@exaudeus/workrail 0.17.0 → 1.1.0

package/dist/v2/durable-core/tokens/binary-payload.js

@@ -0,0 +1,279 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TOKEN_KIND_CHECKPOINT = exports.TOKEN_KIND_ACK = exports.TOKEN_KIND_STATE = void 0;
+exports.packStateTokenPayload = packStateTokenPayload;
+exports.packAckTokenPayload = packAckTokenPayload;
+exports.packCheckpointTokenPayload = packCheckpointTokenPayload;
+exports.unpackTokenPayload = unpackTokenPayload;
+const neverthrow_1 = require("neverthrow");
+const index_js_1 = require("../ids/index.js");
+const STATE_TOKEN_LAYOUT = {
+    VERSION: 0,
+    KIND: 1,
+    SESSION_ID: 2,
+    RUN_ID: 18,
+    NODE_ID: 34,
+    WORKFLOW_HASH_REF: 50,
+    TOTAL_SIZE: 66,
+};
+const ACK_TOKEN_LAYOUT = {
+    VERSION: 0,
+    KIND: 1,
+    SESSION_ID: 2,
+    RUN_ID: 18,
+    NODE_ID: 34,
+    ATTEMPT_ID: 50,
+    TOTAL_SIZE: 66,
+};
+const CHECKPOINT_TOKEN_LAYOUT = {
+    VERSION: 0,
+    KIND: 1,
+    SESSION_ID: 2,
+    RUN_ID: 18,
+    NODE_ID: 34,
+    ATTEMPT_ID: 50,
+    TOTAL_SIZE: 66,
+};
+exports.TOKEN_KIND_STATE = 0;
+exports.TOKEN_KIND_ACK = 1;
+exports.TOKEN_KIND_CHECKPOINT = 2;
+const TOKEN_KIND_BYTES = {
+    state: exports.TOKEN_KIND_STATE,
+    ack: exports.TOKEN_KIND_ACK,
+    checkpoint: exports.TOKEN_KIND_CHECKPOINT,
+};
+function packStateTokenPayload(payload, base32) {
+    if (payload.tokenVersion !== 1) {
+        return (0, neverthrow_1.err)({ code: 'BINARY_INVALID_VERSION', version: payload.tokenVersion });
+    }
+    if (payload.tokenKind !== 'state') {
+        return (0, neverthrow_1.err)({ code: 'BINARY_INVALID_TOKEN_KIND', kind: payload.tokenKind });
+    }
+    const buffer = new Uint8Array(STATE_TOKEN_LAYOUT.TOTAL_SIZE);
+    buffer[STATE_TOKEN_LAYOUT.VERSION] = payload.tokenVersion;
+    buffer[STATE_TOKEN_LAYOUT.KIND] = TOKEN_KIND_BYTES[payload.tokenKind];
+    const sessionBytes = sessionIdToBytes(payload.sessionId, base32);
+    if (sessionBytes.isErr())
+        return sessionBytes;
+    buffer.set(sessionBytes.value, STATE_TOKEN_LAYOUT.SESSION_ID);
+    const runBytes = runIdToBytes(payload.runId, base32);
+    if (runBytes.isErr())
+        return runBytes;
+    buffer.set(runBytes.value, STATE_TOKEN_LAYOUT.RUN_ID);
+    const nodeBytes = nodeIdToBytes(payload.nodeId, base32);
+    if (nodeBytes.isErr())
+        return nodeBytes;
+    buffer.set(nodeBytes.value, STATE_TOKEN_LAYOUT.NODE_ID);
+    const wfRefBytes = workflowHashRefToBytes(payload.workflowHashRef, base32);
+    if (wfRefBytes.isErr())
+        return wfRefBytes;
+    buffer.set(wfRefBytes.value, STATE_TOKEN_LAYOUT.WORKFLOW_HASH_REF);
+    return (0, neverthrow_1.ok)(buffer);
+}
+function packAckTokenPayload(payload, base32) {
+    if (payload.tokenVersion !== 1) {
+        return (0, neverthrow_1.err)({ code: 'BINARY_INVALID_VERSION', version: payload.tokenVersion });
+    }
+    if (payload.tokenKind !== 'ack') {
+        return (0, neverthrow_1.err)({ code: 'BINARY_INVALID_TOKEN_KIND', kind: payload.tokenKind });
+    }
+    const buffer = new Uint8Array(ACK_TOKEN_LAYOUT.TOTAL_SIZE);
+    buffer[ACK_TOKEN_LAYOUT.VERSION] = payload.tokenVersion;
+    buffer[ACK_TOKEN_LAYOUT.KIND] = TOKEN_KIND_BYTES[payload.tokenKind];
+    const sessionBytes = sessionIdToBytes(payload.sessionId, base32);
+    if (sessionBytes.isErr())
+        return sessionBytes;
+    buffer.set(sessionBytes.value, ACK_TOKEN_LAYOUT.SESSION_ID);
+    const runBytes = runIdToBytes(payload.runId, base32);
+    if (runBytes.isErr())
+        return runBytes;
+    buffer.set(runBytes.value, ACK_TOKEN_LAYOUT.RUN_ID);
+    const nodeBytes = nodeIdToBytes(payload.nodeId, base32);
+    if (nodeBytes.isErr())
+        return nodeBytes;
