@apifuse/provider-sdk 2.1.0-beta.9 → 2.2.0-beta.10

package/dist/dev.d.ts

@@ -1,4 +1,4 @@
-import type { ProviderDefinition } from "./types";
+import type { ProviderDefinition } from "./types.js";
 export interface DevServerOptions {
     port?: number;
     sessionDbPath?: string;

package/dist/dev.js

@@ -1,4 +1,4 @@
-import { serve } from "./server/serve";
+import { serve } from "./server/serve.js";
 export function createDevServer(provider, options) {
     const port = options?.port ?? 3900;
     return {

package/dist/errors.d.ts

@@ -1,4 +1,4 @@
-import type { ProviderErrorCategory } from "./observability";
+import type { ProviderErrorCategory } from "./observability.js";
 export type ProviderErrorOptions = {
     fix?: string;
     code?: string;
@@ -39,6 +39,9 @@ export declare class TransportError extends ProviderError {
     readonly upstreamStatus?: number;
     constructor(message: string, options?: TransportErrorOptions);
 }
+export declare function isProviderError(value: unknown): value is ProviderError;
+export declare function isSessionExpiredError(value: unknown): value is SessionExpiredError;
+export declare function isTransportError(value: unknown): value is TransportError;
 export declare class ProviderSecretError extends ProviderError {
     constructor(message: string, options?: ProviderErrorOptions);
 }

package/dist/errors.js

@@ -1,3 +1,35 @@
+// Versioned, cross-realm brands. `Symbol.for` resolves to the same symbol in
+// any copy/entrypoint of this SDK major version, so an error created by a
+// duplicate module instance (e.g. the packaged CLI's src/* server vs a
+// provider's dist/* import) still carries a brand the server can recognize even
+// though `instanceof` splits across the two constructors. The `@1` suffix lets a
+// future breaking change to this contract mint a distinct key.
+const PROVIDER_ERROR_BRAND = Symbol.for("@apifuse/provider-sdk/error-brand@1");
+const PROVIDER_ERROR_BRAND_VALUE = 1;
+const SESSION_EXPIRED_BRAND = Symbol.for("@apifuse/provider-sdk/error-kind/session-expired@1");
+const TRANSPORT_BRAND = Symbol.for("@apifuse/provider-sdk/error-kind/transport@1");
+// Defines a non-enumerable, non-writable, non-configurable own data property.
+// Immutable + own means a guard can trust it via a single descriptor read
+// without invoking attacker-controlled getters or accepting inherited brands.
+function defineErrorBrand(target, brand, value) {
+    Object.defineProperty(target, brand, {
+        value,
+        enumerable: false,
+        writable: false,
+        configurable: false,
+    });
+}
+// Recognizes an own data-property brand with the expected value. Rejects
+// missing brands (unbranded lookalikes), accessor brands (no own `value`
+// slot — the getter is never called), and inherited brands (own-descriptor
+// lookup returns undefined on the child).
+function hasOwnBrand(value, brand, expected) {
+    if (value === null || (typeof value !== "object" && typeof value !== "function")) {
+        return false;
+    }
+    const descriptor = Object.getOwnPropertyDescriptor(value, brand);
+    return (descriptor !== undefined && Object.hasOwn(descriptor, "value") && descriptor.value === expected);
+}
 export class ProviderError extends Error {
     options;
     constructor(message, options) {
@@ -7,6 +39,7 @@ export class ProviderError extends Error {
         if (options?.cause) {
             this.cause = options.cause;
         }
+        defineErrorBrand(this, PROVIDER_ERROR_BRAND, PROVIDER_ERROR_BRAND_VALUE);
     }
     get fix() {
         return this.options?.fix;
@@ -39,6 +72,7 @@ export class SessionExpiredError extends AuthError {
             ...options,
         });
         this.name = "SessionExpiredError";
+        defineErrorBrand(this, SESSION_EXPIRED_BRAND, true);
     }
 }
 export class ValidationError extends ProviderError {
@@ -57,8 +91,22 @@ export class TransportError extends ProviderError {
         this.name = "TransportError";
         this.status = options?.status;
         this.upstreamStatus = options?.upstreamStatus ?? options?.status;
+        defineErrorBrand(this, TRANSPORT_BRAND, true);
     }
 }
+// Cross-module type guards. Prefer these over `instanceof` at any boundary that
+// may receive an error from a different copy/entrypoint of the SDK (see the HTTP
+// server error boundary). They recognize branded errors regardless of which
+// module instance constructed them, while rejecting unbranded lookalikes.
+export function isProviderError(value) {
+    return hasOwnBrand(value, PROVIDER_ERROR_BRAND, PROVIDER_ERROR_BRAND_VALUE);
+}
+export function isSessionExpiredError(value) {
+    return isProviderError(value) && hasOwnBrand(value, SESSION_EXPIRED_BRAND, true);
+}
+export function isTransportError(value) {
+    return isProviderError(value) && hasOwnBrand(value, TRANSPORT_BRAND, true);
+}
 export class ProviderSecretError extends ProviderError {
     constructor(message, options) {
         super(message, { code: "provider_secret_error", ...options });

package/dist/i18n/catalog.d.ts

@@ -1,5 +1,5 @@
-import type { AuthTurn } from "../types";
-import { type ProviderLocale, type ProviderLocaleCatalog, type ProviderLocaleKey, type ProviderLocaleValue } from "./keys";
+import type { AuthTurn } from "../types.js";
+import { type ProviderLocale, type ProviderLocaleCatalog, type ProviderLocaleKey, type ProviderLocaleValue } from "./keys.js";
 export type ProviderLocaleCatalogMap = Record<ProviderLocale, ProviderLocaleCatalog>;
 export interface LoadProviderLocaleCatalogsOptions {
     providerDir: string;

