@stigmer/server 3.30.0 → 3.31.0

package/src/domain/oauthapp/__tests__/oauthapp.test.ts

@@ -11,15 +11,17 @@
  *     ciphertext (no double encryption);
  *   - the keyless WARN-degrade path stores plaintext yet still redacts on
  *     read, and the enc:v<N>: shape rejection stays UNCONDITIONAL (oss#395);
- *   - the delete RPC returns the STORED secret unredacted — Go behavior
- *     ported byte-faithfully (delete is absent from RedactOAuthApp's
- *     response list) and disclosed in the PR;
+ *   - the delete RPC answers the removed app REDACTED, never the stored
+ *     secret: not the ciphertext on a keyed server, not the plaintext on
+ *     a keyless one (stigmer/stigmer#1257; the Go port returned it);
  *   - the referential delete guard's resolution semantics (stigmer#584),
  *     proven by seeding McpServer rows directly through the store — the
  *     McpServer RPC surface belongs to #9 and is not required here.
  *
  * Keys are injected via env (vi.stubEnv) so the ladder short-circuits
- * before its file steps — the real ~/.stigmer is never touched.
+ * before its file steps — the real ~/.stigmer is never touched. Who may
+ * read or list an app is the enforcing lane's conformance suite's
+ * (role-enforcement.conformance.test.ts).
  */
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -50,7 +52,7 @@ import {
   REDACTED_MARKER,
   deleteBlockedByMcpServerMessage,
 } from "../constants.js";
-import { resolveOAuthAppRef } from "../refresolution/refresolution.js";
+import { resolveOAuthAppRef } from "../refresolution.js";
 
 const silentLogger = createLogger({ level: "error", pretty: false, write: () => {} });
 
@@ -285,14 +287,12 @@ describe("oauthapp domain (encryption enabled)", () => {
     expect(listed.entries[1]?.metadata?.id).toBe(first.metadata?.id);
   });
 
-  it("delete returns the STORED resource unredacted — the ported Go behavior (disclosed)", async () => {
+  it("delete answers the removed app redacted — never the stored ciphertext", async () => {
     const created = await ts.command.create(appInput());
     const deleted = await ts.command.delete({ resourceId: created.metadata!.id });
 
-    // Go's delete path never calls RedactOAuthApp: the response carries the
-    // stored ciphertext (plaintext on a keyless server). Pinned so the
-    // faithful port cannot silently "fix" the divergence candidate.
-    expect(deleted.spec?.clientSecret.startsWith(ENCRYPTED_PREFIX)).toBe(true);
+    expect(deleted.metadata?.id).toBe(created.metadata?.id);
+    expect(deleted.spec?.clientSecret).toBe(REDACTED_MARKER);
 
     const err = await grpcError(() => ts.query.get({ value: created.metadata!.id }));
     expect(err.code).toBe(Code.NotFound);
@@ -405,6 +405,13 @@ describe("oauthapp domain (encryption disabled)", () => {
     expect(stored.spec?.clientSecret).toBe("test-client-secret");
   });
 
+  it("delete answers the removed app redacted — never the stored plaintext", async () => {
+    const created = await ts.command.create(appInput());
+    const deleted = await ts.command.delete({ resourceId: created.metadata!.id });
+
+    expect(deleted.spec?.clientSecret).toBe(REDACTED_MARKER);
+  });
+
   it("still rejects ciphertext-shaped secrets — the oss#395 boundary is not gated on key state", async () => {
     const err = await grpcError(() =>
       ts.command.create(appInput({ clientSecret: "enc:v1:c211Z2dsZWQ=" })),

