@pikku/core 0.12.74 → 0.12.78

package/knowledge/decisions/internals/validate-checks-personas-through-a-shared-module.md

@@ -0,0 +1,43 @@
+---
+type: decision
+title: Both validators check personas through one shared module, and a persona counts from either the meta or the source
+description: workspace validate and fabric validate are separate implementations, so the persona/actor/knowledge checks live in persona-checks.ts and are called by both — and a persona is counted from the generated meta or a definePersonas() source scan, whichever answers first
+tags: cli, validate, scenarios, personas
+---
+
+# Both validators check personas through one shared module, and a persona counts from either the meta or the source
+
+`pikku workspace validate` and `pikku fabric validate` read like one command
+with a flag. They are not. They are two implementations that walk the same
+project and duplicate about eighteen findings between them verbatim —
+`functions-dir-missing` exists twice, character for character, in two files.
+Fabric adds the deploy-shaped checks (themes, frontends, the Cloudflare
+adapter, the `.gitignore` contract); workspace adds the local-development ones
+(`dev.db`, the auth migrations).
+
+So a check written into either one is a check half the projects never run. An
+app that never deploys through fabric only ever sees workspace validate; an app
+that does sees fabric validate in CI. The persona checks are the kind that only
+pay off when nobody remembers to ask for them, which means they had to be in
+both. Rather than duplicate them a nineteenth time, they live in
+`persona-checks.ts` and both validators call `runPersonaChecks`. Merging the
+two validators outright is the better fix and a much larger one; this does not
+block it.
+
+**A persona counts from either source, and either alone is wrong at a
+predictable moment.** The generated `pikku-personas-meta.gen.json` is empty on
+a fresh clone where codegen has not run, so trusting only it means a warning
+that fires on every new checkout — and a validator that cries wolf gets muted,
+after which it never says anything worth hearing. A source scan for
+`definePersonas(` cannot see personas an addon contributed. Declared by either
+counts as declared.
+
+**Everything here is `warn`, never `error`.** A project with no personas is
+under-tested, not broken, and `validate` gating a deploy on it would make the
+first thing anyone does with the check be to remove it. `knowledge-empty` stays
+at the `info` the shared `@pikku/knowledge` package already assigned it rather
+than being raised to match — the severity belongs to that package.
+
+**What this rules out:** duplicating the checks into both validators;
+adding them to only one; deriving the persona count from the generated meta
+alone; failing a build over a missing persona.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/core",
-  "version": "0.12.74",
+  "version": "0.12.78",
   "description": "The Pikku runtime — functions, wirings, services, middleware and types",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
@@ -8,7 +8,7 @@
   "main": "dist/index.js",
   "type": "module",
   "scripts": {
-    "tsc": "tsc",
+    "tsc": "tsc && tsc -p tsconfig.type-tests.json",
     "build": "tsc -b",
     "ncu": "npx npm-check-updates",
     "release": "npm run build && npm test",
@@ -57,6 +57,7 @@
     "./services/v8-coverage": "./dist/services/v8-coverage-service.js",
     "./services/istanbul-coverage": "./dist/services/istanbul-coverage-service.js",
     "./services/local-content": "./dist/services/local-content.js",
+    "./services/local-content-request-handler": "./dist/services/local-content-request-handler.js",
     "./services/temporary-file-service": "./dist/services/temporary-file-service.js",
     "./crypto-utils": "./dist/crypto-utils.js",
     "./hmac": "./dist/utils/hmac.js",

