@pikku/core 0.12.106 → 0.12.111

package/dist/wirings/flag/cached-flag-source.js

@@ -0,0 +1,96 @@
+import { compiledFallbackSnapshot } from './validate-flag-definitions.js';
+const DEFAULT_TTL_MS = 30_000;
+/**
+ * The caching every flag source needs, so no adapter has to get it right twice.
+ *
+ * Three layers, in descending order of truth: a fresh read, the last good read,
+ * and the compiled declaration. The middle layer is the one that matters —
+ * dropping straight to the compiled fallback on a blip would switch on every
+ * flag an operator had deliberately left off, which is the opposite of what a
+ * dark launch is for. The compiled fallback is reached only on a cold start
+ * that has never managed a read, where there is nothing better to say.
+ *
+ * Refresh is pull-on-demand rather than a background poller on purpose. A
+ * poller assumes a long-lived process; an isolate on a serverless runtime is
+ * neither long-lived nor allowed to hold a timer between requests, so a vendor
+ * SDK built around one either never refreshes or leaks. Fetching inside the
+ * request that noticed the snapshot was stale works in both places.
+ */
+export class CachedFlagSource {
+    cached;
+    cachedAt = 0;
+    inflight;
+    /**
+     * Bumped by every `invalidate()`. A read that started before the signal
+     * arrived carries the generation it started in, and stores nothing if that
+     * generation is no longer current — otherwise a webhook that landed
+     * mid-fetch would be answered by the pre-webhook snapshot, stamped fresh,
+     * and the kill switch would sit stale for another whole TTL.
+     */
+    generation = 0;
+    fallback;
+    declared;
+    ttlMs;
+    constructor(options = {}) {
+        this.ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
+        this.declared = options.declared ?? [];
+        this.fallback = compiledFallbackSnapshot(this.declared);
+    }
+    /** Replaces the cold-start fallback, once the declared set is known. */
+    setDeclared(declared) {
+        this.declared = declared;
+        this.fallback = compiledFallbackSnapshot(declared);
+    }
+    declaredFlags() {
+        return this.declared;
+    }
+    /**
+     * Drops the cache, so the next read goes to the store.
+     *
+     * Public because the signal usually arrives from outside: PostHog and Unleash
+     * both emit a webhook on a flag change, and an HTTP wiring that receives one
+     * calls this to cut the kill-switch latency from the TTL to delivery time. A
+     * LaunchDarkly stream is the same call from a held-open connection rather
+     * than a request.
+     *
+     * It does not fetch. An eager refetch makes a burst of webhooks N round
+     * trips, and on a serverless runtime the isolate that received the signal may
+     * be gone before anything reads the result. The request that next notices the
+     * cache is empty pays for the read, and it is the one that needs it.
+     */
+    invalidate() {
+        this.cachedAt = 0;
+        this.generation++;
+        this.inflight = undefined;
+    }
+    async snapshot() {
+        if (this.cached && Date.now() - this.cachedAt < this.ttlMs) {
+            return this.cached;
+        }
+        if (!this.inflight) {
+            const generation = this.generation;
+            const read = this.fetchSnapshot().then((snapshot) => {
+                if (generation === this.generation) {
+                    this.cached = snapshot;
+                    this.cachedAt = Date.now();
+                    if (this.inflight === read) {
+                        this.inflight = undefined;
+                    }
+                }
+                return snapshot;
+            });
+            read.catch(() => {
+                if (this.inflight === read) {
+                    this.inflight = undefined;
+                }
+            });
+            this.inflight = read;
+        }
+        try {
+            return await this.inflight;
+        }
+        catch {
+            return this.cached ?? this.fallback;
+        }
+    }
+}

