@xemahq/temporal-runtime 0.9.0 → 0.10.0

package/README.md

@@ -197,9 +197,11 @@ erasure does not finish before its deadline, the call throws.
 ### Connecting
 
 Every worker and client connects to the frontend over TLS, verified against the
-server CA, with a JWT bearer from the infra realm. There is no plaintext or
-unauthenticated mode. The bearer comes from OAuth client-credentials for the
-process's workload trust identity, and it is replaced before it expires.
+server CA, with a JWT bearer from identity-api's workflow authority. There is
+no plaintext or unauthenticated mode. The bearer is minted from the pod's
+projected ServiceAccount token (`POST /internal/workflow-credential`) and is
+replaced before it expires. The pod names nothing but that attestation: the
+authority derives the namespace and the audience.
 
 ```ts
 import {
@@ -215,28 +217,38 @@ const client = await connectTemporalClient(options);
 ```
 
 `temporalConnectionOptionsFromEnv` takes an injected reader and reads
-`TEMPORAL_ADDRESS`, `TEMPORAL_TLS_CA_PATH`, `TEMPORAL_AUTH_TOKEN_ENDPOINT`,
-`TEMPORAL_AUTH_CLIENT_ID`, `TEMPORAL_AUTH_CLIENT_SECRET_FILE` and
-`TEMPORAL_AUTH_AUDIENCE` (all required). It also reads
-`TEMPORAL_TLS_SERVER_NAME` and the `TEMPORAL_TLS_CLIENT_CERT_PATH` /
-`TEMPORAL_TLS_CLIENT_KEY_PATH` pair, which are optional.
+`TEMPORAL_ADDRESS`, `TEMPORAL_TLS_CA_PATH`, `TEMPORAL_AUTH_IDENTITY_API_URL` and
+`TEMPORAL_AUTH_ATTESTATION_FILE` (all required). The attestation file is the
+projected ServiceAccount token, whose audience must equal the attester audience
+identity-api declares. It also reads `TEMPORAL_TLS_SERVER_NAME` and the
+`TEMPORAL_TLS_CLIENT_CERT_PATH` / `TEMPORAL_TLS_CLIENT_KEY_PATH` pair, which are
+optional.
 
-### Keeping any client-credentials token current
+If identity-api refuses the attestation, the process fails closed: the connect
+rejects (or, on a refresh, the process crashes) with a `TemporalCredentialRefusedError`
+that carries identity-api's typed refusal code. A refusal is never retried and
+there is no fallback credential.
+
+### Keeping the workflow credential current
 
 `ProactiveTokenRefresher` is the one refresh mechanism. The connections use it,
-and so can any other holder of an infra-realm token:
+and so can any other holder of the same credential:
 
 ```ts
 const tokens = await ProactiveTokenRefresher.start({
-  source: createClientCredentialsTokenSource(temporalClientCredentialsFromEnv(env)),
-  description: 'controller client',
+  source: createWorkflowCredentialTokenSource(temporalWorkflowCredentialFromEnv(env)),
+  description: 'controller token',
 });
 await tokens.subscribe((token) => writeSecret(token.value));
 ```
 
-It refreshes at 75% of the issuer's lifetime and retries with backoff while the
-current token is still valid. If the token expires with no replacement, it
-crashes the process (or calls the `onFatal` you pass instead).
+It refreshes at 75% of the credential's lifetime and retries with backoff while
+the current one is still valid. If it expires with no replacement, it crashes
+the process (or calls the `onFatal` you pass instead).
+
+The Worker Controller token publisher (`xema-temporal-controller-token-publisher`)
+writes the worker's own credential into the controller Secret: one credential
+per ServiceAccount, no separate controller identity.
 
 ### Tests
 
@@ -249,7 +261,7 @@ runs the connection suite against it.
 - `@nestjs/common` ^11
 - `reflect-metadata` ^0.2
 - `@xemahq/contracts` >=0.55.0
-- `@xemahq/identity-client` >=0.9.0
+- `@xemahq/identity-client` >=0.18.0
 
 ## License
 

package/dist/bin/controller-token-publisher.js

@@ -10,9 +10,9 @@ const logger = {
     error: (message) => console.error(message),
 };
 async function main() {
-    const options = await (0, controller_token_publisher_1.controllerTokenPublisherOptionsFromEnv)((name) => process.env[name]);
+    const options = await (0, controller_token_publisher_1.controllerTokenPublisherOptionsFromEnv)((name) => process.env[name], { logger });
     await (0, controller_token_publisher_1.startControllerTokenPublisher)(options, { logger });
-    logger.log(`Worker Controller token publisher: ${options.clientId} → ${options.target.namespace}/${options.target.secretName}#${options.target.secretKey}`);
+    logger.log(`Worker Controller token publisher: ${options.description} → ${options.target.namespace}/${options.target.secretName}#${options.target.secretKey}`);
 }
 void main();
 //# sourceMappingURL=controller-token-publisher.js.map

package/dist/bin/controller-token-publisher.js.map

@@ -1 +1 @@
-{"version":3,"file":"controller-token-publisher.js","sourceRoot":"","sources":["../../src/bin/controller-token-publisher.ts"],"names":[],"mappings":";;;AAUA,kFAG2C;AAE3C,MAAM,MAAM,GAAG;IACb,GAAG,EAAE,CAAC,OAAe,EAAE,EAAE;QACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;IAChD,KAAK,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;CACnD,CAAC;AAEF,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,GAAG,MAAM,IAAA,mEAAsC,EAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1F,MAAM,IAAA,0DAA6B,EAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,CAAC,sCAAsC,OAAO,CAAC,QAAQ,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;AAC9J,CAAC;AAKD,KAAK,IAAI,EAAE,CAAC"}
+{"version":3,"file":"controller-token-publisher.js","sourceRoot":"","sources":["../../src/bin/controller-token-publisher.ts"],"names":[],"mappings":";;;AAUA,kFAG2C;AAE3C,MAAM,MAAM,GAAG;IACb,GAAG,EAAE,CAAC,OAAe,EAAE,EAAE;QACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;IAChD,KAAK,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;CACnD,CAAC;AAEF,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,GAAG,MAAM,IAAA,mEAAsC,EAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACtG,MAAM,IAAA,0DAA6B,EAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,CAAC,sCAAsC,OAAO,CAAC,WAAW,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;AACjK,CAAC;AAKD,KAAK,IAAI,EAAE,CAAC"}

package/dist/index.d.ts

@@ -2,7 +2,7 @@ export * from './lib/connection';
 export * from './lib/controller-token-publisher';
 export * from './lib/access-token';
 export * from './lib/bounded-retry';
-export * from './lib/client-credentials-token-source';
+export * from './lib/workflow-credential-token-source';
 export * from './lib/proactive-token-refresher';
 export * from './lib/namespace';
 export * from './lib/base-temporal-client.service';
@@ -15,7 +15,7 @@ export * from './lib/biome-worker';
 export * from './lib/fairness';
 export * from './lib/nexus-contract';
 export * from './lib/nexus-handler';
-export { NEXUS_CALLER_NOT_BOUND, NEXUS_ENDPOINTS_NOT_DEFINED, NEXUS_OPERATION_TIMED_OUT, NEXUS_ORG_MISSING, NEXUS_SERVICE_NOT_BOUND, nexusServiceKey, } from './lib/nexus-constants';
+export { NEXUS_CALLER_NOT_BOUND, NEXUS_CALLER_UNVERIFIABLE, NEXUS_ENDPOINTS_NOT_DEFINED, NEXUS_OPERATION_TIMED_OUT, NEXUS_ORG_MISSING, NEXUS_SERVICE_NOT_BOUND, nexusServiceKey, } from './lib/nexus-constants';
 export * from './lib/standalone-activity';
 export * from './lib/auth-kind';
 export * from './lib/service-http-client';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA8CA,cAAc,kBAAkB,CAAC;AACjC,cAAc,kCAAkC,CAAC;AACjD,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uCAAuC,CAAC;AACtD,cAAc,iCAAiC,CAAC;AAChD,cAAc,iBAAiB,CAAC;AAChC,cAAc,oCAAoC,CAAC;AACnD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,iCAAiC,CAAC;AAChD,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,yBAAyB,EACzB,iBAAiB,EACjB,uBAAuB,EACvB,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAC/B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA8CA,cAAc,kBAAkB,CAAC;AACjC,cAAc,kCAAkC,CAAC;AACjD,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wCAAwC,CAAC;AACvD,cAAc,iCAAiC,CAAC;AAChD,cAAc,iBAAiB,CAAC;AAChC,cAAc,oCAAoC,CAAC;AACnD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,iCAAiC,CAAC;AAChD,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,iBAAiB,EACjB,uBAAuB,EACvB,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAC/B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC"}

package/dist/index.js

@@ -14,12 +14,12 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.nexusServiceKey = exports.NEXUS_SERVICE_NOT_BOUND = exports.NEXUS_ORG_MISSING = exports.NEXUS_OPERATION_TIMED_OUT = exports.NEXUS_ENDPOINTS_NOT_DEFINED = exports.NEXUS_CALLER_NOT_BOUND = void 0;
+exports.nexusServiceKey = exports.NEXUS_SERVICE_NOT_BOUND = exports.NEXUS_ORG_MISSING = exports.NEXUS_OPERATION_TIMED_OUT = exports.NEXUS_ENDPOINTS_NOT_DEFINED = exports.NEXUS_CALLER_UNVERIFIABLE = exports.NEXUS_CALLER_NOT_BOUND = void 0;
 __exportStar(require("./lib/connection"), exports);
 __exportStar(require("./lib/controller-token-publisher"), exports);
 __exportStar(require("./lib/access-token"), exports);
 __exportStar(require("./lib/bounded-retry"), exports);
-__exportStar(require("./lib/client-credentials-token-source"), exports);
+__exportStar(require("./lib/workflow-credential-token-source"), exports);
 __exportStar(require("./lib/proactive-token-refresher"), exports);
 __exportStar(require("./lib/namespace"), exports);
 __exportStar(require("./lib/base-temporal-client.service"), exports);
@@ -34,6 +34,7 @@ __exportStar(require("./lib/nexus-contract"), exports);
 __exportStar(require("./lib/nexus-handler"), exports);
 var nexus_constants_1 = require("./lib/nexus-constants");
 Object.defineProperty(exports, "NEXUS_CALLER_NOT_BOUND", { enumerable: true, get: function () { return nexus_constants_1.NEXUS_CALLER_NOT_BOUND; } });
+Object.defineProperty(exports, "NEXUS_CALLER_UNVERIFIABLE", { enumerable: true, get: function () { return nexus_constants_1.NEXUS_CALLER_UNVERIFIABLE; } });
 Object.defineProperty(exports, "NEXUS_ENDPOINTS_NOT_DEFINED", { enumerable: true, get: function () { return nexus_constants_1.NEXUS_ENDPOINTS_NOT_DEFINED; } });
 Object.defineProperty(exports, "NEXUS_OPERATION_TIMED_OUT", { enumerable: true, get: function () { return nexus_constants_1.NEXUS_OPERATION_TIMED_OUT; } });
 Object.defineProperty(exports, "NEXUS_ORG_MISSING", { enumerable: true, get: function () { return nexus_constants_1.NEXUS_ORG_MISSING; } });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AA8CA,mDAAiC;AACjC,mEAAiD;AACjD,qDAAmC;AACnC,sDAAoC;AACpC,wEAAsD;AACtD,kEAAgD;AAChD,kDAAgC;AAChC,qEAAmD;AACnD,8DAA4C;AAC5C,iEAA+C;AAC/C,+CAA6B;AAC7B,wDAAsC;AACtC,kEAAgD;AAChD,qDAAmC;AACnC,iDAA+B;AAC/B,uDAAqC;AACrC,sDAAoC;AACpC,yDAO+B;AAN7B,yHAAA,sBAAsB,OAAA;AACtB,8HAAA,2BAA2B,OAAA;AAC3B,4HAAA,yBAAyB,OAAA;AACzB,oHAAA,iBAAiB,OAAA;AACjB,0HAAA,uBAAuB,OAAA;AACvB,kHAAA,eAAe,OAAA;AAEjB,4DAA0C;AAC1C,kDAAgC;AAChC,4DAA0C;AAC1C,iDAA+B;AAC/B,0DAAwC;AACxC,oDAAkC;AAClC,qDAAmC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AA8CA,mDAAiC;AACjC,mEAAiD;AACjD,qDAAmC;AACnC,sDAAoC;AACpC,yEAAuD;AACvD,kEAAgD;AAChD,kDAAgC;AAChC,qEAAmD;AACnD,8DAA4C;AAC5C,iEAA+C;AAC/C,+CAA6B;AAC7B,wDAAsC;AACtC,kEAAgD;AAChD,qDAAmC;AACnC,iDAA+B;AAC/B,uDAAqC;AACrC,sDAAoC;AACpC,yDAQ+B;AAP7B,yHAAA,sBAAsB,OAAA;AACtB,4HAAA,yBAAyB,OAAA;AACzB,8HAAA,2BAA2B,OAAA;AAC3B,4HAAA,yBAAyB,OAAA;AACzB,oHAAA,iBAAiB,OAAA;AACjB,0HAAA,uBAAuB,OAAA;AACvB,kHAAA,eAAe,OAAA;AAEjB,4DAA0C;AAC1C,kDAAgC;AAChC,4DAA0C;AAC1C,iDAA+B;AAC/B,0DAAwC;AACxC,oDAAkC;AAClC,qDAAmC"}

package/dist/lib/access-token.d.ts

@@ -4,7 +4,7 @@ export interface AccessToken {
 }
 export type AccessTokenSource = () => Promise<AccessToken>;
 export interface AccessTokenClaims {
-    readonly aud: readonly string[];
+    readonly iat: number | undefined;
     readonly exp: number | undefined;
 }
 export declare function decodeAccessTokenClaims(token: string): AccessTokenClaims;

package/dist/lib/access-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-token.d.ts","sourceRoot":"","sources":["../../src/lib/access-token.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAQD,MAAM,MAAM,iBAAiB,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;AAG3D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAQD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAyBxE"}
+{"version":3,"file":"access-token.d.ts","sourceRoot":"","sources":["../../src/lib/access-token.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAQD,MAAM,MAAM,iBAAiB,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;AAG3D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAOD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,CAsBxE"}

