@apifuse/provider-sdk 2.2.0-beta.14 → 2.2.0-beta.16

package/src/runtime/stealth.ts

@@ -50,6 +50,11 @@ import {
 	shouldRetryProxyTransportAttempt,
 	validateUnsafeProxyTransportRetryMethods,
 } from "./proxy-retry-policy.js";
+import {
+	evaluateRedirectHop,
+	isRedirectStatus,
+	resolveRedirectUrl,
+} from "./redirects.js";
 import {
 	isSensitiveKey,
 	redactSensitiveError,
@@ -731,16 +736,6 @@ function normalizeMethod(method: HttpMethod | string): StealthMethod {
 	}
 }
 
-function isRedirectStatus(status: number): boolean {
-	return [301, 302, 303, 307, 308].includes(status);
-}
-
-function nextRedirectMethod(status: number, method: StealthMethod): StealthMethod {
-	if (status === 303 && method !== "HEAD") return "GET";
-	if ((status === 301 || status === 302) && method === "POST") return "GET";
-	return method;
-}
-
 function locationHeader(headers: Record<string, string>): string | undefined {
 	for (const [name, value] of Object.entries(headers)) {
 		if (name.toLowerCase() === "location") return value;
@@ -1256,7 +1251,7 @@ function createSessionFetcher(
 					const redactedLocation = location ? redactRedirectUrl(location) : undefined;
 					let nextUrl: string | undefined;
 					try {
-						nextUrl = location ? new URL(location, responseUrl).toString() : undefined;
+						nextUrl = resolveRedirectUrl(location, responseUrl);
 					} catch (error) {
 						throw redactSensitiveError(error, [...sensitiveValues], location, redactedLocation);
 					}
@@ -1297,51 +1292,29 @@ function createSessionFetcher(
 							throw sanitizedError;
 						}
 					}
-					if (shouldStop) {
-						return {
-							final: response,
-							hops,
-							reason: "stopped",
-							cookies: cookieJar.snapshot(),
-							cookieStore: cookieJar.serialize(),
-						};
-					}
-
-					if (!nextUrl) {
-						return {
-							final: response,
-							hops,
-							reason: "missing_location",
-							cookies: cookieJar.snapshot(),
-							cookieStore: cookieJar.serialize(),
-						};
-					}
-
-					if (hops.length > maxHops) {
+					const decision = evaluateRedirectHop({
+						status: response.status,
+						method,
+						nextUrl,
+						shouldStop,
+						redirectCount: hops.length,
+						maxHops,
+						visitedRequests,
+					});
+					if (decision.kind === "stop") {
 						return {
 							final: response,
 							hops,
-							reason: "max_hops",
+							reason: decision.reason,
 							cookies: cookieJar.snapshot(),
 							cookieStore: cookieJar.serialize(),
 						};
 					}
-
-					const nextMethod = nextRedirectMethod(response.status, method);
-					if (nextMethod !== method) {
+					if (decision.nextMethod !== method) {
 						body = undefined;
 					}
-					if (visitedRequests.has(`${nextMethod} ${nextUrl}`)) {
-						return {
-							final: response,
-							hops,
-							reason: "loop",
-							cookies: cookieJar.snapshot(),
-							cookieStore: cookieJar.serialize(),
-						};
-					}
-					method = nextMethod;
-					currentUrl = nextUrl;
+					method = decision.nextMethod;
+					currentUrl = decision.nextUrl;
 				}
 
 				if (!response) {

package/src/server/serve.ts

@@ -4,6 +4,10 @@ import { join } from "node:path";
 import { Hono } from "hono";
 import { z } from "zod";
 import { AuthAbortError, createAuthFlowHelpers } from "../auth.js";
+import {
+	SDK_OWNED_PROVIDER_ERROR_CODES,
+	SDK_RUNTIME_OWNED_ERROR_CODES,
+} from "../error-resolution.js";
 import {
 	AuthError,
 	isProviderError,
@@ -36,6 +40,7 @@ import { createEnvContext } from "../runtime/env.js";
 import { executeOperation } from "../runtime/executor.js";
 import { createHttpClient } from "../runtime/http.js";
 import { wrapWithInstrumentation } from "../runtime/instrumentation.js";
+import { createNativeNetworkClient } from "../runtime/native-network.js";
 import { getProviderBaseUrl } from "../runtime/provider.js";
 import {
 	PROXY_AUTH_IP_DENIED_CODE,
@@ -78,15 +83,19 @@ import type {
 	FlowContextStore,
 	HttpRetrySummary,
 	OperationDefinition,
+	OperationErrorCode,
 	OperationHttpStreamTransport,
 	OperationSseTransport,
+	ProviderErrorStatus,
 	ProviderContext,
 	ProviderDefinition,
+	ProviderProxyPolicy,
 	ProviderRuntimeState,
 	ProviderStreamEvent,
 	StealthClient,
 	SttContext,
 } from "../types.js";
+import { VALID_OPERATION_ERROR_STATUSES } from "../types.js";
 import {
 	createSelfTestApp,
 	createSelfTestAuthFlowInvoke,
@@ -287,6 +296,13 @@ function resolveOperationConnectionId(request: OperationRequest): string | undef
 	return request.connection?.id ?? request.connectionId;
 }
 
