@stigmer/temporal-codecs 3.12.9

package/encryption/config.js

@@ -0,0 +1,119 @@
+/**
+ * Payload-encryption configuration (stigmer-cloud#227, stigmer#398).
+ *
+ * Two key sources, strict precedence:
+ *
+ *   1. Environment (STIGMER_PAYLOAD_ENCRYPTION_KEY(_ID)) — the operator's
+ *      explicit choice: self-hosted deployments sharing one key with their
+ *      server, and cloud sandboxes injected with the platform key. When the
+ *      env key is set, bootstrap-delivered material is ignored entirely.
+ *   2. Bootstrap-delivered — server-managed per-identity keys handed to
+ *      desktop-class runners by getRunnerBootstrapConfig. Held in memory
+ *      only; persistence lives server-side, which is what makes Temporal
+ *      replay work across runner restarts (every boot re-fetches the SAME
+ *      key).
+ *
+ * Encryption is enabled iff a key is present from either source — the same
+ * enabled-iff-configured pattern as the claim-check codec. A malformed key
+ * fails the boot rather than silently running plaintext: an operator who set
+ * the key (or a server that minted one) intended history to be encrypted.
+ *
+ * Key rotation: payloads carry the id of the key that encrypted them.
+ * During a rotation window the previous key stays readable via the
+ * secondary pair while new payloads are written under the primary key.
+ * Workers capture keys at construction, so a rotated bootstrap key lands
+ * on the next runner boot — there is no live re-key.
+ *
+ * Moved from backend/services/runner/src/encryption/config.ts when the
+ * codecs became @stigmer/temporal-codecs (one home for the cross-language
+ * envelope contract; the TS server is the second consumer). Key VALUES are
+ * read through an injected {@link SecretReader} because secret custody is
+ * consumer policy, not codec policy: the runner routes reads through its
+ * boot-capture credential store (stigmer#508 — secrets must not live in
+ * process.env where agent shells could read them), while other consumers
+ * read their own stores. No process.env default is provided for the
+ * VALUES: a forgotten injection must fail to compile, not silently bypass
+ * a consumer's secret custody.
+ */
+const KEY_ENV = "STIGMER_PAYLOAD_ENCRYPTION_KEY";
+const KEY_ID_ENV = "STIGMER_PAYLOAD_ENCRYPTION_KEY_ID";
+const SECONDARY_KEY_ENV = "STIGMER_PAYLOAD_ENCRYPTION_SECONDARY_KEY";
+const SECONDARY_KEY_ID_ENV = "STIGMER_PAYLOAD_ENCRYPTION_SECONDARY_KEY_ID";
+const AES_256_KEY_BYTES = 32;
+/**
+ * Returns the encryption config, or undefined when encryption is not
+ * configured (the codec is then simply not installed).
+ *
+ * Source precedence: the env key wins outright; bootstrap-delivered
+ * material applies only when no env key is set (see the module doc).
+ *
+ * @throws when a key is present but malformed, or a key id is missing —
+ *   key misconfiguration must stop the boot, not degrade to plaintext.
+ *   This applies equally to bootstrap material: a server that hands out
+ *   a bad key or omits its id has broken the protocol contract, and
+ *   running plaintext against a server that manages keys would silently
+ *   defeat the feature.
+ */
+export function loadPayloadEncryptionConfig(readSecret, bootstrap) {
+    const rawKey = readSecret(KEY_ENV);
+    if (rawKey) {
+        const primary = {
+            keyId: requireKeyId(KEY_ID_ENV),
+            key: parseKey(rawKey, KEY_ENV),
+        };
+        const rawSecondary = readSecret(SECONDARY_KEY_ENV);
+        const secondary = rawSecondary
+            ? {
+                keyId: requireKeyId(SECONDARY_KEY_ID_ENV),
+                key: parseKey(rawSecondary, SECONDARY_KEY_ENV),
+            }
+            : undefined;
+        return { primary, secondary };
+    }
+    if (bootstrap?.key) {
+        const primary = {
+            keyId: requireBootstrapKeyId(bootstrap.keyId, "payload_encryption_key_id"),
+            key: parseKey(bootstrap.key, "bootstrap payload_encryption_key"),
+        };
+        const secondary = bootstrap.secondaryKey
+            ? {
+                keyId: requireBootstrapKeyId(bootstrap.secondaryKeyId, "payload_encryption_secondary_key_id"),
+                key: parseKey(bootstrap.secondaryKey, "bootstrap payload_encryption_secondary_key"),
+            }
+            : undefined;
+        return { primary, secondary };
+    }
+    return undefined;
+}
+function requireKeyId(envName) {
+    const keyId = process.env[envName];
+    // An explicit id is required (no default): during rotation two keys
+    // coexist, and payloads must name which one encrypted them.
+    if (!keyId) {
+        throw new Error(`Payload encryption misconfigured: ${envName} is required when the ` +
+            `corresponding key is set`);
+    }
+    return keyId;
+}
+function requireBootstrapKeyId(keyId, fieldName) {
+    if (!keyId) {
+        throw new Error(`Runner bootstrap returned a payload encryption key without its ${fieldName} — ` +
+            `refusing to encrypt under an unidentified key (server contract violation)`);
+    }
+    return keyId;
+}
+function parseKey(rawBase64, envName) {
+    let key;
+    try {
+        key = Buffer.from(rawBase64, "base64");
+    }
+    catch {
+        throw new Error(`Payload encryption misconfigured: ${envName} is not valid base64`);
+    }
+    if (key.length !== AES_256_KEY_BYTES) {
+        throw new Error(`Payload encryption misconfigured: ${envName} must decode to ` +
+            `${AES_256_KEY_BYTES} bytes (AES-256), got ${key.length}`);
+    }
+    return key;
+}
+//# sourceMappingURL=config.js.map