+    buffer.set(nodeBytes.value, ACK_TOKEN_LAYOUT.NODE_ID);
+    const attemptBytes = attemptIdToBytes(payload.attemptId, base32);
+    if (attemptBytes.isErr())
+        return attemptBytes;
+    buffer.set(attemptBytes.value, ACK_TOKEN_LAYOUT.ATTEMPT_ID);
+    return (0, neverthrow_1.ok)(buffer);
+}
+function packCheckpointTokenPayload(payload, base32) {
+    if (payload.tokenVersion !== 1) {
+        return (0, neverthrow_1.err)({ code: 'BINARY_INVALID_VERSION', version: payload.tokenVersion });
+    }
+    if (payload.tokenKind !== 'checkpoint') {
+        return (0, neverthrow_1.err)({ code: 'BINARY_INVALID_TOKEN_KIND', kind: payload.tokenKind });
+    }
+    const buffer = new Uint8Array(CHECKPOINT_TOKEN_LAYOUT.TOTAL_SIZE);
+    buffer[CHECKPOINT_TOKEN_LAYOUT.VERSION] = payload.tokenVersion;
+    buffer[CHECKPOINT_TOKEN_LAYOUT.KIND] = TOKEN_KIND_BYTES[payload.tokenKind];
+    const sessionBytes = sessionIdToBytes(payload.sessionId, base32);
+    if (sessionBytes.isErr())
+        return sessionBytes;
+    buffer.set(sessionBytes.value, CHECKPOINT_TOKEN_LAYOUT.SESSION_ID);
+    const runBytes = runIdToBytes(payload.runId, base32);
+    if (runBytes.isErr())
+        return runBytes;
+    buffer.set(runBytes.value, CHECKPOINT_TOKEN_LAYOUT.RUN_ID);
+    const nodeBytes = nodeIdToBytes(payload.nodeId, base32);
+    if (nodeBytes.isErr())
+        return nodeBytes;
+    buffer.set(nodeBytes.value, CHECKPOINT_TOKEN_LAYOUT.NODE_ID);
+    const attemptBytes = attemptIdToBytes(payload.attemptId, base32);
+    if (attemptBytes.isErr())
+        return attemptBytes;
+    buffer.set(attemptBytes.value, CHECKPOINT_TOKEN_LAYOUT.ATTEMPT_ID);
+    return (0, neverthrow_1.ok)(buffer);
+}
+function unpackTokenPayload(bytes, base32) {
+    if (bytes.length !== 66) {
+        return (0, neverthrow_1.err)({ code: 'BINARY_INVALID_LENGTH', expected: 66, actual: bytes.length });
+    }
+    const tokenVersion = bytes[0];
+    const tokenKind = bytes[1];
+    if (tokenVersion !== 1) {
+        return (0, neverthrow_1.err)({ code: 'BINARY_UNSUPPORTED_VERSION', version: tokenVersion });
+    }
+    let offset = 2;
+    const sessionIdRes = bytesToSessionId(bytes.slice(offset, offset + 16), base32);
+    if (sessionIdRes.isErr())
+        return (0, neverthrow_1.err)(sessionIdRes.error);
+    const sessionId = sessionIdRes.value;
+    offset += 16;
+    const runIdRes = bytesToRunId(bytes.slice(offset, offset + 16), base32);
+    if (runIdRes.isErr())
+        return (0, neverthrow_1.err)(runIdRes.error);
+    const runId = runIdRes.value;
+    offset += 16;
+    const nodeIdRes = bytesToNodeId(bytes.slice(offset, offset + 16), base32);
+    if (nodeIdRes.isErr())
+        return (0, neverthrow_1.err)(nodeIdRes.error);
+    const nodeId = nodeIdRes.value;
+    offset += 16;
+    const field4 = bytes.slice(offset, offset + 16);
+    switch (tokenKind) {
+        case exports.TOKEN_KIND_STATE: {
+            const wfRefRes = bytesToWorkflowHashRef(field4, base32);
+            if (wfRefRes.isErr())
+                return (0, neverthrow_1.err)(wfRefRes.error);
+            return (0, neverthrow_1.ok)({
+                tokenVersion: 1,
+                tokenKind: 'state',
+                sessionId,
+                runId,
+                nodeId,
+                workflowHashRef: wfRefRes.value,
+            });
+        }
+        case exports.TOKEN_KIND_ACK: {
+            const attemptIdRes = bytesToAttemptId(field4, base32);
+            if (attemptIdRes.isErr())
+                return (0, neverthrow_1.err)(attemptIdRes.error);
+            return (0, neverthrow_1.ok)({
+                tokenVersion: 1,
+                tokenKind: 'ack',
+                sessionId,
