@ashlr/stack-core 0.1.1

package/src/oauth.ts

@@ -0,0 +1,184 @@
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { spawn } from "node:child_process";
+import { platform } from "node:os";
+import type { AddressInfo } from "node:net";
+import { StackError } from "./errors.ts";
+
+/**
+ * Minimal OAuth PKCE helper suitable for CLI/desktop OAuth flows. Spins up a
+ * localhost loopback server, opens the browser to the provider auth URL,
+ * catches the callback, then exchanges the code for an access token.
+ *
+ * This helper is transport-only — each provider composes it with its own URLs
+ * and scopes.
+ */
+
+export interface PkceFlowOptions {
+  clientId: string;
+  authUrl: string;
+  tokenUrl: string;
+  scope?: string;
+  /** Additional query params for the authorize request. */
+  extraAuthParams?: Record<string, string>;
+  /** Human-readable label used in console prompts. */
+  providerName: string;
+  /** Timeout in ms. Defaults to 5 minutes. */
+  timeoutMs?: number;
+}
+
+export interface TokenResponse {
+  access_token: string;
+  token_type?: string;
+  expires_in?: number;
+  refresh_token?: string;
+  scope?: string;
+  [key: string]: unknown;
+}
+
+export async function runPkceFlow(opts: PkceFlowOptions): Promise<TokenResponse> {
+  const verifier = base64url(randomBytes(64));
+  const challenge = base64url(createHash("sha256").update(verifier).digest());
+  const state = base64url(randomBytes(16));
+
+  const { code, redirectUri } = await captureCallback({
+    state,
+    authUrl: opts.authUrl,
+    clientId: opts.clientId,
+    challenge,
+    scope: opts.scope,
+    extraAuthParams: opts.extraAuthParams,
+    providerName: opts.providerName,
+    timeoutMs: opts.timeoutMs ?? 5 * 60 * 1000,
+  });
+
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code,
+    redirect_uri: redirectUri,
+    client_id: opts.clientId,
+    code_verifier: verifier,
+  });
+
+  const response = await fetch(opts.tokenUrl, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body,
+  });
+
+  if (!response.ok) {
+    const text = await response.text();
+    throw new StackError(
+      "OAUTH_TOKEN_EXCHANGE_FAILED",
+      `${opts.providerName} rejected the token exchange (${response.status}): ${text}`,
+    );
+  }
+
+  return (await response.json()) as TokenResponse;
+}
+
+interface CaptureArgs {
+  state: string;
+  authUrl: string;
+  clientId: string;
+  challenge: string;
+  scope?: string;
+  extraAuthParams?: Record<string, string>;
+  providerName: string;
+  timeoutMs: number;
+}
+
+async function captureCallback(args: CaptureArgs): Promise<{ code: string; redirectUri: string }> {
+  return new Promise((resolve, reject) => {
+    // Bind the port BEFORE registering the request handler. This guarantees
+    // `redirectUri` is a completed string by the time any callback request
+    // can possibly arrive, eliminating the race where an adversary-replayed
+    // callback could land with `redirectUri === ""`.
