@ashlr/stack-core 0.1.1 → 0.3.0

package/src/catalog.ts

@@ -23,13 +23,14 @@ export interface ProviderRef {
     | "Cloud"
     | "AI"
     | "Analytics"
+    | "Observability"
     | "Errors"
     | "Payments"
     | "Code"
     | "Tickets"
     | "Email"
     | "Auth"
-    | "Features";
+    | "FeatureFlags";
   authKind: CatalogAuthKind;
   /** Canonical .env names this provider writes into Phantom. */
   secrets: string[];
@@ -42,6 +43,13 @@ export interface ProviderRef {
     preview?: boolean;
     detail: string;
   };
+  /**
+   * When true, the adapter only validates and stores the key — no upstream
+   * resource is created or configured. Absence of this flag means the adapter
+   * performs real provisioning (project/database/repo creation, token minting,
+   * etc.). v0.2 will bring provisioning to key-only providers over time.
+   */
+  keyOnly?: boolean;
   /** Dashboard URL `stack open <name>` lands on. */
   dashboard: string;
   /** Upstream reference docs URL for when something goes wrong. */
@@ -50,6 +58,14 @@ export interface ProviderRef {
   howTo: string;
   /** Free-form note about v1 limitations or caveats. */
   notes?: string;
+  /**
+   * npm packages to install in the consuming project after `stack add <name>`
+   * succeeds — the SDK(s) you'd `import` from to actually use this provider.
+   * `stack add` prompts the user to install these with their detected package
+   * manager (bun / pnpm / npm / yarn). Leave empty for providers with no first-
+   * party SDK (e.g. shell-script-only providers or REST-only adapters).
+   */
+  sdkPackages?: string[];
 }
 
 /** Back-compat re-export for call sites that still use `AuthKind`. */
@@ -74,6 +90,7 @@ export const PROVIDERS_REF: ProviderRef[] = [
     howTo: "Browser OAuth (PKCE) via the Ashlr Stack app.",
     notes:
       "v1 provisions a project and fetches service keys. Database password is auto-generated and stored in Phantom.",
+    sdkPackages: ["@supabase/supabase-js"],
   },
   {
     name: "neon",
@@ -82,9 +99,16 @@ export const PROVIDERS_REF: ProviderRef[] = [
     authKind: "pat",
     secrets: ["NEON_API_KEY", "DATABASE_URL"],
     blurb: "Serverless Postgres. Creates a project and pools the connection string.",
+    mcp: {
+      name: "neon",
+      preview: true,
+      detail:
+        "@neondatabase/mcp-server-neon with NEON_API_KEY piped from Phantom — branch, migrate, and query from the agent.",
+    },
     dashboard: "https://console.neon.tech",
     docs: "https://neon.tech/docs/reference/api-reference",
     howTo: "Paste a personal API key from https://console.neon.tech/app/settings/api-keys.",
+    sdkPackages: ["@neondatabase/serverless"],
   },
   {
     name: "turso",
@@ -96,6 +120,7 @@ export const PROVIDERS_REF: ProviderRef[] = [
     dashboard: "https://app.turso.tech",
     docs: "https://docs.turso.tech",
     howTo: "Paste a platform token from https://app.turso.tech/account/api-tokens.",
+    sdkPackages: ["@libsql/client"],
   },
   {
     name: "convex",
@@ -104,9 +129,11 @@ export const PROVIDERS_REF: ProviderRef[] = [
     authKind: "api_key",
     secrets: ["CONVEX_DEPLOY_KEY"],
     blurb: "Reactive backend-as-a-service. Deploy key stored in Phantom.",
+    keyOnly: true,
     dashboard: "https://dashboard.convex.dev",
     docs: "https://docs.convex.dev",
     howTo: "Create a deploy key in the Convex dashboard and paste it.",
+    sdkPackages: ["convex"],
   },
   {
     name: "upstash",
@@ -115,9 +142,11 @@ export const PROVIDERS_REF: ProviderRef[] = [
     authKind: "api_key",
     secrets: ["UPSTASH_MANAGEMENT_TOKEN"],
     blurb: "Serverless Redis + Kafka. Management token stored in Phantom.",
+    keyOnly: true,
     dashboard: "https://console.upstash.com",
     docs: "https://upstash.com/docs/devops/developer-api",
     howTo: "Generate a management token from the Upstash console.",
+    sdkPackages: ["@upstash/redis"],
   },
   {
     name: "firebase",
@@ -126,13 +155,28 @@ export const PROVIDERS_REF: ProviderRef[] = [
     authKind: "api_key",
     secrets: ["FIREBASE_SERVICE_ACCOUNT_JSON"],
     blurb: "Realtime DB + Auth. Service-account JSON stored verbatim in Phantom.",
+    keyOnly: true,
     dashboard: "https://console.firebase.google.com",
     docs: "https://firebase.google.com/docs/admin/setup",
     howTo:
       "Paste the full service-account JSON from Firebase → Project settings → Service accounts.",
+    sdkPackages: ["firebase"],
   },
 
