@apifuse/provider-sdk 2.2.0-beta.2 → 2.2.0-beta.21

package/dist/runtime/stt.d.ts

@@ -1,4 +1,4 @@
-import type { ProviderSttConfig, SttContext, SttTranscribeRequest, SttVerificationCodeOptions, VerificationCodeExtractionResult } from "../types";
+import type { ProviderSttConfig, SttContext, SttTranscribeRequest, SttVerificationCodeOptions, VerificationCodeExtractionResult } from "../types.js";
 export declare const APIFUSE__STT__BACKEND_ENV = "APIFUSE__STT__BACKEND";
 export declare const APIFUSE__STT__MODEL_ENV = "APIFUSE__STT__MODEL";
 export declare const CLOUDFLARE_ACCOUNT_ID_ENV = "APIFUSE__CLOUDFLARE__ACCOUNT_ID";

package/dist/runtime/stt.js

@@ -1,4 +1,4 @@
-import { ProviderError, TransportError, ValidationError } from "../errors";
+import { ProviderError, TransportError, ValidationError } from "../errors.js";
 export const APIFUSE__STT__BACKEND_ENV = "APIFUSE__STT__BACKEND";
 export const APIFUSE__STT__MODEL_ENV = "APIFUSE__STT__MODEL";
 export const CLOUDFLARE_ACCOUNT_ID_ENV = "APIFUSE__CLOUDFLARE__ACCOUNT_ID";
@@ -59,17 +59,12 @@ export function createSttClientFromEnv(config, env = process.env) {
     return createCloudflareWorkersAiSttClient({
         accountId,
         apiToken,
-        model: normalizedEnvValue(env, APIFUSE__STT__MODEL_ENV) ??
-            DEFAULT_CLOUDFLARE_WORKERS_AI_STT_MODEL,
+        model: normalizedEnvValue(env, APIFUSE__STT__MODEL_ENV) ?? DEFAULT_CLOUDFLARE_WORKERS_AI_STT_MODEL,
     });
 }
 function base64ByteLength(data) {
     const normalized = data.trim();
-    const padding = normalized.endsWith("==")
-        ? 2
-        : normalized.endsWith("=")
-            ? 1
-            : 0;
+    const padding = normalized.endsWith("==") ? 2 : normalized.endsWith("=") ? 1 : 0;
     return Math.floor((normalized.length * 3) / 4) - padding;
 }
 function assertBase64Audio(audio, maxAudioBytes) {
@@ -80,9 +75,7 @@ function assertBase64Audio(audio, maxAudioBytes) {
         });
     }
     const data = audio.data.trim();
-    if (data.length === 0 ||
-        data.length % 4 !== 0 ||
-        !BASE64_AUDIO_PATTERN.test(data)) {
+    if (data.length === 0 || data.length % 4 !== 0 || !BASE64_AUDIO_PATTERN.test(data)) {
         throw new ValidationError("STT audio.data must be a base64-encoded string", {
             code: "INVALID_STT_AUDIO",
         });
@@ -90,7 +83,9 @@ function assertBase64Audio(audio, maxAudioBytes) {
     const bytes = base64ByteLength(data);
     const maxBytes = maxAudioBytes ?? DEFAULT_STT_MAX_AUDIO_BYTES;
     if (bytes > maxBytes) {
-        throw new ValidationError(`STT audio exceeds maxAudioBytes (${bytes} > ${maxBytes})`, { code: "STT_AUDIO_TOO_LARGE" });
+        throw new ValidationError(`STT audio exceeds maxAudioBytes (${bytes} > ${maxBytes})`, {
+            code: "STT_AUDIO_TOO_LARGE",
+        });
     }
     return bytes;
 }
@@ -227,8 +222,7 @@ export function createCloudflareWorkersAiSttClient(options) {
     return {
         async transcribe(request) {
             const warnings = [];
-            if (request.initialPrompt &&
-                effectivePromptPolicy(request) !== "custom-hint") {
+            if (request.initialPrompt && effectivePromptPolicy(request) !== "custom-hint") {
                 const warning = warnOrThrowUnsupportedOption(request, "initialPrompt is honored only when promptPolicy is custom-hint");
                 if (warning)
                     warnings.push(warning);
@@ -350,7 +344,9 @@ function lengthSet(codeLengths) {
 }
 function validCodeLength(value) {
     if (!Number.isInteger(value) || value < 1 || value > 32) {
-        throw new ValidationError("STT verification code length must be an integer between 1 and 32", { code: "INVALID_STT_VERIFICATION_CODE_OPTIONS" });
+        throw new ValidationError("STT verification code length must be an integer between 1 and 32", {
+            code: "INVALID_STT_VERIFICATION_CODE_OPTIONS",
+        });
     }
     return value;
 }

