@ashlr/stack-core 0.1.1

package/src/providers/github.ts

@@ -0,0 +1,180 @@
+import type { ServiceEntry } from "../config.ts";
+import { StackError } from "../errors.ts";
+import { addSecret } from "../phantom.ts";
+import { fetchWithRetry } from "../http.ts";
+import { readLine, tryRevealSecret } from "./_helpers.ts";
+import { resolveOAuthClientId } from "../env.ts";
+import type {
+  AuthHandle,
+  HealthStatus,
+  Materialized,
+  Provider,
+  ProviderContext,
+  Resource,
+} from "./_base.ts";
+
+/**
+ * GitHub — OAuth device flow (no local redirect needed, works in SSH/remote
+ * sessions). Requires a GitHub OAuth App; we fall back to PAT paste when the
+ * client id isn't configured.
+ *
+ * Device flow: https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps#device-flow
+ */
+
+const TOKEN_SECRET = "GITHUB_TOKEN";
+const DEFAULT_SCOPE = "repo,read:org,read:user";
+
+const github: Provider = {
+  name: "github",
+  displayName: "GitHub",
+  category: "code",
+  authKind: "oauth_device",
+  docs: "https://docs.github.com/en/rest",
+
+  async login(ctx: ProviderContext): Promise<AuthHandle> {
+    const cached = await tryRevealSecret(TOKEN_SECRET);
+    if (cached) {
+      const identity = await fetchUser(cached);
+      if (identity) return { token: cached, identity };
+      ctx.log({ level: "warn", msg: "Cached GitHub token invalid; re-authenticating." });
+    }
+
+    const clientId = resolveOAuthClientId("github", process.env.GITHUB_STACK_CLIENT_ID);
+    if (clientId) {
+      const token = await runDeviceFlow(clientId);
+      const identity = await fetchUser(token);
+      if (!identity)
+        throw new StackError("GITHUB_AUTH_INVALID", "GitHub accepted the code but rejected the token.");
+      await addSecret(TOKEN_SECRET, token);
+      return { token, identity };
+    }
+
+    // PAT fallback.
+    if (!ctx.interactive)
+      throw new StackError("GITHUB_AUTH_REQUIRED", "Set GITHUB_STACK_CLIENT_ID or paste a PAT.");
+    process.stderr.write(
+      "\n  Create a GitHub PAT at https://github.com/settings/personal-access-tokens/new\n  Paste it here: ",
+    );
+    const token = (await readLine()).trim();
+    const identity = await fetchUser(token);
+    if (!identity) throw new StackError("GITHUB_AUTH_INVALID", "GitHub rejected that token.");
+    await addSecret(TOKEN_SECRET, token);
+    return { token, identity };
+  },
+
+  async provision(_ctx, auth, opts): Promise<Resource> {
+    const login = auth.identity?.login ?? "user";
+    if (opts.existingResourceId) {
+      return { id: opts.existingResourceId, displayName: opts.existingResourceId };
+    }
+    // v1 doesn't auto-create repos — users usually have a repo already. We
+    // attach to the account and surface the login as the resource id.
+    return { id: login, displayName: `@${login}` };
+  },
+
+  async materialize(_ctx, _resource, auth): Promise<Materialized> {
+    return {
+      secrets: { [TOKEN_SECRET]: auth.token },
+      mcp: {
+        name: "github",
+        type: "stdio",
+        command: "npx",
+        args: ["-y", "@modelcontextprotocol/server-github"],
+        env: { GITHUB_PERSONAL_ACCESS_TOKEN: `$(phantom reveal ${TOKEN_SECRET})` },
+      },
+    };
+  },
+
+  async healthcheck(_ctx, _entry: ServiceEntry): Promise<HealthStatus> {
+    const token = await tryRevealSecret(TOKEN_SECRET);
+    if (!token) return { kind: "error", detail: `${TOKEN_SECRET} missing from vault` };
+    const start = Date.now();
+    const user = await fetchUser(token);
+    const latencyMs = Date.now() - start;
+    return user ? { kind: "ok", latencyMs } : { kind: "error", detail: "token invalid" };
+  },
+
+  dashboardUrl(): string {
+    return "https://github.com";
+  },
+};
+
+export default github;
+
+async function fetchUser(token: string): Promise<Record<string, string> | undefined> {
+  try {
+    // Idempotent GET — retry transient 429s (GitHub's primary-rate-limit
+    // responses usually carry Retry-After) + 5xx from github.com.
+    const res = await fetchWithRetry("https://api.github.com/user", {
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/vnd.github+json",
+        "User-Agent": "ashlr-stack",
+      },
+    });
+    if (!res.ok) return undefined;
+    const body = (await res.json()) as Record<string, unknown>;
+    const out: Record<string, string> = {};
+    for (const [k, v] of Object.entries(body))
+      if (typeof v === "string" || typeof v === "number") out[k] = String(v);
+    return out;
+  } catch {
+    return undefined;
+  }
+}
+
+async function runDeviceFlow(clientId: string): Promise<string> {
+  // 1. Request device code.
+  const startRes = await fetch("https://github.com/login/device/code", {
+    method: "POST",
+    headers: { Accept: "application/json", "content-type": "application/json" },
+    body: JSON.stringify({ client_id: clientId, scope: DEFAULT_SCOPE }),
+  });
+  if (!startRes.ok)
+    throw new StackError("GITHUB_DEVICE_START_FAILED", `device/code ${startRes.status}`);
+  const {
+    device_code,
+    user_code,
+    verification_uri,
+    interval,
+    expires_in,
+  } = (await startRes.json()) as {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    interval: number;
+    expires_in: number;
+  };
+
+  process.stderr.write(
+    `\n  Visit ${verification_uri} and enter this code: ${user_code}\n  (waiting for approval…)\n`,
+  );
+
+  // 2. Poll for the token.
+  const deadline = Date.now() + expires_in * 1000;
+  let pollInterval = (interval ?? 5) * 1000;
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, pollInterval));
+    const res = await fetch("https://github.com/login/oauth/access_token", {
+      method: "POST",
+      headers: { Accept: "application/json", "content-type": "application/json" },
+      body: JSON.stringify({
+        client_id: clientId,
+        device_code,
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+      }),
+    });
+    const body = (await res.json()) as {
+      access_token?: string;
+      error?: string;
+      interval?: number;
+    };
+    if (body.access_token) return body.access_token;
+    if (body.error === "slow_down") pollInterval += 5000;
+    else if (body.error === "authorization_pending") continue;
+    else throw new StackError("GITHUB_DEVICE_FAILED", body.error ?? "unknown error");
+  }
+  throw new StackError("GITHUB_DEVICE_TIMEOUT", "Device flow timed out.");
+}
+
+

