@ashlr/stack-core 0.1.1 → 0.2.2

package/src/providers/cloudflare.ts

@@ -1,6 +1,5 @@
 import type { ServiceEntry } from "../config.ts";
 import { StackError } from "../errors.ts";
-import { addSecret, revealSecret } from "../phantom.ts";
 import { fetchWithRetry } from "../http.ts";
 import type {
   AuthHandle,
@@ -11,6 +10,8 @@ import type {
   ProvisionOpts,
   Resource,
 } from "./_base.ts";
+import { acceptVerifiedExisting, storeProviderSecret } from "./_credential-stage.ts";
+import { promptSecret, tryRevealSecret } from "./_helpers.ts";
 
 /**
  * Cloudflare — Workers / Pages / R2 / D1 / KV all hang off one Account API
@@ -31,21 +32,26 @@ const cloudflare: Provider = {
   docs: "https://developers.cloudflare.com/api",
 
   async login(ctx: ProviderContext): Promise<AuthHandle> {
-    const cached = await tryRevealSecret(TOKEN_SECRET);
+    const cached = await tryRevealSecret(TOKEN_SECRET, ctx);
     if (cached) {
       const identity = await verifyToken(cached);
-      if (identity) return { token: cached, identity };
+      if (identity) {
+        acceptVerifiedExisting(ctx, TOKEN_SECRET, cached);
+        return { token: cached, identity };
+      }
       ctx.log({ level: "warn", msg: "Cached Cloudflare token invalid." });
     }
     if (!ctx.interactive)
       throw new StackError("CLOUDFLARE_AUTH_REQUIRED", "No valid Cloudflare token in vault.");
-    process.stderr.write(
-      "\n  Create an API token at https://dash.cloudflare.com/profile/api-tokens\n  Scopes: Account · Workers Scripts / Pages / R2 / D1 as needed\n  Paste it here: ",
-    );
-    const token = (await readLine()).trim();
+    const token = await promptSecret(ctx, {
+      message: "Paste your Cloudflare API token",
+      howTo:
+        "Create an API token at https://dash.cloudflare.com/profile/api-tokens (scopes: Account · Workers Scripts / Pages / R2 / D1 as needed)",
+    });
     const identity = await verifyToken(token);
-    if (!identity) throw new StackError("CLOUDFLARE_AUTH_INVALID", "Cloudflare rejected that token.");
-    await addSecret(TOKEN_SECRET, token);
+    if (!identity)
+      throw new StackError("CLOUDFLARE_AUTH_INVALID", "Cloudflare rejected that token.");
+    await storeProviderSecret(ctx, TOKEN_SECRET, token);
     return { token, identity };
   },
 
@@ -67,7 +73,7 @@ const cloudflare: Provider = {
     };
   },
 
-  async materialize(_ctx, resource, auth): Promise<Materialized> {
+  async materialize(ctx, resource, auth): Promise<Materialized> {
     return {
       secrets: {
         CLOUDFLARE_API_TOKEN: auth.token,
@@ -77,8 +83,8 @@ const cloudflare: Provider = {
     };
   },
 
-  async healthcheck(_ctx, _entry: ServiceEntry): Promise<HealthStatus> {
-    const token = await tryRevealSecret(TOKEN_SECRET);
+  async healthcheck(ctx, _entry: ServiceEntry): Promise<HealthStatus> {
+    const token = await tryRevealSecret(TOKEN_SECRET, ctx);
     if (!token) return { kind: "error", detail: `${TOKEN_SECRET} missing from vault` };
     const start = Date.now();
     const identity = await verifyToken(token);
@@ -119,28 +125,3 @@ async function fetchAccounts(token: string): Promise<Array<{ id: string; name: s
   const body = (await res.json()) as { result?: Array<{ id: string; name: string }> };
   return body.result ?? [];
 }
-
-async function tryRevealSecret(key: string): Promise<string | undefined> {
-  try {
-    const v = await revealSecret(key);
-    return v.length > 0 ? v : undefined;
-  } catch {
-    return undefined;
-  }
-}
-
-async function readLine(): Promise<string> {
-  return new Promise((resolve) => {
-    let buf = "";
-    const onData = (chunk: Buffer) => {
-      buf += chunk.toString();
-      if (buf.includes("\n")) {
-        process.stdin.off("data", onData);
-        process.stdin.pause();
-        resolve(buf.split("\n")[0]);
-      }
-    };
-    process.stdin.resume();
-    process.stdin.on("data", onData);
-  });
-}

