@pikku/inspector 0.12.58 → 0.12.60

package/src/add/{add-ai-scorer.test.ts → add-agent-scorer.test.ts}

@@ -23,7 +23,7 @@ const makeLogger = (criticals: Array<{ code: ErrorCode; message: string }>) =>
   }) satisfies InspectorLogger
 
 const inspectSources = async (sources: Record<string, string>) => {
-  const rootDir = await mkdtemp(join(tmpdir(), 'pikku-add-ai-scorer-'))
+  const rootDir = await mkdtemp(join(tmpdir(), 'pikku-add-agent-scorer-'))
   const files: Record<string, string> = {}
   for (const [name, source] of Object.entries(sources)) {
     files[name] = join(rootDir, name)
@@ -43,16 +43,16 @@ const inspectSources = async (sources: Record<string, string>) => {
 const inspectSource = (source: string) =>
   inspectSources({ 'grading.scorer.ts': source })
 
-describe('addAIScorer', () => {
+describe('addAgentScorer', () => {
   test('reads the lane off which constructor was called, not off a field', async () => {
     const { state, criticals } = await inspectSource(
       [
-        `export const brevity = pikkuAIScorer({`,
+        `export const brevity = pikkuAgentScorer({`,
         `  name: 'brevity',`,
         `  description: 'Shorter answers score higher',`,
         `  score: () => ({ score: 1 }),`,
         `})`,
-        `export const helpfulness = pikkuAIJudge({`,
+        `export const helpfulness = pikkuAgentJudge({`,
         `  name: 'helpfulness',`,
         `  description: 'Does the answer help',`,
         `  model: 'claude-opus-5',`,
@@ -69,7 +69,7 @@ describe('addAIScorer', () => {
   test('defaults an unstated sample rate to grading every run', async () => {
     const { state } = await inspectSource(
       [
-        `export const brevity = pikkuAIScorer({`,
+        `export const brevity = pikkuAgentScorer({`,
         `  name: 'brevity',`,
         `  description: 'Shorter answers score higher',`,
         `  score: () => ({ score: 1 }),`,
@@ -84,7 +84,7 @@ describe('addAIScorer', () => {
   test('carries the sample rate and the reference requirement into the meta', async () => {
     const { state } = await inspectSource(
       [
-        `export const correctness = pikkuAIJudge({`,
+        `export const correctness = pikkuAgentJudge({`,
         `  name: 'correctness',`,
         `  description: 'Is the answer right',`,
         `  model: 'claude-opus-5',`,
@@ -105,7 +105,7 @@ describe('addAIScorer', () => {
   test('rejects a sample rate that is not a fraction', async () => {
     const { state, criticals } = await inspectSource(
       [
-        `export const brevity = pikkuAIScorer({`,
+        `export const brevity = pikkuAgentScorer({`,
         `  name: 'brevity',`,
         `  description: 'Shorter answers score higher',`,
         `  sampleRate: 50,`,
@@ -122,7 +122,7 @@ describe('addAIScorer', () => {
   test('a scorer with no description is refused, since the meta is what names it', async () => {
     const { criticals } = await inspectSource(
       [
-        `export const brevity = pikkuAIScorer({`,
+        `export const brevity = pikkuAgentScorer({`,
         `  name: 'brevity',`,
         `  score: () => ({ score: 1 }),`,
         `})`,
@@ -135,7 +135,7 @@ describe('addAIScorer', () => {
   test('records where a scorer was declared, so codegen can import it back', async () => {
     const { state } = await inspectSource(
       [
-        `export const brevity = pikkuAIScorer({`,
+        `export const brevity = pikkuAgentScorer({`,
         `  name: 'brevity',`,
         `  description: 'Shorter answers score higher',`,
         `  score: () => ({ score: 1 }),`,
@@ -153,7 +153,7 @@ describe('addAIScorer', () => {
 
 describe('an agent asking to be graded', () => {
   const scorerFile = [
-    `export const brevity = pikkuAIScorer({`,
+    `export const brevity = pikkuAgentScorer({`,
     `  name: 'brevity',`,
     `  description: 'Shorter answers score higher',`,
     `  score: () => ({ score: 1 }),`,
@@ -162,7 +162,7 @@ describe('an agent asking to be graded', () => {
 
