Rayfin `functions` deploy fails: CLI emits TYPESCRIPT runtime but Fabric UDF service only accepts PYTHON

What happened?

The Rayfin functions service (client.functions.<name>.invoke()) is the only way to run server-side logic authenticated by the existing Rayfin app session — no separate Entra app registration, no admin consent. But it can't be deployed today, because the CLI and the Fabric service disagree on the runtime.

• @microsoft/rayfin-cli (verified through 1.33.2, latest) is TypeScript-only: rayfin functions init scaffolds src/function_app.ts; the deploy validator hard-requires src/function_app.ts; deploy metadata is derived from the TypeScript AST as runtime: 'TypeScript' (functions-metadata-generator.js). Even --functions-prebuilt still runs the TS validator + TS metadata generator.

• On rayfin up, the static app deploys fine, but the functions deploy is rejected by the service:

  400 FUNCSET_DEPLOY_FAILED
  UnsupportedArgument: "Runtime. Value: TYPESCRIPT is unsupported. Supported values are: PYTHON"
  

So the consent-free client.functions.invoke() channel has no deployable backend: the only runtime the CLI produces (TypeScript) is the only one the service refuses (Python-only).

Why it matters: in tenants that block user consent to non-"low" Entra permissions, the usual fallback — a standalone Python UDF invoked with a Power BI–audience token (UserDataFunction.Execute.All) — triggers a "Need admin approval" gate that can be unobtainable. The Rayfin functions channel would avoid this because it rides the existing Rayfin session. This is already acknowledged in microsoft/awesome-rayfin → templates/pbi-fixer/rayfin/rayfin.yml: "Rayfin (TypeScript) functions are disabled: the Fabric UDF backend does not yet accept the TYPESCRIPT runtime. The server-side logic runs in a separate standalone Python User Data Functions item instead."

Ask (any one unblocks it):

1. Enable the TypeScript UDF runtime server-side so the FuncSet deploy accepts what the CLI already emits (preferred — no app-author changes). Is there a GA date or a tenant/capacity preview flag?
2. Or add a Python authoring path to the Rayfin functions service so rayfin/functions/ can be Python and deploy into the appBackend FuncSet, keeping client.functions.invoke() consent-free.
3. Or document a supported way to invoke a standalone Python UDF through the Rayfin session (publishable-key auth) instead of a Power BI–audience token, so it stays consent-free in restrictive tenants.

Steps to reproduce

1. In a Rayfin app, set services.functions.enabled: true in rayfin/rayfin.yml.
2. npx rayfin functions init, then add udf.func('ping', async () => 'pong') in src/function_app.ts.
3. npx rayfin up --workspace-id <ws> --yes.
4. Static content deploys; the functions deploy fails with the 400 "Supported values are: PYTHON".

Environment

• Rayfin CLI: @microsoft/rayfin-cli 1.33.2 (also repro on 1.33.1)
• Node: 22.x
• OS: Windows
• Fabric: workspace on a UDF-capable capacity
• Tenant: blocks user consent to non-"low" Entra permissions

Logs or screenshots

400 FUNCSET_DEPLOY_FAILED -> UnsupportedArgument:
"Runtime. Value: TYPESCRIPT is unsupported. Supported values are: PYTHON"
(PowerBIApiErrorResponse, exceptionCulprit 1)