package/src/column-form.test.ts

@@ -0,0 +1,97 @@
+import { describe, test } from 'node:test'
+import assert from 'node:assert/strict'
+import {
+  hashToken,
+  unsafeAsHashed,
+  unsafeAsSealed,
+  unsafeAsWrapped,
+} from './column-form.js'
+import type {
+  HashedValue,
+  SealedValue,
+  WrappedValue,
+} from './data-classification.js'
+import { deriveKEK, envelopeEncrypt, envelopeRewrap } from './crypto-utils.js'
+
+const KEY_MATERIAL = 'x'.repeat(32)
+
+describe('hashToken', () => {
+  test('is the sha256 of the input, lowercase hex', async () => {
+    // Known vector, so a refactor of the hex encoding cannot quietly change
+    // what every stored hash in every downstream database means.
+    assert.equal(
+      await hashToken('abc'),
+      'ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad'
+    )
+  })
+
+  test('is stable across calls', async () => {
+    assert.equal(await hashToken('token'), await hashToken('token'))
+  })
+
+  test('separates different inputs', async () => {
+    assert.notEqual(await hashToken('a'), await hashToken('b'))
+  })
+})
+
+describe('the form brands', () => {
+  test('a plain string is not assignable to any of them', () => {
+    // @ts-expect-error plaintext cannot be written to a wrapped column
+    const wrapped: WrappedValue = 'not-ciphertext'
+    // @ts-expect-error plaintext cannot be written to a sealed column
+    const sealed: SealedValue = 'not-ciphertext'
+    // @ts-expect-error a raw token cannot be written where its hash belongs
+    const hashed: HashedValue = 'raw-token'
+    assert.ok(wrapped && sealed && hashed)
+  })
+
+  test('the three do not substitute for one another', () => {
+    const wrapped = unsafeAsWrapped('ct')
+    // @ts-expect-error a value fabric cannot read is not one it can
+    const asWrapped: WrappedValue = unsafeAsSealed('ct')
+    // @ts-expect-error a digest is not ciphertext
+    const asHashed: HashedValue = wrapped
+    assert.ok(asWrapped && asHashed)
+  })
+
+  test('but each still widens to string, so reads and query operands are unaffected', () => {
+    const asString: string = unsafeAsWrapped('ct')
+    assert.equal(asString, 'ct')
+    assert.equal(`${unsafeAsHashed('abc')}`, 'abc')
+  })
+})
+
+describe('the envelope primitives produce the brand', () => {
+  test('envelopeEncrypt returns ciphertext that is writable to a wrapped column', async () => {
+    const kek = await deriveKEK(KEY_MATERIAL, 'c2FsdA')
+    const { ciphertext, wrappedDEK } = await envelopeEncrypt(kek, 'value')
+    // No cast: this is the whole mechanism — the only way to satisfy the
+    // column type is to have actually encrypted something.
+    const forColumn: WrappedValue = ciphertext
+    const dekForColumn: WrappedValue = wrappedDEK
+    assert.ok(forColumn.length > 0 && dekForColumn.length > 0)
+  })
+
+  test('a rewrapped DEK is still writable, so rotation needs no escape hatch', async () => {
+    const oldKek = await deriveKEK(KEY_MATERIAL, 'c2FsdA')
+    const newKek = await deriveKEK('y'.repeat(32), 'c2FsdA')
+    const { wrappedDEK } = await envelopeEncrypt(oldKek, 'value')
+    const rewrapped: WrappedValue = await envelopeRewrap(
+      oldKek,
+      newKek,
+      wrappedDEK
+    )
+    assert.notEqual(rewrapped, wrappedDEK)
+  })
+
+  test('decrypting accepts a bare string, so reading a row back needs no cast', async () => {
+    const kek = await deriveKEK(KEY_MATERIAL, 'c2FsdA')
+    const { ciphertext, wrappedDEK } = await envelopeEncrypt(kek, 'value')
+    const { envelopeDecrypt } = await import('./crypto-utils.js')
+    const fromRow: string = ciphertext
+    assert.equal(
+      await envelopeDecrypt<string>(kek, fromRow, wrappedDEK),
+      'value'
+    )
+  })
+})