package/dist/i18n/catalog.js

@@ -1,6 +1,6 @@
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
-import { getProviderLocalePath, isProviderLocaleValue, providerLocaleKey, } from "./keys";
+import { getProviderLocalePath, isProviderLocaleValue, providerLocaleKey, } from "./keys.js";
 export function loadProviderLocaleCatalogs(options) {
     const catalogs = {};
     for (const locale of options.locales) {
@@ -26,9 +26,7 @@ function isStringRecord(value) {
 function localizeAuthInputSchema(expectedInput, options) {
     if (!expectedInput)
         return undefined;
-    const schema = isRecord(expectedInput.schema)
-        ? expectedInput.schema
-        : expectedInput;
+    const schema = isRecord(expectedInput.schema) ? expectedInput.schema : expectedInput;
     const localizedSchema = localizeAuthSchemaObject(schema, options);
     if (localizedSchema === schema)
         return undefined;
@@ -40,9 +38,7 @@ function isRecord(value) {
     return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function localizeAuthSchemaObject(schema, options) {
-    const properties = isRecord(schema.properties)
-        ? schema.properties
-        : undefined;
+    const properties = isRecord(schema.properties) ? schema.properties : undefined;
     if (!properties)
         return schema;
     let changed = false;
@@ -50,9 +46,7 @@ function localizeAuthSchemaObject(schema, options) {
         if (!isRecord(property))
             return [fieldName, property];
         const nameKey = typeof property.nameKey === "string" ? property.nameKey : undefined;
-        const descriptionKey = typeof property.descriptionKey === "string"
-            ? property.descriptionKey
-            : undefined;
+        const descriptionKey = typeof property.descriptionKey === "string" ? property.descriptionKey : undefined;
         const title = nameKey
             ? asStringValue(resolveProviderLocaleValue(options.catalogs, nameKey, options.locale, options.fallbackLocale))
             : undefined;

package/dist/i18n/index.d.ts

@@ -1,2 +1,2 @@
-export * from "./catalog";
-export * from "./keys";
+export * from "./catalog.js";
+export * from "./keys.js";

package/dist/i18n/index.js

@@ -1,2 +1,2 @@
-export * from "./catalog";
-export * from "./keys";
+export * from "./catalog.js";
+export * from "./keys.js";

package/dist/i18n/keys.d.ts

@@ -1,5 +1,5 @@
-import type { ProviderLocaleKey } from "../types";
-export type { ProviderLocale, ProviderLocaleKey } from "../types";
+import type { ProviderLocaleKey } from "../types.js";
+export type { ProviderLocale, ProviderLocaleKey } from "../types.js";
 export declare function providerLocaleKey(key: string): ProviderLocaleKey;
 export declare function isProviderLocaleKey(value: unknown): value is ProviderLocaleKey;
 export declare function assertProviderLocaleKey(value: unknown): asserts value is ProviderLocaleKey;

