@pikku/addon-meta-conversions 0.1.2 → 0.1.3

package/dist/.pikku/scenarios/schemas/register.gen.d.ts

@@ -0,0 +1,5 @@
+/**
+ * This file was generated by @pikku/cli@0.12.96
+ */
+export declare const empty: null;
+//# sourceMappingURL=register.gen.d.ts.map

package/dist/.pikku/scenarios/schemas/register.gen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.gen.d.ts","sourceRoot":"","sources":["../../../../.pikku/scenarios/schemas/register.gen.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,eAAO,MAAM,KAAK,MAAO,CAAC"}

package/dist/.pikku/scenarios/schemas/register.gen.js

@@ -0,0 +1,5 @@
+/**
+ * This file was generated by @pikku/cli@0.12.96
+ */
+export const empty = null;
+//# sourceMappingURL=register.gen.js.map

package/dist/.pikku/scenarios/schemas/register.gen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.gen.js","sourceRoot":"","sources":["../../../../.pikku/scenarios/schemas/register.gen.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC"}

package/dist/.pikku/scenarios/schemas/register.gen.ts

@@ -0,0 +1,4 @@
+/**
+ * This file was generated by @pikku/cli@0.12.96
+ */
+export const empty = null;

package/dist/.pikku/scheduler/pikku-scheduler-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.55
+ * This file was generated by @pikku/cli@0.12.96
  */
 /**
  * Scheduler-specific type definitions for tree-shaking optimization

package/dist/.pikku/scheduler/pikku-scheduler-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.55
+ * This file was generated by @pikku/cli@0.12.96
  */
 /**
  * Scheduler-specific type definitions for tree-shaking optimization

package/dist/.pikku/scheduler/pikku-scheduler-types.gen.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.55
+ * This file was generated by @pikku/cli@0.12.96
  */
 /**
  * Scheduler-specific type definitions for tree-shaking optimization

package/dist/.pikku/schemas/register.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.55
+ * This file was generated by @pikku/cli@0.12.96
  */
 import { addSchema } from '@pikku/core/schema';
 import * as EventSendInput from './schemas/EventSendInput.schema.json' with { type: 'json' };

package/dist/.pikku/schemas/register.gen.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.55
+ * This file was generated by @pikku/cli@0.12.96
  */
 import { addSchema } from '@pikku/core/schema'
 

package/dist/.pikku/scopes/pikku-personas-meta.gen.json

@@ -0,0 +1 @@
+{}

package/dist/.pikku/scopes/pikku-personas.gen.d.ts

@@ -0,0 +1,37 @@
+import type { CorePersona, PersonaMeta, PersonasMeta } from '@pikku/core/persona';
+import type { SystemRoleName } from './pikku-roles.gen.js';
+/** Every declared persona. */
+export type PersonaId = never;
+/**
+ * The personas a virtual user can actually be.
+ *
+ * Excludes anyone whose only login is a provider account — driving a consent
+ * screen needs a human — and anyone declared `runnable: false`, who exists to
+ * be acted upon rather than to act.
+ */
+export type RunnablePersonaId = never;
+/** Every environment configured in pikku.config.json. */
+export type EnvironmentName = never;
+/**
+ * A persona whose roles are checked against `defineSystemRole` and whose
+ * environments are checked against the config.
+ *
+ * Omitting `environments` means every environment except the ones flagged
+ * `production: true`. Naming a production one additionally requires
+ * `disposition: 'accountable'`, which the type cannot express and `pikku`
+ * refuses at build time.
+ */
+export type TypedPersona = Omit<CorePersona, 'roles' | 'environments'> & {
+    roles?: SystemRoleName[];
+    environments?: EnvironmentName[];
+};
+/**
+ * Declare the people who use this application.
+ *
+ * A persona while running is a virtual user; there is no second declaration.
+ */
+export declare const definePersonas: (personas: Record<string, TypedPersona>) => void;
+/** Declared personas, keyed by id. Read by the console and `pikku persona`. */
+export declare const PERSONAS: PersonasMeta;
+export declare const PERSONA_LIST: PersonaMeta[];
+//# sourceMappingURL=pikku-personas.gen.d.ts.map

