@outputai/credentials 0.1.4-dev.0 → 0.1.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@outputai/credentials",
-  "version": "0.1.4-dev.0",
+  "version": "0.1.4",
   "description": "Encrypted credentials management for Output.ai workflows",
   "type": "module",
   "exports": {
@@ -17,7 +17,7 @@
     "js-yaml": "4.1.1"
   },
   "peerDependencies": {
-    "@outputai/core": "0.1.4-dev.0"
+    "@outputai/core": "0.1.4"
   },
   "devDependencies": {
     "@types/js-yaml": "4.0.9"

package/dist/credentials.d.ts

@@ -1,6 +0,0 @@
-export declare const resolveCredentialRefs: () => string[];
-export declare const credentials: {
-    get: (path: string, defaultValue?: unknown) => unknown;
-    require: (path: string) => unknown;
-    _reset: () => void;
-};

package/dist/credentials.js

@@ -1,87 +0,0 @@
-import { dirname } from 'node:path';
-import { MissingCredentialError } from './errors.js';
-import { getExecutionContext } from '@outputai/core/sdk_activity_integration';
-import { deepMerge } from '@outputai/core/sdk_utils';
-import { getProvider } from './provider_registry.js';
-const getNestedValue = (obj, dotPath) => dotPath.split('.').reduce((acc, part) => acc?.[part], obj);
-const detectEnvironment = () => {
-    const env = process.env.NODE_ENV;
-    return (env === 'production' || env === 'development') ? env : undefined;
-};
-const GLOBAL_CACHE_KEY = Symbol('global');
-const cache = new Map();
-const loadGlobal = () => {
-    if (cache.has(GLOBAL_CACHE_KEY)) {
-        return cache.get(GLOBAL_CACHE_KEY);
-    }
-    const data = getProvider().loadGlobal({ environment: detectEnvironment() });
-    cache.set(GLOBAL_CACHE_KEY, data);
-    return data;
-};
-const loadForWorkflow = (workflowName, workflowDir) => {
-    if (cache.has(workflowName)) {
-        return cache.get(workflowName);
-    }
-    const globalData = loadGlobal();
-    const workflowData = getProvider().loadForWorkflow({
-        workflowName,
-        workflowDir,
-        environment: detectEnvironment()
-    });
-    const merged = workflowData ? deepMerge(globalData, workflowData) : globalData;
-    cache.set(workflowName, merged);
-    return merged;
-};
-const getWorkflowContext = () => {
-    const ctx = getExecutionContext();
-    if (!ctx) {
-        return { workflowName: undefined, workflowDir: undefined };
-    }
-    return {
-        workflowName: ctx.workflow.name,
-        workflowDir: dirname(ctx.workflow.filename)
-    };
-};
-const load = () => {
-    const { workflowName, workflowDir } = getWorkflowContext();
-    if (!workflowName) {
-        return loadGlobal();
-    }
-    return loadForWorkflow(workflowName, workflowDir);
-};
-const CREDENTIAL_REF_PREFIX = 'credential:';
-export const resolveCredentialRefs = () => {
-    const refs = Object.entries(process.env)
-        .filter(([, v]) => typeof v === 'string' && v.startsWith(CREDENTIAL_REF_PREFIX));
-    if (refs.length === 0) {
-        return [];
-    }
-    const data = loadGlobal();
-    const resolved = [];
-    for (const [envVar, value] of refs) {
-        const credPath = value.slice(CREDENTIAL_REF_PREFIX.length);
-        const credValue = getNestedValue(data, credPath);
-        if (typeof credValue === 'string' && credValue.length > 0) {
-            process.env[envVar] = credValue;
-            resolved.push(envVar);
-        }
-    }
-    return resolved;
-};
-export const credentials = {
-    get: (path, defaultValue = undefined) => {
-        const data = load();
-        const value = getNestedValue(data, path);
-        return value !== undefined ? value : defaultValue;
-    },
-    require: (path) => {
-        const value = credentials.get(path);
-        if (value === undefined || value === null) {
-            throw new MissingCredentialError(path);
-        }
-        return value;
-    },
-    _reset: () => {
-        cache.clear();
-    }
-};

package/dist/credentials.spec.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/credentials.spec.js

