@stigmer/server 3.14.0-dev.20260910084630

package/dist/temporal/mcpserver/engine-client.js

@@ -0,0 +1,211 @@
+import { WorkflowFailedError, WorkflowNotFoundError } from "@temporalio/client";
+import { ApplicationFailure, TimeoutFailure, WorkflowExecutionAlreadyStartedError, } from "@temporalio/common";
+// Default-imported: @temporalio/proto is CommonJS, and Node's ESM loader
+// cannot statically detect its `temporal` named export (the runtime
+// throws SyntaxError on the named form even though tsc accepts it).
+import temporalProto from "@temporalio/proto";
+import { MCP_SERVER_ENGINE_DISCONNECTED } from "../../domain/mcpserver/engine.js";
+import { CONNECT_WORKFLOW_NAME, connectWorkflowIdFor } from "./names.js";
+export class TemporalMcpServerConnectEngine {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    async startOrAttachConnect(mcpServerId, input, runTimeoutMs) {
+        const { client, config, logger } = this.deps;
+        const workflowId = connectWorkflowIdFor(mcpServerId);
+        // MCP connect is not session-scoped (it discovers tools at the server
+        // level), so it always routes to the default runner queue regardless
+        // of routing mode (connect.go:642-645).
+        const runnerQueue = config.runnerQueue;
+        let handle;
+        let attached = false;
+        try {
+            handle = await client.workflow.start(CONNECT_WORKFLOW_NAME, {
+                workflowId,
+                taskQueue: runnerQueue,
+                workflowRunTimeout: runTimeoutMs,
+                args: [input],
+            });
+        }
+        catch (error) {
+            if (error instanceof WorkflowExecutionAlreadyStartedError) {
+                logger.info("Connect workflow already in flight — attaching to it", {
+                    workflow_id: workflowId,
+                    mcp_server_id: mcpServerId,
+                });
+                handle = client.workflow.getHandle(workflowId);
+                attached = true;
+            }
+            else {
+                throw error;
+            }
+        }
+        if (!attached) {
+            logger.info("Started MCP connect workflow", {
+                workflow_id: workflowId,
+                mcp_server_id: mcpServerId,
+                runner_queue: runnerQueue,
+            });
+        }
+        return {
+            workflowId,
+            attached,
+            result: (raceTimeoutMs) => awaitRunOutcome(handle, raceTimeoutMs),
+        };
+    }
+    async isConnectRunRunning(workflowId) {
+        if (workflowId === "") {
+            return false;
+        }
+        try {
+            const description = await this.deps.client.workflow
+                .getHandle(workflowId)
+                .describe();
+            return description.status.name === "RUNNING";
+        }
+        catch {
+            return false;
+        }
+    }
+    async hasRunnerQueuePollers() {
+        const { client, config, logger } = this.deps;
+        try {
+            const response = await client.workflowService.describeTaskQueue({
+                namespace: client.options.namespace,
+                taskQueue: { name: config.runnerQueue },
+                taskQueueType: temporalProto.temporal.api.enums.v1.TaskQueueType
+                    .TASK_QUEUE_TYPE_WORKFLOW,
+            });
+            return (response.pollers?.length ?? 0) > 0;
+        }
+        catch (error) {
+            logger.debug("Could not describe runner task queue for connect pre-flight", {
+                runner_queue: config.runnerQueue,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return undefined;
+        }
+    }
+}
+/**
+ * Awaits a run and classifies its settle into the seam's taxonomy —
+ * run.Get's errors.As switch (connect.go:661-694), one arm per Temporal
+ * failure class. raceTimeoutMs mirrors Go's bounded background contexts:
+ * the classification for a fired backstop is Go's ctx text, so the
+ * settle paths render the same failure they would have logged there.
+ */
+async function awaitRunOutcome(handle, raceTimeoutMs) {
+    const resultPromise = handle
+        .result()
+        .then((output) => {
+        // The runner returns the output object directly; a null (crashed
