@pikku/cli 0.12.125 → 0.12.126

package/dist/.pikku/variables/pikku-variable-types.gen.d.ts

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.125
+ * This file was generated by @pikku/cli@0.12.126
  */
 export { defineVariable } from '@pikku/core/variable';

package/dist/.pikku/variables/pikku-variable-types.gen.js

@@ -1,4 +1,4 @@
 /**
- * This file was generated by @pikku/cli@0.12.125
+ * This file was generated by @pikku/cli@0.12.126
  */
 export { defineVariable } from '@pikku/core/variable';

package/dist/.pikku/variables/pikku-variables.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.125
+ * This file was generated by @pikku/cli@0.12.126
  */
 import { TypedVariablesService as CoreTypedVariablesService } from '@pikku/core/services';
 import type { VariablesService } from '@pikku/core/services';

package/dist/.pikku/variables/pikku-variables.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.125
+ * This file was generated by @pikku/cli@0.12.126
  */
 import { TypedVariablesService as CoreTypedVariablesService, } from '@pikku/core/services';
 /**

package/dist/.pikku/workflow/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.125
+ * This file was generated by @pikku/cli@0.12.126
  */
 /**
  * Subpath entry — `#pikku/workflow` resolves here.

package/dist/.pikku/workflow/index.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.125
+ * This file was generated by @pikku/cli@0.12.126
  */
 /**
  * Subpath entry — `#pikku/workflow` resolves here.

package/dist/.pikku/workflow/pikku-workflow-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.125
+ * This file was generated by @pikku/cli@0.12.126
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import type { PikkuWorkflowGraphConfig, PikkuWorkflowGraphResult } from '@pikku/core/workflow';

package/dist/.pikku/workflow/pikku-workflow-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.125
+ * This file was generated by @pikku/cli@0.12.126
  */
 import { WorkflowCancelledException } from '@pikku/core/workflow';
 import { pikkuWorkflowGraph as corePikkuWorkflowGraph } from '@pikku/core/workflow';

package/dist/.pikku/workflow/pikku-workflow-wirings-meta.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.125
+ * This file was generated by @pikku/cli@0.12.126
  */
 import { pikkuState } from '@pikku/core/state';
 import allWorkflowMeta from './meta/allWorkflow.gen.json' with { type: 'json' };

package/dist/.pikku/workflow/pikku-workflow-wirings.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.125
+ * This file was generated by @pikku/cli@0.12.126
  */
 import { addWorkflow } from '@pikku/core/workflow';
 import './pikku-workflow-wirings-meta.gen.js';

package/dist/bin/pikku-bin.mjs

@@ -11,8 +11,8 @@ async function checkForUpdate() {
     })
     if (!res.ok) return
     const { version: latest } = await res.json()
-    if (latest !== '0.12.125') {
-      process.stderr.write(`\n  Update available  0.12.125 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
+    if (latest !== '0.12.126') {
+      process.stderr.write(`\n  Update available  0.12.126 → ${latest}\n  brew upgrade pikku  or  npm install -g @pikku/cli\n\n`)
     }
   } catch {}
 }

package/dist/src/cli.wiring.js

@@ -35,7 +35,7 @@ import { validate, renderValidate } from './functions/commands/validate.js';
 import { knowledgeValidate, renderKnowledgeValidate, } from './functions/commands/knowledge-validate.js';
 import { knowledgeIndex, renderKnowledgeIndex, } from './functions/commands/knowledge-index.js';
 import { scenarioRun, scenarioList } from './functions/commands/scenario.js';
-import { personaList, personaRun } from './functions/commands/persona.js';
+import { personaList, personaRun, personaSecret, } from './functions/commands/persona.js';
 import { personaSync } from './functions/commands/persona-sync.js';
 import { pikkuVersionsInit } from './functions/commands/versions-init.js';
 import { pikkuEmailsInit } from './functions/commands/emails-init.js';
@@ -642,6 +642,11 @@ wireCLI({
                     func: personaList,
                     description: 'List the declared personas — who each one is, what they may do, and what they are trying to get done',
                 }),
+                secret: pikkuCLICommand({
+                    func: personaSecret,
+                    description: 'Mint the actor credential for a persona from SCENARIO_ACTOR_SECRET, bound to their address. Hand these to a run as PIKKU_PERSONA_SECRETS instead of the root, which is entitled to every persona. Names none, mints all.',
+                    parameters: '[personas...]',
+                }),
             },
         },
         fabric: {

