@pikku/schedule 0.12.7 → 0.12.9

package/CHANGELOG.md

@@ -1,3 +1,64 @@
+## 0.12.9
+
+### Patch Changes
+
+- 15c4968: The default runtime path no longer needs `node:*`, `Buffer` or an unguarded `process`, so it loads on edge runtimes (Web APIs only).
+
+  **Breaking:** `FileScenarioRunStore`, `scenarioArtifactContentType` and `scenarioRunSummary` leave the `@pikku/core/services` barrel because they use `node:fs`. Import them from `@pikku/core/services/file-scenario-run-store`. Pre-0.13 breaking changes still ship as a patch.
+
+  **Breaking:** the HMAC helpers in `@pikku/core/hmac` run on Web Crypto, which is async. `hmacSha256Hex`, `hmacDigest`, `verifyHmacSignature` and `verifyPublicKeySignature` now return a Promise; `timingSafeStringEqual` stays synchronous. `WebhookService.sign` and `WebhookService.verify` return a Promise, and so does `verifySlackSignature` in `@pikku/gateway-slack`: `await` them. A function-style `verify` on a webhook source may return a Promise as well. `verifyPublicKeySignature` accepts RSA and EC (P-256, P-384, P-521) PEM keys; Ed25519 and RSA-PSS keys verify as false.
+
+  `isProduction()` (and the `PIKKU_MODEL_ALIASES` and `PIKKU_ENV` reads) now ask the registered singleton services' `variables` service first, then `process.env` when `process` exists. With neither, `isProduction()` is true, so an edge deployment never exposes error details by accident. `LocalVariablesService` resolves its `process.env` default when constructed and falls back to an empty store without `process`.
+
+  Workflow invocation ids use a built-in SHA-1 and stay byte-identical. `@pikku/kysely` and the Cloudflare hibernation server use `globalThis.crypto.randomUUID()` and no `Buffer`; `@pikku/kysely` is marked `sideEffects: false`. `@pikku/ai-deepinfra` reads `DEEPINFRA_API_KEY` only when `process` exists and decodes base64 audio without `Buffer`.
+
+  Runtime tiers. A package declares where it can run in `package.json`: `"pikku": { "runtime": "edge" | "serverless" | "server" }`, with optional per-subpath overrides (`"exports": { "./dev": "server" }`). `server` is the default. `@pikku/core` and the default services are `edge` (core's Node-only subpaths are `server`), `@pikku/better-auth`, `@pikku/addon-admin` and `@pikku/cloudflare` are `serverless` (better-auth statically imports `node:crypto` scrypt), and `@pikku/addon-console` is `server` and must never land in a deployed unit.
+
+  `pikku deploy` now verifies each deployed unit before bundling it. The unit is bundled with esbuild (neutral platform, `workerd`/`worker`/`browser` conditions) under its tier's profile, ahead of the adapter's aliases and stubs so they cannot hide anything, and the build fails when the bundle holds a package declared above the unit's tier or a Node built-in the runtime does not provide. The error names the unit, package, import chain and the fix. A built-in the provider stubs is a warning. On an edge unit, a bundled `InMemory*` class also fails the build. The unit's tier is its `runtime`, else the project's own `pikku.runtime`, else the provider default (`serverless` on Cloudflare). Packages that declare nothing are judged by their imports only.
+
+  `ProviderAdapter.getRuntimeProfile(tier?)` returns the compat date, compat flags, the built-ins the runtime provides (keyed by compat date), the stubbed ones and the externals. The Cloudflare adapter derives `wrangler.toml`, the upload metadata and the bundle externals from it; `node:os` and `node:fs` are not provided before compat date 2025-09-15. The default is `nodejs_compat_v2` with compat date 2024-12-18, which is what `wrangler.toml` and Fabric's live workers already use, so Fabric deploys see no runtime change. Only the direct-API upload in `@pikku/deploy-cloudflare` (`createWorker`, used by its own `deploy()`) moves: it sent `nodejs_compat` with 2024-01-01 before. A newer date or flag is opt-in through the adapter option `new CloudflareProviderAdapter({ compatDate })` or `getCloudflareRuntimeProfile(tier, compatDate)`. From 2025-08-15 `node:http` and `node:https` exist, and from 2025-09-15 `node:os`, `node:fs` (stubbed by the build regardless) and `node:perf_hooks`; the verifier's allowed built-ins follow the effective date. A newer date changes the runtime of every worker deployed with it.
+
+  `declareScopes(['pikku:console'])` (from `@pikku/core/scope`) declares scopes by id without wiring anything. `wireAddon({ scopes })` only requires a scope of an addon's functions; the tree arrives with the addon's metadata, so a role granting `pikku:console` used to fail PKU124 unless the addon was wired, and a wired `@pikku/addon-console` lands in every unit carrying the `/rpc` catch-all. An app that grants the scope without the console now calls `declareScopes` and no longer needs the scaffold or the addon. When the addon is wired its tree and descriptions win and the bare id adds nothing.
+
+  More packages declare a tier after bundling each with the edge profile. `edge`: `@pikku/addon-graph`, `@pikku/pino`, `@pikku/jose`, `@pikku/ai-vercel`, `@pikku/ai-voice`. `serverless`: `@pikku/kysely-postgres` (postgres.js needs `node:buffer`, `stream`, `events`), `@pikku/backblaze` (`copyFile` reads a local file, which the build stubs), `@pikku/gateway-slack` (`@slack/web-api` imports `node:os` and `zlib`). `server`: `@pikku/schedule` (`cron` imports `child_process`), `@pikku/aws-services` (the AWS SDK's Node handler needs `node:http2`), `@pikku/browser` (puppeteer), and `@pikku/modelcontextprotocol` except its `./fetch` subpath, which is `edge`.
+
+  `@pikku/addon-graph` no longer needs `node:crypto` or `Buffer`: the Crypto function hashes and HMACs on Web Crypto (MD5 is built in, since Web Crypto has none) and encodes with `TextEncoder`/`atob`/`btoa`, with output unchanged.
+
+- Updated dependencies [6f11bb5]
+- Updated dependencies [0c67e33]
+- Updated dependencies [15c4968]
+- Updated dependencies [d75a23d]
+- Updated dependencies [9b12c8a]
+  - @pikku/core@0.12.138
+
+## 0.12.8
+
+### Patch Changes
+
+- 4c7a1b5: Run the monorepo's own scripts through bun instead of yarn. What moves is the
+  package manager each package's `prepublishOnly` and build scripts invoke, plus
+  the two manifest fixes bun needs to resolve the tree: `uWebSockets.js` is
+  declared with an explicit `github:` specifier, and `@pikku/uws-handler` marks
+  its `uWebSockets.js` peer optional so a bun install of a consumer that brings
+  its own uWS app does not try to fetch it from the registry.
+
+  Three published behaviours change, all of them cases where an isolated
+  `node_modules` or bun as the runtime had been papered over by yarn's hoisting:
+
+  - `@pikku/migrator-sql` turns foreign keys on when it opens a sqlite database
+    through bun. `node:sqlite` enforces them by default and `bun:sqlite` does not,
+    which silently turned every `ON DELETE CASCADE` into a no-op under
+    `bunx --bun pikku`.
+  - `@pikku/cli` resolves a deploy provider against the project being deployed
+    rather than against wherever the CLI itself is installed, which is what its
+    own "is not installed" error asks the user to arrange.
+  - `@pikku/cli` treats a specifier a runtime hands straight back — bun does this
+    for the modules it implements itself — as not resolved from the project, so
+    it falls back rather than loading the runtime's own copy.
+
+- Updated dependencies [4c7a1b5]
+  - @pikku/core@0.12.108
+
 ## 0.12.7
 