+function resolveNativeProxyPolicy(provider: ProviderDefinition): ProviderProxyPolicy | undefined {
+	if (typeof provider.proxy === "object") return provider.proxy;
+	if (provider.proxy === true) return { mode: "optional" };
+	if (provider.proxy === false) return { mode: "disabled" };
+	return undefined;
+}
+
 function createProviderContext(
 	provider: ProviderDefinition,
 	request: OperationRequest,
@@ -353,6 +369,17 @@ function createProviderContext(
 						engine: provider.browser?.engine,
 					})
 				: createBrowserStub(),
+		...(provider.native
+			? {
+					native: {
+						network: createNativeNetworkClient({
+							egress: provider.native.network,
+							proxyPolicy: resolveNativeProxyPolicy(provider),
+							affinityKey: proxyClientOptions.affinityKey,
+						}),
+					},
+				}
+			: {}),
 		trace: createTraceContext(),
 		auth: createAuthStub(),
 		stt: options.stt ?? createSttClientFromEnv(provider.stt),
@@ -455,6 +482,17 @@ function createAuthFlowContext(
 					? createStealthClient(stealthBaseUrl, stealthProfile.name, stealthClientOptions)
 					: createStealthClient(stealthBaseUrl, stealthClientOptions)
 				: createStealthStub(),
+			...(provider.native
+				? {
+						native: {
+							network: createNativeNetworkClient({
+								egress: provider.native.network,
+								proxyPolicy: resolveNativeProxyPolicy(provider),
+								affinityKey: proxyClientOptions.affinityKey,
+							}),
+						},
+					}
+				: {}),
 			env: createEnvContext(provider.secrets?.map((secret) => secret.name)),
 			credential,
 			context: flowContextStore.context,
@@ -613,8 +651,12 @@ function zodDetails(error: z.ZodError): Array<{
 	}));
 }
 
-function toErrorResponse(error: unknown, requestId?: string): OperationErrorResponse {
-	const observability = errorObservabilityDetails(error);
+function toErrorResponse(
+	error: unknown,
+	requestId?: string,
+	declaredErrorCode?: OperationErrorCode,
+): OperationErrorResponse {
+	const observability = errorObservabilityDetails(error, declaredErrorCode);
 	if (error instanceof StatefulRoutingDeadlineError) {
 		return {
 			error: {
@@ -678,7 +720,13 @@ function toErrorResponse(error: unknown, requestId?: string): OperationErrorResp
 // narrowing from a ProviderError-typed value would collapse the negative branch
 // to `never`. Narrowing from unknown avoids that while still recognizing errors
 // from a duplicate SDK module instance.
-function providerObservabilityDetails(error: unknown): ErrorObservabilityDetails | undefined {
+function providerObservabilityDetails(
+	error: unknown,
+	declaredErrorCode?: OperationErrorCode,
+): ErrorObservabilityDetails | undefined {
+	const declaredRetryable = sdkOwnsErrorResolution(error)
+		? undefined
+		: declaredErrorCode?.retryable;
 	// Session-expiry surfaces the credential_expired category + the opt-in
 	// retryable signal so Gateway/Credential Service can refresh and re-drive the
 	// operation (see design.md §4.3 D3). Without this branch the auth error would
@@ -688,7 +736,7 @@ function providerObservabilityDetails(error: unknown): ErrorObservabilityDetails
 		return {
 			category: error.options?.category ?? "credential_expired",
 			taxonomyVersion: PROVIDER_OBSERVABILITY_TAXONOMY_VERSION,
-			retryable: error.options?.retryable ?? false,
+			retryable: error.options?.retryable ?? declaredRetryable ?? false,
 		};
 	}
 	// Missing-secret errors carry the canonical credential_unavailable category
@@ -700,7 +748,7 @@ function providerObservabilityDetails(error: unknown): ErrorObservabilityDetails
 		return {
 			category: error.options?.category ?? "credential_unavailable",
 			taxonomyVersion: PROVIDER_OBSERVABILITY_TAXONOMY_VERSION,
-			retryable: error.options?.retryable ?? false,
+			retryable: error.options?.retryable ?? declaredRetryable ?? false,
 		};
 	}
 	if (!isTransportError(error)) {
@@ -735,18 +783,27 @@ function providerObservabilityDetails(error: unknown): ErrorObservabilityDetails
 	};
 }
 
