@outputai/core 0.14.0 → 0.14.1-next.51e8690.0

package/dist/credentials/credentials.d.ts

@@ -0,0 +1,6 @@
+export declare const resolveCredentialRefs: () => string[];
+export declare const credentials: {
+    get: (path: string, defaultValue?: unknown) => unknown;
+    require: (path: string) => unknown;
+    _reset: () => void;
+};

package/dist/credentials/credentials.js

@@ -0,0 +1,87 @@
+import { dirname } from 'node:path';
+import { MissingCredentialError } from './errors.js';
+import { deepMerge } from '#helpers/object';
+import { getProvider } from './provider_registry.js';
+import { Storage } from '#async_storage';
+const getNestedValue = (obj, dotPath) => dotPath.split('.').reduce((acc, part) => acc?.[part], obj);
+const detectEnvironment = () => {
+    const env = process.env.NODE_ENV;
+    return (env === 'production' || env === 'development') ? env : undefined;
+};
+const GLOBAL_CACHE_KEY = Symbol('global');
+const cache = new Map();
+const loadGlobal = () => {
+    if (cache.has(GLOBAL_CACHE_KEY)) {
+        return cache.get(GLOBAL_CACHE_KEY);
+    }
+    const data = getProvider().loadGlobal({ environment: detectEnvironment() });
+    cache.set(GLOBAL_CACHE_KEY, data);
+    return data;
+};
+const loadForWorkflow = (workflowName, workflowDir) => {
+    if (cache.has(workflowName)) {
+        return cache.get(workflowName);
+    }
+    const globalData = loadGlobal();
+    const workflowData = getProvider().loadForWorkflow({
+        workflowName,
+        workflowDir,
+        environment: detectEnvironment()
+    });
+    const merged = workflowData ? deepMerge(globalData, workflowData) : globalData;
+    cache.set(workflowName, merged);
+    return merged;
+};
+const getWorkflowContext = () => {
+    const ctx = Storage.load();
+    if (!ctx) {
+        return { workflowName: undefined, workflowDir: undefined };
+    }
+    return {
+        workflowName: ctx.activityInfo.workflowType,
+        workflowDir: dirname(ctx.workflowFilename)
+    };
+};
+const load = () => {
+    const { workflowName, workflowDir } = getWorkflowContext();
+    if (!workflowName) {
+        return loadGlobal();
+    }
+    return loadForWorkflow(workflowName, workflowDir);
+};
+const CREDENTIAL_REF_PREFIX = 'credential:';
+export const resolveCredentialRefs = () => {
+    const refs = Object.entries(process.env)
+        .filter(([, v]) => typeof v === 'string' && v.startsWith(CREDENTIAL_REF_PREFIX));
+    if (refs.length === 0) {
+        return [];
+    }
+    const data = loadGlobal();
+    const resolved = [];
+    for (const [envVar, value] of refs) {
+        const credPath = value.slice(CREDENTIAL_REF_PREFIX.length);
+        const credValue = getNestedValue(data, credPath);
+        if (typeof credValue === 'string' && credValue.length > 0) {
+            process.env[envVar] = credValue;
+            resolved.push(envVar);
+        }
+    }
+    return resolved;
+};
+export const credentials = {
+    get: (path, defaultValue = undefined) => {
+        const data = load();
+        const value = getNestedValue(data, path);
+        return value !== undefined ? value : defaultValue;
+    },
+    require: (path) => {
+        const value = credentials.get(path);
+        if (value === undefined || value === null) {
+            throw new MissingCredentialError(path);
+        }
+        return value;
+    },
+    _reset: () => {
+        cache.clear();
+    }
+};

package/dist/credentials/encrypted_yaml_provider.d.ts

@@ -0,0 +1,2 @@
+import type { CredentialsProvider } from './types.js';
+export declare const encryptedYamlProvider: CredentialsProvider;

