@pikku/inspector 0.12.50 → 0.12.52

package/dist/add/add-functions.js

@@ -4,6 +4,24 @@ import { extractFunctionName, funcIdToTypeName, } from '../utils/extract-functio
 import { extractFunctionNode } from '../utils/extract-function-node.js';
 import { extractUsedWires } from '../utils/extract-services.js';
 import { formatVersionedId, parseVersionedId } from '@pikku/core';
+/** Binding keys a `pikkuScenarioStep` may declare, in report order. */
+const SCENARIO_SURFACE_KEYS = [
+    'browser',
+    'cli',
+    'default',
+];
+/**
+ * The step wrappers, and who acts in each.
+ *
+ * Which function was called *is* the kind. That is the whole reason these are
+ * three declarations rather than a `kind:` field on one: a string literal can be
+ * copied into an addon package by a consumer, a called identifier cannot.
+ */
+const SCENARIO_STEP_KINDS = new Map([
+    ['pikkuScenarioStep', 'persona'],
+    ['pikkuPlatformScenarioStep', 'platform'],
+    ['pikkuAddonScenarioStep', 'addon'],
+]);
 import { getPropertyValue, getArrayPropertyValue, getCommonWireMetaData, } from '../utils/get-property-value.js';
 import { canonicalJSON, hashString } from '../utils/hash.js';
 import { resolveMiddleware } from '../utils/middleware.js';
@@ -261,6 +279,66 @@ function computeImplementationHash(args) {
         config: objectNode ? printNode(objectNode) : null,
     }));
 }
+/**
+ * Registers a `pikkuRemoteChannelFunc` declaration: a name, its schemas and its
+ * description, with no body to inspect. The name has to reach `rpc.internalMeta`
+ * for `channel.remote` to resolve the schemas it validates each call against.
+ */
+const addRemoteChannelFunc = ({ state, logger, node, pikkuFuncId, name, exportedName, inputSchemaRef, outputSchemaRef, meta, }) => {
+    const sourceFile = node.getSourceFile().fileName;
+    if (!exportedName) {
+        logger.error(`• Remote channel function '${name}' is not exported, this is not allowed.`);
+        return;
+    }
+    // Two files declaring the same capability is the collision that matters:
+    // both ids are the bare name, so the id-compatibility check below reads them
+    // as the same function and lets the second overwrite the first.
+    const existingFunction = state.functions.meta[pikkuFuncId];
+    if (existingFunction &&
+        existingFunction.sourceFile &&
+        existingFunction.sourceFile !== sourceFile) {
+        logger.critical(ErrorCode.DUPLICATE_FUNCTION_NAME, `Function name '${name}' is not unique. ` +
+            `'${pikkuFuncId}' is already defined in '${existingFunction.sourceFile}' and cannot be redefined in '${sourceFile}'.`);
+        return;
+    }
+    const existing = state.rpc.internalMeta[name];
+    if (existing && !areCompatibleFunctionIds(existing, pikkuFuncId)) {
+        logger.critical(ErrorCode.DUPLICATE_FUNCTION_NAME, `Function name '${name}' is not unique. ` +
+            `It already points to '${existing}' in '${resolveExistingFunctionSource(state, existing) || 'unknown file'}', but '${pikkuFuncId}' in '${sourceFile}' tried to use the same name.`);
+        return;
+    }
+    const capitalizedName = funcIdToTypeName(name);
+    const registerSchema = (ref, suffix) => {
+        if (!ref)
+            return null;
+        const schemaName = `${capitalizedName}${suffix}`;
+        state.schemaLookup.set(schemaName, ref);
+        state.functions.typesMap.addCustomType(schemaName, 'unknown', []);
+        return schemaName;
+    };
+    const inputSchemaName = registerSchema(inputSchemaRef, 'Input');
+    const outputSchemaName = registerSchema(outputSchemaRef, 'Output');
+    state.functions.meta[pikkuFuncId] = {
+        pikkuFuncId,
+        functionType: 'remote',
+        funcWrapper: 'pikkuRemoteChannelFunc',
+        sessionless: true,
+        name,
+        services: { optimized: true, services: [] },
+        inputSchemaName,
+        outputSchemaName,
+        inputs: inputSchemaName ? [inputSchemaName] : [],
+        outputs: outputSchemaName ? [outputSchemaName] : [],
+        sourceFile,
+        exportedName,
+        ...meta,
+    };
