@apifuse/provider-sdk 2.1.0-beta.11 → 2.1.0-beta.13

package/dist/cli/create.js

@@ -544,8 +544,8 @@ function renderAuthBlock(authMode) {
             return `{
     mode: "credentials",
     flow: {
-      start: async () => ({
-        kind: "input",
+      start: async (_ctx) => ({
+        kind: "form",
         turnId: crypto.randomUUID(),
         expectedInput: {
           schema: {
@@ -588,7 +588,7 @@ function renderAuthBlock(authMode) {
             return `{
     mode: "oauth2",
     flow: {
-      start: async () => ({
+      start: async (_ctx) => ({
         kind: "redirect",
         turnId: crypto.randomUUID(),
         data: {

package/dist/define.js

@@ -141,6 +141,11 @@ function validateProviderShape(config) {
         "mode" in auth &&
         typeof auth.mode === "string")
         assertLiteralField(auth.mode, "auth.mode", VALID_AUTH_MODES, String(config.id));
+    if (auth && typeof auth === "object" && "exchange" in auth) {
+        throw new ProviderError(`Provider "${String(config.id)}" auth.exchange is not part of the Provider SDK auth contract`, {
+            fix: "Use the single canonical auth interface: auth.flow. Gateway calls auth.flow.start/continue/poll/abort/refresh only and persists complete turn data.credential as-is, so put login/token/session exchange inside auth.flow.continue.",
+        });
+    }
     if (auth &&
         typeof auth === "object" &&
         "flow" in auth &&