package/dist/index.d.ts

@@ -1,41 +1,44 @@
-export * from "./ceremonies";
-export * from "./choice-token";
-export type { ApiFuseConfig, BrowserConfig, ProxyConfig, SessionConfig, } from "./config/loader";
-export { defineConfig, loadApiFuseConfig } from "./config/loader";
-export { canonicalJson, digestProviderContract, extractProviderContract, type JsonPrimitive, type JsonValue, PROVIDER_CONTRACT_SCHEMA_VERSION, type ProviderContractOperation, type ProviderContractSnapshot, } from "./contract";
-export { defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, defineStreamOperation, every, type ProviderConfig, } from "./define";
-export type { DevServerOptions } from "./dev";
-export { createDevServer, startDevServer } from "./dev";
-export * from "./errors";
-export * from "./i18n";
-export { type LintDiagnostic, lintOperation, lintProvider, } from "./lint";
-export * from "./recipes/gov-api";
-export * from "./recipes/rest-api";
-export { createFlowContext, createScratchpad } from "./runtime/auth-flow";
-export type { BrowserClientOptions } from "./runtime/browser";
-export { BrowserClient, createBrowserClient } from "./runtime/browser";
-export { createBypassProviderCache, createProviderCache, type ProviderCacheOptions, resetProviderCacheForTests, } from "./runtime/cache";
-export { type CreateProviderChoiceContextOptions, createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice";
-export { type CreateCredentialContextOptions, createCredentialContext, } from "./runtime/credential";
-export { createEnvContext } from "./runtime/env";
-export { executeOperation } from "./runtime/executor";
-export { createHttpClient } from "./runtime/http";
-export type { Insight, InsightSeverity } from "./runtime/insights";
-export { generateInsights } from "./runtime/insights";
-export { type InstrumentationOptions, type InstrumentedProviderContext, wrapWithInstrumentation, } from "./runtime/instrumentation";
-export { type PrevalidateResult, prevalidate } from "./runtime/prevalidate";
-export { getProviderBaseUrl } from "./runtime/provider";
-export { createUnsupportedProviderRuntimeState, UnsupportedProviderStateError, } from "./runtime/state";
-export { createStealthClient } from "./runtime/stealth";
-export { APIFUSE__STT__BACKEND_ENV, APIFUSE__STT__CLOUDFLARE_API_TOKEN_ENV, APIFUSE__STT__MODEL_ENV, createSttClientFromEnv, createUnsupportedSttClient, extractVerificationCode, resolveSttPrompt, } from "./runtime/stt";
-export { type CreateTraceContextOptions, createTraceContext, type Span, type TraceContext, } from "./runtime/trace";
-export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, type SensitiveFieldKind, type SensitiveFieldOptions, type SensitivePath, sensitive, z, } from "./schema";
-export { createServerApp, type ServeOptions, serve } from "./server";
-export { getStealthProfile, listStealthProfiles } from "./stealth/profiles";
-export * from "./stream";
-export type { ApiFuseResponse, AuthConfig, AuthContext, AuthFlowDefinition, AuthFlowInputHandler, AuthFlowStartHandler, AuthMode, AuthTurn, Bcp47Locale, BrowserEngine, BrowserOptions, ConnectionMode, ContextDeclaration, ContextScratchpad, CredentialContext, CredentialDeclaration, E164PhoneNumber, EnvContext, FlowContext, FlowContextStore, HealthCheckAssertionContext, HealthCheckCase, HealthCheckCaseResult, HealthCheckSuite, HealthCheckUnsupported, HealthJourneyDefinition, HealthJourneyEventContext, HealthJourneyGatewayContext, HealthJourneyJournalContext, HealthJourneyManualTriggerPolicy, HealthJourneyRunContext, HealthJourneyRunResult, HealthJourneySchedule, HealthJourneySmsContext, HealthJourneyStep, HttpClient, HttpMethod, HttpResponse, HttpRetryOptions, HttpRetrySummary, HttpStreamResponse, IanaTimeZone, InferSchemaOutput, Iso3166Alpha2CountryCode, Iso4217CurrencyCode, Iso8601Duration, OperationAnnotations, OperationApprovalPolicy, OperationContractMetadata, OperationDefinition, OperationDeprecationMetadata, OperationDocMeta, OperationErrorCode, OperationHandlerResult, OperationInputExample, OperationLifecycle, OperationObservabilityConfig, OperationObservabilitySensitiveConfig, OperationRelationships, OperationRiskClass, OperationSensitivePath, OperationToolRouterMetadata, OperationTransport, OperationTransportKind, ProbeInterval, ProviderAccessConfig, ProviderAccessVisibility, ProviderCache, ProviderCacheGetOrSetOptions, ProviderCacheKeyOptions, ProviderCacheLookupMeta, ProviderCacheResponseMeta, ProviderCacheResult, ProviderChoiceBindingOptions, ProviderChoiceContext, ProviderChoiceIssueOptions, ProviderChoiceParseOptions, ProviderContext, ProviderDefinition, ProviderHealthMonitorConfig, ProviderLocale, ProviderLocaleKey, ProviderLocaleKeyInput, ProviderLogoProfile, ProviderLogoSource, ProviderMeta, ProviderProxyConfig, ProviderProxyMode, ProviderProxyPolicy, ProviderProxyProvider, ProviderProxySessionAffinity, ProviderPublicConnectionMode, ProviderPublicProfile, ProviderReviewed, ProviderRuntimeState, ProviderSecretDeclaration, ProviderStateDurationString, ProviderStateNamespace, ProviderStreamEvent, ProviderSttConfig, ProviderSttMode, ProviderSupportLevel, RequestOptions, Rfc3339Instant, SchemaLike, SmsOrigin, SmsOtpExtractionPattern, SmsOtpMatcherDefinition, SseMessage, StandardSchemaV1, StateCasResult, StateNamespaceOptions, StateValue, StateWriteOptions, StealthClient, StealthFetchOptions, StealthPlatform, StealthProfile, StealthResponse, StealthSession, SttAudioInput, SttContext, SttPromptPolicy, SttSegment, SttTranscribeMode, SttTranscribeRequest, SttTranscript, SttUnsupportedOptionPolicy, SttUsage, SttVerificationCodeOptions, SttWarning, TraceConfig, TraceSpan, VerificationCodeCandidate, VerificationCodeCandidateSource, VerificationCodeExtractionResult, } from "./types";
-export { DEFAULT_OPERATION_TRANSPORT, HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, PROBE_INTERVALS, STREAM_CHUNK_BYTES_MAX, STREAM_CHUNK_BYTES_MIN, STREAM_HEARTBEAT_MS_MAX, STREAM_HEARTBEAT_MS_MIN, STREAM_IDLE_TIMEOUT_MS_MAX, STREAM_IDLE_TIMEOUT_MS_MIN, STREAM_MAX_DURATION_MS_MAX, STREAM_MAX_DURATION_MS_MIN, } from "./types";
-export * from "./utils/date";
-export * from "./utils/parse";
-export * from "./utils/text";
-export * from "./utils/transform";
+export * from "./auth.js";
+export * from "./ceremonies/index.js";
+export * from "./choice-token.js";
+export type { ApiFuseConfig, BrowserConfig, ProxyConfig, SessionConfig, } from "./config/loader.js";
+export { defineConfig, loadApiFuseConfig } from "./config/loader.js";