package/dist/.pikku/scopes/pikku-personas.gen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pikku-personas.gen.d.ts","sourceRoot":"","sources":["../../../.pikku/scopes/pikku-personas.gen.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACjF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAG1D,8BAA8B;AAC9B,MAAM,MAAM,SAAS,GAAG,KAAK,CAAA;AAE7B;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,KAAK,CAAA;AAErC,yDAAyD;AACzD,MAAM,MAAM,eAAe,GAAG,KAAK,CAAA;AAEnC;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,OAAO,GAAG,cAAc,CAAC,GAAG;IACvE,KAAK,CAAC,EAAE,cAAc,EAAE,CAAA;IACxB,YAAY,CAAC,EAAE,eAAe,EAAE,CAAA;CACjC,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,GAAI,UAAU,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,KAAG,IAC1C,CAAA;AAE9B,+EAA+E;AAC/E,eAAO,MAAM,QAAQ,EAAE,YAAqD,CAAA;AAE5E,eAAO,MAAM,YAAY,EAAE,WAAW,EAA4B,CAAA"}

package/dist/.pikku/scopes/pikku-personas.gen.js

@@ -0,0 +1,18 @@
+/**
+ * This file was generated by @pikku/cli@0.12.96
+ */
+/**
+ * This file was generated by the @pikku/cli
+ */
+import { definePersonas as definePersonasCore } from '@pikku/core/persona';
+import definitions from './pikku-personas-meta.gen.json' with { type: 'json' };
+/**
+ * Declare the people who use this application.
+ *
+ * A persona while running is a virtual user; there is no second declaration.
+ */
+export const definePersonas = (personas) => definePersonasCore(personas);
+/** Declared personas, keyed by id. Read by the console and `pikku persona`. */
+export const PERSONAS = definitions;
+export const PERSONA_LIST = Object.values(PERSONAS);
+//# sourceMappingURL=pikku-personas.gen.js.map

package/dist/.pikku/scopes/pikku-personas.gen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pikku-personas.gen.js","sourceRoot":"","sources":["../../../.pikku/scopes/pikku-personas.gen.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;GAEG;AACH,OAAO,EAAE,cAAc,IAAI,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAG1E,OAAO,WAAW,MAAM,gCAAgC,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AA+B9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAsC,EAAQ,EAAE,CAC7E,kBAAkB,CAAC,QAAQ,CAAC,CAAA;AAE9B,+EAA+E;AAC/E,MAAM,CAAC,MAAM,QAAQ,GAAiB,WAAsC,CAAA;AAE5E,MAAM,CAAC,MAAM,YAAY,GAAkB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA"}

package/dist/.pikku/scopes/pikku-personas.gen.ts

@@ -0,0 +1,52 @@
+/**
+ * This file was generated by @pikku/cli@0.12.96
+ */
+/**
+ * This file was generated by the @pikku/cli
+ */
+import { definePersonas as definePersonasCore } from '@pikku/core/persona'
+import type { CorePersona, PersonaMeta, PersonasMeta } from '@pikku/core/persona'
+import type { SystemRoleName } from './pikku-roles.gen.js'
+import definitions from './pikku-personas-meta.gen.json' with { type: 'json' }
+
+/** Every declared persona. */
+export type PersonaId = never
+
+/**
+ * The personas a virtual user can actually be.
+ *
+ * Excludes anyone whose only login is a provider account — driving a consent
+ * screen needs a human — and anyone declared `runnable: false`, who exists to
+ * be acted upon rather than to act.
+ */
+export type RunnablePersonaId = never
+
+/** Every environment configured in pikku.config.json. */
+export type EnvironmentName = never
+
+/**
+ * A persona whose roles are checked against `defineSystemRole` and whose
+ * environments are checked against the config.
+ *
+ * Omitting `environments` means every environment except the ones flagged
+ * `production: true`. Naming a production one additionally requires
+ * `disposition: 'accountable'`, which the type cannot express and `pikku`
+ * refuses at build time.
+ */
+export type TypedPersona = Omit<CorePersona, 'roles' | 'environments'> & {
+  roles?: SystemRoleName[]
+  environments?: EnvironmentName[]
+}
+
+/**
+ * Declare the people who use this application.
+ *
+ * A persona while running is a virtual user; there is no second declaration.
+ */
+export const definePersonas = (personas: Record<string, TypedPersona>): void =>
+  definePersonasCore(personas)
+
+/** Declared personas, keyed by id. Read by the console and `pikku persona`. */
+export const PERSONAS: PersonasMeta = definitions as unknown as PersonasMeta
+
+export const PERSONA_LIST: PersonaMeta[] = Object.values(PERSONAS)

