@pikku/cli 0.12.124 → 0.12.126

package/dist/src/deploy/frontend-assets.js

@@ -0,0 +1,82 @@
+/**
+ * Embed a built frontend into a `bun build --compile` binary.
+ *
+ * Bun embeds a file imported with `with { type: 'file' }` and hands back an
+ * opaque `/$bunfs/…` path at runtime. That attribute cannot be applied to a
+ * dynamic import, and there is no way to embed a directory, so each file needs
+ * its own literal `import` statement — hence a generated module rather than a
+ * walk at startup.
+ *
+ * esbuild rejects the attribute outright ("Importing with a type attribute of
+ * \"file\" is not supported"), so this module is kept out of the esbuild bundle
+ * as an external and is resolved by the later `bun build --compile` step, which
+ * follows the import from the emitted `bundle.js`.
+ *
+ * The manifest can only name files that already exist, which fixes the build
+ * order: frontend build → manifest generation → server bundle → compile.
+ */
+import { cp, readdir, rm, writeFile } from 'node:fs/promises';
+import { join, relative } from 'node:path';
+export const FRONTEND_ASSET_MANIFEST_FILE = 'frontend-assets.gen.js';
+/** Directory name the built frontend is copied to inside a deploy unit. */
+export const FRONTEND_DIR_NAME = 'frontend';
+const toPosix = (value) => value.replace(/\\/g, '/');
+/**
+ * Every file under `dir`, keyed by its path relative to it.
+ *
+ * Sorted by key: directory read order is not stable across filesystems, and the
+ * manifest feeds a build whose output should not change run to run.
+ */
+export async function collectFrontendAssets(dir) {
+    const assets = [];
+    const walk = async (current) => {
+        const entries = await readdir(current, { withFileTypes: true });
+        for (const entry of entries) {
+            const absolute = join(current, entry.name);
+            if (entry.isDirectory()) {
+                await walk(absolute);
+            }
+            else if (entry.isFile()) {
+                assets.push({ key: toPosix(relative(dir, absolute)), path: absolute });
+            }
+        }
+    };
+    await walk(dir);
+    return assets.sort((a, b) => (a.key < b.key ? -1 : a.key > b.key ? 1 : 0));
+}
+/**
+ * The manifest module source, with specifiers relative to `manifestDir` — the
+ * directory the file itself is written to.
+ */
+export function generateFrontendAssetManifest(assets, manifestDir) {
+    const lines = ['// Generated by @pikku/cli — do not edit'];
+    assets.forEach((asset, index) => {
+        const specifier = toPosix(relative(manifestDir, asset.path));
+        lines.push(`import asset${index} from './${specifier}' with { type: 'file' }`);
+    });
+    lines.push('', 'export const frontendAssets = {');
+    assets.forEach((asset, index) => {
+        lines.push(`  '${asset.key}': asset${index},`);
+    });
+    lines.push('}', '');
+    return lines.join('\n');
+}
+/**
+ * Copy a built frontend into a deploy unit and write the manifest beside it.
+ *
+ * The copy comes first and the manifest is generated from the copy, not the
+ * source: the unit directory is what the bundle and the compile step see, and
+ * the machine that compiles has no reason to still hold the frontend's build
+ * tree. A stale copy is removed rather than merged into, so a file dropped
+ * from the frontend's output cannot survive into the next binary.
+ *
+ * Returns the keys that were embedded, in manifest order.
+ */
+export async function materializeFrontend(frontendDir, unitDir) {
+    const target = join(unitDir, FRONTEND_DIR_NAME);
+    await rm(target, { recursive: true, force: true });
+    await cp(frontendDir, target, { recursive: true });
+    const assets = await collectFrontendAssets(target);
+    await writeFile(join(unitDir, FRONTEND_ASSET_MANIFEST_FILE), generateFrontendAssetManifest(assets, unitDir), 'utf-8');
+    return assets.map((asset) => asset.key);
+}

