@stigmer/runner 3.12.7 → 3.12.9

package/dist/encryption/config.js

@@ -1,113 +0,0 @@
-/**
- * Payload-encryption configuration (stigmer-cloud#227, stigmer#398).
- *
- * Two key sources, strict precedence:
- *
- *   1. Environment (STIGMER_PAYLOAD_ENCRYPTION_KEY(_ID)) — the operator's
- *      explicit choice: self-hosted deployments sharing one key with their
- *      server, and cloud sandboxes injected with the platform key. When the
- *      env key is set, bootstrap-delivered material is ignored entirely.
- *   2. Bootstrap-delivered — server-managed per-identity keys handed to
- *      desktop-class runners by getRunnerBootstrapConfig. Held in memory
- *      only; persistence lives server-side, which is what makes Temporal
- *      replay work across runner restarts (every boot re-fetches the SAME
- *      key).
- *
- * Encryption is enabled iff a key is present from either source — the same
- * enabled-iff-configured pattern as the claim-check codec. A malformed key
- * fails the boot rather than silently running plaintext: an operator who set
- * the key (or a server that minted one) intended history to be encrypted.
- *
- * Key rotation: payloads carry the id of the key that encrypted them.
- * During a rotation window the previous key stays readable via the
- * secondary pair while new payloads are written under the primary key.
- * Workers capture keys at construction, so a rotated bootstrap key lands
- * on the next runner boot — there is no live re-key.
- */
-import { getRunnerSecret } from "../shared/runner-credential-store.js";
-const KEY_ENV = "STIGMER_PAYLOAD_ENCRYPTION_KEY";
-const KEY_ID_ENV = "STIGMER_PAYLOAD_ENCRYPTION_KEY_ID";
-const SECONDARY_KEY_ENV = "STIGMER_PAYLOAD_ENCRYPTION_SECONDARY_KEY";
-const SECONDARY_KEY_ID_ENV = "STIGMER_PAYLOAD_ENCRYPTION_SECONDARY_KEY_ID";
-const AES_256_KEY_BYTES = 32;
-/**
- * Returns the encryption config, or undefined when encryption is not
- * configured (the codec is then simply not installed).
- *
- * Source precedence: the env key wins outright; bootstrap-delivered
- * material applies only when no env key is set (see the module doc).
- *
- * @throws when a key is present but malformed, or a key id is missing —
- *   key misconfiguration must stop the boot, not degrade to plaintext.
- *   This applies equally to bootstrap material: a server that hands out
- *   a bad key or omits its id has broken the protocol contract, and
- *   running plaintext against a server that manages keys would silently
- *   defeat the feature.
- */
-export function loadPayloadEncryptionConfig(bootstrap) {
-    // Key VALUES resolve through the credential store (the #508 boot capture
-    // moves them out of process.env — agent shells must not read them); the
-    // *_KEY_ID companions are rotation bookkeeping, not secrets, and stay
-    // plain env reads.
-    const rawKey = getRunnerSecret(KEY_ENV);
-    if (rawKey) {
-        const primary = {
-            keyId: requireKeyId(KEY_ID_ENV),
-            key: parseKey(rawKey, KEY_ENV),
-        };
-        const rawSecondary = getRunnerSecret(SECONDARY_KEY_ENV);
-        const secondary = rawSecondary
-            ? {
-                keyId: requireKeyId(SECONDARY_KEY_ID_ENV),
-                key: parseKey(rawSecondary, SECONDARY_KEY_ENV),
-            }
-            : undefined;
-        return { primary, secondary };
-    }
-    if (bootstrap?.key) {
-        const primary = {
-            keyId: requireBootstrapKeyId(bootstrap.keyId, "payload_encryption_key_id"),
-            key: parseKey(bootstrap.key, "bootstrap payload_encryption_key"),
-        };
-        const secondary = bootstrap.secondaryKey
-            ? {
-                keyId: requireBootstrapKeyId(bootstrap.secondaryKeyId, "payload_encryption_secondary_key_id"),
-                key: parseKey(bootstrap.secondaryKey, "bootstrap payload_encryption_secondary_key"),
-            }
-            : undefined;
-        return { primary, secondary };
-    }
-    return undefined;
-}
-function requireKeyId(envName) {
-    const keyId = process.env[envName];
-    // An explicit id is required (no default): during rotation two keys
-    // coexist, and payloads must name which one encrypted them.
-    if (!keyId) {
-        throw new Error(`Payload encryption misconfigured: ${envName} is required when the ` +
-            `corresponding key is set`);
-    }
-    return keyId;
-}
-function requireBootstrapKeyId(keyId, fieldName) {
-    if (!keyId) {
-        throw new Error(`Runner bootstrap returned a payload encryption key without its ${fieldName} — ` +
-            `refusing to encrypt under an unidentified key (server contract violation)`);
-    }
-    return keyId;
-}
-function parseKey(rawBase64, envName) {
-    let key;
-    try {
-        key = Buffer.from(rawBase64, "base64");
-    }
-    catch {
-        throw new Error(`Payload encryption misconfigured: ${envName} is not valid base64`);
-    }
-    if (key.length !== AES_256_KEY_BYTES) {
-        throw new Error(`Payload encryption misconfigured: ${envName} must decode to ` +
-            `${AES_256_KEY_BYTES} bytes (AES-256), got ${key.length}`);
-    }
-    return key;
-}
-//# sourceMappingURL=config.js.map