+    state.functions.files.set(pikkuFuncId, { path: sourceFile, exportedName });
+    state.rpc.internalMeta[name] = pikkuFuncId;
+    // Imported so a local call gets the factory's "this runs on the client"
+    // error rather than a bare lookup miss.
+    state.rpc.internalFiles.set(pikkuFuncId, { path: sourceFile, exportedName });
+};
 /**
  * Inspect pikkuFunc calls, extract input/output and first-arg destructuring,
  * then push into state.functions.meta.
@@ -274,18 +352,19 @@ export const addFunctions = (logger, node, checker, state, options) => {
         return;
     }
     // Match identifiers that contain both "pikku" and "func" (case insensitive),
-    // plus pikkuScenario and pikkuScenarioStep (workflow wrappers without "func"
-    // in their names)
+    // plus pikkuScenario and the three scenario step wrappers (workflow wrappers
+    // without "func" in their names)
     const pikkuFuncPattern = /pikku.*func/i;
     if (!pikkuFuncPattern.test(expression.text) &&
         expression.text !== 'pikkuScenario' &&
-        expression.text !== 'pikkuScenarioStep') {
+        !SCENARIO_STEP_KINDS.has(expression.text)) {
         return;
     }
     // A scenario step is bundled like any invoked function, but is deliberately
     // never RPC-registered: a step may drive a browser, so exposing it over the
     // network would put a test harness on the public API surface.
-    const isScenarioStep = expression.text === 'pikkuScenarioStep';
+    const scenarioStepKind = SCENARIO_STEP_KINDS.get(expression.text);
+    const isScenarioStep = scenarioStepKind !== undefined;
     // A scenario's own body. Marked so the codegen partitions and the deploy
     // analyzer can tell it apart from an application workflow without having to
     // reach into the workflow graph.
@@ -316,6 +395,15 @@ export const addFunctions = (logger, node, checker, state, options) => {
     let expose;
     let remote;
     let mcp;
+    /**
+     * A sessionless function's own `auth: true`. `sessionless` records the
+     * baseline — a `pikkuFunc` always needs a session — while this records the
+     * tightening a `pikkuSessionlessFunc` applies to itself, which is otherwise
+     * invisible to anything reading meta.
+     */
+    let auth;
+    /** The author's claim that the body authorizes its own callers. */
+    let selfAuthenticated;
     let readonly_;
     let deploy;
     let approvalRequired;
@@ -323,7 +411,8 @@ export const addFunctions = (logger, node, checker, state, options) => {
     let workflowQueued;
     let workflowRetries;
     let workflowTimeout;
-    let scenarioStepBrowser;
+    let scenarioStepSurfaces;
+    let scenarioStepAddon;
     let scenarioStepTemplate;
     let scopes;
     let version;
@@ -390,13 +479,48 @@ export const addFunctions = (logger, node, checker, state, options) => {
         expose = getPropertyValue(firstArg, 'expose');
         remote = getPropertyValue(firstArg, 'remote');
         mcp = getPropertyValue(firstArg, 'mcp');
+        auth = getPropertyValue(firstArg, 'auth');
+        selfAuthenticated = getPropertyValue(firstArg, 'selfAuthenticated');
         readonly_ = getPropertyValue(firstArg, 'readonly');
         deploy = getPropertyValue(firstArg, 'deploy');
         approvalRequired = getPropertyValue(firstArg, 'approvalRequired');
         workflowQueued = getPropertyValue(firstArg, 'workflowQueued');
         workflowRetries = getPropertyValue(firstArg, 'workflowRetries');
         workflowTimeout = getPropertyValue(firstArg, 'workflowTimeout');
-        scenarioStepBrowser = getPropertyValue(firstArg, 'browser');
+        // A step declares one implementation per surface it supports; the binding
+        // keys that are present ARE the declaration, so there is nothing to read a
+        // value from — only names to collect.
+        const declaredSurfaces = SCENARIO_SURFACE_KEYS.filter((surface) => firstArg.properties.some((prop) => (ts.isPropertyAssignment(prop) ||
+            ts.isMethodDeclaration(prop) ||
+            ts.isShorthandPropertyAssignment(prop)) &&
+            ts.isIdentifier(prop.name) &&
+            prop.name.text === surface));
