@apifuse/provider-sdk 2.1.0-beta.9 → 2.2.0-beta.10

package/dist/server/serve.d.ts

@@ -1,7 +1,7 @@
 import { Hono } from "hono";
-import { type ProviderErrorCategory } from "../observability";
-import type { ProviderDefinition, ProviderRuntimeState, SttContext } from "../types";
-import { type OperationRequest } from "./types";
+import { type ProviderErrorCategory } from "../observability.js";
+import type { ProviderDefinition, ProviderRuntimeState, SttContext } from "../types.js";
+import { type OperationRequest } from "./types.js";
 export declare function resolveProviderProxyAffinityKey(provider: ProviderDefinition, request: OperationRequest, operationId: string): string;
 type ProviderRequestCost = {
     durationMs: number;
@@ -35,6 +35,11 @@ export type ProviderServerLogEvent = (ProviderServerLogEventBase & {
         message: string;
     }>;
 }) | {
+    level: "warn";
+    event: "provider_secrets_missing";
+    providerId: string;
+    missingSecrets: string[];
+} | {
     level: "warn";
     event: "provider_cleanup_failed";
     providerId: string;
@@ -59,6 +64,12 @@ export declare function createServerApp(provider: ProviderDefinition, options?:
 export interface ServeOptions extends ProviderServerOptions {
     host?: string;
     port?: number;
+    /**
+     * Port for the internal self-test listener (default 3001 or
+     * APIFUSE__PROVIDER_RUNTIME__SELF_TEST_PORT). The listener only starts
+     * when APIFUSE__PROVIDER_RUNTIME__SELF_TEST_MASTER_SECRET is present.
+     */
+    selfTestPort?: number;
 }
 export declare function serve(provider: ProviderDefinition, options?: ServeOptions): Promise<void>;
 export {};

