@ashlr/stack-core 0.1.1 → 0.2.2

package/src/providers/_api-key.ts

@@ -1,7 +1,5 @@
 import type { ServiceEntry } from "../config.ts";
 import { StackError } from "../errors.ts";
-import { addSecret } from "../phantom.ts";
-import { readLine, tryRevealSecret } from "./_helpers.ts";
 import type {
   AuthHandle,
   HealthStatus,
@@ -12,6 +10,8 @@ import type {
   ProviderContext,
   Resource,
 } from "./_base.ts";
+import { acceptVerifiedExisting, storeProviderSecret } from "./_credential-stage.ts";
+import { promptSecret, tryRevealSecret } from "./_helpers.ts";
 
 /**
  * Factory for API-key-paste providers (OpenAI, Anthropic, xAI, DeepSeek, Resend,
@@ -54,10 +54,13 @@ export function makeApiKeyProvider(spec: ApiKeyProviderSpec): Provider {
     docs: spec.docs,
 
     async login(ctx: ProviderContext): Promise<AuthHandle> {
-      const cached = await tryRevealSecret(spec.secretName);
+      const cached = await tryRevealSecret(spec.secretName, ctx);
       if (cached) {
         const identity = await spec.verify(cached);
-        if (identity) return { token: cached, identity };
+        if (identity) {
+          acceptVerifiedExisting(ctx, spec.secretName, cached);
+          return { token: cached, identity };
+        }
         ctx.log({ level: "warn", msg: `Cached ${spec.displayName} key invalid; re-entering.` });
       }
       if (!ctx.interactive) {
@@ -66,20 +69,20 @@ export function makeApiKeyProvider(spec: ApiKeyProviderSpec): Provider {
           `${spec.displayName}: no valid key in vault and session is non-interactive.`,
         );
       }
-      process.stderr.write(`\n  ${spec.howTo}\n  Paste your ${spec.displayName} API key: `);
-      const key = (await readLine()).trim();
-      if (!key) throw new StackError(`${spec.name.toUpperCase()}_AUTH_REQUIRED`, "No key provided.");
+      const key = await promptSecret(ctx, {
+        message: `Paste your ${spec.displayName} API key`,
+        howTo: spec.howTo,
+      });
+      if (!key)
+        throw new StackError(`${spec.name.toUpperCase()}_AUTH_REQUIRED`, "No key provided.");
       const identity = await spec.verify(key);
       if (!identity)
         throw new StackError(
           `${spec.name.toUpperCase()}_AUTH_INVALID`,
           `${spec.displayName} rejected that key.`,
         );
-      // Persist the verified key immediately. Previously we deferred to
-      // `materialize()`, so if any step after `login()` threw (e.g. a
-      // provision-side API error) the user would have to re-paste their key.
-      // Matches the hand-written providers (supabase, neon, vercel, github, sentry).
-      await addSecret(spec.secretName, key);
+      // Explicit login writes now; addService owns deferred credential inputs.
+      await storeProviderSecret(ctx, spec.secretName, key);
       return { token: key, identity };
     },
 
@@ -95,8 +98,8 @@ export function makeApiKeyProvider(spec: ApiKeyProviderSpec): Provider {
       };
     },
 
-    async materialize(_ctx, _resource, auth): Promise<Materialized> {
-      await addSecret(spec.secretName, auth.token);
+    async materialize(ctx, _resource, auth): Promise<Materialized> {
+      await storeProviderSecret(ctx, spec.secretName, auth.token);
       return {
         secrets: { [spec.secretName]: auth.token },
         ...(spec.mcp ? { mcp: spec.mcp } : {}),
@@ -105,7 +108,7 @@ export function makeApiKeyProvider(spec: ApiKeyProviderSpec): Provider {
 
     async healthcheck(ctx, entry) {
       if (spec.healthcheck) return spec.healthcheck(ctx, entry);
-      const key = await tryRevealSecret(spec.secretName);
+      const key = await tryRevealSecret(spec.secretName, ctx);
       if (!key) return { kind: "error", detail: `${spec.secretName} missing from vault` };
       const start = Date.now();
       const identity = await spec.verify(key);
@@ -118,5 +121,3 @@ export function makeApiKeyProvider(spec: ApiKeyProviderSpec): Provider {
     },
   };
 }
-
-