+        if (scenarioStepKind === 'platform' || scenarioStepKind === 'addon') {
+            // Neither kind has surfaces. Nobody clicks "Stripe's webhook arrives", and
+            // there is no human behind "the platform has expired the trial" — so both
+            // take a single `func`, and a binding key here is a coded error rather
+            // than a convention nobody reads.
+            if (declaredSurfaces.length > 0) {
+                logger.error(`• ${expression.text}('${name}') declares ${declaredSurfaces.join('/')} — a ${scenarioStepKind} step has one implementation, declared as \`func\`. Surfaces are how a person drives the system, and nobody drives this one.`);
+                return;
+            }
+            // The phase rule depends on it: an assertion runs every witness it has and
+            // fails if they disagree, so a step with exactly one witness by
+            // construction has to be unable to look like it has several.
+            scenarioStepSurfaces = ['default'];
+            if (scenarioStepKind === 'addon') {
+                scenarioStepAddon = getPropertyValue(firstArg, 'addon');
+                if (!scenarioStepAddon) {
+                    logger.error(`• pikkuAddonScenarioStep('${name}') needs a string literal \`addon\` naming the addon whose system acts — the same name its wireAddon declares.`);
+                    return;
+                }
+            }
+        }
+        else {
+            scenarioStepSurfaces = declaredSurfaces.length
+                ? declaredSurfaces
+                : undefined;
+        }
         scenarioStepTemplate = getPropertyValue(firstArg, 'template');
         scopes = getArrayPropertyValue(firstArg, 'scopes') ?? undefined;
         // Extract approvalDescription identifier reference
@@ -488,6 +612,23 @@ export const addFunctions = (logger, node, checker, state, options) => {
         }
         pikkuFuncId = formatVersionedId(baseName, version);
     }
+    // A remote channel capability is a contract with no body: the connected
+    // client answers it. Everything past this point reads the handler, so it gets
+    // its own path rather than a nullable handler threaded through all of it.
+    if (expression.text === 'pikkuRemoteChannelFunc') {
+        addRemoteChannelFunc({
+            state,
+            logger,
+            node,
+            pikkuFuncId,
+            name,
+            exportedName,
+            inputSchemaRef,
+            outputSchemaRef,
+            meta: { version, title, tags, summary, description, errors },
+        });
+        return;
+    }
     const isMCPToolFunc = expression.text === 'pikkuMCPToolFunc';
     const isListFunc = expression.text === 'pikkuListFunc';
     const mcpEnabled = mcp || isMCPToolFunc;
@@ -795,6 +936,8 @@ export const addFunctions = (logger, node, checker, state, options) => {
         inputs: inputNames.filter((n) => n !== 'void') ?? null,
         outputs: outputNames.filter((n) => n !== 'void') ?? null,
         expose: expose || undefined,
+        auth: auth || undefined,
+        selfAuthenticated: selfAuthenticated || undefined,
         remote: remote || undefined,
         scenarioStep: isScenarioStep || undefined,
         scenario: isScenario || undefined,
@@ -806,7 +949,13 @@ export const addFunctions = (logger, node, checker, state, options) => {
         workflowQueued: workflowQueued === true ? true : undefined,
         workflowRetries: workflowRetries ?? undefined,
         workflowTimeout: workflowTimeout ?? undefined,
-        scenarioStepBrowser: scenarioStepBrowser === true ? true : undefined,
+        scenarioStepSurfaces,
+        // `persona` is the default reading of an unmarked step, so it is left off
+        // rather than written into every step meta a project already has.
+        scenarioStepKind: scenarioStepKind && scenarioStepKind !== 'persona'
+            ? scenarioStepKind
+            : undefined,
+        scenarioStepAddon,
         scenarioStepTemplate: scenarioStepTemplate || undefined,
         scopes: scopes ?? undefined,
         implementationHash,