package/dist/encryption/config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/encryption/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AA4BvE,MAAM,OAAO,GAAG,gCAAgC,CAAC;AACjD,MAAM,UAAU,GAAG,mCAAmC,CAAC;AACvD,MAAM,iBAAiB,GAAG,0CAA0C,CAAC;AACrE,MAAM,oBAAoB,GAAG,6CAA6C,CAAC;AAE3E,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,2BAA2B,CACzC,SAAgC;IAEhC,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,mBAAmB;IACnB,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAkB;YAC7B,KAAK,EAAE,YAAY,CAAC,UAAU,CAAC;YAC/B,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;SAC/B,CAAC;QAEF,MAAM,YAAY,GAAG,eAAe,CAAC,iBAAiB,CAAC,CAAC;QACxD,MAAM,SAAS,GAA8B,YAAY;YACvD,CAAC,CAAC;gBACE,KAAK,EAAE,YAAY,CAAC,oBAAoB,CAAC;gBACzC,GAAG,EAAE,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;aAC/C;YACH,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,SAAS,EAAE,GAAG,EAAE,CAAC;QACnB,MAAM,OAAO,GAAkB;YAC7B,KAAK,EAAE,qBAAqB,CAAC,SAAS,CAAC,KAAK,EAAE,2BAA2B,CAAC;YAC1E,GAAG,EAAE,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,kCAAkC,CAAC;SACjE,CAAC;QAEF,MAAM,SAAS,GAA8B,SAAS,CAAC,YAAY;YACjE,CAAC,CAAC;gBACE,KAAK,EAAE,qBAAqB,CAC1B,SAAS,CAAC,cAAc,EACxB,qCAAqC,CACtC;gBACD,GAAG,EAAE,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,4CAA4C,CAAC;aACpF;YACH,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,oEAAoE;IACpE,4DAA4D;IAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,wBAAwB;YAClE,0BAA0B,CAC7B,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAyB,EAAE,SAAiB;IACzE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,kEAAkE,SAAS,KAAK;YAC9E,2EAA2E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,SAAiB,EAAE,OAAe;IAClD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,OAAO,sBAAsB,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,kBAAkB;YAC5D,GAAG,iBAAiB,yBAAyB,GAAG,CAAC,MAAM,EAAE,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/encryption/index.d.ts

