@stigmer/runner 3.12.7 → 3.12.9

package/src/__tests__/encryption-codec.test.ts

@@ -1,287 +0,0 @@
-/**
- * Unit tests for the payload-encryption codec (stigmer-cloud#227).
- *
- * Covers the codec in isolation, its composition with the claim-check
- * codec (order is load-bearing: encrypt before relocate, so object
- * storage only ever sees ciphertext), the config loader's fail-fast
- * contract, and the committed cross-language conformance fixture that
- * pins the envelope format the Java decode-only codec (stigmer-cloud
- * temporal-starter) must match.
- */
-
-import { describe, it, expect, afterEach } from "vitest";
-import { randomBytes } from "node:crypto";
-import { readFileSync } from "node:fs";
-import { join, dirname } from "node:path";
-import { fileURLToPath } from "node:url";
-import type { Payload } from "@temporalio/common";
-import { EncryptionPayloadCodec } from "../encryption/payload-codec.js";
-import { loadPayloadEncryptionConfig } from "../encryption/config.js";
-import type { PayloadEncryptionConfig } from "../encryption/config.js";
-import { ClaimcheckPayloadCodec } from "../claimcheck/payload-codec.js";
-import { makeInMemoryArtifactStorage } from "../__test-utils__/fake-artifact-storage.js";
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-
-function makeKeyConfig(overrides: Partial<PayloadEncryptionConfig> = {}): PayloadEncryptionConfig {
-  return {
-    primary: { keyId: "test-key-1", key: randomBytes(32) },
-    ...overrides,
-  };
-}
-
-function makeJsonPayload(value: unknown): Payload {
-  return {
-    metadata: { encoding: Buffer.from("json/plain") },
-    data: Buffer.from(JSON.stringify(value)),
-  };
-}
-
-function metadataString(payload: Payload, key: string): string | undefined {
-  const bytes = payload.metadata?.[key];
-  return bytes ? Buffer.from(bytes).toString("utf-8") : undefined;
-}
-
-describe("EncryptionPayloadCodec", () => {
-  it("round-trips a payload, restoring metadata and data exactly", async () => {
-    const codec = new EncryptionPayloadCodec(makeKeyConfig());
-    const original = makeJsonPayload({ secret: "s3cret-value" });
-
-    const [encoded] = await codec.encode([original]);
-    expect(metadataString(encoded, "encoding")).toBe("binary/encrypted");
-    expect(metadataString(encoded, "encryption-key-id")).toBe("test-key-1");
-    expect(Buffer.from(encoded.data!).includes("s3cret-value")).toBe(false);
-
-    const [decoded] = await codec.decode([encoded]);
-    expect(metadataString(decoded, "encoding")).toBe("json/plain");
-    expect(Buffer.from(decoded.data!)).toEqual(original.data);
-  });
-
-  it("passes through payloads it did not encode", async () => {
-    const codec = new EncryptionPayloadCodec(makeKeyConfig());
-    const plaintext = makeJsonPayload({ from: "java-orchestrator" });
-    const [decoded] = await codec.decode([plaintext]);
-    expect(decoded).toBe(plaintext);
-  });
-
-  it("skips data-less payloads on encode (binary/null void results)", async () => {
-    const codec = new EncryptionPayloadCodec(makeKeyConfig());
-    const nullPayload: Payload = {
-      metadata: { encoding: Buffer.from("binary/null") },
-      data: undefined,
-    };
-    const [encoded] = await codec.encode([nullPayload]);
-    expect(encoded).toBe(nullPayload);
-  });
-
-  it("fails closed on tampered ciphertext", async () => {
-    const codec = new EncryptionPayloadCodec(makeKeyConfig());
-    const [encoded] = await codec.encode([makeJsonPayload({ a: 1 })]);
-
-    const tampered = Buffer.from(encoded.data!);
-    tampered[tampered.length - 1] ^= 0xff;
-
-    await expect(
-      codec.decode([{ metadata: encoded.metadata, data: tampered }]),
-    ).rejects.toThrow(/corrupt or the configured key does not match/);
-  });
-
-  it("fails closed on an unknown key id", async () => {
-    const writer = new EncryptionPayloadCodec(makeKeyConfig());
-    const [encoded] = await writer.encode([makeJsonPayload({ a: 1 })]);