+        // codec path etc.) classifies as an empty result rather than a
+        // crash — persistConnectResult's preserve-on-empty then applies.
+        return { ok: true, output: (output ?? {}) };
+    })
+        .catch((error) => {
+        return { ok: false, failure: classifyRunError(error) };
+    });
+    if (raceTimeoutMs === undefined) {
+        return resultPromise;
+    }
+    let backstop;
+    const backstopPromise = new Promise((resolve) => {
+        backstop = setTimeout(() => {
+            // Go's expired background context makes run.Get return
+            // "context deadline exceeded", which lands in the default
+            // (Internal) arm — same text, same classification.
+            resolve({
+                ok: false,
+                failure: { kind: "other", message: "context deadline exceeded" },
+            });
+        }, raceTimeoutMs);
+    });
+    try {
+        return await Promise.race([resultPromise, backstopPromise]);
+    }
+    finally {
+        if (backstop !== undefined) {
+            clearTimeout(backstop);
+        }
+    }
+}
+function classifyRunError(error) {
+    if (error instanceof WorkflowFailedError) {
+        // Walk the WHOLE cause chain, not just the direct cause: a workflow
+        // failed by an activity arrives as WorkflowFailedError →
+        // ActivityFailure → ApplicationFailure, and Go's errors.As unwraps
+        // the same chain to find the runner's ApplicationError (whose message
+        // is the classified, user-facing text — the intermediate
+        // ActivityFailure's "Activity task failed" is NOT the contract).
+        // Pinned by the mcpserver-connect suite's unreachable-server arm.
+        let application;
+        let timeout;
+        let cause = error.cause;
+        while (cause !== undefined && cause !== null) {
+            if (application === undefined && cause instanceof ApplicationFailure) {
+                application = cause;
+            }
+            if (timeout === undefined && cause instanceof TimeoutFailure) {
+                timeout = cause;
+            }
+            cause = cause.cause;
+        }
+        // Go's switch order: the application arm wins when both match.
+        if (application !== undefined) {
+            // The runner's crafted, user-facing message (issue #239 arm).
+            return { kind: "application", message: application.message };
+        }
+        if (timeout !== undefined) {
+            // The WorkflowRunTimeout elapsed (issue #243 arm).
+            return { kind: "timeout" };
+        }
+        return {
+            kind: "other",
+            message: error.cause?.message !== undefined && error.cause.message !== ""
+                ? error.cause.message
+                : error.message,
+        };
+    }
+    if (error instanceof WorkflowNotFoundError) {
+        // Go serviceerror.NotFound — the run vanished (e.g. Temporal data
+        // loss); the domain maps this to Unavailable.
+        return { kind: "service-not-found" };
+    }
+    return {
+        kind: "other",
+        message: error instanceof Error ? error.message : String(error),
+    };
+}
+/**
+ * Builds the provider compose hands the mcpserver registration.
+ * Availability parity per the manager's contract: disconnected ONLY until
+ * the first successful connect; afterwards the engine wraps the manager's
+ * CURRENT client, stale-during-outage included — operations then fail
+ * exactly as Go's stale-client operations do.
+ */
+export function newMcpServerEngineStateProvider(deps) {
+    let memo;
+    return () => {
+        const client = deps.manager.getClient();
+        if (client === undefined) {
+            return MCP_SERVER_ENGINE_DISCONNECTED;
+        }
+        if (memo === undefined || memo.client !== client) {
+            memo = {
+                client,
+                state: {
+                    connected: true,
+                    engine: new TemporalMcpServerConnectEngine({
+                        client,
+                        config: deps.config,
+                        logger: deps.logger,
+                    }),
+                },
+            };
+        }
+        return memo.state;
+    };
+}
+//# sourceMappingURL=engine-client.js.map