@@ -1,3 +0,0 @@
-export { EncryptionPayloadCodec } from "./payload-codec.js";
-export { loadPayloadEncryptionConfig } from "./config.js";
-export type { PayloadEncryptionConfig, EncryptionKey } from "./config.js";

package/dist/encryption/index.js

@@ -1,3 +0,0 @@
-export { EncryptionPayloadCodec } from "./payload-codec.js";
-export { loadPayloadEncryptionConfig } from "./config.js";
-//# sourceMappingURL=index.js.map

package/dist/encryption/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/encryption/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC"}

package/dist/encryption/payload-codec.d.ts

@@ -1,41 +0,0 @@
-/**
- * Temporal PayloadCodec that encrypts payloads at rest in workflow
- * history (stigmer-cloud#227).
- *
- * Why: the workflow engine runs inside the Temporal deterministic
- * sandbox, so decrypted execution-context values cross the history
- * boundary in many places — the hydrate activity result, the runtime
- * env passed as an input to every per-task activity, and expression
- * results recorded as local-activity markers. Encrypting at the payload
- * codec layer closes the entire class with one mechanism instead of
- * chasing each crossing.
- *
- * Envelope (cross-SDK contract — the Java decode-only codec in
- * stigmer-cloud's temporal-starter must match it byte-for-byte, pinned
- * by the conformance fixture in __tests__/fixtures/):
- *
- *   metadata: encoding            = "binary/encrypted"
- *             encryption-key-id   = <key id that encrypted this payload>
- *   data:     iv (12 bytes) ‖ AES-256-GCM(ciphertext ‖ tag (16 bytes))
- *
- * The plaintext is the serialized ORIGINAL Payload proto (metadata AND
- * data), so decode restores the payload exactly — including its
- * original encoding — with no side channel.
- *
- * Decode passes through payloads it did not encode. This is what keeps
- * plaintext signals from the Java/Go orchestrators and pre-rollout
- * in-flight histories working with zero migration. Everything else
- * fails closed: unknown key id, missing key id, and ciphertext tampering
- * all throw rather than surfacing bogus payloads.
- */
-import type { Payload, PayloadCodec } from "@temporalio/common";
-import type { PayloadEncryptionConfig } from "./config.js";
-export declare class EncryptionPayloadCodec implements PayloadCodec {
-    private readonly config;
-    private readonly decryptKeysById;
-    constructor(config: PayloadEncryptionConfig);
-    encode(payloads: Payload[]): Promise<Payload[]>;
-    decode(payloads: Payload[]): Promise<Payload[]>;
-    private encodePayload;
-    private decodePayload;
-}

