[Bridge] Served ExecuteSyncNexusOperation in the frontend.

chasm/lib/nexusoperation/validator.go

@@ -343,6 +343,42 @@ func (v *validator) normalizeIDPolicies(req *workflowservice.StartNexusOperation
 	}
 }
 
+// ValidateAndNormalizeSyncRequest checks an ExecuteSyncNexusOperation request against the limits
+// of standalone operations. It sets a missing request ID and lowercases the Nexus headers in place.
+func ValidateAndNormalizeSyncRequest(
+	config *Config,
+	logger log.Logger,
+	req *workflowservice.ExecuteSyncNexusOperationRequest,
+) error {
+	v := &validator{config: config, logger: logger}
+	if err := v.normalizeRequestID(&req.RequestId); err != nil {
+		return err
+	}
+	if err := v.validateIDLength("identity", req.GetIdentity()); err != nil {
+		return err
+	}
+	// The target and input checks take a start request, and these fields are the same.
+	start := &workflowservice.StartNexusOperationExecutionRequest{
+		Namespace: req.GetNamespace(),
+		Endpoint:  req.GetEndpoint(),
+		Service:   req.GetService(),
+		Operation: req.GetOperation(),
+		Input:     req.GetInput(),
+	}
+	if err := v.validateTarget(start); err != nil {
+		return err
+	}
+	if err := v.validateInput(start); err != nil {
+		return err
+	}
+	loweredHeaders, err := v.validateAndLowercaseHeaders(req.GetNamespace(), req.GetNexusHeader())
+	if err != nil {
+		return err
+	}
+	req.NexusHeader = loweredHeaders
+	return nil
+}
+
 // validateOnConflictOptions validates the on_conflict_options of a start request:
 //   - attach_completion_callbacks requires attach_request_id, since it is embedded into the keys we use
 //     to persist them on the Operation's Callbacks map.

common/api/metadata.go

@@ -109,6 +109,7 @@ var (
 		"RequestCancelNexusOperationExecution":         {Scope: ScopeNamespace, Access: AccessWrite, Polling: PollingNone},
 		"StartActivityExecution":                       {Scope: ScopeNamespace, Access: AccessWrite, Polling: PollingNone},
 		"StartNexusOperationExecution":                 {Scope: ScopeNamespace, Access: AccessWrite, Polling: PollingNone},
+		"ExecuteSyncNexusOperation":                    {Scope: ScopeNamespace, Access: AccessWrite, Polling: PollingNone},
 		"TerminateActivityExecution":                   {Scope: ScopeNamespace, Access: AccessWrite, Polling: PollingNone},
 		"TerminateNexusOperationExecution":             {Scope: ScopeNamespace, Access: AccessWrite, Polling: PollingNone},
 		"PollNexusTaskQueue":                           {Scope: ScopeNamespace, Access: AccessWrite, Polling: PollingAlways},

common/dynamicconfig/constants.go

@@ -1188,6 +1188,13 @@ so forwarding by endpoint ID will not work out of the box.`,
 		`FrontendEnableBatchOperationsForStandaloneActivities controls whether the frontend accepts the batch cancel, terminate, and delete standalone activity operation fields`,
 	)
 
+	FrontendEnableExecuteSyncNexusOperation = NewNamespaceBoolSetting(
+		"frontend.enableExecuteSyncNexusOperation",
+		false,
+		`FrontendEnableExecuteSyncNexusOperation enables the ExecuteSyncNexusOperation API in the
+frontend for callers in the namespace.`,
+	)
+
 	FrontendEnableUpdateWorkflowExecution = NewNamespaceBoolSetting(
 		"frontend.enableUpdateWorkflowExecution",
 		true,

common/rpc/interceptor/redirection.go

@@ -43,6 +43,10 @@ var (
 		"GetSearchAttributes": func() any { return &workflowservice.GetSearchAttributesResponse{} },
 		"GetClusterInfo":      func() any { return &workflowservice.GetClusterInfoResponse{} },
 		"GetSystemInfo":       func() any { return &workflowservice.GetSystemInfoResponse{} },
+
+		// The handler checks the target namespace, which can be active in another cluster than the
+		// caller namespace.
+		"ExecuteSyncNexusOperation": func() any { return &workflowservice.ExecuteSyncNexusOperationResponse{} },
 	}
 
 	globalAPIResponses = map[string]responseConstructorFn{

common/rpc/interceptor/redirection_test.go

@@ -95,6 +95,8 @@ func (s *redirectionInterceptorSuite) TestLocalAPI() {
 		"GetSearchAttributes": {},
 		"GetClusterInfo":      {},
 		"GetSystemInfo":       {},
+
+		"ExecuteSyncNexusOperation": {},
 	}, apis)
 }
 

