@pikku/inspector 0.12.42 → 0.12.44

package/src/utils/custom-types-generator.test.ts

@@ -1,6 +1,9 @@
 import { test, describe } from 'node:test'
 import { strict as assert } from 'node:assert'
-import { generateCustomTypes } from './custom-types-generator.js'
+import {
+  generateCustomTypes,
+  sanitizeTypeName,
+} from './custom-types-generator.js'
 import { TypesMap } from '../types-map.js'
 
 function makeTypesMap(
@@ -97,3 +100,25 @@ describe('generateCustomTypes — classification wrapper stripping', () => {
     )
   })
 })
+
+describe('sanitizeTypeName — valid JS identifier', () => {
+  test('replaces disallowed characters with underscores', () => {
+    assert.equal(
+      sanitizeTypeName('Add Beehiiv subscribers'),
+      'Add_Beehiiv_subscribers'
+    )
+  })
+
+  test('prefixes an underscore when the name starts with a digit', () => {
+    // A name like "2. Add Beehiiv newsletter subscribers" otherwise produces
+    // `2__Add_...`, an invalid JS identifier that breaks the generated
+    // `import <ident> from ...` in pikku-workflow-wirings-meta.gen.ts.
+    const id = sanitizeTypeName('2. Add Beehiiv newsletter subscribers')
+    assert.equal(id, '_2__Add_Beehiiv_newsletter_subscribers')
+    assert.match(id, /^[A-Za-z_$]/, 'must start with a valid identifier char')
+  })
+
+  test('leaves an already-valid identifier unchanged', () => {
+    assert.equal(sanitizeTypeName('UserEmail'), 'UserEmail')
+  })
+})

package/src/utils/custom-types-generator.ts

@@ -8,7 +8,8 @@ import type { TypesMap } from '../types-map.js'
  */
 
 export function sanitizeTypeName(name: string): string {
-  return name.replace(/[^a-zA-Z0-9_$]/g, '_')
+  const sanitized = name.replace(/[^a-zA-Z0-9_$]/g, '_')
+  return /^[0-9]/.test(sanitized) ? `_${sanitized}` : sanitized
 }
 
 const CLASSIFICATION_WRAPPERS = new Set(['Private', 'Pii', 'Secret'])

package/src/utils/ensure-function-metadata.ts

@@ -309,6 +309,48 @@ export function ensureFunctionMetadata(
   }
 }
 
+/**
+ * Register metadata for a `func:` inlined into a wiring (queue/scheduler/
+ * trigger/gateway/…).
+ *
+ * An inline function has no exported name, so `addFunctions` skips it (it bails
+ * on `__temp_` ids) and only the wiring's context-based id exists. Without this
+ * the wiring points at a function that was never registered and the worker
+ * resolves to nothing at runtime ("Missing generated metadata for ...").
+ *
+ * The stub also carries no session info, so the runtime would treat it as
+ * session-required and every invocation would fail with "Authentication
+ * required". Derive `sessionless` from the helper the function was built with —
+ * the same rule `addFunctions` applies to named ones (`!== 'pikkuFunc'`).
+ */
+export function ensureInlineWiringFunction(
+  state: InspectorState,
+  pikkuFuncId: string,
+  fallbackName: string | undefined,
+  funcInitializer: ts.Node,
+  checker: ts.TypeChecker,
+  isHelper?: boolean
+): void {
+  ensureFunctionMetadata(
+    state,
+    pikkuFuncId,
+    fallbackName,
+    funcInitializer,
+    checker,
+    isHelper
+  )
+
+  const meta = state.functions.meta[pikkuFuncId]
+  if (
+    meta &&
+    meta.sessionless === undefined &&
+    ts.isCallExpression(funcInitializer) &&
+    ts.isIdentifier(funcInitializer.expression)
+  ) {
+    meta.sessionless = funcInitializer.expression.text !== 'pikkuFunc'
+  }
+}
+
 function populateTypesLookup(
   state: InspectorState,
   pikkuFuncId: string,

package/src/utils/filter-inspector-state.test.ts

@@ -82,7 +82,6 @@ function createMockInspectorState(): Omit<InspectorState, 'typesLookup'> {
       },
       files: new Set(['/test/project/src/api/users.ts']),
       routeMiddleware: new Map(),
-      routePermissions: new Map(),
     },
     functions: {
       typesMap: new Map(),
@@ -332,7 +331,6 @@ function createMockInspectorState(): Omit<InspectorState, 'typesLookup'> {
     permissions: {
       definitions: {},
       instances: {},
-      tagPermissions: new Map(),
     },
     serviceAggregation: {
       requiredServices: new Set(),