-
-    const reader = new EncryptionPayloadCodec(
-      makeKeyConfig({ primary: { keyId: "other-key", key: randomBytes(32) } }),
-    );
-    await expect(reader.decode([encoded])).rejects.toThrow(
-      /unknown key id 'test-key-1'/,
-    );
-  });
-
-  it("fails closed when the key id metadata is missing", async () => {
-    const codec = new EncryptionPayloadCodec(makeKeyConfig());
-    const [encoded] = await codec.encode([makeJsonPayload({ a: 1 })]);
-
-    const stripped: Payload = {
-      metadata: { encoding: Buffer.from("binary/encrypted") },
-      data: encoded.data,
-    };
-    await expect(codec.decode([stripped])).rejects.toThrow(
-      /missing its encryption-key-id/,
-    );
-  });
-
-  it("decodes payloads written under the secondary key (rotation window)", async () => {
-    const oldKey = { keyId: "2026-01", key: randomBytes(32) };
-    const writer = new EncryptionPayloadCodec({ primary: oldKey });
-    const [encoded] = await writer.encode([makeJsonPayload({ rotated: true })]);
-
-    const rotatedReader = new EncryptionPayloadCodec({
-      primary: { keyId: "2026-08", key: randomBytes(32) },
-      secondary: oldKey,
-    });
-    const [decoded] = await rotatedReader.decode([encoded]);
-    expect(JSON.parse(Buffer.from(decoded.data!).toString())).toEqual({ rotated: true });
-  });
-});
-
-describe("composition with claim-check (encrypt, then relocate)", () => {
-  it("stores only ciphertext in object storage and round-trips exactly", async () => {
-    const { storage, blobs } = makeInMemoryArtifactStorage();
-    const encryption = new EncryptionPayloadCodec(makeKeyConfig());
-    const claimcheck = new ClaimcheckPayloadCodec(storage, {
-      enabled: true,
-      thresholdBytes: 128,
-      compressionEnabled: false,
-      keyPrefix: "claimcheck/",
-    });
-
-    const secret = "very-large-and-very-secret-".repeat(32);
-    const original = makeJsonPayload({ secret });
-
-    // Temporal applies codec arrays in order on encode, reverse on decode.
-    const [encrypted] = await encryption.encode([original]);
-    const [relocated] = await claimcheck.encode([encrypted]);
-    expect(metadataString(relocated, "encoding")).toBe("binary/claimcheck");
-
-    expect(blobs.size).toBe(1);
-    const blob: Buffer = blobs.values().next().value!;
-    expect(blob.includes("very-large-and-very-secret-")).toBe(false);
-
-    const [restored] = await claimcheck.decode([relocated]);
-    const [decrypted] = await encryption.decode([restored]);
-    expect(metadataString(decrypted, "encoding")).toBe("json/plain");
-    expect(Buffer.from(decrypted.data!)).toEqual(original.data);
-  });
-});
-
-describe("loadPayloadEncryptionConfig", () => {
-  const ENV_VARS = [
-    "STIGMER_PAYLOAD_ENCRYPTION_KEY",
-    "STIGMER_PAYLOAD_ENCRYPTION_KEY_ID",
-    "STIGMER_PAYLOAD_ENCRYPTION_SECONDARY_KEY",
-    "STIGMER_PAYLOAD_ENCRYPTION_SECONDARY_KEY_ID",
-  ];
-
-  afterEach(() => {
-    for (const name of ENV_VARS) delete process.env[name];
-  });
-
-  it("returns undefined when no key is configured", () => {
-    expect(loadPayloadEncryptionConfig()).toBeUndefined();
-  });
-
-  it("loads primary and secondary keys", () => {
-    process.env.STIGMER_PAYLOAD_ENCRYPTION_KEY = randomBytes(32).toString("base64");
-    process.env.STIGMER_PAYLOAD_ENCRYPTION_KEY_ID = "k2";
-    process.env.STIGMER_PAYLOAD_ENCRYPTION_SECONDARY_KEY = randomBytes(32).toString("base64");
-    process.env.STIGMER_PAYLOAD_ENCRYPTION_SECONDARY_KEY_ID = "k1";
-
-    const config = loadPayloadEncryptionConfig();
-    expect(config?.primary.keyId).toBe("k2");
-    expect(config?.primary.key.length).toBe(32);
-    expect(config?.secondary?.keyId).toBe("k1");
-  });
-
-  it("fails the boot when a key is set without an id", () => {
-    process.env.STIGMER_PAYLOAD_ENCRYPTION_KEY = randomBytes(32).toString("base64");
-    expect(() => loadPayloadEncryptionConfig()).toThrow(
