@ashlr/stack-core 0.1.1 → 0.2.2

package/src/providers/plausible.ts

@@ -0,0 +1,26 @@
+import { makeApiKeyProvider } from "./_api-key.ts";
+import { verifyFetch } from "./_helpers.ts";
+
+export default makeApiKeyProvider({
+  name: "plausible",
+  displayName: "Plausible",
+  category: "analytics",
+  docs: "https://plausible.io/docs/stats-api",
+  secretName: "PLAUSIBLE_API_KEY",
+  howTo:
+    "Generate an API key at https://plausible.io/settings and note your site ID (the domain you track).",
+  dashboard: "https://plausible.io",
+  async verify(key) {
+    try {
+      // /api/v1/sites lists all sites — read-only, confirms key validity.
+      const res = await verifyFetch("https://plausible.io/api/v1/sites", {
+        headers: { Authorization: `Bearer ${key}` },
+      });
+      if (!res.ok) return undefined;
+      const body = (await res.json()) as { sites?: Array<{ domain: string }> };
+      return { sites: String(body.sites?.length ?? 0) };
+    } catch {
+      return undefined;
+    }
+  },
+});

package/src/providers/sentry.ts

@@ -1,8 +1,6 @@
 import type { ServiceEntry } from "../config.ts";
 import { StackError } from "../errors.ts";
-import { addSecret } from "../phantom.ts";
 import { fetchWithRetry } from "../http.ts";
-import { readLine, tryRevealSecret } from "./_helpers.ts";
 import type {
   AuthHandle,
   HealthStatus,
@@ -12,6 +10,8 @@ import type {
   ProvisionOpts,
   Resource,
 } from "./_base.ts";
+import { acceptVerifiedExisting, storeProviderSecret } from "./_credential-stage.ts";
+import { promptSecret, tryRevealSecret } from "./_helpers.ts";
 
 /**
  * Sentry — error tracking. v1 uses an Auth Token (users create one at
@@ -33,20 +33,24 @@ const sentry: Provider = {
   docs: "https://docs.sentry.io/api/",
 
   async login(ctx: ProviderContext): Promise<AuthHandle> {
-    const cached = await tryRevealSecret(TOKEN_SECRET);
+    const cached = await tryRevealSecret(TOKEN_SECRET, ctx);
     if (cached) {
       const identity = await fetchIdentity(cached);
-      if (identity) return { token: cached, identity };
+      if (identity) {
+        acceptVerifiedExisting(ctx, TOKEN_SECRET, cached);
+        return { token: cached, identity };
+      }
       ctx.log({ level: "warn", msg: "Cached Sentry token invalid." });
     }
     if (!ctx.interactive) throw new StackError("SENTRY_AUTH_REQUIRED", "No valid Sentry token.");
-    process.stderr.write(
-      "\n  Create a Sentry Auth Token at https://sentry.io/settings/account/api/auth-tokens/\n  Required scopes: project:write, org:read\n  Paste it here: ",
-    );
-    const token = (await readLine()).trim();
+    const token = await promptSecret(ctx, {
+      message: "Paste your Sentry Auth Token",
+      howTo:
+        "Create a Sentry Auth Token at https://sentry.io/settings/account/api/auth-tokens/ (scopes: project:write, org:read)",
+    });
     const identity = await fetchIdentity(token);
     if (!identity) throw new StackError("SENTRY_AUTH_INVALID", "Sentry rejected that token.");
-    await addSecret(TOKEN_SECRET, token);
+    await storeProviderSecret(ctx, TOKEN_SECRET, token);
     return { token, identity };
   },
 
@@ -79,7 +83,7 @@ const sentry: Provider = {
     return { id: `${orgSlug}/${project.slug}`, displayName: project.name };
   },
 
-  async materialize(_ctx, resource, auth): Promise<Materialized> {
+  async materialize(ctx, resource, auth): Promise<Materialized> {
     const [orgSlug, projectSlug] = resource.id.split("/");
     const dsn = await fetchDsn(auth.token, orgSlug, projectSlug);
     const secrets: Record<string, string> = { SENTRY_AUTH_TOKEN: auth.token };
@@ -102,8 +106,8 @@ const sentry: Provider = {
     };
   },
 