package/src/utils/filter-inspector-state.ts

@@ -425,6 +425,8 @@ export function filterInspectorState(
       internalFiles: new Map(state.rpc.internalFiles),
       exposedMeta: { ...state.rpc.exposedMeta },
       exposedFiles: new Map(state.rpc.exposedFiles),
+      remoteMeta: { ...state.rpc.remoteMeta },
+      remoteFiles: new Map(state.rpc.remoteFiles),
       invokedFunctions: new Set(state.rpc.invokedFunctions),
     },
     cli: {
@@ -1052,6 +1054,13 @@ export function filterInspectorState(
         filteredState.rpc.exposedFiles.delete(key)
       }
     }
+    for (const key of Object.keys(filteredState.rpc.remoteMeta)) {
+      const targetFuncId = filteredState.rpc.remoteMeta[key]
+      if (!survivingFuncIds.has(targetFuncId) && !survivingFuncIds.has(key)) {
+        delete filteredState.rpc.remoteMeta[key]
+        filteredState.rpc.remoteFiles.delete(key)
+      }
+    }
     // Prune invokedFunctions to match surviving functions
     for (const funcId of filteredState.rpc.invokedFunctions) {
       if (!survivingFuncIds.has(funcId)) {

package/src/utils/get-property-value.test.ts

@@ -0,0 +1,141 @@
+import { describe, test } from 'node:test'
+import assert from 'node:assert'
+import * as ts from 'typescript'
+import {
+  getArrayPropertyValue,
+  getRecordPropertyValue,
+} from './get-property-value.js'
+
+/**
+ * Parses `const x = { ... }` and hands back the object literal.
+ */
+const objectLiteral = (source: string): ts.ObjectLiteralExpression => {
+  const file = ts.createSourceFile(
+    'test.ts',
+    `const x = ${source}`,
+    ts.ScriptTarget.Latest,
+    true
+  )
+  const statement = file.statements[0] as ts.VariableStatement
+  const initializer = statement.declarationList.declarations[0]!.initializer
+  if (!initializer || !ts.isObjectLiteralExpression(initializer)) {
+    throw new Error('expected an object literal')
+  }
+  return initializer
+}
+
+const firstObjectLiteral = (src: string): ts.ObjectLiteralExpression => {
+  const sourceFile = ts.createSourceFile(
+    'test.ts',
+    src,
+    ts.ScriptTarget.Latest,
+    true
+  )
+  let found: ts.ObjectLiteralExpression | undefined
+  const walk = (node: ts.Node) => {
+    if (!found && ts.isObjectLiteralExpression(node)) {
+      found = node
+    }
+    ts.forEachChild(node, walk)
+  }
+  walk(sourceFile)
+  if (!found) {
+    throw new Error('no object literal in source')
+  }
+  return found
+}
+
+describe('getArrayPropertyValue', () => {
+  test('reads a plain array literal', () => {
+    const obj = objectLiteral(`{ tags: ['a', 'b'] }`)
+    assert.deepEqual(getArrayPropertyValue(obj, 'tags'), ['a', 'b'])
+  })
+
+  test('returns null when the property is absent', () => {
+    const obj = objectLiteral(`{ other: ['a'] }`)
+    assert.equal(getArrayPropertyValue(obj, 'tags'), null)
+  })
+
+  test('reads an array widened with `as const`', () => {
+    const obj = objectLiteral(`{ tags: ['a', 'b'] as const }`)
+    assert.deepEqual(
+      getArrayPropertyValue(obj, 'tags'),
+      ['a', 'b'],
+      '`as const` on an array is idiomatic and must not drop the value'
+    )
+  })
+
+  test('reads an array cast with `as any`', () => {
+    const obj = objectLiteral(`{ tags: ['a'] as any }`)
+    assert.deepEqual(
+      getArrayPropertyValue(obj, 'tags'),
+      ['a'],
+      'a cast must not let a value escape static validation'
+    )
+  })
+
+  test('reads an array through `satisfies`', () => {
+    const obj = objectLiteral(`{ tags: ['a'] satisfies string[] }`)
+    assert.deepEqual(getArrayPropertyValue(obj, 'tags'), ['a'])
+  })
+
+  test('reads an array through nested casts', () => {
+    const obj = objectLiteral(`{ tags: ['a'] as const as any }`)
+    assert.deepEqual(getArrayPropertyValue(obj, 'tags'), ['a'])
+  })
+
+  test('ignores non-string elements', () => {
+    const obj = objectLiteral(`{ tags: ['a', 1, foo] }`)
+    assert.deepEqual(getArrayPropertyValue(obj, 'tags'), ['a'])
+  })
+
+  test('returns null for a non-array initializer', () => {
+    const obj = objectLiteral(`{ tags: 'a' }`)
+    assert.equal(getArrayPropertyValue(obj, 'tags'), null)
+  })
+})
+
+describe('getRecordPropertyValue', () => {
+  test('extracts a string record', () => {
+    const obj = firstObjectLiteral(
+      `const x = { additionalParams: { access_type: 'offline', prompt: 'consent' } }`
+    )
+    assert.deepStrictEqual(getRecordPropertyValue(obj, 'additionalParams'), {
+      access_type: 'offline',
+      prompt: 'consent',
+    })
+  })
+
+  test('handles quoted keys', () => {
+    const obj = firstObjectLiteral(
+      `const x = { additionalParams: { 'token_access_type': 'offline' } }`
+    )
+    assert.deepStrictEqual(getRecordPropertyValue(obj, 'additionalParams'), {
+      token_access_type: 'offline',
+    })
+  })
+
+  test('returns null when the property is absent', () => {
+    const obj = firstObjectLiteral(`const x = { scopes: ['a'] }`)
+    assert.strictEqual(getRecordPropertyValue(obj, 'additionalParams'), null)
+  })
+
+  test('returns null for a non-literal initializer', () => {
+    const obj = firstObjectLiteral(`const x = { additionalParams: SOME_CONST }`)
+    assert.strictEqual(getRecordPropertyValue(obj, 'additionalParams'), null)
+  })
+
+  test('skips non-string values rather than coercing them', () => {
+    const obj = firstObjectLiteral(
+      `const x = { additionalParams: { a: 'keep', b: 42, c: true } }`
+    )
+    assert.deepStrictEqual(getRecordPropertyValue(obj, 'additionalParams'), {
+      a: 'keep',
+    })
+  })
+
+  test('returns null for an empty record', () => {
+    const obj = firstObjectLiteral(`const x = { additionalParams: {} }`)
+    assert.strictEqual(getRecordPropertyValue(obj, 'additionalParams'), null)
+  })
+})

