@xemahq/temporal-runtime 0.6.0 → 0.7.0

package/README.md

@@ -28,16 +28,17 @@
 
 ## Overview
 
-Shared runtime glue for services that run Temporal workflow workers or start
-workflows. It provides one battle-tested setup so services do not drift:
-connection handling, an on-behalf-of activity-auth context, a worker factory
-that wires the interceptor and payload codec, an authenticated service HTTP
-client for activities, idempotent schedule reconciliation, and a closed set of
-visibility search attributes.
+Shared runtime glue for services that run Temporal workers or start
+workflows: connection handling, an on-behalf-of activity-auth context, biome
+worker components on Worker Deployment versioning, org fairness, Standalone
+Activities, an authenticated service HTTP client for activities, idempotent
+schedule reconciliation, and a closed set of visibility search attributes.
 
 ## When to use it
 
-- Use it in any service that runs a Temporal worker or starts a workflow.
+- A biome ships a `kind: worker` component and needs to run its workflows,
+  activities or Nexus handlers.
+- A service starts a workflow or a one-shot durable activity for an org.
 
 ## Installation
 
@@ -47,17 +48,159 @@ pnpm add @xemahq/temporal-runtime
 
 ## Usage
 
+### A biome worker component
+
+Define the component from its manifest's worker protocol (revision `v2`), then
+compose one or more definitions into a process. The process connects once,
+derives its namespace from the deployment id and trust domain, and polls every
+declared task queue (`<biomeId>:<name>`) with a versioned worker.
+
+```ts
+import {
+  composeBiomeWorkers,
+  defineBiomeWorker,
+  resolveWorkerDeploymentVersionFromEnv,
+} from '@xemahq/temporal-runtime';
+
+const translation = defineBiomeWorker({
+  biomeId: 'pai-core',
+  componentKey: 'translation-worker',
+  origin: BiomeOrigin.FirstParty,
+  protocol: manifest.components[i].protocol, // as declared, parsed here
+  workflowsPath: require.resolve('./workflows'),
+  activities,
+  nexusServices: [{ service: 'agent-session', version: 'v1', handler }],
+});
+
+const process = await composeBiomeWorkers({
+  connection,                       // a NativeConnection you own
+  deploymentId: env('XEMA_DEPLOYMENT_ID'),
+  version: resolveWorkerDeploymentVersionFromEnv(env),
+  definitions: [translation],
+});
+await process.run();                // process.shutdown() on SIGTERM
+```
+
+The implementations must match the manifest: `workflowsPath` iff a queue
+serves `workflows`, `activities` iff a queue serves `activities`, and exactly
+one handler per `nexus.provides` entry. A mismatch, mixed trust domains, or a
+task queue polled twice refuses at boot with a `BiomeWorkerError`.
+
+### Versioning
+
+Every worker polls as one Worker Deployment version, and every workflow it
+starts is PINNED to that version. In a cluster the version comes from the
+Temporal Worker Controller (`TEMPORAL_DEPLOYMENT_NAME`,
+`TEMPORAL_WORKER_BUILD_ID`); there is no default and no unversioned mode. So a
+run started on an old version finishes there, new runs go to the current
+version, and an old version drains only when its pinned runs end. Biomes
+composed into one process share that process's version; a biome that releases
+on its own cadence runs in its own process.
+
+### Org fairness
+
+```ts
+await startWorkflowForOrg(client, 'translationWorkflow', {
+  orgId, taskQueue, workflowId, args: [input],
+});
+```
+
+The org id is the fairness key. The run's activities and child workflows carry
+it, scheduling work under a different key fails the run, and a
+`fairness: 'org'` queue refuses work that arrives without one. Nexus
+operations do not carry a priority in SDK 1.24, so a Nexus handler sets the
+fairness key of the work it starts from the caller's org.
+
+### Standalone Activities
+
+```ts
+await startStandaloneActivity(client, {
+  id: `outbox:${table}:${rowId}`,
+  type: 'relayOutboxRow',
+  taskQueue,
+  orgId,                            // or null: stated, never omitted
+  idConflict: StandaloneActivityIdConflict.UseExisting,
+  startToCloseTimeout: '1m',
+});
+```
+
+### Search attributes and org erasure
+
+A deployment namespace declares ONE custom search attribute, `OrgId` (Keyword),
+and the shared-infra provisioning Job declares it, not a workload: adding
+search attributes is an admin call the workload role cannot make. At boot a
+starter calls `verifyPlatformSearchAttributes(connection, namespace)`, which
+reads the namespace and refuses to boot, naming what is missing.
+
+Every org-scoped run carries `OrgId`. `startWorkflowForOrg` sets it, and so does
+`buildPlatformSearchAttributes({ orgId })`; a child workflow inherits it from its
+parent, since every bundle compiles in the propagation interceptor. Org erasure
+then deletes that org's executions from the shared namespace:
+
 ```ts
-import { createPlatformWorker } from '@xemahq/temporal-runtime';
+await eraseOrgWorkflowExecutions(client, { orgId, reason: 'org erased' });
+```
+
+Running executions are terminated, then every one is deleted. Other orgs'
+executions, and cluster-wide runs with no `OrgId`, are untouched. If the
+erasure does not finish before its deadline, the call throws.
 
-const worker = await createPlatformWorker(workerOptions);
-await worker.run();
+### Connecting
+
+Every worker and client connects to the frontend over TLS, verified against the
+server CA, with a JWT bearer from the infra realm. There is no plaintext or
+unauthenticated mode. The bearer comes from OAuth client-credentials for the
+process's workload trust identity, and it is replaced before it expires.
+
+```ts
+import {
+  connectTemporalClient,
+  connectTemporalWorker,
+  temporalConnectionOptionsFromEnv,
+} from '@xemahq/temporal-runtime';
+
+const options = temporalConnectionOptionsFromEnv((name) => config.get(name));
+const worker = await connectTemporalWorker(options);
+const client = await connectTemporalClient(options);
+// worker.connection / client.connection go to the SDK; close() stops refreshing.
 ```
 