package/encryption/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/encryption/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAmCH,MAAM,OAAO,GAAG,gCAAgC,CAAC;AACjD,MAAM,UAAU,GAAG,mCAAmC,CAAC;AACvD,MAAM,iBAAiB,GAAG,0CAA0C,CAAC;AACrE,MAAM,oBAAoB,GAAG,6CAA6C,CAAC;AAE3E,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,2BAA2B,CACzC,UAAwB,EACxB,SAAgC;IAEhC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAkB;YAC7B,KAAK,EAAE,YAAY,CAAC,UAAU,CAAC;YAC/B,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;SAC/B,CAAC;QAEF,MAAM,YAAY,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;QACnD,MAAM,SAAS,GAA8B,YAAY;YACvD,CAAC,CAAC;gBACE,KAAK,EAAE,YAAY,CAAC,oBAAoB,CAAC;gBACzC,GAAG,EAAE,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;aAC/C;YACH,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,SAAS,EAAE,GAAG,EAAE,CAAC;QACnB,MAAM,OAAO,GAAkB;YAC7B,KAAK,EAAE,qBAAqB,CAAC,SAAS,CAAC,KAAK,EAAE,2BAA2B,CAAC;YAC1E,GAAG,EAAE,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,kCAAkC,CAAC;SACjE,CAAC;QAEF,MAAM,SAAS,GAA8B,SAAS,CAAC,YAAY;YACjE,CAAC,CAAC;gBACE,KAAK,EAAE,qBAAqB,CAC1B,SAAS,CAAC,cAAc,EACxB,qCAAqC,CACtC;gBACD,GAAG,EAAE,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,4CAA4C,CAAC;aACpF;YACH,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,oEAAoE;IACpE,4DAA4D;IAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,wBAAwB;YAClE,0BAA0B,CAC7B,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAyB,EAAE,SAAiB;IACzE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,kEAAkE,SAAS,KAAK;YAC9E,2EAA2E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,SAAiB,EAAE,OAAe;IAClD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,OAAO,sBAAsB,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,kBAAkB;YAC5D,GAAG,iBAAiB,yBAAyB,GAAG,CAAC,MAAM,EAAE,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/encryption/payload-codec.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Temporal PayloadCodec that encrypts payloads at rest in workflow
+ * history (stigmer-cloud#227).
+ *
+ * Why: the workflow engine runs inside the Temporal deterministic
+ * sandbox, so decrypted execution-context values cross the history
+ * boundary in many places — the hydrate activity result, the runtime
+ * env passed as an input to every per-task activity, and expression
+ * results recorded as local-activity markers. Encrypting at the payload
+ * codec layer closes the entire class with one mechanism instead of
+ * chasing each crossing.
+ *
+ * Envelope (cross-SDK contract — the Java decode-only codec in
+ * stigmer-cloud's temporal-starter must match it byte-for-byte, pinned
+ * by the conformance fixture in __tests__/fixtures/):
+ *
+ *   metadata: encoding            = "binary/encrypted"
+ *             encryption-key-id   = <key id that encrypted this payload>
+ *   data:     iv (12 bytes) ‖ AES-256-GCM(ciphertext ‖ tag (16 bytes))
+ *
+ * The plaintext is the serialized ORIGINAL Payload proto (metadata AND
+ * data), so decode restores the payload exactly — including its
+ * original encoding — with no side channel.
+ *
+ * Decode passes through payloads it did not encode. This is what keeps
+ * plaintext signals from the Java/Go orchestrators and pre-rollout
+ * in-flight histories working with zero migration. Everything else
+ * fails closed: unknown key id, missing key id, and ciphertext tampering
+ * all throw rather than surfacing bogus payloads.
+ *
+ * Moved from backend/services/runner/src/encryption/payload-codec.ts when
+ * the codecs became @stigmer/temporal-codecs (one home for the
+ * cross-language envelope contract; the TS server is the second consumer).
+ */
+import type { Payload, PayloadCodec } from "@temporalio/common";
+import type { PayloadEncryptionConfig } from "./config.js";
+export declare class EncryptionPayloadCodec implements PayloadCodec {
+    private readonly config;
+    private readonly decryptKeysById;
+    constructor(config: PayloadEncryptionConfig);
+    encode(payloads: Payload[]): Promise<Payload[]>;
+    decode(payloads: Payload[]): Promise<Payload[]>;
+    private encodePayload;
+    private decodePayload;
+}
+//# sourceMappingURL=payload-codec.d.ts.map