-      /STIGMER_PAYLOAD_ENCRYPTION_KEY_ID is required/,
-    );
-  });
-
-  it("fails the boot on a key of the wrong length", () => {
-    process.env.STIGMER_PAYLOAD_ENCRYPTION_KEY = randomBytes(16).toString("base64");
-    process.env.STIGMER_PAYLOAD_ENCRYPTION_KEY_ID = "k1";
-    expect(() => loadPayloadEncryptionConfig()).toThrow(/must decode to 32 bytes/);
-  });
-
-  // Server-managed key material from getRunnerBootstrapConfig (stigmer#398):
-  // desktop-class runners receive a per-identity key at bootstrap instead of
-  // env config. The env key is the operator's explicit choice and must win.
-  describe("bootstrap-delivered keys", () => {
-    const bootstrapKeys = () => ({
-      key: randomBytes(32).toString("base64"),
-      keyId: "identity-key-v1",
-      secondaryKey: randomBytes(32).toString("base64"),
-      secondaryKeyId: "identity-key-v0",
-    });
-
-    it("enables encryption from bootstrap material when no env key is set", () => {
-      const config = loadPayloadEncryptionConfig(bootstrapKeys());
-      expect(config?.primary.keyId).toBe("identity-key-v1");
-      expect(config?.primary.key.length).toBe(32);
-      expect(config?.secondary?.keyId).toBe("identity-key-v0");
-    });
-
-    it("env-configured key wins over bootstrap material", () => {
-      process.env.STIGMER_PAYLOAD_ENCRYPTION_KEY = randomBytes(32).toString("base64");
-      process.env.STIGMER_PAYLOAD_ENCRYPTION_KEY_ID = "env-key";
-
-      const config = loadPayloadEncryptionConfig(bootstrapKeys());
-      expect(config?.primary.keyId).toBe("env-key");
-      expect(config?.secondary).toBeUndefined();
-    });
-
-    it("fails the boot on a bootstrap key without its id (server contract violation)", () => {
-      expect(() =>
-        loadPayloadEncryptionConfig({ key: randomBytes(32).toString("base64") }),
-      ).toThrow(/payload_encryption_key_id/);
-    });
-
-    it("fails the boot on a malformed bootstrap key rather than running plaintext", () => {
-      expect(() =>
-        loadPayloadEncryptionConfig({
-          key: randomBytes(16).toString("base64"),
-          keyId: "identity-key-v1",
-        }),
-      ).toThrow(/must decode to 32 bytes/);
-    });
-
-    it("fails the boot on a bootstrap secondary key without its id", () => {
-      expect(() =>
-        loadPayloadEncryptionConfig({
-          key: randomBytes(32).toString("base64"),
-          keyId: "identity-key-v1",
-          secondaryKey: randomBytes(32).toString("base64"),
-        }),
-      ).toThrow(/payload_encryption_secondary_key_id/);
-    });
-  });
-});
-
-describe("cross-language conformance fixture", () => {
-  // The committed fixture pins the envelope as a wire contract. A copy
-  // lives in stigmer-cloud (temporal-starter test resources) where the
-  // Java decode-only codec must decrypt it to the same payload. Never
-  // regenerate it casually: changing the fixture means changing the
-  // cross-SDK envelope, which requires both implementations to move in
-  // lockstep.
-  it("decrypts the committed fixture to the expected payload", async () => {
-    const fixture = JSON.parse(
-      readFileSync(join(__dirname, "fixtures", "encrypted-payload-fixture.json"), "utf-8"),
-    );
-
-    const codec = new EncryptionPayloadCodec({
-      primary: {
-        keyId: fixture.keyId,
-        key: Buffer.from(fixture.keyBase64, "base64"),
-      },
-    });
-
-    const encrypted: Payload = {
-      metadata: Object.fromEntries(
-        Object.entries(fixture.encrypted.metadataBase64 as Record<string, string>).map(
-          ([k, v]) => [k, Buffer.from(v, "base64")],
-        ),
-      ),
-      data: Buffer.from(fixture.encrypted.dataBase64, "base64"),
-    };
-
-    const [decoded] = await codec.decode([encrypted]);
-    expect(metadataString(decoded, "encoding")).toBe("json/plain");
-    expect(Buffer.from(decoded.data!).toString("utf-8")).toBe(
-      fixture.original.dataJson,
-    );
-  });
-});