+`temporalConnectionOptionsFromEnv` takes an injected reader and reads
+`TEMPORAL_ADDRESS`, `TEMPORAL_TLS_CA_PATH`, `TEMPORAL_AUTH_TOKEN_ENDPOINT`,
+`TEMPORAL_AUTH_CLIENT_ID`, `TEMPORAL_AUTH_CLIENT_SECRET_FILE` and
+`TEMPORAL_AUTH_AUDIENCE` (all required). It also reads
+`TEMPORAL_TLS_SERVER_NAME` and the `TEMPORAL_TLS_CLIENT_CERT_PATH` /
+`TEMPORAL_TLS_CLIENT_KEY_PATH` pair, which are optional.
+
+### Keeping any client-credentials token current
+
+`ProactiveTokenRefresher` is the one refresh mechanism. The connections use it,
+and so can any other holder of an infra-realm token:
+
+```ts
+const tokens = await ProactiveTokenRefresher.start({
+  source: createClientCredentialsTokenSource(temporalClientCredentialsFromEnv(env)),
+  description: 'controller client',
+});
+await tokens.subscribe((token) => writeSecret(token.value));
+```
+
+It refreshes at 75% of the issuer's lifetime and retries with backoff while the
+current token is still valid. If the token expires with no replacement, it
+crashes the process (or calls the `onFatal` you pass instead).
+
+### Tests
+
+`pnpm test` runs the unit suite. `pnpm test:integration` starts one Temporal
+1.32 server per run, in Docker, with frontend TLS and the JWT authorizer, and
+runs the connection suite against it.
+
 ## Peer requirements
 
-- `@nestjs/common` ^10 || ^11
+- `@nestjs/common` ^11
 - `reflect-metadata` ^0.2
+- `@xemahq/contracts` >=0.52.0
+- `@xemahq/identity-client` >=0.9.0
 