-  async healthcheck(_ctx, entry: ServiceEntry): Promise<HealthStatus> {
-    const token = await tryRevealSecret(TOKEN_SECRET);
+  async healthcheck(ctx, entry: ServiceEntry): Promise<HealthStatus> {
+    const token = await tryRevealSecret(TOKEN_SECRET, ctx);
     if (!token) return { kind: "error", detail: `${TOKEN_SECRET} missing from vault` };
     if (!entry.resource_id) return { kind: "warn", detail: "no resource_id" };
     const [orgSlug, projectSlug] = entry.resource_id.split("/");
@@ -114,9 +118,7 @@ const sentry: Provider = {
       headers: { Authorization: `Bearer ${token}` },
     });
     const latencyMs = Date.now() - start;
-    return res.ok
-      ? { kind: "ok", latencyMs }
-      : { kind: "error", detail: `HTTP ${res.status}` };
+    return res.ok ? { kind: "ok", latencyMs } : { kind: "error", detail: `HTTP ${res.status}` };
   },
 
   dashboardUrl(entry: ServiceEntry): string {
@@ -179,5 +181,3 @@ async function fetchDsn(
   const keys = (await res.json()) as Array<{ dsn?: { public?: string } }>;
   return keys[0]?.dsn?.public;
 }
-
-

package/src/providers/stripe.ts

@@ -23,8 +23,7 @@ export default makeApiKeyProvider({
       if (!res.ok) return undefined;
       const body = (await res.json()) as Record<string, unknown>;
       const out: Record<string, string> = {};
-      for (const [k, v] of Object.entries(body))
-        if (typeof v === "string") out[k] = v;
+      for (const [k, v] of Object.entries(body)) if (typeof v === "string") out[k] = v;
       return out;
     } catch {
       return undefined;

package/src/providers/supabase.ts

@@ -1,19 +1,24 @@
-import {
-  type AuthHandle,
-  type HealthStatus,
-  type Materialized,
-  type Provider,
-  type ProviderContext,
-  type ProvisionOpts,
-  type Resource,
-} from "./_base.ts";
 import type { ServiceEntry } from "../config.ts";
+import { resolveOAuthClientId } from "../env.ts";
 import { StackError } from "../errors.ts";
-import { addSecret, exec as phantomExec } from "../phantom.ts";
-import { readLine, tryRevealSecret } from "./_helpers.ts";
 import { fetchWithRetry } from "../http.ts";
 import { runPkceFlow } from "../oauth.ts";
-import { resolveOAuthClientId } from "../env.ts";
+import { exec as phantomExec } from "../phantom.ts";
+import type {
+  AuthHandle,
+  HealthStatus,
+  Materialized,
+  Provider,
+  ProviderContext,
+  ProvisionOpts,
+  Resource,
+} from "./_base.ts";
+import {
+  acceptVerifiedExisting,
+  carryResourceCredential,
+  storeProviderSecret,
+} from "./_credential-stage.ts";
+import { promptSecret, tryRevealSecret } from "./_helpers.ts";
 
 /**
  * Supabase — the Wave 2 pilot provider. Proves the full loop:
@@ -37,11 +42,15 @@ const supabase: Provider = {
     const clientId = resolveOAuthClientId("supabase", process.env.SUPABASE_STACK_CLIENT_ID);
 
     // Path A — cached PAT from a previous login
-    const cached = await tryRevealSecret(STACK_PAT_SECRET);
+    const cached = await tryRevealSecret(STACK_PAT_SECRET, ctx);
     if (cached) {
       const identity = await fetchIdentity(cached);
       if (identity) {
-        ctx.log({ level: "info", msg: `Reusing cached Supabase token for ${identity.email ?? identity.id}` });
+        acceptVerifiedExisting(ctx, STACK_PAT_SECRET, cached);
+        ctx.log({
+          level: "info",
+          msg: `Reusing cached Supabase token for ${identity.email ?? identity.id}`,
+        });
         return { token: cached, identity };
       }
       ctx.log({ level: "warn", msg: "Cached Supabase token invalid; re-authenticating." });
@@ -56,8 +65,10 @@ const supabase: Provider = {
         tokenUrl: `${API}/v1/oauth/token`,
       });
       const token = tokenResponse.access_token;
-      await addSecret(STACK_PAT_SECRET, token);
       const identity = await fetchIdentity(token);
+      if (!identity)
+        throw new StackError("SUPABASE_AUTH_INVALID", "Supabase rejected that access token.");
+      await storeProviderSecret(ctx, STACK_PAT_SECRET, token);
       return {
         token,
         identity,
@@ -75,24 +86,21 @@ const supabase: Provider = {
       );
     }
 
