@apifuse/provider-sdk 2.2.0-beta.2 → 2.2.0-beta.21

package/dist/index.d.ts

@@ -1,42 +1,46 @@
-export * from "./auth";
-export * from "./ceremonies";
-export * from "./choice-token";
-export type { ApiFuseConfig, BrowserConfig, ProxyConfig, SessionConfig, } from "./config/loader";
-export { defineConfig, loadApiFuseConfig } from "./config/loader";
-export { canonicalJson, digestProviderContract, extractProviderContract, type JsonPrimitive, type JsonValue, PROVIDER_CONTRACT_SCHEMA_VERSION, type ProviderContractOperation, type ProviderContractSnapshot, } from "./contract";
-export { centered, delayed, defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, defineStreamOperation, every, type ProviderConfig, } from "./define";
-export type { DevServerOptions } from "./dev";
-export { createDevServer, startDevServer } from "./dev";
-export * from "./errors";
-export * from "./i18n";
-export { type LintDiagnostic, lintOperation, lintProvider, } from "./lint";
-export * from "./recipes/gov-api";
-export * from "./recipes/rest-api";
-export { createFlowContext, createScratchpad } from "./runtime/auth-flow";
-export type { BrowserClientOptions } from "./runtime/browser";
-export { BrowserClient, createBrowserClient } from "./runtime/browser";
-export { createBypassProviderCache, createProviderCache, type ProviderCacheOptions, resetProviderCacheForTests, } from "./runtime/cache";
-export { type CreateProviderChoiceContextOptions, createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice";
-export { type CreateCredentialContextOptions, createCredentialContext, } from "./runtime/credential";
-export { createEnvContext } from "./runtime/env";
-export { executeOperation } from "./runtime/executor";
-export { createHttpClient } from "./runtime/http";
-export type { Insight, InsightSeverity } from "./runtime/insights";
-export { generateInsights } from "./runtime/insights";
-export { type InstrumentationOptions, type InstrumentedProviderContext, wrapWithInstrumentation, } from "./runtime/instrumentation";
-export { type PrevalidateResult, prevalidate } from "./runtime/prevalidate";
-export { getProviderBaseUrl } from "./runtime/provider";
-export { createUnsupportedProviderRuntimeState, UnsupportedProviderStateError, } from "./runtime/state";
-export { createStealthClient } from "./runtime/stealth";
-export { APIFUSE__STT__BACKEND_ENV, APIFUSE__STT__CLOUDFLARE_API_TOKEN_ENV, APIFUSE__STT__MODEL_ENV, createSttClientFromEnv, createUnsupportedSttClient, extractVerificationCode, resolveSttPrompt, } from "./runtime/stt";
-export { type CreateTraceContextOptions, createTraceContext, type Span, type TraceContext, } from "./runtime/trace";
-export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, type SensitiveFieldKind, type SensitiveFieldOptions, type SensitivePath, sensitive, z, } from "./schema";
-export { createServerApp, type ServeOptions, serve } from "./server";
-export { getStealthProfile, listStealthProfiles } from "./stealth/profiles";
-export * from "./stream";
-export type { ApiFuseResponse, AuthConfig, AuthContext, AuthFlowDefinition, AuthFlowInputHandler, AuthFlowStartHandler, AuthMode, AuthTurn, Bcp47Locale, BrowserEngine, BrowserOptions, BrowserResourceBody, BrowserResourceDecision, BrowserResourceMethod, BrowserResourcePolicy, BrowserResourceRequest, BrowserResourceRoute, ConnectionMode, ContextDeclaration, CookieJar, ContextScratchpad, CredentialContext, CredentialDeclaration, E164PhoneNumber, EnvContext, FlowContext, FlowContextStore, HealthCheckAssertionContext, HealthCheckCase, HealthCheckCaseResult, HealthCheckSuite, HealthCheckUnsupported, HealthJourneyDefinition, HealthJourneyEventContext, HealthJourneyGatewayContext, HealthJourneyJournalContext, HealthJourneyManualTriggerPolicy, HealthJourneyRunContext, HealthJourneyRunResult, HealthJourneySchedule, HealthScheduleRandomization, HealthJourneySmsContext, HealthJourneyStep, HttpClient, HttpMethod, HttpResponse, HttpRetryOptions, HttpRetrySummary, HttpStreamResponse, IanaTimeZone, InferSchemaOutput, Iso3166Alpha2CountryCode, Iso4217CurrencyCode, Iso8601Duration, OperationAnnotations, OperationApprovalPolicy, OperationContractMetadata, OperationDefinition, OperationDeprecationMetadata, OperationDocMeta, OperationErrorCode, OperationHandlerResult, OperationInputExample, OperationLifecycle, OperationObservabilityConfig, OperationObservabilitySensitiveConfig, OperationRelationships, OperationRiskClass, OperationSensitivePath, OperationToolRouterMetadata, OperationTransport, OperationTransportKind, ProbeInterval, ProviderAccessConfig, ProviderAccessVisibility, ProviderCache, ProviderCacheGetOrSetOptions, ProviderCacheKeyOptions, ProviderCacheLookupMeta, ProviderCacheResponseMeta, ProviderCacheResult, ProviderChoiceBindingOptions, ProviderChoiceContext, ProviderChoiceIssueOptions, ProviderChoiceParseOptions, ProviderContext, ProviderDefinition, ProviderHealthMonitorConfig, ProviderHealthProbeConfig, ProviderLocale, ProviderLocaleKey, ProviderLocaleKeyInput, ProviderLogoProfile, ProviderLogoSource, ProviderMeta, ProviderProxyConfig, ProviderProxyMode, ProviderProxyPolicy, ProviderProxyProvider, ProviderProxySessionAffinity, ProviderPublicConnectionMode, ProviderPublicProfile, ProviderReviewed, ProviderRuntimeState, ProviderSecretDeclaration, ProviderStateDurationString, ProviderStateNamespace, ProviderStreamEvent, ProviderSttConfig, ProviderSttMode, ProviderSupportLevel, RequestOptions, Rfc3339Instant, SchemaLike, SmsOrigin, SmsOtpExtractionPattern, SmsOtpMatcherDefinition, SseMessage, StandardSchemaV1, StateCasResult, StateNamespaceOptions, StateValue, StateWriteOptions, StealthClient, StealthFetchOptions, StealthPlatform, StealthProfile, StealthRedirectHop, StealthRedirectRunOptions, StealthRedirectRunResult, StealthResponse, StealthSession, StealthSessionCookies, SttAudioInput, SttContext, SttPromptPolicy, SttSegment, SttTranscribeMode, SttTranscribeRequest, SttTranscript, SttUnsupportedOptionPolicy, SttUsage, SttVerificationCodeOptions, SttWarning, TraceConfig, TraceSpan, VerificationCodeCandidate, VerificationCodeCandidateSource, VerificationCodeExtractionResult, } from "./types";
-export { DEFAULT_OPERATION_TRANSPORT, HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, PROBE_INTERVALS, STREAM_CHUNK_BYTES_MAX, STREAM_CHUNK_BYTES_MIN, STREAM_HEARTBEAT_MS_MAX, STREAM_HEARTBEAT_MS_MIN, STREAM_IDLE_TIMEOUT_MS_MAX, STREAM_IDLE_TIMEOUT_MS_MIN, STREAM_MAX_DURATION_MS_MAX, STREAM_MAX_DURATION_MS_MIN, } from "./types";
-export * from "./utils/date";
-export * from "./utils/parse";
-export * from "./utils/text";
-export * from "./utils/transform";
+export * from "./auth.js";
+export * from "./ceremonies/index.js";
+export * from "./choice-token.js";
+export type { ApiFuseConfig, BrowserConfig, ProxyConfig, ProxyProtocol, ProxyResolutionOptions, ProxyResolutionSource, ProxyVendorName, ResolvedProxyConfig, SessionConfig, } from "./config/loader.js";
+export { defineConfig, loadApiFuseConfig, resolveProxy } from "./config/loader.js";
+export { canonicalJson, digestProviderContract, extractProviderContract, type JsonPrimitive, type JsonValue, PROVIDER_CONTRACT_SCHEMA_VERSION, type ProviderContractOperation, type ProviderContractSnapshot, } from "./contract.js";
+export { centered, delayed, defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, defineStreamOperation, every, type ProviderConfig, } from "./define.js";
+export type { DevServerOptions } from "./dev.js";
+export { createDevServer, startDevServer } from "./dev.js";
+export * from "./errors.js";
+export * from "./observability.js";
+export * from "./user-input.js";
+export * from "./i18n/index.js";
+export { type LintDiagnostic, lintOperation, lintProvider, } from "./lint.js";
+export * from "./recipes/gov-api.js";
+export * from "./recipes/rest-api.js";
+export { createFlowContext, createScratchpad } from "./runtime/auth-flow.js";
+export type { BrowserClientOptions } from "./runtime/browser.js";
+export { BrowserClient, createBrowserClient } from "./runtime/browser.js";
+export { createBypassProviderCache, createProviderCache, type ProviderCacheOptions, resetProviderCacheForTests, } from "./runtime/cache.js";
+export { type CreateProviderChoiceContextOptions, createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice.js";
+export { type CreateCredentialContextOptions, createCredentialContext, } from "./runtime/credential.js";
+export { createEnvContext } from "./runtime/env.js";
+export { executeOperation } from "./runtime/executor.js";
+export { createHttpClient } from "./runtime/http.js";
+export { createNativeNetworkClient, createEnvVendorCredentialResolver, deriveNativeCredentialAffinityKey, NativeEgressGrantExpiredError, NativeEgressNotDeclaredError, NativeIdleTimeoutError, NativeNetworkError, NativeProxyExpiredError, resolveNativeGatewayProxy, type NativeGatewayProxy, type NativeGatewayProxyResolutionInput, type NativeGatewayProxySkipReason, type NativeGatewayProxySynthesizer, type NativeGatewayProxySynthesisResult, type NativeGatewayProxySynthesisInput, type NativeNetworkClientOptions, type NativeNetworkErrorCode, type VendorCredentialLookup, type VendorCredentialResolver, } from "./runtime/native-network.js";
+export type { Insight, InsightSeverity } from "./runtime/insights.js";
+export { generateInsights } from "./runtime/insights.js";
+export { type InstrumentationOptions, type InstrumentedProviderContext, wrapWithInstrumentation, } from "./runtime/instrumentation.js";
+export { type PrevalidateResult, prevalidate } from "./runtime/prevalidate.js";
+export { getProviderBaseUrl } from "./runtime/provider.js";
+export { assertRequiredSecretsPresent, listMissingRequiredSecrets, MISSING_SECRET_CODE, } from "./runtime/secrets.js";
+export { createUnsupportedProviderRuntimeState, UnsupportedProviderStateError, } from "./runtime/state.js";
+export { createStealthClient } from "./runtime/stealth.js";
+export { APIFUSE__STT__BACKEND_ENV, APIFUSE__STT__CLOUDFLARE_API_TOKEN_ENV, APIFUSE__STT__MODEL_ENV, createSttClientFromEnv, createUnsupportedSttClient, extractVerificationCode, resolveSttPrompt, } from "./runtime/stt.js";
