@pikku/inspector 0.12.58 → 0.12.60

package/src/add/add-wire-addon.ts

@@ -60,6 +60,8 @@ export function addWireAddon(
   let secretOverrides: Record<string, string> | undefined
   let variableOverrides: Record<string, string> | undefined
   let credentialOverrides: Record<string, string> | undefined
+  let secretGrants: string[] | undefined
+  let credentialGrants: string[] | undefined
   let globalSecrets: string | undefined
   let globalCredentials: string | undefined
 
@@ -104,6 +106,10 @@ export function addWireAddon(
       ts.isObjectLiteralExpression(prop.initializer)
     ) {
       credentialOverrides = parseStringRecord(prop.initializer)
+    } else if (key === 'secretGrants') {
+      secretGrants = parseStringArray(prop.initializer)
+    } else if (key === 'credentialGrants') {
+      credentialGrants = parseStringArray(prop.initializer)
     } else if (key === 'globalSecrets') {
       // The grant is real at runtime whatever the reason evaluates to, so a
       // non-literal is recorded as its source text rather than dropped.
@@ -130,6 +136,8 @@ export function addWireAddon(
     secretOverrides,
     variableOverrides,
     credentialOverrides,
+    secretGrants,
+    credentialGrants,
     globalSecrets,
     globalCredentials,
   })

package/src/add/add-workflow-graph-input.test.ts

@@ -36,7 +36,7 @@ describe('addWorkflowGraph — node input extraction', () => {
       graphFile,
       [
         "import { pikkuWorkflowGraph } from '@pikku/core/workflow'",
-        "import { template } from '@pikku/core/workflow'",
+        "import { template } from '@pikku/core/ecosystem/workflow'",
         'export const myGraph = pikkuWorkflowGraph({',
         "  name: 'input-graph',",
         "  nodes: { edit: 'edit' },",

package/src/add/add-workflow.ts

@@ -3,7 +3,10 @@ import type { AddWiring, InspectorState } from '../types.js'
 import { extractFunctionName } from '../utils/extract-function-name.js'
 import { extractFunctionNode } from '../utils/extract-function-node.js'
 import { ErrorCode } from '../error-codes.js'
-import type { WorkflowStepMeta, WorkflowContext } from '@pikku/core/workflow'
+import type {
+  WorkflowStepMeta,
+  WorkflowContext,
+} from '@pikku/core/ecosystem/workflow'
 import {
   extractStringLiteral,
   isStringLike,

package/src/add/addon-contracts.test.ts

@@ -178,7 +178,7 @@ describe('addon contract metadata', () => {
     await writeFile(
       appFile,
       [
-        "import { wireAddon } from '@pikku/core/rpc'",
+        "import { wireAddon } from '@pikku/core/ecosystem/rpc'",
         "import { wireHTTPRoutes } from '@pikku/core/http'",
         "import { wireChannel } from '@pikku/core/channel'",
         "import { wireCLI } from '@pikku/core/cli'",

package/src/error-codes.ts

@@ -105,6 +105,7 @@ export enum ErrorCode {
   // Dependency integrity errors
   DUPLICATE_CORE_VERSION = 'PKU717',
   CORE_VERSION_SKEW = 'PKU718',
+  SPLIT_TYPE_IDENTITY = 'PKU719',
 
   // Data classification errors
   PII_IN_OUTPUT = 'PKU910',

package/src/inspector.ts

@@ -221,7 +221,7 @@ export function getInitialInspectorState(rootDir: string): InspectorState {
       instances: {},
       tagMiddleware: new Map(),
     },
-    aiMiddleware: {
+    agentMiddleware: {
       definitions: {},
     },
     permissions: {