package/src/providers/convex.ts

@@ -12,8 +12,7 @@ export default makeApiKeyProvider({
   category: "database",
   docs: "https://docs.convex.dev",
   secretName: "CONVEX_DEPLOY_KEY",
-  howTo:
-    "Create a deploy key at https://dashboard.convex.dev (Project → Settings → Deploy Keys).",
+  howTo: "Create a deploy key at https://dashboard.convex.dev (Project → Settings → Deploy Keys).",
   dashboard: "https://dashboard.convex.dev",
   async verify(key) {
     // Convex deploy keys have the shape prod:<team>:<project>|<token>. No

package/src/providers/datadog.ts

@@ -0,0 +1,29 @@
+import { makeApiKeyProvider } from "./_api-key.ts";
+import { verifyFetch } from "./_helpers.ts";
+
+export default makeApiKeyProvider({
+  name: "datadog",
+  displayName: "Datadog",
+  category: "observability",
+  docs: "https://docs.datadoghq.com/api/latest/",
+  secretName: "DD_API_KEY",
+  howTo:
+    "Create an API key at https://app.datadoghq.com/organization-settings/api-keys. This adapter validates and stores that key only.",
+  dashboard: "https://app.datadoghq.com",
+  async verify(key) {
+    try {
+      // GET /api/v1/validate — requires only the API key in the header.
+      const res = await verifyFetch("https://api.datadoghq.com/api/v1/validate", {
+        headers: {
+          "DD-API-KEY": key,
+          Accept: "application/json",
+        },
+      });
+      if (!res.ok) return undefined;
+      const body = (await res.json()) as { valid?: boolean };
+      return body.valid ? { valid: "true" } : undefined;
+    } catch {
+      return undefined;
+    }
+  },
+});

package/src/providers/digitalocean.ts

@@ -0,0 +1,30 @@
+import { makeApiKeyProvider } from "./_api-key.ts";
+import { verifyFetch } from "./_helpers.ts";
+
+export default makeApiKeyProvider({
+  name: "digitalocean",
+  displayName: "DigitalOcean",
+  category: "cloud",
+  docs: "https://docs.digitalocean.com/reference/api/api-reference/",
+  secretName: "DIGITALOCEAN_TOKEN",
+  howTo: "Create a personal access token at https://cloud.digitalocean.com/account/api/tokens.",
+  dashboard: "https://cloud.digitalocean.com",
+  async verify(key) {
+    try {
+      const res = await verifyFetch("https://api.digitalocean.com/v2/account", {
+        headers: {
+          Authorization: `Bearer ${key}`,
+          Accept: "application/json",
+        },
+      });
+      if (!res.ok) return undefined;
+      const body = (await res.json()) as { account?: { email?: string; uuid?: string } };
+      return {
+        email: body.account?.email ?? "",
+        uuid: body.account?.uuid ?? "",
+      };
+    } catch {
+      return undefined;
+    }
+  },
+});

package/src/providers/gcp.ts

@@ -0,0 +1,36 @@
+import { makeApiKeyProvider } from "./_api-key.ts";
+
+// GCP uses a service-account JSON blob as the primary credential. We store
+// the raw JSON in Phantom. The verify step does a structural parse only —
+// exchanging the JSON for an OAuth2 access token and then calling the Cloud
+// Resource Manager API requires network round-trips to token.googleapis.com
+// and is deferred to v0.2. The structural check is sufficient to catch copy-
+// paste errors (wrong file, truncated JSON, wrong project).
+export default makeApiKeyProvider({
+  name: "gcp",
+  displayName: "GCP",
+  category: "cloud",
+  docs: "https://cloud.google.com/docs/authentication/getting-started",
+  secretName: "GCP_SERVICE_ACCOUNT_JSON",
+  howTo:
+    "Download a service-account JSON key from GCP → IAM & Admin → Service Accounts and paste the full JSON content.",
+  dashboard: "https://console.cloud.google.com",
+  async verify(key) {
+    try {
+      const parsed = JSON.parse(key) as Record<string, unknown>;
+      if (
+        parsed.type === "service_account" &&
+        typeof parsed.project_id === "string" &&
+        typeof parsed.client_email === "string"
+      ) {
+        return {
+          project_id: parsed.project_id as string,
+          client_email: parsed.client_email as string,
+        };
+      }
+      return undefined;
+    } catch {
+      return undefined;
+    }
+  },
+});