package/src/utils/get-property-value.ts

@@ -5,6 +5,17 @@ import { extractStringLiteral } from './extract-node-value.js'
 /**
  * Extracts an array of strings from an object property.
  */
+/**
+ * Unwraps `x as const` / `x as any` / `x satisfies T` down to the underlying
+ * expression. Without this a cast makes the value invisible to the inspector,
+ * so it is silently dropped from meta rather than validated — and `as const` on
+ * an array is idiomatic enough that this is easy to hit by accident.
+ */
+const unwrapAs = (node: ts.Expression): ts.Expression =>
+  ts.isAsExpression(node) || ts.isSatisfiesExpression(node)
+    ? unwrapAs(node.expression)
+    : node
+
 export const getArrayPropertyValue = (
   obj: ts.ObjectLiteralExpression,
   propertyName: string
@@ -17,7 +28,7 @@ export const getArrayPropertyValue = (
   )
 
   if (property && ts.isPropertyAssignment(property)) {
-    const initializer = property.initializer
+    const initializer = unwrapAs(property.initializer)
     if (ts.isArrayLiteralExpression(initializer)) {
       return initializer.elements
         .filter(ts.isStringLiteral)
@@ -28,6 +39,56 @@ export const getArrayPropertyValue = (
   return null
 }
 