package/src/__tests__/fixtures/encrypted-payload-fixture.json

@@ -1,15 +0,0 @@
-{
-  "description": "Cross-language conformance fixture for the Temporal payload-encryption envelope (stigmer-cloud#227). data = iv(12) || AES-256-GCM ciphertext || tag(16); plaintext is the serialized original Payload proto. The TS codec (stigmer OSS runner) and the Java decode-only codec (stigmer-cloud temporal-starter) must both decrypt this to original.dataJson with encoding json/plain. The key is TEST-ONLY. Do not regenerate without moving both implementations in lockstep.",
-  "keyId": "conformance-2026-08-11",
-  "keyBase64": "LwN0jDzOwm0aPH8lyRRqsTMali/7RAgKKB9CY6psNFw=",
-  "encrypted": {
-    "metadataBase64": {
-      "encoding": "YmluYXJ5L2VuY3J5cHRlZA==",
-      "encryption-key-id": "Y29uZm9ybWFuY2UtMjAyNi0wOC0xMQ=="
-    },
-    "dataBase64": "CzL44tAoZwoawET5ApaDKGLYcJO2P8eTPS4hZnoEOUvZ7jkD5mkCnD9krgY9etYWO+06y779i8xRCs7QrnOKo5xo74HtlY0bwxYjr2dOra9TGRbtv3PlrW+DcfmEFAQ3Efem"
-  },
-  "original": {
-    "dataJson": "{\"secret\":\"cross-language-conformance-value\"}"
-  }
-}

package/src/claimcheck/compressor.ts

@@ -1,9 +0,0 @@
-import { gzipSync, gunzipSync } from "node:zlib";
-
-export function compress(data: Buffer): Buffer<ArrayBuffer> {
-  return gzipSync(data) as Buffer<ArrayBuffer>;
-}
-
-export function decompress(data: Buffer): Buffer<ArrayBuffer> {
-  return gunzipSync(data) as Buffer<ArrayBuffer>;
-}

package/src/claimcheck/config.ts

@@ -1,20 +0,0 @@
-export interface ClaimcheckConfig {
-  readonly enabled: boolean;
-  readonly thresholdBytes: number;
-  readonly compressionEnabled: boolean;
-  readonly keyPrefix: string;
-}
-
-const DEFAULT_THRESHOLD_BYTES = 128 * 1024; // 128KB
-
-export function loadClaimcheckConfig(): ClaimcheckConfig {
-  return {
-    enabled: process.env.CLAIMCHECK_ENABLED === "true",
-    thresholdBytes: parseInt(
-      process.env.CLAIMCHECK_THRESHOLD_BYTES ?? String(DEFAULT_THRESHOLD_BYTES),
-      10,
-    ),
-    compressionEnabled: process.env.CLAIMCHECK_COMPRESSION_ENABLED !== "false",
-    keyPrefix: process.env.CLAIMCHECK_KEY_PREFIX ?? "claimcheck/",
-  };
-}

