@pikku/cli 0.12.20 → 0.12.22

package/dist/src/fabric/functions/llm-key.function.d.ts

@@ -0,0 +1,46 @@
+import { z } from 'zod';
+export declare const FabricLLMKeyInput: z.ZodObject<{
+    shell: z.ZodOptional<z.ZodBoolean>;
+    env: z.ZodOptional<z.ZodBoolean>;
+    json: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const FabricLLMKeyOutput: z.ZodObject<{
+    proxyUrl: z.ZodString;
+    apiKey: z.ZodString;
+    format: z.ZodEnum<{
+        text: "text";
+        json: "json";
+        shell: "shell";
+        env: "env";
+    }>;
+}, z.core.$strip>;
+export declare const FabricLLMKey: import("../../../.pikku/pikku-types.gen.js").PikkuFunctionConfig<{
+    shell?: boolean | undefined;
+    env?: boolean | undefined;
+    json?: boolean | undefined;
+}, {
+    proxyUrl: string;
+    apiKey: string;
+    format: "text" | "json" | "shell" | "env";
+}, "rpc" | "session", import("../../../.pikku/pikku-types.gen.js").PikkuFunctionSessionless<{
+    shell?: boolean | undefined;
+    env?: boolean | undefined;
+    json?: boolean | undefined;
+}, {
+    proxyUrl: string;
+    apiKey: string;
+    format: "text" | "json" | "shell" | "env";
+}, "rpc" | "session", import("../../../types/application-types.js").Services> | import("../../../.pikku/pikku-types.gen.js").PikkuFunction<{
+    shell?: boolean | undefined;
+    env?: boolean | undefined;
+    json?: boolean | undefined;
+}, {
+    proxyUrl: string;
+    apiKey: string;
+    format: "text" | "json" | "shell" | "env";
+}, "rpc" | "session", import("../../../types/application-types.js").Services>, undefined, undefined>;
+export declare const renderLLMKey: (_services: unknown, data: {
+    proxyUrl: string;
+    apiKey: string;
+    format: "text" | "env" | "shell" | "json";
+}) => void;

package/dist/src/fabric/functions/llm-key.function.js

@@ -0,0 +1,76 @@
+import { z } from 'zod';
+import { BadRequestError, UnauthorizedError } from '@pikku/core/errors';
+import { pikkuSessionlessFunc } from '../../../.pikku/pikku-types.gen.js';
+import { resolveApiContext } from '../lib/config.js';
+import { getFabricRPC } from '../lib/http.js';
+export const FabricLLMKeyInput = z.object({
+    shell: z.boolean().optional(),
+    env: z.boolean().optional(),
+    json: z.boolean().optional(),
+});
+export const FabricLLMKeyOutput = z.object({
+    proxyUrl: z.string(),
+    apiKey: z.string(),
+    format: z.enum(['text', 'env', 'shell', 'json']),
+});
+function shellEscape(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+export const FabricLLMKey = pikkuSessionlessFunc({
+    description: 'Mint or reuse the current user Fabric AI gateway key.',
+    input: FabricLLMKeyInput,
+    output: FabricLLMKeyOutput,
+    func: async (_services, { shell, env, json }) => {
+        const selectedFormats = [shell, env, json].filter(Boolean).length;
+        if (selectedFormats > 1) {
+            throw new BadRequestError('Choose only one of `--shell`, `--env`, or `--json`.');
+        }
+        const ctx = await resolveApiContext();
+        if (!ctx.token) {
+            throw new UnauthorizedError('Not logged in. Run `pikku fabric login` first.');
+        }
+        const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
+        const result = (await rpc.invoke('getDeveloperLiteLLMKey', {}));
+        const format = shell
+            ? 'shell'
+            : env
+                ? 'env'
+                : json
+                    ? 'json'
+                    : 'text';
+        return {
+            proxyUrl: result.proxyUrl,
+            apiKey: result.apiKey,
+            format,
+        };
+    },
+});
+export const renderLLMKey = (_services, data) => {
+    if (data.format === 'json') {
+        console.log(JSON.stringify({
+            proxyUrl: data.proxyUrl,
+            apiKey: data.apiKey,
+            openaiBaseUrl: data.proxyUrl,
+            openaiApiKey: data.apiKey,
+            litellmProxyUrl: data.proxyUrl,
+            litellmApiKey: data.apiKey,
+        }, null, 2));
+        return;
+    }
+    const envLines = [
+        `OPENAI_BASE_URL=${data.proxyUrl}`,
+        `OPENAI_API_KEY=${data.apiKey}`,
+        `LITELLM_PROXY_URL=${data.proxyUrl}`,
+        `LITELLM_API_KEY=${data.apiKey}`,
+    ];
+    if (data.format === 'shell') {
+        console.log(envLines
+            .map((line) => {
+            const [key, ...rest] = line.split('=');
+            return `export ${key}=${shellEscape(rest.join('='))}`;
+        })
+            .join('\n'));
+        return;
+    }
+    console.log(envLines.join('\n'));
+};