+export { type CreateTraceContextOptions, createTraceContext, type Span, type TraceContext, } from "./runtime/trace.js";
+export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, type SensitiveFieldKind, type SensitiveFieldOptions, type SensitivePath, sensitive, z, } from "./schema.js";
+export { createServerApp, ERROR_OBSERVABILITY_HEADER, type ServeOptions, serve, } from "./server/index.js";
+export { getStealthProfile, listStealthProfiles } from "./stealth/profiles.js";
+export * from "./stream.js";
+export type { ApiFuseResponse, AuthConfig, AuthContext, AuthFlowDefinition, AuthFlowInputHandler, AuthFlowStartHandler, AuthMode, AuthTurn, Bcp47Locale, BrowserEngine, BrowserOptions, BrowserResourceBody, BrowserResourceDecision, BrowserResourceMethod, BrowserResourcePolicy, BrowserResourceRequest, BrowserResourceRoute, ConnectionMode, ContextDeclaration, CookieJar, ContextScratchpad, CredentialContext, CredentialDeclaration, E164PhoneNumber, EnvContext, FlowContext, FlowContextStore, HealthCheckAssertionContext, HealthCheckCase, HealthCheckCaseResult, HealthCheckSuite, HealthCheckUnsupported, HealthJourneyDefinition, HealthJourneyEventContext, HealthJourneyGatewayContext, HealthJourneyJournalContext, HealthJourneyManualTriggerPolicy, HealthJourneyRunContext, HealthJourneyRunResult, HealthJourneySchedule, HealthScheduleRandomization, HealthJourneySmsContext, HealthJourneyStep, HttpClient, HttpMethod, HttpRedirectFailureReason, HttpRedirectPolicy, HttpRedirectPolicyMode, HttpResponse, HttpRetryOptions, HttpRetrySummary, HttpStreamResponse, IanaTimeZone, InferSchemaOutput, Iso3166Alpha2CountryCode, Iso4217CurrencyCode, Iso8601Duration, NativeContext, NativeNetworkClient, NativeNetworkCloseReason, NativeNetworkConnection, NativeNetworkConnectInput, NativeNetworkConnectOptions, NativeNetworkDynamicGrantOptions, NativeNetworkEgressGrant, NativeProviderConfig, NativeProviderContext, NativeProxyDrainHandler, NativeProxyEgressInfo, NativeProxyExpiringEvent, NativeProxyExpiringReason, NativeTcpDynamicEgressRule, NativeTcpEgressGrant, NativeTcpEgressRule, NativeTcpPortRange, NativeTcpTlsMode, NativeTlsConnectOptions, OperationAnnotations, OperationApprovalPolicy, OperationContractMetadata, OperationDefinition, OperationDeprecationMetadata, OperationDocMeta, OperationErrorCode, ProviderErrorStatus, OperationHandlerResult, OperationInputExample, OperationLifecycle, OperationObservabilityConfig, OperationObservabilitySensitiveConfig, OperationRelationships, OperationRiskClass, OperationSensitivePath, OperationToolRouterMetadata, OperationTransport, OperationTransportKind, ProbeInterval, ProviderAccessConfig, ProviderAccessVisibility, ProviderCache, ProviderCacheGetOrSetOptions, ProviderCacheKeyOptions, ProviderCacheLookupMeta, ProviderCacheResponseMeta, ProviderCacheResult, ProviderChoiceBindingOptions, ProviderChoiceContext, ProviderChoiceIssueOptions, ProviderChoiceParseOptions, ProviderContext, ProviderDefinition, ProviderDeploymentOverrides, ProviderFileRef, ProviderFilesContext, ProviderHealthMonitorConfig, ProviderHealthProbeConfig, ProviderLocale, ProviderLocaleKey, ProviderLocaleKeyInput, ProviderLogoProfile, ProviderLogoSource, ProviderMeta, ProviderProxyConfig, ProviderProxyMode, ProviderProxyPolicy, ProxiedOAuthConfig, ProviderProxyProvider, ProviderProxySessionAffinity, ProviderPublicConnectionMode, ProviderPublicProfile, ProviderReviewed, ProviderResolvedFile, ProviderRuntimeState, ProviderSecretDeclaration, ProviderStateDurationString, ProviderStateNamespace, ProviderStreamEvent, ProviderSttConfig, ProviderSttMode, ProviderSupportLevel, RequestOptions, RedirectRunReason, Rfc3339Instant, SchemaLike, SmsOrigin, SmsOtpExtractionPattern, SmsOtpMatcherDefinition, SseMessage, StandardSchemaV1, StateCasResult, StateNamespaceOptions, StateValue, StateWriteOptions, StealthClient, StealthCookieStore, StealthCookieStoreV1, StealthFetchOptions, StealthPlatform, StealthProfile, StealthRedirectHop, StealthRedirectRunOptions, StealthRedirectRunResult, StealthResponse, StealthSession, StealthSessionCookies, SttAudioInput, SttContext, SttPromptPolicy, SttSegment, SttTranscribeMode, SttTranscribeRequest, SttTranscript, SttUnsupportedOptionPolicy, SttUsage, SttVerificationCodeOptions, SttWarning, TraceConfig, TraceSpan, VerificationCodeCandidate, VerificationCodeCandidateSource, VerificationCodeExtractionResult, } from "./types.js";
+export { DEFAULT_OPERATION_TRANSPORT, HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, PROBE_INTERVALS, STREAM_CHUNK_BYTES_MAX, STREAM_CHUNK_BYTES_MIN, STREAM_HEARTBEAT_MS_MAX, STREAM_HEARTBEAT_MS_MIN, STREAM_IDLE_TIMEOUT_MS_MAX, STREAM_IDLE_TIMEOUT_MS_MIN, STREAM_MAX_DURATION_MS_MAX, STREAM_MAX_DURATION_MS_MIN, } from "./types.js";
+export * from "./utils/date.js";
+export * from "./utils/parse.js";
+export * from "./utils/text.js";
+export * from "./utils/transform.js";

package/dist/index.js

@@ -1,38 +1,42 @@
 // @apifuse/provider-sdk
-export * from "./auth";