package/src/column-form.ts

@@ -0,0 +1,58 @@
+// knowledge: decisions/internals/core-column-form-is-an-axis-of-its-own.md
+import type {
+  HashedValue,
+  SealedValue,
+  WrappedValue,
+} from './data-classification.js'
+
+/**
+ * SHA-256 of a credential, lowercase hex — the sole producer of `HashedValue`.
+ *
+ * Deliberately unpeppered. These are high-entropy random bearer tokens, not
+ * passwords: there is no candidate set to search, so a pepper would add a key
+ * to manage and a rotation story to own while buying nothing. A column holding
+ * a *low*-entropy secret is not a `hashed` column — it wants a password KDF and
+ * a different type entirely.
+ *
+ * Async because it runs on WebCrypto rather than `node:crypto`, so the same
+ * code path works in a Worker. Callers that hash a bearer token on every
+ * request are already async.
+ */
+export const hashToken = async (raw: string): Promise<HashedValue> => {
+  const subtle = globalThis.crypto?.subtle
+  if (!subtle) {
+    throw new Error('WebCrypto not available')
+  }
+  const digest = await subtle.digest(
+    'SHA-256',
+    new TextEncoder().encode(raw)
+  )
+  let hex = ''
+  for (const byte of new Uint8Array(digest)) {
+    hex += byte.toString(16).padStart(2, '0')
+  }
+  return hex as HashedValue
+}
+
+/**
+ * Assert that a string already in storage is ciphertext of the given form.
+ *
+ * The brands exist so that new writes must come from a real encrypt/hash call,
+ * but three paths legitimately hold such a value as a bare `string`: a
+ * migration backfilling rows written before the column declared its form, a
+ * test fixture, and a value arriving over the wire from a service that sealed
+ * it elsewhere. Each of those is a promise the caller is making, not something
+ * the type system can check — which is why these are named to be greppable and
+ * why there is no non-`unsafe` spelling. If one of these appears in ordinary
+ * request-handling code, that is the bug.
+ */
+export const unsafeAsWrapped = (stored: string): WrappedValue =>
+  stored as WrappedValue
+
+/** See `unsafeAsWrapped`. */
+export const unsafeAsSealed = (stored: string): SealedValue =>
+  stored as SealedValue
+
+/** See `unsafeAsWrapped`. */
+export const unsafeAsHashed = (stored: string): HashedValue =>
+  stored as HashedValue

package/src/crypto-utils.ts

@@ -1,3 +1,4 @@
+import type { WrappedValue } from './data-classification.js'
 import { WeakKeyMaterialError } from './errors/errors.js'
 
 const encoder = new TextEncoder()
@@ -373,11 +374,19 @@ export const deriveKEK = async (
   return deriveKey(passphrase, fromBase64Url(salt))
 }
 
+/**
+ * The one place a `WrappedValue` is minted. Every branded return below routes
+ * through here, so the assertion "these bytes really are ciphertext" is made
+ * once and audited once instead of at each call site.
+ */
+const asWrapped = (ciphertext: string): WrappedValue =>
+  ciphertext as WrappedValue
+
 export const wrapDEK = async (
   kek: CryptoKey,
   plaintextDEK: string
-): Promise<string> => {
-  return encryptWithCryptoKey(kek, plaintextDEK)
+): Promise<WrappedValue> => {
+  return asWrapped(await encryptWithCryptoKey(kek, plaintextDEK))
 }
 
 export const unwrapDEK = async (
@@ -408,8 +417,8 @@ const decryptWithDEK = async <T>(
 }
 
 export interface EnvelopeEncryptResult {
-  ciphertext: string
-  wrappedDEK: string
+  ciphertext: WrappedValue
+  wrappedDEK: WrappedValue
 }
 
 export const envelopeEncrypt = async (
@@ -417,11 +426,21 @@ export const envelopeEncrypt = async (
   value: unknown
 ): Promise<EnvelopeEncryptResult> => {
   const dek = await generateDEK()
-  const ciphertext = await encryptWithDEK(dek, value)
+  const ciphertext = asWrapped(await encryptWithDEK(dek, value))
   const wrappedDEK = await wrapDEK(kek, dek)
   return { ciphertext, wrappedDEK }
 }
 
+/**
+ * Note the inputs are plain `string`, not `WrappedValue`.
+ *
+ * The brand exists to stop plaintext being *written* to a wrapped column, and
+ * a `WrappedValue` is assignable to `string`, so a branded caller still passes
+ * without a cast. Demanding the brand here would buy nothing — feeding the
+ * wrong string in already fails at the AEAD tag — while forcing a cast into
+ * every path that reads ciphertext back out of a row, a parsed envelope, or the
+ * wire, which is exactly where casts are least reviewable.
+ */
 export const envelopeDecrypt = async <T>(
   kek: CryptoKey,
   ciphertext: string,
@@ -435,7 +454,7 @@ export const envelopeRewrap = async (
   oldKEK: CryptoKey,
   newKEK: CryptoKey,
   wrappedDEK: string
-): Promise<string> => {
+): Promise<WrappedValue> => {
   const dek = await unwrapDEK(oldKEK, wrappedDEK)
   return wrapDEK(newKEK, dek)
 }