package/dist/wirings/flag/define-feature-flags.d.ts

@@ -0,0 +1,33 @@
+import type { CoreFeatureFlags } from './flag.types.js';
+/**
+ * No-op function for declaring feature flags.
+ * This exists purely for TypeScript type checking and will be tree-shaken.
+ * The CLI extracts metadata via AST parsing and generates a `FeatureFlagName`
+ * union, so `flags.calList` is a compile error rather than a silent `false`.
+ *
+ * That typing is load-bearing rather than a convenience: flags fail closed, so
+ * a typo'd flag reads `false`, hides its feature permanently, and leaves every
+ * test, screenshot and gate green. An untyped key makes a missing product
+ * indistinguishable from a working one.
+ *
+ * Removal is deliberately not destructive. Deleting a declaration leaves the
+ * row in the store, marked undeclared and inert, until `pikku flags prune` —
+ * the same additive contract `defineScope` and `defineSystemRole` have, and for
+ * the same reason: a mid-deploy revocation is not something a code edit should
+ * be able to cause.
+ *
+ * @example
+ * ```typescript
+ * defineFeatureFlags({
+ *   takeInBike: {
+ *     description: 'Book a bike in at the counter',
+ *     anyOf: ['bikes:intake'],
+ *   },
+ *   aiAssistant: {
+ *     description: 'The assistant panel',
+ *     // no anyOf — the switch is the whole answer
+ *   },
+ * })
+ * ```
+ */
+export declare const defineFeatureFlags: (_config: CoreFeatureFlags) => void;

package/dist/wirings/flag/define-feature-flags.js

@@ -0,0 +1,32 @@
+/**
+ * No-op function for declaring feature flags.
+ * This exists purely for TypeScript type checking and will be tree-shaken.
+ * The CLI extracts metadata via AST parsing and generates a `FeatureFlagName`
+ * union, so `flags.calList` is a compile error rather than a silent `false`.
+ *
+ * That typing is load-bearing rather than a convenience: flags fail closed, so
+ * a typo'd flag reads `false`, hides its feature permanently, and leaves every
+ * test, screenshot and gate green. An untyped key makes a missing product
+ * indistinguishable from a working one.
+ *
+ * Removal is deliberately not destructive. Deleting a declaration leaves the
+ * row in the store, marked undeclared and inert, until `pikku flags prune` —
+ * the same additive contract `defineScope` and `defineSystemRole` have, and for
+ * the same reason: a mid-deploy revocation is not something a code edit should
+ * be able to cause.
+ *
+ * @example
+ * ```typescript
+ * defineFeatureFlags({
+ *   takeInBike: {
+ *     description: 'Book a bike in at the counter',
+ *     anyOf: ['bikes:intake'],
+ *   },
+ *   aiAssistant: {
+ *     description: 'The assistant panel',
+ *     // no anyOf — the switch is the whole answer
+ *   },
+ * })
+ * ```
+ */
+export const defineFeatureFlags = (_config) => { };

package/dist/wirings/flag/flag.types.d.ts

@@ -0,0 +1,97 @@
+/**
+ * A feature flag: a UI-facing name a client can ask about without knowing
+ * anything about the capability vocabulary.
+ *
+ * The flag is the indirection that keeps scopes a server concern. Returning
+ * `session.scopes` to the client would work and is wrong three times over: it
+ * publishes the vocabulary to every screen, it makes a scope rename a frontend
+ * refactor, and it forces each call site to reimplement parent-grant
+ * resolution — which some will get wrong in the permissive direction.
+ */
+export type CoreFeatureFlag = {
+    /** Surfaced in the console beside the switch. */
+    description?: string;
+    /**
+     * The session satisfies this flag by holding ANY of these — deliberately the
+     * opposite of `scopes:`, which is AND, because a flag usually reveals one
+     * entry point several roles can reach. Named `anyOf` and not `scopes` so the
+     * inverted semantics are visible at the call site.
+     *
+     * Every id must be declared with `defineScope`; the inspector fails the
+     * build otherwise, the same rule `defineSystemRole` already enforces.
+     *
+     * Omitted means no capability constraint — NOT "always on". The switch,
+     * the rollout bucket and any override still apply, which is what makes a
+     * flag usable as a pure kill switch. An explicit `anyOf: []` is a
+     * declaration error: write no key, or write scopes.
+     */
+    anyOf?: string[];
+};
+/**
+ * Feature flags to declare, keyed by name. A key must be non-empty and must
+ * not contain `:` — that separator belongs to scopes, and a flag that looks
+ * like a scope id invites exactly the confusion this exists to prevent.
+ */
+export type CoreFeatureFlags = Record<string, CoreFeatureFlag>;
+export type FeatureFlagDefinitionMeta = {
+    name: string;
+    description?: string;
+    anyOf?: string[];
+    sourceFile?: string;
+};
+export type FeatureFlagDefinitions = FeatureFlagDefinitionMeta[];
+export type FeatureFlagDefinitionsMeta = Record<string, FeatureFlagDefinitionMeta>;
+/** A declared flag, ready to sync into a flag store. */
+export type DeclaredFlag = {
+    name: string;
+    description?: string;
+    anyOf?: string[];
+};
+/**
+ * Who a rollout bucket and an override are keyed on.
+ *
+ * The organization is preferred over the user wherever both are known: two
+ * colleagues on a screen-share seeing different UIs is a support ticket.
+ */
+export type FlagSubject = {
+    organizationId?: string;
+    userId?: string;
+};
+/** The runtime half of one flag: what an operator set, not what code declared. */
+export type FlagConfig = {
+    enabled: boolean;
+    /** 0–100, or null for no rollout constraint. */
+    rolloutPercent: number | null;
+    /**
+     * Per-subject short-circuits, keyed by subject id. The one genuine OR in the
+     * model: "off for everyone, but these three orgs see it." An override wins
+     * over both the switch and the bucket, in either direction, so QA can enter a
+     * 5% rollout and a single tenant can be excluded from a bad one.
+     */
+    overrides: Record<string, boolean>;
+};
+/**
+ * The global config half, keyed by flag name. One small blob shared by every
+ * user, which is why it is not baked into the session: writing it per-session
+ * would make killing a feature an unbounded fan-out over every active session,
+ * with users on both sides of the flip for its duration.
+ */
+export type FlagConfigSnapshot = Record<string, FlagConfig>;
+/**
+ * A flag resolves to two booleans, not one. One bit cannot distinguish "you may
+ * not" (a 403, the caller's own situation) from "nobody may right now" (a 503,
+ * ours) — and collapsing them is what leaves a kill switch with nothing to
+ * enforce.
+ */
+export type FlagState = {
+    /** The feature is switched on at all. Global, caller-blind, and the only half
+     *  the runner enforces. */
+    available: boolean;
+    /** This session holds a satisfying scope. Advisory to the client; hides UI and
+     *  protects nothing, forever. */
+    capable: boolean;
+};
+/** What a client renders on. */
+export type ResolvedFlag = FlagState & {
+    show: boolean;
+};

