anhedral 0.10.0 → 0.11.0

package/dist/providers/adapters.js

@@ -0,0 +1,269 @@
+import { object, list, text, resourceId } from './api.js';
+import { setting } from './config.js';
+function result(resources, runtime, nextActions = [], ready = true) {
+    return { resources, runtime, ready, nextActions };
+}
+const create = (context, key, route, body) => context.state.create(context.id, key, context.api, route, body);
+function same(value, expected, description) {
+    if (value !== expected)
+        throw new Error(`Provider ${description} differs from the selected configuration.`);
+}
+async function neon(context) {
+    const { settings: config, api } = context;
+    let id = setting(config, 'projectId');
+    if (!id) {
+        const response = await create(context, 'project', '/api/v2/projects', {
+            project: {
+                name: setting(config, 'name'),
+                org_id: setting(config, 'organizationId'),
+                region_id: setting(config, 'region'),
+                default_branch: {
+                    name: 'main',
+                    database_name: setting(config, 'database'),
+                    role_name: setting(config, 'role'),
+                },
+            },
+        });
+        id = resourceId(object(response.project).id);
+    }
+    id = resourceId(id);
+    const project = object(object(await api(`/api/v2/projects/${id}`)).project);
+    same(project.org_id, setting(config, 'organizationId'), 'Neon organization');
+    if (project.suspended === true)
+        throw new Error('Neon project is suspended.');
+    const operations = list(object(await api(`/api/v2/projects/${id}/operations`)).operations);
+    if (operations.some((operation) => !['finished', 'skipped'].includes(String(operation.status))))
+        return result({ project: id }, {}, ['Neon operations are pending or failed. Inspect the project, then run ship again.'], false);
+    const query = new URLSearchParams({
+        database_name: setting(config, 'database'),
+        role_name: setting(config, 'role'),
+        pooled: 'true',
+    });
+    const uri = text(object(await api(`/api/v2/projects/${id}/connection_uri?${query}`)).uri);
+    const parsed = new URL(uri);
+    if (!['postgres:', 'postgresql:'].includes(parsed.protocol) ||
+        !parsed.hostname.endsWith('.neon.tech'))
+        throw new Error('Neon returned an unexpected database connection.');
+    return result({ project: id }, { DATABASE_URL: uri });
+}
+async function clerk(context) {
+    const { settings: config, api } = context;
+    const principal = object(await api('/v1/platform/me'));
+    same(principal.subject, setting(config, 'workspaceId'), 'Clerk workspace');
+    let id = setting(config, 'applicationId');
+    if (!id)
+        id = resourceId((await create(context, 'application', '/v1/platform/applications', {
+            name: setting(config, 'name'),
+            environment_types: [setting(config, 'environment')],
+        })).application_id);
+    id = resourceId(id);
+    const application = object(await api(`/v1/platform/applications/${id}?include_secret_keys=true`));
+    same(application.application_id, id, 'Clerk application');
+    const instances = list(application.instances).filter((instance) => instance.environment_type === config.environment);
+    if (instances.length !== 1)
+        throw new Error('Clerk did not return exactly one selected environment.');
+    const instance = instances[0];
+    const publishable = text(instance.publishable_key);
+    const secret = text(instance.secret_key);
+    const mode = config.environment === 'production' ? 'live' : 'test';
+    if (!publishable.startsWith(`pk_${mode}_`) || !secret.startsWith(`sk_${mode}_`))
+        throw new Error('Clerk keys do not match the selected environment.');
+    return result({ application: id, instance: resourceId(instance.instance_id) }, {
+        CLERK_SECRET_KEY: secret,
+        CLERK_PUBLISHABLE_KEY: publishable,
+        NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: publishable,
+    }, config.environment === 'production'
+        ? ['Verify the production Clerk domain, DNS and enabled OAuth providers before delivery.']
