@xemahq/temporal-runtime 0.5.2 → 0.7.0

package/dist/lib/connection.js

@@ -1,62 +1,174 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.TEMPORAL_CONNECTION_ENV = void 0;
+exports.temporalClientCredentialsFromEnv = temporalClientCredentialsFromEnv;
+exports.temporalConnectionOptionsFromEnv = temporalConnectionOptionsFromEnv;
+exports.validateTemporalConnectionOptions = validateTemporalConnectionOptions;
 exports.connectTemporalWorker = connectTemporalWorker;
 exports.connectTemporalClient = connectTemporalClient;
-exports.resolveTemporalConnectionOptionsFromEnv = resolveTemporalConnectionOptionsFromEnv;
-const node_fs_1 = require("node:fs");
+const promises_1 = require("node:fs/promises");
 const client_1 = require("@temporalio/client");
 const worker_1 = require("@temporalio/worker");
-function readTlsPair(tls) {
-    return {
-        clientCertPair: {
-            crt: (0, node_fs_1.readFileSync)(tls.clientCertPath),
-            key: (0, node_fs_1.readFileSync)(tls.clientKeyPath),
+const bounded_retry_1 = require("./bounded-retry");
+const client_credentials_token_source_1 = require("./client-credentials-token-source");
+const proactive_token_refresher_1 = require("./proactive-token-refresher");
+exports.TEMPORAL_CONNECTION_ENV = {
+    address: 'TEMPORAL_ADDRESS',
+    tlsCaPath: 'TEMPORAL_TLS_CA_PATH',
+    tlsServerName: 'TEMPORAL_TLS_SERVER_NAME',
+    tlsClientCertPath: 'TEMPORAL_TLS_CLIENT_CERT_PATH',
+    tlsClientKeyPath: 'TEMPORAL_TLS_CLIENT_KEY_PATH',
+    tokenEndpoint: 'TEMPORAL_AUTH_TOKEN_ENDPOINT',
+    clientId: 'TEMPORAL_AUTH_CLIENT_ID',
+    clientSecretFile: 'TEMPORAL_AUTH_CLIENT_SECRET_FILE',
+    audience: 'TEMPORAL_AUTH_AUDIENCE',
+};
+const RETIRED_CONNECTION_ENV = ['TEMPORAL_TLS_ENABLED'];
+function required(env, name) {
+    const value = env(name)?.trim();
+    if (!value) {
+        throw new Error(`${name} is required for a Temporal connection: every worker and client ` +
+            'connects to the frontend over TLS with an infra-realm bearer token, and ' +
+            'there is no plaintext or unauthenticated mode.');
+    }
+    return value;
+}
+function optional(env, name) {
+    const value = env(name)?.trim();
+    return value ? value : undefined;
+}
+function temporalClientCredentialsFromEnv(env) {
+    const options = {
+        tokenEndpoint: required(env, exports.TEMPORAL_CONNECTION_ENV.tokenEndpoint),
+        clientId: required(env, exports.TEMPORAL_CONNECTION_ENV.clientId),
+        clientSecretFile: required(env, exports.TEMPORAL_CONNECTION_ENV.clientSecretFile),
+        audience: required(env, exports.TEMPORAL_CONNECTION_ENV.audience),
+    };
+    (0, client_credentials_token_source_1.validateClientCredentialsOptions)(options);
+    return options;
+}
+function temporalConnectionOptionsFromEnv(env) {
+    for (const retired of RETIRED_CONNECTION_ENV) {
+        if (env(retired) !== undefined) {
+            throw new Error(`${retired} is set, but the opt-in TLS mode it controlled is removed: TLS and ` +
+                `an infra-realm bearer are unconditional. Remove ${retired} from the deployment.`);
+        }
+    }
+    const clientCertPath = optional(env, exports.TEMPORAL_CONNECTION_ENV.tlsClientCertPath);
+    const clientKeyPath = optional(env, exports.TEMPORAL_CONNECTION_ENV.tlsClientKeyPath);
+    const serverName = optional(env, exports.TEMPORAL_CONNECTION_ENV.tlsServerName);
+    const options = {
+        address: required(env, exports.TEMPORAL_CONNECTION_ENV.address),
+        tls: {
+            serverCaPath: required(env, exports.TEMPORAL_CONNECTION_ENV.tlsCaPath),
+            ...(serverName !== undefined ? { serverName } : {}),
+            ...(clientCertPath !== undefined ? { clientCertPath } : {}),
+            ...(clientKeyPath !== undefined ? { clientKeyPath } : {}),
         },
-        ...(tls.serverName !== undefined
-            ? { serverNameOverride: tls.serverName }
-            : {}),
+        credentials: temporalClientCredentialsFromEnv(env),
     };
+    validateTemporalConnectionOptions(options);
+    return options;
 }
-async function connectTemporalWorker(options) {
-    if (!options.tls) {
-        return worker_1.NativeConnection.connect({ address: options.address });
+function validateTemporalConnectionOptions(options) {
+    if (options.address.trim().length === 0) {
+        throw new Error('Temporal connection: address is required.');
     }
-    return worker_1.NativeConnection.connect({
-        address: options.address,
-        tls: readTlsPair(options.tls),
-    });
+    if (options.tls.serverCaPath.trim().length === 0) {
+        throw new Error('Temporal connection: tls.serverCaPath is required.');
+    }
+    const hasCert = options.tls.clientCertPath !== undefined;
+    const hasKey = options.tls.clientKeyPath !== undefined;
+    if (hasCert !== hasKey) {
+        throw new Error('Temporal connection: tls.clientCertPath and tls.clientKeyPath are a pair — set both or neither.');
+    }