package/dist/lib/access-token.js

@@ -18,13 +18,11 @@ function decodeAccessTokenClaims(token) {
         throw new Error('Temporal access token payload is not a JSON object.');
     }
     const record = payload;
-    const rawAud = record['aud'];
-    const aud = typeof rawAud === 'string'
-        ? [rawAud]
-        : Array.isArray(rawAud)
-            ? rawAud.filter((entry) => typeof entry === 'string')
-            : [];
+    const rawIat = record['iat'];
     const rawExp = record['exp'];
-    return { aud, exp: typeof rawExp === 'number' ? rawExp : undefined };
+    return {
+        iat: typeof rawIat === 'number' ? rawIat : undefined,
+        exp: typeof rawExp === 'number' ? rawExp : undefined,
+    };
 }
 //# sourceMappingURL=access-token.js.map

package/dist/lib/access-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-token.js","sourceRoot":"","sources":["../../src/lib/access-token.ts"],"names":[],"mappings":";;AAgCA,0DAyBC;AAzBD,SAAgB,uBAAuB,CAAC,KAAa;IACnD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAClF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4DAA4D,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,GAAG,GACP,OAAO,MAAM,KAAK,QAAQ;QACxB,CAAC,CAAC,CAAC,MAAM,CAAC;QACV,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACrB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;YACtE,CAAC,CAAC,EAAE,CAAC;IACX,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AACvE,CAAC"}
+{"version":3,"file":"access-token.js","sourceRoot":"","sources":["../../src/lib/access-token.ts"],"names":[],"mappings":";;AA+BA,0DAsBC;AAtBD,SAAgB,uBAAuB,CAAC,KAAa;IACnD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAClF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4DAA4D,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO;QACL,GAAG,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACpD,GAAG,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;KACrD,CAAC;AACJ,CAAC"}

package/dist/lib/bounded-retry.d.ts

@@ -12,6 +12,11 @@ export interface RetryClock {
 export declare const SYSTEM_CLOCK: RetryClock;
 export declare function backoffDelayMs(policy: BoundedRetryPolicy, failedAttempt: number): number;
 export declare function sleep(clock: RetryClock, ms: number): Promise<void>;
+export declare class PermanentFailureError extends Error {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
 export declare class BoundedRetryExhaustedError extends Error {
     readonly operation: string;
     readonly attempts: number;

package/dist/lib/bounded-retry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bounded-retry.d.ts","sourceRoot":"","sources":["../../src/lib/bounded-retry.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,kBAAkB;IAEjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAGD,eAAO,MAAM,4BAA4B,EAAE,kBAI1C,CAAC;AAGF,MAAM,WAAW,UAAU;IACzB,GAAG,IAAI,MAAM,CAAC;IACd,UAAU,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IACtD,YAAY,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;CACrC;AAED,eAAO,MAAM,YAAY,EAAE,UAU1B,CAAC;AAEF,wBAAgB,cAAc,CAAC,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAExF;AAED,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIlE;AAGD,qBAAa,0BAA2B,SAAQ,KAAK;IAEjD,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBADhB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EACzB,KAAK,EAAE,OAAO;CAUjB;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAOzE;AAOD,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,UAAU,EACjB,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,KAAK,IAAI,GAC/E,OAAO,CAAC,CAAC,CAAC,CAeZ"}
+{"version":3,"file":"bounded-retry.d.ts","sourceRoot":"","sources":["../../src/lib/bounded-retry.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,kBAAkB;IAEjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAGD,eAAO,MAAM,4BAA4B,EAAE,kBAI1C,CAAC;AAGF,MAAM,WAAW,UAAU;IACzB,GAAG,IAAI,MAAM,CAAC;IACd,UAAU,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IACtD,YAAY,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;CACrC;AAED,eAAO,MAAM,YAAY,EAAE,UAU1B,CAAC;AAEF,wBAAgB,cAAc,CAAC,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAExF;AAED,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIlE;AAOD,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3D;AAGD,qBAAa,0BAA2B,SAAQ,KAAK;IAEjD,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBADhB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EACzB,KAAK,EAAE,OAAO;CAUjB;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAOzE;AAOD,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,UAAU,EACjB,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,KAAK,IAAI,GAC/E,OAAO,CAAC,CAAC,CAAC,CAgBZ"}

package/dist/lib/bounded-retry.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BoundedRetryExhaustedError = exports.SYSTEM_CLOCK = exports.DEFAULT_BOUNDED_RETRY_POLICY = void 0;
+exports.BoundedRetryExhaustedError = exports.PermanentFailureError = exports.SYSTEM_CLOCK = exports.DEFAULT_BOUNDED_RETRY_POLICY = void 0;
 exports.backoffDelayMs = backoffDelayMs;
 exports.sleep = sleep;
 exports.assertBoundedRetryPolicy = assertBoundedRetryPolicy;
@@ -27,6 +27,13 @@ function sleep(clock, ms) {
         clock.setTimeout(resolve, ms);
     });
 }
+class PermanentFailureError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = 'PermanentFailureError';
+    }
+}
+exports.PermanentFailureError = PermanentFailureError;
 class BoundedRetryExhaustedError extends Error {
     operation;
     attempts;
@@ -54,6 +61,8 @@ async function withBoundedRetry(operationName, operation, policy, clock, onAttem
             return await operation();
         }
         catch (error) {
+            if (error instanceof PermanentFailureError)
+                throw error;
             lastError = error;
             if (attempt === policy.attempts)
                 break;

package/dist/lib/bounded-retry.js.map

@@ -1 +1 @@
-{"version":3,"file":"bounded-retry.js","sourceRoot":"","sources":["../../src/lib/bounded-retry.ts"],"names":[],"mappings":";;;AAyCA,wCAEC;AAED,sBAIC;AAmBD,4DAOC;AAOD,4CAqBC;AAvFY,QAAA,4BAA4B,GAAuB;IAC9D,QAAQ,EAAE,CAAC;IACX,cAAc,EAAE,KAAK;IACrB,UAAU,EAAE,MAAM;CACnB,CAAC;AASW,QAAA,YAAY,GAAe;IACtC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;IACrB,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAGxC,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAuC,CAAC;CAChF,CAAC;AAEF,SAAgB,cAAc,CAAC,MAA0B,EAAE,aAAqB;IAC9E,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,cAAc,GAAG,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,SAAgB,KAAK,CAAC,KAAiB,EAAE,EAAU;IACjD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC;AAGD,MAAa,0BAA2B,SAAQ,KAAK;IAExC;IACA;IAFX,YACW,SAAiB,EACjB,QAAgB,EACzB,KAAc;QAEd,KAAK,CACH,GAAG,SAAS,iBAAiB,QAAQ,gBACnC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,EACF,EAAE,KAAK,EAAE,CACV,CAAC;QATO,cAAS,GAAT,SAAS,CAAQ;QACjB,aAAQ,GAAR,QAAQ,CAAQ;QASzB,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAdD,gEAcC;AAED,SAAgB,wBAAwB,CAAC,MAA0B;IACjE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,uDAAuD,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AAOM,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,SAA2B,EAC3B,MAA0B,EAC1B,KAAiB,EACjB,eAAgF;IAEhF,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,SAAkB,CAAC;IACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG,KAAK,CAAC;YAClB,IAAI,OAAO,KAAK,MAAM,CAAC,QAAQ;gBAAE,MAAM;YACvC,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC9C,eAAe,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YACzC,MAAM,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,MAAM,IAAI,0BAA0B,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAClF,CAAC"}
+{"version":3,"file":"bounded-retry.js","sourceRoot":"","sources":["../../src/lib/bounded-retry.ts"],"names":[],"mappings":";;;AAyCA,wCAEC;AAED,sBAIC;AA+BD,4DAOC;AAOD,4CAsBC;AApGY,QAAA,4BAA4B,GAAuB;IAC9D,QAAQ,EAAE,CAAC;IACX,cAAc,EAAE,KAAK;IACrB,UAAU,EAAE,MAAM;CACnB,CAAC;AASW,QAAA,YAAY,GAAe;IACtC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;IACrB,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAGxC,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAuC,CAAC;CAChF,CAAC;AAEF,SAAgB,cAAc,CAAC,MAA0B,EAAE,aAAqB;IAC9E,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,cAAc,GAAG,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,SAAgB,KAAK,CAAC,KAAiB,EAAE,EAAU;IACjD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC;AAOD,MAAa,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AALD,sDAKC;AAGD,MAAa,0BAA2B,SAAQ,KAAK;IAExC;IACA;IAFX,YACW,SAAiB,EACjB,QAAgB,EACzB,KAAc;QAEd,KAAK,CACH,GAAG,SAAS,iBAAiB,QAAQ,gBACnC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,EACF,EAAE,KAAK,EAAE,CACV,CAAC;QATO,cAAS,GAAT,SAAS,CAAQ;QACjB,aAAQ,GAAR,QAAQ,CAAQ;QASzB,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAdD,gEAcC;AAED,SAAgB,wBAAwB,CAAC,MAA0B;IACjE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,uDAAuD,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AAOM,KAAK,UAAU,gBAAgB,CACpC,aAAqB,EACrB,SAA2B,EAC3B,MAA0B,EAC1B,KAAiB,EACjB,eAAgF;IAEhF,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,SAAkB,CAAC;IACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAqB;gBAAE,MAAM,KAAK,CAAC;YACxD,SAAS,GAAG,KAAK,CAAC;YAClB,IAAI,OAAO,KAAK,MAAM,CAAC,QAAQ;gBAAE,MAAM;YACvC,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC9C,eAAe,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YACzC,MAAM,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,MAAM,IAAI,0BAA0B,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAClF,CAAC"}

package/dist/lib/connection.d.ts

@@ -1,14 +1,13 @@
 import { Connection } from '@temporalio/client';
 import { NativeConnection } from '@temporalio/worker';
-import type { AccessTokenSource } from './access-token';
 import { type BoundedRetryPolicy, type RetryClock } from './bounded-retry';
-import { type ClientCredentialsDeps, type ClientCredentialsOptions } from './client-credentials-token-source';
 import type { TemporalEnvReader } from './namespace';
 import { ProactiveTokenRefresher, type TokenRefresherLogger } from './proactive-token-refresher';
+import { type WorkflowCredentialDeps, type WorkflowCredentialOptions } from './workflow-credential-token-source';
 export interface TemporalConnectionOptions {
     readonly address: string;
     readonly tls: TemporalTlsOptions;
-    readonly credentials: ClientCredentialsOptions;
+    readonly credentials: WorkflowCredentialOptions;
     readonly connectRetry?: BoundedRetryPolicy;
 }
 export interface TemporalTlsOptions {
@@ -17,12 +16,11 @@ export interface TemporalTlsOptions {
     readonly clientCertPath?: string;
     readonly clientKeyPath?: string;
 }
-export interface TemporalConnectionDeps extends ClientCredentialsDeps {
+export interface TemporalConnectionDeps extends WorkflowCredentialDeps {
     readonly logger?: TokenRefresherLogger;
     readonly clock?: RetryClock;
     readonly onCredentialFailure?: (error: Error) => void;
     readonly readFile?: (path: string) => Promise<Buffer>;
-    readonly tokenSource?: AccessTokenSource;
 }
 export interface TemporalWorkerConnection {
     readonly connection: NativeConnection;
@@ -40,12 +38,10 @@ export declare const TEMPORAL_CONNECTION_ENV: {
     readonly tlsServerName: "TEMPORAL_TLS_SERVER_NAME";
     readonly tlsClientCertPath: "TEMPORAL_TLS_CLIENT_CERT_PATH";
     readonly tlsClientKeyPath: "TEMPORAL_TLS_CLIENT_KEY_PATH";
-    readonly tokenEndpoint: "TEMPORAL_AUTH_TOKEN_ENDPOINT";
-    readonly clientId: "TEMPORAL_AUTH_CLIENT_ID";
-    readonly clientSecretFile: "TEMPORAL_AUTH_CLIENT_SECRET_FILE";
-    readonly audience: "TEMPORAL_AUTH_AUDIENCE";
+    readonly identityApiUrl: "TEMPORAL_AUTH_IDENTITY_API_URL";
+    readonly attestationFile: "TEMPORAL_AUTH_ATTESTATION_FILE";
 };
-export declare function temporalClientCredentialsFromEnv(env: TemporalEnvReader): ClientCredentialsOptions;
+export declare function temporalWorkflowCredentialFromEnv(env: TemporalEnvReader): WorkflowCredentialOptions;
 export declare function temporalConnectionOptionsFromEnv(env: TemporalEnvReader): TemporalConnectionOptions;
 export declare function validateTemporalConnectionOptions(options: TemporalConnectionOptions): void;
 export declare function connectTemporalWorker(options: TemporalConnectionOptions, deps?: TemporalConnectionDeps): Promise<TemporalWorkerConnection>;

package/dist/lib/connection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../src/lib/connection.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAkB,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAIL,KAAK,kBAAkB,EACvB,KAAK,UAAU,EAChB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC9B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,uBAAuB,EACvB,KAAK,oBAAoB,EAC1B,MAAM,6BAA6B,CAAC;AAqBrC,MAAM,WAAW,yBAAyB;IAExC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,wBAAwB,CAAC;IAE/C,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;CAC5C;AAED,MAAM,WAAW,kBAAkB;IAEjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAGD,MAAM,WAAW,sBAAuB,SAAQ,qBAAqB;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;IAE5B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACtD,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAEtD,QAAQ,CAAC,WAAW,CAAC,EAAE,iBAAiB,CAAC;CAC1C;AAGD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IAEzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAGD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IAEzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAGD,eAAO,MAAM,uBAAuB;;;;;;;;;;CAU1B,CAAC;AA2BX,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,iBAAiB,GAAG,wBAAwB,CASjG;AASD,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,iBAAiB,GAAG,yBAAyB,CAwBlG;AAGD,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,yBAAyB,GAAG,IAAI,CAe1F;AA8DD,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,yBAAyB,EAClC,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC,wBAAwB,CAAC,CA8BnC;AAOD,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,yBAAyB,EAClC,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC,wBAAwB,CAAC,CAgCnC"}
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../src/lib/connection.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAkB,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EAIL,KAAK,kBAAkB,EACvB,KAAK,UAAU,EAChB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,uBAAuB,EACvB,KAAK,oBAAoB,EAC1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAGL,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC/B,MAAM,oCAAoC,CAAC;AAsB5C,MAAM,WAAW,yBAAyB;IAExC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,yBAAyB,CAAC;IAEhD,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;CAC5C;AAED,MAAM,WAAW,kBAAkB;IAEjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAGD,MAAM,WAAW,sBAAuB,SAAQ,sBAAsB;IACpE,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;IAE5B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACtD,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACvD;AAGD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IAEzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAGD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IAEzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAGD,eAAO,MAAM,uBAAuB;;;;;;;;CAQ1B,CAAC;AAoCX,wBAAgB,iCAAiC,CAAC,GAAG,EAAE,iBAAiB,GAAG,yBAAyB,CAOnG;AASD,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,iBAAiB,GAAG,yBAAyB,CAyBlG;AAGD,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,yBAAyB,GAAG,IAAI,CAe1F;AA6DD,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,yBAAyB,EAClC,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC,wBAAwB,CAAC,CA8BnC;AAOD,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,yBAAyB,EAClC,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC,wBAAwB,CAAC,CAgCnC"}