   // ── Deploy ────────────────────────────────────────────────────────────────
+  {
+    name: "modal",
+    displayName: "Modal",
+    category: "Deploy",
+    authKind: "api_key",
+    secrets: ["MODAL_TOKEN"],
+    blurb: "Serverless compute for AI + data. Token stored in Phantom.",
+    keyOnly: true,
+    dashboard: "https://modal.com",
+    docs: "https://modal.com/docs",
+    howTo: "Create a token in the Modal dashboard and paste it.",
+    sdkPackages: [],
+  },
   {
     name: "vercel",
     displayName: "Vercel",
@@ -140,9 +184,16 @@ export const PROVIDERS_REF: ProviderRef[] = [
     authKind: "pat",
     secrets: ["VERCEL_TOKEN"],
     blurb: "Frontend platform. Stores a scoped access token for deploys + env sync.",
+    mcp: {
+      name: "vercel",
+      preview: true,
+      detail:
+        "Vercel MCP server with VERCEL_TOKEN piped from Phantom — list deployments, tail logs, sync env.",
+    },
     dashboard: "https://vercel.com/dashboard",
     docs: "https://vercel.com/docs/rest-api",
     howTo: "Paste a personal access token from https://vercel.com/account/tokens.",
+    sdkPackages: [],
   },
   {
     name: "railway",
@@ -151,9 +202,11 @@ export const PROVIDERS_REF: ProviderRef[] = [
     authKind: "api_key",
     secrets: ["RAILWAY_TOKEN"],
     blurb: "Infra from a repo. Project-level token stored in Phantom.",
+    keyOnly: true,
     dashboard: "https://railway.app/dashboard",
     docs: "https://docs.railway.app/reference/public-api",
     howTo: "Paste an API token from https://railway.app/account/tokens.",
+    sdkPackages: [],
   },
   {
     name: "fly",
@@ -162,9 +215,11 @@ export const PROVIDERS_REF: ProviderRef[] = [
     authKind: "api_key",
     secrets: ["FLY_API_TOKEN"],
     blurb: "VMs at the edge. Machines API token stored in Phantom.",
+    keyOnly: true,
     dashboard: "https://fly.io/dashboard",
     docs: "https://fly.io/docs/machines/api",
     howTo: "Paste an API token from https://fly.io/user/personal_access_tokens.",
+    sdkPackages: [],
   },
   {
     name: "cloudflare",
@@ -173,9 +228,16 @@ export const PROVIDERS_REF: ProviderRef[] = [
     authKind: "pat",
     secrets: ["CLOUDFLARE_API_TOKEN", "CLOUDFLARE_ACCOUNT_ID"],
     blurb: "Workers, R2, D1. Account id inferred from the token's scope.",
+    mcp: {
+      name: "cloudflare",
+      preview: true,
+      detail:
+        "Cloudflare MCP (Workers Bindings + R2 + D1) with CLOUDFLARE_API_TOKEN piped from Phantom.",
+    },
     dashboard: "https://dash.cloudflare.com",
     docs: "https://developers.cloudflare.com/api",
     howTo: "Create a scoped API token at https://dash.cloudflare.com/profile/api-tokens.",
+    sdkPackages: [],
   },
   {
     name: "render",
@@ -184,9 +246,11 @@ export const PROVIDERS_REF: ProviderRef[] = [
     authKind: "api_key",
     secrets: ["RENDER_API_KEY"],
     blurb: "Zero-config hosting. API key stored in Phantom.",
+    keyOnly: true,
     dashboard: "https://dashboard.render.com",
     docs: "https://api-docs.render.com",
     howTo: "Generate a key at https://dashboard.render.com/u/settings#api-keys.",
+    sdkPackages: [],
   },
 