package/dist/.pikku/scopes/pikku-roles-meta.gen.json

@@ -0,0 +1 @@
+{}

package/dist/.pikku/scopes/pikku-roles.gen.d.ts

@@ -0,0 +1,31 @@
+/**
+ * This file was generated by @pikku/cli@0.12.96
+ */
+/**
+ * This file was generated by the @pikku/cli
+ */
+import type { SystemRole } from '@pikku/core/role';
+/**
+ * Every role that ships with this application.
+ *
+ * Roles an admin composes in the console are not here and cannot be: they do
+ * not exist at build time, and can be deleted after it.
+ */
+export type SystemRoleName = never;
+/**
+ * The declared role set, for a ScopeService to sync into its store.
+ *
+ * Derived from the metadata sidecar rather than inlined, so the import above
+ * forces tsc to emit the .json alongside this file — an addon publishes only
+ * its compiled output, and a host reads that .json to merge the addon's roles
+ * into its own union.
+ *
+ * Additive on removal: a deleted declaration leaves an inert row rather than
+ * revoking everyone's grant on deploy. Use `pikku roles prune` to remove them.
+ */
+export declare const SYSTEM_ROLES: SystemRole[];
+/** Declared roles, keyed by name. Rendered by the console when granting. */
+export declare const SYSTEM_ROLES_META: Record<string, SystemRole>;
+/** Whether a role name is declared in code, and therefore not editable. */
+export declare const isSystemRole: (name: string) => boolean;
+//# sourceMappingURL=pikku-roles.gen.d.ts.map

package/dist/.pikku/scopes/pikku-roles.gen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pikku-roles.gen.d.ts","sourceRoot":"","sources":["../../../.pikku/scopes/pikku-roles.gen.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;GAEG;AACH,OAAO,KAAK,EAAE,UAAU,EAA6B,MAAM,kBAAkB,CAAA;AAI7E;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,KAAK,CAAA;AAElC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,YAAY,EAAE,UAAU,EAEpC,CAAA;AAED,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAExD,CAAA;AAED,2EAA2E;AAC3E,eAAO,MAAM,YAAY,GAAI,MAAM,MAAM,KAAG,OACmB,CAAA"}

package/dist/.pikku/scopes/pikku-roles.gen.js

@@ -0,0 +1,19 @@
+import { flattenSystemRoleDefinitions } from '@pikku/core/role';
+import definitions from './pikku-roles-meta.gen.json' with { type: 'json' };
+/**
+ * The declared role set, for a ScopeService to sync into its store.
+ *
+ * Derived from the metadata sidecar rather than inlined, so the import above
+ * forces tsc to emit the .json alongside this file — an addon publishes only
+ * its compiled output, and a host reads that .json to merge the addon's roles
+ * into its own union.
+ *
+ * Additive on removal: a deleted declaration leaves an inert row rather than
+ * revoking everyone's grant on deploy. Use `pikku roles prune` to remove them.
+ */
+export const SYSTEM_ROLES = flattenSystemRoleDefinitions(Object.values(definitions));
+/** Declared roles, keyed by name. Rendered by the console when granting. */
+export const SYSTEM_ROLES_META = Object.fromEntries(SYSTEM_ROLES.map((role) => [role.name, role]));
+/** Whether a role name is declared in code, and therefore not editable. */
+export const isSystemRole = (name) => Object.prototype.hasOwnProperty.call(SYSTEM_ROLES_META, name);
+//# sourceMappingURL=pikku-roles.gen.js.map

package/dist/.pikku/scopes/pikku-roles.gen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pikku-roles.gen.js","sourceRoot":"","sources":["../../../.pikku/scopes/pikku-roles.gen.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAA;AAC/D,OAAO,WAAW,MAAM,6BAA6B,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AAU3E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,YAAY,GAAiB,4BAA4B,CACpE,MAAM,CAAC,MAAM,CAAC,WAAwC,CAAC,CACxD,CAAA;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,iBAAiB,GAA+B,MAAM,CAAC,WAAW,CAC7E,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAC9C,CAAA;AAED,2EAA2E;AAC3E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAY,EAAW,EAAE,CACpD,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAA"}