 ## License
 

package/dist/bin/controller-token-publisher.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=controller-token-publisher.d.ts.map

package/dist/bin/controller-token-publisher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller-token-publisher.d.ts","sourceRoot":"","sources":["../../src/bin/controller-token-publisher.ts"],"names":[],"mappings":""}

package/dist/bin/controller-token-publisher.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const controller_token_publisher_1 = require("../lib/controller-token-publisher");
+const logger = {
+    log: (message) => {
+        process.stdout.write(`${message}\n`);
+    },
+    warn: (message) => console.warn(message),
+    error: (message) => console.error(message),
+};
+async function main() {
+    const options = await (0, controller_token_publisher_1.controllerTokenPublisherOptionsFromEnv)((name) => process.env[name]);
+    await (0, controller_token_publisher_1.startControllerTokenPublisher)(options, { logger });
+    logger.log(`Worker Controller token publisher: ${options.clientId} → ${options.target.namespace}/${options.target.secretName}#${options.target.secretKey}`);
+}
+void main();
+//# sourceMappingURL=controller-token-publisher.js.map

package/dist/bin/controller-token-publisher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller-token-publisher.js","sourceRoot":"","sources":["../../src/bin/controller-token-publisher.ts"],"names":[],"mappings":";;;AAUA,kFAG2C;AAE3C,MAAM,MAAM,GAAG;IACb,GAAG,EAAE,CAAC,OAAe,EAAE,EAAE;QACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;IAChD,KAAK,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;CACnD,CAAC;AAEF,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,GAAG,MAAM,IAAA,mEAAsC,EAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1F,MAAM,IAAA,0DAA6B,EAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,CAAC,sCAAsC,OAAO,CAAC,QAAQ,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;AAC9J,CAAC;AAKD,KAAK,IAAI,EAAE,CAAC"}

package/dist/index.d.ts

@@ -1,12 +1,23 @@
 export * from './lib/connection';
+export * from './lib/controller-token-publisher';
+export * from './lib/access-token';
+export * from './lib/bounded-retry';
+export * from './lib/client-credentials-token-source';
+export * from './lib/proactive-token-refresher';
 export * from './lib/namespace';
 export * from './lib/base-temporal-client.service';
 export * from './lib/activity-auth-context';
 export * from './lib/on-behalf-of-interceptor';
 export * from './lib/worker';
+export * from './lib/workflow-purity';
+export * from './lib/worker-deployment-version';
+export * from './lib/biome-worker';
+export * from './lib/fairness';
+export * from './lib/standalone-activity';
 export * from './lib/auth-kind';
 export * from './lib/service-http-client';
 export * from './lib/schedule';
 export * from './lib/search-attributes';
+export * from './lib/org-erasure';
 export * from './lib/temporal-sdk';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAwBA,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oCAAoC,CAAC;AACnD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAyCA,cAAc,kBAAkB,CAAC;AACjC,cAAc,kCAAkC,CAAC;AACjD,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uCAAuC,CAAC;AACtD,cAAc,iCAAiC,CAAC;AAChD,cAAc,iBAAiB,CAAC;AAChC,cAAc,oCAAoC,CAAC;AACnD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,iCAAiC,CAAC;AAChD,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC"}

