uplink-cli 0.1.38 → 0.2.0

package/cli/src/registrars/dreamhost.ts

@@ -0,0 +1,129 @@
+import type { InventoryDomain, RegistrarAdapter, RegistrarCredentials } from "./types";
+
+const BASE = "https://api.dreamhost.com/";
+const NO_ACCESS = "this_key_cannot_access_this_cmd";
+
+type DreamhostEnvelope = {
+  result?: string;
+  data?: unknown;
+  reason?: string;
+};
+
+function keysOf(creds: RegistrarCredentials): string[] {
+  const keys = [creds.apiKey || creds.token, ...(creds.extraTokens || [])];
+  return [...new Set(keys.filter((key): key is string => Boolean(key)))];
+}
+
+async function dreamhostCmd(key: string, cmd: string): Promise<unknown> {
+  const url = `${BASE}?key=${encodeURIComponent(key)}&cmd=${encodeURIComponent(cmd)}&format=json`;
+  const res = await fetch(url, { headers: { Accept: "application/json" } });
+  const text = await res.text();
+  let body: DreamhostEnvelope;
+  try {
+    body = text ? (JSON.parse(text) as DreamhostEnvelope) : {};
+  } catch {
+    throw new Error(`DreamHost returned a non-JSON response (HTTP ${res.status})`);
+  }
+  if (!res.ok || body.result !== "success") {
+    const detail = body.reason || (typeof body.data === "string" ? body.data : "") || `HTTP ${res.status}`;
+    throw new Error(`DreamHost ${cmd} failed: ${detail}`);
+  }
+  return body.data;
+}
+
+function rowsOf(data: unknown): Array<Record<string, unknown>> {
+  if (!Array.isArray(data)) return [];
+  return data.filter((row): row is Record<string, unknown> => Boolean(row) && typeof row === "object");
+}
+
+function domainOf(row: Record<string, unknown>): string | undefined {
+  const value = row.domain ?? row.name ?? row.domain_name;
+  return typeof value === "string" && value.includes(".") ? value.toLowerCase() : undefined;
+}
+
+function expiryOf(row: Record<string, unknown>): string | undefined {
+  const value = row.expires ?? row.expiry ?? row.expiration_date;
+  return typeof value === "string" && value ? value : undefined;
+}
+
+/**
+ * DreamHost API keys are scoped per command. Panel keys with domain access can
+ * list registrations; DNS-only keys can still reveal the account's domains via
+ * dns-list_records zones, so each lookup falls through that chain.
+ */
+async function listForKey(key: string): Promise<InventoryDomain[]> {
+  const out: InventoryDomain[] = [];
+  const seen = new Set<string>();
+  const push = (domain: string | undefined, expiresAt?: string) => {
+    if (!domain || seen.has(domain)) return;
+    seen.add(domain);
+    out.push({ domain, provider: "dreamhost", status: "owned", expiresAt });
+  };
+
+  let lastError: Error | null = null;
+  for (const cmd of ["domain-list_registrations", "domain-list_domains"]) {
+    try {
+      for (const row of rowsOf(await dreamhostCmd(key, cmd))) {
+        push(domainOf(row), expiryOf(row));
+      }
+      if (out.length > 0) return out;
+    } catch (error) {
+      lastError = error instanceof Error ? error : new Error(String(error));
+      if (!lastError.message.includes(NO_ACCESS)) throw lastError;
+    }
+  }
+
+  try {
+    for (const row of rowsOf(await dreamhostCmd(key, "dns-list_records"))) {
+      const zone = row.zone;
+      if (typeof zone === "string" && zone.includes(".")) push(zone.toLowerCase());
+    }
+    return out;
+  } catch (error) {
+    const err = error instanceof Error ? error : new Error(String(error));
+    throw lastError && err.message.includes(NO_ACCESS) ? lastError : err;
+  }
+}
+
+export const dreamhostAdapter: RegistrarAdapter = {
+  id: "dreamhost",
+  label: "DreamHost",
+  connectHelp:
+    "Panel API key(s); DNS-scoped keys work too. --token-env DREAMHOST_API_KEY (comma-separate env names for multiple accounts)",
+  async verify(creds) {
+    const keys = keysOf(creds);
+    if (keys.length === 0) throw new Error("DreamHost API key is missing");
+    for (const key of keys) {
+      await listForKey(key);
+    }
+    return creds;
+  },
+  async listDomains(creds) {
+    const out: InventoryDomain[] = [];
+    const seen = new Set<string>();
+    const errors: string[] = [];
+    for (const key of keysOf(creds)) {
+      try {
+        for (const item of await listForKey(key)) {
+          if (seen.has(item.domain)) continue;
+          seen.add(item.domain);
+          out.push(item);
+        }
+      } catch (error) {
+        errors.push(error instanceof Error ? error.message : String(error));
+      }
+    }
+    if (out.length === 0 && errors.length > 0) throw new Error(errors.join("; "));
+    return out.sort((a, b) => a.domain.localeCompare(b.domain));
+  },
+  async check(creds, domain) {
+    // DreamHost has no availability API; it can only confirm ownership.
+    // Throw for unowned domains so `domains check` falls through to a
+    // provider that can quote (or the public DNS/RDAP fallback).
+    const owned = await this.listDomains(creds);
+    if (owned.some((item) => item.domain === domain.toLowerCase())) {
+      return { domain, provider: "dreamhost", status: "owned", buyable: false };
+    }
+    throw new Error("DreamHost cannot check availability for domains outside the account");
+  },
+};

