@pikku/core 0.12.83 → 0.12.86

package/src/wirings/gateway/gateway-runner.ts

@@ -81,10 +81,9 @@ export const resolveGatewayAdapter = (
 import type {
   PikkuWire,
   PikkuRawWire,
-  CorePikkuMiddleware,
   CoreSingletonServices,
 } from '../../types/core.types.js'
-
+import type { CorePikkuMiddleware } from '../../middleware/middleware.types.js'
 export const wireGateway = (config: CoreGateway): void => {
   pikkuState(null, 'gateway', 'gateways').set(config.name, config)
 
@@ -206,8 +205,7 @@ const createWebhookPostHandler = (config: CoreGateway) => {
     }
 
     const gatewayMiddleware = userMiddleware as
-      | CorePikkuMiddleware[]
-      | undefined
+      CorePikkuMiddleware[] | undefined
     const result: any = gatewayMiddleware?.length
       ? await runMiddleware(services, wire, gatewayMiddleware, invoke)
       : await invoke()
@@ -334,8 +332,7 @@ const wireWebsocketGateway = (config: CoreGateway): void => {
       }
 
       const gatewayMiddleware = userMiddleware as
-        | CorePikkuMiddleware[]
-        | undefined
+        CorePikkuMiddleware[] | undefined
       const result: any = gatewayMiddleware?.length
         ? await runMiddleware(services, wire, gatewayMiddleware, invoke)
         : await invoke()

package/src/wirings/gateway/gateway.types.ts

@@ -1,9 +1,11 @@
 import type {
   CommonWireMeta,
-  CorePikkuMiddleware,
-  CorePikkuMiddlewareGroup,
   CoreSingletonServices,
 } from '../../types/core.types.js'
+import type {
+  CorePikkuMiddleware,
+  CorePikkuMiddlewareGroup,
+} from '../../middleware/middleware.types.js'
 import type { CorePikkuFunctionConfig } from '../../function/functions.types.js'
 import type { PikkuHTTPRequest } from '../http/http.types.js'
 
@@ -31,8 +33,7 @@ export interface GatewayOutboundMessage {
 }
 
 export type WebhookVerificationResult =
-  | { verified: true; response: unknown }
-  | { verified: false }
+  { verified: true; response: unknown } | { verified: false }
 
 export interface GatewayAdapter {
   name: string

package/src/wirings/http/http-routes.test.ts

@@ -4,8 +4,7 @@ import { wireHTTPRoutes, defineHTTPRoutes } from './http-routes.js'
 import { pikkuState, resetPikkuState } from '../../pikku-state.js'
 import { addFunction } from '../../function/function-runner.js'
 import { httpRouter } from './routers/http-router.js'
-import type { CorePikkuMiddleware } from '../../types/core.types.js'
-
+import type { CorePikkuMiddleware } from '../../middleware/middleware.types.js'
 const mockFunc = async () => ({ success: true })
 