package/dist/index.js

@@ -15,14 +15,25 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./lib/connection"), exports);
+__exportStar(require("./lib/controller-token-publisher"), exports);
+__exportStar(require("./lib/access-token"), exports);
+__exportStar(require("./lib/bounded-retry"), exports);
+__exportStar(require("./lib/client-credentials-token-source"), exports);
+__exportStar(require("./lib/proactive-token-refresher"), exports);
 __exportStar(require("./lib/namespace"), exports);
 __exportStar(require("./lib/base-temporal-client.service"), exports);
 __exportStar(require("./lib/activity-auth-context"), exports);
 __exportStar(require("./lib/on-behalf-of-interceptor"), exports);
 __exportStar(require("./lib/worker"), exports);
+__exportStar(require("./lib/workflow-purity"), exports);
+__exportStar(require("./lib/worker-deployment-version"), exports);
+__exportStar(require("./lib/biome-worker"), exports);
+__exportStar(require("./lib/fairness"), exports);
+__exportStar(require("./lib/standalone-activity"), exports);
 __exportStar(require("./lib/auth-kind"), exports);
 __exportStar(require("./lib/service-http-client"), exports);
 __exportStar(require("./lib/schedule"), exports);
 __exportStar(require("./lib/search-attributes"), exports);
+__exportStar(require("./lib/org-erasure"), exports);
 __exportStar(require("./lib/temporal-sdk"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAwBA,mDAAiC;AACjC,kDAAgC;AAChC,qEAAmD;AACnD,8DAA4C;AAC5C,iEAA+C;AAC/C,+CAA6B;AAC7B,kDAAgC;AAChC,4DAA0C;AAC1C,iDAA+B;AAC/B,0DAAwC;AACxC,qDAAmC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAyCA,mDAAiC;AACjC,mEAAiD;AACjD,qDAAmC;AACnC,sDAAoC;AACpC,wEAAsD;AACtD,kEAAgD;AAChD,kDAAgC;AAChC,qEAAmD;AACnD,8DAA4C;AAC5C,iEAA+C;AAC/C,+CAA6B;AAC7B,wDAAsC;AACtC,kEAAgD;AAChD,qDAAmC;AACnC,iDAA+B;AAC/B,4DAA0C;AAC1C,kDAAgC;AAChC,4DAA0C;AAC1C,iDAA+B;AAC/B,0DAAwC;AACxC,oDAAkC;AAClC,qDAAmC"}

package/dist/lib/access-token.d.ts

@@ -0,0 +1,11 @@
+export interface AccessToken {
+    readonly value: string;
+    readonly expiresAt: number;
+}
+export type AccessTokenSource = () => Promise<AccessToken>;
+export interface AccessTokenClaims {
+    readonly aud: readonly string[];
+    readonly exp: number | undefined;
+}
+export declare function decodeAccessTokenClaims(token: string): AccessTokenClaims;
+//# sourceMappingURL=access-token.d.ts.map

package/dist/lib/access-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-token.d.ts","sourceRoot":"","sources":["../../src/lib/access-token.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAQD,MAAM,MAAM,iBAAiB,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;AAG3D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAQD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAyBxE"}

package/dist/lib/access-token.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeAccessTokenClaims = decodeAccessTokenClaims;
+function decodeAccessTokenClaims(token) {
+    const parts = token.split('.');
+    const payloadSegment = parts[1];
+    if (parts.length !== 3 || payloadSegment === undefined) {
+        throw new Error('Temporal access token is not a JWT (expected three dot-separated segments).');
+    }
+    let payload;
+    try {
+        payload = JSON.parse(Buffer.from(payloadSegment, 'base64url').toString('utf8'));
+    }
+    catch (cause) {
+        throw new Error('Temporal access token payload is not valid base64url JSON.', { cause });
+    }
+    if (typeof payload !== 'object' || payload === null) {
+        throw new Error('Temporal access token payload is not a JSON object.');
+    }
+    const record = payload;
+    const rawAud = record['aud'];
+    const aud = typeof rawAud === 'string'
+        ? [rawAud]
+        : Array.isArray(rawAud)
+            ? rawAud.filter((entry) => typeof entry === 'string')
+            : [];
+    const rawExp = record['exp'];
+    return { aud, exp: typeof rawExp === 'number' ? rawExp : undefined };
+}
+//# sourceMappingURL=access-token.js.map