package/dist/runtime/trace.d.ts

@@ -1,5 +1,5 @@
-import type { TraceContext as BaseTraceContext, TraceAttributeValue, TraceConfig, TraceSpan } from "../types";
-import { type OTLPExportOptions } from "./otlp";
+import type { TraceContext as BaseTraceContext, TraceAttributeValue, TraceConfig, TraceSpan } from "../types.js";
+import { type OTLPExportOptions } from "./otlp.js";
 export type SpanAttributeValue = TraceAttributeValue;
 export type Span = TraceSpan;
 export interface TraceContext extends BaseTraceContext {

package/dist/runtime/trace.js

@@ -1,5 +1,5 @@
 import { AsyncLocalStorage } from "node:async_hooks";
-import { exportSpansOTLP } from "./otlp";
+import { exportSpansOTLP } from "./otlp.js";
 export const TRACE_RECORDER = Symbol.for("@apifuse/provider-sdk/runtime/trace-recorder");
 function buildOTLPExportOptions(config) {
     if (config?.exporter !== "otlp") {
@@ -23,9 +23,7 @@ export function resolveTraceContextOptions(config) {
     };
 }
 function normalizeAttributeValue(value) {
-    if (typeof value === "string" ||
-        typeof value === "number" ||
-        typeof value === "boolean") {
+    if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
         return value;
     }
     if (value === null || value === undefined) {

package/dist/runtime/waterfall.d.ts

@@ -1,4 +1,4 @@
-import type { Span } from "./trace";
+import type { Span } from "./trace.js";
 export type WaterfallRequest = {
     method: string;
     path: string;

package/dist/schema.d.ts

@@ -1,5 +1,5 @@
 import { type ZodString, type ZodType, z } from "zod";
-import type { InferSchemaOutput, ProviderLocaleKey, SchemaLike } from "./types";
+import type { InferSchemaOutput, ProviderLocaleKey, SchemaLike } from "./types.js";
 export { z };
 export type SchemaValidationResult<TSchema extends SchemaLike> = {
     success: true;

package/dist/schema.js

@@ -1,6 +1,6 @@
 import { z } from "zod";
-import { ValidationError } from "./errors";
-import { providerLocaleKey } from "./i18n/keys";
+import { ValidationError } from "./errors.js";
+import { providerLocaleKey } from "./i18n/keys.js";
 export { z };
 function isFailureResult(result) {
     return "issues" in result;
@@ -99,21 +99,15 @@ export function field(schema, options = {}) {
     const metadata = described.meta() ?? {};
     return described.meta({
         ...metadata,
-        ...((options.sensitive ?? true)
-            ? { [APIFUSE_SENSITIVE_META_KEY]: true }
-            : {}),
-        ...(options.kind
-            ? { [APIFUSE_SENSITIVE_KIND_META_KEY]: options.kind }
-            : {}),
+        ...((options.sensitive ?? true) ? { [APIFUSE_SENSITIVE_META_KEY]: true } : {}),
+        ...(options.kind ? { [APIFUSE_SENSITIVE_KIND_META_KEY]: options.kind } : {}),
     });
 }
 export function sensitive(schema, kind) {
     return field(schema, { sensitive: true, kind });
 }
 function sensitiveString(kind, description, options = {}) {
-    const schema = options.minLength === undefined
-        ? z.string()
-        : z.string().min(options.minLength);
+    const schema = options.minLength === undefined ? z.string() : z.string().min(options.minLength);
     return field(schema, {
         kind,
         description: options.description ?? description,
@@ -132,8 +126,7 @@ export const fields = {
 };
 export function isSensitiveSchema(schema) {
     const metadata = readZodMetadata(schema);
-    return (metadata !== undefined &&
-        Reflect.get(metadata, APIFUSE_SENSITIVE_META_KEY) === true);
+    return metadata !== undefined && Reflect.get(metadata, APIFUSE_SENSITIVE_META_KEY) === true;
 }
 export function collectSensitivePaths(schema) {
     const out = [];
@@ -217,8 +210,7 @@ function pathMatches(path, patterns) {
 }
 function isReservedSensitiveKey(key) {
     const normalized = key.toLowerCase().replace(/[-_\s]/g, "");
-    return (RESERVED_SENSITIVE_KEYS.has(normalized) ||
-        RESERVED_SENSITIVE_KEYS.has(key.toLowerCase()));
+    return RESERVED_SENSITIVE_KEYS.has(normalized) || RESERVED_SENSITIVE_KEYS.has(key.toLowerCase());
 }
 function readZodMetadata(schema) {
     if (!schema || typeof schema !== "object" || !("meta" in schema)) {