+/**
+ * Extracts a string->string record from an object property.
+ *
+ * `getPropertyValue` falls through to `getText()` for an object literal, which
+ * returns the raw source text rather than the record — so callers that need the
+ * entries (e.g. oauth2 `additionalParams`) must use this instead.
+ */
+export const getRecordPropertyValue = (
+  obj: ts.ObjectLiteralExpression,
+  propertyName: string
+): Record<string, string> | null => {
+  const property = obj.properties.find(
+    (p) =>
+      ts.isPropertyAssignment(p) &&
+      ts.isIdentifier(p.name) &&
+      p.name.text === propertyName
+  )
+
+  if (!property || !ts.isPropertyAssignment(property)) {
+    return null
+  }
+  const initializer = property.initializer
+  if (!ts.isObjectLiteralExpression(initializer)) {
+    return null
+  }
+
+  const record: Record<string, string> = {}
+  for (const prop of initializer.properties) {
+    if (!ts.isPropertyAssignment(prop)) {
+      continue
+    }
+    const key = ts.isIdentifier(prop.name)
+      ? prop.name.text
+      : ts.isStringLiteral(prop.name)
+        ? prop.name.text
+        : null
+    if (key === null) {
+      continue
+    }
+    if (
+      ts.isStringLiteral(prop.initializer) ||
+      ts.isNoSubstitutionTemplateLiteral(prop.initializer)
+    ) {
+      record[key] = prop.initializer.text
+    }
+  }
+
+  return Object.keys(record).length > 0 ? record : null
+}
+
 /**
  * Wiring identity fields (`name`, `secretId`, `variableId`, …) are read
  * STATICALLY from source — a const or variable reference is keyed by its

package/src/utils/load-addon-functions-meta.test.ts

@@ -0,0 +1,157 @@
+import { strict as assert } from 'assert'
+import { describe, test, before, after } from 'node:test'
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'fs'
+import { tmpdir } from 'os'
+import { join } from 'path'
+import { loadAddonFunctionsMeta } from './load-addon-functions-meta.js'
+import type { InspectorState, InspectorLogger } from '../types.js'
+
+const ADDON = '@addon/slack'
+
+const writeAddonFixture = (rootDir: string) => {
+  writeFileSync(
+    join(rootDir, 'package.json'),
+    JSON.stringify({ name: 'consumer' })
+  )
+  const addonDir = join(rootDir, 'node_modules', ADDON)
+  const pikku = join(addonDir, '.pikku')
+  mkdirSync(join(pikku, 'function'), { recursive: true })
+  mkdirSync(join(pikku, 'secrets'), { recursive: true })
+  mkdirSync(join(pikku, 'variables'), { recursive: true })
+  mkdirSync(join(pikku, 'credentials'), { recursive: true })
+  writeFileSync(join(addonDir, 'package.json'), JSON.stringify({ name: ADDON }))
+  writeFileSync(
+    join(pikku, 'function', 'pikku-functions-meta.gen.json'),
+    JSON.stringify({})
+  )
+  // Real addon secrets/variables have a logical name that DIFFERS from the id
+  // the addon reads by (secretId/variableId) — overrides key on the id.
+  writeFileSync(
+    join(pikku, 'secrets', 'pikku-secrets-meta.gen.json'),
+    JSON.stringify({ slack: { name: 'slack', secretId: 'SLACK_TOKEN' } })
+  )
+  writeFileSync(
+    join(pikku, 'variables', 'pikku-variables-meta.gen.json'),
+    JSON.stringify({ region: { name: 'region', variableId: 'REGION' } })
+  )
+  writeFileSync(
+    join(pikku, 'credentials', 'pikku-credentials-meta.gen.json'),
+    JSON.stringify({
+      slackOAuth: { name: 'slackOAuth', type: 'singleton' },
+    })
+  )
+}
+
+const makeState = (
+  rootDir: string,
+  wireAddonDeclarations: Map<string, any>
+): InspectorState =>
+  ({
+    rootDir,
+    rpc: { wireAddonDeclarations },
+    addonFunctions: {},
+    secrets: { definitions: [] },
+    variables: { definitions: [] },
+    credentials: { definitions: [] },
+    mcpEndpoints: { toolsMeta: {} },
+    addonServerlessIncompatible: new Map(),
+    addonRequiredParentServices: [],
+    exportedContracts: { addonHttp: {}, addonCli: {}, addonChannel: {} },
+  }) as unknown as InspectorState
+
+const logger = {
+  debug: () => {},
+  info: () => {},
+  warn: () => {},
+  error: () => {},
+  critical: () => {},
+  diagnostic: () => {},
+} as unknown as InspectorLogger
+
+describe('loadAddonFunctionsMeta — per-instance secret/variable overrides', () => {
+  let rootDir: string
+
+  before(() => {
+    rootDir = mkdtempSync(join(tmpdir(), 'pikku-addon-meta-'))
+    writeAddonFixture(rootDir)
+  })
+
+  after(() => {
+    rmSync(rootDir, { recursive: true, force: true })
+  })
+
+  test('registers the override target names, one per instance, not the shared logical name', async () => {
+    const state = makeState(
+      rootDir,
+      new Map<string, any>([
+        [
+          'slack-marketing',
+          {
+            package: ADDON,
+            // Overrides key on the secretId/variableId, not the logical name.
+            secretOverrides: { SLACK_TOKEN: 'SLACK_MARKETING_TOKEN' },
+            variableOverrides: { REGION: 'MARKETING_REGION' },
+            credentialOverrides: { slackOAuth: 'slack_marketing_oauth' },
+          },
+        ],
+        [
+          'slack-support',
+          {
+            package: ADDON,
+            secretOverrides: { SLACK_TOKEN: 'SLACK_SUPPORT_TOKEN' },
+            credentialOverrides: { slackOAuth: 'slack_support_oauth' },
+          },
+        ],
+      ])
+    )
+
+    await loadAddonFunctionsMeta(logger, state)
+
+    const secretIds = state.secrets.definitions
+      .map((d: any) => d.secretId)
+      .sort()
+    assert.deepEqual(secretIds, [
+      'SLACK_MARKETING_TOKEN',
+      'SLACK_SUPPORT_TOKEN',
+    ])
+
+    // slack-marketing overrides region; slack-support has no override, so it
+    // falls back to the addon's default variableId.
+    const variableIds = state.variables.definitions
+      .map((d: any) => d.variableId)
+      .sort()
+    assert.deepEqual(variableIds, ['MARKETING_REGION', 'REGION'])
+
+    // Each instance's credentialOverride surfaces a distinct credential name
+    // (which doubles as the better-auth providerId) — no shared account pool.
+    const credentialNames = state.credentials.definitions
+      .map((d: any) => d.name)
+      .sort()
+    assert.deepEqual(credentialNames, [
+      'slack_marketing_oauth',
+      'slack_support_oauth',
+    ])
+  })
+
+  test('falls back to the addon logical name when no override is provided', async () => {
+    const state = makeState(
+      rootDir,
+      new Map<string, any>([['slack-plain', { package: ADDON }]])
+    )
+
+    await loadAddonFunctionsMeta(logger, state)
+
+    assert.deepEqual(
+      state.secrets.definitions.map((d: any) => d.secretId),
+      ['SLACK_TOKEN']
+    )
+    assert.deepEqual(
+      state.variables.definitions.map((d: any) => d.variableId),
+      ['REGION']
+    )
+    assert.deepEqual(
+      state.credentials.definitions.map((d: any) => d.name),
+      ['slackOAuth']
+    )
+  })
+})

