voidforge-build 23.9.1

package/dist/wizard/api/users.js

@@ -0,0 +1,244 @@
+/**
+ * Users API — Multi-user management endpoints.
+ * All user management requires admin role.
+ * Invite completion is public (token-authenticated).
+ */
+import { addRoute } from '../router.js';
+import { parseJsonBody } from '../lib/body-parser.js';
+import { validateSession, parseSessionCookie, isRemoteMode, getClientIp, checkRateLimit, isValidUsername, } from '../lib/tower-auth.js';
+import { createInvite, completeInvite, removeUser, updateUserRole, listUsers, hasRole, isValidRole, } from '../lib/user-manager.js';
+import { audit } from '../lib/audit-log.js';
+import { removeUserFromAllProjects } from '../lib/project-registry.js';
+import { sendJson } from '../lib/http-helpers.js';
+/** Extract and validate session from request. Returns null if not authenticated. */
+function getSession(req) {
+    const token = parseSessionCookie(req.headers.cookie);
+    const ip = getClientIp(req);
+    if (!token)
+        return null;
+    return validateSession(token, ip);
+}
+// GET /api/users — List all users (admin only)
+addRoute('GET', '/api/users', async (req, res) => {
+    if (!isRemoteMode()) {
+        sendJson(res, 400, { success: false, error: 'User management requires remote mode' });
+        return;
+    }
+    const session = getSession(req);
+    if (!session) {
+        sendJson(res, 401, { success: false, error: 'Authentication required' });
+        return;
+    }
+    if (!hasRole(session, 'admin')) {
+        const ip = getClientIp(req);
+        await audit('access_denied', ip, session.username, { action: 'list_users' });
+        sendJson(res, 404, { success: false, error: 'Not found' });
+        return;
+    }
+    const users = await listUsers();
+    sendJson(res, 200, { success: true, data: { users } });
+});
+// POST /api/users/invite — Create invitation (admin only)
+addRoute('POST', '/api/users/invite', async (req, res) => {
+    if (!isRemoteMode()) {
+        sendJson(res, 400, { success: false, error: 'User management requires remote mode' });
+        return;
+    }
+    const session = getSession(req);
+    if (!session) {
+        sendJson(res, 401, { success: false, error: 'Authentication required' });
+        return;
+    }
+    // Admin check at route level (defense-in-depth — createInvite also checks)
+    if (!hasRole(session, 'admin')) {
+        const ip = getClientIp(req);
+        await audit('access_denied', ip, session.username, { action: 'create_invite' });
+        sendJson(res, 404, { success: false, error: 'Not found' });
+        return;
+    }
+    const body = await parseJsonBody(req);
+    if (typeof body !== 'object' || body === null) {
+        sendJson(res, 400, { success: false, error: 'Request body must be a JSON object' });
+        return;
+    }
+    const { role } = body;
+    if (typeof role !== 'string' || !isValidRole(role)) {
+        sendJson(res, 400, { success: false, error: 'role must be one of: admin, deployer, viewer' });
+        return;
+    }
+    const ip = getClientIp(req);
+    try {
+        const invite = await createInvite(role, session, ip);
+        sendJson(res, 201, { success: true, data: invite });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : 'Failed to create invite';
+        if (message === 'Too many pending invites' || message === 'Invalid role') {
+            sendJson(res, 400, { success: false, error: message });
+        }
+        else {
+            sendJson(res, 400, { success: false, error: 'Failed to create invite' });
+        }
+    }
+});
+// POST /api/users/complete-invite — New user completes invitation setup
+addRoute('POST', '/api/users/complete-invite', async (req, res) => {
+    if (!isRemoteMode()) {
+        sendJson(res, 400, { success: false, error: 'User management requires remote mode' });
+        return;
+    }
+    // Rate limit — this is a public endpoint (auth-exempt)
+    const ip = getClientIp(req);
+    const rateCheck = checkRateLimit(ip);
+    if (!rateCheck.allowed) {
+        sendJson(res, 429, { success: false, error: 'Too many attempts. Try again later.' });
+        return;
+    }
+    const body = await parseJsonBody(req);
+    if (typeof body !== 'object' || body === null) {
+        sendJson(res, 400, { success: false, error: 'Request body must be a JSON object' });
+        return;
+    }
+    const { token, username, password } = body;
+    if (typeof token !== 'string' || token.length !== 64) {
+        sendJson(res, 400, { success: false, error: 'Invalid invite token' });
+        return;
+    }
+    if (typeof username !== 'string' || !isValidUsername(username.trim())) {
+        sendJson(res, 400, { success: false, error: 'Username must be 3-64 characters (letters, numbers, . _ -)' });
+        return;
+    }
+    if (typeof password !== 'string' || password.length < 12 || password.length > 256) {
+        sendJson(res, 400, { success: false, error: 'Password must be 12-256 characters' });
+        return;
+    }
+    try {
+        const result = await completeInvite(token, username.trim(), password, ip);
+        sendJson(res, 201, {
