v1.34.1

Feature Enhancements

• Trust Providers (TypeScript SDK)

  • Added support for GitLab CI/CD OIDC (gitlab_identity_token):
    • Factory: createGitLabIdentityTokenTrustProvider
    • Registry method: trustProviders.gitlabIdentityToken(options)
    • Subpath import: @aembit/edge-sdk/trust-providers/gitlab-identity-token
    • Authenticates workloads executing within GitLab CI pipelines using job OIDC tokens (CI_JOB_JWT_V2 or custom).
    • Supported configuration options:
      • identityToken (Required): String token or lazy token resolver function (() => Promise<string>).
      • id (Optional, defaults to "gitlab-identity-token"): Custom provider instance identifier.
      • retry (Optional): Retry policy override for token resolution.
  • Added support for Terraform Cloud / HCP Terraform OIDC (terraform_cloud_identity_token):
    • Factory: createTerraformCloudIdentityTokenTrustProvider
    • Registry method: trustProviders.terraformCloudIdentityToken(options)
    • Subpath import: @aembit/edge-sdk/trust-providers/terraform-cloud-identity-token
    • Authenticates runs in Terraform Cloud / HCP Terraform using workload identity tokens (TFC_WORKLOAD_IDENTITY_TOKEN or custom).
    • Supported configuration options:
      • identityToken (Required): String token or lazy token resolver function (() => Promise<string>).
      • id (Optional, defaults to "terraform-cloud-identity-token"): Custom provider instance identifier.
      • retry (Optional): Retry policy override.
  • Added support for Kubernetes Service Account (k8s_service_account):
    • Factory: createK8sServiceAccountTrustProvider
    • Registry method: trustProviders.k8sServiceAccount(options)
    • Subpath import: @aembit/edge-sdk/trust-providers/k8s-service-account
    • Authenticates in-cluster workloads using projected Kubernetes ServiceAccount tokens (/var/run/secrets/kubernetes.io/serviceaccount/token or custom).
    • Supported configuration options:
      • serviceAccountToken (Required): String token or lazy token resolver function (() => Promise<string>).
      • id (Optional, defaults to "k8s-service-account"): Custom provider instance identifier.
      • retry (Optional): Retry policy override.
  • Added support for Custom Provider Identifiers & Observability:
    • All built-in Trust Provider options now accept an optional id parameter.
    • Custom identifiers are propagated into structured log events (trustProviderId) and returned in AuthSession metadata, supporting multi-identity workloads and APM/OpenTelemetry correlation.

• SDK Root Error Exports (TypeScript SDK)

  • Exported core protocol and runtime error classes directly from the root package entrypoint (@aembit/edge-sdk):
    • EdgeSdkError (base error class)
    • ApiError
    • AuthError
    • CredentialError
    • TransportError
    • TrustProviderError

Documentation & Examples

• Runnable End-to-End Examples
  • Added new runnable reference examples under ts/examples/:
    • gitlab-ci-oidc: Demonstrates authenticating in GitLab CI pipelines to retrieve credentials from Aembit.
    • terraform-cloud-oidc: Demonstrates HCP Terraform run authentication via dynamic workload identity tokens.
    • k8s-service-account: Demonstrates authenticating Kubernetes pods using projected ServiceAccount tokens.
• Example & Documentation Modernization
  • Updated existing examples to consume the published @aembit/edge-sdk package and import TrustProviderError.
  • Standardized API base URL placeholders across documentation and examples from <region> to <stack> (e.g., https://<tenant>.<stack>.aembit.io/api).
  • Updated TypeScript SDK README.md with a supported trust providers compatibility matrix and provider ID customization guidance.

Maintenance & CI/CD

• SonarCloud Project Separation
  • Explicitly configured sonar.projectName for TypeScript (Edge SDK (TypeScript)) and Python (Edge SDK (Python)) to provide distinct headers on SonarCloud PR decoration comments.
• Dependency & Workflow Upgrades
  • Bumped GitHub Actions workflow dependencies in .github/workflows/ci.yml.
  • Updated NPM dependencies across root and TypeScript workspaces.