go.mod

@@ -224,4 +224,4 @@ require (
 
 tool golang.org/x/perf/cmd/benchstat
 
-replace go.temporal.io/api => github.com/moetemp/api-go v1.63.6-0.20261016104405-5d5af69e7748
+replace go.temporal.io/api => github.com/moetemp/api-go v1.63.6-0.20261016104423-a090bbf0413c

go.sum

@@ -319,8 +319,8 @@ github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJ
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
 github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/moetemp/api-go v1.63.6-0.20261016104405-5d5af69e7748 h1:YMY5nOoBhv17FNekWZj5Co4ktqSoEKgConNior8/prg=
-github.com/moetemp/api-go v1.63.6-0.20261016104405-5d5af69e7748/go.mod h1:acM0I9WPuYg8W3Pd9jOZvEgi7mRUttUQ4+e7fowKVnM=
+github.com/moetemp/api-go v1.63.6-0.20261016104423-a090bbf0413c h1:gwxe6Y8xFv+z6WVGvR0pw8IM+UD8RVtmUl4qyqSFvXY=
+github.com/moetemp/api-go v1.63.6-0.20261016104423-a090bbf0413c/go.mod h1:acM0I9WPuYg8W3Pd9jOZvEgi7mRUttUQ4+e7fowKVnM=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=

service/frontend/configs/quotas.go

@@ -63,6 +63,9 @@ var (
 		// Dispatching a Nexus task is a potentially long running RPC, it's classified in the same bucket as QueryWorkflow.
 		DispatchNexusTaskByNamespaceAndTaskQueueAPIName: 1,
 		DispatchNexusTaskByEndpointAPIName:              1,
+
+		// A sync Nexus call waits for its Nexus task to finish, as a dispatch does.
+		"/temporal.api.workflowservice.v1.WorkflowService/ExecuteSyncNexusOperation": 1,
 	}
 
 	// PollTaskAPISet is the set of API methods for which NamespaceRateLimitInterceptor will
@@ -96,6 +99,7 @@ var (
 		"/temporal.api.workflowservice.v1.WorkflowService/StartBatchOperation":              1,
 		"/temporal.api.workflowservice.v1.WorkflowService/StartActivityExecution":           1,
 		"/temporal.api.workflowservice.v1.WorkflowService/StartNexusOperationExecution":     1,
+		"/temporal.api.workflowservice.v1.WorkflowService/ExecuteSyncNexusOperation":        1,
 		"/temporal.api.workflowservice.v1.WorkflowService/AttachStreamCallback":             1,
 		DispatchNexusTaskByNamespaceAndTaskQueueAPIName:                                     1,
 		DispatchNexusTaskByEndpointAPIName:                                                  1,

service/frontend/fx.go

@@ -33,6 +33,7 @@ import (
 	"go.temporal.io/server/common/metrics"
 	"go.temporal.io/server/common/namespace"
 	"go.temporal.io/server/common/namespace/nsreplication"
+	commonnexus "go.temporal.io/server/common/nexus"
 	"go.temporal.io/server/common/persistence"
 	"go.temporal.io/server/common/persistence/serialization"
 	"go.temporal.io/server/common/persistence/visibility"
@@ -1003,6 +1004,12 @@ func HandlerProvider(
 	streamNotifierHandler streamnotifier.FrontendHandler,
 	registry *chasm.Registry,
 	frontendServiceResolver membership.ServiceResolver,
+	endpointRegistry commonnexus.EndpointRegistry,
+	namespaceRateLimiter interceptor.NamespaceRateLimitInterceptor,
+	nexusOperationConfig *chasmnexus.Config,
+	authInterceptor *authorization.Interceptor,
+	namespaceValidator *interceptor.NamespaceValidatorInterceptor,
+	namespaceCountLimiter *interceptor.ConcurrentRequestLimitInterceptor,
 ) Handler {
 	workerDeploymentReadRateLimiter := configs.NewGlobalNamespaceRateLimiter(
 		frontendServiceResolver,
@@ -1050,6 +1057,14 @@ func HandlerProvider(
 			saMapperProvider,
 			saValidator,
 		),
+		endpointRegistry,
+		namespaceRateLimiter,
+		nexusOperationConfig,
+		SyncNexusChecks{
+			Authorizer:   authInterceptor,
+			StateChecker: namespaceValidator,
+			CountLimiter: namespaceCountLimiter,
+		},
 	)
 	return wfHandler
 }