package/dist/lib/connection.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TEMPORAL_CONNECTION_ENV = void 0;
-exports.temporalClientCredentialsFromEnv = temporalClientCredentialsFromEnv;
+exports.temporalWorkflowCredentialFromEnv = temporalWorkflowCredentialFromEnv;
 exports.temporalConnectionOptionsFromEnv = temporalConnectionOptionsFromEnv;
 exports.validateTemporalConnectionOptions = validateTemporalConnectionOptions;
 exports.connectTemporalWorker = connectTemporalWorker;
@@ -10,25 +10,29 @@ const promises_1 = require("node:fs/promises");
 const client_1 = require("@temporalio/client");
 const worker_1 = require("@temporalio/worker");
 const bounded_retry_1 = require("./bounded-retry");
-const client_credentials_token_source_1 = require("./client-credentials-token-source");
 const proactive_token_refresher_1 = require("./proactive-token-refresher");
+const workflow_credential_token_source_1 = require("./workflow-credential-token-source");
 exports.TEMPORAL_CONNECTION_ENV = {
     address: 'TEMPORAL_ADDRESS',
     tlsCaPath: 'TEMPORAL_TLS_CA_PATH',
     tlsServerName: 'TEMPORAL_TLS_SERVER_NAME',
     tlsClientCertPath: 'TEMPORAL_TLS_CLIENT_CERT_PATH',
     tlsClientKeyPath: 'TEMPORAL_TLS_CLIENT_KEY_PATH',
-    tokenEndpoint: 'TEMPORAL_AUTH_TOKEN_ENDPOINT',
-    clientId: 'TEMPORAL_AUTH_CLIENT_ID',
-    clientSecretFile: 'TEMPORAL_AUTH_CLIENT_SECRET_FILE',
-    audience: 'TEMPORAL_AUTH_AUDIENCE',
+    identityApiUrl: 'TEMPORAL_AUTH_IDENTITY_API_URL',
+    attestationFile: 'TEMPORAL_AUTH_ATTESTATION_FILE',
 };
-const RETIRED_CONNECTION_ENV = ['TEMPORAL_TLS_ENABLED'];
+const RETIRED_CONNECTION_ENV = [
+    'TEMPORAL_TLS_ENABLED',
+    'TEMPORAL_AUTH_TOKEN_ENDPOINT',
+    'TEMPORAL_AUTH_CLIENT_ID',
+    'TEMPORAL_AUTH_CLIENT_SECRET_FILE',
+    'TEMPORAL_AUTH_AUDIENCE',
+];
 function required(env, name) {
     const value = env(name)?.trim();
     if (!value) {
         throw new Error(`${name} is required for a Temporal connection: every worker and client ` +
-            'connects to the frontend over TLS with an infra-realm bearer token, and ' +
+            'connects to the frontend over TLS with a workflow-authority bearer token, and ' +
             'there is no plaintext or unauthenticated mode.');
     }
     return value;
@@ -37,21 +41,20 @@ function optional(env, name) {
     const value = env(name)?.trim();
     return value ? value : undefined;
 }
-function temporalClientCredentialsFromEnv(env) {
+function temporalWorkflowCredentialFromEnv(env) {
     const options = {
-        tokenEndpoint: required(env, exports.TEMPORAL_CONNECTION_ENV.tokenEndpoint),
-        clientId: required(env, exports.TEMPORAL_CONNECTION_ENV.clientId),
-        clientSecretFile: required(env, exports.TEMPORAL_CONNECTION_ENV.clientSecretFile),
-        audience: required(env, exports.TEMPORAL_CONNECTION_ENV.audience),
+        identityApiUrl: required(env, exports.TEMPORAL_CONNECTION_ENV.identityApiUrl),
+        attestationFile: required(env, exports.TEMPORAL_CONNECTION_ENV.attestationFile),
     };
-    (0, client_credentials_token_source_1.validateClientCredentialsOptions)(options);
+    (0, workflow_credential_token_source_1.validateWorkflowCredentialOptions)(options);
     return options;
 }
 function temporalConnectionOptionsFromEnv(env) {
     for (const retired of RETIRED_CONNECTION_ENV) {
         if (env(retired) !== undefined) {
-            throw new Error(`${retired} is set, but the opt-in TLS mode it controlled is removed: TLS and ` +
-                `an infra-realm bearer are unconditional. Remove ${retired} from the deployment.`);
+            throw new Error(`${retired} is set, but the setting it controlled is removed: TLS and ` +
+                `a workflow-authority bearer (${exports.TEMPORAL_CONNECTION_ENV.identityApiUrl}, ` +
+                `${exports.TEMPORAL_CONNECTION_ENV.attestationFile}) are unconditional. Remove ${retired} from the deployment.`);
         }
     }
     const clientCertPath = optional(env, exports.TEMPORAL_CONNECTION_ENV.tlsClientCertPath);
@@ -65,7 +68,7 @@ function temporalConnectionOptionsFromEnv(env) {
             ...(clientCertPath !== undefined ? { clientCertPath } : {}),
             ...(clientKeyPath !== undefined ? { clientKeyPath } : {}),
         },
-        credentials: temporalClientCredentialsFromEnv(env),
+        credentials: temporalWorkflowCredentialFromEnv(env),
     };
     validateTemporalConnectionOptions(options);
     return options;
@@ -82,7 +85,7 @@ function validateTemporalConnectionOptions(options) {
     if (hasCert !== hasKey) {
         throw new Error('Temporal connection: tls.clientCertPath and tls.clientKeyPath are a pair — set both or neither.');
     }
-    (0, client_credentials_token_source_1.validateClientCredentialsOptions)(options.credentials);
+    (0, workflow_credential_token_source_1.validateWorkflowCredentialOptions)(options.credentials);
 }
 async function resolveTls(tls, read) {
     const serverRootCACertificate = await read(tls.serverCaPath);
@@ -101,10 +104,9 @@ async function resolveTls(tls, read) {
     return config;
 }
 async function startTokens(options, deps) {
-    const source = deps.tokenSource ?? (0, client_credentials_token_source_1.createClientCredentialsTokenSource)(options.credentials, deps);
     return proactive_token_refresher_1.ProactiveTokenRefresher.start({
-        source,
-        description: `client ${options.credentials.clientId}`,
+        source: (0, workflow_credential_token_source_1.createWorkflowCredentialTokenSource)(options.credentials, deps),
+        description: `workflow credential ${options.credentials.attestationFile}`,
         startupRetry: options.connectRetry ?? bounded_retry_1.DEFAULT_BOUNDED_RETRY_POLICY,
         ...(deps.logger !== undefined ? { logger: deps.logger } : {}),
         ...(deps.clock !== undefined ? { clock: deps.clock } : {}),

package/dist/lib/connection.js.map

@@ -1 +1 @@
-{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../src/lib/connection.ts"],"names":[],"mappings":";;;AAgIA,4EASC;AASD,4EAwBC;AAGD,8EAeC;AA8DD,sDAiCC;AAOD,sDAmCC;AArUD,+CAA4C;AAE5C,+CAAgE;AAChE,+CAAsD;AAGtD,mDAMyB;AACzB,uFAK2C;AAE3C,2EAGqC;AAoExB,QAAA,uBAAuB,GAAG;IACrC,OAAO,EAAE,kBAAkB;IAC3B,SAAS,EAAE,sBAAsB;IACjC,aAAa,EAAE,0BAA0B;IACzC,iBAAiB,EAAE,+BAA+B;IAClD,gBAAgB,EAAE,8BAA8B;IAChD,aAAa,EAAE,8BAA8B;IAC7C,QAAQ,EAAE,yBAAyB;IACnC,gBAAgB,EAAE,kCAAkC;IACpD,QAAQ,EAAE,wBAAwB;CAC1B,CAAC;AAGX,MAAM,sBAAsB,GAAG,CAAC,sBAAsB,CAAU,CAAC;AAEjE,SAAS,QAAQ,CAAC,GAAsB,EAAE,IAAY;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,kEAAkE;YACvE,0EAA0E;YAC1E,gDAAgD,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,GAAsB,EAAE,IAAY;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IAChC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACnC,CAAC;AAOD,SAAgB,gCAAgC,CAAC,GAAsB;IACrE,MAAM,OAAO,GAA6B;QACxC,aAAa,EAAE,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,aAAa,CAAC;QACnE,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,QAAQ,CAAC;QACzD,gBAAgB,EAAE,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,gBAAgB,CAAC;QACzE,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,QAAQ,CAAC;KAC1D,CAAC;IACF,IAAA,kEAAgC,EAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,OAAO,CAAC;AACjB,CAAC;AASD,SAAgB,gCAAgC,CAAC,GAAsB;IACrE,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;QAC7C,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,qEAAqE;gBAC7E,mDAAmD,OAAO,uBAAuB,CACpF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,cAAc,GAAG,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,iBAAiB,CAAC,CAAC;IAChF,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,gBAAgB,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,aAAa,CAAC,CAAC;IACxE,MAAM,OAAO,GAA8B;QACzC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,OAAO,CAAC;QACvD,GAAG,EAAE;YACH,YAAY,EAAE,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,SAAS,CAAC;YAC9D,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D;QACD,WAAW,EAAE,gCAAgC,CAAC,GAAG,CAAC;KACnD,CAAC;IACF,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC;AACjB,CAAC;AAGD,SAAgB,iCAAiC,CAAC,OAAkC;IAClF,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC;IACvD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,iGAAiG,CAClG,CAAC;IACJ,CAAC;IACD,IAAA,kEAAgC,EAAC,OAAO,CAAC,WAAW,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAuB,EACvB,IAAuC;IAGvC,MAAM,uBAAuB,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC7D,IAAI,uBAAuB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,YAAY,YAAY,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,MAAM,GAAc,EAAE,uBAAuB,EAAE,CAAC;IACtD,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS;QAAE,MAAM,CAAC,kBAAkB,GAAG,GAAG,CAAC,UAAU,CAAC;IAC7E,IAAI,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACxE,MAAM,CAAC,cAAc,GAAG;YACtB,GAAG,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;YACnC,GAAG,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;SACnC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,OAAkC,EAClC,IAA4B;IAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,IAAI,IAAA,oEAAkC,EAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACjG,OAAO,mDAAuB,CAAC,KAAK,CAAC;QACnC,MAAM;QACN,WAAW,EAAE,UAAU,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE;QACrD,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,4CAA4B;QAClE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,OAAkC,EAClC,IAA4B;IAE5B,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,mBAAQ,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAChD,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK,EAAE,OAAO,CAAC,YAAY,IAAI,4CAA4B;QAC3D,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,4BAAY;KAClC,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAA0B;IAC3C,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,OAAO,GAAG,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC;AACrC,CAAC;AAOM,KAAK,UAAU,qBAAqB,CACzC,OAAkC,EAClC,OAA+B,EAAE;IAEjC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,UAA4B,CAAC;IACjC,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,IAAA,gCAAgB,EACjC,mCAAmC,OAAO,CAAC,OAAO,EAAE,EACpD,GAAG,EAAE,CAAC,yBAAgB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,EACzF,KAAK,EACL,KAAK,EACL,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CACxB,IAAI,CAAC,MAAM,EAAE,IAAI,CACf,iCAAiC,OAAO,CAAC,OAAO,aAAa,OAAO,UAAU;YAC5E,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,KAAK,KAAK,CACzF,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,KAAK,CAAC;IACd,CAAC;IAGD,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,OAAO;QACL,UAAU;QACV,MAAM;QACN,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;QAC3B,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAOM,KAAK,UAAU,qBAAqB,CACzC,OAAkC,EAClC,OAA+B,EAAE;IAEjC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,UAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,IAAA,gCAAgB,EACjC,mCAAmC,OAAO,CAAC,OAAO,EAAE,EACpD,GAAG,EAAE,CACH,mBAAU,CAAC,OAAO,CAAC;YACjB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG;YACH,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;SAC7B,CAAC,EACJ,KAAK,EACL,KAAK,EACL,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CACxB,IAAI,CAAC,MAAM,EAAE,IAAI,CACf,iCAAiC,OAAO,CAAC,OAAO,aAAa,OAAO,UAAU;YAC5E,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,KAAK,KAAK,CACzF,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO;QACL,UAAU;QACV,MAAM;QACN,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;QAC3B,CAAC,CAAC;KACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../src/lib/connection.ts"],"names":[],"mappings":";;;AAqIA,8EAOC;AASD,4EAyBC;AAGD,8EAeC;AA6DD,sDAiCC;AAOD,sDAmCC;AAxUD,+CAA4C;AAE5C,+CAAgE;AAChE,+CAAsD;AAEtD,mDAMyB;AAEzB,2EAGqC;AACrC,yFAK4C;AAmE/B,QAAA,uBAAuB,GAAG;IACrC,OAAO,EAAE,kBAAkB;IAC3B,SAAS,EAAE,sBAAsB;IACjC,aAAa,EAAE,0BAA0B;IACzC,iBAAiB,EAAE,+BAA+B;IAClD,gBAAgB,EAAE,8BAA8B;IAChD,cAAc,EAAE,gCAAgC;IAChD,eAAe,EAAE,gCAAgC;CACzC,CAAC;AAMX,MAAM,sBAAsB,GAAG;IAC7B,sBAAsB;IACtB,8BAA8B;IAC9B,yBAAyB;IACzB,kCAAkC;IAClC,wBAAwB;CAChB,CAAC;AAEX,SAAS,QAAQ,CAAC,GAAsB,EAAE,IAAY;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,kEAAkE;YACvE,gFAAgF;YAChF,gDAAgD,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,GAAsB,EAAE,IAAY;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IAChC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACnC,CAAC;AAOD,SAAgB,iCAAiC,CAAC,GAAsB;IACtE,MAAM,OAAO,GAA8B;QACzC,cAAc,EAAE,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,cAAc,CAAC;QACrE,eAAe,EAAE,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,eAAe,CAAC;KACxE,CAAC;IACF,IAAA,oEAAiC,EAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC;AACjB,CAAC;AASD,SAAgB,gCAAgC,CAAC,GAAsB;IACrE,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;QAC7C,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,6DAA6D;gBACrE,gCAAgC,+BAAuB,CAAC,cAAc,IAAI;gBAC1E,GAAG,+BAAuB,CAAC,eAAe,+BAA+B,OAAO,uBAAuB,CAC1G,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,cAAc,GAAG,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,iBAAiB,CAAC,CAAC;IAChF,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,gBAAgB,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,aAAa,CAAC,CAAC;IACxE,MAAM,OAAO,GAA8B;QACzC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,OAAO,CAAC;QACvD,GAAG,EAAE;YACH,YAAY,EAAE,QAAQ,CAAC,GAAG,EAAE,+BAAuB,CAAC,SAAS,CAAC;YAC9D,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D;QACD,WAAW,EAAE,iCAAiC,CAAC,GAAG,CAAC;KACpD,CAAC;IACF,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC;AACjB,CAAC;AAGD,SAAgB,iCAAiC,CAAC,OAAkC;IAClF,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC;IACvD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,iGAAiG,CAClG,CAAC;IACJ,CAAC;IACD,IAAA,oEAAiC,EAAC,OAAO,CAAC,WAAW,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAuB,EACvB,IAAuC;IAGvC,MAAM,uBAAuB,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC7D,IAAI,uBAAuB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,YAAY,YAAY,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,MAAM,GAAc,EAAE,uBAAuB,EAAE,CAAC;IACtD,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS;QAAE,MAAM,CAAC,kBAAkB,GAAG,GAAG,CAAC,UAAU,CAAC;IAC7E,IAAI,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACxE,MAAM,CAAC,cAAc,GAAG;YACtB,GAAG,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;YACnC,GAAG,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;SACnC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,OAAkC,EAClC,IAA4B;IAE5B,OAAO,mDAAuB,CAAC,KAAK,CAAC;QACnC,MAAM,EAAE,IAAA,sEAAmC,EAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC;QACtE,WAAW,EAAE,uBAAuB,OAAO,CAAC,WAAW,CAAC,eAAe,EAAE;QACzE,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,4CAA4B;QAClE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,OAAkC,EAClC,IAA4B;IAE5B,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,mBAAQ,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAChD,OAAO;QACL,GAAG;QACH,MAAM;QACN,KAAK,EAAE,OAAO,CAAC,YAAY,IAAI,4CAA4B;QAC3D,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,4BAAY;KAClC,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAA0B;IAC3C,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,OAAO,GAAG,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC;AACrC,CAAC;AAOM,KAAK,UAAU,qBAAqB,CACzC,OAAkC,EAClC,OAA+B,EAAE;IAEjC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,UAA4B,CAAC;IACjC,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,IAAA,gCAAgB,EACjC,mCAAmC,OAAO,CAAC,OAAO,EAAE,EACpD,GAAG,EAAE,CAAC,yBAAgB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,EACzF,KAAK,EACL,KAAK,EACL,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CACxB,IAAI,CAAC,MAAM,EAAE,IAAI,CACf,iCAAiC,OAAO,CAAC,OAAO,aAAa,OAAO,UAAU;YAC5E,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,KAAK,KAAK,CACzF,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,KAAK,CAAC;IACd,CAAC;IAGD,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,OAAO;QACL,UAAU;QACV,MAAM;QACN,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;QAC3B,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAOM,KAAK,UAAU,qBAAqB,CACzC,OAAkC,EAClC,OAA+B,EAAE;IAEjC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,UAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,IAAA,gCAAgB,EACjC,mCAAmC,OAAO,CAAC,OAAO,EAAE,EACpD,GAAG,EAAE,CACH,mBAAU,CAAC,OAAO,CAAC;YACjB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG;YACH,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;SAC7B,CAAC,EACJ,KAAK,EACL,KAAK,EACL,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CACxB,IAAI,CAAC,MAAM,EAAE,IAAI,CACf,iCAAiC,OAAO,CAAC,OAAO,aAAa,OAAO,UAAU;YAC5E,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,KAAK,KAAK,CACzF,CACJ,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO;QACL,UAAU;QACV,MAAM;QACN,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;QAC3B,CAAC,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/lib/controller-token-publisher.d.ts

