@mesh-tech/mesh-cli 0.1.0

package/templates/temporal-api-worker/worker/src/encryption-codec.ts

@@ -0,0 +1,156 @@
+/**
+ * Temporal Payload Encryption Codec
+ *
+ * Encrypts workflow payloads using AES-256-GCM following Temporal's
+ * recommended pattern: serialize the entire payload with Protobuf,
+ * then encrypt.
+ *
+ * Reference: https://github.com/temporalio/samples-typescript/blob/main/encryption/src/encryption-codec.ts
+ */
+
+import { webcrypto as crypto } from "node:crypto";
+import {
+  METADATA_ENCODING_KEY,
+  Payload,
+  PayloadCodec,
+  ValueError,
+} from "@temporalio/common";
+import proto from "@temporalio/proto";
+
+const { temporal } = proto;
+
+const ENCODING = "binary/encrypted";
+const METADATA_ENCRYPTION_KEY_ID = "encryption-key-id";
+const IV_LENGTH = 12;
+
+/**
+ * Derive a CryptoKey from an encoding key string using SHA-256
+ */
+async function deriveKey(encodingKey: string): Promise<crypto.CryptoKey> {
+  const keyData = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(encodingKey)
+  );
+  return crypto.subtle.importKey("raw", keyData, { name: "AES-GCM" }, false, [
+    "encrypt",
+    "decrypt",
+  ]);
+}
+
+/**
+ * Encrypt data using AES-256-GCM
+ * Output: IV (12 bytes) + Ciphertext+AuthTag (WebCrypto format)
+ */
+async function encrypt(
+  data: Uint8Array,
+  key: crypto.CryptoKey
+): Promise<Uint8Array> {
+  const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH));
+  const encrypted = await crypto.subtle.encrypt(
+    { name: "AES-GCM", iv },
+    key,
+    data
+  );
+  // Prepend IV to ciphertext+authTag
+  const result = new Uint8Array(IV_LENGTH + encrypted.byteLength);
+  result.set(iv, 0);
+  result.set(new Uint8Array(encrypted), IV_LENGTH);
+  return result;
+}
+
+/**
+ * Decrypt data using AES-256-GCM
+ * Input: IV (12 bytes) + Ciphertext+AuthTag
+ */
+async function decrypt(
+  data: Uint8Array,
+  key: crypto.CryptoKey
+): Promise<Uint8Array> {
+  const iv = data.slice(0, IV_LENGTH);
+  const ciphertextWithTag = data.slice(IV_LENGTH);
+  const decrypted = await crypto.subtle.decrypt(
+    { name: "AES-GCM", iv },
+    key,
+    ciphertextWithTag
+  );
+  return new Uint8Array(decrypted);
+}
+
+/**
+ * Payload codec that encrypts/decrypts payloads using AES-256-GCM.
+ *
+ * Uses Protobuf serialization for the entire payload (data + metadata)
+ * following Temporal's recommended pattern.
+ */
+export class EncryptionCodec implements PayloadCodec {
+  private constructor(
+    private readonly key: crypto.CryptoKey,
+    private readonly keyId: string
+  ) {}
+
+  static async create(encodingKey: string): Promise<EncryptionCodec> {
+    const key = await deriveKey(encodingKey);
+    // Use truncated hash as key ID for identification
+    const keyIdData = await crypto.subtle.digest(
+      "SHA-256",
+      new TextEncoder().encode(encodingKey)
+    );
+    const keyId = Buffer.from(keyIdData).toString("hex").slice(0, 16);
+    return new EncryptionCodec(key, keyId);
+  }
+
+  async encode(payloads: Payload[]): Promise<Payload[]> {
+    return Promise.all(
+      payloads.map(async (payload) => ({
+        metadata: {
+          [METADATA_ENCODING_KEY]: new TextEncoder().encode(ENCODING),
+          [METADATA_ENCRYPTION_KEY_ID]: new TextEncoder().encode(this.keyId),
+        },
+        // Serialize entire payload with Protobuf, then encrypt
+        data: await encrypt(
+          temporal.api.common.v1.Payload.encode(payload).finish(),
+          this.key
+        ),
+      }))
+    );
+  }
+
+  async decode(payloads: Payload[]): Promise<Payload[]> {
+    return Promise.all(
+      payloads.map(async (payload) => {
+        // Check if encrypted
+        const encoding = payload.metadata?.[METADATA_ENCODING_KEY];
+        if (!encoding) {
+          return payload;
+        }
+
+        const encodingStr = new TextDecoder().decode(encoding);
+        if (encodingStr !== ENCODING) {
+          return payload;
+        }
+
+        if (!payload.data) {
+          throw new ValueError("Payload data is missing");
+        }
+
+        // Decrypt and deserialize with Protobuf
+        const decryptedBytes = await decrypt(payload.data, this.key);
+        return temporal.api.common.v1.Payload.decode(decryptedBytes);
+      })
+    );
+  }
+}
+
+/**
+ * Creates an encryption codec from TEMPORAL_ENCODING_KEY env var.
+ * Returns undefined if not set.
+ */
+export async function createEncryptionCodec(): Promise<EncryptionCodec | undefined> {
+  const encodingKey = process.env.TEMPORAL_ENCODING_KEY;
+  if (!encodingKey) {
+    console.log("[Encryption] No TEMPORAL_ENCODING_KEY set, payloads will not be encrypted");
+    return undefined;
+  }
+  console.log("[Encryption] Payload encryption enabled");
+  return EncryptionCodec.create(encodingKey);
+}