package/dist/src/fabric/functions/login.function.d.ts

@@ -0,0 +1,42 @@
+import { z } from 'zod';
+export declare const FabricLoginInput: z.ZodObject<{
+    apiKey: z.ZodOptional<z.ZodString>;
+    token: z.ZodOptional<z.ZodString>;
+    apiUrl: z.ZodOptional<z.ZodString>;
+    consoleUrl: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const FabricLoginOutput: z.ZodObject<{
+    ok: z.ZodBoolean;
+    apiUrl: z.ZodString;
+}, z.core.$strip>;
+/**
+ * Device-authorization-style CLI login. Server mints a short code, user types
+ * it on the console's /cli-auth page (logging in via Auth.js if not already
+ * signed in). CLI polls until the row flips to 'confirmed' and grabs the
+ * one-shot bearer.
+ */
+export declare const FabricLogin: import("../../../.pikku/pikku-types.gen.js").PikkuFunctionConfig<{
+    apiKey?: string | undefined;
+    token?: string | undefined;
+    apiUrl?: string | undefined;
+    consoleUrl?: string | undefined;
+}, {
+    ok: boolean;
+    apiUrl: string;
+}, "rpc" | "session", import("../../../.pikku/pikku-types.gen.js").PikkuFunctionSessionless<{
+    apiKey?: string | undefined;
+    token?: string | undefined;
+    apiUrl?: string | undefined;
+    consoleUrl?: string | undefined;
+}, {
+    ok: boolean;
+    apiUrl: string;
+}, "rpc" | "session", import("../../../types/application-types.js").Services> | import("../../../.pikku/pikku-types.gen.js").PikkuFunction<{
+    apiKey?: string | undefined;
+    token?: string | undefined;
+    apiUrl?: string | undefined;
+    consoleUrl?: string | undefined;
+}, {
+    ok: boolean;
+    apiUrl: string;
+}, "rpc" | "session", import("../../../types/application-types.js").Services>, undefined, undefined>;

