@pikku/addon-console 0.12.38 → 0.12.41

package/dist/.pikku/function/pikku-functions-meta-verbose.gen.json

@@ -27,14 +27,17 @@
       "AgentCredentialCheckOutput"
     ],
     "expose": true,
-    "implementationHash": "4ae243f8ce4235da",
+    "scopes": [
+      "pikku:console:credentials:read"
+    ],
+    "implementationHash": "2eb907cc29e4bbf1",
     "title": "Agent Credential Check",
     "description": "Checks which OAuth credentials an agent needs and whether the authenticated user has connected them.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/agent-credential-check.function.ts",
     "exportedName": "agentCredentialCheck",
-    "bodyStart": 26,
-    "bodyEnd": 73,
+    "bodyStart": 27,
+    "bodyEnd": 74,
     "contractHash": "07bf36af4e1b26cd",
     "inputHash": "5b191655",
     "outputHash": "eeff398a"
@@ -60,14 +63,17 @@
       "CredentialDeleteOutput"
     ],
     "expose": true,
-    "implementationHash": "c1adc37855c0b0e1",
+    "scopes": [
+      "pikku:console:credentials:manage"
+    ],
+    "implementationHash": "a8b0a6bef7315d21",
     "title": "Delete Credential",
     "description": "Deletes a credential, optionally scoped to a user.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/credential-delete.function.ts",
     "exportedName": "credentialDelete",
-    "bodyStart": 11,
-    "bodyEnd": 12,
+    "bodyStart": 12,
+    "bodyEnd": 13,
     "contractHash": "c0c0129a197c5bed",
     "inputHash": "e5f90226",
     "outputHash": "d380569d"
@@ -93,14 +99,17 @@
       "CredentialGetOutput"
     ],
     "expose": true,
-    "implementationHash": "35bcfa960b0d439e",
+    "scopes": [
+      "pikku:console:credentials:read"
+    ],
+    "implementationHash": "d10a1a3e78198017",
     "title": "Get Credential",
     "description": "Retrieves a credential value, optionally scoped to a user.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/credential-get.function.ts",
     "exportedName": "credentialGet",
-    "bodyStart": 11,
-    "bodyEnd": 12,
+    "bodyStart": 12,
+    "bodyEnd": 13,
     "contractHash": "20ae6fc72986b883",
     "inputHash": "1162de3d",
     "outputHash": "7f6b0ebf"
@@ -125,14 +134,17 @@
       "CredentialListUsersOutput"
     ],
     "expose": true,
-    "implementationHash": "96315b9ae55ee8bd",
+    "scopes": [
+      "pikku:console:credentials:read"
+    ],
+    "implementationHash": "5ae54268a8679eca",
     "title": "List Credential Users",
     "description": "Lists all users and their credential status for each declared credential.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/credential-list-users.function.ts",
     "exportedName": "credentialListUsers",
-    "bodyStart": 17,
-    "bodyEnd": 35,
+    "bodyStart": 18,
+    "bodyEnd": 36,
     "contractHash": "0b3e0e99cc0fe325",
     "inputHash": "13b79bd2",
     "outputHash": "5bf6ba22"
@@ -158,14 +170,17 @@
       "CredentialSetOutput"
     ],
     "expose": true,
-    "implementationHash": "75a1560247e99655",
+    "scopes": [
+      "pikku:console:credentials:manage"
+    ],
+    "implementationHash": "8cb65ff7ad057612",
     "title": "Set Credential",
     "description": "Stores a credential value, optionally scoped to a user.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/credential-set.function.ts",
     "exportedName": "credentialSet",
-    "bodyStart": 11,
-    "bodyEnd": 12,
+    "bodyStart": 12,
+    "bodyEnd": 13,
     "contractHash": "1cf24418020be4f5",
     "inputHash": "411710ba",
     "outputHash": "d17478ee"
@@ -191,14 +206,17 @@
       "CredentialStatusOutput"
     ],
     "expose": true,
-    "implementationHash": "18e0af3ea331ec7a",
+    "scopes": [
+      "pikku:console:credentials:read"
+    ],
+    "implementationHash": "dc7a4a408c270885",
     "title": "Credential Status",
     "description": "Checks which of the given credential names are configured. Optionally scoped to a user.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/credential-status.function.ts",
     "exportedName": "credentialStatus",
-    "bodyStart": 12,
-    "bodyEnd": 16,
+    "bodyStart": 13,
+    "bodyEnd": 17,
     "contractHash": "54c549aa89a51ad1",
     "inputHash": "e5e1d5fa",
     "outputHash": "d90abe74"
@@ -224,14 +242,17 @@
       "CredentialUsersOutput"
     ],
     "expose": true,
-    "implementationHash": "e8ce71c17b4e2253",
+    "scopes": [
+      "pikku:console:credentials:read"
+    ],
+    "implementationHash": "26ed1bba9a3526f6",
     "title": "Credential Users",
     "description": "Lists all user IDs that have a specific credential configured.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/credential-users.function.ts",
     "exportedName": "credentialUsers",
-    "bodyStart": 11,
-    "bodyEnd": 12,
+    "bodyStart": 12,
+    "bodyEnd": 13,
     "contractHash": "3978cc43086f3ba9",
     "inputHash": "3ece4aca",
     "outputHash": "ad9afc4a"
@@ -257,14 +278,17 @@
       "DeleteAgentThreadOutput"
     ],
     "expose": true,
-    "implementationHash": "458d54717e1ba2cb",
+    "scopes": [
+      "pikku:console:agents:manage"
+    ],
+    "implementationHash": "fbf377f15a449d80",
     "title": "Delete Agent Thread",
     "description": "Deletes an AI agent thread and all its associated messages and runs via cascade.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/delete-agent-thread.function.ts",
     "exportedName": "deleteAgentThread",
-    "bodyStart": 12,
-    "bodyEnd": 13,
+    "bodyStart": 13,
+    "bodyEnd": 14,
     "contractHash": "4a965a6fb8ee9447",
     "inputHash": "a375c07d",
     "outputHash": "a2094cc1"
@@ -290,14 +314,17 @@
       "DeleteWorkflowRunOutput"
     ],
     "expose": true,
-    "implementationHash": "ef700a005caf64a7",
+    "scopes": [
+      "pikku:console:workflows:manage"
+    ],
+    "implementationHash": "7b3d728e5dd950e7",
     "title": "Delete Workflow Run",
     "description": "Deletes a workflow run and all its associated steps and history.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/delete-workflow-run.function.ts",
     "exportedName": "deleteWorkflowRun",
-    "bodyStart": 12,
-    "bodyEnd": 13,
+    "bodyStart": 13,
+    "bodyEnd": 14,
     "contractHash": "ad8307eecdc7ad6a",
     "inputHash": "9c70c523",
     "outputHash": "15f13ae6"
@@ -321,14 +348,17 @@
       "GetAddonCategoriesOutput"
     ],
     "expose": true,
-    "implementationHash": "cdb84c378a117052",
+    "scopes": [
+      "pikku:console:addons:read"