package/dist/wirings/flag/flag.types.js

@@ -0,0 +1 @@
+export {};

package/dist/wirings/flag/index.d.ts

@@ -0,0 +1,7 @@
+export { CachedFlagSource } from './cached-flag-source.js';
+export type { CachedFlagSourceOptions } from './cached-flag-source.js';
+export { assertFeatureAvailable } from './assert-feature-available.js';
+export { defineFeatureFlags } from './define-feature-flags.js';
+export { bucketOf, resolveFlag, resolveFlagForClient, resolveFlagsForClient, subjectIdOf, } from './resolve-flag.js';
+export { compiledFallbackSnapshot, flattenFeatureFlagDefinitions, validateAndBuildFeatureFlagDefinitionsMeta, } from './validate-flag-definitions.js';
+export type { CoreFeatureFlag, CoreFeatureFlags, DeclaredFlag, FeatureFlagDefinitionMeta, FeatureFlagDefinitions, FeatureFlagDefinitionsMeta, FlagConfig, FlagConfigSnapshot, FlagState, FlagSubject, ResolvedFlag, } from './flag.types.js';

package/dist/wirings/flag/index.js

@@ -0,0 +1,5 @@
+export { CachedFlagSource } from './cached-flag-source.js';
+export { assertFeatureAvailable } from './assert-feature-available.js';
+export { defineFeatureFlags } from './define-feature-flags.js';
+export { bucketOf, resolveFlag, resolveFlagForClient, resolveFlagsForClient, subjectIdOf, } from './resolve-flag.js';
+export { compiledFallbackSnapshot, flattenFeatureFlagDefinitions, validateAndBuildFeatureFlagDefinitionsMeta, } from './validate-flag-definitions.js';