package/src/providers/index.ts

@@ -0,0 +1,59 @@
+import type { Provider } from "./_base.ts";
+import { ProviderNotFoundError } from "../errors.ts";
+
+/**
+ * Registry of curated providers. Entries are added in Waves 2–3 as each
+ * provider is implemented. Keeping this list explicit (no dynamic discovery)
+ * keeps the catalog curated and the bundle small.
+ */
+
+const registry: Record<string, () => Promise<Provider>> = {
+  // Wave 2 pilot — full upstream lifecycle via Management API.
+  supabase: async () => (await import("./supabase.ts")).default,
+
+  // Wave 3 — databases & deploy.
+  neon: async () => (await import("./neon.ts")).default,
+  turso: async () => (await import("./turso.ts")).default,
+  convex: async () => (await import("./convex.ts")).default,
+  vercel: async () => (await import("./vercel.ts")).default,
+  railway: async () => (await import("./railway.ts")).default,
+  fly: async () => (await import("./fly.ts")).default,
+  cloudflare: async () => (await import("./cloudflare.ts")).default,
+  render: async () => (await import("./render.ts")).default,
+  firebase: async () => (await import("./firebase.ts")).default,
+  upstash: async () => (await import("./upstash.ts")).default,
+
+  // Wave 3 — AI API keys (no upstream provisioning; paste + verify).
+  openai: async () => (await import("./openai.ts")).default,
+  anthropic: async () => (await import("./anthropic.ts")).default,
+  xai: async () => (await import("./xai.ts")).default,
+  deepseek: async () => (await import("./deepseek.ts")).default,
+  replicate: async () => (await import("./replicate.ts")).default,
+  braintrust: async () => (await import("./braintrust.ts")).default,
+  modal: async () => (await import("./modal.ts")).default,
+
+  // Wave 3 — analytics / errors / code / ops.
+  posthog: async () => (await import("./posthog.ts")).default,
+  sentry: async () => (await import("./sentry.ts")).default,
+  github: async () => (await import("./github.ts")).default,
+  linear: async () => (await import("./linear.ts")).default,
+  stripe: async () => (await import("./stripe.ts")).default,
+  resend: async () => (await import("./resend.ts")).default,
+  sendgrid: async () => (await import("./sendgrid.ts")).default,
+  mailgun: async () => (await import("./mailgun.ts")).default,
+  postmark: async () => (await import("./postmark.ts")).default,
+  clerk: async () => (await import("./clerk.ts")).default,
+  aws: async () => (await import("./aws.ts")).default,
+};
+
+export const providers = registry;
+
+export function listProviderNames(): string[] {
+  return Object.keys(registry).sort();
+}
+
+export async function getProvider(name: string): Promise<Provider> {
+  const loader = registry[name];
+  if (!loader) throw new ProviderNotFoundError(name);
+  return loader();
+}