@@ -1,392 +0,0 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import { dump as stringifyYaml } from 'js-yaml';
-import { encrypt, generateKey } from './encryption.js';
-const YAML_CONTENT = stringifyYaml({
-    anthropic: { api_key: 'sk-ant-test' },
-    aws: { region: 'us-east-1', secret: 'aws-secret' }
-});
-const WORKFLOW_YAML = stringifyYaml({
-    anthropic: { api_key: 'sk-ant-workflow' },
-    stripe: { secret_key: 'sk-stripe-wf' }
-});
-const SAVED_ENV = {};
-const SAVED_ARGV2 = process.argv[2];
-const ENV_KEYS = [
-    'OUTPUT_CREDENTIALS_KEY', 'OUTPUT_CREDENTIALS_KEY_PRODUCTION',
-    'OUTPUT_CREDENTIALS_KEY_DEVELOPMENT', 'OUTPUT_CREDENTIALS_KEY_MY_WORKFLOW',
-    'NODE_ENV'
-];
-const saveEnv = () => ENV_KEYS.forEach(k => {
-    SAVED_ENV[k] = process.env[k];
-});
-const restoreEnv = () => ENV_KEYS.forEach(k => {
-    if (SAVED_ENV[k] === undefined) {
-        delete process.env[k];
-    }
-    else {
-        process.env[k] = SAVED_ENV[k];
-    }
-});
-const clearEnv = () => ENV_KEYS.forEach(k => delete process.env[k]);
-const loadCredentials = async () => {
-    vi.resetModules();
-    const mod = await import('./index.js');
-    return mod.credentials;
-};
-describe('credentials module', () => {
-    const key = generateKey();
-    const ciphertext = encrypt(YAML_CONTENT, key);
-    beforeEach(() => {
-        saveEnv();
-        clearEnv();
-    });
-    afterEach(() => {
-        restoreEnv();
-        process.argv[2] = SAVED_ARGV2;
-    });
-    describe('get', () => {
-        it('should return nested value from decrypted YAML', async () => {
-            process.env.OUTPUT_CREDENTIALS_KEY = key;
-            vi.doMock('node:fs', () => ({
-                readFileSync: () => ciphertext,
-                existsSync: (path) => path.endsWith('credentials.yml.enc')
-            }));
-            const credentials = await loadCredentials();
-            expect(credentials.get('anthropic.api_key')).toBe('sk-ant-test');
-            expect(credentials.get('aws.region')).toBe('us-east-1');
-        });
-        it('should return default value for missing path', async () => {
-            process.env.OUTPUT_CREDENTIALS_KEY = key;
-            vi.doMock('node:fs', () => ({
-                readFileSync: () => ciphertext,
-                existsSync: (path) => path.endsWith('credentials.yml.enc')
-            }));
-            const credentials = await loadCredentials();
-            expect(credentials.get('nonexistent.key', 'fallback')).toBe('fallback');
-        });
-        it('should return undefined when path is missing and no default', async () => {
-            process.env.OUTPUT_CREDENTIALS_KEY = key;
-            vi.doMock('node:fs', () => ({
-                readFileSync: () => ciphertext,
-                existsSync: (path) => path.endsWith('credentials.yml.enc')
-            }));
-            const credentials = await loadCredentials();
-            expect(credentials.get('nonexistent')).toBeUndefined();
-        });
-        it('should return empty object when no credentials file exists', async () => {
-            vi.doMock('node:fs', () => ({
-                readFileSync: vi.fn(),
-                existsSync: () => false
-            }));
-            const credentials = await loadCredentials();
-            expect(credentials.get('anything')).toBeUndefined();
-            expect(credentials.get('anything', 'default')).toBe('default');
-        });
-    });
-    describe('require', () => {
-        it('should return value when credential exists', async () => {
-            process.env.OUTPUT_CREDENTIALS_KEY = key;
-            vi.doMock('node:fs', () => ({
-                readFileSync: () => ciphertext,
-                existsSync: (path) => path.endsWith('credentials.yml.enc')
-            }));
-            const credentials = await loadCredentials();
-            expect(credentials.require('aws.secret')).toBe('aws-secret');
-        });
-        it('should throw MissingCredentialError when credential is missing', async () => {
-            process.env.OUTPUT_CREDENTIALS_KEY = key;
-            vi.doMock('node:fs', () => ({
-                readFileSync: () => ciphertext,
-                existsSync: (path) => path.endsWith('credentials.yml.enc')
-            }));
-            const credentials = await loadCredentials();
-            expect(() => credentials.require('missing.path'))
-                .toThrow('Required credential not found: "missing.path"');
-        });
-    });
-    describe('key resolution', () => {
-        it('should prefer env var over key file', async () => {
-            process.env.OUTPUT_CREDENTIALS_KEY = key;
-            const readFileSync = vi.fn().mockReturnValue(ciphertext);
-            vi.doMock('node:fs', () => ({
-                readFileSync,
-                existsSync: (path) => path.endsWith('credentials.yml.enc')
-            }));
-            const credentials = await loadCredentials();
-            credentials.get('anthropic.api_key');
-            const keyFileCalls = readFileSync.mock.calls.filter((c) => c[0].endsWith('.key'));
-            expect(keyFileCalls).toHaveLength(0);
-        });
-        it('should fall back to key file when env var is not set', async () => {
-            const readFileSync = vi.fn().mockImplementation((path) => {
-                if (path.endsWith('.key')) {
-                    return key;
-                }
-                return ciphertext;
-            });
-            vi.doMock('node:fs', () => ({
-                readFileSync,
-                existsSync: () => true
-            }));
-            const credentials = await loadCredentials();
-            expect(credentials.get('anthropic.api_key')).toBe('sk-ant-test');
-        });
-        it('should throw MissingKeyError when no key source is available', async () => {
-            vi.doMock('node:fs', () => ({
-                readFileSync: vi.fn(),
-                existsSync: (path) => path.endsWith('credentials.yml.enc')
-            }));
-            const credentials = await loadCredentials();
-            expect(() => credentials.get('anything')).toThrow('No credentials key found');
-        });
-    });
-    describe('environment detection', () => {
-        it('should read environment-specific file when NODE_ENV=production', async () => {
-            process.env.NODE_ENV = 'production';
-            process.env.OUTPUT_CREDENTIALS_KEY_PRODUCTION = key;
-            vi.doMock('node:fs', () => ({