 const mockMiddleware: CorePikkuMiddleware = async (_services, _wire, next) => {

package/src/wirings/http/http-runner-addon-ref.test.ts

@@ -0,0 +1,238 @@
+import { test, describe, beforeEach } from 'node:test'
+import * as assert from 'assert'
+import { addHTTPMiddleware, fetch, wireHTTP } from './http-runner.js'
+import { pikkuState, resetPikkuState } from '../../pikku-state.js'
+import { addSchema } from '../../schema.js'
+import { PikkuMockRequest } from '../channel/local/local-channel-runner.test.js'
+import { httpRouter } from './routers/http-router.js'
+import type { CoreHTTPFunctionWiring, HTTPMethod } from './http.types.js'
+
+const ADDON_PACKAGE = '@acme/addon'
+const ADDON_NAMESPACE = 'ext'
+const TARGET = `${ADDON_NAMESPACE}:greet`
+
+class ParamsRequest extends PikkuMockRequest {
+  override async data() {
+    return this.params()
+  }
+  override header(): string | null {
+    return null
+  }
+}
+
+const registerAddon = (
+  sessionless = true,
+  inputSchemaName: string | null = null
+) => {
+  pikkuState(null, 'addons', 'packages').set(ADDON_NAMESPACE, {
+    package: ADDON_PACKAGE,
+  } as never)
+  pikkuState(ADDON_PACKAGE, 'function', 'meta', {
+    greet: {
+      pikkuFuncId: 'greet',
+      name: 'greet',
+      sessionless,
+      inputSchemaName,
+      outputSchemaName: null,
+      inputs: [],
+      outputs: [],
+      services: { optimized: false, services: [] },
+    },
+  } as never)
+}
+
+const emptyHTTPMeta = () => ({
+  get: {},
+  post: {},
+  delete: {},
+  patch: {},
+  head: {},
+  put: {},
+  options: {},
+})
+
+const setRouteMeta = (
+  route: string,
+  method: HTTPMethod,
+  extra: Record<string, unknown> = {}
+) => {
+  const meta = pikkuState(null, 'http', 'meta')
+  meta[method][route] = {
+    pikkuFuncId: TARGET,
+    route,
+    method,
+    ...extra,
+  }
+}
+
+describe('http routes wired with ref() to an addon function', () => {
+  beforeEach(() => {
+    resetPikkuState()
+    httpRouter.reset()
+    pikkuState(null, 'package', 'singletonServices', {
+      logger: { info: () => {}, warn: () => {}, error: () => {} },
+    } as never)
+    pikkuState(null, 'package', 'factories', {
+      createWireServices: async () => ({}),
+    } as never)
+    pikkuState(null, 'http', 'meta', emptyHTTPMeta() as never)
+  })
+
+  test('resolves the namespaced target through the addon package', async () => {
+    registerAddon()
+    setRouteMeta('/addon/greet', 'get', { auth: false })
+
+    wireHTTP({
+      route: '/addon/greet',
+      method: 'get',
+      auth: false,
+      func: { func: async () => ({ message: 'hello' }) },
+    } as CoreHTTPFunctionWiring<unknown, unknown, string>)
+    httpRouter.initialize()
+
+    const response = await fetch(new ParamsRequest('/addon/greet', 'get'))
+
+    assert.strictEqual(response.status, 200)
+    assert.deepStrictEqual(await response.json(), { message: 'hello' })
+  })
+
+  test('serves the same addon function at two routes with different params', async () => {
+    registerAddon()
+    setRouteMeta('/addon/greet/:id', 'get', { auth: false, params: ['id'] })
+    setRouteMeta('/addon/greet-all', 'get', { auth: false })
+
+    const seen: unknown[] = []
+    const proxy = {
+      func: async (_services: never, data: unknown) => {
+        seen.push(data)
+        return data
+      },
+    }
+
+    wireHTTP({
+      route: '/addon/greet/:id',
+      method: 'get',
+      auth: false,
+      func: proxy,
+    } as unknown as CoreHTTPFunctionWiring<unknown, unknown, string>)
+    wireHTTP({
+      route: '/addon/greet-all',
+      method: 'get',
+      auth: false,
+      func: proxy,
+    } as unknown as CoreHTTPFunctionWiring<unknown, unknown, string>)
+    httpRouter.initialize()
+
+    const withParam = await fetch(new ParamsRequest('/addon/greet/42', 'get'))
+    const withoutParam = await fetch(
+      new ParamsRequest('/addon/greet-all', 'get')
+    )
+
+    assert.deepStrictEqual(await withParam.json(), { id: '42' })
+    assert.deepStrictEqual(await withoutParam.json(), {})
+    assert.deepEqual(seen, [{ id: '42' }, {}])
+  })
+
+  /**
+   * The addon registers its schemas in its own package state, and the name the
+   * runner validates against comes from the addon's metadata. Resolving the
+   * target's metadata by namespace while still reading the schema registry of
+   * the wire's package looks the name up under 'main', where the addon never
+   * put it — the route then answers 500 for every input it was given.
+   */
+  test("validates input against the addon package's schema registry", async () => {
+    registerAddon(true, 'GreetInput')
+    addSchema(
+      'GreetInput',
+      { type: 'object', properties: { id: { type: 'string' } } },
+      ADDON_PACKAGE
+    )
+    setRouteMeta('/addon/greet-schema/:id', 'get', {
+      auth: false,
+      params: ['id'],
+    })
+
+    const compiled: string[] = []
+    pikkuState(null, 'package', 'singletonServices', {
+      logger: { info: () => {}, warn: () => {}, error: () => {} },
+      schema: {
+        compileSchema: (key: string) => {
+          compiled.push(key)
+        },
+        validateSchema: () => {},
+        getSchemaKeys: () => [],
+      },
+    } as never)
+
+    wireHTTP({
+      route: '/addon/greet-schema/:id',
+      method: 'get',
+      auth: false,
+      func: { func: async (_s: never, data: unknown) => data },
+    } as unknown as CoreHTTPFunctionWiring<unknown, unknown, string>)
+    httpRouter.initialize()
+
+    const response = await fetch(
+      new ParamsRequest('/addon/greet-schema/42', 'get')
+    )
+
+    assert.strictEqual(response.status, 200)
+    assert.deepStrictEqual(await response.json(), { id: '42' })
+    assert.deepStrictEqual(compiled.length > 0, true)
+  })
+
+  test("runs the consuming app's middleware, not the addon package's", async () => {
+    registerAddon()
+    setRouteMeta('/addon/greet-mw', 'get', {
+      auth: false,
+      middleware: [{ type: 'http', route: '*' }],
+    })
+
+    const ran: string[] = []
+    addHTTPMiddleware('*', [
+      async (_services, _wire, next) => {
+        ran.push('app')
+        await next()
+      },
+    ] as never)
+    addHTTPMiddleware(
+      '*',
+      [
+        async (_services: never, _wire: never, next: () => Promise<void>) => {
+          ran.push('addon')
+          await next()
+        },
+      ] as never,
+      ADDON_PACKAGE
+    )
+
+    wireHTTP({
+      route: '/addon/greet-mw',
+      method: 'get',
+      auth: false,
+      func: { func: async () => ({ message: 'hello' }) },
+    } as CoreHTTPFunctionWiring<unknown, unknown, string>)
+    httpRouter.initialize()
+
+    const response = await fetch(new ParamsRequest('/addon/greet-mw', 'get'))
+
+    assert.strictEqual(response.status, 200)
+    assert.deepStrictEqual(ran, ['app'])
+  })
+
+  test('honours the addon function metadata when a session is required', async () => {
+    registerAddon(false)
+    setRouteMeta('/addon/greet', 'get')
+
+    wireHTTP({
+      route: '/addon/greet',
+      method: 'get',
+      func: { func: async () => ({ message: 'hello' }) },
+    } as CoreHTTPFunctionWiring<unknown, unknown, string>)
+    httpRouter.initialize()
+
+    const response = await fetch(new ParamsRequest('/addon/greet', 'get'))
+
+    assert.strictEqual(response.status, 403)
+  })
+})