package/src/domain/oauthapp/controller.ts

@@ -12,15 +12,20 @@
  * The secret contract: client_secret is AES-256-GCM encrypted at rest via
  * the SAME SecretService instance the Environment controller uses (Go
  * wires one service for both), and redacted to ***REDACTED*** on every
- * read surface; the marker round-trips on update/apply as "keep the stored
- * secret"; client-supplied enc:v<N>:-shaped values are refused on every
- * write door (oss#395). Deletion is blocked while an McpServer's
- * oauth_app_ref resolves to the app (stigmer/stigmer#584).
+ * response, the delete's included; the marker round-trips on update/apply
+ * as "keep the stored secret"; client-supplied enc:v<N>:-shaped values are
+ * refused on every write door (oss#395). Deletion is blocked while an
+ * McpServer's oauth_app_ref resolves to the app (stigmer/stigmer#584).
  *
- * Versus Stigmer Cloud, OSS excludes the Authorize, CreateIamPolicies, and
- * Publish steps (no multi-tenant auth, IAM/FGA, or event publishing), and
- * OAuthApp is deliberately not search-indexed (a configuration resource;
- * `not_search_indexed` in the kind registry).
+ * Every chain opens with Authorize; create and delete run the shared
+ * tuple-lifecycle steps against the composed lifecycle; getByReference
+ * loads, then authorizes the loaded app exactly as `get` would
+ * (AuthorizeResolvedTarget); listByOrg narrows through the list read
+ * scope, so a caller who may not `get` an app does not see it listed
+ * either: the model shows an app to its creator and the organization's
+ * admins, never to members or viewers (fga/model/iam/oauth_app.fga,
+ * stigmer/stigmer#1257). OAuthApp is deliberately not search-indexed (a
+ * configuration resource; `not_search_indexed` in the kind registry).
  */
 import type { ConnectRouter, HandlerContext } from "@connectrpc/connect";
 import { create, fromBinary } from "@bufbuild/protobuf";
@@ -43,6 +48,8 @@ import { OAuthAppQueryController } from "@stigmer/protos/ai/stigmer/iam/oauthapp
 
 import type { Logger } from "../../boot/logger.js";
 import type { Authorizer } from "../../extensions/authorizer.js";
+import type { ListReadScope } from "../../extensions/list-read-scope.js";
+import { restrictListByReadScope } from "../../extensions/list-read-scope.js";
 import type { ResourceAuthorizationLifecycle } from "../../extensions/resource-authorization.js";
 import type { SecretService } from "../../encryption/encryption.js";
 import { internalError } from "../../pipeline/errors.js";
@@ -105,6 +112,8 @@ export interface OAuthAppControllerDeps {
   readonly authorizer: Authorizer;
   /** The composed tuple-lifecycle driver — undefined = the shared steps no-op (C2). */
   readonly authorizationLifecycle: ResourceAuthorizationLifecycle | undefined;
+  /** The composed list read scope — listByOrg narrows through it; undefined = the OSS full scan (stigmer/stigmer#1257). */
+  readonly listReadScope: ListReadScope | undefined;
 }
 
 /** Registers both OAuthApp services on the router (routes stage). */
@@ -261,8 +270,10 @@ async function apply(
  * between load and delete. The RESOURCE_ID_KEY is set manually because
  * ApiResourceDeleteInput carries resourceId, not the value field
  * ExtractResourceId expects (the environment-domain pattern). Returns the
- * deleted resource for the audit trail — unredacted, exactly as Go does
- * (see redactOAuthApp's header for the disclosure).
+ * deleted app for the audit trail, redacted like every other response (the
+ * ChannelApp and Environment delete shape): the chain has already
+ * destroyed the sealed secret, so the stored value could only leak
+ * (stigmer/stigmer#1257).
  */
 async function deleteOAuthApp(
   deps: OAuthAppControllerDeps,
@@ -311,7 +322,9 @@ async function deleteOAuthApp(
       "deleted OAuthApp not found in context",
     );
   }
-  return deleted as OAuthApp;
+  const app = deleted as OAuthApp;
+  redactOAuthApp(app);
+  return app;
 }
 
 /** Get — LoadTarget by id, then redact (Go buildGetPipeline). */
@@ -382,9 +395,11 @@ async function getByReference(
 const LIST_RESULT_KEY = "listResult";
 
 /**
- * ListByOrg — all OAuthApps whose metadata.org matches, each redacted,
- * sorted created_at descending (Go listByOrgStep). No pagination:
- * typically 1–5 per org. No authorization filtering in OSS.
+ * ListByOrg — the organization's OAuthApps the caller may view, each
+ * redacted, sorted created_at descending (Go listByOrgStep). No
+ * pagination: typically 1–5 per org. The annotation admits anyone who can
+ * view the organization; the list read scope then keeps only the apps a
+ * `get` would return (stigmer/stigmer#1257).
  */
 async function listByOrg(
   deps: OAuthAppControllerDeps,
@@ -408,7 +423,7 @@ async function listByOrg(
       ),
     )
     .addStep(newValidateProtoStep())
-    .addStep(newListByOrgStep(deps.store, deps.logger))
+    .addStep(newListByOrgStep(deps.store, deps.listReadScope, deps.logger))
     .build()
     .execute(reqCtx);
 