+export { canonicalJson, digestProviderContract, extractProviderContract, type JsonPrimitive, type JsonValue, PROVIDER_CONTRACT_SCHEMA_VERSION, type ProviderContractOperation, type ProviderContractSnapshot, } from "./contract.js";
+export { centered, delayed, defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, defineStreamOperation, every, type ProviderConfig, } from "./define.js";
+export type { DevServerOptions } from "./dev.js";
+export { createDevServer, startDevServer } from "./dev.js";
+export * from "./errors.js";
+export * from "./user-input.js";
+export * from "./i18n/index.js";
+export { type LintDiagnostic, lintOperation, lintProvider, } from "./lint.js";
+export * from "./recipes/gov-api.js";
+export * from "./recipes/rest-api.js";
+export { createFlowContext, createScratchpad } from "./runtime/auth-flow.js";
+export type { BrowserClientOptions } from "./runtime/browser.js";
+export { BrowserClient, createBrowserClient } from "./runtime/browser.js";
+export { createBypassProviderCache, createProviderCache, type ProviderCacheOptions, resetProviderCacheForTests, } from "./runtime/cache.js";
+export { type CreateProviderChoiceContextOptions, createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice.js";
+export { type CreateCredentialContextOptions, createCredentialContext, } from "./runtime/credential.js";
+export { createEnvContext } from "./runtime/env.js";
+export { executeOperation } from "./runtime/executor.js";
+export { createHttpClient } from "./runtime/http.js";
+export type { Insight, InsightSeverity } from "./runtime/insights.js";
+export { generateInsights } from "./runtime/insights.js";
+export { type InstrumentationOptions, type InstrumentedProviderContext, wrapWithInstrumentation, } from "./runtime/instrumentation.js";
+export { type PrevalidateResult, prevalidate } from "./runtime/prevalidate.js";
+export { getProviderBaseUrl } from "./runtime/provider.js";
+export { assertRequiredSecretsPresent, listMissingRequiredSecrets, MISSING_SECRET_CODE, } from "./runtime/secrets.js";
+export { createUnsupportedProviderRuntimeState, UnsupportedProviderStateError, } from "./runtime/state.js";
+export { createStealthClient } from "./runtime/stealth.js";
+export { APIFUSE__STT__BACKEND_ENV, APIFUSE__STT__CLOUDFLARE_API_TOKEN_ENV, APIFUSE__STT__MODEL_ENV, createSttClientFromEnv, createUnsupportedSttClient, extractVerificationCode, resolveSttPrompt, } from "./runtime/stt.js";
+export { type CreateTraceContextOptions, createTraceContext, type Span, type TraceContext, } from "./runtime/trace.js";
+export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, type SensitiveFieldKind, type SensitiveFieldOptions, type SensitivePath, sensitive, z, } from "./schema.js";
+export { createServerApp, type ServeOptions, serve } from "./server/index.js";
+export { getStealthProfile, listStealthProfiles } from "./stealth/profiles.js";
+export * from "./stream.js";
+export type { ApiFuseResponse, AuthConfig, AuthContext, AuthFlowDefinition, AuthFlowInputHandler, AuthFlowStartHandler, AuthMode, AuthTurn, Bcp47Locale, BrowserEngine, BrowserOptions, BrowserResourceBody, BrowserResourceDecision, BrowserResourceMethod, BrowserResourcePolicy, BrowserResourceRequest, BrowserResourceRoute, ConnectionMode, ContextDeclaration, CookieJar, ContextScratchpad, CredentialContext, CredentialDeclaration, E164PhoneNumber, EnvContext, FlowContext, FlowContextStore, HealthCheckAssertionContext, HealthCheckCase, HealthCheckCaseResult, HealthCheckSuite, HealthCheckUnsupported, HealthJourneyDefinition, HealthJourneyEventContext, HealthJourneyGatewayContext, HealthJourneyJournalContext, HealthJourneyManualTriggerPolicy, HealthJourneyRunContext, HealthJourneyRunResult, HealthJourneySchedule, HealthScheduleRandomization, HealthJourneySmsContext, HealthJourneyStep, HttpClient, HttpMethod, HttpResponse, HttpRetryOptions, HttpRetrySummary, HttpStreamResponse, IanaTimeZone, InferSchemaOutput, Iso3166Alpha2CountryCode, Iso4217CurrencyCode, Iso8601Duration, OperationAnnotations, OperationApprovalPolicy, OperationContractMetadata, OperationDefinition, OperationDeprecationMetadata, OperationDocMeta, OperationErrorCode, OperationHandlerResult, OperationInputExample, OperationLifecycle, OperationObservabilityConfig, OperationObservabilitySensitiveConfig, OperationRelationships, OperationRiskClass, OperationSensitivePath, OperationToolRouterMetadata, OperationTransport, OperationTransportKind, ProbeInterval, ProviderAccessConfig, ProviderAccessVisibility, ProviderCache, ProviderCacheGetOrSetOptions, ProviderCacheKeyOptions, ProviderCacheLookupMeta, ProviderCacheResponseMeta, ProviderCacheResult, ProviderChoiceBindingOptions, ProviderChoiceContext, ProviderChoiceIssueOptions, ProviderChoiceParseOptions, ProviderContext, ProviderDefinition, ProviderDeploymentOverrides, ProviderHealthMonitorConfig, ProviderHealthProbeConfig, ProviderLocale, ProviderLocaleKey, ProviderLocaleKeyInput, ProviderLogoProfile, ProviderLogoSource, ProviderMeta, ProviderProxyConfig, ProviderProxyMode, ProviderProxyPolicy, ProviderProxyProvider, ProviderProxySessionAffinity, ProviderPublicConnectionMode, ProviderPublicProfile, ProviderReviewed, ProviderRuntimeState, ProviderSecretDeclaration, ProviderStateDurationString, ProviderStateNamespace, ProviderStreamEvent, ProviderSttConfig, ProviderSttMode, ProviderSupportLevel, RequestOptions, Rfc3339Instant, SchemaLike, SmsOrigin, SmsOtpExtractionPattern, SmsOtpMatcherDefinition, SseMessage, StandardSchemaV1, StateCasResult, StateNamespaceOptions, StateValue, StateWriteOptions, StealthClient, StealthFetchOptions, StealthPlatform, StealthProfile, StealthRedirectHop, StealthRedirectRunOptions, StealthRedirectRunResult, StealthResponse, StealthSession, StealthSessionCookies, SttAudioInput, SttContext, SttPromptPolicy, SttSegment, SttTranscribeMode, SttTranscribeRequest, SttTranscript, SttUnsupportedOptionPolicy, SttUsage, SttVerificationCodeOptions, SttWarning, TraceConfig, TraceSpan, VerificationCodeCandidate, VerificationCodeCandidateSource, VerificationCodeExtractionResult, } from "./types.js";
+export { DEFAULT_OPERATION_TRANSPORT, HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, PROBE_INTERVALS, STREAM_CHUNK_BYTES_MAX, STREAM_CHUNK_BYTES_MIN, STREAM_HEARTBEAT_MS_MAX, STREAM_HEARTBEAT_MS_MIN, STREAM_IDLE_TIMEOUT_MS_MAX, STREAM_IDLE_TIMEOUT_MS_MIN, STREAM_MAX_DURATION_MS_MAX, STREAM_MAX_DURATION_MS_MIN, } from "./types.js";
+export * from "./utils/date.js";
+export * from "./utils/parse.js";
+export * from "./utils/text.js";
+export * from "./utils/transform.js";