package/templates/temporal-api-worker/worker/src/worker.ts.hbs

@@ -0,0 +1,93 @@
+/**
+ * {{titleCase name}} Temporal Worker
+ *
+ * Environment variables:
+ * - TEMPORAL_ADDRESS: Temporal server address (default: localhost:7233)
+ * - TEMPORAL_NAMESPACE: Temporal namespace (required)
+ * - TEMPORAL_TASK_QUEUE: Task queue name (required)
+ * - TEMPORAL_ENCODING_KEY: Encoding key for payload encryption (optional)
+ */
+
+import * as fs from "fs";
+import * as path from "path";
+import { fileURLToPath } from "url";
+import { NativeConnection, Worker, WorkerOptions, bundleWorkflowCode } from "@temporalio/worker";
+import * as activities from "./activities.js";
+import { createEncryptionCodec } from "./encryption-codec.js";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+const TEMPORAL_ADDRESS = process.env.TEMPORAL_ADDRESS ?? "localhost:7233";
+
+function requireEnv(name: string): string {
+  const value = process.env[name];
+  if (!value) {
+    throw new Error(`${name} environment variable is required`);
+  }
+  return value;
+}
+
+const TEMPORAL_NAMESPACE = requireEnv("TEMPORAL_NAMESPACE");
+const TEMPORAL_TASK_QUEUE = requireEnv("TEMPORAL_TASK_QUEUE");
+
+/**
+ * Load workflows - uses pre-bundled code in production, source files in dev
+ */
+async function getWorkflowOptions(): Promise<
+  Pick<WorkerOptions, "workflowBundle" | "workflowsPath">
+> {
+  const bundlePath = path.join(__dirname, "workflows-bundle.js");
+
+  if (fs.existsSync(bundlePath)) {
+    console.log("[Worker] Loading pre-bundled workflows...");
+    return {
+      workflowBundle: { code: fs.readFileSync(bundlePath, "utf-8") },
+    };
+  }
+
+  console.log("[Worker] Bundling workflows from source...");
+  return {
+    workflowBundle: await bundleWorkflowCode({
+      workflowsPath: new URL("./workflows.js", import.meta.url).pathname,
+    }),
+  };
+}
+
+async function run() {
+  console.log(`[Worker] Connecting to Temporal at ${TEMPORAL_ADDRESS}...`);
+
+  const connection = await NativeConnection.connect({
+    address: TEMPORAL_ADDRESS,
+  });
+
+  console.log(`[Worker] Connected. Namespace: ${TEMPORAL_NAMESPACE}`);
+
+  const workflowOptions = await getWorkflowOptions();
+
+  // Set up payload encryption if encoding key is available
+  const encryptionCodec = await createEncryptionCodec();
+  const dataConverter = encryptionCodec
+    ? { payloadCodecs: [encryptionCodec] }
+    : undefined;
+
+  if (encryptionCodec) {
+    console.log("[Worker] Payload encryption enabled");
+  }
+
+  const worker = await Worker.create({
+    connection,
+    namespace: TEMPORAL_NAMESPACE,
+    taskQueue: TEMPORAL_TASK_QUEUE,
+    ...workflowOptions,
+    activities,
+    dataConverter,
+  });
+
+  console.log(`[Worker] Starting on task queue: ${TEMPORAL_TASK_QUEUE}`);
+  await worker.run();
+}
+
+run().catch((err) => {
+  console.error("[Worker] Fatal error:", err);
+  process.exit(1);
+});

package/templates/temporal-api-worker/worker/src/workflows.ts.hbs

@@ -0,0 +1,60 @@
+/**
+ * {{titleCase name}} Workflows
+ *
+ * Define your workflow logic here. Workflows are deterministic functions
+ * that orchestrate activities and other workflows.
+ *
+ * Rules for workflows:
+ * - Must be deterministic (same inputs = same outputs)
+ * - Cannot use Date.now(), Math.random(), or other non-deterministic APIs
+ * - Use sleep() instead of setTimeout()
+ * - Use proxyActivities() to call activities
+ */
+
+import { proxyActivities, sleep } from "@temporalio/workflow";
+import type * as activities from "./activities.js";
+
+// Configure activity retries and timeouts
+const { greet, processTask } = proxyActivities<typeof activities>({
+  startToCloseTimeout: "30 seconds",
+  retry: {
+    maximumAttempts: 3,
+  },
+});
+
+/**
+ * Simple greeting workflow
+ *
+ * @param name - Name to greet
+ * @returns Greeting message
+ */
+export async function greetingWorkflow(name: string): Promise<string> {
+  return await greet(name);
+}
+
+/**
+ * Task processing workflow with notification
+ *
+ * @param taskId - Task identifier
+ * @param userId - User who owns the task
+ * @returns Task status
+ */
+export async function taskWorkflow(
+  taskId: string,
+  userId: string
+): Promise<{ status: string; taskId: string }> {
+  console.log(`[Workflow] Processing task ${taskId} for user ${userId}`);
+
+  // Process the task
+  const result = await processTask(taskId);
+
+  // Wait before completing (demonstrates durable timers)
+  await sleep("2 seconds");
+
+  console.log(`[Workflow] Task ${taskId} completed with status: ${result}`);
+
+  return {
+    status: result,
+    taskId,
+  };
+}

package/templates/temporal-api-worker/worker/tsconfig.json

@@ -0,0 +1,14 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "declaration": true
+  },
+  "include": ["src/**/*"]
+}