@apifuse/provider-sdk 2.2.0-beta.2 → 2.2.0-beta.21

package/dist/native-egress-policy.js

@@ -0,0 +1,288 @@
+import { canonicalizeEgressHost, classifyEgressHost, formatIpv6, parseIpv4Cidr, parseIpv6Cidr, } from "./native-address.js";
+const NATIVE_PROVIDER_FIELD_RECORD = {
+    network: true,
+};
+const NATIVE_NETWORK_FIELD_RECORD = {
+    tcp: true,
+    dynamicTcp: true,
+};
+const NATIVE_TCP_RULE_FIELD_RECORD = {
+    host: true,
+    ports: true,
+    tls: true,
+};
+const NATIVE_DYNAMIC_TCP_RULE_FIELD_RECORD = {
+    sourceHost: true,
+    sourceHostSuffixes: true,
+    sourceIpv4Cidrs: true,
+    sourceIpv6Cidrs: true,
+    sourcePorts: true,
+    sourcePortRanges: true,
+    targetHostSuffixes: true,
+    targetIpv4Cidrs: true,
+    targetIpv6Cidrs: true,
+    targetPorts: true,
+    targetPortRanges: true,
+    tls: true,
+    ttlMs: true,
+    maxGrants: true,
+};
+const NATIVE_TCP_PORT_RANGE_FIELD_RECORD = {
+    start: true,
+    end: true,
+};
+const NATIVE_PROVIDER_FIELDS = Object.keys(NATIVE_PROVIDER_FIELD_RECORD);
+const NATIVE_NETWORK_FIELDS = Object.keys(NATIVE_NETWORK_FIELD_RECORD);
+const NATIVE_TCP_RULE_FIELDS = Object.keys(NATIVE_TCP_RULE_FIELD_RECORD);
+const NATIVE_DYNAMIC_TCP_RULE_FIELDS = Object.keys(NATIVE_DYNAMIC_TCP_RULE_FIELD_RECORD);
+const NATIVE_TCP_PORT_RANGE_FIELDS = Object.keys(NATIVE_TCP_PORT_RANGE_FIELD_RECORD);
+export class NativeEgressPolicyValidationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "NativeEgressPolicyValidationError";
+    }
+}
+function fail(message) {
+    throw new NativeEgressPolicyValidationError(message);
+}
+function dataRecord(value, fieldPath, allowed) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        fail(`${fieldPath} must be an object`);
+    const prototype = Reflect.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null)
+        fail(`${fieldPath} must be a plain object`);
+    const record = {};
+    for (const key of Reflect.ownKeys(value)) {
+        if (typeof key !== "string")
+            fail(`${fieldPath} must not contain symbol fields`);
+        if (!allowed.includes(key))
+            fail(`Unknown field ${fieldPath}.${key}`);
+        const descriptor = Reflect.getOwnPropertyDescriptor(value, key);
+        if (!descriptor || !("value" in descriptor))
+            fail(`${fieldPath}.${key} must be a data field`);
+        record[key] = descriptor.value;
+    }
+    return record;
+}
+function dataArray(value, fieldPath) {
+    if (!Array.isArray(value))
+        fail(`${fieldPath} must be an array`);
+    const result = [];
+    for (const key of Reflect.ownKeys(value)) {
+        if (key === "length")
+            continue;
+        if (typeof key !== "string" || !/^(?:0|[1-9]\d*)$/.test(key))
+            fail(`${fieldPath} must not contain non-index fields`);
+        const descriptor = Reflect.getOwnPropertyDescriptor(value, key);
+        if (!descriptor || !("value" in descriptor))
+            fail(`${fieldPath}[${key}] must be a data field`);
+        result[Number(key)] = descriptor.value;
+    }
+    if (result.length !== value.length)
+        fail(`${fieldPath} must not be sparse`);
+    for (let index = 0; index < result.length; index += 1) {
+        if (!(index in result))
+            fail(`${fieldPath} must not be sparse`);
+    }
+    return result;
+}
+function host(value, fieldPath, suffix = false) {
+    if (typeof value === "string" && value.includes("*"))
+        fail(`${fieldPath} must be an exact ${suffix ? "DNS suffix" : "hostname"}, not a wildcard`);
+    const canonical = canonicalizeEgressHost(value);
+    if (!canonical.ok)
+        fail(`${fieldPath} must be a non-empty hostname`);
+    const kind = classifyEgressHost(canonical.host);
+    if (kind === "numeric-ambiguous")
+        fail(`${fieldPath} value is an unresolvable numeric-ambiguous spelling`);
+    if (suffix && kind !== "dns") {
+        const family = kind === "ipv4" ? "IPv4" : "IPv6";
+        fail(`${fieldPath} must be a DNS suffix, not an ${family} literal`);
+    }
+    return canonical.host;
+}
+function port(value, fieldPath) {
+    if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1 || value > 65_535)
+        fail(`${fieldPath} must be an integer from 1 to 65535`);
+    return value;
+}
+function ports(value, fieldPath) {
+    return dataArray(value, fieldPath).map((value, index) => port(value, `${fieldPath}[${index}]`));
+}
+function hostSuffixes(value, fieldPath) {
