@pikku/cli 0.12.125 → 0.12.127

package/dist/src/fabric/functions/findings-flush.function.js

@@ -0,0 +1,36 @@
+import { z } from 'zod';
+import { pikkuSessionlessFunc } from '../../../.pikku/function/index.js';
+import { resolveApiContext } from '../lib/config.js';
+import { flushSpool } from '../lib/finding-spool.js';
+export const FabricFindingsFlushInput = z.object({
+    apiUrl: z.string().optional(),
+});
+export const FabricFindingsFlushOutput = z.object({
+    sent: z.number(),
+    remaining: z.number(),
+    reason: z.string().optional(),
+});
+/**
+ * Explicitly asked for, so unlike `report` this one says plainly that it
+ * cannot run: someone who typed `flush` wants to know the login is missing,
+ * not to have the queue quietly stay put.
+ */
+export const FabricFindingsFlush = pikkuSessionlessFunc({
+    description: 'Send every finding queued locally.',
+    input: FabricFindingsFlushInput,
+    output: FabricFindingsFlushOutput,
+    func: async (_services, { apiUrl: apiUrlOverride }) => {
+        const ctx = await resolveApiContext({ apiUrlOverride });
+        if (!ctx.token)
+            throw new Error('Not logged in. Run `pikku fabric login` first.');
+        const result = await flushSpool({
+            apiUrl: ctx.apiUrl,
+            token: ctx.token,
+            projectId: ctx.projectId,
+        });
+        console.log(result.remaining === 0
+            ? `[fabric] sent ${result.sent} finding(s)`
+            : `[fabric] sent ${result.sent}, ${result.remaining} still queued (${result.reason})`);
+        return result;
+    },
+});

package/dist/src/fabric/functions/findings-list.function.d.ts

@@ -0,0 +1,55 @@
+import { z } from 'zod';
+export declare const FabricFindingsListInput: z.ZodObject<{}, z.core.$strip>;
+export declare const FabricFindingsListOutput: z.ZodObject<{
+    findings: z.ZodArray<z.ZodObject<{
+        title: z.ZodString;
+        kind: z.ZodString;
+        reason: z.ZodString;
+        reportedAt: z.ZodString;
+        projectId: z.ZodNullable<z.ZodString>;
+        file: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/**
+ * What is waiting to be sent. Without this the spool is invisible, and an
+ * agent has no way to tell a finding that reached fabric from one still
+ * sitting on the machine.
+ */
+export declare const FabricFindingsList: import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<Record<string, never>, {
+    findings: {
+        title: string;
+        kind: string;
+        reason: string;
+        reportedAt: string;
+        projectId: string | null;
+        file: string;
+    }[];
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<Record<string, never>, {
+    findings: {
+        title: string;
+        kind: string;
+        reason: string;
+        reportedAt: string;
+        projectId: string | null;
+        file: string;
+    }[];
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<Record<string, never>, {
+    findings: {
+        title: string;
+        kind: string;
+        reason: string;
+        reportedAt: string;
+        projectId: string | null;
+        file: string;
+    }[];
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>;
+type QueuedFinding = {
+    title: string;
+    kind: string;
+    reason: string;
+    reportedAt: string;
+};
+export declare const renderFindingsList: (_s: unknown, { findings }: {
+    findings: QueuedFinding[];
+}) => void;
+export {};

package/dist/src/fabric/functions/findings-list.function.js

@@ -0,0 +1,52 @@
+import { z } from 'zod';
+import { pikkuSessionlessFunc } from '../../../.pikku/function/index.js';
+import { readSpool } from '../lib/finding-spool.js';
+import { dim, table } from '../lib/output.js';
+export const FabricFindingsListInput = z.object({});
+export const FabricFindingsListOutput = z.object({
+    findings: z.array(z.object({
+        title: z.string(),
+        kind: z.string(),
+        reason: z.string(),
+        reportedAt: z.string(),
+        projectId: z.string().nullable(),
+        file: z.string(),
+    })),
+});
+/**
+ * What is waiting to be sent. Without this the spool is invisible, and an
+ * agent has no way to tell a finding that reached fabric from one still
+ * sitting on the machine.
+ */
+export const FabricFindingsList = pikkuSessionlessFunc({
+    description: 'List the findings queued locally, waiting to be sent.',
+    input: FabricFindingsListInput,
+    output: FabricFindingsListOutput,
+    func: async () => ({
+        findings: (await readSpool()).map((entry) => ({
+            title: entry.payload.title,
+            kind: entry.payload.kind,
+            reason: entry.reason,
+            reportedAt: entry.payload.reportedAt,
+            projectId: entry.projectId,
+            file: entry.file,
+        })),
+    }),
+});
+export const renderFindingsList = (_s, { findings }) => {
+    console.log('');
+    if (findings.length === 0) {
+        console.log(dim('  Nothing queued — every finding you filed was sent.'));
+        console.log('');
+        return;
+    }
+    console.log(table(['REPORTED', 'KIND', 'HELD BECAUSE', 'TITLE'], findings.map((f) => [
+        f.reportedAt.slice(0, 16).replace('T', ' '),
+        f.kind,
+        f.reason,
+        f.title,
+    ])));
+    console.log('');
+    console.log(dim('  `pikku fabric findings flush` sends them.'));
+    console.log('');
+};