+                runId,
+                nodeId,
+                attemptId: attemptIdRes.value,
+            });
+        }
+        case exports.TOKEN_KIND_CHECKPOINT: {
+            const attemptIdRes = bytesToAttemptId(field4, base32);
+            if (attemptIdRes.isErr())
+                return (0, neverthrow_1.err)(attemptIdRes.error);
+            return (0, neverthrow_1.ok)({
+                tokenVersion: 1,
+                tokenKind: 'checkpoint',
+                sessionId,
+                runId,
+                nodeId,
+                attemptId: attemptIdRes.value,
+            });
+        }
+        default:
+            return (0, neverthrow_1.err)({ code: 'BINARY_UNKNOWN_TOKEN_KIND', kind: tokenKind });
+    }
+}
+function idStringToBytesOrFail(id, expectedPrefix, base32) {
+    const parts = id.split('_');
+    if (parts.length !== 2) {
+        return (0, neverthrow_1.err)({
+            code: 'BINARY_INVALID_ID_FORMAT',
+            id,
+            reason: 'Expected format: <prefix>_<base32>',
+        });
+    }
+    const [prefix, suffix] = parts;
+    if (prefix !== expectedPrefix) {
+        return (0, neverthrow_1.err)({
+            code: 'BINARY_INVALID_ID_FORMAT',
+            id,
+            reason: `Expected prefix '${expectedPrefix}_', got '${prefix}_'`,
+        });
+    }
+    if (!/^[a-z2-7]{26}$/.test(suffix)) {
+        return (0, neverthrow_1.err)({
+            code: 'BINARY_INVALID_ID_FORMAT',
+            id,
+            reason: 'ID suffix must be 26 base32 chars [a-z2-7]',
+        });
+    }
+    const decoded = base32.decode(suffix);
+    if (decoded.isErr()) {
+        return (0, neverthrow_1.err)({
+            code: 'BINARY_INVALID_ID_FORMAT',
+            id,
+            reason: `Base32 decode failed: ${decoded.error.code}`,
+        });
+    }
+    if (decoded.value.length !== 16) {
+        return (0, neverthrow_1.err)({
+            code: 'BINARY_INVALID_ID_FORMAT',
+            id,
+            reason: `Decoded to ${decoded.value.length} bytes, expected 16`,
+        });
+    }
+    return (0, neverthrow_1.ok)(decoded.value);
+}
+function idBytesToString(bytes, prefix, base32) {
+    if (bytes.length !== 16) {
+        return (0, neverthrow_1.err)({
+            code: 'BINARY_INVALID_ID_BYTES',
+            field: prefix,
+        });
+    }
+    const suffix = base32.encode(bytes);
+    return (0, neverthrow_1.ok)(`${prefix}_${suffix}`);
+}
+function sessionIdToBytes(id, base32) {
+    return idStringToBytesOrFail(String(id), 'sess', base32);
+}
+function bytesToSessionId(bytes, base32) {
+    return idBytesToString(bytes, 'sess', base32).map(id => (0, index_js_1.asSessionId)(id));
+}
+function runIdToBytes(id, base32) {
+    return idStringToBytesOrFail(String(id), 'run', base32);
+}
+function bytesToRunId(bytes, base32) {
+    return idBytesToString(bytes, 'run', base32).map(id => (0, index_js_1.asRunId)(id));
+}
+function nodeIdToBytes(id, base32) {
+    return idStringToBytesOrFail(String(id), 'node', base32);
+}
+function bytesToNodeId(bytes, base32) {
+    return idBytesToString(bytes, 'node', base32).map(id => (0, index_js_1.asNodeId)(id));
+}
+function attemptIdToBytes(id, base32) {
+    return idStringToBytesOrFail(String(id), 'attempt', base32);
+}
+function bytesToAttemptId(bytes, base32) {
+    return idBytesToString(bytes, 'attempt', base32).map(id => (0, index_js_1.asAttemptId)(id));
+}
+function workflowHashRefToBytes(hashRef, base32) {
+    return idStringToBytesOrFail(String(hashRef), 'wf', base32);
+}
+function bytesToWorkflowHashRef(bytes, base32) {
+    return idBytesToString(bytes, 'wf', base32).map(id => (0, index_js_1.asWorkflowHashRef)(id));
+}

