@pikku/core 0.12.137 → 0.12.138

package/dist/wirings/trigger/trigger-runner.js

@@ -43,7 +43,9 @@ export async function setupTrigger({ name, input, onTrigger, }) {
         trigger: {
             invoke: (data) => {
                 singletonServices.logger.info(`Trigger fired: ${name}`);
-                onTrigger(data);
+                // `invoke` is typed void for trigger sources, so a rejection from the
+                // trigger function is logged here rather than left unhandled.
+                Promise.resolve(onTrigger(data)).catch((e) => singletonServices.logger.error(`Trigger '${name}' handler failed: ${e?.message ?? e}`));
             },
         },
     };

package/dist/wirings/trigger/webhook-source-runner.js

@@ -63,6 +63,9 @@ const readRequest = async (http) => {
     };
 };
 const signedWith = async (verify, request, secret, services) => {
+    // Fail closed: an empty secret never verifies, whatever the scheme.
+    if (!secret)
+        return false;
     if (typeof verify === 'function') {
         return await verify(request, secret, services);
     }
@@ -72,14 +75,14 @@ const signedWith = async (verify, request, secret, services) => {
     };
     if ('hmac' in verify) {
         const { header: name, prefix, algorithm, encoding, secretEncoding, } = verify.hmac;
-        return verifyHmacSignature(secret, header(name, prefix), algorithm, request.body, encoding, secretEncoding);
+        return await verifyHmacSignature(secret, header(name, prefix), algorithm, request.body, encoding, secretEncoding);
     }
     if ('token' in verify) {
         const token = header(verify.token.header, verify.token.prefix);
         return !!token && timingSafeStringEqual(token, secret);
     }
     const { header: name, ...options } = verify.publicKey;
-    return verifyPublicKeySignature(secret, header(name), request.body, options);
+    return await verifyPublicKeySignature(secret, header(name), request.body, options);
 };
 /**
  * Whether the request was signed with the source's secret. A request with a

package/dist/wirings/virtual-user/virtual-user-scaffold.js

@@ -1,3 +1,4 @@
+import { readEnvVariable } from '../../env.js';
 import { BadRequestError, ForbiddenError } from '../../errors/errors.js';
 import { prepareVirtualUserRun } from './prepare-virtual-user-run.js';
 import { runVirtualUser as runVirtualUserEngine } from './run-virtual-user.js';
@@ -122,7 +123,7 @@ const refuseInProduction = (personaId, disposition, config, environments, enviro
  * scheduled tick have in common. The dispatch that follows is typed off the
  * app's RPC map, so it stays in the generated wiring.
  */
-export const startVirtualUserRun = async ({ store, personas, config, environments, environment = process.env.PIKKU_ENV, persona: personaId, disposition: requested, seed: requestedSeed, goals, memory, startedBy, }) => {
+export const startVirtualUserRun = async ({ store, personas, config, environments, environment = readEnvVariable('PIKKU_ENV'), persona: personaId, disposition: requested, seed: requestedSeed, goals, memory, startedBy, }) => {
     const runStore = requireVirtualUserRunStore(store);
     const persona = runnablePersona(personas, personaId);
     const disposition = (requested ??
@@ -251,7 +252,7 @@ export const serializeVirtualUserSchedule = (schedule, personas) => {
  * keeps what it had: enabling a row saved earlier as adversarial is refused
  * just as saving one would be.
  */
-export const writeVirtualUserSchedule = async ({ store, personas, persona, enabled, disposition, goals, budget, minIntervalMs, maxIntervalMs, nextRunAt, config, environments, environment = process.env.PIKKU_ENV, }) => {
+export const writeVirtualUserSchedule = async ({ store, personas, persona, enabled, disposition, goals, budget, minIntervalMs, maxIntervalMs, nextRunAt, config, environments, environment = readEnvVariable('PIKKU_ENV'), }) => {
     const scheduleStore = requireVirtualUserScheduleStore(store);
     const declared = runnablePersona(personas, persona);
     const current = enabled === undefined || disposition === undefined