+    const server = createServer();
+
+    const timer = setTimeout(() => {
+      server.close();
+      reject(new StackError("OAUTH_TIMEOUT", `${args.providerName} auth timed out.`));
+    }, args.timeoutMs);
+    server.on("close", () => clearTimeout(timer));
+
+    server.listen(0, "127.0.0.1", () => {
+      const { port } = server.address() as AddressInfo;
+      const redirectUri = `http://127.0.0.1:${port}/callback`;
+
+      server.on("request", (req, res) => {
+        if (!req.url) {
+          res.writeHead(400).end();
+          return;
+        }
+        const url = new URL(req.url, "http://127.0.0.1");
+        if (url.pathname !== "/callback") {
+          res.writeHead(404).end();
+          return;
+        }
+        const receivedState = url.searchParams.get("state");
+        const code = url.searchParams.get("code");
+        const error = url.searchParams.get("error");
+        if (error) {
+          res
+            .writeHead(400, { "content-type": "text/html" })
+            .end(htmlPage("error", args.providerName, error));
+          server.close();
+          reject(new StackError("OAUTH_DENIED", `${args.providerName} auth denied: ${error}`));
+          return;
+        }
+        if (!code || receivedState !== args.state) {
+          res
+            .writeHead(400, { "content-type": "text/html" })
+            .end(htmlPage("error", args.providerName, "state mismatch"));
+          server.close();
+          reject(new StackError("OAUTH_STATE_MISMATCH", "Auth callback state did not match request."));
+          return;
+        }
+        res.writeHead(200, { "content-type": "text/html" }).end(htmlPage("ok", args.providerName));
+        server.close();
+        resolve({ code, redirectUri });
+      });
+
+      const params = new URLSearchParams({
+        response_type: "code",
+        client_id: args.clientId,
+        redirect_uri: redirectUri,
+        state: args.state,
+        code_challenge: args.challenge,
+        code_challenge_method: "S256",
+        ...(args.scope ? { scope: args.scope } : {}),
+        ...(args.extraAuthParams ?? {}),
+      });
+      const authorizeUrl = `${args.authUrl}?${params.toString()}`;
+
+      console.log(`\n  Opening ${args.providerName} in your browser…`);
+      console.log(`  If nothing happens, visit:\n    ${authorizeUrl}\n`);
+      openBrowser(authorizeUrl);
+    });
+  });
+}
+
+function openBrowser(url: string): void {
+  const cmd = platform() === "darwin" ? "open" : platform() === "win32" ? "start" : "xdg-open";
+  try {
+    spawn(cmd, [url], { stdio: "ignore", detached: true }).unref();
+  } catch {
+    /* user can still copy the URL manually */
+  }
+}
+
+function base64url(buf: Buffer | Uint8Array): string {
+  return Buffer.from(buf).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+function htmlPage(kind: "ok" | "error", provider: string, detail?: string): string {
+  const title = kind === "ok" ? "Sign-in complete" : "Sign-in failed";
+  const body =
+    kind === "ok"
+      ? `You can close this tab and return to your terminal. Stack has finished wiring up ${provider}.`
+      : `Something went wrong${detail ? `: ${detail}` : ""}. Return to your terminal for next steps.`;
+  return `<!doctype html><meta charset="utf-8"><title>${title}</title>
+<style>html,body{height:100%;margin:0;font-family:ui-sans-serif,system-ui,-apple-system}main{display:grid;place-items:center;height:100%}section{max-width:420px;padding:32px;border-radius:12px;background:#fafafa;border:1px solid #eee}h1{font-size:18px;margin:0 0 8px}p{margin:0;color:#555;line-height:1.5}</style>
+<main><section><h1>${title}</h1><p>${body}</p></section></main>`;
+}

package/src/phantom.ts

@@ -0,0 +1,156 @@
+import { spawn } from "node:child_process";
+import { PhantomNotInstalledError, StackError } from "./errors.ts";
+
+/**
+ * Thin wrapper around the `phantom` CLI. Stack never stores secrets locally —
+ * every read/write goes through Phantom. If Phantom is missing, we surface a
+ * clear install hint instead of silently falling back to a weaker store.
+ */
+
+export interface PhantomExecResult {
+  stdout: string;
+  stderr: string;
+  code: number;
+}
+
+let cachedInstalled: boolean | undefined;
+
+export async function isPhantomInstalled(): Promise<boolean> {
+  if (cachedInstalled !== undefined) return cachedInstalled;
+  try {