-function errorObservabilityDetails(error: unknown): ErrorObservabilityDetails {
-	const providerDetails = providerObservabilityDetails(error);
+function errorObservabilityDetails(
+	error: unknown,
+	declaredErrorCode?: OperationErrorCode,
+): ErrorObservabilityDetails {
+	const effectiveDeclaration = sdkOwnsErrorResolution(error) ? undefined : declaredErrorCode;
+	const providerDetails = providerObservabilityDetails(error, effectiveDeclaration);
 	if (providerDetails) return providerDetails;
 
 	if (error instanceof z.ZodError || isValidationError(error)) {
+		const declaredStatus = effectiveDeclaration?.status;
 		return {
 			category:
 				isProviderError(error) && error.options?.category
 					? error.options.category
-					: "input_validation",
+					: isEmittableErrorStatus(declaredStatus) && declaredStatus >= 500
+						? "provider_error"
+						: "input_validation",
 			taxonomyVersion: PROVIDER_OBSERVABILITY_TAXONOMY_VERSION,
-			retryable: isProviderError(error) ? (error.options?.retryable ?? false) : false,
+			retryable: isProviderError(error)
+				? (error.options?.retryable ?? effectiveDeclaration?.retryable ?? false)
+				: false,
 		};
 	}
 
@@ -762,7 +819,7 @@ function errorObservabilityDetails(error: unknown): ErrorObservabilityDetails {
 		return {
 			category: error.options?.category ?? "provider_error",
 			taxonomyVersion: PROVIDER_OBSERVABILITY_TAXONOMY_VERSION,
-			retryable: error.options?.retryable ?? false,
+			retryable: error.options?.retryable ?? effectiveDeclaration?.retryable ?? false,
 		};
 	}
 
@@ -773,9 +830,16 @@ function errorObservabilityDetails(error: unknown): ErrorObservabilityDetails {
 	};
 }
 
-function responseWithErrorObservability(response: Response, error: unknown): Response {
+function responseWithErrorObservability(
+	response: Response,
+	error: unknown,
+	declaredErrorCode?: OperationErrorCode,
+): Response {
 	const headers = new Headers(response.headers);
-	headers.set(ERROR_OBSERVABILITY_HEADER, JSON.stringify(errorObservabilityDetails(error)));
+	headers.set(
+		ERROR_OBSERVABILITY_HEADER,
+		JSON.stringify(errorObservabilityDetails(error, declaredErrorCode)),
+	);
 	return new Response(response.body, {
 		status: response.status,
 		statusText: response.statusText,
@@ -807,7 +871,14 @@ function publicProviderErrorMessage(error: ProviderError): string {
 	return error.message;
 }
 
-function toStatusCode(error: unknown): 400 | 401 | 404 | 429 | 500 | 502 | 503 | 504 {
+function isEmittableErrorStatus(value: unknown): value is ProviderErrorStatus {
+	return (
+		typeof value === "number" &&
+		VALID_OPERATION_ERROR_STATUSES.some((status) => status === value)
+	);
+}
+
+function toStatusCode(error: unknown, declaredErrorCode?: OperationErrorCode): ProviderErrorStatus {
 	if (error instanceof z.ZodError) {
 		return 400;
 	}
@@ -815,6 +886,12 @@ function toStatusCode(error: unknown): 400 | 401 | 404 | 429 | 500 | 502 | 503 |
 		return 504;
 	}
 	if (isProviderError(error)) {
+		if (
+			!sdkOwnsErrorResolution(error) &&
+			isEmittableErrorStatus(declaredErrorCode?.status)
+		) {
+			return declaredErrorCode.status;
+		}
 		switch (error.code) {
 			case "AUTH_REQUIRED":
 			case "reauth_required":
@@ -852,77 +929,39 @@ function toStatusCode(error: unknown): 400 | 401 | 404 | 429 | 500 | 502 | 503 |
 	return 500;
 }
 