package/dist/server/serve.js

@@ -2,29 +2,33 @@ import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { Hono } from "hono";
 import { z } from "zod";
-import { AuthError, ProviderError, SessionExpiredError, TransportError, } from "../errors";
-import { loadProviderLocaleCatalogs, localizeAuthTurn, } from "../i18n/catalog";
-import { categoryForStatus, isRetryableCategory, PROVIDER_OBSERVABILITY_TAXONOMY_VERSION, } from "../observability";
-import { createScratchpad } from "../runtime/auth-flow";
-import { createBrowserClient } from "../runtime/browser";
-import { createProviderCache } from "../runtime/cache";
-import { createProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "../runtime/choice";
-import { createCredentialContext } from "../runtime/credential";
-import { createEnvContext } from "../runtime/env";
-import { executeOperation } from "../runtime/executor";
-import { createHttpClient } from "../runtime/http";
-import { wrapWithInstrumentation } from "../runtime/instrumentation";
-import { getProviderBaseUrl } from "../runtime/provider";
-import { PROXY_AUTH_IP_DENIED_CODE, PROXY_EDGE_AUTH_REJECTED_CODE, PROXY_POOL_EXHAUSTED_CODE, } from "../runtime/proxy-errors";
-import { PROVIDER_TELEMETRY_HEADER, ProxyTelemetryCollector, } from "../runtime/proxy-telemetry";
-import { createProviderRuntimeStateFromEnv, createUnsupportedProviderRuntimeState, } from "../runtime/state";
-import { createStealthClient } from "../runtime/stealth";
-import { createSttClientFromEnv } from "../runtime/stt";
-import { createTraceContext } from "../runtime/trace";
-import { parseSchema } from "../schema";
-import { getStealthProfile } from "../stealth/profiles";
-import { APIFUSE_STREAM_DONE_EVENT, APIFUSE_STREAM_ERROR_EVENT, encodeSseEvent, error as streamError, } from "../stream";
-import { AuthFlowRequestSchema, OperationRequestSchema, } from "./types";
+import { AuthAbortError, createAuthFlowHelpers } from "../auth.js";
+import { AuthError, isProviderError, isSessionExpiredError, isTransportError, ProviderError, } from "../errors.js";
+import { loadProviderLocaleCatalogs, localizeAuthTurn, } from "../i18n/catalog.js";
+import { categoryForStatus, isRetryableCategory, PROVIDER_OBSERVABILITY_TAXONOMY_VERSION, } from "../observability.js";
+import { createScratchpad } from "../runtime/auth-flow.js";
+import { createBrowserClient } from "../runtime/browser.js";
+import { createProviderCache } from "../runtime/cache.js";
+import { createProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "../runtime/choice.js";
+import { createCredentialContext } from "../runtime/credential.js";
+import { createEnvContext } from "../runtime/env.js";
+import { executeOperation } from "../runtime/executor.js";
+import { createHttpClient } from "../runtime/http.js";
+import { wrapWithInstrumentation } from "../runtime/instrumentation.js";
+import { getProviderBaseUrl } from "../runtime/provider.js";
+import { PROXY_AUTH_IP_DENIED_CODE, PROXY_EDGE_AUTH_REJECTED_CODE, PROXY_POOL_EXHAUSTED_CODE, } from "../runtime/proxy-errors.js";
+import { PROVIDER_TELEMETRY_HEADER, ProxyTelemetryCollector } from "../runtime/proxy-telemetry.js";
+import { assertRequiredSecretsPresent, listMissingRequiredSecrets, MISSING_SECRET_CODE, } from "../runtime/secrets.js";
+import { createProviderRuntimeStateFromEnv, createUnsupportedProviderRuntimeState, } from "../runtime/state.js";
+import { createStealthClient } from "../runtime/stealth.js";
+import { createSttClientFromEnv } from "../runtime/stt.js";
+import { createTraceContext } from "../runtime/trace.js";
+import { parseSchema } from "../schema.js";
+import { getStealthProfile } from "../stealth/profiles.js";
+import { APIFUSE_STREAM_DONE_EVENT, APIFUSE_STREAM_ERROR_EVENT, encodeSseEvent, error as streamError, } from "../stream.js";
+import { createSelfTestApp, createSelfTestAuthFlowInvoke, createSelfTestInvoke, resolveSelfTestPort, } from "./self-test.js";
+import { resolveSelfTestMasterSecrets } from "./self-test-token.js";
+import { AuthFlowRequestSchema, OperationRequestSchema, } from "./types.js";
 const DEFAULT_HOST = "0.0.0.0";
 const DEFAULT_PORT = 3000;
 const AUTH_FLOW_LOCALES = ["en", "ko", "ja"];
@@ -90,9 +94,7 @@ function getProviderStealthBaseUrl(provider) {
     return firstHost ? `https://${firstHost}` : undefined;
 }
 function getProviderStealthProfile(provider) {
-    return provider.stealth?.profile
-        ? getStealthProfile(provider.stealth.profile)
-        : undefined;
+    return provider.stealth?.profile ? getStealthProfile(provider.stealth.profile) : undefined;
 }
 function isProductionProviderBrowserMode(provider, env = process.env) {
     if (provider.runtime !== "browser") {