+    const result = await exec(["--version"], { allowFailure: true });
+    cachedInstalled = result.code === 0;
+  } catch {
+    cachedInstalled = false;
+  }
+  return cachedInstalled;
+}
+
+export async function assertPhantomInstalled(): Promise<void> {
+  if (!(await isPhantomInstalled())) throw new PhantomNotInstalledError();
+}
+
+export interface ExecOptions {
+  cwd?: string;
+  allowFailure?: boolean;
+  stdin?: string;
+  /** If true, inherit stdio so interactive flows (OAuth browser) work. */
+  interactive?: boolean;
+}
+
+export async function exec(args: string[], opts: ExecOptions = {}): Promise<PhantomExecResult> {
+  return new Promise((resolvePromise, reject) => {
+    const child = spawn("phantom", args, {
+      cwd: opts.cwd,
+      stdio: opts.interactive ? "inherit" : ["pipe", "pipe", "pipe"],
+    });
+
+    let stdout = "";
+    let stderr = "";
+
+    if (!opts.interactive) {
+      child.stdout?.on("data", (chunk) => {
+        stdout += chunk.toString();
+      });
+      child.stderr?.on("data", (chunk) => {
+        stderr += chunk.toString();
+      });
+      if (opts.stdin !== undefined) {
+        child.stdin?.write(opts.stdin);
+        child.stdin?.end();
+      }
+    }
+
+    child.on("error", (err) => {
+      if ((err as NodeJS.ErrnoException).code === "ENOENT") {
+        reject(new PhantomNotInstalledError());
+        return;
+      }
+      reject(err);
+    });
+
+    child.on("close", (code) => {
+      const result: PhantomExecResult = { stdout, stderr, code: code ?? 0 };
+      if (code !== 0 && !opts.allowFailure) {
+        reject(
+          new StackError(
+            "PHANTOM_EXEC_FAILED",
+            `phantom ${formatArgsForError(args)} failed (exit ${code}): ${stderr.trim() || stdout.trim()}`,
+          ),
+        );
+        return;
+      }
+      resolvePromise(result);
+    });
+  });
+}
+
+export async function addSecret(key: string, value: string, cwd?: string): Promise<void> {
+  await assertPhantomInstalled();
+  await exec(["add", key, value], { cwd });
+}
+
+export async function removeSecret(key: string, cwd?: string): Promise<void> {
+  await assertPhantomInstalled();
+  await exec(["remove", key], { cwd, allowFailure: true });
+}
+
+export async function listSecrets(cwd?: string): Promise<string[]> {
+  await assertPhantomInstalled();
+  const { stdout } = await exec(["list"], { cwd, allowFailure: true });
+  return stdout
+    .split("\n")
+    .map((line) => line.trim())
+    .filter((line) => line.length > 0 && !line.startsWith("#"));
+}
+
+export async function revealSecret(key: string, cwd?: string): Promise<string> {
+  await assertPhantomInstalled();
+  const { stdout } = await exec(["reveal", key], { cwd });
+  return stdout.trim();
+}
+
+export async function ensureInitialized(cwd?: string): Promise<void> {
+  await assertPhantomInstalled();
+  const result = await exec(["status"], { cwd, allowFailure: true });
+  if (result.code !== 0 || /not initialized/i.test(result.stdout + result.stderr)) {
+    await exec(["init"], { cwd, interactive: true });
+  }
+}
+
+export async function syncToPlatform(
+  platform: "vercel" | "railway" | "fly",
+  projectId: string,
+  cwd?: string,
+): Promise<void> {
+  await assertPhantomInstalled();
+  await exec(["sync", "--platform", platform, "--project", projectId], { cwd, interactive: true });
+}
+
+/**
+ * For tests only. Resets the installation-detection cache so a fake `phantom`
+ * binary placed on PATH by a test harness can be picked up.
+ */
+export function __resetPhantomCache(): void {
+  cachedInstalled = undefined;
+}
+
+/**
+ * Redact the secret value in phantom CLI arg lists before they're interpolated
+ * into any error message or log line. `phantom add <KEY> <VALUE>` is the main
+ * risk surface: without this, a non-zero exit would leak the raw secret in the
+ * thrown error. Also redacts `add-secret` just in case a future MCP sub-tool
+ * shells out with a different verb.
+ */
+function formatArgsForError(args: string[]): string {
+  const SENSITIVE_FOLLOWERS = new Set(["add", "add-secret"]);
+  const redacted = args.map((arg, i) => {
+    const prev = args[i - 1];
+    // For `add KEY VALUE`, the third arg (i=2 if args[0] is the verb) is the value.
+    if (SENSITIVE_FOLLOWERS.has(args[0]) && i === 2) return "<redacted>";
+    // `reveal KEY` has no secret value in args, but belt-and-suspenders for future verbs.
