stageflow 0.33.0 → 0.36.0

package/dist/channels/providers/photonWhatsapp.js

@@ -0,0 +1,146 @@
+import { z } from "zod";
+import { ChannelError } from "../errors.js";
+import { httpCall, parseJson, statusFailure } from "../http.js";
+import { healthOf, importModule, receiptFor, withSendTimeout, withSpectrumApp, zodValidator } from "./kit.js";
+import { PHOTON_BASE_URL, PHOTON_CREDENTIAL_YAML, PHOTON_FIELDS, credentialsOf, photonData, photonHeaders } from "./photonImessage.js";
+export const WHATSAPP_META = {
+    label: "WhatsApp Business",
+    blurb: "Not connected · via Photon",
+    icon: "phone",
+    via: "Photon",
+    note: "Enable WhatsApp for the project in the Photon dashboard first. Uses the Spectrum SDK packages (optional dependencies). Stages pin an approved template per recipient.",
+    fields: PHOTON_FIELDS,
+    recipient: { label: "Recipient", placeholder: "+14155550123", multiple: false, cc: false, template: true },
+    envNames: ["PHOTON_PROJECT_ID", "PHOTON_PROJECT_SECRET"],
+    yamlExample: `${PHOTON_CREDENTIAL_YAML}connections:
+  - id: orders-whatsapp
+    provider: whatsapp
+    credential: photon-main
+`,
+    stageExample: `    to: "+14155550123"
+    template:
+      name: order_update
+      languageCode: en_US
+      bodyParams: ["{{message}}"]`,
+};
+export const MESSAGE_PLACEHOLDER = "{{message}}";
+export const MAX_TEMPLATE_PARAM = 1024;
+const templateSchema = z.object({
+    name: z.string().regex(/^[a-z0-9_]{1,512}$/),
+    languageCode: z.string().regex(/^[a-z]{2,3}(_[A-Z]{2})?$/),
+    bodyParams: z.array(z.string().min(1).max(MAX_TEMPLATE_PARAM)).max(10).optional(),
+}).strict();
+const targetSchema = z.object({
+    to: z.string().regex(/^\+[1-9]\d{6,14}$/),
+    template: templateSchema.optional(),
+}).strict();
+const validateConfig = zodValidator(z.object({}).strict(), "config", () => ({}));
+const validateTarget = zodValidator(targetSchema, "target", (data) => ({
+    recipient: data.to,
+    ...(data.template ? { template: data.template } : {}),
+}));
+/** Template parameters cannot hold newlines, tabs or long runs of spaces. */
+export function templateParam(text) {
+    return text.replace(/[\r\n\t]+/g, " ").replace(/ {2,}/g, " ").trim();
+}
+/** Fills `{{message}}` in the pinned parameters. Fails before sending if a result is empty or too long. */
+export function fillTemplate(template, message, connectionId) {
+    const text = templateParam(message.subject ? `${message.subject}: ${message.text}` : message.text);
+    const bodyParams = template.bodyParams?.map(param => (param.includes(MESSAGE_PLACEHOLDER) ? param.split(MESSAGE_PLACEHOLDER).join(text) : param));
+    if (bodyParams?.some(param => param.length === 0 || param.length > MAX_TEMPLATE_PARAM)) {
+        throw new ChannelError("CHANNEL_INVALID_INPUT", false, { connectionId, field: "text" });
+    }
+    return { ...template, ...(bodyParams ? { bodyParams } : {}) };
+}
+function metaCode(error) {
+    const candidates = [error?.code, error?.error?.code];
+    for (const value of candidates)
+        if (typeof value === "number")
+            return value;
+    const match = /\b(13\d{4}|190)\b/.exec(error instanceof Error ? error.message : "");
+    return match ? Number(match[1]) : undefined;
+}
+const RECIPIENT_CODES = new Set([131026, 131030, 131021]);
+const INVALID_CODES = new Set([132000, 132001, 132005, 132012, 132015, 132016]);
+const RATE_CODES = new Set([131056, 130429, 131048]);
+/** Maps SDK and Meta errors. Unclassified errors may have happened after the send, so they are unknown. */
+export function classifyWhatsappError(error, connectionId) {
+    if (error instanceof ChannelError)
+        return error;
+    const detail = { connectionId };
+    const code = metaCode(error);
+    if (code === 131047 || code === 131051)
+        return new ChannelError("CHANNEL_WINDOW_CLOSED", false, detail);
+    if (code !== undefined && RECIPIENT_CODES.has(code))