 ### Patch Changes

package/dist/in-memory-scheduler-service.js

@@ -24,7 +24,7 @@ export class InMemorySchedulerService extends SchedulerService {
         const delayMs = typeof delay === 'string' ? parseDurationString(delay) : delay;
         const taskId = `inmem-${++this.idCounter}-${Date.now()}`;
         const scheduledFor = new Date(Date.now() + delayMs);
-        const timer = setTimeout(async () => {
+        const run = async () => {
             this.delayedTasks.delete(taskId);
             try {
                 // An RPC, not a cron task. `runScheduledTask` looks the name up in the
@@ -48,6 +48,10 @@ export class InMemorySchedulerService extends SchedulerService {
             catch (err) {
                 getLogger().error(`Failed to execute delayed RPC '${rpcName}': ${err}`);
             }
+        };
+        // `run` catches and logs every error itself, so nothing can reject
+        const timer = setTimeout(() => {
+            void run();
         }, delayMs);
         this.delayedTasks.set(taskId, {
             taskId,
@@ -110,15 +114,20 @@ export class InMemorySchedulerService extends SchedulerService {
      */
     async stop() {
         for (const [, job] of this.cronJobs) {
-            job.stop();
+            await job.stop();
         }
         this.cronJobs.clear();
     }
     startCronJob(name, schedule) {
         const job = new CronJob(schedule, async () => {
-            getLogger().info(`Running scheduled task: ${name}`);
-            await runScheduledTask({ name });
-            getLogger().debug(`Completed scheduled task: ${name}`);
+            try {
+                getLogger().info(`Running scheduled task: ${name}`);
+                await runScheduledTask({ name });
+                getLogger().debug(`Completed scheduled task: ${name}`);
+            }
+            catch (err) {
+                getLogger().error(`Scheduled task '${name}' failed: ${err}`);
+            }
         }, null, true);
         this.cronJobs.set(name, job);
     }

