@pikku/core 0.12.8 → 0.12.10

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 ## 0.12.4
 
+## 0.12.10
+
+### Patch Changes
+
+- 0f59432: Add per-user credential system with CredentialService, OAuth2 route handlers, and KyselyCredentialService with envelope encryption
+- 52b64d1: Provide workflow wire to graph nodes for sleep/suspend support. Graph nodes now receive a workflow wire alongside the graph wire, enabling tools like `graph:sleep` to work in graph execution context. Improves dynamic workflow system instructions with output path documentation, nested path examples, and design principles for AI agents.
+
+## 0.12.9
+
+### Patch Changes
+
+- e412b4d: Replace raw Error throws in AI agent runner/stream/prepare with typed PikkuError subclasses. `AIProviderNotConfiguredError` (503) replaces "AIAgentRunnerService not available" with a user-friendly message. `AIProviderAuthError` (401) available for API key validation errors.
+- 53dc8c8: Fix toWebRequest to respect x-forwarded-proto and x-forwarded-host headers behind reverse proxies. Previously always used http:// which broke OAuth callback URLs behind TLS-terminating proxies like Fly.io.
+- 0a1cc51: Add secure defaults for cookie authentication: httpOnly, secure, sameSite 'lax', and path '/'. User-provided options override these defaults.
+- 0a1cc51: Prevent internal error details from leaking to clients. Stack traces via exposeErrors are now blocked in production. SSE and WebSocket error handlers use registered error responses instead of raw error messages. Secret key names and route paths are no longer included in error messages.
+- 0a1cc51: Cap form-urlencoded parameters at 256 to prevent abuse via unbounded parameter parsing.
+- 0a1cc51: Add path traversal protection to LocalContent file operations. Asset keys are now validated to stay within the configured upload directory.
+- 0a1cc51: Use private Symbol for global pikku state key to prevent external code from accessing framework internals via Symbol.for().
+- 0a1cc51: Filter out **proto**, constructor, and prototype keys during request data merging to prevent prototype pollution.
+- 0a1cc51: Improve LocalContent URL signing with proper signedAt/expiresAt parameters. When an optional JWTService is provided, URLs include a cryptographic signature for verification.
+- 0a1cc51: Fix timeout middleware to use Promise.race instead of throwing inside setTimeout, which caused uncatchable exceptions that crashed the process.
+- 0a1cc51: Use constant-time comparison for static bearer token authentication to prevent timing side-channel attacks.
+- 8b9b2e9: Fix child workflow completion in queued execution mode. When a sub-workflow completes, the parent step is now marked as succeeded and the parent orchestrator resumes automatically via `onChildWorkflowCompleted`. Adds `parentStepId` to `WorkflowRunWire` to track the parent step without querying. Retains advisory locks in PgKyselyWorkflowService for concurrency safety. Fixes pgboss `registerQueues` to accept an optional logger parameter.
+- 8b9b2e9: Add debug-level logging to workflow service for step scheduling, execution, and orchestration to aid troubleshooting.
+- b973d44: Add `inline` property to workflow function definitions. When `inline: true` is set on a workflow, it always executes inline without dispatching to the queue service, even when a queue service is available. This is useful for workflows that should run synchronously within the parent process (e.g. scaffolding/setup steps that produce local files).
+
+  The flag flows from the function definition through the inspector, into the serialized workflow graph, and is checked at runtime by the workflow service.
+
+- 8b9b2e9: Strip undefined values from workflow step data before dispatching to the queue service, preventing postgres UNDEFINED_VALUE errors.
+- 8b9b2e9: Support sub-workflow invocation in graph-based workflow steps. When a step's rpcName refers to a registered workflow instead of an RPC function, `executeGraphStep` now starts it as a child workflow and polls for completion. Respects the `inline` meta flag on the sub-workflow.
+
 ## 0.12.8
 