+    return dataArray(value, fieldPath).map((value, index) => host(value, `${fieldPath}[${index}]`, true));
+}
+function ipv4Cidrs(value, fieldPath) {
+    const seen = new Set();
+    return dataArray(value, fieldPath).map((value, index) => {
+        const cidrPath = `${fieldPath}[${index}]`;
+        if (typeof value !== "string")
+            fail(`${cidrPath} must be an IPv4 CIDR in a.b.c.d/nn form`);
+        const parsed = parseIpv4Cidr(value);
+        if (!parsed.ok) {
+            if (parsed.reason === "non-canonical-network")
+                fail(`${cidrPath} must use the canonical network address with no host bits set`);
+            fail(`${cidrPath} must be an IPv4 CIDR in a.b.c.d/nn form`);
+        }
+        const duplicateKey = `${parsed.network}/${parsed.prefix}`;
+        if (seen.has(duplicateKey))
+            fail(`${fieldPath} must not contain duplicate CIDRs`);
+        seen.add(duplicateKey);
+        return value;
+    });
+}
+function ipv6Cidrs(value, fieldPath) {
+    const seen = new Set();
+    return dataArray(value, fieldPath).map((value, index) => {
+        const cidrPath = `${fieldPath}[${index}]`;
+        if (typeof value !== "string")
+            fail(`${cidrPath} must be an IPv6 CIDR in address/nn form`);
+        const parsed = parseIpv6Cidr(value);
+        if (!parsed.ok) {
+            if (parsed.reason === "non-canonical-network")
+                fail(`${cidrPath} must use the canonical network address with no host bits set`);
+            if (parsed.overlap === "ipv4-mapped")
+                fail(`${cidrPath} overlaps IPv4-mapped ::ffff:0:0/96 address space`);
+            if (parsed.overlap === "ipv4-compatible")
+                fail(`${cidrPath} overlaps IPv4-compatible ::/96 address space`);
+            fail(`${cidrPath} must be an IPv6 CIDR in address/nn form`);
+        }
+        const duplicateKey = `${formatIpv6(parsed.network)}/${parsed.prefix}`;
+        if (seen.has(duplicateKey))
+            fail(`${fieldPath} must not contain duplicate CIDRs`);
+        seen.add(duplicateKey);
+        return value;
+    });
+}
+function ranges(value, fieldPath) {
+    return dataArray(value, fieldPath).map((value, index) => {
+        const rangePath = `${fieldPath}[${index}]`;
+        const record = dataRecord(value, rangePath, NATIVE_TCP_PORT_RANGE_FIELDS);
+        const start = port(record.start, `${rangePath}.start`);
+        const end = port(record.end, `${rangePath}.end`);
+        if (start > end)
+            fail(`${rangePath}.start must not exceed end`);
+        return { start, end };
+    });
+}
+function tls(value, fieldPath) {
+    if (value !== "required" && value !== "allowed" && value !== "disabled")
+        fail(`${fieldPath} must be required, allowed, or disabled`);
+    return value;
+}
+function positiveInteger(value, fieldPath) {
+    if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0)
+        fail(`${fieldPath} must be a positive integer`);
+    return value;
+}
+export function parseNativeEgressPolicy(value) {
+    try {
+        const policy = dataRecord(value, "native.network", NATIVE_NETWORK_FIELDS);
+        const staticRules = policy.tcp === undefined
+            ? []
+            : dataArray(policy.tcp, "native.network.tcp").map((value, index) => {
+                const fieldPath = `native.network.tcp[${index}]`;
+                const rule = dataRecord(value, fieldPath, NATIVE_TCP_RULE_FIELDS);
+                const declaredPorts = ports(rule.ports, `${fieldPath}.ports`);
+                if (declaredPorts.length === 0)
+                    fail(`${fieldPath}.ports must not be empty`);
+                return {
+                    host: host(rule.host, `${fieldPath}.host`),
+                    ports: declaredPorts,
+                    tls: tls(rule.tls, `${fieldPath}.tls`),
+                };
+            });
+        const dynamicRules = policy.dynamicTcp === undefined
+            ? []
+            : dataArray(policy.dynamicTcp, "native.network.dynamicTcp").map((value, index) => {
+                const fieldPath = `native.network.dynamicTcp[${index}]`;
+                const rule = dataRecord(value, fieldPath, NATIVE_DYNAMIC_TCP_RULE_FIELDS);
+                const sourceHost = rule.sourceHost === undefined
+                    ? undefined
+                    : host(rule.sourceHost, `${fieldPath}.sourceHost`);
+                const sourceHostSuffixes = rule.sourceHostSuffixes === undefined
+                    ? []