package/dist/src/fabric/fabric-commands.d.ts

@@ -563,7 +563,7 @@ export declare const fabricCommands: {
         subcommands: {
             set: import("@pikku/core/cli").CoreCLICommandConfig<import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
                 name: string;
-                branch: string;
+                branch?: string | undefined;
                 value?: string | undefined;
                 force?: boolean | undefined;
             }, {
@@ -571,7 +571,7 @@ export declare const fabricCommands: {
                 keyId: string;
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
                 name: string;
-                branch: string;
+                branch?: string | undefined;
                 value?: string | undefined;
                 force?: boolean | undefined;
             }, {
@@ -579,7 +579,7 @@ export declare const fabricCommands: {
                 keyId: string;
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
                 name: string;
-                branch: string;
+                branch?: string | undefined;
                 value?: string | undefined;
                 force?: boolean | undefined;
             }, {
@@ -587,7 +587,7 @@ export declare const fabricCommands: {
                 keyId: string;
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>, import("../../.pikku/middleware/pikku-middleware-types.gen.js").PikkuMiddleware, (services: import("../../types/application-types.js").SingletonServices, data: any, session?: import("../../types/application-types.js").UserSession | undefined) => void | Promise<void>, string>;
             list: import("@pikku/core/cli").CoreCLICommandConfig<import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
-                branch: string;
+                branch?: string | undefined;
                 json?: boolean | undefined;
             }, {
                 secrets: {
@@ -595,7 +595,7 @@ export declare const fabricCommands: {
                     updatedAt: string;
                 }[];
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
-                branch: string;
+                branch?: string | undefined;
                 json?: boolean | undefined;
             }, {
                 secrets: {
@@ -603,7 +603,7 @@ export declare const fabricCommands: {
                     updatedAt: string;
                 }[];
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
-                branch: string;
+                branch?: string | undefined;
                 json?: boolean | undefined;
             }, {
                 secrets: {
@@ -612,17 +612,17 @@ export declare const fabricCommands: {
                 }[];
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>, import("../../.pikku/middleware/pikku-middleware-types.gen.js").PikkuMiddleware, (services: import("../../types/application-types.js").SingletonServices, data: any, session?: import("../../types/application-types.js").UserSession | undefined) => void | Promise<void>, string>;
             rotate: import("@pikku/core/cli").CoreCLICommandConfig<import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
-                branch: string;
+                branch?: string | undefined;
                 force?: boolean | undefined;
             }, {
                 retiredKeyId: string | null;
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
-                branch: string;
+                branch?: string | undefined;
                 force?: boolean | undefined;
             }, {
                 retiredKeyId: string | null;
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
-                branch: string;
+                branch?: string | undefined;
                 force?: boolean | undefined;
             }, {
                 retiredKeyId: string | null;
@@ -634,29 +634,29 @@ export declare const fabricCommands: {
         subcommands: {
             set: import("@pikku/core/cli").CoreCLICommandConfig<import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
                 name: string;
-                branch: string;
                 value: string;
+                branch?: string | undefined;
             }, {
                 name: string;
                 success: boolean;
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
                 name: string;
-                branch: string;
                 value: string;
+                branch?: string | undefined;
             }, {
                 name: string;
                 success: boolean;
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
                 name: string;
-                branch: string;
                 value: string;
+                branch?: string | undefined;
             }, {
                 name: string;
                 success: boolean;
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>, import("../../.pikku/middleware/pikku-middleware-types.gen.js").PikkuMiddleware, (services: import("../../types/application-types.js").SingletonServices, data: any, session?: import("../../types/application-types.js").UserSession | undefined) => void | Promise<void>, string>;
             get: import("@pikku/core/cli").CoreCLICommandConfig<import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
                 name: string;
-                branch: string;
+                branch?: string | undefined;
                 json?: boolean | undefined;
             }, {
                 name: string;
@@ -664,7 +664,7 @@ export declare const fabricCommands: {
                 value: unknown;
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
                 name: string;
-                branch: string;
+                branch?: string | undefined;
                 json?: boolean | undefined;
             }, {
                 name: string;
@@ -672,7 +672,7 @@ export declare const fabricCommands: {
                 value: unknown;
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
                 name: string;
-                branch: string;
+                branch?: string | undefined;
                 json?: boolean | undefined;
             }, {
                 name: string;
@@ -760,6 +760,46 @@ export declare const fabricCommands: {
         projectId: string;
         status: any;
     }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>, import("../../.pikku/middleware/pikku-middleware-types.gen.js").PikkuMiddleware, (services: import("../../types/application-types.js").SingletonServices, data: any, session?: import("../../types/application-types.js").UserSession | undefined) => void | Promise<void>, string>;
+    projects: import("@pikku/core/cli").CoreCLICommandConfig<import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
+        apiUrl?: string | undefined;
+    }, {
+        projects: {
+            projectId: string;
+            name: string;
+            slug: string;
+            status: string;
+            productionBranch: string;
+            gitRepoUrl: string | null;
+            createdAt: string;
+            linked: boolean;
+        }[];
+    }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
+        apiUrl?: string | undefined;
+    }, {
+        projects: {
+            projectId: string;
+            name: string;
+            slug: string;
+            status: string;
+            productionBranch: string;
+            gitRepoUrl: string | null;
+            createdAt: string;
+            linked: boolean;
+        }[];
+    }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
+        apiUrl?: string | undefined;
+    }, {
+        projects: {
+            projectId: string;
+            name: string;
+            slug: string;
+            status: string;
+            productionBranch: string;
+            gitRepoUrl: string | null;
+            createdAt: string;
+            linked: boolean;
+        }[];
+    }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>, import("../../.pikku/middleware/pikku-middleware-types.gen.js").PikkuMiddleware, (services: import("../../types/application-types.js").SingletonServices, data: any, session?: import("../../types/application-types.js").UserSession | undefined) => void | Promise<void>, string>;
     errors: import("@pikku/core/cli").CoreCLICommandConfig<import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
         branch: string;
         function?: string | undefined;