@@ -422,9 +437,17 @@ async function listByOrg(
   return list as OAuthApps;
 }
 
-/** The domain-local list step: load all, filter by org, redact, sort. */
+/**
+ * The domain-local list step: load all, keep the request's org, narrow to
+ * the caller's apps, redact, sort. The org predicate stays the step's own
+ * because with no scope composed the helper returns its input unchanged
+ * and never reads the org (the trusted-local full scan); with one, the
+ * scope is the last per-row predicate, so a composed driver is asked about
+ * the org's apps, never every tenant's (the environment list's order).
+ */
 function newListByOrgStep(
   store: Store,
+  listReadScope: ListReadScope | undefined,
   logger: Logger,
 ): PipelineStep<typeof OAuthAppQueryController.method.listByOrg.input> {
   return {
@@ -443,7 +466,7 @@ function newListByOrgStep(
         throw internalError(error, "failed to list OAuthApps");
       }
 
-      const apps: OAuthApp[] = [];
+      const requested: OAuthApp[] = [];
       for (const data of resources) {
         let app: OAuthApp;
         try {
@@ -457,8 +480,18 @@ function newListByOrgStep(
         if ((app.metadata?.org ?? "") !== org) {
           continue;
         }
+        requested.push(app);
+      }
+
+      const apps = await restrictListByReadScope(
+        listReadScope,
+        ctx.callerIdentity,
+        ApiResourceKind.oauth_app,
+        requested,
+        "",
+      );
+      for (const app of apps) {
         redactOAuthApp(app);
-        apps.push(app);
       }
 
       apps.sort((a, b) =>

package/src/domain/oauthapp/refresolution.ts

@@ -7,8 +7,9 @@
  * answers): the read-path oauth_status enricher (mcpserver, #9), the
  * OAuth initiate and token-refresh paths (#19 — refresh MUST use the app
  * initiate selected or it runs against the wrong vendor credentials), and
- * the OAuthApp delete guard (#13). This file seeds src/domain/oauthapp/;
- * the domain's controllers arrive with #13.
+ * the OAuthApp delete guard (#13). Every consumer imports it from here,
+ * so there is one ladder to change (stigmer/stigmer#1173 removed a
+ * second copy the delete guard had read).
  *
  * Resolution semantics: OSS has a flat OAuthApp store — no org-override
  * chain like the cloud's OAuthAppResolutionService, so the ref is the

package/src/domain/oauthapp/steps.ts

@@ -33,18 +33,18 @@ import {
   REDACTED_MARKER,
   deleteBlockedByMcpServerMessage,
 } from "./constants.js";
-import { resolveOAuthAppRef } from "./refresolution/refresolution.js";
+import { resolveOAuthAppRef } from "./refresolution.js";
 
 /**
  * Replaces client_secret with the redaction marker (Go RedactOAuthApp).
  *
  * A function rather than a pipeline step because redaction applies at
  * different points per operation: create/update after persist on newState;
- * get/getByReference after load on the target; listByOrg per entry. Go's
- * response list deliberately excludes DELETE — the delete RPC returns the
- * STORED resource with its encrypted secret intact, ported byte-faithfully
- * and disclosed in the PR (a cross-edition follow-up candidate: with
- * encryption disabled the stored value is plaintext).
+ * get/getByReference after load on the target; listByOrg per entry; delete
+ * on the removed row after its chain. Every response is redacted, the
+ * delete's included: the Go port returned the stored secret from delete —
+ * ciphertext, or plaintext on a keyless server — which no reader needs
+ * once the chain has destroyed the sealed value (stigmer/stigmer#1257).
  */
 export function redactOAuthApp(app: OAuthApp): void {
   if (app.spec !== undefined && app.spec.clientSecret !== "") {