package/dist/.pikku/scopes/pikku-roles.gen.ts

@@ -0,0 +1,41 @@
+/**
+ * This file was generated by @pikku/cli@0.12.96
+ */
+/**
+ * This file was generated by the @pikku/cli
+ */
+import type { SystemRole, SystemRoleDefinitionsMeta } from '@pikku/core/role'
+import { flattenSystemRoleDefinitions } from '@pikku/core/role'
+import definitions from './pikku-roles-meta.gen.json' with { type: 'json' }
+
+/**
+ * Every role that ships with this application.
+ *
+ * Roles an admin composes in the console are not here and cannot be: they do
+ * not exist at build time, and can be deleted after it.
+ */
+export type SystemRoleName = never
+
+/**
+ * The declared role set, for a ScopeService to sync into its store.
+ *
+ * Derived from the metadata sidecar rather than inlined, so the import above
+ * forces tsc to emit the .json alongside this file — an addon publishes only
+ * its compiled output, and a host reads that .json to merge the addon's roles
+ * into its own union.
+ *
+ * Additive on removal: a deleted declaration leaves an inert row rather than
+ * revoking everyone's grant on deploy. Use `pikku roles prune` to remove them.
+ */
+export const SYSTEM_ROLES: SystemRole[] = flattenSystemRoleDefinitions(
+  Object.values(definitions as SystemRoleDefinitionsMeta)
+)
+
+/** Declared roles, keyed by name. Rendered by the console when granting. */
+export const SYSTEM_ROLES_META: Record<string, SystemRole> = Object.fromEntries(
+  SYSTEM_ROLES.map((role) => [role.name, role])
+)
+
+/** Whether a role name is declared in code, and therefore not editable. */
+export const isSystemRole = (name: string): boolean =>
+  Object.prototype.hasOwnProperty.call(SYSTEM_ROLES_META, name)

package/dist/.pikku/scopes/pikku-scope-types.gen.d.ts

@@ -0,0 +1,8 @@
+/**
+ * This file was generated by @pikku/cli@0.12.96
+ */
+export { defineScope } from '@pikku/core/scope';
+export type { CoreScopes, CoreScopeNode, FlatScope, ScopeDefinitionMeta, ScopeDefinitionsMeta } from '@pikku/core/scope';
+export { defineSystemRole } from '@pikku/core/role';
+export type { CoreSystemRole, CoreSystemRoles, SystemRole, SystemRoleDefinitionMeta, SystemRoleDefinitionsMeta } from '@pikku/core/role';
+//# sourceMappingURL=pikku-scope-types.gen.d.ts.map

package/dist/.pikku/scopes/pikku-scope-types.gen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pikku-scope-types.gen.d.ts","sourceRoot":"","sources":["../../../.pikku/scopes/pikku-scope-types.gen.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACnD,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,UAAU,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/.pikku/scopes/pikku-scope-types.gen.js

@@ -0,0 +1,6 @@
+/**
+ * This file was generated by @pikku/cli@0.12.96
+ */
+export { defineScope } from '@pikku/core/scope';
+export { defineSystemRole } from '@pikku/core/role';
+//# sourceMappingURL=pikku-scope-types.gen.js.map

package/dist/.pikku/scopes/pikku-scope-types.gen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pikku-scope-types.gen.js","sourceRoot":"","sources":["../../../.pikku/scopes/pikku-scope-types.gen.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAE/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/.pikku/scopes/pikku-scope-types.gen.ts

