@pikku/skills 0.12.50 → 0.12.51

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/skills",
-  "version": "0.12.50",
+  "version": "0.12.51",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/pikkujs/pikku.git",

package/skills/pikku-services/SKILL.md

@@ -79,6 +79,16 @@ service's paths and size limit; omitting it does not disable it.
   function enriches the event with the function id, wire type, trace id and user
   identity; an `insertInto('audit_log')` of your own gets none of that, and a
   write inside a transaction that later rolls back records nothing.
+- **Do not reach for `node:os` (`tmpdir()`, `homedir()`) or hand-roll `mkdtemp`
+  to get a scratch file.** `node:os` is missing from the Cloudflare Workers
+  runtime, so one import fails the whole worker at upload, even if the code path
+  never runs there. `TemporaryFileService` (`@pikku/core/services/temporary-file-service`)
+  is a **wire service**, not a singleton: build it in `pikkuWireServices` with
+  `new TemporaryFileService(singletonServices.logger, tempDir).createInstance()`
+  and return the `TemporaryFileInstance`, so each invocation owns its own files.
+  Use `writeFile(key, stream)`, `getTempFileAbsolutePath(key)` when a subprocess
+  needs a path, and `cleanup()` in a `finally`. Do not construct it in
+  `pikkuServices` and close over it in a singleton — pass the instance in per call.
 - **Do not log an unrevealed secret.** Every logger argument is `Safe<>`-guarded,
   so a `SecretValue` nested anywhere in the call collapses it to `never` and it
   stops compiling. That is deliberate — it would have printed `[secret]` anyway.

package/skills/pikku-webhook/SKILL.md

@@ -155,7 +155,11 @@ public because receivers share the scheme:
 ```ts
 const raw = await request.text()
 if (
-  !webhookService.verify(secret, request.headers.get('x-pikku-signature')!, raw)
+  !(await webhookService.verify(
+    secret,
+    request.headers.get('x-pikku-signature')!,
+    raw
+  ))
 ) {
   throw new UnauthorizedError()
 }

package/skills/pikku-wiring/references/gateway-slack.md

@@ -102,7 +102,7 @@ const tokens = await exchangeSlackOAuthCode({
 ```typescript
 import { verifySlackSignature } from '@pikku/gateway-slack'
 
-verifySlackSignature(signingSecret, signature, timestamp, body): boolean
+verifySlackSignature(signingSecret, signature, timestamp, body): Promise<boolean>
 ```
 
 **Signature before timestamp** — the two middle arguments are both strings, so

package/skills/pikku-wiring/references/trigger.md

@@ -158,9 +158,10 @@ subscribe to its events as `<source>:<event>`:
     provider's private key; the stored secret is its PEM public key (Wise).
   - Anything else (a timestamp in the signed payload, a signature in the body
     or query, a URL in the signed string) is a function
-    `(request, secret, services) => boolean`, built from `hmacDigest`,
+    `(request, secret, services) => boolean | Promise<boolean>`, built from `hmacDigest`,
     `verifyHmacSignature`, `verifyPublicKeySignature` and
-    `timingSafeStringEqual` in `@pikku/core/hmac`.
+    `timingSafeStringEqual` in `@pikku/core/hmac` (all but the last are
+    async: `await` them).
 
   A request with a body that fails is refused with a 401. A bodiless request
   that fails (a validation token in the query) still reaches