+        : []);
+}
+async function resend(context) {
+    const { settings: config, api } = context;
+    let id = setting(config, 'domainId');
+    if (!id)
+        id = resourceId((await create(context, 'domain', '/domains', {
+            name: setting(config, 'domain'),
+            ...(setting(config, 'region') ? { region: config.region } : {}),
+        })).id);
+    id = resourceId(id);
+    let domain = object(await api(`/domains/${id}`));
+    same(domain.name, setting(config, 'domain'), 'Resend domain');
+    if (domain.status !== 'verified') {
+        await api(`/domains/${id}/verify`, 'POST');
+        domain = object(await api(`/domains/${id}`));
+    }
+    if (domain.status !== 'verified') {
+        const records = list(domain.records).map((record) => `${text(record.type)} ${text(record.name)} ${text(record.value)}${record.priority === undefined ? '' : ` (priority ${Number(record.priority)})`}`);
+        return result({ domain: id }, {}, ['Publish the Resend DNS records, wait for verification, then run ship again.', ...records], false);
+    }
+    const key = await create(context, 'sending-key', '/api-keys', {
+        name: `anhedral-${id}`.slice(0, 50),
+        permission: 'sending_access',
+        domain_id: id,
+    });
+    const keys = object(await api('/api-keys'));
+    if (keys.has_more === true || !list(keys.data).some((entry) => entry.id === key.id))
+        throw new Error('Resend did not confirm the recorded sending key; inspect key access before configuring runtime.');
+    return result({ domain: id, sendingKey: resourceId(key.id) }, { RESEND_API_KEY: text(key.token) });
+}
+async function stripe(context) {
+    const { settings: config, api, environment } = context;
+    const account = object(await api('/v1/account'));
+    same(account.id, setting(config, 'accountId'), 'Stripe account');
+    const key = text(environment.STRIPE_SECRET_KEY);
+    const prefix = config.mode === 'live' ? /^(sk|rk)_live_/ : /^(sk|rk)_test_/;
+    if (!prefix.test(key))
+        throw new Error('Stripe key does not match the selected test/live mode.');
+    const resources = { account: resourceId(account.id) };
+    const runtime = { STRIPE_SECRET_KEY: key };
+    if (setting(config, 'webhookUrl')) {
+        const webhook = await create(context, 'webhook', '/v1/webhook_endpoints', {
+            url: config.webhookUrl,
+            enabled_events: config.webhookEvents,
+        });
+        const id = resourceId(webhook.id);
+        const current = object(await api(`/v1/webhook_endpoints/${id}`));
+        same(current.url, setting(config, 'webhookUrl'), 'Stripe webhook URL');
+        same(current.livemode, config.mode === 'live', 'Stripe webhook mode');
+        if (current.status !== 'enabled' ||
+            !Array.isArray(current.enabled_events) ||
+            JSON.stringify([...current.enabled_events].sort()) !==
+                JSON.stringify([...config.webhookEvents].sort()))
+            throw new Error('Stripe webhook is disabled or its events differ from the selected configuration.');
+        resources.webhook = id;
+        runtime.STRIPE_WEBHOOK_SECRET = text(webhook.secret);
+    }
+    return result(resources, runtime, config.mode === 'live' && account.charges_enabled !== true
+        ? ['Complete Stripe account activation before accepting live payments.']
+        : []);
+}
+async function sentry(context) {
+    const { settings: config, api } = context;
+    const organization = resourceId(config.organization);
+    const team = resourceId(config.team);
+    const slug = resourceId(config.project);
+    const projects = list(await api(`/api/0/teams/${organization}/${team}/projects/`));
+    const matching = projects.filter((project) => project.slug === slug);
+    if (matching.length > 1)
+        throw new Error('Sentry project selection is ambiguous.');
+    if (!matching.length)
+        await create(context, 'project', `/api/0/teams/${organization}/${team}/projects/`, {
+            name: setting(config, 'name') || slug,
+            slug,
+            platform: config.platform,
+            default_rules: false,
+        });
+    const project = object(await api(`/api/0/projects/${organization}/${slug}/`));
+    same(object(project.organization).slug, organization, 'Sentry organization');
+    same(project.platform, setting(config, 'platform'), 'Sentry platform');
+    if (!list(project.teams).some((entry) => entry.slug === team))
+        throw new Error('Sentry project belongs to a different team.');
+    let keys = list(await api(`/api/0/projects/${organization}/${slug}/keys/`)).filter((key) => key.isActive === true);
+    if (!keys.length) {
+        await create(context, 'client-key', `/api/0/projects/${organization}/${slug}/keys/`, {