package/dist/serve.d.ts

@@ -1 +1 @@
-export { createServerApp, type ServeOptions, serve } from "./server/serve";
+export { createServerApp, type ServeOptions, serve } from "./server/serve.js";

package/dist/serve.js

@@ -1 +1 @@
-export { createServerApp, serve } from "./server/serve";
+export { createServerApp, serve } from "./server/serve.js";

package/dist/server/index.d.ts

@@ -1,7 +1,7 @@
-export { createServerApp, type ServeOptions, serve } from "./serve";
-export { computeSelfTestPlanDigest, createSelfTestApp, createSelfTestInvoke, DEFAULT_SELF_TEST_REQUEST_BUDGET_MS, isSelfTestReadOnlyOperation, PROVIDER_RUNTIME_SELF_TEST_REQUEST_BUDGET_MS_ENV, resolveSelfTestPort, SELF_TEST_HEALTHZ_PATH, SELF_TEST_PATH, SELF_TEST_SCHEMA_VERSION, type SelfTestAppOptions, type SelfTestCaseResult, type SelfTestCaseStatus, type SelfTestOperationInvoke, type SelfTestRequest, SelfTestRequestSchema, type SelfTestResponse, } from "./self-test";
-export { resolveHealthCheckInputDateTokens } from "./self-test-input-tokens";
-export { collectSelfTestSensitiveValues, redactSelfTestText, SELF_TEST_MAX_TEXT_LENGTH, SELF_TEST_REDACTED_PLACEHOLDER, } from "./self-test-redaction";
-export { DEFAULT_SELF_TEST_PORT, deriveSelfTestToken, PROVIDER_RUNTIME_SELF_TEST_MASTER_SECRET_ENV, PROVIDER_RUNTIME_SELF_TEST_MASTER_SECRET_PREVIOUS_ENV, PROVIDER_RUNTIME_SELF_TEST_PORT_ENV, resolveSelfTestMasterSecrets, type SelfTestMasterSecrets, verifySelfTestAuthorization, } from "./self-test-token";
-export type { AuthFlowRequest, AuthFlowResponse, AuthFlowSuccessResponse, ConnectionMode, OperationConnection, OperationErrorResponse, OperationRequest, OperationResponse, OperationSuccessResponse, } from "./types";
-export { AuthFlowRequestSchema, AuthFlowSuccessResponseSchema, ConnectionModeSchema, ErrorEnvelopeSchema, OperationConnectionSchema, OperationErrorResponseSchema, OperationRequestSchema, OperationSuccessResponseSchema, } from "./types";
+export { createServerApp, ERROR_OBSERVABILITY_HEADER, type ErrorObservabilityDetails, type ProviderServerCloseOptions, type ProviderServerHandle, type ProviderServerLogEvent, type ProviderServerLogger, type ProviderServerOperationExecutor, type ProviderServerOperationExecutorInput, type ProviderServerOptions, type ProviderServerStatefulForwardEnvelope, type ServeOptions, serve, } from "./serve.js";
+export { computeSelfTestPlanDigest, createSelfTestApp, createSelfTestAuthFlowInvoke, createSelfTestInvoke, DEFAULT_SELF_TEST_REQUEST_BUDGET_MS, isSelfTestReadOnlyOperation, PROVIDER_RUNTIME_SELF_TEST_REQUEST_BUDGET_MS_ENV, resolveSelfTestPort, SELF_TEST_AUTH_FLOW_MULTI_TURN_SKIP_REASON, SELF_TEST_AUTH_FLOW_REJECTED_SKIP_REASON, SELF_TEST_HEALTHZ_PATH, SELF_TEST_PATH, SELF_TEST_SCHEMA_VERSION, type SelfTestAppOptions, type SelfTestAuthFlowInvoke, type SelfTestAuthFlowRoute, type SelfTestCaseResult, type SelfTestCaseStatus, type SelfTestOperationInvoke, type SelfTestRequest, SelfTestRequestSchema, type SelfTestResponse, } from "./self-test.js";
+export { type InputDateTokenCalendar, resolveHealthCheckInputDateTokens, } from "./self-test-input-tokens.js";
+export { collectSelfTestSensitiveValues, redactSelfTestText, SELF_TEST_MAX_TEXT_LENGTH, SELF_TEST_REDACTED_PLACEHOLDER, } from "./self-test-redaction.js";
+export { DEFAULT_SELF_TEST_PORT, deriveSelfTestToken, PROVIDER_RUNTIME_SELF_TEST_MASTER_SECRET_ENV, PROVIDER_RUNTIME_SELF_TEST_MASTER_SECRET_PREVIOUS_ENV, PROVIDER_RUNTIME_SELF_TEST_PORT_ENV, resolveSelfTestMasterSecrets, type SelfTestMasterSecrets, verifySelfTestAuthorization, } from "./self-test-token.js";
+export type { AuthFlowRequest, AuthFlowResponse, AuthFlowSuccessResponse, ConnectionMode, OperationConnection, OperationErrorResponse, OperationRequest, OperationResponse, OperationSuccessResponse, } from "./types.js";
+export { AuthFlowRequestSchema, AuthFlowSuccessResponseSchema, ConnectionModeSchema, ErrorEnvelopeSchema, OperationConnectionSchema, OperationErrorResponseSchema, OperationRequestSchema, OperationSuccessResponseSchema, } from "./types.js";

