@apifuse/provider-sdk 2.2.0-beta.14 → 2.2.0-beta.15

package/src/runtime/stealth.ts

@@ -50,6 +50,11 @@ import {
 	shouldRetryProxyTransportAttempt,
 	validateUnsafeProxyTransportRetryMethods,
 } from "./proxy-retry-policy.js";
+import {
+	evaluateRedirectHop,
+	isRedirectStatus,
+	resolveRedirectUrl,
+} from "./redirects.js";
 import {
 	isSensitiveKey,
 	redactSensitiveError,
@@ -731,16 +736,6 @@ function normalizeMethod(method: HttpMethod | string): StealthMethod {
 	}
 }
 
-function isRedirectStatus(status: number): boolean {
-	return [301, 302, 303, 307, 308].includes(status);
-}
-
-function nextRedirectMethod(status: number, method: StealthMethod): StealthMethod {
-	if (status === 303 && method !== "HEAD") return "GET";
-	if ((status === 301 || status === 302) && method === "POST") return "GET";
-	return method;
-}
-
 function locationHeader(headers: Record<string, string>): string | undefined {
 	for (const [name, value] of Object.entries(headers)) {
 		if (name.toLowerCase() === "location") return value;
@@ -1256,7 +1251,7 @@ function createSessionFetcher(
 					const redactedLocation = location ? redactRedirectUrl(location) : undefined;
 					let nextUrl: string | undefined;
 					try {
-						nextUrl = location ? new URL(location, responseUrl).toString() : undefined;
+						nextUrl = resolveRedirectUrl(location, responseUrl);
 					} catch (error) {
 						throw redactSensitiveError(error, [...sensitiveValues], location, redactedLocation);
 					}
@@ -1297,51 +1292,29 @@ function createSessionFetcher(
 							throw sanitizedError;
 						}
 					}
-					if (shouldStop) {
-						return {
-							final: response,
-							hops,
-							reason: "stopped",
-							cookies: cookieJar.snapshot(),
-							cookieStore: cookieJar.serialize(),
-						};
-					}
-
-					if (!nextUrl) {
-						return {
-							final: response,
-							hops,
-							reason: "missing_location",
-							cookies: cookieJar.snapshot(),
-							cookieStore: cookieJar.serialize(),
-						};
-					}
-
-					if (hops.length > maxHops) {
+					const decision = evaluateRedirectHop({
+						status: response.status,
+						method,
+						nextUrl,
+						shouldStop,
+						redirectCount: hops.length,
+						maxHops,
+						visitedRequests,
+					});
+					if (decision.kind === "stop") {
 						return {
 							final: response,
 							hops,
-							reason: "max_hops",
+							reason: decision.reason,
 							cookies: cookieJar.snapshot(),
 							cookieStore: cookieJar.serialize(),
 						};
 					}
-
-					const nextMethod = nextRedirectMethod(response.status, method);
-					if (nextMethod !== method) {
+					if (decision.nextMethod !== method) {
 						body = undefined;
 					}
-					if (visitedRequests.has(`${nextMethod} ${nextUrl}`)) {
-						return {
-							final: response,
-							hops,
-							reason: "loop",
-							cookies: cookieJar.snapshot(),
-							cookieStore: cookieJar.serialize(),
-						};
-					}
-					method = nextMethod;
-					currentUrl = nextUrl;
+					method = decision.nextMethod;
+					currentUrl = decision.nextUrl;
 				}
 
 				if (!response) {

package/src/server/serve.ts

@@ -36,6 +36,7 @@ import { createEnvContext } from "../runtime/env.js";
 import { executeOperation } from "../runtime/executor.js";
 import { createHttpClient } from "../runtime/http.js";
 import { wrapWithInstrumentation } from "../runtime/instrumentation.js";
+import { createNativeNetworkClient } from "../runtime/native-network.js";
 import { getProviderBaseUrl } from "../runtime/provider.js";
 import {
 	PROXY_AUTH_IP_DENIED_CODE,
@@ -82,6 +83,7 @@ import type {
 	OperationSseTransport,
 	ProviderContext,
 	ProviderDefinition,
+	ProviderProxyPolicy,
 	ProviderRuntimeState,
 	ProviderStreamEvent,
 	StealthClient,
@@ -287,6 +289,13 @@ function resolveOperationConnectionId(request: OperationRequest): string | undef
 	return request.connection?.id ?? request.connectionId;
 }
 