+    if (prev && SENSITIVE_FOLLOWERS.has(prev) && i === 2) return "<redacted>";
+    return arg;
+  });
+  return redacted.join(" ");
+}

package/src/pipeline.ts

@@ -0,0 +1,131 @@
+import {
+  type ServiceEntry,
+  type StackConfig,
+  readConfig,
+  writeConfig,
+} from "./config.ts";
+import { StackError } from "./errors.ts";
+import { addSecret, assertPhantomInstalled } from "./phantom.ts";
+import { mergeMcpEntry } from "./mcp-writer.ts";
+import { getProvider } from "./providers/index.ts";
+import type { LogEvent, ProviderContext } from "./providers/_base.ts";
+
+export interface AddServiceOpts {
+  providerName: string;
+  cwd?: string;
+  interactive?: boolean;
+  existingResourceId?: string;
+  hints?: Record<string, unknown>;
+  log?: (event: LogEvent) => void;
+  /** If false, skip persisting to .stack.toml (used by dry-run / preview). */
+  persist?: boolean;
+}
+
+export interface AddServiceResult {
+  providerName: string;
+  resourceId: string;
+  displayName: string;
+  secretCount: number;
+  mcpWired: boolean;
+  entry: ServiceEntry;
+}
+
+/**
+ * Full add-service pipeline: login → provision → materialize → write secrets
+ * → merge .mcp.json → update .stack.toml. Used by both `stack add` and
+ * `stack templates apply` so behaviour stays in lockstep.
+ */
+export async function addService(opts: AddServiceOpts): Promise<AddServiceResult> {
+  await assertPhantomInstalled();
+  const provider = await getProvider(opts.providerName);
+  const cwd = opts.cwd ?? process.cwd();
+  const config: StackConfig = await readConfig(cwd);
+
+  // Attaching to an existing resource id is always allowed — that's the path
+  // `stack doctor --fix` uses to re-run the pipeline for a degraded service.
+  if (config.services[provider.name] && !opts.existingResourceId) {
+    throw new StackError(
+      "SERVICE_ALREADY_ADDED",
+      `${provider.displayName} is already in this stack. Pass existingResourceId to re-attach, or remove it first.`,
+    );
+  }
+
+  const ctx: ProviderContext = {
+    cwd,
+    interactive: opts.interactive ?? process.stdout.isTTY === true,
+    log: opts.log ?? (() => {}),
+  };
+
+  const auth = await provider.login(ctx);
+  const resource = await provider.provision(ctx, auth, {
+    existingResourceId: opts.existingResourceId,
+    hints: opts.hints,
+  });
+
+  // Provision succeeded: from here on, any failure leaves a dangling upstream
+  // resource. Wrap the rest of the pipeline so we can persist a minimal
+  // breadcrumb entry to .stack.toml before re-throwing. This is what lets
+  // `stack doctor --fix` (or `stack remove`) clean up later — without the
+  // breadcrumb, the user has a live resource on the provider side with no
+  // local record at all.
+  try {
+    const materialized = await provider.materialize(ctx, resource, auth);
+
+    for (const [key, value] of Object.entries(materialized.secrets)) {
+      await addSecret(key, value, cwd);
+    }
+    if (materialized.mcp) await mergeMcpEntry(materialized.mcp, cwd);
+
+    const entry: ServiceEntry = {
+      provider: provider.name,
+      resource_id: resource.id,
+      region: resource.region,
+      secrets: Object.keys(materialized.secrets),
+      mcp: materialized.mcp?.name,
+      meta: resource.meta,
+      created_at: new Date().toISOString(),
+      created_by: "stack add",
+    };
+
+    if (opts.persist !== false) {
+      config.services[provider.name] = entry;
+      await writeConfig(config, cwd);
+    }
+
+    return {
+      providerName: provider.name,
+      resourceId: resource.id,
+      displayName: resource.displayName,
+      secretCount: Object.keys(materialized.secrets).length,
+      mcpWired: Boolean(materialized.mcp),
+      entry,
+    };
+  } catch (err) {
+    // Partial-failure breadcrumb: write just enough to .stack.toml that a
+    // later `stack doctor --fix` or `stack remove` can find the dangling
+    // upstream resource. We intentionally leave `secrets: []` — materialize
+    // didn't run to completion, so we don't know which vault keys (if any)
+    // were populated. Same goes for `mcp`: we don't know what the MCP entry
+    // would have been, so we don't claim to have wired one.
+    if (opts.persist !== false) {
+      const partial: ServiceEntry = {
+        provider: provider.name,
+        resource_id: resource.id,
+        region: resource.region,
+        secrets: [],
+        meta: resource.meta,
+        created_at: new Date().toISOString(),
+        created_by: "stack add (partial)",
+      };
+      try {
+        config.services[provider.name] = partial;
+        await writeConfig(config, cwd);
+      } catch {
+        // If even writing the breadcrumb fails, swallow — the original
+        // error below is the user-visible signal; we don't want to mask it
+        // with a disk-write failure.