package/dist/index.js

@@ -1,37 +1,40 @@
 // @apifuse/provider-sdk
-export * from "./ceremonies";
-export * from "./choice-token";
-export { defineConfig, loadApiFuseConfig } from "./config/loader";
-export { canonicalJson, digestProviderContract, extractProviderContract, PROVIDER_CONTRACT_SCHEMA_VERSION, } from "./contract";
-export { defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, defineStreamOperation, every, } from "./define";
-export { createDevServer, startDevServer } from "./dev";
-export * from "./errors";
-export * from "./i18n";
-export { lintOperation, lintProvider, } from "./lint";
-export * from "./recipes/gov-api";
-export * from "./recipes/rest-api";
-export { createFlowContext, createScratchpad } from "./runtime/auth-flow";
-export { BrowserClient, createBrowserClient } from "./runtime/browser";
-export { createBypassProviderCache, createProviderCache, resetProviderCacheForTests, } from "./runtime/cache";
-export { createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice";
-export { createCredentialContext, } from "./runtime/credential";
-export { createEnvContext } from "./runtime/env";
-export { executeOperation } from "./runtime/executor";
-export { createHttpClient } from "./runtime/http";
-export { generateInsights } from "./runtime/insights";
-export { wrapWithInstrumentation, } from "./runtime/instrumentation";
-export { prevalidate } from "./runtime/prevalidate";
-export { getProviderBaseUrl } from "./runtime/provider";
-export { createUnsupportedProviderRuntimeState, UnsupportedProviderStateError, } from "./runtime/state";
-export { createStealthClient } from "./runtime/stealth";
-export { APIFUSE__STT__BACKEND_ENV, APIFUSE__STT__CLOUDFLARE_API_TOKEN_ENV, APIFUSE__STT__MODEL_ENV, createSttClientFromEnv, createUnsupportedSttClient, extractVerificationCode, resolveSttPrompt, } from "./runtime/stt";
-export { createTraceContext, } from "./runtime/trace";
-export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, sensitive, z, } from "./schema";
-export { createServerApp, serve } from "./server";
-export { getStealthProfile, listStealthProfiles } from "./stealth/profiles";
-export * from "./stream";
-export { DEFAULT_OPERATION_TRANSPORT, HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, PROBE_INTERVALS, STREAM_CHUNK_BYTES_MAX, STREAM_CHUNK_BYTES_MIN, STREAM_HEARTBEAT_MS_MAX, STREAM_HEARTBEAT_MS_MIN, STREAM_IDLE_TIMEOUT_MS_MAX, STREAM_IDLE_TIMEOUT_MS_MIN, STREAM_MAX_DURATION_MS_MAX, STREAM_MAX_DURATION_MS_MIN, } from "./types";
-export * from "./utils/date";
-export * from "./utils/parse";
-export * from "./utils/text";
-export * from "./utils/transform";
+export * from "./auth.js";
+export * from "./ceremonies/index.js";
+export * from "./choice-token.js";
+export { defineConfig, loadApiFuseConfig } from "./config/loader.js";
+export { canonicalJson, digestProviderContract, extractProviderContract, PROVIDER_CONTRACT_SCHEMA_VERSION, } from "./contract.js";
+export { centered, delayed, defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, defineStreamOperation, every, } from "./define.js";
+export { createDevServer, startDevServer } from "./dev.js";
+export * from "./errors.js";
+export * from "./user-input.js";
+export * from "./i18n/index.js";
+export { lintOperation, lintProvider, } from "./lint.js";
+export * from "./recipes/gov-api.js";
+export * from "./recipes/rest-api.js";
+export { createFlowContext, createScratchpad } from "./runtime/auth-flow.js";
+export { BrowserClient, createBrowserClient } from "./runtime/browser.js";
+export { createBypassProviderCache, createProviderCache, resetProviderCacheForTests, } from "./runtime/cache.js";
+export { createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice.js";
+export { createCredentialContext, } from "./runtime/credential.js";
+export { createEnvContext } from "./runtime/env.js";
+export { executeOperation } from "./runtime/executor.js";
+export { createHttpClient } from "./runtime/http.js";
+export { generateInsights } from "./runtime/insights.js";
+export { wrapWithInstrumentation, } from "./runtime/instrumentation.js";
+export { prevalidate } from "./runtime/prevalidate.js";
+export { getProviderBaseUrl } from "./runtime/provider.js";
+export { assertRequiredSecretsPresent, listMissingRequiredSecrets, MISSING_SECRET_CODE, } from "./runtime/secrets.js";
+export { createUnsupportedProviderRuntimeState, UnsupportedProviderStateError, } from "./runtime/state.js";
+export { createStealthClient } from "./runtime/stealth.js";
+export { APIFUSE__STT__BACKEND_ENV, APIFUSE__STT__CLOUDFLARE_API_TOKEN_ENV, APIFUSE__STT__MODEL_ENV, createSttClientFromEnv, createUnsupportedSttClient, extractVerificationCode, resolveSttPrompt, } from "./runtime/stt.js";
+export { createTraceContext, } from "./runtime/trace.js";
+export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, sensitive, z, } from "./schema.js";
+export { createServerApp, serve } from "./server/index.js";
+export { getStealthProfile, listStealthProfiles } from "./stealth/profiles.js";
+export * from "./stream.js";
+export { DEFAULT_OPERATION_TRANSPORT, HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, PROBE_INTERVALS, STREAM_CHUNK_BYTES_MAX, STREAM_CHUNK_BYTES_MIN, STREAM_HEARTBEAT_MS_MAX, STREAM_HEARTBEAT_MS_MIN, STREAM_IDLE_TIMEOUT_MS_MAX, STREAM_IDLE_TIMEOUT_MS_MIN, STREAM_MAX_DURATION_MS_MAX, STREAM_MAX_DURATION_MS_MIN, } from "./types.js";
+export * from "./utils/date.js";
+export * from "./utils/parse.js";
+export * from "./utils/text.js";
+export * from "./utils/transform.js";