package/dist/v2/durable-core/tokens/index.d.ts

@@ -1,8 +1,13 @@
 export { TokenPayloadV1Schema, StateTokenPayloadV1Schema, AckTokenPayloadV1Schema, CheckpointTokenPayloadV1Schema, expectedPrefixForTokenKind, } from './payloads.js';
 export type { TokenPayloadV1, StateTokenPayloadV1, AckTokenPayloadV1, CheckpointTokenPayloadV1 } from './payloads.js';
-export { encodeTokenPayloadV1, encodeUnsignedTokenV1, parseTokenV1 } from './token-codec.js';
-export type { TokenDecodeErrorV2, ParsedTokenV1 } from './token-codec.js';
-export { signTokenV1, verifyTokenSignatureV1, assertTokenScopeMatchesState } from './token-signer.js';
-export type { TokenVerifyErrorV2 } from './token-signer.js';
+export { encodeTokenPayloadV1Binary, parseTokenV1Binary } from './token-codec.js';
+export type { TokenDecodeErrorV2, ParsedTokenV1Binary } from './token-codec.js';
+export { packStateTokenPayload, packAckTokenPayload, packCheckpointTokenPayload, unpackTokenPayload, TOKEN_KIND_STATE, TOKEN_KIND_ACK, TOKEN_KIND_CHECKPOINT, } from './binary-payload.js';
+export type { BinaryPackError, BinaryUnpackError } from './binary-payload.js';
+export { signTokenV1Binary, verifyTokenSignatureV1Binary, assertTokenScopeMatchesStateBinary, } from './token-signer.js';
+export type { TokenSignErrorV2, TokenVerifyErrorV2 } from './token-signer.js';
+export { createTokenCodecPorts, unsafeTokenCodecPorts } from './token-codec-ports.js';
+export type { TokenCodecPorts, TokenCodecPortsError } from './token-codec-ports.js';
+export type { TokenParsePorts, TokenVerifyPorts, TokenSignPorts } from './token-codec-capabilities.js';
 export type { AttemptId, OutputId } from '../ids/index.js';
 export { asAttemptId, asOutputId } from '../ids/index.js';