@@ -101,18 +103,19 @@ function isProductionProviderBrowserMode(provider, env = process.env) {
     if (env.APIFUSE__PROVIDER__RUNTIME === "browser") {
         return true;
     }
-    return (env.NODE_ENV === "production" && env.APIFUSE__PROVIDER__ID === provider.id);
+    return env.NODE_ENV === "production" && env.APIFUSE__PROVIDER__ID === provider.id;
 }
 export function resolveProviderProxyAffinityKey(provider, request, operationId) {
-    const connectionKey = request.connection?.id ?? request.connection?.externalRef;
-    const affinity = typeof provider.proxy === "object"
-        ? provider.proxy.session?.affinity
-        : undefined;
+    const connectionKey = resolveOperationConnectionId(request) ?? request.connection?.externalRef;
+    const affinity = typeof provider.proxy === "object" ? provider.proxy.session?.affinity : undefined;
     if (affinity === "operation") {
         return `${provider.id}/${operationId}`;
     }
     return connectionKey ?? provider.id;
 }
+function resolveOperationConnectionId(request) {
+    return request.connection?.id ?? request.connectionId;
+}
 function createProviderContext(provider, request, operationId, options = {}, state = createUnsupportedProviderRuntimeState(), proxyTelemetry) {
     const baseUrl = getProviderBaseUrl(provider);
     const stealthBaseUrl = getProviderStealthBaseUrl(provider);
@@ -139,7 +142,7 @@ function createProviderContext(provider, request, operationId, options = {}, sta
         values: request.connection?.secrets,
     });
     const requestContext = {
-        connectionId: request.connection?.id,
+        connectionId: resolveOperationConnectionId(request),
         headers: request.headers ?? {},
     };
     const context = wrapWithInstrumentation({
@@ -209,7 +212,7 @@ function createFlowContextStore(allowedKeys, initialContext = {}) {
         },
     };
 }
-function createAuthFlowContext(provider, request, options = {}) {
+function createAuthFlowContext(provider, request, options = {}, signal) {
     const baseUrl = getProviderBaseUrl(provider);
     const stealthBaseUrl = getProviderStealthBaseUrl(provider);
     const stealthProfile = getProviderStealthProfile(provider);
@@ -251,6 +254,7 @@ function createAuthFlowContext(provider, request, options = {}) {
             credential,
             context: flowContextStore.context,
             stt: options.stt ?? createSttClientFromEnv(provider.stt),
+            auth: createAuthFlowHelpers({ signal }),
         },
         getPatch: flowContextStore.getPatch,
     };
@@ -286,7 +290,7 @@ function zodDetails(error) {
     }));
 }
 function toErrorResponse(error, requestId) {
-    if (error instanceof ProviderError) {
+    if (isProviderError(error)) {
         const details = publicProviderErrorDetails(error);
         return {
             error: {
@@ -308,11 +312,22 @@ function toErrorResponse(error, requestId) {
             },
         };
     }
+    // A masked internal error MUST NOT be advertised as retryable: without an
+    // explicit retryable:false the hub (bori provider-backed engine) defaults 5xx
+    // to retryable:true, which turns a deterministic pre-upstream crash into an
+    // infinite START->CONTINUE->restart loop (2026-07-22 catchtable reserve RCA).
+    // We still refuse to leak message/stack — only the error class name (or the
+    // primitive type for non-Error throwables) is surfaced for ops triage.
     return {
         error: {
             code: "internal_error",
             message: "Internal error",
             ...(requestId ? { requestId } : {}),
+            details: {
+                retryable: false,
+                category: "internal_error",
+                errorClass: error instanceof Error ? error.name : typeof error,
+            },
         },
     };
 }
@@ -336,20 +351,37 @@ function publicProviderErrorDetails(error) {
 function isPlainRecord(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }
+// Accepts `unknown` so the branded guards narrow cleanly from the top: the
+// subtype error classes are structurally compatible with ProviderError, so
+// narrowing from a ProviderError-typed value would collapse the negative branch
+// to `never`. Narrowing from unknown avoids that while still recognizing errors
+// from a duplicate SDK module instance.
 function providerObservabilityDetails(error) {
     // Session-expiry surfaces the credential_expired category + the opt-in
     // retryable signal so Gateway/Credential Service can refresh and re-drive the
     // operation (see design.md §4.3 D3). Without this branch the auth error would
     // serialize as a bare 401 with no retryable/category, losing the refresh
     // signal for exactly the retryOnAuthRefresh operations it is meant to enable.