package/dist/src/fabric/functions/report.function.d.ts

@@ -0,0 +1,121 @@
+import { z } from 'zod';
+/**
+ * Every field is optional here and the strictness lives in `FindingInput`,
+ * because `--stdin` supplies the whole finding at once and the flags then
+ * carry nothing. Whichever path was used, the same schema decides whether a
+ * finding is well-formed.
+ */
+export declare const FabricReportInput: z.ZodObject<{
+    title: z.ZodOptional<z.ZodString>;
+    kind: z.ZodOptional<z.ZodEnum<{
+        product: "product";
+        harness: "harness";
+    }>>;
+    model: z.ZodOptional<z.ZodString>;
+    expected: z.ZodOptional<z.ZodString>;
+    actual: z.ZodOptional<z.ZodString>;
+    skill: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    passage: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    command: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    error: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    repro: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    workaround: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    proposal: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    tried: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    unresolved: z.ZodOptional<z.ZodOptional<z.ZodBoolean>>;
+    area: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    surface: z.ZodOptional<z.ZodOptional<z.ZodEnum<{
+        local: "local";
+        deployed: "deployed";
+        both: "both";
+    }>>>;
+    cost: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    run: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    deployTarget: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    stdin: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const FabricReportOutput: z.ZodObject<{
+    sent: z.ZodBoolean;
+    reason: z.ZodOptional<z.ZodString>;
+    spooled: z.ZodBoolean;
+    queued: z.ZodNumber;
+}, z.core.$strip>;
+export declare const FabricReport: import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
+    title?: string | undefined;
+    kind?: "product" | "harness" | undefined;
+    model?: string | undefined;
+    expected?: string | undefined;
+    actual?: string | undefined;
+    skill?: string | undefined;
+    passage?: string | undefined;
+    command?: string | undefined;
+    error?: string | undefined;
+    repro?: string | undefined;
+    workaround?: string | undefined;
+    proposal?: string | undefined;
+    tried?: string | undefined;
+    unresolved?: boolean | undefined;
+    area?: string | undefined;
+    surface?: "local" | "deployed" | "both" | undefined;
+    cost?: string | undefined;
+    run?: string | undefined;
+    deployTarget?: string | undefined;
+    stdin?: boolean | undefined;
+}, {
+    sent: boolean;
+    spooled: boolean;
+    queued: number;
+    reason?: string | undefined;
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
+    title?: string | undefined;
+    kind?: "product" | "harness" | undefined;
+    model?: string | undefined;
+    expected?: string | undefined;
+    actual?: string | undefined;
+    skill?: string | undefined;
+    passage?: string | undefined;
+    command?: string | undefined;
+    error?: string | undefined;
+    repro?: string | undefined;
+    workaround?: string | undefined;
+    proposal?: string | undefined;
+    tried?: string | undefined;
+    unresolved?: boolean | undefined;
+    area?: string | undefined;
+    surface?: "local" | "deployed" | "both" | undefined;
+    cost?: string | undefined;
+    run?: string | undefined;
+    deployTarget?: string | undefined;
+    stdin?: boolean | undefined;
+}, {
+    sent: boolean;
+    spooled: boolean;
+    queued: number;
+    reason?: string | undefined;
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
+    title?: string | undefined;
+    kind?: "product" | "harness" | undefined;
+    model?: string | undefined;
+    expected?: string | undefined;
+    actual?: string | undefined;
+    skill?: string | undefined;
+    passage?: string | undefined;
+    command?: string | undefined;
+    error?: string | undefined;
+    repro?: string | undefined;
+    workaround?: string | undefined;
+    proposal?: string | undefined;
+    tried?: string | undefined;
+    unresolved?: boolean | undefined;
+    area?: string | undefined;
+    surface?: "local" | "deployed" | "both" | undefined;
+    cost?: string | undefined;
+    run?: string | undefined;
+    deployTarget?: string | undefined;
+    stdin?: boolean | undefined;
+}, {
+    sent: boolean;
+    spooled: boolean;
+    queued: number;
+    reason?: string | undefined;
+}, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices>, undefined, undefined>;