package/src/providers/github.ts

@@ -1,9 +1,7 @@
 import type { ServiceEntry } from "../config.ts";
+import { resolveOAuthClientId } from "../env.ts";
 import { StackError } from "../errors.ts";
-import { addSecret } from "../phantom.ts";
 import { fetchWithRetry } from "../http.ts";
-import { readLine, tryRevealSecret } from "./_helpers.ts";
-import { resolveOAuthClientId } from "../env.ts";
 import type {
   AuthHandle,
   HealthStatus,
@@ -12,6 +10,8 @@ import type {
   ProviderContext,
   Resource,
 } from "./_base.ts";
+import { acceptVerifiedExisting, storeProviderSecret } from "./_credential-stage.ts";
+import { promptSecret, tryRevealSecret } from "./_helpers.ts";
 
 /**
  * GitHub — OAuth device flow (no local redirect needed, works in SSH/remote
@@ -32,33 +32,39 @@ const github: Provider = {
   docs: "https://docs.github.com/en/rest",
 
   async login(ctx: ProviderContext): Promise<AuthHandle> {
-    const cached = await tryRevealSecret(TOKEN_SECRET);
+    const cached = await tryRevealSecret(TOKEN_SECRET, ctx);
     if (cached) {
       const identity = await fetchUser(cached);
-      if (identity) return { token: cached, identity };
+      if (identity) {
+        acceptVerifiedExisting(ctx, TOKEN_SECRET, cached);
+        return { token: cached, identity };
+      }
       ctx.log({ level: "warn", msg: "Cached GitHub token invalid; re-authenticating." });
     }
 
     const clientId = resolveOAuthClientId("github", process.env.GITHUB_STACK_CLIENT_ID);
     if (clientId) {
-      const token = await runDeviceFlow(clientId);
+      const token = await runDeviceFlow(ctx, clientId);
       const identity = await fetchUser(token);
       if (!identity)
-        throw new StackError("GITHUB_AUTH_INVALID", "GitHub accepted the code but rejected the token.");
-      await addSecret(TOKEN_SECRET, token);
+        throw new StackError(
+          "GITHUB_AUTH_INVALID",
+          "GitHub accepted the code but rejected the token.",
+        );
+      await storeProviderSecret(ctx, TOKEN_SECRET, token);
       return { token, identity };
     }
 
     // PAT fallback.
     if (!ctx.interactive)
       throw new StackError("GITHUB_AUTH_REQUIRED", "Set GITHUB_STACK_CLIENT_ID or paste a PAT.");
-    process.stderr.write(
-      "\n  Create a GitHub PAT at https://github.com/settings/personal-access-tokens/new\n  Paste it here: ",
-    );
-    const token = (await readLine()).trim();
+    const token = await promptSecret(ctx, {
+      message: "Paste your GitHub PAT",
+      howTo: "Create a GitHub PAT at https://github.com/settings/personal-access-tokens/new",
+    });
     const identity = await fetchUser(token);
     if (!identity) throw new StackError("GITHUB_AUTH_INVALID", "GitHub rejected that token.");
-    await addSecret(TOKEN_SECRET, token);
+    await storeProviderSecret(ctx, TOKEN_SECRET, token);
     return { token, identity };
   },
 
@@ -72,7 +78,7 @@ const github: Provider = {
     return { id: login, displayName: `@${login}` };
   },
 
-  async materialize(_ctx, _resource, auth): Promise<Materialized> {
+  async materialize(ctx, _resource, auth): Promise<Materialized> {
     return {
       secrets: { [TOKEN_SECRET]: auth.token },
       mcp: {
@@ -85,8 +91,8 @@ const github: Provider = {
     };
   },
 
