@pikku/cli 0.12.113 → 0.12.115

package/dist/.pikku/rpc/pikku-rpc-wirings-meta.internal.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 import { pikkuState } from '@pikku/core/state';
 import metaData from './pikku-rpc-wirings-meta.internal.gen.json' with { type: 'json' };

package/dist/.pikku/scenarios/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 /**
  * Subpath entry — `#pikku/scenarios` resolves here.

package/dist/.pikku/scenarios/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 /**
  * Subpath entry — `#pikku/scenarios` resolves here.

package/dist/.pikku/scenarios/pikku-personas.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 /** Personas declared with definePersonas() */
 import { createHttpPersonas } from '@pikku/core/persona';

package/dist/.pikku/scenarios/pikku-scenario-functions-meta.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 import { pikkuState } from '@pikku/core/state';
 import '../function/pikku-functions-meta.gen.js';

package/dist/.pikku/scenarios/pikku-scenario-functions.gen.d.ts

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 export {};

package/dist/.pikku/scenarios/pikku-scenario-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 import type { PikkuScenarioWire, ScenarioStepOptions } from '@pikku/core/scenario';
 import type { PikkuWorkflowWire } from '@pikku/core/workflow';

package/dist/.pikku/scenarios/pikku-scenario-wirings-meta.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 import { pikkuState } from '@pikku/core/state';
 import '../workflow/pikku-workflow-wirings-meta.gen.js';

package/dist/.pikku/scenarios/pikku-scenario-wirings.gen.d.ts

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 export {};

package/dist/.pikku/scenarios/schemas/register.gen.d.ts

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 export declare const empty: null;

package/dist/.pikku/scenarios/schemas/register.gen.js

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 export const empty = null;

package/dist/.pikku/scheduler/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 /**
  * Subpath entry — `#pikku/scheduler` resolves here.

package/dist/.pikku/scheduler/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 /**
  * Subpath entry — `#pikku/scheduler` resolves here.

package/dist/.pikku/scheduler/pikku-scheduler-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 /**
  * Scheduler-specific type definitions for tree-shaking optimization

package/dist/.pikku/scheduler/pikku-scheduler-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 /**
  * Scheduler-specific type definitions for tree-shaking optimization

package/dist/.pikku/schemas/register.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 import { addSchema } from '@pikku/core/schema';
 import * as BinaryInput from './schemas/BinaryInput.schema.json' with { type: 'json' };

package/dist/.pikku/scopes/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 /**
  * Subpath entry — `#pikku/scopes` resolves here.

package/dist/.pikku/scopes/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 /**
  * Subpath entry — `#pikku/scopes` resolves here.

package/dist/.pikku/scopes/pikku-personas.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 /**
  * This file was generated by the @pikku/cli

package/dist/.pikku/scopes/pikku-roles.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 /**
  * This file was generated by the @pikku/cli

package/dist/.pikku/scopes/pikku-scope-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 export { defineScope } from '@pikku/core/scope';
 export { defineSystemRole } from '@pikku/core/role';

package/dist/.pikku/scopes/pikku-scope-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 export { defineScope } from '@pikku/core/scope';
 export { defineSystemRole } from '@pikku/core/role';

package/dist/.pikku/scopes/pikku-scopes.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 /**
  * This file was generated by the @pikku/cli

package/dist/.pikku/secrets/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 /**
  * Subpath entry — `#pikku/secrets` resolves here.

package/dist/.pikku/secrets/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 /**
  * Subpath entry — `#pikku/secrets` resolves here.

package/dist/.pikku/secrets/pikku-secret-types.gen.d.ts

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 export { defineSecret } from '@pikku/core/secret';

package/dist/.pikku/secrets/pikku-secret-types.gen.js

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 export { defineSecret } from '@pikku/core/secret';

package/dist/.pikku/secrets/pikku-secrets.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 import { TypedSecretService as CoreTypedSecretService } from '@pikku/core/services';
 import type { SecretService } from '@pikku/core/services';

package/dist/.pikku/secrets/pikku-secrets.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 import { TypedSecretService as CoreTypedSecretService } from '@pikku/core/services';
 /**

package/dist/.pikku/services/pikku-meta-service.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 import { LocalMetaService } from '@pikku/core/services/local-meta';
 export declare class PikkuMetaService extends LocalMetaService {

package/dist/.pikku/services/pikku-meta-service.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 import { LocalMetaService } from '@pikku/core/services/local-meta';
 export class PikkuMetaService extends LocalMetaService {

package/dist/.pikku/setup/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 /**
  * Subpath entry — `#pikku/setup` resolves here.