package/src/providers/linear.ts

@@ -0,0 +1,46 @@
+import { makeApiKeyProvider } from "./_api-key.ts";
+import { verifyFetch } from "./_helpers.ts";
+
+/**
+ * Linear — v1 uses a personal API key (users create one at
+ * https://linear.app/settings/api). OAuth is deferred to when we register the
+ * Ashlr Stack app with Linear (see provider-auth-matrix.md).
+ */
+export default makeApiKeyProvider({
+  name: "linear",
+  displayName: "Linear",
+  category: "tickets",
+  docs: "https://developers.linear.app/docs",
+  secretName: "LINEAR_API_KEY",
+  howTo: "Create a personal API key at https://linear.app/settings/api",
+  dashboard: "https://linear.app",
+  mcp: {
+    name: "linear",
+    type: "stdio",
+    command: "npx",
+    args: ["-y", "mcp-linear"],
+    env: { LINEAR_API_KEY: "$(phantom reveal LINEAR_API_KEY)" },
+  },
+  async verify(key) {
+    try {
+      // GraphQL POST but a read-only `{ viewer }` query — opt-in idempotent.
+      const res = await verifyFetch("https://api.linear.app/graphql", {
+        method: "POST",
+        headers: { "content-type": "application/json", Authorization: key },
+        body: JSON.stringify({ query: "{ viewer { id name email } }" }),
+      });
+      if (!res.ok) return undefined;
+      const body = (await res.json()) as {
+        data?: { viewer?: { id: string; name: string; email: string } };
+      };
+      if (!body.data?.viewer?.id) return undefined;
+      return {
+        id: body.data.viewer.id,
+        name: body.data.viewer.name,
+        email: body.data.viewer.email,
+      };
+    } catch {
+      return undefined;
+    }
+  },
+});

package/src/providers/mailgun.ts

@@ -0,0 +1,26 @@
+import { makeApiKeyProvider } from "./_api-key.ts";
+import { verifyFetch } from "./_helpers.ts";
+
+// Mailgun's API uses HTTP Basic auth with the literal username `api` and the
+// API key as password, not a bearer token — hence the inlined base64 header.
+export default makeApiKeyProvider({
+  name: "mailgun",
+  displayName: "Mailgun",
+  category: "email",
+  docs: "https://documentation.mailgun.com/docs/mailgun/api-reference/",
+  secretName: "MAILGUN_API_KEY",
+  howTo: "Paste an API key from https://app.mailgun.com/settings/api_security.",
+  dashboard: "https://app.mailgun.com",
+  async verify(key) {
+    try {
+      const res = await verifyFetch("https://api.mailgun.net/v3/domains", {
+        headers: { Authorization: `Basic ${btoa(`api:${key}`)}` },
+      });
+      if (!res.ok) return undefined;
+      const body = (await res.json()) as { items?: Array<{ name: string }> };
+      return { domains: String(body.items?.length ?? 0) };
+    } catch {
+      return undefined;
+    }
+  },
+});

package/src/providers/modal.ts

@@ -0,0 +1,27 @@
+import { makeApiKeyProvider } from "./_api-key.ts";
+
+/**
+ * Modal — serverless GPU / sandbox platform for AI workloads. v1 accepts the
+ * token + token-secret pair (Modal uses two credentials: a token ID and a
+ * token secret, generated via `modal token new`). Users paste them separated
+ * by a colon: `<token-id>:<token-secret>`.
+ */
+export default makeApiKeyProvider({
+  name: "modal",
+  displayName: "Modal",
+  category: "deploy",
+  docs: "https://modal.com/docs",
+  secretName: "MODAL_TOKEN",
+  howTo:
+    "Run `modal token new` locally, then paste as `<token-id>:<token-secret>` (or create at https://modal.com/settings/tokens)",
+  dashboard: "https://modal.com",
+  async verify(key) {
+    if (!key.includes(":")) return undefined;
+    const [id, secret] = key.split(":");
+    if (!id || !secret) return undefined;
+    // Modal doesn't expose a public lightweight verify endpoint; we shape-check
+    // the token. First real API call (modal deploy) will surface any issue.
+    if (!id.startsWith("ak-") && !id.startsWith("as-")) return undefined;
+    return { token_id: id };
+  },
+});