-                readFileSync: () => ciphertext,
-                existsSync: (path) => path.includes('credentials/production.yml.enc')
-            }));
-            const credentials = await loadCredentials();
-            expect(credentials.get('anthropic.api_key')).toBe('sk-ant-test');
-        });
-        it('should fall back to default when env-specific file does not exist', async () => {
-            process.env.NODE_ENV = 'development';
-            process.env.OUTPUT_CREDENTIALS_KEY = key;
-            vi.doMock('node:fs', () => ({
-                readFileSync: () => ciphertext,
-                existsSync: (path) => path.endsWith('credentials.yml.enc') && !path.includes('credentials/')
-            }));
-            const credentials = await loadCredentials();
-            expect(credentials.get('anthropic.api_key')).toBe('sk-ant-test');
-        });
-    });
-    describe('base directory resolution', () => {
-        it('should use process.argv[2] when it is an absolute path', async () => {
-            process.argv[2] = '/app/test_workflows';
-            process.env.OUTPUT_CREDENTIALS_KEY = key;
-            const paths = [];
-            vi.doMock('node:fs', () => ({
-                readFileSync: () => ciphertext,
-                existsSync: (path) => {
-                    paths.push(path);
-                    return path.endsWith('credentials.yml.enc');
-                }
-            }));
-            const credentials = await loadCredentials();
-            credentials.get('anthropic.api_key');
-            expect(paths.some(p => p.startsWith('/app/test_workflows/'))).toBe(true);
-        });
-        it('should fall back to process.cwd() when argv[2] is not absolute', async () => {
-            process.argv[2] = 'credentials';
-            process.env.OUTPUT_CREDENTIALS_KEY = key;
-            const paths = [];
-            vi.doMock('node:fs', () => ({
-                readFileSync: () => ciphertext,
-                existsSync: (path) => {
-                    paths.push(path);
-                    return path.endsWith('credentials.yml.enc');
-                }
-            }));
-            const credentials = await loadCredentials();
-            credentials.get('anthropic.api_key');
-            expect(paths.some(p => p.startsWith(process.cwd()))).toBe(true);
-            expect(paths.every(p => !p.startsWith('credentials/'))).toBe(true);
-        });
-    });
-    describe('caching', () => {
-        it('should cache loaded credentials across multiple get calls', async () => {
-            process.env.OUTPUT_CREDENTIALS_KEY = key;
-            const readFileSync = vi.fn().mockReturnValue(ciphertext);
-            vi.doMock('node:fs', () => ({
-                readFileSync,
-                existsSync: (path) => path.endsWith('credentials.yml.enc')
-            }));
-            const credentials = await loadCredentials();
-            credentials.get('anthropic.api_key');
-            credentials.get('aws.region');
-            credentials.get('aws.secret');
-            expect(readFileSync).toHaveBeenCalledTimes(1);
-        });
-        it('should re-read after _reset()', async () => {
-            process.env.OUTPUT_CREDENTIALS_KEY = key;
-            const readFileSync = vi.fn().mockReturnValue(ciphertext);
-            vi.doMock('node:fs', () => ({
-                readFileSync,
-                existsSync: (path) => path.endsWith('credentials.yml.enc')
-            }));
-            const credentials = await loadCredentials();
-            credentials.get('anthropic.api_key');
-            credentials._reset();
-            credentials.get('anthropic.api_key');
-            expect(readFileSync).toHaveBeenCalledTimes(2);
-        });
-    });
-    describe('per-workflow credentials', () => {
-        const workflowKey = generateKey();
-        const workflowCiphertext = encrypt(WORKFLOW_YAML, workflowKey);
-        it('should load workflow-specific credentials and deep-merge with global', async () => {
-            process.env.OUTPUT_CREDENTIALS_KEY = key;
-            vi.doMock('node:fs', () => ({
-                readFileSync: (path) => {
-                    if (path.includes('/workflows/my_workflow/credentials.yml.enc')) {
-                        return workflowCiphertext;
-                    }
-                    if (path.includes('/workflows/my_workflow/credentials.key')) {
-                        return workflowKey;
-                    }
-                    return ciphertext;
-                },
-                existsSync: (path) => path.endsWith('credentials.yml.enc') ||
-                    path.includes('/workflows/my_workflow/credentials.key')
-            }));
-            vi.doMock('@outputai/core/sdk_activity_integration', () => ({
-                getExecutionContext: () => ({ workflow: { id: 'test-id', name: 'my_workflow', filename: '/app/src/workflows/my_workflow/workflow.ts' } })
-            }));
-            const credentials = await loadCredentials();
-            expect(credentials.get('anthropic.api_key')).toBe('sk-ant-workflow');
-            expect(credentials.get('stripe.secret_key')).toBe('sk-stripe-wf');
-            expect(credentials.get('aws.region')).toBe('us-east-1');
-        });
-        it('should fall back to global when workflow has no credentials file', async () => {
-            process.env.OUTPUT_CREDENTIALS_KEY = key;
-            vi.doMock('node:fs', () => ({
-                readFileSync: () => ciphertext,
-                existsSync: (path) => path.endsWith('credentials.yml.enc') && !path.includes('/workflows/')
-            }));
-            vi.doMock('@outputai/core/sdk_activity_integration', () => ({
-                getExecutionContext: () => ({ workflow: { id: 'test-id', name: 'simple', filename: '/app/src/workflows/simple/workflow.ts' } })
-            }));
-            const credentials = await loadCredentials();
-            expect(credentials.get('anthropic.api_key')).toBe('sk-ant-test');
-        });
-        it('should use global key when workflow has no key file', async () => {
-            process.env.OUTPUT_CREDENTIALS_KEY = key;
-            const sharedCiphertext = encrypt(WORKFLOW_YAML, key);
-            vi.doMock('node:fs', () => ({
-                readFileSync: (path) => {
-                    if (path.includes('/workflows/my_workflow/credentials.yml.enc')) {
-                        return sharedCiphertext;
-                    }
