Add opt-in decryption for CLI and web observability#1000

Closed

TooTallNate wants to merge 46 commits intonate/wire-encryptionfrom

nate/opt-in-decrypt

Commits on Feb 19, 2026

Add browser-compatible AES-GCM to core and HKDF key derivation to world-vercel
TooTallNate
committed
update changeset
TooTallNate
committed
Move HKDF key derivation server-side: API returns per-run derived key
TooTallNate
committed
Refactor encrypt/decrypt to accept CryptoKey, export importKey for callers to import once per run
TooTallNate
committed
Pass WorkflowRun entity to getEncryptionKeyForRun where available (avoids redundant lookup)
TooTallNate
committed
.
TooTallNate
committed
Refactor handleSuspension to accept WorkflowRun, pass run entity to getEncryptionKeyForRun
TooTallNate
committed
Overload getEncryptionKeyForRun: accept context for start(), fetch WorkflowRun in resume-hook
TooTallNate
committed
Split changeset into per-package descriptions for world, world-vercel, and core
TooTallNate
committed
Remove unnecessary Uint8Array.from() wrapper around Buffer.from()
TooTallNate
committed
Use zod to parse Vercel API response
TooTallNate
committed
Wire encryption into serialization layer
TooTallNate
committed
Wire AES-GCM encryption into serialization layer
TooTallNate
committed
update changeset
TooTallNate
committed
Add encryption unit tests: primitives, maybeEncrypt/maybeDecrypt, isEncrypted, complex type round-trips
TooTallNate
committed
Accept CryptoKey in encrypt/decrypt, export importKey for callers to import once per run
TooTallNate
committed
Fix review comments: cache stream encryption key, remove redundant casts, fix stale comments
TooTallNate
committed
Trying to clean up some type non-sense
TooTallNate
committed
Make EventsConsumer async-aware: remove all setTimeout(0) hacks from step/hook/sleep callbacks
TooTallNate
committed
Revert "Make EventsConsumer async-aware: remove all setTimeout(0) hacks from step/hook/sleep callbacks"
TooTallNate
committed
Add failing test: encrypted Promise.all replay triggers unconsumed event race condition
TooTallNate
committed
Fix failing test
TooTallNate
committed
.
TooTallNate
committed
Add full encryption test suite to workflow.test.ts and attempt fix for storytime
TooTallNate
committed
.
TooTallNate
committed
Redesign EventsConsumer: scan-forward consume, watchdog timer, post-completion corruption check
TooTallNate
committed
Make decryption an explicit opt-in for o11y tooling
TooTallNate
committed
Restore encrypted data handling in o11y hydration layer
TooTallNate
committed
Use EncryptedDataRef with util.inspect.custom for CLI encrypted data display
TooTallNate
committed
Fix Decrypt button crash: use correct 'refresh' callback from useWorkflowResourceData
TooTallNate
committed
Implement client-side decryption for web o11y with getEncryptionKeyForRun RPC
TooTallNate
committed
Fix CLI decrypt: fetch WorkflowRun for key resolution, cache per runId
TooTallNate
committed
Use named constructor pattern for encrypted data display in web o11y
TooTallNate
committed
Decrypt event data when encryption key is available after Decrypt button click
TooTallNate
committed
Lift encryption key to run-level state, auto-decrypt on fetch, fix field pollution
TooTallNate
committed
Re-load expanded event data when encryption key becomes available
TooTallNate
committed
Consolidate Decrypt to title bar Button, remove sidebar decrypt card
TooTallNate
committed
Add hover tooltip to Decrypt button explaining scope and state
TooTallNate
committed
Show flat Encrypted label for encrypted fields, use Lucide Lock icon in DataInspector
TooTallNate
committed
Render eventData subfields individually to avoid encrypted markers in collapsed preview
TooTallNate
committed
Revert: render eventData subfields individually
TooTallNate
committed
Fix Lock icon vertical alignment in DataInspector encrypted label
TooTallNate
committed
update changeset
TooTallNate
committed
Fix loading state never clearing for hook/sleep resource types
TooTallNate
committed
Update CLI, web, and stream callers for CryptoKey: importKey at resolution sites
TooTallNate
committed
Pass teamId to the get-key endpoint
TooTallNate
committed