@ashlr/stack-core 0.1.1 → 0.3.0

package/src/providers/_credential-stage.ts

@@ -0,0 +1,237 @@
+import { resolve } from "node:path";
+import { StackError } from "../errors.ts";
+import { addSecret, revealSecret } from "../phantom.ts";
+import type { ProviderContext, Resource } from "./_base.ts";
+
+type Phase = "login" | "provision" | "critical" | "materialize" | "commit";
+interface Scope {
+  cwd: string;
+  phase: Phase;
+  inputs: Map<string, string>;
+  candidates: Map<string, string>;
+  existing: Map<string, string>;
+  critical: Map<Resource, Map<string, string>>;
+  createdCritical: Map<string, string>;
+}
+const scopes = new WeakMap<ProviderContext, Scope>();
+// Keep only a no-values tombstone after disposal: a retained operation context
+// must never fall through to standalone persistence after its operation ends.
+const managed = new WeakSet<ProviderContext>();
+
+function active(ctx: ProviderContext): Scope | undefined {
+  const scope = scopes.get(ctx);
+  if (!scope && managed.has(ctx)) {
+    throw new StackError("CREDENTIAL_SCOPE_CLOSED", "Credential operation has already ended.");
+  }
+  return scope;
+}
+function required(ctx: ProviderContext): Scope {
+  const scope = active(ctx);
+  if (!scope) throw new StackError("CREDENTIAL_SCOPE_REQUIRED", "Credential operation is missing.");
+  return scope;
+}
+function conflict(): never {
+  throw new StackError(
+    "CREDENTIAL_INPUT_CONFLICT",
+    "Credential inputs disagree for one secret slot.",
+  );
+}
+function validate(value: string): void {
+  if (/[\r\n]/.test(value)) {
+    throw new StackError(
+      "PHANTOM_SECRET_VALUE_UNSUPPORTED",
+      "Phantom Secrets accepts one line per secret; CR/LF values cannot be stored unchanged.",
+    );
+  }
+}
+function merge(inputs: Map<string, string>, key: string, value: string): void {
+  validate(value);
+  if (inputs.has(key) && inputs.get(key) !== value) conflict();
+  inputs.set(key, value);
+}
+
+/** Internal source coordination only; no public receipt or vault attestation. */
+export function beginCredentialStage(ctx: ProviderContext): void {
+  if (managed.has(ctx)) {
+    throw new StackError("CREDENTIAL_SCOPE_CLOSED", "Credential context cannot be reused.");
+  }
+  managed.add(ctx);
+  scopes.set(ctx, {
+    cwd: resolve(ctx.cwd),
+    phase: "login",
+    inputs: new Map(),
+    candidates: new Map(),
+    existing: new Map(),
+    critical: new Map(),
+    createdCritical: new Map(),
+  });
+}
+export function credentialPhase(ctx: ProviderContext, phase: Phase): void {
+  const scope = required(ctx);
+  scope.candidates.clear();
+  scope.phase = phase;
+}
+export function closeCredentialStage(ctx: ProviderContext): void {
+  const scope = scopes.get(ctx);
+  if (!scope) return;
+  scope.inputs.clear();
+  scope.candidates.clear();
+  scope.existing.clear();
+  for (const values of scope.critical.values()) values.clear();
+  scope.critical.clear();
+  scope.createdCritical.clear();
+  scopes.delete(ctx);
+}
+
+export async function readProviderSecret(ctx: ProviderContext, key: string): Promise<string> {
+  const scope = active(ctx);
+  const value = await revealSecret(key, scope?.cwd ?? ctx.cwd);
+  if (scope) {
+    if (active(ctx) !== scope) {
+      throw new StackError("CREDENTIAL_SCOPE_CLOSED", "Credential operation has already ended.");
+    }
+    if (scope.phase === "login" && value) scope.candidates.set(key, value);
+  }
+  return value;
+}
+/** Called only by the original cached branch after its fresh verifier succeeds.
+ * Exact input equality authorizes omitting this operation's duplicate create;
+ * it does not attest a concurrently unchanged vault or authenticate arbitrary JS.
+ */
+export function acceptVerifiedExisting(ctx: ProviderContext, key: string, value: string): void {
+  const scope = active(ctx);
+  if (!scope) return;
+  if (scope.phase !== "login" || scope.candidates.get(key) !== value) {
+    throw new StackError(
+      "CREDENTIAL_EXISTING_UNCONFIRMED",
+      "Existing credential was not verified in this login.",
+    );
+  }
+  if (scope.inputs.has(key) && scope.inputs.get(key) !== value) conflict();
+  scope.existing.set(key, value);
+  scope.candidates.delete(key);
+}
+
+async function createCredential(key: string, value: string, cwd: string): Promise<void> {
+  try {
+    await addSecret(key, value, cwd);
+  } catch (err) {