   const agent = (scorers: string) =>
     [
-      `export const assistant = pikkuAIAgent({`,
+      `export const assistant = pikkuAgent({`,
       `  name: 'assistant',`,
       `  description: 'Answers questions',`,
       `  goal: 'Answer the question.',`,

package/src/add/{add-ai-scorer.ts → add-agent-scorer.ts}

@@ -5,16 +5,16 @@ import { extractFunctionName } from '../utils/extract-function-name.js'
 import { ErrorCode } from '../error-codes.js'
 
 /**
- * `pikkuAIScorer` grades in code and `pikkuAIJudge` grades with a model, which
+ * `pikkuAgentScorer` grades in code and `pikkuAgentJudge` grades with a model, which
  * is the whole difference between the two lanes — so the lane is read off which
  * constructor was called rather than from a field an author could contradict.
  */
 const LANES: Record<string, 'fast' | 'slow'> = {
-  pikkuAIScorer: 'fast',
-  pikkuAIJudge: 'slow',
+  pikkuAgentScorer: 'fast',
+  pikkuAgentJudge: 'slow',
 }
 
-export const addAIScorer: AddWiring = (logger, node, checker, state) => {
+export const addAgentScorer: AddWiring = (logger, node, checker, state) => {
   if (!ts.isCallExpression(node)) return
 
   const expression = node.expression

package/src/add/{add-ai-agent.test.ts → add-agent.test.ts}

@@ -2,7 +2,7 @@ import { describe, test } from 'node:test'
 import assert from 'node:assert'
 import * as ts from 'typescript'
 
-import { resolveWorkflowReferences } from './add-ai-agent.js'
+import { resolveWorkflowReferences } from './add-agent.js'
 import type { InspectorLogger } from '../types.js'
 
 function createSourceFile(code: string): ts.SourceFile {

package/src/add/{add-ai-agent.ts → add-agent.ts}

@@ -12,7 +12,7 @@ import {
 import {
   resolveMiddleware,
   resolveChannelMiddleware,
-  resolveAIMiddleware,
+  resolveAgentMiddleware,
 } from '../utils/middleware.js'
 import { resolvePermissions } from '../utils/permissions.js'
 import { ErrorCode } from '../error-codes.js'
@@ -119,7 +119,7 @@ function resolveAgentReferences(
       logger.critical(
         ErrorCode.INVALID_VALUE,
         `AI agent '${agentName}' agents array contains a string literal '${element.text}'. ` +
-          `Use an agent reference instead (e.g., import the pikkuAIAgent variable).`
+          `Use an agent reference instead (e.g., import the pikkuAgent variable).`
       )
       continue
     }
@@ -134,7 +134,7 @@ function resolveAgentReferences(
       logger.critical(
         ErrorCode.INVALID_VALUE,
         `AI agent '${agentName}' agents array contains identifier '${element.text}' ` +
-          `that could not be resolved to a pikkuAIAgent.`
+          `that could not be resolved to a pikkuAgent.`
       )
     }
   }
@@ -319,7 +319,7 @@ function resolveIdentifierToAgentName(
     if (
       ts.isCallExpression(decl.initializer) &&
       ts.isIdentifier(decl.initializer.expression) &&
-      decl.initializer.expression.text === 'pikkuAIAgent'
+      decl.initializer.expression.text === 'pikkuAgent'
     ) {
       if (ts.isIdentifier(decl.name)) {
         return decl.name.text
@@ -363,13 +363,7 @@ function resolveScorerNames(
   return names.length > 0 ? names : null
 }
 
-export const addAIAgent: AddWiring = (
-  logger,
-  node,
-  checker,
-  state,
-  options
-) => {
+export const addAgent: AddWiring = (logger, node, checker, state, options) => {
   if (!ts.isCallExpression(node)) {
     return
   }
@@ -378,7 +372,7 @@ export const addAIAgent: AddWiring = (
   const firstArg = args[0]
   const expression = node.expression
 
