@outputai/core 0.14.1-next.bd031f8.0 → 0.14.1-next.e9dfa49.0

package/dist/credentials/credentials.d.ts

@@ -0,0 +1,6 @@
+export declare const resolveCredentialRefs: () => string[];
+export declare const credentials: {
+    get: (path: string, defaultValue?: unknown) => unknown;
+    require: (path: string) => unknown;
+    _reset: () => void;
+};

package/dist/credentials/credentials.js

@@ -0,0 +1,87 @@
+import { dirname } from 'node:path';
+import { MissingCredentialError } from './errors.js';
+import { deepMerge } from '#helpers/object';
+import { getProvider } from './provider_registry.js';
+import { Storage } from '#async_storage';
+const getNestedValue = (obj, dotPath) => dotPath.split('.').reduce((acc, part) => acc?.[part], obj);
+const detectEnvironment = () => {
+    const env = process.env.NODE_ENV;
+    return (env === 'production' || env === 'development') ? env : undefined;
+};
+const GLOBAL_CACHE_KEY = Symbol('global');
+const cache = new Map();
+const loadGlobal = () => {
+    if (cache.has(GLOBAL_CACHE_KEY)) {
+        return cache.get(GLOBAL_CACHE_KEY);
+    }
+    const data = getProvider().loadGlobal({ environment: detectEnvironment() });
+    cache.set(GLOBAL_CACHE_KEY, data);
+    return data;
+};
+const loadForWorkflow = (workflowName, workflowDir) => {
+    if (cache.has(workflowName)) {
+        return cache.get(workflowName);
+    }
+    const globalData = loadGlobal();
+    const workflowData = getProvider().loadForWorkflow({
+        workflowName,
+        workflowDir,
+        environment: detectEnvironment()
+    });
+    const merged = workflowData ? deepMerge(globalData, workflowData) : globalData;
+    cache.set(workflowName, merged);
+    return merged;
+};
+const getWorkflowContext = () => {
+    const ctx = Storage.load();
+    if (!ctx) {
+        return { workflowName: undefined, workflowDir: undefined };
+    }
+    return {
+        workflowName: ctx.activityInfo.workflowType,
+        workflowDir: dirname(ctx.workflowFilename)
+    };
+};
+const load = () => {
+    const { workflowName, workflowDir } = getWorkflowContext();
+    if (!workflowName) {
+        return loadGlobal();
+    }
+    return loadForWorkflow(workflowName, workflowDir);
+};
+const CREDENTIAL_REF_PREFIX = 'credential:';
+export const resolveCredentialRefs = () => {
+    const refs = Object.entries(process.env)
+        .filter(([, v]) => typeof v === 'string' && v.startsWith(CREDENTIAL_REF_PREFIX));
+    if (refs.length === 0) {
+        return [];
+    }
+    const data = loadGlobal();
+    const resolved = [];
+    for (const [envVar, value] of refs) {
+        const credPath = value.slice(CREDENTIAL_REF_PREFIX.length);
+        const credValue = getNestedValue(data, credPath);
+        if (typeof credValue === 'string' && credValue.length > 0) {
+            process.env[envVar] = credValue;
+            resolved.push(envVar);
+        }
+    }
+    return resolved;
+};
+export const credentials = {
+    get: (path, defaultValue = undefined) => {
+        const data = load();
+        const value = getNestedValue(data, path);
+        return value !== undefined ? value : defaultValue;
+    },
+    require: (path) => {
+        const value = credentials.get(path);
+        if (value === undefined || value === null) {
+            throw new MissingCredentialError(path);
+        }
+        return value;
+    },
+    _reset: () => {
+        cache.clear();
+    }
+};

package/dist/credentials/encrypted_yaml_provider.d.ts

@@ -0,0 +1,2 @@
+import type { CredentialsProvider } from './types.js';
+export declare const encryptedYamlProvider: CredentialsProvider;