package/dist/src/fabric/fabric-commands.js

@@ -26,6 +26,7 @@ import { FabricDeployApply, renderDeployApply, } from './functions/deploy.functi
 import { FabricDeployList, renderDeployList, } from './functions/deploy-list.function.js';
 import { FabricDeployUnits, renderDeployUnits, } from './functions/deploy-units.function.js';
 import { FabricStatus, renderStatus } from './functions/status.function.js';
+import { FabricProjectsList, renderProjectsList, } from './functions/projects-list.function.js';
 import { FabricErrors, renderErrors } from './functions/errors.function.js';
 import { FabricDbSchema, renderDbSchema, } from './functions/db-schema.function.js';
 import { FabricRollback } from './functions/rollback.function.js';
@@ -325,6 +326,11 @@ export const fabricCommands = defineCLICommands({
         render: renderStatus,
         description: 'Show the linked project status (active + in-flight deploy)',
     }),
+    projects: pikkuCLICommand({
+        func: FabricProjectsList,
+        render: renderProjectsList,
+        description: 'List the projects in your organization, with their ids (works unlinked)',
+    }),
     errors: pikkuCLICommand({
         func: FabricErrors,
         render: renderErrors,

package/dist/src/fabric/functions/deploy.function.js

@@ -5,7 +5,7 @@ import { getFabricRPC } from '../lib/http.js';
 import { assertNamedBranchDeploySafety, resolveRef } from '../lib/git.js';
 import { promptConfirm } from '../lib/prompt.js';
 import { added, changed, removed, dim, table } from '../lib/output.js';
-import { blockedReason, blockedSummary, missingConfigHints, changesAreEmpty, classifyStatus, describeDeployment, destructiveMigrations, isApprovable, readDeploymentStatus, readWorkers, stateLabel, waitForDeployment, } from '../lib/deployment.js';
+import { blockedReason, blockedSummary, missingConfigHints, changesAreEmpty, classifyStatus, describeDeployment, destructiveMigrations, isApprovable, readDeploymentStatus, readWorkers, reconcileDeployedRef, stateLabel, waitForDeployment, } from '../lib/deployment.js';
 const DEFAULT_TIMEOUT_SECONDS = 900;
 export const FabricDeployInput = z.object({
     branch: z.string().optional(),
@@ -181,7 +181,17 @@ export const FabricDeployApply = pikkuSessionlessFunc({
             deploymentId = created.deploymentId;
             stageId = created.stageId;
             runId = created.runId;
-            emit({ event: 'created', deploymentId, branch, ref: resolved });
+            // Read the commit back off the deployment rather than repeating the one
+            // that was asked for: `deployByStageKind` attaches to an already-parked
+            // plan for the branch instead of cutting a new one, and that plan is
+            // pinned to whatever commit it was created at.
+            ref = reconcileDeployedRef({
+                requested: resolved,
+                actual: (await describeDeployment(rpc, projectId, deploymentId))?.gitSha ??
+                    null,
+                deploymentId,
+            });
+            emit({ event: 'created', deploymentId, branch, ref });
         }
         const base = {
             event: 'result',