package/src/providers/neon.ts

@@ -0,0 +1,175 @@
+import type { ServiceEntry } from "../config.ts";
+import { StackError } from "../errors.ts";
+import { addSecret } from "../phantom.ts";
+import { fetchWithRetry } from "../http.ts";
+import { readLine, tryRevealSecret } from "./_helpers.ts";
+import type {
+  AuthHandle,
+  HealthStatus,
+  Materialized,
+  Provider,
+  ProviderContext,
+  ProvisionOpts,
+  Resource,
+} from "./_base.ts";
+
+/**
+ * Neon — serverless Postgres. v1 uses a Neon API key (users create one at
+ * https://console.neon.tech/app/settings/api-keys). Provision creates a new
+ * project (and thus a default branch + database + role), materialize returns
+ * the connection string.
+ *
+ * API reference: https://api-docs.neon.tech/reference/getting-started-with-neon-api
+ */
+
+const API = "https://console.neon.tech/api/v2";
+const TOKEN_SECRET = "NEON_API_KEY";
+
+const neon: Provider = {
+  name: "neon",
+  displayName: "Neon",
+  category: "database",
+  authKind: "pat",
+  docs: "https://neon.tech/docs/reference/api-reference",
+
+  async login(ctx: ProviderContext): Promise<AuthHandle> {
+    const cached = await tryRevealSecret(TOKEN_SECRET);
+    if (cached) {
+      const identity = await fetchIdentity(cached);
+      if (identity) return { token: cached, identity };
+      ctx.log({ level: "warn", msg: "Cached Neon key invalid; re-entering." });
+    }
+    if (!ctx.interactive) throw new StackError("NEON_AUTH_REQUIRED", "No valid Neon API key in vault.");
+    process.stderr.write(
+      "\n  Create a Neon API key at https://console.neon.tech/app/settings/api-keys\n  Paste it here: ",
+    );
+    const token = (await readLine()).trim();
+    const identity = await fetchIdentity(token);
+    if (!identity) throw new StackError("NEON_AUTH_INVALID", "Neon rejected that API key.");
+    await addSecret(TOKEN_SECRET, token);
+    return { token, identity };
+  },
+
+  async provision(_ctx, auth, opts: ProvisionOpts): Promise<Resource> {
+    if (opts.existingResourceId) {
+      const project = await fetchProject(auth.token, opts.existingResourceId);
+      if (!project)
+        throw new StackError("NEON_PROJECT_NOT_FOUND", `No Neon project ${opts.existingResourceId}.`);
+      return toResource(project);
+    }
+    const name = `stack-${Date.now().toString(36)}`;
+    const region = (opts.hints?.region as string | undefined) ?? "aws-us-east-2";
+    const res = await fetch(`${API}/projects`, {
+      method: "POST",
+      headers: authHeaders(auth.token),
+      body: JSON.stringify({ project: { name, region_id: region } }),
+    });
+    if (!res.ok)
+      throw new StackError(
+        "NEON_CREATE_FAILED",
+        `Neon project creation failed (${res.status}): ${await res.text()}`,
+      );
+    const body = (await res.json()) as { project: NeonProject; connection_uris?: Array<{ connection_uri: string }> };
+    // Stash the fresh connection URI keyed by project id so it isn't confused
+    // with another project's DATABASE_URL. Also write the canonical slot (the
+    // current project's materialize call will overwrite it).
+    if (body.connection_uris?.[0]?.connection_uri) {
+      const uri = body.connection_uris[0].connection_uri;
+      await addSecret(`NEON_DATABASE_URL_${body.project.id}`, uri);
+      await addSecret("DATABASE_URL", uri);
+    }
+    return toResource(body.project);
+  },
+
+  async materialize(_ctx, resource, auth): Promise<Materialized> {