-    if (error instanceof SessionExpiredError) {
+    if (isSessionExpiredError(error)) {
         return {
             category: error.options?.category ?? "credential_expired",
             taxonomyVersion: PROVIDER_OBSERVABILITY_TAXONOMY_VERSION,
             retryable: error.options?.retryable ?? false,
         };
     }
-    if (!(error instanceof TransportError)) {
+    // Missing-secret errors carry the canonical credential_unavailable category
+    // so Gateway/observability can attribute the failure to provisioning, not
+    // the upstream. Matched by code (not constructor) so both the SDK-owned
+    // runtime gate and any not-yet-migrated provider-thrown MISSING_SECRET
+    // serialize identically, including across duplicate SDK module instances.
+    if (isProviderError(error) && error.code === MISSING_SECRET_CODE) {
+        return {
+            category: error.options?.category ?? "credential_unavailable",
+            taxonomyVersion: PROVIDER_OBSERVABILITY_TAXONOMY_VERSION,
+            retryable: error.options?.retryable ?? false,
+        };
+    }
+    if (!isTransportError(error)) {
         return undefined;
     }
     const isProxyPoolCode = error.code === PROXY_POOL_EXHAUSTED_CODE ||
@@ -378,7 +410,7 @@ function providerObservabilityDetails(error) {
     };
 }
 function publicProviderErrorMessage(error) {
-    if (error instanceof TransportError) {
+    if (isTransportError(error)) {
         if (error.code === PROXY_AUTH_IP_DENIED_CODE) {
             return error.message;
         }
@@ -406,14 +438,18 @@ function toStatusCode(error) {
     if (error instanceof z.ZodError) {
         return 400;
     }
-    if (error instanceof TransportError) {
+    if (isTransportError(error)) {
         return error.code === "transport_timeout" ? 504 : 502;
     }
-    if (error instanceof ProviderError) {
+    if (isProviderError(error)) {
         switch (error.code) {
             case "AUTH_REQUIRED":
             case "reauth_required":
                 return 401;
+            // Unprovisioned declared secret: a deployment/config defect, never an
+            // upstream failure — explicit 400 (was only reached via fallthrough).
+            case MISSING_SECRET_CODE:
+                return 400;
             case "NOT_FOUND":
             case "not_found":
             case "NO_DATA":
@@ -441,16 +477,14 @@ function extractRequestId(raw) {
     return typeof value === "string" ? value : undefined;
 }
 function logProviderError(logger, provider, kind, route, requestId, error, status, cost) {
-    const code = error instanceof ProviderError
+    const code = isProviderError(error)
         ? (error.code ?? "provider_error")
         : error instanceof z.ZodError
             ? "invalid_request"
             : "internal_error";
     const errorClass = error instanceof Error ? error.name : typeof error;
     const message = error instanceof Error ? error.message : String(error);
-    const details = error instanceof ProviderError
-        ? providerObservabilityDetails(error)
-        : undefined;
+    const details = isProviderError(error) ? providerObservabilityDetails(error) : undefined;
     const emit = typeof logger === "function" ? logger : defaultProviderServerLogger;
     emit({
         level: status >= 500 ? "error" : "warn",
@@ -464,7 +498,7 @@ function logProviderError(logger, provider, kind, route, requestId, error, statu
         code,
         errorClass,
         message,
-        ...(error instanceof TransportError && error.upstreamStatus
+        ...(isTransportError(error) && error.upstreamStatus
             ? { upstreamStatus: error.upstreamStatus }
             : {}),
         ...(details
@@ -587,8 +621,7 @@ async function validateSseEvent(operation, event) {
     const transport = getSseTransport(operation);
     const schema = transport?.events?.[event.event];
     if (!schema) {
-        if (event.event === APIFUSE_STREAM_ERROR_EVENT ||
-            event.event === APIFUSE_STREAM_DONE_EVENT) {
+        if (event.event === APIFUSE_STREAM_ERROR_EVENT || event.event === APIFUSE_STREAM_DONE_EVENT) {
             return event;
         }
         throw new ProviderError(`SSE event "${event.event}" is not declared in operation transport.events.`, {
@@ -707,8 +740,7 @@ function enforceStreamChunkLimit(body, maxChunkBytes) {
 }
 function toStreamingResponse(operation, result, cleanup, requestId) {
     const transport = operation.transport?.kind ?? "json";
-    if (transport === "sse" &&
-        (result instanceof Response || result instanceof ReadableStream)) {
+    if (transport === "sse" && (result instanceof Response || result instanceof ReadableStream)) {
         void cleanup();
