@outputai/credentials 0.1.3-dev.0 → 0.1.4-dev.0

package/dist/credentials.d.ts

@@ -1,3 +1,4 @@
+export declare const resolveCredentialRefs: () => string[];
 export declare const credentials: {
     get: (path: string, defaultValue?: unknown) => unknown;
     require: (path: string) => unknown;

package/dist/credentials.js

@@ -49,6 +49,25 @@ const load = () => {
     }
     return loadForWorkflow(workflowName, workflowDir);
 };
+const CREDENTIAL_REF_PREFIX = 'credential:';
+export const resolveCredentialRefs = () => {
+    const refs = Object.entries(process.env)
+        .filter(([, v]) => typeof v === 'string' && v.startsWith(CREDENTIAL_REF_PREFIX));
+    if (refs.length === 0) {
+        return [];
+    }
+    const data = loadGlobal();
+    const resolved = [];
+    for (const [envVar, value] of refs) {
+        const credPath = value.slice(CREDENTIAL_REF_PREFIX.length);
+        const credValue = getNestedValue(data, credPath);
+        if (typeof credValue === 'string' && credValue.length > 0) {
+            process.env[envVar] = credValue;
+            resolved.push(envVar);
+        }
+    }
+    return resolved;
+};
 export const credentials = {
     get: (path, defaultValue = undefined) => {
         const data = load();

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { credentials } from './credentials.js';
+export { credentials, resolveCredentialRefs } from './credentials.js';
 export { setProvider, getProvider } from './provider_registry.js';
 export { encryptedYamlProvider } from './encrypted_yaml_provider.js';
 export { encrypt, decrypt, generateKey } from './encryption.js';

package/dist/index.js

@@ -1,9 +1,13 @@
 import { setProvider } from './provider_registry.js';
 import { encryptedYamlProvider } from './encrypted_yaml_provider.js';
+import { onBeforeStart } from '@outputai/core/hooks';
+import { resolveCredentialRefs } from './credentials.js';
 // Auto-configure the default provider when the barrel is imported.
 // This keeps provider_registry.ts free of node:fs imports (sandbox-safe).
 setProvider(encryptedYamlProvider);
-export { credentials } from './credentials.js';
+// Resolve credential: env var references at worker startup.
+onBeforeStart(resolveCredentialRefs);
+export { credentials, resolveCredentialRefs } from './credentials.js';
 export { setProvider, getProvider } from './provider_registry.js';
 export { encryptedYamlProvider } from './encrypted_yaml_provider.js';
 export { encrypt, decrypt, generateKey } from './encryption.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@outputai/credentials",
-  "version": "0.1.3-dev.0",
+  "version": "0.1.4-dev.0",
   "description": "Encrypted credentials management for Output.ai workflows",
   "type": "module",
   "exports": {
@@ -17,7 +17,7 @@
     "js-yaml": "4.1.1"
   },
   "peerDependencies": {
-    "@outputai/core": "0.1.3-dev.0"
+    "@outputai/core": "0.1.4-dev.0"
   },
   "devDependencies": {
     "@types/js-yaml": "4.0.9"