@apifuse/provider-sdk 2.2.0-beta.13 → 2.2.0-beta.15

package/src/testing/run.ts

@@ -4,6 +4,12 @@ import { createProviderCache } from "../runtime/cache.js";
 import { createTestProviderChoiceContext } from "../runtime/choice.js";
 import { createMemoryProviderRuntimeState } from "../runtime/state.js";
 import { createUnsupportedSttClient } from "../runtime/stt.js";
+import {
+	createNativeEgressAuthorization,
+	NativeNetworkError,
+	snapshotNativeConnectInput,
+	snapshotNativeGrantInput,
+} from "../runtime/native-network.js";
 import { safeParseSchemaSync } from "../schema.js";
 import { requestPathForFixture } from "../fixture-sanitization.js";
 import { findStreamCaptureGroup, replayStreamEvidence } from "../stream-evidence.js";
@@ -307,6 +313,17 @@ function createUpstreamContext(
 	};
 	const request = { headers: {} };
 	const state = createMemoryProviderRuntimeState();
+	const nativeEgress = provider.native
+		? createNativeEgressAuthorization({ egress: provider.native.network })
+		: undefined;
+	const requireNativeEgress = () => {
+		if (!nativeEgress)
+			throw new NativeNetworkError(
+				"Native egress authorization is unavailable",
+				"native_egress_policy_invalid",
+			);
+		return nativeEgress;
+	};
 	const dispatch = async (
 		call: Omit<StandardTestsUpstreamCall, "operationName">,
 	): Promise<NormalizedUpstreamResponse> => {
@@ -498,30 +515,38 @@ function createUpstreamContext(
 		...(provider.native
 			? {
 					native: {
-						network: {
-							connectTcp: async (options) =>
-								createNativeConnection(
+					network: {
+							connectTcp: async (options) => {
+								const request = snapshotNativeConnectInput(options);
+								requireNativeEgress().assertConnect(request, "disabled");
+								return createNativeConnection(
 									await dispatch({
 										transport: "native",
 										method: "connectTcp",
-										url: `tcp://${options.host}:${options.port}`,
-										options,
+										url: `tcp://${request.host}:${request.port}`,
+										options: request,
 									}),
 									dispatch,
-									`tcp://${options.host}:${options.port}`,
-								),
-							connectTls: async (options) =>
-								createNativeConnection(
+									`tcp://${request.host}:${request.port}`,
+								);
+							},
+							connectTls: async (options) => {
+								const request = snapshotNativeConnectInput(options);
+								requireNativeEgress().assertConnect(request, "required");
+								return createNativeConnection(
 									await dispatch({
 										transport: "native",
 										method: "connectTls",
-										url: `tls://${options.host}:${options.port}`,
-										options,
+										url: `tls://${request.host}:${request.port}`,
+										options: request,
 									}),
 									dispatch,
-									`tls://${options.host}:${options.port}`,
-								),
-							grantTcpEgress: () => ({ revoke: () => {} }),
+									`tls://${request.host}:${request.port}`,
+								);
+							},
+							grantTcpEgress: (input) => {
+								return requireNativeEgress().grant(snapshotNativeGrantInput(input));
+							},
 						},
 					},
 				}

package/src/types.ts

@@ -1019,8 +1019,32 @@ export interface RequestOptions {
 	 */
 	throwOnHttpError?: boolean;
 	retry?: boolean | HttpRetryPreset | HttpRetryOptions;
+	/**
+	 * Opt-in redirect-hop enforcement for ctx.http. When present, redirects are
+	 * evaluated before the next request is issued. Existing callers that omit
+	 * this policy retain the native fetch redirect behavior.
+	 */
+	redirectPolicy?: HttpRedirectPolicy;
+}
+
+export type RedirectRunReason =
+	| "completed"
+	| "stopped"
+	| "max_hops"
+	| "missing_location"
+	| "loop";
+
+export type HttpRedirectPolicyMode = "same-origin";
+
+export interface HttpRedirectPolicy {
+	/** Only follow redirects whose canonical scheme, host, and port match the initial URL. */
+	mode: HttpRedirectPolicyMode;
+	/** Maximum number of redirect hops that may be followed. Must be an integer from 0 to 20. */
+	maxHops: number;
 }
 
+export type HttpRedirectFailureReason = Exclude<RedirectRunReason, "completed">;
+
 export type HttpMethod =
 	| "HEAD"
 	| "head"
@@ -1039,7 +1063,7 @@ export type HttpMethod =
 	| "PATCH"
 	| "patch";
 
-export interface StealthFetchOptions extends RequestOptions {
+export interface StealthFetchOptions extends Omit<RequestOptions, "redirectPolicy"> {
 	method?: HttpMethod;
 	body?: string | Buffer;
 	redirect?: "follow" | "manual" | "error";
@@ -1152,7 +1176,7 @@ export interface StealthRedirectRunOptions
 export interface StealthRedirectRunResult {
 	final: StealthResponse;
 	hops: StealthRedirectHop[];
-	reason: "completed" | "stopped" | "max_hops" | "missing_location" | "loop";
+	reason: RedirectRunReason;
 	/**
 	 * Complete flat view across all redirect hosts. Attributes and duplicate names are lost.
 	 * @deprecated Use cookieStore for lossless persistence.
@@ -1290,6 +1314,12 @@ export interface NativeTcpEgressRule {
 /**
  * Bounded native TCP egress discovered through a declared bootstrap endpoint.
  * Host suffixes are exact DNS suffixes, not wildcard patterns.
+ *
+ * Dynamic rules are ordered. The first rule whose source, target, port, and TLS
+ * selectors match exclusively owns the grant; its ttlMs and maxGrants bounds
+ * apply, and an exhausted/shorter rule never falls through to a later overlap.
+ * Every rule must declare a source host selector, source port list/range, and
+ * target port list/range; omitted ttlMs/maxGrants remain unbounded.
  */
 export interface NativeTcpDynamicEgressRule {
 	readonly sourceHost?: string;