-                    return ciphertext;
-                },
-                existsSync: (path) => {
-                    if (path.includes('/workflows/my_workflow/credentials.key')) {
-                        return false;
-                    }
-                    return path.endsWith('credentials.yml.enc');
-                }
-            }));
-            vi.doMock('@outputai/core/sdk_activity_integration', () => ({
-                getExecutionContext: () => ({ workflow: { id: 'test-id', name: 'my_workflow', filename: '/app/src/workflows/my_workflow/workflow.ts' } })
-            }));
-            const credentials = await loadCredentials();
-            expect(credentials.get('stripe.secret_key')).toBe('sk-stripe-wf');
-        });
-        it('should use workflow-specific env var key when set', async () => {
-            process.env.OUTPUT_CREDENTIALS_KEY = key;
-            process.env.OUTPUT_CREDENTIALS_KEY_MY_WORKFLOW = workflowKey;
-            vi.doMock('node:fs', () => ({
-                readFileSync: (path) => {
-                    if (path.includes('/workflows/my_workflow/credentials.yml.enc')) {
-                        return workflowCiphertext;
-                    }
-                    return ciphertext;
-                },
-                existsSync: (path) => path.endsWith('credentials.yml.enc')
-            }));
-            vi.doMock('@outputai/core/sdk_activity_integration', () => ({
-                getExecutionContext: () => ({ workflow: { id: 'test-id', name: 'my_workflow', filename: '/app/src/workflows/my_workflow/workflow.ts' } })
-            }));
-            const credentials = await loadCredentials();
-            expect(credentials.get('stripe.secret_key')).toBe('sk-stripe-wf');
-        });
-        it('should isolate cache between different workflows', async () => {
-            process.env.OUTPUT_CREDENTIALS_KEY = key;
-            const otherYaml = stringifyYaml({ custom: { value: 'other-wf' } });
-            const otherCiphertext = encrypt(otherYaml, key);
-            vi.doMock('node:fs', () => ({
-                readFileSync: (path) => {
-                    if (path.includes('/workflows/workflow_a/credentials.yml.enc')) {
-                        return encrypt(stringifyYaml({ custom: { value: 'wf-a' } }), key);
-                    }
-                    if (path.includes('/workflows/workflow_b/credentials.yml.enc')) {
-                        return otherCiphertext;
-                    }
-                    return ciphertext;
-                },
-                existsSync: (path) => path.endsWith('credentials.yml.enc')
-            }));
-            const ctx = { name: undefined, filename: undefined };
-            vi.doMock('@outputai/core/sdk_activity_integration', () => ({
-                getExecutionContext: () => ctx.name ? { workflow: { id: 'test-id', name: ctx.name, filename: ctx.filename } } : null
-            }));
-            const credentials = await loadCredentials();
-            ctx.name = 'workflow_a';
-            ctx.filename = '/app/src/workflows/workflow_a/workflow.ts';
-            expect(credentials.get('custom.value')).toBe('wf-a');
-            ctx.name = 'workflow_b';
-            ctx.filename = '/app/src/workflows/workflow_b/workflow.ts';
-            expect(credentials.get('custom.value')).toBe('other-wf');
-        });
-        it('should use global credentials when outside activity context', async () => {
-            process.env.OUTPUT_CREDENTIALS_KEY = key;
-            vi.doMock('node:fs', () => ({
-                readFileSync: () => ciphertext,
-                existsSync: (path) => path.endsWith('credentials.yml.enc')
-            }));
-            vi.doMock('@outputai/core/sdk_activity_integration', () => ({
-                getExecutionContext: () => null
-            }));
-            const credentials = await loadCredentials();
-            expect(credentials.get('anthropic.api_key')).toBe('sk-ant-test');
-        });
-        it('should clear all cached scopes on _reset()', async () => {
-            process.env.OUTPUT_CREDENTIALS_KEY = key;
-            const readFileSync = vi.fn().mockReturnValue(ciphertext);
-            vi.doMock('node:fs', () => ({
-                readFileSync,
-                existsSync: (path) => path.endsWith('credentials.yml.enc') && !path.includes('/workflows/')
-            }));
-            vi.doMock('@outputai/core/sdk_activity_integration', () => ({
-                getExecutionContext: () => ({ workflow: { id: 'test-id', name: 'test_wf', filename: '/app/src/workflows/test_wf/workflow.ts' } })
-            }));
-            const credentials = await loadCredentials();
-            credentials.get('anthropic.api_key');
-            credentials._reset();
-            credentials.get('anthropic.api_key');
-            expect(readFileSync).toHaveBeenCalledTimes(2);
-        });
-    });
-    describe('custom provider', () => {
-        it('should use a custom provider when set via registry', async () => {
-            const customProvider = {
-                loadGlobal: () => ({ custom: { key: 'from-provider' } }),
-                loadForWorkflow: () => null
-            };
-            vi.doMock('./encrypted_yaml_provider.js', () => ({
-                encryptedYamlProvider: customProvider
-            }));
-            const credentials = await loadCredentials();
-            expect(credentials.get('custom.key')).toBe('from-provider');
-        });
-        it('should deep-merge workflow provider data over global', async () => {
-            const customProvider = {
-                loadGlobal: () => ({ shared: 'global', base: { a: 1, b: 2 } }),
-                loadForWorkflow: () => ({ base: { b: 99 }, extra: 'wf-only' })
-            };
-            vi.doMock('./encrypted_yaml_provider.js', () => ({
-                encryptedYamlProvider: customProvider
-            }));
-            vi.doMock('@outputai/core/sdk_activity_integration', () => ({
-                getExecutionContext: () => ({ workflow: { id: 'test-id', name: 'test', filename: '/app/workflows/test/workflow.ts' } })
-            }));
-            const credentials = await loadCredentials();
-            expect(credentials.get('shared')).toBe('global');
-            expect(credentials.get('base.a')).toBe(1);
-            expect(credentials.get('base.b')).toBe(99);
-            expect(credentials.get('extra')).toBe('wf-only');
-        });
-    });
-});