package/src/types.ts

@@ -1,35 +1,41 @@
 import type * as ts from 'typescript'
 import type { SecretUsage } from './utils/extract-secret-usage.js'
-import type { ChannelMessageMeta, ChannelsMeta } from '@pikku/core/channel'
-import type { GatewaysMeta } from '@pikku/core/gateway'
-import type { HTTPWiringsMeta } from '@pikku/core/http'
-import type { ScheduledTasksMeta } from '@pikku/core/scheduler'
-import type { TriggerMeta, TriggerSourceMeta } from '@pikku/core/trigger'
-import type { QueueWorkersMeta } from '@pikku/core/queue'
-import type { WorkflowsMeta } from '@pikku/core/workflow'
+import type {
+  ChannelMessageMeta,
+  ChannelsMeta,
+} from '@pikku/core/ecosystem/channel'
+import type { GatewaysMeta } from '@pikku/core/ecosystem/gateway'
+import type { HTTPWiringsMeta } from '@pikku/core/ecosystem/http'
+import type { ScheduledTasksMeta } from '@pikku/core/ecosystem/scheduler'
+import type {
+  TriggerMeta,
+  TriggerSourceMeta,
+} from '@pikku/core/ecosystem/trigger'
+import type { QueueWorkersMeta } from '@pikku/core/ecosystem/queue'
+import type { WorkflowsMeta } from '@pikku/core/ecosystem/workflow'
 import type {
   MCPResourceMeta,
   MCPToolMeta,
   MCPPromptMeta,
-} from '@pikku/core/mcp'
-import type { AIAgentMeta } from '@pikku/core/ai-agent'
-import type { ScorerMeta } from '@pikku/core/ai-scorer'
-import type { CLIMeta } from '@pikku/core/cli'
-import type { CLICommandMeta } from '@pikku/core/cli'
-import type { NodesMeta } from '@pikku/core/node'
-import type { SecretDefinitions } from '@pikku/core/secret'
-import type { CredentialDefinitions } from '@pikku/core/credential'
-import type { ScopeDefinitions } from '@pikku/core/scope'
-import type { SystemRoleDefinitions } from '@pikku/core/role'
-import type { PersonaDefinitions } from '@pikku/core/persona'
-import type { VariableDefinitions } from '@pikku/core/variable'
+} from '@pikku/core/ecosystem/mcp'
+import type { AgentsMeta } from '@pikku/core/ecosystem/agent'
+import type { ScorerMeta } from '@pikku/core/ecosystem/agent-scorer'
+import type { CLIMeta } from '@pikku/core/ecosystem/cli'
+import type { CLICommandMeta } from '@pikku/core/ecosystem/cli'
+import type { NodesMeta } from '@pikku/core/ecosystem/node'
+import type { SecretDefinitions } from '@pikku/core/ecosystem/secret'
+import type { CredentialDefinitions } from '@pikku/core/ecosystem/credential'
+import type { ScopeDefinitions } from '@pikku/core/ecosystem/scope'
+import type { SystemRoleDefinitions } from '@pikku/core/ecosystem/role'
+import type { PersonaDefinitions } from '@pikku/core/ecosystem/persona'
+import type { VariableDefinitions } from '@pikku/core/ecosystem/variable'
 import type { TypesMap } from './types-map.js'
+import type { FunctionsMeta } from '@pikku/core/ecosystem/services'
 import type {
-  FunctionsMeta,
   FunctionServicesMeta,
   FunctionWiresMeta,
   JSONValue,
-} from '@pikku/core'
+} from '@pikku/core/ecosystem/types'
 import type { OpenAPISpecInfo } from './utils/serialize-openapi-json.js'
 import type { ErrorCode, CodedDiagnostic } from './error-codes.js'
 import type {
@@ -588,6 +594,10 @@ export interface InspectorState {
         secretOverrides?: Record<string, string>
         variableOverrides?: Record<string, string>
         credentialOverrides?: Record<string, string>
+        /** Secrets the app lends this instance, named as the addon reads them. */
+        secretGrants?: string[]
+        /** Credentials the app lends this instance, named as the addon reads them. */
+        credentialGrants?: string[]
         /**
          * The app's stated reason for handing this instance the whole
          * `SecretService` instead of one scoped to its declared secrets.
@@ -609,7 +619,7 @@ export interface InspectorState {
     files: Set<string>
   }
   agents: {
-    agentsMeta: AIAgentMeta
+    agentsMeta: AgentsMeta
     files: Map<string, { path: string; exportedName: string }>
   }
   scorers: {
@@ -677,7 +687,7 @@ export interface InspectorState {
   }
   middleware: InspectorMiddlewareState
   channelMiddleware: InspectorChannelMiddlewareState
-  aiMiddleware: InspectorAIMiddlewareState
+  agentMiddleware: InspectorAIMiddlewareState
   permissions: InspectorPermissionState
   serviceAggregation: {
     requiredServices: Set<string>