package/dist/server/index.js

@@ -1,6 +1,6 @@
-export { createServerApp, serve } from "./serve";
-export { computeSelfTestPlanDigest, createSelfTestApp, createSelfTestInvoke, DEFAULT_SELF_TEST_REQUEST_BUDGET_MS, isSelfTestReadOnlyOperation, PROVIDER_RUNTIME_SELF_TEST_REQUEST_BUDGET_MS_ENV, resolveSelfTestPort, SELF_TEST_HEALTHZ_PATH, SELF_TEST_PATH, SELF_TEST_SCHEMA_VERSION, SelfTestRequestSchema, } from "./self-test";
-export { resolveHealthCheckInputDateTokens } from "./self-test-input-tokens";
-export { collectSelfTestSensitiveValues, redactSelfTestText, SELF_TEST_MAX_TEXT_LENGTH, SELF_TEST_REDACTED_PLACEHOLDER, } from "./self-test-redaction";
-export { DEFAULT_SELF_TEST_PORT, deriveSelfTestToken, PROVIDER_RUNTIME_SELF_TEST_MASTER_SECRET_ENV, PROVIDER_RUNTIME_SELF_TEST_MASTER_SECRET_PREVIOUS_ENV, PROVIDER_RUNTIME_SELF_TEST_PORT_ENV, resolveSelfTestMasterSecrets, verifySelfTestAuthorization, } from "./self-test-token";
-export { AuthFlowRequestSchema, AuthFlowSuccessResponseSchema, ConnectionModeSchema, ErrorEnvelopeSchema, OperationConnectionSchema, OperationErrorResponseSchema, OperationRequestSchema, OperationSuccessResponseSchema, } from "./types";
+export { createServerApp, ERROR_OBSERVABILITY_HEADER, serve, } from "./serve.js";
+export { computeSelfTestPlanDigest, createSelfTestApp, createSelfTestAuthFlowInvoke, createSelfTestInvoke, DEFAULT_SELF_TEST_REQUEST_BUDGET_MS, isSelfTestReadOnlyOperation, PROVIDER_RUNTIME_SELF_TEST_REQUEST_BUDGET_MS_ENV, resolveSelfTestPort, SELF_TEST_AUTH_FLOW_MULTI_TURN_SKIP_REASON, SELF_TEST_AUTH_FLOW_REJECTED_SKIP_REASON, SELF_TEST_HEALTHZ_PATH, SELF_TEST_PATH, SELF_TEST_SCHEMA_VERSION, SelfTestRequestSchema, } from "./self-test.js";
+export { resolveHealthCheckInputDateTokens, } from "./self-test-input-tokens.js";
+export { collectSelfTestSensitiveValues, redactSelfTestText, SELF_TEST_MAX_TEXT_LENGTH, SELF_TEST_REDACTED_PLACEHOLDER, } from "./self-test-redaction.js";
+export { DEFAULT_SELF_TEST_PORT, deriveSelfTestToken, PROVIDER_RUNTIME_SELF_TEST_MASTER_SECRET_ENV, PROVIDER_RUNTIME_SELF_TEST_MASTER_SECRET_PREVIOUS_ENV, PROVIDER_RUNTIME_SELF_TEST_PORT_ENV, resolveSelfTestMasterSecrets, verifySelfTestAuthorization, } from "./self-test-token.js";
+export { AuthFlowRequestSchema, AuthFlowSuccessResponseSchema, ConnectionModeSchema, ErrorEnvelopeSchema, OperationConnectionSchema, OperationErrorResponseSchema, OperationRequestSchema, OperationSuccessResponseSchema, } from "./types.js";