package/dist/lib/access-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-token.js","sourceRoot":"","sources":["../../src/lib/access-token.ts"],"names":[],"mappings":";;AAgCA,0DAyBC;AAzBD,SAAgB,uBAAuB,CAAC,KAAa;IACnD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAClF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4DAA4D,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,GAAG,GACP,OAAO,MAAM,KAAK,QAAQ;QACxB,CAAC,CAAC,CAAC,MAAM,CAAC;QACV,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACrB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;YACtE,CAAC,CAAC,EAAE,CAAC;IACX,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AACvE,CAAC"}

package/dist/lib/base-temporal-client.service.d.ts

@@ -1,5 +1,5 @@
 import { Logger, type OnApplicationBootstrap, type OnModuleDestroy } from '@nestjs/common';
-import { type TemporalConnectionOptions } from './connection';
+import { type TemporalConnectionDeps, type TemporalConnectionOptions } from './connection';
 import { Client, Connection, type ClientOptions } from './temporal-sdk';
 export declare abstract class BaseTemporalClientService implements OnApplicationBootstrap, OnModuleDestroy {
     protected readonly logger: Logger;
@@ -7,7 +7,8 @@ export declare abstract class BaseTemporalClientService implements OnApplication
     private client;
     private resolvedNamespace;
     protected abstract resolveNamespace(): string;
-    protected resolveConnectionOptions(): TemporalConnectionOptions;
+    protected abstract resolveConnectionOptions(): TemporalConnectionOptions;
+    protected resolveConnectionDeps(): TemporalConnectionDeps;
     protected resolveClientOptions(): Omit<ClientOptions, 'connection' | 'namespace'> | undefined;
     onApplicationBootstrap(): Promise<void>;
     onModuleDestroy(): Promise<void>;

package/dist/lib/base-temporal-client.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base-temporal-client.service.d.ts","sourceRoot":"","sources":["../../src/lib/base-temporal-client.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,MAAM,EACN,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AA6CxE,8BACsB,yBACpB,YAAW,sBAAsB,EAAE,eAAe;IAElD,SAAS,CAAC,QAAQ,CAAC,MAAM,SAAqC;IAE9D,OAAO,CAAC,UAAU,CAA2B;IAC7C,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,iBAAiB,CAAuB;IAMhD,SAAS,CAAC,QAAQ,CAAC,gBAAgB,IAAI,MAAM;IAO7C,SAAS,CAAC,wBAAwB,IAAI,yBAAyB;IAS/D,SAAS,CAAC,oBAAoB,IAC1B,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,WAAW,CAAC,GAC/C,SAAS;IAIP,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAcvC,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IActC,SAAS,CAAC,SAAS,IAAI,MAAM;IAW7B,SAAS,CAAC,aAAa,IAAI,UAAU;IAWrC,SAAS,CAAC,YAAY,IAAI,MAAM;CASjC"}
+{"version":3,"file":"base-temporal-client.service.d.ts","sourceRoot":"","sources":["../../src/lib/base-temporal-client.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,MAAM,EACN,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAGL,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC/B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAqDxE,8BACsB,yBACpB,YAAW,sBAAsB,EAAE,eAAe;IAElD,SAAS,CAAC,QAAQ,CAAC,MAAM,SAAqC;IAE9D,OAAO,CAAC,UAAU,CAAyC;IAC3D,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,iBAAiB,CAAuB;IAMhD,SAAS,CAAC,QAAQ,CAAC,gBAAgB,IAAI,MAAM;IAO7C,SAAS,CAAC,QAAQ,CAAC,wBAAwB,IAAI,yBAAyB;IAOxE,SAAS,CAAC,qBAAqB,IAAI,sBAAsB;IASzD,SAAS,CAAC,oBAAoB,IAC1B,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,WAAW,CAAC,GAC/C,SAAS;IAIP,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAevC,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IActC,SAAS,CAAC,SAAS,IAAI,MAAM;IAW7B,SAAS,CAAC,aAAa,IAAI,UAAU;IAWrC,SAAS,CAAC,YAAY,IAAI,MAAM;CASjC"}