+            name: 'Anhedral',
+        });
+        keys = list(await api(`/api/0/projects/${organization}/${slug}/keys/`)).filter((key) => key.isActive === true);
+    }
+    if (keys.length !== 1)
+        throw new Error('Select exactly one active Sentry client key before configuring.');
+    const dsn = text(object(keys[0].dsn).public);
+    if (new URL(dsn).protocol !== 'https:')
+        throw new Error('Sentry DSN must use HTTPS.');
+    return result({ project: resourceId(project.id) }, { SENTRY_DSN: dsn });
+}
+async function posthog(context) {
+    const { settings: config, api } = context;
+    const organization = resourceId(config.organizationId);
+    let id = setting(config, 'projectId');
+    if (!id)
+        id = resourceId((await create(context, 'project', `/api/organizations/${organization}/projects/`, {
+            name: config.name,
+        })).id);
+    id = resourceId(id);
+    const project = object(await api(`/api/organizations/${organization}/projects/${id}/`));
+    same(resourceId(project.id), id, 'PostHog project');
+    same(project.organization, organization, 'PostHog organization');
+    return result({ project: id }, {
+        POSTHOG_API_KEY: text(project.api_token),
+        POSTHOG_HOST: config.region === 'eu' ? 'https://eu.i.posthog.com' : 'https://us.i.posthog.com',
+    });
+}
+async function openai(context) {
+    const { settings: config, api } = context;
+    let id = setting(config, 'projectId');
+    if (!id)
+        id = resourceId((await create(context, 'project', '/v1/organization/projects', { name: config.name })).id);
+    id = resourceId(id);
+    const project = object(await api(`/v1/organization/projects/${id}`));
+    same(project.id, id, 'OpenAI project');
+    if (project.status !== 'active')
+        throw new Error('OpenAI project is not active.');
+    const account = await create(context, 'service-account', `/v1/organization/projects/${id}/service_accounts`, { name: config.serviceAccountName });
+    const accountId = resourceId(account.id);
+    const current = object(await api(`/v1/organization/projects/${id}/service_accounts/${accountId}`));
+    same(current.id, accountId, 'OpenAI service account');
+    same(current.name, setting(config, 'serviceAccountName'), 'OpenAI service account name');
+    return result({ project: id, serviceAccount: accountId }, { OPENAI_API_KEY: text(object(account.api_key).value) });
+}
+async function revenuecat(context) {
+    const { settings: config, api } = context;
+    let id = setting(config, 'projectId');
+    if (!id)
+        id = resourceId((await create(context, 'project', '/v2/projects', { name: config.name })).id);
+    id = resourceId(id);
+    const project = object(await api(`/v2/projects/${id}`));
+    same(project.id, id, 'RevenueCat project');
+    const resources = { project: id };
+    const runtime = {};
+    if (setting(config, 'webAppId') || setting(config, 'stripeAccountId')) {
+        let appId = setting(config, 'webAppId');
+        if (!appId)
+            appId = resourceId((await create(context, 'web-app', `/v2/projects/${id}/apps`, {
+                name: `${setting(config, 'name') || id} web`,
+                type: 'stripe',
+                stripe: { stripe_account_id: config.stripeAccountId },
+            })).id);
+        appId = resourceId(appId);
+        const app = object(await api(`/v2/projects/${id}/apps/${appId}`));
+        same(app.type, 'stripe', 'RevenueCat web app');
+        if (setting(config, 'stripeAccountId'))
+            same(object(app.stripe).stripe_account_id, config.stripeAccountId, 'RevenueCat Stripe account');
+        resources.webApp = appId;
+    }
+    for (const platform of ['ios', 'android']) {
+        const type = platform === 'ios' ? 'app_store' : 'play_store';
+        const identifier = setting(config, platform === 'ios' ? 'bundleId' : 'packageName');
+        let appId = setting(config, `${platform}AppId`);
+        if (!identifier && !appId)
+            continue;
+        if (!appId)
+            appId = resourceId((await create(context, `${platform}-app`, `/v2/projects/${id}/apps`, {
+                name: `${setting(config, 'name') || id} ${platform}`,
+                type,
+                [type]: { [platform === 'ios' ? 'bundle_id' : 'package_name']: identifier },
+            })).id);
+        appId = resourceId(appId);
+        const app = object(await api(`/v2/projects/${id}/apps/${appId}`));
+        same(app.type, type, 'RevenueCat app platform');
+        if (identifier)
+            same(object(app[type])[platform === 'ios' ? 'bundle_id' : 'package_name'], identifier, 'RevenueCat app identifier');
