@pikku/cli 0.12.125 → 0.12.126

package/dist/src/functions/commands/db-reset.js

@@ -43,13 +43,17 @@ export const dbReset = pikkuSessionlessFunc({
         logger.info(zod.written
             ? `db reset: regenerated ${zod.outFile} (${zod.tables.length} tables)`
             : `db reset: ${zod.outFile} unchanged`);
+        // Both lines report on the SEED STEP, never on the database. A migration
+        // is free to carry rows — data a deployed stage needs is migration data —
+        // so "database is empty" was a verdict this step has no standing to reach,
+        // and it read as a failed reset every time it was wrong.
         if (noSeed) {
-            logger.info('db reset: --no-seed, leaving the database empty');
+            logger.info('db reset: --no-seed, skipping the dev seed');
             return;
         }
         const devSeedResult = await devSeed(resolved);
         logger.info(devSeedResult.applied
             ? `db reset: seeded ${resolved.devSeedFile} (${devSeedResult.bytes} bytes)`
-            : `db reset: no ${resolved.devSeedFile} found, database is empty`);
+            : `db reset: no dev seed applied (${resolved.devSeedFile} not found)`);
     },
 });

package/dist/src/functions/commands/dev.js

@@ -24,13 +24,17 @@ import { resolveConsoleMount } from './serve-console.js';
 import { serverReadyLine } from '../../server/server-ready.js';
 import { createEphemeralContentSigningJWT } from '../../server/content-signing-jwt.js';
 import { enableDevActorSignIn } from '../../server/actor-sign-in.js';
+import { resolvePersonas } from '../../utils/resolve-personas.js';
 import { applyModelAliasOverride } from '../../utils/model-alias-override.js';
 export const dev = pikkuSessionlessFunc({
     remote: true,
     func: async ({ logger, config, getInspectorState, invalidateInspectorState, variables, devServerRunner, }, { port, watch, hmr, coverage, test, model }, { rpc }) => {
         process.env.PIKKU_DEV_QUICK_LOGIN ??= 'true';
         process.env.PIKKU_ENV ??= resolveDevEnvironmentName(config.environments ?? {});
-        enableDevActorSignIn(logger);
+        await enableDevActorSignIn(logger, async () => {
+            const state = await getInspectorState(true, false, false, true);
+            return Object.values(resolvePersonas(state.personas?.definitions ?? [], config.scenarios?.emailDomain));
+        });
         applyModelAliasOverride(logger, model, config.models);
         if (test) {
             process.env.PIKKU_TEST_RUN = 'true';

package/dist/src/functions/commands/persona.d.ts

@@ -55,4 +55,22 @@ export declare const personaRun: import("#pikku/function").PikkuFunctionConfig<{
     out?: string;
 }, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;
 /** Who this app is for, and what each of them wants, without running anything. */
+/**
+ * Mint the actor credential for one persona, or for every declared persona.
+ *
+ * The root secret is entitled to all of them, so nothing that only needs to be
+ * one person should ever hold it. What comes out is bound to that persona's
+ * address by the target — presenting it for anyone else is refused — so a CI
+ * job, a container or a virtual user can be handed exactly the people it is
+ * meant to be and no more.
+ *
+ * Printed as `id=secret` lines, which is the shape PIKKU_PERSONA_SECRETS reads.
+ */
+export declare const personaSecret: import("#pikku/function").PikkuFunctionConfig<{
+    personas?: string[];
+}, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<{
+    personas?: string[];
+}, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<{
+    personas?: string[];
+}, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;
 export declare const personaList: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/persona.js