package/src/providers/_base.ts

@@ -5,6 +5,7 @@ export type ProviderCategory =
   | "deploy"
   | "cloud"
   | "analytics"
+  | "observability"
   | "errors"
   | "ai"
   | "payments"
@@ -12,6 +13,7 @@ export type ProviderCategory =
   | "tickets"
   | "email"
   | "auth"
+  | "featureflags"
   | "comms";
 
 export type AuthKind = "oauth_pkce" | "oauth_device" | "pat" | "api_key" | "cli_shell";
@@ -22,6 +24,24 @@ export interface ProviderContext {
   interactive: boolean;
   /** Structured logger — callers wire this to the CLI's @clack spinner. */
   log: (event: LogEvent) => void;
+  /**
+   * Host-owned interactive prompt for credential entry. The CLI wires this to
+   * its @clack prompt and pauses any active spinner around it (mirrors `log`).
+   * Providers MUST route PAT/key paste through this rather than writing to
+   * stderr directly — a stderr prompt is clobbered by a running spinner, which
+   * makes `stack add` appear to hang. When absent (tests, non-CLI hosts),
+   * `promptSecret` falls back to a bare stdin read.
+   */
+  prompt?: (req: PromptRequest) => Promise<string>;
+}
+
+export interface PromptRequest {
+  /** One-line ask, e.g. "Paste your Supabase access token". */
+  message: string;
+  /** Optional guidance shown above the input (a URL, required scopes). */
+  howTo?: string;
+  /** Mask the input. Defaults to true — these are always secrets. */
+  secret?: boolean;
 }
 
 export interface LogEvent {
@@ -92,5 +112,12 @@ export interface Provider {
 
   healthcheck?(ctx: ProviderContext, entry: ServiceEntry): Promise<HealthStatus>;
   dashboardUrl?(entry: ServiceEntry): string;
-  deprovision?(ctx: ProviderContext, entry: ServiceEntry, auth: AuthHandle): Promise<void>;
+
+  /**
+   * Tear down an upstream resource created by `provision`. Used by `addService`
+   * to roll back on partial failure. Optional — if the provider doesn't
+   * implement it, the dangling resource is logged and the user is directed to
+   * `stack doctor --fix`.
+   */
+  deprovision?(ctx: ProviderContext, auth: AuthHandle, resourceId: string): Promise<void>;
 }

