@outputai/credentials 0.2.1-next.fd72d95.0 → 0.3.0

package/dist/encrypted_yaml_provider.js

@@ -1,7 +1,7 @@
 import { readFileSync, existsSync } from 'node:fs';
 import { load as parseYaml } from 'js-yaml';
 import { decrypt } from './encryption.js';
-import { MissingKeyError } from './errors.js';
+import { InvalidCredentialsKeyError, MalformedCredentialsKeyError, MissingKeyError } from './errors.js';
 import { resolveKeyEnvVar, resolveCredentialsPath, resolveKeyPath, resolveWorkflowCredentialsPath, resolveWorkflowKeyPath, resolveWorkflowKeyEnvVar } from './paths.js';
 const resolveBaseDir = () => {
     const arg = process.argv[2];
@@ -29,7 +29,25 @@ const resolveWorkflowKey = (workflowName, workflowDir) => {
     }
     return resolveKey(undefined);
 };
-const decryptYaml = (credPath, key) => parseYaml(decrypt(readFileSync(credPath, 'utf8').trim(), key)) || {};
+const safeDecrypt = (ciphertext, key, credPath) => {
+    try {
+        return decrypt(ciphertext, key);
+    }
+    catch (error) {
+        if (error instanceof RangeError) {
+            throw new MalformedCredentialsKeyError(credPath, error.message);
+        }
+        if (error instanceof Error && error.message.includes('aes/gcm')) {
+            throw new InvalidCredentialsKeyError(credPath);
+        }
+        throw new InvalidCredentialsKeyError(credPath, error instanceof Error ? error.message : String(error));
+    }
+};
+const decryptYaml = (credPath, key) => {
+    const ciphertext = readFileSync(credPath, 'utf8').trim();
+    const plaintext = safeDecrypt(ciphertext, key, credPath);
+    return parseYaml(plaintext) || {};
+};
 export const encryptedYamlProvider = {
     loadGlobal: ({ environment }) => {
         const baseDir = resolveBaseDir();

package/dist/encrypted_yaml_provider.spec.js

@@ -81,6 +81,70 @@ describe('encrypted YAML provider', () => {
             expect(() => provider.loadGlobal({ environment: undefined }))
                 .toThrow('No credentials key found');
         });
+        it('should throw InvalidCredentialsKeyError when the key does not match the encrypted file', async () => {
+            process.env.OUTPUT_CREDENTIALS_KEY = generateKey();
+            vi.doMock('node:fs', () => ({
+                readFileSync: () => ciphertext,
+                existsSync: (path) => path.endsWith('credentials.yml.enc')
+            }));
+            const provider = await loadProvider();
+            const { InvalidCredentialsKeyError } = await import('./errors.js');
+            expect(() => provider.loadGlobal({ environment: undefined }))
+                .toThrow(InvalidCredentialsKeyError);
+            expect(() => provider.loadGlobal({ environment: undefined }))
+                .toThrow(/Failed to decrypt .*credentials\.yml\.enc/);
+        });
+        it('should throw MalformedCredentialsKeyError when the key has the wrong length', async () => {
+            process.env.OUTPUT_CREDENTIALS_KEY = key.slice(0, 55);
+            vi.doMock('node:fs', () => ({
+                readFileSync: () => ciphertext,
+                existsSync: (path) => path.endsWith('credentials.yml.enc')
+            }));
+            const provider = await loadProvider();
+            const { MalformedCredentialsKeyError } = await import('./errors.js');
+            expect(() => provider.loadGlobal({ environment: undefined }))
+                .toThrow(MalformedCredentialsKeyError);
+            expect(() => provider.loadGlobal({ environment: undefined }))
+                .toThrow(/must be exactly 64 hex characters/);
+        });
+        it('should throw MalformedCredentialsKeyError when the key contains non-hex characters', async () => {
+            process.env.OUTPUT_CREDENTIALS_KEY = `${key.slice(0, 10)} ${key.slice(11)}`;
+            vi.doMock('node:fs', () => ({
+                readFileSync: () => ciphertext,
+                existsSync: (path) => path.endsWith('credentials.yml.enc')
+            }));
+            const provider = await loadProvider();
+            const { MalformedCredentialsKeyError } = await import('./errors.js');
+            expect(() => provider.loadGlobal({ environment: undefined }))
+                .toThrow(MalformedCredentialsKeyError);
+            expect(() => provider.loadGlobal({ environment: undefined }))
+                .toThrow(/typos, whitespace, or truncation/);
+        });
+        it('should throw InvalidCredentialsKeyError with the underlying message for unknown decrypt failures', async () => {
+            process.env.OUTPUT_CREDENTIALS_KEY = key;
+            vi.doMock('node:fs', () => ({
+                readFileSync: () => ciphertext,
+                existsSync: (path) => path.endsWith('credentials.yml.enc')
+            }));
+            vi.doMock('./encryption.js', () => ({
+                decrypt: () => {
+                    throw new Error('unexpected internal failure');
+                }
+            }));
+            try {
+                const provider = await loadProvider();
+                const { InvalidCredentialsKeyError } = await import('./errors.js');
+                expect(() => provider.loadGlobal({ environment: undefined }))
+                    .toThrow(InvalidCredentialsKeyError);
+                expect(() => provider.loadGlobal({ environment: undefined }))
+                    .toThrow(/unexpected internal failure/);
+                expect(() => provider.loadGlobal({ environment: undefined }))
+                    .toThrow(/may not match.*or the credentials file may be corrupted/);
+            }
+            finally {
+                vi.doUnmock('./encryption.js');
+            }
+        });
     });
     describe('loadForWorkflow', () => {
         it('should return null when workflowDir is undefined', async () => {