package/src/claimcheck/index.ts

@@ -1,3 +0,0 @@
-export { ClaimcheckPayloadCodec } from "./payload-codec.js";
-export { loadClaimcheckConfig, type ClaimcheckConfig } from "./config.js";
-export { compress, decompress } from "./compressor.js";

package/src/claimcheck/payload-codec.ts

@@ -1,139 +0,0 @@
-/**
- * Temporal PayloadCodec that transparently offloads large payloads to
- * external storage (ArtifactStorage). Payloads below the threshold pass
- * through unchanged. Payloads at or above the threshold are compressed
- * (optional), uploaded, and replaced with a small reference marker.
- *
- * On decode, markers are detected, the original payload is downloaded
- * and decompressed, and the original bytes are restored — transparent
- * to workflow/activity code.
- */
-
-import { randomUUID } from "node:crypto";
-import type { Payload, PayloadCodec } from "@temporalio/common";
-import type { ArtifactStorage } from "../shared/artifact-storage.js";
-import type { ClaimcheckConfig } from "./config.js";
-import { compress, decompress } from "./compressor.js";
-
-const MARKER_METADATA_KEY = "encoding";
-const MARKER_ENCODING_VALUE = "binary/claimcheck";
-
-interface ClaimcheckMarker {
-  key: string;
-  size: number;
-  compressed: boolean;
-  /**
-   * The relocated payload's original metadata, base64-encoded per value.
-   * Without it the restored payload would carry the marker's own
-   * "binary/claimcheck" encoding and no payload converter could interpret
-   * it. Absent on markers written before this field existed; those decode
-   * with the legacy (metadata-less) behavior.
-   */
-  metadata?: Record<string, string>;
-}
-
-export class ClaimcheckPayloadCodec implements PayloadCodec {
-  constructor(
-    private readonly storage: ArtifactStorage,
-    private readonly config: ClaimcheckConfig,
-  ) {}
-
-  async encode(payloads: Payload[]): Promise<Payload[]> {
-    return Promise.all(payloads.map((p) => this.encodePayload(p)));
-  }
-
-  async decode(payloads: Payload[]): Promise<Payload[]> {
-    return Promise.all(payloads.map((p) => this.decodePayload(p)));
-  }
-
-  private async encodePayload(payload: Payload): Promise<Payload> {
-    const data = payload.data;
-    if (!data || data.length < this.config.thresholdBytes) {
-      return payload;
-    }
-
-    const originalBuf = Buffer.from(data);
-    let uploadBuf = originalBuf;
-    let compressed = false;
-
-    if (this.config.compressionEnabled) {
-      const compressedBuf = compress(originalBuf);
-      if (compressedBuf.length < originalBuf.length) {
-        uploadBuf = compressedBuf;
-        compressed = true;
-      }
-    }
-
-    const key = `${this.config.keyPrefix}${randomUUID()}`;
-    await this.storage.upload(key, uploadBuf, "application/octet-stream");
-
-    const marker: ClaimcheckMarker = {
-      key,
-      size: data.length,
-      compressed,
-      metadata: serializeMetadata(payload.metadata),
-    };
-
-    return {
-      metadata: {
-        [MARKER_METADATA_KEY]: Buffer.from(MARKER_ENCODING_VALUE),
-      },
-      data: Buffer.from(JSON.stringify(marker)),
-    };
-  }
-
-  private async decodePayload(payload: Payload): Promise<Payload> {
-    if (!this.isClaimcheckPayload(payload)) {
-      return payload;
-    }
-
-    const marker: ClaimcheckMarker = JSON.parse(
-      Buffer.from(payload.data!).toString("utf-8"),
-    );
-
-    let rawBuf: Buffer;
-    try {
-      rawBuf = await this.storage.download(marker.key);
-    } catch (err) {
-      // Preserve the claimcheck-scoped error contract; the shared download error
-      // already carries the HTTP status (proxy) or the miss (local) as the cause.
-      const cause = err instanceof Error ? err.message : String(err);
-      throw new Error(`Claimcheck retrieve failed for key ${marker.key}: ${cause}`);
-    }
-    const dataBuf = marker.compressed ? decompress(rawBuf) : rawBuf;
-
-    return {
-      metadata: marker.metadata
-        ? deserializeMetadata(marker.metadata)
-        : payload.metadata,
-      data: dataBuf,
-    };
-  }
-
-  private isClaimcheckPayload(payload: Payload): boolean {
-    const encoding = payload.metadata?.[MARKER_METADATA_KEY];
-    if (!encoding) return false;
-    return Buffer.from(encoding).toString("utf-8") === MARKER_ENCODING_VALUE;
-  }
-}
-
-function serializeMetadata(
-  metadata: Payload["metadata"],
-): Record<string, string> | undefined {
-  if (!metadata) return undefined;
-  const out: Record<string, string> = {};
-  for (const [key, value] of Object.entries(metadata)) {
-    if (value) out[key] = Buffer.from(value).toString("base64");
-  }
-  return out;
-}
-
-function deserializeMetadata(
-  metadata: Record<string, string>,
-): Record<string, Uint8Array> {
-  const out: Record<string, Uint8Array> = {};
-  for (const [key, value] of Object.entries(metadata)) {
-    out[key] = Buffer.from(value, "base64");
-  }
-  return out;
-}