@@ -0,0 +1,7 @@
+/**
+ * This file was generated by @pikku/cli@0.12.96
+ */
+export { defineScope } from '@pikku/core/scope'
+export type { CoreScopes, CoreScopeNode, FlatScope, ScopeDefinitionMeta, ScopeDefinitionsMeta } from '@pikku/core/scope'
+export { defineSystemRole } from '@pikku/core/role'
+export type { CoreSystemRole, CoreSystemRoles, SystemRole, SystemRoleDefinitionMeta, SystemRoleDefinitionsMeta } from '@pikku/core/role'

package/dist/.pikku/scopes/pikku-scopes-meta.gen.json

@@ -0,0 +1 @@
+{}

package/dist/.pikku/scopes/pikku-scopes.gen.d.ts

@@ -0,0 +1,36 @@
+/**
+ * This file was generated by @pikku/cli@0.12.96
+ */
+/**
+ * This file was generated by the @pikku/cli
+ */
+import type { FlatScope } from '@pikku/core/scope';
+/**
+ * Every scope a function can require.
+ *
+ * A `:*` entry requires the scope and all of its descendants. Held grants are
+ * matched against this by `verifyScopes` — `admin:*` on a session satisfies
+ * any `admin:...` requirement.
+ */
+export type ScopeId = never;
+export interface ScopeMeta {
+    id: ScopeId;
+    displayName?: string;
+    description?: string;
+}
+/**
+ * The declared scope set, for a ScopeService to sync into its store.
+ *
+ * Derived from the metadata sidecar rather than inlined, so that the import
+ * above forces tsc to emit the .json alongside this file. An addon publishes
+ * only its compiled output, and a host reads that .json to merge the addon's
+ * scopes into its own `ScopeId` union and declared set — an uncopied sidecar
+ * would leave the addon's scopes ungrantable.
+ *
+ * Additive: removing a declaration leaves an inert row rather than revoking a
+ * grant mid-deploy. Use `pikku scopes prune` to remove them deliberately.
+ */
+export declare const SCOPES: FlatScope[];
+/** Declared scopes, keyed by id. Rendered by the console when granting. */
+export declare const SCOPES_META: Record<string, ScopeMeta>;
+//# sourceMappingURL=pikku-scopes.gen.d.ts.map

package/dist/.pikku/scopes/pikku-scopes.gen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pikku-scopes.gen.d.ts","sourceRoot":"","sources":["../../../.pikku/scopes/pikku-scopes.gen.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;GAEG;AACH,OAAO,KAAK,EAAE,SAAS,EAAwB,MAAM,mBAAmB,CAAA;AAIxE;;;;;;GAMG;AACH,MAAM,MAAM,OAAO,GAAG,KAAK,CAAA;AAE3B,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,OAAO,CAAA;IACX,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,MAAM,EAAE,SAAS,EAE7B,CAAA;AAMD,2EAA2E;AAC3E,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAWjD,CAAA"}

package/dist/.pikku/scopes/pikku-scopes.gen.js

@@ -0,0 +1,28 @@
+import { flattenScopeDefinitions } from '@pikku/core/scope';
+import definitions from './pikku-scopes-meta.gen.json' with { type: 'json' };
+/**
+ * The declared scope set, for a ScopeService to sync into its store.
+ *
+ * Derived from the metadata sidecar rather than inlined, so that the import
+ * above forces tsc to emit the .json alongside this file. An addon publishes
+ * only its compiled output, and a host reads that .json to merge the addon's
+ * scopes into its own `ScopeId` union and declared set — an uncopied sidecar
+ * would leave the addon's scopes ungrantable.
+ *
+ * Additive: removing a declaration leaves an inert row rather than revoking a
+ * grant mid-deploy. Use `pikku scopes prune` to remove them deliberately.
+ */
+export const SCOPES = flattenScopeDefinitions(Object.values(definitions));
+const DISPLAY_NAMES = {};
+/** Declared scopes, keyed by id. Rendered by the console when granting. */
+export const SCOPES_META = Object.fromEntries(SCOPES.map((scope) => [
+    scope.id,
+    {
+        id: scope.id,
+        ...(DISPLAY_NAMES[scope.id]
+            ? { displayName: DISPLAY_NAMES[scope.id] }
+            : {}),
+        ...(scope.description ? { description: scope.description } : {}),
+    },
+]));
+//# sourceMappingURL=pikku-scopes.gen.js.map