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "@pikku/schedule",
-  "version": "0.12.7",
+  "version": "0.12.9",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pikkujs/pikku.git",
+    "directory": "packages/schedule"
+  },
   "description": "In-memory scheduler service for Pikku cron wirings",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
@@ -16,14 +21,13 @@
     "test": "bash run-tests.sh",
     "test:watch": "bash run-tests.sh --watch",
     "test:coverage": "bash run-tests.sh --coverage",
-    "prepublishOnly": "yarn build"
+    "prepublishOnly": "bun run build"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.85"
+    "@pikku/core": "^0.12.138"
   },
   "devDependencies": {
-    "@types/node": "^24.13.3",
-    "typescript": "^6.0.3"
+    "@types/node": "^24.13.3"
   },
   "engines": {
     "node": ">=24"
@@ -39,4 +43,4 @@
       "default": "./dist/index.js"
     }
   }
-}
+}

package/run-tests.sh

@@ -34,20 +34,35 @@ files=($(find src -type f -name "*.test.ts"))
 # Check if any files matched the pattern
 if [ ${#files[@]} -eq 0 ]; then
   echo "No test files found matching pattern: $pattern"
+  if [ "${STRICT_TEST_DISCOVERY}" = "1" ]; then
+    exit 1
+  fi
   exit 0
 fi
 
-# Construct the node command
-node_cmd=(node --import tsx --test)
+# Construct the bun command
+#
+# --parallel gives every test file its own worker process, which is what node's
+# `--test` did. Several suites keep module-level caches (a TypeScript program, a
+# temp fixture directory) that a shared process would leak between files.
+#
+# --timeout because bun caps a test at 5s by default where node had no cap, and
+# the suites that build real TypeScript programs run well past that.
+bun_cmd=(bun test --parallel --timeout 120000)
 
 # Append options based on flags
 if [ "$watch_mode" = true ]; then
-  node_cmd+=(--watch)
+  # --watch reruns in one process; parallel workers have nothing to watch.
+  bun_cmd=(bun test --watch --timeout 120000)
 fi
 
 if [ "$coverage_mode" = true ]; then
-  node_cmd+=(--test-coverage-include="src/**/*.{ts,js}" --test-coverage-exclude="**/dist/**" --experimental-test-coverage --test-reporter=lcov --test-reporter-destination=lcov.info)
+  # --coverage-dir=. keeps lcov.info at the package root: CI merges every
+  # package's report by prefixing its SF paths with the file's own directory,
+  # so a nested coverage/ directory would re-root them one level too deep.
+  bun_cmd+=(--coverage --coverage-reporter=lcov --coverage-reporter=text --coverage-dir=.)
+  export PIKKU_TEST_COVERAGE=1
 fi
 
-# Execute the node command with the expanded list of files
-"${node_cmd[@]}" "${files[@]}"
+# Execute the bun command with the expanded list of files
+"${bun_cmd[@]}" "${files[@]}"