-// Codes emitted by SDK-owned paths must never be attributed to provider
-// authors by the unregistered-code signal, even when their intentional status
-// is 500. Provider-authored codes not in this registry retain the signal.
-const SDK_OWNED_PROVIDER_ERROR_CODES = new Set([
-	"AUTH_PROMPT_UNAVAILABLE",
-	"BROWSER_CDP_POOL_REQUIRED",
-	"BROWSER_RUNTIME_UNSUPPORTED",
-	"STEALTH_RUNTIME_UNSUPPORTED",
-	"SSE_EVENT_UNDECLARED",
-	"STREAM_EVENT_TOO_LARGE",
-	"STREAM_CHUNK_TOO_LARGE",
-	"SSE_RESULT_UNSUPPORTED",
-	"STREAM_RESULT_UNSUPPORTED",
-	"AUTH_FLOW_NOT_CONFIGURED",
-	"refresh_not_supported",
-	"RUNTIME_UNSUPPORTED",
-	"PROVIDER_STATE_UNSUPPORTED",
-	"CHOICE_TOKEN_MASTER_SECRET_NOT_CONFIGURED",
-	"CHOICE_STATE_PAYLOAD_TOO_LARGE",
-	"CHOICE_STATE_UNAVAILABLE",
-	"CHOICE_CONTEXT_REQUIRED",
-	"unsupported_stealth_cookie_store_version",
-	"provider_secret_error",
-	"credential_key_error",
-	"credential_mode_error",
-	"flow_expired",
-	"turn_validation_error",
-	"context_access_error",
-	"UNSUPPORTED_STT_OPTION",
-	"INVALID_STT_AUDIO",
-	"STT_AUDIO_TOO_LARGE",
-	"STT_UPSTREAM_FAILED",
-	"INVALID_STT_VERIFICATION_CODE_OPTIONS",
-	"NO_CODE_FOUND",
-	"AMBIGUOUS_CODE",
-	"retry_invalid_policy",
-	"retry_unsafe_method",
-	"stealth_cookie_store_serialize_failed",
-	"response_too_large",
-	"transport_stream_unavailable",
-	"transport_invalid_method",
-	"http_transport_override_unsupported",
-	"transport_invalid_url",
-	"retry_exhausted",
-	"auth_abort_unsafe_data",
-	"credentials_auth_missing_credential_keys",
-	"credentials_auth_missing_credential",
-	"credentials_auth_invalid_login_result",
-	"credentials_auth_unknown_challenge",
-	"credentials_auth_unknown_pending_challenge",
-	"STATEFUL_FORWARDING_NOT_CONFIGURED",
-	"STATEFUL_FORWARDING_SIGNATURE_MISSING",
-	"STATEFUL_FORWARDING_NONCE_INVALID",
-	"STATEFUL_FORWARDING_TIMESTAMP_INVALID",
-	"STATEFUL_FORWARDING_SIGNATURE_INVALID",
-	"STATEFUL_FORWARDING_REPLAY_DETECTED",
-	"STATEFUL_FORWARDING_REPLAY_CACHE_FULL",
-	"STATEFUL_FORWARDING_ENVELOPE_INVALID",
-	"STATEFUL_FORWARDING_PROVIDER_MISMATCH",
-	"STATEFUL_FORWARDING_SOURCE_POD_MISMATCH",
-	"STATEFUL_FORWARDING_OWNER_FENCE_INVALID",
-	"STATEFUL_FORWARDING_REQUEST_FAILED",
-	"STATEFUL_FORWARDING_CONTEXT_MISSING",
-	"STATEFUL_FORWARDING_BAD_RESPONSE",
-	"STATEFUL_INTERNAL_EXECUTOR_NOT_CONFIGURED",
-	"STATEFUL_FILE_FORWARDING_UNSUPPORTED",
-	"STATEFUL_CONTROL_PLANE_OPERATION_AMBIGUOUS",
-	"STATEFUL_CONTROL_PLANE_REQUEST_FAILED",
-	"STATEFUL_CONTROL_PLANE_HTTP_ERROR",
-	"STATEFUL_CONTROL_PLANE_INVALID_RESPONSE",
-]);
+function sdkOwnsErrorResolution(error: unknown): boolean {
+	if (isSessionExpiredError(error)) return true;
+	if (isTransportError(error)) return true;
+	if (error instanceof z.ZodError) return true;
+	if (error instanceof StatefulRoutingDeadlineError) return true;
+	return (
+		isProviderError(error) &&
+		typeof error.code === "string" &&
+		SDK_RUNTIME_OWNED_ERROR_CODES.has(error.code)
+	);
+}
+
+type OperationErrorCodeLookup = ReadonlyMap<string, ReadonlyMap<string, OperationErrorCode>>;
+
+function buildOperationErrorCodeLookup(provider: ProviderDefinition): OperationErrorCodeLookup {
+	return new Map(
+		Object.entries(provider.operations).flatMap(([operationId, operation]) => {
+			const errorCodes = operation.docs?.errorCodes;
+			return errorCodes?.length
+				? [[operationId, new Map(errorCodes.map((entry) => [entry.code, entry]))] as const]
+				: [];
+		}),
+	);
+}
+
+function declaredErrorCodeFor(
+	error: unknown,
+	operationId: string | undefined,
+	lookup: OperationErrorCodeLookup,
+): OperationErrorCode | undefined {
+	if (!operationId || !isProviderError(error) || typeof error.code !== "string") return undefined;
+	return lookup.get(operationId)?.get(error.code);
+}
 