package/dist/v2/durable-core/tokens/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.asOutputId = exports.asAttemptId = exports.assertTokenScopeMatchesState = exports.verifyTokenSignatureV1 = exports.signTokenV1 = exports.parseTokenV1 = exports.encodeUnsignedTokenV1 = exports.encodeTokenPayloadV1 = exports.expectedPrefixForTokenKind = exports.CheckpointTokenPayloadV1Schema = exports.AckTokenPayloadV1Schema = exports.StateTokenPayloadV1Schema = exports.TokenPayloadV1Schema = void 0;
+exports.asOutputId = exports.asAttemptId = exports.unsafeTokenCodecPorts = exports.createTokenCodecPorts = exports.assertTokenScopeMatchesStateBinary = exports.verifyTokenSignatureV1Binary = exports.signTokenV1Binary = exports.TOKEN_KIND_CHECKPOINT = exports.TOKEN_KIND_ACK = exports.TOKEN_KIND_STATE = exports.unpackTokenPayload = exports.packCheckpointTokenPayload = exports.packAckTokenPayload = exports.packStateTokenPayload = exports.parseTokenV1Binary = exports.encodeTokenPayloadV1Binary = exports.expectedPrefixForTokenKind = exports.CheckpointTokenPayloadV1Schema = exports.AckTokenPayloadV1Schema = exports.StateTokenPayloadV1Schema = exports.TokenPayloadV1Schema = void 0;
 var payloads_js_1 = require("./payloads.js");
 Object.defineProperty(exports, "TokenPayloadV1Schema", { enumerable: true, get: function () { return payloads_js_1.TokenPayloadV1Schema; } });
 Object.defineProperty(exports, "StateTokenPayloadV1Schema", { enumerable: true, get: function () { return payloads_js_1.StateTokenPayloadV1Schema; } });
@@ -8,13 +8,23 @@ Object.defineProperty(exports, "AckTokenPayloadV1Schema", { enumerable: true, ge
 Object.defineProperty(exports, "CheckpointTokenPayloadV1Schema", { enumerable: true, get: function () { return payloads_js_1.CheckpointTokenPayloadV1Schema; } });
 Object.defineProperty(exports, "expectedPrefixForTokenKind", { enumerable: true, get: function () { return payloads_js_1.expectedPrefixForTokenKind; } });
 var token_codec_js_1 = require("./token-codec.js");
-Object.defineProperty(exports, "encodeTokenPayloadV1", { enumerable: true, get: function () { return token_codec_js_1.encodeTokenPayloadV1; } });
-Object.defineProperty(exports, "encodeUnsignedTokenV1", { enumerable: true, get: function () { return token_codec_js_1.encodeUnsignedTokenV1; } });
-Object.defineProperty(exports, "parseTokenV1", { enumerable: true, get: function () { return token_codec_js_1.parseTokenV1; } });
+Object.defineProperty(exports, "encodeTokenPayloadV1Binary", { enumerable: true, get: function () { return token_codec_js_1.encodeTokenPayloadV1Binary; } });
+Object.defineProperty(exports, "parseTokenV1Binary", { enumerable: true, get: function () { return token_codec_js_1.parseTokenV1Binary; } });
+var binary_payload_js_1 = require("./binary-payload.js");
+Object.defineProperty(exports, "packStateTokenPayload", { enumerable: true, get: function () { return binary_payload_js_1.packStateTokenPayload; } });
+Object.defineProperty(exports, "packAckTokenPayload", { enumerable: true, get: function () { return binary_payload_js_1.packAckTokenPayload; } });
+Object.defineProperty(exports, "packCheckpointTokenPayload", { enumerable: true, get: function () { return binary_payload_js_1.packCheckpointTokenPayload; } });
+Object.defineProperty(exports, "unpackTokenPayload", { enumerable: true, get: function () { return binary_payload_js_1.unpackTokenPayload; } });
+Object.defineProperty(exports, "TOKEN_KIND_STATE", { enumerable: true, get: function () { return binary_payload_js_1.TOKEN_KIND_STATE; } });
+Object.defineProperty(exports, "TOKEN_KIND_ACK", { enumerable: true, get: function () { return binary_payload_js_1.TOKEN_KIND_ACK; } });
+Object.defineProperty(exports, "TOKEN_KIND_CHECKPOINT", { enumerable: true, get: function () { return binary_payload_js_1.TOKEN_KIND_CHECKPOINT; } });
 var token_signer_js_1 = require("./token-signer.js");
-Object.defineProperty(exports, "signTokenV1", { enumerable: true, get: function () { return token_signer_js_1.signTokenV1; } });
-Object.defineProperty(exports, "verifyTokenSignatureV1", { enumerable: true, get: function () { return token_signer_js_1.verifyTokenSignatureV1; } });
-Object.defineProperty(exports, "assertTokenScopeMatchesState", { enumerable: true, get: function () { return token_signer_js_1.assertTokenScopeMatchesState; } });
+Object.defineProperty(exports, "signTokenV1Binary", { enumerable: true, get: function () { return token_signer_js_1.signTokenV1Binary; } });
+Object.defineProperty(exports, "verifyTokenSignatureV1Binary", { enumerable: true, get: function () { return token_signer_js_1.verifyTokenSignatureV1Binary; } });
+Object.defineProperty(exports, "assertTokenScopeMatchesStateBinary", { enumerable: true, get: function () { return token_signer_js_1.assertTokenScopeMatchesStateBinary; } });
+var token_codec_ports_js_1 = require("./token-codec-ports.js");
+Object.defineProperty(exports, "createTokenCodecPorts", { enumerable: true, get: function () { return token_codec_ports_js_1.createTokenCodecPorts; } });
+Object.defineProperty(exports, "unsafeTokenCodecPorts", { enumerable: true, get: function () { return token_codec_ports_js_1.unsafeTokenCodecPorts; } });
 var index_js_1 = require("../ids/index.js");
 Object.defineProperty(exports, "asAttemptId", { enumerable: true, get: function () { return index_js_1.asAttemptId; } });
 Object.defineProperty(exports, "asOutputId", { enumerable: true, get: function () { return index_js_1.asOutputId; } });