package/src/sandbox/__tests__/docker.integration.test.ts

@@ -47,6 +47,8 @@ describe.skipIf(!optedIn || !dockerAnswers())(
       // them (the runner tolerates an unreachable backend at boot).
       backendEndpoint: "http://host.docker.internal:7234",
       temporalAddress: "host.docker.internal:7233",
+      temporalNamespace: "default",
+      temporalConnectionEnv: {},
       runnerImage:
         process.env["STIGMER_SANDBOX_RUNNER_IMAGE"] ??
         "ghcr.io/stigmer/runner:latest",

package/src/sandbox/__tests__/kubernetes.test.ts

@@ -34,6 +34,8 @@ const silentLogger = { info: () => {} };
 const config: SandboxDriverConfig = {
   backendEndpoint: "http://stigmer-server.stigmer.svc:7234",
   temporalAddress: "temporal.stigmer.svc:7233",
+  temporalNamespace: "stigmer",
+  temporalConnectionEnv: {},
   runnerImage: "ghcr.io/stigmer/runner:latest",
   runnerCommand: "stigmer-runner",
   kubernetesNamespace: "stigmer-sandboxes",
@@ -205,6 +207,7 @@ describe("the manifest shapes (the Java SandboxManifestFactory pins)", () => {
     expect(envByName.get("TEMPORAL_SERVICE_ADDRESS")?.value).toBe(
       config.temporalAddress,
     );
+    expect(envByName.get("TEMPORAL_NAMESPACE")?.value).toBe("stigmer");
     expect(envByName.get("WORKSPACE_ROOT_DIR")?.value).toBe("/workspace");
     expect(envByName.get("STIGMER_TOKEN")?.valueFrom?.secretKeyRef?.name).toBe(
       `${sandboxBaseName("session", "ses_1")}-env`,
@@ -233,4 +236,28 @@ describe("the manifest shapes (the Java SandboxManifestFactory pins)", () => {
     const secret = buildSandboxSecret("session", "ses_1", "");
     expect(secret.stringData).toEqual({});
   });
+
+  it("an authenticated Temporal's settings live in the Secret and are only named by the Deployment", () => {
+    const connectionEnv = {
+      STIGMER_TEMPORAL_TLS: "true",
+      STIGMER_TEMPORAL_API_KEY: "api-key-1",
+      STIGMER_TEMPORAL_TLS_SERVER_CA_CERT_DATA: "-----BEGIN CERTIFICATE-----\nca\n-----END CERTIFICATE-----\n",
+    };
+    const authenticated = { ...config, temporalConnectionEnv: connectionEnv };
+    const env = { taskQueue: "session:ses_1", stigmerToken: "tok", callerClass: "user" };
+
+    const secret = buildSandboxSecret("session", "ses_1", "tok", connectionEnv);
+    expect(secret.stringData).toEqual({ ...connectionEnv, STIGMER_TOKEN: "tok" });
+
+    const container = buildSandboxDeployment("session", "ses_1", env, authenticated).spec?.template.spec
+      ?.containers[0];
+    for (const name of Object.keys(connectionEnv)) {
+      const entry = (container?.env ?? []).find((candidate) => candidate.name === name);
+      expect(entry?.value, `${name} must not be a plain manifest value`).toBeUndefined();
+      expect(entry?.valueFrom?.secretKeyRef).toEqual({
+        name: `${sandboxBaseName("session", "ses_1")}-env`,
+        key: name,
+      });
+    }
+  });
 });

package/src/sandbox/__tests__/local-process.integration.test.ts

@@ -54,6 +54,8 @@ describe.skipIf(process.platform === "win32")(
     const config: SandboxDriverConfig = {
       backendEndpoint: "http://127.0.0.1:7234",
       temporalAddress: "127.0.0.1:7233",
+      temporalNamespace: "stigmer-smoke",
+      temporalConnectionEnv: { STIGMER_TEMPORAL_TLS: "true", STIGMER_TEMPORAL_API_KEY: "k-smoke" },
       runnerImage: "unused-by-this-driver",
       runnerCommand: script,
       kubernetesNamespace: "unused-by-this-driver",
@@ -78,6 +80,9 @@ describe.skipIf(process.platform === "win32")(
     }
 