-  async healthcheck(_ctx, _entry: ServiceEntry): Promise<HealthStatus> {
-    const token = await tryRevealSecret(TOKEN_SECRET);
+  async healthcheck(ctx, _entry: ServiceEntry): Promise<HealthStatus> {
+    const token = await tryRevealSecret(TOKEN_SECRET, ctx);
     if (!token) return { kind: "error", detail: `${TOKEN_SECRET} missing from vault` };
     const start = Date.now();
     const user = await fetchUser(token);
@@ -123,7 +129,7 @@ async function fetchUser(token: string): Promise<Record<string, string> | undefi
   }
 }
 
-async function runDeviceFlow(clientId: string): Promise<string> {
+async function runDeviceFlow(ctx: ProviderContext, clientId: string): Promise<string> {
   // 1. Request device code.
   const startRes = await fetch("https://github.com/login/device/code", {
     method: "POST",
@@ -132,23 +138,21 @@ async function runDeviceFlow(clientId: string): Promise<string> {
   });
   if (!startRes.ok)
     throw new StackError("GITHUB_DEVICE_START_FAILED", `device/code ${startRes.status}`);
-  const {
-    device_code,
-    user_code,
-    verification_uri,
-    interval,
-    expires_in,
-  } = (await startRes.json()) as {
-    device_code: string;
-    user_code: string;
-    verification_uri: string;
-    interval: number;
-    expires_in: number;
-  };
+  const { device_code, user_code, verification_uri, interval, expires_in } =
+    (await startRes.json()) as {
+      device_code: string;
+      user_code: string;
+      verification_uri: string;
+      interval: number;
+      expires_in: number;
+    };
 
-  process.stderr.write(
-    `\n  Visit ${verification_uri} and enter this code: ${user_code}\n  (waiting for approval…)\n`,
-  );
+  // Route through ctx.log so the CLI pauses its spinner — a bare stderr write
+  // here is repainted over by the spinner and the user never sees the code.
+  ctx.log({
+    level: "info",
+    msg: `Visit ${verification_uri} and enter this code: ${user_code} (waiting for approval…)`,
+  });
 
   // 2. Poll for the token.
   const deadline = Date.now() + expires_in * 1000;
@@ -176,5 +180,3 @@ async function runDeviceFlow(clientId: string): Promise<string> {
   }
   throw new StackError("GITHUB_DEVICE_TIMEOUT", "Device flow timed out.");
 }
-
-

package/src/providers/grafana.ts

@@ -0,0 +1,29 @@
+import { makeApiKeyProvider } from "./_api-key.ts";
+import { verifyFetch } from "./_helpers.ts";
+
+// Grafana is self-hosted or Grafana Cloud — we store both the token and the
+// base URL. The secretName for `makeApiKeyProvider` is the token slot; the URL
+// is prompted separately in the howTo message and stored via a custom
+// materialize approach. For now, the key that is "verified" is the API token,
+// and the GRAFANA_URL is a second secret the user must add manually or via
+// `stack add grafana` with a follow-up prompt. This matches the pattern used
+// by Sentry (which also stores multiple secrets).
+export default makeApiKeyProvider({
+  name: "grafana",
+  displayName: "Grafana",
+  category: "observability",
+  docs: "https://grafana.com/docs/grafana/latest/developers/http_api/",
+  secretName: "GRAFANA_API_KEY",
+  howTo:
+    "Create a service-account token in Grafana → Administration → Service accounts. You will also need your Grafana base URL (e.g. https://myorg.grafana.net).",
+  dashboard: "https://grafana.com",
+  async verify(key) {
+    // Without the URL we can't verify against the actual instance. We do a
+    // structural check: Grafana service-account tokens start with "glsa_".
+    // Grafana Cloud API tokens also start with "glc_". Accept both shapes.
+    if (key.startsWith("glsa_") || key.startsWith("glc_") || key.length >= 32) {
+      return { token_type: key.startsWith("glsa_") ? "service_account" : "api_key" };
+    }
+    return undefined;
+  },
+});