+        return new ChannelError("CHANNEL_RECIPIENT_REJECTED", false, detail);
+    if (code !== undefined && INVALID_CODES.has(code))
+        return new ChannelError("CHANNEL_INVALID_INPUT", false, detail);
+    if (code !== undefined && RATE_CODES.has(code))
+        return new ChannelError("CHANNEL_RATE_LIMIT", true, detail);
+    if (code === 190)
+        return new ChannelError("CHANNEL_AUTH_FAILED", false, detail);
+    const status = error?.status;
+    if (status === 401)
+        return new ChannelError("CHANNEL_AUTH_FAILED", false, detail);
+    if (status === 403)
+        return new ChannelError("CHANNEL_UNAUTHORIZED", false, detail);
+    if (status === 429)
+        return new ChannelError("CHANNEL_RATE_LIMIT", true, detail);
+    return new ChannelError("CHANNEL_SEND_OUTCOME_UNKNOWN", false, detail);
+}
+/** The Spectrum SDK send for WhatsApp, on the same shared lifecycle as iMessage. */
+export function spectrumWhatsappTransport(importer = importModule) {
+    return {
+        send: (credentials, recipient, outbound) => withSpectrumApp(importer, credentials, { pkg: "@spectrum-ts/whatsapp-business", exportName: "whatsappBusiness" }, async ({ platform, module }) => {
+            const user = await platform.user(recipient);
+            const space = await platform.space.create(user);
+            const sent = await space.send("template" in outbound ? module.whatsappTemplate(outbound.template) : outbound.text);
+            return typeof sent?.id === "string" ? { messageId: sent.id } : {};
+        }),
+    };
+}
+/**
+ * WhatsApp Business through a Photon project (cloud mode), 1:1 only. Free-form text works only
+ * inside the 24-hour window after the recipient last wrote to the business, so a stage that
+ * writes first must pin an approved `template`. Receiving is not part of this phase.
+ */
+export function createPhotonWhatsappProvider(options = {}) {
+    const doFetch = options.fetch ?? fetch;
+    const base = options.baseUrl ?? PHOTON_BASE_URL;
+    const transport = options.transport ?? spectrumWhatsappTransport();
+    return {
+        id: "whatsapp",
+        meta: WHATSAPP_META,
+        operations: ["send"],
+        secrets: { required: [] },
+        credentialProvider: "photon",
+        validateConfig,
+        validateTarget,
+        check: (connection, signal) => healthOf(async () => {
+            const credentials = credentialsOf(connection);
+            const result = await httpCall({
+                fetch: doFetch, url: `${base}/projects/${encodeURIComponent(credentials.projectId)}/whatsapp-business/tokens`, method: "POST",
+                headers: photonHeaders(credentials), body: {}, timeoutMs: options.checkTimeoutMs ?? 10000, signal, mode: "check", connectionId: connection.id,
+            });
+            if (result.status < 200 || result.status >= 300)
+                throw statusFailure(result.status, "check", connection.id);
+            const auth = photonData(parseJson(result.text))?.auth;
+            if (!(auth && typeof auth === "object" && Object.keys(auth).length > 0)) {
+                throw new ChannelError("CHANNEL_INVALID_INPUT", false, { connectionId: connection.id, field: "whatsapp" });
+            }
+        }),
+        async send(connection, target, message, _context) {
+            const credentials = credentialsOf(connection);
+            const outbound = target.template
+                ? { template: fillTemplate(target.template, message, connection.id) }
+                : { text: message.subject ? `${message.subject}\n\n${message.text}` : message.text };
+            try {
+                const sent = await withSendTimeout(options.sendTimeoutMs ?? 45000, connection.id, transport.send(credentials, target.recipient, outbound));
+                return receiptFor(sent.messageId);
+            }
+            catch (error) {
+                throw classifyWhatsappError(error, connection.id);
+            }
+        },
+    };
+}