package/cli/src/registrars/godaddy.ts

@@ -0,0 +1,105 @@
+import { httpError, parseJson } from "./http";
+import type { DomainQuote, InventoryDomain, RegistrarAdapter, RegistrarCredentials } from "./types";
+
+const BASE = "https://api.godaddy.com";
+
+async function godaddyFetch(
+  creds: RegistrarCredentials,
+  path: string,
+  init: RequestInit = {}
+): Promise<Response> {
+  if (!creds.token) throw new Error("GoDaddy token is missing");
+  return fetch(`${BASE}${path}`, {
+    ...init,
+    headers: {
+      Authorization: `Bearer ${creds.token}`,
+      Accept: "application/json",
+      "Content-Type": "application/json",
+      ...(init.headers || {}),
+    },
+  });
+}
+
+function centsToUsd(value: number): number {
+  return value / 100;
+}
+
+function microToUsd(value: number): number {
+  return value / 1_000_000;
+}
+
+export const godaddyAdapter: RegistrarAdapter = {
+  id: "godaddy",
+  label: "GoDaddy",
+  connectHelp: "Personal Access Token with domains.domain:read. --token-env GODADDY_PAT",
+  async verify(creds) {
+    const res = await godaddyFetch(creds, "/v1/domains?limit=1");
+    if (!res.ok) throw httpError(res, await res.text());
+    return creds;
+  },
+  async listDomains(creds) {
+    const out: InventoryDomain[] = [];
+    let marker: string | undefined;
+    for (;;) {
+      const params = new URLSearchParams({ limit: "100" });
+      if (marker) params.set("marker", marker);
+      const res = await godaddyFetch(creds, `/v1/domains?${params}`);
+      if (!res.ok) throw httpError(res, await res.text());
+      const batch = await parseJson<Array<{ domain?: string; expires?: string }>>(res);
+      if (!Array.isArray(batch) || batch.length === 0) break;
+      for (const item of batch) {
+        if (!item.domain) continue;
+        out.push({
+          domain: item.domain.toLowerCase(),
+          provider: "godaddy",
+          status: "owned",
+          expiresAt: item.expires,
+        });
+      }
+      if (batch.length < 100) break;
+      marker = batch[batch.length - 1]?.domain;
+      if (!marker) break;
+    }
+    return out;
+  },
+  async check(creds, domain) {
+    const v3 = await godaddyFetch(
+      creds,
+      `/v3/domains/check-availability?domain=${encodeURIComponent(domain)}`
+    );
+    if (v3.ok) {
+      const data = await parseJson<{
+        available?: boolean;
+        prices?: Array<{ period?: number; price?: { value?: number } }>;
+      }>(v3);
+      const year1 = data.prices?.find((p) => p.period === 1) ?? data.prices?.[0];
+      const priceUsd = year1?.price?.value != null ? centsToUsd(year1.price.value) : undefined;
+      if (data.available) {
+        return { domain, provider: "godaddy", status: "available", buyable: true, priceUsd };
+      }
+      return { domain, provider: "godaddy", status: "taken", buyable: false };
+    }
+
+    // Fall back only when this API version is unavailable. Retrying a 401,
+    // 429, or 5xx against v1 wastes quota and can hide the real failure.
+    if (v3.status !== 404 && v3.status !== 405) {
+      throw httpError(v3, await v3.text());
+    }
+
+    const v1 = await godaddyFetch(
+      creds,
+      `/v1/domains/available?domain=${encodeURIComponent(domain)}`
+    );
+    if (!v1.ok) throw httpError(v1, await v1.text());
+    const data = await parseJson<{
+      available?: boolean;
+      price?: number;
+      currency?: string;
+    }>(v1);
+    const priceUsd = data.price != null ? microToUsd(data.price) : undefined;
+    if (data.available) {
+      return { domain, provider: "godaddy", status: "available", buyable: true, priceUsd };
+    }
+    return { domain, provider: "godaddy", status: "taken", buyable: false };
+  },
+};