+    ],
+    "implementationHash": "8f77548fad1f3c59",
     "title": "Get Addon Categories",
     "description": "Category counts across the whole addon catalogue, for the gallery category rail. Counted by the registry — deriving them from the loaded rows would undercount everything the user has not scrolled to yet.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-addon-categories.function.ts",
     "exportedName": "getAddonCategories",
-    "bodyStart": 9,
-    "bodyEnd": 9,
+    "bodyStart": 10,
+    "bodyEnd": 10,
     "contractHash": "71fbb74fbafa3971",
     "inputHash": "671c08eb",
     "outputHash": "67a958be"
@@ -354,14 +384,17 @@
       "string"
     ],
     "expose": true,
-    "implementationHash": "cb9396ee6d1c080c",
+    "scopes": [
+      "pikku:console:addons:read"
+    ],
+    "implementationHash": "13044e3a3700a91a",
     "title": "Get Addon Icon",
     "description": "Returns the icon for an addon from its metadata",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-addon-icon.function.ts",
     "exportedName": "getAddonIcon",
-    "bodyStart": 11,
-    "bodyEnd": 12,
+    "bodyStart": 9,
+    "bodyEnd": 10,
     "contractHash": "941bcb3964361cb3",
     "inputHash": "c9486bc8",
     "outputHash": "e7ab44d1"
@@ -385,14 +418,17 @@
       "GetAddonInstancesOutput"
     ],
     "expose": true,
-    "implementationHash": "aaf21504c28464f8",
+    "scopes": [
+      "pikku:console:addons:read"
+    ],
+    "implementationHash": "33214b2fe956c303",
     "title": "Get Addon Instances",
     "description": "Returns the wired instances of an addon package and their per-instance overrides.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-addon-instances.function.ts",
     "exportedName": "getAddonInstances",
-    "bodyStart": 31,
-    "bodyEnd": 42,
+    "bodyStart": 32,
+    "bodyEnd": 43,
     "contractHash": "a0f0bba74c363c18",
     "inputHash": "71254e9e",
     "outputHash": "9f2fff5a"
@@ -418,17 +454,20 @@
       "AddonMetaPage"
     ],
     "expose": true,
-    "implementationHash": "549de5adab237e0c",
+    "scopes": [
+      "pikku:console:addons:read"
+    ],
+    "implementationHash": "298f5ec0080b58d5",
     "title": "Get Addon Metadata",
     "description": "Returns one page of the addon catalogue. Search, category and sort are applied by the registry rather than the caller, so they cover every package and not just the pages already loaded.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-addon-meta.function.ts",
     "exportedName": "getAddonMeta",
-    "bodyStart": 13,
-    "bodyEnd": 13,
-    "contractHash": "855c785d172e4ca0",
+    "bodyStart": 14,
+    "bodyEnd": 14,
+    "contractHash": "a221c4d32d232590",
     "inputHash": "bc3bf42d",
-    "outputHash": "de765636"
+    "outputHash": "02854c4f"
   },
   "getAddonCommunityPackage": {
     "pikkuFuncId": "getAddonCommunityPackage",
@@ -451,17 +490,59 @@
       "AddonPackageInfo"
     ],
     "expose": true,
-    "implementationHash": "e5f5a6ecf3cd2c76",
+    "scopes": [
+      "pikku:console:addons:read"
+    ],
+    "implementationHash": "5743f5795e5f27e6",
     "title": "Get Community Addon Package",
     "description": "Returns the full details of a community addon by ID from the registry",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-addon-package.function.ts",
     "exportedName": "getAddonCommunityPackage",
-    "bodyStart": 13,
-    "bodyEnd": 13,
-    "contractHash": "687653e3c213ed35",
+    "bodyStart": 14,
+    "bodyEnd": 14,
+    "contractHash": "d508534482688cb1",
     "inputHash": "450acb95",
-    "outputHash": "0f166252"
+    "outputHash": "6aba41a1"
+  },
+  "getAgentRunScores": {
+    "pikkuFuncId": "getAgentRunScores",
+    "functionType": "user",
+    "funcWrapper": "pikkuFunc",
+    "sessionless": false,
+    "name": "getAgentRunScores",
+    "services": {
+      "optimized": true,
+      "services": [
+        "aiRunState"
+      ]
+    },
+    "wires": {
+      "optimized": true,
+      "wires": [
+        "session"
+      ]
+    },
+    "inputSchemaName": "GetAgentRunScoresInput",
+    "outputSchemaName": "GetAgentRunScoresOutput",
+    "inputs": [
+      "GetAgentRunScoresInput"
+    ],
+    "outputs": [
+      "GetAgentRunScoresOutput"
+    ],
+    "expose": true,
+    "implementationHash": "a2011ab7077a8204",
+    "title": "Get Agent Run Scores",
+    "description": "Returns every grade recorded against one AI agent run, newest first. A run accumulates one row per scorer, and a re-grade appends rather than replaces — so a run may carry the same scorer more than once. A caller without the admin scope may only read the grades of runs its own session owns.",
+    "isDirectFunction": false,
+    "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-agent-run-scores.function.ts",
+    "exportedName": "getAgentRunScores",
+    "bodyStart": 13,
+    "bodyEnd": 28,
+    "contractHash": "e94bb92d695b9002",
+    "inputHash": "fc8fc7eb",
+    "outputHash": "e9ce1c33"
   },
   "getAgentThreadMessages": {
     "pikkuFuncId": "getAgentThreadMessages",
@@ -484,14 +565,17 @@
       "GetAgentThreadMessagesOutput"
     ],
     "expose": true,
-    "implementationHash": "b3199103df324fb7",
+    "scopes": [
+      "pikku:console:agents:read"
+    ],
+    "implementationHash": "abdb18bb25dd7ea3",
     "title": "Get Agent Thread Messages",
     "description": "Returns all messages for a given AI agent thread, ordered by creation time.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-agent-thread-messages.function.ts",
     "exportedName": "getAgentThreadMessages",
-    "bodyStart": 9,
-    "bodyEnd": 9,
+    "bodyStart": 10,
+    "bodyEnd": 10,
     "contractHash": "16058b8da61ea056",
     "inputHash": "1212abd3",
     "outputHash": "04960780"
@@ -508,6 +592,12 @@
         "agentRunService"
       ]
     },
+    "wires": {
+      "optimized": true,
+      "wires": [
+        "session"
+      ]
+    },
     "inputSchemaName": "GetAgentThreadRunsInput",
     "outputSchemaName": "GetAgentThreadRunsOutput",
     "inputs": [
@@ -517,14 +607,17 @@
       "GetAgentThreadRunsOutput"
     ],
     "expose": true,
-    "implementationHash": "68faa15cc84a150b",
+    "scopes": [
+      "pikku:console:agents:read"
+    ],
+    "implementationHash": "6f757bbaece48c9c",
     "title": "Get Agent Thread Runs",
-    "description": "Returns all runs for a given AI agent thread, ordered by creation time descending.",