package/encryption/payload-codec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-codec.d.ts","sourceRoot":"","sources":["../../src/encryption/payload-codec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAQhE,OAAO,KAAK,EAAiB,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAY1E,qBAAa,sBAAuB,YAAW,YAAY;IAG7C,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAsB;gBAEzB,MAAM,EAAE,uBAAuB;IAOtD,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAI/C,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAIrD,OAAO,CAAC,aAAa;IAkBrB,OAAO,CAAC,aAAa;CAuBtB"}

package/encryption/payload-codec.js

@@ -0,0 +1,134 @@
+/**
+ * Temporal PayloadCodec that encrypts payloads at rest in workflow
+ * history (stigmer-cloud#227).
+ *
+ * Why: the workflow engine runs inside the Temporal deterministic
+ * sandbox, so decrypted execution-context values cross the history
+ * boundary in many places — the hydrate activity result, the runtime
+ * env passed as an input to every per-task activity, and expression
+ * results recorded as local-activity markers. Encrypting at the payload
+ * codec layer closes the entire class with one mechanism instead of
+ * chasing each crossing.
+ *
+ * Envelope (cross-SDK contract — the Java decode-only codec in
+ * stigmer-cloud's temporal-starter must match it byte-for-byte, pinned
+ * by the conformance fixture in __tests__/fixtures/):
+ *
+ *   metadata: encoding            = "binary/encrypted"
+ *             encryption-key-id   = <key id that encrypted this payload>
+ *   data:     iv (12 bytes) ‖ AES-256-GCM(ciphertext ‖ tag (16 bytes))
+ *
+ * The plaintext is the serialized ORIGINAL Payload proto (metadata AND
+ * data), so decode restores the payload exactly — including its
+ * original encoding — with no side channel.
+ *
+ * Decode passes through payloads it did not encode. This is what keeps
+ * plaintext signals from the Java/Go orchestrators and pre-rollout
+ * in-flight histories working with zero migration. Everything else
+ * fails closed: unknown key id, missing key id, and ciphertext tampering
+ * all throw rather than surfacing bogus payloads.
+ *
+ * Moved from backend/services/runner/src/encryption/payload-codec.ts when
+ * the codecs became @stigmer/temporal-codecs (one home for the
+ * cross-language envelope contract; the TS server is the second consumer).
+ */
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+// Default-import + destructure, NOT `import { temporal } from …`:
+// @temporalio/proto is CommonJS and its `temporal` export defeats Node's
+// cjs-module-lexer named-export detection, so the named form loads under
+// tsx/vitest (their interop is looser) but crashes plain `node dist/main.js`
+// at startup with "Named export 'temporal' not found" (stigmer/stigmer#399
+// boot regression). Pinned by scripts/verify-dist-boot.mjs in CI.
+import proto from "@temporalio/proto";
+const { temporal } = proto;
+const ENCODING_METADATA_KEY = "encoding";
+const ENCRYPTED_ENCODING_VALUE = "binary/encrypted";
+const KEY_ID_METADATA_KEY = "encryption-key-id";
+/** AES-GCM parameters shared with the Java implementation. */
+const IV_BYTES = 12;
+const AUTH_TAG_BYTES = 16;
+export class EncryptionPayloadCodec {
+    config;
+    decryptKeysById;
+    constructor(config) {
+        this.config = config;
+        this.decryptKeysById = new Map([[config.primary.keyId, config.primary.key]]);
+        if (config.secondary) {