package/cli/src/registrars/hostinger.ts

@@ -0,0 +1,106 @@
+import { httpError, parseJson } from "./http";
+import type { DomainQuote, InventoryDomain, RegistrarAdapter, RegistrarCredentials } from "./types";
+
+const BASE = "https://developers.hostinger.com";
+
+async function hostingerFetch(
+  creds: RegistrarCredentials,
+  path: string,
+  init: RequestInit = {}
+): Promise<Response> {
+  if (!creds.token) throw new Error("Hostinger token is missing");
+  return fetch(`${BASE}${path}`, {
+    ...init,
+    headers: {
+      Authorization: `Bearer ${creds.token}`,
+      Accept: "application/json",
+      "Content-Type": "application/json",
+      ...(init.headers || {}),
+    },
+  });
+}
+
+function asList(data: unknown): unknown[] {
+  if (Array.isArray(data)) return data;
+  if (data && typeof data === "object") {
+    const obj = data as { data?: unknown; items?: unknown; domains?: unknown };
+    if (Array.isArray(obj.data)) return obj.data;
+    if (Array.isArray(obj.items)) return obj.items;
+    if (Array.isArray(obj.domains)) return obj.domains;
+  }
+  return [];
+}
+
+function domainField(item: unknown): string | undefined {
+  if (!item || typeof item !== "object") return undefined;
+  const obj = item as { domain?: string; name?: string; domain_name?: string };
+  return obj.domain || obj.name || obj.domain_name;
+}
+
+function splitDomain(fqdn: string): { label: string; tld: string } {
+  const i = fqdn.indexOf(".");
+  if (i <= 0) return { label: fqdn, tld: "com" };
+  return { label: fqdn.slice(0, i), tld: fqdn.slice(i + 1) };
+}
+
+export const hostingerAdapter: RegistrarAdapter = {
+  id: "hostinger",
+  label: "Hostinger",
+  connectHelp: "hPanel API token. --token-env HOSTINGER_API_TOKEN",
+  async verify(creds) {
+    const res = await hostingerFetch(creds, "/api/domains/v1/portfolio");
+    if (!res.ok) throw httpError(res, await res.text());
+    return creds;
+  },
+  async listDomains(creds) {
+    const res = await hostingerFetch(creds, "/api/domains/v1/portfolio");
+    if (!res.ok) throw httpError(res, await res.text());
+    const data = await parseJson<unknown>(res);
+    const out: InventoryDomain[] = [];
+    for (const item of asList(data)) {
+      const domain = domainField(item);
+      if (!domain) continue;
+      const expires =
+        item && typeof item === "object"
+          ? (item as { expires_at?: string; expiry_date?: string }).expires_at ||
+            (item as { expiry_date?: string }).expiry_date
+          : undefined;
+      out.push({
+        domain: domain.toLowerCase(),
+        provider: "hostinger",
+        status: "owned",
+        expiresAt: expires,
+      });
+    }
+    return out;
+  },
+  async check(creds, domain) {
+    const { label, tld } = splitDomain(domain);
+    const res = await hostingerFetch(creds, "/api/domains/v1/availability", {
+      method: "POST",
+      body: JSON.stringify({ domain: label, tlds: [tld], with_alternatives: false }),
+    });
+    if (!res.ok) throw httpError(res, await res.text());
+    const data = await parseJson<unknown>(res);
+    const rows = asList(data);
+    const match =
+      rows.find((row) => domainField(row)?.toLowerCase() === domain.toLowerCase()) || rows[0];
+    const available =
+      match && typeof match === "object"
+        ? Boolean((match as { is_available?: boolean; available?: boolean }).is_available ??
+            (match as { available?: boolean }).available)
+        : false;
+    if (available) {
+      return { domain, provider: "hostinger", status: "available", buyable: true };
+    }
+    const restriction =
+      match && typeof match === "object" ? (match as { restriction?: string }).restriction : undefined;
+    return {
+      domain,
+      provider: "hostinger",
+      status: restriction ? "not_for_sale" : "taken",
+      buyable: false,
+      error: restriction,
+    };
+  },
+};