package/dist/index.d.ts

@@ -1,3 +1,4 @@
+export * from "./auth";
 export * from "./ceremonies";
 export * from "./choice-token";
 export type { ApiFuseConfig, BrowserConfig, ProxyConfig, SessionConfig, } from "./config/loader";
@@ -33,7 +34,7 @@ export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SEN
 export { createServerApp, type ServeOptions, serve } from "./server";
 export { getStealthProfile, listStealthProfiles } from "./stealth/profiles";
 export * from "./stream";
-export type { ApiFuseResponse, AuthConfig, AuthContext, AuthFlowDefinition, AuthFlowInputHandler, AuthFlowStartHandler, AuthMode, AuthTurn, Bcp47Locale, BrowserEngine, BrowserOptions, ConnectionMode, ContextDeclaration, CookieJar, ContextScratchpad, CredentialContext, CredentialDeclaration, E164PhoneNumber, EnvContext, FlowContext, FlowContextStore, HealthCheckAssertionContext, HealthCheckCase, HealthCheckCaseResult, HealthCheckSuite, HealthCheckUnsupported, HealthJourneyDefinition, HealthJourneyEventContext, HealthJourneyGatewayContext, HealthJourneyJournalContext, HealthJourneyManualTriggerPolicy, HealthJourneyRunContext, HealthJourneyRunResult, HealthJourneySchedule, HealthJourneySmsContext, HealthJourneyStep, HttpClient, HttpMethod, HttpResponse, HttpRetryOptions, HttpRetrySummary, HttpStreamResponse, IanaTimeZone, InferSchemaOutput, Iso3166Alpha2CountryCode, Iso4217CurrencyCode, Iso8601Duration, OperationAnnotations, OperationApprovalPolicy, OperationContractMetadata, OperationDefinition, OperationDeprecationMetadata, OperationDocMeta, OperationErrorCode, OperationHandlerResult, OperationInputExample, OperationLifecycle, OperationObservabilityConfig, OperationObservabilitySensitiveConfig, OperationRelationships, OperationRiskClass, OperationSensitivePath, OperationToolRouterMetadata, OperationTransport, OperationTransportKind, ProbeInterval, ProviderAccessConfig, ProviderAccessVisibility, ProviderCache, ProviderCacheGetOrSetOptions, ProviderCacheKeyOptions, ProviderCacheLookupMeta, ProviderCacheResponseMeta, ProviderCacheResult, ProviderChoiceBindingOptions, ProviderChoiceContext, ProviderChoiceIssueOptions, ProviderChoiceParseOptions, ProviderContext, ProviderDefinition, ProviderHealthMonitorConfig, ProviderLocale, ProviderLocaleKey, ProviderLocaleKeyInput, ProviderLogoProfile, ProviderLogoSource, ProviderMeta, ProviderProxyConfig, ProviderProxyMode, ProviderProxyPolicy, ProviderProxyProvider, ProviderProxySessionAffinity, ProviderPublicConnectionMode, ProviderPublicProfile, ProviderReviewed, ProviderRuntimeState, ProviderSecretDeclaration, ProviderStateDurationString, ProviderStateNamespace, ProviderStreamEvent, ProviderSttConfig, ProviderSttMode, ProviderSupportLevel, RequestOptions, Rfc3339Instant, SchemaLike, SmsOrigin, SmsOtpExtractionPattern, SmsOtpMatcherDefinition, SseMessage, StandardSchemaV1, StateCasResult, StateNamespaceOptions, StateValue, StateWriteOptions, StealthClient, StealthFetchOptions, StealthPlatform, StealthProfile, StealthRedirectHop, StealthRedirectRunOptions, StealthRedirectRunResult, StealthResponse, StealthSession, StealthSessionCookies, SttAudioInput, SttContext, SttPromptPolicy, SttSegment, SttTranscribeMode, SttTranscribeRequest, SttTranscript, SttUnsupportedOptionPolicy, SttUsage, SttVerificationCodeOptions, SttWarning, TraceConfig, TraceSpan, VerificationCodeCandidate, VerificationCodeCandidateSource, VerificationCodeExtractionResult, } from "./types";