package/src/encryption/config.ts

@@ -1,161 +0,0 @@
-/**
- * Payload-encryption configuration (stigmer-cloud#227, stigmer#398).
- *
- * Two key sources, strict precedence:
- *
- *   1. Environment (STIGMER_PAYLOAD_ENCRYPTION_KEY(_ID)) — the operator's
- *      explicit choice: self-hosted deployments sharing one key with their
- *      server, and cloud sandboxes injected with the platform key. When the
- *      env key is set, bootstrap-delivered material is ignored entirely.
- *   2. Bootstrap-delivered — server-managed per-identity keys handed to
- *      desktop-class runners by getRunnerBootstrapConfig. Held in memory
- *      only; persistence lives server-side, which is what makes Temporal
- *      replay work across runner restarts (every boot re-fetches the SAME
- *      key).
- *
- * Encryption is enabled iff a key is present from either source — the same
- * enabled-iff-configured pattern as the claim-check codec. A malformed key
- * fails the boot rather than silently running plaintext: an operator who set
- * the key (or a server that minted one) intended history to be encrypted.
- *
- * Key rotation: payloads carry the id of the key that encrypted them.
- * During a rotation window the previous key stays readable via the
- * secondary pair while new payloads are written under the primary key.
- * Workers capture keys at construction, so a rotated bootstrap key lands
- * on the next runner boot — there is no live re-key.
- */
-
-import { getRunnerSecret } from "../shared/runner-credential-store.js";
-
-export interface EncryptionKey {
-  readonly keyId: string;
-  /** 32-byte AES-256 key. */
-  readonly key: Buffer;
-}
-
-export interface PayloadEncryptionConfig {
-  /** Key used to encrypt outgoing payloads (and decrypt its own). */
-  readonly primary: EncryptionKey;
-  /** Decrypt-only key accepted during rotation windows. */
-  readonly secondary?: EncryptionKey;
-}
-
-/**
- * Server-managed key material delivered by getRunnerBootstrapConfig.
- * Structurally mirrors {@link BootstrapPayloadEncryptionKeys} in
- * stigmer-client.ts — declared here so this leaf module stays free of
- * client imports.
- */
-export interface BootstrapKeyMaterial {
-  readonly key: string;
-  readonly keyId?: string;
-  readonly secondaryKey?: string;
-  readonly secondaryKeyId?: string;
-}
-
-const KEY_ENV = "STIGMER_PAYLOAD_ENCRYPTION_KEY";
-const KEY_ID_ENV = "STIGMER_PAYLOAD_ENCRYPTION_KEY_ID";
-const SECONDARY_KEY_ENV = "STIGMER_PAYLOAD_ENCRYPTION_SECONDARY_KEY";
-const SECONDARY_KEY_ID_ENV = "STIGMER_PAYLOAD_ENCRYPTION_SECONDARY_KEY_ID";
-
-const AES_256_KEY_BYTES = 32;
-
-/**
- * Returns the encryption config, or undefined when encryption is not
- * configured (the codec is then simply not installed).
- *
- * Source precedence: the env key wins outright; bootstrap-delivered
- * material applies only when no env key is set (see the module doc).
- *
- * @throws when a key is present but malformed, or a key id is missing —
- *   key misconfiguration must stop the boot, not degrade to plaintext.
- *   This applies equally to bootstrap material: a server that hands out
- *   a bad key or omits its id has broken the protocol contract, and