package/dist/src/fabric/functions/report.function.js

@@ -0,0 +1,84 @@
+import { z } from 'zod';
+import { pikkuSessionlessFunc } from '../../../.pikku/function/index.js';
+import { resolveApiContext } from '../lib/config.js';
+import { collectReportEnvironment } from '../lib/report-environment.js';
+import { FindingInput, buildFindingPayload, parseFinding, parseFindingJson, postFinding, renderReceipt, validateFinding, } from '../lib/finding.js';
+import { flushSpool, readSpool, spoolFinding } from '../lib/finding-spool.js';
+/**
+ * Every field is optional here and the strictness lives in `FindingInput`,
+ * because `--stdin` supplies the whole finding at once and the flags then
+ * carry nothing. Whichever path was used, the same schema decides whether a
+ * finding is well-formed.
+ */
+export const FabricReportInput = FindingInput.partial().extend({
+    stdin: z.boolean().optional(),
+});
+export const FabricReportOutput = z.object({
+    sent: z.boolean(),
+    reason: z.string().optional(),
+    spooled: z.boolean(),
+    queued: z.number(),
+});
+const readStdin = async () => {
+    if (process.stdin.isTTY) {
+        throw new Error('--stdin expects the finding as JSON on standard input, and nothing was piped in.');
+    }
+    const chunks = [];
+    for await (const chunk of process.stdin)
+        chunks.push(Buffer.from(chunk));
+    return Buffer.concat(chunks).toString('utf8');
+};
+/**
+ * Every path that cannot send holds the finding instead. The states that stop
+ * a send — logged out, fabric unreachable — are the states a finding is most
+ * likely to be describing, so dropping it loses exactly the reports worth
+ * having.
+ */
+const hold = async (payload, reason, projectId, message) => {
+    await spoolFinding({ payload, reason, projectId });
+    const queued = (await readSpool()).length;
+    console.log(`[fabric] ${message} — finding queued (${queued} waiting, sent on your next report)`);
+    return { sent: false, reason, spooled: true, queued };
+};
+export const FabricReport = pikkuSessionlessFunc({
+    description: 'Report a finding — something about pikku that cost time — to fabric.',
+    input: FabricReportInput,
+    output: FabricReportOutput,
+    func: async (_services, { stdin, ...flags }) => {
+        const parsed = stdin
+            ? parseFindingJson(await readStdin())
+            : parseFinding(flags);
+        if ('problems' in parsed) {
+            throw new Error(parsed.problems.join('\n'));
+        }
+        const problems = validateFinding(parsed.finding);
+        if (problems.length > 0) {
+            throw new Error(problems.join('\n'));
+        }
+        const payload = buildFindingPayload(parsed.finding, await collectReportEnvironment());
+        console.log(renderReceipt(payload));
+        const ctx = await resolveApiContext();
+        if (!ctx.token) {
+            return hold(payload, 'not-logged-in', ctx.projectId, 'not logged in');
+        }
+        const flushed = await flushSpool({
+            apiUrl: ctx.apiUrl,
+            token: ctx.token,
+            projectId: ctx.projectId,
+        });
+        if (flushed.sent > 0) {
+            console.log(`[fabric] sent ${flushed.sent} finding(s) held from earlier`);
+        }
+        const result = await postFinding({
+            apiUrl: ctx.apiUrl,
+            token: ctx.token,
+            projectId: ctx.projectId,
+            payload,
+        });
+        if (!result.sent) {
+            return hold(payload, result.reason ?? 'send-failed', ctx.projectId, `fabric did not accept it (${result.reason})`);
+        }
+        console.log('[fabric] finding sent');
+        return { sent: true, spooled: false, queued: flushed.remaining };
+    },
+});