package/dist/wirings/flag/resolve-flag.d.ts

@@ -0,0 +1,52 @@
+import type { CoreUserSession } from '../../types/core.types.js';
+import type { DeclaredFlag, FlagConfigSnapshot, FlagState, FlagSubject, ResolvedFlag } from './flag.types.js';
+/**
+ * FNV-1a over `${flag}:${subject}`.
+ *
+ * Salted by flag key so two flags at 50% do not select the same half and
+ * concurrent rollouts stay independent. Sync and non-crypto on purpose:
+ * WebCrypto's digest is async and this runs inside resolution, which does no
+ * I/O and cannot await.
+ */
+export declare const bucketOf: (flag: string, subject: string) => number;
+/**
+ * The subject a bucket and an override are keyed on.
+ *
+ * Organization first: a percentage rollout that splits colleagues inside one
+ * account is a support ticket, not an experiment.
+ */
+export declare const subjectIdOf: (subject: FlagSubject | undefined) => string | undefined;
+/**
+ * Resolves one flag from the session and the config snapshot. Pure, sync, and
+ * the only thing on the request path — the I/O is the snapshot read, which the
+ * caller has already done and which implementations cache.
+ *
+ * `subject` is passed explicitly rather than read off the session because the
+ * subject is not always in one: a queue worker, a cron task or a workflow step
+ * knows its organization from its input, and resolving those against no subject
+ * would skip every per-org override and deny an org that was explicitly
+ * granted. Where it is omitted the session is used.
+ *
+ * A flag absent from the snapshot fails OPEN on availability, falling back to
+ * the declaration compiled into the bundle. Treating an unreadable config as
+ * everything-off turns a transient store blip into a total outage of your own
+ * product. It is safe only because `capable` comes from the session and
+ * `scopes:` is untouched, so failing open cannot expose anything the caller was
+ * not already authorized for.
+ */
+export declare const resolveFlag: (key: string, anyOf: readonly string[] | undefined, session: CoreUserSession | undefined, config: FlagConfigSnapshot, subject?: FlagSubject) => FlagState;
+/** {@link resolveFlag} plus the `show` a client renders on. */
+export declare const resolveFlagForClient: (key: string, anyOf: readonly string[] | undefined, session: CoreUserSession | undefined, config: FlagConfigSnapshot, subject?: FlagSubject) => ResolvedFlag;
+/**
+ * Every declared flag resolved for one caller, as a client consumes them.
+ *
+ * A client asks once per session and reads the map synchronously after, rather
+ * than asking per flag: a flag is checked wherever a component renders, and a
+ * request from each would put the network in front of a paint. The snapshot is
+ * already in isolate memory, so this is a map over a cached object.
+ *
+ * Bare booleans, not `FlagState`. `show` is the collapse of the two halves, and
+ * sending them apart would tell a client which features exist but are dark —
+ * a roadmap nobody meant to publish.
+ */
+export declare const resolveFlagsForClient: (declared: readonly DeclaredFlag[], session: CoreUserSession | undefined, config: FlagConfigSnapshot, subject?: FlagSubject) => Record<string, boolean>;