+    // Producer output can contain input values. Preserve a recognized refusal
+    // code, never its raw message/cause or an upstream-derived secret name.
+    const code = err instanceof StackError ? err.code : "PHANTOM_EXEC_FAILED";
+    throw new StackError(
+      code,
+      code === "PHANTOM_SECRET_EXISTS"
+        ? "Credential storage was refused; the secret name already exists."
+        : "Credential storage could not be confirmed.",
+    );
+  }
+}
+export async function commitOrdinaryCredential(
+  ctx: ProviderContext,
+  key: string,
+  value: string,
+): Promise<void> {
+  const scope = required(ctx);
+  if (scope.phase !== "commit") {
+    throw new StackError("CREDENTIAL_PHASE_CLOSED", "Credential commit is not active.");
+  }
+  await createCredential(key, value, scope.cwd);
+}
+
+export async function storeProviderSecret(
+  ctx: ProviderContext,
+  key: string,
+  value: string,
+): Promise<void> {
+  const scope = active(ctx);
+  if (!scope) return createCredential(key, value, ctx.cwd);
+  if (scope.phase !== "login" && scope.phase !== "provision" && scope.phase !== "materialize") {
+    throw new StackError("CREDENTIAL_PHASE_CLOSED", "Credential input collection has ended.");
+  }
+  if (scope.existing.has(key) && scope.existing.get(key) !== value) conflict();
+  merge(scope.inputs, key, value);
+}
+
+/** The generated password is not recoverable from the API. Carry it privately
+ * on the exact returned resource until the pipeline owns failure cleanup.
+ * Standalone provision retains its immediate strict persistence contract.
+ */
+export async function carryResourceCredential(
+  ctx: ProviderContext,
+  resource: Resource,
+  key: string,
+  value: string,
+): Promise<void> {
+  const scope = active(ctx);
+  if (!scope) return createCredential(key, value, ctx.cwd);
+  if (scope.phase !== "provision") {
+    throw new StackError("CREDENTIAL_PHASE_CLOSED", "Resource credential collection has ended.");
+  }
+  let values = scope.critical.get(resource);
+  if (!values) {
+    values = new Map();
+    scope.critical.set(resource, values);
+  }
+  merge(values, key, value);
+}
+export async function commitResourceCredentials(
+  ctx: ProviderContext,
+  resource: Resource,
+  created: (key: string) => void,
+): Promise<void> {
+  const scope = required(ctx);
+  if (scope.phase !== "critical") {
+    throw new StackError("CREDENTIAL_PHASE_CLOSED", "Resource credential commit is not active.");
+  }
+  const values = scope.critical.get(resource);
+  if (!values) return;
+  // Take once before the first await. Refusal or unknown completion is never
+  // converted into a successful write or retried from this private carry.
+  scope.critical.delete(resource);
+  try {
+    for (const [key, value] of values) {
+      if (scope.inputs.has(key) && scope.inputs.get(key) !== value) conflict();
+      if (scope.existing.has(key) || scope.createdCritical.has(key)) conflict();
+      try {
+        await addSecret(key, value, scope.cwd);
+      } catch {
+        // The generated name includes an upstream identifier. Do not reflect
+        // that name, producer output or the password into a failure diagnostic.
+        throw new StackError(
+          "RESOURCE_CREDENTIAL_UNCONFIRMED",
+          "Resource credential storage was refused or could not be confirmed.",
+        );
+      }
+      scope.createdCritical.set(key, value);
+      created(key);
+    }
+  } finally {
+    values.clear();
+  }
+}
+
+/** Validate the entire ordinary plan before its first create. Critical resource
+ * writes necessarily precede materialize; a later conflict uses owned rollback.
+ * Materialized slots stay first; auth-only slots follow, before MCP/config.
+ */
+export function ordinaryCredentialPlan(
+  ctx: ProviderContext,
+  materialized: Record<string, string>,
+): Array<[string, string]> {
+  const scope = required(ctx);
+  const plan = new Map<string, string>();
+  for (const [key, value] of Object.entries(materialized)) merge(plan, key, value);
+  for (const [key, value] of scope.inputs) merge(plan, key, value);
+  for (const [key, value] of plan) {
+    if (scope.existing.has(key)) {
+      if (scope.existing.get(key) !== value) conflict();
+      plan.delete(key);
+    }
+    if (scope.createdCritical.has(key)) {
+      if (scope.createdCritical.get(key) !== value) conflict();
+      plan.delete(key);
+    }
+  }
+  return [...plan];
+}