+                    : hostSuffixes(rule.sourceHostSuffixes, `${fieldPath}.sourceHostSuffixes`);
+                const sourceIpv4Cidrs = rule.sourceIpv4Cidrs === undefined
+                    ? []
+                    : ipv4Cidrs(rule.sourceIpv4Cidrs, `${fieldPath}.sourceIpv4Cidrs`);
+                const sourceIpv6Cidrs = rule.sourceIpv6Cidrs === undefined
+                    ? []
+                    : ipv6Cidrs(rule.sourceIpv6Cidrs, `${fieldPath}.sourceIpv6Cidrs`);
+                if (sourceHost === undefined &&
+                    sourceHostSuffixes.length === 0 &&
+                    sourceIpv4Cidrs.length === 0 &&
+                    sourceIpv6Cidrs.length === 0)
+                    fail(`${fieldPath} must declare sourceHost or a non-empty sourceHostSuffixes, sourceIpv4Cidrs, or sourceIpv6Cidrs list`);
+                const sourcePorts = rule.sourcePorts === undefined
+                    ? []
+                    : ports(rule.sourcePorts, `${fieldPath}.sourcePorts`);
+                const sourcePortRanges = rule.sourcePortRanges === undefined
+                    ? []
+                    : ranges(rule.sourcePortRanges, `${fieldPath}.sourcePortRanges`);
+                if (sourcePorts.length === 0 && sourcePortRanges.length === 0)
+                    fail(`${fieldPath} must declare a non-empty sourcePorts or sourcePortRanges list`);
+                const targetHostSuffixes = rule.targetHostSuffixes === undefined
+                    ? []
+                    : hostSuffixes(rule.targetHostSuffixes, `${fieldPath}.targetHostSuffixes`);
+                const targetIpv4Cidrs = rule.targetIpv4Cidrs === undefined
+                    ? []
+                    : ipv4Cidrs(rule.targetIpv4Cidrs, `${fieldPath}.targetIpv4Cidrs`);
+                const targetIpv6Cidrs = rule.targetIpv6Cidrs === undefined
+                    ? []
+                    : ipv6Cidrs(rule.targetIpv6Cidrs, `${fieldPath}.targetIpv6Cidrs`);
+                if (targetHostSuffixes.length === 0 &&
+                    targetIpv4Cidrs.length === 0 &&
+                    targetIpv6Cidrs.length === 0)
+                    fail(`${fieldPath} must declare a non-empty targetHostSuffixes, targetIpv4Cidrs, or targetIpv6Cidrs list`);
+                const targetPorts = rule.targetPorts === undefined
+                    ? []
+                    : ports(rule.targetPorts, `${fieldPath}.targetPorts`);
+                const targetPortRanges = rule.targetPortRanges === undefined
+                    ? []
+                    : ranges(rule.targetPortRanges, `${fieldPath}.targetPortRanges`);
+                if (targetPorts.length === 0 && targetPortRanges.length === 0)
+                    fail(`${fieldPath} must declare a non-empty targetPorts or targetPortRanges list`);
+                return {
+                    ...(sourceHost === undefined ? {} : { sourceHost }),
+                    sourceHostSuffixes,
+                    sourceIpv4Cidrs,
+                    sourceIpv6Cidrs,
+                    sourcePorts,
+                    sourcePortRanges,
+                    targetHostSuffixes,
+                    targetIpv4Cidrs,
+                    targetIpv6Cidrs,
+                    targetPorts,
+                    targetPortRanges,
+                    tls: tls(rule.tls, `${fieldPath}.tls`),
+                    ...(rule.ttlMs === undefined
+                        ? {}
+                        : { ttlMs: positiveInteger(rule.ttlMs, `${fieldPath}.ttlMs`) }),
+                    ...(rule.maxGrants === undefined
+                        ? {}
+                        : { maxGrants: positiveInteger(rule.maxGrants, `${fieldPath}.maxGrants`) }),
+                };
+            });
+        return { staticRules, dynamicRules };
+    }
+    catch (error) {
+        if (error instanceof NativeEgressPolicyValidationError)
+            throw error;
+        throw new NativeEgressPolicyValidationError("Native egress policy could not be inspected safely");
+    }
+}
+export function validateNativeProviderConfig(value) {
+    if (value === undefined)
+        return;
+    try {
+        const native = dataRecord(value, "native", NATIVE_PROVIDER_FIELDS);
+        if (native.network !== undefined)
+            parseNativeEgressPolicy(native.network);
+    }
+    catch (error) {
+        if (error instanceof NativeEgressPolicyValidationError)
+            throw error;
+        throw new NativeEgressPolicyValidationError("Native provider config could not be inspected safely");
+    }
+}