+export type { ApiFuseResponse, AuthConfig, AuthContext, AuthFlowDefinition, AuthFlowInputHandler, AuthFlowStartHandler, AuthMode, AuthTurn, Bcp47Locale, BrowserEngine, BrowserOptions, BrowserResourceBody, BrowserResourceDecision, BrowserResourceMethod, BrowserResourcePolicy, BrowserResourceRequest, BrowserResourceRoute, ConnectionMode, ContextDeclaration, CookieJar, ContextScratchpad, CredentialContext, CredentialDeclaration, E164PhoneNumber, EnvContext, FlowContext, FlowContextStore, HealthCheckAssertionContext, HealthCheckCase, HealthCheckCaseResult, HealthCheckSuite, HealthCheckUnsupported, HealthJourneyDefinition, HealthJourneyEventContext, HealthJourneyGatewayContext, HealthJourneyJournalContext, HealthJourneyManualTriggerPolicy, HealthJourneyRunContext, HealthJourneyRunResult, HealthJourneySchedule, HealthJourneySmsContext, HealthJourneyStep, HttpClient, HttpMethod, HttpResponse, HttpRetryOptions, HttpRetrySummary, HttpStreamResponse, IanaTimeZone, InferSchemaOutput, Iso3166Alpha2CountryCode, Iso4217CurrencyCode, Iso8601Duration, OperationAnnotations, OperationApprovalPolicy, OperationContractMetadata, OperationDefinition, OperationDeprecationMetadata, OperationDocMeta, OperationErrorCode, OperationHandlerResult, OperationInputExample, OperationLifecycle, OperationObservabilityConfig, OperationObservabilitySensitiveConfig, OperationRelationships, OperationRiskClass, OperationSensitivePath, OperationToolRouterMetadata, OperationTransport, OperationTransportKind, ProbeInterval, ProviderAccessConfig, ProviderAccessVisibility, ProviderCache, ProviderCacheGetOrSetOptions, ProviderCacheKeyOptions, ProviderCacheLookupMeta, ProviderCacheResponseMeta, ProviderCacheResult, ProviderChoiceBindingOptions, ProviderChoiceContext, ProviderChoiceIssueOptions, ProviderChoiceParseOptions, ProviderContext, ProviderDefinition, ProviderHealthMonitorConfig, ProviderLocale, ProviderLocaleKey, ProviderLocaleKeyInput, ProviderLogoProfile, ProviderLogoSource, ProviderMeta, ProviderProxyConfig, ProviderProxyMode, ProviderProxyPolicy, ProviderProxyProvider, ProviderProxySessionAffinity, ProviderPublicConnectionMode, ProviderPublicProfile, ProviderReviewed, ProviderRuntimeState, ProviderSecretDeclaration, ProviderStateDurationString, ProviderStateNamespace, ProviderStreamEvent, ProviderSttConfig, ProviderSttMode, ProviderSupportLevel, RequestOptions, Rfc3339Instant, SchemaLike, SmsOrigin, SmsOtpExtractionPattern, SmsOtpMatcherDefinition, SseMessage, StandardSchemaV1, StateCasResult, StateNamespaceOptions, StateValue, StateWriteOptions, StealthClient, StealthFetchOptions, StealthPlatform, StealthProfile, StealthRedirectHop, StealthRedirectRunOptions, StealthRedirectRunResult, StealthResponse, StealthSession, StealthSessionCookies, SttAudioInput, SttContext, SttPromptPolicy, SttSegment, SttTranscribeMode, SttTranscribeRequest, SttTranscript, SttUnsupportedOptionPolicy, SttUsage, SttVerificationCodeOptions, SttWarning, TraceConfig, TraceSpan, VerificationCodeCandidate, VerificationCodeCandidateSource, VerificationCodeExtractionResult, } from "./types";
 export { DEFAULT_OPERATION_TRANSPORT, HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, PROBE_INTERVALS, STREAM_CHUNK_BYTES_MAX, STREAM_CHUNK_BYTES_MIN, STREAM_HEARTBEAT_MS_MAX, STREAM_HEARTBEAT_MS_MIN, STREAM_IDLE_TIMEOUT_MS_MAX, STREAM_IDLE_TIMEOUT_MS_MIN, STREAM_MAX_DURATION_MS_MAX, STREAM_MAX_DURATION_MS_MIN, } from "./types";
 export * from "./utils/date";
 export * from "./utils/parse";