package/src/providers/_helpers.ts

@@ -1,5 +1,8 @@
+import { StackError } from "../errors.ts";
+import { type RetryOptions, fetchWithRetry } from "../http.ts";
 import { revealSecret } from "../phantom.ts";
-import { fetchWithRetry, type RetryOptions } from "../http.ts";
+import type { ProviderContext } from "./_base.ts";
+import { readProviderSecret } from "./_credential-stage.ts";
 
 /**
  * Shared helpers for every hand-written provider. Before this existed, each
@@ -7,18 +10,61 @@ import { fetchWithRetry, type RetryOptions } from "../http.ts";
  * one source of truth keeps behaviour consistent.
  */
 
-export async function tryRevealSecret(key: string): Promise<string | undefined> {
+/**
+ * Names whose stored value Phantom refused to reveal to this process (it only
+ * reveals into an attached terminal). Lets `stack doctor` tell "stored but
+ * unreadable here" apart from "missing", since `tryRevealSecret` returns
+ * `undefined` for both. Names only, never values.
+ */
+const revealRefusals = new Set<string>();
+
+/** Return and clear the names Phantom refused to reveal since the last call. */
+export function takeRevealRefusals(): string[] {
+  const names = [...revealRefusals];
+  revealRefusals.clear();
+  return names;
+}
+
+export async function tryRevealSecret(
+  key: string,
+  ctx?: ProviderContext,
+): Promise<string | undefined> {
   try {
-    const value = await revealSecret(key);
+    const value = ctx ? await readProviderSecret(ctx, key) : await revealSecret(key);
     return value.length > 0 ? value : undefined;
-  } catch {
+  } catch (err) {
+    if (err instanceof StackError && err.code === "PHANTOM_TRUSTED_TERMINAL_REQUIRED") {
+      revealRefusals.add(key);
+    }
     return undefined;
   }
 }
 
 /**
- * Read a single line from stdin. Used by every provider's PAT-paste fallback
- * when no OAuth client is configured. Resumes stdin, reads until newline, then
+ * Prompt the user for a credential. When the host supplies `ctx.prompt` (the
+ * CLI always does), the request goes through it — the CLI pauses its spinner,
+ * runs a @clack prompt, then resumes. This is the ONLY safe way to read a
+ * credential while a spinner is running: writing the prompt to stderr directly
+ * gets clobbered by the spinner's repaint and `stack add` looks like it hung.
+ *
+ * Falls back to a bare stderr-prompt + stdin read for non-CLI hosts and tests,
+ * where no spinner is competing for the terminal.
+ */
+export async function promptSecret(
+  ctx: ProviderContext,
+  req: { message: string; howTo?: string },
+): Promise<string> {
+  if (ctx.prompt) {
+    return (await ctx.prompt({ message: req.message, howTo: req.howTo, secret: true })).trim();
+  }
+  if (req.howTo) process.stderr.write(`\n  ${req.howTo}\n`);
+  process.stderr.write(`  ${req.message}: `);
+  return (await readLine()).trim();
+}
+
+/**
+ * Read a single line from stdin. Used by `promptSecret`'s non-CLI fallback when
+ * no host prompt is configured. Resumes stdin, reads until newline, then
  * pauses stdin so the parent process doesn't hang waiting for EOF.
  */
 export async function readLine(): Promise<string> {
@@ -42,7 +88,7 @@ export async function readLine(): Promise<string> {
  * Bearer-token providers. Providers with custom auth header shapes (Anthropic,
  * Upstash, Linear, Supabase PKCE) inline their own.
  */
-export function bearerJsonHeaders(token: string): HeadersInit {
+export function bearerJsonHeaders(token: string): NonNullable<RequestInit["headers"]> {
   return {
     Authorization: `Bearer ${token}`,
     "content-type": "application/json",
@@ -58,7 +104,7 @@ export function bearerJsonHeaders(token: string): HeadersInit {
  * 429/5xx is always safe. Keeps each provider's `verify` free of retry glue.
  */
 export function verifyFetch(
-  input: RequestInfo | URL,
+  input: string | URL | Request,
   init?: RequestInit,
   opts?: RetryOptions,
 ): Promise<Response> {
@@ -74,7 +120,7 @@ export function verifyFetch(
  * Usage: `ctx.log({ msg: \`token ${scrub(t)} rejected\` })` prints
  * `token ****abcd rejected`, never the raw secret.
  */
-export function scrub(value: string, keepLast: number = 4): string {
+export function scrub(value: string, keepLast = 4): string {
   if (!value) return "";
   if (value.length <= keepLast) return "****";
   return `****${value.slice(-keepLast)}`;