     it("ensure spawns once, injects the runner env contract, and is idempotent", async () => {
+      // A server configured by path: the child must get the rendered
+      // settings only, never the inherited _PATH item beside them.
+      process.env["STIGMER_TEMPORAL_TLS_SERVER_CA_CERT_PATH"] = "/etc/inherited-ca.pem";
       await driver.ensureSessionSandbox("ses_smoke", {
         taskQueue: "session:ses_smoke",
         stigmerToken: "tok-smoke",
@@ -111,6 +116,11 @@ describe.skipIf(process.platform === "win32")(
         `TEMPORAL_SERVICE_ADDRESS=${config.temporalAddress}`,
       );
       expect(dump).toMatch(/WORKSPACE_ROOT_DIR=.+session-ses_smoke/);
+      expect(dump).toContain("TEMPORAL_NAMESPACE=stigmer-smoke");
+      expect(dump).toContain("STIGMER_TEMPORAL_TLS=true");
+      expect(dump).toContain("STIGMER_TEMPORAL_API_KEY=k-smoke");
+      expect(dump).not.toContain("STIGMER_TEMPORAL_TLS_SERVER_CA_CERT_PATH");
+      delete process.env["STIGMER_TEMPORAL_TLS_SERVER_CA_CERT_PATH"];
     });
 
     it("deprovision kills the child; probe reports absent; re-ensure respawns", async () => {

package/src/sandbox/__tests__/provisioner.test.ts

@@ -34,6 +34,8 @@ const silentLogger = createLogger({
 const driverConfig: SandboxDriverConfig = {
   backendEndpoint: "http://host.docker.internal:7234",
   temporalAddress: "host.docker.internal:7233",
+  temporalNamespace: "default",
+  temporalConnectionEnv: {},
   runnerImage: "ghcr.io/stigmer/runner:latest",
   runnerCommand: "stigmer-runner",
   kubernetesNamespace: "stigmer-sandboxes",

package/src/sandbox/docker.ts

@@ -142,14 +142,20 @@ export const newDockerSandboxProvisioner: SandboxProvisionerFactory = ({
       "--env",
       `TEMPORAL_SERVICE_ADDRESS=${config.temporalAddress}`,
       "--env",
+      `TEMPORAL_NAMESPACE=${config.temporalNamespace}`,
+      "--env",
       `WORKSPACE_ROOT_DIR=${CONTAINER_WORKSPACE_DIR}`,
     ];
+    // Value-less --env inherits from the CLI's environment (module header:
+    // the token must never appear in argv). The Temporal connection
+    // settings ride the same channel: they carry credentials, and PEM text
+    // does not belong on a command line.
+    const secretEnv: Record<string, string> = { ...config.temporalConnectionEnv };
+    if (env.stigmerToken !== "") secretEnv["STIGMER_TOKEN"] = env.stigmerToken;
     let runEnv: NodeJS.ProcessEnv | undefined;
-    if (env.stigmerToken !== "") {
-      // Value-less --env inherits from the CLI's environment (module
-      // header: the token must never appear in argv).
-      runArgs.push("--env", "STIGMER_TOKEN");
-      runEnv = { ...process.env, STIGMER_TOKEN: env.stigmerToken };
+    if (Object.keys(secretEnv).length > 0) {
+      for (const name of Object.keys(secretEnv)) runArgs.push("--env", name);
+      runEnv = { ...process.env, ...secretEnv };
     }
     runArgs.push(config.runnerImage, ...RUNNER_CONTAINER_COMMAND);
     await docker(runArgs, runEnv);