+    (0, client_credentials_token_source_1.validateClientCredentialsOptions)(options.credentials);
 }
-async function connectTemporalClient(options) {
-    if (!options.tls) {
-        return client_1.Connection.connect({ address: options.address });
+async function resolveTls(tls, read) {
+    const serverRootCACertificate = await read(tls.serverCaPath);
+    if (serverRootCACertificate.length === 0) {
+        throw new Error(`Temporal server CA file ${tls.serverCaPath} is empty.`);
+    }
+    const config = { serverRootCACertificate };
+    if (tls.serverName !== undefined)
+        config.serverNameOverride = tls.serverName;
+    if (tls.clientCertPath !== undefined && tls.clientKeyPath !== undefined) {
+        config.clientCertPair = {
+            crt: await read(tls.clientCertPath),
+            key: await read(tls.clientKeyPath),
+        };
     }
-    return client_1.Connection.connect({
-        address: options.address,
-        tls: readTlsPair(options.tls),
+    return config;
+}
+async function startTokens(options, deps) {
+    const source = deps.tokenSource ?? (0, client_credentials_token_source_1.createClientCredentialsTokenSource)(options.credentials, deps);
+    return proactive_token_refresher_1.ProactiveTokenRefresher.start({
+        source,
+        description: `client ${options.credentials.clientId}`,
+        startupRetry: options.connectRetry ?? bounded_retry_1.DEFAULT_BOUNDED_RETRY_POLICY,
+        ...(deps.logger !== undefined ? { logger: deps.logger } : {}),
+        ...(deps.clock !== undefined ? { clock: deps.clock } : {}),
+        ...(deps.onCredentialFailure !== undefined ? { onFatal: deps.onCredentialFailure } : {}),
     });
 }
-function resolveTemporalConnectionOptionsFromEnv() {
-    const address = process.env.TEMPORAL_ADDRESS?.trim();
-    if (!address) {
-        throw new Error('TEMPORAL_ADDRESS is required for a Temporal connection.');
+async function prepare(options, deps) {
+    validateTemporalConnectionOptions(options);
+    const tls = await resolveTls(options.tls, deps.readFile ?? ((path) => (0, promises_1.readFile)(path)));
+    const tokens = await startTokens(options, deps);
+    return {
+        tls,
+        tokens,
+        retry: options.connectRetry ?? bounded_retry_1.DEFAULT_BOUNDED_RETRY_POLICY,
+        clock: deps.clock ?? bounded_retry_1.SYSTEM_CLOCK,
+    };
+}
+function onceClose(close) {
+    let closing = null;
+    return () => (closing ??= close());
+}
+async function connectTemporalWorker(options, deps = {}) {
+    const { tls, tokens, retry, clock } = await prepare(options, deps);
+    let connection;
+    try {
+        connection = await (0, bounded_retry_1.withBoundedRetry)(`Connecting a Temporal worker to ${options.address}`, () => worker_1.NativeConnection.connect({ address: options.address, tls, apiKey: tokens.token() }), retry, clock, (attempt, error, delay) => deps.logger?.warn(`Temporal worker connection to ${options.address}: attempt ${attempt} failed ` +
+            `(${error instanceof Error ? error.message : String(error)}); retrying in ${delay}ms.`));
     }
-    if (process.env.TEMPORAL_TLS_ENABLED !== 'true') {
-        return { address };
+    catch (error) {
+        tokens.stop();
+        throw error;
     }
-    const clientCertPath = process.env.TEMPORAL_TLS_CLIENT_CERT_PATH?.trim();
-    const clientKeyPath = process.env.TEMPORAL_TLS_CLIENT_KEY_PATH?.trim();
-    if (!clientCertPath || !clientKeyPath) {
-        throw new Error('TEMPORAL_TLS_ENABLED=true requires both TEMPORAL_TLS_CLIENT_CERT_PATH ' +
-            'and TEMPORAL_TLS_CLIENT_KEY_PATH.');
+    await tokens.subscribe((token) => connection.setApiKey(token.value));
+    return {
+        connection,
+        tokens,
+        close: onceClose(async () => {
+            tokens.stop();
+            await connection.close();
+        }),
+    };
+}
+async function connectTemporalClient(options, deps = {}) {
+    const { tls, tokens, retry, clock } = await prepare(options, deps);
+    let connection;
+    try {
+        connection = await (0, bounded_retry_1.withBoundedRetry)(`Connecting a Temporal client to ${options.address}`, () => client_1.Connection.connect({
+            address: options.address,
+            tls,
+            apiKey: () => tokens.token(),
+        }), retry, clock, (attempt, error, delay) => deps.logger?.warn(`Temporal client connection to ${options.address}: attempt ${attempt} failed ` +
+            `(${error instanceof Error ? error.message : String(error)}); retrying in ${delay}ms.`));
+    }
+    catch (error) {
+        tokens.stop();
+        throw error;
     }
-    const serverName = process.env.TEMPORAL_TLS_SERVER_NAME?.trim();
     return {
-        address,
-        tls: {
-            clientCertPath,
-            clientKeyPath,
-            ...(serverName ? { serverName } : {}),
-        },
+        connection,
+        tokens,
+        close: onceClose(async () => {
+            tokens.stop();
+            await connection.close();
+        }),
     };
 }
 //# sourceMappingURL=connection.js.map

