voidforge-build 23.9.1

package/dist/wizard/lib/natural-language-deploy.js

@@ -0,0 +1,186 @@
+/**
+ * Natural Language Deploy — resolve prose deployment descriptions to YAML frontmatter.
+ *
+ * Parse: "I want a $20/month server with SSL and daily backups"
+ * → { deploy: 'vps', instanceType: 't3.small', hostname: '', resilience: { backups: 'daily', ... } }
+ *
+ * Uses keyword matching and heuristics — no AI API call required.
+ */
+const BUDGET_TIERS = [
+    { maxMonthly: 10, instanceType: 't3.micro', label: '~$8/mo' },
+    { maxMonthly: 25, instanceType: 't3.small', label: '~$17/mo' },
+    { maxMonthly: 50, instanceType: 't3.medium', label: '~$34/mo' },
+    { maxMonthly: 100, instanceType: 't3.large', label: '~$68/mo' },
+    { maxMonthly: Infinity, instanceType: 't3.xlarge', label: '~$136/mo' },
+];
+function resolveInstanceFromBudget(budget) {
+    return BUDGET_TIERS.find(t => budget <= t.maxMonthly) ?? BUDGET_TIERS[BUDGET_TIERS.length - 1];
+}
+// ── Keyword patterns ────────────────────────────
+const PLATFORM_KEYWORDS = [
+    { pattern: /\bvercel\b/i, target: 'vercel', reason: 'Vercel mentioned explicitly' },
+    { pattern: /\brailway\b/i, target: 'railway', reason: 'Railway mentioned explicitly' },
+    { pattern: /\bcloudflare\b/i, target: 'cloudflare', reason: 'Cloudflare mentioned explicitly' },
+    { pattern: /\bdocker\b|\bcontainer\b/i, target: 'docker', reason: 'Docker/container mentioned' },
+    { pattern: /\bstatic\s*(?:site|hosting|files?)\b/i, target: 'static', reason: 'Static site hosting' },
+    { pattern: /\bvps\b|\bserver\b|\bec2\b|\baws\b|\bssh\b/i, target: 'vps', reason: 'Server/VPS/AWS mentioned' },
+    { pattern: /\bserverless\b|\bedge\b/i, target: 'vercel', reason: 'Serverless/edge → Vercel' },
+    { pattern: /\bfree\s*tier\b|\bno\s*cost\b|\bfree\b/i, target: 'railway', reason: 'Free tier → Railway' },
+];
+const FEATURE_KEYWORDS = [
+    { pattern: /\bbackup/i, key: 'backups', reason: 'Backups requested' },
+    { pattern: /\bssl\b|\bhttps\b|\btls\b/i, key: 'ssl', reason: 'SSL/TLS requested' },
+    { pattern: /\bcustom\s*domain\b|\bmy\s*domain\b/i, key: 'customDomain', reason: 'Custom domain' },
+    { pattern: /\brollback\b|\brevert\b/i, key: 'rollback', reason: 'Rollback requested' },
+    { pattern: /\bpreview\b|\bpr\s*deploy/i, key: 'previewDeploys', reason: 'Preview deploys' },
+    { pattern: /\bhealth\s*check\b|\bmonitoring\b|\buptime\b/i, key: 'healthCheck', reason: 'Health monitoring' },
+    { pattern: /\brate\s*limit/i, key: 'rateLimiting', reason: 'Rate limiting' },
+    { pattern: /\bgraceful\b|\bzero\s*downtime\b/i, key: 'gracefulShutdown', reason: 'Zero-downtime' },
+    { pattern: /\bmulti\s*(?:env|environment)\b|\bstaging\b/i, key: 'multiEnv', reason: 'Multi-environment' },
+    { pattern: /\berror\s*boundar/i, key: 'errorBoundaries', reason: 'Error boundaries' },
+    { pattern: /\bdead\s*letter\b|\bdlq\b|\bretry\s*queue\b/i, key: 'deadLetterQueue', reason: 'Dead letter queue' },
+    { pattern: /\bmigration/i, key: 'migrations', reason: 'Database migrations' },
+];
+const SCALE_KEYWORDS = [
+    { pattern: /\bsmall\b|\bsimple\b|\bblog\b|\bpersonal\b|\bside\s*project\b|\bmvp\b|\bprototype\b/i, scale: 'small', reason: 'Small/simple project' },