package/dist/src/deploy/bundler/bun-bundler.js

@@ -96,11 +96,18 @@ export class BunBundler extends BaseBundler {
             entrypoints: [input.entryPath],
             target: input.platform === 'node' ? 'node' : 'browser',
             format: input.format === 'cjs' ? 'cjs' : 'esm',
-            // identifiers:true is safe — pikku's only name-based reflection
-            // (error→status mapping) compares a class against an instance of the SAME
-            // (consistently-renamed) class, and workflow exceptions hardcode their
-            // `.name` string. So full minification preserves correctness.
-            minify: { whitespace: true, syntax: true, identifiers: true },
+            // keepNames matches the esbuild bundler, which has always set it. The
+            // error→status mapping survives renaming either way — it compares a
+            // class against an instance of the SAME consistently-renamed class —
+            // but `Function.name` reaches further than that: it is the name every
+            // error answers with on the wire, the one an unregistered error is
+            // matched by, and what appears in a stack trace someone has to read.
+            minify: {
+                whitespace: true,
+                syntax: true,
+                identifiers: true,
+                keepNames: true,
+            },
             sourcemap: input.sourcemap ? 'external' : 'none',
             define: input.define,
             banner: input.bannerJs,

package/dist/src/fabric/fabric-commands.d.ts

@@ -563,7 +563,7 @@ export declare const fabricCommands: {
         subcommands: {
             set: import("@pikku/core/cli").CoreCLICommandConfig<import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
                 name: string;
-                branch: string;
+                branch?: string | undefined;
                 value?: string | undefined;
                 force?: boolean | undefined;
             }, {
@@ -571,7 +571,7 @@ export declare const fabricCommands: {
                 keyId: string;
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
                 name: string;
-                branch: string;
+                branch?: string | undefined;
                 value?: string | undefined;
                 force?: boolean | undefined;
             }, {
@@ -579,7 +579,7 @@ export declare const fabricCommands: {
                 keyId: string;
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
                 name: string;
-                branch: string;
+                branch?: string | undefined;
                 value?: string | undefined;
                 force?: boolean | undefined;
             }, {
@@ -587,7 +587,7 @@ export declare const fabricCommands: {
                 keyId: string;
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>, import("../../.pikku/middleware/pikku-middleware-types.gen.js").PikkuMiddleware, (services: import("../../types/application-types.js").SingletonServices, data: any, session?: import("../../types/application-types.js").UserSession | undefined) => void | Promise<void>, string>;
             list: import("@pikku/core/cli").CoreCLICommandConfig<import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
-                branch: string;
+                branch?: string | undefined;
                 json?: boolean | undefined;
             }, {
                 secrets: {
@@ -595,7 +595,7 @@ export declare const fabricCommands: {
                     updatedAt: string;
                 }[];
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
-                branch: string;
+                branch?: string | undefined;
                 json?: boolean | undefined;
             }, {
                 secrets: {
@@ -603,7 +603,7 @@ export declare const fabricCommands: {
                     updatedAt: string;
                 }[];
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
-                branch: string;
+                branch?: string | undefined;
                 json?: boolean | undefined;
             }, {
                 secrets: {
@@ -612,17 +612,17 @@ export declare const fabricCommands: {
                 }[];
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>, import("../../.pikku/middleware/pikku-middleware-types.gen.js").PikkuMiddleware, (services: import("../../types/application-types.js").SingletonServices, data: any, session?: import("../../types/application-types.js").UserSession | undefined) => void | Promise<void>, string>;
             rotate: import("@pikku/core/cli").CoreCLICommandConfig<import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
-                branch: string;
+                branch?: string | undefined;
                 force?: boolean | undefined;
             }, {
                 retiredKeyId: string | null;
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
-                branch: string;
+                branch?: string | undefined;
                 force?: boolean | undefined;
             }, {
                 retiredKeyId: string | null;
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
-                branch: string;
+                branch?: string | undefined;
                 force?: boolean | undefined;
             }, {
                 retiredKeyId: string | null;
@@ -634,29 +634,29 @@ export declare const fabricCommands: {
         subcommands: {
             set: import("@pikku/core/cli").CoreCLICommandConfig<import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
                 name: string;
-                branch: string;
                 value: string;
+                branch?: string | undefined;
             }, {
                 name: string;
                 success: boolean;
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
                 name: string;
-                branch: string;
                 value: string;
+                branch?: string | undefined;
             }, {
                 name: string;
                 success: boolean;
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
                 name: string;
-                branch: string;
                 value: string;
+                branch?: string | undefined;
             }, {
                 name: string;
                 success: boolean;
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>, import("../../.pikku/middleware/pikku-middleware-types.gen.js").PikkuMiddleware, (services: import("../../types/application-types.js").SingletonServices, data: any, session?: import("../../types/application-types.js").UserSession | undefined) => void | Promise<void>, string>;
             get: import("@pikku/core/cli").CoreCLICommandConfig<import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
                 name: string;
-                branch: string;
+                branch?: string | undefined;
                 json?: boolean | undefined;
             }, {
                 name: string;
@@ -664,7 +664,7 @@ export declare const fabricCommands: {
                 value: unknown;
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
                 name: string;
-                branch: string;
+                branch?: string | undefined;
                 json?: boolean | undefined;
             }, {
                 name: string;
@@ -672,7 +672,7 @@ export declare const fabricCommands: {
                 value: unknown;
             }, "rpc" | "session", import("../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
                 name: string;
-                branch: string;
+                branch?: string | undefined;
                 json?: boolean | undefined;
             }, {
                 name: string;