   // ── Cloud ─────────────────────────────────────────────────────────────────
@@ -197,10 +261,12 @@ export const PROVIDERS_REF: ProviderRef[] = [
     authKind: "api_key",
     secrets: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_REGION"],
     blurb: "S3, Lambda, RDS. IAM access keys stored in Phantom.",
+    keyOnly: true,
     dashboard: "https://console.aws.amazon.com",
     docs: "https://docs.aws.amazon.com/iam/",
     howTo: "Create an IAM access key pair in the AWS console and paste both halves.",
     notes: "v1 stores the keys only — no resource provisioning. Scope the IAM policy narrowly.",
+    sdkPackages: [],
   },
 
   // ── AI ────────────────────────────────────────────────────────────────────
@@ -211,9 +277,11 @@ export const PROVIDERS_REF: ProviderRef[] = [
     authKind: "api_key",
     secrets: ["OPENAI_API_KEY"],
     blurb: "GPT, Realtime, embeddings. Key verified against /v1/models on paste.",
+    keyOnly: true,
     dashboard: "https://platform.openai.com",
     docs: "https://platform.openai.com/docs/api-reference",
     howTo: "Paste a secret key from https://platform.openai.com/api-keys.",
+    sdkPackages: ["openai"],
   },
   {
     name: "anthropic",
@@ -222,9 +290,11 @@ export const PROVIDERS_REF: ProviderRef[] = [
     authKind: "api_key",
     secrets: ["ANTHROPIC_API_KEY"],
     blurb: "Claude models + MCP. Key verified against the Messages API on paste.",
+    keyOnly: true,
     dashboard: "https://console.anthropic.com",
     docs: "https://docs.anthropic.com/en/api",
     howTo: "Paste a secret key from https://console.anthropic.com/settings/keys.",
+    sdkPackages: ["@anthropic-ai/sdk"],
   },
   {
     name: "xai",
@@ -233,9 +303,11 @@ export const PROVIDERS_REF: ProviderRef[] = [
     authKind: "api_key",
     secrets: ["XAI_API_KEY"],
     blurb: "Grok + tool use. Key verified on paste.",
+    keyOnly: true,
     dashboard: "https://console.x.ai",
     docs: "https://docs.x.ai/api",
     howTo: "Paste a key from https://console.x.ai.",
+    sdkPackages: ["openai"],
   },
   {
     name: "deepseek",
@@ -244,9 +316,38 @@ export const PROVIDERS_REF: ProviderRef[] = [
     authKind: "api_key",
     secrets: ["DEEPSEEK_API_KEY"],
     blurb: "Open-weight models. Key verified on paste.",
+    keyOnly: true,
     dashboard: "https://platform.deepseek.com",
     docs: "https://api-docs.deepseek.com",
     howTo: "Paste a key from https://platform.deepseek.com/api_keys.",
+    sdkPackages: ["openai"],
+  },
+  {
+    name: "replicate",
+    displayName: "Replicate",
+    category: "AI",
+    authKind: "pat",
+    secrets: ["REPLICATE_API_TOKEN"],
+    blurb: "Open-source model inference with per-second billing. API token stored in Phantom.",
+    keyOnly: true,
+    dashboard: "https://replicate.com",
+    docs: "https://replicate.com/docs/reference/http",
+    howTo: "Create a token at https://replicate.com/account/api-tokens.",
+    sdkPackages: ["replicate"],
+  },
+  {
+    name: "braintrust",
+    displayName: "Braintrust",
+    category: "AI",
+    authKind: "api_key",
+    secrets: ["BRAINTRUST_API_KEY"],
+    blurb:
+      "LLM evals + observability + prompt playground. Verified against /v1/organization on paste.",
+    keyOnly: true,
+    dashboard: "https://www.braintrust.dev/app",
+    docs: "https://www.braintrust.dev/docs",
+    howTo: "Create a key at https://www.braintrust.dev/app/settings/api-keys.",
+    sdkPackages: ["braintrust"],
   },
 
   // ── Analytics ─────────────────────────────────────────────────────────────
@@ -257,6 +358,7 @@ export const PROVIDERS_REF: ProviderRef[] = [
     authKind: "api_key",
     secrets: ["POSTHOG_PERSONAL_API_KEY"],
     blurb: "Product analytics + flags. Personal API key stored in Phantom.",
+    keyOnly: true,
     mcp: {
       name: "posthog",
       detail:
@@ -265,6 +367,7 @@ export const PROVIDERS_REF: ProviderRef[] = [
     dashboard: "https://app.posthog.com",
     docs: "https://posthog.com/docs/api",
     howTo: "Create a personal API key at https://app.posthog.com/me/settings (scope: all).",
+    sdkPackages: ["posthog-node"],
   },
 