package/src/utils/compute-required-schemas.ts

@@ -1,4 +1,4 @@
-import type { FunctionsMeta } from '@pikku/core'
+import type { FunctionsMeta } from '@pikku/core/ecosystem/services'
 import type { TypesMap } from '../types-map.js'
 import type { SchemaRef } from '../types.js'
 

package/src/utils/contract-hashes.test.ts

@@ -10,7 +10,7 @@ import {
   extractContractsFromMeta,
 } from './contract-hashes.js'
 import type { ContractEntry, VersionManifest } from './contract-hashes.js'
-import type { FunctionsMeta } from '@pikku/core'
+import type { FunctionsMeta } from '@pikku/core/ecosystem/services'
 import { ErrorCode } from '../error-codes.js'
 
 function makeContracts(

package/src/utils/contract-hashes.ts

@@ -1,5 +1,6 @@
-import type { FunctionsMeta, JSONValue } from '@pikku/core'
-import { parseVersionedId } from '@pikku/core'
+import type { FunctionsMeta } from '@pikku/core/ecosystem/services'
+import type { JSONValue } from '@pikku/core/ecosystem/types'
+import { parseVersionedId } from '@pikku/core/ecosystem/types'
 import type { TypesMap } from '../types-map.js'
 import { ErrorCode } from '../error-codes.js'
 import { canonicalJSON, hashString } from './hash.js'

package/src/utils/extract-function-name.ts

@@ -1,7 +1,7 @@
 import * as ts from 'typescript'
 import { createHash } from 'crypto'
 import { relative } from 'path'
-import { formatVersionedId } from '@pikku/core'
+import { formatVersionedId } from '@pikku/core/ecosystem/types'
 
 /**
  * Deterministic placeholder id for an anonymous/unnamed pikku function or

package/src/utils/extract-services.ts

@@ -1,5 +1,8 @@
 import * as ts from 'typescript'
-import type { FunctionServicesMeta, FunctionWiresMeta } from '@pikku/core'
+import type {
+  FunctionServicesMeta,
+  FunctionWiresMeta,
+} from '@pikku/core/ecosystem/types'
 
 /**
  * Extract services from a function's first parameter destructuring pattern

package/src/utils/filter-inspector-state.ts

@@ -3,8 +3,8 @@ import type {
   InspectorFilters,
   InspectorLogger,
 } from '../types.js'
-import type { PikkuWiringTypes } from '@pikku/core'
-import { parseVersionedId } from '@pikku/core'
+import type { PikkuWiringTypes } from '@pikku/core/ecosystem/types'
+import { parseVersionedId } from '@pikku/core/ecosystem/types'
 import { aggregateRequiredServices } from './post-process.js'
 import { resolveDeployTarget } from './resolve-deploy-target.js'
 

package/src/utils/filter-utils.ts

@@ -1,5 +1,5 @@
 import type { InspectorFilters, InspectorLogger } from '../types.js'
-import type { PikkuWiringTypes } from '@pikku/core'
+import type { PikkuWiringTypes } from '@pikku/core/ecosystem/types'
 