package/dist/src/fabric/functions/deploy.function.js

@@ -5,7 +5,7 @@ import { getFabricRPC } from '../lib/http.js';
 import { assertNamedBranchDeploySafety, resolveRef } from '../lib/git.js';
 import { promptConfirm } from '../lib/prompt.js';
 import { added, changed, removed, dim, table } from '../lib/output.js';
-import { blockedReason, blockedSummary, missingConfigHints, changesAreEmpty, classifyStatus, describeDeployment, destructiveMigrations, isApprovable, readDeploymentStatus, readWorkers, stateLabel, waitForDeployment, } from '../lib/deployment.js';
+import { blockedReason, blockedSummary, missingConfigHints, changesAreEmpty, classifyStatus, describeDeployment, destructiveMigrations, isApprovable, readDeploymentStatus, readWorkers, reconcileDeployedRef, stateLabel, waitForDeployment, } from '../lib/deployment.js';
 const DEFAULT_TIMEOUT_SECONDS = 900;
 export const FabricDeployInput = z.object({
     branch: z.string().optional(),
@@ -181,7 +181,17 @@ export const FabricDeployApply = pikkuSessionlessFunc({
             deploymentId = created.deploymentId;
             stageId = created.stageId;
             runId = created.runId;
-            emit({ event: 'created', deploymentId, branch, ref: resolved });
+            // Read the commit back off the deployment rather than repeating the one
+            // that was asked for: `deployByStageKind` attaches to an already-parked
+            // plan for the branch instead of cutting a new one, and that plan is
+            // pinned to whatever commit it was created at.
+            ref = reconcileDeployedRef({
+                requested: resolved,
+                actual: (await describeDeployment(rpc, projectId, deploymentId))?.gitSha ??
+                    null,
+                deploymentId,
+            });
+            emit({ event: 'created', deploymentId, branch, ref });
         }
         const base = {
             event: 'result',

package/dist/src/fabric/functions/secrets-list.function.d.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 export declare const FabricSecretsListInput: z.ZodObject<{
-    branch: z.ZodString;
+    branch: z.ZodOptional<z.ZodString>;
     json: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 export declare const FabricSecretsListOutput: z.ZodObject<{
@@ -10,7 +10,7 @@ export declare const FabricSecretsListOutput: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export declare const FabricSecretsList: import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
-    branch: string;
+    branch?: string | undefined;
     json?: boolean | undefined;
 }, {
     secrets: {
@@ -18,7 +18,7 @@ export declare const FabricSecretsList: import("../../../.pikku/function/pikku-f
         updatedAt: string;
     }[];
 }, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
-    branch: string;
+    branch?: string | undefined;
     json?: boolean | undefined;
 }, {
     secrets: {
@@ -26,7 +26,7 @@ export declare const FabricSecretsList: import("../../../.pikku/function/pikku-f
         updatedAt: string;
     }[];
 }, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
-    branch: string;
+    branch?: string | undefined;
     json?: boolean | undefined;
 }, {
     secrets: {