package/dist/src/fabric/functions/login.function.js

@@ -0,0 +1,68 @@
+import { z } from 'zod';
+import { pikkuSessionlessFunc } from '../../../.pikku/pikku-types.gen.js';
+import { readAuthFile, writeAuthFile, resolveApiContext, } from '../lib/config.js';
+import { getFabricRPC } from '../lib/http.js';
+import { deriveConsoleUrl } from '../lib/console-url.js';
+export const FabricLoginInput = z.object({
+    apiKey: z.string().optional(),
+    token: z.string().optional(),
+    apiUrl: z.string().optional(),
+    consoleUrl: z.string().optional(),
+});
+export const FabricLoginOutput = z.object({
+    ok: z.boolean(),
+    apiUrl: z.string(),
+});
+const POLL_INTERVAL_MS = 2000;
+const POLL_TIMEOUT_MS = 5 * 60 * 1000;
+/**
+ * Device-authorization-style CLI login. Server mints a short code, user types
+ * it on the console's /cli-auth page (logging in via Auth.js if not already
+ * signed in). CLI polls until the row flips to 'confirmed' and grabs the
+ * one-shot bearer.
+ */
+export const FabricLogin = pikkuSessionlessFunc({
+    description: 'Authenticate the CLI against fabric-api via a one-time code.',
+    input: FabricLoginInput,
+    output: FabricLoginOutput,
+    func: async (_services, { apiKey, token, apiUrl: apiUrlOverride, consoleUrl: consoleUrlOverride }) => {
+        const ctx = await resolveApiContext({ apiUrlOverride });
+        const apiUrl = ctx.apiUrl;
+        // Static-token fast paths — useful for CI and "I already have a token".
+        const explicit = apiKey ?? token;
+        if (explicit) {
+            const auth = await readAuthFile();
+            auth.tokens[apiUrl] = explicit;
+            await writeAuthFile(auth);
+            console.log(`[fabric] saved token for ${apiUrl}`);
+            return { ok: true, apiUrl };
+        }
+        const consoleUrl = (consoleUrlOverride ?? deriveConsoleUrl(apiUrl)).replace(/\/$/, '');
+        const rpc = getFabricRPC({ apiUrl, token: null });
+        const { code, expiresAt } = await rpc.invoke('requestCliAuth');
+        console.log('');
+        console.log('  Enter this code at:');
+        console.log(`    ${consoleUrl}/cli-auth`);
+        console.log('');
+        console.log(`  Code: ${code}`);
+        console.log(`  (expires ${new Date(expiresAt).toLocaleTimeString()})`);
+        console.log('');
+        console.log('  Waiting for confirmation…');
+        const deadline = Date.now() + POLL_TIMEOUT_MS;
+        while (Date.now() < deadline) {
+            await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
+            const result = await rpc.invoke('pollCliAuth', { code });
+            if (result.status === 'expired') {
+                throw new Error('Code expired before confirmation. Run `pikku fabric login` again.');
+            }
+            if (result.status === 'confirmed' && result.token) {
+                const auth = await readAuthFile();
+                auth.tokens[apiUrl] = result.token;
+                await writeAuthFile(auth);
+                console.log(`[fabric] logged in; token saved for ${apiUrl}`);
+                return { ok: true, apiUrl };
+            }
+        }
+        throw new Error('Login timed out.');
+    },
+});

package/dist/src/fabric/functions/logs.function.d.ts

@@ -0,0 +1,40 @@
+import { z } from 'zod';
+export declare const FabricLogsInput: z.ZodObject<{
+    branch: z.ZodOptional<z.ZodString>;
+    deployment: z.ZodOptional<z.ZodString>;
+    level: z.ZodOptional<z.ZodString>;
+    since: z.ZodOptional<z.ZodString>;
+    follow: z.ZodOptional<z.ZodBoolean>;
+    json: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const FabricLogsOutput: z.ZodObject<{
+    count: z.ZodNumber;
+}, z.core.$strip>;
+export declare const FabricLogs: import("../../../.pikku/pikku-types.gen.js").PikkuFunctionConfig<{
+    branch?: string | undefined;
+    deployment?: string | undefined;
+    level?: string | undefined;
+    since?: string | undefined;
+    follow?: boolean | undefined;
+    json?: boolean | undefined;
+}, {
+    count: number;
+}, "rpc" | "session", import("../../../.pikku/pikku-types.gen.js").PikkuFunctionSessionless<{
+    branch?: string | undefined;
+    deployment?: string | undefined;
+    level?: string | undefined;
+    since?: string | undefined;
+    follow?: boolean | undefined;
+    json?: boolean | undefined;
+}, {
+    count: number;
+}, "rpc" | "session", import("../../../types/application-types.js").Services> | import("../../../.pikku/pikku-types.gen.js").PikkuFunction<{
+    branch?: string | undefined;
+    deployment?: string | undefined;
+    level?: string | undefined;
+    since?: string | undefined;
+    follow?: boolean | undefined;
+    json?: boolean | undefined;
+}, {
+    count: number;
+}, "rpc" | "session", import("../../../types/application-types.js").Services>, undefined, undefined>;