package/dist/wirings/workflow/workflow-invocation-id.js

@@ -1,16 +1,93 @@
-import { createHash } from 'node:crypto';
 const PIKKU_WORKFLOW_NAMESPACE = '70696b6b-7500-5770-9f6c-6f77000a0001';
-const parseUuid = (uuid) => Buffer.from(uuid.replace(/-/g, ''), 'hex');
+const encoder = new TextEncoder();
+const parseUuid = (uuid) => {
+    const hex = uuid.replace(/-/g, '');
+    const bytes = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < bytes.length; i++) {
+        bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    }
+    return bytes;
+};
 const formatUuid = (bytes) => {
-    const hex = bytes.toString('hex');
+    let hex = '';
+    for (const b of bytes)
+        hex += b.toString(16).padStart(2, '0');
     return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
 };
+/**
+ * SHA-1 (FIPS 180-4). Web Crypto only offers an async digest and `uuidv5` is
+ * called synchronously (and is a public export), so this is a small pure-JS
+ * one. It only derives dedupe IDs, never anything secret.
+ */
+const sha1 = (message) => {
+    const padded = new Uint8Array(((message.length + 9 + 63) >> 6) << 6);
+    padded.set(message);
+    padded[message.length] = 0x80;
+    const view = new DataView(padded.buffer);
+    view.setUint32(padded.length - 8, Math.floor((message.length * 8) / 2 ** 32));
+    view.setUint32(padded.length - 4, (message.length * 8) >>> 0);
+    let h0 = 0x67452301;
+    let h1 = 0xefcdab89;
+    let h2 = 0x98badcfe;
+    let h3 = 0x10325476;
+    let h4 = 0xc3d2e1f0;
+    const w = new Uint32Array(80);
+    const rotl = (x, n) => (x << n) | (x >>> (32 - n));
+    for (let offset = 0; offset < padded.length; offset += 64) {
+        for (let i = 0; i < 16; i++)
+            w[i] = view.getUint32(offset + i * 4);
+        for (let i = 16; i < 80; i++) {
+            w[i] = rotl(w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16], 1);
+        }
+        let a = h0;
+        let b = h1;
+        let c = h2;
+        let d = h3;
+        let e = h4;
+        for (let i = 0; i < 80; i++) {
+            let f;
+            let k;
+            if (i < 20) {
+                f = (b & c) | (~b & d);
+                k = 0x5a827999;
+            }
+            else if (i < 40) {
+                f = b ^ c ^ d;
+                k = 0x6ed9eba1;
+            }
+            else if (i < 60) {
+                f = (b & c) | (b & d) | (c & d);
+                k = 0x8f1bbcdc;
+            }
+            else {
+                f = b ^ c ^ d;
+                k = 0xca62c1d6;
+            }
+            const temp = (rotl(a, 5) + f + e + k + w[i]) >>> 0;
+            e = d;
+            d = c;
+            c = rotl(b, 30) >>> 0;
+            b = a;
+            a = temp;
+        }
+        h0 = (h0 + a) >>> 0;
+        h1 = (h1 + b) >>> 0;
+        h2 = (h2 + c) >>> 0;
+        h3 = (h3 + d) >>> 0;
+        h4 = (h4 + e) >>> 0;
+    }
+    const out = new Uint8Array(20);
+    const outView = new DataView(out.buffer);
+    [h0, h1, h2, h3, h4].forEach((h, i) => outView.setUint32(i * 4, h));
+    return out;
+};
 export const uuidv5 = (name, namespace = PIKKU_WORKFLOW_NAMESPACE) => {
-    const hash = createHash('sha1')
-        .update(parseUuid(namespace))
-        .update(name, 'utf8')
-        .digest();
-    const bytes = hash.subarray(0, 16);
+    const ns = parseUuid(namespace);
+    const nameBytes = encoder.encode(name);
+    const input = new Uint8Array(ns.length + nameBytes.length);
+    input.set(ns);
+    input.set(nameBytes, ns.length);
+    const bytes = sha1(input).subarray(0, 16);
     bytes[6] = (bytes[6] & 0x0f) | 0x50;
     bytes[8] = (bytes[8] & 0x3f) | 0x80;
     return formatUuid(bytes);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/core",
-  "version": "0.12.137",
+  "version": "0.12.138",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/pikkujs/pikku.git",
@@ -81,6 +81,7 @@
     "./services/local-content": "./dist/services/local-content.js",
     "./services/local-content-request-handler": "./dist/services/local-content-request-handler.js",
     "./services/temporary-file-service": "./dist/services/temporary-file-service.js",
+    "./services/file-scenario-run-store": "./dist/services/file-scenario-run-store.js",
     "./crypto-utils": "./dist/crypto-utils.js",
     "./hmac": "./dist/utils/hmac.js",
     "./state": "./dist/pikku-state.js",
@@ -100,6 +101,7 @@
   },
   "devDependencies": {
     "@ag-ui/core": "0.0.57",
+    "@pikku/deploy": "^0.12.15",
     "@types/node": "^24.13.3",
     "esbuild": "~0.28.2",
     "tsx": "^4.23.12"

package/src/public-surface.json

@@ -326,6 +326,7 @@
     "validateAndBuildCredentialDefinitionsMeta"
   ],
   "./scope": [
+    "declareScopes",
     "defineScope",
     "flattenScopeDefinitions",
     "hasScopes",
@@ -432,7 +433,6 @@
     "ACTOR_SECRET_NAME",
     "ConsoleLogger",
     "DEFAULT_WEBHOOK_RETRIES",
-    "FileScenarioRunStore",
     "InMemoryAgentRunStateService",
     "InMemoryLeaseService",
     "InMemoryQueueService",
@@ -482,8 +482,6 @@
     "pikkuRemoteScheduledJobFunc",
     "pikkuWebhookWorkerFunc",
     "renderEmail",
-    "scenarioArtifactContentType",
-    "scenarioRunSummary",
     "spy",
     "stub",
     "verifyActorSecret",
@@ -510,6 +508,11 @@
     "createLocalContentRequestHandler",
     "verifySignedContentRequest"
   ],
+  "./services/file-scenario-run-store": [
+    "FileScenarioRunStore",
+    "scenarioArtifactContentType",
+    "scenarioRunSummary"
+  ],
   "./services/temporary-file-service": [
     "TemporaryFileInstance",
     "TemporaryFileService"