@pikku/core 0.12.7 → 0.12.9

package/dist/wirings/workflow/graph/graph-runner.js

@@ -1,5 +1,17 @@
-import { pikkuState } from '../../../pikku-state.js';
+import { pikkuState, getSingletonServices } from '../../../pikku-state.js';
 import { RPCNotFoundError } from '../../rpc/rpc-runner.js';
+export class ChildWorkflowStartedException extends Error {
+    parentRunId;
+    stepId;
+    childRunId;
+    name = 'ChildWorkflowStartedException';
+    constructor(parentRunId, stepId, childRunId) {
+        super(`Child workflow started: ${childRunId}`);
+        this.parentRunId = parentRunId;
+        this.stepId = stepId;
+        this.childRunId = childRunId;
+    }
+}
 function buildTemplateRegex(nodeId) {
     if (!nodeId.includes('${'))
         return null;
@@ -321,15 +333,46 @@ export async function executeGraphStep(workflowService, rpcService, runId, stepI
         getState: () => workflowService.getRunState(runId),
     };
     try {
-        const result = await rpcService.rpcWithWire(rpcName, data, {
-            graph: graphWire,
-        });
+        let result;
+        const subWorkflowMeta = pikkuState(null, 'workflows', 'meta')[rpcName];
+        if (subWorkflowMeta) {
+            const childWire = {
+                type: 'workflow',
+                id: rpcName,
+                parentRunId: runId,
+                parentStepId: stepId,
+            };
+            const shouldInline = subWorkflowMeta.inline || !getSingletonServices()?.queueService;
+            const { runId: childRunId } = await workflowService.startWorkflow(rpcName, data, childWire, rpcService, { inline: shouldInline });
+            await workflowService.setStepChildRunId(stepId, childRunId);
+            if (shouldInline) {
+                const childRun = await workflowService.getRun(childRunId);
+                if (childRun?.status === 'failed') {
+                    throw new Error(childRun.error?.message || 'Sub-workflow failed');
+                }
+                if (childRun?.status === 'cancelled') {
+                    throw new Error('Sub-workflow was cancelled');
+                }
+                result = childRun?.output;
+            }
+            else {
+                throw new ChildWorkflowStartedException(runId, stepId, childRunId);
+            }
+        }
+        else {
+            result = await rpcService.rpcWithWire(rpcName, data, {
+                graph: graphWire,
+            });
+        }
         if (wireState.branchKey) {
             await workflowService.setBranchTaken(stepId, wireState.branchKey);
         }
         return result;
     }
     catch (error) {
+        if (error instanceof ChildWorkflowStartedException) {
+            throw error;
+        }
         if (error instanceof RPCNotFoundError) {
             await workflowService.updateRunStatus(runId, 'suspended', undefined, {
                 message: `RPC '${rpcName}' not found. Deploy the missing function and resume.`,
@@ -381,9 +424,31 @@ async function executeGraphNodeInline(workflowService, rpcService, runId, graphN
         getState: () => workflowService.getRunState(runId),
     };
     try {
-        const result = await rpcService.rpcWithWire(rpcName, input, {
-            graph: graphWire,
-        });
+        let result;
+        const subWorkflowMeta = pikkuState(null, 'workflows', 'meta')[rpcName];
+        if (subWorkflowMeta) {
+            const childWire = {
+                type: 'workflow',
+                id: rpcName,
+                parentRunId: runId,
+                parentStepId: stepState.stepId,
+            };
+            const { runId: childRunId } = await workflowService.startWorkflow(rpcName, input, childWire, rpcService, { inline: true });
+            await workflowService.setStepChildRunId(stepState.stepId, childRunId);
+            const childRun = await workflowService.getRun(childRunId);
+            if (childRun?.status === 'failed') {
+                throw new Error(childRun.error?.message || 'Sub-workflow failed');
+            }
+            if (childRun?.status === 'cancelled') {
+                throw new Error('Sub-workflow was cancelled');
+            }
+            result = childRun?.output;
+        }
+        else {
+            result = await rpcService.rpcWithWire(rpcName, input, {
+                graph: graphWire,
+            });
+        }
         if (wireState.branchKey) {
             await workflowService.setBranchTaken(stepState.stepId, wireState.branchKey);
         }