package/dist/add/add-http-route.js

@@ -145,17 +145,23 @@ export function registerHTTPRoute({ obj, state, checker, logger, sourceFile, bas
             inlineMeta.sessionless = targetMeta.sessionless;
         }
     }
+    // The route's own `auth`, falling back to the group's. Recorded on the meta
+    // below so an audit can answer "is this route open?" without re-reading the
+    // source: the route can tighten a sessionless function, and until this was
+    // written down that tightening existed only in the wiring.
+    const routeAuthProp = getPropertyValue(obj, 'auth');
+    const resolvedAuth = routeAuthProp === true || routeAuthProp === false
+        ? routeAuthProp
+        : inheritedAuth;
     // For inline functions (e.g. oauth2 handlers), propagate sessionless: true
     // when auth is explicitly disabled at the route or group level — the
     // developer opted out of auth so no session is required.
     {
         const inlineMeta = state.functions.meta[funcName];
-        if (inlineMeta && inlineMeta.sessionless === undefined) {
-            const routeAuth = getPropertyValue(obj, 'auth');
-            const resolvedAuth = routeAuth === true || routeAuth === false ? routeAuth : inheritedAuth;
-            if (resolvedAuth === false) {
-                inlineMeta.sessionless = true;
-            }
+        if (inlineMeta &&
+            inlineMeta.sessionless === undefined &&
+            resolvedAuth === false) {
+            inlineMeta.sessionless = true;
         }
     }
     // Lookup existing function metadata
@@ -239,6 +245,7 @@ export function registerHTTPRoute({ obj, state, checker, logger, sourceFile, bas
         route: fullRoute,
         sourceFile: sourceFile.fileName,
         method: method,
+        ...(resolvedAuth !== undefined && { auth: resolvedAuth }),
         params: params.length > 0 ? params : undefined,
         query: query.length > 0 ? query : undefined,
         inputTypes: undefined,
@@ -284,6 +291,9 @@ export function registerHTTPRouteMeta({ route, state, logger, sourceFile, basePa
         route: fullRoute,
         sourceFile: sourceFile.fileName,
         method: method,
+        ...((route.auth ?? inheritedAuth) !== undefined && {
+            auth: route.auth ?? inheritedAuth,
+        }),
         params: params.length > 0 ? params : undefined,
         inputTypes: undefined,
         tags: tags.length > 0 ? tags : undefined,