package/dist/.pikku/scopes/pikku-scopes.gen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pikku-scopes.gen.js","sourceRoot":"","sources":["../../../.pikku/scopes/pikku-scopes.gen.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,WAAW,MAAM,8BAA8B,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AAiB5E;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,MAAM,GAAgB,uBAAuB,CACxD,MAAM,CAAC,MAAM,CAAC,WAAmC,CAAC,CACnD,CAAA;AAED,MAAM,aAAa,GAA2B,EAE7C,CAAA;AAED,2EAA2E;AAC3E,MAAM,CAAC,MAAM,WAAW,GAA8B,MAAM,CAAC,WAAW,CACtE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE;IACR;QACE,EAAE,EAAE,KAAK,CAAC,EAAa;QACvB,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE;YAC1C,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE;CACF,CAAC,CACH,CAAA"}

package/dist/.pikku/scopes/pikku-scopes.gen.ts

@@ -0,0 +1,58 @@
+/**
+ * This file was generated by @pikku/cli@0.12.96
+ */
+/**
+ * This file was generated by the @pikku/cli
+ */
+import type { FlatScope, ScopeDefinitionsMeta } from '@pikku/core/scope'
+import { flattenScopeDefinitions } from '@pikku/core/scope'
+import definitions from './pikku-scopes-meta.gen.json' with { type: 'json' }
+
+/**
+ * Every scope a function can require.
+ *
+ * A `:*` entry requires the scope and all of its descendants. Held grants are
+ * matched against this by `verifyScopes` — `admin:*` on a session satisfies
+ * any `admin:...` requirement.
+ */
+export type ScopeId = never
+
+export interface ScopeMeta {
+  id: ScopeId
+  displayName?: string
+  description?: string
+}
+
+/**
+ * The declared scope set, for a ScopeService to sync into its store.
+ *
+ * Derived from the metadata sidecar rather than inlined, so that the import
+ * above forces tsc to emit the .json alongside this file. An addon publishes
+ * only its compiled output, and a host reads that .json to merge the addon's
+ * scopes into its own `ScopeId` union and declared set — an uncopied sidecar
+ * would leave the addon's scopes ungrantable.
+ *
+ * Additive: removing a declaration leaves an inert row rather than revoking a
+ * grant mid-deploy. Use `pikku scopes prune` to remove them deliberately.
+ */
+export const SCOPES: FlatScope[] = flattenScopeDefinitions(
+  Object.values(definitions as ScopeDefinitionsMeta)
+)
+
+const DISPLAY_NAMES: Record<string, string> = {
+
+}
+
+/** Declared scopes, keyed by id. Rendered by the console when granting. */
+export const SCOPES_META: Record<string, ScopeMeta> = Object.fromEntries(
+  SCOPES.map((scope) => [
+    scope.id,
+    {
+      id: scope.id as ScopeId,
+      ...(DISPLAY_NAMES[scope.id]
+        ? { displayName: DISPLAY_NAMES[scope.id] }
+        : {}),
+      ...(scope.description ? { description: scope.description } : {}),
+    },
+  ])
+)

package/dist/.pikku/secrets/pikku-secret-types.gen.d.ts

@@ -1,6 +1,6 @@
 /**
- * This file was generated by @pikku/cli@0.12.55
+ * This file was generated by @pikku/cli@0.12.96
  */
-export { wireSecret } from '@pikku/core/secret';
+export { defineSecret } from '@pikku/core/secret';
 export type { CoreSecret, SecretDefinitionMeta, SecretDefinitionsMeta } from '@pikku/core/secret';
 //# sourceMappingURL=pikku-secret-types.gen.d.ts.map

package/dist/.pikku/secrets/pikku-secret-types.gen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pikku-secret-types.gen.d.ts","sourceRoot":"","sources":["../../../.pikku/secrets/pikku-secret-types.gen.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAC/C,YAAY,EAAE,UAAU,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"pikku-secret-types.gen.d.ts","sourceRoot":"","sources":["../../../.pikku/secrets/pikku-secret-types.gen.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EAAE,UAAU,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA"}

package/dist/.pikku/secrets/pikku-secret-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.55
+ * This file was generated by @pikku/cli@0.12.96
  */
-export { wireSecret } from '@pikku/core/secret';
+export { defineSecret } from '@pikku/core/secret';
 //# sourceMappingURL=pikku-secret-types.gen.js.map