package/src/utils/load-addon-functions-meta.ts

@@ -133,6 +133,10 @@ export async function loadAddonFunctionsMeta(
   const require = createRequire(join(state.rootDir, 'package.json'))
 
   for (const [namespace, decl] of wireAddonDeclarations) {
+    // Remote addons (wireRemoteAddon) ship as a devDependency: types only.
+    // Their functions, secrets, variables, schemas and services live on the
+    // HOST that runs them — never load or require any of that here.
+    if (decl.remote) continue
     try {
       const metaPath = require.resolve(
         `${decl.package}/.pikku/function/pikku-functions-meta.gen.json`
@@ -168,18 +172,55 @@ export async function loadAddonFunctionsMeta(
         const secretsRaw = await readFile(secretsMetaPath, 'utf-8')
         const secretsMeta = JSON.parse(secretsRaw)
         for (const [key, def] of Object.entries<any>(secretsMeta)) {
+          // secretOverrides key on the SECRET ID (the string the addon passes to
+          // getSecret — its typed map is keyed by secretId, e.g.
+          // `getSecret('MAILGUN_CREDENTIALS')`), NOT the logical meta key, so the
+          // runtime aliaser (which also keys on secretId) and this merge agree.
+          // The resolved id is the real project secret; the addon's secretId is
+          // the default when no override is given. Two instances with different
+          // overrides therefore surface two distinct project secrets. `key` is
+          // the fallback for older meta that predates the secretId field.
+          const secretId = def.secretId ?? key
+          const resolvedSecretId = decl.secretOverrides?.[secretId] ?? secretId
           const existing = state.secrets.definitions.find(
-            (d: any) => d.name === key
+            (d: any) => (d.secretId ?? d.name) === resolvedSecretId
           )
           if (!existing) {
-            state.secrets.definitions.push(def)
-            logger.debug(`Loaded addon secret '${key}' from ${decl.package}`)
+            state.secrets.definitions.push({
+              ...def,
+              secretId: resolvedSecretId,
+            })
+            logger.debug(
+              `Loaded addon secret '${resolvedSecretId}' from ${decl.package}`
+            )
           }
         }
       } catch {
         // No secrets meta — that's fine
       }
 