+    { pattern: /\bmedium\b|\bstartup\b|\bsaas\b|\bteam\b|\bgrow/i, scale: 'medium', reason: 'Medium/startup scale' },
+    { pattern: /\blarge\b|\benterprise\b|\bthousands\b|\bhigh\s*traffic\b|\bscale\b|\bproduction\b/i, scale: 'large', reason: 'Large/production scale' },
+];
+// ── Main resolver ───────────────────────────────
+export function resolveDeployConfig(prose) {
+    if (!prose.trim())
+        return null;
+    const reasoning = [];
+    const features = new Set();
+    // Extract budget — prefer amounts near cost keywords, fall back to first $N
+    const costContextMatch = prose.match(/(?:budget|spend|cost|month|mo)[^$]*\$(\d+(?:\.\d+)?)/i)
+        ?? prose.match(/\$(\d+(?:\.\d+)?)(?:\s*\/\s*mo(?:nth)?)/i)
+        ?? prose.match(/\$(\d+(?:\.\d+)?)/i);
+    const budget = costContextMatch ? Math.round(parseFloat(costContextMatch[1])) : -1;
+    // Detect explicit platform
+    let deploy = 'vps'; // default
+    let platformDetected = false;
+    for (const kw of PLATFORM_KEYWORDS) {
+        if (kw.pattern.test(prose)) {
+            deploy = kw.target;
+            reasoning.push(kw.reason);
+            platformDetected = true;
+            break;
+        }
+    }
+    // Detect features
+    for (const kw of FEATURE_KEYWORDS) {
+        if (kw.pattern.test(prose)) {
+            features.add(kw.key);
+            reasoning.push(kw.reason);
+        }
+    }
+    // Detect scale
+    let scale = 'small';
+    for (const kw of SCALE_KEYWORDS) {
+        if (kw.pattern.test(prose)) {
+            scale = kw.scale;
+            reasoning.push(kw.reason);
+            break;
+        }
+    }
+    // If no platform detected, infer from features and scale
+    if (!platformDetected) {
+        if (features.has('previewDeploys') || features.has('errorBoundaries')) {
+            deploy = 'vercel';
+            reasoning.push('Preview deploys/error boundaries → Vercel (best support)');
+        }
+        else if (scale === 'large' || features.has('customDomain') || budget > 30) {
+            deploy = 'vps';
+            reasoning.push('Large scale or custom domain with budget → VPS');
+        }
+        else if (scale === 'small' && budget < 0) {
+            deploy = 'railway';
+            reasoning.push('Small project, no budget specified → Railway (easiest start)');
+        }
+        else {
+            deploy = 'vps';
+            reasoning.push('Default → VPS (most flexible)');
+        }
+    }
+    // Resolve instance type from budget or scale
+    let instanceType = '';
+    let estimatedCost = '';
+    if (deploy === 'vps') {
+        if (budget >= 0) {
+            const tier = resolveInstanceFromBudget(budget);
+            instanceType = tier.instanceType;
+            estimatedCost = tier.label;
+            reasoning.push(`Budget $${budget}/mo → ${tier.instanceType} (${tier.label})`);
+        }
+        else {
+            const scaleMap = { small: 't3.micro', medium: 't3.small', large: 't3.medium' };
+            const costMap = { small: '~$8/mo', medium: '~$17/mo', large: '~$34/mo' };
+            instanceType = scaleMap[scale];
+            estimatedCost = costMap[scale];
+            reasoning.push(`${scale} scale → ${instanceType} (${estimatedCost})`);