package/dist/v2/durable-core/tokens/payloads.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import type { AttemptId, NodeId, RunId, SessionId, TokenStringV1, WorkflowHash } from '../ids/index.js';
+import type { AttemptId, NodeId, RunId, SessionId, TokenStringV1, WorkflowHashRef } from '../ids/index.js';
 export type TokenVersionV1 = 1;
 export type TokenKindV1 = 'state' | 'ack' | 'checkpoint';
 export declare const AttemptIdSchema: z.ZodEffects<z.ZodString, AttemptId, string>;
@@ -12,7 +12,7 @@ export declare const StateTokenPayloadV1Schema: z.ZodObject<{
     sessionId: z.ZodEffects<z.ZodString, SessionId, string>;
     runId: z.ZodEffects<z.ZodString, RunId, string>;
     nodeId: z.ZodEffects<z.ZodString, NodeId, string>;
-    workflowHash: z.ZodEffects<z.ZodString, never, string>;
+    workflowHashRef: z.ZodEffects<z.ZodString, WorkflowHashRef, string>;
 }, "strip", z.ZodTypeAny, {
     sessionId: string & {
         readonly __brand: "v2.SessionId";
@@ -23,16 +23,18 @@ export declare const StateTokenPayloadV1Schema: z.ZodObject<{
     nodeId: string & {
         readonly __brand: "v2.NodeId";
     };
-    workflowHash: never;
     tokenVersion: 1;
     tokenKind: "state";
+    workflowHashRef: string & {
+        readonly __brand: "v2.WorkflowHashRef";
+    };
 }, {
     sessionId: string;
     runId: string;
     nodeId: string;
-    workflowHash: string;
     tokenVersion: 1;
     tokenKind: "state";
+    workflowHashRef: string;
 }>;
 export type StateTokenPayloadV1 = z.infer<typeof StateTokenPayloadV1Schema> & {
     readonly tokenVersion: TokenVersionV1;
@@ -40,7 +42,7 @@ export type StateTokenPayloadV1 = z.infer<typeof StateTokenPayloadV1Schema> & {
     readonly sessionId: SessionId;
     readonly runId: RunId;
     readonly nodeId: NodeId;
-    readonly workflowHash: WorkflowHash;
+    readonly workflowHashRef: WorkflowHashRef;
 };
 export declare const AckTokenPayloadV1Schema: z.ZodObject<{
     tokenVersion: z.ZodLiteral<1>;
@@ -124,7 +126,7 @@ export declare const TokenPayloadV1Schema: z.ZodDiscriminatedUnion<"tokenKind",
     sessionId: z.ZodEffects<z.ZodString, SessionId, string>;
     runId: z.ZodEffects<z.ZodString, RunId, string>;
     nodeId: z.ZodEffects<z.ZodString, NodeId, string>;
-    workflowHash: z.ZodEffects<z.ZodString, never, string>;
+    workflowHashRef: z.ZodEffects<z.ZodString, WorkflowHashRef, string>;
 }, "strip", z.ZodTypeAny, {
     sessionId: string & {
         readonly __brand: "v2.SessionId";
@@ -135,16 +137,18 @@ export declare const TokenPayloadV1Schema: z.ZodDiscriminatedUnion<"tokenKind",
     nodeId: string & {
         readonly __brand: "v2.NodeId";
     };
-    workflowHash: never;
     tokenVersion: 1;
     tokenKind: "state";
+    workflowHashRef: string & {
+        readonly __brand: "v2.WorkflowHashRef";
+    };
 }, {
     sessionId: string;
     runId: string;
     nodeId: string;
-    workflowHash: string;
     tokenVersion: 1;
     tokenKind: "state";
+    workflowHashRef: string;
 }>, z.ZodObject<{
     tokenVersion: z.ZodLiteral<1>;
     tokenKind: z.ZodLiteral<"ack">;