package/dist/wirings/flag/resolve-flag.js

@@ -0,0 +1,90 @@
+import { hasAnyScope } from '../../scopes.js';
+/**
+ * FNV-1a over `${flag}:${subject}`.
+ *
+ * Salted by flag key so two flags at 50% do not select the same half and
+ * concurrent rollouts stay independent. Sync and non-crypto on purpose:
+ * WebCrypto's digest is async and this runs inside resolution, which does no
+ * I/O and cannot await.
+ */
+export const bucketOf = (flag, subject) => {
+    let h = 0x811c9dc5;
+    const s = `${flag}:${subject}`;
+    for (let i = 0; i < s.length; i++) {
+        h ^= s.charCodeAt(i);
+        h = Math.imul(h, 0x01000193) >>> 0;
+    }
+    return h % 10_000;
+};
+/**
+ * The subject a bucket and an override are keyed on.
+ *
+ * Organization first: a percentage rollout that splits colleagues inside one
+ * account is a support ticket, not an experiment.
+ */
+export const subjectIdOf = (subject) => {
+    const usable = (id) => id === undefined || id === '' ? undefined : id;
+    return usable(subject?.organizationId) ?? usable(subject?.userId);
+};
+/**
+ * Resolves one flag from the session and the config snapshot. Pure, sync, and
+ * the only thing on the request path — the I/O is the snapshot read, which the
+ * caller has already done and which implementations cache.
+ *
+ * `subject` is passed explicitly rather than read off the session because the
+ * subject is not always in one: a queue worker, a cron task or a workflow step
+ * knows its organization from its input, and resolving those against no subject
+ * would skip every per-org override and deny an org that was explicitly
+ * granted. Where it is omitted the session is used.
+ *
+ * A flag absent from the snapshot fails OPEN on availability, falling back to
+ * the declaration compiled into the bundle. Treating an unreadable config as
+ * everything-off turns a transient store blip into a total outage of your own
+ * product. It is safe only because `capable` comes from the session and
+ * `scopes:` is untouched, so failing open cannot expose anything the caller was
+ * not already authorized for.
+ */
+export const resolveFlag = (key, anyOf, session, config, subject) => {
+    const capable = anyOf === undefined ? true : hasAnyScope(anyOf, session?.scopes);
+    const row = config[key];
+    if (!row) {
+        return { available: true, capable };
+    }
+    const id = subjectIdOf(subject) ??
+        subjectIdOf({ organizationId: session?.orgId, userId: session?.userId });
+    const override = id === undefined ? undefined : row.overrides[id];
+    if (override !== undefined) {
+        return { available: override, capable };
+    }
+    // No subject skips the bucket rather than failing it. A sessionless caller
+    // has nothing to hash, and hashing a constant would put every cron run in one
+    // bucket — making a 10% rollout either 0% or 100% of background work at
+    // random. A percentage is a statement about users; background work is either
+    // on or off.
+    const inBucket = row.rolloutPercent === null || id === undefined
+        ? true
+        : bucketOf(key, id) < Math.round(row.rolloutPercent * 100);
+    return { available: row.enabled && inBucket, capable };
+};
+/** {@link resolveFlag} plus the `show` a client renders on. */
+export const resolveFlagForClient = (key, anyOf, session, config, subject) => {
+    const state = resolveFlag(key, anyOf, session, config, subject);
+    return { ...state, show: state.available && state.capable };
+};
+/**
+ * Every declared flag resolved for one caller, as a client consumes them.
+ *
+ * A client asks once per session and reads the map synchronously after, rather
+ * than asking per flag: a flag is checked wherever a component renders, and a
+ * request from each would put the network in front of a paint. The snapshot is
+ * already in isolate memory, so this is a map over a cached object.
+ *
+ * Bare booleans, not `FlagState`. `show` is the collapse of the two halves, and
+ * sending them apart would tell a client which features exist but are dark —
+ * a roadmap nobody meant to publish.
+ */
+export const resolveFlagsForClient = (declared, session, config, subject) => Object.fromEntries(declared.map((flag) => [
+    flag.name,
+    resolveFlagForClient(flag.name, flag.anyOf, session, config, subject)
+        .show,
+]));

package/dist/wirings/flag/validate-flag-definitions.d.ts

@@ -0,0 +1,26 @@
+import type { DeclaredFlag, FeatureFlagDefinitions, FeatureFlagDefinitionsMeta, FlagConfigSnapshot } from './flag.types.js';
+/**
+ * The declared flags as a flat list, deduplicated by name.
+ *
+ * A flag may legitimately be declared more than once — an addon and its host
+ * app both contributing one — and
+ * {@link validateAndBuildFeatureFlagDefinitionsMeta} has already guaranteed
+ * those declarations are identical.
+ */
+export declare const flattenFeatureFlagDefinitions: (definitions: FeatureFlagDefinitions) => DeclaredFlag[];
+/**
+ * Validates declared flags and keys them by name.
+ *
+ * Definitions sharing a name must name the same scope set; a conflicting
+ * redeclaration is a hard error naming both source files. Order within `anyOf`
+ * is not significant.
+ */
+export declare function validateAndBuildFeatureFlagDefinitionsMeta(definitions: FeatureFlagDefinitions): FeatureFlagDefinitionsMeta;
+/**
+ * The snapshot a flag source falls back to when its store cannot be read: every
+ * declared flag on, no rollout, no overrides.
+ *
+ * This is the compiled declaration, not a database read — putting a fallback
+ * query on the request path is how a slow store becomes a slow product.
+ */
+export declare const compiledFallbackSnapshot: (flags: readonly DeclaredFlag[]) => FlagConfigSnapshot;