+            success: true,
+            data: {
+                totpSecret: result.totpSecret,
+                totpUri: result.totpUri,
+                role: result.role,
+                message: 'Scan the QR code with your authenticator app.',
+            },
+        }, true); // no-cache — TOTP secret must not be cached
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : 'Failed to complete invite';
+        if (message === 'Invalid or expired invite') {
+            sendJson(res, 404, { success: false, error: 'Invalid or expired invite' });
+        }
+        else if (message === 'Username already taken') {
+            sendJson(res, 409, { success: false, error: 'Username already taken' });
+        }
+        else {
+            sendJson(res, 400, { success: false, error: 'Failed to complete setup' });
+        }
+    }
+});
+// POST /api/users/remove — Remove a user (admin only)
+addRoute('POST', '/api/users/remove', async (req, res) => {
+    if (!isRemoteMode()) {
+        sendJson(res, 400, { success: false, error: 'User management requires remote mode' });
+        return;
+    }
+    const session = getSession(req);
+    if (!session) {
+        sendJson(res, 401, { success: false, error: 'Authentication required' });
+        return;
+    }
+    if (!hasRole(session, 'admin')) {
+        const ip = getClientIp(req);
+        await audit('access_denied', ip, session.username, { action: 'remove_user' });
+        sendJson(res, 404, { success: false, error: 'Not found' });
+        return;
+    }
+    const body = await parseJsonBody(req);
+    if (typeof body !== 'object' || body === null) {
+        sendJson(res, 400, { success: false, error: 'Request body must be a JSON object' });
+        return;
+    }
+    const { username } = body;
+    if (typeof username !== 'string' || username.trim().length === 0) {
+        sendJson(res, 400, { success: false, error: 'username is required' });
+        return;
+    }
+    // Prevent self-deletion
+    if (username.trim() === session.username) {
+        sendJson(res, 400, { success: false, error: 'Cannot remove yourself' });
+        return;
+    }
+    const ip = getClientIp(req);
+    try {
+        await removeUser(username.trim());
+        // Clean up project access entries for the removed user
+        const cleanedProjects = await removeUserFromAllProjects(username.trim());
+        await audit('user_remove', ip, session.username, { target: username.trim(), projectsCleanedUp: cleanedProjects });
+        sendJson(res, 200, { success: true });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : 'Failed to remove user';
+        if (message === 'User not found' || message === 'Cannot remove the last admin') {
+            sendJson(res, 400, { success: false, error: message });
+        }
+        else {
+            sendJson(res, 400, { success: false, error: 'Failed to remove user' });
+        }
+    }
+});
+// POST /api/users/role — Change a user's role (admin only)
+addRoute('POST', '/api/users/role', async (req, res) => {
+    if (!isRemoteMode()) {
+        sendJson(res, 400, { success: false, error: 'User management requires remote mode' });
+        return;
+    }
+    const session = getSession(req);
+    if (!session) {
+        sendJson(res, 401, { success: false, error: 'Authentication required' });
+        return;
+    }
+    if (!hasRole(session, 'admin')) {
+        const ip = getClientIp(req);
+        await audit('access_denied', ip, session.username, { action: 'change_role' });
+        sendJson(res, 404, { success: false, error: 'Not found' });
+        return;
+    }
+    const body = await parseJsonBody(req);
+    if (typeof body !== 'object' || body === null) {
+        sendJson(res, 400, { success: false, error: 'Request body must be a JSON object' });
+        return;
+    }
+    const { username, role } = body;
+    if (typeof username !== 'string' || username.trim().length === 0) {
+        sendJson(res, 400, { success: false, error: 'username is required' });
+        return;
+    }
+    if (typeof role !== 'string' || !isValidRole(role)) {
+        sendJson(res, 400, { success: false, error: 'role must be one of: admin, deployer, viewer' });
+        return;
+    }
+    // Prevent self-demotion (accidental lockout)
+    if (username.trim() === session.username && role !== session.role) {
+        sendJson(res, 400, { success: false, error: 'Cannot change your own role' });
+        return;
+    }
+    const ip = getClientIp(req);
+    try {
+        await updateUserRole(username.trim(), role);
+        await audit('role_change', ip, session.username, {
+            target: username.trim(),
+            newRole: role,
+        });
+        sendJson(res, 200, { success: true });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : 'Failed to update role';
+        if (message === 'User not found' || message === 'Cannot demote the last admin') {
+            sendJson(res, 400, { success: false, error: message });
+        }
+        else {
+            sendJson(res, 400, { success: false, error: 'Failed to update role' });
+        }
+    }
+});