package/dist/credentials/encrypted_yaml_provider.js

@@ -0,0 +1,77 @@
+import { readFileSync, existsSync } from 'node:fs';
+import { load as parseYaml } from 'js-yaml';
+import { decrypt } from './encryption.js';
+import { InvalidCredentialsKeyError, MalformedCredentialsKeyError, MissingKeyError } from './errors.js';
+import { resolveKeyEnvVar, resolveCredentialsPath, resolveKeyPath, resolveWorkflowCredentialsPath, resolveWorkflowKeyPath, resolveWorkflowKeyEnvVar } from './paths.js';
+const resolveBaseDir = () => {
+    const arg = process.argv[2];
+    return (arg && arg.startsWith('/')) ? arg : process.cwd();
+};
+const resolveKey = (environment) => {
+    const envVarName = resolveKeyEnvVar(environment);
+    if (process.env[envVarName]) {
+        return process.env[envVarName];
+    }
+    const keyFilePath = resolveKeyPath(resolveBaseDir(), environment);
+    if (existsSync(keyFilePath)) {
+        return readFileSync(keyFilePath, 'utf8').trim();
+    }
+    throw new MissingKeyError(environment);
+};
+const resolveWorkflowKey = (workflowName, workflowDir) => {
+    const envVarName = resolveWorkflowKeyEnvVar(workflowName);
+    if (process.env[envVarName]) {
+        return process.env[envVarName];
+    }
+    const keyPath = resolveWorkflowKeyPath(workflowDir);
+    if (existsSync(keyPath)) {
+        return readFileSync(keyPath, 'utf8').trim();
+    }
+    return resolveKey(undefined);
+};
+const safeDecrypt = (ciphertext, key, credPath) => {
+    try {
+        return decrypt(ciphertext, key);
+    }
+    catch (error) {
+        if (error instanceof RangeError) {
+            throw new MalformedCredentialsKeyError(credPath, error.message);
+        }
+        if (error instanceof Error && error.message.includes('aes/gcm')) {
+            throw new InvalidCredentialsKeyError(credPath);
+        }
+        throw new InvalidCredentialsKeyError(credPath, error instanceof Error ? error.message : String(error));
+    }
+};
+const decryptYaml = (credPath, key) => {
+    const ciphertext = readFileSync(credPath, 'utf8').trim();
+    const plaintext = safeDecrypt(ciphertext, key, credPath);
+    return parseYaml(plaintext) || {};
+};
+export const encryptedYamlProvider = {
+    loadGlobal: ({ environment }) => {
+        const baseDir = resolveBaseDir();
+        const credPath = resolveCredentialsPath(baseDir, environment);
+        if (!existsSync(credPath)) {
+            if (environment) {
+                const defaultPath = resolveCredentialsPath(baseDir, undefined);
+                if (existsSync(defaultPath)) {
+                    return decryptYaml(defaultPath, resolveKey(undefined));
+                }
+            }
+            return {};
+        }
+        return decryptYaml(credPath, resolveKey(environment));
+    },
+    loadForWorkflow: ({ workflowName, workflowDir }) => {
+        if (!workflowDir) {
+            return null;
+        }
+        const credPath = resolveWorkflowCredentialsPath(workflowDir);
+        if (!existsSync(credPath)) {
+            return null;
+        }
+        const key = resolveWorkflowKey(workflowName, workflowDir);
+        return decryptYaml(credPath, key);
+    }
+};

package/dist/credentials/encryption.d.ts

@@ -0,0 +1,3 @@
+export declare const generateKey: () => string;
+export declare const encrypt: (plaintext: string, keyHex: string) => string;
+export declare const decrypt: (ciphertext: string, keyHex: string) => string;

package/dist/credentials/encryption.js

@@ -0,0 +1,6 @@
+import { gcm } from '@noble/ciphers/aes.js';
+import { managedNonce, randomBytes, hexToBytes, bytesToHex } from '@noble/ciphers/utils.js';
+const aes = managedNonce(gcm);
+export const generateKey = () => bytesToHex(randomBytes(32));
+export const encrypt = (plaintext, keyHex) => Buffer.from(aes(hexToBytes(keyHex)).encrypt(new TextEncoder().encode(plaintext))).toString('base64');
+export const decrypt = (ciphertext, keyHex) => new TextDecoder().decode(aes(hexToBytes(keyHex)).decrypt(Buffer.from(ciphertext, 'base64')));