+            this.decryptKeysById.set(config.secondary.keyId, config.secondary.key);
+        }
+    }
+    async encode(payloads) {
+        return payloads.map((p) => this.encodePayload(p));
+    }
+    async decode(payloads) {
+        return payloads.map((p) => this.decodePayload(p));
+    }
+    encodePayload(payload) {
+        // Data-less payloads (binary/null from void results) stay as-is:
+        // there is nothing to protect, and the cross-language parents that
+        // await our workflows as void must be able to read them without a key.
+        if (!payload.data || payload.data.length === 0) {
+            return payload;
+        }
+        const plaintext = temporal.api.common.v1.Payload.encode(payload).finish();
+        return {
+            metadata: {
+                [ENCODING_METADATA_KEY]: Buffer.from(ENCRYPTED_ENCODING_VALUE),
+                [KEY_ID_METADATA_KEY]: Buffer.from(this.config.primary.keyId),
+            },
+            data: encrypt(plaintext, this.config.primary),
+        };
+    }
+    decodePayload(payload) {
+        if (!isEncryptedPayload(payload)) {
+            return payload;
+        }
+        const keyIdBytes = payload.metadata?.[KEY_ID_METADATA_KEY];
+        if (!keyIdBytes) {
+            throw new Error("Encrypted payload is missing its encryption-key-id metadata — refusing to decode");
+        }
+        const keyId = Buffer.from(keyIdBytes).toString("utf-8");
+        const key = this.decryptKeysById.get(keyId);
+        if (!key) {
+            throw new Error(`Encrypted payload uses unknown key id '${keyId}' — configure it as the ` +
+                `primary or secondary payload encryption key (rotation window?)`);
+        }
+        const plaintext = decrypt(payload.data, key, keyId);
+        return temporal.api.common.v1.Payload.decode(plaintext);
+    }
+}
+function isEncryptedPayload(payload) {
+    const encoding = payload.metadata?.[ENCODING_METADATA_KEY];
+    if (!encoding)
+        return false;
+    return Buffer.from(encoding).toString("utf-8") === ENCRYPTED_ENCODING_VALUE;
+}
+function encrypt(plaintext, key) {
+    const iv = randomBytes(IV_BYTES);
+    const cipher = createCipheriv("aes-256-gcm", key.key, iv);
+    const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    // Layout iv ‖ ciphertext ‖ tag matches Java's AES/GCM/NoPadding, whose
+    // doFinal() output is ciphertext ‖ tag.
+    return Buffer.concat([iv, ciphertext, cipher.getAuthTag()]);
+}
+function decrypt(data, key, keyId) {
+    if (data.length < IV_BYTES + AUTH_TAG_BYTES) {
+        throw new Error(`Encrypted payload under key id '${keyId}' is truncated (${data.length} bytes)`);
+    }
+    const buf = Buffer.from(data);
+    const iv = buf.subarray(0, IV_BYTES);
+    const ciphertext = buf.subarray(IV_BYTES, buf.length - AUTH_TAG_BYTES);
+    const tag = buf.subarray(buf.length - AUTH_TAG_BYTES);
+    const decipher = createDecipheriv("aes-256-gcm", key, iv);
+    decipher.setAuthTag(tag);
+    try {
+        return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+    }
+    catch {
+        // GCM auth failure: tampered ciphertext or a key that does not match
+        // its advertised id. Never surface partially decrypted bytes.
+        throw new Error(`Failed to decrypt payload under key id '${keyId}' — ciphertext is ` +
+            `corrupt or the configured key does not match`);
+    }
+}
+//# sourceMappingURL=payload-codec.js.map