   // ── Errors ────────────────────────────────────────────────────────────────
@@ -274,7 +377,8 @@ export const PROVIDERS_REF: ProviderRef[] = [
     category: "Errors",
     authKind: "pat",
     secrets: ["SENTRY_AUTH_TOKEN", "SENTRY_DSN", "SENTRY_ORG", "SENTRY_PROJECT"],
-    blurb: "Error + performance tracking. Creates a project and fetches its DSN.",
+    blurb:
+      "Error + performance tracking. Attaches to an existing project and reads its DSN when available.",
     mcp: {
       name: "sentry",
       detail:
@@ -284,6 +388,7 @@ export const PROVIDERS_REF: ProviderRef[] = [
     docs: "https://docs.sentry.io/api/",
     howTo:
       "Paste an auth token from https://sentry.io/settings/account/api/auth-tokens/ (scopes: project:read, project:write).",
+    sdkPackages: ["@sentry/node"],
   },
 
   // ── Payments ──────────────────────────────────────────────────────────────
@@ -294,12 +399,20 @@ export const PROVIDERS_REF: ProviderRef[] = [
     authKind: "api_key",
     secrets: ["STRIPE_SECRET_KEY"],
     blurb: "Billing, subscriptions, tax. Restricted / test-mode secret key stored in Phantom.",
+    keyOnly: true,
+    mcp: {
+      name: "stripe",
+      preview: true,
+      detail:
+        "@stripe/mcp with STRIPE_SECRET_KEY piped from Phantom — create products, prices, and inspect events from the agent.",
+    },
     dashboard: "https://dashboard.stripe.com",
     docs: "https://docs.stripe.com/api",
     howTo:
       "Create a restricted key at https://dashboard.stripe.com/apikeys (use test mode for development).",
     notes:
       "v1 only stores the key. Full Stripe Connect / account linking lands when we register the Ashlr OAuth app.",
+    sdkPackages: ["stripe"],
   },
 
   // ── Code ──────────────────────────────────────────────────────────────────
@@ -318,6 +431,7 @@ export const PROVIDERS_REF: ProviderRef[] = [
     dashboard: "https://github.com",
     docs: "https://docs.github.com/en/rest",
     howTo: "Browser device-code flow — enter the code GitHub shows you, authorise, done.",
+    sdkPackages: ["octokit"],
   },
 
   // ── Tickets ───────────────────────────────────────────────────────────────
@@ -328,6 +442,7 @@ export const PROVIDERS_REF: ProviderRef[] = [
     authKind: "api_key",
     secrets: ["LINEAR_API_KEY"],
     blurb: "Issues, projects, cycles. Personal API key stored in Phantom.",
+    keyOnly: true,
     mcp: {
       name: "linear",
       detail: "mcp-linear with LINEAR_API_KEY piped from Phantom.",
@@ -335,6 +450,7 @@ export const PROVIDERS_REF: ProviderRef[] = [
     dashboard: "https://linear.app",
     docs: "https://developers.linear.app/docs",
     howTo: "Create a personal API key at https://linear.app/settings/api.",
+    sdkPackages: ["@linear/sdk"],
   },
 