package/dist/credentials/encrypted_yaml_provider.js

@@ -0,0 +1,77 @@
+import { readFileSync, existsSync } from 'node:fs';
+import { load as parseYaml } from 'js-yaml';
+import { decrypt } from './encryption.js';
+import { InvalidCredentialsKeyError, MalformedCredentialsKeyError, MissingKeyError } from './errors.js';
+import { resolveKeyEnvVar, resolveCredentialsPath, resolveKeyPath, resolveWorkflowCredentialsPath, resolveWorkflowKeyPath, resolveWorkflowKeyEnvVar } from './paths.js';
+const resolveBaseDir = () => {
+    const arg = process.argv[2];
+    return (arg && arg.startsWith('/')) ? arg : process.cwd();
+};
+const resolveKey = (environment) => {
+    const envVarName = resolveKeyEnvVar(environment);
+    if (process.env[envVarName]) {
+        return process.env[envVarName];
+    }
+    const keyFilePath = resolveKeyPath(resolveBaseDir(), environment);
+    if (existsSync(keyFilePath)) {
+        return readFileSync(keyFilePath, 'utf8').trim();
+    }
+    throw new MissingKeyError(environment);
+};
+const resolveWorkflowKey = (workflowName, workflowDir) => {
+    const envVarName = resolveWorkflowKeyEnvVar(workflowName);
+    if (process.env[envVarName]) {
+        return process.env[envVarName];
+    }
+    const keyPath = resolveWorkflowKeyPath(workflowDir);
+    if (existsSync(keyPath)) {
+        return readFileSync(keyPath, 'utf8').trim();
+    }
+    return resolveKey(undefined);
+};
+const safeDecrypt = (ciphertext, key, credPath) => {
+    try {
+        return decrypt(ciphertext, key);
+    }
+    catch (error) {
+        if (error instanceof RangeError) {
+            throw new MalformedCredentialsKeyError(credPath, error.message);
+        }
+        if (error instanceof Error && error.message.includes('aes/gcm')) {
+            throw new InvalidCredentialsKeyError(credPath);
+        }
+        throw new InvalidCredentialsKeyError(credPath, error instanceof Error ? error.message : String(error));
+    }
+};
+const decryptYaml = (credPath, key) => {
+    const ciphertext = readFileSync(credPath, 'utf8').trim();
+    const plaintext = safeDecrypt(ciphertext, key, credPath);
+    return parseYaml(plaintext) || {};
+};
+export const encryptedYamlProvider = {
+    loadGlobal: ({ environment }) => {
+        const baseDir = resolveBaseDir();
+        const credPath = resolveCredentialsPath(baseDir, environment);
+        if (!existsSync(credPath)) {
+            if (environment) {
+                const defaultPath = resolveCredentialsPath(baseDir, undefined);
+                if (existsSync(defaultPath)) {
+                    return decryptYaml(defaultPath, resolveKey(undefined));
+                }
+            }
+            return {};
+        }
+        return decryptYaml(credPath, resolveKey(environment));
+    },
+    loadForWorkflow: ({ workflowName, workflowDir }) => {
+        if (!workflowDir) {
+            return null;
+        }
+        const credPath = resolveWorkflowCredentialsPath(workflowDir);
+        if (!existsSync(credPath)) {
+            return null;
+        }
+        const key = resolveWorkflowKey(workflowName, workflowDir);
+        return decryptYaml(credPath, key);
+    }
+};

package/dist/credentials/encryption.d.ts

@@ -0,0 +1,3 @@
+export declare const generateKey: () => string;
+export declare const encrypt: (plaintext: string, keyHex: string) => string;
+export declare const decrypt: (ciphertext: string, keyHex: string) => string;

package/dist/credentials/encryption.js

@@ -0,0 +1,6 @@
+import { gcm } from '@noble/ciphers/aes.js';
+import { managedNonce, randomBytes, hexToBytes, bytesToHex } from '@noble/ciphers/utils.js';
+const aes = managedNonce(gcm);
+export const generateKey = () => bytesToHex(randomBytes(32));
+export const encrypt = (plaintext, keyHex) => Buffer.from(aes(hexToBytes(keyHex)).encrypt(new TextEncoder().encode(plaintext))).toString('base64');
+export const decrypt = (ciphertext, keyHex) => new TextDecoder().decode(aes(hexToBytes(keyHex)).decrypt(Buffer.from(ciphertext, 'base64')));

package/dist/credentials/errors.d.ts

@@ -0,0 +1,13 @@
+import { FatalError } from '#errors';
+export declare class MissingKeyError extends FatalError {
+    constructor(environment?: string | null);
+}
+export declare class MissingCredentialError extends FatalError {
+    constructor(path: string);
+}
+export declare class InvalidCredentialsKeyError extends FatalError {
+    constructor(credentialsPath: string, underlyingError?: string);
+}
+export declare class MalformedCredentialsKeyError extends FatalError {
+    constructor(credentialsPath: string, detail: string);
+}