@@ -1,11 +1,11 @@
 import { resolve, dirname } from 'node:path';
 import { mkdirSync, writeFileSync } from 'node:fs';
 import { pikkuSessionlessFunc } from '#pikku/function';
-import { createHttpPersonas, personaEnvironmentRefusal, roleMismatchMessage, verifyPersonaRoles, } from '@pikku/core/persona';
+import { createHttpPersonas, deriveActorSecret, personaEnvironmentRefusal, roleMismatchMessage, verifyPersonaRoles, } from '@pikku/core/persona';
 import { personaVirtualUserTarget, runVirtualUser, catalogueClassification, DISPOSITIONS, prepareVirtualUserRun, } from '@pikku/core/virtual-user';
 import { getSingletonServices, setSingletonServices } from '@pikku/core/state';
 import { resolvePersonas } from '../../utils/resolve-personas.js';
-import { resolvePersonaCredentials } from '../../utils/persona-credentials.js';
+import { ACTOR_SECRET_VARIABLE, PERSONA_SECRETS_VARIABLE, resolvePersonaCredentials, } from '../../utils/persona-credentials.js';
 import { resolveEnvironment } from './environment.js';
 import { createDevAgentRunner } from './dev-agent-runner.js';
 import { formatVirtualUserReport } from './virtual-user-formatter.js';
@@ -191,6 +191,45 @@ export const personaRun = pikkuSessionlessFunc({
     },
 });
 /** Who this app is for, and what each of them wants, without running anything. */
+/**
+ * Mint the actor credential for one persona, or for every declared persona.
+ *
+ * The root secret is entitled to all of them, so nothing that only needs to be
+ * one person should ever hold it. What comes out is bound to that persona's
+ * address by the target — presenting it for anyone else is refused — so a CI
+ * job, a container or a virtual user can be handed exactly the people it is
+ * meant to be and no more.
+ *
+ * Printed as `id=secret` lines, which is the shape PIKKU_PERSONA_SECRETS reads.
+ */
+export const personaSecret = pikkuSessionlessFunc({
+    func: async ({ logger, config, variables, getInspectorState }, input) => {
+        const root = await variables.get(ACTOR_SECRET_VARIABLE);
+        if (!root) {
+            throw new Error(`${ACTOR_SECRET_VARIABLE} is not set — there is no root to derive from. ` +
+                `It lives in the environment of whoever mints credentials, and never in pikku.config.json.`);
+        }
+        const state = await getInspectorState(true, false, false, true);
+        const declared = resolvePersonas(state.personas?.definitions ?? [], config.scenarios?.emailDomain);
+        const wanted = input.personas?.length
+            ? input.personas
+            : Object.keys(declared);
+        const unknown = wanted.filter((id) => !declared[id]);
+        if (unknown.length > 0) {
+            throw new Error(`No persona ${unknown.map((id) => `'${id}'`).join(', ')} is declared. ` +
+                `Declared: ${Object.keys(declared).sort().join(', ') || 'none'}.`);
+        }
+        const minted = [];
+        for (const id of wanted) {
+            minted.push(`${id}=${await deriveActorSecret(String(root), declared[id].email)}`);
+        }
+        for (const line of minted) {
+            logger.info(line);
+        }
+        logger.info('');
+        logger.info(`Hand these to a run as ${PERSONA_SECRETS_VARIABLE}='${minted.join(',')}'`);
+    },
+});
 export const personaList = pikkuSessionlessFunc({
     func: async ({ logger, config, getInspectorState }) => {
         const state = await getInspectorState(true, false, false, true);