package/dist/src/fabric/functions/logs.function.js

@@ -0,0 +1,84 @@
+import { z } from 'zod';
+import { pikkuSessionlessFunc } from '../../../.pikku/pikku-types.gen.js';
+import { resolveApiContext } from '../lib/config.js';
+import { getFabricRPC } from '../lib/http.js';
+export const FabricLogsInput = z.object({
+    branch: z.string().optional(),
+    deployment: z.string().optional(),
+    level: z.string().optional(),
+    since: z.string().optional(),
+    follow: z.boolean().optional(),
+    json: z.boolean().optional(),
+});
+export const FabricLogsOutput = z.object({ count: z.number() });
+function formatLog(log) {
+    return `${log.timestamp} ${log.level.toUpperCase().padEnd(5)} ${log.functionName} — ${log.message}`;
+}
+/**
+ * Stable identity for an entry across polls. OpenObserve doesn't expose a
+ * monotonic id we can dedup on, so we hash the few fields that should be
+ * unique together (timestamp + traceId + message). Keeps memory bounded —
+ * the `seen` set is pruned to the last cursorWindow entries between polls.
+ */
+function logKey(log) {
+    return `${log.timestamp}|${log.traceId ?? ''}|${log.functionName}|${log.message}`;
+}
+export const FabricLogs = pikkuSessionlessFunc({
+    description: 'Stream or fetch logs for a stage / deployment via fabric-api.',
+    input: FabricLogsInput,
+    output: FabricLogsOutput,
+    func: async (_services, { branch, level, json, follow }) => {
+        const ctx = await resolveApiContext();
+        if (!ctx.token)
+            throw new Error('Not logged in. Run `pikku fabric login` first.');
+        if (!ctx.projectId)
+            throw new Error('No fabric project linked. Run `pikku fabric link` first.');
+        if (!branch)
+            throw new Error('Specify --branch <branch-name>.');
+        const seen = new Set();
+        const cursorWindow = 5_000;
+        const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
+        const projectId = ctx.projectId;
+        const fetchAndPrintNew = async () => {
+            const res = await rpc.invoke('getFabricLogsByStageKind', {
+                projectId,
+                branch,
+                level: level ?? undefined,
+            });
+            let printed = 0;
+            for (const log of res.logs) {
+                const k = logKey(log);
+                if (seen.has(k))
+                    continue;
+                seen.add(k);
+                if (json) {
+                    console.log(JSON.stringify(log));
+                }
+                else {
+                    console.log(formatLog(log));
+                }
+                printed += 1;
+            }
+            // Bound memory — keep the most recent cursorWindow keys.
+            if (seen.size > cursorWindow) {
+                const trimmed = Array.from(seen).slice(seen.size - cursorWindow);
+                seen.clear();
+                for (const k of trimmed)
+                    seen.add(k);
+            }
+            return printed;
+        };
+        let count = await fetchAndPrintNew();
+        if (follow) {
+            // Server-side SSE for logs is a planned upgrade — OpenObserve doesn't
+            // push natively without extra plumbing. For now we poll at 2s and
+            // dedup against entries already printed, which gives `tail -f`-ish
+            // behaviour without re-printing the full window each tick.
+            while (true) {
+                await new Promise((r) => setTimeout(r, 2000));
+                count += await fetchAndPrintNew();
+            }
+        }
+        return { count };
+    },
+});