package/src/providers/_credential-stage.ts

@@ -0,0 +1,237 @@
+import { resolve } from "node:path";
+import { StackError } from "../errors.ts";
+import { addSecret, revealSecret } from "../phantom.ts";
+import type { ProviderContext, Resource } from "./_base.ts";
+
+type Phase = "login" | "provision" | "critical" | "materialize" | "commit";
+interface Scope {
+  cwd: string;
+  phase: Phase;
+  inputs: Map<string, string>;
+  candidates: Map<string, string>;
+  existing: Map<string, string>;
+  critical: Map<Resource, Map<string, string>>;
+  createdCritical: Map<string, string>;
+}
+const scopes = new WeakMap<ProviderContext, Scope>();
+// Keep only a no-values tombstone after disposal: a retained operation context
+// must never fall through to standalone persistence after its operation ends.
+const managed = new WeakSet<ProviderContext>();
+
+function active(ctx: ProviderContext): Scope | undefined {
+  const scope = scopes.get(ctx);
+  if (!scope && managed.has(ctx)) {
+    throw new StackError("CREDENTIAL_SCOPE_CLOSED", "Credential operation has already ended.");
+  }
+  return scope;
+}
+function required(ctx: ProviderContext): Scope {
+  const scope = active(ctx);
+  if (!scope) throw new StackError("CREDENTIAL_SCOPE_REQUIRED", "Credential operation is missing.");
+  return scope;
+}
+function conflict(): never {
+  throw new StackError(
+    "CREDENTIAL_INPUT_CONFLICT",
+    "Credential inputs disagree for one secret slot.",
+  );
+}
+function validate(value: string): void {
+  if (/[\r\n]/.test(value)) {
+    throw new StackError(
+      "PHANTOM_SECRET_VALUE_UNSUPPORTED",
+      "Phantom Secrets accepts one line per secret; CR/LF values cannot be stored unchanged.",
+    );
+  }
+}
+function merge(inputs: Map<string, string>, key: string, value: string): void {
+  validate(value);
+  if (inputs.has(key) && inputs.get(key) !== value) conflict();
+  inputs.set(key, value);
+}
+
+/** Internal source coordination only; no public receipt or vault attestation. */
+export function beginCredentialStage(ctx: ProviderContext): void {
+  if (managed.has(ctx)) {
+    throw new StackError("CREDENTIAL_SCOPE_CLOSED", "Credential context cannot be reused.");
+  }
+  managed.add(ctx);
+  scopes.set(ctx, {
+    cwd: resolve(ctx.cwd),
+    phase: "login",
+    inputs: new Map(),
+    candidates: new Map(),
+    existing: new Map(),
+    critical: new Map(),
+    createdCritical: new Map(),
+  });
+}
+export function credentialPhase(ctx: ProviderContext, phase: Phase): void {
+  const scope = required(ctx);
+  scope.candidates.clear();
+  scope.phase = phase;
+}
+export function closeCredentialStage(ctx: ProviderContext): void {
+  const scope = scopes.get(ctx);
+  if (!scope) return;
+  scope.inputs.clear();
+  scope.candidates.clear();
+  scope.existing.clear();
+  for (const values of scope.critical.values()) values.clear();
+  scope.critical.clear();
+  scope.createdCritical.clear();
+  scopes.delete(ctx);
+}
+
+export async function readProviderSecret(ctx: ProviderContext, key: string): Promise<string> {
+  const scope = active(ctx);
+  const value = await revealSecret(key, scope?.cwd ?? ctx.cwd);
+  if (scope) {
+    if (active(ctx) !== scope) {
+      throw new StackError("CREDENTIAL_SCOPE_CLOSED", "Credential operation has already ended.");
+    }
+    if (scope.phase === "login" && value) scope.candidates.set(key, value);
+  }
+  return value;
+}
+/** Called only by the original cached branch after its fresh verifier succeeds.
+ * Exact input equality authorizes omitting this operation's duplicate create;
+ * it does not attest a concurrently unchanged vault or authenticate arbitrary JS.
+ */
+export function acceptVerifiedExisting(ctx: ProviderContext, key: string, value: string): void {
+  const scope = active(ctx);
+  if (!scope) return;
+  if (scope.phase !== "login" || scope.candidates.get(key) !== value) {
+    throw new StackError(
+      "CREDENTIAL_EXISTING_UNCONFIRMED",
+      "Existing credential was not verified in this login.",
+    );
+  }
+  if (scope.inputs.has(key) && scope.inputs.get(key) !== value) conflict();
+  scope.existing.set(key, value);
+  scope.candidates.delete(key);
+}
+
+async function createCredential(key: string, value: string, cwd: string): Promise<void> {
+  try {
+    await addSecret(key, value, cwd);
+  } catch (err) {
+    // Producer output can contain input values. Preserve a recognized refusal