 ### Patch Changes

package/dist/env.d.ts

@@ -0,0 +1 @@
+export declare const isProduction: () => boolean;

package/dist/env.js

@@ -0,0 +1 @@
+export const isProduction = () => process.env.NODE_ENV === 'production';

package/dist/errors/errors.d.ts

@@ -204,3 +204,17 @@ export declare class MaxComputeTimeReachedError extends PikkuError {
  */
 export declare class MissingSchemaError extends PikkuError {
 }
+/**
+ * An AI provider has not been configured. Set up an AI provider (e.g. OpenAI, Anthropic) to use agent features.
+ * @group Error
+ */
+export declare class AIProviderNotConfiguredError extends PikkuError {
+    constructor();
+}
+/**
+ * The AI provider API key is missing or invalid.
+ * @group Error
+ */
+export declare class AIProviderAuthError extends PikkuError {
+    constructor(message?: string);
+}

package/dist/errors/errors.js

@@ -347,3 +347,30 @@ addError(MissingSchemaError, {
     status: 500,
     message: 'A required schema was not found. Ensure schema generation has been run.',
 });
+/**
+ * An AI provider has not been configured. Set up an AI provider (e.g. OpenAI, Anthropic) to use agent features.
+ * @group Error
+ */
+export class AIProviderNotConfiguredError extends PikkuError {
+    constructor() {
+        super('No AI provider configured. Please set up an AI provider (e.g. OpenAI, Anthropic) and provide a valid API key to use this agent.');
+    }
+}
+addError(AIProviderNotConfiguredError, {
+    status: 503,
+    message: 'No AI provider configured. Please set up an AI provider (e.g. OpenAI, Anthropic) and provide a valid API key to use this agent.',
+});
+/**
+ * The AI provider API key is missing or invalid.
+ * @group Error
+ */
+export class AIProviderAuthError extends PikkuError {
+    constructor(message) {
+        super(message ||
+            'AI provider API key is missing or invalid. Please check your API key configuration.');
+    }
+}
+addError(AIProviderAuthError, {
+    status: 401,
+    message: 'AI provider API key is missing or invalid. Please check your API key configuration.',
+});

package/dist/function/function-runner.d.ts

@@ -2,11 +2,12 @@ import type { CoreServices, CoreUserSession, CorePikkuMiddleware, PikkuWiringTyp
 import type { CorePikkuChannelMiddleware } from '../wirings/channel/channel.types.js';
 import type { CorePermissionGroup, CorePikkuFunctionConfig, CorePikkuPermission } from './functions.types.js';
 import type { SessionService } from '../services/user-session-service.js';
+import type { PikkuCredentialWireService } from '../services/credential-wire-service.js';
 export declare const addFunction: (funcName: string, funcConfig: CorePikkuFunctionConfig<any, any>, packageName?: string | null) => void;
 export declare const getFunctionNames: (packageName?: string | null) => string[];
 export declare const getAllFunctionNames: () => string[];
 export declare const runPikkuFuncDirectly: <In, Out>(funcName: string, allServices: CoreServices, wire: PikkuWire, data: In, userSession?: SessionService<CoreUserSession>, packageName?: string | null) => Promise<Out>;
-export declare const runPikkuFunc: <In = any, Out = any>(wireType: PikkuWiringTypes, wireId: string, funcName: string, { singletonServices, createWireServices, data, auth: wiringAuth, inheritedMiddleware, wireMiddleware, inheritedChannelMiddleware, wireChannelMiddleware, inheritedPermissions, wirePermissions, coerceDataFromSchema, tags, wire, sessionService, packageName, }: {
+export declare const runPikkuFunc: <In = any, Out = any>(wireType: PikkuWiringTypes, wireId: string, funcName: string, { singletonServices, createWireServices, data, auth: wiringAuth, inheritedMiddleware, wireMiddleware, inheritedChannelMiddleware, wireChannelMiddleware, inheritedPermissions, wirePermissions, coerceDataFromSchema, tags, wire, sessionService, credentialWireService, packageName, }: {
     singletonServices: CoreSingletonServices;
     createWireServices?: CreateWireServices;
     data: () => Promise<In> | In;
@@ -21,5 +22,6 @@ export declare const runPikkuFunc: <In = any, Out = any>(wireType: PikkuWiringTy
     tags?: string[];
     wire: PikkuWire;
     sessionService?: SessionService<CoreUserSession>;
+    credentialWireService?: PikkuCredentialWireService;
     packageName?: string | null;
 }) => Promise<Out>;