package/dist/wirings/workflow/pikku-workflow-service.d.ts

@@ -47,6 +47,7 @@ export declare class WorkflowStepNameNotString extends Error {
  */
 export declare abstract class PikkuWorkflowService implements WorkflowService {
     private inlineRuns;
+    protected get logger(): import("../../services/logger.js").Logger;
     constructor();
     /**
      * Check if a run is executing inline (without queues)
@@ -249,6 +250,8 @@ export declare abstract class PikkuWorkflowService implements WorkflowService {
         wire?: WorkflowRunWire;
     }): Promise<any>;
     runWorkflowJob(runId: string, rpcService: any): Promise<void>;
+    private onChildWorkflowCompleted;
+    private onChildWorkflowFailed;
     private runVersionMismatchFallback;
     /**
      * Execute a single workflow step (called by worker)

package/dist/wirings/workflow/pikku-workflow-service.js

@@ -4,6 +4,7 @@ import { getDurationInMilliseconds } from '../../time-utils.js';
 import { continueGraph, executeGraphStep, runWorkflowGraph, runFromMeta, } from './graph/graph-runner.js';
 import { PikkuError, addError } from '../../errors/error-handler.js';
 import { RPCNotFoundError } from '../rpc/rpc-runner.js';
+import { ChildWorkflowStartedException } from './graph/graph-runner.js';
 /**
  * Exception thrown when workflow needs to pause for async step
  */
@@ -84,6 +85,9 @@ const WORKFLOW_END_STATES = new Set([
  */
 export class PikkuWorkflowService {
     inlineRuns = new Set();
+    get logger() {
+        return getSingletonServices()?.logger;
+    }
     constructor() { }
     /**
      * Check if a run is executing inline (without queues)
@@ -124,12 +128,12 @@ export class PikkuWorkflowService {
     }
     async queueStepWorker(runId, stepName, rpcName, data) {
         const queueService = this.verifyQueueService();
-        await queueService.add(this.getConfig().stepWorkerQueueName, {
+        await queueService.add(this.getConfig().stepWorkerQueueName, JSON.parse(JSON.stringify({
             runId,
             stepName,
             rpcName,
             data,
-        });
+        })));
     }
     /**
      * Execute a workflow sleep step completion
@@ -163,7 +167,9 @@ export class PikkuWorkflowService {
             throw new WorkflowNotFoundError(name);
         }
         if (workflowMeta.source === 'graph' || workflowMeta.source === 'ai-agent') {
-            const shouldInline = options?.inline || !getSingletonServices()?.queueService;
+            const shouldInline = options?.inline ||
+                workflowMeta.inline ||
+                !getSingletonServices()?.queueService;
             return runWorkflowGraph(this, name, input, rpcService, shouldInline, options?.startNode, wire);
         }
         // DSL workflow - check registration exists
@@ -175,17 +181,25 @@ export class PikkuWorkflowService {
         if (!workflowMeta.graphHash) {
             throw new Error(`Missing workflow graphHash for '${name}'`);
         }
-        const shouldInline = options?.inline || !getSingletonServices()?.queueService;
+        const shouldInline = options?.inline ||
+            workflowMeta.inline ||
+            !getSingletonServices()?.queueService;
         const runId = await this.createRun(name, input, shouldInline, workflowMeta.graphHash, wire);
         if (shouldInline) {
             this.inlineRuns.add(runId);
-            this.runWorkflowJob(runId, rpcService)
-                .catch((err) => {
-                getSingletonServices().logger.error(`Workflow ${name} (run ${runId}) failed:`, err);
-            })
-                .finally(() => {
+            try {
+                await this.runWorkflowJob(runId, rpcService);
+            }
+            catch (error) {
+                if (error.name !== 'WorkflowAsyncException' &&
+                    error.name !== 'WorkflowCancelledException' &&
+                    error.name !== 'WorkflowSuspendedException') {
+                    getSingletonServices().logger.error(`Workflow ${name} (run ${runId}) failed:`, error);
+                }
+            }
+            finally {
                 this.inlineRuns.delete(runId);
-            });
+            }
         }
         else {
             await this.resumeWorkflow(runId);
@@ -227,6 +241,14 @@ export class PikkuWorkflowService {
         }
         if (workflowMeta?.source === 'graph') {
             await continueGraph(this, runId, run.workflow);
+            const updatedRun = await this.getRun(runId);
+            if (updatedRun?.status === 'completed') {
+                await this.onChildWorkflowCompleted(updatedRun, updatedRun.output);
+            }
+            else if (updatedRun?.status === 'failed' ||