+    "description": "Returns all runs for a given AI agent thread, ordered by creation time descending. A caller without the admin scope sees only the runs its own session owns.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-agent-thread-runs.function.ts",
     "exportedName": "getAgentThreadRuns",
-    "bodyStart": 9,
-    "bodyEnd": 9,
+    "bodyStart": 14,
+    "bodyEnd": 22,
     "contractHash": "2e961f7a3c523dad",
     "inputHash": "81647ab7",
     "outputHash": "6352aca1"
@@ -556,14 +649,17 @@
       "GetAgentThreadsOutput"
     ],
     "expose": true,
-    "implementationHash": "ff53a04a24d86a23",
+    "scopes": [
+      "pikku:console:agents:read"
+    ],
+    "implementationHash": "88298524d8d06c82",
     "title": "Get Agent Threads",
     "description": "Returns a list of AI agent threads from the database. Accepts optional filters: agentName, resourceId, limit, and offset for pagination. A caller without the admin scope sees only the threads its own session owns.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-agent-threads.function.ts",
     "exportedName": "getAgentThreads",
-    "bodyStart": 16,
-    "bodyEnd": 25,
+    "bodyStart": 17,
+    "bodyEnd": 26,
     "contractHash": "d629208347702d27",
     "inputHash": "41f5350c",
     "outputHash": "6598bdff"
@@ -587,17 +683,20 @@
       "AllMeta"
     ],
     "expose": true,
-    "implementationHash": "f95d5f2fceef56bb",
+    "scopes": [
+      "pikku:console:wirings:read"
+    ],
+    "implementationHash": "238e359b6a5eb3b6",
     "title": "Get All Metadata",
     "description": "Reads and returns a combined object containing metadata for every wiring type (HTTP, RPC, channels, schedulers, queues, workflows, CLI, MCP, gateways, triggers, trigger sources, services, functions, and secrets) by delegating to wiringService.readAllMeta()",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-all-meta.function.ts",
     "exportedName": "getAllMeta",
-    "bodyStart": 10,
-    "bodyEnd": 10,
-    "contractHash": "f519b0ffbc05a4fb",
+    "bodyStart": 11,
+    "bodyEnd": 11,
+    "contractHash": "e83303feede7423a",
     "inputHash": "bf06e182",
-    "outputHash": "efdef6d5"
+    "outputHash": "b30b1312"
   },
   "getAuditFilters": {
     "pikkuFuncId": "getAuditFilters",
@@ -622,9 +721,9 @@
     ],
     "expose": true,
     "scopes": [
-      "pikku:audit:read"
+      "pikku:console:audit:read"
     ],
-    "implementationHash": "1093adb91ed54d67",
+    "implementationHash": "9b3445ba297cbc01",
     "title": "Get Audit Filters",
     "description": "Returns the distinct users and event types present in the audit trail, for populating the audit screen filters.",
     "isDirectFunction": false,
@@ -664,9 +763,9 @@
     ],
     "expose": true,
     "scopes": [
-      "pikku:audit:read"
+      "pikku:console:audit:read"
     ],
-    "implementationHash": "88129d345d48a487",
+    "implementationHash": "df26d9f8e4504540",
     "title": "Get Audits",
     "description": "Returns a page of the audit trail, newest first, optionally filtered by user, event type, and time range. Reports readable: false when the configured audit sink is write-only.",
     "isDirectFunction": false,
@@ -697,14 +796,17 @@
       "AuthProvidersMeta"
     ],
     "expose": true,
-    "implementationHash": "28d47382959b8d6b",
+    "scopes": [
+      "pikku:console:wirings:read"
+    ],
+    "implementationHash": "ac7907560a650587",
     "title": "Get Auth Providers",
     "description": "Returns the social providers and plugins configured via pikkuBetterAuth(), read from the generated auth-meta.gen.json.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-auth-providers.function.ts",
     "exportedName": "getAuthProviders",
-    "bodyStart": 49,
-    "bodyEnd": 49,
+    "bodyStart": 50,
+    "bodyEnd": 50,
     "contractHash": "206e6e045002b418",
     "inputHash": "1d94c8c3",
     "outputHash": "280a6c55"
@@ -731,14 +833,17 @@
       "ChannelSnippets"
     ],
     "expose": true,
-    "implementationHash": "28466fe6c70c1f0b",
+    "scopes": [
+      "pikku:console:wirings:read"
+    ],
+    "implementationHash": "a078bcef73a356a1",
     "title": "Get Channel Snippets",
     "description": "Given a channelName, reads channel metadata from metaService, finds the matching channel, and generates code snippets (overview, handlers, actions) for that channel. Returns empty snippets if the channel is not found.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-channel-snippets.function.ts",
     "exportedName": "getChannelSnippets",
-    "bodyStart": 14,
-    "bodyEnd": 17,
+    "bodyStart": 15,
+    "bodyEnd": 18,
     "contractHash": "f29c66bdcc7eefce",
     "inputHash": "6f60ad3f",
     "outputHash": "044e9275"
@@ -762,14 +867,17 @@
       "DbSchema"
     ],
     "expose": true,
-    "implementationHash": "3c0db47f3d609ea1",
+    "scopes": [
+      "pikku:console:db:read"
+    ],
+    "implementationHash": "b00c39689e267566",
     "title": "Get Database Schema",
     "description": "Introspects the local development SQLite database and returns table/column metadata enriched with data-classification annotations from db/annotations.gen.json.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-db-schema.function.ts",
     "exportedName": "getDbSchema",
-    "bodyStart": 11,
-    "bodyEnd": 14,
+    "bodyStart": 12,
+    "bodyEnd": 17,
     "contractHash": "c25846d977be35cc",
     "inputHash": "933c3d66",
     "outputHash": "665f2f0d"
@@ -793,17 +901,20 @@
       "GetFunctionsMetaOutput"
     ],
     "expose": true,
-    "implementationHash": "67fbdf8db39fa458",
+    "scopes": [
+      "pikku:console:wirings:read"
+    ],
+    "implementationHash": "39bf1c2346ff7f96",
     "title": "Get Functions Metadata",
     "description": "Reads function metadata from metaService and returns it as a flat array of FunctionMeta objects, enriched with version history from the versions manifest if available.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-functions-meta.function.ts",
     "exportedName": "getFunctionsMeta",
-    "bodyStart": 24,
-    "bodyEnd": 66,
-    "contractHash": "63b97fbd842d0834",
+    "bodyStart": 22,
+    "bodyEnd": 64,
+    "contractHash": "d96b40174d792fc2",
     "inputHash": "f42aa828",
-    "outputHash": "48a49cd3"
+    "outputHash": "fe1eb5c5"
   },
   "getInstalledAddons": {
     "pikkuFuncId": "getInstalledAddons",