package/dist/src/functions/commands/scenario-browser.d.ts

@@ -9,12 +9,16 @@
  */
 import type { ScenarioArtifact, ScenarioBrowserFailure, ScenarioBrowserProvider } from '@pikku/core/scenario';
 import type { ResolvedPersona } from '@pikku/core/services';
-import type { OperatorSignInOptions } from '@pikku/core/persona';
+import type { ActorSecretResolver, OperatorSignInOptions } from '@pikku/core/persona';
 /** The default driver, used when a project names no other. */
 export declare const DEFAULT_BROWSER_DRIVER = "@pikku/playwright";
 export interface ScenarioBrowserDriverOptions {
-    /** The actor secret, for a local `pikku dev` target. */
-    secret?: string;
+    /**
+     * The root actor secret, for a local `pikku dev` target — each persona's
+     * credential is derived from it. A resolver instead when this run was handed
+     * credentials for only some personas.
+     */
+    secret?: string | ActorSecretResolver;
     /** Fabric operator credentials, for a deployed target. */
     operator?: OperatorSignInOptions;
     actors: Record<string, ResolvedPersona>;
@@ -72,8 +76,12 @@ export interface ResolveScenarioBrowserProviderOptions {
     appUrl?: string;
     /** Base url per app, for a product whose personas sign into more than one. */
     appUrls?: Record<string, string>;
-    /** The actor secret, for a local `pikku dev` target. */
-    secret?: string;
+    /**
+     * The root actor secret, for a local `pikku dev` target — each persona's
+     * credential is derived from it. A resolver instead when this run was handed
+     * credentials for only some personas.
+     */
+    secret?: string | ActorSecretResolver;
     /** Fabric operator credentials, for a deployed target. */
     operator?: OperatorSignInOptions;
     actors: Record<string, ResolvedPersona>;

package/dist/src/functions/db/check-enums.d.ts

@@ -0,0 +1,38 @@
+/**
+ * A `CHECK (col IN ('a','b',…))` constraint is an enum by another name, and
+ * both introspectors read one back as SQL text: SQLite stores the `CREATE
+ * TABLE` verbatim, Postgres hands back a normalised `pg_get_constraintdef`.
+ * The parsing they need differs, but the quoting rules do not, so both go
+ * through here.
+ */
+/**
+ * Blank out `--` line comments and `/* … *\/` block comments, leaving a string
+ * of the same shape so offsets and line breaks still line up.
+ *
+ * Quoted text is skipped rather than scanned: `'a--b'` is a value, not a
+ * comment. The reverse — reading a comment as SQL — is what makes this
+ * necessary at all: an apostrophe in `-- the clinician's copy` opens a string
+ * that runs to the next quote in the real list, and a bracket in `-- (see
+ * below)` closes the list early. Either way the CHECK survives as a union that
+ * is wrong, which is worse than no union.
+ */
+export declare function stripSqlComments(sql: string): string;
+/** The single-quoted literals in `text`, with doubled quotes unescaped. */
+export declare function quotedValues(text: string): string[];
+/**
+ * Map each column constrained by a `CHECK (col IN (…))` in a `CREATE TABLE`
+ * statement to its allowed values. Only the positive `col IN (…)` form is
+ * recognised (the convention); `NOT IN`, ranges and boolean expressions are
+ * left for the column to stay a plain string.
+ */
+export declare function parseCheckEnumsFromDdl(ddl: string): Map<string, string[]>;
+/**
+ * The allowed values in a Postgres check constraint, or `undefined` when the
+ * constraint is not an enumeration.
+ *
+ * Postgres does not store the `IN (…)` you wrote — `pg_get_constraintdef`
+ * rewrites it as `= ANY (ARRAY[…])`, with each element cast to the column's
+ * type. Matching that shape is deliberate: `NOT IN` normalises to `<> ALL
+ * (ARRAY[…])` and a range to `>`/`<`, and neither is an enum.
+ */
+export declare function parseCheckEnumValues(constraintDef: string): string[] | undefined;