package/cli/src/registrars/http.ts

@@ -0,0 +1,18 @@
+export async function readResponseBody(res: Response): Promise<string> {
+  return res.text();
+}
+
+export async function parseJson<T>(res: Response): Promise<T> {
+  const text = await readResponseBody(res);
+  if (!text) return {} as T;
+  try {
+    return JSON.parse(text) as T;
+  } catch {
+    throw new Error(`Invalid JSON from ${res.url} (${res.status})`);
+  }
+}
+
+export function httpError(res: Response, body: string): Error {
+  const trimmed = body.replace(/\s+/g, " ").trim().slice(0, 300);
+  return new Error(`HTTP ${res.status}${trimmed ? `: ${trimmed}` : ""}`);
+}

package/cli/src/registrars/index.ts

@@ -0,0 +1,32 @@
+import { cloudflareAdapter } from "./cloudflare";
+import { dreamhostAdapter } from "./dreamhost";
+import { godaddyAdapter } from "./godaddy";
+import { hostingerAdapter } from "./hostinger";
+import { namecheapAdapter } from "./namecheap";
+import type { ProviderId, RegistrarAdapter } from "./types";
+
+/** GoDaddy first, then the rest. Namecheap last because connect is the clumsiest. */
+export const adapters: RegistrarAdapter[] = [
+  godaddyAdapter,
+  cloudflareAdapter,
+  hostingerAdapter,
+  namecheapAdapter,
+  dreamhostAdapter,
+];
+
+const byId = new Map(adapters.map((adapter) => [adapter.id, adapter]));
+
+export function getAdapter(id: ProviderId): RegistrarAdapter {
+  const adapter = byId.get(id);
+  if (!adapter) throw new Error(`Unknown provider: ${id}`);
+  return adapter;
+}
+
+export { connectedProviders, readRegistrarStore, removeProvider, saveProvider } from "./store";
+export { PROVIDER_IDS, isProviderId } from "./types";
+export type {
+  DomainQuote,
+  InventoryDomain,
+  ProviderId,
+  RegistrarCredentials,
+} from "./types";

