From dbbcf48b19e5625e8450e4b67e545767d34dbe7b Mon Sep 17 00:00:00 2001 From: Jwahir Sundai Date: Thu, 28 May 2026 11:01:47 -0500 Subject: [PATCH 1/5] warn about wrapper type incompatibility with typed operations --- docs/encyclopedia/nexus/nexus-security.mdx | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/docs/encyclopedia/nexus/nexus-security.mdx b/docs/encyclopedia/nexus/nexus-security.mdx index 8f266f541b..59783ff1a4 100644 --- a/docs/encyclopedia/nexus/nexus-security.mdx +++ b/docs/encyclopedia/nexus/nexus-security.mdx @@ -89,6 +89,16 @@ See the [encryption sample](https://github.com/temporalio/samples-go/blob/main/e Use wrapper types (for example, `EndpointValue`) so the Data Converter selects an Endpoint-specific encryption key. This encrypts only Nexus traffic with a dedicated key, without sharing Namespace keys across teams. +:::warning Incompatible with typed operations + +The wrapper approach changes the static type of the operation input, so it only compiles when the caller uses `ExecuteOperation` with a **string operation name**. +A typed reference declared as `nexus.Operation[Input, Output]` constrains the input through Go generics, and the wrapped value will not satisfy that constraint. +The call fails at compile time, not at runtime. + +For typed operations, pass the Endpoint name to the Data Converter through the workflow context instead of wrapping the input. + +::: + See the [draft endpoint-based encryption sample](https://github.com/temporalio/samples-go/compare/main...bergundy:samples-go:nexus-encryption-by-endpoint). ### Choosing an approach From 26d9480a7e9c81ea7ba7f5200c52ced203b8633d Mon Sep 17 00:00:00 2001 From: Jwahir Sundai Date: Thu, 28 May 2026 11:10:48 -0500 Subject: [PATCH 2/5] fix typed ops failure description, add error example --- docs/encyclopedia/nexus/nexus-security.mdx | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/docs/encyclopedia/nexus/nexus-security.mdx b/docs/encyclopedia/nexus/nexus-security.mdx index 59783ff1a4..77c32f6fe1 100644 --- a/docs/encyclopedia/nexus/nexus-security.mdx +++ b/docs/encyclopedia/nexus/nexus-security.mdx @@ -91,9 +91,14 @@ This encrypts only Nexus traffic with a dedicated key, without sharing Namespace :::warning Incompatible with typed operations -The wrapper approach changes the static type of the operation input, so it only compiles when the caller uses `ExecuteOperation` with a **string operation name**. -A typed reference declared as `nexus.Operation[Input, Output]` constrains the input through Go generics, and the wrapped value will not satisfy that constraint. -The call fails at compile time, not at runtime. +The wrapper approach changes the type of the operation input. +When using `ExecuteOperation` directly, both operation and input are typed as `any`, so the call itself compiles. +However, if the caller uses a typed wrapper or generated helper that constrains the input type through Go generics, the wrapped value will not satisfy that constraint and the call will fail at compile time: + +``` +cannot assign argument of type "converter.NexusOperation" to type "…EchoInput" +``` +For string-based operation names called directly via `ExecuteOperation`, the mismatch may only surface at runtime during deserialization. For typed operations, pass the Endpoint name to the Data Converter through the workflow context instead of wrapping the input. From c9f8bf68a742271c79a3cda98805f62129e241d7 Mon Sep 17 00:00:00 2001 From: Jwahir Sundai Date: Fri, 29 May 2026 08:11:57 -0400 Subject: [PATCH 3/5] tighter language, match original issue wording --- docs/encyclopedia/nexus/nexus-security.mdx | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/docs/encyclopedia/nexus/nexus-security.mdx b/docs/encyclopedia/nexus/nexus-security.mdx index 77c32f6fe1..d8be5010b8 100644 --- a/docs/encyclopedia/nexus/nexus-security.mdx +++ b/docs/encyclopedia/nexus/nexus-security.mdx @@ -89,18 +89,17 @@ See the [encryption sample](https://github.com/temporalio/samples-go/blob/main/e Use wrapper types (for example, `EndpointValue`) so the Data Converter selects an Endpoint-specific encryption key. This encrypts only Nexus traffic with a dedicated key, without sharing Namespace keys across teams. -:::warning Incompatible with typed operations +:::warning Limited to string-based operation names -The wrapper approach changes the type of the operation input. -When using `ExecuteOperation` directly, both operation and input are typed as `any`, so the call itself compiles. -However, if the caller uses a typed wrapper or generated helper that constrains the input type through Go generics, the wrapped value will not satisfy that constraint and the call will fail at compile time: +When calling `ExecuteOperation` with a non-string operation (for example, an operation definition or reference), the wrapper changes the input type and `ExecuteOperation` fails type-checking: ``` cannot assign argument of type "converter.NexusOperation" to type "…EchoInput" ``` -For string-based operation names called directly via `ExecuteOperation`, the mismatch may only surface at runtime during deserialization. -For typed operations, pass the Endpoint name to the Data Converter through the workflow context instead of wrapping the input. +This approach only works when the operation is passed as a string name. +For typed operations, pass the Nexus endpoint info through the workflow context instead of the wrapped input. +This requires a Nexus workflow outbound interceptor and a context-aware codec converter, and does not work with synchronous operations. ::: From a70ba963f19013d2aee073a7e6bb0e939e6d3648 Mon Sep 17 00:00:00 2001 From: Jwahir Sundai Date: Fri, 29 May 2026 13:31:53 -0400 Subject: [PATCH 4/5] "" to type "" Co-authored-by: Xinyi Chen --- docs/encyclopedia/nexus/nexus-security.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/encyclopedia/nexus/nexus-security.mdx b/docs/encyclopedia/nexus/nexus-security.mdx index d8be5010b8..f279dac405 100644 --- a/docs/encyclopedia/nexus/nexus-security.mdx +++ b/docs/encyclopedia/nexus/nexus-security.mdx @@ -94,7 +94,7 @@ This encrypts only Nexus traffic with a dedicated key, without sharing Namespace When calling `ExecuteOperation` with a non-string operation (for example, an operation definition or reference), the wrapper changes the input type and `ExecuteOperation` fails type-checking: ``` -cannot assign argument of type "converter.NexusOperation" to type "…EchoInput" +cannot assign argument of type "" to type "" ``` This approach only works when the operation is passed as a string name. From 6c2f378fd0417f6b6ee845cd7dc59d1a65b698f3 Mon Sep 17 00:00:00 2001 From: Jwahir Sundai Date: Tue, 2 Jun 2026 17:17:08 -0500 Subject: [PATCH 5/5] drop last line --- docs/encyclopedia/nexus/nexus-security.mdx | 1 - 1 file changed, 1 deletion(-) diff --git a/docs/encyclopedia/nexus/nexus-security.mdx b/docs/encyclopedia/nexus/nexus-security.mdx index f279dac405..ac014320b1 100644 --- a/docs/encyclopedia/nexus/nexus-security.mdx +++ b/docs/encyclopedia/nexus/nexus-security.mdx @@ -99,7 +99,6 @@ cannot assign argument of type "" to type "" This approach only works when the operation is passed as a string name. For typed operations, pass the Nexus endpoint info through the workflow context instead of the wrapped input. -This requires a Nexus workflow outbound interceptor and a context-aware codec converter, and does not work with synchronous operations. :::