-export * from "./ceremonies";
-export * from "./choice-token";
-export { defineConfig, loadApiFuseConfig } from "./config/loader";
-export { canonicalJson, digestProviderContract, extractProviderContract, PROVIDER_CONTRACT_SCHEMA_VERSION, } from "./contract";
-export { centered, delayed, defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, defineStreamOperation, every, } from "./define";
-export { createDevServer, startDevServer } from "./dev";
-export * from "./errors";
-export * from "./i18n";
-export { lintOperation, lintProvider, } from "./lint";
-export * from "./recipes/gov-api";
-export * from "./recipes/rest-api";
-export { createFlowContext, createScratchpad } from "./runtime/auth-flow";
-export { BrowserClient, createBrowserClient } from "./runtime/browser";
-export { createBypassProviderCache, createProviderCache, resetProviderCacheForTests, } from "./runtime/cache";
-export { createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice";
-export { createCredentialContext, } from "./runtime/credential";
-export { createEnvContext } from "./runtime/env";
-export { executeOperation } from "./runtime/executor";
-export { createHttpClient } from "./runtime/http";
-export { generateInsights } from "./runtime/insights";
-export { wrapWithInstrumentation, } from "./runtime/instrumentation";
-export { prevalidate } from "./runtime/prevalidate";
-export { getProviderBaseUrl } from "./runtime/provider";
-export { createUnsupportedProviderRuntimeState, UnsupportedProviderStateError, } from "./runtime/state";
-export { createStealthClient } from "./runtime/stealth";
-export { APIFUSE__STT__BACKEND_ENV, APIFUSE__STT__CLOUDFLARE_API_TOKEN_ENV, APIFUSE__STT__MODEL_ENV, createSttClientFromEnv, createUnsupportedSttClient, extractVerificationCode, resolveSttPrompt, } from "./runtime/stt";
-export { createTraceContext, } from "./runtime/trace";
-export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, sensitive, z, } from "./schema";
-export { createServerApp, serve } from "./server";
-export { getStealthProfile, listStealthProfiles } from "./stealth/profiles";
-export * from "./stream";
-export { DEFAULT_OPERATION_TRANSPORT, HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, PROBE_INTERVALS, STREAM_CHUNK_BYTES_MAX, STREAM_CHUNK_BYTES_MIN, STREAM_HEARTBEAT_MS_MAX, STREAM_HEARTBEAT_MS_MIN, STREAM_IDLE_TIMEOUT_MS_MAX, STREAM_IDLE_TIMEOUT_MS_MIN, STREAM_MAX_DURATION_MS_MAX, STREAM_MAX_DURATION_MS_MIN, } from "./types";
-export * from "./utils/date";
-export * from "./utils/parse";
-export * from "./utils/text";
-export * from "./utils/transform";
+export * from "./auth.js";
+export * from "./ceremonies/index.js";
+export * from "./choice-token.js";
+export { defineConfig, loadApiFuseConfig, resolveProxy } from "./config/loader.js";
+export { canonicalJson, digestProviderContract, extractProviderContract, PROVIDER_CONTRACT_SCHEMA_VERSION, } from "./contract.js";
+export { centered, delayed, defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, defineStreamOperation, every, } from "./define.js";
+export { createDevServer, startDevServer } from "./dev.js";
+export * from "./errors.js";
+export * from "./observability.js";
+export * from "./user-input.js";
+export * from "./i18n/index.js";
+export { lintOperation, lintProvider, } from "./lint.js";
+export * from "./recipes/gov-api.js";
+export * from "./recipes/rest-api.js";
+export { createFlowContext, createScratchpad } from "./runtime/auth-flow.js";
+export { BrowserClient, createBrowserClient } from "./runtime/browser.js";
+export { createBypassProviderCache, createProviderCache, resetProviderCacheForTests, } from "./runtime/cache.js";
+export { createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice.js";
+export { createCredentialContext, } from "./runtime/credential.js";
+export { createEnvContext } from "./runtime/env.js";
+export { executeOperation } from "./runtime/executor.js";
+export { createHttpClient } from "./runtime/http.js";
+export { createNativeNetworkClient, createEnvVendorCredentialResolver, deriveNativeCredentialAffinityKey, NativeEgressGrantExpiredError, NativeEgressNotDeclaredError, NativeIdleTimeoutError, NativeNetworkError, NativeProxyExpiredError, resolveNativeGatewayProxy, } from "./runtime/native-network.js";
+export { generateInsights } from "./runtime/insights.js";
+export { wrapWithInstrumentation, } from "./runtime/instrumentation.js";
+export { prevalidate } from "./runtime/prevalidate.js";
+export { getProviderBaseUrl } from "./runtime/provider.js";
+export { assertRequiredSecretsPresent, listMissingRequiredSecrets, MISSING_SECRET_CODE, } from "./runtime/secrets.js";
+export { createUnsupportedProviderRuntimeState, UnsupportedProviderStateError, } from "./runtime/state.js";
+export { createStealthClient } from "./runtime/stealth.js";
+export { APIFUSE__STT__BACKEND_ENV, APIFUSE__STT__CLOUDFLARE_API_TOKEN_ENV, APIFUSE__STT__MODEL_ENV, createSttClientFromEnv, createUnsupportedSttClient, extractVerificationCode, resolveSttPrompt, } from "./runtime/stt.js";