package/dist/v2/durable-core/tokens/payloads.js

@@ -5,8 +5,10 @@ exports.expectedPrefixForTokenKind = expectedPrefixForTokenKind;
 exports.asTokenString = asTokenString;
 const zod_1 = require("zod");
 const index_js_1 = require("../ids/index.js");
-const sha256DigestSchema = zod_1.z.string().regex(/^sha256:[0-9a-f]{64}$/, 'Expected sha256:<64 hex chars>');
-const workflowHashSchema = sha256DigestSchema.transform((v) => (0, index_js_1.asWorkflowHash)((0, index_js_1.asSha256Digest)(v)));
+const workflowHashRefSchema = zod_1.z
+    .string()
+    .regex(/^wf_[a-z2-7]{26}$/, 'Expected wf_<26 base32 chars [a-z2-7]>')
+    .transform((v) => (0, index_js_1.asWorkflowHashRef)(v));
 const nonEmpty = zod_1.z.string().min(1);
 const delimiterSafeId = nonEmpty.regex(/^[^:\s]+$/, 'Expected a delimiter-safe ID (no ":" or whitespace)');
 exports.AttemptIdSchema = delimiterSafeId.transform(index_js_1.asAttemptId);
@@ -19,7 +21,7 @@ exports.StateTokenPayloadV1Schema = zod_1.z.object({
     sessionId: exports.SessionIdSchema,
     runId: exports.RunIdSchema,
     nodeId: exports.NodeIdSchema,
-    workflowHash: workflowHashSchema,
+    workflowHashRef: workflowHashRefSchema,
 });
 exports.AckTokenPayloadV1Schema = zod_1.z.object({
     tokenVersion: zod_1.z.literal(1),

package/dist/v2/durable-core/tokens/token-codec-capabilities.d.ts

@@ -0,0 +1,4 @@
+import type { TokenCodecPorts } from './token-codec-ports.js';
+export type TokenParsePorts = Pick<TokenCodecPorts, 'bech32m' | 'base32'>;
+export type TokenVerifyPorts = Pick<TokenCodecPorts, 'keyring' | 'hmac' | 'base64url'>;
+export type TokenSignPorts = TokenCodecPorts;

package/dist/v2/durable-core/tokens/token-codec-capabilities.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/v2/durable-core/tokens/token-codec-ports.d.ts

@@ -0,0 +1,42 @@
+import type { Result } from 'neverthrow';
+import type { KeyringV1 } from '../../ports/keyring.port.js';
+import type { HmacSha256PortV2 } from '../../ports/hmac-sha256.port.js';
+import type { Base64UrlPortV2 } from '../../ports/base64url.port.js';
+import type { Base32PortV2 } from '../../ports/base32.port.js';
+import type { Bech32mPortV2 } from '../../ports/bech32m.port.js';
+declare const tokenCodecPortsBrand: unique symbol;
+export type TokenCodecPorts = Readonly<{
+    readonly keyring: KeyringV1;
+    readonly hmac: HmacSha256PortV2;
+    readonly base64url: Base64UrlPortV2;
+    readonly base32: Base32PortV2;
+    readonly bech32m: Bech32mPortV2;
+}> & {
+    readonly [tokenCodecPortsBrand]: 'TokenCodecPorts';
+};
+export type TokenCodecPortsError = {
+    readonly code: 'TOKEN_CODEC_PORTS_MISSING_KEYRING';
+} | {
+    readonly code: 'TOKEN_CODEC_PORTS_MISSING_HMAC';
+} | {
+    readonly code: 'TOKEN_CODEC_PORTS_MISSING_BASE64URL';
+} | {
+    readonly code: 'TOKEN_CODEC_PORTS_MISSING_BASE32';
+} | {
+    readonly code: 'TOKEN_CODEC_PORTS_MISSING_BECH32M';
+};
+export declare function createTokenCodecPorts(deps: {
+    readonly keyring?: KeyringV1 | null;
+    readonly hmac?: HmacSha256PortV2 | null;
+    readonly base64url?: Base64UrlPortV2 | null;
+    readonly base32?: Base32PortV2 | null;
+    readonly bech32m?: Bech32mPortV2 | null;
+}): Result<TokenCodecPorts, TokenCodecPortsError>;
+export declare function unsafeTokenCodecPorts(deps: {
+    readonly keyring: KeyringV1;
+    readonly hmac: HmacSha256PortV2;
+    readonly base64url: Base64UrlPortV2;
+    readonly base32: Base32PortV2;
+    readonly bech32m: Bech32mPortV2;
+}): TokenCodecPorts;
+export {};