package/src/wirings/http/http-runner.test.ts

@@ -1,7 +1,8 @@
 import { test, describe, beforeEach, afterEach } from 'node:test'
 import * as assert from 'assert'
 import { NotFoundError } from '../../errors/errors.js'
-import type { JSONValue, CorePikkuMiddleware } from '../../types/core.types.js'
+import type { JSONValue } from '../../utils.js'
+import type { CorePikkuMiddleware } from '../../middleware/middleware.types.js'
 import {
   addHTTPMiddleware,
   createHTTPWire,
@@ -112,13 +113,7 @@ const setHTTPFunctionMap = (func: any) => {
 const setRouteMeta = (
   route: string,
   method:
-    | 'get'
-    | 'post'
-    | 'put'
-    | 'delete'
-    | 'patch'
-    | 'head'
-    | 'options' = 'get',
+    'get' | 'post' | 'put' | 'delete' | 'patch' | 'head' | 'options' = 'get',
   overrides: Record<string, unknown> = {}
 ) => {
   const meta = pikkuState(null, 'http', 'meta')

package/src/wirings/http/http-runner.ts

@@ -14,12 +14,14 @@ import type {
 } from '../../function/functions.types.js'
 import type {
   CoreUserSession,
-  CorePikkuMiddleware,
-  CorePikkuMiddlewareGroup,
   PikkuRawWire,
   PikkuWire,
   PikkuWiringTypes,
 } from '../../types/core.types.js'
+import type {
+  CorePikkuMiddleware,
+  CorePikkuMiddlewareGroup,
+} from '../../middleware/middleware.types.js'
 import { NotFoundError } from '../../errors/errors.js'
 import { createWeakUID, isSerializable } from '../../utils.js'
 import {
@@ -100,7 +102,11 @@ export const wireHTTP = <
     return
   }
   if (httpWiring.func) {
-    addFunction(routeMeta.pikkuFuncId, httpWiring.func)
+    addFunction(
+      routeMeta.pikkuFuncId,
+      httpWiring.func,
+      routeMeta.packageName ?? null
+    )
   }
   const routes = pikkuState(null, 'http', 'routes')
   if (!routes.has(httpWiring.method)) {