package/dist/server/self-test-input-tokens.d.ts

@@ -1 +1,2 @@
-export declare function resolveHealthCheckInputDateTokens(value: unknown, now?: Date): unknown;
+export type InputDateTokenCalendar = "KST" | "UTC";
+export declare function resolveHealthCheckInputDateTokens(value: unknown, now?: Date, calendar?: InputDateTokenCalendar): unknown;

package/dist/server/self-test-input-tokens.js

@@ -1,20 +1,20 @@
 /**
- * Relative-KST date token resolution for health-check case inputs, ported from
- * the monorepo health-monitor (`apps/health-monitor/src/lib/health-check-input.ts`)
- * so provider self-tests resolve durable probe inputs identically.
+ * Relative date-token resolution for health-check case inputs and fixture
+ * requests. The calendar defaults to KST; callers that need UTC must opt in
+ * explicitly so UTC and KST do not silently disagree from 15:00–23:59 UTC.
  *
- * Supported token: `+<days>d` or `+<days>d:YYYYMMDD` (1..365 days ahead, KST).
+ * Supported token: `+<days>d` or `+<days>d:YYYYMMDD` (1..365 days ahead).
  */
-const RELATIVE_KST_DATE_TOKEN = /^\+(\d{1,3})d(?::(YYYYMMDD))?$/i;
-function dateFromKstDaysAhead(daysAhead, now = new Date(), format = "YYYY-MM-DD") {
-    const kstNow = new Date(now.getTime() + 9 * 60 * 60 * 1000);
-    const date = new Date(Date.UTC(kstNow.getUTCFullYear(), kstNow.getUTCMonth(), kstNow.getUTCDate() + daysAhead));
+const RELATIVE_DATE_TOKEN = /^\+(\d{1,3})d(?::(YYYYMMDD))?$/i;
+function dateFromDaysAhead(daysAhead, now = new Date(), format = "YYYY-MM-DD", calendar = "KST") {
+    const calendarNow = new Date(now.getTime() + (calendar === "KST" ? 9 * 60 * 60 * 1000 : 0));
+    const date = new Date(Date.UTC(calendarNow.getUTCFullYear(), calendarNow.getUTCMonth(), calendarNow.getUTCDate() + daysAhead));
     const isoDate = date.toISOString().slice(0, 10);
     return format === "YYYYMMDD" ? isoDate.replace(/-/g, "") : isoDate;
 }
-export function resolveHealthCheckInputDateTokens(value, now = new Date()) {
+export function resolveHealthCheckInputDateTokens(value, now = new Date(), calendar = "KST") {
     if (typeof value === "string") {
-        const relative = value.match(RELATIVE_KST_DATE_TOKEN);
+        const relative = value.match(RELATIVE_DATE_TOKEN);
         if (!relative)
             return value;
         const daysAhead = Number(relative[1]);
@@ -22,16 +22,20 @@ export function resolveHealthCheckInputDateTokens(value, now = new Date()) {
             return value;
         }
         const format = relative[2]?.toUpperCase() === "YYYYMMDD" ? "YYYYMMDD" : "YYYY-MM-DD";
-        return dateFromKstDaysAhead(daysAhead, now, format);
+        return dateFromDaysAhead(daysAhead, now, format, calendar);
     }
     if (Array.isArray(value)) {
-        return value.map((entry) => resolveHealthCheckInputDateTokens(entry, now));
+        const resolved = value.map((entry) => resolveHealthCheckInputDateTokens(entry, now, calendar));
+        return resolved.some((entry, index) => entry !== value[index]) ? resolved : value;
     }
     if (value && typeof value === "object") {
-        return Object.fromEntries(Object.entries(value).map(([key, entry]) => [
+        const resolved = Object.fromEntries(Object.entries(value).map(([key, entry]) => [
             key,
-            resolveHealthCheckInputDateTokens(entry, now),
+            resolveHealthCheckInputDateTokens(entry, now, calendar),
         ]));
+        return Object.entries(resolved).some(([key, entry]) => entry !== Reflect.get(value, key))
+            ? resolved
+            : value;
     }
     return value;
 }