package/encryption/payload-codec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-codec.js","sourceRoot":"","sources":["../../src/encryption/payload-codec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE5E,kEAAkE;AAClE,yEAAyE;AACzE,yEAAyE;AACzE,6EAA6E;AAC7E,2EAA2E;AAC3E,kEAAkE;AAClE,OAAO,KAAK,MAAM,mBAAmB,CAAC;AAGtC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;AAE3B,MAAM,qBAAqB,GAAG,UAAU,CAAC;AACzC,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AACpD,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAEhD,8DAA8D;AAC9D,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,MAAM,OAAO,sBAAsB;IAGJ;IAFZ,eAAe,CAAsB;IAEtD,YAA6B,MAA+B;QAA/B,WAAM,GAAN,MAAM,CAAyB;QAC1D,IAAI,CAAC,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7E,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAmB;QAC9B,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAmB;QAC9B,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IAEO,aAAa,CAAC,OAAgB;QACpC,iEAAiE;QACjE,mEAAmE;QACnE,uEAAuE;QACvE,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/C,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1E,OAAO;YACL,QAAQ,EAAE;gBACR,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC;gBAC9D,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aAC9D;YACD,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;SAC9C,CAAC;IACJ,CAAC;IAEO,aAAa,CAAC,OAAgB;QACpC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,mBAAmB,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,0CAA0C,KAAK,0BAA0B;gBACvE,gEAAgE,CACnE,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,IAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACrD,OAAO,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,qBAAqB,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,wBAAwB,CAAC;AAC9E,CAAC;AAED,SAAS,OAAO,CAAC,SAAqB,EAAE,GAAkB;IACxD,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,uEAAuE;IACvE,wCAAwC;IACxC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,OAAO,CAAC,IAAgB,EAAE,GAAW,EAAE,KAAa;IAC3D,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,GAAG,cAAc,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,mCAAmC,KAAK,mBAAmB,IAAI,CAAC,MAAM,SAAS,CAChF,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,GAAG,cAAc,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,cAAc,CAAC,CAAC;IAEtD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1D,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,8DAA8D;QAC9D,MAAM,IAAI,KAAK,CACb,2CAA2C,KAAK,oBAAoB;YAClE,8CAA8C,CACjD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/index.d.ts

@@ -0,0 +1,28 @@
+/**
+ * @stigmer/temporal-codecs — Temporal payload codecs shared by Stigmer's
+ * TypeScript Temporal processes (the runner today; the TS server at its
+ * cutover). The encryption envelope is a cross-language wire contract
+ * (the Java decode-only codec in stigmer-cloud's temporal-starter must
+ * match it byte-for-byte, pinned by the fixture in
+ * src/__tests__/fixtures/), which is why the codecs live in one library
+ * instead of per-consumer copies that could fork.
+ *
+ * This is the package's ONLY public boundary. Codec order at the consumer
+ * is a correctness property: install [encryption, claimcheck] so encode
+ * encrypts before relocating (object storage only ever sees ciphertext)
+ * and decode restores the blob before decrypting.
+ *
+ * Dependency policy: @temporalio/common and @temporalio/proto are pinned
+ * exact and identical to the runner's pins, bumped in lockstep with it —
+ * the runner's consumer-install gate (stigmer#786) fails any version mix
+ * because a split @temporalio/proto tree registers the core-sdk protobuf
+ * namespace twice and crashes worker init.
+ */
+export { EncryptionPayloadCodec } from "./encryption/payload-codec.js";
+export { loadPayloadEncryptionConfig } from "./encryption/config.js";
+export type { BootstrapKeyMaterial, EncryptionKey, PayloadEncryptionConfig, SecretReader, } from "./encryption/config.js";
+export { ClaimcheckPayloadCodec } from "./claimcheck/payload-codec.js";
+export { loadClaimcheckConfig } from "./claimcheck/config.js";
+export type { ClaimcheckConfig } from "./claimcheck/config.js";
+export type { ClaimcheckStorage } from "./claimcheck/storage.js";
+//# sourceMappingURL=index.d.ts.map

package/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AACrE,YAAY,EACV,oBAAoB,EACpB,aAAa,EACb,uBAAuB,EACvB,YAAY,GACb,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC"}