package/dist/encrypted_yaml_provider.d.ts

@@ -1,2 +0,0 @@
-import type { CredentialsProvider } from './types.js';
-export declare const encryptedYamlProvider: CredentialsProvider;

package/dist/encrypted_yaml_provider.js

@@ -1,59 +0,0 @@
-import { readFileSync, existsSync } from 'node:fs';
-import { load as parseYaml } from 'js-yaml';
-import { decrypt } from './encryption.js';
-import { MissingKeyError } from './errors.js';
-import { resolveKeyEnvVar, resolveCredentialsPath, resolveKeyPath, resolveWorkflowCredentialsPath, resolveWorkflowKeyPath, resolveWorkflowKeyEnvVar } from './paths.js';
-const resolveBaseDir = () => {
-    const arg = process.argv[2];
-    return (arg && arg.startsWith('/')) ? arg : process.cwd();
-};
-const resolveKey = (environment) => {
-    const envVarName = resolveKeyEnvVar(environment);
-    if (process.env[envVarName]) {
-        return process.env[envVarName];
-    }
-    const keyFilePath = resolveKeyPath(resolveBaseDir(), environment);
-    if (existsSync(keyFilePath)) {
-        return readFileSync(keyFilePath, 'utf8').trim();
-    }
-    throw new MissingKeyError(environment);
-};
-const resolveWorkflowKey = (workflowName, workflowDir) => {
-    const envVarName = resolveWorkflowKeyEnvVar(workflowName);
-    if (process.env[envVarName]) {
-        return process.env[envVarName];
-    }
-    const keyPath = resolveWorkflowKeyPath(workflowDir);
-    if (existsSync(keyPath)) {
-        return readFileSync(keyPath, 'utf8').trim();
-    }
-    return resolveKey(undefined);
-};
-const decryptYaml = (credPath, key) => parseYaml(decrypt(readFileSync(credPath, 'utf8').trim(), key)) || {};
-export const encryptedYamlProvider = {
-    loadGlobal: ({ environment }) => {
-        const baseDir = resolveBaseDir();
-        const credPath = resolveCredentialsPath(baseDir, environment);
-        if (!existsSync(credPath)) {
-            if (environment) {
-                const defaultPath = resolveCredentialsPath(baseDir, undefined);
-                if (existsSync(defaultPath)) {
-                    return decryptYaml(defaultPath, resolveKey(undefined));
-                }
-            }
-            return {};
-        }
-        return decryptYaml(credPath, resolveKey(environment));
-    },
-    loadForWorkflow: ({ workflowName, workflowDir }) => {
-        if (!workflowDir) {
-            return null;
-        }
-        const credPath = resolveWorkflowCredentialsPath(workflowDir);
-        if (!existsSync(credPath)) {
-            return null;
-        }
-        const key = resolveWorkflowKey(workflowName, workflowDir);
-        return decryptYaml(credPath, key);
-    }
-};

package/dist/encrypted_yaml_provider.spec.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/encrypted_yaml_provider.spec.js