package/dist/src/fabric/functions/secrets-list.function.js

@@ -2,9 +2,9 @@ import { z } from 'zod';
 import { pikkuSessionlessFunc } from '../../../.pikku/function/index.js';
 import { resolveApiContext } from '../lib/config.js';
 import { getFabricRPC } from '../lib/http.js';
-import { resolveStageId } from '../lib/stage.js';
+import { resolveStage } from '../lib/stage.js';
 export const FabricSecretsListInput = z.object({
-    branch: z.string(),
+    branch: z.string().optional(),
     json: z.boolean().optional(),
 });
 export const FabricSecretsListOutput = z.object({
@@ -14,14 +14,14 @@ export const FabricSecretsList = pikkuSessionlessFunc({
     description: 'List the secrets set on a stage, by name. Values are sealed to the stage and never leave it.',
     input: FabricSecretsListInput,
     output: FabricSecretsListOutput,
-    func: async (_services, { branch, json }) => {
+    func: async (_services, { branch: requested, json }) => {
         const ctx = await resolveApiContext();
         if (!ctx.token)
             throw new Error('Not logged in. Run `pikku fabric login` first.');
         if (!ctx.projectId)
             throw new Error('No fabric project linked. Run `pikku fabric link` first.');
         const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
-        const stageId = await resolveStageId(rpc, ctx.projectId, branch);
+        const { stageId, branch } = await resolveStage(rpc, ctx.projectId, requested);
         const result = await rpc.invoke('listStageSecretNames', { stageId });
         if (json) {
             console.log(JSON.stringify({ branch, secrets: result.secrets }, null, 2));

package/dist/src/fabric/functions/secrets-rotate.function.d.ts

@@ -1,23 +1,23 @@
 import { z } from 'zod';
 export declare const FabricSecretsRotateInput: z.ZodObject<{
-    branch: z.ZodString;
+    branch: z.ZodOptional<z.ZodString>;
     force: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 export declare const FabricSecretsRotateOutput: z.ZodObject<{
     retiredKeyId: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
 export declare const FabricSecretsRotate: import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
-    branch: string;
+    branch?: string | undefined;
     force?: boolean | undefined;
 }, {
     retiredKeyId: string | null;
 }, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
-    branch: string;
+    branch?: string | undefined;
     force?: boolean | undefined;
 }, {
     retiredKeyId: string | null;
 }, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
-    branch: string;
+    branch?: string | undefined;
     force?: boolean | undefined;
 }, {
     retiredKeyId: string | null;

package/dist/src/fabric/functions/secrets-rotate.function.js

@@ -2,9 +2,9 @@ import { z } from 'zod';
 import { pikkuSessionlessFunc } from '../../../.pikku/function/index.js';
 import { resolveApiContext } from '../lib/config.js';
 import { getFabricRPC } from '../lib/http.js';
-import { resolveStageId } from '../lib/stage.js';
+import { resolveStage } from '../lib/stage.js';
 export const FabricSecretsRotateInput = z.object({
-    branch: z.string(),
+    branch: z.string().optional(),
     force: z.boolean().optional(),
 });
 export const FabricSecretsRotateOutput = z.object({
@@ -14,20 +14,23 @@ export const FabricSecretsRotate = pikkuSessionlessFunc({
     description: "Retire a stage's sealing key so the next deploy issues a new one. Secrets sealed to the old key must be set again.",
     input: FabricSecretsRotateInput,
     output: FabricSecretsRotateOutput,
-    func: async (_services, { branch, force }) => {
+    func: async (_services, { branch: requested, force }) => {
         const ctx = await resolveApiContext();
         if (!ctx.token)
             throw new Error('Not logged in. Run `pikku fabric login` first.');
         if (!ctx.projectId)
             throw new Error('No fabric project linked. Run `pikku fabric link` first.');
+        // Resolved before the refusal, so the one message standing between a
+        // typo and unreadable secrets names the stage that would actually be
+        // rotated rather than echoing an argument that may not have been passed.
+        const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
+        const { stageId, branch } = await resolveStage(rpc, ctx.projectId, requested);
         if (!force) {
             // Not a confirmation for politeness — this is the one operation here
             // that destroys access to data. Fabric cannot read the sealed values, so
             // it cannot carry them over, and nobody can undo it afterwards.
             throw new Error(`Rotating the sealing key on ${branch} makes every secret already set on it unreadable — fabric cannot re-seal values it cannot open, so each one must be set again after the next deploy. Re-run with --force if that is what you want.`);
         }
-        const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
-        const stageId = await resolveStageId(rpc, ctx.projectId, branch);
         const result = await rpc.invoke('rotateStageSealingKey', { stageId });
         console.log(`[fabric] retired sealing key ${result.retiredKeyId} on ${branch}`);
         console.log('[fabric] deploy the stage to issue a new key, then set its secrets again');