package/dist/src/functions/db/check-enums.js

@@ -0,0 +1,103 @@
+/**
+ * A `CHECK (col IN ('a','b',…))` constraint is an enum by another name, and
+ * both introspectors read one back as SQL text: SQLite stores the `CREATE
+ * TABLE` verbatim, Postgres hands back a normalised `pg_get_constraintdef`.
+ * The parsing they need differs, but the quoting rules do not, so both go
+ * through here.
+ */
+/**
+ * Blank out `--` line comments and `/* … *\/` block comments, leaving a string
+ * of the same shape so offsets and line breaks still line up.
+ *
+ * Quoted text is skipped rather than scanned: `'a--b'` is a value, not a
+ * comment. The reverse — reading a comment as SQL — is what makes this
+ * necessary at all: an apostrophe in `-- the clinician's copy` opens a string
+ * that runs to the next quote in the real list, and a bracket in `-- (see
+ * below)` closes the list early. Either way the CHECK survives as a union that
+ * is wrong, which is worse than no union.
+ */
+export function stripSqlComments(sql) {
+    let out = '';
+    let i = 0;
+    while (i < sql.length) {
+        const c = sql[i];
+        if (c === "'" || c === '"') {
+            const end = closingQuote(sql, i);
+            out += sql.slice(i, end);
+            i = end;
+            continue;
+        }
+        if (c === '-' && sql[i + 1] === '-') {
+            while (i < sql.length && sql[i] !== '\n') {
+                out += ' ';
+                i++;
+            }
+            continue;
+        }
+        if (c === '/' && sql[i + 1] === '*') {
+            const close = sql.indexOf('*/', i + 2);
+            const end = close === -1 ? sql.length : close + 2;
+            for (let k = i; k < end; k++)
+                out += sql[k] === '\n' ? '\n' : ' ';
+            i = end;
+            continue;
+        }
+        out += c;
+        i++;
+    }
+    return out;
+}
+/** Index just past the quoted run starting at `start`, doubled quotes included. */
+function closingQuote(sql, start) {
+    const quote = sql[start];
+    let i = start + 1;
+    while (i < sql.length) {
+        if (sql[i] === quote) {
+            if (sql[i + 1] === quote) {
+                i += 2;
+                continue;
+            }
+            return i + 1;
+        }
+        i++;
+    }
+    return sql.length;
+}
+/** The single-quoted literals in `text`, with doubled quotes unescaped. */
+export function quotedValues(text) {
+    return [...text.matchAll(/'((?:[^']|'')*)'/g)].map((m) => m[1].replace(/''/g, "'"));
+}
+/**
+ * Map each column constrained by a `CHECK (col IN (…))` in a `CREATE TABLE`
+ * statement to its allowed values. Only the positive `col IN (…)` form is
+ * recognised (the convention); `NOT IN`, ranges and boolean expressions are
+ * left for the column to stay a plain string.
+ */
+export function parseCheckEnumsFromDdl(ddl) {
+    const out = new Map();
+    const sql = stripSqlComments(ddl);
+    const checkIn = /CHECK\s*\(\s*"?(\w+)"?\s+IN\s*\(([^)]*)\)/gi;
+    let m;
+    while ((m = checkIn.exec(sql))) {
+        const values = quotedValues(m[2]);
+        if (values.length > 0)
+            out.set(m[1], values);
+    }
+    return out;
+}
+/**
+ * The allowed values in a Postgres check constraint, or `undefined` when the
+ * constraint is not an enumeration.
+ *
+ * Postgres does not store the `IN (…)` you wrote — `pg_get_constraintdef`
+ * rewrites it as `= ANY (ARRAY[…])`, with each element cast to the column's
+ * type. Matching that shape is deliberate: `NOT IN` normalises to `<> ALL
+ * (ARRAY[…])` and a range to `>`/`<`, and neither is an enum.
+ */
+export function parseCheckEnumValues(constraintDef) {
+    const any = /=\s*ANY\s*\(\s*\(?\s*ARRAY\s*\[([^\]]*)\]/i.exec(constraintDef);
+    if (!any)
+        return undefined;
+    const values = quotedValues(any[1]);
+    return values.length > 0 ? values : undefined;
+}