package/dist/credentials/errors.js

@@ -0,0 +1,39 @@
+import { FatalError } from '#errors';
+export class MissingKeyError extends FatalError {
+    constructor(environment) {
+        const envVar = environment ?
+            `OUTPUT_CREDENTIALS_KEY_${environment.toUpperCase()}` :
+            'OUTPUT_CREDENTIALS_KEY';
+        const keyFile = environment ?
+            `config/credentials/${environment}.key` :
+            'config/credentials.key';
+        super(`No credentials key found. Set ${envVar} env var or create ${keyFile}.`);
+        this.name = 'MissingKeyError';
+    }
+}
+export class MissingCredentialError extends FatalError {
+    constructor(path) {
+        super(`Required credential not found: "${path}".`);
+        this.name = 'MissingCredentialError';
+    }
+}
+export class InvalidCredentialsKeyError extends FatalError {
+    constructor(credentialsPath, underlyingError) {
+        const message = underlyingError ?
+            `Failed to decrypt ${credentialsPath}: ${underlyingError}. ` +
+                'The credentials key may not match the one used to encrypt this file, or the credentials file may be corrupted. ' +
+                'Check OUTPUT_CREDENTIALS_KEY env var or config/credentials.key.' :
+            `Failed to decrypt ${credentialsPath}. The credentials key does not match the one used to encrypt this file. ` +
+                'Check OUTPUT_CREDENTIALS_KEY env var or config/credentials.key.';
+        super(message);
+        this.name = 'InvalidCredentialsKeyError';
+    }
+}
+export class MalformedCredentialsKeyError extends FatalError {
+    constructor(credentialsPath, detail) {
+        super(`Credentials key for ${credentialsPath} is malformed (${detail}). ` +
+            'The key must be exactly 64 hex characters. ' +
+            'Check OUTPUT_CREDENTIALS_KEY env var or config/credentials.key for typos, whitespace, or truncation.');
+        this.name = 'MalformedCredentialsKeyError';
+    }
+}

package/dist/credentials/index.d.ts

@@ -0,0 +1,6 @@
+export { credentials, resolveCredentialRefs } from './credentials.js';
+export { setProvider } from './provider_registry.js';
+export { encrypt, decrypt, generateKey } from './encryption.js';
+export { InvalidCredentialsKeyError, MalformedCredentialsKeyError, MissingCredentialError, MissingKeyError } from './errors.js';
+export { getNestedValue, resolveCredentialsPath, resolveKeyPath, resolveKeyEnvVar, resolveWorkflowCredentialsPath, resolveWorkflowKeyPath, resolveWorkflowKeyEnvVar } from './paths.js';
+export type { CredentialsProvider } from './types.js';

package/dist/credentials/index.js

@@ -0,0 +1,5 @@
+export { credentials, resolveCredentialRefs } from './credentials.js';
+export { setProvider } from './provider_registry.js';
+export { encrypt, decrypt, generateKey } from './encryption.js';
+export { InvalidCredentialsKeyError, MalformedCredentialsKeyError, MissingCredentialError, MissingKeyError } from './errors.js';
+export { getNestedValue, resolveCredentialsPath, resolveKeyPath, resolveKeyEnvVar, resolveWorkflowCredentialsPath, resolveWorkflowKeyPath, resolveWorkflowKeyEnvVar } from './paths.js';

package/dist/credentials/init.d.ts

@@ -0,0 +1 @@
+export declare const init: () => void;

package/dist/credentials/init.js

@@ -0,0 +1,7 @@
+import { createChildLogger } from '#logger';
+import { resolveCredentialRefs } from './credentials.js';
+const log = createChildLogger('Credentials');
+export const init = () => {
+    const vars = resolveCredentialRefs();
+    log.info('Resolved credential env vars', { vars });
+};

package/dist/credentials/paths.d.ts

@@ -0,0 +1,7 @@
+export declare const resolveKeyEnvVar: (environment?: string) => string;
+export declare const resolveWorkflowKeyEnvVar: (workflowName: string) => string;
+export declare const resolveCredentialsPath: (baseDir: string, environment?: string) => string;
+export declare const resolveKeyPath: (baseDir: string, environment?: string) => string;
+export declare const resolveWorkflowCredentialsPath: (workflowDir: string) => string;
+export declare const resolveWorkflowKeyPath: (workflowDir: string) => string;
+export declare const getNestedValue: (obj: unknown, dotPath: string) => unknown;