package/dist/wizard/api/war-room.d.ts

@@ -0,0 +1,16 @@
+/**
+ * War Room API — Alternative dashboard view using shared data parsers.
+ *
+ * v22.0 (ADR-041 M1): All routes use resolveProject() for project scoping.
+ * Routes registered at /api/projects/:id/war-room/*.
+ *
+ * Shares all parsers and WebSocket infra with Danger Room via wizard/lib/dashboard-*.ts.
+ */
+import type { IncomingMessage } from 'node:http';
+import type { Duplex } from 'node:stream';
+export declare const broadcastWarRoom: (data: {
+    type: string;
+    [key: string]: unknown;
+}, projectId?: string) => void;
+export declare const closeWarRoom: () => void;
+export declare const handleWarRoomUpgrade: (req: IncomingMessage, socket: Duplex, head: Buffer, projectId?: string) => void;

package/dist/wizard/api/war-room.js

@@ -0,0 +1,70 @@
+/**
+ * War Room API — Alternative dashboard view using shared data parsers.
+ *
+ * v22.0 (ADR-041 M1): All routes use resolveProject() for project scoping.
+ * Routes registered at /api/projects/:id/war-room/*.
+ *
+ * Shares all parsers and WebSocket infra with Danger Room via wizard/lib/dashboard-*.ts.
+ */
+import { addRoute } from '../router.js';
+import { sendJson } from '../lib/http-helpers.js';
+import { resolveProject } from '../lib/project-scope.js';
+import { parseCampaignState, parseBuildState, parseFindings, readDeployLog, readVersion, readContextStats, } from '../lib/dashboard-data.js';
+import { createDashboardWs } from '../lib/dashboard-ws.js';
+// ── WebSocket ───────────────────────────────────
+const ws = createDashboardWs('War Room');
+export const broadcastWarRoom = ws.broadcast;
+export const closeWarRoom = ws.close;
+export const handleWarRoomUpgrade = (req, socket, head, projectId) => ws.handleUpgrade(req, socket, head, projectId);
+// ── Project-scoped REST endpoints ──────────────
+addRoute('GET', '/api/projects/:id/war-room/campaign', async (req, res) => {
+    const resolved = await resolveProject(req, res);
+    if (!resolved)
+        return;
+    sendJson(res, 200, await parseCampaignState(resolved.context.logsDir));
+});
+addRoute('GET', '/api/projects/:id/war-room/build', async (req, res) => {
+    const resolved = await resolveProject(req, res);
+    if (!resolved)
+        return;
+    sendJson(res, 200, await parseBuildState(resolved.context.logsDir));
+});
+addRoute('GET', '/api/projects/:id/war-room/findings', async (req, res) => {
+    const resolved = await resolveProject(req, res);
+    if (!resolved)
+        return;
+    sendJson(res, 200, await parseFindings(resolved.context.logsDir));
+});
+addRoute('GET', '/api/projects/:id/war-room/version', async (req, res) => {
+    const resolved = await resolveProject(req, res);
+    if (!resolved)
+        return;
+    sendJson(res, 200, await readVersion(resolved.context.directory));
+});
+addRoute('GET', '/api/projects/:id/war-room/deploy', async (req, res) => {
+    const resolved = await resolveProject(req, res);
+    if (!resolved)
+        return;
+    sendJson(res, 200, await readDeployLog(resolved.context.logsDir));
+});
+addRoute('GET', '/api/projects/:id/war-room/context', async (_req, res) => {
+    // Context stats are global (user-scoped Claude session)
+    sendJson(res, 200, await readContextStats());
+});
+addRoute('GET', '/api/projects/:id/war-room/experiments', async (req, res) => {
+    const resolved = await resolveProject(req, res);
+    if (!resolved)
+        return;
+    try {
+        const { listExperiments } = await import('../lib/experiment.js');
+        const experiments = await listExperiments();
+        sendJson(res, 200, { experiments, total: experiments.length });
+    }
+    catch {
+        sendJson(res, 200, { experiments: [], total: 0 });
+    }
+});
+// ── Legacy routes removed (ADR-046, v23.4) ────────
+// The standalone war-room.html now redirects to the project dashboard.
+// Legacy /api/war-room/* shims (v22.0.x P0-B) have been removed.
+// All data is served via /api/projects/:id/war-room/* routes above.