@@ -2,6 +2,7 @@ import type { AccessTokenSource } from './access-token';
 import type { RetryClock } from './bounded-retry';
 import type { TemporalEnvReader } from './namespace';
 import { ProactiveTokenRefresher, type AccessTokenListener, type TokenRefresherLogger } from './proactive-token-refresher';
+import { type WorkflowCredentialDeps } from './workflow-credential-token-source';
 export declare const CONTROLLER_TOKEN_PUBLISHER_ENV: {
     readonly secretName: "XEMA_TEMPORAL_CONTROLLER_TOKEN_SECRET";
     readonly secretKey: "XEMA_TEMPORAL_CONTROLLER_TOKEN_KEY";
@@ -36,10 +37,10 @@ export declare class ControllerTokenSinkError extends Error {
 export declare function kubernetesSecretTokenSink(target: KubernetesSecretTarget, deps?: KubernetesSecretSinkDeps): AccessTokenListener;
 export interface ControllerTokenPublisherOptions {
     readonly source: AccessTokenSource;
-    readonly clientId: string;
+    readonly description: string;
     readonly target: KubernetesSecretTarget;
 }
-export declare function controllerTokenPublisherOptionsFromEnv(env: TemporalEnvReader, deps?: {
+export declare function controllerTokenPublisherOptionsFromEnv(env: TemporalEnvReader, deps?: WorkflowCredentialDeps & {
     readonly readFile?: (path: string) => Promise<string>;
     readonly serviceAccountDir?: string;
 }): Promise<ControllerTokenPublisherOptions>;

package/dist/lib/controller-token-publisher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller-token-publisher.d.ts","sourceRoot":"","sources":["../../src/lib/controller-token-publisher.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAe,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGlD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,uBAAuB,EACvB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EAC1B,MAAM,6BAA6B,CAAC;AAwBrC,eAAO,MAAM,8BAA8B;;;;;CAKjC,CAAC;AAGX,eAAO,MAAM,8BAA8B,kDAAkD,CAAC;AAG9F,MAAM,WAAW,sBAAsB;IAErC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IAEzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAGD,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,KAAK,OAAO,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAElE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACtD,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC;CACvC;AAOD,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAoCD,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,sBAAsB,EAC9B,IAAI,GAAE,wBAA6B,GAClC,mBAAmB,CAyBrB;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAEnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;CACzC;AASD,wBAAsB,sCAAsC,CAC1D,GAAG,EAAE,iBAAiB,EACtB,IAAI,GAAE;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAO,GACxG,OAAO,CAAC,+BAA+B,CAAC,CAwB1C;AASD,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,+BAA+B,EACxC,IAAI,GAAE,wBAAwB,GAAG;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;CACxB,GACL,OAAO,CAAC,uBAAuB,CAAC,CAelC"}
+{"version":3,"file":"controller-token-publisher.d.ts","sourceRoot":"","sources":["../../src/lib/controller-token-publisher.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAe,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,uBAAuB,EACvB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EAC1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,oCAAoC,CAAC;AAwB5C,eAAO,MAAM,8BAA8B;;;;;CAKjC,CAAC;AAGX,eAAO,MAAM,8BAA8B,kDAAkD,CAAC;AAG9F,MAAM,WAAW,sBAAsB;IAErC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IAEzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAGD,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,KAAK,OAAO,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAElE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACtD,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC;CACvC;AAOD,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAoCD,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,sBAAsB,EAC9B,IAAI,GAAE,wBAA6B,GAClC,mBAAmB,CAyBrB;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAEnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;CACzC;AAUD,wBAAsB,sCAAsC,CAC1D,GAAG,EAAE,iBAAiB,EACtB,IAAI,GAAE,sBAAsB,GAAG;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACtD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAChC,GACL,OAAO,CAAC,+BAA+B,CAAC,CAwB1C;AASD,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,+BAA+B,EACxC,IAAI,GAAE,wBAAwB,GAAG;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;CACxB,GACL,OAAO,CAAC,uBAAuB,CAAC,CAelC"}

package/dist/lib/controller-token-publisher.js

@@ -6,9 +6,9 @@ exports.controllerTokenPublisherOptionsFromEnv = controllerTokenPublisherOptions
 exports.startControllerTokenPublisher = startControllerTokenPublisher;
 const promises_1 = require("node:fs/promises");
 const node_https_1 = require("node:https");
-const client_credentials_token_source_1 = require("./client-credentials-token-source");
 const connection_1 = require("./connection");
 const proactive_token_refresher_1 = require("./proactive-token-refresher");
+const workflow_credential_token_source_1 = require("./workflow-credential-token-source");
 exports.CONTROLLER_TOKEN_PUBLISHER_ENV = {
     secretName: 'XEMA_TEMPORAL_CONTROLLER_TOKEN_SECRET',
     secretKey: 'XEMA_TEMPORAL_CONTROLLER_TOKEN_KEY',
@@ -71,7 +71,7 @@ function kubernetesSecretTokenSink(target, deps = {}) {
     };
 }
 async function controllerTokenPublisherOptionsFromEnv(env, deps = {}) {
-    const credentials = (0, connection_1.temporalClientCredentialsFromEnv)(env);
+    const credentials = (0, connection_1.temporalWorkflowCredentialFromEnv)(env);
     const required = (name) => {
         const value = env(name)?.trim();
         if (!value)
@@ -84,8 +84,8 @@ async function controllerTokenPublisherOptionsFromEnv(env, deps = {}) {
     const port = required(exports.CONTROLLER_TOKEN_PUBLISHER_ENV.apiPort);
     const namespace = (await read(`${dir}/namespace`)).trim();
     return {
-        source: (0, client_credentials_token_source_1.createClientCredentialsTokenSource)(credentials),
-        clientId: credentials.clientId,
+        source: (0, workflow_credential_token_source_1.createWorkflowCredentialTokenSource)(credentials, deps),
+        description: credentials.attestationFile,
         target: {
             apiServer: `https://${host.includes(':') ? `[${host}]` : host}:${port}`,
             namespace,
@@ -99,7 +99,7 @@ async function controllerTokenPublisherOptionsFromEnv(env, deps = {}) {
 async function startControllerTokenPublisher(options, deps = {}) {
     const refresher = await proactive_token_refresher_1.ProactiveTokenRefresher.start({
         source: options.source,
-        description: `${options.clientId} (Worker Controller credential → ${options.target.namespace}/${options.target.secretName})`,
+        description: `${options.description} (Worker Controller credential → ${options.target.namespace}/${options.target.secretName})`,
         ...(deps.logger ? { logger: deps.logger } : {}),
         ...(deps.onFatal ? { onFatal: deps.onFatal } : {}),
         ...(deps.clock ? { clock: deps.clock } : {}),