- *   running plaintext against a server that manages keys would silently
- *   defeat the feature.
- */
-export function loadPayloadEncryptionConfig(
-  bootstrap?: BootstrapKeyMaterial,
-): PayloadEncryptionConfig | undefined {
-  // Key VALUES resolve through the credential store (the #508 boot capture
-  // moves them out of process.env — agent shells must not read them); the
-  // *_KEY_ID companions are rotation bookkeeping, not secrets, and stay
-  // plain env reads.
-  const rawKey = getRunnerSecret(KEY_ENV);
-  if (rawKey) {
-    const primary: EncryptionKey = {
-      keyId: requireKeyId(KEY_ID_ENV),
-      key: parseKey(rawKey, KEY_ENV),
-    };
-
-    const rawSecondary = getRunnerSecret(SECONDARY_KEY_ENV);
-    const secondary: EncryptionKey | undefined = rawSecondary
-      ? {
-          keyId: requireKeyId(SECONDARY_KEY_ID_ENV),
-          key: parseKey(rawSecondary, SECONDARY_KEY_ENV),
-        }
-      : undefined;
-
-    return { primary, secondary };
-  }
-
-  if (bootstrap?.key) {
-    const primary: EncryptionKey = {
-      keyId: requireBootstrapKeyId(bootstrap.keyId, "payload_encryption_key_id"),
-      key: parseKey(bootstrap.key, "bootstrap payload_encryption_key"),
-    };
-
-    const secondary: EncryptionKey | undefined = bootstrap.secondaryKey
-      ? {
-          keyId: requireBootstrapKeyId(
-            bootstrap.secondaryKeyId,
-            "payload_encryption_secondary_key_id",
-          ),
-          key: parseKey(bootstrap.secondaryKey, "bootstrap payload_encryption_secondary_key"),
-        }
-      : undefined;
-
-    return { primary, secondary };
-  }
-
-  return undefined;
-}
-
-function requireKeyId(envName: string): string {
-  const keyId = process.env[envName];
-  // An explicit id is required (no default): during rotation two keys
-  // coexist, and payloads must name which one encrypted them.
-  if (!keyId) {
-    throw new Error(
-      `Payload encryption misconfigured: ${envName} is required when the ` +
-        `corresponding key is set`,
-    );
-  }
-  return keyId;
-}
-
-function requireBootstrapKeyId(keyId: string | undefined, fieldName: string): string {
-  if (!keyId) {
-    throw new Error(
-      `Runner bootstrap returned a payload encryption key without its ${fieldName} — ` +
-        `refusing to encrypt under an unidentified key (server contract violation)`,
-    );
-  }
-  return keyId;
-}
-
-function parseKey(rawBase64: string, envName: string): Buffer {
-  let key: Buffer;
-  try {
-    key = Buffer.from(rawBase64, "base64");
-  } catch {
-    throw new Error(`Payload encryption misconfigured: ${envName} is not valid base64`);
-  }
-  if (key.length !== AES_256_KEY_BYTES) {
-    throw new Error(
-      `Payload encryption misconfigured: ${envName} must decode to ` +
-        `${AES_256_KEY_BYTES} bytes (AES-256), got ${key.length}`,
-    );
-  }
-  return key;
-}

package/src/encryption/index.ts

@@ -1,3 +0,0 @@
-export { EncryptionPayloadCodec } from "./payload-codec.js";
-export { loadPayloadEncryptionConfig } from "./config.js";
-export type { PayloadEncryptionConfig, EncryptionKey } from "./config.js";