package/dist/.pikku/secrets/pikku-secret-types.gen.js.map

@@ -1 +1 @@
-{"version":3,"file":"pikku-secret-types.gen.js","sourceRoot":"","sources":["../../../.pikku/secrets/pikku-secret-types.gen.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"pikku-secret-types.gen.js","sourceRoot":"","sources":["../../../.pikku/secrets/pikku-secret-types.gen.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA"}

package/dist/.pikku/secrets/pikku-secret-types.gen.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.55
+ * This file was generated by @pikku/cli@0.12.96
  */
-export { wireSecret } from '@pikku/core/secret'
+export { defineSecret } from '@pikku/core/secret'
 export type { CoreSecret, SecretDefinitionMeta, SecretDefinitionsMeta } from '@pikku/core/secret'

package/dist/.pikku/secrets/pikku-secrets.gen.d.ts

@@ -1,10 +1,20 @@
 /**
- * This file was generated by @pikku/cli@0.12.55
+ * This file was generated by @pikku/cli@0.12.96
  */
 import { TypedSecretService as CoreTypedSecretService } from '@pikku/core/services';
 import type { SecretService } from '@pikku/core/services';
+import type { SecretDefinitionsMeta } from '@pikku/core/secret';
 import type { z } from 'zod';
 import { metaConversionsSecretsSchema } from '../../src/meta-conversions.secret.js';
+/**
+ * Every secret declared in this package.
+ *
+ * Read from the metadata sidecar rather than inlined, so that the import above
+ * forces tsc to emit the .json alongside this file. An addon publishes only its
+ * compiled output, and a host reads that .json to discover the addon's declared
+ * secrets — an uncopied sidecar leaves them invisible to the host.
+ */
+export declare const SECRETS_META: SecretDefinitionsMeta;
 export interface CredentialsMap {
     'META_CONVERSIONS_CREDENTIALS': z.infer<typeof metaConversionsSecretsSchema>;
 }

package/dist/.pikku/secrets/pikku-secrets.gen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pikku-secrets.gen.d.ts","sourceRoot":"","sources":["../../../.pikku/secrets/pikku-secrets.gen.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,kBAAkB,IAAI,sBAAsB,EAAuB,MAAM,sBAAsB,CAAA;AACxG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAC5B,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAA;AAEnF,MAAM,WAAW,cAAc;IAC7B,8BAA8B,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAA;CAC7E;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAA;AAM3C,qBAAa,kBAAmB,SAAQ,sBAAsB,CAAC,cAAc,CAAC;gBAChE,OAAO,EAAE,aAAa;CAGnC"}
+{"version":3,"file":"pikku-secrets.gen.d.ts","sourceRoot":"","sources":["../../../.pikku/secrets/pikku-secrets.gen.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,kBAAkB,IAAI,sBAAsB,EAAuB,MAAM,sBAAsB,CAAA;AACxG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAE/D,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAC5B,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAA;AAEnF;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,EAAE,qBACW,CAAA;AAEtC,MAAM,WAAW,cAAc;IAC7B,8BAA8B,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAA;CAC7E;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAA;AAM3C,qBAAa,kBAAmB,SAAQ,sBAAsB,CAAC,cAAc,CAAC;gBAChE,OAAO,EAAE,aAAa;CAGnC"}

package/dist/.pikku/secrets/pikku-secrets.gen.js

@@ -1,9 +1,19 @@
 /**
- * This file was generated by @pikku/cli@0.12.55
+ * This file was generated by @pikku/cli@0.12.96
  */
 import { TypedSecretService as CoreTypedSecretService } from '@pikku/core/services';
+import secretsMeta from './pikku-secrets-meta.gen.json' with { type: 'json' };
+/**
+ * Every secret declared in this package.
+ *
+ * Read from the metadata sidecar rather than inlined, so that the import above
+ * forces tsc to emit the .json alongside this file. An addon publishes only its
+ * compiled output, and a host reads that .json to discover the addon's declared
+ * secrets — an uncopied sidecar leaves them invisible to the host.
+ */
+export const SECRETS_META = secretsMeta;
 const CREDENTIALS_META = {
-    'META_CONVERSIONS_CREDENTIALS': { name: 'metaConversions', displayName: 'Meta Conversions API' }
+    'META_CONVERSIONS_CREDENTIALS': { name: 'metaConversions', displayName: "Meta Conversions API" }
 };
 export class TypedSecretService extends CoreTypedSecretService {
     constructor(secrets) {