package/src/sandbox/kubernetes.ts

@@ -6,7 +6,8 @@
  * @kubernetes/client-node, the official client — this driver is the one
  * the cloud composition will eventually run in production, C4).
  *
- * Each sandbox = a per-sandbox Secret (STIGMER_TOKEN) + a single-replica
+ * Each sandbox = a per-sandbox Secret (STIGMER_TOKEN, plus the Temporal
+ * connection settings when the server's Temporal is authenticated) + a single-replica
  * Deployment (strategy Recreate) + a PVC-backed /workspace for the
  * persistent scopes (session, workflow — the Java persistent-scope
  * split; connect rides emptyDir). One shared namespace, never
@@ -255,6 +256,7 @@ export function buildSandboxSecret(
   scope: SandboxScope,
   id: string,
   stigmerToken: string,
+  temporalConnectionEnv: Readonly<Record<string, string>> = {},
 ): V1Secret {
   return {
     metadata: {
@@ -264,7 +266,10 @@ export function buildSandboxSecret(
     type: "Opaque",
     // A token-less sandbox still gets its (empty) Secret — the object
     // must exist for uniform cleanup (the Java posture).
-    stringData: stigmerToken !== "" ? { STIGMER_TOKEN: stigmerToken } : {},
+    stringData: {
+      ...temporalConnectionEnv,
+      ...(stigmerToken !== "" ? { STIGMER_TOKEN: stigmerToken } : {}),
+    },
   };
 }
 
@@ -308,6 +313,7 @@ export function buildSandboxDeployment(
     { name: "STIGMER_TASK_QUEUE", value: env.taskQueue },
     { name: "STIGMER_BACKEND_ENDPOINT", value: config.backendEndpoint },
     { name: "TEMPORAL_SERVICE_ADDRESS", value: config.temporalAddress },
+    { name: "TEMPORAL_NAMESPACE", value: config.temporalNamespace },
     { name: "WORKSPACE_ROOT_DIR", value: WORKSPACE_MOUNT_PATH },
   ];
   if (env.stigmerToken !== "") {
@@ -318,6 +324,15 @@ export function buildSandboxDeployment(
       },
     });
   }
+  // The Temporal connection settings sit in the same per-sandbox Secret as
+  // the token (buildSandboxSecret): they carry credentials, so the
+  // Deployment names them and never holds their values.
+  for (const name of Object.keys(config.temporalConnectionEnv)) {
+    containerEnv.push({
+      name,
+      valueFrom: { secretKeyRef: { name: `${baseName}-env`, key: name } },
+    });
+  }
 
   return {
     metadata: { name: baseName, labels },
@@ -417,7 +432,7 @@ export function newKubernetesSandboxProvisionerOverGateway(
       // references it), claim (reused when it survived a repair), then
       // the Deployment. No readiness wait (module header).
       await gateway.applySecret(
-        buildSandboxSecret(scope, id, env.stigmerToken),
+        buildSandboxSecret(scope, id, env.stigmerToken, config.temporalConnectionEnv),
       );
       if (PERSISTENT_SCOPES.has(scope)) {
         await gateway.applyPvc(buildWorkspacePvc(scope, id));

package/src/sandbox/local-process.ts

@@ -33,6 +33,8 @@ import { mkdirSync } from "node:fs";
 import { homedir } from "node:os";
 import path from "node:path";
 
+import { TEMPORAL_CONNECTION_ENV_NAMES } from "@stigmer/temporal-codecs";
+
 import type { Logger } from "../boot/logger.js";
 import type {
   SandboxEnvironment,
@@ -86,10 +88,18 @@ export const newLocalProcessSandboxProvisioner: SandboxProvisionerFactory = ({
     );
     mkdirSync(workspaceRoot, { recursive: true });
 
+    // The server's own Temporal connection settings are replaced by their
+    // rendered form, never inherited beside it: an inherited _PATH item
+    // next to its rendered _DATA twin is a boot refusal in the runner.
+    const inherited = Object.fromEntries(
+      Object.entries(process.env).filter(([name]) => !TEMPORAL_CONNECTION_ENV_NAMES.includes(name)),
+    );
     const childEnv: NodeJS.ProcessEnv = {
-      ...process.env,
+      ...inherited,
+      ...config.temporalConnectionEnv,
       MODE: "local",
       STIGMER_TASK_QUEUE: env.taskQueue,
+      TEMPORAL_NAMESPACE: config.temporalNamespace,
       WORKSPACE_ROOT_DIR: workspaceRoot,
     };
     if (config.backendEndpoint !== "") {