package/index.js

@@ -0,0 +1,25 @@
+/**
+ * @stigmer/temporal-codecs — Temporal payload codecs shared by Stigmer's
+ * TypeScript Temporal processes (the runner today; the TS server at its
+ * cutover). The encryption envelope is a cross-language wire contract
+ * (the Java decode-only codec in stigmer-cloud's temporal-starter must
+ * match it byte-for-byte, pinned by the fixture in
+ * src/__tests__/fixtures/), which is why the codecs live in one library
+ * instead of per-consumer copies that could fork.
+ *
+ * This is the package's ONLY public boundary. Codec order at the consumer
+ * is a correctness property: install [encryption, claimcheck] so encode
+ * encrypts before relocating (object storage only ever sees ciphertext)
+ * and decode restores the blob before decrypting.
+ *
+ * Dependency policy: @temporalio/common and @temporalio/proto are pinned
+ * exact and identical to the runner's pins, bumped in lockstep with it —
+ * the runner's consumer-install gate (stigmer#786) fails any version mix
+ * because a split @temporalio/proto tree registers the core-sdk protobuf
+ * namespace twice and crashes worker init.
+ */
+export { EncryptionPayloadCodec } from "./encryption/payload-codec.js";
+export { loadPayloadEncryptionConfig } from "./encryption/config.js";
+export { ClaimcheckPayloadCodec } from "./claimcheck/payload-codec.js";
+export { loadClaimcheckConfig } from "./claimcheck/config.js";
+//# sourceMappingURL=index.js.map

package/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAQrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC"}

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@stigmer/temporal-codecs",
+  "version": "3.12.9",
+  "description": "Temporal payload codecs shared by Stigmer's TypeScript Temporal processes — AES-256-GCM payload encryption and claim-check offloading, the one home for the cross-language envelope contract",
+  "license": "Apache-2.0",
+  "type": "module",
+  "sideEffects": false,
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/stigmer/stigmer.git",
+    "directory": "backend/libs/ts/temporal-codecs"
+  },
+  "engines": {
+    "node": "^22.13.0 || >=23.4.0"
+  },
+  "keywords": [
+    "stigmer",
+    "temporal",
+    "payload-codec",
+    "encryption",
+    "claim-check"
+  ],
+  "main": "./index.js",
+  "types": "./index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./index.d.ts",
+      "import": "./index.js",
+      "default": "./index.js"
+    }
+  },
+  "dependencies": {
+    "@temporalio/common": "1.16.2",
+    "@temporalio/proto": "1.16.2"
+  }
+}

package/src/__test-utils__/fake-claimcheck-storage.ts

@@ -0,0 +1,54 @@
+/**
+ * The canonical in-memory {@link ClaimcheckStorage} test double — the
+ * lib-scoped sibling of the runner's fake-artifact-storage.ts (which
+ * models the runner's richer ArtifactStorage port and stays there).
+ *
+ * Design, mirrored from that double:
+ *  - `upload` / `download` are backed by one shared `Map`, so a key that
+ *    was uploaded reads back byte-exact — the double behaves like a real
+ *    content store, not a pair of disconnected stubs.
+ *  - Both methods are `vi.fn`s, so call assertions work and either can be
+ *    overridden per-test to force a failure
+ *    (`storage.download.mockRejectedValueOnce(new Error("… HTTP 404 …"))`).
+ */
+
+import { vi } from "vitest";
+import type { ClaimcheckStorage } from "../claimcheck/storage.js";
+
+/** A {@link ClaimcheckStorage} whose methods are `vi.fn` spies over a shared Map. */
+export type InMemoryClaimcheckStorage = {
+  [K in keyof ClaimcheckStorage]: ReturnType<typeof vi.fn>;
+} & ClaimcheckStorage;
+
+export interface InMemoryClaimcheckStorageHandle {
+  /** The storage double to inject; both methods are spy-able `vi.fn`s. */
+  readonly storage: InMemoryClaimcheckStorage;
+  /** The backing store — inspect or seed it directly in a test. */
+  readonly blobs: Map<string, Buffer>;
+}
+
+/**
+ * Build an in-memory {@link ClaimcheckStorage} backed by a shared `Map`.
+ *
+ * @example
+ * const { storage, blobs } = makeInMemoryClaimcheckStorage();
+ * await storage.upload("k", Buffer.from("hi"));
+ * expect((await storage.download("k")).toString()).toBe("hi");
+ */
+export function makeInMemoryClaimcheckStorage(): InMemoryClaimcheckStorageHandle {
+  const blobs = new Map<string, Buffer>();
+
+  const storage = {
+    upload: vi.fn(async (key: string, content: Buffer, _contentType?: string) => {
+      blobs.set(key, Buffer.from(content));
+      return key;
+    }),
+    download: vi.fn(async (key: string) => {
+      const b = blobs.get(key);
+      if (!b) throw new Error(`Artifact not found for key '${key}'`);
+      return Buffer.from(b);
+    }),
+  } as InMemoryClaimcheckStorage;
+
+  return { storage, blobs };
+}