@@ -1,135 +0,0 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import { dump as stringifyYaml } from 'js-yaml';
-import { encrypt, generateKey } from './encryption.js';
-const YAML_CONTENT = stringifyYaml({
-    db: { host: 'localhost', password: 'secret' }
-});
-const SAVED_ENV = {};
-const SAVED_ARGV2 = process.argv[2];
-const ENV_KEYS = [
-    'OUTPUT_CREDENTIALS_KEY', 'OUTPUT_CREDENTIALS_KEY_PRODUCTION',
-    'OUTPUT_CREDENTIALS_KEY_MY_WORKFLOW', 'NODE_ENV'
-];
-const saveEnv = () => ENV_KEYS.forEach(k => {
-    SAVED_ENV[k] = process.env[k];
-});
-const restoreEnv = () => ENV_KEYS.forEach(k => {
-    if (SAVED_ENV[k] === undefined) {
-        delete process.env[k];
-    }
-    else {
-        process.env[k] = SAVED_ENV[k];
-    }
-});
-const clearEnv = () => ENV_KEYS.forEach(k => delete process.env[k]);
-const loadProvider = async () => {
-    vi.resetModules();
-    const mod = await import('./encrypted_yaml_provider.js');
-    return mod.encryptedYamlProvider;
-};
-describe('encrypted YAML provider', () => {
-    const key = generateKey();
-    const ciphertext = encrypt(YAML_CONTENT, key);
-    beforeEach(() => {
-        saveEnv();
-        clearEnv();
-    });
-    afterEach(() => {
-        restoreEnv();
-        process.argv[2] = SAVED_ARGV2;
-    });
-    describe('loadGlobal', () => {
-        it('should decrypt and parse YAML credentials', async () => {
-            process.env.OUTPUT_CREDENTIALS_KEY = key;
-            vi.doMock('node:fs', () => ({
-                readFileSync: () => ciphertext,
-                existsSync: (path) => path.endsWith('credentials.yml.enc')
-            }));
-            const provider = await loadProvider();
-            const result = provider.loadGlobal({ environment: undefined });
-            expect(result).toEqual({ db: { host: 'localhost', password: 'secret' } });
-        });
-        it('should return empty object when no credentials file exists', async () => {
-            vi.doMock('node:fs', () => ({
-                readFileSync: vi.fn(),
-                existsSync: () => false
-            }));
-            const provider = await loadProvider();
-            expect(provider.loadGlobal({ environment: undefined })).toEqual({});
-        });
-        it('should use environment-specific path when provided', async () => {
-            process.env.OUTPUT_CREDENTIALS_KEY_PRODUCTION = key;
-            const paths = [];
-            vi.doMock('node:fs', () => ({
-                readFileSync: () => ciphertext,
-                existsSync: (path) => {
-                    paths.push(path);
-                    return path.includes('credentials/production.yml.enc');
-                }
-            }));
-            const provider = await loadProvider();
-            provider.loadGlobal({ environment: 'production' });
-            expect(paths.some(p => p.includes('credentials/production.yml.enc')))
-                .toBe(true);
-        });
-        it('should throw MissingKeyError when no key available', async () => {
-            vi.doMock('node:fs', () => ({
-                readFileSync: () => ciphertext,
-                existsSync: (path) => path.endsWith('credentials.yml.enc')
-            }));
-            const provider = await loadProvider();
-            expect(() => provider.loadGlobal({ environment: undefined }))
-                .toThrow('No credentials key found');
-        });
-    });
-    describe('loadForWorkflow', () => {
-        it('should return null when workflowDir is undefined', async () => {
-            const provider = await loadProvider();
-            const result = provider.loadForWorkflow({
-                workflowName: 'test',
-                workflowDir: undefined
-            });
-            expect(result).toBeNull();
-        });
-        it('should return null when no workflow credentials file exists', async () => {
-            vi.doMock('node:fs', () => ({
-                readFileSync: vi.fn(),
-                existsSync: () => false
-            }));
-            const provider = await loadProvider();
-            const result = provider.loadForWorkflow({
-                workflowName: 'test',
-                workflowDir: '/app/workflows/test'
-            });
-            expect(result).toBeNull();
-        });
-        it('should decrypt workflow-specific credentials', async () => {
-            process.env.OUTPUT_CREDENTIALS_KEY = key;
-            vi.doMock('node:fs', () => ({
-                readFileSync: () => ciphertext,
-                existsSync: (path) => path.endsWith('credentials.yml.enc')
-            }));
-            const provider = await loadProvider();
-            const result = provider.loadForWorkflow({
-                workflowName: 'my_workflow',
-                workflowDir: '/app/workflows/my_workflow'
-            });
-            expect(result).toEqual({ db: { host: 'localhost', password: 'secret' } });
-        });
-        it('should use workflow-specific env var key when set', async () => {
-            const workflowKey = generateKey();
-            const workflowCipher = encrypt(YAML_CONTENT, workflowKey);
-            process.env.OUTPUT_CREDENTIALS_KEY_MY_WORKFLOW = workflowKey;
-            vi.doMock('node:fs', () => ({
-                readFileSync: () => workflowCipher,
-                existsSync: (path) => path.endsWith('credentials.yml.enc')
-            }));
-            const provider = await loadProvider();
-            const result = provider.loadForWorkflow({
-                workflowName: 'my_workflow',
-                workflowDir: '/app/workflows/my_workflow'
-            });
-            expect(result).toEqual({ db: { host: 'localhost', password: 'secret' } });
-        });
-    });
-});