package/dist/add/add-middleware.js

@@ -4,6 +4,49 @@ import { extractServicesFromFunction, extractUsedWires, } from '../utils/extract
 import { extractMiddlewareRefs } from '../utils/middleware.js';
 import { getPropertyValue } from '../utils/get-property-value.js';
 import { getPropertyAssignmentInitializer } from '../utils/type-utils.js';
+/**
+ * Record a middleware group, keeping any registration already stored under the
+ * same pattern or tag.
+ *
+ * Several files may add middleware for one pattern — an app's own `'*'` group
+ * alongside the generated better-auth session bridge, say — and the runtime
+ * composes them. A plain `set` kept only the last, and codegen emits imports
+ * from what is stored, so the other file was never imported and its middleware
+ * silently stopped running. Merging is the only shape that cannot lose a gate;
+ * the first registration stays primary so single-registration groups serialize
+ * exactly as before.
+ */
+function recordMiddlewareGroup(groups, key, group) {
+    const existing = groups.get(key);
+    if (!existing) {
+        groups.set(key, group);
+        return;
+    }
+    // The same call seen twice — the inspector may revisit a file — is not a
+    // second registration, and appending it would emit a duplicate import.
+    const alreadyRecorded = [
+        existing,
+        ...(existing.additionalRegistrations ?? []),
+    ];
+    if (alreadyRecorded.some((r) => r.sourceFile === group.sourceFile && r.position === group.position)) {
+        return;
+    }
+    existing.additionalRegistrations = [
+        ...(existing.additionalRegistrations ?? []),
+        {
+            exportName: group.exportName,
+            sourceFile: group.sourceFile,
+            position: group.position,
+            isFactory: group.isFactory,
+        },
+    ];
+    existing.count += group.count;
+    existing.instanceIds = [...existing.instanceIds, ...group.instanceIds];
+    existing.services = {
+        optimized: false,
+        services: Array.from(new Set([...existing.services.services, ...group.services.services])),
+    };
+}
 function renameTempDefinitions(state, definitionIds, groupType, groupKey, storeKey = 'middleware') {
     const tempIndices = definitionIds
         .map((name, i) => (name.startsWith('__temp_') ? i : -1))
@@ -238,7 +281,7 @@ export const addMiddleware = (logger, node, checker, state) => {
             logger.warn(`• Middleware group '${exportedName}' for tag '${tag}' is not wrapped in a factory function. ` +
                 `For tree-shaking, use: export const ${exportedName} = () => addTagMiddleware('${tag}', [...])`);
         }
-        state.middleware.tagMiddleware.set(tag, {
+        recordMiddlewareGroup(state.middleware.tagMiddleware, tag, {
             exportName: exportedName,
             sourceFile,
             position: node.getStart(),
@@ -348,7 +391,7 @@ export const addMiddleware = (logger, node, checker, state) => {
             logger.warn(`• HTTP middleware group '${exportedName}' for pattern '${pattern}' is not wrapped in a factory function. ` +
                 `For tree-shaking, use: export const ${exportedName} = () => addHTTPMiddleware('${pattern}', [...])`);
         }
-        state.http.routeMiddleware.set(pattern, {
+        recordMiddlewareGroup(state.http.routeMiddleware, pattern, {
             exportName: exportedName,
             sourceFile,
             position: node.getStart(),
@@ -582,7 +625,7 @@ export const addMiddleware = (logger, node, checker, state) => {
             logger.warn(`• Channel middleware group '${exportedName}' for tag '${tag}' is not wrapped in a factory function. ` +
                 `For tree-shaking, use: export const ${exportedName} = () => addChannelMiddleware('${tag}', [...])`);
         }
-        state.channelMiddleware.tagMiddleware.set(tag, {
+        recordMiddlewareGroup(state.channelMiddleware.tagMiddleware, tag, {
             exportName: exportedName,
             sourceFile,
             position: node.getStart(),

package/dist/add/add-personas.d.ts

@@ -0,0 +1,13 @@
+import type { AddWiring } from '../types.js';
+/**
+ * Inspector for `definePersonas()` calls.
+ *
+ * A persona is entirely declaration — a person, their roles, what they want —
+ * so there is no code body and nothing to resolve at runtime. What is read here
+ * is the whole thing, and it is generated straight to `personas.gen.json` for
+ * the CLI and the console to read without loading the app.
+ *
+ * `name` is the one field that cannot be defaulted. A persona without one is
+ * not a person, and the console has nothing to show.
+ */
+export declare const addPersonas: AddWiring;