package/dist/channels/providers/slack.d.ts

@@ -0,0 +1,25 @@
+import { ChannelError } from "../errors.js";
+import type { HttpMode } from "../http.js";
+import type { ChannelProvider, ProviderMeta } from "../types.js";
+export type SlackConfig = {
+    teamId?: string;
+};
+export type SlackTarget = {
+    channel: string;
+};
+export declare const SLACK_BASE_URL = "https://slack.com/api";
+export declare const SLACK_META: ProviderMeta;
+export type SlackOptions = {
+    fetch?: typeof fetch;
+    baseUrl?: string;
+    sendTimeoutMs?: number;
+    checkTimeoutMs?: number;
+};
+/** Maps a Slack `ok: false` error name. Names are mapped, never echoed. */
+export declare function slackFailure(name: unknown, mode: HttpMode, connectionId: string): ChannelError;
+/**
+ * Posts as a Slack bot through `chat.postMessage`. The bot needs `chat:write`; posting to a
+ * public channel it has not joined also needs `chat:write.public`, and a direct message to a
+ * user id needs `im:write`. Receiving is not part of this phase.
+ */
+export declare function createSlackProvider(options?: SlackOptions): ChannelProvider<SlackConfig, SlackTarget>;

package/dist/channels/providers/slack.js

@@ -0,0 +1,101 @@
+import { z } from "zod";
+import { ChannelError } from "../errors.js";
+import { httpCall, parseJson, statusFailure } from "../http.js";
+import { healthOf, receiptFor, zodValidator } from "./kit.js";
+export const SLACK_BASE_URL = "https://slack.com/api";
+export const SLACK_META = {
+    label: "Slack",
+    blurb: "Not connected · post as a bot",
+    icon: "hash",
+    fields: [
+        { key: "botToken", label: "Bot token", hint: "xoxb-… from your Slack app (OAuth & Permissions). Needs chat:write.", target: "secret", input: "password", required: true, placeholder: "xoxb-..." },
+        { key: "teamId", label: "Workspace ID (optional)", hint: "Pins the connection to one workspace, such as T0123ABCD.", target: "config", input: "text", required: false, placeholder: "T0123ABCD" },
+    ],
+    recipient: { label: "Channel id", placeholder: "C0123ABCD (channel, group, DM or user id)", multiple: false, cc: false, template: false },
+    envNames: ["SLACK_BOT_TOKEN"],
+    yamlExample: `connections:
+  - id: ops-slack
+    provider: slack
+    secrets:
+      botToken: env:SLACK_BOT_TOKEN
+`,
+    stageExample: "    to: C0123ABCD",
+};
+const configSchema = z.object({ teamId: z.string().regex(/^T[A-Z0-9]{2,31}$/).optional() }).strict();
+const targetSchema = z.object({ to: z.string().regex(/^[CGDU][A-Z0-9]{2,31}$/) }).strict();
+const validateConfig = zodValidator(configSchema, "config");
+const validateTarget = zodValidator(targetSchema, "target", (data) => ({ channel: data.to }));
+const AUTH_ERRORS = new Set(["invalid_auth", "not_authed", "account_inactive", "token_revoked", "token_expired"]);
+const SCOPE_ERRORS = new Set(["missing_scope", "not_allowed_token_type", "no_permission", "restricted_action", "access_denied"]);
+const RECIPIENT_ERRORS = new Set([
+    "channel_not_found", "user_not_found", "is_archived", "not_in_channel", "cannot_dm_bot", "user_disabled",
+    "restricted_action_read_only_channel", "restricted_action_thread_only_channel", "channel_is_archived",
+]);
+const TRANSIENT_ERRORS = new Set(["internal_error", "fatal_error", "service_unavailable", "request_timeout"]);
+/** Maps a Slack `ok: false` error name. Names are mapped, never echoed. */
+export function slackFailure(name, mode, connectionId) {
+    const detail = { connectionId };
+    if (typeof name !== "string")
+        return new ChannelError(mode === "send" ? "CHANNEL_SEND_OUTCOME_UNKNOWN" : "CHANNEL_CONNECTION_FAILED", mode !== "send", detail);