package/src/providers/anthropic.ts

@@ -1,3 +1,4 @@
+import { anthropicBaseUrl } from "../base-urls.ts";
 import { makeApiKeyProvider } from "./_api-key.ts";
 import { verifyFetch } from "./_helpers.ts";
 
@@ -11,7 +12,7 @@ export default makeApiKeyProvider({
   dashboard: "https://console.anthropic.com",
   async verify(key) {
     try {
-      const res = await verifyFetch("https://api.anthropic.com/v1/models", {
+      const res = await verifyFetch(`${anthropicBaseUrl()}/v1/models`, {
         headers: {
           "x-api-key": key,
           "anthropic-version": "2023-06-01",

package/src/providers/auth0.ts

@@ -0,0 +1,27 @@
+import { makeApiKeyProvider } from "./_api-key.ts";
+import { verifyFetch } from "./_helpers.ts";
+
+export default makeApiKeyProvider({
+  name: "auth0",
+  displayName: "Auth0",
+  category: "auth",
+  docs: "https://auth0.com/docs/api/management/v2",
+  secretName: "AUTH0_DOMAIN",
+  howTo:
+    "Enter your Auth0 tenant domain, such as your-tenant.us.auth0.com. This adapter checks its discovery response and stores only that domain.",
+  dashboard: "https://manage.auth0.com",
+  async verify(key) {
+    // `key` here is the domain (e.g. "myapp.us.auth0.com").
+    // We hit the OIDC discovery endpoint — no credentials required — to confirm
+    // the tenant is reachable. Full M2M credential verification requires an
+    // access-token exchange which is deferred to the multi-secret login path.
+    try {
+      const res = await verifyFetch(`https://${key}/.well-known/openid-configuration`);
+      if (!res.ok) return undefined;
+      const body = (await res.json()) as { issuer?: string };
+      return body.issuer ? { issuer: body.issuer } : undefined;
+    } catch {
+      return undefined;
+    }
+  },
+});

package/src/providers/aws.ts

@@ -1,8 +1,6 @@
-import type { ServiceEntry } from "../config.ts";
 import { createHash, createHmac } from "node:crypto";
+import type { ServiceEntry } from "../config.ts";
 import { StackError } from "../errors.ts";
-import { addSecret } from "../phantom.ts";
-import { readLine, tryRevealSecret } from "./_helpers.ts";
 import type {
   AuthHandle,
   HealthStatus,
@@ -11,6 +9,8 @@ import type {
   ProviderContext,
   Resource,
 } from "./_base.ts";
+import { acceptVerifiedExisting, storeProviderSecret } from "./_credential-stage.ts";
+import { promptSecret, tryRevealSecret } from "./_helpers.ts";
 