-  if (!ts.isIdentifier(expression) || expression.text !== 'pikkuAIAgent') {
+  if (!ts.isIdentifier(expression) || expression.text !== 'pikkuAgent') {
     return
   }
 
@@ -579,7 +573,7 @@ export const addAIAgent: AddWiring = (
       tags,
       checker
     )
-    const aiMiddleware = resolveAIMiddleware(state, obj, checker)
+    const agentMiddleware = resolveAgentMiddleware(state, obj, checker)
     const permissions = resolvePermissions(state, obj, tags, checker)
 
     state.serviceAggregation.usedFunctions.add(agentKey)
@@ -623,7 +617,7 @@ export const addAIAgent: AddWiring = (
       workingMemorySchema,
       middleware,
       channelMiddleware,
-      aiMiddleware,
+      agentMiddleware,
       permissions,
     }
 
@@ -632,10 +626,10 @@ export const addAIAgent: AddWiring = (
     const funcMeta = state.functions.meta[agentKey]
     if (funcMeta?.services) {
       for (const svc of [
-        'aiStorage',
-        'aiRunState',
+        'agentStorage',
+        'agentRunState',
         'agentRunService',
-        'aiAgentRunner',
+        'agentRunner',
       ]) {
         if (!funcMeta.services.services.includes(svc)) {
           funcMeta.services.services.push(svc)

package/src/add/add-auth.ts

@@ -1,5 +1,5 @@
 import * as ts from 'typescript'
-import type { FunctionServicesMeta } from '@pikku/core'
+import type { FunctionServicesMeta } from '@pikku/core/ecosystem/types'
 import type { AddWiring } from '../types.js'
 import { ErrorCode } from '../error-codes.js'
 import { extractServicesFromFunction } from '../utils/extract-services.js'

package/src/add/add-channel.ts

@@ -10,7 +10,10 @@ import {
   makeContextBasedId,
 } from '../utils/extract-function-name.js'
 import { getPropertyAssignmentInitializer } from '../utils/type-utils.js'
-import type { ChannelMessageMeta, ChannelMeta } from '@pikku/core/channel'
+import type {
+  ChannelMessageMeta,
+  ChannelMeta,
+} from '@pikku/core/ecosystem/channel'
 import type { InspectorState, AddWiring } from '../types.js'
 import {
   resolveMiddleware,

package/src/add/add-cli.ts

@@ -6,7 +6,7 @@ import type {
   InspectorOptions,
   InspectorState,
 } from '../types.js'
-import type { CLIProgramMeta, CLICommandMeta } from '@pikku/core/cli'
+import type { CLIProgramMeta, CLICommandMeta } from '@pikku/core/ecosystem/cli'
 import {
   extractFunctionName,
   makeContextBasedId,

package/src/add/add-functions.ts

@@ -8,9 +8,14 @@ import {
 } from '../utils/extract-function-name.js'
 import { extractFunctionNode } from '../utils/extract-function-node.js'
 import { extractUsedWires } from '../utils/extract-services.js'
-import type { AuditDurability, FunctionServicesMeta } from '@pikku/core'
-import type { ScenarioStepKind, ScenarioSurface } from '@pikku/core/workflow'
-import { formatVersionedId, parseVersionedId } from '@pikku/core'
+import type { AuditDurability } from '@pikku/core/ecosystem/services'
+import type { FunctionServicesMeta } from '@pikku/core/ecosystem/types'
+import type { ScenarioSurface } from '@pikku/core/scenario'
+import type { ScenarioStepKind } from '@pikku/core/ecosystem/scenario'
+import {
+  formatVersionedId,
+  parseVersionedId,
+} from '@pikku/core/ecosystem/types'
 