package/dist/src/fabric/functions/projects-list.function.d.ts

@@ -0,0 +1,72 @@
+import { z } from 'zod';
+export declare const FabricProjectsListInput: z.ZodObject<{
+    apiUrl: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const FabricProjectsListOutput: z.ZodObject<{
+    projects: z.ZodArray<z.ZodObject<{
+        projectId: z.ZodString;
+        name: z.ZodString;
+        slug: z.ZodString;
+        status: z.ZodString;
+        productionBranch: z.ZodString;
+        gitRepoUrl: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
+        linked: z.ZodBoolean;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/**
+ * The only fabric command that does not need a linked project, which is the
+ * point of it: a checkout whose config still holds `__PROJECT_ID__` can run
+ * nothing else, and `fabric init` cannot recover the id either — it creates,
+ * so against an existing project it fails with a 409 that carries no id.
+ */
+export declare const FabricProjectsList: import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
+    apiUrl?: string | undefined;
+}, {
+    projects: {
+        projectId: string;
+        name: string;
+        slug: string;
+        status: string;
+        productionBranch: string;
+        gitRepoUrl: string | null;
+        createdAt: string;
+        linked: boolean;
+    }[];
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
+    apiUrl?: string | undefined;
+}, {
+    projects: {
+        projectId: string;
+        name: string;
+        slug: string;
+        status: string;
+        productionBranch: string;
+        gitRepoUrl: string | null;
+        createdAt: string;
+        linked: boolean;
+    }[];
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
+    apiUrl?: string | undefined;
+}, {
+    projects: {
+        projectId: string;
+        name: string;
+        slug: string;
+        status: string;
+        productionBranch: string;
+        gitRepoUrl: string | null;
+        createdAt: string;
+        linked: boolean;
+    }[];
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>;
+type FabricProject = {
+    projectId: string;
+    name: string;
+    gitRepoUrl: string | null;
+    linked: boolean;
+};
+export declare const renderProjectsList: (_s: unknown, { projects }: {
+    projects: FabricProject[];
+}) => void;
+export {};

package/dist/src/fabric/functions/projects-list.function.js

@@ -0,0 +1,63 @@
+import { z } from 'zod';
+import { pikkuSessionlessFunc } from '../../../.pikku/function/index.js';
+import { findProjectConfig, resolveApiContext } from '../lib/config.js';
+import { getFabricRPC } from '../lib/http.js';
+import { dim } from '../lib/output.js';
+export const FabricProjectsListInput = z.object({
+    apiUrl: z.string().optional(),
+});
+export const FabricProjectsListOutput = z.object({
+    projects: z.array(z.object({
+        projectId: z.string(),
+        name: z.string(),
+        slug: z.string(),
+        status: z.string(),
+        productionBranch: z.string(),
+        gitRepoUrl: z.string().nullable(),
+        createdAt: z.string(),
+        linked: z.boolean(),
+    })),
+});
+/**
+ * The only fabric command that does not need a linked project, which is the
+ * point of it: a checkout whose config still holds `__PROJECT_ID__` can run
+ * nothing else, and `fabric init` cannot recover the id either — it creates,
+ * so against an existing project it fails with a 409 that carries no id.
+ */
+export const FabricProjectsList = pikkuSessionlessFunc({
+    description: 'List the projects in your organization.',
+    input: FabricProjectsListInput,
+    output: FabricProjectsListOutput,
+    func: async (_services, { apiUrl: apiUrlOverride }) => {
+        const ctx = await resolveApiContext({ apiUrlOverride });
+        if (!ctx.token)
+            throw new Error('Not logged in. Run `pikku fabric login` first.');
+        const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
+        const { projects } = await rpc.invoke('fabricCliProjects', {});
+        const local = await findProjectConfig();
+        const linkedId = local?.config.projectId;
+        return {
+            projects: projects.map((project) => ({
+                ...project,
+                linked: linkedId !== undefined && project.projectId === linkedId,
+            })),
+        };
+    },
+});
+export const renderProjectsList = (_s, { projects }) => {
+    console.log('');
+    if (projects.length === 0) {
+        console.log(dim('  No projects yet. Run `pikku fabric link` to create one.'));
+        console.log('');
+        return;
+    }
+    const width = Math.max(...projects.map((p) => p.name.length));
+    for (const project of projects) {
+        console.log(`  ${project.linked ? '*' : ' '} ${project.name.padEnd(width)}  ${project.projectId}  ${dim(project.gitRepoUrl ?? 'no repo')}`);
+    }
+    console.log('');
+    if (projects.some((p) => p.linked)) {
+        console.log(dim('  * this checkout'));
+        console.log('');
+    }
+};