+        }
+    }
+    else {
+        estimatedCost = deploy === 'railway' ? 'Free tier available' :
+            deploy === 'vercel' ? 'Free tier available' :
+                deploy === 'cloudflare' ? 'Free tier available' :
+                    deploy === 'static' ? 'Minimal (~$1/mo S3)' : 'Varies';
+    }
+    // Extract hostname if mentioned
+    const hostnameMatch = prose.match(/(?:domain|hostname|url)[\s:]*([a-z0-9.-]+\.[a-z]{2,})/i);
+    const hostname = hostnameMatch ? hostnameMatch[1] : '';
+    if (hostname)
+        reasoning.push(`Hostname detected: ${hostname}`);
+    // Build resilience config — defaults based on deploy target + detected features
+    const isVps = deploy === 'vps';
+    const isPlatform = ['vercel', 'railway', 'cloudflare'].includes(deploy);
+    const resilience = {
+        multiEnv: features.has('multiEnv') || scale !== 'small',
+        previewDeploys: features.has('previewDeploys') || (isPlatform && scale !== 'small'),
+        rollback: features.has('rollback') || isPlatform,
+        migrations: features.has('migrations') ? 'auto' : (isVps ? 'manual' : 'no'),
+        backups: features.has('backups') ? 'daily' : (isVps && scale !== 'small' ? 'weekly' : 'no'),
+        healthCheck: features.has('healthCheck') || isVps || scale !== 'small',
+        gracefulShutdown: features.has('gracefulShutdown') || isVps,
+        errorBoundaries: features.has('errorBoundaries'),
+        rateLimiting: features.has('rateLimiting') || scale === 'large',
+        deadLetterQueue: features.has('deadLetterQueue'),
+    };
+    return {
+        deploy,
+        instanceType,
+        hostname,
+        estimatedMonthlyCost: estimatedCost,
+        resilience,
+        reasoning,
+    };
+}
+/** Sanitize a string for safe YAML double-quoted interpolation. */
+function yamlSafe(value) {
+    return value.replace(/[\\"]/g, '');
+}
+/** Convert a DeployConfig to YAML frontmatter fragment. */
+export function toFrontmatter(config) {
+    const lines = [
+        `deploy: "${yamlSafe(config.deploy)}"`,
+    ];
+    if (config.instanceType) {
+        lines.push(`instance_type: "${yamlSafe(config.instanceType)}"`);
+    }
+    if (config.hostname) {
+        lines.push(`hostname: "${yamlSafe(config.hostname.toLowerCase())}"`);
+    }
+    lines.push('resilience:');
+    lines.push(`  multi-env: ${config.resilience.multiEnv ? 'yes' : 'no'}`);
+    lines.push(`  preview-deploys: ${config.resilience.previewDeploys ? 'yes' : 'no'}`);
+    lines.push(`  rollback: ${config.resilience.rollback ? 'yes' : 'no'}`);
+    lines.push(`  migrations: "${yamlSafe(config.resilience.migrations)}"`);
+    lines.push(`  backups: "${yamlSafe(config.resilience.backups)}"`);
+    lines.push(`  health-check: ${config.resilience.healthCheck ? 'yes' : 'no'}`);
+    lines.push(`  graceful-shutdown: ${config.resilience.gracefulShutdown ? 'yes' : 'no'}`);
+    lines.push(`  error-boundaries: ${config.resilience.errorBoundaries ? 'yes' : 'no'}`);
+    lines.push(`  rate-limiting: ${config.resilience.rateLimiting ? 'yes' : 'no'}`);
+    lines.push(`  dead-letter-queue: ${config.resilience.deadLetterQueue ? 'yes' : 'no'}`);
+    return lines.join('\n');
+}