 function extractRequestId(raw: unknown): string | undefined {
 	if (!raw || typeof raw !== "object") {
@@ -942,6 +981,7 @@ function logProviderError(
 	error: unknown,
 	status: number,
 	cost: ProviderRequestCost,
+	declaredErrorCode?: OperationErrorCode,
 ): void {
 	const code = isProviderError(error)
 		? (error.code ?? "provider_error")
@@ -952,13 +992,14 @@ function logProviderError(
 				: "internal_error";
 	const errorClass = error instanceof Error ? error.name : typeof error;
 	const message = error instanceof Error ? error.message : String(error);
-	const details = errorObservabilityDetails(error);
+	const details = errorObservabilityDetails(error, declaredErrorCode);
 	const isUnregisteredProviderErrorCode =
 		status === 500 &&
 		isProviderError(error) &&
 		!isValidationError(error) &&
 		typeof error.code === "string" &&
-		!SDK_OWNED_PROVIDER_ERROR_CODES.has(error.code);
+		!SDK_OWNED_PROVIDER_ERROR_CODES.has(error.code) &&
+		declaredErrorCode === undefined;
 	const emit = typeof logger === "function" ? logger : defaultProviderServerLogger;
 	emit({
 		level: status >= 500 ? "error" : "warn",
@@ -1693,6 +1734,7 @@ export function createServerApp(
 	validateStatefulServerConfig(options);
 	const app = new Hono();
 	const logger = options.logger ?? defaultProviderServerLogger;
+	const operationErrorCodes = buildOperationErrorCodeLookup(provider);
 	const statefulForwardingReplayCache = new StatefulForwardingReplayCache(
 		options.statefulForwarding?.replayCacheMaxEntries ??
 			DEFAULT_STATEFUL_FORWARDING_REPLAY_CACHE_MAX_ENTRIES,
@@ -1738,6 +1780,7 @@ export function createServerApp(
 	app.post(STATEFUL_INTERNAL_OPERATIONS_ROUTE, async (c) => {
 		let rawBodyText = "";
 		let rawBody: unknown;
+		let operationId: string | undefined;
 		const operation = "stateful-internal";
 		const requestCost = startRequestCost();
 		try {
@@ -1848,7 +1891,7 @@ export function createServerApp(
 				});
 			}
 			const request = operationRequestFromForwardingEnvelope(envelope);
-			const operationId = envelope.operationId;
+			operationId = envelope.operationId;
 			const ctx = createProviderContext(provider, request, operationId, options, state);
 			if (deadlineAtMs !== undefined && deadlineAtMs <= Date.now()) {
 				throw new StatefulRoutingDeadlineError(envelope.requestId, envelope.deadlineAt as string);
@@ -1872,7 +1915,8 @@ export function createServerApp(
 			);
 			return c.json({ data: output });
 		} catch (error) {
-			const status = toStatusCode(error);
+			const declaredErrorCode = declaredErrorCodeFor(error, operationId, operationErrorCodes);
+			const status = toStatusCode(error, declaredErrorCode);
 			if (isProviderError(error) && error.code === "STATEFUL_FORWARDING_REPLAY_CACHE_FULL") {
 				c.header("Retry-After", String(STATEFUL_FORWARDING_REPLAY_RETRY_AFTER_SECONDS));
 			}
@@ -1881,15 +1925,17 @@ export function createServerApp(
 				logger,
 				provider,
 				"operation",
-				operation,
+				operationId || operation,
 				requestId,
 				error,
 				status,
 				finishRequestCost(requestCost),
+				declaredErrorCode,
 			);
 			return responseWithErrorObservability(
-				c.json(toErrorResponse(error, requestId), status),
+				c.json(toErrorResponse(error, requestId, declaredErrorCode), status),
 				error,
+				declaredErrorCode,
 			);
 		}
 	});
@@ -1940,7 +1986,8 @@ export function createServerApp(
 			);
 			return c.json(response);
 		} catch (error) {
-			const status = toStatusCode(error);
+			const declaredErrorCode = declaredErrorCodeFor(error, operation, operationErrorCodes);
+			const status = toStatusCode(error, declaredErrorCode);
 			const requestId = extractRequestId(rawBody);
 			logProviderError(
 				logger,
@@ -1951,12 +1998,14 @@ export function createServerApp(
 				error,
 				status,
 				finishRequestCost(requestCost),
+				declaredErrorCode,
 			);
 			const telemetryHeader = proxyTelemetry.toHeaderValue();
 			if (telemetryHeader) c.header(PROVIDER_TELEMETRY_HEADER, telemetryHeader);
 			return responseWithErrorObservability(
-				c.json(toErrorResponse(error, requestId), status),
+				c.json(toErrorResponse(error, requestId, declaredErrorCode), status),
 				error,
+				declaredErrorCode,
 			);
 		}
 	});