package/dist/lib/controller-token-publisher.js.map

@@ -1 +1 @@
-{"version":3,"file":"controller-token-publisher.js","sourceRoot":"","sources":["../../src/lib/controller-token-publisher.ts"],"names":[],"mappings":";;;AAuHA,8DA4BC;AAgBD,wFA2BC;AASD,sEAsBC;AA7ND,+CAA4C;AAC5C,2CAAqD;AAIrD,uFAAuF;AACvF,6CAAgE;AAEhE,2EAIqC;AAwBxB,QAAA,8BAA8B,GAAG;IAC5C,UAAU,EAAE,uCAAuC;IACnD,SAAS,EAAE,oCAAoC;IAC/C,OAAO,EAAE,yBAAyB;IAClC,OAAO,EAAE,yBAAyB;CAC1B,CAAC;AAGE,QAAA,8BAA8B,GAAG,+CAA+C,CAAC;AA6B9F,MAAM,WAAW,GAAG,wCAAwC,CAAC;AAC7D,MAAM,UAAU,GAAG,yBAAyB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAGlC,MAAa,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AALD,4DAKC;AAED,MAAM,cAAc,GAAuB,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CACvE,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,MAAM,GAAG,GAAG,IAAA,oBAAY,EACtB,GAAG,EACH;QACE,MAAM,EAAE,OAAO;QACf,EAAE;QACF,OAAO,EAAE,kBAAkB;QAC3B,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,cAAc,EAAE,8BAA8B;YAC9C,MAAM,EAAE,kBAAkB;YAC1B,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;SAC1C;KACF,EACD,CAAC,GAAG,EAAE,EAAE;QACN,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACtD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5G,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CACF,CAAC;IACF,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,SAAS,GAAG,oBAAoB,kBAAkB,IAAI,CAAC,CAAC,CAAC,CAAC;IACxG,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC,CAAC,CAAC;AASL,SAAgB,yBAAyB,CACvC,MAA8B,EAC9B,OAAiC,EAAE;IAEnC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,wBAAwB,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,mCAAmC,CAAC,CAAC;IAC1H,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,wBAAwB,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;IACvH,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,wBAAwB,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAA,mBAAQ,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC;IAC5C,MAAM,GAAG,GACP,GAAG,MAAM,CAAC,SAAS,sBAAsB,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;QAC/E,YAAY,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;IACtD,OAAO,KAAK,EAAE,KAAkB,EAAE,EAAE;QAClC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpG,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QACnH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACpD,MAAM,IAAI,wBAAwB,CAChC,SAAS,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,UAAU,aAAa,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC7G,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAgBM,KAAK,UAAU,sCAAsC,CAC1D,GAAsB,EACtB,OAAuG,EAAE;IAEzG,MAAM,WAAW,GAAG,IAAA,6CAAgC,EAAC,GAAG,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,wBAAwB,CAAC,GAAG,IAAI,wDAAwD,CAAC,CAAC;QAChH,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,IAAI,sCAA8B,CAAC;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAA,mBAAQ,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,QAAQ,CAAC,sCAA8B,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,QAAQ,CAAC,sCAA8B,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,OAAO;QACL,MAAM,EAAE,IAAA,oEAAkC,EAAC,WAAW,CAAC;QACvD,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,MAAM,EAAE;YACN,SAAS,EAAE,WAAW,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE;YACvE,SAAS;YACT,UAAU,EAAE,QAAQ,CAAC,sCAA8B,CAAC,UAAU,CAAC;YAC/D,SAAS,EAAE,QAAQ,CAAC,sCAA8B,CAAC,SAAS,CAAC;YAC7D,uBAAuB,EAAE,GAAG,GAAG,QAAQ;YACvC,MAAM,EAAE,GAAG,GAAG,SAAS;SACxB;KACF,CAAC;AACJ,CAAC;AASM,KAAK,UAAU,6BAA6B,CACjD,OAAwC,EACxC,OAII,EAAE;IAEN,MAAM,SAAS,GAAG,MAAM,mDAAuB,CAAC,KAAK,CAAC;QACpD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,WAAW,EAAE,GAAG,OAAO,CAAC,QAAQ,oCAAoC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,GAAG;QAC5H,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,SAAS,CAAC,yBAAyB,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,SAAS,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"controller-token-publisher.js","sourceRoot":"","sources":["../../src/lib/controller-token-publisher.ts"],"names":[],"mappings":";;;AA0HA,8DA4BC;AAiBD,wFA8BC;AASD,sEAsBC;AApOD,+CAA4C;AAC5C,2CAAqD;AAIrD,6CAAiE;AAEjE,2EAIqC;AACrC,yFAG4C;AAwB/B,QAAA,8BAA8B,GAAG;IAC5C,UAAU,EAAE,uCAAuC;IACnD,SAAS,EAAE,oCAAoC;IAC/C,OAAO,EAAE,yBAAyB;IAClC,OAAO,EAAE,yBAAyB;CAC1B,CAAC;AAGE,QAAA,8BAA8B,GAAG,+CAA+C,CAAC;AA6B9F,MAAM,WAAW,GAAG,wCAAwC,CAAC;AAC7D,MAAM,UAAU,GAAG,yBAAyB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAGlC,MAAa,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AALD,4DAKC;AAED,MAAM,cAAc,GAAuB,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CACvE,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,MAAM,GAAG,GAAG,IAAA,oBAAY,EACtB,GAAG,EACH;QACE,MAAM,EAAE,OAAO;QACf,EAAE;QACF,OAAO,EAAE,kBAAkB;QAC3B,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,cAAc,EAAE,8BAA8B;YAC9C,MAAM,EAAE,kBAAkB;YAC1B,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;SAC1C;KACF,EACD,CAAC,GAAG,EAAE,EAAE;QACN,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACtD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5G,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CACF,CAAC;IACF,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,SAAS,GAAG,oBAAoB,kBAAkB,IAAI,CAAC,CAAC,CAAC,CAAC;IACxG,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC,CAAC,CAAC;AASL,SAAgB,yBAAyB,CACvC,MAA8B,EAC9B,OAAiC,EAAE;IAEnC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,wBAAwB,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,mCAAmC,CAAC,CAAC;IAC1H,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,wBAAwB,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;IACvH,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,wBAAwB,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAA,mBAAQ,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC;IAC5C,MAAM,GAAG,GACP,GAAG,MAAM,CAAC,SAAS,sBAAsB,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;QAC/E,YAAY,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;IACtD,OAAO,KAAK,EAAE,KAAkB,EAAE,EAAE;QAClC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpG,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QACnH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACpD,MAAM,IAAI,wBAAwB,CAChC,SAAS,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,UAAU,aAAa,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC7G,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAiBM,KAAK,UAAU,sCAAsC,CAC1D,GAAsB,EACtB,OAGI,EAAE;IAEN,MAAM,WAAW,GAAG,IAAA,8CAAiC,EAAC,GAAG,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,wBAAwB,CAAC,GAAG,IAAI,wDAAwD,CAAC,CAAC;QAChH,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,IAAI,sCAA8B,CAAC;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAA,mBAAQ,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,QAAQ,CAAC,sCAA8B,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,QAAQ,CAAC,sCAA8B,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,OAAO;QACL,MAAM,EAAE,IAAA,sEAAmC,EAAC,WAAW,EAAE,IAAI,CAAC;QAC9D,WAAW,EAAE,WAAW,CAAC,eAAe;QACxC,MAAM,EAAE;YACN,SAAS,EAAE,WAAW,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE;YACvE,SAAS;YACT,UAAU,EAAE,QAAQ,CAAC,sCAA8B,CAAC,UAAU,CAAC;YAC/D,SAAS,EAAE,QAAQ,CAAC,sCAA8B,CAAC,SAAS,CAAC;YAC7D,uBAAuB,EAAE,GAAG,GAAG,QAAQ;YACvC,MAAM,EAAE,GAAG,GAAG,SAAS;SACxB;KACF,CAAC;AACJ,CAAC;AASM,KAAK,UAAU,6BAA6B,CACjD,OAAwC,EACxC,OAII,EAAE;IAEN,MAAM,SAAS,GAAG,MAAM,mDAAuB,CAAC,KAAK,CAAC;QACpD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,WAAW,EAAE,GAAG,OAAO,CAAC,WAAW,oCAAoC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,GAAG;QAC/H,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,SAAS,CAAC,yBAAyB,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,SAAS,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/lib/nexus-constants.d.ts

@@ -2,6 +2,7 @@ export declare const NEXUS_ENDPOINTS_DEFINE = "__XEMA_NEXUS_ENDPOINTS__";
 export declare const NEXUS_SERVICE_NOT_BOUND = "NEXUS_SERVICE_NOT_BOUND";
 export declare const NEXUS_ENDPOINTS_NOT_DEFINED = "NEXUS_ENDPOINTS_NOT_DEFINED";
 export declare const NEXUS_CALLER_NOT_BOUND = "NEXUS_CALLER_NOT_BOUND";
+export declare const NEXUS_CALLER_UNVERIFIABLE = "NEXUS_CALLER_UNVERIFIABLE";
 export declare const NEXUS_ORG_MISSING = "NEXUS_ORG_MISSING";
 export declare function nexusServiceKey(service: string, version: string): string;
 export declare const NEXUS_OPERATION_TIMED_OUT = "NEXUS_OPERATION_TIMED_OUT";

package/dist/lib/nexus-constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nexus-constants.d.ts","sourceRoot":"","sources":["../../src/lib/nexus-constants.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AAOjE,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAGjE,eAAO,MAAM,2BAA2B,gCAAgC,CAAC;AAGzE,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AAG/D,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAGrD,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAExE;AAMD,eAAO,MAAM,yBAAyB,8BAA8B,CAAC"}
+{"version":3,"file":"nexus-constants.d.ts","sourceRoot":"","sources":["../../src/lib/nexus-constants.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AAOjE,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAGjE,eAAO,MAAM,2BAA2B,gCAAgC,CAAC;AAGzE,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AAO/D,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AAGrE,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAGrD,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAExE;AAMD,eAAO,MAAM,yBAAyB,8BAA8B,CAAC"}

package/dist/lib/nexus-constants.js

@@ -1,11 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.NEXUS_OPERATION_TIMED_OUT = exports.NEXUS_ORG_MISSING = exports.NEXUS_CALLER_NOT_BOUND = exports.NEXUS_ENDPOINTS_NOT_DEFINED = exports.NEXUS_SERVICE_NOT_BOUND = exports.NEXUS_ENDPOINTS_DEFINE = void 0;
+exports.NEXUS_OPERATION_TIMED_OUT = exports.NEXUS_ORG_MISSING = exports.NEXUS_CALLER_UNVERIFIABLE = exports.NEXUS_CALLER_NOT_BOUND = exports.NEXUS_ENDPOINTS_NOT_DEFINED = exports.NEXUS_SERVICE_NOT_BOUND = exports.NEXUS_ENDPOINTS_DEFINE = void 0;
 exports.nexusServiceKey = nexusServiceKey;
 exports.NEXUS_ENDPOINTS_DEFINE = '__XEMA_NEXUS_ENDPOINTS__';
 exports.NEXUS_SERVICE_NOT_BOUND = 'NEXUS_SERVICE_NOT_BOUND';
 exports.NEXUS_ENDPOINTS_NOT_DEFINED = 'NEXUS_ENDPOINTS_NOT_DEFINED';
 exports.NEXUS_CALLER_NOT_BOUND = 'NEXUS_CALLER_NOT_BOUND';
+exports.NEXUS_CALLER_UNVERIFIABLE = 'NEXUS_CALLER_UNVERIFIABLE';
 exports.NEXUS_ORG_MISSING = 'NEXUS_ORG_MISSING';
 function nexusServiceKey(service, version) {
     return `${service}@${version}`;

package/dist/lib/nexus-constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"nexus-constants.js","sourceRoot":"","sources":["../../src/lib/nexus-constants.ts"],"names":[],"mappings":";;;AA8BA,0CAEC;AArBY,QAAA,sBAAsB,GAAG,0BAA0B,CAAC;AAOpD,QAAA,uBAAuB,GAAG,yBAAyB,CAAC;AAGpD,QAAA,2BAA2B,GAAG,6BAA6B,CAAC;AAG5D,QAAA,sBAAsB,GAAG,wBAAwB,CAAC;AAGlD,QAAA,iBAAiB,GAAG,mBAAmB,CAAC;AAGrD,SAAgB,eAAe,CAAC,OAAe,EAAE,OAAe;IAC9D,OAAO,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;AACjC,CAAC;AAMY,QAAA,yBAAyB,GAAG,2BAA2B,CAAC"}
+{"version":3,"file":"nexus-constants.js","sourceRoot":"","sources":["../../src/lib/nexus-constants.ts"],"names":[],"mappings":";;;AAqCA,0CAEC;AA5BY,QAAA,sBAAsB,GAAG,0BAA0B,CAAC;AAOpD,QAAA,uBAAuB,GAAG,yBAAyB,CAAC;AAGpD,QAAA,2BAA2B,GAAG,6BAA6B,CAAC;AAG5D,QAAA,sBAAsB,GAAG,wBAAwB,CAAC;AAOlD,QAAA,yBAAyB,GAAG,2BAA2B,CAAC;AAGxD,QAAA,iBAAiB,GAAG,mBAAmB,CAAC;AAGrD,SAAgB,eAAe,CAAC,OAAe,EAAE,OAAe;IAC9D,OAAO,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;AACjC,CAAC;AAMY,QAAA,yBAAyB,GAAG,2BAA2B,CAAC"}

package/dist/lib/nexus-handler.d.ts

@@ -26,7 +26,15 @@ export interface XemaNexusServiceImplementation {
     readonly operations: ReadonlyMap<string, BiomeNexusOperationMode>;
     bind(policy: NexusCallerPolicy): PlatformNexusServiceHandler;
 }
-export declare function callerNamespaceOf(links: readonly nexus.Link[]): string | undefined;
+export type CallerNamespaceRefusal = 'none' | 'ambiguous' | 'malformed';
+export type CallerNamespaceResult = {
+    readonly ok: true;
+    readonly namespace: string;
+} | {
+    readonly ok: false;
+    readonly reason: CallerNamespaceRefusal;
+};
+export declare function callerNamespaceOf(links: readonly nexus.Link[]): CallerNamespaceResult;
 export declare function nexusHandlerFor<Ops extends XemaNexusOperationMap>(contract: XemaNexusContract<Ops>, impl: XemaNexusServiceImpl<Ops>): XemaNexusServiceImplementation;
 export type { NexusOperationInputOf, NexusOperationOutputOf };
 //# sourceMappingURL=nexus-handler.d.ts.map

package/dist/lib/nexus-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nexus-handler.d.ts","sourceRoot":"","sources":["../../src/lib/nexus-handler.ts"],"names":[],"mappings":"AAmBA,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,oBAAoB,IAAI,yBAAyB,EACvD,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,KAAK,MAAM,WAAW,CAAC;AAKnC,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC3B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAOjF,MAAM,MAAM,4BAA4B,CAAC,CAAC,SAAS,QAAQ,IAAI,IAAI,CACjE,yBAAyB,CAAC,CAAC,CAAC,EAC5B,UAAU,GAAG,kBAAkB,GAAG,uBAAuB,CAC1D,GAAG;IACF,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;CACnD,CAAC;AAGF,MAAM,WAAW,yBAAyB,CAAC,CAAC,SAAS,mBAAmB,GAAG,mBAAmB;IAE5F,QAAQ,CAAC,KAAK,EAAE,CAAC,SAAS,mBAAmB,CAAC,GAAG,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAEhF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAEjC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,qBAAqB,CAAC;IAQ5C,aAAa,CAAC,CAAC,SAAS,QAAQ,EAC9B,kBAAkB,EAAE,MAAM,GAAG,CAAC,EAC9B,OAAO,EAAE,4BAA4B,CAAC,CAAC,CAAC,GACvC,OAAO,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CACnD;AAED,KAAK,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;AAGjF,MAAM,MAAM,sBAAsB,CAAC,EAAE,IACnC,EAAE,SAAS,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,uBAAuB,CAAC,KAAK,CAAC,GAC1E,CAAC,GAAG,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GACrF,EAAE,SAAS,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,uBAAuB,CAAC,IAAI,CAAC,GAC3E,CAAC,GAAG,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GACrE,KAAK,CAAC;AAEd,MAAM,MAAM,oBAAoB,CAAC,GAAG,SAAS,qBAAqB,IAAI;IACpE,QAAQ,EAAE,CAAC,IAAI,MAAM,GAAG,GAAG,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACnE,CAAC;AAGF,MAAM,WAAW,iBAAiB;IAEhC,QAAQ,CAAC,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvD;AAGD,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IAElE,IAAI,CAAC,MAAM,EAAE,iBAAiB,GAAG,2BAA2B,CAAC;CAC9D;AAWD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,SAAS,KAAK,CAAC,IAAI,EAAE,GAAG,MAAM,GAAG,SAAS,CAWlF;AA2ED,wBAAgB,eAAe,CAAC,GAAG,SAAS,qBAAqB,EAC/D,QAAQ,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAChC,IAAI,EAAE,oBAAoB,CAAC,GAAG,CAAC,GAC9B,8BAA8B,CA6ChC;AAED,YAAY,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,CAAC"}
+{"version":3,"file":"nexus-handler.d.ts","sourceRoot":"","sources":["../../src/lib/nexus-handler.ts"],"names":[],"mappings":"AA8BA,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,oBAAoB,IAAI,yBAAyB,EACvD,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,KAAK,MAAM,WAAW,CAAC;AAKnC,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC3B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAOjF,MAAM,MAAM,4BAA4B,CAAC,CAAC,SAAS,QAAQ,IAAI,IAAI,CACjE,yBAAyB,CAAC,CAAC,CAAC,EAC5B,UAAU,GAAG,kBAAkB,GAAG,uBAAuB,CAC1D,GAAG;IACF,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;CACnD,CAAC;AAGF,MAAM,WAAW,yBAAyB,CAAC,CAAC,SAAS,mBAAmB,GAAG,mBAAmB;IAE5F,QAAQ,CAAC,KAAK,EAAE,CAAC,SAAS,mBAAmB,CAAC,GAAG,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAEhF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAEjC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,qBAAqB,CAAC;IAQ5C,aAAa,CAAC,CAAC,SAAS,QAAQ,EAC9B,kBAAkB,EAAE,MAAM,GAAG,CAAC,EAC9B,OAAO,EAAE,4BAA4B,CAAC,CAAC,CAAC,GACvC,OAAO,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CACnD;AAED,KAAK,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;AAGjF,MAAM,MAAM,sBAAsB,CAAC,EAAE,IACnC,EAAE,SAAS,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,uBAAuB,CAAC,KAAK,CAAC,GAC1E,CAAC,GAAG,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GACrF,EAAE,SAAS,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,uBAAuB,CAAC,IAAI,CAAC,GAC3E,CAAC,GAAG,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GACrE,KAAK,CAAC;AAEd,MAAM,MAAM,oBAAoB,CAAC,GAAG,SAAS,qBAAqB,IAAI;IACpE,QAAQ,EAAE,CAAC,IAAI,MAAM,GAAG,GAAG,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACnE,CAAC;AAGF,MAAM,WAAW,iBAAiB;IAEhC,QAAQ,CAAC,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvD;AAGD,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IAElE,IAAI,CAAC,MAAM,EAAE,iBAAiB,GAAG,2BAA2B,CAAC;CAC9D;AAaD,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG,WAAW,GAAG,WAAW,CAAC;AAExE,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAcpE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,SAAS,KAAK,CAAC,IAAI,EAAE,GAAG,qBAAqB,CAarF;AA4ED,wBAAgB,eAAe,CAAC,GAAG,SAAS,qBAAqB,EAC/D,QAAQ,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAChC,IAAI,EAAE,oBAAoB,CAAC,GAAG,CAAC,GAC9B,8BAA8B,CA6ChC;AAED,YAAY,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,CAAC"}