package/src/in-memory-scheduler-service.test.ts

@@ -1,94 +0,0 @@
-import { describe, test } from 'node:test'
-import assert from 'node:assert/strict'
-import { pikkuState } from '@pikku/core/state'
-import { addFunction } from '@pikku/core/function'
-
-import { InMemorySchedulerService } from './in-memory-scheduler-service.js'
-
-const waitFor = async (predicate: () => boolean, withinMs = 2000) => {
-  const deadline = Date.now() + withinMs
-  while (Date.now() < deadline) {
-    if (predicate()) return true
-    await new Promise((resolve) => setTimeout(resolve, 10))
-  }
-  return false
-}
-
-describe('InMemorySchedulerService scheduleRPC', () => {
-  test('schedules and executes delayed RPC', async () => {
-    const logger = {
-      info: () => {},
-      warn: () => {},
-      debug: () => {},
-      error: () => {},
-    }
-
-    pikkuState(null, 'package', 'singletonServices', {
-      logger,
-    } as any)
-
-    const scheduler = new InMemorySchedulerService()
-    try {
-      const taskId = await scheduler.scheduleRPC(50, 'testRpc', { ok: true }, {
-        userId: 'user-1',
-      } as any)
-      assert.ok(taskId)
-
-      const task = await scheduler.getTask(taskId)
-      assert.ok(task)
-      assert.equal(task.rpcName, 'testRpc')
-    } finally {
-      await scheduler.close()
-    }
-  })
-
-  /**
-   * The delay actually has to invoke the RPC, with its data.
-   *
-   * The test above only proved the task was registered, which is why the
-   * scheduler could dispatch through `runScheduledTask` — a lookup against the
-   * *cron task* registry that no scheduled RPC is ever in — and still pass.
-   * Every internally scheduled RPC failed with ScheduledTaskNotFoundError,
-   * `pikkuWorkflowSleeper` among them, so an async workflow never woke from
-   * `workflow.sleep`.
-   */
-  test('invokes the named RPC with its data once the delay elapses', async () => {
-    const errors: string[] = []
-    const logger = {
-      info: () => {},
-      warn: () => {},
-      debug: () => {},
-      error: (message: string) => errors.push(message),
-    }
-    pikkuState(null, 'package', 'singletonServices', { logger } as any)
-
-    const calls: unknown[] = []
-    addFunction(
-      'delayedTestRpc',
-      {
-        func: async (_services: any, data: unknown) => calls.push(data),
-      } as any,
-      null
-    )
-    pikkuState(null, 'function', 'meta')['delayedTestRpc'] = {
-      name: 'delayedTestRpc',
-      sessionless: true,
-      permissions: [],
-    } as any
-
-    const scheduler = new InMemorySchedulerService()
-    try {
-      await scheduler.scheduleRPC(20, 'delayedTestRpc', {
-        runId: 'run-1',
-        stepId: 'step-1',
-      })
-      assert.ok(
-        await waitFor(() => calls.length > 0),
-        `RPC was never invoked; scheduler errors: ${JSON.stringify(errors)}`
-      )
-      assert.deepEqual(calls[0], { runId: 'run-1', stepId: 'step-1' })
-    } finally {
-      await scheduler.close()
-    }
-  })
-})