package/cli/src/registrars/namecheap.ts

@@ -0,0 +1,163 @@
+import { httpError } from "./http";
+import type { DomainQuote, InventoryDomain, RegistrarAdapter, RegistrarCredentials } from "./types";
+
+const API_URL = "https://api.namecheap.com/xml.response";
+
+let clientIpPromise: Promise<string> | undefined;
+const pricingCache = new Map<string, Promise<Map<string, number>>>();
+
+async function clientIp(): Promise<string> {
+  clientIpPromise ??= fetch("https://api.ipify.org")
+    .then(async (res) => {
+      if (!res.ok) throw new Error(`ip lookup failed (${res.status})`);
+      return (await res.text()).trim();
+    })
+    .catch((error: unknown) => {
+      clientIpPromise = undefined;
+      throw error;
+    });
+  return clientIpPromise;
+}
+
+function attr(tag: string, name: string): string | undefined {
+  return new RegExp(`${name}="([^"]*)"`, "i").exec(tag)?.[1];
+}
+
+async function namecheapCall(
+  creds: RegistrarCredentials,
+  command: string,
+  extra: Record<string, string>
+): Promise<string> {
+  if (!creds.apiUser || !creds.apiKey) throw new Error("Namecheap API user and key are required");
+  const params = new URLSearchParams({
+    ApiUser: creds.apiUser,
+    ApiKey: creds.apiKey,
+    UserName: creds.apiUser,
+    Command: command,
+    ClientIp: await clientIp(),
+    ...extra,
+  });
+  const res = await fetch(`${API_URL}?${params}`);
+  const xml = await res.text();
+  const status = /Status="([^"]+)"/.exec(xml)?.[1];
+  if (status !== "OK") {
+    const err = /<Error[^>]*>([^<]+)<\/Error>/.exec(xml)?.[1] || `Namecheap ${status || res.status}`;
+    const ip = await clientIp().catch(() => "");
+    if (/ip/i.test(err) && ip) {
+      throw new Error(`${err}. Whitelist this machine's IP in Namecheap API access: ${ip}`);
+    }
+    throw new Error(err);
+  }
+  if (!res.ok) throw httpError(res, xml);
+  return xml;
+}
+
+async function loadRegisterPrices(creds: RegistrarCredentials): Promise<Map<string, number>> {
+  const xml = await namecheapCall(creds, "namecheap.users.getPricing", {
+    ProductType: "DOMAIN",
+    ActionName: "REGISTER",
+  });
+  const prices = new Map<string, number>();
+  const categories = xml.matchAll(/<ProductCategory Name="register">([\s\S]*?)<\/ProductCategory>/gi);
+  for (const category of categories) {
+    const products = category[1].matchAll(/<Product Name="([^"]+)">([\s\S]*?)<\/Product>/gi);
+    for (const match of products) {
+      const tld = match[1].toLowerCase();
+      const year1 =
+        /<Price\b([^>]*Duration="1"[^>]*DurationType="YEAR"[^>]*)\/?>/i.exec(match[2]) ??
+        /<Price\b([^>]*DurationType="YEAR"[^>]*Duration="1"[^>]*)\/?>/i.exec(match[2]);
+      if (!year1) continue;
+      const fields = year1[1];
+      const your = Number(attr(fields, "YourPrice") ?? attr(fields, "Price"));
+      if (!Number.isFinite(your)) continue;
+      const extra = Number(attr(fields, "YourAdditonalCost") ?? attr(fields, "AdditionalCost") ?? "0");
+      prices.set(tld, your + (Number.isFinite(extra) ? extra : 0));
+    }
+  }
+  return prices;
+}
+
+function registerPrices(creds: RegistrarCredentials): Promise<Map<string, number>> {
+  const key = creds.apiUser || "";
+  let pending = pricingCache.get(key);
+  if (!pending) {
+    pending = loadRegisterPrices(creds).catch((error: unknown) => {
+      pricingCache.delete(key);
+      throw error;
+    });
+    pricingCache.set(key, pending);
+  }
+  return pending;
+}
+
+export const namecheapAdapter: RegistrarAdapter = {
+  id: "namecheap",
+  label: "Namecheap",
+  connectHelp:
+    "API key + username, and whitelist this machine's IP. --token-env NAMECHEAP_API_KEY --user-env NAMECHEAP_API_USER",
+  async verify(creds) {
+    await namecheapCall(creds, "namecheap.domains.getList", { PageSize: "20" });
+    return creds;
+  },
+  async listDomains(creds) {
+    const out: InventoryDomain[] = [];
+    let page = 1;
+    for (;;) {
+      const xml = await namecheapCall(creds, "namecheap.domains.getList", {
+        Page: String(page),
+        PageSize: "100",
+      });
+      const tags = xml.matchAll(/<Domain\b([^>]*)\/?>/gi);
+      let count = 0;
+      for (const match of tags) {
+        count += 1;
+        const name = attr(match[1], "Name") || attr(match[1], "Domain");
+        if (!name) continue;
+        out.push({
+          domain: name.toLowerCase(),
+          provider: "namecheap",
+          status: "owned",
+          expiresAt: attr(match[1], "Expires") || attr(match[1], "ExpiredDate"),
+        });
+      }
+      if (count < 100) break;
+      page += 1;
+      if (page > 50) break;
+    }
+    return out;
+  },
+  async check(creds, domain) {
+    const xml = await namecheapCall(creds, "namecheap.domains.check", { DomainList: domain });
+    const tag = xml.match(/<DomainCheckResult\b([^>]*)\/?>/i)?.[1];
+    if (!tag) {
+      return { domain, provider: "namecheap", status: "unknown", error: "no check result" };
+    }
+    const available = attr(tag, "Available")?.toLowerCase() === "true";
+    const premium = attr(tag, "IsPremiumName")?.toLowerCase() === "true";
+    if (!available) {
+      return { domain, provider: "namecheap", status: "not_for_sale", buyable: false, premium };
+    }
+    if (premium) {
+      const price =
+        Number(attr(tag, "PremiumRegistrationPrice") || "0") + Number(attr(tag, "IcannFee") || "0");
+      return {
+        domain,
+        provider: "namecheap",
+        status: "available",
+        buyable: true,
+        premium: true,
+        priceUsd: price > 0 ? price : undefined,
+      };
+    }
+    const tld = domain.slice(domain.lastIndexOf(".") + 1).toLowerCase();
+    const prices = await registerPrices(creds);
+    return {
+      domain,
+      provider: "namecheap",
+      status: "available",
+      buyable: true,
+      premium: false,
+      priceUsd: prices.get(tld),
+    };
+  },
+};