package/dist/observability.d.ts

@@ -1,5 +1,8 @@
-export declare const PROVIDER_OBSERVABILITY_TAXONOMY_VERSION = "2026-05-26";
-export declare const PROVIDER_ERROR_CATEGORIES: readonly ["ok", "timeout", "network", "upstream_http", "upstream_rate_limited", "upstream_auth", "upstream_schema_drift", "proxy_pool", "anti_bot_blocked", "credential_expired", "credential_unavailable", "input_validation", "output_validation", "provider_error", "internal_error", "unclassified"];
+export declare const PROVIDER_OBSERVABILITY_TAXONOMY_VERSION = "2026-08-07";
+export declare const PROVIDER_ERROR_CATEGORIES: readonly ["ok", "timeout", "network", "upstream_http", "upstream_rate_limited", "upstream_auth", "upstream_rejected", "upstream_schema_drift", "proxy_pool", "anti_bot_blocked", "credential_expired", "credential_unavailable", "input_validation", "output_validation", "provider_error", "internal_error", "dependency_unavailable", "unsupported_transport", "client_cancelled", "unclassified"];
 export type ProviderErrorCategory = (typeof PROVIDER_ERROR_CATEGORIES)[number];
 export declare function categoryForStatus(status: number): ProviderErrorCategory;
 export declare function isRetryableCategory(category: ProviderErrorCategory): boolean;
+export declare const PROVIDER_ERROR_SOURCES: readonly ["client", "upstream_rule", "upstream_failure", "apifuse"];
+export type ProviderErrorSource = (typeof PROVIDER_ERROR_SOURCES)[number];
+export declare function sourceForCategory(category: ProviderErrorCategory): ProviderErrorSource;

package/dist/observability.js

@@ -1,4 +1,5 @@
-export const PROVIDER_OBSERVABILITY_TAXONOMY_VERSION = "2026-05-26";
+// Mirrors packages/provider-observability in the platform monorepo (SoT).
+export const PROVIDER_OBSERVABILITY_TAXONOMY_VERSION = "2026-08-07";
 export const PROVIDER_ERROR_CATEGORIES = [
     "ok",
     "timeout",
@@ -6,6 +7,7 @@ export const PROVIDER_ERROR_CATEGORIES = [
     "upstream_http",
     "upstream_rate_limited",
     "upstream_auth",
+    "upstream_rejected",
     "upstream_schema_drift",
     "proxy_pool",
     "anti_bot_blocked",
@@ -15,6 +17,9 @@ export const PROVIDER_ERROR_CATEGORIES = [
     "output_validation",
     "provider_error",
     "internal_error",
+    "dependency_unavailable",
+    "unsupported_transport",
+    "client_cancelled",
     "unclassified",
 ];
 export function categoryForStatus(status) {
@@ -26,6 +31,10 @@ export function categoryForStatus(status) {
         return "upstream_rate_limited";
     if (status === 401 || status === 403)
         return "upstream_auth";
+    // provider-error-contract: 409/410/422 are the deterministic
+    // upstream-rejection status class — not a retryable upstream failure.
+    if (status === 409 || status === 410 || status === 422)
+        return "upstream_rejected";
     if (status >= 400)
         return "upstream_http";
     return "unclassified";
@@ -37,3 +46,41 @@ export function isRetryableCategory(category) {
         category === "upstream_http" ||
         category === "proxy_pool");
 }
+// Who stopped the request (honest-provider-error-contract). A deliberately
+// small public projection of the internal taxonomy:
+// - client: the request itself is fixable by the caller
+// - upstream_rule: the upstream service refused it under its own business
+//   rules (deterministic) or rate limits
+// - upstream_failure: the upstream service malfunctioned — retryable
+// - apifuse: an APIFuse-side fault (provider bug, platform dependency)
+export const PROVIDER_ERROR_SOURCES = [
+    "client",
+    "upstream_rule",
+    "upstream_failure",
+    "apifuse",
+];
+export function sourceForCategory(category) {
+    switch (category) {
+        case "input_validation":
+        case "credential_expired":
+        case "credential_unavailable":
+        case "client_cancelled":
+            return "client";
+        case "upstream_rejected":
+        case "upstream_rate_limited":
+            return "upstream_rule";
+        case "timeout":
+        case "network":
+        case "upstream_http":
+        case "upstream_auth":
+        case "upstream_schema_drift":
+        case "anti_bot_blocked":
+            return "upstream_failure";
+        default:
+            // ok never reaches error serialization; provider_error,
+            // internal_error, output_validation, proxy_pool,
+            // dependency_unavailable, unsupported_transport, unclassified are
+            // APIFuse-side faults.
+            return "apifuse";
+    }
+}