+        const keys = list(object(await api(`/v2/projects/${id}/apps/${appId}/public_api_keys`)).items).filter((entry) => entry.app_id === appId && entry.environment === 'production');
+        if (keys.length !== 1)
+            throw new Error('RevenueCat must return exactly one production public SDK key per app.');
+        resources[`${platform}App`] = appId;
+        runtime[`EXPO_PUBLIC_REVENUECAT_${platform.toUpperCase()}_API_KEY`] = text(keys[0].key);
+    }
+    return result(resources, runtime, [
+        'Configure store credentials or the Stripe connection, products and offerings and verify purchases before enabling billing. SDK keys alone do not activate subscriptions.',
+    ]);
+}
+export const PROVIDER_ADAPTERS = {
+    neon,
+    clerk,
+    resend,
+    stripe,
+    revenuecat,
+    sentry,
+    posthog,
+    openai,
+};

package/dist/providers/api.d.ts

@@ -0,0 +1,28 @@
+import type { IntegrationProvider, ProviderSettings } from './config.js';
+export type ApiObject = Record<string, unknown>;
+export declare function object(value: unknown): ApiObject;
+export declare function list(value: unknown): ApiObject[];
+export declare function text(value: unknown): string;
+export declare function resourceId(value: unknown): string;
+export declare function digest(value: unknown): string;
+export declare const CREDENTIALS: Record<IntegrationProvider, string>;
+export interface ApiRequest {
+    (route: string, method?: 'GET' | 'POST' | 'PATCH', body?: ApiObject, operation?: string): Promise<unknown>;
+}
+export declare class ProviderRequestError extends Error {
+    readonly rejected: boolean;
+    readonly status?: number | undefined;
+    constructor(message: string, rejected: boolean, status?: number | undefined);
+}
+export interface ProviderRetryOptions {
+    /** Reads only; provider mutations always receive exactly one attempt. */
+    maxAttempts?: number;
+    totalTimeoutMs?: number;
+    attemptTimeoutMs?: number;
+    baseDelayMs?: number;
+    maxDelayMs?: number;
+    delay?: (milliseconds: number) => Promise<void>;
+}
+/** Fixed origins, bounded reads and sanitized errors keep management keys out of output.
+ * Only GET requests retry transient failures; unknown mutation outcomes never replay. */
+export declare function providerApi(id: IntegrationProvider, settings: ProviderSettings, environment: NodeJS.ProcessEnv, send: typeof fetch, options?: ProviderRetryOptions): ApiRequest;

package/dist/providers/api.js

@@ -0,0 +1,252 @@
+import { createHash } from 'node:crypto';
+import { PROVIDER_DEFINITIONS } from './definitions.js';
+export function object(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('Provider returned an invalid resource.');
+    return value;
+}
+export function list(value) {
+    if (!Array.isArray(value))
+        throw new Error('Provider returned an invalid resource list.');
+    return value.map(object);
+}
+export function text(value) {
+    if (typeof value !== 'string' || !value || value.length > 16384 || /[\r\n\x00]/.test(value))
+        throw new Error('Provider returned an invalid resource field.');
+    return value;
+}
+export function resourceId(value) {
+    const id = typeof value === 'number' && Number.isSafeInteger(value) && value > 0
+        ? String(value)
+        : text(value);
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,254}$/.test(id))
+        throw new Error('Provider returned an invalid resource ID.');
+    return id;
+}
+export function digest(value) {
+    const canonical = (item) => Array.isArray(item)
+        ? item.map(canonical)
+        : item && typeof item === 'object'
+            ? Object.fromEntries(Object.entries(item)
+                .sort(([a], [b]) => a.localeCompare(b))
+                .map(([key, entry]) => [key, canonical(entry)]))
+            : item;
+    return createHash('sha256')
+        .update(JSON.stringify(canonical(value)))
+        .digest('hex');
+}
+export const CREDENTIALS = Object.fromEntries(Object.entries(PROVIDER_DEFINITIONS).map(([id, definition]) => [id, definition.credential]));
+export class ProviderRequestError extends Error {
+    rejected;
+    status;
+    constructor(message, rejected, status) {
+        super(message);
+        this.rejected = rejected;
+        this.status = status;
+    }
+}
+class TransportFailure extends Error {
+}
+class RequestTimeout extends TransportFailure {
+}
+function retryPolicy(options) {
+    const policy = {
+        maxAttempts: options.maxAttempts ?? 3,
+        totalTimeoutMs: options.totalTimeoutMs ?? 30_000,
+        attemptTimeoutMs: options.attemptTimeoutMs ?? 10_000,
+        baseDelayMs: options.baseDelayMs ?? 100,
+        maxDelayMs: options.maxDelayMs ?? 2_000,
+        delay: options.delay ??