package/dist/wizard/lib/network.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Network utilities — shared private IP detection for WebSocket origin validation.
+ * Consolidates duplicate implementations from health-poller.ts and site-scanner.ts.
+ *
+ * Covers:
+ * - RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
+ * - CGNAT/Tailscale: 100.64.0.0/10 (RFC 6598)
+ * - Loopback: 127.0.0.0/8
+ * - IPv6 ULA: fd00::/8 (ZeroTier, WireGuard)
+ * - IPv6 loopback: ::1
+ */
+/**
+ * Check if an IP address is in a private/internal range.
+ * Uses numeric octet parsing — NEVER string prefix matching.
+ * (SECURITY_AUDITOR.md: "ip.startsWith('172.2') matches public IPs like 172.200.x.x")
+ */
+export declare function isPrivateIp(ip: string): boolean;
+/**
+ * Check if a WebSocket/HTTP origin is from a private network.
+ * Extracts the hostname from the origin URL and checks if it's private.
+ */
+export declare function isPrivateOrigin(origin: string): boolean;

package/dist/wizard/lib/network.js

@@ -0,0 +1,72 @@
+/**
+ * Network utilities — shared private IP detection for WebSocket origin validation.
+ * Consolidates duplicate implementations from health-poller.ts and site-scanner.ts.
+ *
+ * Covers:
+ * - RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
+ * - CGNAT/Tailscale: 100.64.0.0/10 (RFC 6598)
+ * - Loopback: 127.0.0.0/8
+ * - IPv6 ULA: fd00::/8 (ZeroTier, WireGuard)
+ * - IPv6 loopback: ::1
+ */
+/**
+ * Check if an IP address is in a private/internal range.
+ * Uses numeric octet parsing — NEVER string prefix matching.
+ * (SECURITY_AUDITOR.md: "ip.startsWith('172.2') matches public IPs like 172.200.x.x")
+ */
+export function isPrivateIp(ip) {
+    // IPv6 checks
+    if (ip.includes(':')) {
+        const normalized = ip.replace(/^\[/, '').replace(/\]$/, '').toLowerCase();
+        if (normalized === '::1')
+            return true;
+        // IPv4-mapped IPv6 (::ffff:10.0.0.1) — extract and check the IPv4 part
+        const v4Mapped = normalized.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
+        if (v4Mapped)
+            return isPrivateIp(v4Mapped[1]);
+        // fd00::/8 — unique local addresses (ZeroTier, WireGuard)
+        if (normalized.startsWith('fd'))
+            return true;
+        // fe80::/10 — link-local
+        if (normalized.startsWith('fe80'))
+            return true;
+        return false;
+    }
+    // IPv4 checks — parse octets to integers
+    const parts = ip.split('.');
+    if (parts.length !== 4)
+        return false;
+    const octets = parts.map(Number);
+    if (octets.some(n => isNaN(n) || n < 0 || n > 255))
+        return false;
+    const [a, b] = octets;
+    // 10.0.0.0/8
+    if (a === 10)
+        return true;
+    // 172.16.0.0/12 (172.16.x.x through 172.31.x.x)
+    if (a === 172 && b >= 16 && b <= 31)
+        return true;
+    // 192.168.0.0/16
+    if (a === 192 && b === 168)
+        return true;
+    // 127.0.0.0/8 (loopback)
+    if (a === 127)
+        return true;
+    // 100.64.0.0/10 (CGNAT — Tailscale uses this range)
+    if (a === 100 && b >= 64 && b <= 127)
+        return true;
+    return false;
+}
+/**
+ * Check if a WebSocket/HTTP origin is from a private network.
+ * Extracts the hostname from the origin URL and checks if it's private.
+ */
+export function isPrivateOrigin(origin) {
+    try {
+        const url = new URL(origin);
+        return isPrivateIp(url.hostname);
+    }
+    catch {
+        return false;
+    }
+}

package/dist/wizard/lib/oauth-core.d.ts

@@ -0,0 +1,6 @@
+/**
+ * OAuth core — re-exports from the oauth-token-lifecycle pattern for wizard runtime use.
+ * ARCH-R2-012: Production code should not import from docs/patterns/ directly.
+ */
+export { needsRefresh, handleRefreshFailure, getTokenHealth, tokenVaultKey, deserializeTokens, shouldRotateSessionToken, rotateSessionToken, validateSessionToken, } from './patterns/oauth-token-lifecycle.js';
+export type { SessionTokenState } from './patterns/oauth-token-lifecycle.js';