package/dist/wirings/flag/validate-flag-definitions.js

@@ -0,0 +1,103 @@
+const SEPARATOR = ':';
+/**
+ * Names that already exist on every object literal. Declaring one makes the
+ * meta lookup below find `Object.prototype`'s member, treat the flag as
+ * already declared, and drop it — a flag that validated but never reached the
+ * snapshot, which is the one failure a typed flag key exists to prevent.
+ */
+const INHERITED_NAMES = new Set(['__proto__', 'constructor', 'prototype']);
+const assertFlagName = (name) => {
+    if (name.length === 0) {
+        throw new Error('A feature flag is declared with an empty name.');
+    }
+    if (INHERITED_NAMES.has(name)) {
+        throw new Error(`Feature flag '${name}' is named after a property every object already ` +
+            `carries, so it cannot be told apart from one. Pick another name.`);
+    }
+    if (name.includes(SEPARATOR)) {
+        throw new Error(`Feature flag '${name}' contains the '${SEPARATOR}' separator. ` +
+            `'${SEPARATOR}' delimits scope ids; a flag named like a scope reads as one.`);
+    }
+};
+/**
+ * The declared flags as a flat list, deduplicated by name.
+ *
+ * A flag may legitimately be declared more than once — an addon and its host
+ * app both contributing one — and
+ * {@link validateAndBuildFeatureFlagDefinitionsMeta} has already guaranteed
+ * those declarations are identical.
+ */
+export const flattenFeatureFlagDefinitions = (definitions) => {
+    const seen = new Set();
+    const out = [];
+    for (const def of definitions) {
+        if (seen.has(def.name)) {
+            continue;
+        }
+        seen.add(def.name);
+        out.push({
+            name: def.name,
+            description: def.description,
+            anyOf: def.anyOf ? [...def.anyOf] : undefined,
+        });
+    }
+    return out;
+};
+/**
+ * Validates declared flags and keys them by name.
+ *
+ * Definitions sharing a name must name the same scope set; a conflicting
+ * redeclaration is a hard error naming both source files. Order within `anyOf`
+ * is not significant.
+ */
+export function validateAndBuildFeatureFlagDefinitionsMeta(definitions) {
+    const meta = {};
+    for (const def of definitions) {
+        assertFlagName(def.name);
+        if (def.anyOf && def.anyOf.length === 0) {
+            throw new Error(`Feature flag '${def.name}' declares 'anyOf: []'. ` +
+                `An empty list satisfies nobody, which is never what is meant: ` +
+                `omit 'anyOf' for a pure switch, or name the scopes that reveal it.`);
+        }
+        const existing = meta[def.name];
+        if (existing) {
+            const sameScopes = JSON.stringify([...(existing.anyOf ?? [])].sort()) ===
+                JSON.stringify([...(def.anyOf ?? [])].sort());
+            if (!sameScopes) {
+                throw new Error(`Feature flag '${def.name}' is declared with different scopes.\n` +
+                    `  First declaration: ${existing.sourceFile ?? 'unknown'}\n` +
+                    `  Second declaration: ${def.sourceFile ?? 'unknown'}\n` +
+                    `Flags sharing a name must name the same scopes.`);
+            }
+            // The description is what an operator reads beside the switch, and the
+            // winner here is whichever file the inspector walked first. Two
+            // descriptions for one flag is a disagreement about what the switch
+            // does, and source order is not the thing that should settle it.
+            if (existing.description !== def.description) {
+                throw new Error(`Feature flag '${def.name}' is declared with different descriptions.\n` +
+                    `  First declaration: ${existing.sourceFile ?? 'unknown'}\n` +
+                    `  Second declaration: ${def.sourceFile ?? 'unknown'}\n` +
+                    `Flags sharing a name must describe the same thing.`);
+            }
+            continue;
+        }
+        meta[def.name] = {
+            name: def.name,
+            description: def.description,
+            anyOf: def.anyOf ? [...def.anyOf] : undefined,
+            sourceFile: def.sourceFile,
+        };
+    }
+    return meta;
+}
+/**
+ * The snapshot a flag source falls back to when its store cannot be read: every
+ * declared flag on, no rollout, no overrides.
+ *
+ * This is the compiled declaration, not a database read — putting a fallback
+ * query on the request path is how a slow store becomes a slow product.
+ */
+export const compiledFallbackSnapshot = (flags) => Object.fromEntries(flags.map((flag) => [
+    flag.name,
+    { enabled: true, rolloutPercent: null, overrides: {} },
+]));

package/dist/wirings/rpc/rpc-runner.js

@@ -121,6 +121,9 @@ export class ContextAwareRPCService {
             functionMeta = pikkuState(resolved.packageName, 'function', 'meta')[resolved.pikkuFuncId];
         }
         if (!functionMeta) {
+            if (funcName.includes(':') && this.services.deploymentService) {
+                return await this.rpc(funcName, data);
+            }
             throw new RPCNotFoundError(funcName);
         }
         if (!functionMeta.expose || functionMeta.scenarioStep) {