+      // Load addon scopes meta. Without this an addon's own scopes never reach
+      // the host's ScopeId union or its declared set, so the pikku_scopes FK
+      // would refuse to grant one.
+      try {
+        const scopesMetaPath = require.resolve(
+          `${decl.package}/.pikku/scopes/pikku-scopes-meta.gen.json`
+        )
+        const scopesRaw = await readFile(scopesMetaPath, 'utf-8')
+        const scopesMeta = JSON.parse(scopesRaw)
+        for (const [key, def] of Object.entries<any>(scopesMeta)) {
+          const existing = state.scopes.definitions.find(
+            (d: any) => d.name === key
+          )
+          if (!existing) {
+            state.scopes.definitions.push(def)
+            logger.debug(`Loaded addon scope '${key}' from ${decl.package}`)
+          }
+        }
+      } catch {
+        // No scopes meta — that's fine
+      }
+
       // Load addon variables meta
       try {
         const variablesMetaPath = require.resolve(
@@ -188,17 +229,62 @@ export async function loadAddonFunctionsMeta(
         const variablesRaw = await readFile(variablesMetaPath, 'utf-8')
         const variablesMeta = JSON.parse(variablesRaw)
         for (const [key, def] of Object.entries<any>(variablesMeta)) {
+          // variableOverrides key on the VARIABLE ID (the string the addon reads
+          // via its typed map, keyed by variableId), same as secretOverrides key
+          // on secretId — so the runtime aliaser and this merge agree. `key` is
+          // the fallback for older meta without a variableId field.
+          const variableId = def.variableId ?? key
+          const resolvedVariableId =
+            decl.variableOverrides?.[variableId] ?? variableId
           const existing = state.variables.definitions.find(
-            (d: any) => d.name === key
+            (d: any) => (d.variableId ?? d.name) === resolvedVariableId
           )
           if (!existing) {
-            state.variables.definitions.push(def)
-            logger.debug(`Loaded addon variable '${key}' from ${decl.package}`)
+            state.variables.definitions.push({
+              ...def,
+              variableId: resolvedVariableId,
+            })
+            logger.debug(
+              `Loaded addon variable '${resolvedVariableId}' from ${decl.package}`
+            )
           }
         }
       } catch {
         // No variables meta — that's fine
       }
+
+      // Load addon credentials meta. Without this an addon's OAuth2/wire
+      // credentials never reach the consuming app's CREDENTIAL_OAUTH2_CONFIGS,
+      // so the credential-oauth provider and BetterAuthCredentialService can't
+      // resolve them — the addon's Connect flow and status silently no-op.
+      try {
+        const credentialsMetaPath = require.resolve(
+          `${decl.package}/.pikku/credentials/pikku-credentials-meta.gen.json`
+        )
+        const credentialsRaw = await readFile(credentialsMetaPath, 'utf-8')
+        const credentialsMeta = JSON.parse(credentialsRaw)
+        for (const [key, def] of Object.entries<any>(credentialsMeta)) {
+          // Each instance's credentialOverrides remap the addon's logical
+          // credential name to a project credential — same mechanic as secrets
+          // and variables above. The credential name doubles as the better-auth
+          // providerId (accounts keyed by providerId+userId), so two instances
+          // with different overrides surface two distinct OAuth providers rather
+          // than sharing one account pool. The logical name is the default when
+          // no override is given.
+          const resolvedName = decl.credentialOverrides?.[key] ?? key
+          const existing = state.credentials.definitions.find(
+            (d: any) => d.name === resolvedName
+          )
+          if (!existing) {
+            state.credentials.definitions.push({ ...def, name: resolvedName })
+            logger.debug(
+              `Loaded addon credential '${resolvedName}' from ${decl.package}`
+            )
+          }
+        }
+      } catch {
+        // No credentials meta — that's fine
+      }
       // Load addon serverlessIncompatible service names from pikku-addon-meta.gen.json
       let loadedParentServices = false
       try {
@@ -323,6 +409,8 @@ export async function loadAddonSchemas(
   const require = createRequire(join(state.rootDir, 'package.json'))
 
   for (const [namespace, decl] of wireAddonDeclarations) {
+    // Remote addons carry no local schemas — their funcs run on the host.
+    if (decl.remote) continue
     try {
       const metaPath = require.resolve(
         `${decl.package}/.pikku/function/pikku-functions-meta.gen.json`