package/dist/errors.d.ts

@@ -4,3 +4,9 @@ export declare class MissingKeyError extends Error {
 export declare class MissingCredentialError extends Error {
     constructor(path: string);
 }
+export declare class InvalidCredentialsKeyError extends Error {
+    constructor(credentialsPath: string, underlyingError?: string);
+}
+export declare class MalformedCredentialsKeyError extends Error {
+    constructor(credentialsPath: string, detail: string);
+}

package/dist/errors.js

@@ -7,10 +7,32 @@ export class MissingKeyError extends Error {
             `config/credentials/${environment}.key` :
             'config/credentials.key';
         super(`No credentials key found. Set ${envVar} env var or create ${keyFile}.`);
+        this.name = 'MissingKeyError';
     }
 }
 export class MissingCredentialError extends Error {
     constructor(path) {
         super(`Required credential not found: "${path}".`);
+        this.name = 'MissingCredentialError';
+    }
+}
+export class InvalidCredentialsKeyError extends Error {
+    constructor(credentialsPath, underlyingError) {
+        const message = underlyingError ?
+            `Failed to decrypt ${credentialsPath}: ${underlyingError}. ` +
+                'The credentials key may not match the one used to encrypt this file, or the credentials file may be corrupted. ' +
+                'Check OUTPUT_CREDENTIALS_KEY env var or config/credentials.key.' :
+            `Failed to decrypt ${credentialsPath}. The credentials key does not match the one used to encrypt this file. ` +
+                'Check OUTPUT_CREDENTIALS_KEY env var or config/credentials.key.';
+        super(message);
+        this.name = 'InvalidCredentialsKeyError';
+    }
+}
+export class MalformedCredentialsKeyError extends Error {
+    constructor(credentialsPath, detail) {
+        super(`Credentials key for ${credentialsPath} is malformed (${detail}). ` +
+            'The key must be exactly 64 hex characters. ' +
+            'Check OUTPUT_CREDENTIALS_KEY env var or config/credentials.key for typos, whitespace, or truncation.');
+        this.name = 'MalformedCredentialsKeyError';
     }
 }

package/dist/hooks.js

@@ -1,6 +1,6 @@
 import { setProvider } from './provider_registry.js';
 import { encryptedYamlProvider } from './encrypted_yaml_provider.js';
-import { onBeforeStart } from '@outputai/core/hooks';
+import { onBeforeWorkerStart } from '@outputai/core/hooks';
 import { resolveCredentialRefs } from './credentials.js';
 setProvider(encryptedYamlProvider);
-onBeforeStart(resolveCredentialRefs);
+onBeforeWorkerStart(resolveCredentialRefs);

package/dist/index.d.ts

@@ -3,6 +3,6 @@ export { credentials, resolveCredentialRefs } from './credentials.js';
 export { setProvider, getProvider } from './provider_registry.js';
 export { encryptedYamlProvider } from './encrypted_yaml_provider.js';
 export { encrypt, decrypt, generateKey } from './encryption.js';
-export { MissingCredentialError, MissingKeyError } from './errors.js';
+export { InvalidCredentialsKeyError, MalformedCredentialsKeyError, MissingCredentialError, MissingKeyError } from './errors.js';
 export { getNestedValue, resolveCredentialsPath, resolveKeyPath, resolveKeyEnvVar, resolveWorkflowCredentialsPath, resolveWorkflowKeyPath, resolveWorkflowKeyEnvVar } from './paths.js';
 export type { CredentialsProvider, GlobalContext, WorkflowContext } from './types.js';

package/dist/index.js

@@ -3,5 +3,5 @@ export { credentials, resolveCredentialRefs } from './credentials.js';
 export { setProvider, getProvider } from './provider_registry.js';
 export { encryptedYamlProvider } from './encrypted_yaml_provider.js';
 export { encrypt, decrypt, generateKey } from './encryption.js';
-export { MissingCredentialError, MissingKeyError } from './errors.js';
+export { InvalidCredentialsKeyError, MalformedCredentialsKeyError, MissingCredentialError, MissingKeyError } from './errors.js';
 export { getNestedValue, resolveCredentialsPath, resolveKeyPath, resolveKeyEnvVar, resolveWorkflowCredentialsPath, resolveWorkflowKeyPath, resolveWorkflowKeyEnvVar } from './paths.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@outputai/credentials",
-  "version": "0.2.1-next.fd72d95.0",
+  "version": "0.3.0",
   "description": "Encrypted credentials management for Output.ai workflows",
   "type": "module",
   "exports": {
@@ -19,7 +19,7 @@
   "dependencies": {
     "@noble/ciphers": "2.2.0",
     "js-yaml": "4.1.1",
-    "@outputai/core": "0.2.1-next.fd72d95.0"
+    "@outputai/core": "0.3.0"
   },
   "devDependencies": {
     "@types/js-yaml": "4.0.9"