package/dist/provider.d.ts

@@ -1,11 +1,12 @@
-export { AuthAbortError, credentialsAuthChallenge, createAuthFlowHelpers, defineCredentialsAuth, } from "./auth";
-export type { CredentialsAuthChallengeDefinition, CredentialsAuthChallengeRequest, CredentialsAuthCompleteResult, CredentialsAuthCredential, CredentialsAuthField, CredentialsAuthFields, CredentialsAuthFieldType, CredentialsAuthInput, CredentialsAuthLoginResult, DefineCredentialsAuthOptions, DefinedCredentialsAuth, } from "./auth";
-export { createFormCeremony } from "./ceremonies";
-export { assertFreshProviderChoiceIssuedAt, createProviderChoiceToken, ProviderChoiceTokenError, type ProviderChoiceTokenErrorReason, type ProviderChoiceTokenPayload, parseProviderChoiceToken, } from "./choice-token";
-export { centered, delayed, defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, every, } from "./define";
-export { AuthError, ProviderError, SessionExpiredError, TransportError, ValidationError, } from "./errors";
-export { getProviderLocalePath, providerLocaleKey, qualifyProviderLocaleKey, } from "./i18n";
-export { type CreateProviderChoiceContextOptions, createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice";
-export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, type SensitiveFieldKind, type SensitiveFieldOptions, type SensitivePath, sensitive, z, } from "./schema";
-export type { AuthAbortData, AuthAbortRetry, AuthFlowTerminalContext, AuthMode, AuthSafeData, AuthSafeJson, FlowContext, HealthCheckAssertionContext, HealthCheckCase, HealthCheckSuite, HealthCheckUnsupported, HealthJourneyDefinition, HealthJourneyEventContext, HealthJourneyManualTriggerPolicy, HealthJourneyRunContext, HealthJourneyRunResult, HealthScheduleRandomization, HttpRetryOptions, HttpRetrySummary, InferSchemaOutput, OperationApprovalPolicy, OperationContractMetadata, OperationDefinition, OperationDocMeta, OperationErrorCode, OperationInputExample, OperationLifecycle, OperationObservabilityConfig, OperationObservabilitySensitiveConfig, OperationRelationships, OperationRiskClass, OperationSensitivePath, OperationToolRouterMetadata, OperationTransport, ProviderAccessVisibility, ProviderChoiceBindingOptions, ProviderChoiceContext, ProviderChoiceIssueOptions, ProviderChoiceParseOptions, ProviderContext, ProviderDefinition, ProviderLocale, ProviderLocaleKey, ProviderLocaleKeyInput, ProviderLogoProfile, ProviderProxyPolicy, ProviderPublicConnectionMode, ProviderPublicProfile, ProviderRuntimeState, ProviderStateDurationString, ProviderStateNamespace, ProviderSupportLevel, SchemaLike, SmsOtpMatcherDefinition, StandardSchemaV1, StateCasResult, StateNamespaceOptions, StateValue, StateWriteOptions, } from "./types";
-export { HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, } from "./types";
+export { AuthAbortError, credentialsAuthChallenge, createAuthFlowHelpers, defineCredentialsAuth, } from "./auth.js";
+export type { CredentialsAuthChallengeDefinition, CredentialsAuthChallengeRequest, CredentialsAuthCompleteResult, CredentialsAuthCredential, CredentialsAuthField, CredentialsAuthFields, CredentialsAuthFieldType, CredentialsAuthInput, CredentialsAuthLoginResult, DefineCredentialsAuthOptions, DefinedCredentialsAuth, } from "./auth.js";
+export { createFormCeremony } from "./ceremonies/index.js";
+export { assertFreshProviderChoiceIssuedAt, createProviderChoiceToken, ProviderChoiceTokenError, type ProviderChoiceTokenErrorReason, type ProviderChoiceTokenPayload, parseProviderChoiceToken, } from "./choice-token.js";
+export { centered, delayed, defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, every, } from "./define.js";
+export { AuthError, HttpRedirectError, isProviderError, isSessionExpiredError, isTransportError, ProviderError, SessionExpiredError, TransportError, ValidationError, } from "./errors.js";
+export { getProviderLocalePath, providerLocaleKey, qualifyProviderLocaleKey, } from "./i18n/index.js";
+export { type CreateProviderChoiceContextOptions, createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice.js";
+export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, type SensitiveFieldKind, type SensitiveFieldOptions, type SensitivePath, sensitive, z, } from "./schema.js";
+export type { AuthAbortData, AuthAbortRetry, AuthFlowTerminalContext, AuthMode, AuthSafeData, AuthSafeJson, FlowContext, HealthCheckAssertionContext, HealthCheckCase, HealthCheckSuite, HealthCheckUnsupported, HealthJourneyDefinition, HealthJourneyEventContext, HealthJourneyManualTriggerPolicy, HealthJourneyRunContext, HealthJourneyRunResult, HealthScheduleRandomization, HttpRedirectFailureReason, HttpRedirectPolicy, HttpRedirectPolicyMode, HttpRetryOptions, HttpRetrySummary, InferSchemaOutput, NativeContext, NativeNetworkClient, NativeNetworkCloseReason, NativeNetworkConnection, NativeNetworkConnectInput, NativeNetworkConnectOptions, NativeNetworkDynamicGrantOptions, NativeNetworkEgressGrant, NativeProviderConfig, NativeProviderContext, NativeProxyDrainHandler, NativeProxyEgressInfo, NativeProxyExpiringEvent, NativeProxyExpiringReason, NativeTcpDynamicEgressRule, NativeTcpEgressGrant, NativeTcpEgressRule, NativeTcpPortRange, NativeTcpTlsMode, NativeTlsConnectOptions, OperationApprovalPolicy, OperationContractMetadata, OperationDefinition, OperationDocMeta, OperationErrorCode, ProviderErrorStatus, OperationInputExample, OperationLifecycle, OperationObservabilityConfig, OperationObservabilitySensitiveConfig, OperationRelationships, OperationRiskClass, OperationSensitivePath, OperationToolRouterMetadata, OperationTransport, ProviderAccessVisibility, ProviderChoiceBindingOptions, ProviderChoiceContext, ProviderChoiceIssueOptions, ProviderChoiceParseOptions, ProviderContext, ProviderDefinition, ProviderDeploymentOverrides, ProviderFileRef, ProviderFilesContext, ProviderLocale, ProviderLocaleKey, ProviderLocaleKeyInput, ProviderLogoProfile, ProviderProxyPolicy, ProxiedOAuthConfig, ProviderPublicConnectionMode, ProviderPublicProfile, ProviderResolvedFile, ProviderRuntimeState, ProviderStateDurationString, ProviderStateNamespace, ProviderSupportLevel, RedirectRunReason, SchemaLike, SmsOtpMatcherDefinition, StandardSchemaV1, StateCasResult, StateNamespaceOptions, StateValue, StateWriteOptions, } from "./types.js";
+export { createNativeNetworkClient, createEnvVendorCredentialResolver, deriveNativeCredentialAffinityKey, NativeEgressGrantExpiredError, NativeEgressNotDeclaredError, NativeIdleTimeoutError, NativeNetworkError, NativeProxyExpiredError, resolveNativeGatewayProxy, type NativeGatewayProxy, type NativeGatewayProxyResolutionInput, type NativeGatewayProxySkipReason, type NativeGatewayProxySynthesizer, type NativeGatewayProxySynthesisResult, type NativeGatewayProxySynthesisInput, type NativeNetworkClientOptions, type NativeNetworkErrorCode, type VendorCredentialLookup, type VendorCredentialResolver, } from "./runtime/native-network.js";
+export { HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, } from "./types.js";