package/dist/index.js

@@ -1,4 +1,5 @@
 // @apifuse/provider-sdk
+export * from "./auth";
 export * from "./ceremonies";
 export * from "./choice-token";
 export { defineConfig, loadApiFuseConfig } from "./config/loader";

package/dist/lint.d.ts

@@ -8,6 +8,7 @@ type ProviderAuthLike = {
         abort?: unknown;
         refresh?: unknown;
     };
+    exchange?: unknown;
 };
 type ProviderContractMetaLike = {
     publicSchemaFieldNames?: "normalized";

package/dist/lint.js

@@ -1,5 +1,6 @@
 import { lintPublicSchemaFieldNames } from "./public-schema-field-lint";
 import { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_SENSITIVE_META_KEY, } from "./schema";
+const AUTH_OPERATION_ID_PATTERN = /^(?:auth[-_])?(?:login|exchange|continue|refresh|callback)(?:[-_]|$)/i;
 function lintAllowedHosts(providerId, allowedHosts) {
     const prefix = providerId ? `Provider "${providerId}"` : "Provider";
     if (!allowedHosts) {
@@ -49,6 +50,9 @@ function lintReviewed(providerId, reviewed) {
         },
     ];
 }
+function isProviderAuthLike(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
 function hasReusableSecretKeys(keys) {
     if (!keys) {
         return false;
@@ -99,6 +103,14 @@ function lintAuthModel(provider) {
             message: `${providerLabel} must define auth.flow.continue for ${authMode} auth mode.`,
         });
     }
+    if (isProviderAuthLike(provider.auth) && "exchange" in provider.auth) {
+        diagnostics.push({
+            rule: "auth-exchange-unsupported",
+            level: "error",
+            field: "auth.exchange",
+            message: `${providerLabel} must not define auth.exchange. The Provider SDK has one auth interface: auth.flow. Gateway only calls auth.flow.start/continue/poll/abort/refresh and persists complete turn data.credential as-is; put login/token/session exchange inside auth.flow.continue.`,
+        });
+    }
     if (authMode === "credentials" && credentialKeys.length === 0) {
         diagnostics.push({
             rule: "credential-keys-required-when-credentials-mode",
@@ -673,6 +685,21 @@ export function lintProvider(provider, options = {}) {
         ...lintPlaywrightDirectImports(provider),
         ...lintSelfHostedBrowserPatterns(provider, options),
     ];
+    if (provider.operations) {
+        const authMode = provider.auth?.mode;
+        if (authMode === "credentials" || authMode === "oauth2") {
+            for (const operationKey of Object.keys(provider.operations)) {
+                if (AUTH_OPERATION_ID_PATTERN.test(operationKey)) {
+                    diagnostics.push({
+                        rule: "auth-operation-unsupported",
+                        level: "error",
+                        field: `operations.${operationKey}`,
+                        message: `Provider "${provider.id ?? "unknown"}" operation "${operationKey}" looks like a login/token/session exchange endpoint. Authenticated providers must expose login through the single auth.flow interface because Gateway persists only auth.flow complete turn data.credential as the connection credential. Move this logic into auth.flow.continue instead of a provider operation.`,
+                    });
+                }
+            }
+        }
+    }
     if (!provider.operations) {
         return diagnostics;
     }