package/src/sandbox/provisioner.ts

@@ -136,6 +136,18 @@ export interface SandboxDriverConfig {
   readonly backendEndpoint: string;
   /** Temporal address as reachable from inside a sandbox (TEMPORAL_SERVICE_ADDRESS). */
   readonly temporalAddress: string;
+  /** The Temporal namespace the sandbox's runner polls in (TEMPORAL_NAMESPACE). */
+  readonly temporalNamespace: string;
+  /**
+   * How the sandbox's runner authenticates to that Temporal: the server's
+   * own `STIGMER_TEMPORAL_*` settings rendered by `temporalConnectionEnv`
+   * (`@stigmer/temporal-codecs`), every PEM item in its `_DATA` form so no
+   * file has to exist inside the sandbox. Empty for a plaintext Temporal.
+   * The values include credentials, so each driver passes them through the
+   * channel it uses for the token, never through argv or a plain manifest
+   * value.
+   */
+  readonly temporalConnectionEnv: Readonly<Record<string, string>>;
   /** The runner image for container-based drivers (docker/kubernetes). */
   readonly runnerImage: string;
   /** The runner executable for the local-process driver. */

package/src/temporal/__tests__/manager.test.ts

@@ -11,6 +11,9 @@
  *     lives forever — latent until #21/#22 add factories);
  *   - the Go availability parity: getClient() is undefined only until
  *     the first successful connect;
+ *   - both connections, the client's and the workers' native one, carry
+ *     the configured connection security (TLS and API key) beside the
+ *     address, and a plaintext manager passes neither;
  *   - deps.createWorker builds through THIS package's Worker.create with
  *     the manager's connection, namespace, and codec chain pre-wired
  *     (the finding-16 seam — factories never see the NativeConnection);
@@ -34,14 +37,34 @@ const sdkSpy = vi.hoisted(() => ({
   createCalls: [] as Record<string, unknown>[],
   /** The connection object the mocked NativeConnection.connect returned last. */
   lastConnection: undefined as unknown,
+  /** Options of every NativeConnection.connect and Connection.connect call. */
+  nativeConnectCalls: [] as Record<string, unknown>[],
+  clientConnectCalls: [] as Record<string, unknown>[],
 }));
 
+vi.mock("@temporalio/client", async (importOriginal) => {
+  const original = await importOriginal<typeof import("@temporalio/client")>();
+  return {
+    ...original,
+    Connection: {
+      connect: async (options: Record<string, unknown>) => {
+        sdkSpy.clientConnectCalls.push(options);
+        return { close: async () => {}, healthService: { check: async () => ({ status: 1 }) } };
+      },
+    },
+    Client: class {
+      constructor(readonly options: Record<string, unknown>) {}
+    },
+  };
+});
+
 vi.mock("@temporalio/worker", async (importOriginal) => {
   const original = await importOriginal<typeof import("@temporalio/worker")>();
   return {
     ...original,
     NativeConnection: {
-      connect: async () => {
+      connect: async (options: Record<string, unknown>) => {
+        sdkSpy.nativeConnectCalls.push(options);
         const connection = { close: async () => {} };
         sdkSpy.lastConnection = connection;
         return connection;
@@ -74,6 +97,8 @@ const managers: TemporalManager[] = [];
 afterEach(async () => {
   sdkSpy.createCalls.length = 0;
   sdkSpy.lastConnection = undefined;
+  sdkSpy.nativeConnectCalls.length = 0;
+  sdkSpy.clientConnectCalls.length = 0;
   for (const manager of managers.splice(0)) {
     await manager.close();
   }
@@ -108,11 +133,13 @@ function newManager(
     payloadCodecs?: ConstructorParameters<
       typeof TemporalManager
     >[0]["payloadCodecs"];
+    connection?: ConstructorParameters<typeof TemporalManager>[0]["connection"];
   },
 ): TemporalManager {
   const manager = new TemporalManager({
     hostPort: "127.0.0.1:1",
     namespace: "default",
+    connection: options?.connection ?? {},
     logger: options?.logger ?? silentLogger,
     payloadCodecs: options?.payloadCodecs ?? [],
     workerFactories: factories,
@@ -283,6 +310,37 @@ describe("TemporalManager createWorker capability (the finding-16 seam)", () =>
   });
 });
 