package/dist/provider.js

@@ -1,9 +1,10 @@
-export { AuthAbortError, credentialsAuthChallenge, createAuthFlowHelpers, defineCredentialsAuth, } from "./auth";
-export { createFormCeremony } from "./ceremonies";
-export { assertFreshProviderChoiceIssuedAt, createProviderChoiceToken, ProviderChoiceTokenError, parseProviderChoiceToken, } from "./choice-token";
-export { centered, delayed, defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, every, } from "./define";
-export { AuthError, ProviderError, SessionExpiredError, TransportError, ValidationError, } from "./errors";
-export { getProviderLocalePath, providerLocaleKey, qualifyProviderLocaleKey, } from "./i18n";
-export { createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice";
-export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, sensitive, z, } from "./schema";
-export { HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, } from "./types";
+export { AuthAbortError, credentialsAuthChallenge, createAuthFlowHelpers, defineCredentialsAuth, } from "./auth.js";
+export { createFormCeremony } from "./ceremonies/index.js";
+export { assertFreshProviderChoiceIssuedAt, createProviderChoiceToken, ProviderChoiceTokenError, parseProviderChoiceToken, } from "./choice-token.js";
+export { centered, delayed, defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, every, } from "./define.js";
+export { AuthError, HttpRedirectError, isProviderError, isSessionExpiredError, isTransportError, ProviderError, SessionExpiredError, TransportError, ValidationError, } from "./errors.js";
+export { getProviderLocalePath, providerLocaleKey, qualifyProviderLocaleKey, } from "./i18n/index.js";
+export { createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice.js";
+export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, sensitive, z, } from "./schema.js";
+export { createNativeNetworkClient, createEnvVendorCredentialResolver, deriveNativeCredentialAffinityKey, NativeEgressGrantExpiredError, NativeEgressNotDeclaredError, NativeIdleTimeoutError, NativeNetworkError, NativeProxyExpiredError, resolveNativeGatewayProxy, } from "./runtime/native-network.js";
+export { HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, } from "./types.js";

package/dist/public-schema-field-lint.d.ts

@@ -1,2 +1,2 @@
-import type { LintDiagnostic } from "./lint";
+import type { LintDiagnostic } from "./lint.js";
 export declare function lintPublicSchemaFieldNames(providerId: string | undefined, operationId: string, input: unknown, output: unknown, enforce: boolean): LintDiagnostic[];

