@apifuse/provider-sdk 2.2.0-beta.21 → 2.2.0-beta.23

package/dist/types.d.ts

@@ -196,6 +196,54 @@ export interface SmsOtpMatcherDefinition {
     /** Runtime/fixture helper. Not serialized into generated registry artifacts. */
     extractOtp(body: string): string | null;
 }
+export interface ProviderOcrConfig {
+    readonly mode: "required" | "optional";
+}
+export type OcrImageInput = {
+    readonly kind: "base64";
+    readonly data: string;
+    readonly mediaType?: string;
+} | {
+    readonly kind: "url";
+    readonly url: string;
+};
+export interface OcrRecognizeRequest {
+    readonly image: OcrImageInput;
+    readonly hint?: "captcha" | "document" | "generic";
+    readonly prompt?: string;
+    readonly maxTokens?: number;
+    readonly timeoutMs?: number;
+}
+export interface OcrWarning {
+    readonly code: string;
+    readonly message: string;
+}
+export interface OcrResult {
+    readonly text: string;
+    readonly model: string;
+    readonly warnings?: readonly OcrWarning[];
+}
+export interface OcrCaptchaOptions {
+    readonly length?: number;
+    /** Allowed characters. A RegExp is applied to each character, not to the whole text. */
+    readonly charset?: string | RegExp;
+    readonly caseSensitive?: boolean;
+    readonly maxCandidates?: number;
+}
+export interface OcrCaptchaCandidate {
+    readonly text: string;
+    readonly satisfiesConstraints: boolean;
+}
+export interface OcrCaptchaResult {
+    readonly text: string;
+    readonly candidates: readonly OcrCaptchaCandidate[];
+    readonly satisfiesConstraints: boolean;
+    readonly model: string;
+}
+export interface OcrContext {
+    recognize(request: OcrRecognizeRequest): Promise<OcrResult>;
+    extractCaptchaText(image: OcrImageInput, options?: OcrCaptchaOptions): Promise<OcrCaptchaResult>;
+}
 export type SttTranscribeMode = "general" | "otp";
 export type SttPromptPolicy = "none" | "default-hint" | "custom-hint";
 export type SttUnsupportedOptionPolicy = "warn" | "error";
@@ -1543,6 +1591,7 @@ export interface FlowContext {
     env: EnvContext;
     credential?: CredentialContext;
     context: ContextScratchpad;
+    ocr: OcrContext;
     stt: SttContext;
     auth: AuthFlowTerminalContext;
 }
@@ -1634,6 +1683,7 @@ export interface ProviderContext {
     browser: BrowserClient;
     trace: TraceContext;
     auth: AuthContext;
+    ocr: OcrContext;
     stt: SttContext;
     choice: ProviderChoiceContext;
 }
@@ -1785,6 +1835,7 @@ export interface ProviderDefinition {
         platform: StealthPlatform;
     };
     proxy?: ProviderProxyConfig;
+    ocr?: ProviderOcrConfig;
     stt?: ProviderSttConfig;
     browser?: {
         engine: BrowserEngine;

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "2.2.0-beta.21",
+	"version": "2.2.0-beta.23",
 	"name": "@apifuse/provider-sdk",
 	"private": false,
 	"type": "module",

package/src/contract-types.ts

@@ -13,6 +13,7 @@ export interface ProviderContractSnapshot {
 	readonly allowedHosts?: readonly string[];
 	readonly stealth?: JsonValue;
 	readonly proxy?: JsonValue;
+	readonly ocr?: JsonValue;
 	readonly stt?: JsonValue;
 	readonly browser?: JsonValue;
 	readonly auth?: JsonValue;