+      }
+    }
+    throw err;
+  }
+}

package/src/providers/_api-key.ts

@@ -0,0 +1,122 @@
+import type { ServiceEntry } from "../config.ts";
+import { StackError } from "../errors.ts";
+import { addSecret } from "../phantom.ts";
+import { readLine, tryRevealSecret } from "./_helpers.ts";
+import type {
+  AuthHandle,
+  HealthStatus,
+  Materialized,
+  McpServerEntry,
+  Provider,
+  ProviderCategory,
+  ProviderContext,
+  Resource,
+} from "./_base.ts";
+
+/**
+ * Factory for API-key-paste providers (OpenAI, Anthropic, xAI, DeepSeek, Resend,
+ * PostHog-PAT, Upstash, Clerk, Railway, Fly). These providers don't provision
+ * upstream resources — they just validate a pasted key and route it into the
+ * Phantom vault under a canonical secret name.
+ */
+
+export interface ApiKeyProviderSpec {
+  name: string;
+  displayName: string;
+  category: ProviderCategory;
+  docs: string;
+  /** .env name for the key. Also the Phantom vault key. */
+  secretName: string;
+  /** Optional friendly instruction shown when prompting for the key. */
+  howTo: string;
+  /**
+   * Verify the pasted key against the provider's API. Return an identity object
+   * (e.g. org id, account email) on success, undefined on invalid.
+   */
+  verify(key: string): Promise<Record<string, string> | undefined>;
+  /** Optional dashboard URL (used by `stack open`). */
+  dashboard?: string;
+  /** Optional MCP server entry to wire into .mcp.json. */
+  mcp?: McpServerEntry;
+  /**
+   * Optional health check. Defaults to re-running `verify` against the stored
+   * secret, which is the right call for stateless API keys.
+   */
+  healthcheck?: (ctx: ProviderContext, entry: ServiceEntry) => Promise<HealthStatus>;
+}
+
+export function makeApiKeyProvider(spec: ApiKeyProviderSpec): Provider {
+  return {
+    name: spec.name,
+    displayName: spec.displayName,
+    category: spec.category,
+    authKind: "api_key",
+    docs: spec.docs,
+
+    async login(ctx: ProviderContext): Promise<AuthHandle> {
+      const cached = await tryRevealSecret(spec.secretName);
+      if (cached) {
+        const identity = await spec.verify(cached);
+        if (identity) return { token: cached, identity };
+        ctx.log({ level: "warn", msg: `Cached ${spec.displayName} key invalid; re-entering.` });
+      }
+      if (!ctx.interactive) {
+        throw new StackError(
+          `${spec.name.toUpperCase()}_AUTH_REQUIRED`,
+          `${spec.displayName}: no valid key in vault and session is non-interactive.`,
+        );
+      }
+      process.stderr.write(`\n  ${spec.howTo}\n  Paste your ${spec.displayName} API key: `);
+      const key = (await readLine()).trim();
+      if (!key) throw new StackError(`${spec.name.toUpperCase()}_AUTH_REQUIRED`, "No key provided.");
+      const identity = await spec.verify(key);
+      if (!identity)
+        throw new StackError(
+          `${spec.name.toUpperCase()}_AUTH_INVALID`,
+          `${spec.displayName} rejected that key.`,
+        );
+      // Persist the verified key immediately. Previously we deferred to
+      // `materialize()`, so if any step after `login()` threw (e.g. a
+      // provision-side API error) the user would have to re-paste their key.
+      // Matches the hand-written providers (supabase, neon, vercel, github, sentry).
+      await addSecret(spec.secretName, key);
+      return { token: key, identity };
+    },
+
+    async provision(_ctx, auth, opts): Promise<Resource> {
+      const id = opts.existingResourceId ?? auth.identity?.id ?? auth.identity?.org_id ?? "default";
+      return {
+        id,
+        displayName:
+          (auth.identity?.name as string | undefined) ??
+          (auth.identity?.email as string | undefined) ??