 /**
  * Match a value against a pattern with wildcard support

package/src/utils/middleware.test.ts

@@ -1,6 +1,6 @@
 import { describe, test } from 'node:test'
 import assert from 'node:assert'
-import { resolveAIMiddleware } from './middleware.js'
+import { resolveAgentMiddleware } from './middleware.js'
 import { getInitialInspectorState } from '../inspector.js'
 import * as ts from 'typescript'
 
@@ -26,39 +26,39 @@ function createMockChecker(): ts.TypeChecker {
   return {} as any
 }
 
-describe('resolveAIMiddleware', () => {
-  test('should return undefined when no aiMiddleware property exists', () => {
+describe('resolveAgentMiddleware', () => {
+  test('should return undefined when no agentMiddleware property exists', () => {
     const state = getInitialInspectorState('/test')
     const src = createSourceFile('const x = { name: "test" }')
     const obj = getObjectLiteral(src)
     const checker = createMockChecker()
 
-    const result = resolveAIMiddleware(state, obj, checker)
+    const result = resolveAgentMiddleware(state, obj, checker)
 
     assert.strictEqual(result, undefined)
   })
 
-  test('should return undefined when aiMiddleware array is empty', () => {
+  test('should return undefined when agentMiddleware array is empty', () => {
     const state = getInitialInspectorState('/test')
-    const src = createSourceFile('const x = { aiMiddleware: [] }')
+    const src = createSourceFile('const x = { agentMiddleware: [] }')
     const obj = getObjectLiteral(src)
     const checker = createMockChecker()
 
-    const result = resolveAIMiddleware(state, obj, checker)
+    const result = resolveAgentMiddleware(state, obj, checker)
 
     assert.strictEqual(result, undefined)
   })
 
-  test('should resolve aiMiddleware identifiers as wire metadata', () => {
+  test('should resolve agentMiddleware identifiers as wire metadata', () => {
     const state = getInitialInspectorState('/test')
-    state.aiMiddleware.definitions['myAIMW'] = {
+    state.agentMiddleware.definitions['myAIMW'] = {
       services: { optimized: true, services: ['logger'] },
       sourceFile: '/test/middleware.ts',
       position: 0,
       exportedName: 'myAIMW',
     }
 
-    const code = 'const x = { aiMiddleware: [myAIMW] }'
+    const code = 'const x = { agentMiddleware: [myAIMW] }'
     const program = ts.createProgram({
       rootNames: ['test.ts'],
       options: { target: ts.ScriptTarget.ESNext },
@@ -77,7 +77,7 @@ describe('resolveAIMiddleware', () => {
     const sourceFile = program.getSourceFile('test.ts')!
     const obj = getObjectLiteral(sourceFile)
 
-    const result = resolveAIMiddleware(state, obj, checker)
+    const result = resolveAgentMiddleware(state, obj, checker)
 
     assert.ok(result)
     assert.strictEqual(result.length, 1)
@@ -88,22 +88,22 @@ describe('resolveAIMiddleware', () => {
     })
   })
 
-  test('should resolve multiple aiMiddleware entries', () => {
+  test('should resolve multiple agentMiddleware entries', () => {
     const state = getInitialInspectorState('/test')
-    state.aiMiddleware.definitions['firstMW'] = {
+    state.agentMiddleware.definitions['firstMW'] = {
       services: { optimized: true, services: ['logger'] },
       sourceFile: '/test/middleware.ts',
       position: 0,
       exportedName: 'firstMW',
     }
-    state.aiMiddleware.definitions['secondMW'] = {
+    state.agentMiddleware.definitions['secondMW'] = {
       services: { optimized: true, services: [] },
       sourceFile: '/test/middleware.ts',
       position: 100,
       exportedName: 'secondMW',
     }
 