package/dist/encryption/payload-codec.js

@@ -1,130 +0,0 @@
-/**
- * Temporal PayloadCodec that encrypts payloads at rest in workflow
- * history (stigmer-cloud#227).
- *
- * Why: the workflow engine runs inside the Temporal deterministic
- * sandbox, so decrypted execution-context values cross the history
- * boundary in many places — the hydrate activity result, the runtime
- * env passed as an input to every per-task activity, and expression
- * results recorded as local-activity markers. Encrypting at the payload
- * codec layer closes the entire class with one mechanism instead of
- * chasing each crossing.
- *
- * Envelope (cross-SDK contract — the Java decode-only codec in
- * stigmer-cloud's temporal-starter must match it byte-for-byte, pinned
- * by the conformance fixture in __tests__/fixtures/):
- *
- *   metadata: encoding            = "binary/encrypted"
- *             encryption-key-id   = <key id that encrypted this payload>
- *   data:     iv (12 bytes) ‖ AES-256-GCM(ciphertext ‖ tag (16 bytes))
- *
- * The plaintext is the serialized ORIGINAL Payload proto (metadata AND
- * data), so decode restores the payload exactly — including its
- * original encoding — with no side channel.
- *
- * Decode passes through payloads it did not encode. This is what keeps
- * plaintext signals from the Java/Go orchestrators and pre-rollout
- * in-flight histories working with zero migration. Everything else
- * fails closed: unknown key id, missing key id, and ciphertext tampering
- * all throw rather than surfacing bogus payloads.
- */
-import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
-// Default-import + destructure, NOT `import { temporal } from …`:
-// @temporalio/proto is CommonJS and its `temporal` export defeats Node's
-// cjs-module-lexer named-export detection, so the named form loads under
-// tsx/vitest (their interop is looser) but crashes plain `node dist/main.js`
-// at startup with "Named export 'temporal' not found" (stigmer/stigmer#399
-// boot regression). Pinned by scripts/verify-dist-boot.mjs in CI.
-import proto from "@temporalio/proto";
-const { temporal } = proto;
-const ENCODING_METADATA_KEY = "encoding";
-const ENCRYPTED_ENCODING_VALUE = "binary/encrypted";
-const KEY_ID_METADATA_KEY = "encryption-key-id";
-/** AES-GCM parameters shared with the Java implementation. */
-const IV_BYTES = 12;
-const AUTH_TAG_BYTES = 16;
-export class EncryptionPayloadCodec {
-    config;
-    decryptKeysById;
-    constructor(config) {
-        this.config = config;
-        this.decryptKeysById = new Map([[config.primary.keyId, config.primary.key]]);
-        if (config.secondary) {
-            this.decryptKeysById.set(config.secondary.keyId, config.secondary.key);
-        }
-    }
-    async encode(payloads) {
-        return payloads.map((p) => this.encodePayload(p));
-    }
-    async decode(payloads) {
-        return payloads.map((p) => this.decodePayload(p));
-    }
-    encodePayload(payload) {
-        // Data-less payloads (binary/null from void results) stay as-is:
-        // there is nothing to protect, and the cross-language parents that
-        // await our workflows as void must be able to read them without a key.
-        if (!payload.data || payload.data.length === 0) {
-            return payload;
-        }
-        const plaintext = temporal.api.common.v1.Payload.encode(payload).finish();
-        return {
-            metadata: {
-                [ENCODING_METADATA_KEY]: Buffer.from(ENCRYPTED_ENCODING_VALUE),
-                [KEY_ID_METADATA_KEY]: Buffer.from(this.config.primary.keyId),
-            },
-            data: encrypt(plaintext, this.config.primary),
-        };
-    }
-    decodePayload(payload) {
-        if (!isEncryptedPayload(payload)) {
-            return payload;
-        }
-        const keyIdBytes = payload.metadata?.[KEY_ID_METADATA_KEY];
-        if (!keyIdBytes) {
-            throw new Error("Encrypted payload is missing its encryption-key-id metadata — refusing to decode");
-        }
-        const keyId = Buffer.from(keyIdBytes).toString("utf-8");
-        const key = this.decryptKeysById.get(keyId);
-        if (!key) {
-            throw new Error(`Encrypted payload uses unknown key id '${keyId}' — configure it as the ` +
-                `primary or secondary payload encryption key (rotation window?)`);
-        }
-        const plaintext = decrypt(payload.data, key, keyId);
-        return temporal.api.common.v1.Payload.decode(plaintext);
-    }
-}
-function isEncryptedPayload(payload) {
-    const encoding = payload.metadata?.[ENCODING_METADATA_KEY];
-    if (!encoding)
-        return false;
-    return Buffer.from(encoding).toString("utf-8") === ENCRYPTED_ENCODING_VALUE;
-}
-function encrypt(plaintext, key) {
-    const iv = randomBytes(IV_BYTES);
-    const cipher = createCipheriv("aes-256-gcm", key.key, iv);
-    const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
-    // Layout iv ‖ ciphertext ‖ tag matches Java's AES/GCM/NoPadding, whose
-    // doFinal() output is ciphertext ‖ tag.
-    return Buffer.concat([iv, ciphertext, cipher.getAuthTag()]);
-}
-function decrypt(data, key, keyId) {
-    if (data.length < IV_BYTES + AUTH_TAG_BYTES) {
-        throw new Error(`Encrypted payload under key id '${keyId}' is truncated (${data.length} bytes)`);
-    }
-    const buf = Buffer.from(data);
-    const iv = buf.subarray(0, IV_BYTES);
-    const ciphertext = buf.subarray(IV_BYTES, buf.length - AUTH_TAG_BYTES);
-    const tag = buf.subarray(buf.length - AUTH_TAG_BYTES);
-    const decipher = createDecipheriv("aes-256-gcm", key, iv);
-    decipher.setAuthTag(tag);
-    try {
-        return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-    }
-    catch {
-        // GCM auth failure: tampered ciphertext or a key that does not match
-        // its advertised id. Never surface partially decrypted bytes.
-        throw new Error(`Failed to decrypt payload under key id '${keyId}' — ciphertext is ` +
-            `corrupt or the configured key does not match`);
-    }
-}
-//# sourceMappingURL=payload-codec.js.map