+          spec.displayName,
+        meta: auth.identity,
+      };
+    },
+
+    async materialize(_ctx, _resource, auth): Promise<Materialized> {
+      await addSecret(spec.secretName, auth.token);
+      return {
+        secrets: { [spec.secretName]: auth.token },
+        ...(spec.mcp ? { mcp: spec.mcp } : {}),
+      };
+    },
+
+    async healthcheck(ctx, entry) {
+      if (spec.healthcheck) return spec.healthcheck(ctx, entry);
+      const key = await tryRevealSecret(spec.secretName);
+      if (!key) return { kind: "error", detail: `${spec.secretName} missing from vault` };
+      const start = Date.now();
+      const identity = await spec.verify(key);
+      const latencyMs = Date.now() - start;
+      return identity ? { kind: "ok", latencyMs } : { kind: "error", detail: "key invalid" };
+    },
+
+    dashboardUrl() {
+      return spec.dashboard ?? "";
+    },
+  };
+}
+
+

package/src/providers/_base.ts

@@ -0,0 +1,96 @@
+import type { ServiceEntry } from "../config.ts";
+
+export type ProviderCategory =
+  | "database"
+  | "deploy"
+  | "cloud"
+  | "analytics"
+  | "errors"
+  | "ai"
+  | "payments"
+  | "code"
+  | "tickets"
+  | "email"
+  | "auth"
+  | "comms";
+
+export type AuthKind = "oauth_pkce" | "oauth_device" | "pat" | "api_key" | "cli_shell";
+
+export interface ProviderContext {
+  cwd: string;
+  /** If non-interactive (CI, agent), providers should fail fast instead of prompting. */
+  interactive: boolean;
+  /** Structured logger — callers wire this to the CLI's @clack spinner. */
+  log: (event: LogEvent) => void;
+}
+
+export interface LogEvent {
+  level: "info" | "warn" | "error";
+  msg: string;
+  data?: Record<string, unknown>;
+}
+
+export interface AuthHandle {
+  /** Opaque, provider-specific. Usually an access token or PAT. */
+  token: string;
+  /** Optional provider-side identity (user id, email, org id). */
+  identity?: Record<string, string>;
+  /** Epoch ms when token expires. Omit if non-expiring. */
+  expiresAt?: number;
+}
+
+export interface ProvisionOpts {
+  /** If the user already has a resource on the provider side, use this instead of creating. */
+  existingResourceId?: string;
+  /** Provider-specific provisioning hints (region, tier, org). */
+  hints?: Record<string, unknown>;
+}
+
+export interface Resource {
+  id: string;
+  displayName: string;
+  region?: string;
+  /** Provider-specific fields persisted into .stack.toml meta. */
+  meta?: Record<string, unknown>;
+}
+
+export interface Materialized {
+  /** Secrets to store in Phantom vault. Key is the .env name, value is the real secret. */
+  secrets: Record<string, string>;
+  /** Optional MCP server entry to merge into .mcp.json. */
+  mcp?: McpServerEntry;
+  /** Environment URLs or hints to expose in `stack status`. */
+  urls?: Record<string, string>;
+}
+
+export interface McpServerEntry {
+  name: string;
+  type?: "stdio" | "sse" | "http";
+  command?: string;
+  args?: string[];
+  url?: string;
+  env?: Record<string, string>;
+  headers?: Record<string, string>;
+}
+
+export type HealthStatus =
+  | { kind: "ok"; latencyMs?: number; detail?: string }
+  | { kind: "warn"; detail: string }
+  | { kind: "error"; detail: string };
+
+export interface Provider {
+  name: string;
+  displayName: string;
+  category: ProviderCategory;
+  authKind: AuthKind;
+  /** Human-readable docs URL for when something goes wrong. */
+  docs?: string;
+
+  login(ctx: ProviderContext): Promise<AuthHandle>;
+  provision(ctx: ProviderContext, auth: AuthHandle, opts: ProvisionOpts): Promise<Resource>;
+  materialize(ctx: ProviderContext, resource: Resource, auth: AuthHandle): Promise<Materialized>;
+
+  healthcheck?(ctx: ProviderContext, entry: ServiceEntry): Promise<HealthStatus>;
+  dashboardUrl?(entry: ServiceEntry): string;
+  deprovision?(ctx: ProviderContext, entry: ServiceEntry, auth: AuthHandle): Promise<void>;
+}