@ pub trait StateMachine: Sized {
     /// Given the shared data and new state, create a new instance.
     fn from_parts(state: Self::State, shared: Self::SharedState) -> Self;
 
+    #[allow(dead_code)]
     /// Return a PlantUML definition of the fsm that can be used to visualize it
     fn visualizer() -> &'static str;
 }
@@ -70,36 +70,12 @@ impl<E: Error> Display for MachineError<E> {
 }
 impl<E: Error> Error for MachineError<E> {}
 
-pub enum MachineUpdate<Machine>
-where
-    Machine: StateMachine,
-{
-    InvalidTransition,
-    Ok { commands: Vec<Machine::Command> },
-}
-
-impl<M> MachineUpdate<M>
-where
-    M: StateMachine,
-{
-    /// Unwraps the machine update, panicking if the transition was invalid.
-    pub fn unwrap(self) -> Vec<M::Command> {
-        match self {
-            Self::Ok { commands } => commands,
-            Self::InvalidTransition => panic!("Transition was not successful!"),
-        }
-    }
-}
-
 /// A transition result is emitted every time the [StateMachine] handles an event.
 pub enum TransitionResult<Machine, DestinationState>
 where
     Machine: StateMachine,
     DestinationState: Into<Machine::State>,
 {
-    /// This state does not define a transition for this event from this state. All other errors
-    /// should use the [Err](enum.TransitionResult.html#variant.Err) variant.
-    InvalidTransition,
     /// The transition was successful
     Ok {
         commands: Vec<Machine::Command>,
@@ -178,7 +154,6 @@ where
     /// Turns more-specific (struct) transition result into more-general (enum) transition result
     pub fn into_general(self) -> TransitionResult<Sm, Sm::State> {
         match self {
-            TransitionResult::InvalidTransition => TransitionResult::InvalidTransition,
             TransitionResult::Ok {
                 commands,
                 new_state,
@@ -200,7 +175,6 @@ where
                 new_state,
                 commands,
             } => Ok((commands, new_state)),
-            TransitionResult::InvalidTransition => Err(MachineError::InvalidTransition),
             TransitionResult::Err(e) => Err(MachineError::Underlying(e)),
         }
     }

package/sdk-core/{core-api → crates/common}/src/lib.rs

@@ -1,6 +1,12 @@
+//! This crate contains base-level functionality needed by the other crates in the Temporal Core and
+//! Rust SDK.
+
 #[cfg(feature = "envconfig")]
 pub mod envconfig;
 pub mod errors;
+#[doc(hidden)]
+pub mod fsm_trait;
+pub mod protos;
 pub mod telemetry;
 pub mod worker;
 
@@ -9,16 +15,17 @@ use crate::{
         CompleteActivityError, CompleteNexusError, CompleteWfError, PollError,
         WorkerValidationError,
     },
+    protos::coresdk::{
+        ActivityHeartbeat, ActivityTaskCompletion,
+        activity_task::ActivityTask,
+        nexus::{NexusTask, NexusTaskCompletion},
+        workflow_activation::WorkflowActivation,
+        workflow_completion::WorkflowActivationCompletion,
+    },
     worker::WorkerConfig,
 };
 use std::sync::Arc;
-use temporal_sdk_core_protos::coresdk::{
-    ActivityHeartbeat, ActivityTaskCompletion,
-    activity_task::ActivityTask,
-    nexus::{NexusTask, NexusTaskCompletion},
-    workflow_activation::WorkflowActivation,
-    workflow_completion::WorkflowActivationCompletion,
-};
+use uuid::Uuid;
 
 /// This trait is the primary way by which language specific SDKs interact with the core SDK.
 /// It represents one worker, which has a (potentially shared) client for connecting to the service
@@ -125,8 +132,8 @@ pub trait Worker: Send + Sync {
     /// [Worker::complete_workflow_activation] and [Worker::complete_activity_task] for those
     /// workflows & activities until they are done. At that point, the lang SDK can end the process,
     /// or drop the [Worker] instance via [Worker::finalize_shutdown], which will close the
-    /// connection and free resources. If you have set [WorkerConfig::no_remote_activities], you may
-    /// skip calling [Worker::poll_activity_task].
+    /// connection and free resources. If you have set [WorkerConfig::task_types] to exclude
+    /// [worker::WorkerTaskTypes::activity_only()], you may skip calling [Worker::poll_activity_task].
     ///
     /// Lang implementations should use [Worker::initiate_shutdown] followed by
     /// [Worker::finalize_shutdown].
@@ -138,6 +145,10 @@ pub trait Worker: Send + Sync {
     /// This should be called only after [Worker::shutdown] has resolved and/or both polling
     /// functions have returned `ShutDown` errors.
     async fn finalize_shutdown(self);
+
+    /// Unique identifier for this worker instance.
+    /// This must be stable across the worker's lifetime and unique per instance.
+    fn worker_instance_key(&self) -> Uuid;
 }
 
 #[async_trait::async_trait]
@@ -205,6 +216,10 @@ where
     async fn finalize_shutdown(self) {
         panic!("Can't finalize shutdown on Arc'd worker")
     }
+
+    fn worker_instance_key(&self) -> Uuid {
+        (**self).worker_instance_key()
+    }
 }
 
 macro_rules! dbg_panic {

package/sdk-core/{sdk-core-protos/src → crates/common/src/protos}/canned_histories.rs

@@ -1,4 +1,4 @@
-use crate::{
+use crate::protos::{
     TestHistoryBuilder,
     coresdk::common::NamespacedWorkflowExecution,
     temporal::api::{

package/sdk-core/{sdk-core-protos/src → crates/common/src/protos}/history_builder.rs

@@ -1,4 +1,4 @@
-use crate::{
+use crate::protos::{
     HistoryInfo,
     constants::{LOCAL_ACTIVITY_MARKER_NAME, PATCH_MARKER_NAME},
     coresdk::{

package/sdk-core/{sdk-core-protos/src → crates/common/src/protos}/history_info.rs

@@ -1,4 +1,4 @@
-use crate::temporal::api::{
+use crate::protos::temporal::api::{
     common::v1::WorkflowType,
     enums::v1::{EventType, TaskQueueKind},
     history::v1::{History, HistoryEvent, WorkflowExecutionStartedEventAttributes, history_event},
@@ -207,7 +207,7 @@ impl From<HistoryInfo> for GetWorkflowExecutionHistoryResponse {
 
 #[cfg(test)]
 mod tests {
-    use crate::{TestHistoryBuilder, temporal::api::enums::v1::EventType};
+    use crate::protos::{TestHistoryBuilder, temporal::api::enums::v1::EventType};
 
     fn single_timer(timer_id: &str) -> TestHistoryBuilder {
         let mut t = TestHistoryBuilder::default();