package/dist/recipes/gov-api.js

@@ -1,4 +1,4 @@
-import { unwrapEnvelope } from "../utils/parse";
+import { unwrapEnvelope } from "../utils/parse.js";
 function getResultCode(raw) {
     if (!raw || typeof raw !== "object") {
         return undefined;

package/dist/runtime/auth-flow.d.ts

@@ -1,6 +1,7 @@
-import type { ContextScratchpad, EnvContext, FlowContext, HttpClient, StealthClient, SttContext } from "../types";
+import type { ContextScratchpad, EnvContext, FlowContext, HttpClient, StealthClient, SttContext } from "../types.js";
 export declare function createScratchpad(allowedKeys: string[], initial?: Record<string, unknown>): ContextScratchpad;
 export declare function createFlowContext(options: {
+    flowId?: string;
     http: HttpClient;
     stealth: StealthClient;
     env: EnvContext;

package/dist/runtime/auth-flow.js

@@ -1,6 +1,6 @@
-import { ContextAccessError } from "../errors";
-import { createAuthFlowHelpers } from "../auth";
-import { createUnsupportedSttClient } from "./stt";
+import { ContextAccessError } from "../errors.js";
+import { createAuthFlowHelpers } from "../auth.js";
+import { createUnsupportedSttClient } from "./stt.js";
 function normalizeAllowedKeys(allowedKeys) {
     return new Set(allowedKeys.filter((key) => key.trim().length > 0));
 }
@@ -32,6 +32,7 @@ export function createScratchpad(allowedKeys, initial = {}) {
 }
 export function createFlowContext(options) {
     return {
+        flowId: options.flowId,
         connectionId: options.connectionId,
         externalRef: options.externalRef,
         tenantId: options.tenantId,

package/dist/runtime/browser.d.ts

@@ -1,4 +1,4 @@
-import type { BrowserChallengeRequest, BrowserChallengeResult, BrowserClient as BrowserClientContract, BrowserEngine, BrowserOptions, BrowserPage } from "../types";
+import type { BrowserChallengeRequest, BrowserChallengeResult, BrowserClient as BrowserClientContract, BrowserEngine, BrowserOptions, BrowserPage } from "../types.js";
 type BrowserPageContract = BrowserPage;
 export type BrowserClientOptions = BrowserOptions & {
     allowedHosts?: string[];

package/dist/runtime/browser.js

@@ -1,5 +1,5 @@
 import { createRequire } from "node:module";
-import { ProviderError } from "../errors";
+import { ProviderError } from "../errors.js";
 const require = createRequire(import.meta.url);
 const DEFAULT_WAIT_TIMEOUT_MS = 30_000;
 const SELECTOR_POLL_INTERVAL_MS = 100;
@@ -83,13 +83,14 @@ function matchesResourceRoute(match, request) {
 function toCdpFulfillParams(requestId, decision) {
     const body = toResourceBody(decision.body);
     return {
-        ...(body === undefined
-            ? {}
-            : { body: Buffer.from(body).toString("base64") }),
+        ...(body === undefined ? {} : { body: Buffer.from(body).toString("base64") }),
         ...(decision.headers === undefined
             ? {}
             : {
-                responseHeaders: Object.entries(decision.headers).map(([name, value]) => ({ name, value })),
+                responseHeaders: Object.entries(decision.headers).map(([name, value]) => ({
+                    name,
+                    value,
+                })),
             }),
         requestId,
         responseCode: decision.status ?? 200,
@@ -574,16 +575,13 @@ function parsePoolAcquireResponse(value) {
             code: "BROWSER_RUNTIME_UNSUPPORTED",
         });
     }
-    if (value.browserContextId !== undefined &&
-        typeof value.browserContextId !== "string") {
+    if (value.browserContextId !== undefined && typeof value.browserContextId !== "string") {
         throw new ProviderError("CDP Pool returned an invalid acquire response", {
             code: "BROWSER_RUNTIME_UNSUPPORTED",
         });
     }
     return {
-        ...(value.browserContextId
-            ? { browserContextId: value.browserContextId }
-            : {}),
+        ...(value.browserContextId ? { browserContextId: value.browserContextId } : {}),
         pageId: value.pageId,
         wsEndpoint: value.wsEndpoint,
     };
@@ -605,9 +603,7 @@ function parseCdpFrameTreeNode(value) {
         frame: {
             id: frameId,
             name: typeof value.frame.name === "string" ? value.frame.name : undefined,
-            parentId: typeof value.frame.parentId === "string"
-                ? value.frame.parentId
-                : undefined,
+            parentId: typeof value.frame.parentId === "string" ? value.frame.parentId : undefined,
             url: typeof value.frame.url === "string" ? value.frame.url : undefined,
         },
         ...(childFrames ? { childFrames } : {}),
@@ -620,9 +616,7 @@ function getCdpExecutionContext(params) {
     const contextId = params.context.id;
     const auxData = params.context.auxData;
     return {
-        frameId: isRecord(auxData) && typeof auxData.frameId === "string"
-            ? auxData.frameId
-            : undefined,
+        frameId: isRecord(auxData) && typeof auxData.frameId === "string" ? auxData.frameId : undefined,
         id: typeof contextId === "number" ? contextId : undefined,
     };
 }
@@ -773,8 +767,7 @@ class CdpPoolBrowserPage {
             returnByValue: true,
         });
         if (result.exceptionDetails) {
-            throw new Error(String(result.exceptionDetails.text ??
-                "Browser evaluation failed"));
+            throw new Error(String(result.exceptionDetails.text ?? "Browser evaluation failed"));
         }
         return result.result?.value;
     }
@@ -859,9 +852,7 @@ class CdpPoolBrowserPage {
         this.closed = true;
         try {
             await this.release({
-                ...(this.browserContextId
-                    ? { browserContextId: this.browserContextId }
-                    : {}),
+                ...(this.browserContextId ? { browserContextId: this.browserContextId } : {}),
                 pageId: this.pageId,
             });
         }
@@ -1002,12 +993,8 @@ class CdpPoolBrowserClient {
     }
     async acquirePage(options) {
         const acquireResult = parsePoolAcquireResponse(await this.poolClient.send("acquire", {
-            ...(this.allowedHosts.length > 0
-                ? { allowedHosts: this.allowedHosts }
-                : {}),
-            ...(options?.isolatedContext
-                ? { isolationMode: "browserContext" }
-                : {}),
+            ...(this.allowedHosts.length > 0 ? { allowedHosts: this.allowedHosts } : {}),
+            ...(options?.isolatedContext ? { isolationMode: "browserContext" } : {}),
         }));
         const pageClient = new JsonRpcWebSocketClient(acquireResult.wsEndpoint);
         const page = new CdpPoolBrowserPage(acquireResult.pageId, acquireResult.browserContextId, pageClient, async (request) => {
@@ -1223,8 +1210,7 @@ async function solveRecaptchaChallenge(page, request) {
 async function findRecaptchaFrame(frames, siteKey) {
     for (const frame of frames) {
         const url = await frame.url();
-        const matchesRecaptcha = url.includes("google.com/recaptcha") ||
-            url.includes("recaptcha.net/recaptcha");
+        const matchesRecaptcha = url.includes("google.com/recaptcha") || url.includes("recaptcha.net/recaptcha");
         const matchesSiteKey = !siteKey || url.includes(siteKey);
         if (matchesRecaptcha && matchesSiteKey) {
             return frame;