package/dist/server/self-test-redaction.d.ts

@@ -1,4 +1,4 @@
-import type { ProviderDefinition } from "../types";
+import type { ProviderDefinition } from "../types.js";
 export declare const SELF_TEST_REDACTED_PLACEHOLDER = "[REDACTED]";
 /** Maximum length of any string echoed in a self-test response. */
 export declare const SELF_TEST_MAX_TEXT_LENGTH = 300;

package/dist/server/self-test-redaction.js

@@ -1,4 +1,4 @@
-import { PROVIDER_RUNTIME_SELF_TEST_MASTER_SECRET_ENV, PROVIDER_RUNTIME_SELF_TEST_MASTER_SECRET_PREVIOUS_ENV, } from "./self-test-token";
+import { PROVIDER_RUNTIME_SELF_TEST_MASTER_SECRET_ENV, PROVIDER_RUNTIME_SELF_TEST_MASTER_SECRET_PREVIOUS_ENV, } from "./self-test-token.js";
 export const SELF_TEST_REDACTED_PLACEHOLDER = "[REDACTED]";
 /** Maximum length of any string echoed in a self-test response. */
 export const SELF_TEST_MAX_TEXT_LENGTH = 300;

package/dist/server/self-test.d.ts

@@ -1,8 +1,8 @@
 import { Hono } from "hono";
 import { z } from "zod";
-import type { OperationDefinition, ProviderDefinition } from "../types";
-import { type SelfTestMasterSecrets } from "./self-test-token";
-import type { OperationConnection } from "./types";
+import type { OperationDefinition, ProviderDefinition } from "../types.js";
+import { type SelfTestMasterSecrets } from "./self-test-token.js";
+import type { OperationConnection } from "./types.js";
 export declare const SELF_TEST_SCHEMA_VERSION: 1;
 export declare const SELF_TEST_PATH = "/internal/health/self-test";
 export declare const SELF_TEST_HEALTHZ_PATH = "/healthz";
@@ -61,11 +61,53 @@ export type SelfTestOperationInvoke = (args: {
     data: unknown;
     meta?: Record<string, unknown>;
 }>;
+export type SelfTestAuthFlowRoute = "start" | "continue";
+/**
+ * In-process driver for the tenant app's /auth pipeline. Self-test uses it to
+ * materialize `requiresConnection` credentials through the provider's declared
+ * auth flow — the exact path production connections take — instead of
+ * injecting raw credential inputs as connection secrets.
+ */
+export type SelfTestAuthFlowInvoke = (args: {
+    route: SelfTestAuthFlowRoute;
+    requestId: string;
+    flowId: string;
+    /** Stable per-credential connection id — keeps login on the probe's affinity. */
+    connectionId?: string;
+    /** The probe connection's externalRef — flows reading ctx.externalRef see the same identity. */
+    externalRef?: string;
+    input?: Record<string, unknown>;
+    context?: Record<string, unknown>;
+}) => Promise<{
+    status: number;
+    body: unknown;
+}>;
+/**
+ * Skip reason reported when a declared auth flow does not complete in a single
+ * continue (OTP, retry loop). Cross-repo contract: the health-monitor maps
+ * this exact string to `self_test_incapable`; never vary it.
+ */
+export declare const SELF_TEST_AUTH_FLOW_MULTI_TURN_SKIP_REASON = "auth_flow_multi_turn";
+/**
+ * A `retry` turn after credential submission: the flow REJECTED the
+ * configured inputs (bad password, exchange failure). Distinct from the
+ * multi-turn gap so monitoring surfaces it as a real credential outage, and
+ * memoized like multi-turn so the probe does not re-submit rejected
+ * credentials every cycle (lockout safety).
+ */
+export declare const SELF_TEST_AUTH_FLOW_REJECTED_SKIP_REASON = "auth_flow_rejected";
 export interface SelfTestAppOptions {
     /** Derived-token verification secrets; without them every self-test route 404s. */
     secrets?: SelfTestMasterSecrets;
     /** In-process invoke bound to the tenant-facing app's /v1 pipeline. */
     invoke: SelfTestOperationInvoke;
+    /**
+     * In-process auth-flow driver bound to the tenant-facing app's /auth