         throw new ProviderError("SSE operations must return an AsyncIterable of typed stream.event(...) values.", {
             code: "SSE_RESULT_UNSUPPORTED",
@@ -719,9 +751,7 @@ function toStreamingResponse(operation, result, cleanup, requestId) {
     }
     if (result instanceof Response) {
         const httpTransport = getHttpStreamTransport(operation);
-        if (httpTransport &&
-            result.body &&
-            httpTransport?.maxChunkBytes !== undefined) {
+        if (httpTransport && result.body && httpTransport?.maxChunkBytes !== undefined) {
             return responseWithCleanup(new Response(enforceStreamChunkLimit(result.body, httpTransport.maxChunkBytes), {
                 headers: result.headers,
                 status: result.status,
@@ -740,8 +770,7 @@ function toStreamingResponse(operation, result, cleanup, requestId) {
                 ? { "Content-Type": "text/event-stream; charset=utf-8" }
                 : {
                     "Content-Type": operation.transport?.kind === "http-stream"
-                        ? (operation.transport.contentType ??
-                            "application/octet-stream")
+                        ? (operation.transport.contentType ?? "application/octet-stream")
                         : "application/octet-stream",
                 },
         }), cleanup);
@@ -759,9 +788,7 @@ function getSseTransport(operation) {
     return operation.transport?.kind === "sse" ? operation.transport : undefined;
 }
 function getHttpStreamTransport(operation) {
-    return operation.transport?.kind === "http-stream"
-        ? operation.transport
-        : undefined;
+    return operation.transport?.kind === "http-stream" ? operation.transport : undefined;
 }
 function toAuthFlowResponse(result, contextPatch) {
     if (result instanceof Response) {
@@ -789,7 +816,7 @@ function isAuthFlowLocale(value) {
     return value === "en" || value === "ko" || value === "ja";
 }
 function isAuthTurn(value) {
-    return (!!value && typeof value === "object" && "kind" in value && "turnId" in value);
+    return !!value && typeof value === "object" && "kind" in value && "turnId" in value;
 }
 function loadAuthFlowLocaleCatalogs(provider) {
     for (const providerDir of [
@@ -879,15 +906,23 @@ function responseWithProviderTelemetry(response, proxyTelemetry) {
         statusText: response.statusText,
     });
 }
-async function handleAuthFlow(provider, request, route, options = {}) {
+async function handleAuthFlow(provider, request, route, options = {}, signal) {
     const flow = provider.auth?.flow;
     if (!flow) {
         throw new ProviderError("Auth flow is not configured", {
             code: "AUTH_FLOW_NOT_CONFIGURED",
         });
     }
-    const { context, getPatch } = createAuthFlowContext(provider, request, options);
+    // Same SDK-owned gate as executeOperation: OAuth/credentials ceremonies
+    // depend on declared secrets (client ids/secrets), so fail structured before
+    // any flow code runs instead of at whatever point the ceremony first reads
+    // the env. `abort` stays exempt: a user must always be able to cancel a
+    // stranded flow even when provisioning is broken.
+    const { context, getPatch } = createAuthFlowContext(provider, request, options, signal);
     try {
+        if (route !== "abort") {
+            assertRequiredSecretsPresent(provider, context.env);
+        }
         const result = route === "start"
             ? await flow.start(context)
             : route === "continue"
@@ -916,6 +951,12 @@ async function handleAuthFlow(provider, request, route, options = {}) {
             : result;
         return toAuthFlowResponse(materializedResult, getPatch());
     }
+    catch (error) {
+        if (error instanceof AuthAbortError) {
+            return toAuthFlowResponse(error.turn, getPatch());
+        }
+        throw error;
+    }
     finally {
         context.stealth.close?.();
     }
@@ -928,6 +969,20 @@ export function createServerApp(provider, options = {}) {
             providerId: provider.id,
             allowMemoryFallback: options.allowMemoryStateFallback === true,
         });
+    // Boot-time visibility for unprovisioned declared secrets: emit a structured
+    // warn so deploy tooling/alerting sees the gap the moment the pod boots,
+    // instead of discovering it request-by-request. Deliberately log-only — a
+    // boot crash would trade a structured MISSING_SECRET signal for
+    // CrashLoopBackOff. Requests still fail closed via the executeOperation gate.
+    const missingSecretsAtBoot = listMissingRequiredSecrets(provider, createEnvContext(provider.secrets?.map((secret) => secret.name)));
+    if (missingSecretsAtBoot.length > 0) {
+        logger({