package/src/providers/hetzner.ts

@@ -0,0 +1,29 @@
+import { makeApiKeyProvider } from "./_api-key.ts";
+import { verifyFetch } from "./_helpers.ts";
+
+export default makeApiKeyProvider({
+  name: "hetzner",
+  displayName: "Hetzner",
+  category: "cloud",
+  docs: "https://docs.hetzner.cloud/",
+  secretName: "HETZNER_API_TOKEN",
+  howTo: "Create an API token in Hetzner Cloud Console → Project → Security → API Tokens.",
+  dashboard: "https://console.hetzner.cloud",
+  async verify(key) {
+    try {
+      // GET /v1/locations is a lightweight public-ish endpoint that returns
+      // available datacenters — valid for any token, no side effects.
+      const res = await verifyFetch("https://api.hetzner.cloud/v1/locations", {
+        headers: {
+          Authorization: `Bearer ${key}`,
+          Accept: "application/json",
+        },
+      });
+      if (!res.ok) return undefined;
+      const body = (await res.json()) as { locations?: Array<{ name: string }> };
+      return { locations: String(body.locations?.length ?? 0) };
+    } catch {
+      return undefined;
+    }
+  },
+});

package/src/providers/index.ts

@@ -1,5 +1,5 @@
-import type { Provider } from "./_base.ts";
 import { ProviderNotFoundError } from "../errors.ts";
+import type { Provider } from "./_base.ts";
 
 /**
  * Registry of curated providers. Entries are added in Waves 2–3 as each
@@ -44,6 +44,18 @@ const registry: Record<string, () => Promise<Provider>> = {
   postmark: async () => (await import("./postmark.ts")).default,
   clerk: async () => (await import("./clerk.ts")).default,
   aws: async () => (await import("./aws.ts")).default,
+
+  // Wave 4 — key-only adapters (coming-soon catalog entries shipped as adapters).
+  auth0: async () => (await import("./auth0.ts")).default,
+  datadog: async () => (await import("./datadog.ts")).default,
+  digitalocean: async () => (await import("./digitalocean.ts")).default,
+  gcp: async () => (await import("./gcp.ts")).default,
+  grafana: async () => (await import("./grafana.ts")).default,
+  hetzner: async () => (await import("./hetzner.ts")).default,
+  launchdarkly: async () => (await import("./launchdarkly.ts")).default,
+  mixpanel: async () => (await import("./mixpanel.ts")).default,
+  plausible: async () => (await import("./plausible.ts")).default,
+  workos: async () => (await import("./workos.ts")).default,
 };
 
 export const providers = registry;

package/src/providers/launchdarkly.ts

@@ -0,0 +1,33 @@
+import { makeApiKeyProvider } from "./_api-key.ts";
+import { verifyFetch } from "./_helpers.ts";
+
+export default makeApiKeyProvider({
+  name: "launchdarkly",
+  displayName: "LaunchDarkly",
+  category: "featureflags",
+  docs: "https://apidocs.launchdarkly.com/",
+  secretName: "LAUNCHDARKLY_API_TOKEN",
+  howTo:
+    "Create an API access token at LaunchDarkly → Account settings → Authorization. You will also need your SDK key from LaunchDarkly → Environments.",
+  dashboard: "https://app.launchdarkly.com",
+  async verify(key) {
+    try {
+      // GET /api/v2/caller-identity is a lightweight endpoint that returns
+      // metadata about the token without requiring any specific permission scope.
+      const res = await verifyFetch("https://app.launchdarkly.com/api/v2/caller-identity", {
+        headers: {
+          Authorization: key,
+          Accept: "application/json",
+        },
+      });
+      if (!res.ok) return undefined;
+      const body = (await res.json()) as { accountId?: string; tokenType?: string };
+      return {
+        accountId: body.accountId ?? "",
+        tokenType: body.tokenType ?? "api",
+      };
+    } catch {
+      return undefined;
+    }
+  },
+});