package/dist/src/functions/db/db-codegen.js

@@ -641,6 +641,21 @@ export async function generateSchemaTypes(introspector, options) {
     const coercionBody = [
         `// Generated by @pikku/cli — do not edit by hand.`,
         `// Run \`pikku db migrate\` to refresh.`,
+        `//`,
+        `// Nothing applies this for you. Attach it where the kysely singleton is`,
+        `// created, in createSingletonServices:`,
+        `//`,
+        `//   import { createCoercionPlugin } from '@pikku/kysely'`,
+        `//   import { coercionMap } from '#pikku/db/coercion.gen.js'`,
+        `//`,
+        `//   kysely: existingServices.kysely.withPlugin(`,
+        `//     createCoercionPlugin({ map: coercionMap }),`,
+        `//   )`,
+        `//`,
+        `// Unwired, this file is invisible locally and fatal deployed: the dev`,
+        `// driver hydrates a TEXT date into a Date by itself, a deployed one`,
+        `// returns the raw string, and the generated schema types the column`,
+        `// \`Date\` either way — so tsc flags nothing and no local test can fail.`,
         ``,
         `export const coercionMap = {`,
         coercionEntries,

package/dist/src/functions/db/postgres/postgres-introspector.d.ts

@@ -12,6 +12,20 @@ export declare class PostgresIntrospector implements DbIntrospector {
     connect(): Promise<void>;
     listTables(): Promise<string[]>;
     getColumns(table: string): Promise<ColumnInfo[]>;
+    /**
+     * Columns constrained to a value list by a `CHECK (col IN (…))`, keyed like
+     * {@link getAllColumns} then by column name. Postgres has native enums, but
+     * a CHECK is the other half of how a schema says "one of these" — and the
+     * one an app written against SQLite as well ends up using, since SQLite has
+     * no enums at all. Left as plain `string`, every caller narrows it by hand.
+     *
+     * Only single-column constraints are read: `conkey` naming two columns means
+     * neither is restricted to the list on its own.
+     *
+     * `table` limits the sweep to one table; omitted, it covers the schema. Both
+     * are one round-trip — see {@link getAllColumns}.
+     */
+    private getCheckEnums;
     getForeignKeys(table: string): Promise<ForeignKeyInfo[]>;
     getAllColumns(): Promise<Map<string, ColumnInfo[]>>;
     getAllForeignKeys(): Promise<Map<string, ForeignKeyInfo[]>>;