+                updatedRun?.status === 'cancelled') {
+                await this.onChildWorkflowFailed(updatedRun, new Error(updatedRun.error?.message || 'Child workflow failed'));
+            }
             return;
         }
         const registrations = pikkuState(null, 'workflows', 'registrations');
@@ -249,6 +271,7 @@ export class PikkuWorkflowService {
                     data: () => run.input,
                 });
                 await this.updateRunStatus(runId, 'completed', result);
+                await this.onChildWorkflowCompleted(run, result);
             }
             catch (error) {
                 if (error instanceof WorkflowAsyncException) {
@@ -260,6 +283,7 @@ export class PikkuWorkflowService {
                         stack: '',
                         code: 'WORKFLOW_CANCELLED',
                     });
+                    await this.onChildWorkflowFailed(run, error);
                     throw error;
                 }
                 if (error instanceof WorkflowSuspendedException) {
@@ -275,10 +299,27 @@ export class PikkuWorkflowService {
                     stack: error.stack,
                     code: error.code,
                 });
+                await this.onChildWorkflowFailed(run, error);
                 throw error;
             }
         });
     }
+    async onChildWorkflowCompleted(childRun, result) {
+        const { parentRunId, parentStepId } = childRun.wire ?? {};
+        if (!parentRunId || !parentStepId)
+            return;
+        this.logger?.debug(`Child workflow ${childRun.id} completed, updating parent step ${parentStepId}`);
+        await this.setStepResult(parentStepId, result);
+        await this.resumeWorkflow(parentRunId);
+    }
+    async onChildWorkflowFailed(childRun, error) {
+        const { parentRunId, parentStepId } = childRun.wire ?? {};
+        if (!parentRunId || !parentStepId)
+            return;
+        this.logger?.debug(`Child workflow ${childRun.id} failed, updating parent step ${parentStepId}`);
+        await this.setStepError(parentStepId, error);
+        await this.resumeWorkflow(parentRunId);
+    }
     async runVersionMismatchFallback(run, currentMeta, rpcService) {
         const source = currentMeta.source;
         if (source === 'complex') {
@@ -309,9 +350,8 @@ export class PikkuWorkflowService {
         await this.withStepLock(runId, stepName, async () => {
             // Get step state
             let stepState = await this.getStepState(runId, stepName);
-            // Idempotency - if already succeeded, resume orchestrator and return
+            // Idempotency - if already succeeded, nothing to do
             if (stepState.status === 'succeeded') {
-                await this.resumeWorkflow(runId);
                 return;
             }
             // Log warning if already running (race condition)
@@ -322,8 +362,7 @@ export class PikkuWorkflowService {
             if (stepState.status === 'failed') {
                 stepState = await this.createRetryAttempt(stepState.stepId, 'running');
             }
-            if (stepState.status === 'pending') {
-                // Mark pending step as running before execution
+            if (stepState.status === 'pending' || stepState.status === 'scheduled') {
                 await this.setStepRunning(stepState.stepId);
             }
             try {
@@ -352,6 +391,10 @@ export class PikkuWorkflowService {
                 await this.resumeWorkflow(runId);
             }
             catch (error) {
+                if (error instanceof ChildWorkflowStartedException) {
+                    this.logger?.debug(`Workflow step '${stepName}': child workflow ${error.childRunId} started, waiting for completion`);
+                    return;
+                }
                 if (error instanceof RPCNotFoundError) {
                     await this.setStepError(stepState.stepId, error);
                     await this.updateRunStatus(runId, 'suspended', undefined, {
@@ -437,12 +480,12 @@ export class PikkuWorkflowService {
             // Map step retry options to queue job options
             const retries = stepOptions?.retries ?? 0;
             const retryDelay = stepOptions?.retryDelay;
-            await getSingletonServices().queueService.add(this.getConfig().stepWorkerQueueName, {
+            await getSingletonServices().queueService.add(this.getConfig().stepWorkerQueueName, JSON.parse(JSON.stringify({
                 runId,
                 stepName,
                 rpcName,
                 data,
-            }, {
+            })), {
                 // attempts includes initial attempt, retries doesn't
                 attempts: retries + 1,
                 // Map retry delay to backoff