package/src/providers/mixpanel.ts

@@ -0,0 +1,37 @@
+import { makeApiKeyProvider } from "./_api-key.ts";
+import { verifyFetch } from "./_helpers.ts";
+
+export default makeApiKeyProvider({
+  name: "mixpanel",
+  displayName: "Mixpanel",
+  category: "analytics",
+  docs: "https://developer.mixpanel.com/reference/overview",
+  secretName: "MIXPANEL_PROJECT_TOKEN",
+  howTo:
+    "Find your project token in Mixpanel → Settings → Project Settings. The API secret is on the same page.",
+  dashboard: "https://mixpanel.com",
+  async verify(key) {
+    // Mixpanel's Ingestion API accepts the project token directly. We send a
+    // no-op import request to confirm the token is valid without writing data.
+    // POST /import with an empty events array returns 200 on a valid token.
+    try {
+      const res = await verifyFetch("https://api.mixpanel.com/import?strict=1", {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Accept: "application/json",
+          Authorization: `Basic ${Buffer.from(`${key}:`).toString("base64")}`,
+        },
+        body: JSON.stringify([]),
+      });
+      // 200 = valid token (empty import is fine), 401/403 = invalid
+      if (res.status === 200 || res.status === 400) {
+        // 400 means "no events" which still confirms the token is valid
+        return { project_token: `${key.slice(0, 6)}…` };
+      }
+      return undefined;
+    } catch {
+      return undefined;
+    }
+  },
+});

package/src/providers/neon.ts

@@ -1,8 +1,6 @@
 import type { ServiceEntry } from "../config.ts";
 import { StackError } from "../errors.ts";
-import { addSecret } from "../phantom.ts";
 import { fetchWithRetry } from "../http.ts";
-import { readLine, tryRevealSecret } from "./_helpers.ts";
 import type {
   AuthHandle,
   HealthStatus,
@@ -12,6 +10,8 @@ import type {
   ProvisionOpts,
   Resource,
 } from "./_base.ts";
+import { acceptVerifiedExisting, storeProviderSecret } from "./_credential-stage.ts";
+import { promptSecret, tryRevealSecret } from "./_helpers.ts";
 
 /**
  * Neon — serverless Postgres. v1 uses a Neon API key (users create one at
@@ -33,20 +33,24 @@ const neon: Provider = {
   docs: "https://neon.tech/docs/reference/api-reference",
 
   async login(ctx: ProviderContext): Promise<AuthHandle> {
-    const cached = await tryRevealSecret(TOKEN_SECRET);
+    const cached = await tryRevealSecret(TOKEN_SECRET, ctx);
     if (cached) {
       const identity = await fetchIdentity(cached);
-      if (identity) return { token: cached, identity };
+      if (identity) {
+        acceptVerifiedExisting(ctx, TOKEN_SECRET, cached);
+        return { token: cached, identity };
+      }
       ctx.log({ level: "warn", msg: "Cached Neon key invalid; re-entering." });
     }
-    if (!ctx.interactive) throw new StackError("NEON_AUTH_REQUIRED", "No valid Neon API key in vault.");
-    process.stderr.write(
-      "\n  Create a Neon API key at https://console.neon.tech/app/settings/api-keys\n  Paste it here: ",
-    );
-    const token = (await readLine()).trim();
+    if (!ctx.interactive)
+      throw new StackError("NEON_AUTH_REQUIRED", "No valid Neon API key in vault.");
+    const token = await promptSecret(ctx, {
+      message: "Paste your Neon API key",
+      howTo: "Create a Neon API key at https://console.neon.tech/app/settings/api-keys",
+    });
     const identity = await fetchIdentity(token);
     if (!identity) throw new StackError("NEON_AUTH_INVALID", "Neon rejected that API key.");
-    await addSecret(TOKEN_SECRET, token);
+    await storeProviderSecret(ctx, TOKEN_SECRET, token);
     return { token, identity };
   },
 