package/dist/add/add-personas.js

@@ -0,0 +1,210 @@
+import * as ts from 'typescript';
+import { DISPOSITIONS } from '@pikku/core/virtual-user';
+import { isRunnablePersona } from '@pikku/core/persona';
+import { ErrorCode } from '../error-codes.js';
+import { booleanProperty, getProperty, numberProperty, stringArrayProperty, stringProperty, unwrapAs, } from '../utils/literal-properties.js';
+/** A dial and the range outside which it is a mistake rather than a choice. */
+const RATES = [
+    ['temperature', 0, 2],
+    ['repeatRate', 0, 1],
+    ['reReadRate', 0, 1],
+];
+/**
+ * `{ moves, temperature, repeatRate, … }` — a disposition's dials, overridden.
+ *
+ * The ranges are checked here rather than at run time because these are the
+ * kind of typo that does not throw: `repeatRate: 18` meaning 18% would silently
+ * double every call the persona makes, and you would read the run as a product
+ * bug.
+ */
+const tuningProperty = (config, onError) => {
+    const value = getProperty(config, 'tuning');
+    if (!value || !ts.isObjectLiteralExpression(value)) {
+        return undefined;
+    }
+    const tuning = {};
+    const movesValue = getProperty(value, 'moves');
+    if (movesValue && ts.isObjectLiteralExpression(movesValue)) {
+        const moves = {};
+        for (const move of ['continue', 'suspend', 'resume', 'abandon']) {
+            const weight = numberProperty(movesValue, move);
+            if (weight === undefined) {
+                continue;
+            }
+            if (weight < 0) {
+                onError(`tuning.moves.${move} must not be negative (got ${weight}).`);
+                continue;
+            }
+            moves[move] = weight;
+        }
+        if (Object.keys(moves).length) {
+            tuning.moves = moves;
+        }
+    }
+    for (const [name, min, max] of RATES) {
+        const rate = numberProperty(value, name);
+        if (rate === undefined) {
+            continue;
+        }
+        if (rate < min || rate > max) {
+            onError(`tuning.${name} must be between ${min} and ${max} (got ${rate}).`);
+            continue;
+        }
+        Object.assign(tuning, { [name]: rate });
+    }
+    for (const flag of ['emptyMemory', 'readOnly', 'invertedOracle']) {
+        const declared = booleanProperty(value, flag);
+        if (declared !== undefined) {
+            tuning[flag] = declared;
+        }
+    }
+    const instructions = stringProperty(value, 'instructions');
+    if (instructions !== undefined) {
+        tuning.instructions = instructions;
+    }
+    return Object.keys(tuning).length ? tuning : undefined;
+};
+const accountProperty = (value) => {
+    if (!value || !ts.isObjectLiteralExpression(value)) {
+        return undefined;
+    }
+    const provider = stringProperty(value, 'provider');
+    return provider === undefined ? {} : { provider };
+};
+const linkedAccountsProperty = (config, personaId, logger) => {
+    const value = getProperty(config, 'linkedAccounts');
+    if (!value || !ts.isObjectLiteralExpression(value)) {
+        return undefined;
+    }
+    const accounts = {};
+    for (const prop of value.properties) {
+        if (!ts.isPropertyAssignment(prop)) {
+            continue;
+        }
+        if (!ts.isIdentifier(prop.name) && !ts.isStringLiteral(prop.name)) {
+            logger.critical(ErrorCode.NON_LITERAL_WIRE_NAME, `Persona '${personaId}' has a linked account whose key is not a literal.`);
+            continue;
+        }
+        const account = accountProperty(prop.initializer);
+        if (!account) {
+            logger.critical(ErrorCode.INVALID_VALUE, `Persona '${personaId}' linked account '${prop.name.text}' must be an object literal.`);
+            continue;
+        }
+        accounts[prop.name.text] = account;
+    }
+    return Object.keys(accounts).length ? accounts : undefined;
+};
+/**
+ * Inspector for `definePersonas()` calls.
+ *
+ * A persona is entirely declaration — a person, their roles, what they want —
+ * so there is no code body and nothing to resolve at runtime. What is read here
+ * is the whole thing, and it is generated straight to `personas.gen.json` for
+ * the CLI and the console to read without loading the app.
+ *
+ * `name` is the one field that cannot be defaulted. A persona without one is
+ * not a person, and the console has nothing to show.
+ */
+export const addPersonas = (logger, node, _checker, state) => {
+    if (!ts.isCallExpression(node)) {
+        return;
+    }
+    const expression = node.expression;
+    if (!ts.isIdentifier(expression) || expression.text !== 'definePersonas') {
+        return;
+    }
+    const firstArg = node.arguments[0];
+    if (!firstArg) {
+        return;
+    }
+    const unwrapped = unwrapAs(firstArg);
+    if (!ts.isObjectLiteralExpression(unwrapped)) {
+        logger.critical(ErrorCode.INVALID_VALUE, 'definePersonas() needs an inline object — personas are read statically, never evaluated.');
+        return;
+    }