package/src/wirings/http/http.types.ts

@@ -1,9 +1,7 @@
 import type { SerializeOptions } from 'cookie'
 import type { StandardSchemaV1 } from '@standard-schema/spec'
-import type {
-  CorePikkuMiddleware,
-  CommonWireMeta,
-} from '../../types/core.types.js'
+import type { CommonWireMeta } from '../../types/core.types.js'
+import type { CorePikkuMiddleware } from '../../middleware/middleware.types.js'
 import type {
   CorePikkuFunction,
   CorePikkuFunctionSessionless,
@@ -43,13 +41,7 @@ export type RunHTTPWiringOptions = Partial<{
 }>
 
 export type HTTPMethod =
-  | 'post'
-  | 'get'
-  | 'delete'
-  | 'patch'
-  | 'head'
-  | 'put'
-  | 'options'
+  'post' | 'get' | 'delete' | 'patch' | 'head' | 'put' | 'options'
 
 export type HTTPHeadersSchema = StandardSchemaV1<
   Record<string, string | string[] | undefined>
@@ -193,7 +185,6 @@ export type HTTPWiringMeta = CommonWireMeta & {
    * join wrong reads an open route as a closed one.
    */
   requiresSession?: boolean
-  refTarget?: string
   params?: string[]
   query?: string[]
   inputTypes?: HTTPFunctionMetaInputTypes

package/src/wirings/http/index.ts

@@ -9,6 +9,7 @@ export { fetch, fetchData, wireHTTP, addHTTPMiddleware } from './http-runner.js'
 
 export { wireHTTPRoutes, defineHTTPRoutes } from './http-routes.js'
 export { toWebRequest, applyWebResponse } from './web-request.js'
+export { httpRouter } from './routers/http-router.js'
 
 export type {
   AssertHTTPWiringParams,

package/src/wirings/http/pikku-fetch-http-request.ts

@@ -1,5 +1,5 @@
 import { parse as parseQuery } from 'picoquery'
-import { parse as parseCookie } from 'cookie'
+import { parseCookie } from 'cookie'
 import type { HTTPMethod, PikkuHTTPRequest, PikkuQuery } from './http.types.js'
 import {
   PayloadTooLargeError,

package/src/wirings/http/pikku-fetch-http-response.ts

@@ -1,6 +1,6 @@
 import type { PikkuHTTPResponse } from './http.types.js'
 import type { SerializeOptions as CookieSerializeOptions } from 'cookie'
-import { serialize as serializeCookie } from 'cookie'
+import { stringifySetCookie } from 'cookie'
 
 export class PikkuFetchHTTPResponse implements PikkuHTTPResponse {
   #statusCode: number = 200
@@ -116,7 +116,8 @@ export class PikkuFetchHTTPResponse implements PikkuHTTPResponse {
 
   public toResponse(args?: Record<string, any>): Response {
     const cookieHeader = Array.from(this.#cookies.entries()).map(
-      ([name, { value, flags }]) => serializeCookie(name, value, flags)
+      ([name, { value, flags }]) =>
+        stringifySetCookie({ name, value, ...flags }, flags)
     )
     cookieHeader.forEach((cookie) => this.#headers.append('Set-Cookie', cookie))
     return new Response(this.#body, {

package/src/wirings/mcp/mcp-runner.test.ts

@@ -12,7 +12,7 @@ import {
 import { addGlobalMiddleware } from '../../middleware-runner.js'
 import { addFunction } from '../../function/function-runner.js'
 import { pikkuState, resetPikkuState } from '../../pikku-state.js'
-import { pikkuMiddleware } from '../../types/core.types.js'
+import { pikkuMiddleware } from '../../middleware/middleware-factories.js'
 import { addTagMiddleware } from '../../middleware-runner.js'
 
 const logger = {

package/src/wirings/mcp/mcp.types.ts

@@ -6,8 +6,7 @@ import type {
 import type {
   CorePikkuMiddleware,
   MiddlewareMetadata,
-} from '../../types/core.types.js'
-
+} from '../../middleware/middleware.types.js'
 /** "user/{userId}/post/{postId}" => "userId" | "postId" */
 type ExtractMCPURIParams<S extends string> =
   S extends `${string}{${infer Param}}/${infer Rest}`