package/dist/lib/connection.js.map

@@ -1 +1 @@
-{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../src/lib/connection.ts"],"names":[],"mappings":";;AAyDA,sDAUC;AAOD,sDAUC;AAWD,0FAyBC;AAxHD,qCAAuC;AAEvC,+CAAgD;AAChD,+CAAsD;AAoCtD,SAAS,WAAW,CAClB,GAAkD;IAElD,OAAO;QACL,cAAc,EAAE;YACd,GAAG,EAAE,IAAA,sBAAY,EAAC,GAAG,CAAC,cAAc,CAAC;YACrC,GAAG,EAAE,IAAA,sBAAY,EAAC,GAAG,CAAC,aAAa,CAAC;SACrC;QACD,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS;YAC9B,CAAC,CAAC,EAAE,kBAAkB,EAAE,GAAG,CAAC,UAAU,EAAE;YACxC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAMM,KAAK,UAAU,qBAAqB,CACzC,OAAkC;IAElC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjB,OAAO,yBAAgB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,yBAAgB,CAAC,OAAO,CAAC;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC;KAC9B,CAAC,CAAC;AACL,CAAC;AAOM,KAAK,UAAU,qBAAqB,CACzC,OAAkC;IAElC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjB,OAAO,mBAAU,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,mBAAU,CAAC,OAAO,CAAC;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC;KAC9B,CAAC,CAAC;AACL,CAAC;AAWD,SAAgB,uCAAuC;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,MAAM,EAAE,CAAC;QAChD,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE,CAAC;IACzE,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,CAAC;IACvE,IAAI,CAAC,cAAc,IAAI,CAAC,aAAa,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,wEAAwE;YACtE,mCAAmC,CACtC,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAC;IAChE,OAAO;QACL,OAAO;QACP,GAAG,EAAE;YACH,cAAc;YACd,aAAa;YACb,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../src/lib/connection.ts"],"names":[],"mappings":";;;AAgIA,4EASC;AASD,4EAwBC;AAGD,8EAeC;AA8DD,sDAiCC;AAOD,sDAmCC;AArUD,+CAA4C;AAE5C,+CAAgE;AAChE,+CAAsD;AAGtD,mDAMyB;AACzB,uFAK2C;AAE3C,2EAGqC;AAoExB,QAAA,uBAAuB,GAAG;IACrC,OAAO,EAAE,kBAAkB;IAC3B,SAAS,EAAE,sBAAsB;IACjC,aAAa,EAAE,0BAA0B;IACzC,iBAAiB,EAAE,+BAA+B;IAClD,gBAAgB,EAAE,8BAA8B;IAChD,aAAa,EAAE,8BAA8B;IAC7C,QAAQ,EAAE,yBAAyB;IACnC,gBAAgB,EAAE,kCAAkC;IACpD,QAAQ,EAAE,wBAAwB;CAC1B,CAAC;AAGX,MAAM,sBAAsB,GAAG,CAAC,sBAAsB,CAAU,CAAC;AAEjE,SAAS,QAAQ,CAAC,GAAsB,EAAE,IAAY;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,kEAAkE;YACvE,0EAA0E;YAC1E,gDAAgD,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,GAAsB,EAAE,IAAY;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IAChC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACnC,CAAC;AAOD,SAAgB,gCAAgC,CAAC,GAAsB;IACrE,MAAM,OAAO,GAA6B;QACxC,aAAa,EAAE,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,aAAa,CAAC;QACnE,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,QAAQ,CAAC;QACzD,gBAAgB,EAAE,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,gBAAgB,CAAC;QACzE,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,QAAQ,CAAC;KAC1D,CAAC;IACF,IAAA,kEAAgC,EAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,OAAO,CAAC;AACjB,CAAC;AASD,SAAgB,gCAAgC,CAAC,GAAsB;IACrE,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;QAC7C,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,qEAAqE;gBAC7E,mDAAmD,OAAO,uBAAuB,CACpF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,cAAc,GAAG,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,iBAAiB,CAAC,CAAC;IAChF,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,gBAAgB,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,aAAa,CAAC,CAAC;IACxE,MAAM,OAAO,GAA8B;QACzC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,OAAO,CAAC;QACvD,GAAG,EAAE;YACH,YAAY,EAAE,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,SAAS,CAAC;YAC9D,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D;QACD,WAAW,EAAE,gCAAgC,CAAC,GAAG,CAAC;KACnD,CAAC;IACF,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC;AACjB,CAAC;AAGD,SAAgB,iCAAiC,CAAC,OAAkC;IAClF,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC;IACvD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,iGAAiG,CAClG,CAAC;IACJ,CAAC;IACD,IAAA,kEAAgC,EAAC,OAAO,CAAC,WAAW,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAuB,EACvB,IAAuC;IAGvC,MAAM,uBAAuB,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC7D,IAAI,uBAAuB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,YAAY,YAAY,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,MAAM,GAAc,EAAE,uBAAuB,EAAE,CAAC;IACtD,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS;QAAE,MAAM,CAAC,kBAAkB,GAAG,GAAG,CAAC,UAAU,CAAC;IAC7E,IAAI,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACxE,MAAM,CAAC,cAAc,GAAG;YACtB,GAAG,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;YACnC,GAAG,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;SACnC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,OAAkC,EAClC,IAA4B;IAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,IAAI,IAAA,oEAAkC,EAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACjG,OAAO,mDAAuB,CAAC,KAAK,CAAC;QACnC,MAAM;QACN,WAAW,EAAE,UAAU,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE;QACrD,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,4CAA4B;QAClE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,OAAkC,EAClC,IAA4B;IAE5B,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,mBAAQ,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAChD,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK,EAAE,OAAO,CAAC,YAAY,IAAI,4CAA4B;QAC3D,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,4BAAY;KAClC,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAA0B;IAC3C,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,OAAO,GAAG,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC;AACrC,CAAC;AAOM,KAAK,UAAU,qBAAqB,CACzC,OAAkC,EAClC,OAA+B,EAAE;IAEjC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,UAA4B,CAAC;IACjC,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,IAAA,gCAAgB,EACjC,mCAAmC,OAAO,CAAC,OAAO,EAAE,EACpD,GAAG,EAAE,CAAC,yBAAgB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,EACzF,KAAK,EACL,KAAK,EACL,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CACxB,IAAI,CAAC,MAAM,EAAE,IAAI,CACf,iCAAiC,OAAO,CAAC,OAAO,aAAa,OAAO,UAAU;YAC5E,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,KAAK,KAAK,CACzF,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,KAAK,CAAC;IACd,CAAC;IAGD,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,OAAO;QACL,UAAU;QACV,MAAM;QACN,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;QAC3B,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAOM,KAAK,UAAU,qBAAqB,CACzC,OAAkC,EAClC,OAA+B,EAAE;IAEjC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,UAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,IAAA,gCAAgB,EACjC,mCAAmC,OAAO,CAAC,OAAO,EAAE,EACpD,GAAG,EAAE,CACH,mBAAU,CAAC,OAAO,CAAC;YACjB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG;YACH,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;SAC7B,CAAC,EACJ,KAAK,EACL,KAAK,EACL,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CACxB,IAAI,CAAC,MAAM,EAAE,IAAI,CACf,iCAAiC,OAAO,CAAC,OAAO,aAAa,OAAO,UAAU;YAC5E,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,KAAK,KAAK,CACzF,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO;QACL,UAAU;QACV,MAAM;QACN,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;QAC3B,CAAC,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/lib/controller-token-publisher.d.ts