package/src/data-classification.ts

@@ -11,9 +11,53 @@ export type AnonymizeStrategy =
   | 'keep'
   | null
 
+// knowledge: decisions/internals/core-column-form-is-an-axis-of-its-own.md
+
+/**
+ * How a column's bytes are represented at rest, as distinct from how sensitive
+ * the value is (`Classification`). The two are independent: a token hash is
+ * `secret` + `hashed` and must never be encrypted, because the hash *is* the
+ * lookup key; a live bearer token is `secret` + `plain` today and should not be.
+ *
+ * `wrapped` and `sealed` are siblings rather than one being "encrypted": both
+ * are ciphertext, and what separates them is who can read it back. Wrapped is
+ * symmetric and the application holds the key. Sealed is asymmetric and the
+ * application holds only the public half, so it can write the value and never
+ * read it. Storing one where the other is expected is silent, permanent data
+ * loss, which is why they are not collapsed into a single `encrypted`.
+ */
+export type ColumnForm = 'plain' | 'hashed' | 'wrapped' | 'sealed'
+
+declare const wrappedBrand: unique symbol
+declare const sealedBrand: unique symbol
+declare const hashedBrand: unique symbol
+
+/**
+ * Ciphertext under a symmetric key the application holds — the output of
+ * `envelopeEncrypt`, `wrapDEK` or `envelopeRewrap`.
+ *
+ * Unlike `Secret<T>` the brand is REQUIRED, so a plain `string` is not
+ * assignable and a column declared `form: 'wrapped'` cannot be written with
+ * anything but genuine ciphertext. It stays assignable *to* `string`, so it
+ * still works as a query operand and serializes normally — the constraint is on
+ * construction, not on use.
+ */
+export type WrappedValue = string & { readonly [wrappedBrand]: true }
+
+/** Ciphertext under a public key whose private half the application does not
+ *  hold. Deliberately not assignable to `WrappedValue`: writing one where the
+ *  other belongs produces a row nobody can ever open. */
+export type SealedValue = string & { readonly [sealedBrand]: true }
+
+/** A one-way digest of a secret input. The brand's job is narrow — stop a *raw*
+ *  credential being written into the column that should hold its hash. */
+export type HashedValue = string & { readonly [hashedBrand]: true }
+
 export interface ColumnClassification {
   classification: Classification
   anonymize_strategy: AnonymizeStrategy
+  /** At-rest representation. Absent means `plain`. */
+  form?: ColumnForm
   description?: string
 }
 

package/src/function/functions.types.ts

@@ -12,6 +12,7 @@ import type { StandardSchemaV1 } from '@standard-schema/spec'
 import type { PikkuError } from '../errors/error-handler.js'
 import type { CoreNodeConfig } from '../wirings/node/node.types.js'
 import type { ScenarioSurface } from '../wirings/workflow/scenario-step.types.js'
+import type { Safe } from '../secret-value.js'
 
 /**
  * @deprecated Use StandardSchemaV1 from @standard-schema/spec instead.
@@ -31,7 +32,9 @@ export type CorePikkuFunction<
   services: Services,
   data: In,
   wire: Wire
-) => Wire['channel'] extends null ? Promise<Out> : Promise<Out> | Promise<void>
+) => Wire['channel'] extends null
+  ? Promise<Safe<Out>>
+  : Promise<Safe<Out>> | Promise<void>
 
 export type CorePikkuFunctionSessionless<
   In,
@@ -45,7 +48,9 @@ export type CorePikkuFunctionSessionless<
   services: Services,
   data: In,
   wire: Wire
-) => Wire['channel'] extends null ? Promise<Out> : Promise<Out> | Promise<void>
+) => Wire['channel'] extends null
+  ? Promise<Safe<Out>>
+  : Promise<Safe<Out>> | Promise<void>
 