package/dist/src/fabric/functions/metrics.function.d.ts

@@ -0,0 +1,32 @@
+import { z } from 'zod';
+export declare const FabricMetricsInput: z.ZodObject<{
+    branch: z.ZodString;
+    hours: z.ZodOptional<z.ZodNumber>;
+    function: z.ZodOptional<z.ZodString>;
+    json: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const FabricMetricsOutput: z.ZodObject<{
+    count: z.ZodNumber;
+}, z.core.$strip>;
+export declare const FabricMetrics: import("../../../.pikku/pikku-types.gen.js").PikkuFunctionConfig<{
+    branch: string;
+    hours?: number | undefined;
+    function?: string | undefined;
+    json?: boolean | undefined;
+}, {
+    count: number;
+}, "rpc" | "session", import("../../../.pikku/pikku-types.gen.js").PikkuFunctionSessionless<{
+    branch: string;
+    hours?: number | undefined;
+    function?: string | undefined;
+    json?: boolean | undefined;
+}, {
+    count: number;
+}, "rpc" | "session", import("../../../types/application-types.js").Services> | import("../../../.pikku/pikku-types.gen.js").PikkuFunction<{
+    branch: string;
+    hours?: number | undefined;
+    function?: string | undefined;
+    json?: boolean | undefined;
+}, {
+    count: number;
+}, "rpc" | "session", import("../../../types/application-types.js").Services>, undefined, undefined>;

package/dist/src/fabric/functions/metrics.function.js

@@ -0,0 +1,49 @@
+import { z } from 'zod';
+import { pikkuSessionlessFunc } from '../../../.pikku/pikku-types.gen.js';
+import { resolveApiContext } from '../lib/config.js';
+import { getFabricRPC } from '../lib/http.js';
+export const FabricMetricsInput = z.object({
+    branch: z.string(),
+    hours: z.number().optional(),
+    function: z.string().optional(),
+    json: z.boolean().optional(),
+});
+export const FabricMetricsOutput = z.object({ count: z.number() });
+function formatRow(row) {
+    const errRate = row.requests > 0 ? ((row.errors / row.requests) * 100).toFixed(1) : '0.0';
+    return `${row.timestamp}  reqs=${String(row.requests).padStart(5)}  err=${String(row.errors).padStart(4)} (${errRate}%)  avg=${row.avgDuration.toFixed(0)}ms  min=${row.minDuration.toFixed(0)}ms  max=${row.maxDuration.toFixed(0)}ms`;
+}
+export const FabricMetrics = pikkuSessionlessFunc({
+    description: 'Fetch aggregated request metrics for a stage via fabric-api.',
+    input: FabricMetricsInput,
+    output: FabricMetricsOutput,
+    func: async (_services, { branch, hours, function: functionName, json }) => {
+        const ctx = await resolveApiContext();
+        if (!ctx.token)
+            throw new Error('Not logged in. Run `pikku fabric login` first.');
+        if (!ctx.projectId)
+            throw new Error('No fabric project linked. Run `pikku fabric link` first.');
+        const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
+        const res = await rpc.invoke('getProjectMetricsByStageKind', {
+            projectId: ctx.projectId,
+            branch,
+            hours,
+            functionName,
+        });
+        if (json) {
+            const wireTypes = Object.fromEntries((res.wireTypes ?? []).map((r) => [
+                r.wireType,
+                r.requests,
+            ]));
+            console.log(JSON.stringify({ branch, metrics: res.metrics, wireTypes }, null, 2));
+        }
+        else if (res.metrics.length === 0) {
+            console.log(`[fabric] no metrics for ${branch} in the last ${hours ?? 24}h`);
+        }
+        else {
+            for (const row of res.metrics)
+                console.log(formatRow(row));
+        }
+        return { count: res.metrics.length };
+    },
+});