-    const code = 'const x = { aiMiddleware: [firstMW, secondMW] }'
+    const code = 'const x = { agentMiddleware: [firstMW, secondMW] }'
     const program = ts.createProgram({
       rootNames: ['test.ts'],
       options: { target: ts.ScriptTarget.ESNext },
@@ -122,7 +122,7 @@ describe('resolveAIMiddleware', () => {
     const sourceFile = program.getSourceFile('test.ts')!
     const obj = getObjectLiteral(sourceFile)
 
-    const result = resolveAIMiddleware(state, obj, checker)
+    const result = resolveAgentMiddleware(state, obj, checker)
 
     assert.ok(result)
     assert.strictEqual(result.length, 2)
@@ -132,16 +132,16 @@ describe('resolveAIMiddleware', () => {
     assert.strictEqual((result[1] as any).name, 'secondMW')
   })
 
-  test('should mark inline aiMiddleware (null exportedName)', () => {
+  test('should mark inline agentMiddleware (null exportedName)', () => {
     const state = getInitialInspectorState('/test')
-    state.aiMiddleware.definitions['inlineMW'] = {
+    state.agentMiddleware.definitions['inlineMW'] = {
       services: { optimized: true, services: [] },
       sourceFile: '/test/middleware.ts',
       position: 0,
       exportedName: null,
     }
 
-    const code = 'const x = { aiMiddleware: [inlineMW] }'
+    const code = 'const x = { agentMiddleware: [inlineMW] }'
     const program = ts.createProgram({
       rootNames: ['test.ts'],
       options: { target: ts.ScriptTarget.ESNext },
@@ -160,7 +160,7 @@ describe('resolveAIMiddleware', () => {
     const sourceFile = program.getSourceFile('test.ts')!
     const obj = getObjectLiteral(sourceFile)
 
-    const result = resolveAIMiddleware(state, obj, checker)
+    const result = resolveAgentMiddleware(state, obj, checker)
 
     assert.ok(result)
     assert.strictEqual(result.length, 1)
@@ -171,10 +171,10 @@ describe('resolveAIMiddleware', () => {
     })
   })
 
-  test('should handle aiMiddleware referencing unknown definitions', () => {
+  test('should handle agentMiddleware referencing unknown definitions', () => {
     const state = getInitialInspectorState('/test')
 
-    const code = 'const x = { aiMiddleware: [unknownMW] }'
+    const code = 'const x = { agentMiddleware: [unknownMW] }'
     const program = ts.createProgram({
       rootNames: ['test.ts'],
       options: { target: ts.ScriptTarget.ESNext },
@@ -193,7 +193,7 @@ describe('resolveAIMiddleware', () => {
     const sourceFile = program.getSourceFile('test.ts')!
     const obj = getObjectLiteral(sourceFile)
 
-    const result = resolveAIMiddleware(state, obj, checker)
+    const result = resolveAgentMiddleware(state, obj, checker)
 
     assert.ok(result)
     assert.strictEqual(result.length, 1)

package/src/utils/middleware.ts

@@ -1,5 +1,5 @@
 import * as ts from 'typescript'
-import type { MiddlewareMetadata } from '@pikku/core'
+import type { MiddlewareMetadata } from '@pikku/core/ecosystem/types'
 import { extractFunctionName } from './extract-function-name.js'
 import type { InspectorState } from '../types.js'
 
@@ -214,24 +214,24 @@ export function resolveHTTPMiddlewareFromObject(
   )
 }
 
-function getAIMiddlewareNode(
+function getAgentMiddlewareNode(
   obj: ts.ObjectLiteralExpression
 ): ts.Expression | undefined {
   const prop = obj.properties.find(
     (p) =>
       ts.isPropertyAssignment(p) &&
       ts.isIdentifier(p.name) &&
-      p.name.text === 'aiMiddleware'
+      p.name.text === 'agentMiddleware'
   ) as ts.PropertyAssignment | undefined
   return prop?.initializer
 }
 
