zeekay 71b3c30d73 feat(sdk): IAM bearer auth over ZAP (auth_token) for the gated frontend ...

The gated engine (cloud ServeGated :9999) requires an auth_token on every
JSON-body RPC; the TS SDK had no way to send one. Add a TokenProvider that
rides client lifecycle + worker Subscribe as auth_token (mirrors the Go SDK's
Options.Token), injected at the ZAP transport for JSON bodies only — worker
Respond/Heartbeat field-object frames are HMAC-authenticated and untouched.

Threaded through Connection/TasksClient/Worker options. Proven: unit test
(auth_token rides JSON RPCs, absent without a source) + gated e2e vs a real
RequireIdentity tasksd with a local RS256 JWKS (anonymous -> 401; IAM-bearer
client+worker run a durable workflow to COMPLETED with org-scoped namespace).

2026-07-04 21:39:26 -07:00

..

auth-token.test.ts

feat(sdk): IAM bearer auth over ZAP (auth_token) for the gated frontend

2026-07-04 21:39:26 -07:00

client.test.ts

…

durable-primitives.integration.test.ts

…

gated.integration.test.ts

feat(sdk): IAM bearer auth over ZAP (auth_token) for the gated frontend

2026-07-04 21:39:26 -07:00

integration.test.ts

…

mock-server.ts

feat(sdk): IAM bearer auth over ZAP (auth_token) for the gated frontend

2026-07-04 21:39:26 -07:00

worker-activity.test.ts

…

worker-workflow.test.ts

…

zap-wire.test.ts

…