package/dist/encryption/payload-codec.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"payload-codec.js","sourceRoot":"","sources":["../../src/encryption/payload-codec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE5E,kEAAkE;AAClE,yEAAyE;AACzE,yEAAyE;AACzE,6EAA6E;AAC7E,2EAA2E;AAC3E,kEAAkE;AAClE,OAAO,KAAK,MAAM,mBAAmB,CAAC;AAGtC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;AAE3B,MAAM,qBAAqB,GAAG,UAAU,CAAC;AACzC,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AACpD,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAEhD,8DAA8D;AAC9D,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,MAAM,OAAO,sBAAsB;IAGJ;IAFZ,eAAe,CAAsB;IAEtD,YAA6B,MAA+B;QAA/B,WAAM,GAAN,MAAM,CAAyB;QAC1D,IAAI,CAAC,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7E,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAmB;QAC9B,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAmB;QAC9B,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IAEO,aAAa,CAAC,OAAgB;QACpC,iEAAiE;QACjE,mEAAmE;QACnE,uEAAuE;QACvE,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/C,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1E,OAAO;YACL,QAAQ,EAAE;gBACR,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC;gBAC9D,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aAC9D;YACD,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;SAC9C,CAAC;IACJ,CAAC;IAEO,aAAa,CAAC,OAAgB;QACpC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,mBAAmB,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,0CAA0C,KAAK,0BAA0B;gBACvE,gEAAgE,CACnE,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,IAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACrD,OAAO,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,qBAAqB,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,wBAAwB,CAAC;AAC9E,CAAC;AAED,SAAS,OAAO,CAAC,SAAqB,EAAE,GAAkB;IACxD,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,uEAAuE;IACvE,wCAAwC;IACxC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,OAAO,CAAC,IAAgB,EAAE,GAAW,EAAE,KAAa;IAC3D,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,GAAG,cAAc,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,mCAAmC,KAAK,mBAAmB,IAAI,CAAC,MAAM,SAAS,CAChF,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,GAAG,cAAc,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,cAAc,CAAC,CAAC;IAEtD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1D,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,8DAA8D;QAC9D,MAAM,IAAI,KAAK,CACb,2CAA2C,KAAK,oBAAoB;YAClE,8CAA8C,CACjD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/src/__tests__/claimcheck-codec.test.ts