+    const sourceFile = node.getSourceFile().fileName;
+    const known = Object.keys(DISPOSITIONS);
+    for (const prop of unwrapped.properties) {
+        if (!ts.isPropertyAssignment(prop)) {
+            continue;
+        }
+        if (!ts.isIdentifier(prop.name) && !ts.isStringLiteral(prop.name)) {
+            logger.critical(ErrorCode.NON_LITERAL_WIRE_NAME, 'A persona is declared with a key that is not a literal.');
+            continue;
+        }
+        const id = prop.name.text;
+        if (!ts.isObjectLiteralExpression(prop.initializer)) {
+            logger.critical(ErrorCode.INVALID_VALUE, `Persona '${id}' must be an object literal.`);
+            continue;
+        }
+        const config = prop.initializer;
+        const name = stringProperty(config, 'name');
+        if (!name) {
+            logger.critical(ErrorCode.INVALID_VALUE, `Persona '${id}' needs a literal 'name' — a persona is a person, and the console has nothing to show without one.`);
+            continue;
+        }
+        // The generated `definePersonas` types this as a union, so a bad value only
+        // reaches here in source that does not compile. Caught anyway: a
+        // disposition is the entire behaviour, and defaulting a typo to `realistic`
+        // would run a different person than the one that was written.
+        const disposition = stringProperty(config, 'disposition');
+        if (disposition !== undefined && !known.includes(disposition)) {
+            logger.critical(ErrorCode.INVALID_VALUE, `Persona '${id}' has an unknown disposition '${disposition}'. One of: ${known.join(', ')}`);
+            continue;
+        }
+        let tuningFailed = false;
+        const tuning = tuningProperty(config, (message) => {
+            tuningFailed = true;
+            logger.critical(ErrorCode.INVALID_VALUE, `Persona '${id}': ${message}`);
+        });
+        if (tuningFailed) {
+            continue;
+        }
+        const account = accountProperty(getProperty(config, 'account'));
+        const declaredRunnable = booleanProperty(config, 'runnable');
+        const persona = {
+            id,
+            name,
+            roles: stringArrayProperty(config, 'roles') ?? [],
+            goals: stringArrayProperty(config, 'goals') ?? [],
+            tags: stringArrayProperty(config, 'tags') ?? [],
+            runnable: isRunnablePersona({
+                ...(declaredRunnable !== undefined
+                    ? { runnable: declaredRunnable }
+                    : {}),
+                ...(account ? { account } : {}),
+            }),
+            sourceFile,
+        };
+        const jobTitle = stringProperty(config, 'jobTitle');
+        if (jobTitle !== undefined)
+            persona.jobTitle = jobTitle;
+        const description = stringProperty(config, 'description');
+        if (description !== undefined)
+            persona.description = description;
+        const personality = stringProperty(config, 'personality');
+        if (personality !== undefined)
+            persona.personality = personality;
+        if (disposition !== undefined) {
+            persona.disposition = disposition;
+        }
+        if (tuning !== undefined)
+            persona.tuning = tuning;
+        const fixtures = stringArrayProperty(config, 'fixtures');
+        if (fixtures !== undefined)
+            persona.fixtures = fixtures;
+        // Left absent rather than resolved here: "everywhere but production" is a
+        // fact about the config, and the inspector has no business baking today's
+        // environment list into a meta file that outlives it.
+        const environments = stringArrayProperty(config, 'environments');
+        if (environments !== undefined)
+            persona.environments = environments;
+        if (account !== undefined)
+            persona.account = account;
+        const linkedAccounts = linkedAccountsProperty(config, id, logger);
+        if (linkedAccounts !== undefined)
+            persona.linkedAccounts = linkedAccounts;
+        state.personas.files.add(sourceFile);
+        state.personas.definitions.push(persona);
+    }
+};

package/dist/add/add-scope.js

@@ -89,7 +89,7 @@ export const addScope = (logger, node, checker, state, _options) => {
         return;
     }
     const expression = node.expression;
-    if (!ts.isIdentifier(expression) || expression.text !== 'wireScope') {
+    if (!ts.isIdentifier(expression) || expression.text !== 'defineScope') {
         return;
     }
     const firstArg = node.arguments[0];

package/dist/add/add-secret.js

@@ -1,6 +1,6 @@
 import { createAddKeyedWiring } from './add-keyed-wiring.js';
 export const addSecret = createAddKeyedWiring({
-    functionName: 'wireSecret',
+    functionName: 'defineSecret',
     idField: 'secretId',
     label: 'Secret',
     schemaPrefix: 'SecretSchema',

package/dist/add/add-system-role.d.ts

@@ -0,0 +1,2 @@
+import type { AddWiring } from '../types.js';
+export declare const addSystemRole: AddWiring;