-    // Avoid a hard dependency on @clack/prompts in the core package — read from stdin.
-    process.stderr.write(
-      "\n  Create a Personal Access Token at https://supabase.com/dashboard/account/tokens\n  Paste it here: ",
-    );
-    const token = (await readLine()).trim();
+    // The host (CLI) owns the prompt UI so it can pause its spinner; core stays
+    // free of a hard @clack dependency.
+    const token = await promptSecret(ctx, {
+      message: "Paste your Supabase access token",
+      howTo: "Create a Personal Access Token at https://supabase.com/dashboard/account/tokens",
+    });
     if (!token) throw new StackError("SUPABASE_AUTH_REQUIRED", "No token provided.");
     const identity = await fetchIdentity(token);
     if (!identity)
       throw new StackError("SUPABASE_AUTH_INVALID", "Supabase rejected that access token.");
-    await addSecret(STACK_PAT_SECRET, token);
+    await storeProviderSecret(ctx, STACK_PAT_SECRET, token);
     return { token, identity };
   },
 
-  async provision(
-    ctx: ProviderContext,
-    auth: AuthHandle,
-    opts: ProvisionOpts,
-  ): Promise<Resource> {
+  async provision(ctx: ProviderContext, auth: AuthHandle, opts: ProvisionOpts): Promise<Resource> {
     if (opts.existingResourceId) {
       const project = await fetchProject(auth.token, opts.existingResourceId);
       if (!project)
@@ -139,13 +147,13 @@ const supabase: Provider = {
       );
     }
     const project = (await res.json()) as SupabaseProject;
-    // Stash the DB password as a secret too — it's otherwise unrecoverable.
-    await addSecret(`SUPABASE_DB_PASSWORD_${project.id}`, dbPass);
-    return toResource(project);
+    const resource = toResource(project);
+    await carryResourceCredential(ctx, resource, `SUPABASE_DB_PASSWORD_${project.id}`, dbPass);
+    return resource;
   },
 
   async materialize(
-    _ctx: ProviderContext,
+    ctx: ProviderContext,
     resource: Resource,
     auth: AuthHandle,
   ): Promise<Materialized> {
@@ -178,17 +186,16 @@ const supabase: Provider = {
     };
   },
 
-  async healthcheck(_ctx: ProviderContext, entry: ServiceEntry): Promise<HealthStatus> {
+  async healthcheck(ctx: ProviderContext, entry: ServiceEntry): Promise<HealthStatus> {
     if (!entry.resource_id) return { kind: "error", detail: "missing resource_id" };
-    const anon = await tryRevealSecret("SUPABASE_ANON_KEY");
+    const anon = await tryRevealSecret("SUPABASE_ANON_KEY", ctx);
     if (!anon) return { kind: "error", detail: "SUPABASE_ANON_KEY missing from vault" };
     const start = Date.now();
     try {
       // GET against the REST root. Safe to retry on transient 5xx / 429.
-      const res = await fetchWithRetry(
-        `https://${entry.resource_id}.supabase.co/rest/v1/`,
-        { headers: { apikey: anon, Authorization: `Bearer ${anon}` } },
-      );
+      const res = await fetchWithRetry(`https://${entry.resource_id}.supabase.co/rest/v1/`, {
+        headers: { apikey: anon, Authorization: `Bearer ${anon}` },
+      });
       const latencyMs = Date.now() - start;
       if (res.ok) return { kind: "ok", latencyMs };
       return { kind: "warn", detail: `HTTP ${res.status}` };
@@ -200,6 +207,28 @@ const supabase: Provider = {
   dashboardUrl(entry: ServiceEntry): string {
     return entry.resource_id ? dashboardUrl(entry.resource_id) : "https://supabase.com/dashboard";
   },
+
+  async deprovision(_ctx: ProviderContext, auth: AuthHandle, resourceId: string): Promise<void> {
+    let res: Response;
+    try {
+      res = await fetch(`${API}/v1/projects/${resourceId}`, {
+        method: "DELETE",
+        headers: authHeaders(auth.token),
+      });
+    } catch {
+      throw new StackError(
+        "SUPABASE_DELETE_UNCONFIRMED",
+        "Supabase resource deletion could not be confirmed.",
+      );
+    }
+    // Admit only documented completion statuses; other 2xx/404 are unconfirmed.
+    // https://supabase.com/docs/reference/api/v1-delete-a-project
+    if (res.status === 200) return;
+    throw new StackError(
+      "SUPABASE_DELETE_FAILED",
+      `Supabase resource deletion failed (HTTP ${res.status}).`,
+    );
+  },
 };
 