+    // code, never its raw message/cause or an upstream-derived secret name.
+    const code = err instanceof StackError ? err.code : "PHANTOM_EXEC_FAILED";
+    throw new StackError(
+      code,
+      code === "PHANTOM_SECRET_EXISTS"
+        ? "Credential storage was refused; the secret name already exists."
+        : "Credential storage could not be confirmed.",
+    );
+  }
+}
+export async function commitOrdinaryCredential(
+  ctx: ProviderContext,
+  key: string,
+  value: string,
+): Promise<void> {
+  const scope = required(ctx);
+  if (scope.phase !== "commit") {
+    throw new StackError("CREDENTIAL_PHASE_CLOSED", "Credential commit is not active.");
+  }
+  await createCredential(key, value, scope.cwd);
+}
+
+export async function storeProviderSecret(
+  ctx: ProviderContext,
+  key: string,
+  value: string,
+): Promise<void> {
+  const scope = active(ctx);
+  if (!scope) return createCredential(key, value, ctx.cwd);
+  if (scope.phase !== "login" && scope.phase !== "provision" && scope.phase !== "materialize") {
+    throw new StackError("CREDENTIAL_PHASE_CLOSED", "Credential input collection has ended.");
+  }
+  if (scope.existing.has(key) && scope.existing.get(key) !== value) conflict();
+  merge(scope.inputs, key, value);
+}
+
+/** The generated password is not recoverable from the API. Carry it privately
+ * on the exact returned resource until the pipeline owns failure cleanup.
+ * Standalone provision retains its immediate strict persistence contract.
+ */
+export async function carryResourceCredential(
+  ctx: ProviderContext,
+  resource: Resource,
+  key: string,
+  value: string,
+): Promise<void> {
+  const scope = active(ctx);
+  if (!scope) return createCredential(key, value, ctx.cwd);
+  if (scope.phase !== "provision") {
+    throw new StackError("CREDENTIAL_PHASE_CLOSED", "Resource credential collection has ended.");
+  }
+  let values = scope.critical.get(resource);
+  if (!values) {
+    values = new Map();
+    scope.critical.set(resource, values);
+  }
+  merge(values, key, value);
+}
+export async function commitResourceCredentials(
+  ctx: ProviderContext,
+  resource: Resource,
+  created: (key: string) => void,
+): Promise<void> {
+  const scope = required(ctx);
+  if (scope.phase !== "critical") {
+    throw new StackError("CREDENTIAL_PHASE_CLOSED", "Resource credential commit is not active.");
+  }
+  const values = scope.critical.get(resource);
+  if (!values) return;
+  // Take once before the first await. Refusal or unknown completion is never
+  // converted into a successful write or retried from this private carry.
+  scope.critical.delete(resource);
+  try {
+    for (const [key, value] of values) {
+      if (scope.inputs.has(key) && scope.inputs.get(key) !== value) conflict();
+      if (scope.existing.has(key) || scope.createdCritical.has(key)) conflict();
+      try {
+        await addSecret(key, value, scope.cwd);
+      } catch {
+        // The generated name includes an upstream identifier. Do not reflect
+        // that name, producer output or the password into a failure diagnostic.
+        throw new StackError(
+          "RESOURCE_CREDENTIAL_UNCONFIRMED",
+          "Resource credential storage was refused or could not be confirmed.",
+        );
+      }
+      scope.createdCritical.set(key, value);
+      created(key);
+    }
+  } finally {
+    values.clear();
+  }
+}
+
+/** Validate the entire ordinary plan before its first create. Critical resource
+ * writes necessarily precede materialize; a later conflict uses owned rollback.
+ * Materialized slots stay first; auth-only slots follow, before MCP/config.
+ */
+export function ordinaryCredentialPlan(
+  ctx: ProviderContext,
+  materialized: Record<string, string>,
+): Array<[string, string]> {
+  const scope = required(ctx);
+  const plan = new Map<string, string>();
+  for (const [key, value] of Object.entries(materialized)) merge(plan, key, value);
+  for (const [key, value] of scope.inputs) merge(plan, key, value);
+  for (const [key, value] of plan) {
+    if (scope.existing.has(key)) {
+      if (scope.existing.get(key) !== value) conflict();
+      plan.delete(key);
+    }
+    if (scope.createdCritical.has(key)) {
+      if (scope.createdCritical.get(key) !== value) conflict();
+      plan.delete(key);
+    }
+  }
+  return [...plan];
+}