package/dist/src/fabric/functions/secrets-list.function.d.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 export declare const FabricSecretsListInput: z.ZodObject<{
-    branch: z.ZodString;
+    branch: z.ZodOptional<z.ZodString>;
     json: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 export declare const FabricSecretsListOutput: z.ZodObject<{
@@ -10,7 +10,7 @@ export declare const FabricSecretsListOutput: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export declare const FabricSecretsList: import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
-    branch: string;
+    branch?: string | undefined;
     json?: boolean | undefined;
 }, {
     secrets: {
@@ -18,7 +18,7 @@ export declare const FabricSecretsList: import("../../../.pikku/function/pikku-f
         updatedAt: string;
     }[];
 }, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
-    branch: string;
+    branch?: string | undefined;
     json?: boolean | undefined;
 }, {
     secrets: {
@@ -26,7 +26,7 @@ export declare const FabricSecretsList: import("../../../.pikku/function/pikku-f
         updatedAt: string;
     }[];
 }, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
-    branch: string;
+    branch?: string | undefined;
     json?: boolean | undefined;
 }, {
     secrets: {

package/dist/src/fabric/functions/secrets-list.function.js

@@ -2,9 +2,9 @@ import { z } from 'zod';
 import { pikkuSessionlessFunc } from '../../../.pikku/function/index.js';
 import { resolveApiContext } from '../lib/config.js';
 import { getFabricRPC } from '../lib/http.js';
-import { resolveStageId } from '../lib/stage.js';
+import { resolveStage } from '../lib/stage.js';
 export const FabricSecretsListInput = z.object({
-    branch: z.string(),
+    branch: z.string().optional(),
     json: z.boolean().optional(),
 });
 export const FabricSecretsListOutput = z.object({
@@ -14,14 +14,14 @@ export const FabricSecretsList = pikkuSessionlessFunc({
     description: 'List the secrets set on a stage, by name. Values are sealed to the stage and never leave it.',
     input: FabricSecretsListInput,
     output: FabricSecretsListOutput,
-    func: async (_services, { branch, json }) => {
+    func: async (_services, { branch: requested, json }) => {
         const ctx = await resolveApiContext();
         if (!ctx.token)
             throw new Error('Not logged in. Run `pikku fabric login` first.');
         if (!ctx.projectId)
             throw new Error('No fabric project linked. Run `pikku fabric link` first.');
         const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
-        const stageId = await resolveStageId(rpc, ctx.projectId, branch);
+        const { stageId, branch } = await resolveStage(rpc, ctx.projectId, requested);
         const result = await rpc.invoke('listStageSecretNames', { stageId });
         if (json) {
             console.log(JSON.stringify({ branch, secrets: result.secrets }, null, 2));

package/dist/src/fabric/functions/secrets-rotate.function.d.ts

@@ -1,23 +1,23 @@
 import { z } from 'zod';
 export declare const FabricSecretsRotateInput: z.ZodObject<{
-    branch: z.ZodString;
+    branch: z.ZodOptional<z.ZodString>;
     force: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 export declare const FabricSecretsRotateOutput: z.ZodObject<{
     retiredKeyId: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
 export declare const FabricSecretsRotate: import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
-    branch: string;
+    branch?: string | undefined;
     force?: boolean | undefined;
 }, {
     retiredKeyId: string | null;
 }, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
-    branch: string;
+    branch?: string | undefined;
     force?: boolean | undefined;
 }, {
     retiredKeyId: string | null;
 }, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
-    branch: string;
+    branch?: string | undefined;
     force?: boolean | undefined;
 }, {
     retiredKeyId: string | null;