package/dist/wizard/lib/oauth-core.js

@@ -0,0 +1,5 @@
+/**
+ * OAuth core — re-exports from the oauth-token-lifecycle pattern for wizard runtime use.
+ * ARCH-R2-012: Production code should not import from docs/patterns/ directly.
+ */
+export { needsRefresh, handleRefreshFailure, getTokenHealth, tokenVaultKey, deserializeTokens, shouldRotateSessionToken, rotateSessionToken, validateSessionToken, } from './patterns/oauth-token-lifecycle.js';

package/dist/wizard/lib/open-browser.d.ts

@@ -0,0 +1 @@
+export declare function openBrowser(url: string): Promise<void>;

package/dist/wizard/lib/open-browser.js

@@ -0,0 +1,26 @@
+import { execFile } from 'node:child_process';
+export function openBrowser(url) {
+    return new Promise((resolve) => {
+        const platform = process.platform;
+        let cmd;
+        let args;
+        if (platform === 'darwin') {
+            cmd = 'open';
+            args = [url];
+        }
+        else if (platform === 'win32') {
+            cmd = 'cmd';
+            args = ['/c', 'start', '', url];
+        }
+        else {
+            cmd = 'xdg-open';
+            args = [url];
+        }
+        execFile(cmd, args, (err) => {
+            if (err) {
+                console.log(`  Open ${url} in your browser to continue`);
+            }
+            resolve();
+        });
+    });
+}