package/dist/credentials/paths.js

@@ -0,0 +1,14 @@
+import { resolve } from 'node:path';
+export const resolveKeyEnvVar = (environment) => environment ?
+    `OUTPUT_CREDENTIALS_KEY_${environment.toUpperCase()}` :
+    'OUTPUT_CREDENTIALS_KEY';
+export const resolveWorkflowKeyEnvVar = (workflowName) => `OUTPUT_CREDENTIALS_KEY_${workflowName.toUpperCase()}`;
+export const resolveCredentialsPath = (baseDir, environment) => environment ?
+    resolve(baseDir, `config/credentials/${environment}.yml.enc`) :
+    resolve(baseDir, 'config/credentials.yml.enc');
+export const resolveKeyPath = (baseDir, environment) => environment ?
+    resolve(baseDir, `config/credentials/${environment}.key`) :
+    resolve(baseDir, 'config/credentials.key');
+export const resolveWorkflowCredentialsPath = (workflowDir) => resolve(workflowDir, 'credentials.yml.enc');
+export const resolveWorkflowKeyPath = (workflowDir) => resolve(workflowDir, 'credentials.key');
+export const getNestedValue = (obj, dotPath) => dotPath.split('.').reduce((acc, part) => acc && typeof acc === 'object' ? acc[part] : undefined, obj);

package/dist/credentials/provider_registry.d.ts

@@ -0,0 +1,3 @@
+import type { CredentialsProvider } from './types.js';
+export declare const getProvider: () => CredentialsProvider;
+export declare const setProvider: (provider: CredentialsProvider) => void;

package/dist/credentials/provider_registry.js

@@ -0,0 +1,6 @@
+import { encryptedYamlProvider } from './encrypted_yaml_provider.js';
+const registry = { provider: encryptedYamlProvider };
+export const getProvider = () => registry.provider;
+export const setProvider = (provider) => {
+    registry.provider = provider;
+};

package/dist/credentials/types.d.ts

@@ -0,0 +1,12 @@
+export interface GlobalContext {
+    environment: string | undefined;
+}
+export interface WorkflowContext {
+    workflowName: string;
+    workflowDir: string | undefined;
+    environment?: string | undefined;
+}
+export interface CredentialsProvider {
+    loadGlobal(context: GlobalContext): Record<string, unknown>;
+    loadForWorkflow(context: WorkflowContext): Record<string, unknown> | null;
+}

package/dist/credentials/types.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@outputai/core",
-  "version": "0.14.1-next.bd031f8.0",
+  "version": "0.14.1-next.e9dfa49.0",
   "description": "The core module of the output framework",
   "type": "module",
   "engines": {
@@ -26,11 +26,18 @@
     "./temporal": {
       "types": "./src/temporal/index.d.ts",
       "import": "./src/temporal/index.js"
+    },
+    "./credentials": {
+      "types": "./dist/credentials/index.d.ts",
+      "import": "./dist/credentials/index.js"
     }
   },
   "files": [
     "./src",
-    "./bin"
+    "./dist",
+    "./bin",
+    "!**/*.spec.*",
+    "!src/credentials"
   ],
   "bin": {
     "output-worker": "./bin/worker.sh",
@@ -39,29 +46,32 @@
     "output-copy-assets": "./bin/copy_assets.js"
   },
   "dependencies": {
-    "@aws-sdk/client-s3": "3.1038.0",
-    "@aws-sdk/lib-storage": "3.1038.0",
+    "@aws-sdk/client-s3": "3.1138.0",
+    "@aws-sdk/lib-storage": "3.1138.0",
     "@babel/generator": "7.29.1",
-    "@babel/parser": "7.29.2",
+    "@babel/parser": "7.29.9",
     "@babel/traverse": "7.29.0",
     "@babel/types": "7.29.0",
-    "@temporalio/activity": "1.20.3",
-    "@temporalio/client": "1.20.3",
-    "@temporalio/common": "1.20.3",
-    "@temporalio/worker": "1.20.3",
-    "@temporalio/workflow": "1.20.3",
+    "@noble/ciphers": "2.4.0",
+    "@temporalio/activity": "1.24.0",
+    "@temporalio/client": "1.24.0",
+    "@temporalio/common": "1.24.0",
+    "@temporalio/worker": "1.24.0",
+    "@temporalio/workflow": "1.24.0",
     "folder-hash": "4.1.3",
-    "json-stream-stringify": "3.1.6",
+    "js-yaml": "5.4.2",
+    "json-stream-stringify": "3.1.7",
     "redis": "5.12.1",
     "stacktrace-parser": "0.1.11",
-    "undici": "8.9.0",
+    "undici": "8.11.0",
     "winston": "3.19.0"
   },
   "peerDependencies": {
     "zod": ">=4.3 <5"
   },
   "devDependencies": {
-    "zod": "4.3.6"
+    "@types/js-yaml": "4.0.9",
+    "zod": "4.6.5"
   },
   "license": "Apache-2.0",
   "publishConfig": {
@@ -70,6 +80,7 @@
   "imports": {
     "#bus": "./src/bus.js",
     "#consts": "./src/consts.js",
+    "#credentials/*": "./dist/credentials/*.js",
     "#errors": "./src/errors.js",
     "#logger": "./src/logger/index.js",
     "#hooks/*": "./src/hooks/*.js",
@@ -82,6 +93,6 @@
   },
   "scripts": {
     "worker": "node ./src/worker/index.js",
-    "build": "pnpm exec tsc -p ./tsconfig.typecheck.json"
+    "build": "rm -rf ./dist && tsc && pnpm exec tsc -p ./tsconfig.typecheck.json"
   }
 }