package/dist/provider.d.ts

@@ -1,3 +1,5 @@
+export { AuthAbortError, credentialsAuthChallenge, createAuthFlowHelpers, defineCredentialsAuth, } from "./auth";
+export type { CredentialsAuthChallengeDefinition, CredentialsAuthChallengeRequest, CredentialsAuthCompleteResult, CredentialsAuthCredential, CredentialsAuthField, CredentialsAuthFields, CredentialsAuthFieldType, CredentialsAuthInput, CredentialsAuthLoginResult, DefineCredentialsAuthOptions, DefinedCredentialsAuth, } from "./auth";
 export { createFormCeremony } from "./ceremonies";
 export { assertFreshProviderChoiceIssuedAt, createProviderChoiceToken, ProviderChoiceTokenError, type ProviderChoiceTokenErrorReason, type ProviderChoiceTokenPayload, parseProviderChoiceToken, } from "./choice-token";
 export { defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, every, } from "./define";
@@ -5,5 +7,5 @@ export { AuthError, ProviderError, SessionExpiredError, TransportError, Validati
 export { getProviderLocalePath, providerLocaleKey, qualifyProviderLocaleKey, } from "./i18n";
 export { type CreateProviderChoiceContextOptions, createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice";
 export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, type SensitiveFieldKind, type SensitiveFieldOptions, type SensitivePath, sensitive, z, } from "./schema";
-export type { AuthMode, FlowContext, HealthCheckAssertionContext, HealthCheckCase, HealthCheckSuite, HealthCheckUnsupported, HealthJourneyDefinition, HealthJourneyEventContext, HealthJourneyManualTriggerPolicy, HealthJourneyRunContext, HealthJourneyRunResult, HttpRetryOptions, HttpRetrySummary, InferSchemaOutput, OperationApprovalPolicy, OperationContractMetadata, OperationDefinition, OperationDocMeta, OperationErrorCode, OperationInputExample, OperationLifecycle, OperationObservabilityConfig, OperationObservabilitySensitiveConfig, OperationRelationships, OperationRiskClass, OperationSensitivePath, OperationToolRouterMetadata, OperationTransport, ProviderAccessVisibility, ProviderChoiceBindingOptions, ProviderChoiceContext, ProviderChoiceIssueOptions, ProviderChoiceParseOptions, ProviderContext, ProviderDefinition, ProviderLocale, ProviderLocaleKey, ProviderLocaleKeyInput, ProviderLogoProfile, ProviderProxyPolicy, ProviderPublicConnectionMode, ProviderPublicProfile, ProviderRuntimeState, ProviderStateDurationString, ProviderStateNamespace, ProviderSupportLevel, SchemaLike, SmsOtpMatcherDefinition, StandardSchemaV1, StateCasResult, StateNamespaceOptions, StateValue, StateWriteOptions, } from "./types";
+export type { AuthAbortData, AuthAbortRetry, AuthFlowTerminalContext, AuthMode, AuthSafeData, AuthSafeJson, FlowContext, HealthCheckAssertionContext, HealthCheckCase, HealthCheckSuite, HealthCheckUnsupported, HealthJourneyDefinition, HealthJourneyEventContext, HealthJourneyManualTriggerPolicy, HealthJourneyRunContext, HealthJourneyRunResult, HttpRetryOptions, HttpRetrySummary, InferSchemaOutput, OperationApprovalPolicy, OperationContractMetadata, OperationDefinition, OperationDocMeta, OperationErrorCode, OperationInputExample, OperationLifecycle, OperationObservabilityConfig, OperationObservabilitySensitiveConfig, OperationRelationships, OperationRiskClass, OperationSensitivePath, OperationToolRouterMetadata, OperationTransport, ProviderAccessVisibility, ProviderChoiceBindingOptions, ProviderChoiceContext, ProviderChoiceIssueOptions, ProviderChoiceParseOptions, ProviderContext, ProviderDefinition, ProviderLocale, ProviderLocaleKey, ProviderLocaleKeyInput, ProviderLogoProfile, ProviderProxyPolicy, ProviderPublicConnectionMode, ProviderPublicProfile, ProviderRuntimeState, ProviderStateDurationString, ProviderStateNamespace, ProviderSupportLevel, SchemaLike, SmsOtpMatcherDefinition, StandardSchemaV1, StateCasResult, StateNamespaceOptions, StateValue, StateWriteOptions, } from "./types";
 export { HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, } from "./types";

package/dist/provider.js

@@ -1,3 +1,4 @@
+export { AuthAbortError, credentialsAuthChallenge, createAuthFlowHelpers, defineCredentialsAuth, } from "./auth";
 export { createFormCeremony } from "./ceremonies";
 export { assertFreshProviderChoiceIssuedAt, createProviderChoiceToken, ProviderChoiceTokenError, parseProviderChoiceToken, } from "./choice-token";
 export { defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, every, } from "./define";

package/dist/runtime/auth-flow.js

@@ -1,4 +1,5 @@
 import { ContextAccessError } from "../errors";
+import { createAuthFlowHelpers } from "../auth";
 import { createUnsupportedSttClient } from "./stt";
 function normalizeAllowedKeys(allowedKeys) {
     return new Set(allowedKeys.filter((key) => key.trim().length > 0));
@@ -40,5 +41,6 @@ export function createFlowContext(options) {
         env: options.env,
         context: createScratchpad(options.allowedKeys, options.initialContext),
         stt: options.stt ?? createUnsupportedSttClient(),
+        auth: createAuthFlowHelpers(),
     };
 }