+export { createTraceContext, } from "./runtime/trace.js";
+export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, sensitive, z, } from "./schema.js";
+export { createServerApp, ERROR_OBSERVABILITY_HEADER, serve, } from "./server/index.js";
+export { getStealthProfile, listStealthProfiles } from "./stealth/profiles.js";
+export * from "./stream.js";
+export { DEFAULT_OPERATION_TRANSPORT, HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, PROBE_INTERVALS, STREAM_CHUNK_BYTES_MAX, STREAM_CHUNK_BYTES_MIN, STREAM_HEARTBEAT_MS_MAX, STREAM_HEARTBEAT_MS_MIN, STREAM_IDLE_TIMEOUT_MS_MAX, STREAM_IDLE_TIMEOUT_MS_MIN, STREAM_MAX_DURATION_MS_MAX, STREAM_MAX_DURATION_MS_MIN, } from "./types.js";
+export * from "./utils/date.js";
+export * from "./utils/parse.js";
+export * from "./utils/text.js";
+export * from "./utils/transform.js";

package/dist/lint.d.ts

@@ -1,4 +1,4 @@
-type AuthModeLike = "none" | "platform-managed" | "credentials" | "oauth2" | "api-key";
+type AuthModeLike = "none" | "platform-managed" | "credentials" | "oauth2" | "oauth2_proxied" | "api-key";
 type ProviderAuthLike = {
     mode?: AuthModeLike;
     flow?: {

package/dist/lint.js

@@ -1,5 +1,5 @@
-import { lintPublicSchemaFieldNames } from "./public-schema-field-lint";
-import { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_SENSITIVE_META_KEY, } from "./schema";
+import { lintPublicSchemaFieldNames } from "./public-schema-field-lint.js";
+import { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_SENSITIVE_META_KEY } from "./schema.js";
 const AUTH_OPERATION_ID_PATTERN = /^(?:auth[-_])?(?:login|exchange|continue|refresh|callback)(?:[-_]|$)/i;
 function lintAllowedHosts(providerId, allowedHosts) {
     const prefix = providerId ? `Provider "${providerId}"` : "Provider";
@@ -120,8 +120,7 @@ function lintAuthModel(provider) {
         });
     }
     if (hasReusableSecretKeys(credentialKeys) &&
-        (!provider.credential?.storesReusableSecret ||
-            !provider.credential.justification)) {
+        (!provider.credential?.storesReusableSecret || !provider.credential.justification)) {
         diagnostics.push({
             rule: "credential-reusable-secret",
             level: "error",
@@ -131,8 +130,7 @@ function lintAuthModel(provider) {
     }
     if (typeof provider.auth?.flow?.refresh === "function" &&
         hasReusableReloginSecretKeys(credentialKeys) &&
-        (!provider.credential?.storesReusableSecret ||
-            !provider.credential.justification)) {
+        (!provider.credential?.storesReusableSecret || !provider.credential.justification)) {
         diagnostics.push({
             rule: "auth-refresh-reusable-secret",
             level: "error",
@@ -149,8 +147,7 @@ function lintAuthModel(provider) {
         });
     }
     const authFlowSource = getAuthFlowSource(provider);
-    if (authFlowSource.includes("ctx.context") &&
-        (provider.context?.keys?.length ?? 0) === 0) {
+    if (authFlowSource.includes("ctx.context") && (provider.context?.keys?.length ?? 0) === 0) {
         diagnostics.push({
             rule: "context-keys-required",
             level: "warn",
@@ -435,8 +432,7 @@ function isComplexSchema(schema, seen = new Set()) {
         const childChildren = getChildSchemas(child);
         return childChildren.length > 0;
     });
-    return (hasNestedComposite ||
-        children.some(({ schema: child }) => isComplexSchema(child, seen)));
+    return hasNestedComposite || children.some(({ schema: child }) => isComplexSchema(child, seen));
 }
 function hasBidirectionalFixtures(fixtures) {
     if (!fixtures || typeof fixtures !== "object") {
@@ -448,9 +444,7 @@ function getOperationSource(operation) {
     if (operation.source) {
         return operation.source;
     }
-    return typeof operation.handler === "function"
-        ? operation.handler.toString()
-        : "";
+    return typeof operation.handler === "function" ? operation.handler.toString() : "";
 }
 function lintStealthTransportUsage(provider) {
     if (provider.stealth || !provider.operations) {
@@ -621,8 +615,7 @@ export function lintOperation(op) {
             message: "Operation whenToUse must use whenToUseKeys instead of raw static prose.",
         });
     }
-    if ((op.whenNotToUse?.length ?? 0) > 0 &&
-        !(op.whenNotToUseKeys?.length ?? 0)) {
+    if ((op.whenNotToUse?.length ?? 0) > 0 && !(op.whenNotToUseKeys?.length ?? 0)) {
         diagnostics.push({
             rule: "operation-when-not-to-use-raw-prose",
             level: "error",

package/dist/native-address.d.ts

@@ -0,0 +1,43 @@
+export type EgressHostKind = "ipv4" | "ipv6" | "ipv4-mapped-ipv6" | "numeric-ambiguous" | "dns";
+export type EgressHostCanonicalizationFailure = "not-string" | "reserved-delimiter" | "control-character" | "whitespace" | "canonicalization-empty";
+export type EgressHostCanonicalizationResult = {
+    readonly ok: true;
+    readonly host: string;
+} | {
+    readonly ok: false;
+    readonly reason: EgressHostCanonicalizationFailure;