package/dist/credentials/errors.d.ts

@@ -0,0 +1,13 @@
+import { FatalError } from '#errors';
+export declare class MissingKeyError extends FatalError {
+    constructor(environment?: string | null);
+}
+export declare class MissingCredentialError extends FatalError {
+    constructor(path: string);
+}
+export declare class InvalidCredentialsKeyError extends FatalError {
+    constructor(credentialsPath: string, underlyingError?: string);
+}
+export declare class MalformedCredentialsKeyError extends FatalError {
+    constructor(credentialsPath: string, detail: string);
+}

package/dist/credentials/errors.js

@@ -0,0 +1,39 @@
+import { FatalError } from '#errors';
+export class MissingKeyError extends FatalError {
+    constructor(environment) {
+        const envVar = environment ?
+            `OUTPUT_CREDENTIALS_KEY_${environment.toUpperCase()}` :
+            'OUTPUT_CREDENTIALS_KEY';
+        const keyFile = environment ?
+            `config/credentials/${environment}.key` :
+            'config/credentials.key';
+        super(`No credentials key found. Set ${envVar} env var or create ${keyFile}.`);
+        this.name = 'MissingKeyError';
+    }
+}
+export class MissingCredentialError extends FatalError {
+    constructor(path) {
+        super(`Required credential not found: "${path}".`);
+        this.name = 'MissingCredentialError';
+    }
+}
+export class InvalidCredentialsKeyError extends FatalError {
+    constructor(credentialsPath, underlyingError) {
+        const message = underlyingError ?
+            `Failed to decrypt ${credentialsPath}: ${underlyingError}. ` +
+                'The credentials key may not match the one used to encrypt this file, or the credentials file may be corrupted. ' +
+                'Check OUTPUT_CREDENTIALS_KEY env var or config/credentials.key.' :
+            `Failed to decrypt ${credentialsPath}. The credentials key does not match the one used to encrypt this file. ` +
+                'Check OUTPUT_CREDENTIALS_KEY env var or config/credentials.key.';
+        super(message);
+        this.name = 'InvalidCredentialsKeyError';
+    }
+}
+export class MalformedCredentialsKeyError extends FatalError {
+    constructor(credentialsPath, detail) {
+        super(`Credentials key for ${credentialsPath} is malformed (${detail}). ` +
+            'The key must be exactly 64 hex characters. ' +
+            'Check OUTPUT_CREDENTIALS_KEY env var or config/credentials.key for typos, whitespace, or truncation.');
+        this.name = 'MalformedCredentialsKeyError';
+    }
+}

package/dist/credentials/index.d.ts

@@ -0,0 +1,6 @@
+export { credentials, resolveCredentialRefs } from './credentials.js';
+export { setProvider } from './provider_registry.js';
+export { encrypt, decrypt, generateKey } from './encryption.js';
+export { InvalidCredentialsKeyError, MalformedCredentialsKeyError, MissingCredentialError, MissingKeyError } from './errors.js';
+export { getNestedValue, resolveCredentialsPath, resolveKeyPath, resolveKeyEnvVar, resolveWorkflowCredentialsPath, resolveWorkflowKeyPath, resolveWorkflowKeyEnvVar } from './paths.js';
+export type { CredentialsProvider } from './types.js';

package/dist/credentials/index.js

@@ -0,0 +1,5 @@
+export { credentials, resolveCredentialRefs } from './credentials.js';
+export { setProvider } from './provider_registry.js';
+export { encrypt, decrypt, generateKey } from './encryption.js';
+export { InvalidCredentialsKeyError, MalformedCredentialsKeyError, MissingCredentialError, MissingKeyError } from './errors.js';
+export { getNestedValue, resolveCredentialsPath, resolveKeyPath, resolveKeyEnvVar, resolveWorkflowCredentialsPath, resolveWorkflowKeyPath, resolveWorkflowKeyEnvVar } from './paths.js';

package/dist/credentials/init.d.ts

@@ -0,0 +1 @@
+export declare const init: () => void;

package/dist/credentials/init.js

@@ -0,0 +1,7 @@
+import { createChildLogger } from '#logger';
+import { resolveCredentialRefs } from './credentials.js';
+const log = createChildLogger('Credentials');
+export const init = () => {
+    const vars = resolveCredentialRefs();
+    log.info('Resolved credential env vars', { vars });
+};