package/src/contract.ts

@@ -35,6 +35,7 @@ export function extractProviderContract(provider: ProviderDefinition): ProviderC
 	const auth = extractAuth(provider.auth);
 	const stealth = toJsonValue(provider.stealth);
 	const proxy = toJsonValue(provider.proxy);
+	const ocr = toJsonValue(provider.ocr);
 	const stt = toJsonValue(provider.stt);
 	const browser = toJsonValue(provider.browser);
 	const reviewed = toJsonValue(provider.reviewed);
@@ -59,6 +60,7 @@ export function extractProviderContract(provider: ProviderDefinition): ProviderC
 		...(provider.allowedHosts ? { allowedHosts: [...provider.allowedHosts].sort() } : {}),
 		...(stealth === undefined ? {} : { stealth }),
 		...(proxy === undefined ? {} : { proxy }),
+		...(ocr === undefined ? {} : { ocr }),
 		...(stt === undefined ? {} : { stt }),
 		...(browser === undefined ? {} : { browser }),
 		...(auth === undefined ? {} : { auth }),

package/src/define.ts

@@ -27,6 +27,7 @@ import type {
 	OperationTransport,
 	OperationWebSocketTransport,
 	NativeProviderConfig,
+	ProviderOcrConfig,
 	ProviderAccessConfig,
 	ProviderDefinition,
 	ProviderDeploymentOverrides,
@@ -123,6 +124,7 @@ const VALID_PROVIDER_PROXY_AFFINITIES = [
 	"auth-flow",
 	"connection",
 ] as const;
+const VALID_PROVIDER_OCR_MODES = ["optional", "required"] as const;
 const VALID_PROVIDER_STT_MODES = ["optional", "required"] as const;
 const SMARTPROXY_APP_KEY_SECRET = "APIFUSE__PROXY__SMARTPROXY_APP_KEY";
 const NODEMAVEN_USERNAME_SECRET = "APIFUSE__PROXY__NODEMAVEN_USERNAME";
@@ -248,6 +250,7 @@ export interface ProviderConfig<TOperations extends Record<string, ProviderOpera
 		platform: StealthPlatform;
 	};
 	proxy?: ProviderProxyConfig;
+	ocr?: ProviderOcrConfig;
 	stt?: ProviderSttConfig;
 	browser?: { engine: BrowserEngine };
 	auth?: AuthConfig;
@@ -697,6 +700,18 @@ function validateProviderStt(config: { id: string; stt?: ProviderSttConfig }): v
 	assertLiteralField(stt.mode, "stt.mode", VALID_PROVIDER_STT_MODES, config.id);
 }
 
+function validateProviderOcr(config: { id: string; ocr?: ProviderOcrConfig }): void {
+	const ocr = config.ocr;
+	if (ocr === undefined) return;
+	if (!ocr || typeof ocr !== "object" || Array.isArray(ocr)) {
+		throw new ValidationError(`Provider "${config.id}" has invalid ocr: must be an object.`, {
+			fix: `Use ocr: { mode: "required" } or ocr: { mode: "optional" }.`,
+		});
+	}
+	rejectUnknownFields(ocr, new Set(["mode"]), "ocr");
+	assertLiteralField(ocr.mode, "ocr.mode", VALID_PROVIDER_OCR_MODES, config.id);
+}
+
 function validateOperationIds(
 	providerId: string,
 	operations: Record<string, ProviderOperation>,
@@ -2386,6 +2401,7 @@ export function defineProvider<
 		throw error;
 	}
 	validateProviderProxy(config);
+	validateProviderOcr(config);
 	validateProviderStt(config);
 	if (config.runtime === "browser" && !config.browser)
 		throw new ProviderError(
@@ -2410,6 +2426,7 @@ export function defineProvider<
 		native: config.native,
 		stealth: config.stealth,
 		proxy: config.proxy,
+		ocr: config.ocr,
 		stt: config.stt,
 		browser: config.browser,
 		auth: config.auth,