+};
+export type Ipv6CidrOverlap = "ipv4-mapped" | "ipv4-compatible";
+export type Ipv6CidrParseResult = {
+    readonly ok: true;
+    readonly network: Uint8Array;
+    readonly prefix: number;
+} | {
+    readonly ok: false;
+    readonly reason: "malformed";
+    readonly overlap?: Ipv6CidrOverlap;
+} | {
+    readonly ok: false;
+    readonly reason: "non-canonical-network";
+};
+export declare function parseStrictIpv4(value: string): number | undefined;
+/** Parse the RFC 4291 IPv6 text forms accepted at both policy and runtime boundaries. */
+export declare function parseIpv6(value: string): Uint8Array | undefined;
+export declare function parseIpv4Cidr(value: string): {
+    readonly ok: true;
+    readonly network: number;
+    readonly prefix: number;
+} | {
+    readonly ok: false;
+    readonly reason: "malformed" | "non-canonical-network";
+};
+export declare function parseIpv6Cidr(value: string): Ipv6CidrParseResult;
+export declare function ipv4InCidr(address: number, cidr: string): boolean;
+export declare function ipv6InCidr(address: Uint8Array, cidr: string): boolean;
+export declare function embeddedIpv4FromIpv6(address: Uint8Array): number | undefined;
+export declare function formatIpv6(address: Uint8Array): string;
+/** The single family and ambiguity classifier used by policy and runtime matching. */
+export declare function classifyEgressHost(host: string): EgressHostKind;
+export declare function hasReservedEgressHostDelimiter(value: string): boolean;
+export declare function hasEgressHostControlCharacter(value: string): boolean;
+export declare function canonicalizeEgressHost(value: unknown): EgressHostCanonicalizationResult;

package/dist/native-address.js

@@ -0,0 +1,281 @@
+import { domainToASCII } from "node:url";
+const STRICT_IPV4_PATTERN = /^(0|[1-9]\d{0,2})\.(0|[1-9]\d{0,2})\.(0|[1-9]\d{0,2})\.(0|[1-9]\d{0,2})$/;
+const DECIMAL_COMPONENT_PATTERN = /^\d+$/;
+const HEX_COMPONENT_PATTERN = /^0[xX][\da-fA-F]+$/;
+const IPV6_GROUP_PATTERN = /^[\da-fA-F]{1,4}$/;
+const FORMAT_CONTROL_PATTERN = /\p{Cf}/u;
+const RESERVED_EGRESS_HOST_DELIMITERS = ["/", "\\", "?", "#", "@", "[", "]", " ", "%"];
+const IPV4_MAPPED_PREFIX = Uint8Array.of(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff);
+const IPV4_COMPATIBLE_MIN = Uint8Array.of(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2);
+const IPV4_COMPATIBLE_MAX = Uint8Array.of(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff, 0xff, 0xff);
+export function parseStrictIpv4(value) {
+    const match = STRICT_IPV4_PATTERN.exec(value);
+    if (!match || match[0] !== value)
+        return undefined;
+    const [, first, second, third, fourth] = match;
+    if (first === undefined || second === undefined || third === undefined || fourth === undefined)
+        return undefined;
+    const octets = [Number(first), Number(second), Number(third), Number(fourth)];
+    if (octets.some((octet) => octet > 255))
+        return undefined;
+    const [a, b, c, d] = octets;
+    if (a === undefined || b === undefined || c === undefined || d === undefined)
+        return undefined;
+    return (a * 0x1000000 + b * 0x10000 + c * 0x100 + d) >>> 0;
+}
+function ipv4HexGroups(value) {
+    const address = parseStrictIpv4(value);
+    if (address === undefined)
+        return undefined;
+    return [((address >>> 16) & 0xffff).toString(16), (address & 0xffff).toString(16)];
+}
+/** Parse the RFC 4291 IPv6 text forms accepted at both policy and runtime boundaries. */
+export function parseIpv6(value) {
+    if (!value || value.includes("%") || value.includes("[") || value.includes("]"))
+        return undefined;
+    if (value.indexOf("::") !== value.lastIndexOf("::"))
+        return undefined;
+    let text = value;
+    if (text.includes(".")) {
+        const finalColon = text.lastIndexOf(":");
+        if (finalColon < 0)
+            return undefined;
+        const groups = ipv4HexGroups(text.slice(finalColon + 1));
+        if (!groups)
+            return undefined;
+        text = `${text.slice(0, finalColon + 1)}${groups[0]}:${groups[1]}`;
+    }
+    const compression = text.indexOf("::");
+    let groups;
+    if (compression >= 0) {
+        const leftText = text.slice(0, compression);
+        const rightText = text.slice(compression + 2);
+        const left = leftText ? leftText.split(":") : [];
+        const right = rightText ? rightText.split(":") : [];
+        if (left.some((group) => !IPV6_GROUP_PATTERN.test(group)) ||
+            right.some((group) => !IPV6_GROUP_PATTERN.test(group)) ||
+            left.length + right.length >= 8)
+            return undefined;
+        groups = [...left, ...Array(8 - left.length - right.length).fill("0"), ...right];
+    }
+    else {
+        groups = text.split(":");
+        if (groups.length !== 8 || groups.some((group) => !IPV6_GROUP_PATTERN.test(group)))
+            return undefined;
+    }
+    const bytes = new Uint8Array(16);
+    for (let index = 0; index < groups.length; index += 1) {