@@ -0,0 +1,51 @@
+import type { AccessTokenSource } from './access-token';
+import type { RetryClock } from './bounded-retry';
+import type { TemporalEnvReader } from './namespace';
+import { ProactiveTokenRefresher, type AccessTokenListener, type TokenRefresherLogger } from './proactive-token-refresher';
+export declare const CONTROLLER_TOKEN_PUBLISHER_ENV: {
+    readonly secretName: "XEMA_TEMPORAL_CONTROLLER_TOKEN_SECRET";
+    readonly secretKey: "XEMA_TEMPORAL_CONTROLLER_TOKEN_KEY";
+    readonly apiHost: "KUBERNETES_SERVICE_HOST";
+    readonly apiPort: "KUBERNETES_SERVICE_PORT";
+};
+export declare const IN_CLUSTER_SERVICE_ACCOUNT_DIR = "/var/run/secrets/kubernetes.io/serviceaccount";
+export interface KubernetesSecretTarget {
+    readonly apiServer: string;
+    readonly namespace: string;
+    readonly secretName: string;
+    readonly secretKey: string;
+    readonly serviceAccountTokenFile: string;
+    readonly caFile: string;
+}
+export type SecretPatchRequest = (input: {
+    readonly url: string;
+    readonly ca: string;
+    readonly bearer: string;
+    readonly body: string;
+}) => Promise<{
+    readonly status: number;
+    readonly body: string;
+}>;
+export interface KubernetesSecretSinkDeps {
+    readonly readFile?: (path: string) => Promise<string>;
+    readonly request?: SecretPatchRequest;
+}
+export declare class ControllerTokenSinkError extends Error {
+    constructor(message: string);
+}
+export declare function kubernetesSecretTokenSink(target: KubernetesSecretTarget, deps?: KubernetesSecretSinkDeps): AccessTokenListener;
+export interface ControllerTokenPublisherOptions {
+    readonly source: AccessTokenSource;
+    readonly clientId: string;
+    readonly target: KubernetesSecretTarget;
+}
+export declare function controllerTokenPublisherOptionsFromEnv(env: TemporalEnvReader, deps?: {
+    readonly readFile?: (path: string) => Promise<string>;
+    readonly serviceAccountDir?: string;
+}): Promise<ControllerTokenPublisherOptions>;
+export declare function startControllerTokenPublisher(options: ControllerTokenPublisherOptions, deps?: KubernetesSecretSinkDeps & {
+    readonly logger?: TokenRefresherLogger;
+    readonly onFatal?: (error: Error) => void;
+    readonly clock?: RetryClock;
+}): Promise<ProactiveTokenRefresher>;
+//# sourceMappingURL=controller-token-publisher.d.ts.map

package/dist/lib/controller-token-publisher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller-token-publisher.d.ts","sourceRoot":"","sources":["../../src/lib/controller-token-publisher.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAe,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGlD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,uBAAuB,EACvB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EAC1B,MAAM,6BAA6B,CAAC;AAwBrC,eAAO,MAAM,8BAA8B;;;;;CAKjC,CAAC;AAGX,eAAO,MAAM,8BAA8B,kDAAkD,CAAC;AAG9F,MAAM,WAAW,sBAAsB;IAErC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IAEzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAGD,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,KAAK,OAAO,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAElE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACtD,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC;CACvC;AAOD,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAoCD,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,sBAAsB,EAC9B,IAAI,GAAE,wBAA6B,GAClC,mBAAmB,CAyBrB;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAEnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;CACzC;AASD,wBAAsB,sCAAsC,CAC1D,GAAG,EAAE,iBAAiB,EACtB,IAAI,GAAE;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAO,GACxG,OAAO,CAAC,+BAA+B,CAAC,CAwB1C;AASD,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,+BAA+B,EACxC,IAAI,GAAE,wBAAwB,GAAG;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;CACxB,GACL,OAAO,CAAC,uBAAuB,CAAC,CAelC"}