package/dist/function/function-runner.js

@@ -6,6 +6,7 @@ import { coerceTopLevelDataFromSchema, validateSchema } from '../schema.js';
 import { parseVersionedId } from '../version.js';
 import { createFunctionSessionWireProps } from '../services/user-session-service.js';
 import { ForbiddenError, ReadonlySessionError } from '../errors/errors.js';
+import { createWireServicesCredentialWireProps } from '../services/credential-wire-service.js';
 import { rpcService } from '../wirings/rpc/rpc-runner.js';
 import { closeWireServices } from '../utils.js';
 /**
@@ -70,7 +71,7 @@ export const runPikkuFuncDirectly = async (funcName, allServices, wire, data, us
     };
     return (await funcConfig.func(allServices, data, wireWithSession));
 };
-export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServices, createWireServices, data, auth: wiringAuth, inheritedMiddleware, wireMiddleware, inheritedChannelMiddleware, wireChannelMiddleware, inheritedPermissions, wirePermissions, coerceDataFromSchema, tags = [], wire, sessionService, packageName = null, }) => {
+export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServices, createWireServices, data, auth: wiringAuth, inheritedMiddleware, wireMiddleware, inheritedChannelMiddleware, wireChannelMiddleware, inheritedPermissions, wirePermissions, coerceDataFromSchema, tags = [], wire, sessionService, credentialWireService, packageName = null, }) => {
     wire.wireType ??= wireType;
     wire.wireId ??= wireId;
     const funcMap = pikkuState(packageName, 'function', 'functions');
@@ -188,6 +189,9 @@ export const runPikkuFunc = async (wireType, wireId, funcName, { singletonServic
                 packageName,
             });
         }
+        if (credentialWireService) {
+            Object.assign(resolvedWire, createWireServicesCredentialWireProps(credentialWireService));
+        }
         const wireServices = await resolvedCreateWireServices?.(resolvedSingletonServices, resolvedWire);
         try {
             const services = wireServices && Object.keys(wireServices).length > 0

package/dist/handle-error.js

@@ -1,3 +1,4 @@
+import { isProduction } from './env.js';
 import { getErrorResponse } from './errors/error-handler.js';
 import { NotFoundError } from './errors/errors.js';
 /**
@@ -41,7 +42,7 @@ export const handleHTTPError = (e, http, trackerId, logger, logWarningsForStatus
         if (trackerId) {
             logger.warn(`Error id: ${trackerId}`);
             const errorBody = { errorId: trackerId };
-            if (exposeErrors && e instanceof Error) {
+            if (exposeErrors && !isProduction() && e instanceof Error) {
                 errorBody.message = e.message;
                 errorBody.stack = e.stack;
             }

package/dist/middleware/auth-bearer.js

@@ -1,5 +1,14 @@
 import { InvalidSessionError } from '../errors/errors.js';
 import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js';
+const constantTimeEqual = (a, b) => {
+    if (a.length !== b.length)
+        return false;
+    let result = 0;
+    for (let i = 0; i < a.length; i++) {
+        result |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    }
+    return result === 0;
+};
 /**
  * Bearer token middleware that extracts and validates tokens from the Authorization header.
  *
@@ -41,7 +50,7 @@ export const authBearer = pikkuMiddlewareFactory(({ token } = {}) => pikkuMiddle
             throw new InvalidSessionError();
         }
         let userSession = null;
-        if (token && bearerToken === token.value) {
+        if (token && constantTimeEqual(bearerToken, token.value)) {
             userSession = token.userSession;
         }
         else if (jwtService && !token) {