package/dist/src/fabric/functions/secrets-set.function.d.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 export declare const FabricSecretsSetInput: z.ZodObject<{
     name: z.ZodString;
-    branch: z.ZodString;
+    branch: z.ZodOptional<z.ZodString>;
     value: z.ZodOptional<z.ZodString>;
     force: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
@@ -11,7 +11,7 @@ export declare const FabricSecretsSetOutput: z.ZodObject<{
 }, z.core.$strip>;
 export declare const FabricSecretsSet: import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
     name: string;
-    branch: string;
+    branch?: string | undefined;
     value?: string | undefined;
     force?: boolean | undefined;
 }, {
@@ -19,7 +19,7 @@ export declare const FabricSecretsSet: import("../../../.pikku/function/pikku-fu
     keyId: string;
 }, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
     name: string;
-    branch: string;
+    branch?: string | undefined;
     value?: string | undefined;
     force?: boolean | undefined;
 }, {
@@ -27,7 +27,7 @@ export declare const FabricSecretsSet: import("../../../.pikku/function/pikku-fu
     keyId: string;
 }, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
     name: string;
-    branch: string;
+    branch?: string | undefined;
     value?: string | undefined;
     force?: boolean | undefined;
 }, {

package/dist/src/fabric/functions/secrets-set.function.js

@@ -3,11 +3,11 @@ import { pikkuSessionlessFunc } from '../../../.pikku/function/index.js';
 import { resolveApiContext } from '../lib/config.js';
 import { getFabricRPC } from '../lib/http.js';
 import { promptSecret } from '../lib/prompt.js';
-import { resolveStageId } from '../lib/stage.js';
+import { resolveStage } from '../lib/stage.js';
 import { seal, serializeSealedValue } from '../lib/sealed-box.js';
 export const FabricSecretsSetInput = z.object({
     name: z.string(),
-    branch: z.string(),
+    branch: z.string().optional(),
     value: z.string().optional(),
     force: z.boolean().optional(),
 });
@@ -19,7 +19,7 @@ export const FabricSecretsSet = pikkuSessionlessFunc({
     description: 'Set a stage-scoped secret. Sealed here to the stage public key — the plaintext never leaves this machine.',
     input: FabricSecretsSetInput,
     output: FabricSecretsSetOutput,
-    func: async (_services, { name, branch, value }) => {
+    func: async (_services, { name, branch: requested, value }) => {
         const ctx = await resolveApiContext();
         if (!ctx.token)
             throw new Error('Not logged in. Run `pikku fabric login` first.');
@@ -29,7 +29,7 @@ export const FabricSecretsSet = pikkuSessionlessFunc({
         if (!plaintext)
             throw new Error('Empty secret value — aborting.');
         const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
-        const stageId = await resolveStageId(rpc, ctx.projectId, branch);
+        const { stageId, branch } = await resolveStage(rpc, ctx.projectId, requested);
         // Fabric holds only the public half of this keypair. The private half went
         // to the stage's worker at deploy time and was dropped there, so the value
         // sealed below can be opened by that worker and by nothing else — including