package/dist/lib/controller-token-publisher.js

@@ -0,0 +1,116 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ControllerTokenSinkError = exports.IN_CLUSTER_SERVICE_ACCOUNT_DIR = exports.CONTROLLER_TOKEN_PUBLISHER_ENV = void 0;
+exports.kubernetesSecretTokenSink = kubernetesSecretTokenSink;
+exports.controllerTokenPublisherOptionsFromEnv = controllerTokenPublisherOptionsFromEnv;
+exports.startControllerTokenPublisher = startControllerTokenPublisher;
+const promises_1 = require("node:fs/promises");
+const node_https_1 = require("node:https");
+const client_credentials_token_source_1 = require("./client-credentials-token-source");
+const connection_1 = require("./connection");
+const proactive_token_refresher_1 = require("./proactive-token-refresher");
+exports.CONTROLLER_TOKEN_PUBLISHER_ENV = {
+    secretName: 'XEMA_TEMPORAL_CONTROLLER_TOKEN_SECRET',
+    secretKey: 'XEMA_TEMPORAL_CONTROLLER_TOKEN_KEY',
+    apiHost: 'KUBERNETES_SERVICE_HOST',
+    apiPort: 'KUBERNETES_SERVICE_PORT',
+};
+exports.IN_CLUSTER_SERVICE_ACCOUNT_DIR = '/var/run/secrets/kubernetes.io/serviceaccount';
+const SECRET_NAME = /^[a-z0-9]([-a-z0-9.]{0,251}[a-z0-9])?$/;
+const SECRET_KEY = /^[-._a-zA-Z0-9]{1,253}$/;
+const REQUEST_TIMEOUT_MS = 10_000;
+class ControllerTokenSinkError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ControllerTokenSinkError';
+    }
+}
+exports.ControllerTokenSinkError = ControllerTokenSinkError;
+const defaultRequest = ({ url, ca, bearer, body }) => new Promise((resolve, reject) => {
+    const req = (0, node_https_1.request)(url, {
+        method: 'PATCH',
+        ca,
+        timeout: REQUEST_TIMEOUT_MS,
+        headers: {
+            authorization: `Bearer ${bearer}`,
+            'content-type': 'application/merge-patch+json',
+            accept: 'application/json',
+            'content-length': Buffer.byteLength(body),
+        },
+    }, (res) => {
+        const chunks = [];
+        res.on('data', (chunk) => chunks.push(chunk));
+        res.on('end', () => resolve({ status: res.statusCode ?? 0, body: Buffer.concat(chunks).toString('utf8') }));
+        res.on('error', reject);
+    });
+    req.on('timeout', () => req.destroy(new Error(`PATCH ${url} timed out after ${REQUEST_TIMEOUT_MS}ms`)));
+    req.on('error', reject);
+    req.end(body);
+});
+function kubernetesSecretTokenSink(target, deps = {}) {
+    if (!SECRET_NAME.test(target.secretName)) {
+        throw new ControllerTokenSinkError(`secret name ${JSON.stringify(target.secretName)} is not a Kubernetes object name.`);
+    }
+    if (!SECRET_KEY.test(target.secretKey)) {
+        throw new ControllerTokenSinkError(`secret key ${JSON.stringify(target.secretKey)} is not a valid Secret data key.`);
+    }
+    if (!SECRET_NAME.test(target.namespace)) {
+        throw new ControllerTokenSinkError(`namespace ${JSON.stringify(target.namespace)} is not a Kubernetes namespace name.`);
+    }
+    const read = deps.readFile ?? ((path) => (0, promises_1.readFile)(path, 'utf8'));
+    const send = deps.request ?? defaultRequest;
+    const url = `${target.apiServer}/api/v1/namespaces/${encodeURIComponent(target.namespace)}` +
+        `/secrets/${encodeURIComponent(target.secretName)}`;
+    return async (token) => {
+        const [bearer, ca] = await Promise.all([read(target.serviceAccountTokenFile), read(target.caFile)]);
+        const body = JSON.stringify({ data: { [target.secretKey]: Buffer.from(token.value, 'utf8').toString('base64') } });
+        const response = await send({ url, ca, bearer: bearer.trim(), body });
+        if (response.status < 200 || response.status >= 300) {
+            throw new ControllerTokenSinkError(`PATCH ${target.namespace}/${target.secretName} answered ${response.status}: ${response.body.slice(0, 300)}`);
+        }
+    };
+}
+async function controllerTokenPublisherOptionsFromEnv(env, deps = {}) {
+    const credentials = (0, connection_1.temporalClientCredentialsFromEnv)(env);
+    const required = (name) => {
+        const value = env(name)?.trim();
+        if (!value)
+            throw new ControllerTokenSinkError(`${name} is required by the Worker Controller token publisher.`);
+        return value;
+    };
+    const dir = deps.serviceAccountDir ?? exports.IN_CLUSTER_SERVICE_ACCOUNT_DIR;
+    const read = deps.readFile ?? ((path) => (0, promises_1.readFile)(path, 'utf8'));
+    const host = required(exports.CONTROLLER_TOKEN_PUBLISHER_ENV.apiHost);
+    const port = required(exports.CONTROLLER_TOKEN_PUBLISHER_ENV.apiPort);
+    const namespace = (await read(`${dir}/namespace`)).trim();
+    return {
+        source: (0, client_credentials_token_source_1.createClientCredentialsTokenSource)(credentials),
+        clientId: credentials.clientId,
+        target: {
+            apiServer: `https://${host.includes(':') ? `[${host}]` : host}:${port}`,
+            namespace,
+            secretName: required(exports.CONTROLLER_TOKEN_PUBLISHER_ENV.secretName),
+            secretKey: required(exports.CONTROLLER_TOKEN_PUBLISHER_ENV.secretKey),
+            serviceAccountTokenFile: `${dir}/token`,
+            caFile: `${dir}/ca.crt`,
+        },
+    };
+}
+async function startControllerTokenPublisher(options, deps = {}) {
+    const refresher = await proactive_token_refresher_1.ProactiveTokenRefresher.start({
+        source: options.source,
+        description: `${options.clientId} (Worker Controller credential → ${options.target.namespace}/${options.target.secretName})`,
+        ...(deps.logger ? { logger: deps.logger } : {}),
+        ...(deps.onFatal ? { onFatal: deps.onFatal } : {}),
+        ...(deps.clock ? { clock: deps.clock } : {}),
+    });
+    try {
+        await refresher.subscribe(kubernetesSecretTokenSink(options.target, deps));
+    }
+    catch (error) {
+        refresher.stop();
+        throw error;
+    }
+    return refresher;
+}
+//# sourceMappingURL=controller-token-publisher.js.map