 export default supabase;
@@ -227,7 +256,7 @@ interface SupabaseApiKey {
 
 type SupabaseIdentity = Record<string, string>;
 
-function authHeaders(token: string): HeadersInit {
+function authHeaders(token: string): NonNullable<RequestInit["headers"]> {
   return {
     Authorization: `Bearer ${token}`,
     "content-type": "application/json",

package/src/providers/turso.ts

@@ -1,6 +1,5 @@
 import type { ServiceEntry } from "../config.ts";
 import { StackError } from "../errors.ts";
-import { addSecret, revealSecret } from "../phantom.ts";
 import { fetchWithRetry } from "../http.ts";
 import type {
   AuthHandle,
@@ -11,6 +10,8 @@ import type {
   ProvisionOpts,
   Resource,
 } from "./_base.ts";
+import { acceptVerifiedExisting, storeProviderSecret } from "./_credential-stage.ts";
+import { promptSecret, tryRevealSecret } from "./_helpers.ts";
 
 /**
  * Turso — LibSQL-backed edge database. v1 uses a user-created Platform API
@@ -31,26 +32,31 @@ const turso: Provider = {
   docs: "https://docs.turso.tech",
 
   async login(ctx: ProviderContext): Promise<AuthHandle> {
-    const cached = await tryRevealSecret(PLATFORM_TOKEN_SECRET);
+    const cached = await tryRevealSecret(PLATFORM_TOKEN_SECRET, ctx);
     if (cached) {
       const identity = await fetchIdentity(cached);
-      if (identity) return { token: cached, identity };
+      if (identity) {
+        acceptVerifiedExisting(ctx, PLATFORM_TOKEN_SECRET, cached);
+        return { token: cached, identity };
+      }
       ctx.log({ level: "warn", msg: "Cached Turso token invalid." });
     }
-    if (!ctx.interactive) throw new StackError("TURSO_AUTH_REQUIRED", "No valid Turso token in vault.");
-    process.stderr.write(
-      "\n  Create a Platform API token at https://app.turso.tech/settings/api-tokens\n  Paste it here: ",
-    );
-    const token = (await readLine()).trim();
+    if (!ctx.interactive)
+      throw new StackError("TURSO_AUTH_REQUIRED", "No valid Turso token in vault.");
+    const token = await promptSecret(ctx, {
+      message: "Paste your Turso Platform API token",
+      howTo: "Create a Platform API token at https://app.turso.tech/settings/api-tokens",
+    });
     const identity = await fetchIdentity(token);
     if (!identity) throw new StackError("TURSO_AUTH_INVALID", "Turso rejected that token.");
-    await addSecret(PLATFORM_TOKEN_SECRET, token);
+    await storeProviderSecret(ctx, PLATFORM_TOKEN_SECRET, token);
     return { token, identity };
   },
 
   async provision(ctx, auth, opts: ProvisionOpts): Promise<Resource> {
     const orgs = await fetchOrganizations(auth.token);
-    if (orgs.length === 0) throw new StackError("TURSO_NO_ORGS", "Turso returned no organizations.");
+    if (orgs.length === 0)
+      throw new StackError("TURSO_NO_ORGS", "Turso returned no organizations.");
     const orgSlug = (opts.hints?.orgSlug as string | undefined) ?? orgs[0].slug;
     if (opts.existingResourceId) {
       const [existingOrg, dbName] = opts.existingResourceId.split("/");
@@ -88,7 +94,7 @@ const turso: Provider = {
     };
   },
 