package/dist/encryption.d.ts

@@ -1,3 +0,0 @@
-export declare const generateKey: () => string;
-export declare const encrypt: (plaintext: string, keyHex: string) => string;
-export declare const decrypt: (ciphertext: string, keyHex: string) => string;

package/dist/encryption.js

@@ -1,6 +0,0 @@
-import { gcm } from '@noble/ciphers/aes.js';
-import { managedNonce, randomBytes, hexToBytes, bytesToHex } from '@noble/ciphers/utils.js';
-const aes = managedNonce(gcm);
-export const generateKey = () => bytesToHex(randomBytes(32));
-export const encrypt = (plaintext, keyHex) => Buffer.from(aes(hexToBytes(keyHex)).encrypt(new TextEncoder().encode(plaintext))).toString('base64');
-export const decrypt = (ciphertext, keyHex) => new TextDecoder().decode(aes(hexToBytes(keyHex)).decrypt(Buffer.from(ciphertext, 'base64')));

package/dist/encryption.spec.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/encryption.spec.js

@@ -1,75 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { generateKey, encrypt, decrypt } from './encryption.js';
-describe('encryption module', () => {
-    describe('generateKey', () => {
-        it('should return a 64-character hex string', () => {
-            const key = generateKey();
-            expect(key).toHaveLength(64);
-            expect(key).toMatch(/^[0-9a-f]{64}$/);
-        });
-        it('should produce unique keys on each call', () => {
-            const keys = Array.from({ length: 10 }, () => generateKey());
-            const unique = new Set(keys);
-            expect(unique.size).toBe(10);
-        });
-    });
-    describe('encrypt + decrypt', () => {
-        it('should round-trip plaintext correctly', () => {
-            const key = generateKey();
-            const plaintext = 'hello world: this is a secret!';
-            const ciphertext = encrypt(plaintext, key);
-            const decrypted = decrypt(ciphertext, key);
-            expect(decrypted).toBe(plaintext);
-        });
-        it('should handle empty plaintext', () => {
-            const key = generateKey();
-            const ciphertext = encrypt('', key);
-            const decrypted = decrypt(ciphertext, key);
-            expect(decrypted).toBe('');
-        });
-        it('should handle unicode content', () => {
-            const key = generateKey();
-            const plaintext = 'api_key: sk-ant-🔑\nregion: 日本語テスト';
-            const ciphertext = encrypt(plaintext, key);
-            const decrypted = decrypt(ciphertext, key);
-            expect(decrypted).toBe(plaintext);
-        });
-        it('should produce a valid base64 string', () => {
-            const key = generateKey();
-            const ciphertext = encrypt('test', key);
-            expect(() => Buffer.from(ciphertext, 'base64')).not.toThrow();
-            const decoded = Buffer.from(ciphertext, 'base64');
-            expect(decoded.length).toBeGreaterThan(28);
-        });
-        it('should produce different ciphertext for same plaintext + key (random IV)', () => {
-            const key = generateKey();
-            const plaintext = 'same content';
-            const ct1 = encrypt(plaintext, key);
-            const ct2 = encrypt(plaintext, key);
-            expect(ct1).not.toBe(ct2);
-            expect(decrypt(ct1, key)).toBe(plaintext);
-            expect(decrypt(ct2, key)).toBe(plaintext);
-        });
-    });
-    describe('decrypt error cases', () => {
-        it('should throw when decrypting with wrong key', () => {
-            const key1 = generateKey();
-            const key2 = generateKey();
-            const ciphertext = encrypt('secret', key1);
-            expect(() => decrypt(ciphertext, key2)).toThrow();
-        });
-        it('should throw when ciphertext is too short', () => {
-            const key = generateKey();
-            const tooShort = Buffer.from('short').toString('base64');
-            expect(() => decrypt(tooShort, key)).toThrow();
-        });
-        it('should throw when ciphertext has been tampered with', () => {
-            const key = generateKey();
-            const ciphertext = encrypt('secret', key);
-            const buf = Buffer.from(ciphertext, 'base64');
-            buf[20] = (buf[20] + 1) % 256;
-            const tampered = buf.toString('base64');
-            expect(() => decrypt(tampered, key)).toThrow();
-        });
-    });
-});

package/dist/errors.d.ts

@@ -1,6 +0,0 @@
-export declare class MissingKeyError extends Error {
-    constructor(environment?: string | null);
-}
-export declare class MissingCredentialError extends Error {
-    constructor(path: string);
-}

package/dist/errors.js

@@ -1,16 +0,0 @@
-export class MissingKeyError extends Error {
-    constructor(environment) {
-        const envVar = environment ?
-            `OUTPUT_CREDENTIALS_KEY_${environment.toUpperCase()}` :
-            'OUTPUT_CREDENTIALS_KEY';
-        const keyFile = environment ?
-            `config/credentials/${environment}.key` :
-            'config/credentials.key';
-        super(`No credentials key found. Set ${envVar} env var or create ${keyFile}.`);
-    }
-}
-export class MissingCredentialError extends Error {
-    constructor(path) {
-        super(`Required credential not found: "${path}".`);
-    }
-}