package/dist/src/fabric/functions/secrets-rotate.function.js

@@ -2,9 +2,9 @@ import { z } from 'zod';
 import { pikkuSessionlessFunc } from '../../../.pikku/function/index.js';
 import { resolveApiContext } from '../lib/config.js';
 import { getFabricRPC } from '../lib/http.js';
-import { resolveStageId } from '../lib/stage.js';
+import { resolveStage } from '../lib/stage.js';
 export const FabricSecretsRotateInput = z.object({
-    branch: z.string(),
+    branch: z.string().optional(),
     force: z.boolean().optional(),
 });
 export const FabricSecretsRotateOutput = z.object({
@@ -14,20 +14,23 @@ export const FabricSecretsRotate = pikkuSessionlessFunc({
     description: "Retire a stage's sealing key so the next deploy issues a new one. Secrets sealed to the old key must be set again.",
     input: FabricSecretsRotateInput,
     output: FabricSecretsRotateOutput,
-    func: async (_services, { branch, force }) => {
+    func: async (_services, { branch: requested, force }) => {
         const ctx = await resolveApiContext();
         if (!ctx.token)
             throw new Error('Not logged in. Run `pikku fabric login` first.');
         if (!ctx.projectId)
             throw new Error('No fabric project linked. Run `pikku fabric link` first.');
+        // Resolved before the refusal, so the one message standing between a
+        // typo and unreadable secrets names the stage that would actually be
+        // rotated rather than echoing an argument that may not have been passed.
+        const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
+        const { stageId, branch } = await resolveStage(rpc, ctx.projectId, requested);
         if (!force) {
             // Not a confirmation for politeness — this is the one operation here
             // that destroys access to data. Fabric cannot read the sealed values, so
             // it cannot carry them over, and nobody can undo it afterwards.
             throw new Error(`Rotating the sealing key on ${branch} makes every secret already set on it unreadable — fabric cannot re-seal values it cannot open, so each one must be set again after the next deploy. Re-run with --force if that is what you want.`);
         }
-        const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
-        const stageId = await resolveStageId(rpc, ctx.projectId, branch);
         const result = await rpc.invoke('rotateStageSealingKey', { stageId });
         console.log(`[fabric] retired sealing key ${result.retiredKeyId} on ${branch}`);
         console.log('[fabric] deploy the stage to issue a new key, then set its secrets again');

package/dist/src/fabric/functions/secrets-set.function.d.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 export declare const FabricSecretsSetInput: z.ZodObject<{
     name: z.ZodString;
-    branch: z.ZodString;
+    branch: z.ZodOptional<z.ZodString>;
     value: z.ZodOptional<z.ZodString>;
     force: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
@@ -11,7 +11,7 @@ export declare const FabricSecretsSetOutput: z.ZodObject<{
 }, z.core.$strip>;
 export declare const FabricSecretsSet: import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
     name: string;
-    branch: string;
+    branch?: string | undefined;
     value?: string | undefined;
     force?: boolean | undefined;
 }, {
@@ -19,7 +19,7 @@ export declare const FabricSecretsSet: import("../../../.pikku/function/pikku-fu
     keyId: string;
 }, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
     name: string;
-    branch: string;
+    branch?: string | undefined;
     value?: string | undefined;
     force?: boolean | undefined;
 }, {
@@ -27,7 +27,7 @@ export declare const FabricSecretsSet: import("../../../.pikku/function/pikku-fu
     keyId: string;
 }, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
     name: string;
-    branch: string;
+    branch?: string | undefined;
     value?: string | undefined;
     force?: boolean | undefined;
 }, {

package/dist/src/fabric/functions/secrets-set.function.js

@@ -3,11 +3,11 @@ import { pikkuSessionlessFunc } from '../../../.pikku/function/index.js';
 import { resolveApiContext } from '../lib/config.js';
 import { getFabricRPC } from '../lib/http.js';
 import { promptSecret } from '../lib/prompt.js';
-import { resolveStageId } from '../lib/stage.js';
+import { resolveStage } from '../lib/stage.js';
 import { seal, serializeSealedValue } from '../lib/sealed-box.js';
 export const FabricSecretsSetInput = z.object({
     name: z.string(),
-    branch: z.string(),
+    branch: z.string().optional(),
     value: z.string().optional(),
     force: z.boolean().optional(),
 });
@@ -19,7 +19,7 @@ export const FabricSecretsSet = pikkuSessionlessFunc({
     description: 'Set a stage-scoped secret. Sealed here to the stage public key — the plaintext never leaves this machine.',
     input: FabricSecretsSetInput,
     output: FabricSecretsSetOutput,
-    func: async (_services, { name, branch, value }) => {
+    func: async (_services, { name, branch: requested, value }) => {
         const ctx = await resolveApiContext();
         if (!ctx.token)
             throw new Error('Not logged in. Run `pikku fabric login` first.');
@@ -29,7 +29,7 @@ export const FabricSecretsSet = pikkuSessionlessFunc({
         if (!plaintext)
             throw new Error('Empty secret value — aborting.');
         const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
-        const stageId = await resolveStageId(rpc, ctx.projectId, branch);
+        const { stageId, branch } = await resolveStage(rpc, ctx.projectId, requested);
         // Fabric holds only the public half of this keypair. The private half went
         // to the stage's worker at deploy time and was dropped there, so the value
         // sealed below can be opened by that worker and by nothing else — including