+            level: "warn",
+            event: "provider_secrets_missing",
+            providerId: provider.id,
+            missingSecrets: missingSecretsAtBoot,
+        });
+    }
     app.notFound((c) => c.json({
         error: {
             code: "not_found",
@@ -982,7 +1037,7 @@ export function createServerApp(provider, options = {}) {
                 .json()
                 .catch(() => undefined);
             const body = withAuthRequestHeaders(AuthFlowRequestSchema.parse(rawBody), c.req.raw.headers);
-            const response = await handleAuthFlow(provider, body, "start", options);
+            const response = await handleAuthFlow(provider, body, "start", options, c.req.raw.signal);
             logProviderSuccess(logger, provider, "auth", "start", body.requestId, response instanceof Response ? response.status : 200, finishRequestCost(requestCost));
             return response instanceof Response ? response : c.json(response);
         }
@@ -1002,7 +1057,7 @@ export function createServerApp(provider, options = {}) {
                 .json()
                 .catch(() => undefined);
             const body = withAuthRequestHeaders(AuthFlowRequestSchema.parse(rawBody), c.req.raw.headers);
-            const response = await handleAuthFlow(provider, body, "continue", options);
+            const response = await handleAuthFlow(provider, body, "continue", options, c.req.raw.signal);
             logProviderSuccess(logger, provider, "auth", "continue", body.requestId, response instanceof Response ? response.status : 200, finishRequestCost(requestCost));
             return response instanceof Response ? response : c.json(response);
         }
@@ -1022,7 +1077,7 @@ export function createServerApp(provider, options = {}) {
                 .json()
                 .catch(() => undefined);
             const body = withAuthRequestHeaders(AuthFlowRequestSchema.parse(rawBody), c.req.raw.headers);
-            const response = await handleAuthFlow(provider, body, "poll", options);
+            const response = await handleAuthFlow(provider, body, "poll", options, c.req.raw.signal);
             logProviderSuccess(logger, provider, "auth", "poll", body.requestId, response instanceof Response ? response.status : 200, finishRequestCost(requestCost));
             return response instanceof Response ? response : c.json(response);
         }
@@ -1042,7 +1097,7 @@ export function createServerApp(provider, options = {}) {
                 .json()
                 .catch(() => undefined);
             const body = withAuthRequestHeaders(AuthFlowRequestSchema.parse(rawBody), c.req.raw.headers);
-            const response = await handleAuthFlow(provider, body, "refresh", options);
+            const response = await handleAuthFlow(provider, body, "refresh", options, c.req.raw.signal);
             logProviderSuccess(logger, provider, "auth", "refresh", body.requestId, response instanceof Response ? response.status : 200, finishRequestCost(requestCost));
             return response instanceof Response ? response : c.json(response);
         }
@@ -1062,7 +1117,7 @@ export function createServerApp(provider, options = {}) {
                 .json()
                 .catch(() => undefined);
             const body = withAuthRequestHeaders(AuthFlowRequestSchema.parse(rawBody), c.req.raw.headers);
-            const response = await handleAuthFlow(provider, body, "abort", options);
+            const response = await handleAuthFlow(provider, body, "abort", options, c.req.raw.signal);
             logProviderSuccess(logger, provider, "auth", "disconnect", body.requestId, response instanceof Response ? response.status : 200, finishRequestCost(requestCost));
             return response instanceof Response ? response : c.json(response);
         }
@@ -1106,5 +1161,21 @@ export async function serve(provider, options = {}) {
         hostname: options.host ?? DEFAULT_HOST,
         fetch: app.fetch,
     });
+    // Internal self-test listener (health dependency inversion): a SEPARATE
+    // socket the tenant-facing gateway never dials. Off by default — it only
+    // starts when the shared self-test master secret env is present.
+    const selfTestSecrets = resolveSelfTestMasterSecrets();
+    if (selfTestSecrets) {
+        const selfTestApp = createSelfTestApp(provider, {
+            secrets: selfTestSecrets,
+            invoke: createSelfTestInvoke(app),
+            authFlow: createSelfTestAuthFlowInvoke(app),
+        });
+        bunRuntime.serve({
+            port: options.selfTestPort ?? resolveSelfTestPort(),
+            hostname: options.host ?? DEFAULT_HOST,
+            fetch: selfTestApp.fetch,
+        });
+    }
     await Promise.resolve();
 }