-  async materialize(_ctx, resource, auth): Promise<Materialized> {
+  async materialize(ctx, resource, auth): Promise<Materialized> {
     const [orgSlug, dbName] = resource.id.split("/");
     const dbToken = await mintDbToken(auth.token, orgSlug, dbName);
     const hostname =
@@ -104,8 +110,8 @@ const turso: Provider = {
     };
   },
 
-  async healthcheck(_ctx, entry: ServiceEntry): Promise<HealthStatus> {
-    const token = await tryRevealSecret(PLATFORM_TOKEN_SECRET);
+  async healthcheck(ctx, entry: ServiceEntry): Promise<HealthStatus> {
+    const token = await tryRevealSecret(PLATFORM_TOKEN_SECRET, ctx);
     if (!token) return { kind: "error", detail: `${PLATFORM_TOKEN_SECRET} missing` };
     if (!entry.resource_id) return { kind: "warn", detail: "no resource_id" };
     const [orgSlug, dbName] = entry.resource_id.split("/");
@@ -123,6 +129,36 @@ const turso: Provider = {
     const [orgSlug, dbName] = entry.resource_id.split("/");
     return `https://app.turso.tech/${orgSlug}/databases/${dbName}`;
   },
+
+  async deprovision(_ctx: ProviderContext, auth: AuthHandle, resourceId: string): Promise<void> {
+    // Retain the original org/db selector; extra segments remain a separate routing risk.
+    const [orgSlug, dbName] = resourceId.split("/");
+    if (!orgSlug || !dbName) {
+      throw new StackError(
+        "TURSO_DELETE_ID_INVALID",
+        "Turso resource deletion requires an organization and database.",
+      );
+    }
+    let res: Response;
+    try {
+      res = await fetch(`${API}/organizations/${orgSlug}/databases/${dbName}`, {
+        method: "DELETE",
+        headers: { Authorization: `Bearer ${auth.token}` },
+      });
+    } catch {
+      throw new StackError(
+        "TURSO_DELETE_UNCONFIRMED",
+        "Turso resource deletion could not be confirmed.",
+      );
+    }
+    // Admit documented HTTP200 completion or HTTP404 absence; other statuses remain unconfirmed.
+    // https://docs.turso.tech/api-reference/databases/delete
+    if (res.status === 200 || res.status === 404) return;
+    throw new StackError(
+      "TURSO_DELETE_FAILED",
+      `Turso resource deletion failed (HTTP ${res.status}).`,
+    );
+  },
 };
 
 export default turso;
@@ -170,28 +206,3 @@ async function mintDbToken(
   const body = (await res.json()) as { jwt: string };
   return body.jwt;
 }
-
-async function tryRevealSecret(key: string): Promise<string | undefined> {
-  try {
-    const v = await revealSecret(key);
-    return v.length > 0 ? v : undefined;
-  } catch {
-    return undefined;
-  }
-}
-
-async function readLine(): Promise<string> {
-  return new Promise((resolve) => {
-    let buf = "";
-    const onData = (chunk: Buffer) => {
-      buf += chunk.toString();
-      if (buf.includes("\n")) {
-        process.stdin.off("data", onData);
-        process.stdin.pause();
-        resolve(buf.split("\n")[0]);
-      }
-    };
-    process.stdin.resume();
-    process.stdin.on("data", onData);
-  });
-}

package/src/providers/vercel.ts

@@ -1,8 +1,6 @@
 import type { ServiceEntry } from "../config.ts";
 import { StackError } from "../errors.ts";
-import { addSecret } from "../phantom.ts";
 import { fetchWithRetry } from "../http.ts";
-import { readLine, tryRevealSecret } from "./_helpers.ts";
 import type {
   AuthHandle,
   HealthStatus,
@@ -12,6 +10,8 @@ import type {
   ProvisionOpts,
   Resource,
 } from "./_base.ts";
+import { acceptVerifiedExisting, storeProviderSecret } from "./_credential-stage.ts";
+import { promptSecret, tryRevealSecret } from "./_helpers.ts";
 