package/dist/src/fabric/functions/rollback.function.d.ts

@@ -0,0 +1,76 @@
+import { z } from 'zod';
+export declare const FabricRollbackInput: z.ZodObject<{
+    branch: z.ZodString;
+    target: z.ZodOptional<z.ZodString>;
+    list: z.ZodOptional<z.ZodBoolean>;
+    dryRun: z.ZodOptional<z.ZodBoolean>;
+    yes: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const FabricRollbackOutput: z.ZodObject<{
+    deploymentId: z.ZodOptional<z.ZodString>;
+    rolledBackToDeploymentId: z.ZodOptional<z.ZodString>;
+    candidates: z.ZodArray<z.ZodObject<{
+        deploymentId: z.ZodString;
+        gitSha: z.ZodNullable<z.ZodString>;
+        artifactHash: z.ZodNullable<z.ZodString>;
+        deployedAt: z.ZodNullable<z.ZodString>;
+        versionMajor: z.ZodNumber;
+        versionMinor: z.ZodNumber;
+        versionPatch: z.ZodNumber;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const FabricRollback: import("../../../.pikku/pikku-types.gen.js").PikkuFunctionConfig<{
+    branch: string;
+    target?: string | undefined;
+    list?: boolean | undefined;
+    dryRun?: boolean | undefined;
+    yes?: boolean | undefined;
+}, {
+    candidates: {
+        deploymentId: string;
+        gitSha: string | null;
+        artifactHash: string | null;
+        deployedAt: string | null;
+        versionMajor: number;
+        versionMinor: number;
+        versionPatch: number;
+    }[];
+    deploymentId?: string | undefined;
+    rolledBackToDeploymentId?: string | undefined;
+}, "rpc" | "session", import("../../../.pikku/pikku-types.gen.js").PikkuFunctionSessionless<{
+    branch: string;
+    target?: string | undefined;
+    list?: boolean | undefined;
+    dryRun?: boolean | undefined;
+    yes?: boolean | undefined;
+}, {
+    candidates: {
+        deploymentId: string;
+        gitSha: string | null;
+        artifactHash: string | null;
+        deployedAt: string | null;
+        versionMajor: number;
+        versionMinor: number;
+        versionPatch: number;
+    }[];
+    deploymentId?: string | undefined;
+    rolledBackToDeploymentId?: string | undefined;
+}, "rpc" | "session", import("../../../types/application-types.js").Services> | import("../../../.pikku/pikku-types.gen.js").PikkuFunction<{
+    branch: string;
+    target?: string | undefined;
+    list?: boolean | undefined;
+    dryRun?: boolean | undefined;
+    yes?: boolean | undefined;
+}, {
+    candidates: {
+        deploymentId: string;
+        gitSha: string | null;
+        artifactHash: string | null;
+        deployedAt: string | null;
+        versionMajor: number;
+        versionMinor: number;
+        versionPatch: number;
+    }[];
+    deploymentId?: string | undefined;
+    rolledBackToDeploymentId?: string | undefined;
+}, "rpc" | "session", import("../../../types/application-types.js").Services>, undefined, undefined>;

package/dist/src/fabric/functions/rollback.function.js

@@ -0,0 +1,69 @@
+import { z } from 'zod';
+import { pikkuSessionlessFunc } from '../../../.pikku/pikku-types.gen.js';
+import { resolveApiContext } from '../lib/config.js';
+import { getFabricRPC } from '../lib/http.js';
+export const FabricRollbackInput = z.object({
+    branch: z.string(),
+    target: z.string().optional(),
+    list: z.boolean().optional(),
+    dryRun: z.boolean().optional(),
+    yes: z.boolean().optional(),
+});
+export const FabricRollbackOutput = z.object({
+    deploymentId: z.string().optional(),
+    rolledBackToDeploymentId: z.string().optional(),
+    candidates: z.array(z.object({
+        deploymentId: z.string(),
+        gitSha: z.string().nullable(),
+        artifactHash: z.string().nullable(),
+        deployedAt: z.string().nullable(),
+        versionMajor: z.number(),
+        versionMinor: z.number(),
+        versionPatch: z.number(),
+    })),
+});
+export const FabricRollback = pikkuSessionlessFunc({
+    description: 'Roll live production back to a previous deployment artifact, gated by schema-snapshot compatibility.',
+    input: FabricRollbackInput,
+    output: FabricRollbackOutput,
+    func: async (_services, { target, list, dryRun }) => {
+        const ctx = await resolveApiContext();
+        if (!ctx.token)
+            throw new Error('Not logged in. Run `pikku fabric login` first.');
+        if (!ctx.projectId)
+            throw new Error('No fabric project linked. Run `pikku fabric link` first.');
+        const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
+        // --list (or no target) → just show candidates.
+        if (list || !target) {
+            const result = await rpc.invoke('rollbackDeployment', {
+                projectId: ctx.projectId,
+            });
+            if (result.candidates.length === 0) {
+                console.log('[fabric] no rollback candidates available');
+            }
+            else {
+                console.log('[fabric] rollback candidates (newest first):');
+                for (const c of result.candidates) {
+                    const v = `v${c.versionMajor}.${c.versionMinor}.${c.versionPatch}`;
+                    const sha = c.gitSha ? c.gitSha.slice(0, 8) : '—';
+                    console.log(`  ${c.deploymentId}  ${v}  sha=${sha}  ${c.deployedAt ?? '—'}`);
+                }
+            }
+            return { candidates: result.candidates };
+        }
+        if (dryRun) {
+            console.log(`[fabric] dry-run: would roll back live → ${target}`);
+            return { candidates: [] };
+        }
+        const result = await rpc.invoke('rollbackDeployment', {
+            projectId: ctx.projectId,
+            target,
+        });
+        console.log(`[fabric] rollback queued: new live=${result.deploymentId} (artifact from ${result.rolledBackToDeploymentId})`);
+        return {
+            deploymentId: result.deploymentId,
+            rolledBackToDeploymentId: result.rolledBackToDeploymentId,
+            candidates: result.candidates,
+        };
+    },
+});