package/dist/server/types.d.ts

@@ -1,15 +1,15 @@
 import { z } from "zod";
 export declare const ConnectionModeSchema: z.ZodEnum<{
-    credentials: "credentials";
     none: "none";
+    credentials: "credentials";
     oauth2: "oauth2";
     "platform-managed": "platform-managed";
 }>;
 export declare const OperationConnectionSchema: z.ZodObject<{
     id: z.ZodString;
     mode: z.ZodEnum<{
-        credentials: "credentials";
         none: "none";
+        credentials: "credentials";
         oauth2: "oauth2";
         "platform-managed": "platform-managed";
     }>;
@@ -21,11 +21,12 @@ export declare const OperationConnectionSchema: z.ZodObject<{
 export declare const OperationRequestSchema: z.ZodObject<{
     requestId: z.ZodString;
     input: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    connectionId: z.ZodOptional<z.ZodString>;
     connection: z.ZodOptional<z.ZodObject<{
         id: z.ZodString;
         mode: z.ZodEnum<{
-            credentials: "credentials";
             none: "none";
+            credentials: "credentials";
             oauth2: "oauth2";
             "platform-managed": "platform-managed";
         }>;
@@ -54,21 +55,21 @@ export declare const OperationSuccessResponseSchema: z.ZodObject<{
             stale: z.ZodBoolean;
             keys: z.ZodArray<z.ZodString>;
             source: z.ZodOptional<z.ZodEnum<{
-                loader: "loader";
-                memory: "memory";
                 mixed: "mixed";
                 redis: "redis";
+                memory: "memory";
+                loader: "loader";
             }>>;
         }, z.core.$strip>>;
         retry: z.ZodOptional<z.ZodObject<{
             attempts: z.ZodNumber;
             retries: z.ZodNumber;
             preset: z.ZodOptional<z.ZodEnum<{
-                aggressive_read: "aggressive_read";
                 off: "off";
-                rate_limit_aware: "rate_limit_aware";
-                safe_read: "safe_read";
                 transport_transient: "transport_transient";
+                safe_read: "safe_read";
+                aggressive_read: "aggressive_read";
+                rate_limit_aware: "rate_limit_aware";
             }>>;
             transport: z.ZodEnum<{
                 native: "native";
@@ -100,8 +101,8 @@ export declare const AuthFlowRequestSchema: z.ZodObject<{
     connection: z.ZodOptional<z.ZodObject<{
         id: z.ZodString;
         mode: z.ZodEnum<{
-            credentials: "credentials";
             none: "none";
+            credentials: "credentials";
             oauth2: "oauth2";
             "platform-managed": "platform-managed";
         }>;