package/dist/v2/durable-core/tokens/token-codec-ports.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createTokenCodecPorts = createTokenCodecPorts;
+exports.unsafeTokenCodecPorts = unsafeTokenCodecPorts;
+const neverthrow_1 = require("neverthrow");
+function createTokenCodecPorts(deps) {
+    if (!deps.keyring)
+        return (0, neverthrow_1.err)({ code: 'TOKEN_CODEC_PORTS_MISSING_KEYRING' });
+    if (!deps.hmac)
+        return (0, neverthrow_1.err)({ code: 'TOKEN_CODEC_PORTS_MISSING_HMAC' });
+    if (!deps.base64url)
+        return (0, neverthrow_1.err)({ code: 'TOKEN_CODEC_PORTS_MISSING_BASE64URL' });
+    if (!deps.base32)
+        return (0, neverthrow_1.err)({ code: 'TOKEN_CODEC_PORTS_MISSING_BASE32' });
+    if (!deps.bech32m)
+        return (0, neverthrow_1.err)({ code: 'TOKEN_CODEC_PORTS_MISSING_BECH32M' });
+    return (0, neverthrow_1.ok)(Object.freeze({
+        keyring: deps.keyring,
+        hmac: deps.hmac,
+        base64url: deps.base64url,
+        base32: deps.base32,
+        bech32m: deps.bech32m,
+    }));
+}
+function unsafeTokenCodecPorts(deps) {
+    return Object.freeze({ ...deps });
+}

package/dist/v2/durable-core/tokens/token-codec.d.ts

@@ -2,10 +2,16 @@ import type { Result } from 'neverthrow';
 import type { CanonicalBytes } from '../ids/index.js';
 import type { TokenStringV1 } from '../ids/index.js';
 import type { Base64UrlPortV2 } from '../../ports/base64url.port.js';
+import type { Bech32mDecodeError, TokenHrp } from '../../ports/bech32m.port.js';
+import type { Base32PortV2 } from '../../ports/base32.port.js';
 import { type TokenPayloadV1, type TokenPrefixV1 } from './payloads.js';
+import type { TokenParsePorts } from './token-codec-capabilities.js';
 export type TokenDecodeErrorV2 = {
     readonly code: 'TOKEN_INVALID_FORMAT';
     readonly message: string;
+    readonly details?: {
+        bech32mError?: Bech32mDecodeError;
+    };
 } | {
     readonly code: 'TOKEN_UNSUPPORTED_VERSION';
     readonly message: string;
@@ -30,3 +36,15 @@ export declare function encodeUnsignedTokenV1(payload: TokenPayloadV1, base64url
     readonly payloadBytes: CanonicalBytes;
 }, TokenDecodeErrorV2>;
 export declare function parseTokenV1(token: string, base64url: Base64UrlPortV2): Result<ParsedTokenV1, TokenDecodeErrorV2>;
+export interface ParsedTokenV1Binary {
+    readonly hrp: TokenHrp;
+    readonly version: '1';
+    readonly payloadBytes: Uint8Array;
+    readonly signatureBytes: Uint8Array;
+    readonly payload: TokenPayloadV1;
+}
+export declare function encodeTokenPayloadV1Binary(payload: TokenPayloadV1, base32: Base32PortV2): Result<{
+    payloadBytes: Uint8Array;
+    hrp: TokenHrp;
+}, TokenDecodeErrorV2>;
+export declare function parseTokenV1Binary(tokenString: string, ports: TokenParsePorts): Result<ParsedTokenV1Binary, TokenDecodeErrorV2>;