package/src/async_storage.d.ts

@@ -0,0 +1,4 @@
+// Minimal types so TS modules (credentials) can import this JS file
+export declare const Storage: {
+  load: () => { activityInfo: { workflowType: string }; workflowFilename: string } | undefined;
+};

package/src/consts.js

@@ -23,8 +23,6 @@ export const LifecycleEvent = {
 };
 
 export const BusEventType = {
-  WORKER_BEFORE_START: 'worker:before_start',
-
   WORKFLOW_END: 'workflow:end',
   WORKFLOW_ERROR: 'workflow:error',
   WORKFLOW_LOG: 'workflow:log',

package/src/helpers/object.d.ts

@@ -0,0 +1,2 @@
+// Minimal types so TS modules (credentials) can import this JS file
+export declare function deepMerge( base: Record<string, unknown>, overlay: Record<string, unknown> ): Record<string, unknown>;

package/src/helpers/search_attributes.js

@@ -0,0 +1,25 @@
+const serializeValue = value => typeof value?.toISOString === 'function' ? value.toISOString() : value;
+
+/**
+ * Converts Datetime (Date) search attribute values to ISO strings so the result survives JSON and structured-clone boundaries identically.
+ *
+ * @param {Record<string, unknown[]>} [searchAttributes] Temporal untyped search attributes
+ * @returns {Record<string, Array<string|number|boolean>>|undefined} Undefined when there are no attributes
+ */
+export const serializeSearchAttributes = searchAttributes =>
+  Object.keys( searchAttributes ?? {} ).length ?
+    Object.fromEntries( Object.entries( searchAttributes ).map( ( [ k, values ] ) => [ k, values.map( serializeValue ) ] ) ) :
+    undefined;
+
+const isSystemAttribute = name => name.startsWith( 'Temporal' ) || name === 'BuildIds';
+
+/**
+ * Drops Temporal system search attributes so the rest can be forwarded to child workflows.
+ *
+ * @param {Record<string, unknown[]>} [searchAttributes] Temporal untyped search attributes
+ * @returns {Record<string, unknown[]>|undefined} Undefined when nothing remains
+ */
+export const inheritableSearchAttributes = searchAttributes => {
+  const entries = Object.entries( searchAttributes ?? {} ).filter( ( [ k ] ) => !isSystemAttribute( k ) );
+  return entries.length ? Object.fromEntries( entries ) : undefined;
+};

package/src/helpers/temporal_context.js

@@ -1,3 +1,5 @@
+import { serializeSearchAttributes } from './search_attributes.js';
+
 export const createWorkflowDetails = info => ( {
   attempt: info.attempt,
   continuedFromExecutionRunId: info.continuedFromExecutionRunId,
@@ -8,5 +10,6 @@ export const createWorkflowDetails = info => ( {
   runStartTime: info.runStartTime.getTime(),
   startTime: info.startTime.getTime(),
   workflowId: info.workflowId,
-  workflowType: info.workflowType
+  workflowType: info.workflowType,
+  searchAttributes: serializeSearchAttributes( info.searchAttributes )
 } );

package/src/hooks/index.d.ts

@@ -77,6 +77,12 @@ export interface WorkflowDetails {
    * Starts at 1 and increments for every retry if there is a `retryPolicy`
    */
   attempt: number;
+  /**
+   * Temporal search attributes set on this workflow execution, if any. Datetime values are ISO strings.
+   * Uses the untyped form because `typedSearchAttributes` does not survive the sink/activity-header
+   * serialization boundary (https://github.com/temporalio/sdk-typescript/issues/1635).
+   */
+  searchAttributes?: Record<string, string[] | number[] | boolean[]>;
 }
 