package/dist/middleware/auth-cookie.js

@@ -28,31 +28,40 @@ import { getRelativeTimeOffsetFromNow } from '../time-utils.js';
  * ])
  * ```
  */
-export const authCookie = pikkuMiddlewareFactory(({ name, options, expiresIn }) => pikkuMiddleware(async ({ jwt: jwtService, logger }, { http, setSession, getSession, session, hasSessionChanged }, next) => {
-    if (!http?.request || !setSession || session) {
-        return next();
-    }
-    const cookieValue = http.request.cookie(name);
-    if (cookieValue && jwtService) {
-        const userSession = await jwtService.decode(cookieValue);
-        if (userSession) {
-            setSession?.(userSession);
+export const authCookie = pikkuMiddlewareFactory(({ name, options, expiresIn }) => {
+    const mergedOptions = {
+        httpOnly: true,
+        secure: true,
+        sameSite: 'lax',
+        path: '/',
+        ...options,
+    };
+    return pikkuMiddleware(async ({ jwt: jwtService, logger }, { http, setSession, getSession, session, hasSessionChanged }, next) => {
+        if (!http?.request || !setSession || session) {
+            return next();
         }
-    }
-    await next();
-    if (!http?.response) {
-        return;
-    }
-    if (hasSessionChanged?.()) {
-        const currentSession = await getSession?.();
-        if (jwtService) {
-            http.response.cookie(name, await jwtService.encode(expiresIn, currentSession), {
-                ...options,
-                expires: getRelativeTimeOffsetFromNow(expiresIn),
-            });
+        const cookieValue = http.request.cookie(name);
+        if (cookieValue && jwtService) {
+            const userSession = await jwtService.decode(cookieValue);
+            if (userSession) {
+                setSession?.(userSession);
+            }
         }
-        else {
-            logger.warn('No JWT service available, unable to set cookie');
+        await next();
+        if (!http?.response) {
+            return;
         }
-    }
-}));
+        if (hasSessionChanged?.()) {
+            const currentSession = await getSession?.();
+            if (jwtService) {
+                http.response.cookie(name, await jwtService.encode(expiresIn, currentSession), {
+                    ...mergedOptions,
+                    expires: getRelativeTimeOffsetFromNow(expiresIn),
+                });
+            }
+            else {
+                logger.warn('No JWT service available, unable to set cookie');
+            }
+        }
+    });
+});

package/dist/middleware/timeout.js

@@ -1,9 +1,15 @@
 import { RequestTimeoutError } from '../errors/errors.js';
 import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js';
 export const timeout = () => pikkuMiddlewareFactory(({ timeout }) => pikkuMiddleware(async (_services, _wire, next) => {
-    const timeoutId = setTimeout(() => {
-        throw new RequestTimeoutError();
-    }, timeout);
-    await next();
-    clearTimeout(timeoutId);
+    let timeoutId;
+    await Promise.race([
+        next(),
+        new Promise((_resolve, reject) => {
+            timeoutId = setTimeout(() => reject(new RequestTimeoutError()), timeout);
+        }),
+    ]).finally(() => {
+        if (timeoutId !== undefined) {
+            clearTimeout(timeoutId);
+        }
+    });
 }));

package/dist/pikku-state.js

@@ -1,4 +1,4 @@
-const PIKKU_STATE_KEY = Symbol.for('@pikku/core/state');
+const PIKKU_STATE_KEY = Symbol('@pikku/core/state');
 export const getAllPackageStates = () => {
     if (!globalThis[PIKKU_STATE_KEY]) {
         ;

package/dist/services/credential-service.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Interface for managing dynamic/managed credentials.
+ * Used for OAuth tokens, per-user API keys, and other credentials
+ * that change at runtime (as opposed to SecretService which is for
+ * static, developer-configured values).
+ */
+export interface CredentialService {
+    /**
+     * Retrieves a credential by name and optional user ID.
+     * @param name - The credential name (e.g. 'stripe', 'google-sheets').
+     * @param userId - Optional user ID for per-user credentials. Omit for platform-level.
+     * @returns The credential value, or null if not found.
+     */
+    get<T = unknown>(name: string, userId?: string): Promise<T | null>;
+    /**
+     * Stores a credential.
+     * @param name - The credential name.
+     * @param value - The credential value to store.
+     * @param userId - Optional user ID for per-user credentials. Omit for platform-level.
+     */
+    set(name: string, value: unknown, userId?: string): Promise<void>;
+    /**
+     * Deletes a credential.
+     * @param name - The credential name.
+     * @param userId - Optional user ID for per-user credentials. Omit for platform-level.