package/dist/src/fabric/functions/secrets-list.function.d.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 export declare const FabricSecretsListInput: z.ZodObject<{
-    branch: z.ZodString;
+    branch: z.ZodOptional<z.ZodString>;
     json: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 export declare const FabricSecretsListOutput: z.ZodObject<{
@@ -10,7 +10,7 @@ export declare const FabricSecretsListOutput: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export declare const FabricSecretsList: import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
-    branch: string;
+    branch?: string | undefined;
     json?: boolean | undefined;
 }, {
     secrets: {
@@ -18,7 +18,7 @@ export declare const FabricSecretsList: import("../../../.pikku/function/pikku-f
         updatedAt: string;
     }[];
 }, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
-    branch: string;
+    branch?: string | undefined;
     json?: boolean | undefined;
 }, {
     secrets: {
@@ -26,7 +26,7 @@ export declare const FabricSecretsList: import("../../../.pikku/function/pikku-f
         updatedAt: string;
     }[];
 }, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
-    branch: string;
+    branch?: string | undefined;
     json?: boolean | undefined;
 }, {
     secrets: {

package/dist/src/fabric/functions/secrets-list.function.js

@@ -2,9 +2,9 @@ import { z } from 'zod';
 import { pikkuSessionlessFunc } from '../../../.pikku/function/index.js';
 import { resolveApiContext } from '../lib/config.js';
 import { getFabricRPC } from '../lib/http.js';
-import { resolveStageId } from '../lib/stage.js';
+import { resolveStage } from '../lib/stage.js';
 export const FabricSecretsListInput = z.object({
-    branch: z.string(),
+    branch: z.string().optional(),
     json: z.boolean().optional(),
 });
 export const FabricSecretsListOutput = z.object({
@@ -14,14 +14,14 @@ export const FabricSecretsList = pikkuSessionlessFunc({
     description: 'List the secrets set on a stage, by name. Values are sealed to the stage and never leave it.',
     input: FabricSecretsListInput,
     output: FabricSecretsListOutput,
-    func: async (_services, { branch, json }) => {
+    func: async (_services, { branch: requested, json }) => {
         const ctx = await resolveApiContext();
         if (!ctx.token)
             throw new Error('Not logged in. Run `pikku fabric login` first.');
         if (!ctx.projectId)
             throw new Error('No fabric project linked. Run `pikku fabric link` first.');
         const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
-        const stageId = await resolveStageId(rpc, ctx.projectId, branch);
+        const { stageId, branch } = await resolveStage(rpc, ctx.projectId, requested);
         const result = await rpc.invoke('listStageSecretNames', { stageId });
         if (json) {
             console.log(JSON.stringify({ branch, secrets: result.secrets }, null, 2));

package/dist/src/fabric/functions/secrets-rotate.function.d.ts

@@ -1,23 +1,23 @@
 import { z } from 'zod';
 export declare const FabricSecretsRotateInput: z.ZodObject<{
-    branch: z.ZodString;
+    branch: z.ZodOptional<z.ZodString>;
     force: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 export declare const FabricSecretsRotateOutput: z.ZodObject<{
     retiredKeyId: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
 export declare const FabricSecretsRotate: import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
-    branch: string;
+    branch?: string | undefined;
     force?: boolean | undefined;
 }, {
     retiredKeyId: string | null;
 }, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
-    branch: string;
+    branch?: string | undefined;
     force?: boolean | undefined;
 }, {
     retiredKeyId: string | null;
 }, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
-    branch: string;
+    branch?: string | undefined;
     force?: boolean | undefined;
 }, {
     retiredKeyId: string | null;