package/dist/wizard/danger-room.config.json

@@ -0,0 +1,5 @@
+{
+  "health_endpoint": null,
+  "pm2_process": null,
+  "panels": ["git-status", "tests"]
+}

package/dist/wizard/lib/ad-platform-core.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Ad platform core — re-exports from the ad-platform-adapter pattern for wizard runtime use.
+ * ARCH-R2-012: Production code should not import from docs/patterns/ directly.
+ */
+export type { AdPlatformSetup, AdPlatformAdapter, ReadOnlyAdapter, CampaignConfig, CampaignResult, CampaignUpdate, CreativeConfig, SpendReport, PerformanceMetrics, InsightData, OAuthTokens, ConnectionStatus, PlatformError, Cents, Percentage, Ratio, AdPlatform, } from './patterns/ad-platform-adapter.js';
+export { toCents, toDollars } from './patterns/ad-platform-adapter.js';

package/dist/wizard/lib/ad-platform-core.js

@@ -0,0 +1 @@
+export { toCents, toDollars } from './patterns/ad-platform-adapter.js';

package/dist/wizard/lib/adapters/index.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Ad Platform Adapter Registry
+ *
+ * v17.0 No Stubs Doctrine: only fully-implemented adapters are exported.
+ * Stub files (meta, google, tiktok, linkedin, twitter, reddit, mercury, brex)
+ * were deleted — they contained 77 `throw new Error('Implement...')` calls.
+ * These adapters will be implemented when developer accounts are available (v17.1+).
+ * See ROADMAP.md for the planned adapter list.
+ *
+ * Available adapters:
+ * - SandboxSetup/SandboxAdapter — full implementation with realistic fake data
+ * - SandboxBankAdapter — full implementation for bank/revenue demo
+ * - StripeAdapter — real Stripe API via node:https (free test mode)
+ *
+ * PRD Reference: §9.5, §9.19.10, §9.20.4, §8.1 (Implementation Completeness Policy)
+ */
+export { SandboxSetup, SandboxAdapter } from './sandbox.js';
+export { SandboxBankAdapter } from './sandbox-bank.js';
+export { StripeAdapter } from './stripe.js';
+export type { AdPlatform } from './types.js';
+import type { AdPlatform } from './types.js';
+type PlatformInfo = {
+    name: string;
+    minBudgetCents: number;
+    sandbox?: boolean;
+    implemented: boolean;
+};
+/** Platform registry — tracks both available and planned adapters. */
+export declare const PLATFORM_REGISTRY: Record<AdPlatform | 'sandbox', PlatformInfo>;
+/** Revenue adapters — only those with real implementations. */
+export declare const REVENUE_ADAPTERS: {
+    readonly sandbox: {
+        readonly name: "Sandbox Bank (Demo)";
+        readonly implemented: true;
+    };
+    readonly stripe: {
+        readonly name: "Stripe";
+        readonly implemented: true;
+    };
+    readonly paddle: {
+        readonly name: "Paddle";
+        readonly implemented: false;
+    };
+    readonly mercury: {
+        readonly name: "Mercury";
+        readonly implemented: false;
+    };
+    readonly brex: {
+        readonly name: "Brex";
+        readonly implemented: false;
+    };
+};