package/dist/runtime/cache.d.ts

@@ -1,4 +1,4 @@
-import type { ProviderCache } from "../types";
+import type { ProviderCache } from "../types.js";
 export type ProviderCacheOptions = {
     providerId: string;
     redisUrl?: string;

package/dist/runtime/cache.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
-import { providerCacheRedisUrlFromEnv } from "../config/loader";
-import { createProviderRedisClient, ensureRedisReady, withRedisTimeout, } from "./redis";
+import { providerCacheRedisUrlFromEnv } from "../config/loader.js";
+import { createProviderRedisClient, ensureRedisReady, withRedisTimeout, } from "./redis.js";
 const DEFAULT_PREFIX = "apifuse:provider-cache:v1";
 const DEFAULT_MEMORY_MAX_ENTRIES = 1_000;
 const DEFAULT_REDIS_TIMEOUT_MS = 150;
@@ -71,10 +71,7 @@ function normalizeKeyPart(value, extra) {
     return value;
 }
 function stableHash(value) {
-    return createHash("sha256")
-        .update(JSON.stringify(value))
-        .digest("hex")
-        .slice(0, 32);
+    return createHash("sha256").update(JSON.stringify(value)).digest("hex").slice(0, 32);
 }
 function jitteredTtlMs(ttlMs, jitterPct) {
     if (!jitterPct || jitterPct <= 0)
@@ -282,8 +279,7 @@ export function createProviderCache(options) {
         async delete(key) {
             backend.memory.delete(key);
             const redis = backend.redis;
-            if (!redis ||
-                !(await ensureRedisReady(redis, DEFAULT_REDIS_TIMEOUT_MS))) {
+            if (!redis || !(await ensureRedisReady(redis, DEFAULT_REDIS_TIMEOUT_MS))) {
                 return;
             }
             await withRedisFallback(() => redis.del(key));

package/dist/runtime/choice.d.ts

@@ -1,4 +1,4 @@
-import type { CredentialContext, EnvContext, ProviderChoiceContext, ProviderRequestContext, ProviderRuntimeState } from "../types";
+import type { CredentialContext, EnvContext, ProviderChoiceContext, ProviderRequestContext, ProviderRuntimeState } from "../types.js";
 export declare const PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV = "APIFUSE__PROVIDER_RUNTIME__CHOICE_TOKEN_MASTER_SECRET";
 export type CreateProviderChoiceContextOptions = {
     readonly providerId: string;