package/src/wirings/persona/index.ts

@@ -15,10 +15,7 @@ export type {
   PersonaEnvironment,
   PersonaEnvironmentSubject,
 } from './persona-environments.js'
-export {
-  personaEmail,
-  personaEmails,
-} from './persona-email.js'
+export { personaEmail, personaEmails } from './persona-email.js'
 export type {
   MailboxAllowlist,
   PersonaMailbox,

package/src/wirings/persona/persona.types.ts

@@ -107,6 +107,18 @@ export type CorePersona = {
    * into a flaky suite.
    */
   runnable?: boolean
+  /**
+   * The app this person signs into, when the product is more than one frontend.
+   *
+   * A person uses one of them — staff their app, customers theirs — and that is
+   * what decides where a browser step navigates: `/dashboard` is a different
+   * page in each, so the actor settles which one without the scenario saying.
+   * The runner takes the base url per app (`--app-url <app>=<url>`, or
+   * `appUrls` on the environment) and each actor browses against its own.
+   *
+   * Omitted is the normal case: one app, one url, nothing to say.
+   */
+  app?: string
 }
 
 /** Personas to declare, keyed by id. */
@@ -135,6 +147,8 @@ export type PersonaMeta = {
   /** Absent means "everywhere but production", which is resolved, not stored. */
   environments?: string[]
   runnable: boolean
+  /** The app this person signs into; picks their base url on a browser run. */
+  app?: string
   sourceFile?: string
 }
 

package/src/wirings/queue/queue-identity.test.ts

@@ -21,7 +21,7 @@ import type {
   QueueJob,
   QueueService,
 } from './queue.types.js'
-import { createSecretValue } from '../../secret-value.js'
+import { createSecretValue } from '../../classification/secret-value.js'
 
 const QUEUE_NAME = 'identity-queue'
 const SECRET = 'a'.repeat(48)

package/src/wirings/queue/queue.types.ts

@@ -1,7 +1,7 @@
 import type { CommonWireMeta } from '../../types/core.types.js'
 import type { CorePikkuFunctionConfig } from '../../function/functions.types.js'
 import type { QueueConfigMapping } from './validate-worker-config.js'
-import type { Safe } from '../../secret-value.js'
+import type { Safe } from '../../classification/secret-value.js'
 
 export interface PikkuWorkerConfig {
   name?: string
@@ -63,11 +63,7 @@ export interface ConfigValidationResult {
 }
 
 export type QueueJobStatus =
-  | 'waiting'
-  | 'active'
-  | 'completed'
-  | 'failed'
-  | 'delayed'
+  'waiting' | 'active' | 'completed' | 'failed' | 'delayed'
 
 export type QueueJobMetadata = {
   progress?: number | string | object | undefined | boolean

package/src/wirings/queue/signed-queue-service.ts

@@ -1,4 +1,4 @@
-import type { Safe } from '../../secret-value.js'
+import type { Safe } from '../../classification/secret-value.js'
 import type { Logger } from '../../services/logger.js'
 import type { SecretService } from '../../services/secret-service.js'
 import {

package/src/wirings/rpc/index.ts

@@ -5,16 +5,4 @@ export {
   RemoteAddonConfigError,
   RemoteAddonRequestError,
 } from './rpc-runner.js'
-export {
-  resolveRemoteAddonToken,
-  RemoteAddonAuthError,
-} from './remote-addon-auth.js'
-export type { RemoteAddonAuthBinding } from './remote-addon-auth.js'
 export type { PikkuRPC, RPCMeta } from './rpc-types.js'
-export { wireAddon } from './wire-addon.js'
-export type { WireAddonConfig } from './wire-addon.js'
-export { wireRemoteAddon } from './wire-remote-addon.js'
-export type {
-  WireRemoteAddonConfig,
-  RemoteAddonAuth,
-} from './wire-remote-addon.js'