 /**
@@ -185,14 +191,6 @@ export type ErrorHookPayload =
  */
 export declare function onError( handler: ( payload: ErrorHookPayload ) => void ): void;
 
-/**
- * Register a handler to be invoked once, before the worker starts processing tasks.
- * It is invoked before Worker.create().
- *
- * @param handler - Function called with no arguments.
- */
-export declare function onBeforeWorkerStart( handler: () => void ): void;
-
 /**
  * Register a handler to be invoked when a workflow run starts.
  *

package/src/hooks/index.js

@@ -33,8 +33,6 @@ const onError = cb => {
     callHookCb( cb, { source: 'runtime', ...payload }, 'onError' ) );
 };
 
-const onBeforeWorkerStart = cb => mainEventBus.on( BusEventType.WORKER_BEFORE_START, () => callHookCb( cb, undefined, 'onBeforeWorkerStart' ) );
-
 // Workflow Life-cycle
 // --------------------------------------
 const onWorkflowStart = cb => mainEventBus.on( BusEventType.WORKFLOW_START, payload => callHookCb( cb, payload, 'onWorkflowStart' ) );
@@ -68,7 +66,6 @@ export {
   onActivityEnd,
   onActivityError,
   onActivityStart,
-  onBeforeWorkerStart,
   onError,
   onWorkflowEnd,
   onWorkflowError,

package/src/interface/workflow.js

@@ -2,6 +2,7 @@
 import { proxyActivities, inWorkflowContext, executeChild, workflowInfo, uuid4, ParentClosePolicy, upsertMemo } from '@temporalio/workflow';
 import { WorkflowValidator } from './validations/index.js';
 import { toUrlSafeBase64 } from '#helpers/string';
+import { inheritableSearchAttributes } from '#helpers/search_attributes';
 import { WorkflowContext } from '#helpers/workflow_context';
 import { deepMerge } from '#helpers/object';
 import { defaultOptions } from './workflow_activity_options.js';
@@ -48,7 +49,7 @@ export function workflow( { name, description, inputSchema, outputSchema, fn, op
       );
     }
 
-    const { workflowId, runId, memo, root } = workflowInfo();
+    const { workflowId, runId, memo, root, searchAttributes } = workflowInfo();
     const isRoot = !root;
 
     checkGlobalContextContamination( runId );
@@ -59,7 +60,14 @@ export function workflow( { name, description, inputSchema, outputSchema, fn, op
       const parentClosePolicy = ParentClosePolicy[invocationOptions?.detached ? 'ABANDON' : 'TERMINATE'];
       const childWorkflowId = `${workflowId}-${toUrlSafeBase64( uuid4() )}`;
       const args = [ input, { activityOptions: invocationOptions?.activityOptions } ];
-      return executeChild( name, { args, workflowId: childWorkflowId, parentClosePolicy, memo } );
+      const childSearchAttributes = inheritableSearchAttributes( searchAttributes );
+      return executeChild( name, {
+        args,
+        workflowId: childWorkflowId,
+        parentClosePolicy,
+        memo,
+        ...( childSearchAttributes && { searchAttributes: childSearchAttributes } )
+      } );
     }
 
     // Resolve the activity options: invocation options > definition options > parent options > default options, then enforce final SDK options

package/src/logger/index.d.ts

@@ -0,0 +1,4 @@
+// Minimal types so TS modules (credentials) can import this JS file
+export declare function createChildLogger( namespace: string ): {
+  info: ( message: string, meta?: Record<string, unknown> ) => void;
+};

package/src/worker/index.js

@@ -23,6 +23,7 @@ import { serializeError } from '#helpers/error_serializer';
 import { setupTemporalLogger } from './temporal_logger.js';
 import { WorkerRunner } from './worker_runner.js';
 import { shutdownServices } from './shutdown.js';
+import { init as initCredentials } from '#credentials/init';
 
 import './log_hooks.js';
 
@@ -76,7 +77,8 @@ const execute = async () => {
   log.info( 'Loading activities...', { callerDir } );
   const { activities } = await run( () => loadActivities( callerDir, workflows ) );
 
-  mainEventBus.emit( BusEventType.WORKER_BEFORE_START );
+  log.info( 'Initializing credentials...' );
+  run( initCredentials );
 
   log.info( 'Initializing tracing...' );
   await run( initTracing );