package/dist/lib/base-temporal-client.service.js

@@ -15,18 +15,18 @@ let BaseTemporalClientService = class BaseTemporalClientService {
     connection = null;
     client = null;
     resolvedNamespace = null;
-    resolveConnectionOptions() {
-        return (0, connection_1.resolveTemporalConnectionOptionsFromEnv)();
+    resolveConnectionDeps() {
+        return { logger: this.logger };
     }
     resolveClientOptions() {
         return undefined;
     }
     async onApplicationBootstrap() {
         const namespace = this.resolveNamespace();
-        this.connection = await (0, connection_1.connectTemporalClient)(this.resolveConnectionOptions());
+        this.connection = await (0, connection_1.connectTemporalClient)(this.resolveConnectionOptions(), this.resolveConnectionDeps());
         this.resolvedNamespace = namespace;
         this.client = new temporal_sdk_1.Client({
-            connection: this.connection,
+            connection: this.connection.connection,
             namespace,
             ...this.resolveClientOptions(),
         });
@@ -53,7 +53,7 @@ let BaseTemporalClientService = class BaseTemporalClientService {
             throw new Error(`${this.constructor.name} is not initialized — getConnection() called ` +
                 'before onApplicationBootstrap or after onModuleDestroy.');
         }
-        return this.connection;
+        return this.connection.connection;
     }
     getNamespace() {
         if (!this.resolvedNamespace) {

package/dist/lib/base-temporal-client.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"base-temporal-client.service.js","sourceRoot":"","sources":["../../src/lib/base-temporal-client.service.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAKwB;AAExB,6CAIsB;AACtB,iDAAwE;AA8CjE,IAAe,yBAAyB,GAAxC,MAAe,yBAAyB;IAG1B,MAAM,GAAG,IAAI,eAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAEtD,UAAU,GAAsB,IAAI,CAAC;IACrC,MAAM,GAAkB,IAAI,CAAC;IAC7B,iBAAiB,GAAkB,IAAI,CAAC;IAatC,wBAAwB;QAChC,OAAO,IAAA,oDAAuC,GAAE,CAAC;IACnD,CAAC;IAOS,oBAAoB;QAG5B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,sBAAsB;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1C,IAAI,CAAC,UAAU,GAAG,MAAM,IAAA,kCAAqB,EAC3C,IAAI,CAAC,wBAAwB,EAAE,CAChC,CAAC;QACF,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,IAAI,qBAAM,CAAC;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS;YACT,GAAG,IAAI,CAAC,oBAAoB,EAAE;SAC/B,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,wCAAwC,SAAS,IAAI,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;YACvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAMS,SAAS;QACjB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,2CAA2C;gBACjE,yDAAyD,CAC5D,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAGS,aAAa;QACrB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,+CAA+C;gBACrE,yDAAyD,CAC5D,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAGS,YAAY;QACpB,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,8CAA8C;gBACpE,yDAAyD,CAC5D,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;CACF,CAAA;AA9FqB,8DAAyB;oCAAzB,yBAAyB;IAD9C,IAAA,mBAAU,GAAE;GACS,yBAAyB,CA8F9C"}
+{"version":3,"file":"base-temporal-client.service.js","sourceRoot":"","sources":["../../src/lib/base-temporal-client.service.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAKwB;AAExB,6CAKsB;AACtB,iDAAwE;AAsDjE,IAAe,yBAAyB,GAAxC,MAAe,yBAAyB;IAG1B,MAAM,GAAG,IAAI,eAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAEtD,UAAU,GAAoC,IAAI,CAAC;IACnD,MAAM,GAAkB,IAAI,CAAC;IAC7B,iBAAiB,GAAkB,IAAI,CAAC;IAoBtC,qBAAqB;QAC7B,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACjC,CAAC;IAOS,oBAAoB;QAG5B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,sBAAsB;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1C,IAAI,CAAC,UAAU,GAAG,MAAM,IAAA,kCAAqB,EAC3C,IAAI,CAAC,wBAAwB,EAAE,EAC/B,IAAI,CAAC,qBAAqB,EAAE,CAC7B,CAAC;QACF,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,IAAI,qBAAM,CAAC;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU;YACtC,SAAS;YACT,GAAG,IAAI,CAAC,oBAAoB,EAAE;SAC/B,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,wCAAwC,SAAS,IAAI,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;YACvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAMS,SAAS;QACjB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,2CAA2C;gBACjE,yDAAyD,CAC5D,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAGS,aAAa;QACrB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,+CAA+C;gBACrE,yDAAyD,CAC5D,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;IACpC,CAAC;IAGS,YAAY;QACpB,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,8CAA8C;gBACpE,yDAAyD,CAC5D,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;CACF,CAAA;AAtGqB,8DAAyB;oCAAzB,yBAAyB;IAD9C,IAAA,mBAAU,GAAE;GACS,yBAAyB,CAsG9C"}