package/dist/src/fabric/functions/secrets-list.function.d.ts

@@ -0,0 +1,24 @@
+import { z } from 'zod';
+export declare const FabricSecretsListInput: z.ZodObject<{
+    branch: z.ZodString;
+    json: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const FabricSecretsListOutput: z.ZodObject<{
+    names: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export declare const FabricSecretsList: import("../../../.pikku/pikku-types.gen.js").PikkuFunctionConfig<{
+    branch: string;
+    json?: boolean | undefined;
+}, {
+    names: string[];
+}, "rpc" | "session", import("../../../.pikku/pikku-types.gen.js").PikkuFunctionSessionless<{
+    branch: string;
+    json?: boolean | undefined;
+}, {
+    names: string[];
+}, "rpc" | "session", import("../../../types/application-types.js").Services> | import("../../../.pikku/pikku-types.gen.js").PikkuFunction<{
+    branch: string;
+    json?: boolean | undefined;
+}, {
+    names: string[];
+}, "rpc" | "session", import("../../../types/application-types.js").Services>, undefined, undefined>;

package/dist/src/fabric/functions/secrets-list.function.js

@@ -0,0 +1,37 @@
+import { z } from 'zod';
+import { pikkuSessionlessFunc } from '../../../.pikku/pikku-types.gen.js';
+import { resolveApiContext } from '../lib/config.js';
+import { getFabricRPC } from '../lib/http.js';
+export const FabricSecretsListInput = z.object({
+    branch: z.string(),
+    json: z.boolean().optional(),
+});
+export const FabricSecretsListOutput = z.object({ names: z.array(z.string()) });
+export const FabricSecretsList = pikkuSessionlessFunc({
+    description: 'List secret names visible to a stage (values never leave the server).',
+    input: FabricSecretsListInput,
+    output: FabricSecretsListOutput,
+    func: async (_services, { branch, json }) => {
+        const ctx = await resolveApiContext();
+        if (!ctx.token)
+            throw new Error('Not logged in. Run `pikku fabric login` first.');
+        if (!ctx.projectId)
+            throw new Error('No fabric project linked. Run `pikku fabric link` first.');
+        const rpc = getFabricRPC({ apiUrl: ctx.apiUrl, token: ctx.token });
+        const result = await rpc.invoke('listStageSecrets', {
+            projectId: ctx.projectId,
+            branch,
+        });
+        if (json) {
+            console.log(JSON.stringify({ branch, names: result.names }, null, 2));
+        }
+        else if (result.names.length === 0) {
+            console.log(`[fabric] no secrets set on ${branch}`);
+        }
+        else {
+            for (const name of result.names)
+                console.log(name);
+        }
+        return result;
+    },
+});