package/dist/credentials/paths.d.ts

@@ -0,0 +1,7 @@
+export declare const resolveKeyEnvVar: (environment?: string) => string;
+export declare const resolveWorkflowKeyEnvVar: (workflowName: string) => string;
+export declare const resolveCredentialsPath: (baseDir: string, environment?: string) => string;
+export declare const resolveKeyPath: (baseDir: string, environment?: string) => string;
+export declare const resolveWorkflowCredentialsPath: (workflowDir: string) => string;
+export declare const resolveWorkflowKeyPath: (workflowDir: string) => string;
+export declare const getNestedValue: (obj: unknown, dotPath: string) => unknown;

package/dist/credentials/paths.js

@@ -0,0 +1,14 @@
+import { resolve } from 'node:path';
+export const resolveKeyEnvVar = (environment) => environment ?
+    `OUTPUT_CREDENTIALS_KEY_${environment.toUpperCase()}` :
+    'OUTPUT_CREDENTIALS_KEY';
+export const resolveWorkflowKeyEnvVar = (workflowName) => `OUTPUT_CREDENTIALS_KEY_${workflowName.toUpperCase()}`;
+export const resolveCredentialsPath = (baseDir, environment) => environment ?
+    resolve(baseDir, `config/credentials/${environment}.yml.enc`) :
+    resolve(baseDir, 'config/credentials.yml.enc');
+export const resolveKeyPath = (baseDir, environment) => environment ?
+    resolve(baseDir, `config/credentials/${environment}.key`) :
+    resolve(baseDir, 'config/credentials.key');
+export const resolveWorkflowCredentialsPath = (workflowDir) => resolve(workflowDir, 'credentials.yml.enc');
+export const resolveWorkflowKeyPath = (workflowDir) => resolve(workflowDir, 'credentials.key');
+export const getNestedValue = (obj, dotPath) => dotPath.split('.').reduce((acc, part) => acc && typeof acc === 'object' ? acc[part] : undefined, obj);

package/dist/credentials/provider_registry.d.ts

@@ -0,0 +1,3 @@
+import type { CredentialsProvider } from './types.js';
+export declare const getProvider: () => CredentialsProvider;
+export declare const setProvider: (provider: CredentialsProvider) => void;

package/dist/credentials/provider_registry.js

@@ -0,0 +1,6 @@
+import { encryptedYamlProvider } from './encrypted_yaml_provider.js';
+const registry = { provider: encryptedYamlProvider };
+export const getProvider = () => registry.provider;
+export const setProvider = (provider) => {
+    registry.provider = provider;
+};

package/dist/credentials/types.d.ts

@@ -0,0 +1,12 @@
+export interface GlobalContext {
+    environment: string | undefined;
+}
+export interface WorkflowContext {
+    workflowName: string;
+    workflowDir: string | undefined;
+    environment?: string | undefined;
+}
+export interface CredentialsProvider {
+    loadGlobal(context: GlobalContext): Record<string, unknown>;
+    loadForWorkflow(context: WorkflowContext): Record<string, unknown> | null;
+}

package/dist/credentials/types.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@outputai/core",
-  "version": "0.14.0",
+  "version": "0.14.1-next.51e8690.0",
   "description": "The core module of the output framework",
   "type": "module",
   "engines": {
@@ -26,11 +26,18 @@
     "./temporal": {
       "types": "./src/temporal/index.d.ts",
       "import": "./src/temporal/index.js"
+    },
+    "./credentials": {
+      "types": "./dist/credentials/index.d.ts",
+      "import": "./dist/credentials/index.js"
     }
   },
   "files": [
     "./src",
-    "./bin"
+    "./dist",
+    "./bin",
+    "!**/*.spec.*",
+    "!src/credentials"
   ],
   "bin": {
     "output-worker": "./bin/worker.sh",
@@ -45,12 +52,14 @@
     "@babel/parser": "7.29.2",
     "@babel/traverse": "7.29.0",
     "@babel/types": "7.29.0",
+    "@noble/ciphers": "2.2.0",
     "@temporalio/activity": "1.20.3",
     "@temporalio/client": "1.20.3",
     "@temporalio/common": "1.20.3",
     "@temporalio/worker": "1.20.3",
     "@temporalio/workflow": "1.20.3",
     "folder-hash": "4.1.3",
+    "js-yaml": "4.3.2",
     "json-stream-stringify": "3.1.6",
     "redis": "5.12.1",
     "stacktrace-parser": "0.1.11",
@@ -61,6 +70,7 @@
     "zod": ">=4.3 <5"
   },
   "devDependencies": {
+    "@types/js-yaml": "4.0.9",
     "zod": "4.3.6"
   },
   "license": "Apache-2.0",
@@ -70,6 +80,7 @@
   "imports": {
     "#bus": "./src/bus.js",
     "#consts": "./src/consts.js",
+    "#credentials/*": "./dist/credentials/*.js",
     "#errors": "./src/errors.js",
     "#logger": "./src/logger/index.js",
     "#hooks/*": "./src/hooks/*.js",
@@ -82,6 +93,6 @@
   },
   "scripts": {
     "worker": "node ./src/worker/index.js",
-    "build": "pnpm exec tsc -p ./tsconfig.typecheck.json"
+    "build": "rm -rf ./dist && tsc && pnpm exec tsc -p ./tsconfig.typecheck.json"
   }
 }