@@ -54,7 +58,10 @@ const neon: Provider = {
     if (opts.existingResourceId) {
       const project = await fetchProject(auth.token, opts.existingResourceId);
       if (!project)
-        throw new StackError("NEON_PROJECT_NOT_FOUND", `No Neon project ${opts.existingResourceId}.`);
+        throw new StackError(
+          "NEON_PROJECT_NOT_FOUND",
+          `No Neon project ${opts.existingResourceId}.`,
+        );
       return toResource(project);
     }
     const name = `stack-${Date.now().toString(36)}`;
@@ -69,19 +76,16 @@ const neon: Provider = {
         "NEON_CREATE_FAILED",
         `Neon project creation failed (${res.status}): ${await res.text()}`,
       );
-    const body = (await res.json()) as { project: NeonProject; connection_uris?: Array<{ connection_uri: string }> };
-    // Stash the fresh connection URI keyed by project id so it isn't confused
-    // with another project's DATABASE_URL. Also write the canonical slot (the
-    // current project's materialize call will overwrite it).
-    if (body.connection_uris?.[0]?.connection_uri) {
-      const uri = body.connection_uris[0].connection_uri;
-      await addSecret(`NEON_DATABASE_URL_${body.project.id}`, uri);
-      await addSecret("DATABASE_URL", uri);
-    }
+    const body = (await res.json()) as {
+      project: NeonProject;
+      connection_uris?: Array<{ connection_uri: string }>;
+    };
+    // Return the created resource before any vault write. materialize() obtains
+    // its fresh URI from the API; the pipeline owns persistence and rollback.
     return toResource(body.project);
   },
 
-  async materialize(_ctx, resource, auth): Promise<Materialized> {
+  async materialize(ctx, resource, auth): Promise<Materialized> {
     // Always fetch the connection URI from the API — the vault's DATABASE_URL
     // is a generic key that may belong to another project or another provider.
     // Don't trust it as a cache here.
@@ -100,8 +104,8 @@ const neon: Provider = {
     };
   },
 
-  async healthcheck(_ctx, entry: ServiceEntry): Promise<HealthStatus> {
-    const token = await tryRevealSecret(TOKEN_SECRET);
+  async healthcheck(ctx, entry: ServiceEntry): Promise<HealthStatus> {
+    const token = await tryRevealSecret(TOKEN_SECRET, ctx);
     if (!token) return { kind: "error", detail: `${TOKEN_SECRET} missing from vault` };
     if (!entry.resource_id) return { kind: "warn", detail: "no resource_id" };
     const start = Date.now();
@@ -115,6 +119,28 @@ const neon: Provider = {
       ? `https://console.neon.tech/app/projects/${entry.resource_id}`
       : "https://console.neon.tech";
   },
+
+  async deprovision(_ctx: ProviderContext, auth: AuthHandle, resourceId: string): Promise<void> {
+    let res: Response;
+    try {
+      res = await fetch(`${API}/projects/${resourceId}`, {
+        method: "DELETE",
+        headers: authHeaders(auth.token),
+      });
+    } catch {
+      // Transport details can contain credentials; absence is unconfirmed.
+      throw new StackError(
+        "NEON_DELETE_UNCONFIRMED",
+        "Neon resource deletion could not be confirmed.",
+      );
+    }
+    if (res.status === 404 || res.ok) return;
+    // Keep the bounded status, never the remote response body or secret values.
+    throw new StackError(
+      "NEON_DELETE_FAILED",
+      `Neon resource deletion failed (HTTP ${res.status}).`,
+    );
+  },
 };
 
 export default neon;
@@ -125,7 +151,7 @@ interface NeonProject {
   region_id: string;
 }
 
-function authHeaders(token: string): HeadersInit {
+function authHeaders(token: string): NonNullable<RequestInit["headers"]> {
   return {
     Authorization: `Bearer ${token}`,
     "content-type": "application/json",
@@ -171,5 +197,3 @@ async function fetchConnectionUri(token: string, projectId: string): Promise<str
 function toResource(project: NeonProject): Resource {
   return { id: project.id, displayName: project.name, region: project.region_id };
 }
-
-

package/src/providers/openai.ts

@@ -1,3 +1,4 @@
+import { openaiBaseUrl } from "../base-urls.ts";
 import { makeApiKeyProvider } from "./_api-key.ts";
 import { verifyFetch } from "./_helpers.ts";
 
@@ -11,7 +12,7 @@ export default makeApiKeyProvider({
   dashboard: "https://platform.openai.com",
   async verify(key) {
     try {
-      const res = await verifyFetch("https://api.openai.com/v1/models", {
+      const res = await verifyFetch(`${openaiBaseUrl()}/models`, {
         headers: { Authorization: `Bearer ${key}` },
       });
       if (!res.ok) return undefined;