 /** Binding keys a `pikkuScenarioStep` may declare, in report order. */
 const SCENARIO_SURFACE_KEYS: readonly ScenarioSurface[] = [
@@ -44,7 +49,7 @@ import { ErrorCode } from '../error-codes.js'
 import { findPiiPaths } from '../utils/check-pii-output.js'
 import { findRevealedSecretSinks } from '../utils/check-secret-sinks.js'
 import { isScenarioInstrumentationFunction } from './scenario-instrumentation.js'
-import type { NodeType } from '@pikku/core/node'
+import type { NodeType } from '@pikku/core/ecosystem/node'
 
 const isValidVariableName = (name: string) => {
   const regex = /^[a-zA-Z_$][a-zA-Z0-9_$]*$/

package/src/add/add-gateway.ts

@@ -13,7 +13,7 @@ import { ensureInlineWiringFunction } from '../utils/ensure-function-metadata.js
 import { resolveMiddleware } from '../utils/middleware.js'
 import { extractWireNames } from '../utils/post-process.js'
 import { resolveAddonName } from '../utils/resolve-addon-package.js'
-import type { GatewayTransportType } from '@pikku/core/gateway'
+import type { GatewayTransportType } from '@pikku/core/ecosystem/gateway'
 
 import { ErrorCode } from '../error-codes.js'
 

package/src/add/add-http-route.ts

@@ -4,7 +4,7 @@ import {
   getCommonWireMetaData,
 } from '../utils/get-property-value.js'
 import { pathToRegexp } from 'path-to-regexp'
-import type { HTTPMethod } from '@pikku/core/http'
+import type { HTTPMethod } from '@pikku/core/ecosystem/http'
 import {
   extractFunctionName,
   makeContextBasedId,

package/src/add/add-keyed-wiring.ts

@@ -7,7 +7,7 @@ import {
 import type { AddWiring, InspectorState } from '../types.js'
 import { ErrorCode } from '../error-codes.js'
 import { detectSchemaVendorOrError } from '../utils/detect-schema-vendor.js'
-import { parseDurationString } from '@pikku/core'
+import { parseDurationString } from '@pikku/core/ecosystem/types'
 
 export interface KeyedWiringConfig {
   functionName: string

package/src/add/add-middleware.ts

@@ -698,12 +698,14 @@ export const addMiddleware: AddWiring = (logger, node, checker, state) => {
     return
   }
 
-  if (expression.text === 'pikkuAIMiddleware') {
+  if (expression.text === 'pikkuAgentMiddleware') {
     const arg = args[0]
     if (!arg) return
 
     if (!ts.isObjectLiteralExpression(arg)) {
-      logger.error(`• pikkuAIMiddleware() requires an object literal argument.`)
+      logger.error(
+        `• pikkuAgentMiddleware() requires an object literal argument.`
+      )
       return
     }
 
@@ -744,13 +746,13 @@ export const addMiddleware: AddWiring = (logger, node, checker, state) => {
         pikkuFuncId = node.parent.name.text
       } else {
         logger.error(
-          `• pikkuAIMiddleware() must be assigned to a variable or object property. ` +
-            `Extract it to a const: const myMiddleware = pikkuAIMiddleware(...)`
+          `• pikkuAgentMiddleware() must be assigned to a variable or object property. ` +
+            `Extract it to a const: const myMiddleware = pikkuAgentMiddleware(...)`
         )
         return
       }
     }
-    state.aiMiddleware.definitions[pikkuFuncId] = {
+    state.agentMiddleware.definitions[pikkuFuncId] = {
       services,
       sourceFile: node.getSourceFile().fileName,
       position: node.getStart(),

package/src/add/add-permission.ts

@@ -1,5 +1,5 @@
 import * as ts from 'typescript'
-import type { FunctionWiresMeta } from '@pikku/core'
+import type { FunctionWiresMeta } from '@pikku/core/ecosystem/types'
 import type { AddWiring } from '../types.js'
 import { extractFunctionName } from '../utils/extract-function-name.js'
 import {

package/src/add/add-personas.test.ts

@@ -57,8 +57,8 @@ const inspectSources = async (sources: Record<string, string>) => {
 /** The declared world every persona below is checked against. */
 const withRoles = (...lines: string[]) =>
   [
-    "import { defineScope } from '@pikku/core/scope'",
-    "import { defineSystemRole } from '@pikku/core/role'",
+    "import { defineScope } from '@pikku/core/ecosystem/scope'",
+    "import { defineSystemRole } from '@pikku/core/ecosystem/role'",
     "import { definePersonas } from '@pikku/core/persona'",
     'defineScope({ catalogue: { scopes: { read: {} } }, admin: {} })',
     'defineSystemRole({',