+        const group = groups[index];
+        if (group === undefined)
+            return undefined;
+        const parsed = Number.parseInt(group, 16);
+        bytes[index * 2] = parsed >>> 8;
+        bytes[index * 2 + 1] = parsed & 0xff;
+    }
+    return bytes;
+}
+function prefixMatches(address, network, prefix) {
+    const wholeBytes = Math.floor(prefix / 8);
+    for (let index = 0; index < wholeBytes; index += 1) {
+        if (address[index] !== network[index])
+            return false;
+    }
+    const remainingBits = prefix % 8;
+    if (remainingBits === 0)
+        return true;
+    const mask = (0xff << (8 - remainingBits)) & 0xff;
+    return ((address[wholeBytes] ?? 0) & mask) === ((network[wholeBytes] ?? 0) & mask);
+}
+function compareIpv6(left, right) {
+    for (let index = 0; index < 16; index += 1) {
+        const difference = (left[index] ?? 0) - (right[index] ?? 0);
+        if (difference !== 0)
+            return difference;
+    }
+    return 0;
+}
+function cidrMaximum(network, prefix) {
+    const maximum = network.slice();
+    for (let bit = prefix; bit < 128; bit += 1) {
+        const byteIndex = Math.floor(bit / 8);
+        maximum[byteIndex] = (maximum[byteIndex] ?? 0) | (1 << (7 - (bit % 8)));
+    }
+    return maximum;
+}
+function rangesOverlap(leftMin, leftMax, rightMin, rightMax) {
+    return compareIpv6(leftMin, rightMax) <= 0 && compareIpv6(rightMin, leftMax) <= 0;
+}
+function ipv6CidrOverlap(network, prefix) {
+    const maximum = cidrMaximum(network, prefix);
+    const mappedMin = new Uint8Array(16);
+    mappedMin.set(IPV4_MAPPED_PREFIX);
+    const mappedMax = mappedMin.slice();
+    mappedMax.fill(0xff, 12);
+    if (rangesOverlap(network, maximum, mappedMin, mappedMax))
+        return "ipv4-mapped";
+    if (rangesOverlap(network, maximum, IPV4_COMPATIBLE_MIN, IPV4_COMPATIBLE_MAX))
+        return "ipv4-compatible";
+    return undefined;
+}
+export function parseIpv4Cidr(value) {
+    const separator = value.indexOf("/");
+    if (separator <= 0 || separator !== value.lastIndexOf("/"))
+        return { ok: false, reason: "malformed" };
+    const address = parseStrictIpv4(value.slice(0, separator));
+    const prefixText = value.slice(separator + 1);
+    const prefix = Number(prefixText);
+    if (address === undefined ||
+        !Number.isInteger(prefix) ||
+        prefix < 0 ||
+        prefix > 32 ||
+        String(prefix) !== prefixText)
+        return { ok: false, reason: "malformed" };
+    const mask = prefix === 0 ? 0 : (0xffffffff << (32 - prefix)) >>> 0;
+    const network = (address & mask) >>> 0;
+    if (address !== network)
+        return { ok: false, reason: "non-canonical-network" };
+    return { ok: true, network, prefix };
+}
+export function parseIpv6Cidr(value) {
+    const separator = value.indexOf("/");
+    if (separator <= 0 || separator !== value.lastIndexOf("/"))
+        return { ok: false, reason: "malformed" };
+    const address = parseIpv6(value.slice(0, separator));
+    const prefixText = value.slice(separator + 1);
+    const prefix = Number(prefixText);
+    if (address === undefined ||
+        !Number.isInteger(prefix) ||
+        prefix < 0 ||
+        prefix > 128 ||
+        String(prefix) !== prefixText)
+        return { ok: false, reason: "malformed" };
+    const network = address.slice();
+    const wholeBytes = Math.floor(prefix / 8);
+    const remainingBits = prefix % 8;
+    if (remainingBits > 0) {
+        const mask = (0xff << (8 - remainingBits)) & 0xff;
+        network[wholeBytes] = (network[wholeBytes] ?? 0) & mask;
+    }
+    network.fill(0, wholeBytes + (remainingBits > 0 ? 1 : 0));
+    if (compareIpv6(address, network) !== 0)
+        return { ok: false, reason: "non-canonical-network" };
+    const overlap = ipv6CidrOverlap(network, prefix);
+    if (overlap)
+        return { ok: false, reason: "malformed", overlap };
+    return { ok: true, network, prefix };
+}
+export function ipv4InCidr(address, cidr) {
+    const parsed = parseIpv4Cidr(cidr);
+    if (!parsed.ok)
+        return false;
+    return (parsed.prefix === 0 ||
+        address >>> (32 - parsed.prefix) === parsed.network >>> (32 - parsed.prefix));
+}
+export function ipv6InCidr(address, cidr) {
+    if (address.length !== 16)
+        return false;
+    const parsed = parseIpv6Cidr(cidr);
+    return parsed.ok && prefixMatches(address, parsed.network, parsed.prefix);
+}
+export function embeddedIpv4FromIpv6(address) {
+    if (address.length !== 16)
+        return undefined;
+    const mapped = IPV4_MAPPED_PREFIX.every((byte, index) => address[index] === byte);
+    const compatible = address.slice(0, 12).every((byte) => byte === 0);
+    const embedded = ((address[12] ?? 0) * 0x1000000 +
+        (address[13] ?? 0) * 0x10000 +
+        (address[14] ?? 0) * 0x100 +
+        (address[15] ?? 0)) >>>
+        0;
+    if (mapped || (compatible && embedded !== 0 && embedded !== 1))
+        return embedded;
+    return undefined;
+}
+export function formatIpv6(address) {