package/src/providers/_helpers.ts

@@ -1,5 +1,8 @@
+import { StackError } from "../errors.ts";
+import { type RetryOptions, fetchWithRetry } from "../http.ts";
 import { revealSecret } from "../phantom.ts";
-import { fetchWithRetry, type RetryOptions } from "../http.ts";
+import type { ProviderContext } from "./_base.ts";
+import { readProviderSecret } from "./_credential-stage.ts";
 
 /**
  * Shared helpers for every hand-written provider. Before this existed, each
@@ -7,18 +10,61 @@ import { fetchWithRetry, type RetryOptions } from "../http.ts";
  * one source of truth keeps behaviour consistent.
  */
 
-export async function tryRevealSecret(key: string): Promise<string | undefined> {
+/**
+ * Names whose stored value Phantom refused to reveal to this process (it only
+ * reveals into an attached terminal). Lets `stack doctor` tell "stored but
+ * unreadable here" apart from "missing", since `tryRevealSecret` returns
+ * `undefined` for both. Names only, never values.
+ */
+const revealRefusals = new Set<string>();
+
+/** Return and clear the names Phantom refused to reveal since the last call. */
+export function takeRevealRefusals(): string[] {
+  const names = [...revealRefusals];
+  revealRefusals.clear();
+  return names;
+}
+
+export async function tryRevealSecret(
+  key: string,
+  ctx?: ProviderContext,
+): Promise<string | undefined> {
   try {
-    const value = await revealSecret(key);
+    const value = ctx ? await readProviderSecret(ctx, key) : await revealSecret(key);
     return value.length > 0 ? value : undefined;
-  } catch {
+  } catch (err) {
+    if (err instanceof StackError && err.code === "PHANTOM_TRUSTED_TERMINAL_REQUIRED") {
+      revealRefusals.add(key);
+    }
     return undefined;
   }
 }
 
 /**
- * Read a single line from stdin. Used by every provider's PAT-paste fallback
- * when no OAuth client is configured. Resumes stdin, reads until newline, then
+ * Prompt the user for a credential. When the host supplies `ctx.prompt` (the
+ * CLI always does), the request goes through it — the CLI pauses its spinner,
+ * runs a @clack prompt, then resumes. This is the ONLY safe way to read a
+ * credential while a spinner is running: writing the prompt to stderr directly
+ * gets clobbered by the spinner's repaint and `stack add` looks like it hung.
+ *
+ * Falls back to a bare stderr-prompt + stdin read for non-CLI hosts and tests,
+ * where no spinner is competing for the terminal.
+ */
+export async function promptSecret(
+  ctx: ProviderContext,
+  req: { message: string; howTo?: string },
+): Promise<string> {
+  if (ctx.prompt) {
+    return (await ctx.prompt({ message: req.message, howTo: req.howTo, secret: true })).trim();
+  }
+  if (req.howTo) process.stderr.write(`\n  ${req.howTo}\n`);
+  process.stderr.write(`  ${req.message}: `);
+  return (await readLine()).trim();
+}
+
+/**
+ * Read a single line from stdin. Used by `promptSecret`'s non-CLI fallback when
+ * no host prompt is configured. Resumes stdin, reads until newline, then
  * pauses stdin so the parent process doesn't hang waiting for EOF.
  */
 export async function readLine(): Promise<string> {
@@ -42,7 +88,7 @@ export async function readLine(): Promise<string> {
  * Bearer-token providers. Providers with custom auth header shapes (Anthropic,
  * Upstash, Linear, Supabase PKCE) inline their own.
  */
-export function bearerJsonHeaders(token: string): HeadersInit {
+export function bearerJsonHeaders(token: string): NonNullable<RequestInit["headers"]> {
   return {
     Authorization: `Bearer ${token}`,
     "content-type": "application/json",
@@ -58,7 +104,7 @@ export function bearerJsonHeaders(token: string): HeadersInit {
  * 429/5xx is always safe. Keeps each provider's `verify` free of retry glue.
  */
 export function verifyFetch(
-  input: RequestInfo | URL,
+  input: string | URL | Request,
   init?: RequestInit,
   opts?: RetryOptions,
 ): Promise<Response> {
@@ -74,7 +120,7 @@ export function verifyFetch(
  * Usage: `ctx.log({ msg: \`token ${scrub(t)} rejected\` })` prints
  * `token ****abcd rejected`, never the raw secret.
  */
-export function scrub(value: string, keepLast: number = 4): string {
+export function scrub(value: string, keepLast = 4): string {
   if (!value) return "";
   if (value.length <= keepLast) return "****";
   return `****${value.slice(-keepLast)}`;

package/src/providers/anthropic.ts

@@ -1,3 +1,4 @@
+import { anthropicBaseUrl } from "../base-urls.ts";
 import { makeApiKeyProvider } from "./_api-key.ts";
 import { verifyFetch } from "./_helpers.ts";
 