package/dist/temporal/mcpserver/engine-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine-client.js","sourceRoot":"","sources":["../../../src/temporal/mcpserver/engine-client.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAEhF,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,oCAAoC,GACrC,MAAM,oBAAoB,CAAC;AAC5B,yEAAyE;AACzE,oEAAoE;AACpE,oEAAoE;AACpE,OAAO,aAAa,MAAM,mBAAmB,CAAC;AAc9C,OAAO,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAElF,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAQzE,MAAM,OAAO,8BAA8B;IACZ;IAA7B,YAA6B,IAAyB;QAAzB,SAAI,GAAJ,IAAI,CAAqB;IAAG,CAAC;IAE1D,KAAK,CAAC,oBAAoB,CACxB,WAAmB,EACnB,KAA2B,EAC3B,YAAoB;QAEpB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;QAC7C,MAAM,UAAU,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;QACrD,sEAAsE;QACtE,qEAAqE;QACrE,wCAAwC;QACxC,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QAEvC,IAAI,MAAsB,CAAC;QAC3B,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,qBAAqB,EAAE;gBAC1D,UAAU;gBACV,SAAS,EAAE,WAAW;gBACtB,kBAAkB,EAAE,YAAY;gBAChC,IAAI,EAAE,CAAC,KAAK,CAAC;aACd,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,oCAAoC,EAAE,CAAC;gBAC1D,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;oBAClE,WAAW,EAAE,UAAU;oBACvB,aAAa,EAAE,WAAW;iBAC3B,CAAC,CAAC;gBACH,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;gBAC/C,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;gBAC1C,WAAW,EAAE,UAAU;gBACvB,aAAa,EAAE,WAAW;gBAC1B,YAAY,EAAE,WAAW;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,UAAU;YACV,QAAQ;YACR,MAAM,EAAE,CAAC,aAAsB,EAAE,EAAE,CACjC,eAAe,CAAC,MAAM,EAAE,aAAa,CAAC;SACzC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,UAAkB;QAC1C,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ;iBAChD,SAAS,CAAC,UAAU,CAAC;iBACrB,QAAQ,EAAE,CAAC;YACd,OAAO,WAAW,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,qBAAqB;QACzB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,iBAAiB,CAAC;gBAC9D,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;gBACnC,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE;gBACvC,aAAa,EACX,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa;qBAC9C,wBAAwB;aAC9B,CAAC,CAAC;YACH,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,6DAA6D,EAAE;gBAC1E,YAAY,EAAE,MAAM,CAAC,WAAW;gBAChC,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF;AAED;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAC5B,MAAsB,EACtB,aAAiC;IAEjC,MAAM,aAAa,GAAG,MAAM;SACzB,MAAM,EAAE;SACR,IAAI,CAAC,CAAC,MAAM,EAAqB,EAAE;QAClC,iEAAiE;QACjE,+DAA+D;QAC/D,iEAAiE;QACjE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,MAAM,IAAI,EAAE,CAA0B,EAAE,CAAC;IACvE,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,KAAc,EAAqB,EAAE;QAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;IACzD,CAAC,CAAC,CAAC;IAEL,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,IAAI,QAAoC,CAAC;IACzC,MAAM,eAAe,GAAG,IAAI,OAAO,CAAoB,CAAC,OAAO,EAAE,EAAE;QACjE,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE;YACzB,uDAAuD;YACvD,0DAA0D;YAC1D,mDAAmD;YACnD,OAAO,CAAC;gBACN,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,EAAE;aACjE,CAAC,CAAC;QACL,CAAC,EAAE,aAAa,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,YAAY,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;QACzC,oEAAoE;QACpE,yDAAyD;QACzD,mEAAmE;QACnE,sEAAsE;QACtE,yDAAyD;QACzD,iEAAiE;QACjE,kEAAkE;QAClE,IAAI,WAA2C,CAAC;QAChD,IAAI,OAAmC,CAAC;QACxC,IAAI,KAAK,GAAY,KAAK,CAAC,KAAK,CAAC;QACjC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC7C,IAAI,WAAW,KAAK,SAAS,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;gBACrE,WAAW,GAAG,KAAK,CAAC;YACtB,CAAC;YACD,IAAI,OAAO,KAAK,SAAS,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;gBAC7D,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC;YACD,KAAK,GAAI,KAA6B,CAAC,KAAK,CAAC;QAC/C,CAAC;QACD,+DAA+D;QAC/D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,8DAA8D;YAC9D,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC;QAC/D,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,mDAAmD;YACnD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,CAAC;QACD,OAAO;YACL,IAAI,EAAE,OAAO;YACb,OAAO,EACL,KAAK,CAAC,KAAK,EAAE,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,EAAE;gBAC9D,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO;gBACrB,CAAC,CAAC,KAAK,CAAC,OAAO;SACpB,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;QAC3C,kEAAkE;QAClE,8CAA8C;QAC9C,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;IACvC,CAAC;IACD,OAAO;QACL,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;KAChE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,+BAA+B,CAAC,IAI/C;IACC,IAAI,IAAiE,CAAC;IACtE,OAAO,GAAG,EAAE;QACV,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACxC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,8BAA8B,CAAC;QACxC,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACjD,IAAI,GAAG;gBACL,MAAM;gBACN,KAAK,EAAE;oBACL,SAAS,EAAE,IAAI;oBACf,MAAM,EAAE,IAAI,8BAA8B,CAAC;wBACzC,MAAM;wBACN,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,MAAM,EAAE,IAAI,CAAC,MAAM;qBACpB,CAAC;iBACH;aACF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC,CAAC;AACJ,CAAC"}