package/dist/runtime/browser.js

@@ -3,6 +3,106 @@ import { ProviderError } from "../errors";
 const require = createRequire(import.meta.url);
 const DEFAULT_WAIT_TIMEOUT_MS = 30_000;
 const SELECTOR_POLL_INTERVAL_MS = 100;
+const RESOURCE_POLICY_ROUTE_PATTERN = "**/*";
+const DEFAULT_RESOURCE_METHODS = ["GET", "HEAD"];
+function toResourceBody(body) {
+    if (body === undefined || typeof body === "string" || Buffer.isBuffer(body)) {
+        return body;
+    }
+    if (body instanceof ArrayBuffer) {
+        return Buffer.from(new Uint8Array(body));
+    }
+    return Buffer.from(body);
+}
+function isResourceMethod(method) {
+    return method === "GET" || method === "HEAD";
+}
+async function toResourceRequest(request) {
+    const method = request.method().toUpperCase();
+    if (!isResourceMethod(method)) {
+        return null;
+    }
+    return {
+        headers: await request.allHeaders(),
+        method,
+        resourceType: request.resourceType(),
+        url: request.url(),
+    };
+}
+function toCdpResourceRequest(params) {
+    if (!isRecord(params)) {
+        return null;
+    }
+    const requestId = params.requestId;
+    const rawRequest = params.request;
+    if (typeof requestId !== "string" || !isRecord(rawRequest)) {
+        return null;
+    }
+    const url = rawRequest.url;
+    const method = String(rawRequest.method ?? "").toUpperCase();
+    if (typeof url !== "string" || !isResourceMethod(method)) {
+        return null;
+    }
+    return {
+        requestId,
+        request: {
+            headers: toCdpResourceHeaders(rawRequest.headers),
+            method,
+            resourceType: typeof params.resourceType === "string" ? params.resourceType : undefined,
+            url,
+        },
+    };
+}
+function getCdpPausedRequestId(params) {
+    if (!isRecord(params) || typeof params.requestId !== "string") {
+        return null;
+    }
+    return params.requestId;
+}
+function toCdpResourceHeaders(value) {
+    if (!isRecord(value)) {
+        return {};
+    }
+    const headers = {};
+    for (const [name, headerValue] of Object.entries(value)) {
+        if (typeof headerValue === "string") {
+            headers[name] = headerValue;
+        }
+    }
+    return headers;
+}
+function matchesResourceRoute(match, request) {
+    if (typeof match === "string") {
+        return request.url === match;
+    }
+    if (match instanceof RegExp) {
+        return match.test(request.url);
+    }
+    return match(request);
+}
+function toCdpFulfillParams(requestId, decision) {
+    const body = toResourceBody(decision.body);
+    return {
+        ...(body === undefined
+            ? {}
+            : { body: Buffer.from(body).toString("base64") }),
+        ...(decision.headers === undefined
+            ? {}
+            : {
+                responseHeaders: Object.entries(decision.headers).map(([name, value]) => ({ name, value })),
+            }),
+        requestId,
+        responseCode: decision.status ?? 200,
+    };
+}
+async function fulfillResourceRoute(route, decision) {
+    const body = toResourceBody(decision.body);
+    await route.fulfill({
+        ...(body === undefined ? {} : { body }),
+        ...(decision.headers === undefined ? {} : { headers: decision.headers }),
+        status: decision.status ?? 200,
+    });
+}
 function getDefaultCdpPoolUrl(env = process.env) {
     return env.APIFUSE__CDP_POOL__URL;
 }
@@ -256,6 +356,38 @@ class PlaywrightBrowserPage {
     async close() {
         await this.page.close();
     }
+    async withResourcePolicy(policy, run) {
+        const allowedMethods = new Set(policy.allowedMethods ?? DEFAULT_RESOURCE_METHODS);
+        const handler = async (route) => {
+            const request = await toResourceRequest(route.request());
+            if (!request || !allowedMethods.has(request.method)) {
+                await route.abort("blockedbyclient");
+                return;
+            }
+            for (const resourceRoute of policy.routes) {
+                if (!matchesResourceRoute(resourceRoute.match, request)) {
+                    continue;
+                }
+                const decision = await resourceRoute.handle(request);
+                switch (decision.action) {
+                    case "fulfill":
+                        await fulfillResourceRoute(route, decision);
+                        return;
+                    case "block":
+                        await route.abort("blockedbyclient");
+                        return;
+                }
+            }
+            await route.abort("blockedbyclient");
+        };
+        await this.page.route(RESOURCE_POLICY_ROUTE_PATTERN, handler);
+        try {
+            return await run();
+        }
+        finally {
+            await this.page.unroute(RESOURCE_POLICY_ROUTE_PATTERN, handler);
+        }
+    }
 }
 class PlaywrightBrowserClient {
     options;
@@ -737,6 +869,77 @@ class CdpPoolBrowserPage {
             await this.pageClient.close();
         }
     }
+    async withResourcePolicy(policy, run) {
+        const allowedMethods = new Set(policy.allowedMethods ?? DEFAULT_RESOURCE_METHODS);
+        const handlePausedRequest = (params) => {
+            void this.handleResourcePolicyPausedRequest(params, policy, allowedMethods);
+        };
+        const unsubscribe = this.pageClient.on("Fetch.requestPaused", handlePausedRequest);
+        try {
+            await this.pageClient.send("Fetch.enable", {
+                patterns: [{ requestStage: "Request", urlPattern: "*" }],
+            });
+        }
+        catch (error) {
+            unsubscribe();
+            throw new ProviderError("CDP browser target does not support BrowserPage.withResourcePolicy()", {
+                cause: error instanceof Error ? error : undefined,
+                code: "BROWSER_RUNTIME_UNSUPPORTED",
+                fix: "Use a Chromium CDP target with the Fetch domain enabled, or use the local Playwright browser runtime.",
+            });
+        }
+        try {
+            return await run();
+        }
+        finally {
+            unsubscribe();
+            await this.pageClient.send("Fetch.disable");
+        }
+    }
+    async handleResourcePolicyPausedRequest(params, policy, allowedMethods) {
+        const requestId = getCdpPausedRequestId(params);
+        if (requestId === null) {
+            return;
+        }
+        try {
+            const parsed = toCdpResourceRequest(params);
+            if (!parsed || !allowedMethods.has(parsed.request.method)) {
+                await this.failCdpResourceRequest(requestId);
+                return;
+            }
+            for (const resourceRoute of policy.routes) {
+                if (!matchesResourceRoute(resourceRoute.match, parsed.request)) {
+                    continue;
+                }
+                const decision = await resourceRoute.handle(parsed.request);
+                switch (decision.action) {
+                    case "fulfill":
+                        await this.pageClient.send("Fetch.fulfillRequest", toCdpFulfillParams(parsed.requestId, decision));
+                        return;
+                    case "block":
+                        await this.failCdpResourceRequest(parsed.requestId);
+                        return;
+                }
+            }
+            await this.failCdpResourceRequest(parsed.requestId);
+        }
+        catch {
+            await this.failCdpResourceRequest(requestId);
+        }
+    }
+    async failCdpResourceRequest(requestId) {
+        try {
+            await this.pageClient.send("Fetch.failRequest", {
+                errorReason: "BlockedByClient",
+                requestId,
+            });
+        }
+        catch (error) {
+            if (error instanceof Error) {
+                return;
+            }
+        }
+    }
     async initialize() {
         if (this.initialized) {
             return;

