#restack-libraries-ts

run locally

pnpm link --global

In example project

pnpm link --global @restackio/ai

Hide sensitive fields from the workflow UI

Wrap any value with Sensitive(...) to opt it into selective field encryption. The codec encrypts only the marked fields and leaves the rest of the payload plaintext, so the engine UI keeps showing useful debug context (email, ids, timestamps) while sensitive values render as opaque ciphertext for anyone without the key.

Engine-managed key (recommended)

When the engine is configured with RESTACK_ENGINE_PAYLOAD_KEY and RESTACK_API_BEARER_TOKEN (see the engine readme), the SDK auto-fetches the key during connect() and wires up the codec for you. Consumer services don't need any new env or codec construction:

import { Restack, Sensitive, unwrapSensitive } from "@restackio/ai";

const restack = new Restack({ engineId, apiKey, address, apiAddress });

// Caller side:
await restack.scheduleWorkflow({
  workflowName: "UserSignupWorkflow",
  workflowId,
  input: { email, password: Sensitive(password) },
});

// Workflow side:
type SignupInput = { email: string; password: ReturnType<typeof Sensitive<string>> };
export async function UserSignupWorkflow(input: SignupInput) {
  const password = unwrapSensitive(input.password);
  // ...
}

The SDK passes its apiKey as the bearer token when fetching the key. Engines that don't expose the key endpoint (older versions, or with the env unset) cause the SDK to silently fall back to no encryption — no deployment breakage.

In the engine UI, the password field renders as { "__restack_encrypted__": "v1", "alg": "AES-256-GCM", "iv": "...", "ct": "..." } instead of plaintext.

Consumer-managed key (advanced)

If you'd rather keep the key entirely out of the engine — e.g. each consumer service manages its own key in a KMS — pass a codec explicitly. This overrides the engine auto-wire:

import {
  Restack,
  SensitiveFieldsCodec,
  createAesGcmEncryption,
} from "@restackio/ai";

const key = Buffer.from(process.env.RESTACK_PAYLOAD_KEY!, "base64");
const restack = new Restack({
  engineId, apiKey, address, apiAddress,
  payloadCodecs: [new SensitiveFieldsCodec(createAesGcmEncryption(key))],
});

For non-AES backends (KMS, HSM, envelope encryption), provide your own SensitiveEncryption implementation instead of createAesGcmEncryption. The codec is algorithm-agnostic.