package/dist/lib/nexus-handler.js

@@ -44,20 +44,28 @@ const nexus_contract_1 = require("./nexus-contract");
 const search_attribute_constants_1 = require("./search-attribute-constants");
 const WORKFLOW_EVENT_LINK_TYPE = 'temporal.api.common.v1.Link.WorkflowEvent';
 const WORKFLOW_EVENT_LINK_PATH = /^\/namespaces\/([^/]+)\/workflows\//;
+const CALLER_REFUSALS = new Set([nexus_constants_1.NEXUS_CALLER_NOT_BOUND, nexus_constants_1.NEXUS_CALLER_UNVERIFIABLE]);
 function refuse(code, message) {
-    return new nexus.HandlerError(code === nexus_constants_1.NEXUS_CALLER_NOT_BOUND ? 'UNAUTHORIZED' : 'BAD_REQUEST', `[${code}] ${message}`, { retryableOverride: false });
+    return new nexus.HandlerError(CALLER_REFUSALS.has(code) ? 'UNAUTHORIZED' : 'BAD_REQUEST', `[${code}] ${message}`, { retryableOverride: false });
 }
 function callerNamespaceOf(links) {
-    for (const link of links) {
-        if (link.type !== WORKFLOW_EVENT_LINK_TYPE || link.url.protocol !== 'temporal:') {
-            continue;
-        }
-        const match = WORKFLOW_EVENT_LINK_PATH.exec(link.url.pathname);
-        if (match?.[1] !== undefined) {
-            return decodeURIComponent(match[1]);
-        }
+    const events = links.filter((link) => link.type === WORKFLOW_EVENT_LINK_TYPE);
+    if (events.length === 0)
+        return { ok: false, reason: 'none' };
+    if (events.length > 1)
+        return { ok: false, reason: 'ambiguous' };
+    const [event] = events;
+    if (event.url.protocol !== 'temporal:')
+        return { ok: false, reason: 'malformed' };
+    const match = WORKFLOW_EVENT_LINK_PATH.exec(event.url.pathname);
+    if (match?.[1] === undefined)
+        return { ok: false, reason: 'malformed' };
+    try {
+        return { ok: true, namespace: decodeURIComponent(match[1]) };
+    }
+    catch {
+        return { ok: false, reason: 'malformed' };
     }
-    return undefined;
 }
 function headerValue(headers, name) {
     for (const [key, value] of Object.entries(headers)) {
@@ -67,10 +75,11 @@ function headerValue(headers, name) {
     return undefined;
 }
 function admit(where, op, policy, ctx) {
-    const callerNamespace = callerNamespaceOf(ctx.inboundLinks);
-    if (callerNamespace === undefined) {
-        throw refuse(nexus_constants_1.NEXUS_CALLER_NOT_BOUND, `${where}: the request carries no calling-workflow link, so its caller cannot be verified.`);
+    const caller = callerNamespaceOf(ctx.inboundLinks);
+    if (!caller.ok) {
+        throw refuse(nexus_constants_1.NEXUS_CALLER_UNVERIFIABLE, `${where}: the request does not carry exactly one well-formed calling-workflow link (${caller.reason}), so its caller cannot be verified.`);
     }
+    const callerNamespace = caller.namespace;
     if (!policy.allowedCallerNamespaces.has(callerNamespace)) {
         throw refuse(nexus_constants_1.NEXUS_CALLER_NOT_BOUND, `${where}: namespace ${callerNamespace} is not bound to this service by the distribution lock.`);
     }

package/dist/lib/nexus-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"nexus-handler.js","sourceRoot":"","sources":["../../src/lib/nexus-handler.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoHA,8CAWC;AA2ED,0CAgDC;AAvOD,6CAK2B;AAC3B,iDAAmC;AAEnC,yCAA4C;AAC5C,6DAA6D;AAC7D,uDAA8E;AAC9E,qDAQ0B;AAC1B,6EAAkE;AAMlE,MAAM,wBAAwB,GAAG,2CAA2C,CAAC;AAC7E,MAAM,wBAAwB,GAAG,qCAAqC,CAAC;AA6DvE,SAAS,MAAM,CAAC,IAAY,EAAE,OAAe;IAC3C,OAAO,IAAI,KAAK,CAAC,YAAY,CAC3B,IAAI,KAAK,wCAAsB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,EAChE,IAAI,IAAI,KAAK,OAAO,EAAE,EACtB,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAC7B,CAAC;AACJ,CAAC;AAGD,SAAgB,iBAAiB,CAAC,KAA4B;IAC5D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,wBAAwB,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YAChF,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/D,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,OAA+B,EAAE,IAAY;IAChE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;IAC/C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,KAAK,CACZ,KAAa,EACb,EAAwC,EACxC,MAAyB,EACzB,GAAgC;IAEhC,MAAM,eAAe,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC5D,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,MAAM,CACV,wCAAsB,EACtB,GAAG,KAAK,mFAAmF,CAC5F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QACzD,MAAM,MAAM,CACV,wCAAsB,EACtB,GAAG,KAAK,eAAe,eAAe,yDAAyD,CAChG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,0CAAqB,CAAC,CAAC;IAC/D,IAAI,KAAyB,CAAC;IAC9B,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,KAAK,GAAG,IAAA,yBAAc,EAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,CAAC,mCAAiB,EAAE,GAAG,KAAK,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,IAAI,EAAE,CAAC,KAAK,KAAK,oCAAmB,CAAC,GAAG,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,MAAM,CACV,mCAAiB,EACjB,GAAG,KAAK,gDAAgD,0CAAqB,KAAK;YAChF,sDAAsD,CACzD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK;QACL,eAAe;QACf,KAAK,EAAE,GAAG;QACV,aAAa,CAAC,kBAAkB,EAAE,OAAO;YACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAgC,CAAC;YAC1D,IAAI,QAAQ,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,kFAAkF,CAC3F,CAAC;YACJ,CAAC;YACD,OAAO,IAAA,qBAAkB,EAAC,GAAG,EAAE,kBAAkB,EAAE;gBACjD,GAAG,OAAO;gBACV,GAAG,CAAC,KAAK,KAAK,SAAS;oBACrB,CAAC,CAAC;wBACE,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE;wBAC7C,gBAAgB,EAAE,EAAE,CAAC,+CAAkB,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE;qBACpD;oBACH,CAAC,CAAC,EAAE,CAAC;aACC,CAAC,CAAC;QACd,CAAC;KAC2B,CAAC;AACjC,CAAC;AASD,SAAgB,eAAe,CAC7B,QAAgC,EAChC,IAA+B;IAE/B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAQ,IAAgC,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,4CAA4C;YACjG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,0BAA0B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CACN,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAA0C,CAAC,IAAI,CAAC,CAAC,CAC7F,CAAC;IAEF,SAAS,IAAI,CAAC,MAAyB;QACrC,MAAM,QAAQ,GAA4B,EAAE,CAAC;QAC7C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAyC,CAAC;YAC7E,MAAM,KAAK,GAAG,GAAG,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;YAChE,MAAM,GAAG,GAAI,IAAuF,CAAC,IAAI,CAGpF,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,CAAC,IAAI,KAAK,wCAAuB,CAAC,KAAK;oBACvC,CAAC,CAAC,IAAI,mCAA2B,CAC7B,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,CAAqC,CAC9F;oBACH,CAAC,CAAC,CAAC,GAAgC,EAAE,KAAc,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,KAAK,CAAC,cAAc,CACzB,QAAQ,CAAC,UAAU,EACnB,QAA0C,CACD,CAAC;IAC9C,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,UAAU;QACV,IAAI;KACL,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"nexus-handler.js","sourceRoot":"","sources":["../../src/lib/nexus-handler.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmJA,8CAaC;AA4ED,0CAgDC;AA9PD,6CAK2B;AAC3B,iDAAmC;AAEnC,yCAA4C;AAC5C,6DAA6D;AAC7D,uDAAyG;AACzG,qDAQ0B;AAC1B,6EAAkE;AAMlE,MAAM,wBAAwB,GAAG,2CAA2C,CAAC;AAC7E,MAAM,wBAAwB,GAAG,qCAAqC,CAAC;AA6DvE,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,wCAAsB,EAAE,2CAAyB,CAAC,CAAC,CAAC;AAE1G,SAAS,MAAM,CAAC,IAAY,EAAE,OAAe;IAC3C,OAAO,IAAI,KAAK,CAAC,YAAY,CAC3B,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,EAC1D,IAAI,IAAI,KAAK,OAAO,EAAE,EACtB,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAC7B,CAAC;AACJ,CAAC;AAqBD,SAAgB,iBAAiB,CAAC,KAA4B;IAC5D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,wBAAwB,CAAC,CAAC;IAC9E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC9D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjE,MAAM,CAAC,KAAK,CAAC,GAAG,MAAsB,CAAC;IACvC,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,KAAK,WAAW;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAClF,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACxE,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,OAA+B,EAAE,IAAY;IAChE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;IAC/C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,KAAK,CACZ,KAAa,EACb,EAAwC,EACxC,MAAyB,EACzB,GAAgC;IAEhC,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,MAAM,CACV,2CAAyB,EACzB,GAAG,KAAK,+EAA+E,MAAM,CAAC,MAAM,sCAAsC,CAC3I,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QACzD,MAAM,MAAM,CACV,wCAAsB,EACtB,GAAG,KAAK,eAAe,eAAe,yDAAyD,CAChG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,0CAAqB,CAAC,CAAC;IAC/D,IAAI,KAAyB,CAAC;IAC9B,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,KAAK,GAAG,IAAA,yBAAc,EAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,CAAC,mCAAiB,EAAE,GAAG,KAAK,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,IAAI,EAAE,CAAC,KAAK,KAAK,oCAAmB,CAAC,GAAG,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,MAAM,CACV,mCAAiB,EACjB,GAAG,KAAK,gDAAgD,0CAAqB,KAAK;YAChF,sDAAsD,CACzD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK;QACL,eAAe;QACf,KAAK,EAAE,GAAG;QACV,aAAa,CAAC,kBAAkB,EAAE,OAAO;YACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAgC,CAAC;YAC1D,IAAI,QAAQ,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,kFAAkF,CAC3F,CAAC;YACJ,CAAC;YACD,OAAO,IAAA,qBAAkB,EAAC,GAAG,EAAE,kBAAkB,EAAE;gBACjD,GAAG,OAAO;gBACV,GAAG,CAAC,KAAK,KAAK,SAAS;oBACrB,CAAC,CAAC;wBACE,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE;wBAC7C,gBAAgB,EAAE,EAAE,CAAC,+CAAkB,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE;qBACpD;oBACH,CAAC,CAAC,EAAE,CAAC;aACC,CAAC,CAAC;QACd,CAAC;KAC2B,CAAC;AACjC,CAAC;AASD,SAAgB,eAAe,CAC7B,QAAgC,EAChC,IAA+B;IAE/B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAQ,IAAgC,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,4CAA4C;YACjG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,0BAA0B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CACN,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAA0C,CAAC,IAAI,CAAC,CAAC,CAC7F,CAAC;IAEF,SAAS,IAAI,CAAC,MAAyB;QACrC,MAAM,QAAQ,GAA4B,EAAE,CAAC;QAC7C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAyC,CAAC;YAC7E,MAAM,KAAK,GAAG,GAAG,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;YAChE,MAAM,GAAG,GAAI,IAAuF,CAAC,IAAI,CAGpF,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,CAAC,IAAI,KAAK,wCAAuB,CAAC,KAAK;oBACvC,CAAC,CAAC,IAAI,mCAA2B,CAC7B,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,CAAqC,CAC9F;oBACH,CAAC,CAAC,CAAC,GAAgC,EAAE,KAAc,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,KAAK,CAAC,cAAc,CACzB,QAAQ,CAAC,UAAU,EACnB,QAA0C,CACD,CAAC;IAC9C,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,UAAU;QACV,IAAI;KACL,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/proactive-token-refresher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proactive-token-refresher.d.ts","sourceRoot":"","sources":["../../src/lib/proactive-token-refresher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAIL,KAAK,kBAAkB,EACvB,KAAK,UAAU,EAChB,MAAM,iBAAiB,CAAC;AAGzB,MAAM,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAG/E,MAAM,WAAW,oBAAoB;IACnC,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,8BAA8B;IAE7C,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAEnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAM7B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAEpC,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAE3C,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAC7C,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IASzC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;CAC7B;AAOD,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAI7C;AA+BD,qBAAa,uBAAuB;IAchC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAb1B,OAAO,CAAC,OAAO,CAAc;IAC7B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,KAAK,CAAiB;IAC9B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkC;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IAEjD,OAAO;WAmBM,KAAK,CAAC,OAAO,EAAE,8BAA8B,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAwB7F,KAAK,IAAI,MAAM;IAKf,YAAY,IAAI,WAAW;IAerB,SAAS,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC;IASnE,IAAI,IAAI,IAAI;IASZ,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,GAAG;YAQG,OAAO;IAgDrB,OAAO,CAAC,IAAI;CAMb"}
+{"version":3,"file":"proactive-token-refresher.d.ts","sourceRoot":"","sources":["../../src/lib/proactive-token-refresher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAKL,KAAK,kBAAkB,EACvB,KAAK,UAAU,EAChB,MAAM,iBAAiB,CAAC;AAGzB,MAAM,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAG/E,MAAM,WAAW,oBAAoB;IACnC,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,8BAA8B;IAE7C,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAEnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAM7B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAEpC,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAE3C,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAC7C,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IASzC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;CAC7B;AAOD,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAI7C;AA8BD,qBAAa,uBAAuB;IAchC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAb1B,OAAO,CAAC,OAAO,CAAc;IAC7B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,KAAK,CAAiB;IAC9B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkC;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IAEjD,OAAO;WAmBM,KAAK,CAAC,OAAO,EAAE,8BAA8B,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAwB7F,KAAK,IAAI,MAAM;IAKf,YAAY,IAAI,WAAW;IAerB,SAAS,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC;IASnE,IAAI,IAAI,IAAI;IASZ,OAAO,CAAC,YAAY;IAMpB,OAAO,CAAC,GAAG;YAQG,OAAO;IA0DrB,OAAO,CAAC,IAAI;CAMb"}