package/dist/wirings/virtual-user/virtual-user-scaffold.d.ts

@@ -38,9 +38,9 @@ export declare const VIRTUAL_USER_VARIABLES: {
      * and a server that cannot name its own public URL would be signing in
      * somewhere it only assumed was itself.
      */
-    readonly apiUrl: "VIRTUAL_USER_API_URL";
-    readonly secret: "SCENARIO_ACTOR_SECRET";
-    readonly model: "VIRTUAL_USER_MODEL";
+    readonly apiUrl: 'VIRTUAL_USER_API_URL';
+    readonly secret: 'SCENARIO_ACTOR_SECRET';
+    readonly model: 'VIRTUAL_USER_MODEL';
     /**
      * The same two variables a scenario run reads, because a virtual user signs
      * in and calls through exactly the doors a scenario does. An app that mounts
@@ -48,15 +48,15 @@ export declare const VIRTUAL_USER_VARIABLES: {
      * other way to say so, and without them the run signs in against a 404 and
      * spends its whole budget thinking about why nothing works.
      */
-    readonly signInPath: "SCENARIO_SIGN_IN_PATH";
-    readonly rpcPath: "SCENARIO_RPC_PATH";
+    readonly signInPath: 'SCENARIO_SIGN_IN_PATH';
+    readonly rpcPath: 'SCENARIO_RPC_PATH';
     /**
      * The deployed way in. A Fabric operator token is asymmetric — a stage can
      * verify one and can never mint one — so unlike the actor secret it is safe
      * for a run against a real environment. Read from the environment only as the
      * fallback for a run nobody handed a token to, which is what a schedule is.
      */
-    readonly operatorToken: "FABRIC_OPERATOR_TOKEN";
+    readonly operatorToken: 'FABRIC_OPERATOR_TOKEN';
 };
 /**
  * Which door under the auth mount, given the credential in hand.
@@ -66,7 +66,7 @@ export declare const VIRTUAL_USER_VARIABLES: {
  * to `/api/auth` says so once and both paths follow. A path that names neither
  * plugin is left alone, since it was configured deliberately.
  */
-export declare const signInPathFor: (configured: string | undefined, plugin: "actor" | "fabric") => string | undefined;
+export declare const signInPathFor: (configured: string | undefined, plugin: 'actor' | 'fabric') => string | undefined;
 /**
  * The declared persona behind an id, refused unless it is one a run may be.
  *
@@ -130,7 +130,7 @@ export declare const serializeVirtualUserRun: (run: VirtualUserRunRecord) => {
     persona: string;
     disposition: VirtualUserDisposition;
     seed: number;
-    status: "failed" | "running" | "completed";
+    status: "completed" | "failed" | "running";
     goals: string[];
     memory: Record<string, string>;
     findings: {

package/dist/wirings/virtual-user/virtual-user-schedule.d.ts

@@ -31,7 +31,7 @@ export declare const isDue: (schedule: VirtualUserScheduleRecord, now: Date) =>
  * than rejected, because a schedule is configuration and a swapped pair is a
  * typo, not an attack.
  */
-export declare const nextRunAt: (schedule: Pick<VirtualUserScheduleRecord, "minIntervalMs" | "maxIntervalMs">, now: Date, random: () => number) => Date;
+export declare const nextRunAt: (schedule: Pick<VirtualUserScheduleRecord, 'minIntervalMs' | 'maxIntervalMs'>, now: Date, random: () => number) => Date;
 export type VirtualUserSkipReason = 'in-flight' | 'dispatch-failed' | 'claimed-elsewhere';
 export interface VirtualUserTickResult {
     dispatched: {

package/dist/wirings/workflow/workflow-queue-routing.d.ts

@@ -21,6 +21,6 @@ export declare const stepWorkerQueueName: (strategy: WorkflowQueueStrategy, rpcN
  * every step dispatch would pay for that — only a step that names a workflow
  * and has a queue to reach ever asks.
  */
-export declare const stepDispatchTarget: (rpcName: string, stepName: string, parentIsInline: () => Promise<boolean>) => Promise<"queue" | "inline">;
+export declare const stepDispatchTarget: (rpcName: string, stepName: string, parentIsInline: () => Promise<boolean>) => Promise<'queue' | 'inline'>;
 export declare const jobGroupFor: (strategy: WorkflowQueueStrategy, id?: string) => JobGroup | undefined;
 export declare const stepJobOptions: (stepOptions?: WorkflowStepOptions) => JobOptions;