-export function resolveAIMiddleware(
+export function resolveAgentMiddleware(
   state: InspectorState,
   obj: ts.ObjectLiteralExpression,
   checker: ts.TypeChecker
 ): MiddlewareMetadata[] | undefined {
-  const explicitNode = getAIMiddlewareNode(obj)
+  const explicitNode = getAgentMiddlewareNode(obj)
   if (!explicitNode) return undefined
 
   const names = extractMiddlewarePikkuNames(
@@ -240,7 +240,7 @@ export function resolveAIMiddleware(
     state.rootDir
   )
   const resolved: MiddlewareMetadata[] = names.map((name) => {
-    const def = state.aiMiddleware.definitions[name]
+    const def = state.agentMiddleware.definitions[name]
     return {
       type: 'wire' as const,
       name,

package/src/utils/permissions.ts

@@ -1,5 +1,5 @@
 import * as ts from 'typescript'
-import type { PermissionMetadata } from '@pikku/core'
+import type { PermissionMetadata } from '@pikku/core/ecosystem/types'
 import { extractFunctionName } from './extract-function-name.js'
 import type { InspectorState } from '../types.js'
 

package/src/utils/post-process.test.ts

@@ -59,6 +59,33 @@ const makeOverrideState = (
     },
   }) as unknown as Omit<InspectorState, 'typesLookup'>
 
+const makeGrantState = (
+  kind: 'secrets' | 'credentials',
+  declaredNames: string[],
+  decl: {
+    secretGrants?: string[]
+    credentialGrants?: string[]
+    secretOverrides?: Record<string, string>
+    credentialOverrides?: Record<string, string>
+  }
+): Omit<InspectorState, 'typesLookup'> =>
+  ({
+    rpc: {
+      wireAddonDeclarations: new Map([
+        ['slack-marketing', { package: '@addon/slack', ...decl }],
+      ]),
+    },
+    secrets: {
+      definitions:
+        kind === 'secrets' ? declaredNames.map((name) => ({ name })) : [],
+    },
+    credentials: {
+      definitions:
+        kind === 'credentials' ? declaredNames.map((name) => ({ name })) : [],
+    },
+    variables: { definitions: [] },
+  }) as unknown as Omit<InspectorState, 'typesLookup'>
+
 function makeState(
   overrides: {
     usedFunctions?: string[]
@@ -115,7 +142,7 @@ function makeState(
 
 const CONSOLE_PARENT_SERVICES = [
   'metaService',
-  'aiAgentRunner',
+  'agentRunner',
   'deploymentService',
   'credentialService',
 ]
@@ -160,7 +187,7 @@ describe('aggregateRequiredServices — per-function addon services', () => {
           runAgent: {
             services: {
               optimized: true,
-              services: ['aiAgentRunner', 'deploymentService'],
+              services: ['agentRunner', 'deploymentService'],
             },
           },
         },
@@ -170,7 +197,7 @@ describe('aggregateRequiredServices — per-function addon services', () => {
     aggregateRequiredServices(state)
     const required = state.serviceAggregation.requiredServices
     assert.ok(required.has('metaService'))
-    assert.ok(!required.has('aiAgentRunner'))
+    assert.ok(!required.has('agentRunner'))
     assert.ok(!required.has('deploymentService'))
     assert.ok(!required.has('credentialService'))
   })
@@ -231,7 +258,7 @@ describe('aggregateRequiredServices — per-function addon services', () => {
     const required = state.serviceAggregation.requiredServices
     assert.ok(required.has('kysely'))
     assert.ok(!required.has('metaService'))
-    assert.ok(!required.has('aiAgentRunner'))
+    assert.ok(!required.has('agentRunner'))
   })
 
   test('no used addon functions adds no parent services', () => {
@@ -252,7 +279,7 @@ describe('aggregateRequiredServices — per-function addon services', () => {
     aggregateRequiredServices(state)
     const required = state.serviceAggregation.requiredServices
     assert.ok(!required.has('metaService'))
-    assert.ok(!required.has('aiAgentRunner'))
+    assert.ok(!required.has('agentRunner'))
   })
 