@@ -11,7 +12,7 @@ export default makeApiKeyProvider({
   dashboard: "https://console.anthropic.com",
   async verify(key) {
     try {
-      const res = await verifyFetch("https://api.anthropic.com/v1/models", {
+      const res = await verifyFetch(`${anthropicBaseUrl()}/v1/models`, {
         headers: {
           "x-api-key": key,
           "anthropic-version": "2023-06-01",

package/src/providers/auth0.ts

@@ -0,0 +1,27 @@
+import { makeApiKeyProvider } from "./_api-key.ts";
+import { verifyFetch } from "./_helpers.ts";
+
+export default makeApiKeyProvider({
+  name: "auth0",
+  displayName: "Auth0",
+  category: "auth",
+  docs: "https://auth0.com/docs/api/management/v2",
+  secretName: "AUTH0_DOMAIN",
+  howTo:
+    "Enter your Auth0 tenant domain, such as your-tenant.us.auth0.com. This adapter checks its discovery response and stores only that domain.",
+  dashboard: "https://manage.auth0.com",
+  async verify(key) {
+    // `key` here is the domain (e.g. "myapp.us.auth0.com").
+    // We hit the OIDC discovery endpoint — no credentials required — to confirm
+    // the tenant is reachable. Full M2M credential verification requires an
+    // access-token exchange which is deferred to the multi-secret login path.
+    try {
+      const res = await verifyFetch(`https://${key}/.well-known/openid-configuration`);
+      if (!res.ok) return undefined;
+      const body = (await res.json()) as { issuer?: string };
+      return body.issuer ? { issuer: body.issuer } : undefined;
+    } catch {
+      return undefined;
+    }
+  },
+});

package/src/providers/aws.ts

@@ -1,8 +1,6 @@
-import type { ServiceEntry } from "../config.ts";
 import { createHash, createHmac } from "node:crypto";
+import type { ServiceEntry } from "../config.ts";
 import { StackError } from "../errors.ts";
-import { addSecret } from "../phantom.ts";
-import { readLine, tryRevealSecret } from "./_helpers.ts";
 import type {
   AuthHandle,
   HealthStatus,
@@ -11,6 +9,8 @@ import type {
   ProviderContext,
   Resource,
 } from "./_base.ts";
+import { acceptVerifiedExisting, storeProviderSecret } from "./_credential-stage.ts";
+import { promptSecret, tryRevealSecret } from "./_helpers.ts";
 
 /**
  * AWS — v1 accepts an IAM access key pair (access key id + secret access key).
@@ -32,25 +32,29 @@ const aws: Provider = {
   docs: "https://docs.aws.amazon.com/iam/",
 
   async login(ctx: ProviderContext): Promise<AuthHandle> {
-    const cachedId = await tryRevealSecret(SECRET_ID_KEY);
-    const cachedSecret = await tryRevealSecret(SECRET_SECRET_KEY);
+    const cachedId = await tryRevealSecret(SECRET_ID_KEY, ctx);
+    const cachedSecret = await tryRevealSecret(SECRET_SECRET_KEY, ctx);
     if (cachedId && cachedSecret) {
       const identity = await callStsIdentity(cachedId, cachedSecret, "us-east-1");
-      if (identity) return { token: `${cachedId}:${cachedSecret}`, identity };
+      if (identity) {
+        acceptVerifiedExisting(ctx, SECRET_ID_KEY, cachedId);
+        acceptVerifiedExisting(ctx, SECRET_SECRET_KEY, cachedSecret);
+        return { token: `${cachedId}:${cachedSecret}`, identity };
+      }
       ctx.log({ level: "warn", msg: "Cached AWS credentials invalid." });
     }
     if (!ctx.interactive)
       throw new StackError("AWS_AUTH_REQUIRED", "No valid AWS credentials in vault.");
-    process.stderr.write(
-      "\n  Create an IAM access key at https://console.aws.amazon.com/iam/home#/security_credentials\n  AWS_ACCESS_KEY_ID: ",
-    );
-    const accessKeyId = (await readLine()).trim();
-    process.stderr.write("  AWS_SECRET_ACCESS_KEY: ");
-    const secretAccessKey = (await readLine()).trim();
+    const accessKeyId = await promptSecret(ctx, {
+      message: "AWS_ACCESS_KEY_ID",
+      howTo:
+        "Create an IAM access key at https://console.aws.amazon.com/iam/home#/security_credentials",
+    });
+    const secretAccessKey = await promptSecret(ctx, { message: "AWS_SECRET_ACCESS_KEY" });
     const identity = await callStsIdentity(accessKeyId, secretAccessKey, "us-east-1");
     if (!identity) throw new StackError("AWS_AUTH_INVALID", "AWS rejected those credentials.");
-    await addSecret(SECRET_ID_KEY, accessKeyId);
-    await addSecret(SECRET_SECRET_KEY, secretAccessKey);
+    await storeProviderSecret(ctx, SECRET_ID_KEY, accessKeyId);
+    await storeProviderSecret(ctx, SECRET_SECRET_KEY, secretAccessKey);
     return { token: `${accessKeyId}:${secretAccessKey}`, identity };
   },
 