package/dist/wizard/lib/patterns/ad-billing-adapter.d.ts

@@ -0,0 +1,209 @@
+/**
+ * Pattern: Ad Billing Adapter (Split Interface)
+ *
+ * Key principles:
+ * - Billing is SEPARATE from campaign CRUD. This adapter handles how ad platforms
+ *   get paid (invoices, direct debits, settlements), not how campaigns are managed.
+ *   Campaign operations live in ad-platform-adapter.ts.
+ * - Three capability states determine what Treasury can automate:
+ *     FULLY_FUNDABLE   — Treasury manages settlement lifecycle end-to-end
+ *     MONITORED_ONLY   — spend and billing are observed, but funding is not automated
+ *     UNSUPPORTED      — billing configuration blocks any automation
+ * - Split interface: AdBillingSetup (interactive) + AdBillingAdapter (runtime)
+ * - Single-writer: only Heartbeat daemon calls the runtime adapter
+ * - All amounts in branded integer cents (Cents type from financial-transaction.ts)
+ *
+ * Agents: Dockson (treasury), Wax (paid ads), Heartbeat daemon
+ *
+ * PRD Reference: §10.2, §11.1B, §12.3
+ *
+ * Google Ads Billing API reference:
+ *   Billing setup: managed via Google Ads UI — no API for enabling monthly invoicing.
+ *   Read-only API paths (Ads API v16+):
+ *     BillingSetup resource   → billingSetup.status, paymentsAccount, paymentsProfile
+ *     Invoice resource        → GET /customers/{id}/invoices (monthly invoicing accounts only)
+ *       Fields: invoice.id, invoice.type, invoice.due_date, invoice.total_amount_micros
+ *       Note: amounts in micros (1/1,000,000 of currency unit). Divide by 10,000 for cents.
+ *   payments_account_id identifies the payments profile linked to billing.
+ *   monthly_invoicing must be enabled by Google — not programmatically toggleable.
+ *
+ * Meta Ads Billing reference:
+ *   No first-party invoice API. Billing is managed via:
+ *     GET /act_{id}?fields=funding_source,funding_source_details → funding method classification
+ *     funding_source_details.type: 1=credit_card, 2=debit_card, 4=direct_debit,
+ *       5=paypal, 8=extended_credit, 11=invoice
+ *   Direct debit: Meta pulls from linked bank. No settlement instruction needed.
+ *   Extended credit / invoicing: available to qualifying business accounts.
+ *   For direct debit accounts, Treasury maintains a buffer; for invoiced accounts,
+ *   Treasury tracks due dates and settlement instructions.
+ */
+type Cents = number & {
+    readonly __brand: 'Cents';
+};
+declare function toCents(dollars: number): Cents;
+type CapabilityState = 'FULLY_FUNDABLE' | 'MONITORED_ONLY' | 'UNSUPPORTED';
+type BillingMode = 'monthly_invoicing' | 'direct_debit' | 'extended_credit' | 'manual_bank_transfer' | 'card_only' | 'unknown';
+type AdPlatform = 'google' | 'meta' | 'tiktok' | 'linkedin' | 'twitter' | 'reddit' | 'snap';
+interface Invoice {
+    id: string;
+    platform: AdPlatform;
+    externalAccountId: string;
+    amountCents: Cents;
+    currency: 'USD';
+    issueDate: string;
+    dueDate: string;
+    status: 'pending' | 'paid' | 'overdue' | 'cancelled';
+    lineItems?: InvoiceLineItem[];
+    paymentReference?: string;
+}
+interface InvoiceLineItem {
+    description: string;
+    amountCents: Cents;
+    campaignId?: string;
+}
+interface ExpectedDebit {
+    id: string;
+    platform: AdPlatform;
+    externalAccountId: string;
+    estimatedAmountCents: Cents;
+    currency: 'USD';
+    expectedDate: string;
+    status: 'expected' | 'detected' | 'confirmed' | 'failed';
+    bankTransactionId?: string;
+}
+interface SettlementInstruction {
+    invoiceId: string;
+    platform: AdPlatform;
+    payeeName: string;
+    paymentMethod: 'wire' | 'ach' | 'direct_debit';
+    amountCents: Cents;
+    currency: 'USD';
+    dueDate: string;
+    bankReference?: string;
+    routingNumber?: string;
+    accountNumber?: string;
+    notes: string;
+}
+interface PlatformBillingProfile {
+    platform: AdPlatform;
+    capabilityState: CapabilityState;
+    billingMode: BillingMode;
+    externalAccountId: string;
+    billingSetupId?: string;
+    invoiceGroupId?: string;
+    paymentProfileId?: string;
+    fundingSourceId?: string;
+    currency: 'USD';
+    nextDueDate?: string;
+    status: 'active' | 'degraded' | 'suspended' | 'unconfigured';
+    lastVerifiedAt: string;
+}
+interface BillingConfiguration {
+    billingMode: BillingMode;
+    accountIds: {
+        externalAccountId: string;
+        billingSetupId?: string;
+        invoiceGroupId?: string;
+        paymentProfileId?: string;
+        fundingSourceId?: string;
+    };
+    nextDueDate?: string;
+    estimatedMonthlySpendCents?: Cents;
+}
+interface NormalizedFundingState {
+    platform: AdPlatform;
+    capabilityState: CapabilityState;
+    billingMode: BillingMode;
+    outstandingCents: Cents;