package/src/in-memory-scheduler-service.ts

@@ -1,166 +0,0 @@
-import { CronJob } from 'cron'
-import type { CoreUserSession } from '@pikku/core/types'
-import type {
-  ScheduledTaskInfo,
-  ScheduledTaskSummary,
-} from '@pikku/core/services'
-import { SchedulerService } from '@pikku/core/services'
-import { parseDurationString } from '@pikku/core/utils'
-import { pikkuState, getSingletonServices } from '@pikku/core/state'
-import { runScheduledTask } from '@pikku/core/scheduler'
-import { getScheduledTasks } from '@pikku/core/scheduler'
-import { rpcService } from '@pikku/core/rpc'
-
-interface DelayedTask {
-  taskId: string
-  rpcName: string
-  data?: any
-  session?: CoreUserSession
-  scheduledFor: Date
-  timer: ReturnType<typeof setTimeout>
-}
-
-const getLogger = () => {
-  return pikkuState(null, 'package', 'singletonServices')!.logger
-}
-
-/**
- * In-memory SchedulerService implementation.
- * Uses CronJob for recurring tasks and setTimeout for delayed RPCs.
- */
-export class InMemorySchedulerService extends SchedulerService {
-  private cronJobs = new Map<string, CronJob>()
-  private delayedTasks = new Map<string, DelayedTask>()
-  private idCounter = 0
-
-  async init(): Promise<void> {}
-
-  /**
-   * Schedule a one-off delayed RPC call via setTimeout
-   */
-  async scheduleRPC(
-    delay: number | string,
-    rpcName: string,
-    data?: any,
-    session?: CoreUserSession
-  ): Promise<string> {
-    const delayMs =
-      typeof delay === 'string' ? parseDurationString(delay) : delay
-    const taskId = `inmem-${++this.idCounter}-${Date.now()}`
-    const scheduledFor = new Date(Date.now() + delayMs)
-
-    const timer = setTimeout(async () => {
-      this.delayedTasks.delete(taskId)
-      try {
-        // An RPC, not a cron task. `runScheduledTask` looks the name up in the
-        // scheduler's task registry, which only ever holds wired cron tasks —
-        // so every internally-scheduled RPC died here as
-        // ScheduledTaskNotFoundError. The one that matters most is
-        // `pikkuWorkflowSleeper`: it is registered by the workflow service as a
-        // function, and it is what wakes a run from `workflow.sleep`. With the
-        // wake-up lost to a swallowed log line, an async workflow run stopped
-        // at its first sleep and stayed `running` forever.
-        //
-        // `data` has to be forwarded for the same reason. The sleeper is called
-        // with `{ runId, stepId }` and cannot identify the sleeping step
-        // without it — it was captured in `delayedTasks` but never passed on.
-        // This matches what the BullMQ and pg-boss schedulers already do:
-        // enqueue `{ rpcName, data, session }` and invoke the RPC with it.
-        const services = getSingletonServices()
-        const rpc = rpcService.getContextRPCService(
-          services as any,
-          {},
-          false
-        ) as { invoke: (name: string, data: unknown) => Promise<unknown> }
-        await rpc.invoke(rpcName, data)
-      } catch (err: unknown) {
-        getLogger().error(`Failed to execute delayed RPC '${rpcName}': ${err}`)
-      }
-    }, delayMs)
-
-    this.delayedTasks.set(taskId, {
-      taskId,
-      rpcName,
-      data,
-      session,
-      scheduledFor,
-      timer,
-    })
-
-    return taskId
-  }
-
-  async unschedule(taskId: string): Promise<boolean> {
-    const task = this.delayedTasks.get(taskId)
-    if (task) {
-      clearTimeout(task.timer)
-      this.delayedTasks.delete(taskId)
-      return true
-    }
-    return false
-  }
-
-  async getTask(taskId: string): Promise<ScheduledTaskInfo | null> {
-    const task = this.delayedTasks.get(taskId)
-    if (!task) return null
-    return {
-      taskId: task.taskId,
-      rpcName: task.rpcName,
-      scheduledFor: task.scheduledFor,
-      data: task.data,
-      session: task.session,
-      status: 'scheduled',
-    }
-  }
-
-  async getAllTasks(): Promise<ScheduledTaskSummary[]> {
-    return Array.from(this.delayedTasks.values()).map((t) => ({
-      taskId: t.taskId,
-      rpcName: t.rpcName,
-      scheduledFor: t.scheduledFor,
-    }))
-  }
-
-  async close(): Promise<void> {
-    await this.stop()
-    // Clear delayed tasks
-    for (const [, task] of this.delayedTasks) {
-      clearTimeout(task.timer)
-    }
-    this.delayedTasks.clear()
-  }
-
-  /**
-   * Start recurring scheduled tasks.
-   */
-  async start(): Promise<void> {
-    const scheduledTasks = getScheduledTasks()
-    for (const [, task] of scheduledTasks) {
-      this.startCronJob(task.name, task.schedule)
-    }
-  }
-
-  /**
-   * Stop all recurring CronJobs.
-   */
-  async stop(): Promise<void> {
-    for (const [, job] of this.cronJobs) {
-      job.stop()
-    }
-    this.cronJobs.clear()
-  }
-
-  private startCronJob(name: string, schedule: string) {
-    const job = new CronJob(
-      schedule,
-      async () => {
-        getLogger().info(`Running scheduled task: ${name}`)
-        await runScheduledTask({ name })
-        getLogger().debug(`Completed scheduled task: ${name}`)
-      },
-      null,
-      true
-    )
-    this.cronJobs.set(name, job)
-  }
-}

package/src/index.ts

@@ -1,6 +0,0 @@
-export { InMemorySchedulerService } from './in-memory-scheduler-service.js'
-
-/**
- * @deprecated Use InMemorySchedulerService instead
- */
-export { InMemorySchedulerService as PikkuTaskScheduler } from './in-memory-scheduler-service.js'

package/tsconfig.json

@@ -1,18 +0,0 @@
-{
-  "extends": "../tsconfig.json",
-  "compilerOptions": {
-    "rootDir": "./src",
-    "module": "Node18",
-    "outDir": "dist",
-    "target": "esnext",
-    "declaration": true,
-    "resolveJsonModule": true
-  },
-  "include": ["bin/**/*.ts", "src/**/*.ts"],
-  "exclude": ["**/*.test.ts", "node_modules", "bin/dist"],
-  "references": [
-    {
-      "path": "../core/tsconfig.json"
-    }
-  ]
-}

package/tsconfig.tsbuildinfo

@@ -1 +0,0 @@
-{"root":["./src/in-memory-scheduler-service.ts","./src/index.ts"],"version":"6.0.3"}