package/dist/.pikku/setup/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 /**
  * Subpath entry — `#pikku/setup` resolves here.

package/dist/.pikku/setup/pikku-setup-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 /**
  * Config and service factory definitions, declared once per application

package/dist/.pikku/setup/pikku-setup-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 /**
  * Config and service factory definitions, declared once per application

package/dist/.pikku/trigger/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 /**
  * Subpath entry — `#pikku/trigger` resolves here.

package/dist/.pikku/trigger/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 /**
  * Subpath entry — `#pikku/trigger` resolves here.

package/dist/.pikku/trigger/pikku-trigger-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 /**
  * Trigger-specific type definitions for tree-shaking optimization

package/dist/.pikku/trigger/pikku-trigger-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 /**
  * Trigger-specific type definitions for tree-shaking optimization

package/dist/.pikku/variables/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 /**
  * Subpath entry — `#pikku/variables` resolves here.

package/dist/.pikku/variables/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 /**
  * Subpath entry — `#pikku/variables` resolves here.

package/dist/.pikku/variables/pikku-variable-types.gen.d.ts

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 export { defineVariable } from '@pikku/core/variable';

package/dist/.pikku/variables/pikku-variable-types.gen.js

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 export { defineVariable } from '@pikku/core/variable';

package/dist/.pikku/variables/pikku-variables.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 import { TypedVariablesService as CoreTypedVariablesService } from '@pikku/core/services';
 import type { VariablesService } from '@pikku/core/services';

package/dist/.pikku/variables/pikku-variables.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 import { TypedVariablesService as CoreTypedVariablesService, } from '@pikku/core/services';
 /**

package/dist/.pikku/workflow/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 /**
  * Subpath entry — `#pikku/workflow` resolves here.

package/dist/.pikku/workflow/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 /**
  * Subpath entry — `#pikku/workflow` resolves here.

package/dist/.pikku/workflow/pikku-workflow-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import type { PikkuWorkflowGraphConfig, PikkuWorkflowGraphResult } from '@pikku/core/workflow';

package/dist/.pikku/workflow/pikku-workflow-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import { pikkuWorkflowGraph as corePikkuWorkflowGraph } from '@pikku/core/workflow';

package/dist/.pikku/workflow/pikku-workflow-wirings-meta.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 import { pikkuState } from '@pikku/core/state';
 import allWorkflowMeta from './meta/allWorkflow.gen.json' with { type: 'json' };

package/dist/.pikku/workflow/pikku-workflow-wirings.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.113
+ * This file was generated by @pikku/cli@0.12.115
  */
 import { addWorkflow } from '@pikku/core/workflow';
 import './pikku-workflow-wirings-meta.gen.js';

package/dist/bin/pikku-bin.mjs

@@ -11,8 +11,8 @@ async function checkForUpdate() {
     })
     if (!res.ok) return
     const { version: latest } = await res.json()
-    if (latest !== '0.12.113') {
-      process.stderr.write(`\n  Update available  0.12.113 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
+    if (latest !== '0.12.115') {
+      process.stderr.write(`\n  Update available  0.12.115 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
     }
   } catch {}
 }

package/dist/src/functions/commands/persona-sync.js

@@ -2,6 +2,7 @@ import { pikkuSessionlessFunc } from '#pikku/function';
 import { createHttpPersonas } from '@pikku/core/persona';
 import { personaEnvironmentRefusal } from '@pikku/core/persona';
 import { resolvePersonas } from '../../utils/resolve-personas.js';
+import { resolvePersonaCredentials } from '../../utils/persona-credentials.js';
 import { resolveEnvironment } from './environment.js';
 import { loadDeclaredRoles, openScopeServiceForRoles } from './roles-shared.js';
 /**
@@ -88,18 +89,14 @@ export const personaSync = pikkuSessionlessFunc({
             logger.info('Re-run without --dry-run to apply.');
             return;
         }
-        const secret = await variables.get('SCENARIO_ACTOR_SECRET');
-        if (!secret) {
-            throw new Error('SCENARIO_ACTOR_SECRET is not set — a persona account cannot be created. ' +
-                'Export it in the environment running this command (never put it in pikku.config.json).');
-        }
+        const credentials = await resolvePersonaCredentials(variables, 'a persona account');
         const declaredRoles = await loadDeclaredRoles(config.rolesMetaJsonFile, logger);
         if (!declaredRoles) {
             throw new Error('role metadata not found');
         }
         const signedIn = createHttpPersonas({
             apiUrl: env.apiUrl,
-            secret,
+            ...credentials,
             personas: Object.fromEntries(eligible),
             signInPath: env.signInPath,
             rpcPath: env.rpcPath,