+    nextPaymentDueDate?: string;
+    daysUntilNextPayment?: number;
+    fundingHealthy: boolean;
+    warnings: string[];
+}
+interface DateRange {
+    start: string;
+    end: string;
+}
+interface AdBillingSetup {
+    /** Determine what level of funding automation this platform supports */
+    verifyBillingCapability(platform: AdPlatform, externalAccountId: string, tokens: {
+        accessToken: string;
+    }): Promise<CapabilityState>;
+    /** Read the billing configuration details for storage in vault */
+    readBillingConfiguration(platform: AdPlatform, externalAccountId: string, tokens: {
+        accessToken: string;
+    }): Promise<BillingConfiguration>;
+    /** Auto-detect the billing mode from platform API responses */
+    detectBillingMode(platform: AdPlatform, externalAccountId: string, tokens: {
+        accessToken: string;
+    }): Promise<BillingMode>;
+}
+interface AdBillingAdapter {
+    /** Current capability state — may degrade at runtime if billing config changes */
+    getCapabilityState(platform: AdPlatform): Promise<CapabilityState>;
+    /** List pending and paid invoices in date range (Google monthly invoicing) */
+    readInvoices(platform: AdPlatform, dateRange: DateRange): Promise<Invoice[]>;
+    /** List expected bank debits in date range (Meta direct debit) */
+    readExpectedDebits(platform: AdPlatform, dateRange: DateRange): Promise<ExpectedDebit[]>;
+    /** Generate a settlement instruction for a specific invoice */
+    generateSettlementInstructions(invoice: Invoice): Promise<SettlementInstruction>;
+    /** Confirm that an invoice was settled by linking to a bank transaction */
+    confirmSettlement(invoiceId: string, bankTransactionId: string): Promise<{
+        confirmed: boolean;
+        reconciledAmountCents: Cents;
+        varianceCents: Cents;
+    }>;
+    /** Unified funding view across all connected platforms */
+    normalizeFundingState(): Promise<NormalizedFundingState[]>;
+}
+declare class GoogleBillingAdapter implements AdBillingSetup, AdBillingAdapter {
+    private readonly adsApiUrl;
+    private profiles;
+    verifyBillingCapability(_platform: AdPlatform, externalAccountId: string, tokens: {
+        accessToken: string;
+    }): Promise<CapabilityState>;
+    readBillingConfiguration(_platform: AdPlatform, externalAccountId: string, tokens: {
+        accessToken: string;
+    }): Promise<BillingConfiguration>;
+    detectBillingMode(_platform: AdPlatform, externalAccountId: string, tokens: {
+        accessToken: string;
+    }): Promise<BillingMode>;
+    getCapabilityState(_platform: AdPlatform): Promise<CapabilityState>;
+    readInvoices(_platform: AdPlatform, dateRange: DateRange): Promise<Invoice[]>;
+    readExpectedDebits(_platform: AdPlatform, _dateRange: DateRange): Promise<ExpectedDebit[]>;
+    generateSettlementInstructions(invoice: Invoice): Promise<SettlementInstruction>;
+    confirmSettlement(invoiceId: string, bankTransactionId: string): Promise<{
+        confirmed: boolean;
+        reconciledAmountCents: Cents;
+        varianceCents: Cents;
+    }>;
+    normalizeFundingState(): Promise<NormalizedFundingState[]>;
+    private queryBillingSetup;
+    private classifyGoogleBillingMode;
+}
+declare class MetaBillingAdapter implements AdBillingSetup, AdBillingAdapter {
+    private readonly baseUrl;
+    private profiles;
+    verifyBillingCapability(_platform: AdPlatform, externalAccountId: string, tokens: {
+        accessToken: string;
+    }): Promise<CapabilityState>;
+    readBillingConfiguration(_platform: AdPlatform, externalAccountId: string, tokens: {
+        accessToken: string;
+    }): Promise<BillingConfiguration>;
+    detectBillingMode(_platform: AdPlatform, externalAccountId: string, tokens: {
+        accessToken: string;
+    }): Promise<BillingMode>;
+    getCapabilityState(_platform: AdPlatform): Promise<CapabilityState>;
+    readInvoices(_platform: AdPlatform, _dateRange: DateRange): Promise<Invoice[]>;
+    readExpectedDebits(_platform: AdPlatform, dateRange: DateRange): Promise<ExpectedDebit[]>;
+    generateSettlementInstructions(invoice: Invoice): Promise<SettlementInstruction>;
+    confirmSettlement(invoiceId: string, bankTransactionId: string): Promise<{
+        confirmed: boolean;
+        reconciledAmountCents: Cents;
+        varianceCents: Cents;
+    }>;
+    normalizeFundingState(): Promise<NormalizedFundingState[]>;
+    private apiCall;
+}
+export type { AdBillingSetup, AdBillingAdapter, CapabilityState, BillingMode, AdPlatform, Invoice, InvoiceLineItem, ExpectedDebit, SettlementInstruction, PlatformBillingProfile, BillingConfiguration, NormalizedFundingState, DateRange, Cents, };
+export { toCents, GoogleBillingAdapter, MetaBillingAdapter };