package/dist/index.d.ts

@@ -1,7 +0,0 @@
-export { credentials, resolveCredentialRefs } from './credentials.js';
-export { setProvider, getProvider } from './provider_registry.js';
-export { encryptedYamlProvider } from './encrypted_yaml_provider.js';
-export { encrypt, decrypt, generateKey } from './encryption.js';
-export { MissingCredentialError, MissingKeyError } from './errors.js';
-export { getNestedValue, resolveCredentialsPath, resolveKeyPath, resolveKeyEnvVar, resolveWorkflowCredentialsPath, resolveWorkflowKeyPath, resolveWorkflowKeyEnvVar } from './paths.js';
-export type { CredentialsProvider, GlobalContext, WorkflowContext } from './types.js';

package/dist/index.js

@@ -1,15 +0,0 @@
-import { setProvider } from './provider_registry.js';
-import { encryptedYamlProvider } from './encrypted_yaml_provider.js';
-import { onBeforeStart } from '@outputai/core/hooks';
-import { resolveCredentialRefs } from './credentials.js';
-// Auto-configure the default provider when the barrel is imported.
-// This keeps provider_registry.ts free of node:fs imports (sandbox-safe).
-setProvider(encryptedYamlProvider);
-// Resolve credential: env var references at worker startup.
-onBeforeStart(resolveCredentialRefs);
-export { credentials, resolveCredentialRefs } from './credentials.js';
-export { setProvider, getProvider } from './provider_registry.js';
-export { encryptedYamlProvider } from './encrypted_yaml_provider.js';
-export { encrypt, decrypt, generateKey } from './encryption.js';
-export { MissingCredentialError, MissingKeyError } from './errors.js';
-export { getNestedValue, resolveCredentialsPath, resolveKeyPath, resolveKeyEnvVar, resolveWorkflowCredentialsPath, resolveWorkflowKeyPath, resolveWorkflowKeyEnvVar } from './paths.js';

package/dist/paths.d.ts

@@ -1,7 +0,0 @@
-export declare const resolveKeyEnvVar: (environment?: string) => string;
-export declare const resolveWorkflowKeyEnvVar: (workflowName: string) => string;
-export declare const resolveCredentialsPath: (baseDir: string, environment?: string) => string;
-export declare const resolveKeyPath: (baseDir: string, environment?: string) => string;
-export declare const resolveWorkflowCredentialsPath: (workflowDir: string) => string;
-export declare const resolveWorkflowKeyPath: (workflowDir: string) => string;
-export declare const getNestedValue: (obj: unknown, dotPath: string) => unknown;

package/dist/paths.js

@@ -1,14 +0,0 @@
-import { resolve } from 'node:path';
-export const resolveKeyEnvVar = (environment) => environment ?
-    `OUTPUT_CREDENTIALS_KEY_${environment.toUpperCase()}` :
-    'OUTPUT_CREDENTIALS_KEY';
-export const resolveWorkflowKeyEnvVar = (workflowName) => `OUTPUT_CREDENTIALS_KEY_${workflowName.toUpperCase()}`;
-export const resolveCredentialsPath = (baseDir, environment) => environment ?
-    resolve(baseDir, `config/credentials/${environment}.yml.enc`) :
-    resolve(baseDir, 'config/credentials.yml.enc');
-export const resolveKeyPath = (baseDir, environment) => environment ?
-    resolve(baseDir, `config/credentials/${environment}.key`) :
-    resolve(baseDir, 'config/credentials.key');
-export const resolveWorkflowCredentialsPath = (workflowDir) => resolve(workflowDir, 'credentials.yml.enc');
-export const resolveWorkflowKeyPath = (workflowDir) => resolve(workflowDir, 'credentials.key');
-export const getNestedValue = (obj, dotPath) => dotPath.split('.').reduce((acc, part) => acc && typeof acc === 'object' ? acc[part] : undefined, obj);

package/dist/provider_registry.d.ts

@@ -1,3 +0,0 @@
-import type { CredentialsProvider } from './types.js';
-export declare const getProvider: () => CredentialsProvider;
-export declare const setProvider: (provider: CredentialsProvider) => void;

package/dist/provider_registry.js

@@ -1,10 +0,0 @@
-const registry = { provider: null };
-export const getProvider = () => {
-    if (!registry.provider) {
-        throw new Error('No credentials provider configured. Call setProvider() first.');
-    }
-    return registry.provider;
-};
-export const setProvider = (provider) => {
-    registry.provider = provider;
-};

package/dist/types.d.ts

@@ -1,12 +0,0 @@
-export interface GlobalContext {
-    environment: string | undefined;
-}
-export interface WorkflowContext {
-    workflowName: string;
-    workflowDir: string | undefined;
-    environment?: string | undefined;
-}
-export interface CredentialsProvider {
-    loadGlobal(context: GlobalContext): Record<string, unknown>;
-    loadForWorkflow(context: WorkflowContext): Record<string, unknown> | null;
-}

package/dist/types.js

@@ -1 +0,0 @@
-export {};