@@ -824,14 +935,17 @@
       "GetInstalledAddonsOutput"
     ],
     "expose": true,
-    "implementationHash": "eb77733a41119eb1",
+    "scopes": [
+      "pikku:console:addons:read"
+    ],
+    "implementationHash": "d3d4d76a236b471d",
     "title": "Get Installed Addons",
     "description": "Returns locally wired addons from pikkuState",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-installed-addons.function.ts",
     "exportedName": "getInstalledAddons",
-    "bodyStart": 37,
-    "bodyEnd": 52,
+    "bodyStart": 38,
+    "bodyEnd": 53,
     "contractHash": "cca7dbfcea9bf8b4",
     "inputHash": "3bc40965",
     "outputHash": "0cf9b243"
@@ -857,17 +971,20 @@
       "AddonPackageInfo"
     ],
     "expose": true,
-    "implementationHash": "8c4aa9d56ff3351b",
+    "scopes": [
+      "pikku:console:addons:read"
+    ],
+    "implementationHash": "de325d351240eac5",
     "title": "Get Installed Addon Package",
     "description": "Returns the full details of a locally installed addon by reading from pikkuState and .pikku files",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-installed-package.function.ts",
     "exportedName": "getAddonInstalledPackage",
-    "bodyStart": 15,
-    "bodyEnd": 131,
-    "contractHash": "bc332aa9df4a701a",
+    "bodyStart": 16,
+    "bodyEnd": 132,
+    "contractHash": "58c00e363a5d1ac3",
     "inputHash": "84821b5a",
-    "outputHash": "4e561bc1"
+    "outputHash": "00bb35ed"
   },
   "getKnowledge": {
     "pikkuFuncId": "getKnowledge",
@@ -888,17 +1005,20 @@
       "KnowledgeBundle"
     ],
     "expose": true,
-    "implementationHash": "9a8a721711ba9f64",
+    "scopes": [
+      "pikku:console:knowledge:read"
+    ],
+    "implementationHash": "639e588a8bf452e6",
     "title": "Get Knowledge Base",
     "description": "Reads the project's knowledge/ notes and returns them as a graph — each note with its links in both directions, plus the sections, tag counts, and what `pikku knowledge validate` reports.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-knowledge.function.ts",
     "exportedName": "getKnowledge",
-    "bodyStart": 11,
-    "bodyEnd": 16,
-    "contractHash": "e61e888dbb39ab35",
+    "bodyStart": 12,
+    "bodyEnd": 17,
+    "contractHash": "73958fdfa5a3f31c",
     "inputHash": "52889dc9",
-    "outputHash": "efc7f102"
+    "outputHash": "8231f303"
   },
   "getMyAccess": {
     "pikkuFuncId": "getMyAccess",
@@ -954,14 +1074,17 @@
       "GetOpenapiCategoriesOutput"
     ],
     "expose": true,
-    "implementationHash": "2ec0b1029e467e37",
+    "scopes": [
+      "pikku:console:addons:read"
+    ],
+    "implementationHash": "e7f0845051abdd79",
     "title": "Get OpenAPI Categories",
     "description": "Category counts across the whole OpenAPI catalogue, for the gallery category rail. Counted by the registry rather than derived from the loaded rows, which would only ever describe the pages already scrolled past.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-openapi-categories.function.ts",
     "exportedName": "getOpenapiCategories",
-    "bodyStart": 9,
-    "bodyEnd": 9,
+    "bodyStart": 10,
+    "bodyEnd": 10,
     "contractHash": "7fa6f2cf2a77241f",
     "inputHash": "220060aa",
     "outputHash": "c6fc61e2"
@@ -987,14 +1110,17 @@
       "GetOpenapiDetailOutput"
     ],
     "expose": true,
-    "implementationHash": "89b4e3e8f7036c5d",
+    "scopes": [
+      "pikku:console:addons:read"
+    ],
+    "implementationHash": "7727677fa06ce142",
     "title": "Get OpenAPI Detail",
     "description": "Fetches a single OpenAPI spec detail from the fabric registry by name.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-openapi-detail.function.ts",
     "exportedName": "getOpenapiDetail",
-    "bodyStart": 27,
-    "bodyEnd": 27,
+    "bodyStart": 28,
+    "bodyEnd": 28,
     "contractHash": "ab3426b06a677b45",
     "inputHash": "c91b6280",
     "outputHash": "25720c9f"
@@ -1020,14 +1146,17 @@
       "GetOpenapisOutput"
     ],
     "expose": true,
-    "implementationHash": "23ab9d7b888a4da1",
+    "scopes": [
+      "pikku:console:addons:read"
+    ],
+    "implementationHash": "2f5bd7435fe90910",
     "title": "Get OpenAPI Specs",
     "description": "Fetches one page of the OpenAPI catalogue from the fabric registry. Search and category are applied by the registry so they cover every entry, not just the loaded pages.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-openapis.function.ts",
     "exportedName": "getOpenapis",
-    "bodyStart": 27,
-    "bodyEnd": 27,
+    "bodyStart": 28,
+    "bodyEnd": 28,
     "contractHash": "5f015dbcdade1c8b",
     "inputHash": "f38fbddb",
     "outputHash": "b12c2699"
@@ -1053,18 +1182,50 @@
       "JSONSchema7"
     ],
     "expose": true,
-    "implementationHash": "868246c660fefb97",
+    "scopes": [
+      "pikku:console:wirings:read"
+    ],
+    "implementationHash": "b89ec033aef3f557",
     "title": "Get Schema",
     "description": "Given a schemaName string, looks up and returns the corresponding JSONSchema7 definition from metaService.getSchema(). Returns null if the schema does not exist.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-schema.function.ts",
     "exportedName": "getSchema",
-    "bodyStart": 13,
-    "bodyEnd": 13,
+    "bodyStart": 11,
+    "bodyEnd": 11,
     "contractHash": "d2399b70dccdcda6",
     "inputHash": "bf5548d3",
     "outputHash": "01d4dd0e"
   },
+  "getScorers": {
+    "pikkuFuncId": "getScorers",
+    "functionType": "user",
+    "funcWrapper": "pikkuFunc",
+    "sessionless": false,
+    "name": "getScorers",
+    "services": {
+      "optimized": true,
+      "services": []
+    },
+    "inputSchemaName": null,
+    "outputSchemaName": "GetScorersOutput",
+    "inputs": [],
+    "outputs": [
+      "GetScorersOutput"
+    ],
+    "expose": true,
+    "implementationHash": "9c667130c70f74f5",
+    "title": "Get Scorers",
+    "description": "Returns every declared AI scorer with the lane it grades on, the fraction of live runs it samples, and the agents that named it.",
+    "isDirectFunction": false,
+    "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-scorers.function.ts",
+    "exportedName": "getScorers",
+    "bodyStart": 22,
+    "bodyEnd": 41,
+    "contractHash": "b758944394d9079a",
+    "inputHash": "f9562ce1",
+    "outputHash": "2c10e6ba"
+  },
   "getSecurityAudit": {