package/dist/wizard/lib/adapters/index.js

@@ -0,0 +1,38 @@
+/**
+ * Ad Platform Adapter Registry
+ *
+ * v17.0 No Stubs Doctrine: only fully-implemented adapters are exported.
+ * Stub files (meta, google, tiktok, linkedin, twitter, reddit, mercury, brex)
+ * were deleted — they contained 77 `throw new Error('Implement...')` calls.
+ * These adapters will be implemented when developer accounts are available (v17.1+).
+ * See ROADMAP.md for the planned adapter list.
+ *
+ * Available adapters:
+ * - SandboxSetup/SandboxAdapter — full implementation with realistic fake data
+ * - SandboxBankAdapter — full implementation for bank/revenue demo
+ * - StripeAdapter — real Stripe API via node:https (free test mode)
+ *
+ * PRD Reference: §9.5, §9.19.10, §9.20.4, §8.1 (Implementation Completeness Policy)
+ */
+export { SandboxSetup, SandboxAdapter } from './sandbox.js';
+export { SandboxBankAdapter } from './sandbox-bank.js';
+export { StripeAdapter } from './stripe.js';
+/** Platform registry — tracks both available and planned adapters. */
+export const PLATFORM_REGISTRY = {
+    sandbox: { name: 'Sandbox (Demo)', minBudgetCents: 0, sandbox: true, implemented: true },
+    meta: { name: 'Meta (Facebook/Instagram)', minBudgetCents: 100, implemented: false },
+    google: { name: 'Google Ads', minBudgetCents: 100, implemented: false },
+    tiktok: { name: 'TikTok', minBudgetCents: 2000, implemented: false },
+    linkedin: { name: 'LinkedIn', minBudgetCents: 1000, implemented: false },
+    twitter: { name: 'Twitter/X', minBudgetCents: 100, implemented: false },
+    reddit: { name: 'Reddit', minBudgetCents: 500, implemented: false },
+    snap: { name: 'Snapchat', minBudgetCents: 500, implemented: false },
+};
+/** Revenue adapters — only those with real implementations. */
+export const REVENUE_ADAPTERS = {
+    sandbox: { name: 'Sandbox Bank (Demo)', implemented: true },
+    stripe: { name: 'Stripe', implemented: true },
+    paddle: { name: 'Paddle', implemented: false },
+    mercury: { name: 'Mercury', implemented: false },
+    brex: { name: 'Brex', implemented: false },
+};

package/dist/wizard/lib/adapters/sandbox-bank.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Sandbox Bank Adapter — full implementation for development/demo.
+ *
+ * Implements RevenueSourceAdapter with realistic fake financial data.
+ * Every method returns valid-shaped data. No throws.
+ * This IS a full implementation for a sandbox bank (No Stubs Doctrine, v17.0).
+ */
+import type { RevenueSourceAdapter, RevenueCredentials, ConnectionResult, TransactionPage, BalanceResult, DateRange } from '../revenue-types.js';
+export declare class SandboxBankAdapter implements RevenueSourceAdapter {
+    private accountName;
+    private balanceCents;
+    constructor(label?: string, initialBalanceCents?: number);
+    connect(credentials: RevenueCredentials): Promise<ConnectionResult>;
+    getTransactions(dateRange: DateRange, cursor?: string): Promise<TransactionPage>;
+    getBalance(): Promise<BalanceResult>;
+    detectCurrency(_credentials: RevenueCredentials): Promise<string>;
+}