@@ -64,7 +68,7 @@ const aws: Provider = {
     };
   },
 
-  async materialize(_ctx, resource, auth): Promise<Materialized> {
+  async materialize(ctx, resource, auth): Promise<Materialized> {
     const sep = auth.token.indexOf(":");
     if (sep <= 0 || sep === auth.token.length - 1) {
       throw new StackError(
@@ -80,7 +84,7 @@ const aws: Provider = {
         "AWS auth handle missing access key id or secret access key.",
       );
     }
-    await addSecret(SECRET_REGION, resource.region ?? "us-east-1");
+    await storeProviderSecret(ctx, SECRET_REGION, resource.region ?? "us-east-1");
     return {
       secrets: {
         AWS_ACCESS_KEY_ID: accessKeyId,
@@ -90,10 +94,10 @@ const aws: Provider = {
     };
   },
 
-  async healthcheck(_ctx, _entry: ServiceEntry): Promise<HealthStatus> {
-    const id = await tryRevealSecret(SECRET_ID_KEY);
-    const secret = await tryRevealSecret(SECRET_SECRET_KEY);
-    const region = (await tryRevealSecret(SECRET_REGION)) ?? "us-east-1";
+  async healthcheck(ctx, _entry: ServiceEntry): Promise<HealthStatus> {
+    const id = await tryRevealSecret(SECRET_ID_KEY, ctx);
+    const secret = await tryRevealSecret(SECRET_SECRET_KEY, ctx);
+    const region = (await tryRevealSecret(SECRET_REGION, ctx)) ?? "us-east-1";
     if (!id || !secret) return { kind: "error", detail: "AWS credentials missing from vault" };
     const start = Date.now();
     const identity = await callStsIdentity(id, secret, region);
@@ -127,19 +131,11 @@ async function callStsIdentity(
   const payload = "Action=GetCallerIdentity&Version=2011-06-15";
   const payloadHash = createHash("sha256").update(payload).digest("hex");
 
-  const canonicalHeaders =
-    `content-type:application/x-www-form-urlencoded\n` +
-    `host:${host}\n` +
-    `x-amz-date:${amzDate}\n`;
+  const canonicalHeaders = `content-type:application/x-www-form-urlencoded\nhost:${host}\nx-amz-date:${amzDate}\n`;
   const signedHeaders = "content-type;host;x-amz-date";
-  const canonicalRequest = [
-    method,
-    "/",
-    "",
-    canonicalHeaders,
-    signedHeaders,
-    payloadHash,
-  ].join("\n");
+  const canonicalRequest = [method, "/", "", canonicalHeaders, signedHeaders, payloadHash].join(
+    "\n",
+  );
   const scope = `${datestamp}/${region}/${service}/aws4_request`;
   const stringToSign = [
     "AWS4-HMAC-SHA256",
@@ -189,7 +185,10 @@ function hmac(key: string | Buffer, value: string): Buffer {
 }
 
 function toAmzDate(d: Date): string {
-  return d.toISOString().replace(/[-:]/g, "").replace(/\.\d{3}/, "");
+  return d
+    .toISOString()
+    .replace(/[-:]/g, "")
+    .replace(/\.\d{3}/, "");
 }
 
 function matchXml(xml: string, tag: string): string | undefined {