package/dist/.pikku/secrets/pikku-secrets.gen.js.map

@@ -1 +1 @@
-{"version":3,"file":"pikku-secrets.gen.js","sourceRoot":"","sources":["../../../.pikku/secrets/pikku-secrets.gen.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,kBAAkB,IAAI,sBAAsB,EAAuB,MAAM,sBAAsB,CAAA;AAWxG,MAAM,gBAAgB,GAAmC;IACvD,8BAA8B,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,sBAAsB,EAAE;CACjG,CAAA;AAED,MAAM,OAAO,kBAAmB,SAAQ,sBAAsC;IAC5E,YAAY,OAAsB;QAChC,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAA;IAClC,CAAC;CACF"}
+{"version":3,"file":"pikku-secrets.gen.js","sourceRoot":"","sources":["../../../.pikku/secrets/pikku-secrets.gen.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,kBAAkB,IAAI,sBAAsB,EAAuB,MAAM,sBAAsB,CAAA;AAGxG,OAAO,WAAW,MAAM,+BAA+B,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AAI7E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GACvB,WAAoC,CAAA;AAQtC,MAAM,gBAAgB,GAAmC;IACvD,8BAA8B,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,sBAAsB,EAAE;CACjG,CAAA;AAED,MAAM,OAAO,kBAAmB,SAAQ,sBAAsC;IAC5E,YAAY,OAAsB;QAChC,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAA;IAClC,CAAC;CACF"}

package/dist/.pikku/secrets/pikku-secrets.gen.ts

@@ -1,11 +1,24 @@
 /**
- * This file was generated by @pikku/cli@0.12.55
+ * This file was generated by @pikku/cli@0.12.96
  */
 import { TypedSecretService as CoreTypedSecretService, type CredentialMeta } from '@pikku/core/services'
 import type { SecretService } from '@pikku/core/services'
+import type { SecretDefinitionsMeta } from '@pikku/core/secret'
+import secretsMeta from './pikku-secrets-meta.gen.json' with { type: 'json' }
 import type { z } from 'zod'
 import { metaConversionsSecretsSchema } from '../../src/meta-conversions.secret.js'
 
+/**
+ * Every secret declared in this package.
+ *
+ * Read from the metadata sidecar rather than inlined, so that the import above
+ * forces tsc to emit the .json alongside this file. An addon publishes only its
+ * compiled output, and a host reads that .json to discover the addon's declared
+ * secrets — an uncopied sidecar leaves them invisible to the host.
+ */
+export const SECRETS_META: SecretDefinitionsMeta =
+  secretsMeta as SecretDefinitionsMeta
+
 export interface CredentialsMap {
   'META_CONVERSIONS_CREDENTIALS': z.infer<typeof metaConversionsSecretsSchema>
 }
@@ -13,7 +26,7 @@ export interface CredentialsMap {
 export type SecretId = keyof CredentialsMap
 
 const CREDENTIALS_META: Record<string, CredentialMeta> = {
-  'META_CONVERSIONS_CREDENTIALS': { name: 'metaConversions', displayName: 'Meta Conversions API' }
+  'META_CONVERSIONS_CREDENTIALS': { name: 'metaConversions', displayName: "Meta Conversions API" }
 }
 
 export class TypedSecretService extends CoreTypedSecretService<CredentialsMap> {

package/dist/.pikku/trigger/pikku-trigger-types.gen.d.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.55
+ * This file was generated by @pikku/cli@0.12.96
  */
 /**
  * Trigger-specific type definitions for tree-shaking optimization

package/dist/.pikku/trigger/pikku-trigger-types.gen.js

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.55
+ * This file was generated by @pikku/cli@0.12.96
  */
 /**
  * Trigger-specific type definitions for tree-shaking optimization

package/dist/.pikku/trigger/pikku-trigger-types.gen.ts

@@ -1,5 +1,5 @@
 /**
- * This file was generated by @pikku/cli@0.12.55
+ * This file was generated by @pikku/cli@0.12.96
  */
 /**
  * Trigger-specific type definitions for tree-shaking optimization