+     */
+    delete(name: string, userId?: string): Promise<void>;
+    /**
+     * Checks if a credential exists.
+     * @param name - The credential name.
+     * @param userId - Optional user ID for per-user credentials. Omit for platform-level.
+     */
+    has(name: string, userId?: string): Promise<boolean>;
+    /**
+     * Retrieves all credentials for a user.
+     * @param userId - The user ID.
+     * @returns A record of credential name to value.
+     */
+    getAll(userId: string): Promise<Record<string, unknown>>;
+}

package/dist/services/credential-service.js

@@ -0,0 +1 @@
+export {};

package/dist/services/credential-wire-service.d.ts

@@ -0,0 +1,13 @@
+export declare class PikkuCredentialWireService {
+    private credentials;
+    set(name: string, value: unknown): void;
+    getAll(): Record<string, unknown>;
+    getScoped(allowedNames: string[]): Record<string, unknown>;
+}
+export declare function createMiddlewareCredentialWireProps(credentialWire: PikkuCredentialWireService): {
+    setCredential: (name: string, value: unknown) => void;
+};
+export declare function createWireServicesCredentialWireProps(credentialWire: PikkuCredentialWireService, allowedNames?: string[]): {
+    setCredential: (name: string, value: unknown) => void;
+    getCredentials: () => Record<string, unknown>;
+};

package/dist/services/credential-wire-service.js

@@ -0,0 +1,31 @@
+export class PikkuCredentialWireService {
+    credentials = {};
+    set(name, value) {
+        this.credentials[name] = value;
+    }
+    getAll() {
+        return this.credentials;
+    }
+    getScoped(allowedNames) {
+        const scoped = {};
+        for (const name of allowedNames) {
+            if (name in this.credentials) {
+                scoped[name] = this.credentials[name];
+            }
+        }
+        return scoped;
+    }
+}
+export function createMiddlewareCredentialWireProps(credentialWire) {
+    return {
+        setCredential: (name, value) => credentialWire.set(name, value),
+    };
+}
+export function createWireServicesCredentialWireProps(credentialWire, allowedNames) {
+    return {
+        setCredential: (name, value) => credentialWire.set(name, value),
+        getCredentials: () => allowedNames
+            ? credentialWire.getScoped(allowedNames)
+            : credentialWire.getAll(),
+    };
+}

package/dist/services/index.d.ts

@@ -5,8 +5,10 @@ export { LogLevel } from './logger.js';
 export { ScopedSecretService } from './scoped-secret-service.js';
 export { PikkuSessionService, createMiddlewareSessionWireProps, createFunctionSessionWireProps, } from './user-session-service.js';
 export { TypedSecretService } from './typed-secret-service.js';
+export { PikkuCredentialWireService, createMiddlewareCredentialWireProps, createWireServicesCredentialWireProps, } from './credential-wire-service.js';
 export { TypedVariablesService } from './typed-variables-service.js';
 export { LocalSecretService } from './local-secrets.js';
+export { LocalCredentialService } from './local-credential-service.js';
 export { LocalVariablesService } from './local-variables.js';
 export { ConsoleLogger } from './logger-console.js';
 export { InMemoryWorkflowService } from './in-memory-workflow-service.js';
@@ -28,4 +30,7 @@ export type { AIStorageService } from './ai-storage-service.js';
 export type { AIAgentRunnerParams, AIAgentRunnerResult, AIAgentStepResult, AIAgentRunnerService, } from './ai-agent-runner-service.js';
 export type { CreateRunInput, AIRunStateService, } from './ai-run-state-service.js';
 export type { CredentialStatus, CredentialMeta, } from './typed-secret-service.js';
+export type { CredentialService } from './credential-service.js';
+export { TypedCredentialService } from './typed-credential-service.js';
+export type { CredentialStatusInfo, CredentialMetaInfo, } from './typed-credential-service.js';
 export type { VariableStatus, VariableMeta } from './typed-variables-service.js';

package/dist/services/index.js

@@ -5,11 +5,14 @@ export { LogLevel } from './logger.js';
 export { ScopedSecretService } from './scoped-secret-service.js';
 export { PikkuSessionService, createMiddlewareSessionWireProps, createFunctionSessionWireProps, } from './user-session-service.js';
 export { TypedSecretService } from './typed-secret-service.js';
+export { PikkuCredentialWireService, createMiddlewareCredentialWireProps, createWireServicesCredentialWireProps, } from './credential-wire-service.js';
 export { TypedVariablesService } from './typed-variables-service.js';
 export { LocalSecretService } from './local-secrets.js';
+export { LocalCredentialService } from './local-credential-service.js';
 export { LocalVariablesService } from './local-variables.js';