 /**
  * AWS — v1 accepts an IAM access key pair (access key id + secret access key).
@@ -32,25 +32,29 @@ const aws: Provider = {
   docs: "https://docs.aws.amazon.com/iam/",
 
   async login(ctx: ProviderContext): Promise<AuthHandle> {
-    const cachedId = await tryRevealSecret(SECRET_ID_KEY);
-    const cachedSecret = await tryRevealSecret(SECRET_SECRET_KEY);
+    const cachedId = await tryRevealSecret(SECRET_ID_KEY, ctx);
+    const cachedSecret = await tryRevealSecret(SECRET_SECRET_KEY, ctx);
     if (cachedId && cachedSecret) {
       const identity = await callStsIdentity(cachedId, cachedSecret, "us-east-1");
-      if (identity) return { token: `${cachedId}:${cachedSecret}`, identity };
+      if (identity) {
+        acceptVerifiedExisting(ctx, SECRET_ID_KEY, cachedId);
+        acceptVerifiedExisting(ctx, SECRET_SECRET_KEY, cachedSecret);
+        return { token: `${cachedId}:${cachedSecret}`, identity };
+      }
       ctx.log({ level: "warn", msg: "Cached AWS credentials invalid." });
     }
     if (!ctx.interactive)
       throw new StackError("AWS_AUTH_REQUIRED", "No valid AWS credentials in vault.");
-    process.stderr.write(
-      "\n  Create an IAM access key at https://console.aws.amazon.com/iam/home#/security_credentials\n  AWS_ACCESS_KEY_ID: ",
-    );
-    const accessKeyId = (await readLine()).trim();
-    process.stderr.write("  AWS_SECRET_ACCESS_KEY: ");
-    const secretAccessKey = (await readLine()).trim();
+    const accessKeyId = await promptSecret(ctx, {
+      message: "AWS_ACCESS_KEY_ID",
+      howTo:
+        "Create an IAM access key at https://console.aws.amazon.com/iam/home#/security_credentials",
+    });
+    const secretAccessKey = await promptSecret(ctx, { message: "AWS_SECRET_ACCESS_KEY" });
     const identity = await callStsIdentity(accessKeyId, secretAccessKey, "us-east-1");
     if (!identity) throw new StackError("AWS_AUTH_INVALID", "AWS rejected those credentials.");
-    await addSecret(SECRET_ID_KEY, accessKeyId);
-    await addSecret(SECRET_SECRET_KEY, secretAccessKey);
+    await storeProviderSecret(ctx, SECRET_ID_KEY, accessKeyId);
+    await storeProviderSecret(ctx, SECRET_SECRET_KEY, secretAccessKey);
     return { token: `${accessKeyId}:${secretAccessKey}`, identity };
   },
 
@@ -64,7 +68,7 @@ const aws: Provider = {
     };
   },
 
-  async materialize(_ctx, resource, auth): Promise<Materialized> {
+  async materialize(ctx, resource, auth): Promise<Materialized> {
     const sep = auth.token.indexOf(":");
     if (sep <= 0 || sep === auth.token.length - 1) {
       throw new StackError(
@@ -80,7 +84,7 @@ const aws: Provider = {
         "AWS auth handle missing access key id or secret access key.",
       );
     }
-    await addSecret(SECRET_REGION, resource.region ?? "us-east-1");
+    await storeProviderSecret(ctx, SECRET_REGION, resource.region ?? "us-east-1");
     return {
       secrets: {
         AWS_ACCESS_KEY_ID: accessKeyId,
@@ -90,10 +94,10 @@ const aws: Provider = {
     };
   },
 
-  async healthcheck(_ctx, _entry: ServiceEntry): Promise<HealthStatus> {
-    const id = await tryRevealSecret(SECRET_ID_KEY);
-    const secret = await tryRevealSecret(SECRET_SECRET_KEY);
-    const region = (await tryRevealSecret(SECRET_REGION)) ?? "us-east-1";
+  async healthcheck(ctx, _entry: ServiceEntry): Promise<HealthStatus> {
+    const id = await tryRevealSecret(SECRET_ID_KEY, ctx);
+    const secret = await tryRevealSecret(SECRET_SECRET_KEY, ctx);
+    const region = (await tryRevealSecret(SECRET_REGION, ctx)) ?? "us-east-1";
     if (!id || !secret) return { kind: "error", detail: "AWS credentials missing from vault" };
     const start = Date.now();
     const identity = await callStsIdentity(id, secret, region);
@@ -127,19 +131,11 @@ async function callStsIdentity(
   const payload = "Action=GetCallerIdentity&Version=2011-06-15";
   const payloadHash = createHash("sha256").update(payload).digest("hex");
 