package/dist/lint.d.ts

@@ -8,6 +8,7 @@ type ProviderAuthLike = {
         abort?: unknown;
         refresh?: unknown;
     };
+    exchange?: unknown;
 };
 type ProviderContractMetaLike = {
     publicSchemaFieldNames?: "normalized";

package/dist/lint.js

@@ -1,5 +1,6 @@
-import { lintPublicSchemaFieldNames } from "./public-schema-field-lint";
-import { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_SENSITIVE_META_KEY, } from "./schema";
+import { lintPublicSchemaFieldNames } from "./public-schema-field-lint.js";
+import { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_SENSITIVE_META_KEY } from "./schema.js";
+const AUTH_OPERATION_ID_PATTERN = /^(?:auth[-_])?(?:login|exchange|continue|refresh|callback)(?:[-_]|$)/i;
 function lintAllowedHosts(providerId, allowedHosts) {
     const prefix = providerId ? `Provider "${providerId}"` : "Provider";
     if (!allowedHosts) {
@@ -49,6 +50,9 @@ function lintReviewed(providerId, reviewed) {
         },
     ];
 }
+function isProviderAuthLike(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
 function hasReusableSecretKeys(keys) {
     if (!keys) {
         return false;
@@ -99,6 +103,14 @@ function lintAuthModel(provider) {
             message: `${providerLabel} must define auth.flow.continue for ${authMode} auth mode.`,
         });
     }
+    if (isProviderAuthLike(provider.auth) && "exchange" in provider.auth) {
+        diagnostics.push({
+            rule: "auth-exchange-unsupported",
+            level: "error",
+            field: "auth.exchange",
+            message: `${providerLabel} must not define auth.exchange. The Provider SDK has one auth interface: auth.flow. Gateway only calls auth.flow.start/continue/poll/abort/refresh and persists complete turn data.credential as-is; put login/token/session exchange inside auth.flow.continue.`,
+        });
+    }
     if (authMode === "credentials" && credentialKeys.length === 0) {
         diagnostics.push({
             rule: "credential-keys-required-when-credentials-mode",
@@ -108,8 +120,7 @@ function lintAuthModel(provider) {
         });
     }
     if (hasReusableSecretKeys(credentialKeys) &&
-        (!provider.credential?.storesReusableSecret ||
-            !provider.credential.justification)) {
+        (!provider.credential?.storesReusableSecret || !provider.credential.justification)) {
         diagnostics.push({
             rule: "credential-reusable-secret",
             level: "error",
@@ -119,8 +130,7 @@ function lintAuthModel(provider) {
     }
     if (typeof provider.auth?.flow?.refresh === "function" &&
         hasReusableReloginSecretKeys(credentialKeys) &&
-        (!provider.credential?.storesReusableSecret ||
-            !provider.credential.justification)) {
+        (!provider.credential?.storesReusableSecret || !provider.credential.justification)) {
         diagnostics.push({
             rule: "auth-refresh-reusable-secret",
             level: "error",
@@ -137,8 +147,7 @@ function lintAuthModel(provider) {
         });
     }
     const authFlowSource = getAuthFlowSource(provider);
-    if (authFlowSource.includes("ctx.context") &&
-        (provider.context?.keys?.length ?? 0) === 0) {
+    if (authFlowSource.includes("ctx.context") && (provider.context?.keys?.length ?? 0) === 0) {
         diagnostics.push({
             rule: "context-keys-required",
             level: "warn",
@@ -423,8 +432,7 @@ function isComplexSchema(schema, seen = new Set()) {
         const childChildren = getChildSchemas(child);
         return childChildren.length > 0;
     });
-    return (hasNestedComposite ||
-        children.some(({ schema: child }) => isComplexSchema(child, seen)));
+    return hasNestedComposite || children.some(({ schema: child }) => isComplexSchema(child, seen));
 }
 function hasBidirectionalFixtures(fixtures) {
     if (!fixtures || typeof fixtures !== "object") {
@@ -436,9 +444,7 @@ function getOperationSource(operation) {
     if (operation.source) {
         return operation.source;
     }
-    return typeof operation.handler === "function"
-        ? operation.handler.toString()
-        : "";
+    return typeof operation.handler === "function" ? operation.handler.toString() : "";
 }
 function lintStealthTransportUsage(provider) {
     if (provider.stealth || !provider.operations) {
@@ -609,8 +615,7 @@ export function lintOperation(op) {
             message: "Operation whenToUse must use whenToUseKeys instead of raw static prose.",
         });
     }
-    if ((op.whenNotToUse?.length ?? 0) > 0 &&
-        !(op.whenNotToUseKeys?.length ?? 0)) {
+    if ((op.whenNotToUse?.length ?? 0) > 0 && !(op.whenNotToUseKeys?.length ?? 0)) {
         diagnostics.push({
             rule: "operation-when-not-to-use-raw-prose",
             level: "error",
@@ -673,6 +678,21 @@ export function lintProvider(provider, options = {}) {
         ...lintPlaywrightDirectImports(provider),
         ...lintSelfHostedBrowserPatterns(provider, options),
     ];
+    if (provider.operations) {
+        const authMode = provider.auth?.mode;
+        if (authMode === "credentials" || authMode === "oauth2") {
+            for (const operationKey of Object.keys(provider.operations)) {
+                if (AUTH_OPERATION_ID_PATTERN.test(operationKey)) {
+                    diagnostics.push({
+                        rule: "auth-operation-unsupported",
+                        level: "error",
+                        field: `operations.${operationKey}`,
+                        message: `Provider "${provider.id ?? "unknown"}" operation "${operationKey}" looks like a login/token/session exchange endpoint. Authenticated providers must expose login through the single auth.flow interface because Gateway persists only auth.flow complete turn data.credential as the connection credential. Move this logic into auth.flow.continue instead of a provider operation.`,
+                    });
+                }
+            }
+        }
+    }
     if (!provider.operations) {
         return diagnostics;
     }