package/dist/lib/biome-worker.d.ts

@@ -0,0 +1,83 @@
+import { BiomeWorkerTaskQueueFairness, BiomeWorkerTaskQueueServes, type BiomeOrigin } from '@xemahq/contracts/biome';
+import { type ProcessTrustPolicy } from '@xemahq/contracts/process-topology';
+import { type PlatformNexusServiceHandler, type PlatformWorkerSinks, type PlatformWorkerTuning } from './versioned-worker';
+import { type WorkerDeploymentVersion } from './worker-deployment-version';
+import type { PayloadCodec } from '@temporalio/common';
+import type { ActivityInterceptorsFactory, NativeConnection, Worker } from '@temporalio/worker';
+export declare enum BiomeWorkerErrorCode {
+    ProtocolNotWorkerV2 = "protocol-not-worker-v2",
+    ImplementationMismatch = "implementation-mismatch",
+    NexusMismatch = "nexus-mismatch",
+    InvalidComponentKey = "invalid-component-key",
+    DuplicateComponent = "duplicate-component",
+    DuplicateTaskQueue = "duplicate-task-queue",
+    MixedTrustDomains = "mixed-trust-domains",
+    EmptyComposition = "empty-composition"
+}
+export declare class BiomeWorkerError extends Error {
+    readonly code: BiomeWorkerErrorCode;
+    constructor(code: BiomeWorkerErrorCode, message: string);
+}
+export interface BiomeNexusServiceImplementation {
+    readonly service: string;
+    readonly version: string;
+    readonly handler: PlatformNexusServiceHandler;
+}
+export interface DefineBiomeWorkerOptions {
+    readonly biomeId: string;
+    readonly componentKey: string;
+    readonly origin: BiomeOrigin;
+    readonly protocol: unknown;
+    readonly workflowsPath?: string;
+    readonly activities?: object;
+    readonly nexusServices?: readonly BiomeNexusServiceImplementation[];
+    readonly workflowInterceptorModules?: readonly string[];
+    readonly activityInterceptors?: readonly ActivityInterceptorsFactory[];
+    readonly payloadCodec?: PayloadCodec;
+    readonly sinks?: PlatformWorkerSinks;
+    readonly tuning?: PlatformWorkerTuning;
+}
+export interface BiomeWorkerQueue {
+    readonly name: string;
+    readonly taskQueue: string;
+    readonly serves: readonly BiomeWorkerTaskQueueServes[];
+    readonly fairness: BiomeWorkerTaskQueueFairness;
+    readonly nexusServices: readonly BiomeNexusServiceImplementation[];
+}
+export interface BiomeWorkerDefinition {
+    readonly biomeId: string;
+    readonly componentKey: string;
+    readonly origin: BiomeOrigin;
+    readonly queues: readonly BiomeWorkerQueue[];
+    readonly workflowsPath?: string;
+    readonly activities?: object;
+    readonly workflowInterceptorModules: readonly string[];
+    readonly activityInterceptors: readonly ActivityInterceptorsFactory[];
+    readonly payloadCodec?: PayloadCodec;
+    readonly sinks?: PlatformWorkerSinks;
+    readonly tuning: PlatformWorkerTuning;
+}
+export declare function defineBiomeWorker(options: DefineBiomeWorkerOptions): BiomeWorkerDefinition;
+export interface ComposeBiomeWorkersOptions {
+    readonly connection: NativeConnection;
+    readonly deploymentId: string;
+    readonly version: WorkerDeploymentVersion;
+    readonly trustPolicy?: ProcessTrustPolicy;
+    readonly definitions: readonly BiomeWorkerDefinition[];
+}
+export interface ComposedBiomeWorker {
+    readonly biomeId: string;
+    readonly componentKey: string;
+    readonly taskQueue: string;
+    readonly worker: Worker;
+}
+export interface ComposedBiomeWorkers {
+    readonly trustDomain: string;
+    readonly namespace: string;
+    readonly version: WorkerDeploymentVersion;
+    readonly workers: readonly ComposedBiomeWorker[];
+    run(): Promise<void>;
+    shutdown(): void;
+}
+export declare function composeBiomeWorkers(options: ComposeBiomeWorkersOptions): Promise<ComposedBiomeWorkers>;
+//# sourceMappingURL=biome-worker.d.ts.map