@@ -1,256 +0,0 @@
-import { describe, it, expect, beforeEach } from "vitest";
-import { ClaimcheckPayloadCodec } from "../claimcheck/payload-codec.js";
-import { compress } from "../claimcheck/compressor.js";
-import type { ClaimcheckConfig } from "../claimcheck/config.js";
-import { makeInMemoryArtifactStorage } from "../__test-utils__/fake-artifact-storage.js";
-import type { Payload } from "@temporalio/common";
-
-function makeConfig(overrides: Partial<ClaimcheckConfig> = {}): ClaimcheckConfig {
-  return {
-    enabled: true,
-    thresholdBytes: 1024,
-    compressionEnabled: true,
-    keyPrefix: "claimcheck/",
-    ...overrides,
-  };
-}
-
-function makeStorage() {
-  // The canonical in-memory double; `uploads` aliases its backing Map so the
-  // existing `storage.uploads.*` assertions keep working, and `download` reads
-  // straight from what `encode` uploaded (no fetch to stub).
-  const { storage, blobs } = makeInMemoryArtifactStorage();
-  return Object.assign(storage, { uploads: blobs });
-}
-
-function makePayload(data: string | Buffer): Payload {
-  const buf = typeof data === "string" ? Buffer.from(data) : data;
-  return {
-    metadata: { encoding: Buffer.from("binary/plain") },
-    data: buf,
-  };
-}
-
-function makeLargePayload(sizeBytes: number): Payload {
-  const buf = Buffer.alloc(sizeBytes, "x");
-  return {
-    metadata: { encoding: Buffer.from("binary/plain") },
-    data: buf,
-  };
-}
-
-describe("ClaimcheckPayloadCodec", () => {
-  let storage: ReturnType<typeof makeStorage>;
-  let codec: ClaimcheckPayloadCodec;
-
-  beforeEach(() => {
-    storage = makeStorage();
-    codec = new ClaimcheckPayloadCodec(storage, makeConfig());
-  });
-
-  describe("encode", () => {
-    it("passes through payloads below threshold unchanged", async () => {
-      const payload = makePayload("small data");
-      const [result] = await codec.encode([payload]);
-      expect(result).toBe(payload);
-      expect(storage.uploads.size).toBe(0);
-    });
-
-    it("passes through empty payloads", async () => {
-      const payload: Payload = { metadata: {}, data: undefined };
-      const [result] = await codec.encode([payload]);
-      expect(result).toBe(payload);
-    });
-
-    it("offloads payloads at or above threshold", async () => {
-      const payload = makeLargePayload(1024);
-      const [result] = await codec.encode([payload]);
-
-      expect(result).not.toBe(payload);
-      expect(storage.uploads.size).toBe(1);
-
-      const markerMeta = result.metadata?.["encoding"];
-      expect(Buffer.from(markerMeta!).toString()).toBe("binary/claimcheck");
-
-      const marker = JSON.parse(Buffer.from(result.data!).toString());
-      expect(marker.key).toMatch(/^claimcheck\//);
-      expect(marker.size).toBe(1024);
-      expect(marker.compressed).toBe(true);
-    });
-
-    it("skips compression when it does not reduce size", async () => {
-      const randomBuf = Buffer.from(
-        Array.from({ length: 1024 }, () => Math.floor(Math.random() * 256)),
-      );
-      const payload: Payload = {
-        metadata: { encoding: Buffer.from("binary/plain") },
-        data: randomBuf,
-      };
-
-      const compressedSize = compress(randomBuf).length;
-      if (compressedSize >= randomBuf.length) {
-        const [result] = await codec.encode([payload]);
-        const marker = JSON.parse(Buffer.from(result.data!).toString());
-        expect(marker.compressed).toBe(false);
-
-        const uploaded = storage.uploads.values().next().value!;
-        expect(uploaded.length).toBe(randomBuf.length);
-      }
-    });
-
-    it("does not compress when compression is disabled", async () => {
-      codec = new ClaimcheckPayloadCodec(
-        storage,
-        makeConfig({ compressionEnabled: false }),
-      );
-      const payload = makeLargePayload(1024);
-      const [result] = await codec.encode([payload]);
-
-      const marker = JSON.parse(Buffer.from(result.data!).toString());
-      expect(marker.compressed).toBe(false);
-
-      const uploaded = storage.uploads.values().next().value!;
-      expect(uploaded.length).toBe(1024);
-    });
-
-    it("handles multiple payloads in a batch", async () => {
-      const small = makePayload("tiny");
-      const large = makeLargePayload(2048);
-
-      const results = await codec.encode([small, large]);
-      expect(results[0]).toBe(small);
-      expect(results[1]).not.toBe(large);
-      expect(storage.uploads.size).toBe(1);
-    });
-
-    it("uses configured key prefix", async () => {
-      codec = new ClaimcheckPayloadCodec(
-        storage,
-        makeConfig({ keyPrefix: "custom-prefix/" }),
-      );
-      const payload = makeLargePayload(1024);