package/dist/provider.d.ts

@@ -1,9 +1,11 @@
-export { createFormCeremony } from "./ceremonies";
-export { assertFreshProviderChoiceIssuedAt, createProviderChoiceToken, ProviderChoiceTokenError, type ProviderChoiceTokenErrorReason, type ProviderChoiceTokenPayload, parseProviderChoiceToken, } from "./choice-token";
-export { defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, every, } from "./define";
-export { AuthError, ProviderError, SessionExpiredError, TransportError, ValidationError, } from "./errors";
-export { getProviderLocalePath, providerLocaleKey, qualifyProviderLocaleKey, } from "./i18n";
-export { type CreateProviderChoiceContextOptions, createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice";
-export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, type SensitiveFieldKind, type SensitiveFieldOptions, type SensitivePath, sensitive, z, } from "./schema";
-export type { AuthMode, FlowContext, HealthCheckAssertionContext, HealthCheckCase, HealthCheckSuite, HealthCheckUnsupported, HealthJourneyDefinition, HealthJourneyEventContext, HealthJourneyManualTriggerPolicy, HealthJourneyRunContext, HealthJourneyRunResult, HttpRetryOptions, HttpRetrySummary, InferSchemaOutput, OperationApprovalPolicy, OperationContractMetadata, OperationDefinition, OperationDocMeta, OperationErrorCode, OperationInputExample, OperationLifecycle, OperationObservabilityConfig, OperationObservabilitySensitiveConfig, OperationRelationships, OperationRiskClass, OperationSensitivePath, OperationToolRouterMetadata, OperationTransport, ProviderAccessVisibility, ProviderChoiceBindingOptions, ProviderChoiceContext, ProviderChoiceIssueOptions, ProviderChoiceParseOptions, ProviderContext, ProviderDefinition, ProviderLocale, ProviderLocaleKey, ProviderLocaleKeyInput, ProviderLogoProfile, ProviderProxyPolicy, ProviderPublicConnectionMode, ProviderPublicProfile, ProviderRuntimeState, ProviderStateDurationString, ProviderStateNamespace, ProviderSupportLevel, SchemaLike, SmsOtpMatcherDefinition, StandardSchemaV1, StateCasResult, StateNamespaceOptions, StateValue, StateWriteOptions, } from "./types";
-export { HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, } from "./types";
+export { AuthAbortError, credentialsAuthChallenge, createAuthFlowHelpers, defineCredentialsAuth, } from "./auth.js";
+export type { CredentialsAuthChallengeDefinition, CredentialsAuthChallengeRequest, CredentialsAuthCompleteResult, CredentialsAuthCredential, CredentialsAuthField, CredentialsAuthFields, CredentialsAuthFieldType, CredentialsAuthInput, CredentialsAuthLoginResult, DefineCredentialsAuthOptions, DefinedCredentialsAuth, } from "./auth.js";
+export { createFormCeremony } from "./ceremonies/index.js";
+export { assertFreshProviderChoiceIssuedAt, createProviderChoiceToken, ProviderChoiceTokenError, type ProviderChoiceTokenErrorReason, type ProviderChoiceTokenPayload, parseProviderChoiceToken, } from "./choice-token.js";
+export { centered, delayed, defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, every, } from "./define.js";
+export { AuthError, isProviderError, isSessionExpiredError, isTransportError, ProviderError, SessionExpiredError, TransportError, ValidationError, } from "./errors.js";
+export { getProviderLocalePath, providerLocaleKey, qualifyProviderLocaleKey, } from "./i18n/index.js";
+export { type CreateProviderChoiceContextOptions, createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice.js";
+export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, type SensitiveFieldKind, type SensitiveFieldOptions, type SensitivePath, sensitive, z, } from "./schema.js";
+export type { AuthAbortData, AuthAbortRetry, AuthFlowTerminalContext, AuthMode, AuthSafeData, AuthSafeJson, FlowContext, HealthCheckAssertionContext, HealthCheckCase, HealthCheckSuite, HealthCheckUnsupported, HealthJourneyDefinition, HealthJourneyEventContext, HealthJourneyManualTriggerPolicy, HealthJourneyRunContext, HealthJourneyRunResult, HealthScheduleRandomization, HttpRetryOptions, HttpRetrySummary, InferSchemaOutput, OperationApprovalPolicy, OperationContractMetadata, OperationDefinition, OperationDocMeta, OperationErrorCode, OperationInputExample, OperationLifecycle, OperationObservabilityConfig, OperationObservabilitySensitiveConfig, OperationRelationships, OperationRiskClass, OperationSensitivePath, OperationToolRouterMetadata, OperationTransport, ProviderAccessVisibility, ProviderChoiceBindingOptions, ProviderChoiceContext, ProviderChoiceIssueOptions, ProviderChoiceParseOptions, ProviderContext, ProviderDefinition, ProviderDeploymentOverrides, ProviderLocale, ProviderLocaleKey, ProviderLocaleKeyInput, ProviderLogoProfile, ProviderProxyPolicy, ProviderPublicConnectionMode, ProviderPublicProfile, ProviderRuntimeState, ProviderStateDurationString, ProviderStateNamespace, ProviderSupportLevel, SchemaLike, SmsOtpMatcherDefinition, StandardSchemaV1, StateCasResult, StateNamespaceOptions, StateValue, StateWriteOptions, } from "./types.js";
+export { HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, } from "./types.js";