+function resolveNativeProxyPolicy(provider: ProviderDefinition): ProviderProxyPolicy | undefined {
+	if (typeof provider.proxy === "object") return provider.proxy;
+	if (provider.proxy === true) return { mode: "optional" };
+	if (provider.proxy === false) return { mode: "disabled" };
+	return undefined;
+}
+
 function createProviderContext(
 	provider: ProviderDefinition,
 	request: OperationRequest,
@@ -353,6 +362,17 @@ function createProviderContext(
 						engine: provider.browser?.engine,
 					})
 				: createBrowserStub(),
+		...(provider.native
+			? {
+					native: {
+						network: createNativeNetworkClient({
+							egress: provider.native.network,
+							proxyPolicy: resolveNativeProxyPolicy(provider),
+							affinityKey: proxyClientOptions.affinityKey,
+						}),
+					},
+				}
+			: {}),
 		trace: createTraceContext(),
 		auth: createAuthStub(),
 		stt: options.stt ?? createSttClientFromEnv(provider.stt),
@@ -455,6 +475,17 @@ function createAuthFlowContext(
 					? createStealthClient(stealthBaseUrl, stealthProfile.name, stealthClientOptions)
 					: createStealthClient(stealthBaseUrl, stealthClientOptions)
 				: createStealthStub(),
+			...(provider.native
+				? {
+						native: {
+							network: createNativeNetworkClient({
+								egress: provider.native.network,
+								proxyPolicy: resolveNativeProxyPolicy(provider),
+								affinityKey: proxyClientOptions.affinityKey,
+							}),
+						},
+					}
+				: {}),
 			env: createEnvContext(provider.secrets?.map((secret) => secret.name)),
 			credential,
 			context: flowContextStore.context,
@@ -894,6 +925,11 @@ const SDK_OWNED_PROVIDER_ERROR_CODES = new Set([
 	"transport_stream_unavailable",
 	"transport_invalid_method",
 	"http_transport_override_unsupported",
+	"http_redirect_policy_invalid",
+	"http_redirect_stopped",
+	"http_redirect_max_hops",
+	"http_redirect_missing_location",
+	"http_redirect_loop",
 	"transport_invalid_url",
 	"retry_exhausted",
 	"auth_abort_unsafe_data",

package/src/testing/run.ts

@@ -4,6 +4,12 @@ import { createProviderCache } from "../runtime/cache.js";
 import { createTestProviderChoiceContext } from "../runtime/choice.js";
 import { createMemoryProviderRuntimeState } from "../runtime/state.js";
 import { createUnsupportedSttClient } from "../runtime/stt.js";
+import {
+	createNativeEgressAuthorization,
+	NativeNetworkError,
+	snapshotNativeConnectInput,
+	snapshotNativeGrantInput,
+} from "../runtime/native-network.js";
 import { safeParseSchemaSync } from "../schema.js";
 import { requestPathForFixture } from "../fixture-sanitization.js";
 import { findStreamCaptureGroup, replayStreamEvidence } from "../stream-evidence.js";
@@ -307,6 +313,17 @@ function createUpstreamContext(
 	};
 	const request = { headers: {} };
 	const state = createMemoryProviderRuntimeState();
+	const nativeEgress = provider.native
+		? createNativeEgressAuthorization({ egress: provider.native.network })
+		: undefined;
+	const requireNativeEgress = () => {
+		if (!nativeEgress)
+			throw new NativeNetworkError(
+				"Native egress authorization is unavailable",
+				"native_egress_policy_invalid",
+			);
+		return nativeEgress;
+	};
 	const dispatch = async (
 		call: Omit<StandardTestsUpstreamCall, "operationName">,
 	): Promise<NormalizedUpstreamResponse> => {
@@ -498,30 +515,38 @@ function createUpstreamContext(
 		...(provider.native
 			? {
 					native: {
-						network: {
-							connectTcp: async (options) =>
-								createNativeConnection(
+					network: {
+							connectTcp: async (options) => {
+								const request = snapshotNativeConnectInput(options);
+								requireNativeEgress().assertConnect(request, "disabled");
+								return createNativeConnection(
 									await dispatch({
 										transport: "native",
 										method: "connectTcp",
-										url: `tcp://${options.host}:${options.port}`,
-										options,
+										url: `tcp://${request.host}:${request.port}`,
+										options: request,
 									}),
 									dispatch,
-									`tcp://${options.host}:${options.port}`,
-								),
-							connectTls: async (options) =>
-								createNativeConnection(
+									`tcp://${request.host}:${request.port}`,
+								);
+							},
+							connectTls: async (options) => {
+								const request = snapshotNativeConnectInput(options);
+								requireNativeEgress().assertConnect(request, "required");
+								return createNativeConnection(
 									await dispatch({
 										transport: "native",
 										method: "connectTls",
-										url: `tls://${options.host}:${options.port}`,
-										options,
+										url: `tls://${request.host}:${request.port}`,
+										options: request,
 									}),
 									dispatch,
-									`tls://${options.host}:${options.port}`,
-								),
-							grantTcpEgress: () => ({ revoke: () => {} }),
+									`tls://${request.host}:${request.port}`,
+								);
+							},
+							grantTcpEgress: (input) => {
+								return requireNativeEgress().grant(snapshotNativeGrantInput(input));
+							},
 						},
 					},
 				}