 export { ConsoleLogger } from './logger-console.js';
 export { InMemoryWorkflowService } from './in-memory-workflow-service.js';
 export { InMemoryTriggerService } from './in-memory-trigger-service.js';
 export { InMemoryAIRunStateService } from './in-memory-ai-run-state-service.js';
 export { LocalGatewayService } from './local-gateway-service.js';
+export { TypedCredentialService } from './typed-credential-service.js';

package/dist/services/local-content.d.ts

@@ -1,4 +1,4 @@
-import type { ContentService, Logger } from '@pikku/core/services';
+import type { ContentService, JWTService, Logger } from '@pikku/core/services';
 export interface LocalContentConfig {
     localFileUploadPath: string;
     uploadUrlPrefix: string;
@@ -9,10 +9,13 @@ export interface LocalContentConfig {
 export declare class LocalContent implements ContentService {
     private config;
     private logger;
-    constructor(config: LocalContentConfig, logger: Logger);
+    private jwt?;
+    constructor(config: LocalContentConfig, logger: Logger, jwt?: JWTService | undefined);
+    private safePath;
     init(): Promise<void>;
-    signURL(url: string): Promise<string>;
-    signContentKey(assetKey: string): Promise<string>;
+    private signParams;
+    signURL(url: string, dateLessThan: Date, dateGreaterThan?: Date): Promise<string>;
+    signContentKey(assetKey: string, dateLessThan: Date, dateGreaterThan?: Date): Promise<string>;
     getUploadURL(assetKey: string): Promise<{
         uploadUrl: string;
         assetKey: string;

package/dist/services/local-content.js

@@ -1,21 +1,51 @@
 import { createReadStream, createWriteStream, promises } from 'fs';
 import { mkdir, readFile } from 'fs/promises';
+import { resolve, normalize } from 'path';
 import { pipeline } from 'stream/promises';
 export class LocalContent {
     config;
     logger;
-    constructor(config, logger) {
+    jwt;
+    constructor(config, logger, jwt) {
         this.config = config;
         this.logger = logger;
+        this.jwt = jwt;
+    }
+    safePath(assetKey) {
+        const base = resolve(this.config.localFileUploadPath);
+        const target = resolve(base, normalize(assetKey));
+        if (!target.startsWith(base + '/') && target !== base) {
+            throw new Error('Invalid asset key');
+        }
+        return target;
     }
     async init() { }
-    async signURL(url) {
-        return `${url}?signed=true`;
+    async signParams(dateLessThan, dateGreaterThan) {
+        const signedAt = Date.now();
+        const expiresAt = dateLessThan.getTime();
+        const params = new URLSearchParams({
+            signedAt: String(signedAt),
+            expiresAt: String(expiresAt),
+        });
+        if (dateGreaterThan) {
+            params.set('notBefore', String(dateGreaterThan.getTime()));
+        }
+        if (this.jwt) {
+            const expiresInSeconds = Math.max(1, Math.floor((expiresAt - signedAt) / 1000));
+            const signature = await this.jwt.encode({ value: expiresInSeconds, unit: 'second' }, { signedAt, expiresAt });
+            params.set('signature', signature);
+        }
+        return params.toString();
+    }
+    async signURL(url, dateLessThan, dateGreaterThan) {
+        const params = await this.signParams(dateLessThan, dateGreaterThan);
+        return `${url}?${params}`;
     }
-    async signContentKey(assetKey) {
-        return this.config.server
-            ? `${this.config.server}${this.config.assetUrlPrefix}/${assetKey}?signed=true`
-            : `${this.config.assetUrlPrefix}/${assetKey}?signed=true`;
+    async signContentKey(assetKey, dateLessThan, dateGreaterThan) {
+        const base = this.config.server
+            ? `${this.config.server}${this.config.assetUrlPrefix}/${assetKey}`
+            : `${this.config.assetUrlPrefix}/${assetKey}`;
+        return this.signURL(base, dateLessThan, dateGreaterThan);
     }
     async getUploadURL(assetKey) {
         this.logger.debug(`Going to upload with key: ${assetKey}`);
@@ -26,7 +56,7 @@ export class LocalContent {
     }
     async writeFile(assetKey, stream) {
         this.logger.debug(`Writing file: ${assetKey}`);
-        const path = `${this.config.localFileUploadPath}/${assetKey}`;
+        const path = this.safePath(assetKey);
         try {
             await this.createDirectoryForFile(path);
             const fileStream = createWriteStream(path);
@@ -43,7 +73,7 @@ export class LocalContent {
     async copyFile(assetKey, fromAbsolutePath) {
         this.logger.debug(`Writing file: ${assetKey}`);
         try {
-            const path = `${this.config.localFileUploadPath}/${assetKey}`;
+            const path = this.safePath(assetKey);
             await this.createDirectoryForFile(path);