package/dist/temporal/mcpserver/names.d.ts

@@ -0,0 +1,20 @@
+/**
+ * McpServer connect workflow wire identifiers — cross-edition constants
+ * copied character-for-character from Go (connect.go:31-32, 584-586).
+ * Renaming one is a wire protocol break (guidelines §2).
+ */
+/** The runner's connect workflow type (Go connectWorkflowName). */
+export declare const CONNECT_WORKFLOW_NAME = "stigmer/mcp-server/connect";
+/**
+ * The deterministic workflow ID for a server's connect operation (Go
+ * connectWorkflowID). One ID per server (no random suffix) makes Temporal
+ * itself the authority on "is a connect already running": a second start
+ * while one is in flight is refused with WorkflowExecutionAlreadyStarted,
+ * which the lanes turn into attach semantics — concurrent connects share
+ * one discovery run instead of racing duplicate workflows against the
+ * same server. A new run under the same ID is allowed once the previous
+ * one closes (the SDK's default reuse policy), which is what a reconnect
+ * is.
+ */
+export declare function connectWorkflowIdFor(mcpServerId: string): string;
+//# sourceMappingURL=names.d.ts.map

package/dist/temporal/mcpserver/names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"names.d.ts","sourceRoot":"","sources":["../../../src/temporal/mcpserver/names.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,mEAAmE;AACnE,eAAO,MAAM,qBAAqB,+BAA+B,CAAC;AAElE;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEhE"}

package/dist/temporal/mcpserver/names.js

@@ -0,0 +1,22 @@
+/**
+ * McpServer connect workflow wire identifiers — cross-edition constants
+ * copied character-for-character from Go (connect.go:31-32, 584-586).
+ * Renaming one is a wire protocol break (guidelines §2).
+ */
+/** The runner's connect workflow type (Go connectWorkflowName). */
+export const CONNECT_WORKFLOW_NAME = "stigmer/mcp-server/connect";
+/**
+ * The deterministic workflow ID for a server's connect operation (Go
+ * connectWorkflowID). One ID per server (no random suffix) makes Temporal
+ * itself the authority on "is a connect already running": a second start
+ * while one is in flight is refused with WorkflowExecutionAlreadyStarted,
+ * which the lanes turn into attach semantics — concurrent connects share
+ * one discovery run instead of racing duplicate workflows against the
+ * same server. A new run under the same ID is allowed once the previous
+ * one closes (the SDK's default reuse policy), which is what a reconnect
+ * is.
+ */
+export function connectWorkflowIdFor(mcpServerId) {
+    return `${CONNECT_WORKFLOW_NAME}/${mcpServerId}`;
+}
+//# sourceMappingURL=names.js.map

package/dist/temporal/mcpserver/names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"names.js","sourceRoot":"","sources":["../../../src/temporal/mcpserver/names.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,mEAAmE;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AAElE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,OAAO,GAAG,qBAAqB,IAAI,WAAW,EAAE,CAAC;AACnD,CAAC"}