package/src/testing/run.ts

@@ -4,6 +4,12 @@ import { createProviderCache } from "../runtime/cache.js";
 import { createTestProviderChoiceContext } from "../runtime/choice.js";
 import { createMemoryProviderRuntimeState } from "../runtime/state.js";
 import { createUnsupportedSttClient } from "../runtime/stt.js";
+import {
+	createNativeEgressAuthorization,
+	NativeNetworkError,
+	snapshotNativeConnectInput,
+	snapshotNativeGrantInput,
+} from "../runtime/native-network.js";
 import { safeParseSchemaSync } from "../schema.js";
 import { requestPathForFixture } from "../fixture-sanitization.js";
 import { findStreamCaptureGroup, replayStreamEvidence } from "../stream-evidence.js";
@@ -307,6 +313,17 @@ function createUpstreamContext(
 	};
 	const request = { headers: {} };
 	const state = createMemoryProviderRuntimeState();
+	const nativeEgress = provider.native
+		? createNativeEgressAuthorization({ egress: provider.native.network })
+		: undefined;
+	const requireNativeEgress = () => {
+		if (!nativeEgress)
+			throw new NativeNetworkError(
+				"Native egress authorization is unavailable",
+				"native_egress_policy_invalid",
+			);
+		return nativeEgress;
+	};
 	const dispatch = async (
 		call: Omit<StandardTestsUpstreamCall, "operationName">,
 	): Promise<NormalizedUpstreamResponse> => {
@@ -498,30 +515,38 @@ function createUpstreamContext(
 		...(provider.native
 			? {
 					native: {
-						network: {
-							connectTcp: async (options) =>
-								createNativeConnection(
+					network: {
+							connectTcp: async (options) => {
+								const request = snapshotNativeConnectInput(options);
+								requireNativeEgress().assertConnect(request, "disabled");
+								return createNativeConnection(
 									await dispatch({
 										transport: "native",
 										method: "connectTcp",
-										url: `tcp://${options.host}:${options.port}`,
-										options,
+										url: `tcp://${request.host}:${request.port}`,
+										options: request,
 									}),
 									dispatch,
-									`tcp://${options.host}:${options.port}`,
-								),
-							connectTls: async (options) =>
-								createNativeConnection(
+									`tcp://${request.host}:${request.port}`,
+								);
+							},
+							connectTls: async (options) => {
+								const request = snapshotNativeConnectInput(options);
+								requireNativeEgress().assertConnect(request, "required");
+								return createNativeConnection(
 									await dispatch({
 										transport: "native",
 										method: "connectTls",
-										url: `tls://${options.host}:${options.port}`,
-										options,
+										url: `tls://${request.host}:${request.port}`,
+										options: request,
 									}),
 									dispatch,
-									`tls://${options.host}:${options.port}`,
-								),
-							grantTcpEgress: () => ({ revoke: () => {} }),
+									`tls://${request.host}:${request.port}`,
+								);
+							},
+							grantTcpEgress: (input) => {
+								return requireNativeEgress().grant(snapshotNativeGrantInput(input));
+							},
 						},
 					},
 				}