package/src/wirings/rpc/rpc-runner.test.ts

@@ -10,10 +10,10 @@ import {
   resolveNamespace,
   rpcService,
 } from './rpc-runner.js'
-import { RemoteAddonAuthError } from './remote-addon-auth.js'
-import { wireAddon } from './wire-addon.js'
-import { wireRemoteAddon } from './wire-remote-addon.js'
-import { createSecretValue } from '../../secret-value.js'
+import { RemoteAddonAuthError } from '../addon/remote-addon-auth.js'
+import { wireAddon } from '../addon/wire-addon.js'
+import { wireRemoteAddon } from '../addon/wire-remote-addon.js'
+import { createSecretValue } from '../../classification/secret-value.js'
 
 const createLogger = () => ({
   debug: () => {},

package/src/wirings/rpc/rpc-runner.ts

@@ -6,14 +6,14 @@ import type {
 import type { SessionService } from '../../services/user-session-service.js'
 import type { CoreUserSession } from '../../types/core.types.js'
 import { runPikkuFunc } from '../../function/function-runner.js'
-import type { AddonInstance } from './addon-runner.js'
-import { addonInstanceForNamespace } from './addon-runner.js'
+import type { AddonInstance } from '../addon/addon-runner.js'
+import { addonInstanceForNamespace } from '../addon/addon-runner.js'
 import { pikkuState } from '../../pikku-state.js'
 import { PikkuError, addError } from '../../errors/error-handler.js'
 import type { PikkuRPC, ResolvedFunction } from './rpc-types.js'
 import { parseVersionedId } from '../../version.js'
-import { resolveRemoteAddonToken } from './remote-addon-auth.js'
-import { createAgentRPC } from '../ai-agent/agent-rpc.js'
+import { resolveRemoteAddonToken } from '../addon/remote-addon-auth.js'
+import { createAgentRPC } from '../agent/agent-rpc.js'
 
 /**
  * The session for a wire: read through `getSession` when a runner attached one,
@@ -461,7 +461,7 @@ export class ContextAwareRPCService {
   /**
    * The agent facade, built on access.
    *
-   * The implementation lives in `ai-agent/agent-rpc.ts` so the agent surface is
+   * The implementation lives in `agent/agent-rpc.ts` so the agent surface is
    * one file rather than a wing of this one; a getter rather than a field so a
    * request that never touches an agent never builds it.
    */

package/src/wirings/rpc/rpc-types.ts

@@ -1,5 +1,5 @@
 import type { PikkuRawWire } from '../../types/core.types.js'
-import type { AgentInterruptResult } from '../ai-agent/ai-agent-interrupt.js'
+import type { AgentInterruptResult } from '../agent/agent-interrupt.js'
 
 export type PikkuRPC<
   Invoke extends (...args: any[]) => any = (...args: any[]) => any,

package/src/wirings/scheduler/scheduler.types.ts

@@ -1,8 +1,5 @@
-import type {
-  CoreUserSession,
-  CorePikkuMiddleware,
-  CommonWireMeta,
-} from '../../types/core.types.js'
+import type { CoreUserSession, CommonWireMeta } from '../../types/core.types.js'
+import type { CorePikkuMiddleware } from '../../middleware/middleware.types.js'
 import type {
   CorePikkuFunctionConfig,
   CorePikkuFunctionSessionless,

package/src/wirings/scope/index.ts

@@ -12,3 +12,4 @@ export type {
   ScopeDefinitions,
   ScopeNodeMeta,
 } from './scope.types.js'
+export { hasScopes, verifyScopes } from '../../scopes.js'

package/src/wirings/secret/secret.types.ts

@@ -4,6 +4,15 @@ export type CoreSecret<T = unknown> = {
   description?: string
   secretId: string
   schema: T
+  /**
+   * A secret is REQUIRED by default because `getSecret` throws when the value is
+   * missing — a deploy without it is a runtime failure waiting to happen, so the
+   * deploy gate refuses it. Mark a secret `optional` when absence is a supported
+   * state the app handles (a feature that simply stays off): the generated map
+   * emits it as an optional property and `getSecret` resolves `undefined`
+   * instead of throwing.
+   */
+  optional?: boolean
   /**
    * Where a user goes to obtain this value — a provider's API-key page, a setup
    * guide, an internal runbook. Consoles and deploy UIs surface it beside a
@@ -38,6 +47,7 @@ export type SecretDefinitionMeta = {
   description?: string
   secretId: string
   schema?: Record<string, unknown> | string
+  optional?: boolean
   docsUrl?: string
   oauth2?: OAuth2CredentialConfig
   rotationPeriod?: string