package/dist/wirings/workflow/workflow.types.d.ts

@@ -7,6 +7,7 @@ export interface WorkflowRunWire {
     type: string;
     id?: string;
     parentRunId?: string;
+    parentStepId?: string;
 }
 export interface WorkflowServiceConfig {
     retries: number;
@@ -166,6 +167,7 @@ export type WorkflowsMeta = Record<string, CommonWireMeta & {
     steps: WorkflowStepMeta[];
     context?: WorkflowContext;
     dsl?: boolean;
+    inline?: boolean;
 }>;
 /**
  * Unified workflow runtime meta (used by runtime to execute workflows)
@@ -183,6 +185,8 @@ export interface WorkflowRuntimeMeta {
     description?: string;
     /** Tags for organization */
     tags?: string[];
+    /** If true, workflow always executes inline without queues */
+    inline?: boolean;
     /** Serialized nodes */
     nodes?: Record<string, any>;
     /** Entry node IDs for graph workflows (computed at build time) */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/core",
-  "version": "0.12.7",
+  "version": "0.12.9",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
   "module": "dist/index.js",

package/src/env.ts

@@ -0,0 +1 @@
+export const isProduction = () => process.env.NODE_ENV === 'production'

package/src/errors/errors.ts

@@ -372,3 +372,38 @@ addError(MissingSchemaError, {
   message:
     'A required schema was not found. Ensure schema generation has been run.',
 })
+
+/**
+ * An AI provider has not been configured. Set up an AI provider (e.g. OpenAI, Anthropic) to use agent features.
+ * @group Error
+ */
+export class AIProviderNotConfiguredError extends PikkuError {
+  constructor() {
+    super(
+      'No AI provider configured. Please set up an AI provider (e.g. OpenAI, Anthropic) and provide a valid API key to use this agent.'
+    )
+  }
+}
+addError(AIProviderNotConfiguredError, {
+  status: 503,
+  message:
+    'No AI provider configured. Please set up an AI provider (e.g. OpenAI, Anthropic) and provide a valid API key to use this agent.',
+})
+
+/**
+ * The AI provider API key is missing or invalid.
+ * @group Error
+ */
+export class AIProviderAuthError extends PikkuError {
+  constructor(message?: string) {
+    super(
+      message ||
+        'AI provider API key is missing or invalid. Please check your API key configuration.'
+    )
+  }
+}
+addError(AIProviderAuthError, {
+  status: 401,
+  message:
+    'AI provider API key is missing or invalid. Please check your API key configuration.',
+})

package/src/handle-error.ts

@@ -1,3 +1,4 @@
+import { isProduction } from './env.js'
 import { getErrorResponse } from './errors/error-handler.js'
 import { NotFoundError } from './errors/errors.js'
 import type { Logger } from './services/logger.js'
@@ -55,7 +56,7 @@ export const handleHTTPError = (
     if (trackerId) {
       logger.warn(`Error id: ${trackerId}`)
       const errorBody: Record<string, unknown> = { errorId: trackerId }
-      if (exposeErrors && e instanceof Error) {
+      if (exposeErrors && !isProduction() && e instanceof Error) {
         errorBody.message = e.message
         errorBody.stack = e.stack
       }

package/src/middleware/auth-bearer.ts

@@ -2,6 +2,15 @@ import { InvalidSessionError } from '../errors/errors.js'
 import type { CoreUserSession } from '../types/core.types.js'
 import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js'
 
+const constantTimeEqual = (a: string, b: string): boolean => {
+  if (a.length !== b.length) return false
+  let result = 0
+  for (let i = 0; i < a.length; i++) {
+    result |= a.charCodeAt(i) ^ b.charCodeAt(i)
+  }
+  return result === 0
+}
+
 /**
  * Bearer token middleware that extracts and validates tokens from the Authorization header.
  *
@@ -55,7 +64,7 @@ export const authBearer = pikkuMiddlewareFactory<{
 
         let userSession: CoreUserSession | null = null
 
-        if (token && bearerToken === token.value) {
+        if (token && constantTimeEqual(bearerToken, token.value)) {
           userSession = token.userSession
         } else if (jwtService && !token) {
           userSession = await jwtService.decode(bearerToken)