+    // Always fetch the connection URI from the API — the vault's DATABASE_URL
+    // is a generic key that may belong to another project or another provider.
+    // Don't trust it as a cache here.
+    const connectionUri = await fetchConnectionUri(auth.token, resource.id);
+    if (!connectionUri)
+      throw new StackError(
+        "NEON_CONNECTION_UNAVAILABLE",
+        `Couldn't obtain a connection string for Neon project ${resource.id}.`,
+      );
+    return {
+      secrets: {
+        NEON_API_KEY: auth.token,
+        DATABASE_URL: connectionUri,
+      },
+      urls: { dashboard: `https://console.neon.tech/app/projects/${resource.id}` },
+    };
+  },
+
+  async healthcheck(_ctx, entry: ServiceEntry): Promise<HealthStatus> {
+    const token = await tryRevealSecret(TOKEN_SECRET);
+    if (!token) return { kind: "error", detail: `${TOKEN_SECRET} missing from vault` };
+    if (!entry.resource_id) return { kind: "warn", detail: "no resource_id" };
+    const start = Date.now();
+    const project = await fetchProject(token, entry.resource_id);
+    const latencyMs = Date.now() - start;
+    return project ? { kind: "ok", latencyMs } : { kind: "error", detail: "project not found" };
+  },
+
+  dashboardUrl(entry: ServiceEntry): string {
+    return entry.resource_id
+      ? `https://console.neon.tech/app/projects/${entry.resource_id}`
+      : "https://console.neon.tech";
+  },
+};
+
+export default neon;
+
+interface NeonProject {
+  id: string;
+  name: string;
+  region_id: string;
+}
+
+function authHeaders(token: string): HeadersInit {
+  return {
+    Authorization: `Bearer ${token}`,
+    "content-type": "application/json",
+    Accept: "application/json",
+  };
+}
+
+async function fetchIdentity(token: string): Promise<Record<string, string> | undefined> {
+  try {
+    // Idempotent GET — retry transient failures so a flaky Neon console
+    // gateway doesn't force the user to re-paste their API key.
+    const res = await fetchWithRetry(`${API}/users/me`, { headers: authHeaders(token) });
+    if (!res.ok) return undefined;
+    const body = (await res.json()) as Record<string, unknown>;
+    const out: Record<string, string> = {};
+    for (const [k, v] of Object.entries(body)) if (typeof v === "string") out[k] = v;
+    return out;
+  } catch {
+    return undefined;
+  }
+}
+
+async function fetchProject(token: string, id: string): Promise<NeonProject | undefined> {
+  // Idempotent GET — healthcheck + doctor both call this on every loop.
+  const res = await fetchWithRetry(`${API}/projects/${id}`, { headers: authHeaders(token) });
+  if (res.status === 404) return undefined;
+  if (!res.ok) return undefined;
+  const body = (await res.json()) as { project: NeonProject };
+  return body.project;
+}
+
+async function fetchConnectionUri(token: string, projectId: string): Promise<string | undefined> {
+  // Idempotent GET — retry transient failures so healthcheck + materialize
+  // don't flap on a single flaky Neon gateway response.
+  const res = await fetchWithRetry(`${API}/projects/${projectId}/connection_uri`, {
+    headers: authHeaders(token),
+  });
+  if (!res.ok) return undefined;
+  const body = (await res.json()) as { uri?: string };
+  return body.uri;
+}
+
+function toResource(project: NeonProject): Resource {
+  return { id: project.id, displayName: project.name, region: project.region_id };
+}
+
+