package/dist/lib/proactive-token-refresher.js

@@ -100,6 +100,11 @@ class ProactiveTokenRefresher {
         catch (error) {
             if (this.stopped)
                 return;
+            if (error instanceof bounded_retry_1.PermanentFailureError) {
+                this.fail(new TokenRefreshFatalError(`The Temporal access token for ${this.options.description} cannot be refreshed: ` +
+                    `${describe(error)}. Refusing to continue without a valid credential.`, error));
+                return;
+            }
             const now = this.clock.now();
             const delay = Math.min(this.retryMaxMs, this.retryInitialMs * 2 ** (attempt - 1));
             if (now + delay >= this.current.expiresAt) {

package/dist/lib/proactive-token-refresher.js.map

@@ -1 +1 @@
-{"version":3,"file":"proactive-token-refresher.js","sourceRoot":"","sources":["../../src/lib/proactive-token-refresher.ts"],"names":[],"mappings":";;;AACA,mDAMyB;AAyCzB,MAAM,2BAA2B,GAAG,IAAI,CAAC;AACzC,MAAM,gCAAgC,GAAG,KAAK,CAAC;AAC/C,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAG5C,MAAa,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AALD,wDAKC;AAED,SAAS,aAAa,CAAC,KAAY;IACjC,YAAY,CAAC,GAAG,EAAE;QAChB,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,aAAa,GAAyB,EAAE,GAAG,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC;AAuB/F,MAAa,uBAAuB;IAcf;IAbX,OAAO,CAAc;IACrB,UAAU,CAAS;IACnB,KAAK,GAAY,IAAI,CAAC;IACtB,OAAO,GAAG,KAAK,CAAC;IACP,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC3C,KAAK,CAAa;IAClB,MAAM,CAAuB;IAC7B,QAAQ,CAAS;IACjB,cAAc,CAAS;IACvB,UAAU,CAAS;IACnB,OAAO,CAAyB;IAEjD,YACmB,OAAuC,EACxD,KAAkB;QADD,YAAO,GAAP,OAAO,CAAgC;QAGxD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,4BAAY,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;QAC9C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,iBAAiB,IAAI,2BAA2B,CAAC;QACzE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,0BAA0B,IAAI,gCAAgC,CAAC;QAC7F,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,sBAAsB,IAAI,4BAA4B,CAAC;QACjF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,aAAa,CAAC;QAChD,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACrC,CAAC;IAOD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAuC;QACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,IAAI,2BAA2B,CAAC;QAC1E,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,4CAA4C,QAAQ,IAAI,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,4BAAY,CAAC;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,MAAM,IAAA,gCAAgB,EAClC,2CAA2C,OAAO,CAAC,WAAW,EAAE,EAChE,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,YAAY,IAAI,4CAA4B,EACpD,KAAK,EACL,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CACxB,MAAM,CAAC,IAAI,CACT,6BAA6B,OAAO,CAAC,WAAW,aAAa,OAAO,UAAU;YAC5E,IAAI,QAAQ,CAAC,KAAK,CAAC,kBAAkB,KAAK,KAAK,CAClD,CACJ,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9D,SAAS,CAAC,YAAY,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IAGD,KAAK;QACH,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC;IACnC,CAAC;IAGD,YAAY;QACV,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,sBAAsB,CAC9B,2CAA2C,IAAI,CAAC,OAAO,CAAC,WAAW,cAAc,CAClF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAQD,KAAK,CAAC,SAAS,CAAC,QAA6B;QAC3C,MAAM,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,GAAG,EAAE;YACV,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC,CAAC;IACJ,CAAC;IAGD,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;IAEO,YAAY;QAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC1E,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IAEO,GAAG,CAAC,OAAe,EAAE,OAAe;QAC1C,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE;YACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC,EAAE,OAAO,CAAC,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,OAAe;QACnC,IAAI,IAAiB,CAAC;QACtB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;YAClF,IAAI,GAAG,GAAG,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC1C,IAAI,CAAC,IAAI,CACP,IAAI,sBAAsB,CACxB,iCAAiC,IAAI,CAAC,OAAO,CAAC,WAAW,kBAAkB;oBACzE,mDAAmD,OAAO,WAAW;oBACrE,GAAG,QAAQ,CAAC,KAAK,CAAC,qDAAqD,EACzE,KAAK,CACN,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qCAAqC,IAAI,CAAC,OAAO,CAAC,WAAW,aAAa,OAAO,GAAG;gBAClF,WAAW,QAAQ,CAAC,KAAK,CAAC,kBAAkB,KAAK,KAAK;gBACtD,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,GAAG,uBAAuB,CAC1D,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACnC,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,IAAI,CACP,IAAI,sBAAsB,CACxB,6CAA6C,IAAI,CAAC,OAAO,CAAC,WAAW,SAAS;oBAC5E,kCAAkC,QAAQ,CAAC,KAAK,CAAC,EAAE,EACrD,KAAK,CACN,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO;QAC3B,CAAC;QACD,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAEO,IAAI,CAAC,KAA6B;QACxC,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;CACF;AAlKD,0DAkKC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}
+{"version":3,"file":"proactive-token-refresher.js","sourceRoot":"","sources":["../../src/lib/proactive-token-refresher.ts"],"names":[],"mappings":";;;AACA,mDAOyB;AAyCzB,MAAM,2BAA2B,GAAG,IAAI,CAAC;AACzC,MAAM,gCAAgC,GAAG,KAAK,CAAC;AAC/C,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAG5C,MAAa,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AALD,wDAKC;AAED,SAAS,aAAa,CAAC,KAAY;IACjC,YAAY,CAAC,GAAG,EAAE;QAChB,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,aAAa,GAAyB,EAAE,GAAG,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC;AAsB/F,MAAa,uBAAuB;IAcf;IAbX,OAAO,CAAc;IACrB,UAAU,CAAS;IACnB,KAAK,GAAY,IAAI,CAAC;IACtB,OAAO,GAAG,KAAK,CAAC;IACP,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC3C,KAAK,CAAa;IAClB,MAAM,CAAuB;IAC7B,QAAQ,CAAS;IACjB,cAAc,CAAS;IACvB,UAAU,CAAS;IACnB,OAAO,CAAyB;IAEjD,YACmB,OAAuC,EACxD,KAAkB;QADD,YAAO,GAAP,OAAO,CAAgC;QAGxD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,4BAAY,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;QAC9C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,iBAAiB,IAAI,2BAA2B,CAAC;QACzE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,0BAA0B,IAAI,gCAAgC,CAAC;QAC7F,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,sBAAsB,IAAI,4BAA4B,CAAC;QACjF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,aAAa,CAAC;QAChD,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACrC,CAAC;IAOD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAuC;QACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,IAAI,2BAA2B,CAAC;QAC1E,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,4CAA4C,QAAQ,IAAI,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,4BAAY,CAAC;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,MAAM,IAAA,gCAAgB,EAClC,2CAA2C,OAAO,CAAC,WAAW,EAAE,EAChE,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,YAAY,IAAI,4CAA4B,EACpD,KAAK,EACL,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CACxB,MAAM,CAAC,IAAI,CACT,6BAA6B,OAAO,CAAC,WAAW,aAAa,OAAO,UAAU;YAC5E,IAAI,QAAQ,CAAC,KAAK,CAAC,kBAAkB,KAAK,KAAK,CAClD,CACJ,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9D,SAAS,CAAC,YAAY,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IAGD,KAAK;QACH,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC;IACnC,CAAC;IAGD,YAAY;QACV,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,sBAAsB,CAC9B,2CAA2C,IAAI,CAAC,OAAO,CAAC,WAAW,cAAc,CAClF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAQD,KAAK,CAAC,SAAS,CAAC,QAA6B;QAC3C,MAAM,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,GAAG,EAAE;YACV,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC,CAAC;IACJ,CAAC;IAGD,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;IAEO,YAAY;QAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC1E,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IAEO,GAAG,CAAC,OAAe,EAAE,OAAe;QAC1C,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE;YACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC,EAAE,OAAO,CAAC,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,OAAe;QACnC,IAAI,IAAiB,CAAC;QACtB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO;YACzB,IAAI,KAAK,YAAY,qCAAqB,EAAE,CAAC;gBAC3C,IAAI,CAAC,IAAI,CACP,IAAI,sBAAsB,CACxB,iCAAiC,IAAI,CAAC,OAAO,CAAC,WAAW,wBAAwB;oBAC/E,GAAG,QAAQ,CAAC,KAAK,CAAC,oDAAoD,EACxE,KAAK,CACN,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;YAClF,IAAI,GAAG,GAAG,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC1C,IAAI,CAAC,IAAI,CACP,IAAI,sBAAsB,CACxB,iCAAiC,IAAI,CAAC,OAAO,CAAC,WAAW,kBAAkB;oBACzE,mDAAmD,OAAO,WAAW;oBACrE,GAAG,QAAQ,CAAC,KAAK,CAAC,qDAAqD,EACzE,KAAK,CACN,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qCAAqC,IAAI,CAAC,OAAO,CAAC,WAAW,aAAa,OAAO,GAAG;gBAClF,WAAW,QAAQ,CAAC,KAAK,CAAC,kBAAkB,KAAK,KAAK;gBACtD,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,GAAG,uBAAuB,CAC1D,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACnC,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,IAAI,CACP,IAAI,sBAAsB,CACxB,6CAA6C,IAAI,CAAC,OAAO,CAAC,WAAW,SAAS;oBAC5E,kCAAkC,QAAQ,CAAC,KAAK,CAAC,EAAE,EACrD,KAAK,CACN,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO;QAC3B,CAAC;QACD,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAEO,IAAI,CAAC,KAA6B;QACxC,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;CACF;AA5KD,0DA4KC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/lib/workflow-credential-token-source.d.ts

@@ -0,0 +1,24 @@
+import { type AccessTokenSource } from './access-token';
+import { PermanentFailureError } from './bounded-retry';
+import type { TokenRefresherLogger } from './proactive-token-refresher';
+export interface WorkflowCredentialOptions {
+    readonly identityApiUrl: string;
+    readonly attestationFile: string;
+}
+export interface WorkflowCredentialDeps {
+    readonly fetch?: typeof fetch;
+    readonly readAttestationFile?: (path: string) => Promise<string>;
+    readonly now?: () => number;
+    readonly logger?: TokenRefresherLogger;
+}
+export declare class TemporalCredentialRefusedError extends PermanentFailureError {
+    readonly code: string;
+    readonly status: number | undefined;
+    constructor(message: string, code: string, status: number | undefined, cause: unknown);
+}
+export declare class TemporalCredentialMalformedError extends PermanentFailureError {
+    constructor(message: string);
+}
+export declare function validateWorkflowCredentialOptions(options: WorkflowCredentialOptions): void;
+export declare function createWorkflowCredentialTokenSource(options: WorkflowCredentialOptions, deps?: WorkflowCredentialDeps): AccessTokenSource;
+//# sourceMappingURL=workflow-credential-token-source.d.ts.map

package/dist/lib/workflow-credential-token-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-credential-token-source.d.ts","sourceRoot":"","sources":["../../src/lib/workflow-credential-token-source.ts"],"names":[],"mappings":"AAMA,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAaxE,MAAM,WAAW,yBAAyB;IAExC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAMhC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAGD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;CACxC;AAOD,qBAAa,8BAA+B,SAAQ,qBAAqB;IAIrE,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS;gBAHnC,OAAO,EAAE,MAAM,EAEN,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GAAG,SAAS,EACnC,KAAK,EAAE,OAAO;CAKjB;AAGD,qBAAa,gCAAiC,SAAQ,qBAAqB;gBAC7D,OAAO,EAAE,MAAM;CAI5B;AAGD,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,yBAAyB,GAAG,IAAI,CAa1F;AAcD,wBAAgB,mCAAmC,CACjD,OAAO,EAAE,yBAAyB,EAClC,IAAI,GAAE,sBAA2B,GAChC,iBAAiB,CAsCnB"}