package/src/middleware/auth-cookie.ts

@@ -35,8 +35,15 @@ export const authCookie = pikkuMiddlewareFactory<{
   name: string
   options: SerializeOptions
   expiresIn: RelativeTimeInput
-}>(({ name, options, expiresIn }) =>
-  pikkuMiddleware(
+}>(({ name, options, expiresIn }) => {
+  const mergedOptions: SerializeOptions = {
+    httpOnly: true,
+    secure: true,
+    sameSite: 'lax',
+    path: '/',
+    ...options,
+  }
+  return pikkuMiddleware(
     async (
       { jwt: jwtService, logger },
       { http, setSession, getSession, session, hasSessionChanged },
@@ -67,7 +74,7 @@ export const authCookie = pikkuMiddlewareFactory<{
             name,
             await jwtService.encode(expiresIn, currentSession),
             {
-              ...options,
+              ...mergedOptions,
               expires: getRelativeTimeOffsetFromNow(expiresIn),
             }
           )
@@ -77,4 +84,4 @@ export const authCookie = pikkuMiddlewareFactory<{
       }
     }
   )
-)
+})

package/src/middleware/timeout.ts

@@ -4,12 +4,19 @@ import { pikkuMiddleware, pikkuMiddlewareFactory } from '../types/core.types.js'
 export const timeout = () =>
   pikkuMiddlewareFactory<{ timeout: number }>(({ timeout }) =>
     pikkuMiddleware(async (_services, _wire, next) => {
-      const timeoutId = setTimeout(() => {
-        throw new RequestTimeoutError()
-      }, timeout)
-
-      await next()
-
-      clearTimeout(timeoutId)
+      let timeoutId: ReturnType<typeof setTimeout> | undefined
+      await Promise.race([
+        next(),
+        new Promise<never>((_resolve, reject) => {
+          timeoutId = setTimeout(
+            () => reject(new RequestTimeoutError()),
+            timeout
+          )
+        }),
+      ]).finally(() => {
+        if (timeoutId !== undefined) {
+          clearTimeout(timeoutId)
+        }
+      })
     })
   )

package/src/pikku-state.ts

@@ -14,7 +14,7 @@ import type { GatewaysMeta } from './wirings/gateway/gateway.types.js'
 import type { ScheduledTasksMeta } from './wirings/scheduler/scheduler.types.js'
 import type { TriggerMeta } from './wirings/trigger/trigger.types.js'
 
-const PIKKU_STATE_KEY = Symbol.for('@pikku/core/state')
+const PIKKU_STATE_KEY = Symbol('@pikku/core/state')
 
 export const getAllPackageStates = (): Map<string, PikkuPackageState> => {
   if (!(globalThis as any)[PIKKU_STATE_KEY]) {

package/src/services/local-content.ts

@@ -1,6 +1,7 @@
 import { createReadStream, createWriteStream, promises } from 'fs'
 import { mkdir, readFile } from 'fs/promises'
-import type { ContentService, Logger } from '@pikku/core/services'
+import { resolve, normalize } from 'path'
+import type { ContentService, JWTService, Logger } from '@pikku/core/services'
 import { pipeline } from 'stream/promises'
 import type { Readable } from 'stream'
 
@@ -15,19 +16,66 @@ export interface LocalContentConfig {
 export class LocalContent implements ContentService {
   constructor(
     private config: LocalContentConfig,
-    private logger: Logger
+    private logger: Logger,
+    private jwt?: JWTService
   ) {}
 
+  private safePath(assetKey: string): string {
+    const base = resolve(this.config.localFileUploadPath)
+    const target = resolve(base, normalize(assetKey))
+    if (!target.startsWith(base + '/') && target !== base) {
+      throw new Error('Invalid asset key')
+    }
+    return target
+  }
+
   public async init() {}
 
-  public async signURL(url: string): Promise<string> {
-    return `${url}?signed=true`
+  private async signParams(
+    dateLessThan: Date,
+    dateGreaterThan?: Date
+  ): Promise<string> {
+    const signedAt = Date.now()
+    const expiresAt = dateLessThan.getTime()
+    const params = new URLSearchParams({
+      signedAt: String(signedAt),
+      expiresAt: String(expiresAt),
+    })
+    if (dateGreaterThan) {
+      params.set('notBefore', String(dateGreaterThan.getTime()))
+    }
+    if (this.jwt) {
+      const expiresInSeconds = Math.max(
+        1,
+        Math.floor((expiresAt - signedAt) / 1000)
+      )
+      const signature = await this.jwt.encode(
+        { value: expiresInSeconds, unit: 'second' },
+        { signedAt, expiresAt }
+      )
+      params.set('signature', signature)
+    }
+    return params.toString()
+  }
+
+  public async signURL(
+    url: string,
+    dateLessThan: Date,
+    dateGreaterThan?: Date
+  ): Promise<string> {
+    const params = await this.signParams(dateLessThan, dateGreaterThan)
+    return `${url}?${params}`
   }
 