package/src/providers/openai.ts

@@ -0,0 +1,24 @@
+import { makeApiKeyProvider } from "./_api-key.ts";
+import { verifyFetch } from "./_helpers.ts";
+
+export default makeApiKeyProvider({
+  name: "openai",
+  displayName: "OpenAI",
+  category: "ai",
+  docs: "https://platform.openai.com/docs/api-reference",
+  secretName: "OPENAI_API_KEY",
+  howTo: "Create a key at https://platform.openai.com/api-keys",
+  dashboard: "https://platform.openai.com",
+  async verify(key) {
+    try {
+      const res = await verifyFetch("https://api.openai.com/v1/models", {
+        headers: { Authorization: `Bearer ${key}` },
+      });
+      if (!res.ok) return undefined;
+      const body = (await res.json()) as { data?: Array<{ id: string }> };
+      return { models: String(body.data?.length ?? 0) };
+    } catch {
+      return undefined;
+    }
+  },
+});

package/src/providers/posthog.ts

@@ -0,0 +1,30 @@
+import { makeApiKeyProvider } from "./_api-key.ts";
+import { verifyFetch } from "./_helpers.ts";
+
+export default makeApiKeyProvider({
+  name: "posthog",
+  displayName: "PostHog",
+  category: "analytics",
+  docs: "https://posthog.com/docs/api",
+  secretName: "POSTHOG_PERSONAL_API_KEY",
+  howTo: "Create a personal API key at https://app.posthog.com/me/settings (scope: all)",
+  dashboard: "https://app.posthog.com",
+  mcp: {
+    name: "posthog",
+    type: "sse",
+    url: "https://mcp.posthog.com/sse",
+    headers: { Authorization: "Bearer $(phantom reveal POSTHOG_PERSONAL_API_KEY)" },
+  },
+  async verify(key) {
+    try {
+      const res = await verifyFetch("https://app.posthog.com/api/projects", {
+        headers: { Authorization: `Bearer ${key}` },
+      });
+      if (!res.ok) return undefined;
+      const body = (await res.json()) as { results?: Array<{ id: number; name: string }> };
+      return { projects: String(body.results?.length ?? 0) };
+    } catch {
+      return undefined;
+    }
+  },
+});

package/src/providers/postmark.ts

@@ -0,0 +1,27 @@
+import { makeApiKeyProvider } from "./_api-key.ts";
+import { verifyFetch } from "./_helpers.ts";
+
+export default makeApiKeyProvider({
+  name: "postmark",
+  displayName: "Postmark",
+  category: "email",
+  docs: "https://postmarkapp.com/developer/api/overview",
+  secretName: "POSTMARK_ACCOUNT_TOKEN",
+  howTo: "Paste an account token from https://account.postmarkapp.com/api_tokens.",
+  dashboard: "https://account.postmarkapp.com",
+  async verify(key) {
+    try {
+      const res = await verifyFetch("https://api.postmarkapp.com/servers", {
+        headers: {
+          "X-Postmark-Account-Token": key,
+          Accept: "application/json",
+        },
+      });
+      if (!res.ok) return undefined;
+      const body = (await res.json()) as { Servers?: Array<{ ID: number }> };
+      return { servers: String(body.Servers?.length ?? 0) };
+    } catch {
+      return undefined;
+    }
+  },
+});

package/src/providers/railway.ts

@@ -0,0 +1,35 @@
+import { makeApiKeyProvider } from "./_api-key.ts";
+import { verifyFetch } from "./_helpers.ts";
+
+export default makeApiKeyProvider({
+  name: "railway",
+  displayName: "Railway",
+  category: "deploy",
+  docs: "https://docs.railway.app/reference/public-api",
+  secretName: "RAILWAY_TOKEN",
+  howTo: "Create a team or personal token at https://railway.app/account/tokens",
+  dashboard: "https://railway.app/dashboard",
+  async verify(key) {
+    try {
+      // GraphQL POST, but it's a read-only `{ me }` query — safe to retry,
+      // so we explicitly opt the helper into idempotent semantics.
+      const res = await verifyFetch("https://backboard.railway.app/graphql/v2", {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          Authorization: `Bearer ${key}`,
+        },
+        body: JSON.stringify({ query: "{ me { id email } }" }),
+      });
+      if (!res.ok) return undefined;
+      const body = (await res.json()) as { data?: { me?: { id?: string; email?: string } } };
+      if (!body.data?.me?.id) return undefined;
+      return {
+        id: body.data.me.id,
+        ...(body.data.me.email ? { email: body.data.me.email } : {}),
+      };
+    } catch {
+      return undefined;
+    }
+  },
+});

package/src/providers/render.ts

@@ -0,0 +1,31 @@
+import { makeApiKeyProvider } from "./_api-key.ts";
+import { verifyFetch } from "./_helpers.ts";
+
+/**
+ * Render — managed deploys for web services, static sites, private services.
+ * v1 accepts a user API key (create at https://dashboard.render.com/u/settings).
+ * Verification hits /v1/owners.
+ */
+export default makeApiKeyProvider({
+  name: "render",
+  displayName: "Render",
+  category: "deploy",
+  docs: "https://api-docs.render.com",
+  secretName: "RENDER_API_KEY",
+  howTo: "Create an API key at https://dashboard.render.com/u/settings",
+  dashboard: "https://dashboard.render.com",
+  async verify(key) {
+    try {
+      const res = await verifyFetch("https://api.render.com/v1/owners", {
+        headers: { Authorization: `Bearer ${key}`, Accept: "application/json" },
+      });
+      if (!res.ok) return undefined;
+      const body = (await res.json()) as Array<{ owner?: { id?: string; name?: string } }>;
+      const first = body[0]?.owner;
+      if (!first?.id) return undefined;
+      return { id: first.id, name: first.name ?? "" };
+    } catch {
+      return undefined;
+    }
+  },
+});