@stigmer/temporal-codecs 3.41.0 → 3.41.1-dev.20261003133619.g58ac1f23a411
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/encryption/config.d.ts
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* Payload-encryption configuration (stigmer
|
|
2
|
+
* Payload-encryption configuration (stigmer#398).
|
|
3
3
|
*
|
|
4
4
|
* Two key sources, strict precedence:
|
|
5
5
|
*
|
|
@@ -42,9 +42,9 @@ export interface EncryptionKey {
|
|
|
42
42
|
}
|
|
43
43
|
/**
|
|
44
44
|
* Resolves decrypt-key material for a key id absent from the static
|
|
45
|
-
* config (
|
|
46
|
-
*
|
|
47
|
-
*
|
|
45
|
+
* config (a hosting server may decode desktop-runner histories written
|
|
46
|
+
* under server-managed per-identity `rpk_` keys, whose material lives in
|
|
47
|
+
* a database, not the environment).
|
|
48
48
|
* Returns undefined when the id is unknown — the codec then fails closed
|
|
49
49
|
* with its pinned unknown-key-id error. Implementations own their lookup
|
|
50
50
|
* and unsealing; the codec caches every RESOLVED key for the process
|
package/encryption/config.js
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* Temporal PayloadCodec that encrypts payloads at rest in workflow
|
|
3
|
-
* history
|
|
3
|
+
* history.
|
|
4
4
|
*
|
|
5
5
|
* Why: the workflow engine runs inside the Temporal deterministic
|
|
6
6
|
* sandbox, so decrypted execution-context values cross the history
|
|
@@ -29,8 +29,8 @@
|
|
|
29
29
|
* all throw rather than surfacing bogus payloads.
|
|
30
30
|
*
|
|
31
31
|
* Key ids outside the static primary/secondary pair may be resolved
|
|
32
|
-
* through the config's optional resolveKey seam (
|
|
33
|
-
*
|
|
32
|
+
* through the config's optional resolveKey seam (a hosting server may
|
|
33
|
+
* decode desktop-runner histories under database-resident `rpk_` keys).
|
|
34
34
|
* Resolution is decode-only, resolved keys are cached for the process
|
|
35
35
|
* lifetime (an id's material is immutable — rotation mints a new id),
|
|
36
36
|
* misses are never cached, and an unresolvable id keeps the pinned
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* Temporal PayloadCodec that encrypts payloads at rest in workflow
|
|
3
|
-
* history
|
|
3
|
+
* history.
|
|
4
4
|
*
|
|
5
5
|
* Why: the workflow engine runs inside the Temporal deterministic
|
|
6
6
|
* sandbox, so decrypted execution-context values cross the history
|
|
@@ -29,8 +29,8 @@
|
|
|
29
29
|
* all throw rather than surfacing bogus payloads.
|
|
30
30
|
*
|
|
31
31
|
* Key ids outside the static primary/secondary pair may be resolved
|
|
32
|
-
* through the config's optional resolveKey seam (
|
|
33
|
-
*
|
|
32
|
+
* through the config's optional resolveKey seam (a hosting server may
|
|
33
|
+
* decode desktop-runner histories under database-resident `rpk_` keys).
|
|
34
34
|
* Resolution is decode-only, resolved keys are cached for the process
|
|
35
35
|
* lifetime (an id's material is immutable — rotation mints a new id),
|
|
36
36
|
* misses are never cached, and an unresolvable id keeps the pinned
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@stigmer/temporal-codecs",
|
|
3
|
-
"version": "3.41.
|
|
3
|
+
"version": "3.41.1-dev.20261003133619.g58ac1f23a411",
|
|
4
4
|
"description": "The Temporal plumbing Stigmer's TypeScript Temporal processes share — AES-256-GCM payload encryption and claim-check offloading (the one home for the cross-language envelope contract), and the connection-security settings every Temporal connection reads",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"type": "module",
|
|
@@ -28,6 +28,11 @@
|
|
|
28
28
|
"types": "./index.d.ts",
|
|
29
29
|
"import": "./index.js",
|
|
30
30
|
"default": "./index.js"
|
|
31
|
+
},
|
|
32
|
+
"./connection": {
|
|
33
|
+
"types": "./connection/config.d.ts",
|
|
34
|
+
"import": "./connection/config.js",
|
|
35
|
+
"default": "./connection/config.js"
|
|
31
36
|
}
|
|
32
37
|
},
|
|
33
38
|
"dependencies": {
|
package/src/encryption/config.ts
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* Payload-encryption configuration (stigmer
|
|
2
|
+
* Payload-encryption configuration (stigmer#398).
|
|
3
3
|
*
|
|
4
4
|
* Two key sources, strict precedence:
|
|
5
5
|
*
|
|
@@ -44,9 +44,9 @@ export interface EncryptionKey {
|
|
|
44
44
|
|
|
45
45
|
/**
|
|
46
46
|
* Resolves decrypt-key material for a key id absent from the static
|
|
47
|
-
* config (
|
|
48
|
-
*
|
|
49
|
-
*
|
|
47
|
+
* config (a hosting server may decode desktop-runner histories written
|
|
48
|
+
* under server-managed per-identity `rpk_` keys, whose material lives in
|
|
49
|
+
* a database, not the environment).
|
|
50
50
|
* Returns undefined when the id is unknown — the codec then fails closed
|
|
51
51
|
* with its pinned unknown-key-id error. Implementations own their lookup
|
|
52
52
|
* and unsealing; the codec caches every RESOLVED key for the process
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* Temporal PayloadCodec that encrypts payloads at rest in workflow
|
|
3
|
-
* history
|
|
3
|
+
* history.
|
|
4
4
|
*
|
|
5
5
|
* Why: the workflow engine runs inside the Temporal deterministic
|
|
6
6
|
* sandbox, so decrypted execution-context values cross the history
|
|
@@ -29,8 +29,8 @@
|
|
|
29
29
|
* all throw rather than surfacing bogus payloads.
|
|
30
30
|
*
|
|
31
31
|
* Key ids outside the static primary/secondary pair may be resolved
|
|
32
|
-
* through the config's optional resolveKey seam (
|
|
33
|
-
*
|
|
32
|
+
* through the config's optional resolveKey seam (a hosting server may
|
|
33
|
+
* decode desktop-runner histories under database-resident `rpk_` keys).
|
|
34
34
|
* Resolution is decode-only, resolved keys are cached for the process
|
|
35
35
|
* lifetime (an id's material is immutable — rotation mints a new id),
|
|
36
36
|
* misses are never cached, and an unresolvable id keeps the pinned
|