 export type CorePikkuPermission<
   In = any,
@@ -192,16 +197,18 @@ export type CorePikkuFunctionConfig<
   tags?: string[]
   expose?: boolean
   /**
-   * The function performs its own authorization in its body — verifying a
+   * The permission check for this function lives in its body — verifying a
    * signed token, checking a webhook signature, matching an invite code — so
-   * it is not open despite carrying no session, scope or permission.
+   * it is not open despite declaring no session, scope or permission.
    *
-   * Purely declarative: nothing at runtime reads it, and it grants nothing. It
-   * exists so the claim is written down where an audit can find it, and so
-   * codegen stops warning about a gate it has no way to see. Asserting it
-   * falsely disables the one check that would have caught the mistake.
+   * A last resort. Prefer `permissions`, which are declared, inspectable, and
+   * reusable; reach for this only when the check cannot be expressed as one.
+   *
+   * Purely declarative — it grants nothing, and asserting it falsely disables
+   * the audit that would have caught the mistake. Requires
+   * `allow.permissionsInBody` in `pikku.config.json`.
    */
-  selfAuthenticated?: boolean
+  permissionsInBody?: boolean
   remote?: boolean
   mcp?: boolean
   readonly?: boolean
@@ -248,7 +255,8 @@ export type CorePikkuFunctionConfig<
    * Scopes the session must hold; all are required (AND) and checked before
    * `permissions`, which OR together — a scope can only narrow access.
    * Narrowed to the generated `ScopeId` union, so an undeclared scope is a
-   * compile error.
+   * compile error. Requires a session — see
+   * {@link CorePikkuSessionlessFunctionConfig}.
    */
   scopes?: Scope[]
   permissions?: CorePermissionGroup<PikkuPermission>
@@ -258,3 +266,32 @@ export type CorePikkuFunctionConfig<
   node?: CoreNodeConfig
   errors?: Array<typeof PikkuError>
 }
+
+/**
+ * {@link CorePikkuFunctionConfig} for a function that runs without a session.
+ *
+ * Identical, minus `scopes`. Scopes are AND-ed and `verifyScopes` fails closed,
+ * so an anonymous caller holds none and satisfies none — a sessionless function
+ * with scopes rejects every caller it exists to serve. Gate it with
+ * `permissions`, which receive the optional session and may pass anonymous.
+ */
+export type CorePikkuSessionlessFunctionConfig<
+  PikkuFunction extends CorePikkuFunctionSessionless<any, any, any, any, any>,
+  PikkuPermission extends CorePikkuPermission<any, any, any> =
+    CorePikkuPermission<any>,
+  PikkuMiddleware extends CorePikkuMiddleware<any, any> = CorePikkuMiddleware<
+    any,
+    any
+  >,
+  InputSchema extends StandardSchemaV1 | undefined = undefined,
+  OutputSchema extends StandardSchemaV1 | undefined = undefined,
+> = Omit<
+  CorePikkuFunctionConfig<
+    PikkuFunction,
+    PikkuPermission,
+    PikkuMiddleware,
+    InputSchema,
+    OutputSchema
+  >,
+  'scopes'
+>

package/src/function/index.ts

@@ -9,6 +9,7 @@ export type {
   CorePikkuFunction,
   CorePikkuFunctionSessionless,
   CorePikkuFunctionConfig,
+  CorePikkuSessionlessFunctionConfig,
   CorePikkuAuth,
   CorePikkuAuthConfig,
   CorePikkuPermission,

package/src/index.ts

@@ -197,20 +197,23 @@ export type { SessionService } from './services/user-session-service.js'
 export {
   NoopAuditService,
   createInvocationAudit,
-  resolveAuditActorFromWire,
   resolveAuditConfig,
+  resolveAuditUserIdentityFromWire,
 } from './services/audit-service.js'
 export type {
-  AuditActor,
   AuditConfig,
   AuditDurability,
   AuditEvent,
   AuditEventBatch,
+  AuditFacets,
   AuditLog,
   AuditLogWriteInput,
   AuditOutcome,
+  AuditQuery,
+  AuditQueryResult,
   AuditService,
   AuditSource,
+  AuditUserIdentity,
   ResolvedAuditConfig,
 } from './services/audit-service.js'
 export type {
@@ -284,4 +287,23 @@ export type {
   AnonymizeStrategy,
   ColumnClassification,
   ClassificationManifest,
+  ColumnForm,
+  WrappedValue,
+  SealedValue,
+  HashedValue,
 } from './data-classification.js'
+
+export {
+  hashToken,
+  unsafeAsWrapped,
+  unsafeAsSealed,
+  unsafeAsHashed,
+} from './column-form.js'
+
+export type { SecretValue, Safe } from './secret-value.js'
+export {
+  createSecretValue,
+  isSecretValue,
+  SecretCoercionError,
+  REDACTED,
+} from './secret-value.js'