   // ── Email ─────────────────────────────────────────────────────────────────
@@ -345,9 +461,11 @@ export const PROVIDERS_REF: ProviderRef[] = [
     authKind: "api_key",
     secrets: ["RESEND_API_KEY"],
     blurb: "Transactional + React Email. API key stored in Phantom.",
+    keyOnly: true,
     dashboard: "https://resend.com",
     docs: "https://resend.com/docs",
     howTo: "Paste an API key from https://resend.com/api-keys.",
+    sdkPackages: ["resend"],
   },
   {
     name: "sendgrid",
@@ -356,9 +474,11 @@ export const PROVIDERS_REF: ProviderRef[] = [
     authKind: "api_key",
     secrets: ["SENDGRID_API_KEY"],
     blurb: "High-volume transactional mail. API key verified against /v3/scopes on paste.",
+    keyOnly: true,
     dashboard: "https://app.sendgrid.com",
     docs: "https://docs.sendgrid.com/api-reference",
     howTo: "Paste an API key from https://app.sendgrid.com/settings/api_keys.",
+    sdkPackages: ["@sendgrid/mail"],
   },
   {
     name: "mailgun",
@@ -367,9 +487,11 @@ export const PROVIDERS_REF: ProviderRef[] = [
     authKind: "api_key",
     secrets: ["MAILGUN_API_KEY"],
     blurb: "API-first email + routing. Key verified against /v3/domains on paste (HTTP Basic).",
+    keyOnly: true,
     dashboard: "https://app.mailgun.com",
     docs: "https://documentation.mailgun.com/docs/mailgun/api-reference/",
     howTo: "Paste an API key from https://app.mailgun.com/settings/api_security.",
+    sdkPackages: ["mailgun.js", "form-data"],
   },
   {
     name: "postmark",
@@ -379,12 +501,147 @@ export const PROVIDERS_REF: ProviderRef[] = [
     secrets: ["POSTMARK_ACCOUNT_TOKEN"],
     blurb:
       "Deliverability-focused transactional. Account token verified against /servers on paste.",
+    keyOnly: true,
     dashboard: "https://account.postmarkapp.com",
     docs: "https://postmarkapp.com/developer/api/overview",
     howTo: "Paste an account token from https://account.postmarkapp.com/api_tokens.",
+    sdkPackages: ["postmark"],
+  },
+
+  // ── Analytics ─────────────────────────────────────────────────────────────
+  {
+    name: "mixpanel",
+    displayName: "Mixpanel",
+    category: "Analytics",
+    authKind: "api_key",
+    secrets: ["MIXPANEL_PROJECT_TOKEN", "MIXPANEL_API_SECRET"],
+    blurb: "Product analytics. Project token + optional API secret stored in Phantom.",
+    keyOnly: true,
+    dashboard: "https://mixpanel.com",
+    docs: "https://developer.mixpanel.com/reference/overview",
+    howTo: "Find your project token and API secret in Mixpanel → Settings → Project Settings.",
+    sdkPackages: ["mixpanel"],
+  },
+  {
+    name: "plausible",
+    displayName: "Plausible",
+    category: "Analytics",
+    authKind: "api_key",
+    secrets: ["PLAUSIBLE_API_KEY", "PLAUSIBLE_SITE_ID"],
+    blurb: "Privacy-friendly web analytics. API key verified against the stats API.",
+    keyOnly: true,
+    dashboard: "https://plausible.io",
+    docs: "https://plausible.io/docs/stats-api",
+    howTo: "Generate an API key at https://plausible.io/settings and note your site ID.",
+    sdkPackages: [],
+  },
+
+  // ── Observability ─────────────────────────────────────────────────────────
+  {
+    name: "datadog",
+    displayName: "Datadog",
+    category: "Observability",
+    authKind: "api_key",
+    secrets: ["DD_API_KEY"],
+    blurb:
+      "Metrics, traces, logs. Current adapter validates an API key via /api/v1/validate and stores that key only.",
+    keyOnly: true,
+    dashboard: "https://app.datadoghq.com",
+    docs: "https://docs.datadoghq.com/api/latest/",
+    howTo:
+      "Create an API key at https://app.datadoghq.com/organization-settings/api-keys. This adapter validates and stores that key only.",
+    sdkPackages: ["dd-trace"],
+  },
+  {
+    name: "grafana",
+    displayName: "Grafana",
+    category: "Observability",
+    authKind: "pat",
+    secrets: ["GRAFANA_API_KEY", "GRAFANA_URL"],
+    blurb: "Dashboards + alerting. Service-account token verified against your Grafana instance.",
+    keyOnly: true,
+    dashboard: "https://grafana.com",
+    docs: "https://grafana.com/docs/grafana/latest/developers/http_api/",
+    howTo:
+      "Create a service-account token in Grafana → Administration → Service accounts, and provide your Grafana base URL.",
+    sdkPackages: [],
+  },
+
+  // ── Cloud ─────────────────────────────────────────────────────────────────
+  {
+    name: "gcp",
+    displayName: "GCP",
+    category: "Cloud",
+    authKind: "api_key",
+    secrets: ["GCP_SERVICE_ACCOUNT_JSON", "GCP_PROJECT_ID"],
+    blurb: "Google Cloud Platform. Service-account JSON + project ID stored in Phantom.",
+    keyOnly: true,
+    dashboard: "https://console.cloud.google.com",
+    docs: "https://cloud.google.com/docs/authentication/getting-started",
+    howTo:
+      "Download a service-account JSON key from GCP → IAM & Admin → Service Accounts and paste the full JSON.",
+    notes:
+      "v1 validates JSON shape and project_id field only — live project endpoint verification requires an OAuth2 token exchange; deferred to v0.2.",
+    sdkPackages: [],
+  },
+  {
+    name: "digitalocean",
+    displayName: "DigitalOcean",
+    category: "Cloud",
+    authKind: "pat",
+    secrets: ["DIGITALOCEAN_TOKEN"],
+    blurb:
+      "Droplets, Kubernetes, managed databases. Personal access token verified via /v2/account.",
+    keyOnly: true,
+    dashboard: "https://cloud.digitalocean.com",
+    docs: "https://docs.digitalocean.com/reference/api/api-reference/",
+    howTo: "Create a personal access token at https://cloud.digitalocean.com/account/api/tokens.",
+    sdkPackages: [],
+  },
+  {
+    name: "hetzner",
+    displayName: "Hetzner",
+    category: "Cloud",
+    authKind: "api_key",
+    secrets: ["HETZNER_API_TOKEN"],
+    blurb: "Affordable European cloud servers. API token verified via /v1/locations.",
+    keyOnly: true,
+    dashboard: "https://console.hetzner.cloud",
+    docs: "https://docs.hetzner.cloud/",
+    howTo: "Create an API token in Hetzner Cloud Console → Project → Security → API Tokens.",
+    sdkPackages: [],
   },
 