+            ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds))),
+    };
+    if (!Number.isInteger(policy.maxAttempts) ||
+        policy.maxAttempts < 1 ||
+        policy.maxAttempts > 5 ||
+        [policy.totalTimeoutMs, policy.attemptTimeoutMs].some((value) => !Number.isInteger(value) || value < 1 || value > 30_000) ||
+        [policy.baseDelayMs, policy.maxDelayMs].some((value) => !Number.isInteger(value) || value < 0 || value > 2_000) ||
+        policy.baseDelayMs > policy.maxDelayMs ||
+        typeof policy.delay !== 'function')
+        throw new Error('Invalid bounded provider retry policy.');
+    return policy;
+}
+async function deadline(milliseconds, operation) {
+    const controller = new AbortController();
+    let timer;
+    const timeout = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => {
+            controller.abort();
+            reject(new RequestTimeout());
+        }, milliseconds);
+    });
+    try {
+        return await Promise.race([operation(controller.signal), timeout]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+function cancelBody(response) {
+    try {
+        void response.body?.cancel().catch(() => undefined);
+    }
+    catch {
+        /* Cancellation is best effort; diagnostics stay sanitized. */
+    }
+}
+async function responseJson(id, response, signal) {
+    if (signal.aborted) {
+        cancelBody(response);
+        throw new RequestTimeout();
+    }
+    const reader = response.body?.getReader();
+    if (!reader)
+        throw new Error(`${id}: provider returned an empty response.`);
+    const cancel = () => {
+        void reader.cancel().catch(() => undefined);
+    };
+    signal.addEventListener('abort', cancel, { once: true });
+    const chunks = [];
+    let bytes = 0;
+    try {
+        for (;;) {
+            let chunk;
+            try {
+                chunk = await reader.read();
+            }
+            catch {
+                throw new TransportFailure();
+            }
+            if (chunk.done)
+                break;
+            bytes += chunk.value.length;
+            if (bytes > 2 * 1024 * 1024)
+                throw new Error('Response exceeded size limit.');
+            chunks.push(chunk.value);
+        }
+        return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    }
+    catch (error) {
+        cancel();
+        if (signal.aborted)
+            throw new RequestTimeout();
+        if (error instanceof TransportFailure)
+            throw error;
+        throw new Error(`${id}: provider returned invalid or oversized JSON.`);
+    }
+    finally {
+        signal.removeEventListener('abort', cancel);
+        reader.releaseLock();
+    }
+}
+function requestedDelay(value, maximum) {
+    if (!value)
+        return 0;
+    const milliseconds = /^\d+(?:\.\d+)?$/.test(value)
+        ? Number(value) * 1000
+        : Date.parse(value) - Date.now();
+    if (!Number.isFinite(milliseconds))
+        return 0;
+    // Do not retry sooner than a provider's long waiting requirement. Return the
+    // sanitized error when that wait exceeds this deliberately short retry budget.
+    return milliseconds > maximum ? undefined : Math.max(0, Math.ceil(milliseconds));
+}
+/** Fixed origins, bounded reads and sanitized errors keep management keys out of output.