 /**
  * Vercel provider.
@@ -33,21 +33,24 @@ const vercel: Provider = {
   docs: "https://vercel.com/docs/rest-api",
 
   async login(ctx: ProviderContext): Promise<AuthHandle> {
-    const cached = await tryRevealSecret(TOKEN_SECRET);
+    const cached = await tryRevealSecret(TOKEN_SECRET, ctx);
     if (cached) {
       const identity = await fetchUser(cached);
-      if (identity) return { token: cached, identity };
+      if (identity) {
+        acceptVerifiedExisting(ctx, TOKEN_SECRET, cached);
+        return { token: cached, identity };
+      }
       ctx.log({ level: "warn", msg: "Cached Vercel token invalid; re-entering." });
     }
     if (!ctx.interactive)
       throw new StackError("VERCEL_AUTH_REQUIRED", "No valid Vercel token in vault.");
-    process.stderr.write(
-      "\n  Create a Vercel token at https://vercel.com/account/tokens\n  Paste it here: ",
-    );
-    const token = (await readLine()).trim();
+    const token = await promptSecret(ctx, {
+      message: "Paste your Vercel token",
+      howTo: "Create a Vercel token at https://vercel.com/account/tokens",
+    });
     const identity = await fetchUser(token);
     if (!identity) throw new StackError("VERCEL_AUTH_INVALID", "Vercel rejected that token.");
-    await addSecret(TOKEN_SECRET, token);
+    await storeProviderSecret(ctx, TOKEN_SECRET, token);
     return { token, identity };
   },
 
@@ -55,7 +58,10 @@ const vercel: Provider = {
     if (opts.existingResourceId) {
       const project = await fetchProject(auth.token, opts.existingResourceId);
       if (!project)
-        throw new StackError("VERCEL_PROJECT_NOT_FOUND", `No Vercel project ${opts.existingResourceId}.`);
+        throw new StackError(
+          "VERCEL_PROJECT_NOT_FOUND",
+          `No Vercel project ${opts.existingResourceId}.`,
+        );
       return { id: project.id, displayName: project.name };
     }
     const name = `stack-${Date.now().toString(36)}`;
@@ -75,7 +81,7 @@ const vercel: Provider = {
     return { id: project.id, displayName: project.name };
   },
 
-  async materialize(_ctx, resource, auth): Promise<Materialized> {
+  async materialize(ctx, resource, auth): Promise<Materialized> {
     return {
       secrets: { [TOKEN_SECRET]: auth.token },
       urls: {
@@ -84,8 +90,8 @@ const vercel: Provider = {
     };
   },
 
-  async healthcheck(_ctx, entry: ServiceEntry): Promise<HealthStatus> {
-    const token = await tryRevealSecret(TOKEN_SECRET);
+  async healthcheck(ctx, entry: ServiceEntry): Promise<HealthStatus> {
+    const token = await tryRevealSecret(TOKEN_SECRET, ctx);
     if (!token) return { kind: "error", detail: `${TOKEN_SECRET} missing from vault` };
     if (!entry.resource_id) return { kind: "warn", detail: "no resource_id" };
     const start = Date.now();
@@ -99,11 +105,33 @@ const vercel: Provider = {
       ? `https://vercel.com/dashboard/${entry.resource_id}`
       : "https://vercel.com/dashboard";
   },
+
+  async deprovision(_ctx: ProviderContext, auth: AuthHandle, resourceId: string): Promise<void> {
+    let res: Response;
+    try {
+      res = await fetch(`${API}/v9/projects/${resourceId}`, {
+        method: "DELETE",
+        headers: authHeaders(auth.token),
+      });
+    } catch {
+      throw new StackError(
+        "VERCEL_DELETE_UNCONFIRMED",
+        "Vercel resource deletion could not be confirmed.",
+      );
+    }
+    // Admit only documented completion statuses; other 2xx/404 are unconfirmed.
+    // https://vercel.com/docs/rest-api/projects/delete-a-project
+    if (res.status === 204) return;
+    throw new StackError(
+      "VERCEL_DELETE_FAILED",
+      `Vercel resource deletion failed (HTTP ${res.status}).`,
+    );
+  },
 };
 
 export default vercel;
 