package/dist/server/serve.js

@@ -2,6 +2,7 @@ import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { Hono } from "hono";
 import { z } from "zod";
+import { AuthAbortError, createAuthFlowHelpers } from "../auth";
 import { AuthError, ProviderError, SessionExpiredError, TransportError, } from "../errors";
 import { loadProviderLocaleCatalogs, localizeAuthTurn, } from "../i18n/catalog";
 import { categoryForStatus, isRetryableCategory, PROVIDER_OBSERVABILITY_TAXONOMY_VERSION, } from "../observability";
@@ -209,7 +210,7 @@ function createFlowContextStore(allowedKeys, initialContext = {}) {
         },
     };
 }
-function createAuthFlowContext(provider, request, options = {}) {
+function createAuthFlowContext(provider, request, options = {}, signal) {
     const baseUrl = getProviderBaseUrl(provider);
     const stealthBaseUrl = getProviderStealthBaseUrl(provider);
     const stealthProfile = getProviderStealthProfile(provider);
@@ -251,6 +252,7 @@ function createAuthFlowContext(provider, request, options = {}) {
             credential,
             context: flowContextStore.context,
             stt: options.stt ?? createSttClientFromEnv(provider.stt),
+            auth: createAuthFlowHelpers({ signal }),
         },
         getPatch: flowContextStore.getPatch,
     };
@@ -879,14 +881,14 @@ function responseWithProviderTelemetry(response, proxyTelemetry) {
         statusText: response.statusText,
     });
 }
-async function handleAuthFlow(provider, request, route, options = {}) {
+async function handleAuthFlow(provider, request, route, options = {}, signal) {
     const flow = provider.auth?.flow;
     if (!flow) {
         throw new ProviderError("Auth flow is not configured", {
             code: "AUTH_FLOW_NOT_CONFIGURED",
         });
     }
-    const { context, getPatch } = createAuthFlowContext(provider, request, options);
+    const { context, getPatch } = createAuthFlowContext(provider, request, options, signal);
     try {
         const result = route === "start"
             ? await flow.start(context)
@@ -916,6 +918,12 @@ async function handleAuthFlow(provider, request, route, options = {}) {
             : result;
         return toAuthFlowResponse(materializedResult, getPatch());
     }
+    catch (error) {
+        if (error instanceof AuthAbortError) {
+            return toAuthFlowResponse(error.turn, getPatch());
+        }
+        throw error;
+    }
     finally {
         context.stealth.close?.();
     }
@@ -982,7 +990,7 @@ export function createServerApp(provider, options = {}) {
                 .json()
                 .catch(() => undefined);
             const body = withAuthRequestHeaders(AuthFlowRequestSchema.parse(rawBody), c.req.raw.headers);
-            const response = await handleAuthFlow(provider, body, "start", options);
+            const response = await handleAuthFlow(provider, body, "start", options, c.req.raw.signal);
             logProviderSuccess(logger, provider, "auth", "start", body.requestId, response instanceof Response ? response.status : 200, finishRequestCost(requestCost));
             return response instanceof Response ? response : c.json(response);
         }
@@ -1002,7 +1010,7 @@ export function createServerApp(provider, options = {}) {
                 .json()
                 .catch(() => undefined);
             const body = withAuthRequestHeaders(AuthFlowRequestSchema.parse(rawBody), c.req.raw.headers);
-            const response = await handleAuthFlow(provider, body, "continue", options);
+            const response = await handleAuthFlow(provider, body, "continue", options, c.req.raw.signal);
             logProviderSuccess(logger, provider, "auth", "continue", body.requestId, response instanceof Response ? response.status : 200, finishRequestCost(requestCost));
             return response instanceof Response ? response : c.json(response);
         }
@@ -1022,7 +1030,7 @@ export function createServerApp(provider, options = {}) {
                 .json()
                 .catch(() => undefined);
             const body = withAuthRequestHeaders(AuthFlowRequestSchema.parse(rawBody), c.req.raw.headers);
-            const response = await handleAuthFlow(provider, body, "poll", options);
+            const response = await handleAuthFlow(provider, body, "poll", options, c.req.raw.signal);
             logProviderSuccess(logger, provider, "auth", "poll", body.requestId, response instanceof Response ? response.status : 200, finishRequestCost(requestCost));
             return response instanceof Response ? response : c.json(response);
         }
@@ -1042,7 +1050,7 @@ export function createServerApp(provider, options = {}) {
                 .json()
                 .catch(() => undefined);
             const body = withAuthRequestHeaders(AuthFlowRequestSchema.parse(rawBody), c.req.raw.headers);
-            const response = await handleAuthFlow(provider, body, "refresh", options);
+            const response = await handleAuthFlow(provider, body, "refresh", options, c.req.raw.signal);
             logProviderSuccess(logger, provider, "auth", "refresh", body.requestId, response instanceof Response ? response.status : 200, finishRequestCost(requestCost));
             return response instanceof Response ? response : c.json(response);
         }
@@ -1062,7 +1070,7 @@ export function createServerApp(provider, options = {}) {
                 .json()
                 .catch(() => undefined);
             const body = withAuthRequestHeaders(AuthFlowRequestSchema.parse(rawBody), c.req.raw.headers);
-            const response = await handleAuthFlow(provider, body, "abort", options);
+            const response = await handleAuthFlow(provider, body, "abort", options, c.req.raw.signal);
             logProviderSuccess(logger, provider, "auth", "disconnect", body.requestId, response instanceof Response ? response.status : 200, finishRequestCost(requestCost));
             return response instanceof Response ? response : c.json(response);
         }