package/dist/src/functions/db/postgres/postgres-introspector.js

@@ -1,5 +1,6 @@
 import { Pool } from 'pg';
 import { MIGRATION_TRACKING_TABLE } from '../db-migrator.js';
+import { parseCheckEnumValues } from '../check-enums.js';
 /** Table display name matching `listTables` (schema-qualified unless `public`). */
 function tableKey(schema, table) {
     return schema === 'public' ? table : `${schema}.${table}`;
@@ -85,6 +86,8 @@ export class PostgresIntrospector {
        FROM information_schema.columns c
        WHERE c.table_schema = $2 AND c.table_name = $1
        ORDER BY c.ordinal_position`, [tableName, schema]);
+        const checkEnums = (await this.getCheckEnums({ schema, name: tableName })).get(table) ??
+            new Map();
         return result.rows.map((r) => ({
             name: r.column_name,
             type: resolveColumnType(r.data_type, r.udt_name),
@@ -93,8 +96,51 @@ export class PostgresIntrospector {
             pk: Boolean(r.is_pk),
             defaultValue: r.column_default,
             generated: r.is_generated === 'ALWAYS',
+            enumValues: checkEnums.get(r.column_name),
         }));
     }
+    /**
+     * Columns constrained to a value list by a `CHECK (col IN (…))`, keyed like
+     * {@link getAllColumns} then by column name. Postgres has native enums, but
+     * a CHECK is the other half of how a schema says "one of these" — and the
+     * one an app written against SQLite as well ends up using, since SQLite has
+     * no enums at all. Left as plain `string`, every caller narrows it by hand.
+     *
+     * Only single-column constraints are read: `conkey` naming two columns means
+     * neither is restricted to the list on its own.
+     *
+     * `table` limits the sweep to one table; omitted, it covers the schema. Both
+     * are one round-trip — see {@link getAllColumns}.
+     */
+    async getCheckEnums(table) {
+        const result = await this.client.query(`SELECT n.nspname   AS table_schema,
+              cl.relname  AS table_name,
+              a.attname   AS column_name,
+              pg_get_constraintdef(co.oid) AS def
+       FROM pg_constraint co
+       JOIN pg_class cl     ON cl.oid = co.conrelid
+       JOIN pg_namespace n  ON n.oid = cl.relnamespace
+       JOIN pg_attribute a  ON a.attrelid = co.conrelid AND a.attnum = co.conkey[1]
+       WHERE co.contype = 'c'
+         AND array_length(co.conkey, 1) = 1
+         AND n.nspname NOT IN ('information_schema', 'pg_catalog', 'pg_toast')
+         AND n.nspname NOT LIKE 'pg_temp_%'
+         AND ($1::text IS NULL OR (n.nspname = $1 AND cl.relname = $2))`, [table?.schema ?? null, table?.name ?? null]);
+        const byTable = new Map();
+        for (const r of result.rows) {
+            const values = parseCheckEnumValues(r.def);
+            if (!values)
+                continue;
+            const key = tableKey(r.table_schema, r.table_name);
+            let cols = byTable.get(key);
+            if (!cols) {
+                cols = new Map();
+                byTable.set(key, cols);
+            }
+            cols.set(r.column_name, values);
+        }
+        return byTable;
+    }
     async getForeignKeys(table) {
         const dotIdx = table.indexOf('.');
         const schema = dotIdx >= 0 ? table.slice(0, dotIdx) : 'public';
@@ -153,6 +199,7 @@ export class PostgresIntrospector {
        WHERE c.table_schema NOT IN ('information_schema', 'pg_catalog', 'pg_toast')
          AND c.table_schema NOT LIKE 'pg_temp_%'
        ORDER BY c.table_schema, c.table_name, c.ordinal_position`);
+        const checkEnums = await this.getCheckEnums();
         const byTable = new Map();
         for (const r of result.rows) {
             if (isMigrationTracking(r.table_name))
@@ -171,6 +218,7 @@ export class PostgresIntrospector {
                 pk: Boolean(r.is_pk),
                 defaultValue: r.column_default,
                 generated: r.is_generated === 'ALWAYS',
+                enumValues: checkEnums.get(key)?.get(r.column_name),
             });
         }
         return byTable;

package/dist/src/functions/db/sqlite/sqlite-introspector.d.ts

@@ -7,10 +7,9 @@ export declare class SqliteIntrospector implements DbIntrospector {
     getColumns(table: string): Promise<ColumnInfo[]>;
     /**
      * SQLite has no native enums, but a `CHECK (col IN ('a','b',…))` constraint is
-     * an enum by another name. Parse the table's stored `CREATE TABLE` DDL and map
-     * each constrained column to its allowed values so codegen can type it as a
-     * union. Only the positive `col IN (…)` form is recognised (the convention);
-     * `NOT IN`, ranges, and boolean expressions are left as plain `string`.
+     * an enum by another name. Read back the table's stored `CREATE TABLE` DDL —
+     * which SQLite keeps verbatim, comments included — and map each constrained
+     * column to its allowed values so codegen can type it as a union.
      */
     private parseCheckEnums;
     getForeignKeys(table: string): Promise<ForeignKeyInfo[]>;