-function authHeaders(token: string): HeadersInit {
+function authHeaders(token: string): NonNullable<RequestInit["headers"]> {
   return { Authorization: `Bearer ${token}`, "content-type": "application/json" };
 }
 
@@ -112,23 +140,25 @@ async function fetchUser(token: string): Promise<Record<string, string> | undefi
     // Idempotent GET — retry transient failures during login validation + healthcheck.
     const res = await fetchWithRetry(`${API}/v2/user`, { headers: authHeaders(token) });
     if (!res.ok) return undefined;
-    const body = (await res.json()) as { user?: { uid?: string; email?: string; username?: string } };
+    const body = (await res.json()) as {
+      user?: { uid?: string; email?: string; username?: string };
+    };
     if (!body.user) return undefined;
     const out: Record<string, string> = {};
-    for (const [k, v] of Object.entries(body.user))
-      if (typeof v === "string") out[k] = v;
+    for (const [k, v] of Object.entries(body.user)) if (typeof v === "string") out[k] = v;
     return out;
   } catch {
     return undefined;
   }
 }
 
-async function fetchProject(token: string, id: string): Promise<{ id: string; name: string } | undefined> {
+async function fetchProject(
+  token: string,
+  id: string,
+): Promise<{ id: string; name: string } | undefined> {
   // Idempotent GET — healthcheck reads this on every `stack status` call.
   const res = await fetchWithRetry(`${API}/v9/projects/${id}`, { headers: authHeaders(token) });
   if (res.status === 404) return undefined;
   if (!res.ok) return undefined;
   return (await res.json()) as { id: string; name: string };
 }
-
-

package/src/providers/workos.ts

@@ -0,0 +1,27 @@
+import { makeApiKeyProvider } from "./_api-key.ts";
+import { verifyFetch } from "./_helpers.ts";
+
+export default makeApiKeyProvider({
+  name: "workos",
+  displayName: "WorkOS",
+  category: "auth",
+  docs: "https://workos.com/docs/reference/api",
+  secretName: "WORKOS_API_KEY",
+  howTo: "Find your API key in the WorkOS dashboard → API Keys.",
+  dashboard: "https://dashboard.workos.com",
+  async verify(key) {
+    try {
+      const res = await verifyFetch("https://api.workos.com/organizations?limit=1", {
+        headers: {
+          Authorization: `Bearer ${key}`,
+          "Content-Type": "application/json",
+        },
+      });
+      if (!res.ok) return undefined;
+      const body = (await res.json()) as { data?: unknown[] };
+      return { organizations: String(body.data?.length ?? 0) };
+    } catch {
+      return undefined;
+    }
+  },
+});

package/src/registry.ts

@@ -2,12 +2,7 @@ import { existsSync, mkdirSync } from "node:fs";
 import { readFile, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { basename, resolve } from "node:path";
-import {
-  CONFIG_FILENAME,
-  hasConfig,
-  readConfig,
-  resolveConfigPath,
-} from "./config.ts";
+import { CONFIG_FILENAME, hasConfig, readConfig, resolveConfigPath } from "./config.ts";
 
 /**
  * Machine-global registry of every Stack-enabled project this user has
@@ -82,13 +77,14 @@ export async function registerProject(cwd: string): Promise<RegistryEntry | unde
   return entry;
 }
 
-export async function unregisterProject(path: string): Promise<void> {
+/** Drop `path` from the registry. Returns false (and writes nothing) when it was not registered. */
+export async function unregisterProject(path: string): Promise<boolean> {
   const resolved = resolve(path);
   const file = await readRegistryRaw();
-  await writeRegistryRaw({
-    version: "1",
-    projects: file.projects.filter((p) => p.path !== resolved),
-  });
+  const kept = file.projects.filter((p) => p.path !== resolved);
+  if (kept.length === file.projects.length) return false;
+  await writeRegistryRaw({ version: "1", projects: kept });
+  return true;
 }
 
 export async function listProjects(opts: { prune?: boolean } = {}): Promise<RegistryEntry[]> {