     "pikkuFuncId": "getSecurityAudit",
     "functionType": "user",
@@ -1084,14 +1245,17 @@
       "SecurityAuditReport"
     ],
     "expose": true,
-    "implementationHash": "3abe83813a17a1bb",
+    "scopes": [
+      "pikku:console:security:read"
+    ],
+    "implementationHash": "d9002cfe30ee82d2",
     "title": "Get Security Audit",
     "description": "Returns the dependency security audit (vulnerabilities + available updates) from the generated .pikku/audit.json, or null if `pikku audit` has not been run.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-security-audit.function.ts",
     "exportedName": "getSecurityAudit",
-    "bodyStart": 13,
-    "bodyEnd": 13,
+    "bodyStart": 11,
+    "bodyEnd": 11,
     "contractHash": "34af3b4ba494005d",
     "inputHash": "f4342c15",
     "outputHash": "b360be24"
@@ -1117,14 +1281,17 @@
       "StateDiff"
     ],
     "expose": true,
-    "implementationHash": "dc2de03693128686",
+    "scopes": [
+      "pikku:console:wirings:read"
+    ],
+    "implementationHash": "f012a99ac1cec6fa",
     "title": "Get State Diff",
     "description": "Diff the current project state (ours) against a baseline `.pikku/` directory (typically a worktree at main). Returns added/removed/modified entries per category.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-state-diff.function.ts",
     "exportedName": "getStateDiff",
-    "bodyStart": 13,
-    "bodyEnd": 16,
+    "bodyStart": 14,
+    "bodyEnd": 17,
     "contractHash": "8518cb87a93a3e1e",
     "inputHash": "ee2d646b",
     "outputHash": "6baa567b"
@@ -1150,14 +1317,17 @@
       "WebhookDeliveryWithAttempts"
     ],
     "expose": true,
-    "implementationHash": "78913ef964a87f7e",
+    "scopes": [
+      "pikku:console:wirings:read"
+    ],
+    "implementationHash": "ed7c66b8be8fb842",
     "title": "Get Webhook Delivery",
     "description": "Returns a single webhook delivery with its full attempt history.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-webhook-delivery.function.ts",
     "exportedName": "getWebhookDelivery",
-    "bodyStart": 13,
-    "bodyEnd": 13,
+    "bodyStart": 14,
+    "bodyEnd": 14,
     "contractHash": "a8510b00844b1cfc",
     "inputHash": "091ce638",
     "outputHash": "4d68b3e3"
@@ -1183,17 +1353,20 @@
       "GetWorkflowMetaByIdOutput"
     ],
     "expose": true,
-    "implementationHash": "610083bc870fe3af",
+    "scopes": [
+      "pikku:console:workflows:read"
+    ],
+    "implementationHash": "d97d4706a533ffce",
     "title": "Get Workflow by ID",
     "description": "Given a workflowId string, reads all workflow metadata from wiringService and returns the matching workflow meta object. Returns null if no workflow matches the given ID.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-workflow-meta-by-id.function.ts",
     "exportedName": "getWorkflowMetaById",
-    "bodyStart": 13,
-    "bodyEnd": 14,
-    "contractHash": "7466c667813c4118",
+    "bodyStart": 14,
+    "bodyEnd": 15,
+    "contractHash": "afb89ef1d31d89e7",
     "inputHash": "f967caf6",
-    "outputHash": "30b64e1d"
+    "outputHash": "88f4df73"
   },
   "getWorkflowRunHistory": {
     "pikkuFuncId": "getWorkflowRunHistory",
@@ -1216,14 +1389,17 @@
       "GetWorkflowRunHistoryOutput"
     ],
     "expose": true,
-    "implementationHash": "4b4ce6f3a25fb0c7",
+    "scopes": [
+      "pikku:console:workflows:read"
+    ],
+    "implementationHash": "d4e1b1251fef0421",
     "title": "Get Workflow Run History",
     "description": "Given a runId, returns the full execution history (state transitions, timestamps, errors) for a workflow run from the Postgres workflow database via workflowRunService.getRunHistory().",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-workflow-run-history.function.ts",
     "exportedName": "getWorkflowRunHistory",
-    "bodyStart": 9,
-    "bodyEnd": 9,
+    "bodyStart": 10,
+    "bodyEnd": 10,
     "contractHash": "6e2a5372a06e6c8f",
     "inputHash": "71adef8b",
     "outputHash": "d3a9b834"
@@ -1247,14 +1423,17 @@
       "GetWorkflowRunNamesOutput"
     ],
     "expose": true,
-    "implementationHash": "55fb11439545e8f6",
+    "scopes": [
+      "pikku:console:workflows:read"
+    ],
+    "implementationHash": "c0c423f656ddab10",
     "title": "Get Workflow Run Names",
     "description": "Returns an array of distinct workflow names that have at least one run in the Postgres workflow database via workflowRunService.getDistinctWorkflowNames().",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-workflow-run-names.function.ts",
     "exportedName": "getWorkflowRunNames",
-    "bodyStart": 9,
-    "bodyEnd": 9,
+    "bodyStart": 10,
+    "bodyEnd": 10,
     "contractHash": "dd70bc8a66eef689",
     "inputHash": "ab5ef55e",
     "outputHash": "f7f40084"
@@ -1280,14 +1459,17 @@
       "GetWorkflowRunStepsOutput"
     ],
     "expose": true,
-    "implementationHash": "6dd3abd61dcbfb5c",
+    "scopes": [
+      "pikku:console:workflows:read"
+    ],
+    "implementationHash": "43e66c98506496e8",
     "title": "Get Workflow Run Steps",
     "description": "Given a runId, returns an array of all execution steps for that workflow run from the Postgres workflow database via workflowRunService.getRunSteps(). Returns an empty array if workflowRunService is not configured.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-workflow-run-steps.function.ts",
     "exportedName": "getWorkflowRunSteps",
-    "bodyStart": 9,
-    "bodyEnd": 9,
+    "bodyStart": 10,
+    "bodyEnd": 10,
     "contractHash": "81130856082620bc",
     "inputHash": "6dfc6243",
     "outputHash": "fc160067"
@@ -1313,14 +1495,17 @@
       "GetWorkflowRunOutput"
     ],
     "expose": true,
-    "implementationHash": "11f432594142a6e6",
+    "scopes": [
+      "pikku:console:workflows:read"
+    ],
+    "implementationHash": "aba04b83e04b9dfc",
     "title": "Get Workflow Run",
     "description": "Given a runId, fetches a single workflow run from workflowRunService and also fetches all its steps, returning the run object merged with a steps array. Returns null if workflowRunService is not configured or the run is not found.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-workflow-run.function.ts",
     "exportedName": "getWorkflowRun",
-    "bodyStart": 12,
-    "bodyEnd": 15,
+    "bodyStart": 13,
+    "bodyEnd": 16,
     "contractHash": "af261ba6bbd86e3a",
     "inputHash": "4c364da8",