package/dist/server/types.js

@@ -1,11 +1,6 @@
 import { z } from "zod";
-import { HttpRetryPreset } from "../types";
-export const ConnectionModeSchema = z.enum([
-    "oauth2",
-    "credentials",
-    "platform-managed",
-    "none",
-]);
+import { HttpRetryPreset } from "../types.js";
+export const ConnectionModeSchema = z.enum(["oauth2", "credentials", "platform-managed", "none"]);
 export const OperationConnectionSchema = z.object({
     id: z.string(),
     mode: ConnectionModeSchema,
@@ -17,6 +12,7 @@ export const OperationConnectionSchema = z.object({
 export const OperationRequestSchema = z.object({
     requestId: z.string(),
     input: z.record(z.string(), z.unknown()),
+    connectionId: z.string().optional(),
     connection: OperationConnectionSchema.optional(),
     headers: z.record(z.string(), z.string()).optional(),
     trace: z.record(z.string(), z.string()).optional(),

package/dist/stealth/profiles.d.ts

@@ -1,4 +1,4 @@
-import type { StealthProfile } from "../types";
+import type { StealthProfile } from "../types.js";
 export declare function generateLayer2Headers(profile: StealthProfile): Record<string, string>;
 export declare function getStealthProfile(name: string): StealthProfile;
 export declare function listStealthProfiles(): string[];

package/dist/stealth/profiles.js

@@ -1,4 +1,4 @@
-import { SDKError } from "../errors";
+import { SDKError } from "../errors.js";
 const CHROMIUM_HEADER_ORDER = [
     ":method",
     ":authority",
@@ -74,12 +74,8 @@ function createProfile(name, definition) {
         tlsClientIdentifier: definition.tlsClientIdentifier,
         ja3: definition.ja3,
         ja4: definition.ja4,
-        h2Settings: definition.h2Settings
-            ? { ...definition.h2Settings }
-            : undefined,
-        headerOrder: definition.headerOrder
-            ? [...definition.headerOrder]
-            : undefined,
+        h2Settings: definition.h2Settings ? { ...definition.h2Settings } : undefined,
+        headerOrder: definition.headerOrder ? [...definition.headerOrder] : undefined,
     };
 }
 function extractBrowserMajorVersion(profile) {
@@ -120,9 +116,7 @@ export function generateLayer2Headers(profile) {
             : `"Chromium";v="${majorVersion}", "Google Chrome";v="${majorVersion}", "Not)A;Brand";v="99"`;
         headers["Sec-Ch-Ua-Platform"] = toPlatformHeaderValue(profile.platform);
         headers["Sec-Ch-Ua-Mobile"] =
-            profile.platform === "android" || profile.platform === "ios"
-                ? "?1"
-                : "?0";
+            profile.platform === "android" || profile.platform === "ios" ? "?1" : "?0";
     }
     return headers;
 }
@@ -252,8 +246,5 @@ export function getStealthProfile(name) {
     };
 }
 export function listStealthProfiles() {
-    return [
-        ...Object.keys(STEALTH_PROFILES),
-        ...Object.keys(STEALTH_PROFILE_ALIASES),
-    ];
+    return [...Object.keys(STEALTH_PROFILES), ...Object.keys(STEALTH_PROFILE_ALIASES)];
 }

package/dist/stream.d.ts

@@ -1,4 +1,4 @@
-import type { SseMessage } from "./types";
+import type { SseMessage } from "./types.js";
 export interface SseEvent<TData = unknown> {
     event: string;
     data: TData;

package/dist/testing/index.d.ts

@@ -1,2 +1,2 @@
-export { describeTransform, snapshotTransform, toMatchShape } from "./helpers";
-export { runStandardTests } from "./run";
+export { describeTransform, snapshotTransform, toMatchShape } from "./helpers.js";
+export { runStandardTests } from "./run.js";

package/dist/testing/index.js

@@ -1,2 +1,2 @@
-export { describeTransform, snapshotTransform, toMatchShape } from "./helpers";
-export { runStandardTests } from "./run";
+export { describeTransform, snapshotTransform, toMatchShape } from "./helpers.js";
+export { runStandardTests } from "./run.js";

package/dist/testing/run.d.ts

@@ -1,4 +1,4 @@
-import type { AuthMode, ProviderDefinition } from "../types";
+import type { AuthMode, ProviderDefinition } from "../types.js";
 export interface StandardTestsManifest {
     id?: string;
     displayName?: string;