   // ── Auth ──────────────────────────────────────────────────────────────────
+  {
+    name: "auth0",
+    displayName: "Auth0",
+    category: "Auth",
+    authKind: "api_key",
+    secrets: ["AUTH0_DOMAIN"],
+    blurb:
+      "Identity platform. Current adapter checks a domain's discovery endpoint and stores only the domain.",
+    keyOnly: true,
+    dashboard: "https://manage.auth0.com",
+    docs: "https://auth0.com/docs/api/management/v2",
+    howTo:
+      "Enter your Auth0 tenant domain, such as your-tenant.us.auth0.com. This adapter checks its discovery response and stores only that domain.",
+    notes: "Browser SDK: @auth0/auth0-spa-js. Server SDK: auth0 (bundled).",
+    sdkPackages: ["auth0"],
+  },
+  {
+    name: "workos",
+    displayName: "WorkOS",
+    category: "Auth",
+    authKind: "api_key",
+    secrets: ["WORKOS_API_KEY", "WORKOS_CLIENT_ID"],
+    blurb: "Enterprise SSO + Directory Sync. API key verified via GET /organizations.",
+    keyOnly: true,
+    dashboard: "https://dashboard.workos.com",
+    docs: "https://workos.com/docs/reference/api",
+    howTo: "Find your API key and client ID in the WorkOS dashboard → API Keys.",
+    sdkPackages: ["@workos-inc/node"],
+  },
   {
     name: "clerk",
     displayName: "Clerk",
@@ -392,9 +649,28 @@ export const PROVIDERS_REF: ProviderRef[] = [
     authKind: "api_key",
     secrets: ["CLERK_SECRET_KEY"],
     blurb: "Drop-in auth + users. Secret key stored in Phantom.",
+    keyOnly: true,
     dashboard: "https://dashboard.clerk.com",
     docs: "https://clerk.com/docs",
     howTo: "Paste a secret key from https://dashboard.clerk.com (API Keys).",
+    sdkPackages: ["@clerk/backend"],
+  },
+
+  // ── FeatureFlags ──────────────────────────────────────────────────────────
+  {
+    name: "launchdarkly",
+    displayName: "LaunchDarkly",
+    category: "FeatureFlags",
+    authKind: "api_key",
+    secrets: ["LAUNCHDARKLY_SDK_KEY", "LAUNCHDARKLY_API_TOKEN"],
+    blurb:
+      "Feature flags + experimentation. SDK key + API token verified via /api/v2/caller-identity.",
+    keyOnly: true,
+    dashboard: "https://app.launchdarkly.com",
+    docs: "https://apidocs.launchdarkly.com/",
+    howTo:
+      "Find your SDK key in LaunchDarkly → Environments and create an API token at LaunchDarkly → Account settings → Authorization.",
+    sdkPackages: ["launchdarkly-node-server-sdk"],
   },
 ];
 
@@ -404,13 +680,16 @@ export const PROVIDER_CATEGORIES = [
   "Cloud",
   "AI",
   "Analytics",
+  "Observability",
   "Errors",
   "Payments",
   "Code",
   "Tickets",
   "Email",
   "Auth",
+  "FeatureFlags",
 ] as const;
+// If you see "Features" anywhere, it's stale — no provider currently maps to it.
 
 export function groupByCategory(): Record<string, ProviderRef[]> {
   const out: Record<string, ProviderRef[]> = {};