     "outputHash": "0e2eaa53"
@@ -1346,14 +1531,17 @@
       "GetWorkflowRunsOutput"
     ],
     "expose": true,
-    "implementationHash": "cd3da712c9261551",
+    "scopes": [
+      "pikku:console:workflows:read"
+    ],
+    "implementationHash": "05200ff18644ba69",
     "title": "Get Workflow Runs",
     "description": "Returns a list of workflow runs from the Postgres workflow database. Accepts optional filters: workflowName, status, limit, and offset for pagination. Returns an empty array if workflowRunService is not configured.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-workflow-runs.function.ts",
     "exportedName": "getWorkflowRuns",
-    "bodyStart": 12,
-    "bodyEnd": 17,
+    "bodyStart": 13,
+    "bodyEnd": 18,
     "contractHash": "6bd77e2897f38f7c",
     "inputHash": "1dce44b4",
     "outputHash": "d91cdf81"
@@ -1379,14 +1567,17 @@
       "GetWorkflowVersionOutput"
     ],
     "expose": true,
-    "implementationHash": "fbb727ee24018217",
+    "scopes": [
+      "pikku:console:workflows:read"
+    ],
+    "implementationHash": "a7315d5d9252982d",
     "title": "Get Workflow Version",
     "description": "Given a workflow name and graphHash, looks up the specific workflow version from the Postgres workflow database via workflowRunService.getWorkflowVersion() and returns the workflow graph definition and source code. Returns null if workflowRunService is not configured or the version is not found.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/get-workflow-version.function.ts",
     "exportedName": "getWorkflowVersion",
-    "bodyStart": 12,
-    "bodyEnd": 15,
+    "bodyStart": 13,
+    "bodyEnd": 16,
     "contractHash": "a1afa3245af186ce",
     "inputHash": "4733674a",
     "outputHash": "6b9145b1"
@@ -1414,9 +1605,9 @@
     "expose": true,
     "auth": true,
     "scopes": [
-      "admin"
+      "pikku:console:addons:install"
     ],
-    "implementationHash": "f968dd4687898c9c",
+    "implementationHash": "ec68cd4276b8df7a",
     "title": "Install Addon",
     "description": "Installs a community addon package and creates the wiring file. Requires an admin session.",
     "isDirectFunction": false,
@@ -1451,9 +1642,9 @@
     "expose": true,
     "auth": true,
     "scopes": [
-      "admin"
+      "pikku:console:addons:install"
     ],
-    "implementationHash": "c2dbae6855632081",
+    "implementationHash": "a06c894a64ce0b68",
     "title": "Install OpenAPI Addon",
     "description": "Generates an addon from an OpenAPI spec, installs it into the workspace, and wires it up.",
     "isDirectFunction": false,
@@ -1486,14 +1677,17 @@
       "ListWebhookDeliveriesOutput"
     ],
     "expose": true,
-    "implementationHash": "6bcf6126fbf6336d",
+    "scopes": [
+      "pikku:console:wirings:read"
+    ],
+    "implementationHash": "02598731759a6a98",
     "title": "List Webhook Deliveries",
     "description": "Lists outgoing webhook deliveries (most recent first), optionally scoped to an organization.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/list-webhook-deliveries.function.ts",
     "exportedName": "listWebhookDeliveries",
-    "bodyStart": 13,
-    "bodyEnd": 13,
+    "bodyStart": 14,
+    "bodyEnd": 14,
     "contractHash": "a4aa94d348d78afc",
     "inputHash": "c0b15c7e",
     "outputHash": "f679e184"
@@ -1548,14 +1742,17 @@
       "ReadAgentSourceOutput"
     ],
     "expose": true,
-    "implementationHash": "d12de0c2a94c7e5b",
+    "scopes": [
+      "pikku:console:agents:read"
+    ],
+    "implementationHash": "4bbbb677738ca28b",
     "title": "Read Agent Source",
     "description": "Reads the source code of a pikku AI agent definition and returns its config properties.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/read-agent-source.function.ts",
     "exportedName": "readAgentSource",
-    "bodyStart": 13,
-    "bodyEnd": 18,
+    "bodyStart": 14,
+    "bodyEnd": 19,
     "contractHash": "9ce87ee2b8742dfd",
     "inputHash": "83d575db",
     "outputHash": "f79bf1de"
@@ -1581,14 +1778,17 @@
       "ReadFunctionBodyOutput"
     ],
     "expose": true,
-    "implementationHash": "f11496021f94ed0d",
+    "scopes": [
+      "pikku:console:wirings:read"
+    ],
+    "implementationHash": "1d15d5280422d06f",
     "title": "Read Function Body",
     "description": "Reads the function body (the func: async (...) => { ... } part) from a pikku function definition.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/read-function-body.function.ts",
     "exportedName": "readFunctionBody",
-    "bodyStart": 13,
-    "bodyEnd": 22,
+    "bodyStart": 14,
+    "bodyEnd": 23,
     "contractHash": "a2287f39c1eca38b",
     "inputHash": "3db64982",
     "outputHash": "3e345ceb"
@@ -1614,14 +1814,17 @@
       "ReadFunctionSourceOutput"
     ],
     "expose": true,
-    "implementationHash": "a534d953ed940622",
+    "scopes": [
+      "pikku:console:wirings:read"
+    ],
+    "implementationHash": "efc15e41d75eeccd",
     "title": "Read Function Source",
     "description": "Reads the source code of a pikku function definition and returns its config properties and function body.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/read-function-source.function.ts",
     "exportedName": "readFunctionSource",
-    "bodyStart": 13,
-    "bodyEnd": 18,
+    "bodyStart": 14,
+    "bodyEnd": 19,
     "contractHash": "2bbd984e00ace4ed",
     "inputHash": "de816393",
     "outputHash": "3689cc09"
@@ -1647,14 +1850,17 @@
       "RenderEmailPreviewOutput"
     ],
     "expose": true,
-    "implementationHash": "c17cf7a14f41b9f6",
+    "scopes": [
+      "pikku:console:emails:read"
+    ],
+    "implementationHash": "4c92ba0987ccf5c0",
     "title": "Render Email Preview",
     "description": "Renders an email template preview from emailTemplatesDir using a locale and variable payload.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/render-email-preview.function.ts",
     "exportedName": "renderEmailPreview",
-    "bodyStart": 44,
-    "bodyEnd": 119,
+    "bodyStart": 45,
+    "bodyEnd": 120,
     "contractHash": "5c0010a01eac05df",
     "inputHash": "8bb3bf2b",
     "outputHash": "ccb4573c"
@@ -1678,14 +1884,17 @@
       "SecurityAuditReport"
     ],
     "expose": true,
-    "implementationHash": "1f6bfefb68cebcfe",
+    "scopes": [
+      "pikku:console:security:run"
+    ],
+    "implementationHash": "c344cd6fae3430ec",
     "title": "Run Security Audit",