+    if (AUTH_ERRORS.has(name))
+        return new ChannelError("CHANNEL_AUTH_FAILED", false, detail);
+    if (SCOPE_ERRORS.has(name))
+        return new ChannelError("CHANNEL_UNAUTHORIZED", false, detail);
+    if (RECIPIENT_ERRORS.has(name))
+        return new ChannelError("CHANNEL_RECIPIENT_REJECTED", false, detail);
+    if (name === "ratelimited" || name === "rate_limited")
+        return new ChannelError("CHANNEL_RATE_LIMIT", true, detail);
+    if (TRANSIENT_ERRORS.has(name)) {
+        return mode === "send" ? new ChannelError("CHANNEL_SEND_OUTCOME_UNKNOWN", false, detail) : new ChannelError("CHANNEL_CONNECTION_FAILED", true, detail);
+    }
+    return new ChannelError("CHANNEL_INVALID_INPUT", false, detail);
+}
+/**
+ * Posts as a Slack bot through `chat.postMessage`. The bot needs `chat:write`; posting to a
+ * public channel it has not joined also needs `chat:write.public`, and a direct message to a
+ * user id needs `im:write`. Receiving is not part of this phase.
+ */
+export function createSlackProvider(options = {}) {
+    const doFetch = options.fetch ?? fetch;
+    const base = options.baseUrl ?? SLACK_BASE_URL;
+    const headers = (connection) => ({ authorization: `Bearer ${connection.secrets.botToken}`, accept: "application/json" });
+    return {
+        id: "slack",
+        meta: SLACK_META,
+        operations: ["send"],
+        secrets: { required: ["botToken"] },
+        validateConfig,
+        validateTarget,
+        describe: config => (config.teamId ? { identity: config.teamId } : {}),
+        check: (connection, signal) => healthOf(async () => {
+            const result = await httpCall({
+                fetch: doFetch, url: `${base}/auth.test`, method: "POST", headers: headers(connection),
+                timeoutMs: options.checkTimeoutMs ?? 10000, signal, mode: "check", connectionId: connection.id,
+            });
+            if (result.status < 200 || result.status >= 300)
+                throw statusFailure(result.status, "check", connection.id);
+            const body = parseJson(result.text);
+            if (body?.ok !== true)
+                throw slackFailure(body?.error, "check", connection.id);
+            if (connection.config.teamId !== undefined && body.team_id !== connection.config.teamId) {
+                throw new ChannelError("CHANNEL_INVALID_INPUT", false, { connectionId: connection.id, field: "teamId" });
+            }
+        }),
+        async send(connection, target, message, _context) {
+            const text = message.subject ? `*${message.subject}*\n${message.text}` : message.text;
+            const result = await httpCall({
+                fetch: doFetch, url: `${base}/chat.postMessage`, method: "POST", headers: headers(connection),
+                body: { channel: target.channel, text, link_names: false, unfurl_links: false, unfurl_media: false },
+                timeoutMs: options.sendTimeoutMs ?? 30000, mode: "send", connectionId: connection.id,
+            });
+            if (result.status < 200 || result.status >= 300)
+                throw statusFailure(result.status, "send", connection.id);
+            const body = parseJson(result.text);
+            if (body === undefined)
+                throw new ChannelError("CHANNEL_SEND_OUTCOME_UNKNOWN", false, { connectionId: connection.id });
+            if (body.ok !== true)
+                throw slackFailure(body.error, "send", connection.id);
+            return receiptFor(typeof body.ts === "string" ? body.ts : undefined);
+        },
+    };
+}