package/dist/temporal/payload-codec.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Decode-only Temporal payload codec — ports
+ * pkg/encryption/payloadcodec (Go DecryptionCodec; stigmer-cloud#227,
+ * stigmer#398).
+ *
+ * The runner encrypts its Temporal payloads (activity results, workflow
+ * results) under STIGMER_PAYLOAD_ENCRYPTION_KEY. The server must DECRYPT
+ * those payloads when it reads them — but its own payloads (workflow
+ * inputs, signals, its activities' results) stay plaintext, so encode is
+ * the identity. Installing the codec on the client at dial time is the
+ * single choke point that covers every worker and every client-side read,
+ * exactly the Go shape (temporal_manager.go dialTemporal).
+ *
+ * @stigmer/temporal-codecs exports only the SYMMETRIC EncryptionPayloadCodec
+ * (the runner encrypts with it). This wrapper delegates decode to it and
+ * passes encode through untouched — the decode path only ever consults the
+ * codec's accepted-keys set, so a symmetric inner codec is safe to hold.
+ * Ratified decision (sub-project 20260824.03 plan, brief #1): a server-local
+ * wrapper mirrors Go's server-local DecryptionCodec; the published lib stays
+ * untouched.
+ *
+ * Enabled-iff-configured: no key in the environment means the codec is not
+ * installed at all; a present-but-malformed key is a boot error (an operator
+ * who set the key intended runner history to be encrypted — failing on the
+ * first runner payload read would be strictly worse than failing the boot).
+ */
+import type { Payload, PayloadCodec } from "@temporalio/common";
+import { EncryptionPayloadCodec } from "@stigmer/temporal-codecs";
+import type { PayloadKeyResolver } from "@stigmer/temporal-codecs";
+export declare class ServerDecryptionPayloadCodec implements PayloadCodec {
+    private readonly inner;
+    constructor(inner: EncryptionPayloadCodec);
+    /**
+     * Identity: the server never encrypts its own payloads, so its workflow
+     * histories stay readable in the Temporal UI (Go DecryptionCodec.Encode).
+     */
+    encode(payloads: Payload[]): Promise<Payload[]>;
+    /**
+     * Delegates to the shared codec: payloads the runner encrypted are
+     * decrypted (unknown/missing key ids and tampering fail closed);
+     * payloads nobody encrypted pass through untouched.
+     */
+    decode(payloads: Payload[]): Promise<Payload[]>;
+}
+/**
+ * Loads the server's payload codecs from the environment.
+ *
+ * Returns [] when payload encryption is not configured — the caller then
+ * installs no dataConverter, matching Go's "codec not installed" posture.
+ * Reads process.env directly (no injectable env): the lib's SecretReader
+ * seam exists for the runner's boot-capture credential custody
+ * (stigmer#508 — agent shells inherit its process env), but the lib reads
+ * the *_KEY_ID companions from process.env unconditionally, so a partial
+ * env override here would be honored for values and ignored for ids — a
+ * trap. The server runs no agent shells; plain env reads are its custody
+ * policy, the same source Go's LoadConfigFromEnv reads.
+ *
+ * The optional resolver is the composed credential provider's
+ * resolvePayloadKey capability (C4 Stage 2): decrypt-only fallback for
+ * key ids outside the env pair — the server-managed per-identity `rpk_`
+ * keys desktop runners encrypt under. Deliberate coupling, named: the
+ * resolver rides the env-keyed codec, so it is consulted only when
+ * payload encryption is configured at all (the cloud composition always
+ * configures the platform key; an env-less deployment has no encrypted
+ * histories of its own to decode).
+ *
+ * @throws when a key is present but malformed or missing its id (boot
+ *   error, never a silent plaintext downgrade).
+ */
+export declare function loadServerPayloadCodecs(resolveKey?: PayloadKeyResolver): PayloadCodec[];
+//# sourceMappingURL=payload-codec.d.ts.map

package/dist/temporal/payload-codec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-codec.d.ts","sourceRoot":"","sources":["../../src/temporal/payload-codec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EACL,sBAAsB,EAEvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,qBAAa,4BAA6B,YAAW,YAAY;IACnD,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,sBAAsB;IAE1D;;;OAGG;IACG,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAIrD;;;;OAIG;IACG,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;CAGtD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,CAAC,EAAE,kBAAkB,GAC9B,YAAY,EAAE,CAUhB"}