package/dist/src/functions/commands/persona.js

@@ -5,6 +5,7 @@ import { createHttpPersonas, personaEnvironmentRefusal, roleMismatchMessage, ver
 import { personaVirtualUserTarget, runVirtualUser, catalogueClassification, DISPOSITIONS, prepareVirtualUserRun, } from '@pikku/core/virtual-user';
 import { getSingletonServices, setSingletonServices } from '@pikku/core/state';
 import { resolvePersonas } from '../../utils/resolve-personas.js';
+import { resolvePersonaCredentials } from '../../utils/persona-credentials.js';
 import { resolveEnvironment } from './environment.js';
 import { createDevAgentRunner } from './dev-agent-runner.js';
 import { formatVirtualUserReport } from './virtual-user-formatter.js';
@@ -76,11 +77,7 @@ export const personaRun = pikkuSessionlessFunc({
         if (refusal) {
             throw new Error(refusal);
         }
-        const secret = await variables.get('SCENARIO_ACTOR_SECRET');
-        if (!secret) {
-            throw new Error('SCENARIO_ACTOR_SECRET is not set — a virtual user cannot sign in. ' +
-                'Export it in the environment running this command (never put it in pikku.config.json).');
-        }
+        const credentials = await resolvePersonaCredentials(variables, 'a virtual user');
         const resolvedModel = model ?? config.scenarios?.model;
         if (!resolvedModel) {
             throw new Error('No model to think with — pass --model, or set scenarios.model in pikku.config.json.');
@@ -115,7 +112,7 @@ export const personaRun = pikkuSessionlessFunc({
         }
         const signedIn = createHttpPersonas({
             apiUrl: env.apiUrl,
-            secret,
+            ...credentials,
             personas,
             signInPath: env.signInPath,
             rpcPath: env.rpcPath,

package/dist/src/functions/commands/scenario-browser.d.ts

@@ -9,10 +9,14 @@
  */
 import type { ScenarioArtifact, ScenarioBrowserFailure, ScenarioBrowserProvider } from '@pikku/core/scenario';
 import type { ResolvedPersona } from '@pikku/core/services';
+import type { OperatorSignInOptions } from '@pikku/core/persona';
 /** The default driver, used when a project names no other. */
 export declare const DEFAULT_BROWSER_DRIVER = "@pikku/playwright";
 export interface ScenarioBrowserDriverOptions {
-    secret: string;
+    /** The actor secret, for a local `pikku dev` target. */
+    secret?: string;
+    /** Fabric operator credentials, for a deployed target. */
+    operator?: OperatorSignInOptions;
     actors: Record<string, ResolvedPersona>;
     signInPath?: string;
     capture?: ScenarioCaptureOptions;
@@ -68,7 +72,10 @@ export interface ResolveScenarioBrowserProviderOptions {
     appUrl?: string;
     /** Base url per app, for a product whose personas sign into more than one. */
     appUrls?: Record<string, string>;
-    secret: string;
+    /** The actor secret, for a local `pikku dev` target. */
+    secret?: string;
+    /** Fabric operator credentials, for a deployed target. */
+    operator?: OperatorSignInOptions;
     actors: Record<string, ResolvedPersona>;
     signInPath?: string;
     /**
@@ -96,7 +103,7 @@ export interface ResolveScenarioBrowserProviderOptions {
  * because a run against a placeholder URL is worse than one that refuses to
  * start.
  */
-export declare const resolveScenarioBrowserProvider: ({ environment, apiUrl, appUrl, appUrls, secret, actors, signInPath, capture, browserScenarios, driver, importDriver, }: ResolveScenarioBrowserProviderOptions) => Promise<ScenarioBrowserProvider>;
+export declare const resolveScenarioBrowserProvider: ({ environment, apiUrl, appUrl, appUrls, secret, operator, actors, signInPath, capture, browserScenarios, driver, importDriver, }: ResolveScenarioBrowserProviderOptions) => Promise<ScenarioBrowserProvider>;
 /**
  * The calls the run loop makes, safe against a run with no browser and against
  * a driver that implements none of the optional members.