package/cli/src/registrars/secret.ts

@@ -0,0 +1,66 @@
+import { createInterface } from "readline";
+
+export function readEnvValue(name: string): string {
+  const value = process.env[name]?.trim();
+  if (!value) throw new Error(`Environment variable ${name} is empty or missing`);
+  return value;
+}
+
+/** Hidden prompt. Agents should use --token-env instead so the secret never hits argv. */
+export async function promptSecret(question: string): Promise<string> {
+  const stdin = process.stdin;
+  const stdout = process.stdout;
+  if (!stdin.isTTY || typeof stdin.setRawMode !== "function") {
+    const rl = createInterface({ input: stdin, output: stdout });
+    const answer = await new Promise<string>((resolve) => {
+      rl.question(question, (value) => {
+        rl.close();
+        resolve(value);
+      });
+    });
+    return answer.trim();
+  }
+
+  stdout.write(question);
+  stdin.setRawMode(true);
+  stdin.resume();
+  stdin.setEncoding("utf8");
+
+  return new Promise((resolve, reject) => {
+    let value = "";
+    const onData = (chunk: string) => {
+      for (const char of chunk) {
+        if (char === "\n" || char === "\r") {
+          cleanup();
+          stdout.write("\n");
+          resolve(value.trim());
+          return;
+        }
+        if (char === "\u0003") {
+          cleanup();
+          stdout.write("\n");
+          reject(new Error("Cancelled"));
+          return;
+        }
+        if (char === "\u007f" || char === "\b") {
+          value = value.slice(0, -1);
+          continue;
+        }
+        if (char >= " ") value += char;
+      }
+    };
+    const cleanup = () => {
+      stdin.off("data", onData);
+      try {
+        stdin.setRawMode(false);
+      } catch {
+        /* ignore */
+      }
+    };
+    stdin.on("data", onData);
+  });
+}
+
+export function canPrompt(): boolean {
+  return Boolean(process.stdin.isTTY && process.stdout.isTTY);
+}

package/cli/src/registrars/store.ts

@@ -0,0 +1,55 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+import type { ProviderId, RegistrarCredentials } from "./types";
+
+export type RegistrarStore = Partial<Record<ProviderId, RegistrarCredentials>>;
+
+function storeDir(): string {
+  return join(homedir(), ".uplink");
+}
+
+export function registrarStorePath(): string {
+  return join(storeDir(), "registrars.json");
+}
+
+export function readRegistrarStore(): RegistrarStore {
+  const path = registrarStorePath();
+  if (!existsSync(path)) return {};
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8")) as RegistrarStore;
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+
+export function writeRegistrarStore(store: RegistrarStore): void {
+  mkdirSync(storeDir(), { recursive: true });
+  const path = registrarStorePath();
+  writeFileSync(path, JSON.stringify(store, null, 2), { encoding: "utf8", mode: 0o600 });
+  try {
+    chmodSync(path, 0o600);
+  } catch {
+    /* ignore */
+  }
+}
+
+export function saveProvider(id: ProviderId, creds: RegistrarCredentials): void {
+  const store = readRegistrarStore();
+  store[id] = creds;
+  writeRegistrarStore(store);
+}
+
+export function removeProvider(id: ProviderId): boolean {
+  const store = readRegistrarStore();
+  if (!store[id]) return false;
+  delete store[id];
+  writeRegistrarStore(store);
+  return true;
+}
+
+export function connectedProviders(): ProviderId[] {
+  const store = readRegistrarStore();
+  return (Object.keys(store) as ProviderId[]).filter((id) => Boolean(store[id]));
+}