package/src/add/add-personas.ts

@@ -1,7 +1,8 @@
 import * as ts from 'typescript'
-import { DISPOSITIONS } from '@pikku/core/virtual-user'
+import { DISPOSITIONS } from '@pikku/core/ecosystem/virtual-user'
 import { isRunnablePersona } from '@pikku/core/persona'
-import type { PersonaAccountMeta, PersonaMeta } from '@pikku/core/persona'
+import type { PersonaMeta } from '@pikku/core/persona'
+import type { PersonaAccountMeta } from '@pikku/core/ecosystem/persona'
 import { ErrorCode } from '../error-codes.js'
 import { claimSingleDeclaration } from '../utils/single-declaration.js'
 import type { AddWiring, InspectorLogger } from '../types.js'

package/src/add/add-scenario-step.test.ts

@@ -5,7 +5,8 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { inspect } from '../inspector.js'
 import type { InspectorLogger } from '../types.js'
-import type { ScenarioStepMeta, WorkflowStepMeta } from '@pikku/core/workflow'
+import type { WorkflowStepMeta } from '@pikku/core/ecosystem/workflow'
+import type { ScenarioStepMeta } from '@pikku/core/ecosystem/scenario'
 
 function makeLogger(
   criticals: Array<{ code: string; message: string }>

package/src/add/add-scope.test.ts

@@ -58,7 +58,7 @@ describe('addScope inspector', () => {
   test('extracts a flat scope', async () => {
     const { state, criticals } = await inspectSource(
       [
-        "import { defineScope } from '@pikku/core/scope'",
+        "import { defineScope } from '@pikku/core/ecosystem/scope'",
         'defineScope({',
         '  admin: {',
         "    displayName: 'Administration',",
@@ -81,7 +81,7 @@ describe('addScope inspector', () => {
   test('extracts a displayName at every depth', async () => {
     const { state, criticals } = await inspectSource(
       [
-        "import { defineScope } from '@pikku/core/scope'",
+        "import { defineScope } from '@pikku/core/ecosystem/scope'",
         'defineScope({',
         '  admin: {',
         "    displayName: 'Administration',",
@@ -109,7 +109,7 @@ describe('addScope inspector', () => {
   test('extracts a nested scope tree', async () => {
     const { state, criticals } = await inspectSource(
       [
-        "import { defineScope } from '@pikku/core/scope'",
+        "import { defineScope } from '@pikku/core/ecosystem/scope'",
         'defineScope({',
         '  admin: {',
         '    scopes: {',
@@ -139,7 +139,7 @@ describe('addScope inspector', () => {
   test('records the source file', async () => {
     const { state, file } = await inspectSource(
       [
-        "import { defineScope } from '@pikku/core/scope'",
+        "import { defineScope } from '@pikku/core/ecosystem/scope'",
         'defineScope({ admin: {} })',
       ].join('\n')
     )
@@ -153,7 +153,7 @@ describe('addScope inspector', () => {
   test('extracts several roots from one declaration', async () => {
     const { state, criticals } = await inspectSource(
       [
-        "import { defineScope } from '@pikku/core/scope'",
+        "import { defineScope } from '@pikku/core/ecosystem/scope'",
         'defineScope({ admin: {}, billing: { scopes: { read: {} } } })',
       ].join('\n')
     )
@@ -169,7 +169,7 @@ describe('addScope inspector', () => {
   test('extracts several declarations', async () => {
     const { state } = await inspectSource(
       [
-        "import { defineScope } from '@pikku/core/scope'",
+        "import { defineScope } from '@pikku/core/ecosystem/scope'",
         'defineScope({ admin: {} })',
         'defineScope({ billing: {} })',
       ].join('\n')
@@ -188,11 +188,11 @@ describe('addScope inspector', () => {
   test('declarations in separate files all survive', async () => {
     const { state, criticals } = await inspectSources({
       'user-admin.gen.ts': [
-        "import { defineScope } from '@pikku/core/scope'",
+        "import { defineScope } from '@pikku/core/ecosystem/scope'",
         'defineScope({ admin: {} })',
       ].join('\n'),
       'scopes.ts': [
-        "import { defineScope } from '@pikku/core/scope'",
+        "import { defineScope } from '@pikku/core/ecosystem/scope'",
         'defineScope({ billing: {} })',
       ].join('\n'),
     })
@@ -202,10 +202,10 @@ describe('addScope inspector', () => {
       [],
       `expected no duplicate critical, got ${JSON.stringify(criticals)}`
     )
-    assert.deepEqual(
-      state.scopes.definitions.map((d) => d.name).sort(),
-      ['admin', 'billing']
-    )
+    assert.deepEqual(state.scopes.definitions.map((d) => d.name).sort(), [
+      'admin',
+      'billing',
+    ])
   })
 