package/dist/lib/controller-token-publisher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller-token-publisher.js","sourceRoot":"","sources":["../../src/lib/controller-token-publisher.ts"],"names":[],"mappings":";;;AAuHA,8DA4BC;AAgBD,wFA2BC;AASD,sEAsBC;AA7ND,+CAA4C;AAC5C,2CAAqD;AAIrD,uFAAuF;AACvF,6CAAgE;AAEhE,2EAIqC;AAwBxB,QAAA,8BAA8B,GAAG;IAC5C,UAAU,EAAE,uCAAuC;IACnD,SAAS,EAAE,oCAAoC;IAC/C,OAAO,EAAE,yBAAyB;IAClC,OAAO,EAAE,yBAAyB;CAC1B,CAAC;AAGE,QAAA,8BAA8B,GAAG,+CAA+C,CAAC;AA6B9F,MAAM,WAAW,GAAG,wCAAwC,CAAC;AAC7D,MAAM,UAAU,GAAG,yBAAyB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAGlC,MAAa,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AALD,4DAKC;AAED,MAAM,cAAc,GAAuB,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CACvE,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,MAAM,GAAG,GAAG,IAAA,oBAAY,EACtB,GAAG,EACH;QACE,MAAM,EAAE,OAAO;QACf,EAAE;QACF,OAAO,EAAE,kBAAkB;QAC3B,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,cAAc,EAAE,8BAA8B;YAC9C,MAAM,EAAE,kBAAkB;YAC1B,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;SAC1C;KACF,EACD,CAAC,GAAG,EAAE,EAAE;QACN,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACtD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5G,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CACF,CAAC;IACF,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,SAAS,GAAG,oBAAoB,kBAAkB,IAAI,CAAC,CAAC,CAAC,CAAC;IACxG,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC,CAAC,CAAC;AASL,SAAgB,yBAAyB,CACvC,MAA8B,EAC9B,OAAiC,EAAE;IAEnC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,wBAAwB,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,mCAAmC,CAAC,CAAC;IAC1H,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,wBAAwB,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;IACvH,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,wBAAwB,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAA,mBAAQ,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC;IAC5C,MAAM,GAAG,GACP,GAAG,MAAM,CAAC,SAAS,sBAAsB,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;QAC/E,YAAY,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;IACtD,OAAO,KAAK,EAAE,KAAkB,EAAE,EAAE;QAClC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpG,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QACnH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACpD,MAAM,IAAI,wBAAwB,CAChC,SAAS,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,UAAU,aAAa,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC7G,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAgBM,KAAK,UAAU,sCAAsC,CAC1D,GAAsB,EACtB,OAAuG,EAAE;IAEzG,MAAM,WAAW,GAAG,IAAA,6CAAgC,EAAC,GAAG,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,wBAAwB,CAAC,GAAG,IAAI,wDAAwD,CAAC,CAAC;QAChH,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,IAAI,sCAA8B,CAAC;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAA,mBAAQ,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,QAAQ,CAAC,sCAA8B,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,QAAQ,CAAC,sCAA8B,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,OAAO;QACL,MAAM,EAAE,IAAA,oEAAkC,EAAC,WAAW,CAAC;QACvD,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,MAAM,EAAE;YACN,SAAS,EAAE,WAAW,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE;YACvE,SAAS;YACT,UAAU,EAAE,QAAQ,CAAC,sCAA8B,CAAC,UAAU,CAAC;YAC/D,SAAS,EAAE,QAAQ,CAAC,sCAA8B,CAAC,SAAS,CAAC;YAC7D,uBAAuB,EAAE,GAAG,GAAG,QAAQ;YACvC,MAAM,EAAE,GAAG,GAAG,SAAS;SACxB;KACF,CAAC;AACJ,CAAC;AASM,KAAK,UAAU,6BAA6B,CACjD,OAAwC,EACxC,OAII,EAAE;IAEN,MAAM,SAAS,GAAG,MAAM,mDAAuB,CAAC,KAAK,CAAC;QACpD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,WAAW,EAAE,GAAG,OAAO,CAAC,QAAQ,oCAAoC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,GAAG;QAC5H,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,SAAS,CAAC,yBAAyB,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,SAAS,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/lib/fairness-constants.d.ts

@@ -0,0 +1,3 @@
+export declare const ORG_FAIRNESS_KEY_MISSING = "ORG_FAIRNESS_KEY_MISSING";
+export declare const ORG_FAIRNESS_KEY_OVERRIDDEN = "ORG_FAIRNESS_KEY_OVERRIDDEN";
+//# sourceMappingURL=fairness-constants.d.ts.map

package/dist/lib/fairness-constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fairness-constants.d.ts","sourceRoot":"","sources":["../../src/lib/fairness-constants.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAOnE,eAAO,MAAM,2BAA2B,gCAAgC,CAAC"}

package/dist/lib/fairness-constants.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ORG_FAIRNESS_KEY_OVERRIDDEN = exports.ORG_FAIRNESS_KEY_MISSING = void 0;
+exports.ORG_FAIRNESS_KEY_MISSING = 'ORG_FAIRNESS_KEY_MISSING';
+exports.ORG_FAIRNESS_KEY_OVERRIDDEN = 'ORG_FAIRNESS_KEY_OVERRIDDEN';
+//# sourceMappingURL=fairness-constants.js.map

package/dist/lib/fairness-constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fairness-constants.js","sourceRoot":"","sources":["../../src/lib/fairness-constants.ts"],"names":[],"mappings":";;;AASa,QAAA,wBAAwB,GAAG,0BAA0B,CAAC;AAOtD,QAAA,2BAA2B,GAAG,6BAA6B,CAAC"}