     "description": "Runs `pikku audit --outdated`, regenerating .pikku/audit.json, and returns the fresh report. Mirrors the Run Tests action.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/run-security-audit.function.ts",
     "exportedName": "runSecurityAudit",
-    "bodyStart": 15,
-    "bodyEnd": 23,
+    "bodyStart": 13,
+    "bodyEnd": 21,
     "contractHash": "6349c4e3d5494a15",
     "inputHash": "b49cd137",
     "outputHash": "1cca48c8"
@@ -1718,11 +1927,11 @@
     ],
     "expose": true,
     "scopes": [
-      "pikku:scopes:manage"
+      "pikku:console:scopes:manage"
     ],
-    "implementationHash": "002c9dc1e8a4257e",
+    "implementationHash": "286cf4eceeb2fa5e",
     "title": "Grant Scope",
-    "description": "Grants a scope directly to a user, outside of any role. Takes effect on their next request — no re-login.",
+    "description": "Grants a scope directly to a user, outside of any role. Takes effect on their next request, with no re-login — unless mapSession sets scopes itself, which is authoritative, and then this grant never applies.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/scope-add-scope-to-user.function.ts",
     "exportedName": "scopeAddScopeToUser",
@@ -1760,11 +1969,11 @@
     ],
     "expose": true,
     "scopes": [
-      "pikku:scopes:manage"
+      "pikku:console:scopes:manage"
     ],
-    "implementationHash": "e3220612ac3b71f0",
+    "implementationHash": "57a3793fa5eed6b3",
     "title": "Grant Role",
-    "description": "Grants a role to a user. Takes effect on their next request — no re-login.",
+    "description": "Grants a role to a user. Takes effect on their next request, with no re-login — unless mapSession sets scopes itself, which is authoritative, and then this grant never applies.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/scope-add-user-to-role.function.ts",
     "exportedName": "scopeAddUserToRole",
@@ -1796,9 +2005,9 @@
     ],
     "expose": true,
     "scopes": [
-      "pikku:scopes:manage"
+      "pikku:console:scopes:manage"
     ],
-    "implementationHash": "45f25f430b016391",
+    "implementationHash": "d40d98e1c6ca94d7",
     "title": "Create Role",
     "description": "Creates a role granting the given scopes.",
     "isDirectFunction": false,
@@ -1832,9 +2041,9 @@
     ],
     "expose": true,
     "scopes": [
-      "pikku:scopes:manage"
+      "pikku:console:scopes:manage"
     ],
-    "implementationHash": "f9516dbb94675ccf",
+    "implementationHash": "4d410db3bd62260f",
     "title": "Delete Role",
     "description": "Deletes a role, revoking it from every user who holds it.",
     "isDirectFunction": false,
@@ -1866,9 +2075,9 @@
     ],
     "expose": true,
     "scopes": [
-      "pikku:scopes:read"
+      "pikku:console:scopes:read"
     ],
-    "implementationHash": "5e78c244ddf2cfc9",
+    "implementationHash": "e4248392c9cd9079",
     "title": "List Declared Scopes",
     "description": "Lists the scope vocabulary a role can be composed from, flagging any that are no longer declared in code.",
     "isDirectFunction": false,
@@ -1900,9 +2109,9 @@
     ],
     "expose": true,
     "scopes": [
-      "pikku:scopes:read"
+      "pikku:console:scopes:read"
     ],
-    "implementationHash": "33c3e6c254694e00",
+    "implementationHash": "b86216d77f9aee60",
     "title": "List Roles",
     "description": "Lists every role and the scopes it grants.",
     "isDirectFunction": false,
@@ -1936,9 +2145,9 @@
     ],
     "expose": true,
     "scopes": [
-      "pikku:scopes:read"
+      "pikku:console:scopes:read"
     ],
-    "implementationHash": "f2324450cb109255",
+    "implementationHash": "87ec363bee5d597d",
     "title": "List User Roles",
     "description": "Lists the roles a user holds, the scopes granted to them directly, and the full set those resolve to.",
     "isDirectFunction": false,
@@ -1972,11 +2181,11 @@
     ],
     "expose": true,
     "scopes": [
-      "pikku:scopes:manage"
+      "pikku:console:scopes:manage"
     ],
-    "implementationHash": "12f59a9c18110346",
+    "implementationHash": "8cd16a78812cdd50",
     "title": "Revoke Scope",
-    "description": "Revokes a directly-granted scope from a user. Takes effect on their next request — no re-login.",
+    "description": "Revokes a directly-granted scope from a user. Takes effect on their next request, with no re-login — unless mapSession sets scopes itself, which is authoritative, and then this revoke never applies.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/scope-remove-scope-from-user.function.ts",
     "exportedName": "scopeRemoveScopeFromUser",
@@ -2008,11 +2217,11 @@
     ],
     "expose": true,
     "scopes": [
-      "pikku:scopes:manage"
+      "pikku:console:scopes:manage"
     ],
-    "implementationHash": "587c657823eb1305",
+    "implementationHash": "ab21785ce8424632",
     "title": "Revoke Role",
-    "description": "Revokes a role from a user. Takes effect on their next request — no re-login.",
+    "description": "Revokes a role from a user. Takes effect on their next request, with no re-login — unless mapSession sets scopes itself, which is authoritative, and then this revoke never applies.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/scope-remove-user-from-role.function.ts",
     "exportedName": "scopeRemoveUserFromRole",
@@ -2044,11 +2253,11 @@
     ],
     "expose": true,
     "scopes": [
-      "pikku:scopes:manage"
+      "pikku:console:scopes:manage"
     ],
-    "implementationHash": "532b53bf687f51fb",
+    "implementationHash": "896dade55f54a40f",
     "title": "Set Role Scopes",
-    "description": "Replaces the scopes a role grants. Users holding it see the change on their next request.",
+    "description": "Replaces the scopes a role grants. Users holding it see the change on their next request — unless mapSession sets scopes itself, which is authoritative, and then the change never reaches them.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/scope-set-role-scopes.function.ts",
     "exportedName": "scopeSetRoleScopes",
@@ -2058,6 +2267,105 @@
     "inputHash": "9db02d43",
     "outputHash": "c6ce28cf"
   },
+  "secretGet": {
+    "pikkuFuncId": "secretGet",
+    "functionType": "user",
+    "funcWrapper": "pikkuFunc",
+    "sessionless": false,
+    "name": "secretGet",
+    "services": {
+      "optimized": true,
+      "services": [
+        "secretAdminService"