   // The CLI scaffolds a scope tree of its own — `user-admin.gen.ts` declares the
@@ -214,11 +214,11 @@ describe('addScope inspector', () => {
   test('a generated declaration neither claims the slot nor conflicts', async () => {
     const { state, criticals } = await inspectSources({
       'user-admin.gen.ts': [
-        "import { defineScope } from '@pikku/core/scope'",
+        "import { defineScope } from '@pikku/core/ecosystem/scope'",
         'defineScope({ admin: {} })',
       ].join('\n'),
       'scopes.ts': [
-        "import { defineScope } from '@pikku/core/scope'",
+        "import { defineScope } from '@pikku/core/ecosystem/scope'",
         'defineScope({ billing: {} })',
       ].join('\n'),
     })
@@ -238,7 +238,7 @@ describe('addScope inspector', () => {
   test('is critical when a root embeds the separator', async () => {
     const { criticals } = await inspectSource(
       [
-        "import { defineScope } from '@pikku/core/scope'",
+        "import { defineScope } from '@pikku/core/ecosystem/scope'",
         "defineScope({ 'admin:users': {} })",
       ].join('\n')
     )
@@ -252,7 +252,7 @@ describe('addScope inspector', () => {
   test('is critical when a root is the wildcard', async () => {
     const { criticals } = await inspectSource(
       [
-        "import { defineScope } from '@pikku/core/scope'",
+        "import { defineScope } from '@pikku/core/ecosystem/scope'",
         "defineScope({ '*': {} })",
       ].join('\n')
     )
@@ -266,7 +266,7 @@ describe('addScope inspector', () => {
   test('is critical when a root key is not a literal', async () => {
     const { criticals } = await inspectSource(
       [
-        "import { defineScope } from '@pikku/core/scope'",
+        "import { defineScope } from '@pikku/core/ecosystem/scope'",
         'const k = String(1)',
         'defineScope({ [k]: {} } as any)',
       ].join('\n')
@@ -281,7 +281,7 @@ describe('addScope inspector', () => {
   test('is critical when a root is not an object literal', async () => {
     const { criticals } = await inspectSource(
       [
-        "import { defineScope } from '@pikku/core/scope'",
+        "import { defineScope } from '@pikku/core/ecosystem/scope'",
         "defineScope({ admin: 'nope' } as any)",
       ].join('\n')
     )
@@ -296,7 +296,7 @@ describe('addScope inspector', () => {
 describe('validateScopeReferences', () => {
   const funcSource = (scopes: string, decls: string[] = []) =>
     [
-      "import { defineScope } from '@pikku/core/scope'",
+      "import { defineScope } from '@pikku/core/ecosystem/scope'",
       "import { pikkuSessionlessFunc } from '@pikku/core'",
       ...decls,
       'export const f = pikkuSessionlessFunc({',

package/src/add/add-scope.ts

@@ -2,7 +2,7 @@ import * as ts from 'typescript'
 import { getPropertyValue } from '../utils/get-property-value.js'
 import type { AddWiring, InspectorLogger } from '../types.js'
 import { ErrorCode } from '../error-codes.js'
-import type { ScopeNodeMeta } from '@pikku/core/scope'
+import type { ScopeNodeMeta } from '@pikku/core/ecosystem/scope'
 