package/src/async_storage.d.ts

@@ -0,0 +1,4 @@
+// Minimal types so TS modules (credentials) can import this JS file
+export declare const Storage: {
+  load: () => { activityInfo: { workflowType: string }; workflowFilename: string } | undefined;
+};

package/src/consts.js

@@ -23,8 +23,6 @@ export const LifecycleEvent = {
 };
 
 export const BusEventType = {
-  WORKER_BEFORE_START: 'worker:before_start',
-
   WORKFLOW_END: 'workflow:end',
   WORKFLOW_ERROR: 'workflow:error',
   WORKFLOW_LOG: 'workflow:log',

package/src/helpers/object.d.ts

@@ -0,0 +1,2 @@
+// Minimal types so TS modules (credentials) can import this JS file
+export declare function deepMerge( base: Record<string, unknown>, overlay: Record<string, unknown> ): Record<string, unknown>;

package/src/hooks/index.d.ts

@@ -185,14 +185,6 @@ export type ErrorHookPayload =
  */
 export declare function onError( handler: ( payload: ErrorHookPayload ) => void ): void;
 
-/**
- * Register a handler to be invoked once, before the worker starts processing tasks.
- * It is invoked before Worker.create().
- *
- * @param handler - Function called with no arguments.
- */
-export declare function onBeforeWorkerStart( handler: () => void ): void;
-
 /**
  * Register a handler to be invoked when a workflow run starts.
  *

package/src/hooks/index.js

@@ -33,8 +33,6 @@ const onError = cb => {
     callHookCb( cb, { source: 'runtime', ...payload }, 'onError' ) );
 };
 
-const onBeforeWorkerStart = cb => mainEventBus.on( BusEventType.WORKER_BEFORE_START, () => callHookCb( cb, undefined, 'onBeforeWorkerStart' ) );
-
 // Workflow Life-cycle
 // --------------------------------------
 const onWorkflowStart = cb => mainEventBus.on( BusEventType.WORKFLOW_START, payload => callHookCb( cb, payload, 'onWorkflowStart' ) );
@@ -68,7 +66,6 @@ export {
   onActivityEnd,
   onActivityError,
   onActivityStart,
-  onBeforeWorkerStart,
   onError,
   onWorkflowEnd,
   onWorkflowError,

package/src/logger/index.d.ts

@@ -0,0 +1,4 @@
+// Minimal types so TS modules (credentials) can import this JS file
+export declare function createChildLogger( namespace: string ): {
+  info: ( message: string, meta?: Record<string, unknown> ) => void;
+};

package/src/worker/index.js

@@ -23,6 +23,7 @@ import { serializeError } from '#helpers/error_serializer';
 import { setupTemporalLogger } from './temporal_logger.js';
 import { WorkerRunner } from './worker_runner.js';
 import { shutdownServices } from './shutdown.js';
+import { init as initCredentials } from '#credentials/init';
 
 import './log_hooks.js';
 
@@ -76,7 +77,8 @@ const execute = async () => {
   log.info( 'Loading activities...', { callerDir } );
   const { activities } = await run( () => loadActivities( callerDir, workflows ) );
 