package/dist/lib/workflow-credential-token-source.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TemporalCredentialMalformedError = exports.TemporalCredentialRefusedError = void 0;
+exports.validateWorkflowCredentialOptions = validateWorkflowCredentialOptions;
+exports.createWorkflowCredentialTokenSource = createWorkflowCredentialTokenSource;
+const identity_client_1 = require("@xemahq/identity-client");
+const access_token_1 = require("./access-token");
+const bounded_retry_1 = require("./bounded-retry");
+class TemporalCredentialRefusedError extends bounded_retry_1.PermanentFailureError {
+    code;
+    status;
+    constructor(message, code, status, cause) {
+        super(message, { cause });
+        this.code = code;
+        this.status = status;
+        this.name = 'TemporalCredentialRefusedError';
+    }
+}
+exports.TemporalCredentialRefusedError = TemporalCredentialRefusedError;
+class TemporalCredentialMalformedError extends bounded_retry_1.PermanentFailureError {
+    constructor(message) {
+        super(message);
+        this.name = 'TemporalCredentialMalformedError';
+    }
+}
+exports.TemporalCredentialMalformedError = TemporalCredentialMalformedError;
+function validateWorkflowCredentialOptions(options) {
+    let url;
+    try {
+        url = new URL(options.identityApiUrl);
+    }
+    catch {
+        throw new Error(`Temporal identity-api URL is not a URL: ${options.identityApiUrl}`);
+    }
+    if (url.protocol !== 'https:' && url.protocol !== 'http:') {
+        throw new Error(`Temporal identity-api URL must be http(s): ${options.identityApiUrl}`);
+    }
+    if (options.attestationFile.trim().length === 0) {
+        throw new Error('Temporal workflow credential: attestationFile is required.');
+    }
+}
+function createWorkflowCredentialTokenSource(options, deps = {}) {
+    validateWorkflowCredentialOptions(options);
+    const now = deps.now ?? Date.now;
+    const source = new identity_client_1.WorkflowCredentialSource({
+        identityApiUrl: options.identityApiUrl,
+        readCredential: (0, identity_client_1.fileCredentialReader)(options.attestationFile, deps.readAttestationFile),
+        ...(deps.fetch !== undefined ? { fetch: deps.fetch } : {}),
+        now,
+    });
+    return async () => {
+        source.invalidate();
+        const sentAt = now();
+        let value;
+        try {
+            value = await source.get();
+        }
+        catch (error) {
+            if (error instanceof identity_client_1.WorkflowCredentialError && error.code !== undefined) {
+                const refused = new TemporalCredentialRefusedError(`identity-api refused the Temporal workflow credential: ${error.code} ` +
+                    `(HTTP ${error.status ?? 'unknown'}). ${error.message}`, error.code, error.status, error);
+                deps.logger?.error(refused.message);
+                throw refused;
+            }
+            throw error;
+        }
+        const { iat, exp } = (0, access_token_1.decodeAccessTokenClaims)(value);
+        if (iat === undefined || exp === undefined || exp <= iat) {
+            throw new TemporalCredentialMalformedError('The Temporal workflow credential carries no usable iat/exp; its refresh cannot be scheduled.');
+        }
+        return { value, expiresAt: sentAt + (exp - iat) * 1000 };
+    };
+}
+//# sourceMappingURL=workflow-credential-token-source.js.map

package/dist/lib/workflow-credential-token-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-credential-token-source.js","sourceRoot":"","sources":["../../src/lib/workflow-credential-token-source.ts"],"names":[],"mappings":";;;AAuEA,8EAaC;AAcD,kFAyCC;AA3ID,6DAIiC;AAEjC,iDAIwB;AACxB,mDAAwD;AAsCxD,MAAa,8BAA+B,SAAQ,qCAAqB;IAI5D;IACA;IAJX,YACE,OAAe,EAEN,IAAY,EACZ,MAA0B,EACnC,KAAc;QAEd,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAJjB,SAAI,GAAJ,IAAI,CAAQ;QACZ,WAAM,GAAN,MAAM,CAAoB;QAInC,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AAXD,wEAWC;AAGD,MAAa,gCAAiC,SAAQ,qCAAqB;IACzE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;IACjD,CAAC;CACF;AALD,4EAKC;AAGD,SAAgB,iCAAiC,CAAC,OAAkC;IAClF,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2CAA2C,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,8CAA8C,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAcD,SAAgB,mCAAmC,CACjD,OAAkC,EAClC,OAA+B,EAAE;IAEjC,iCAAiC,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,0CAAwB,CAAC;QAC1C,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,cAAc,EAAE,IAAA,sCAAoB,EAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC;QACvF,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG;KACJ,CAAC,CAAC;IAEH,OAAO,KAAK,IAA0B,EAAE;QACtC,MAAM,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC;QACrB,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,yCAAuB,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACzE,MAAM,OAAO,GAAG,IAAI,8BAA8B,CAChD,0DAA0D,KAAK,CAAC,IAAI,GAAG;oBACrE,SAAS,KAAK,CAAC,MAAM,IAAI,SAAS,MAAM,KAAK,CAAC,OAAO,EAAE,EACzD,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,MAAM,EACZ,KAAK,CACN,CAAC;gBACF,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACpC,MAAM,OAAO,CAAC;YAChB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAA,sCAAuB,EAAC,KAAK,CAAC,CAAC;QACpD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;YACzD,MAAM,IAAI,gCAAgC,CACxC,8FAA8F,CAC/F,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;IAC3D,CAAC,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/temporal-runtime",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Temporal workers and clients for Xema — connection management, on-behalf-of auth interceptors, schedules, and search attributes.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
@@ -29,7 +29,7 @@
     "@types/jest": "^30.0.0",
     "@types/node": "25.2.3",
     "@xemahq/contracts": "^0.60.0",
-    "@xemahq/identity-client": "^0.14.0",
+    "@xemahq/identity-client": "^0.18.0",
     "jest": "^30.3.0",
     "prettier": "3.6.2",
     "reflect-metadata": "0.2.2",
@@ -40,7 +40,7 @@
   "peerDependencies": {
     "@nestjs/common": "^11.0.0",
     "reflect-metadata": "^0.2",
-    "@xemahq/identity-client": ">=0.9.0",
+    "@xemahq/identity-client": ">=0.18.0",
     "@xemahq/contracts": ">=0.60.0"
   },
   "dependencies": {
@@ -82,6 +82,6 @@
     "test:integration": "jest --config jest.integration.config.ts --runInBand"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:463ebda1739ffe585565191c43b695e5458072eaebd18e7e67e64d0734f0f77d"
+    "sourceDigest": "sha256:cfeb8e0b6cc78f1ce2e36651dc51c1f62f793c5e5f0cabe7cb89cc849e66e0e0"
   }
 }

package/dist/lib/client-credentials-token-source.d.ts

@@ -1,23 +0,0 @@
-import { type AccessTokenSource } from './access-token';
-export interface ClientCredentialsOptions {
-    readonly tokenEndpoint: string;
-    readonly clientId: string;
-    readonly clientSecretFile: string;
-    readonly audience: string;
-    readonly requestTimeoutMs?: number;
-}
-export interface ClientCredentialsDeps {
-    readonly fetch?: typeof fetch;
-    readonly readSecretFile?: (path: string) => Promise<string>;
-    readonly now?: () => number;
-}
-export declare class ClientCredentialsTokenError extends Error {
-    readonly status: number | undefined;
-    constructor(message: string, options?: {
-        status?: number;
-        cause?: unknown;
-    });
-}
-export declare function createClientCredentialsTokenSource(options: ClientCredentialsOptions, deps?: ClientCredentialsDeps): AccessTokenSource;
-export declare function validateClientCredentialsOptions(options: ClientCredentialsOptions): void;
-//# sourceMappingURL=client-credentials-token-source.d.ts.map

package/dist/lib/client-credentials-token-source.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"client-credentials-token-source.d.ts","sourceRoot":"","sources":["../../src/lib/client-credentials-token-source.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,gBAAgB,CAAC;AAYxB,MAAM,WAAW,wBAAwB;IAEvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAK1B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAOlC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAGD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAKD,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;gBAExB,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO;CAKhF;AAWD,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,wBAAwB,EACjC,IAAI,GAAE,qBAA0B,GAC/B,iBAAiB,CAsCnB;AAuDD,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI,CAmBxF"}

package/dist/lib/client-credentials-token-source.js

@@ -1,108 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ClientCredentialsTokenError = void 0;
-exports.createClientCredentialsTokenSource = createClientCredentialsTokenSource;
-exports.validateClientCredentialsOptions = validateClientCredentialsOptions;
-const promises_1 = require("node:fs/promises");
-const access_token_1 = require("./access-token");
-const DEFAULT_REQUEST_TIMEOUT_MS = 10_000;
-class ClientCredentialsTokenError extends Error {
-    status;
-    constructor(message, options = {}) {
-        super(message, options.cause === undefined ? undefined : { cause: options.cause });
-        this.name = 'ClientCredentialsTokenError';
-        this.status = options.status;
-    }
-}
-exports.ClientCredentialsTokenError = ClientCredentialsTokenError;
-function createClientCredentialsTokenSource(options, deps = {}) {
-    validateClientCredentialsOptions(options);
-    const doFetch = deps.fetch ?? fetch;
-    const readSecret = deps.readSecretFile ?? ((path) => (0, promises_1.readFile)(path, 'utf8'));
-    const now = deps.now ?? Date.now;
-    const timeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
-    return async () => {
-        const secret = (await readSecret(options.clientSecretFile)).trim();
-        if (secret.length === 0) {
-            throw new ClientCredentialsTokenError(`Temporal client secret file ${options.clientSecretFile} is empty.`);
-        }
-        const sentAt = now();
-        const response = await doFetch(options.tokenEndpoint, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/x-www-form-urlencoded',
-                Accept: 'application/json',
-            },
-            body: new URLSearchParams({
-                grant_type: 'client_credentials',
-                client_id: options.clientId,
-                client_secret: secret,
-            }).toString(),
-            signal: AbortSignal.timeout(timeoutMs),
-        });
-        const text = await response.text();
-        if (!response.ok) {
-            throw new ClientCredentialsTokenError(`Temporal token request for client ${options.clientId} was refused ` +
-                `(HTTP ${response.status}): ${text.slice(0, 300)}`, { status: response.status });
-        }
-        return parseTokenResponse(text, options, sentAt);
-    };
-}
-function parseTokenResponse(text, options, sentAt) {
-    let body;
-    try {
-        body = JSON.parse(text);
-    }
-    catch (cause) {
-        throw new ClientCredentialsTokenError(`Temporal token response for client ${options.clientId} is not JSON.`, { cause });
-    }
-    const record = (typeof body === 'object' && body !== null ? body : {});
-    const value = record['access_token'];
-    if (typeof value !== 'string' || value.length === 0) {
-        throw new ClientCredentialsTokenError(`Temporal token response for client ${options.clientId} carries no access_token.`);
-    }
-    const claims = (0, access_token_1.decodeAccessTokenClaims)(value);
-    if (!claims.aud.includes(options.audience)) {
-        throw new ClientCredentialsTokenError(`Temporal token for client ${options.clientId} does not carry the required ` +
-            `audience "${options.audience}" (aud=${JSON.stringify(claims.aud)}). ` +
-            'The frontend would refuse it; the issuer-side audience mapper is missing.');
-    }
-    const expiresIn = record['expires_in'];
-    let expiresAt;
-    if (typeof expiresIn === 'number' && expiresIn > 0) {
-        expiresAt = sentAt + expiresIn * 1000;
-    }
-    else if (claims.exp !== undefined) {
-        expiresAt = claims.exp * 1000;
-    }
-    else {
-        throw new ClientCredentialsTokenError(`Temporal token for client ${options.clientId} has neither expires_in nor exp; ` +
-            'its refresh cannot be scheduled.');
-    }
-    if (expiresAt <= sentAt) {
-        throw new ClientCredentialsTokenError(`Temporal token for client ${options.clientId} was already expired when issued.`);
-    }
-    return { value, expiresAt };
-}
-function validateClientCredentialsOptions(options) {
-    let url;
-    try {
-        url = new URL(options.tokenEndpoint);
-    }
-    catch {
-        throw new Error(`Temporal token endpoint is not a URL: ${options.tokenEndpoint}`);
-    }
-    if (url.protocol !== 'https:' && url.protocol !== 'http:') {
-        throw new Error(`Temporal token endpoint must be http(s): ${options.tokenEndpoint}`);
-    }
-    for (const [name, value] of [
-        ['clientId', options.clientId],
-        ['clientSecretFile', options.clientSecretFile],
-        ['audience', options.audience],
-    ]) {
-        if (value.trim().length === 0) {
-            throw new Error(`Temporal client credentials: ${name} is required.`);
-        }
-    }
-}
-//# sourceMappingURL=client-credentials-token-source.js.map

package/dist/lib/client-credentials-token-source.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"client-credentials-token-source.js","sourceRoot":"","sources":["../../src/lib/client-credentials-token-source.ts"],"names":[],"mappings":";;;AAoEA,gFAyCC;AAuDD,4EAmBC;AAvLD,+CAA4C;AAE5C,iDAIwB;AAwCxB,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAG1C,MAAa,2BAA4B,SAAQ,KAAK;IAC3C,MAAM,CAAqB;IAEpC,YAAY,OAAe,EAAE,UAAgD,EAAE;QAC7E,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;CACF;AARD,kEAQC;AAWD,SAAgB,kCAAkC,CAChD,OAAiC,EACjC,OAA8B,EAAE;IAEhC,gCAAgC,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAA,mBAAQ,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;IAEzE,OAAO,KAAK,IAA0B,EAAE;QACtC,MAAM,MAAM,GAAG,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,2BAA2B,CACnC,+BAA+B,OAAO,CAAC,gBAAgB,YAAY,CACpE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,OAAO,CAAC,QAAQ;gBAC3B,aAAa,EAAE,MAAM;aACtB,CAAC,CAAC,QAAQ,EAAE;YACb,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,2BAA2B,CACnC,qCAAqC,OAAO,CAAC,QAAQ,eAAe;gBAClE,SAAS,QAAQ,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EACpD,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAC5B,CAAC;QACJ,CAAC;QACD,OAAO,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAY,EACZ,OAAiC,EACjC,MAAc;IAEd,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,2BAA2B,CACnC,sCAAsC,OAAO,CAAC,QAAQ,eAAe,EACrE,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAGpE,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,2BAA2B,CACnC,sCAAsC,OAAO,CAAC,QAAQ,2BAA2B,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,sCAAuB,EAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,2BAA2B,CACnC,6BAA6B,OAAO,CAAC,QAAQ,+BAA+B;YAC1E,aAAa,OAAO,CAAC,QAAQ,UAAU,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK;YACtE,2EAA2E,CAC9E,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IACvC,IAAI,SAAiB,CAAC;IACtB,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACnD,SAAS,GAAG,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;IACxC,CAAC;SAAM,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACpC,SAAS,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,2BAA2B,CACnC,6BAA6B,OAAO,CAAC,QAAQ,mCAAmC;YAC9E,kCAAkC,CACrC,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,2BAA2B,CACnC,6BAA6B,OAAO,CAAC,QAAQ,mCAAmC,CACjF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAGD,SAAgB,gCAAgC,CAAC,OAAiC;IAChF,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,yCAAyC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,4CAA4C,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC;QAC9B,CAAC,kBAAkB,EAAE,OAAO,CAAC,gBAAgB,CAAC;QAC9C,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC;KACtB,EAAE,CAAC;QACX,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,eAAe,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;AACH,CAAC"}