             await promises.copyFile(fromAbsolutePath, path);
         }
@@ -55,7 +85,7 @@ export class LocalContent {
     }
     async readFile(assetKey) {
         this.logger.debug(`Getting key: ${assetKey}`);
-        const filePath = `${this.config.localFileUploadPath}/${assetKey}`;
+        const filePath = this.safePath(assetKey);
         try {
             const stream = createReadStream(filePath);
             // Handle early stream errors (like file not found, permission denied, etc.)
@@ -70,14 +100,14 @@ export class LocalContent {
         }
     }
     async readFileAsBuffer(assetKey) {
-        const filePath = `${this.config.localFileUploadPath}/${assetKey}`;
+        const filePath = this.safePath(assetKey);
         this.logger.debug(`Reading file as buffer: ${assetKey}`);
         return readFile(filePath);
     }
     async deleteFile(assetKey) {
         this.logger.debug(`deleting key: ${assetKey}`);
         try {
-            await promises.unlink(`${this.config.localFileUploadPath}/${assetKey}`);
+            await promises.unlink(this.safePath(assetKey));
             return true;
         }
         catch (e) {

package/dist/services/local-credential-service.d.ts

@@ -0,0 +1,10 @@
+import type { CredentialService } from './credential-service.js';
+export declare class LocalCredentialService implements CredentialService {
+    private store;
+    private makeKey;
+    get<T = unknown>(name: string, userId?: string): Promise<T | null>;
+    set(name: string, value: unknown, userId?: string): Promise<void>;
+    delete(name: string, userId?: string): Promise<void>;
+    has(name: string, userId?: string): Promise<boolean>;
+    getAll(userId: string): Promise<Record<string, unknown>>;
+}

package/dist/services/local-credential-service.js

@@ -0,0 +1,33 @@
+export class LocalCredentialService {
+    store = new Map();
+    makeKey(name, userId) {
+        return userId ? `${userId}:${name}` : name;
+    }
+    async get(name, userId) {
+        const key = this.makeKey(name, userId);
+        const value = this.store.get(key);
+        return value ?? null;
+    }
+    async set(name, value, userId) {
+        const key = this.makeKey(name, userId);
+        this.store.set(key, value);
+    }
+    async delete(name, userId) {
+        const key = this.makeKey(name, userId);
+        this.store.delete(key);
+    }
+    async has(name, userId) {
+        const key = this.makeKey(name, userId);
+        return this.store.has(key);
+    }
+    async getAll(userId) {
+        const prefix = `${userId}:`;
+        const result = {};
+        for (const [key, value] of this.store) {
+            if (key.startsWith(prefix)) {
+                result[key.slice(prefix.length)] = value;
+            }
+        }
+        return result;
+    }
+}

package/dist/services/local-secrets.js

@@ -30,7 +30,7 @@ export class LocalSecretService {
         if (value) {
             return JSON.parse(value);
         }
-        throw new Error(`Secret Not Found: ${key}`);
+        throw new Error('Requested secret not found');
     }
     /**
      * Retrieves a secret by key.
@@ -50,7 +50,7 @@ export class LocalSecretService {
         if (value) {
             return value;
         }
-        throw new Error(`Secret Not Found: ${key}`);
+        throw new Error('Requested secret not found');
     }
     /**
      * Stores a JSON value as a secret in local storage.

package/dist/services/typed-credential-service.d.ts

@@ -0,0 +1,27 @@
+import type { CredentialService } from './credential-service.js';
+export interface CredentialStatusInfo {
+    name: string;
+    displayName: string;
+    isConfigured: boolean;
+    type: 'singleton' | 'wire';
+    oauth2?: boolean;
+}
+export type CredentialMetaInfo = {
+    name: string;
+    displayName: string;
+    type: 'singleton' | 'wire';
+    oauth2?: boolean;
+};
+export declare class TypedCredentialService<TMap = Record<string, unknown>> implements CredentialService {
+    private credentials;
+    private credentialsMeta;
+    constructor(credentials: CredentialService, credentialsMeta: Record<string, CredentialMetaInfo>);
+    get<K extends keyof TMap & string>(name: K, userId?: string): Promise<TMap[K] | null>;
+    get<T = unknown>(name: string, userId?: string): Promise<T | null>;
+    set<K extends string>(name: K, value: K extends keyof TMap ? TMap[K] : unknown, userId?: string): Promise<void>;
+    delete(name: string, userId?: string): Promise<void>;
+    has(name: string, userId?: string): Promise<boolean>;
+    getAll(userId: string): Promise<Record<string, unknown>>;
+    getAllStatus(userId?: string): Promise<CredentialStatusInfo[]>;
+    getMissing(userId?: string): Promise<CredentialStatusInfo[]>;
+}