package/dist/channels/providers/telegram.d.ts

@@ -0,0 +1,21 @@
+import type { ChannelProvider, ProviderMeta } from "../types.js";
+export type TelegramConfig = {
+    botUsername?: string;
+};
+export type TelegramTarget = {
+    chatId: string | number;
+};
+export declare const TELEGRAM_BASE_URL = "https://api.telegram.org";
+export declare const TELEGRAM_MAX_TEXT = 4096;
+export declare const TELEGRAM_META: ProviderMeta;
+export type TelegramOptions = {
+    fetch?: typeof fetch;
+    baseUrl?: string;
+    sendTimeoutMs?: number;
+    checkTimeoutMs?: number;
+};
+/**
+ * Sends through the Telegram Bot API with a bot token. The recipient must have started the
+ * bot (or the bot must be a member of the group or channel). Receiving is not part of this phase.
+ */
+export declare function createTelegramProvider(options?: TelegramOptions): ChannelProvider<TelegramConfig, TelegramTarget>;

package/dist/channels/providers/telegram.js

@@ -0,0 +1,100 @@
+import { z } from "zod";
+import { ChannelError } from "../errors.js";
+import { httpCall, parseJson, statusFailure } from "../http.js";
+import { healthOf, receiptFor, zodValidator } from "./kit.js";
+export const TELEGRAM_BASE_URL = "https://api.telegram.org";
+export const TELEGRAM_MAX_TEXT = 4096;
+export const TELEGRAM_META = {
+    label: "Telegram",
+    blurb: "Not connected · bot token",
+    icon: "send",
+    fields: [
+        { key: "botToken", label: "Bot token", hint: "From @BotFather. People must start the bot before it can message them.", target: "secret", input: "password", required: true, placeholder: "123456:ABC..." },
+        { key: "botUsername", label: "Bot username (optional)", hint: "Fails the check if the token belongs to another bot.", target: "config", input: "text", required: false, placeholder: "acme_alerts_bot" },
+    ],
+    recipient: { label: "Chat id", placeholder: "123456789 or @channelname", multiple: false, cc: false, template: false },
+    envNames: ["TELEGRAM_BOT_TOKEN"],
+    yamlExample: `connections:
+  - id: alerts-telegram
+    provider: telegram
+    secrets:
+      botToken: env:TELEGRAM_BOT_TOKEN
+`,
+    stageExample: '    to: "123456789"',
+};
+const configSchema = z.object({ botUsername: z.string().regex(/^[A-Za-z][A-Za-z0-9_]{4,31}$/).optional() }).strict();
+const chatId = z.union([
+    z.number().int().refine(Number.isSafeInteger),
+    z.string().regex(/^-?\d{1,20}$/),
+    z.string().regex(/^@[A-Za-z][A-Za-z0-9_]{4,31}$/),
+]);
+const targetSchema = z.object({ to: chatId }).strict();
+const validateConfig = zodValidator(configSchema, "config");
+const validateTarget = zodValidator(targetSchema, "target", (data) => ({ chatId: data.to }));
+/**
+ * Telegram mirrors its error in the HTTP status. A bot cannot message a user who has not
+ * started it or who blocked it (403), and an unknown chat is a 400. The description is only
+ * matched, never echoed.
+ */
+function telegramFailure(status, body, mode, connectionId) {
+    const detail = { connectionId };
+    const description = typeof body?.description === "string" ? body.description.toLowerCase() : "";
+    if (status === 404)
+        return new ChannelError("CHANNEL_AUTH_FAILED", false, detail);
+    if (status === 403 && mode === "send")
+        return new ChannelError("CHANNEL_RECIPIENT_REJECTED", false, detail);
+    if (status === 400 && mode === "send" && /chat not found|user not found|peer_id_invalid|chat_id is empty/.test(description)) {
+        return new ChannelError("CHANNEL_RECIPIENT_REJECTED", false, detail);
+    }
+    return statusFailure(status, mode, connectionId);
+}
+/**
+ * Sends through the Telegram Bot API with a bot token. The recipient must have started the
+ * bot (or the bot must be a member of the group or channel). Receiving is not part of this phase.
+ */
+export function createTelegramProvider(options = {}) {
+    const doFetch = options.fetch ?? fetch;
+    const base = options.baseUrl ?? TELEGRAM_BASE_URL;
+    const url = (connection, method) => `${base}/bot${connection.secrets.botToken}/${method}`;
+    return {
+        id: "telegram",
+        meta: TELEGRAM_META,
+        operations: ["send"],
+        secrets: { required: ["botToken"] },
+        validateConfig,
+        validateTarget,
+        describe: config => (config.botUsername ? { identity: `@${config.botUsername}` } : {}),
+        check: (connection, signal) => healthOf(async () => {
+            const result = await httpCall({
+                fetch: doFetch, url: url(connection, "getMe"), method: "GET", headers: { accept: "application/json" },
+                timeoutMs: options.checkTimeoutMs ?? 10000, signal, mode: "check", connectionId: connection.id,
+            });
+            const body = parseJson(result.text);
+            if (result.status < 200 || result.status >= 300)
+                throw telegramFailure(result.status, body, "check", connection.id);
+            if (body?.ok !== true)
+                throw new ChannelError("CHANNEL_CONNECTION_FAILED", true, { connectionId: connection.id });
+            const pinned = connection.config.botUsername;
+            if (pinned !== undefined && String(body.result?.username).toLowerCase() !== pinned.toLowerCase()) {
+                throw new ChannelError("CHANNEL_INVALID_INPUT", false, { connectionId: connection.id, field: "botUsername" });
+            }
+        }),
+        async send(connection, target, message, _context) {
+            const text = message.subject ? `${message.subject}\n\n${message.text}` : message.text;
+            if (text.length > TELEGRAM_MAX_TEXT)
+                throw new ChannelError("CHANNEL_INVALID_INPUT", false, { connectionId: connection.id, field: "text" });
+            const result = await httpCall({
+                fetch: doFetch, url: url(connection, "sendMessage"), method: "POST", headers: { accept: "application/json" },
+                body: { chat_id: target.chatId, text, link_preview_options: { is_disabled: true } },
+                timeoutMs: options.sendTimeoutMs ?? 30000, mode: "send", connectionId: connection.id,
+            });
+            const body = parseJson(result.text);
+            if (result.status < 200 || result.status >= 300)
+                throw telegramFailure(result.status, body, "send", connection.id);
+            if (body?.ok !== true)
+                throw new ChannelError("CHANNEL_SEND_OUTCOME_UNKNOWN", false, { connectionId: connection.id });
+            const id = body.result?.message_id;
+            return receiptFor(typeof id === "number" ? String(id) : undefined);
+        },
+    };
+}