-      const [result] = await codec.encode([payload]);
-
-      const marker = JSON.parse(Buffer.from(result.data!).toString());
-      expect(marker.key).toMatch(/^custom-prefix\//);
-    });
-  });
-
-  describe("decode", () => {
-    it("passes through non-claimcheck payloads unchanged", async () => {
-      const payload = makePayload("normal data");
-      const [result] = await codec.decode([payload]);
-      expect(result).toBe(payload);
-    });
-
-    it("retrieves and decompresses offloaded payloads (round-trip)", async () => {
-      const original = makeLargePayload(2048);
-      const [encoded] = await codec.encode([original]);
-
-      // decode reads back through storage.download from what encode uploaded.
-      const [decoded] = await codec.decode([encoded]);
-      expect(Buffer.from(decoded.data!)).toEqual(original.data);
-    });
-
-    it("restores the original payload metadata (round-trip)", async () => {
-      // The restored payload must carry its ORIGINAL encoding, not the
-      // marker's binary/claimcheck — otherwise no payload converter can
-      // interpret it and composition with the encryption codec breaks.
-      const original: Payload = {
-        metadata: {
-          encoding: Buffer.from("json/plain"),
-          "custom-key": Buffer.from("custom-value"),
-        },
-        data: Buffer.alloc(2048, "y"),
-      };
-
-      const [encoded] = await codec.encode([original]);
-      const [decoded] = await codec.decode([encoded]);
-
-      expect(Buffer.from(decoded.metadata!["encoding"]!).toString()).toBe("json/plain");
-      expect(Buffer.from(decoded.metadata!["custom-key"]!).toString()).toBe("custom-value");
-      expect(Buffer.from(decoded.data!)).toEqual(original.data);
-    });
-
-    it("decodes legacy markers written before metadata preservation", async () => {
-      const original = makeLargePayload(2048);
-      const [encoded] = await codec.encode([original]);
-
-      // Simulate a pre-fix marker: strip the metadata field.
-      const marker = JSON.parse(Buffer.from(encoded.data!).toString());
-      delete marker.metadata;
-      const legacy: Payload = {
-        metadata: encoded.metadata,
-        data: Buffer.from(JSON.stringify(marker)),
-      };
-
-      const [decoded] = await codec.decode([legacy]);
-      expect(Buffer.from(decoded.data!)).toEqual(original.data);
-    });
-
-    it("retrieves uncompressed payloads correctly", async () => {
-      codec = new ClaimcheckPayloadCodec(
-        storage,
-        makeConfig({ compressionEnabled: false }),
-      );
-
-      const original = makeLargePayload(1500);
-      const [encoded] = await codec.encode([original]);
-
-      const [decoded] = await codec.decode([encoded]);
-      expect(Buffer.from(decoded.data!)).toEqual(original.data);
-    });
-
-    it("wraps a download failure with the claimcheck error contract", async () => {
-      const encoded: Payload = {
-        metadata: { encoding: Buffer.from("binary/claimcheck") },
-        data: Buffer.from(JSON.stringify({
-          key: "claimcheck/missing",
-          size: 100,
-          compressed: false,
-        })),
-      };
-
-      // Drive the failure through the port; the proxy download surfaces the HTTP
-      // status, which the codec must preserve in its wrapped, key-scoped message.
-      storage.download.mockRejectedValueOnce(
-        new Error("Artifact download failed (HTTP 404) for key 'claimcheck/missing'"),
-      );
-
-      await expect(codec.decode([encoded])).rejects.toThrow(
-        /Claimcheck retrieve failed for key claimcheck\/missing.*HTTP 404/,
-      );
-    });
-  });
-
-  describe("threshold boundary", () => {
-    it("does NOT offload at threshold - 1", async () => {
-      const payload = makeLargePayload(1023);
-      const [result] = await codec.encode([payload]);
-      expect(result).toBe(payload);
-    });
-
-    it("offloads at exactly threshold", async () => {
-      const payload = makeLargePayload(1024);
-      const [result] = await codec.encode([payload]);
-      expect(result).not.toBe(payload);
-    });
-
-    it("offloads above threshold", async () => {
-      const payload = makeLargePayload(1025);
-      const [result] = await codec.encode([payload]);
-      expect(result).not.toBe(payload);
-    });
-  });
-
-  describe("compressor", () => {
-    it("compresses and decompresses correctly", async () => {
-      const { compress: c, decompress: d } = await import("../claimcheck/compressor.js");
-      const input = Buffer.from("hello world ".repeat(100));
-      const compressed = c(input);
-      expect(compressed.length).toBeLessThan(input.length);
-      const decompressed = d(compressed);
-      expect(decompressed).toEqual(input);
-    });
-  });
-});