   test('internal services in addon function meta never force the blanket', () => {
@@ -273,7 +300,7 @@ describe('aggregateRequiredServices — per-function addon services', () => {
     aggregateRequiredServices(state)
     const required = state.serviceAggregation.requiredServices
     assert.ok(required.has('metaService'))
-    assert.ok(!required.has('aiAgentRunner'))
+    assert.ok(!required.has('agentRunner'))
     assert.ok(!required.has('rpc'))
   })
 
@@ -318,7 +345,7 @@ describe('aggregateRequiredServices — per-function addon services', () => {
     aggregateRequiredServices(state)
     const required = state.serviceAggregation.requiredServices
     assert.ok(required.has('metaService'))
-    assert.ok(!required.has('aiAgentRunner'))
+    assert.ok(!required.has('agentRunner'))
   })
 
   test('multiple used addon functions union their parent services', () => {
@@ -330,7 +357,7 @@ describe('aggregateRequiredServices — per-function addon services', () => {
             services: { optimized: true, services: ['metaService'] },
           },
           runAgent: {
-            services: { optimized: true, services: ['aiAgentRunner'] },
+            services: { optimized: true, services: ['agentRunner'] },
           },
         },
       },
@@ -339,7 +366,7 @@ describe('aggregateRequiredServices — per-function addon services', () => {
     aggregateRequiredServices(state)
     const required = state.serviceAggregation.requiredServices
     assert.ok(required.has('metaService'))
-    assert.ok(required.has('aiAgentRunner'))
+    assert.ok(required.has('agentRunner'))
     assert.ok(!required.has('deploymentService'))
     assert.ok(!required.has('credentialService'))
   })
@@ -414,6 +441,46 @@ describe('override validation resolves the override target (value), not the logi
     validateVariableOverrides(logger, state)
     assert.deepEqual(criticals, [])
   })
+
+  test('validateSecretOverrides accepts a grant naming a declared secret', () => {
+    const { logger, criticals } = makeCriticalLogger()
+    const state = makeGrantState('secrets', ['STRIPE_KEY'], {
+      secretGrants: ['STRIPE_KEY'],
+    })
+    validateSecretOverrides(logger, state)
+    assert.deepEqual(criticals, [])
+  })
+
+  test('validateSecretOverrides flags a grant naming no declared secret', () => {
+    const { logger, criticals } = makeCriticalLogger()
+    const state = makeGrantState('secrets', ['STRIPE_KEY'], {
+      secretGrants: ['STIRPE_KEY'],
+    })
+    validateSecretOverrides(logger, state)
+    assert.equal(criticals.length, 1)
+    assert.match(criticals[0]!.message, /STIRPE_KEY/)
+    assert.match(criticals[0]!.message, /STRIPE_KEY/)
+  })
+
+  test('validateSecretOverrides resolves a grant through its override before looking it up', () => {
+    const { logger, criticals } = makeCriticalLogger()
+    const state = makeGrantState('secrets', ['PROD_EMAIL_KEY'], {
+      secretGrants: ['MAILGUN_KEY'],
+      secretOverrides: { MAILGUN_KEY: 'PROD_EMAIL_KEY' },
+    })
+    validateSecretOverrides(logger, state)
+    assert.deepEqual(criticals, [])
+  })
+
+  test('validateCredentialOverrides flags a grant naming no declared credential', () => {
+    const { logger, criticals } = makeCriticalLogger()
+    const state = makeGrantState('credentials', ['marketing_cred'], {
+      credentialGrants: ['ghost_cred'],
+    })
+    validateCredentialOverrides(logger, state)
+    assert.equal(criticals.length, 1)
+    assert.match(criticals[0]!.message, /ghost_cred/)
+  })
 })
 
 const makeRemoteState = (