+describe("TemporalManager connection security", () => {
+  it("spreads TLS and the API key into both the client's and the workers' connections", async () => {
+    const security = {
+      tls: { serverNameOverride: "temporal.internal" },
+      apiKey: "api-key-1",
+    };
+    const manager = newManager([fakeWorkerFactory({ shutdowns: 0 })], {
+      connection: security,
+    });
+
+    await manager.initialConnect();
+    await manager.startWorkers();
+
+    expect(sdkSpy.clientConnectCalls).toHaveLength(1);
+    expect(sdkSpy.clientConnectCalls[0]).toMatchObject({ address: "127.0.0.1:1", ...security });
+    expect(sdkSpy.nativeConnectCalls).toHaveLength(1);
+    expect(sdkSpy.nativeConnectCalls[0]).toEqual({ address: "127.0.0.1:1", ...security });
+  });
+
+  it("passes neither for a plaintext manager", async () => {
+    const manager = newManager([fakeWorkerFactory({ shutdowns: 0 })]);
+
+    await manager.initialConnect();
+    await manager.startWorkers();
+
+    expect(sdkSpy.clientConnectCalls[0]).not.toHaveProperty("tls");
+    expect(sdkSpy.clientConnectCalls[0]).not.toHaveProperty("apiKey");
+    expect(sdkSpy.nativeConnectCalls[0]).toEqual({ address: "127.0.0.1:1" });
+  });
+});
+
 describe("TemporalManager worker-death observability", () => {
   it("logs a run() rejection at ERROR with the dead worker's queue identity", async () => {
     const lines: string[] = [];

package/src/temporal/manager.ts

@@ -32,6 +32,12 @@
  * connection errors exactly as Go's stale-client operations do, and the
  * health monitor swaps in a fresh client when the server returns.
  *
+ * One choke point for connection security: `connection` (TLS, mutual TLS,
+ * an API key; `@stigmer/temporal-codecs`' `loadTemporalConnectionConfig`)
+ * is spread into BOTH connects, the client's and the workers' native one,
+ * so every worker, OSS and extension alike, authenticates the same way
+ * through createWorker. Absent settings keep the plaintext connection.
+ *
  * One choke point for payload decryption: the codecs are installed on the
  * client at dial AND wired into every worker by the deps' createWorker
  * capability (the TS SDK's Worker.create takes its own dataConverter; Go
@@ -40,6 +46,7 @@
  */
 import { Client, Connection } from "@temporalio/client";
 import type { PayloadCodec } from "@temporalio/common";
+import type { TemporalConnectionConfig } from "@stigmer/temporal-codecs";
 import {
   NativeConnection,
   Worker,
@@ -150,6 +157,8 @@ export type WorkerFactory = (deps: WorkerFactoryDeps) => Promise<Worker>;
 export interface TemporalManagerOptions {
   readonly hostPort: string;
   readonly namespace: string;
+  /** TLS and API key for both connections; `{}` for plaintext. */
+  readonly connection: TemporalConnectionConfig;
   readonly logger: Logger;
   readonly payloadCodecs: PayloadCodec[];
   readonly workerFactories: readonly WorkerFactory[];
@@ -163,6 +172,7 @@ interface RunningWorker {
 export class TemporalManager {
   private readonly hostPort: string;
   private readonly namespace: string;
+  private readonly connectionSecurity: TemporalConnectionConfig;
   private readonly logger: Logger;
   private readonly payloadCodecs: PayloadCodec[];
   private readonly workerFactories: readonly WorkerFactory[];
@@ -184,6 +194,7 @@ export class TemporalManager {
   constructor(options: TemporalManagerOptions) {
     this.hostPort = options.hostPort;
     this.namespace = options.namespace;
+    this.connectionSecurity = options.connection;
     this.logger = options.logger;
     this.payloadCodecs = options.payloadCodecs;
     this.workerFactories = options.workerFactories;
@@ -328,6 +339,7 @@ export class TemporalManager {
     const connection = await Connection.connect({
       address: this.hostPort,
       connectTimeout: DIAL_CONNECT_TIMEOUT_MS,
+      ...this.connectionSecurity,
     });
     const client = new Client({
       connection,
@@ -494,6 +506,7 @@ export class TemporalManager {
   private async createAndRunWorkers(): Promise<void> {
     const nativeConnection = await NativeConnection.connect({
       address: this.hostPort,
+      ...this.connectionSecurity,
     });
     this.nativeConnection = nativeConnection;