package/src/middleware/auth-bearer.test.ts

@@ -8,6 +8,7 @@ import {
   createMiddlewareSessionWireProps,
 } from '../services/user-session-service.js'
 import { InvalidSessionError } from '../errors/errors.js'
+import { createSecretValue } from '../secret-value.js'
 
 beforeEach(() => {
   resetPikkuState()
@@ -429,7 +430,7 @@ describe('authBearer middleware', () => {
     const secrets = {
       getSecret: async (secretId: string) => {
         assert.equal(secretId, 'PIKKU_CONSOLE_TOKEN')
-        return 'secret-token-value'
+        return createSecretValue('secret-token-value')
       },
     }
 
@@ -500,7 +501,7 @@ describe('authBearer middleware', () => {
   test('should not set session when secret-resolved token does not match', async () => {
     const SessionService = new PikkuSessionService<CoreUserSession>()
     const secrets = {
-      getSecret: async () => 'expected-token',
+      getSecret: async () => createSecretValue('expected-token'),
     }
 
     const middleware = authBearer({

package/src/middleware/auth-bearer.ts

@@ -55,9 +55,10 @@ export const authBearer = pikkuMiddlewareFactory<{
             expected = token.value
           } else {
             // An unset secret means the feature is off — never a request error.
-            expected = await secrets
+            const stored = await secrets
               ?.getSecret<string>(token.secretId)
               .catch(() => undefined)
+            expected = stored?.reveal()
           }
           if (expected && constantTimeEqual(bearerToken, expected)) {
             userSession = token.userSession

package/src/middleware/remote-auth.test.ts

@@ -4,6 +4,7 @@ import { pikkuRemoteAuthMiddleware } from './remote-auth.js'
 import { UnauthorizedError } from '../errors/errors.js'
 import { resetPikkuState } from '../pikku-state.js'
 import { encryptWithKeyMaterial, REMOTE_SESSION_INFO } from '../crypto-utils.js'
+import { createSecretValue } from '../secret-value.js'
 
 beforeEach(() => {
   resetPikkuState()
@@ -14,7 +15,7 @@ const TEST_SECRET = 'test-remote-secret-key-with-enough-entropy'
 const createMockSecrets = (secret?: string) => ({
   getSecret: async (key: string) => {
     if (key === 'PIKKU_REMOTE_SECRET' && secret !== undefined) {
-      return secret
+      return createSecretValue(secret)
     }
     throw new Error(`Secret ${key} not found`)
   },

package/src/middleware/remote-auth.ts

@@ -14,7 +14,7 @@ export const pikkuRemoteAuthMiddleware = pikkuMiddleware(
 
     let secret: string
     try {
-      secret = await secrets.getSecret('PIKKU_REMOTE_SECRET')
+      secret = (await secrets.getSecret('PIKKU_REMOTE_SECRET')).reveal()
     } catch {
       if (http.request.path().startsWith('/remote/rpc/')) {
         throw new UnauthorizedError()

package/src/remote.test.ts

@@ -4,6 +4,7 @@ import { buildRemoteHeaders } from './remote.js'
 import { pikkuRemoteAuthMiddleware } from './middleware/remote-auth.js'
 import { resetPikkuState } from './pikku-state.js'
 import { WeakKeyMaterialError } from './errors/errors.js'
+import { createSecretValue } from './secret-value.js'
 
 beforeEach(() => {
   resetPikkuState()
@@ -14,7 +15,7 @@ const WEAK_SECRET = 'dev-remote-secret'
 
 const createSecrets = (secret: string) => ({
   getSecret: async (key: string) => {
-    if (key === 'PIKKU_REMOTE_SECRET') return secret
+    if (key === 'PIKKU_REMOTE_SECRET') return createSecretValue(secret)
     throw new Error(`Secret ${key} not found`)
   },
 })

package/src/remote.ts

@@ -25,7 +25,7 @@ export async function buildRemoteHeaders(
 
   let secret: string | undefined
   try {
-    secret = await secrets?.getSecret('PIKKU_REMOTE_SECRET')
+    secret = (await secrets?.getSecret('PIKKU_REMOTE_SECRET'))?.reveal()
   } catch {}
 
   if (secret && jwt) {