SIAX Technology (sax3l)
Repositories
2
 Projects Packages

@siax/workload-auth (0.1.0)

Published 2026-09-16 09:34:31 +00:00 by admin

Installation

@siax:registry=https://git.cloud.siax.io/api/packages/sax3l/npm/
npm install @siax/workload-auth@0.1.0
"@siax/workload-auth": "0.1.0"

About this package

@siax/workload-auth

Short-lived, EdDSA-signed WORKLOAD identity tokens — mint (issueWorkloadToken), verify (verifyWorkloadToken), and an injectable revocation port (WorkloadRevocationChecker) so a single compromised token can be killed without touching the fleet IdP. Ported out of cl0ud's packages/platform-core/src/auth/workload.ts (P006 DoD: "short-lived workload identity tokens"). Node ESM (.mjs), Node ≥ 20 — same convention as @siax/idempotency, @siax/outbox, @siax/schemas. One real external dependency: jose (Ed25519 JWT sign/verify).

The honest extraction decision

This package was commissioned (Wave 8, 2026-09-14) as "extract the duplicated workload-identity-auth implementation shared by cl0ud/act0/n0d into a shared package." Before porting anything, each premise was checked by reading the actual code rather than assumed:

  • cl0ud — confirmed. packages/platform-core/src/auth/workload.ts (461 lines) is real, tested (auth/__tests__/workload.test.ts, 284 lines, 20+ cases), and is what this package is ported from.
  • act0 and n0d — NOT confirmed. Both were expected to carry their own copy of workload-token issue/verify logic. Neither does. Both vendor a different piece of auth: a self-contained Zitadel OIDC bearer/PAT verifier (src/auth/zitadel.ts in each repo) — real, tested, and explicitly documented in its own header as mirroring "the canonical implementation already shipped on n0d/aud0/api0/inf0" for that, not for workload tokens. cl0ud's own workload.ts header says so directly: "What this does NOT do: make ST0RE, N0D, H0ST, ACT0, or AUD0 accept a CL0UD-issued token... out of scope for this PR." Grepping both repos for workload_id, issueWorkloadToken, WorkloadTokenClaims, CL0UD_WORKLOAD_*, and @siax/platform-core turned up zero hits outside generic uses of the English word "workload" (compute jobs, not identity). There was nothing to de-duplicate in act0 or n0d — see the Wave 8 report for the consumer-by-consumer disposition.
  • inf0's ErrorCode mirror — found, but it's SIAX_ERROR_CODES / SiaxErrorCode in packages/ai-contracts/src/siax-context.ts, which mirrors @siax/contract's 12-value, UPPER_SNAKE_CASE cross-product error vocabulary (UNAUTHENTICATED, AUTHORIZATION_DENIED, CAPABILITY_UNAVAILABLE, RETRYABLE_FAILURE, PERMANENT_FAILURE, ...) — not this module's own 11-value lowercase ErrorCode (packages/platform-core/src/errors.ts: unauthenticated, forbidden, tenant_mismatch, validation_failed, source_unavailable, internal, ...) that workload.ts's unauthenticated() import used. The two vocabularies have already diverged in count, casing, and semantics (no 1:1 mapping for CAPABILITY_UNAVAILABLE, RETRYABLE_FAILURE / PERMANENT_FAILURE vs. plain internal, or tenant_mismatch). inf0's own file header already documents, in its own words, why it mirrors by value instead of importing. Left unchanged — forcing that merge would silently break a vocabulary inf0 deliberately kept separate.

What changed from cl0ud's original

  1. TypeScript → plain ESM. .mjs source + a hand-written src/index.d.ts (matching @siax/outbox's pattern), not a tsc build step — no sibling package in this repo ships one.
  2. The one real cl0ud-internal coupling removed. The original's nonEmpty() input guard threw cl0ud's own unauthenticated() / PlatformError (../errors.js). That's replaced here by a local WorkloadAuthInputError. A consumer that wants cl0ud's (or any other app's) own error envelope catches WorkloadAuthInputError at its own boundary and rethrows in its own shape — that's the seam. Nothing else about the exported names, claim shape, or runtime behavior changed; this is a port, not a rewrite. WORKLOAD_AUTH_* env vars are the new primary names, with CL0UD_WORKLOAD_* accepted as a back-compat alias so cl0ud's existing deploy config would keep working unchanged if it ever wires this package in for real.

Consumer status (Wave 8, 2026-09-14)

  • cl0ud — left as the running implementation (unchanged behavior; see its own workload.ts for a pointer comment to this package). Rewiring cl0ud to import @siax/workload-auth at runtime is blocked on the same unresolved, known estate blocker as every other cross-repo @siax/* consumption: publishing to the Gitea npm registry requires a decision (B-2 in cl0ud's docs/compliance/BLOCKERS.md: "Beslut D13 + Gitea-token med write:package") that has not been made, and no @siax/* package in this repo is consumed by any external repo today (verified: zero references to @siax/idempotency, @siax/outbox, @siax/schemas, etc. in cl0ud/act0/ n0d/inf0's package.json files). This package is the canonical source going forward and is ready to be installed the moment B-2 is resolved.
  • act0, n0d — no change. Neither had the code this task set out to de-duplicate (see above).
  • inf0 — no change, by design. Its mirror is a different, already- diverged vocabulary; see above.

Dependencies

Dependencies

ID Version
jose ^5.9.6
Details
npm
2026-09-16 09:34:31 +00:00
1826
UNLICENSED
latest
12 KiB
Assets (1)
workload-auth-0.1.0.tgz 12 KiB
Versions (1) View all
0.1.0 2026-09-16