package/dist/temporal/payload-codec.js

@@ -0,0 +1,57 @@
+import { EncryptionPayloadCodec, loadPayloadEncryptionConfig, } from "@stigmer/temporal-codecs";
+export class ServerDecryptionPayloadCodec {
+    inner;
+    constructor(inner) {
+        this.inner = inner;
+    }
+    /**
+     * Identity: the server never encrypts its own payloads, so its workflow
+     * histories stay readable in the Temporal UI (Go DecryptionCodec.Encode).
+     */
+    async encode(payloads) {
+        return payloads;
+    }
+    /**
+     * Delegates to the shared codec: payloads the runner encrypted are
+     * decrypted (unknown/missing key ids and tampering fail closed);
+     * payloads nobody encrypted pass through untouched.
+     */
+    async decode(payloads) {
+        return this.inner.decode(payloads);
+    }
+}
+/**
+ * Loads the server's payload codecs from the environment.
+ *
+ * Returns [] when payload encryption is not configured — the caller then
+ * installs no dataConverter, matching Go's "codec not installed" posture.
+ * Reads process.env directly (no injectable env): the lib's SecretReader
+ * seam exists for the runner's boot-capture credential custody
+ * (stigmer#508 — agent shells inherit its process env), but the lib reads
+ * the *_KEY_ID companions from process.env unconditionally, so a partial
+ * env override here would be honored for values and ignored for ids — a
+ * trap. The server runs no agent shells; plain env reads are its custody
+ * policy, the same source Go's LoadConfigFromEnv reads.
+ *
+ * The optional resolver is the composed credential provider's
+ * resolvePayloadKey capability (C4 Stage 2): decrypt-only fallback for
+ * key ids outside the env pair — the server-managed per-identity `rpk_`
+ * keys desktop runners encrypt under. Deliberate coupling, named: the
+ * resolver rides the env-keyed codec, so it is consulted only when
+ * payload encryption is configured at all (the cloud composition always
+ * configures the platform key; an env-less deployment has no encrypted
+ * histories of its own to decode).
+ *
+ * @throws when a key is present but malformed or missing its id (boot
+ *   error, never a silent plaintext downgrade).
+ */
+export function loadServerPayloadCodecs(resolveKey) {
+    const config = loadPayloadEncryptionConfig((name) => process.env[name]);
+    if (config === undefined) {
+        return [];
+    }
+    return [
+        new ServerDecryptionPayloadCodec(new EncryptionPayloadCodec({ ...config, resolveKey })),
+    ];
+}
+//# sourceMappingURL=payload-codec.js.map

package/dist/temporal/payload-codec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-codec.js","sourceRoot":"","sources":["../../src/temporal/payload-codec.ts"],"names":[],"mappings":"AA2BA,OAAO,EACL,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAGlC,MAAM,OAAO,4BAA4B;IACV;IAA7B,YAA6B,KAA6B;QAA7B,UAAK,GAAL,KAAK,CAAwB;IAAG,CAAC;IAE9D;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,QAAmB;QAC9B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,QAAmB;QAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAA+B;IAE/B,MAAM,MAAM,GAAG,2BAA2B,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACxE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO;QACL,IAAI,4BAA4B,CAC9B,IAAI,sBAAsB,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,CAAC,CACtD;KACF,CAAC;AACJ,CAAC"}

package/dist/temporal/runner-failure.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The honest status.error copy for a worker-shutdown-interrupted turn.
+ * Byte-identical to the copy the runner persists from its own shutdown
+ * branches and to the Go/Java mapping, so every downstream status.error
+ * consumer keys on one string (Go runnerfailure.WorkerShutdownStatusError).
+ */
+export declare const WORKER_SHUTDOWN_STATUS_ERROR = "Execution interrupted: runner worker was shut down. Retry or resume.";
+/**
+ * Whether err (anywhere in its cause chain) carries a runner
+ * worker-shutdown shape (Go runnerfailure.IsWorkerShutdown).
+ */
+export declare function isWorkerShutdown(err: unknown): boolean;
+//# sourceMappingURL=runner-failure.d.ts.map

package/dist/temporal/runner-failure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-failure.d.ts","sourceRoot":"","sources":["../../src/temporal/runner-failure.ts"],"names":[],"mappings":"AAiCA;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,yEAC+B,CAAC;AAMzE;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAoBtD"}