 const SEPARATOR = ':'
 const WILDCARD = '*'

package/src/add/add-system-role.test.ts

@@ -55,8 +55,8 @@ const inspectSources = async (sources: Record<string, string>) => {
 }
 
 const IMPORTS = [
-  "import { defineScope } from '@pikku/core/scope'",
-  "import { defineSystemRole } from '@pikku/core/role'",
+  "import { defineScope } from '@pikku/core/ecosystem/scope'",
+  "import { defineSystemRole } from '@pikku/core/ecosystem/role'",
 ]
 
 const withScopes = (...lines: string[]) =>
@@ -118,10 +118,10 @@ describe('addSystemRole inspector', () => {
       )
     )
 
-    assert.deepEqual(
-      state.systemRoles.definitions.map((r) => r.name).sort(),
-      ['admin', 'buyer']
-    )
+    assert.deepEqual(state.systemRoles.definitions.map((r) => r.name).sort(), [
+      'admin',
+      'buyer',
+    ])
   })
 
   // Roles follow scopes: a project scaffolding user-admin has a generated
@@ -132,7 +132,7 @@ describe('addSystemRole inspector', () => {
         "defineSystemRole({ buyer: { scopes: ['catalogue:read'] } })"
       ),
       'more-roles.ts': [
-        "import { defineSystemRole } from '@pikku/core/role'",
+        "import { defineSystemRole } from '@pikku/core/ecosystem/role'",
         "defineSystemRole({ admin: { scopes: ['admin'] } })",
       ].join('\n'),
     })
@@ -142,10 +142,10 @@ describe('addSystemRole inspector', () => {
       [],
       `expected no duplicate critical, got ${JSON.stringify(criticals)}`
     )
-    assert.deepEqual(
-      state.systemRoles.definitions.map((r) => r.name).sort(),
-      ['admin', 'buyer']
-    )
+    assert.deepEqual(state.systemRoles.definitions.map((r) => r.name).sort(), [
+      'admin',
+      'buyer',
+    ])
   })
 
   // A generated file is not the one place a person adds a role to, so it neither
@@ -153,7 +153,7 @@ describe('addSystemRole inspector', () => {
   test('a generated declaration neither claims the slot nor conflicts', async () => {
     const { state, criticals } = await inspectSources({
       'roles.gen.ts': [
-        "import { defineSystemRole } from '@pikku/core/role'",
+        "import { defineSystemRole } from '@pikku/core/ecosystem/role'",
         'defineSystemRole({ admin: { scopes: [] } })',
       ].join('\n'),
       'roles.ts': withScopes(

package/src/add/add-wire-addon.test.ts

@@ -61,11 +61,42 @@ describe('addWireAddon', () => {
       secretOverrides: undefined,
       variableOverrides: undefined,
       credentialOverrides: undefined,
+      secretGrants: undefined,
+      credentialGrants: undefined,
       globalSecrets: undefined,
       globalCredentials: undefined,
     })
   })
 
+  test('captures the secrets and credentials the host lends an addon', () => {
+    const declarations = inspect(`
+      wireAddon({
+        name: 'graph',
+        package: '@pikku/addon-graph',
+        secretGrants: ['STRIPE_KEY', 'GITHUB_TOKEN'],
+        credentialGrants: ['slack'],
+      })
+    `)
+
+    assert.deepEqual(declarations.get('graph').secretGrants, [
+      'STRIPE_KEY',
+      'GITHUB_TOKEN',
+    ])
+    assert.deepEqual(declarations.get('graph').credentialGrants, ['slack'])
+  })
+
+  test('drops a grant list that is not statically knowable', () => {
+    const declarations = inspect(`
+      wireAddon({
+        name: 'graph',
+        package: '@pikku/addon-graph',
+        secretGrants: someRuntimeList,
+      })
+    `)
+
+    assert.equal(declarations.get('graph').secretGrants, undefined)
+  })
+
   test('captures the reason an addon was exempted from credential scoping', () => {
     const declarations = inspect(`
       wireAddon({