+ * Only GET requests retry transient failures; unknown mutation outcomes never replay. */
+export function providerApi(id, settings, environment, send, options = {}) {
+    const token = environment[CREDENTIALS[id]];
+    if (!token || /[^\x21-\x7e]/.test(token))
+        throw new Error(`${id}: supply ${CREDENTIALS[id]}.`);
+    const policy = retryPolicy(options);
+    const definition = PROVIDER_DEFINITIONS[id];
+    const origin = definition.regionalOrigins?.[settings.region ?? ''] ?? definition.origin;
+    return async (route, method = 'GET', body, operation) => {
+        if (!route.startsWith('/') ||
+            route.startsWith('//') ||
+            route.includes('..') ||
+            /[\r\n#\\]/.test(route))
+            throw new Error('Invalid provider API path.');
+        const url = new URL(route, origin);
+        if (url.origin !== origin)
+            throw new Error('Provider API origin changed.');
+        const headers = {
+            Authorization: `Bearer ${token}`,
+            Accept: 'application/json',
+        };
+        let payload;
+        if (body) {
+            if (id === 'stripe') {
+                const form = new URLSearchParams();
+                for (const [key, value] of Object.entries(body)) {
+                    if (Array.isArray(value))
+                        for (const entry of value)
+                            form.append(`${key}[]`, String(entry));
+                    else
+                        form.set(key, String(value));
+                }
+                payload = form.toString();
+                headers['Content-Type'] = 'application/x-www-form-urlencoded';
+            }
+            else {
+                payload = JSON.stringify(body);
+                headers['Content-Type'] = 'application/json';
+            }
+        }
+        if (operation && (id === 'stripe' || id === 'resend'))
+            headers['Idempotency-Key'] = operation;
+        const started = performance.now();
+        const attempts = method === 'GET' ? policy.maxAttempts : 1;
+        for (let attempt = 0; attempt < attempts; attempt++) {
+            const remaining = policy.totalTimeoutMs - (performance.now() - started);
+            if (remaining <= 0)
+                throw new Error(`${id}: provider read retry deadline exceeded.`);
+            let retryAfter = 0;
+            try {
+                return await deadline(Math.min(remaining, method === 'GET' ? policy.attemptTimeoutMs : policy.totalTimeoutMs), async (signal) => {
+                    let response;
+                    try {
+                        response = await send(url.toString(), {
+                            method,
+                            headers,
+                            body: payload,
+                            redirect: 'error',
+                            signal,
+                        });
+                    }
+                    catch {
+                        throw new TransportFailure();
+                    }
+                    if (!response.ok) {
+                        retryAfter =
+                            requestedDelay(response.headers.get('Retry-After'), policy.maxDelayMs) ?? -1;
+                        cancelBody(response);
+                        throw new ProviderRequestError(`${id}: provider request failed (HTTP ${response.status}). Check account, permissions and quota.`, response.status >= 400 &&
+                            response.status < 500 &&
+                            ![408, 429].includes(response.status), response.status);
+                    }
+                    return responseJson(id, response, signal);
+                });
+            }
+            catch (error) {
+                const retryable = error instanceof TransportFailure ||
+                    (error instanceof ProviderRequestError &&
+                        [429, 502, 503, 504].includes(error.status ?? 0));
+                const failure = error instanceof TransportFailure
+                    ? new Error(`${id}: provider request did not complete. Inspect remote status before retrying.`)
+                    : error;
+                if (method !== 'GET' || !retryable || retryAfter < 0 || attempt + 1 >= attempts)
+                    throw failure;
+                const delay = Math.max(retryAfter, Math.min(policy.maxDelayMs, policy.baseDelayMs * 2 ** attempt));
+                const budget = policy.totalTimeoutMs - (performance.now() - started);
+                if (delay >= budget)
+                    throw failure;
+                try {
+                    await deadline(budget, async () => policy.delay(delay));
+                }
+                catch {
+                    throw new Error(`${id}: provider read retry deadline exceeded.`);
+                }
+            }
+        }
+        throw new Error(`${id}: provider read retry deadline exceeded.`);
+    };
+}

package/dist/providers/config.d.ts

@@ -0,0 +1,15 @@
+import { type IntegrationProvider, type ProviderSettings, type ProviderSettingsById } from './definitions.js';
+export { INTEGRATION_PROVIDERS } from './definitions.js';
+export type { IntegrationProvider, ProviderSettings, ProviderSettingsById } from './definitions.js';
+export interface ProviderConfiguration {
+    schemaVersion: 1;
+    providers: Partial<ProviderSettingsById>;
+}
+/** Validate untrusted JSON before assigning provider-specific types. */
+export declare function validateProviderConfiguration(value: unknown, selected?: readonly IntegrationProvider[]): asserts value is ProviderConfiguration;
+export declare function providerConfiguration(root: string): ProviderConfiguration;
+export declare function setting(settings: ProviderSettings, key: string): string;
+/** No identities, domains, prices or organizations are inferred from a user's last session. */
+export declare function providerRequirements(id: IntegrationProvider, config: ProviderSettings): string[];
+export declare function selectedIntegrations(root: string): IntegrationProvider[];
+export declare function providerConfigurationTemplate(products: readonly string[], name: string): ProviderConfiguration;