-  public async signContentKey(assetKey: string): Promise<string> {
-    return this.config.server
-      ? `${this.config.server}${this.config.assetUrlPrefix}/${assetKey}?signed=true`
-      : `${this.config.assetUrlPrefix}/${assetKey}?signed=true`
+  public async signContentKey(
+    assetKey: string,
+    dateLessThan: Date,
+    dateGreaterThan?: Date
+  ): Promise<string> {
+    const base = this.config.server
+      ? `${this.config.server}${this.config.assetUrlPrefix}/${assetKey}`
+      : `${this.config.assetUrlPrefix}/${assetKey}`
+    return this.signURL(base, dateLessThan, dateGreaterThan)
   }
 
   public async getUploadURL(assetKey: string) {
@@ -44,7 +92,7 @@ export class LocalContent implements ContentService {
   ): Promise<boolean> {
     this.logger.debug(`Writing file: ${assetKey}`)
 
-    const path = `${this.config.localFileUploadPath}/${assetKey}`
+    const path = this.safePath(assetKey)
 
     try {
       await this.createDirectoryForFile(path)
@@ -65,7 +113,7 @@ export class LocalContent implements ContentService {
   ): Promise<boolean> {
     this.logger.debug(`Writing file: ${assetKey}`)
     try {
-      const path = `${this.config.localFileUploadPath}/${assetKey}`
+      const path = this.safePath(assetKey)
       await this.createDirectoryForFile(path)
       await promises.copyFile(fromAbsolutePath, path)
     } catch (e) {
@@ -80,7 +128,7 @@ export class LocalContent implements ContentService {
   ): Promise<ReadableStream | NodeJS.ReadableStream> {
     this.logger.debug(`Getting key: ${assetKey}`)
 
-    const filePath = `${this.config.localFileUploadPath}/${assetKey}`
+    const filePath = this.safePath(assetKey)
 
     try {
       const stream = createReadStream(filePath)
@@ -97,7 +145,7 @@ export class LocalContent implements ContentService {
   }
 
   public async readFileAsBuffer(assetKey: string): Promise<Buffer> {
-    const filePath = `${this.config.localFileUploadPath}/${assetKey}`
+    const filePath = this.safePath(assetKey)
     this.logger.debug(`Reading file as buffer: ${assetKey}`)
     return readFile(filePath)
   }
@@ -105,7 +153,7 @@ export class LocalContent implements ContentService {
   public async deleteFile(assetKey: string): Promise<boolean> {
     this.logger.debug(`deleting key: ${assetKey}`)
     try {
-      await promises.unlink(`${this.config.localFileUploadPath}/${assetKey}`)
+      await promises.unlink(this.safePath(assetKey))
       return true
     } catch (e: any) {
       this.logger.error(`Error deleting content ${assetKey}`, e)

package/src/services/local-secrets.test.ts

@@ -22,7 +22,7 @@ describe('LocalSecretService', () => {
     const vars = new LocalVariablesService({})
     const service = new LocalSecretService(vars)
     await assert.rejects(() => service.getSecret('MISSING'), {
-      message: 'Secret Not Found: MISSING',
+      message: 'Requested secret not found',
     })
   })
 
@@ -44,7 +44,7 @@ describe('LocalSecretService', () => {
     const vars = new LocalVariablesService({})
     const service = new LocalSecretService(vars)
     await assert.rejects(() => service.getSecretJSON('MISSING'), {
-      message: 'Secret Not Found: MISSING',
+      message: 'Requested secret not found',
     })
   })
 

package/src/services/local-secrets.ts

@@ -35,7 +35,7 @@ export class LocalSecretService implements SecretService {
     if (value) {
       return JSON.parse(value)
     }
-    throw new Error(`Secret Not Found: ${key}`)
+    throw new Error('Requested secret not found')
   }
 
   /**
@@ -57,7 +57,7 @@ export class LocalSecretService implements SecretService {
     if (value) {
       return value
     }
-    throw new Error(`Secret Not Found: ${key}`)
+    throw new Error('Requested secret not found')
   }
 
   /**

package/src/testing/service-tests.ts

@@ -780,7 +780,7 @@ export function defineServiceTests(config: ServiceTestConfig): void {
       test('getSecret throws for missing key', async () => {
         const service = await factory({ key: kek })
         await assert.rejects(() => service.getSecret('nonexistent'), {
-          message: 'Secret not found: nonexistent',
+          message: 'Requested secret not found',
         })
       })