-  const canonicalHeaders =
-    `content-type:application/x-www-form-urlencoded\n` +
-    `host:${host}\n` +
-    `x-amz-date:${amzDate}\n`;
+  const canonicalHeaders = `content-type:application/x-www-form-urlencoded\nhost:${host}\nx-amz-date:${amzDate}\n`;
   const signedHeaders = "content-type;host;x-amz-date";
-  const canonicalRequest = [
-    method,
-    "/",
-    "",
-    canonicalHeaders,
-    signedHeaders,
-    payloadHash,
-  ].join("\n");
+  const canonicalRequest = [method, "/", "", canonicalHeaders, signedHeaders, payloadHash].join(
+    "\n",
+  );
   const scope = `${datestamp}/${region}/${service}/aws4_request`;
   const stringToSign = [
     "AWS4-HMAC-SHA256",
@@ -189,7 +185,10 @@ function hmac(key: string | Buffer, value: string): Buffer {
 }
 
 function toAmzDate(d: Date): string {
-  return d.toISOString().replace(/[-:]/g, "").replace(/\.\d{3}/, "");
+  return d
+    .toISOString()
+    .replace(/[-:]/g, "")
+    .replace(/\.\d{3}/, "");
 }
 
 function matchXml(xml: string, tag: string): string | undefined {

package/src/providers/cloudflare.ts

@@ -1,6 +1,5 @@
 import type { ServiceEntry } from "../config.ts";
 import { StackError } from "../errors.ts";
-import { addSecret, revealSecret } from "../phantom.ts";
 import { fetchWithRetry } from "../http.ts";
 import type {
   AuthHandle,
@@ -11,6 +10,8 @@ import type {
   ProvisionOpts,
   Resource,
 } from "./_base.ts";
+import { acceptVerifiedExisting, storeProviderSecret } from "./_credential-stage.ts";
+import { promptSecret, tryRevealSecret } from "./_helpers.ts";
 
 /**
  * Cloudflare — Workers / Pages / R2 / D1 / KV all hang off one Account API
@@ -31,21 +32,26 @@ const cloudflare: Provider = {
   docs: "https://developers.cloudflare.com/api",
 
   async login(ctx: ProviderContext): Promise<AuthHandle> {
-    const cached = await tryRevealSecret(TOKEN_SECRET);
+    const cached = await tryRevealSecret(TOKEN_SECRET, ctx);
     if (cached) {
       const identity = await verifyToken(cached);
-      if (identity) return { token: cached, identity };
+      if (identity) {
+        acceptVerifiedExisting(ctx, TOKEN_SECRET, cached);
+        return { token: cached, identity };
+      }
       ctx.log({ level: "warn", msg: "Cached Cloudflare token invalid." });
     }
     if (!ctx.interactive)
       throw new StackError("CLOUDFLARE_AUTH_REQUIRED", "No valid Cloudflare token in vault.");
-    process.stderr.write(
-      "\n  Create an API token at https://dash.cloudflare.com/profile/api-tokens\n  Scopes: Account · Workers Scripts / Pages / R2 / D1 as needed\n  Paste it here: ",
-    );
-    const token = (await readLine()).trim();
+    const token = await promptSecret(ctx, {
+      message: "Paste your Cloudflare API token",
+      howTo:
+        "Create an API token at https://dash.cloudflare.com/profile/api-tokens (scopes: Account · Workers Scripts / Pages / R2 / D1 as needed)",
+    });
     const identity = await verifyToken(token);
-    if (!identity) throw new StackError("CLOUDFLARE_AUTH_INVALID", "Cloudflare rejected that token.");
-    await addSecret(TOKEN_SECRET, token);
+    if (!identity)
+      throw new StackError("CLOUDFLARE_AUTH_INVALID", "Cloudflare rejected that token.");
+    await storeProviderSecret(ctx, TOKEN_SECRET, token);
     return { token, identity };
   },
 
@@ -67,7 +73,7 @@ const cloudflare: Provider = {
     };
   },
 
-  async materialize(_ctx, resource, auth): Promise<Materialized> {
+  async materialize(ctx, resource, auth): Promise<Materialized> {
     return {
       secrets: {
         CLOUDFLARE_API_TOKEN: auth.token,
@@ -77,8 +83,8 @@ const cloudflare: Provider = {
     };
   },
 