package/dist/provider.js

@@ -1,8 +1,9 @@
-export { createFormCeremony } from "./ceremonies";
-export { assertFreshProviderChoiceIssuedAt, createProviderChoiceToken, ProviderChoiceTokenError, parseProviderChoiceToken, } from "./choice-token";
-export { defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, every, } from "./define";
-export { AuthError, ProviderError, SessionExpiredError, TransportError, ValidationError, } from "./errors";
-export { getProviderLocalePath, providerLocaleKey, qualifyProviderLocaleKey, } from "./i18n";
-export { createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice";
-export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, sensitive, z, } from "./schema";
-export { HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, } from "./types";
+export { AuthAbortError, credentialsAuthChallenge, createAuthFlowHelpers, defineCredentialsAuth, } from "./auth.js";
+export { createFormCeremony } from "./ceremonies/index.js";
+export { assertFreshProviderChoiceIssuedAt, createProviderChoiceToken, ProviderChoiceTokenError, parseProviderChoiceToken, } from "./choice-token.js";
+export { centered, delayed, defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, every, } from "./define.js";
+export { AuthError, isProviderError, isSessionExpiredError, isTransportError, ProviderError, SessionExpiredError, TransportError, ValidationError, } from "./errors.js";
+export { getProviderLocalePath, providerLocaleKey, qualifyProviderLocaleKey, } from "./i18n/index.js";
+export { createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice.js";
+export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, sensitive, z, } from "./schema.js";
+export { HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, } from "./types.js";

package/dist/public-schema-field-lint.d.ts

@@ -1,2 +1,2 @@
-import type { LintDiagnostic } from "./lint";
+import type { LintDiagnostic } from "./lint.js";
 export declare function lintPublicSchemaFieldNames(providerId: string | undefined, operationId: string, input: unknown, output: unknown, enforce: boolean): LintDiagnostic[];

package/dist/recipes/gov-api.js

@@ -1,4 +1,4 @@
-import { unwrapEnvelope } from "../utils/parse";
+import { unwrapEnvelope } from "../utils/parse.js";
 function getResultCode(raw) {
     if (!raw || typeof raw !== "object") {
         return undefined;

package/dist/runtime/auth-flow.d.ts

@@ -1,4 +1,4 @@
-import type { ContextScratchpad, EnvContext, FlowContext, HttpClient, StealthClient, SttContext } from "../types";
+import type { ContextScratchpad, EnvContext, FlowContext, HttpClient, StealthClient, SttContext } from "../types.js";
 export declare function createScratchpad(allowedKeys: string[], initial?: Record<string, unknown>): ContextScratchpad;
 export declare function createFlowContext(options: {
     http: HttpClient;

package/dist/runtime/auth-flow.js

@@ -1,5 +1,6 @@
-import { ContextAccessError } from "../errors";
-import { createUnsupportedSttClient } from "./stt";
+import { ContextAccessError } from "../errors.js";
+import { createAuthFlowHelpers } from "../auth.js";
+import { createUnsupportedSttClient } from "./stt.js";
 function normalizeAllowedKeys(allowedKeys) {
     return new Set(allowedKeys.filter((key) => key.trim().length > 0));
 }
@@ -40,5 +41,6 @@ export function createFlowContext(options) {
         env: options.env,
         context: createScratchpad(options.allowedKeys, options.initialContext),
         stt: options.stt ?? createUnsupportedSttClient(),
+        auth: createAuthFlowHelpers(),
     };
 }

package/dist/runtime/browser.d.ts

@@ -1,4 +1,4 @@
-import type { BrowserChallengeRequest, BrowserChallengeResult, BrowserClient as BrowserClientContract, BrowserEngine, BrowserOptions, BrowserPage } from "../types";
+import type { BrowserChallengeRequest, BrowserChallengeResult, BrowserClient as BrowserClientContract, BrowserEngine, BrowserOptions, BrowserPage } from "../types.js";
 type BrowserPageContract = BrowserPage;
 export type BrowserClientOptions = BrowserOptions & {
     allowedHosts?: string[];