[johanngan]

What was changed

Add support for envconfig extensions. These allow separate packages to extend envconfig with their own TOML keys and environment variables by implementing the ClientConfigExtension interface. An extension operates on a config profile as input and outputs a plugin to be attached to the client created from envconfig output.

A TOML file with an extension looks as follows:

[profile.default.ext.my_extension]
some_field = "value"

An envconfig consumer specifies a list of extensions to use when loading connection options via ClientConfig.load_client_connect_config(extensions=...). Returned plugins are client plugins set under the "plugins" key of the resulting ClientConnectConfig, so they are applied when the config is passed to Client.connect(**config). For now, extensions are not supported in other contexts.

Why?

It's useful for external packages to be able to extend the envconfig format without needing to modify the envconfig package itself. The first use-case for this will be integrating with AWS Secrets Manager to specify client secrets via Secrets Manager ID.

Also see the Go implementation in temporalio/sdk-go#2771. Also see the Rust core change in temporalio/sdk-rust#1736.

Checklist

2. How was this tested:

• Added new unit tests.
• Manual end-to-end check (performed by Claude): a small standalone program loaded a real temporal.toml (via TEMPORAL_CONFIG_FILE) with an [profile.default.ext.e2e] table, using real process env vars (TEMPORAL_NAMESPACE, TEMPORAL_EXT_E2E_SUFFIX). An extension passed to ClientConfig.load_client_connect_config read its TOML table and env var and returned a plugin. The program confirmed that the extension saw the env-overridden profile, and that the returned config had the expected namespace and target host and exactly one plugin carrying the expected values.

3. Any docs updates needed?
   The associated in-repo docs are updated. I don't think we need other public docs for now, as right now this is primarily just an implementation detail for the Lambda worker integration with Secrets Manager.

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[johanngan]

I added an additional commit to convert TOML datetimes within envconfig ext tables into native Python datetime types within the Rust bridge, the way tomllib would. It's a fair bit of extra code for something that's probably not going to be used very often, if at all, but it seems like we ought to do it for completeness, but I'm open to dropping it and leaving datetimes as strings instead.

[tconley1428]

Converting to a draft just because I don't like having open PRs which pass CI but shouldn't merge, it can be reviewed in draft until core is ready.

[johanngan]

Converting to a draft just because I don't like having open PRs which pass CI but shouldn't merge, it can be reviewed in draft until core is ready.

SGTM, I converted the .NET/Ruby ones as well

[johanngan]

(Force push to rebase on the recent sdk-core submodule bump in #2093)