-  mainEventBus.emit( BusEventType.WORKER_BEFORE_START );
+  log.info( 'Initializing credentials...' );
+  run( initCredentials );
 
   log.info( 'Initializing tracing...' );
   await run( initTracing );

package/bin/healthcheck.spec.js

@@ -1,90 +0,0 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-
-const closeMock = vi.fn().mockResolvedValue( undefined );
-const connectionMock = { close: closeMock };
-
-const queryMock = vi.fn();
-const getHandleMock = vi.fn().mockReturnValue( { query: queryMock } );
-const ClientMock = vi.fn().mockImplementation( function () {
-  return { workflow: { getHandle: getHandleMock } };
-} );
-const connectMock = vi.fn().mockResolvedValue( connectionMock );
-
-vi.mock( '@temporalio/client', () => ( {
-  Connection: { connect: connectMock },
-  Client: ClientMock
-} ) );
-
-describe( 'bin/healthcheck', () => {
-  const exitMock = vi.fn();
-  const originalExit = process.exit;
-
-  beforeEach( () => {
-    vi.clearAllMocks();
-    process.exit = exitMock;
-    process.env.TEMPORAL_ADDRESS = 'localhost:7233';
-    process.env.TEMPORAL_NAMESPACE = 'default';
-    process.env.OUTPUT_CATALOG_ID = 'test-catalog';
-    delete process.env.TEMPORAL_API_KEY;
-  } );
-
-  afterEach( () => {
-    process.exit = originalExit;
-  } );
-
-  it( 'exits 0 when catalog ping returns "pong"', async () => {
-    queryMock.mockResolvedValue( 'pong' );
-    vi.resetModules();
-    await import( './healthcheck.mjs' );
-    expect( connectMock ).toHaveBeenCalledWith( {
-      address: 'localhost:7233',
-      tls: false,
-      apiKey: undefined
-    } );
-    expect( ClientMock ).toHaveBeenCalledWith( { connection: connectionMock, namespace: 'default' } );
-    expect( getHandleMock ).toHaveBeenCalledWith( 'test-catalog' );
-    expect( queryMock ).toHaveBeenCalledWith( 'ping' );
-    expect( exitMock ).toHaveBeenCalledWith( 0 );
-    expect( closeMock ).toHaveBeenCalled();
-  } );
-
-  it( 'uses TLS and apiKey when TEMPORAL_API_KEY is set', async () => {
-    process.env.TEMPORAL_API_KEY = 'secret';
-    queryMock.mockResolvedValue( 'pong' );
-    vi.resetModules();
-    await import( './healthcheck.mjs' );
-    expect( connectMock ).toHaveBeenCalledWith( {
-      address: 'localhost:7233',
-      tls: true,
-      apiKey: 'secret'
-    } );
-    expect( exitMock ).toHaveBeenCalledWith( 0 );
-  } );
-
-  it( 'uses default namespace and catalog id when env unset', async () => {
-    delete process.env.TEMPORAL_NAMESPACE;
-    delete process.env.OUTPUT_CATALOG_ID;
-    queryMock.mockResolvedValue( 'pong' );
-    vi.resetModules();
-    await import( './healthcheck.mjs' );
-    expect( ClientMock ).toHaveBeenCalledWith( { connection: connectionMock, namespace: 'default' } );
-    expect( getHandleMock ).toHaveBeenCalledWith( 'main' );
-    expect( exitMock ).toHaveBeenCalledWith( 0 );
-  } );
-
-  it( 'exits 1 when catalog ping returns non-pong', async () => {
-    queryMock.mockResolvedValue( 'nope' );
-    vi.resetModules();
-    await import( './healthcheck.mjs' );
-    expect( exitMock ).toHaveBeenCalledWith( 1 );
-    expect( closeMock ).toHaveBeenCalled();
-  } );
-
-  it( 'exits 1 when query throws', async () => {
-    queryMock.mockRejectedValue( new Error( 'connection refused' ) );
-    vi.resetModules();
-    await import( './healthcheck.mjs' );
-    expect( exitMock ).toHaveBeenCalledWith( 1 );
-    expect( closeMock ).toHaveBeenCalled();
-  } );
-} );