-  async healthcheck(_ctx, _entry: ServiceEntry): Promise<HealthStatus> {
-    const token = await tryRevealSecret(TOKEN_SECRET);
+  async healthcheck(ctx, _entry: ServiceEntry): Promise<HealthStatus> {
+    const token = await tryRevealSecret(TOKEN_SECRET, ctx);
     if (!token) return { kind: "error", detail: `${TOKEN_SECRET} missing from vault` };
     const start = Date.now();
     const identity = await verifyToken(token);
@@ -119,28 +125,3 @@ async function fetchAccounts(token: string): Promise<Array<{ id: string; name: s
   const body = (await res.json()) as { result?: Array<{ id: string; name: string }> };
   return body.result ?? [];
 }
-
-async function tryRevealSecret(key: string): Promise<string | undefined> {
-  try {
-    const v = await revealSecret(key);
-    return v.length > 0 ? v : undefined;
-  } catch {
-    return undefined;
-  }
-}
-
-async function readLine(): Promise<string> {
-  return new Promise((resolve) => {
-    let buf = "";
-    const onData = (chunk: Buffer) => {
-      buf += chunk.toString();
-      if (buf.includes("\n")) {
-        process.stdin.off("data", onData);
-        process.stdin.pause();
-        resolve(buf.split("\n")[0]);
-      }
-    };
-    process.stdin.resume();
-    process.stdin.on("data", onData);
-  });
-}

package/src/providers/convex.ts

@@ -12,8 +12,7 @@ export default makeApiKeyProvider({
   category: "database",
   docs: "https://docs.convex.dev",
   secretName: "CONVEX_DEPLOY_KEY",
-  howTo:
-    "Create a deploy key at https://dashboard.convex.dev (Project → Settings → Deploy Keys).",
+  howTo: "Create a deploy key at https://dashboard.convex.dev (Project → Settings → Deploy Keys).",
   dashboard: "https://dashboard.convex.dev",
   async verify(key) {
     // Convex deploy keys have the shape prod:<team>:<project>|<token>. No

package/src/providers/datadog.ts

@@ -0,0 +1,29 @@
+import { makeApiKeyProvider } from "./_api-key.ts";
+import { verifyFetch } from "./_helpers.ts";
+
+export default makeApiKeyProvider({
+  name: "datadog",
+  displayName: "Datadog",
+  category: "observability",
+  docs: "https://docs.datadoghq.com/api/latest/",
+  secretName: "DD_API_KEY",
+  howTo:
+    "Create an API key at https://app.datadoghq.com/organization-settings/api-keys. This adapter validates and stores that key only.",
+  dashboard: "https://app.datadoghq.com",
+  async verify(key) {
+    try {
+      // GET /api/v1/validate — requires only the API key in the header.
+      const res = await verifyFetch("https://api.datadoghq.com/api/v1/validate", {
+        headers: {
+          "DD-API-KEY": key,
+          Accept: "application/json",
+        },
+      });
+      if (!res.ok) return undefined;
+      const body = (await res.json()) as { valid?: boolean };
+      return body.valid ? { valid: "true" } : undefined;
+    } catch {
+      return undefined;
+    }
+  },
+});

package/src/providers/digitalocean.ts

@@ -0,0 +1,30 @@
+import { makeApiKeyProvider } from "./_api-key.ts";
+import { verifyFetch } from "./_helpers.ts";
+
+export default makeApiKeyProvider({
+  name: "digitalocean",
+  displayName: "DigitalOcean",
+  category: "cloud",
+  docs: "https://docs.digitalocean.com/reference/api/api-reference/",
+  secretName: "DIGITALOCEAN_TOKEN",
+  howTo: "Create a personal access token at https://cloud.digitalocean.com/account/api/tokens.",
+  dashboard: "https://cloud.digitalocean.com",
+  async verify(key) {
+    try {
+      const res = await verifyFetch("https://api.digitalocean.com/v2/account", {
+        headers: {
+          Authorization: `Bearer ${key}`,
+          Accept: "application/json",
+        },
+      });
+      if (!res.ok) return undefined;
+      const body = (await res.json()) as { account?: { email?: string; uuid?: string } };
+      return {
+        email: body.account?.email ?? "",
+        uuid: body.account?.uuid ?? "",
+      };
+    } catch {
+      return undefined;
+    }
+  },
+});