package/dist/channels/providers.d.ts

@@ -0,0 +1,5 @@
+import type { AnyChannelProvider } from "./types.js";
+/** Built-in providers are listed in the initial map as they are implemented. */
+export declare function channelProviders(): AnyChannelProvider[];
+export declare function registerChannelProvider(provider: AnyChannelProvider): void;
+export declare function unregisterChannelProvider(id: string): void;

package/dist/channels/providers.js

@@ -0,0 +1,22 @@
+import { createAgentMailProvider } from "./providers/agentmail.js";
+import { createSlackProvider } from "./providers/slack.js";
+import { createTelegramProvider } from "./providers/telegram.js";
+import { createPhotonImessageProvider } from "./providers/photonImessage.js";
+import { createPhotonWhatsappProvider } from "./providers/photonWhatsapp.js";
+const providers = new Map([
+    ["agentmail", createAgentMailProvider()],
+    ["slack", createSlackProvider()],
+    ["telegram", createTelegramProvider()],
+    ["imessage", createPhotonImessageProvider()],
+    ["whatsapp", createPhotonWhatsappProvider()],
+]);
+/** Built-in providers are listed in the initial map as they are implemented. */
+export function channelProviders() {
+    return [...providers.values()];
+}
+export function registerChannelProvider(provider) {
+    providers.set(provider.id, provider);
+}
+export function unregisterChannelProvider(id) {
+    providers.delete(id);
+}

package/dist/channels/registry.d.ts

@@ -0,0 +1,54 @@
+import { type ConnectionsFile } from "./config.js";
+import { ChannelSecretStore, type SecretReader } from "./secretStore.js";
+import type { AnyChannelProvider, ConnectionSummary, ResolvedConnection, ResolvedCredential } from "./types.js";
+export declare const CONNECTIONS_FILE_NAME = "connections.yaml";
+/**
+ * Where connections live. Connections are host-level, like provider credentials, so the default is
+ * `$STAGEFLOW_HOME/connections.yaml`. A `connections.yaml` in the project root takes precedence when
+ * it exists (CI and checked-in setups), and `STAGEFLOW_CONNECTIONS_FILE` overrides both.
+ */
+export declare function connectionsFilePath(cwd: string, env?: NodeJS.ProcessEnv): string;
+export declare function defaultSecretStore(): ChannelSecretStore;
+export type ChannelRegistryOptions = {
+    cwd: string;
+    providers?: readonly AnyChannelProvider[];
+    env?: NodeJS.ProcessEnv;
+    /** Owner scope. TODO(multi-tenant): the local default is the workspace path, like email accounts. */
+    scope?: string;
+    file?: string;
+    /** Already parsed content, used to validate an edit before it is written. */
+    parsed?: ConnectionsFile;
+    secretStore?: SecretReader;
+};
+/** Host-owned, read-only view of `connections.yaml`. Reads return copies. */
+export declare class ChannelRegistry {
+    readonly scope: string;
+    private readonly env;
+    private readonly secretStore;
+    private readonly providers;
+    private readonly credentials;
+    private readonly connections;
+    constructor(options: ChannelRegistryOptions);
+    list(): ConnectionSummary[];
+    private summarize;
+    get(id: string, requireEnabled?: boolean): ConnectionSummary;
+    providerById(providerId: string): AnyChannelProvider;
+    /** Environment variable names that connections and credentials point at with `env:` references. */
+    envSecretNames(): string[];
+    providerList(): AnyChannelProvider[];
+    hasCredential(id: string): boolean;
+    /** Resolves a shared credential by id, for providers that reference one. */
+    resolveCredential(id: string): ResolvedCredential;
+    hasConnection(id: string): boolean;
+    providerFor(id: string): AnyChannelProvider;
+    validateTarget(id: string, target: unknown): unknown;
+    /** Reads secrets from the environment at call time. Values are never cached on the registry. */
+    resolve(id: string, requireEnabled?: boolean): ResolvedConnection;
+    private entry;
+    private requireProvider;
+    private addCredential;
+    private addConnection;
+    private checkSecretNames;
+    private checkCredential;
+}
+export declare function sealed<T extends ResolvedConnection>(value: T): T;