package/dist/lib/fairness.d.ts

@@ -0,0 +1,13 @@
+import { type Priority, type Workflow } from '@temporalio/common';
+import type { Client, WorkflowHandleWithFirstExecutionRunId, WorkflowStartOptions } from '@temporalio/client';
+import type { ActivityInterceptorsFactory } from '@temporalio/worker';
+export { ORG_FAIRNESS_KEY_MISSING, ORG_FAIRNESS_KEY_OVERRIDDEN, } from './fairness-constants';
+export declare const FAIRNESS_KEY_MAX_BYTES = 64;
+export declare function orgFairnessKey(orgId: string): string;
+export type OrgWorkflowStartOptions<T extends Workflow> = Omit<WorkflowStartOptions<T>, 'searchAttributes' | 'typedSearchAttributes'> & {
+    readonly orgId: string;
+    readonly priority?: Omit<Priority, 'fairnessKey'>;
+};
+export declare function startWorkflowForOrg<T extends Workflow>(client: Pick<Client, 'workflow'>, workflowTypeOrFunc: string | T, options: OrgWorkflowStartOptions<T>): Promise<WorkflowHandleWithFirstExecutionRunId<T>>;
+export declare const orgFairnessActivityInterceptor: ActivityInterceptorsFactory;
+//# sourceMappingURL=fairness.d.ts.map

package/dist/lib/fairness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fairness.d.ts","sourceRoot":"","sources":["../../src/lib/fairness.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,QAAQ,EACd,MAAM,oBAAoB,CAAC;AAK5B,OAAO,KAAK,EACV,MAAM,EACN,qCAAqC,EACrC,oBAAoB,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAEV,2BAA2B,EAC5B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAM9B,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAQzC,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAmBpD;AAOD,MAAM,MAAM,uBAAuB,CAAC,CAAC,SAAS,QAAQ,IACpD,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,kBAAkB,GAAG,uBAAuB,CAAC,GAAG;IAE5E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;CACnD,CAAC;AAcJ,wBAAsB,mBAAmB,CAAC,CAAC,SAAS,QAAQ,EAC1D,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EAChC,kBAAkB,EAAE,MAAM,GAAG,CAAC,EAC9B,OAAO,EAAE,uBAAuB,CAAC,CAAC,CAAC,GAClC,OAAO,CAAC,qCAAqC,CAAC,CAAC,CAAC,CAAC,CAenD;AAOD,eAAO,MAAM,8BAA8B,EAAE,2BAkB5C,CAAC"}

package/dist/lib/fairness.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.orgFairnessActivityInterceptor = exports.FAIRNESS_KEY_MAX_BYTES = exports.ORG_FAIRNESS_KEY_OVERRIDDEN = exports.ORG_FAIRNESS_KEY_MISSING = void 0;
+exports.orgFairnessKey = orgFairnessKey;
+exports.startWorkflowForOrg = startWorkflowForOrg;
+const common_1 = require("@temporalio/common");
+const fairness_constants_1 = require("./fairness-constants");
+const search_attribute_constants_1 = require("./search-attribute-constants");
+var fairness_constants_2 = require("./fairness-constants");
+Object.defineProperty(exports, "ORG_FAIRNESS_KEY_MISSING", { enumerable: true, get: function () { return fairness_constants_2.ORG_FAIRNESS_KEY_MISSING; } });
+Object.defineProperty(exports, "ORG_FAIRNESS_KEY_OVERRIDDEN", { enumerable: true, get: function () { return fairness_constants_2.ORG_FAIRNESS_KEY_OVERRIDDEN; } });
+exports.FAIRNESS_KEY_MAX_BYTES = 64;
+function orgFairnessKey(orgId) {
+    if (typeof orgId !== 'string' ||
+        orgId.length === 0 ||
+        orgId.trim() !== orgId) {
+        throw new Error(`orgFairnessKey: org id must be a non-empty string without surrounding ` +
+            `whitespace; got ${JSON.stringify(orgId)}.`);
+    }
+    const bytes = Buffer.byteLength(orgId, 'utf8');
+    if (bytes > exports.FAIRNESS_KEY_MAX_BYTES) {
+        throw new Error(`orgFairnessKey: org id ${JSON.stringify(orgId)} is ${bytes} bytes; ` +
+            `Temporal caps a fairness key at ${exports.FAIRNESS_KEY_MAX_BYTES}.`);
+    }
+    return orgId;
+}
+async function startWorkflowForOrg(client, workflowTypeOrFunc, options) {
+    const { orgId, priority, ...rest } = options;
+    const supplied = priority;
+    if (supplied?.fairnessKey !== undefined) {
+        throw new Error('startWorkflowForOrg: priority.fairnessKey is derived from orgId and may ' +
+            'not be supplied.');
+    }
+    const fairnessKey = orgFairnessKey(orgId);
+    return client.workflow.start(workflowTypeOrFunc, {
+        ...rest,
+        priority: { ...supplied, fairnessKey },
+        searchAttributes: { [search_attribute_constants_1.SEARCH_ATTR_ORG_ID]: [fairnessKey] },
+    });
+}
+const orgFairnessActivityInterceptor = (ctx) => {
+    const inbound = {
+        async execute(input, next) {
+            const key = ctx.info.priority?.fairnessKey;
+            if (key === undefined || key.length === 0) {
+                throw common_1.ApplicationFailure.nonRetryable(`Activity ${ctx.info.activityType} arrived on org-fair task queue ` +
+                    `${ctx.info.taskQueue} with no fairness key. Start the workflow ` +
+                    'with startWorkflowForOrg, or the standalone activity with an orgId.', fairness_constants_1.ORG_FAIRNESS_KEY_MISSING);
+            }
+            return next(input);
+        },
+    };
+    return { inbound };
+};
+exports.orgFairnessActivityInterceptor = orgFairnessActivityInterceptor;
+//# sourceMappingURL=fairness.js.map