package/dist/temporal/runner-failure.js

@@ -0,0 +1,65 @@
+/**
+ * Runner-failure classification at the polyglot Temporal boundary — ports
+ * pkg/runnerfailure (issue #776).
+ *
+ * "The runner's worker was shut down mid-activity" has no typed
+ * representation across the Temporal boundary; it arrives as one of two
+ * message shapes:
+ *
+ *   1. the activity's OWN classification, thrown as a cancelled failure
+ *      ("Activity cancelled (worker shutdown, not user pause)" — the
+ *      runner's execute-cursor/execute-deep-agent shutdown branches); and
+ *   2. the Temporal TS worker's drain failing an activity that could not
+ *      finish inside the shutdown grace window ("Worker is shutting down
+ *      and this activity did not complete in time") — the shape observed
+ *      live in the 2026-08-08 incident.
+ *
+ * Both mean the same thing: infrastructure interrupted the turn; the user
+ * did nothing. Recognizing them in ONE place keeps two behaviors
+ * consistent across the agentexecution (#18) and workflowexecution (#21)
+ * workflows: status.error carries the honest platform-failure copy
+ * instead of raw Temporal internals, and the interruption is treated as
+ * recoverable by the bounded recovery loop (owner ruling on #776).
+ *
+ * Cancelled failures are matched loosely (their messages are
+ * runner-authored, never agent/tool output); everything else must carry
+ * the distinctive drain phrase. Deliberately the same shapes the Go and
+ * Java control planes match.
+ *
+ * Bundle-safe: only @temporalio/common failure classes (workflow-sandbox
+ * legal), imported by workflow code.
+ */
+import { CancelledFailure, ApplicationFailure } from "@temporalio/common";
+/**
+ * The honest status.error copy for a worker-shutdown-interrupted turn.
+ * Byte-identical to the copy the runner persists from its own shutdown
+ * branches and to the Go/Java mapping, so every downstream status.error
+ * consumer keys on one string (Go runnerfailure.WorkerShutdownStatusError).
+ */
+export const WORKER_SHUTDOWN_STATUS_ERROR = "Execution interrupted: runner worker was shut down. Retry or resume.";
+const CANCELED_MARKERS = ["worker shutdown", "shutting down"];
+const DRAIN_MARKER = "worker is shutting down";
+/**
+ * Whether err (anywhere in its cause chain) carries a runner
+ * worker-shutdown shape (Go runnerfailure.IsWorkerShutdown).
+ */
+export function isWorkerShutdown(err) {
+    for (let e = err; e instanceof Error; e = e.cause) {
+        const lower = e.message.toLowerCase();
+        if (e instanceof CancelledFailure) {
+            if (CANCELED_MARKERS.some((marker) => lower.includes(marker))) {
+                return true;
+            }
+        }
+        else if (e instanceof ApplicationFailure) {
+            if (lower.includes(DRAIN_MARKER)) {
+                return true;
+            }
+        }
+        else if (lower.includes(DRAIN_MARKER)) {
+            return true;
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=runner-failure.js.map

package/dist/temporal/runner-failure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-failure.js","sourceRoot":"","sources":["../../src/temporal/runner-failure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GACvC,sEAAsE,CAAC;AAEzE,MAAM,gBAAgB,GAAG,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC;AAE9D,MAAM,YAAY,GAAG,yBAAyB,CAAC;AAE/C;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,KACE,IAAI,CAAC,GAAY,GAAG,EACpB,CAAC,YAAY,KAAK,EAClB,CAAC,GAAI,CAAyB,CAAC,KAAK,EACpC,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACtC,IAAI,CAAC,YAAY,gBAAgB,EAAE,CAAC;YAClC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC9D,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,YAAY,kBAAkB,EAAE,CAAC;YAC3C,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBACjC,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/temporal/schedule/activities.d.ts

@@ -0,0 +1,22 @@
+import type { Logger } from "../../boot/logger.js";
+import type { Store } from "../../store/interface.js";
+import type { ScheduleTemporalConfig } from "./config.js";
+import { type ScheduleTickActivities } from "./names.js";
+import type { RunStarter } from "./run-starter.js";
+import type { ScheduleSyncer } from "./syncer.js";
+export interface ScheduleTickActivityDeps {
+    readonly store: Store;
+    readonly config: ScheduleTemporalConfig;
+    /**
+     * The narrow syncer slice the activities call (satisfied by
+     * ScheduleSyncer): the next-fire refresh on record-tick and the
+     * best-effort artifact re-sync at the pause-threshold crossing.
+     */
+    readonly syncer: Pick<ScheduleSyncer, "peekNextFireAt" | "ensureAndRecord">;
+    /** The fire edge (satisfied by RunStarter). */
+    readonly runStarter: Pick<RunStarter, "startRun">;
+    readonly logger: Logger;
+}
+/** Wires the activity implementations (Go NewTickActivities). */
+export declare function createScheduleTickActivities(deps: ScheduleTickActivityDeps): ScheduleTickActivities;
+//# sourceMappingURL=activities.d.ts.map

package/dist/temporal/schedule/activities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activities.d.ts","sourceRoot":"","sources":["../../../src/temporal/schedule/activities.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EA4BL,KAAK,sBAAsB,EAE5B,MAAM,YAAY,CAAC;AASpB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGlD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,GAAG,iBAAiB,CAAC,CAAC;IAC5E,+CAA+C;IAC/C,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,iEAAiE;AACjE,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,wBAAwB,GAC7B,sBAAsB,CAexB"}