package/src/types.ts

@@ -1019,8 +1019,32 @@ export interface RequestOptions {
 	 */
 	throwOnHttpError?: boolean;
 	retry?: boolean | HttpRetryPreset | HttpRetryOptions;
+	/**
+	 * Opt-in redirect-hop enforcement for ctx.http. When present, redirects are
+	 * evaluated before the next request is issued. Existing callers that omit
+	 * this policy retain the native fetch redirect behavior.
+	 */
+	redirectPolicy?: HttpRedirectPolicy;
+}
+
+export type RedirectRunReason =
+	| "completed"
+	| "stopped"
+	| "max_hops"
+	| "missing_location"
+	| "loop";
+
+export type HttpRedirectPolicyMode = "same-origin";
+
+export interface HttpRedirectPolicy {
+	/** Only follow redirects whose canonical scheme, host, and port match the initial URL. */
+	mode: HttpRedirectPolicyMode;
+	/** Maximum number of redirect hops that may be followed. Must be an integer from 0 to 20. */
+	maxHops: number;
 }
 
+export type HttpRedirectFailureReason = Exclude<RedirectRunReason, "completed">;
+
 export type HttpMethod =
 	| "HEAD"
 	| "head"
@@ -1039,7 +1063,7 @@ export type HttpMethod =
 	| "PATCH"
 	| "patch";
 
-export interface StealthFetchOptions extends RequestOptions {
+export interface StealthFetchOptions extends Omit<RequestOptions, "redirectPolicy"> {
 	method?: HttpMethod;
 	body?: string | Buffer;
 	redirect?: "follow" | "manual" | "error";
@@ -1152,7 +1176,7 @@ export interface StealthRedirectRunOptions
 export interface StealthRedirectRunResult {
 	final: StealthResponse;
 	hops: StealthRedirectHop[];
-	reason: "completed" | "stopped" | "max_hops" | "missing_location" | "loop";
+	reason: RedirectRunReason;
 	/**
 	 * Complete flat view across all redirect hosts. Attributes and duplicate names are lost.
 	 * @deprecated Use cookieStore for lossless persistence.
@@ -1290,6 +1314,12 @@ export interface NativeTcpEgressRule {
 /**
  * Bounded native TCP egress discovered through a declared bootstrap endpoint.
  * Host suffixes are exact DNS suffixes, not wildcard patterns.
+ *
+ * Dynamic rules are ordered. The first rule whose source, target, port, and TLS
+ * selectors match exclusively owns the grant; its ttlMs and maxGrants bounds
+ * apply, and an exhausted/shorter rule never falls through to a later overlap.
+ * Every rule must declare a source host selector, source port list/range, and
+ * target port list/range; omitted ttlMs/maxGrants remain unbounded.
  */
 export interface NativeTcpDynamicEgressRule {
 	readonly sourceHost?: string;