package/dist/lib/fairness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fairness.js","sourceRoot":"","sources":["../../src/lib/fairness.ts"],"names":[],"mappings":";;;AAoCA,wCAmBC;AA0BD,kDAmBC;AApGD,+CAI4B;AAE5B,6DAAgE;AAChE,6EAAkE;AAYlE,2DAG8B;AAF5B,8HAAA,wBAAwB,OAAA;AACxB,iIAAA,2BAA2B,OAAA;AAOhB,QAAA,sBAAsB,GAAG,EAAE,CAAC;AAQzC,SAAgB,cAAc,CAAC,KAAa;IAC1C,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,EACtB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,wEAAwE;YACtE,mBAAmB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAC9C,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,KAAK,GAAG,8BAAsB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,0BAA0B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,KAAK,UAAU;YACnE,mCAAmC,8BAAsB,GAAG,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AA0BM,KAAK,UAAU,mBAAmB,CACvC,MAAgC,EAChC,kBAA8B,EAC9B,OAAmC;IAEnC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,QAAQ,GAAG,QAAgC,CAAC;IAClD,IAAI,QAAQ,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,0EAA0E;YACxE,kBAAkB,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,kBAAkB,EAAE;QAC/C,GAAI,IAA2C;QAC/C,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE;QACtC,gBAAgB,EAAE,EAAE,CAAC,+CAAkB,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE;KAC1D,CAAC,CAAC;AACL,CAAC;AAOM,MAAM,8BAA8B,GAAgC,CACzE,GAAG,EACH,EAAE;IACF,MAAM,OAAO,GAAoC;QAC/C,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI;YACvB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;YAC3C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1C,MAAM,2BAAkB,CAAC,YAAY,CACnC,YAAY,GAAG,CAAC,IAAI,CAAC,YAAY,kCAAkC;oBACjE,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,4CAA4C;oBACjE,qEAAqE,EACvE,6CAAwB,CACzB,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;KACF,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC,CAAC;AAlBW,QAAA,8BAA8B,kCAkBzC"}

package/dist/lib/namespace.d.ts

@@ -0,0 +1,4 @@
+export type TemporalEnvReader = (name: string) => string | undefined;
+export declare const TEMPORAL_NAMESPACE_ENV = "TEMPORAL_NAMESPACE";
+export declare function resolveWorkflowNamespaceFromEnv(env: TemporalEnvReader): string;
+//# sourceMappingURL=namespace.d.ts.map

package/dist/lib/namespace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../../src/lib/namespace.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;AAGrE,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAa3D,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAc9E"}

package/dist/lib/namespace.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TEMPORAL_NAMESPACE_ENV = void 0;
+exports.resolveWorkflowNamespaceFromEnv = resolveWorkflowNamespaceFromEnv;
+const deployment_1 = require("@xemahq/contracts/deployment");
+exports.TEMPORAL_NAMESPACE_ENV = 'TEMPORAL_NAMESPACE';
+function resolveWorkflowNamespaceFromEnv(env) {
+    const raw = env(exports.TEMPORAL_NAMESPACE_ENV);
+    if (raw === undefined || raw.trim().length === 0) {
+        throw new Error(`${exports.TEMPORAL_NAMESPACE_ENV} is required: it is this deployment's workflow ` +
+            'namespace, derived by the deployment from its own identity and rendered ' +
+            'into every process that declares TEMPORAL_ADDRESS. There is no default — ' +
+            'a shared default is what let two deployments on one server run each ' +
+            "other's workflows.");
+    }
+    return (0, deployment_1.workflowNamespaceForDeployment)((0, deployment_1.parseDeploymentId)(raw));
+}
+//# sourceMappingURL=namespace.js.map

package/dist/lib/namespace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.js","sourceRoot":"","sources":["../../src/lib/namespace.ts"],"names":[],"mappings":";;;AA0BA,0EAcC;AAxCD,6DAGsC;AAUzB,QAAA,sBAAsB,GAAG,oBAAoB,CAAC;AAa3D,SAAgB,+BAA+B,CAAC,GAAsB;IACpE,MAAM,GAAG,GAAG,GAAG,CAAC,8BAAsB,CAAC,CAAC;IACxC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,GAAG,8BAAsB,iDAAiD;YACxE,0EAA0E;YAC1E,2EAA2E;YAC3E,sEAAsE;YACtE,oBAAoB,CACvB,CAAC;IACJ,CAAC;IAGD,OAAO,IAAA,2CAA8B,EAAC,IAAA,8BAAiB,EAAC,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC"}

package/dist/lib/org-erasure.d.ts

@@ -0,0 +1,13 @@
+import { type Client } from '@temporalio/client';
+export interface EraseOrgWorkflowExecutionsOptions {
+    readonly orgId: string;
+    readonly reason: string;
+    readonly deadlineMs?: number;
+    readonly passIntervalMs?: number;
+}
+export interface EraseOrgWorkflowExecutionsResult {
+    readonly erased: number;
+}
+export declare function orgWorkflowExecutionsQuery(orgId: string): string;
+export declare function eraseOrgWorkflowExecutions(client: Client, options: EraseOrgWorkflowExecutionsOptions): Promise<EraseOrgWorkflowExecutionsResult>;
+//# sourceMappingURL=org-erasure.d.ts.map

package/dist/lib/org-erasure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-erasure.d.ts","sourceRoot":"","sources":["../../src/lib/org-erasure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,KAAK,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAuBxE,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,gCAAgC;IAE/C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAQD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUhE;AAQD,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,iCAAiC,GACzC,OAAO,CAAC,gCAAgC,CAAC,CA0C3C"}