package/dist/types.d.ts

@@ -1016,6 +1016,32 @@ export interface BrowserFrame {
     evaluate<T>(fn: string | (() => T)): Promise<T>;
     locator(selector: string): BrowserLocator;
 }
+export type BrowserResourceMethod = "GET" | "HEAD";
+export type BrowserResourceRequest = {
+    readonly url: string;
+    readonly method: BrowserResourceMethod;
+    readonly resourceType?: string;
+    readonly headers: Readonly<Record<string, string>>;
+};
+export type BrowserResourceBody = Buffer | Uint8Array | ArrayBuffer | string;
+export type BrowserResourceDecision = {
+    readonly action: "fulfill";
+    readonly status?: number;
+    readonly headers?: Readonly<Record<string, string>>;
+    readonly body?: BrowserResourceBody;
+} | {
+    readonly action: "block";
+    readonly reason?: string;
+};
+export type BrowserResourceRoute = {
+    readonly match: string | RegExp | ((request: BrowserResourceRequest) => boolean);
+    readonly handle: (request: BrowserResourceRequest) => Promise<BrowserResourceDecision> | BrowserResourceDecision;
+};
+export type BrowserResourcePolicy = {
+    readonly defaultAction?: "block";
+    readonly allowedMethods?: readonly BrowserResourceMethod[];
+    readonly routes: readonly BrowserResourceRoute[];
+};
 export interface BrowserPage extends BrowserFrame {
     close(): Promise<void>;
     fill(selector: string, text: string): Promise<void>;
@@ -1030,6 +1056,7 @@ export interface BrowserPage extends BrowserFrame {
         timeout?: number;
     }): Promise<void>;
     frames(): Promise<BrowserFrame[]>;
+    withResourcePolicy<T>(policy: BrowserResourcePolicy, run: () => Promise<T>): Promise<T>;
 }
 export type BrowserChallengeRequest = {
     type: "recaptcha";
@@ -1170,6 +1197,73 @@ export interface ContextScratchpad {
     toJSON(): Record<string, unknown>;
 }
 export type FlowContextStore = ContextScratchpad;
+export type AuthSafeJson = string | number | boolean | null | readonly AuthSafeJson[] | {
+    readonly [key: string]: AuthSafeJson;
+};
+export type AuthSafeData = {
+    readonly [key: string]: AuthSafeJson;
+};
+export type AuthAbortRetry = "never" | "retry" | "after_user_action";
+export type AuthAbortData = Record<string, unknown> & {
+    readonly code: string;
+    readonly message?: string;
+    readonly retry?: AuthAbortRetry;
+    readonly actionHint?: AuthSafeJson;
+    readonly fieldErrors?: {
+        readonly [field: string]: string;
+    };
+    readonly details?: AuthSafeData;
+};
+export interface AuthFlowTerminalContext {
+    readonly signal?: AbortSignal;
+    readonly deadline?: string;
+    complete<TCredential extends Record<string, string>>(options: {
+        readonly credential: TCredential;
+        readonly metadata?: AuthSafeData;
+        readonly data?: AuthSafeData;
+        readonly turnId?: string;
+        readonly expiresAt?: string;
+    }): AuthTurn;
+    abort(options: {
+        readonly code: string;
+        readonly message?: string;
+        readonly retry?: AuthAbortRetry;
+        readonly actionHint?: AuthSafeJson;
+        readonly fieldErrors?: {
+            readonly [field: string]: string;
+        };
+        readonly data?: AuthSafeData;
+        readonly turnId?: string;
+        readonly expiresAt?: string;
+    }): AuthTurn;
+    nextForm(options: {
+        readonly hintKey?: ProviderLocaleKeyInput;
+        readonly data?: AuthSafeData;
+        readonly turnId?: string;
+        readonly expiresAt?: string;
+        readonly timing?: AuthTurn["timing"];
+    } & ({
+        readonly fields: Record<string, {
+            readonly type?: "string" | "email" | "password" | "otp";
+            readonly labelKey?: ProviderLocaleKeyInput;
+            readonly descriptionKey?: ProviderLocaleKeyInput;
+            readonly placeholderKey?: ProviderLocaleKeyInput;
+            readonly required?: boolean;
+            readonly sensitive?: boolean;
+        }>;
+        readonly expectedInput?: never;
+    } | {
+        readonly expectedInput: Record<string, unknown>;
+        readonly fields?: never;
+    })): AuthTurn;
+    nextPoll(options?: {
+        readonly hintKey?: ProviderLocaleKeyInput;
+        readonly data?: AuthSafeData;
+        readonly turnId?: string;
+        readonly expiresAt?: string;
+        readonly timing?: AuthTurn["timing"];
+    }): AuthTurn;
+}
 export interface FlowContext {
     connectionId?: string;
     externalRef?: string;
@@ -1181,6 +1275,7 @@ export interface FlowContext {
     credential?: CredentialContext;
     context: ContextScratchpad;
     stt: SttContext;
+    auth: AuthFlowTerminalContext;
 }
 export interface AuthTurn {
     kind: string;

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "2.1.0-beta.11",
+	"version": "2.1.0-beta.13",
 	"name": "@apifuse/provider-sdk",
 	"private": false,
 	"type": "module",