package/dist/src/functions/commands/scenario-browser.js

@@ -12,7 +12,7 @@ export const DEFAULT_BROWSER_DRIVER = '@pikku/playwright';
  * because a run against a placeholder URL is worse than one that refuses to
  * start.
  */
-export const resolveScenarioBrowserProvider = async ({ environment, apiUrl, appUrl, appUrls, secret, actors, signInPath, capture, browserScenarios, driver = DEFAULT_BROWSER_DRIVER, importDriver = (specifier) => import(specifier), }) => {
+export const resolveScenarioBrowserProvider = async ({ environment, apiUrl, appUrl, appUrls, secret, operator, actors, signInPath, capture, browserScenarios, driver = DEFAULT_BROWSER_DRIVER, importDriver = (specifier) => import(specifier), }) => {
     const module = await importDriver(driver).catch(() => {
         const install = driver === DEFAULT_BROWSER_DRIVER
             ? `Run 'yarn add -D ${driver} @playwright/test'`
@@ -41,6 +41,7 @@ export const resolveScenarioBrowserProvider = async ({ environment, apiUrl, appU
     }
     const options = {
         secret,
+        operator,
         actors,
         signInPath,
         capture,

package/dist/src/functions/commands/scenario.js

@@ -12,6 +12,7 @@ import { collectScenarioStepProse, scenarioBrowserSteps, scenarioFailureFromStep
 import { formatScenarioReport } from './scenario-formatter.js';
 import { resolveScenarioBrowserProvider, scenarioBrowserLifecycle, } from './scenario-browser.js';
 import { resolvePersonas } from '../../utils/resolve-personas.js';
+import { resolvePersonaCredentials } from '../../utils/persona-credentials.js';
 import { spawnDevServer } from '../../server/spawn-dev-server.js';
 import { buildScenarioPlan } from './scenario-plan.js';
 import { resolveEnvironment } from './environment.js';
@@ -165,18 +166,14 @@ export const scenarioRun = pikkuSessionlessFunc({
             process.exitCode = 1;
             return;
         }
-        const secret = await variables.get('SCENARIO_ACTOR_SECRET');
-        if (!secret) {
-            throw new Error('SCENARIO_ACTOR_SECRET is not set — scenario actors cannot sign in. ' +
-                'Export it in the environment running this command (never put it in pikku.config.json).');
-        }
+        const credentials = await resolvePersonaCredentials(variables, 'scenario actors');
         // Every declared persona, with its address filled in. Resolved once: the
         // HTTP personas and the Playwright provider below must see the same
         // registry, and codegen resolved the same way to type `PersonaName`.
         const scenarioActors = resolvePersonas(state.personas?.definitions ?? [], config.scenarios?.emailDomain);
         const actors = createHttpPersonas({
             apiUrl: env.apiUrl,
-            secret,
+            ...credentials,
             personas: scenarioActors,
             signInPath: env.signInPath,
             rpcPath: env.rpcPath,
@@ -300,7 +297,7 @@ export const scenarioRun = pikkuSessionlessFunc({
                     apiUrl: env.apiUrl,
                     appUrl: env.appUrl,
                     appUrls: env.appUrls,
-                    secret,
+                    ...credentials,
                     actors: scenarioActors,
                     signInPath: env.signInPath,
                     capture,

package/dist/src/utils/persona-credentials.d.ts

@@ -0,0 +1,22 @@
+import type { VariablesService } from '@pikku/core/services';
+import type { HttpPersonasConfig } from '@pikku/core/persona';
+/** A Fabric operator token, which is what a deployed stage accepts. */
+export declare const OPERATOR_TOKEN_VARIABLE = "FABRIC_OPERATOR_TOKEN";
+/** The actor plugin's passwordless secret, which only `pikku dev` serves. */
+export declare const ACTOR_SECRET_VARIABLE = "SCENARIO_ACTOR_SECRET";
+/** Opt in to creating persona accounts the target does not already have. */
+export declare const CREATE_MISSING_VARIABLE = "PIKKU_PERSONA_CREATE_MISSING";
+export type PersonaCredentials = Pick<HttpPersonasConfig, 'secret' | 'operator'>;
+/**
+ * How the personas in this run will sign in, decided by which credential the
+ * environment actually holds.
+ *
+ * An operator token wins when both are present. It is the stronger of the two —
+ * asymmetric, and it never needs an account the target would not otherwise
+ * have — so a run that could use either should not fall back to the weaker one.
+ *
+ * `what` names the thing that cannot proceed ('scenario actors', 'a virtual
+ * user'), because the same missing credential blocks several commands and the
+ * message should say which one the operator was running.
+ */
+export declare const resolvePersonaCredentials: (variables: VariablesService, what: string) => Promise<PersonaCredentials>;