+      ]
+    },
+    "inputSchemaName": "SecretGetInput",
+    "outputSchemaName": "SecretGetOutput",
+    "inputs": [
+      "SecretGetInput"
+    ],
+    "outputs": [
+      "SecretGetOutput"
+    ],
+    "expose": true,
+    "implementationHash": "b68dc41e7ea91386",
+    "title": "Get Secret",
+    "description": "Gets the current value of a secret.",
+    "isDirectFunction": false,
+    "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/secret-get.function.ts",
+    "exportedName": "secretGet",
+    "bodyStart": 11,
+    "bodyEnd": 11,
+    "contractHash": "227a7414f4f25e3e",
+    "inputHash": "9670ae4a",
+    "outputHash": "4dba621f"
+  },
+  "secretHas": {
+    "pikkuFuncId": "secretHas",
+    "functionType": "user",
+    "funcWrapper": "pikkuFunc",
+    "sessionless": false,
+    "name": "secretHas",
+    "services": {
+      "optimized": true,
+      "services": [
+        "secretAdminService"
+      ]
+    },
+    "inputSchemaName": "SecretHasInput",
+    "outputSchemaName": "SecretHasOutput",
+    "inputs": [
+      "SecretHasInput"
+    ],
+    "outputs": [
+      "SecretHasOutput"
+    ],
+    "expose": true,
+    "implementationHash": "fe5d2382c636121a",
+    "title": "Has Secret",
+    "description": "Checks whether a secret exists without reading its value.",
+    "isDirectFunction": false,
+    "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/secret-has.function.ts",
+    "exportedName": "secretHas",
+    "bodyStart": 8,
+    "bodyEnd": 9,
+    "contractHash": "40e22efb310192c8",
+    "inputHash": "a81fed12",
+    "outputHash": "eaea1056"
+  },
+  "secretSet": {
+    "pikkuFuncId": "secretSet",
+    "functionType": "user",
+    "funcWrapper": "pikkuFunc",
+    "sessionless": false,
+    "name": "secretSet",
+    "services": {
+      "optimized": true,
+      "services": [
+        "secretAdminService"
+      ]
+    },
+    "inputSchemaName": "SecretSetInput",
+    "outputSchemaName": "SecretSetOutput",
+    "inputs": [
+      "SecretSetInput"
+    ],
+    "outputs": [
+      "SecretSetOutput"
+    ],
+    "expose": true,
+    "implementationHash": "42fe9f5438292894",
+    "title": "Set Secret",
+    "description": "Sets the value of a secret.",
+    "isDirectFunction": false,
+    "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/secret-set.function.ts",
+    "exportedName": "secretSet",
+    "bodyStart": 11,
+    "bodyEnd": 12,
+    "contractHash": "94adfc07462ee833",
+    "inputHash": "2c2e1412",
+    "outputHash": "f8a23810"
+  },
   "streamWorkflowRun": {
     "pikkuFuncId": "streamWorkflowRun",
     "functionType": "user",
@@ -2115,14 +2423,17 @@
       "UpdateAgentConfigOutput"
     ],
     "expose": true,
-    "implementationHash": "cdf5448c905d79af",
+    "scopes": [
+      "pikku:console:agents:manage"
+    ],
+    "implementationHash": "965fc9a318f9cf83",
     "title": "Update Agent Config",
     "description": "Updates the config properties of a pikku AI agent definition in source code and triggers a rebuild.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/update-agent-config.function.ts",
     "exportedName": "updateAgentConfig",
-    "bodyStart": 18,
-    "bodyEnd": 24,
+    "bodyStart": 19,
+    "bodyEnd": 25,
     "contractHash": "7914f6c21b43fab6",
     "inputHash": "bf627fe1",
     "outputHash": "bbec71d0"
@@ -2148,14 +2459,17 @@
       "SecurityAuditReport"
     ],
     "expose": true,
-    "implementationHash": "503840d691b65285",
+    "scopes": [
+      "pikku:console:code:write"
+    ],
+    "implementationHash": "553a9f8c980bcba0",
     "title": "Update Dependency",
     "description": "Bumps a dependency to the given version in package.json, runs `bun install`, re-runs `pikku audit`, and returns the refreshed report. The mechanical (free) remediation — it does NOT run the app or verify anything still works.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/update-dependency.function.ts",
     "exportedName": "updateDependency",
-    "bodyStart": 55,
-    "bodyEnd": 80,
+    "bodyStart": 62,
+    "bodyEnd": 87,
     "contractHash": "ee4066b2bd89d13b",
     "inputHash": "e06e601c",
     "outputHash": "99d1bee1"
@@ -2182,14 +2496,17 @@
       "UpdateEmailTemplateOutput"
     ],
     "expose": true,
-    "implementationHash": "4a2441228957cd55",
+    "scopes": [
+      "pikku:console:emails:write"
+    ],
+    "implementationHash": "8d1d2db62292b01b",
     "title": "Update Email Template",
     "description": "Overwrites an email template HTML source file (templates/<name>.html) so small edits can be made from the console.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/update-email-template.function.ts",
     "exportedName": "updateEmailTemplate",
-    "bodyStart": 17,
-    "bodyEnd": 36,
+    "bodyStart": 18,
+    "bodyEnd": 37,
     "contractHash": "46dfb6154b42f5ab",
     "inputHash": "906d8ace",
     "outputHash": "70750a6d"
@@ -2215,14 +2532,17 @@
       "UpdateFunctionBodyOutput"
     ],
     "expose": true,
-    "implementationHash": "3001bc333b44c279",
+    "scopes": [
+      "pikku:console:code:write"
+    ],
+    "implementationHash": "5171a0f668f82530",
     "title": "Update Function Body",
     "description": "Replaces the function body of a pikku function definition in source code and triggers a rebuild.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/update-function-body.function.ts",
     "exportedName": "updateFunctionBody",
-    "bodyStart": 17,
-    "bodyEnd": 23,
+    "bodyStart": 18,
+    "bodyEnd": 24,
     "contractHash": "9dc1d4a5073b638e",
     "inputHash": "427fe696",
     "outputHash": "b13cf220"
@@ -2248,14 +2568,17 @@
       "UpdateFunctionConfigOutput"
     ],
     "expose": true,
-    "implementationHash": "48e28b2888b17755",
+    "scopes": [
+      "pikku:console:code:write"
+    ],
+    "implementationHash": "d8220f348e91c2a2",
     "title": "Update Function Config",
     "description": "Updates the config properties of a pikku function definition in source code and triggers a rebuild.",
     "isDirectFunction": false,
     "sourceFile": "/home/runner/work/pikku/pikku/packages/addon/pikku-console/src/functions/update-function-config.function.ts",
     "exportedName": "updateFunctionConfig",
-    "bodyStart": 18,
-    "bodyEnd": 28,
+    "bodyStart": 19,
+    "bodyEnd": 29,
     "contractHash": "2e204aca2e325395",
     "inputHash": "9cdb162e",
     "outputHash": "223c95b6"