+    if (address.length !== 16)
+        throw new TypeError("IPv6 addresses must contain exactly 16 bytes");
+    const groups = Array.from({ length: 8 }, (_, index) => (((address[index * 2] ?? 0) << 8) | (address[index * 2 + 1] ?? 0)).toString(16));
+    let bestStart = -1;
+    let bestLength = 0;
+    for (let index = 0; index < groups.length;) {
+        if (groups[index] !== "0") {
+            index += 1;
+            continue;
+        }
+        let end = index + 1;
+        while (end < groups.length && groups[end] === "0")
+            end += 1;
+        if (end - index > bestLength && end - index >= 2) {
+            bestStart = index;
+            bestLength = end - index;
+        }
+        index = end;
+    }
+    if (bestStart < 0)
+        return groups.join(":");
+    const left = groups.slice(0, bestStart).join(":");
+    const right = groups.slice(bestStart + bestLength).join(":");
+    return `${left}::${right}`;
+}
+/** The single family and ambiguity classifier used by policy and runtime matching. */
+export function classifyEgressHost(host) {
+    if (hasReservedEgressHostDelimiter(host) ||
+        hasEgressHostControlCharacter(host) ||
+        /\s/u.test(host))
+        return "numeric-ambiguous";
+    if (parseStrictIpv4(host) !== undefined)
+        return "ipv4";
+    const ipv6 = parseIpv6(host);
+    if (ipv6)
+        return embeddedIpv4FromIpv6(ipv6) === undefined ? "ipv6" : "ipv4-mapped-ipv6";
+    if (host.includes(":"))
+        return "numeric-ambiguous";
+    const labels = host.split(".");
+    if (labels.every((label) => DECIMAL_COMPONENT_PATTERN.exec(label)?.[0] === label ||
+        HEX_COMPONENT_PATTERN.exec(label)?.[0] === label))
+        return "numeric-ambiguous";
+    return "dns";
+}
+export function hasReservedEgressHostDelimiter(value) {
+    return RESERVED_EGRESS_HOST_DELIMITERS.some((delimiter) => value.includes(delimiter));
+}
+export function hasEgressHostControlCharacter(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        if (code <= 31 || code === 127)
+            return true;
+    }
+    return FORMAT_CONTROL_PATTERN.test(value);
+}
+export function canonicalizeEgressHost(value) {
+    if (typeof value !== "string")
+        return { ok: false, reason: "not-string" };
+    if (hasReservedEgressHostDelimiter(value))
+        return { ok: false, reason: "reserved-delimiter" };
+    if (hasEgressHostControlCharacter(value))
+        return { ok: false, reason: "control-character" };
+    if (/\s/u.test(value))
+        return { ok: false, reason: "whitespace" };
+    const raw = value.trim();
+    if (!raw)
+        return { ok: false, reason: "canonicalization-empty" };
+    const ipv6 = parseIpv6(raw);
+    if (ipv6)
+        return { ok: true, host: formatIpv6(ipv6) };
+    // Classify the spelling with one optional root-label dot removed before IDNA.
+    // This keeps resolver-numeric ASCII forms from being widened into canonical IPv4.
+    const numericCandidate = raw.endsWith(".") ? raw.slice(0, -1) : raw;
+    const normalizedNumericCandidate = numericCandidate.toLowerCase();
+    if (classifyEgressHost(normalizedNumericCandidate) === "numeric-ambiguous")
+        return { ok: true, host: normalizedNumericCandidate };
+    let ascii;
+    try {
+        ascii = domainToASCII(raw).toLowerCase().replace(/\.$/, "");
+    }
+    catch {
+        return { ok: false, reason: "canonicalization-empty" };
+    }
+    if (!ascii || /^\.+$/.test(ascii))
+        return { ok: false, reason: "canonicalization-empty" };
+    return { ok: true, host: ascii };
+}

package/dist/native-egress-policy.d.ts

@@ -0,0 +1,31 @@
+import type { NativeTcpPortRange, NativeTcpTlsMode } from "./types.js";
+export type StaticEgressRuleSnapshot = {
+    readonly host: string;
+    readonly ports: readonly number[];
+    readonly tls: NativeTcpTlsMode;
+};
+export type DynamicEgressRuleSnapshot = {
+    readonly sourceHost?: string;
+    readonly sourceHostSuffixes: readonly string[];
+    readonly sourceIpv4Cidrs: readonly string[];
+    readonly sourceIpv6Cidrs: readonly string[];
+    readonly sourcePorts: readonly number[];
+    readonly sourcePortRanges: readonly NativeTcpPortRange[];
+    readonly targetHostSuffixes: readonly string[];
+    readonly targetIpv4Cidrs: readonly string[];
+    readonly targetIpv6Cidrs: readonly string[];
+    readonly targetPorts: readonly number[];
+    readonly targetPortRanges: readonly NativeTcpPortRange[];
+    readonly tls: NativeTcpTlsMode;
+    readonly ttlMs?: number;
+    readonly maxGrants?: number;
+};
+export type NativeEgressPolicySnapshot = {
+    readonly staticRules: readonly StaticEgressRuleSnapshot[];
+    readonly dynamicRules: readonly DynamicEgressRuleSnapshot[];
+};
+export declare class NativeEgressPolicyValidationError extends Error {
+    constructor(message: string);
+}
+export declare function parseNativeEgressPolicy(value: unknown): NativeEgressPolicySnapshot;
+export declare function validateNativeProviderConfig(value: unknown): void;