package/dist/lib/biome-worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"biome-worker.d.ts","sourceRoot":"","sources":["../../src/lib/biome-worker.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,4BAA4B,EAC5B,0BAA0B,EAC1B,KAAK,WAAW,EAEjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,oCAAoC,CAAC;AAO5C,OAAO,EAGL,KAAK,2BAA2B,EAChC,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EAC1B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,6BAA6B,CAAC;AAErC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EACV,2BAA2B,EAC3B,gBAAgB,EAChB,MAAM,EAEP,MAAM,oBAAoB,CAAC;AAG5B,oBAAY,oBAAoB;IAE9B,mBAAmB,2BAA2B;IAE9C,sBAAsB,4BAA4B;IAElD,aAAa,mBAAmB;IAEhC,mBAAmB,0BAA0B;IAE7C,kBAAkB,wBAAwB;IAE1C,kBAAkB,yBAAyB;IAE3C,iBAAiB,wBAAwB;IAEzC,gBAAgB,sBAAsB;CACvC;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IAEvC,QAAQ,CAAC,IAAI,EAAE,oBAAoB;gBAA1B,IAAI,EAAE,oBAAoB,EACnC,OAAO,EAAE,MAAM;CAKlB;AAGD,MAAM,WAAW,+BAA+B;IAE9C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,OAAO,EAAE,2BAA2B,CAAC;CAC/C;AAED,MAAM,WAAW,wBAAwB;IAEvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAM7B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAE3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,+BAA+B,EAAE,CAAC;IAEpE,QAAQ,CAAC,0BAA0B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAExD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,2BAA2B,EAAE,CAAC;IACvE,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;CACxC;AAGD,MAAM,WAAW,gBAAgB;IAE/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACvD,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAC;IAChD,QAAQ,CAAC,aAAa,EAAE,SAAS,+BAA+B,EAAE,CAAC;CACpE;AAGD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC7C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,0BAA0B,EAAE,SAAS,MAAM,EAAE,CAAC;IACvD,QAAQ,CAAC,oBAAoB,EAAE,SAAS,2BAA2B,EAAE,CAAC;IACtE,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;CACvC;AAgDD,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,wBAAwB,GAChC,qBAAqB,CAgIvB;AAED,MAAM,WAAW,0BAA0B;IAEzC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAO9B,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAE1C,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAC;IAC1C,QAAQ,CAAC,WAAW,EAAE,SAAS,qBAAqB,EAAE,CAAC;CACxD;AAGD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IAEnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAMjD,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAErB,QAAQ,IAAI,IAAI,CAAC;CAClB;AAgBD,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAkJ/B"}