package/dist/wizard/lib/adapters/sandbox-bank.js

@@ -0,0 +1,77 @@
+/**
+ * Sandbox Bank Adapter — full implementation for development/demo.
+ *
+ * Implements RevenueSourceAdapter with realistic fake financial data.
+ * Every method returns valid-shaped data. No throws.
+ * This IS a full implementation for a sandbox bank (No Stubs Doctrine, v17.0).
+ */
+import { randomUUID } from 'node:crypto';
+export class SandboxBankAdapter {
+    accountName;
+    balanceCents;
+    constructor(label = 'Sandbox Bank', initialBalanceCents = 500000) {
+        this.accountName = label;
+        this.balanceCents = initialBalanceCents;
+    }
+    async connect(credentials) {
+        return {
+            connected: true,
+            accountName: this.accountName,
+            accountId: `sandbox_bank_${randomUUID().slice(0, 8)}`,
+            currency: 'USD',
+        };
+    }
+    async getTransactions(dateRange, cursor) {
+        // Generate realistic transaction data
+        const dayCount = Math.ceil((new Date(dateRange.end).getTime() - new Date(dateRange.start).getTime()) / (24 * 60 * 60 * 1000));
+        // Invalid date range (end before start) — return empty result
+        if (dayCount <= 0) {
+            return {
+                transactions: [],
+                hasMore: false,
+                cursor: undefined,
+            };
+        }
+        const transactions = [];
+        // Simulate 2-5 transactions per day
+        for (let d = 0; d < dayCount; d++) {
+            const date = new Date(new Date(dateRange.start).getTime() + d * 86400000);
+            const txCount = 2 + Math.floor(Math.random() * 4);
+            for (let t = 0; t < txCount; t++) {
+                const isRevenue = Math.random() > 0.4; // 60% revenue, 40% expenses
+                const amountCents = isRevenue
+                    ? Math.round(500 + Math.random() * 9500) // $5-$100 revenue
+                    : -Math.round(100 + Math.random() * 5000); // $1-$50 expenses
+                const descriptions = isRevenue
+                    ? ['Stripe payout', 'Customer payment', 'Subscription renewal', 'One-time purchase']
+                    : ['Ad spend - Google', 'Ad spend - Meta', 'SaaS subscription', 'Domain renewal', 'Hosting'];
+                transactions.push({
+                    externalId: `txn_${randomUUID().slice(0, 12)}`,
+                    type: isRevenue ? 'charge' : 'refund',
+                    amount: amountCents,
+                    currency: 'USD',
+                    description: descriptions[Math.floor(Math.random() * descriptions.length)],
+                    metadata: { sandbox: 'true', category: isRevenue ? 'revenue' : 'expense' },
+                    createdAt: date.toISOString(),
+                });
+            }
+        }
+        return {
+            transactions,
+            hasMore: false,
+            cursor: undefined,
+        };
+    }
+    async getBalance() {
+        // Slightly vary the balance to simulate real account activity
+        this.balanceCents += Math.round((Math.random() - 0.3) * 10000);
+        return {
+            available: this.balanceCents,
+            pending: Math.round(Math.random() * 50000),
+            currency: 'USD',
+        };
+    }
+    async detectCurrency(_credentials) {
+        return 'USD';
+    }
+}

package/dist/wizard/lib/adapters/sandbox.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Sandbox Ad Platform Adapter — full implementation for development/demo.
+ *
+ * Returns realistic fake data matching the AdPlatformSetup + AdPlatformAdapter
+ * interfaces. Every method returns valid-shaped data. No throws.
+ * This IS a full implementation for a sandbox platform (No Stubs Doctrine, v17.0).
+ *
+ * Use case: demonstrates the full Cultivation pipeline end-to-end without
+ * real platform API credentials. Users can see data flowing through dashboards,
+ * heartbeat daemon running real jobs, reconciliation processing, circuit breakers firing.
+ */
+import type { AdPlatformSetup, AdPlatformAdapter, OAuthTokens, ConnectionStatus, CampaignConfig, CampaignResult, CampaignUpdate, CreativeConfig, SpendReport, PerformanceMetrics, InsightData, Cents } from './types.js';
+export declare class SandboxSetup implements AdPlatformSetup {
+    private label;
+    constructor(label?: string);
+    authenticate(): Promise<OAuthTokens>;
+    verifyConnection(tokens: OAuthTokens): Promise<ConnectionStatus>;
+    detectCurrency(_tokens: OAuthTokens): Promise<string>;
+}
+export declare class SandboxAdapter implements AdPlatformAdapter {
+    private accountId;
+    private tokens;
+    private campaigns;
+    constructor(accountId?: string, tokens?: OAuthTokens);
+    refreshToken(token: OAuthTokens): Promise<OAuthTokens>;
+    createCampaign(config: CampaignConfig): Promise<CampaignResult>;
+    updateCampaign(id: string, changes: CampaignUpdate): Promise<void>;
+    pauseCampaign(id: string): Promise<void>;
+    resumeCampaign(id: string): Promise<void>;
+    deleteCampaign(id: string): Promise<void>;
+    updateBudget(id: string, dailyBudget: Cents): Promise<void>;
+    updateCreative(_id: string, _creative: CreativeConfig): Promise<void>;
+    getSpend(dateRange: {
+        start: string;
+        end: string;
+    }): Promise<SpendReport>;
+    getPerformance(campaignId: string): Promise<PerformanceMetrics>;
+    getInsights(campaignId: string, metrics: string[]): Promise<InsightData>;
+}