+     * pipeline. Required for providers that declare `auth.mode: "credentials"`
+     * with a flow; without it their requiresConnection cases report a visible
+     * auth_flow_unavailable error instead of probing with raw inputs.
+     */
+    authFlow?: SelfTestAuthFlowInvoke;
     /** Overall request budget; defaults to env / 120s. */
     requestBudgetMs?: number;
     /** Env override for secret collection + budget resolution (tests). */
@@ -88,6 +130,65 @@ export declare function isSelfTestReadOnlyOperation(operation: OperationDefiniti
 export declare function createSelfTestInvoke(app: {
     request: (input: string, requestInit?: RequestInit) => Response | Promise<Response>;
 }): SelfTestOperationInvoke;
+/** Binds the self-test auth-flow driver to a tenant app's /auth pipeline in-process. */
+export declare function createSelfTestAuthFlowInvoke(app: {
+    request: (input: string, requestInit?: RequestInit) => Response | Promise<Response>;
+}): SelfTestAuthFlowInvoke;
+/**
+ * How long a memoized multi-turn flow outcome suppresses re-driving the auth
+ * flow. Generous on purpose: a multi-turn ceremony (OTP, device approval) is a
+ * provider property that changes on the timescale of releases, not probe
+ * cycles, and every re-drive is a REAL upstream login submission. The cache is
+ * in-process, so a pod restart also clears the entry.
+ */
+export declare const SELF_TEST_MULTI_TURN_RETRY_AFTER_MS: number;
+/**
+ * Age bound for POSITIVE cached credentials. Expiry modes that never produce
+ * a 401/403 (a 200 login page, an assertion failure) would otherwise replay
+ * the same stale session until pod restart — one re-login per day is the
+ * upstream-safe recovery for them.
+ */
+export declare const SELF_TEST_CREDENTIAL_MAX_AGE_MS: number;
+export type SelfTestCredentialSessionEntry = 
+/** Flow-materialized credential reused across probe cycles. */
+{
+    kind: "credential";
+    credential: Record<string, string>;
+    cachedAtMs: number;
+}
+/**
+ * Negative entry: the flow did not complete in a single continue turn
+ * (`auth_flow_multi_turn`). Memoized so subsequent cycles report the skip
+ * WITHOUT contacting the upstream again — the first attempt already
+ * submitted real credentials (and may have triggered an OTP send).
+ */
+ | {
+    kind: "multi_turn";
+    cachedAtMs: number;
+}
+/**
+ * Negative entry: the flow REJECTED the submitted credential inputs
+ * (`retry` turn after continue — bad password, exchange failure).
+ * Memoized so the probe does not re-submit rejected credentials every
+ * cycle; a new entry is attempted when the inputs rotate (new hash),
+ * the TTL lapses, or the process restarts.
+ */
+ | {
+    kind: "rejected";
+    cachedAtMs: number;
+};
+/**
+ * In-process cache of per-(providerId + stable hash of credentialInputs) auth
+ * flow outcomes, so consecutive probe cycles reuse the session — or the
+ * memoized multi-turn skip — instead of logging in every cycle (upstream
+ * account safety, DR-7). Credential entries are invalidated on a probe auth
+ * failure, at most once; multi-turn entries expire after
+ * `SELF_TEST_MULTI_TURN_RETRY_AFTER_MS` or on process restart. Flow ERRORS
+ * (transport/protocol failures, thrown start/continue) are deliberately NEVER
+ * cached: they are typically transient, and retrying a failed request next
+ * cycle is not a repeated login submission.
+ */
+export type SelfTestCredentialSessionCache = Map<string, SelfTestCredentialSessionEntry>;
 export declare function resolveSelfTestPort(env?: Readonly<Record<string, string | undefined>>): number;
 /**
  * Builds the internal self-test Hono app. This app is served on a SEPARATE