package/dist/src/functions/db/sqlite/sqlite-introspector.js

@@ -1,4 +1,5 @@
 import { MIGRATION_TRACKING_TABLE } from '../db-migrator.js';
+import { parseCheckEnumsFromDdl } from '../check-enums.js';
 const SKIP_TABLES = new Set(['sqlite_sequence', MIGRATION_TRACKING_TABLE]);
 export class SqliteIntrospector {
     db;
@@ -34,28 +35,15 @@ export class SqliteIntrospector {
     }
     /**
      * SQLite has no native enums, but a `CHECK (col IN ('a','b',…))` constraint is
-     * an enum by another name. Parse the table's stored `CREATE TABLE` DDL and map
-     * each constrained column to its allowed values so codegen can type it as a
-     * union. Only the positive `col IN (…)` form is recognised (the convention);
-     * `NOT IN`, ranges, and boolean expressions are left as plain `string`.
+     * an enum by another name. Read back the table's stored `CREATE TABLE` DDL —
+     * which SQLite keeps verbatim, comments included — and map each constrained
+     * column to its allowed values so codegen can type it as a union.
      */
     parseCheckEnums(table) {
-        const out = new Map();
         const row = this.db
             .prepare(`SELECT sql FROM sqlite_master WHERE type = 'table' AND name = ?`)
             .get(table);
-        const ddl = row?.sql;
-        if (!ddl)
-            return out;
-        const checkIn = /CHECK\s*\(\s*"?(\w+)"?\s+IN\s*\(([^)]*)\)/gi;
-        let m;
-        while ((m = checkIn.exec(ddl))) {
-            const column = m[1];
-            const values = [...m[2].matchAll(/'((?:[^']|'')*)'/g)].map((q) => q[1].replace(/''/g, "'"));
-            if (values.length > 0)
-                out.set(column, values);
-        }
-        return out;
+        return row?.sql ? parseCheckEnumsFromDdl(row.sql) : new Map();
     }
     async getForeignKeys(table) {
         const escaped = `"${table.replace(/"/g, '""')}"`;

package/dist/src/functions/wirings/virtual-user/serialize-virtual-user-functions.d.ts

@@ -12,12 +12,15 @@ export interface VirtualUserGenOutput {
  * `pikku persona run` does the same thing from a terminal; this is the same run
  * started over RPC, from CI or from a console, with the result kept.
  *
- * A virtual user is NOT a workflow and NOT a queued job. It explores, so no two
- * attempts take the same steps and there is nothing to replay; and the run
- * record already carries the progress a queue would only be holding on the way
- * here. So `runVirtualUser` writes the record, kicks the run off without
- * awaiting it, and returns the id. The one cost is stated on the record: a
- * restart mid-run strands it at `running`.
+ * A virtual user is still NOT a workflow: it explores, so no two attempts take
+ * the same steps and there is nothing to replay. What it does need is a
+ * trigger. `runVirtualUser` writes the record and returns the id; the run
+ * itself is dispatched onto `pikku-virtual-user-runs`, at one attempt, because
+ * a queue is the only dispatch that survives a deployment which puts each
+ * function in its own unit — there is no in-process promise to leave running
+ * there, and an RPC to a function nothing triggers has nowhere to land. A
+ * project with no queue service keeps the in-process dispatch, which is
+ * correct for the single process it runs in.
  *
  * Emitted as two files. The schemas are zod, and the inspector reads a zod
  * schema by importing the module that declares it — which it cannot do for the

package/dist/src/functions/wirings/virtual-user/serialize-virtual-user-functions.js