package/dist/src/fabric/functions/secrets-rotate.function.js

@@ -2,9 +2,9 @@ import { z } from 'zod';
 import { pikkuSessionlessFunc } from '../../../.pikku/function/index.js';
 import { resolveApiContext } from '../lib/config.js';
 import { getFabricRPC } from '../lib/http.js';
-import { resolveStageId } from '../lib/stage.js';
+import { resolveStage } from '../lib/stage.js';
 export const FabricSecretsRotateInput = z.object({
-    branch: z.string(),
+    branch: z.string().optional(),
     force: z.boolean().optional(),
 });
 export const FabricSecretsRotateOutput = z.object({
@@ -14,20 +14,23 @@ export const FabricSecretsRotate = pikkuSessionlessFunc({
     description: "Retire a stage's sealing key so the next deploy issues a new one. Secrets sealed to the old key must be set again.",
     input: FabricSecretsRotateInput,
     output: FabricSecretsRotateOutput,
-    func: async (_services, { branch, force }) => {
+    func: async (_services, { branch: requested, force }) => {
         const ctx = await resolveApiContext();
         if (!ctx.token)
             throw new Error('Not logged in. Run `pikku fabric login` first.');
         if (!ctx.projectId)
             throw new Error('No fabric project linked. Run `pikku fabric link` first.');
+        // Resolved before the refusal, so the one message standing between a
+        // typo and unreadable secrets names the stage that would actually be
+        // rotated rather than echoing an argument that may not have been passed.
+        const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
+        const { stageId, branch } = await resolveStage(rpc, ctx.projectId, requested);
         if (!force) {
             // Not a confirmation for politeness — this is the one operation here
             // that destroys access to data. Fabric cannot read the sealed values, so
             // it cannot carry them over, and nobody can undo it afterwards.
             throw new Error(`Rotating the sealing key on ${branch} makes every secret already set on it unreadable — fabric cannot re-seal values it cannot open, so each one must be set again after the next deploy. Re-run with --force if that is what you want.`);
         }
-        const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
-        const stageId = await resolveStageId(rpc, ctx.projectId, branch);
         const result = await rpc.invoke('rotateStageSealingKey', { stageId });
         console.log(`[fabric] retired sealing key ${result.retiredKeyId} on ${branch}`);
         console.log('[fabric] deploy the stage to issue a new key, then set its secrets again');

package/dist/src/fabric/functions/secrets-set.function.d.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 export declare const FabricSecretsSetInput: z.ZodObject<{
     name: z.ZodString;
-    branch: z.ZodString;
+    branch: z.ZodOptional<z.ZodString>;
     value: z.ZodOptional<z.ZodString>;
     force: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
@@ -11,7 +11,7 @@ export declare const FabricSecretsSetOutput: z.ZodObject<{
 }, z.core.$strip>;
 export declare const FabricSecretsSet: import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionConfig<{
     name: string;
-    branch: string;
+    branch?: string | undefined;
     value?: string | undefined;
     force?: boolean | undefined;
 }, {
@@ -19,7 +19,7 @@ export declare const FabricSecretsSet: import("../../../.pikku/function/pikku-fu
     keyId: string;
 }, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunctionSessionless<{
     name: string;
-    branch: string;
+    branch?: string | undefined;
     value?: string | undefined;
     force?: boolean | undefined;
 }, {
@@ -27,7 +27,7 @@ export declare const FabricSecretsSet: import("../../../.pikku/function/pikku-fu
     keyId: string;
 }, "rpc" | "session", import("../../../.pikku/function/pikku-function-types.gen.js").WiredServices, unknown> | import("../../../.pikku/function/pikku-function-types.gen.js").PikkuFunction<{
     name: string;
-    branch: string;
+    branch?: string | undefined;
     value?: string | undefined;
     force?: boolean | undefined;
 }, {

package/dist/src/fabric/functions/secrets-set.function.js

@@ -3,11 +3,11 @@ import { pikkuSessionlessFunc } from '../../../.pikku/function/index.js';
 import { resolveApiContext } from '../lib/config.js';
 import { getFabricRPC } from '../lib/http.js';
 import { promptSecret } from '../lib/prompt.js';
-import { resolveStageId } from '../lib/stage.js';
+import { resolveStage } from '../lib/stage.js';
 import { seal, serializeSealedValue } from '../lib/sealed-box.js';
 export const FabricSecretsSetInput = z.object({
     name: z.string(),
-    branch: z.string(),
+    branch: z.string().optional(),
     value: z.string().optional(),
     force: z.boolean().optional(),
 });
@@ -19,7 +19,7 @@ export const FabricSecretsSet = pikkuSessionlessFunc({
     description: 'Set a stage-scoped secret. Sealed here to the stage public key — the plaintext never leaves this machine.',
     input: FabricSecretsSetInput,
     output: FabricSecretsSetOutput,
-    func: async (_services, { name, branch, value }) => {
+    func: async (_services, { name, branch: requested, value }) => {
         const ctx = await resolveApiContext();
         if (!ctx.token)
             throw new Error('Not logged in. Run `pikku fabric login` first.');
@@ -29,7 +29,7 @@ export const FabricSecretsSet = pikkuSessionlessFunc({
         if (!plaintext)
             throw new Error('Empty secret value — aborting.');
         const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
-        const stageId = await resolveStageId(rpc, ctx.projectId, branch);
+        const { stageId, branch } = await resolveStage(rpc, ctx.projectId, requested);
         // Fabric holds only the public half of this keypair. The private half went
         // to the stage's worker at deploy time and was dropped there, so the value
         // sealed below can be opened by that worker and by nothing else — including