@@ -8,12 +8,15 @@
  * `pikku persona run` does the same thing from a terminal; this is the same run
  * started over RPC, from CI or from a console, with the result kept.
  *
- * A virtual user is NOT a workflow and NOT a queued job. It explores, so no two
- * attempts take the same steps and there is nothing to replay; and the run
- * record already carries the progress a queue would only be holding on the way
- * here. So `runVirtualUser` writes the record, kicks the run off without
- * awaiting it, and returns the id. The one cost is stated on the record: a
- * restart mid-run strands it at `running`.
+ * A virtual user is still NOT a workflow: it explores, so no two attempts take
+ * the same steps and there is nothing to replay. What it does need is a
+ * trigger. `runVirtualUser` writes the record and returns the id; the run
+ * itself is dispatched onto `pikku-virtual-user-runs`, at one attempt, because
+ * a queue is the only dispatch that survives a deployment which puts each
+ * function in its own unit — there is no in-process promise to leave running
+ * there, and an RPC to a function nothing triggers has nowhere to land. A
+ * project with no queue service keeps the in-process dispatch, which is
+ * correct for the single process it runs in.
  *
  * Emitted as two files. The schemas are zod, and the inspector reads a zod
  * schema by importing the module that declares it — which it cannot do for the
@@ -265,6 +268,7 @@ export const ExecuteVirtualUserRunOutput = z.object({
  */
 import { pikkuFunc, pikkuSessionlessFunc, type Session } from '${leaf('function')}'
 import { pikkuMiddleware } from '${leaf('middleware')}'
+import { wireQueueWorker } from '${leaf('queue')}'
 import { defineScope } from '${leaf('scopes')}'
 import {
   executeVirtualUserRun as executeRun,
@@ -326,7 +330,11 @@ export const runVirtualUser = pikkuFunc({
   scopes: ['virtualUser:run'],
   input: RunVirtualUserInput,
   output: RunVirtualUserOutput,
-  func: async ({ virtualUserRunStore, config }, input, { session, rpc }) => {
+  func: async (
+    { virtualUserRunStore, config, queueService },
+    input,
+    { session, rpc }
+  ) => {
     const { runId, persona, disposition, goals, memory, seed } =
       await startVirtualUserRun({
         store: virtualUserRunStore,
@@ -345,26 +353,35 @@ export const runVirtualUser = pikkuFunc({
         startedBy: session?.userId ?? null,
       })
 
-    // Deliberately not awaited: a run takes minutes, and a held-open request
-    // survives neither a rollout nor a proxy timeout. executeVirtualUserRun
-    // writes both outcomes to the record itself, so the only thing left to
-    // handle here is a rejection escaping the promise — without the catch it
-    // becomes an unhandled rejection and takes the process with it.
-    void rpc!
-      .invoke('executeVirtualUserRun', {
-        runId,
-        persona,
-        disposition,
-        goals,
-        memory,
-        seed,
-        budget: input.budget,
-        // Rides the dispatch and nothing else. The run record is deliberately
-        // not given it: a record outlives the run, and a credential in a row
-        // somebody can read back is a credential leak.
-        operatorToken: input.operatorToken,
+    const job = {
+      runId,
+      persona,
+      disposition,
+      goals,
+      memory,
+      seed,
+      budget: input.budget,
+      // Rides the dispatch and nothing else. The run record is deliberately
+      // not given it: a record outlives the run, and a credential in a row
+      // somebody can read back is a credential leak.
+      operatorToken: input.operatorToken,
+    }
+
+    if (queueService) {
+      // One attempt. A run is an exploration, so a redelivery is a second
+      // different outing writing into a record that already has an outcome.
+      await queueService.add('pikku-virtual-user-runs', job, {
+        attempts: 1,
+        pikkuUserId: session?.userId,
       })
-      .catch(() => {})
+    } else {
+      // Deliberately not awaited: a run takes minutes, and a held-open request
+      // survives neither a rollout nor a proxy timeout. executeVirtualUserRun
+      // writes both outcomes to the record itself, so the only thing left to
+      // handle here is a rejection escaping the promise — without the catch it
+      // becomes an unhandled rejection and takes the process with it.
+      void rpc!.invoke('executeVirtualUserRun', job).catch(() => {})
+    }
 
     return { runId }
   },
@@ -560,7 +577,8 @@ export const tickVirtualUserSchedules = pikkuSessionlessFunc<void, void>({
 
 /**
  * The run itself. Not exposed: it is dispatched by \`runVirtualUser\` and has no
- * caller of its own.
+ * caller of its own — but it is wired to a queue below, which is what gives it
+ * a unit of its own under a per-function deploy.
  */
 export const executeVirtualUserRun = pikkuSessionlessFunc({
   tags: ['pikku'],
@@ -581,6 +599,12 @@ export const executeVirtualUserRun = pikkuSessionlessFunc({
       ...input,
     }),
 })
+
+wireQueueWorker({
+  name: 'pikku-virtual-user-runs',
+  tags: ['pikku'],
+  func: executeVirtualUserRun,
+})
 `;
     return { schemas, functions };
 };