package/src/error-resolution.ts

@@ -1,3 +1,5 @@
+import type { ProviderErrorStatus } from "./types.js";
+
 // This set suppresses the unregistered-provider-error-code signal for codes
 // intentionally emitted by SDK paths. It is not the complete authority for
 // runtime error resolution: branded errors and additional canonical SDK codes
@@ -28,6 +30,7 @@ export const SDK_OWNED_PROVIDER_ERROR_CODES = new Set([
 	"flow_expired",
 	"turn_validation_error",
 	"context_access_error",
+	"OCR_UPSTREAM_FAILED",
 	"UNSUPPORTED_STT_OPTION",
 	"INVALID_STT_AUDIO",
 	"STT_AUDIO_TOO_LARGE",
@@ -83,9 +86,42 @@ export const SDK_OWNED_PROVIDER_ERROR_CODES = new Set([
 export const SDK_RUNTIME_OWNED_ERROR_CODES = new Set([
 	...SDK_OWNED_PROVIDER_ERROR_CODES,
 	"reauth_required",
+	"OCR_UNAVAILABLE",
+	"UNSUPPORTED_OCR_BACKEND",
 	"STT_UNAVAILABLE",
 	"UNSUPPORTED_STT_BACKEND",
 	"OUTPUT_VALIDATION_FAILED",
 	"NOT_FOUND",
 	"not_found",
 ]);
+
+// Canonical SDK status mapping for recognized provider-thrown error codes.
+// serve.ts toStatusCode consults this map (after operation-declared overrides
+// for non-SDK-owned codes), and the authoring lint treats these codes as
+// SDK-registered. Add new codes here instead of duplicating literals in
+// either consumer.
+export const SDK_STATUS_MAPPED_PROVIDER_ERROR_CODES: ReadonlyMap<string, ProviderErrorStatus> =
+	new Map<string, ProviderErrorStatus>([
+		["AUTH_REQUIRED", 401],
+		["reauth_required", 401],
+		// Unprovisioned declared secret: a deployment/config defect, never an
+		// upstream failure — explicit 400.
+		["MISSING_SECRET", 400],
+		["NOT_FOUND", 404],
+		["not_found", 404],
+		["NO_DATA", 404],
+		["RATE_LIMITED", 429],
+		["UPSTREAM_RATE_LIMIT", 429],
+		["LIMITED_NUMBER_OF_SERVICE_REQUESTS_EXCEEDS_ERROR", 429],
+		// Deterministic upstream business refusal (honest-provider-error-
+		// contract): the upstream evaluated the request and said no under its
+		// own rules — a conflict with upstream state, never a 5xx.
+		["UPSTREAM_REJECTED", 409],
+		["UPSTREAM_ERROR", 502],
+		["BLOCKED", 502],
+		["OCR_UNAVAILABLE", 503],
+		["UNSUPPORTED_OCR_BACKEND", 503],
+		["STT_UNAVAILABLE", 503],
+		["UNSUPPORTED_STT_BACKEND", 503],
+		["STATEFUL_FORWARDING_REPLAY_CACHE_FULL", 503],
+	]);

package/src/index.ts

@@ -111,6 +111,22 @@ export {
 	UnsupportedProviderStateError,
 } from "./runtime/state.js";
 export { createStealthClient } from "./runtime/stealth.js";
+export {
+	APIFUSE__OCR__API_KEY_ENV,
+	APIFUSE__OCR__BACKEND_ENV,
+	APIFUSE__OCR__BASE_URL_ENV,
+	APIFUSE__OCR__CLOUDFLARE_API_TOKEN_ENV,
+	APIFUSE__OCR__MODEL_ENV,
+	CLOUDFLARE_ACCOUNT_ID_ENV,
+	CLOUDFLARE_WORKERS_AI_OCR_BACKEND,
+	createCloudflareWorkersAiOcrClient,
+	createOcrClientFromEnv,
+	createOpenAiCompatibleOcrClient,
+	createUnsupportedOcrClient,
+	DEFAULT_CLOUDFLARE_WORKERS_AI_OCR_MODEL,
+	extractCaptchaCandidates,
+	OPENAI_COMPATIBLE_OCR_BACKEND,
+} from "./runtime/ocr.js";
 export {
 	APIFUSE__STT__BACKEND_ENV,
 	APIFUSE__STT__CLOUDFLARE_API_TOKEN_ENV,
@@ -229,6 +245,14 @@ export type {
 	NativeTcpPortRange,
 	NativeTcpTlsMode,
 	NativeTlsConnectOptions,
+	OcrCaptchaCandidate,
+	OcrCaptchaOptions,
+	OcrCaptchaResult,
+	OcrContext,
+	OcrImageInput,
+	OcrRecognizeRequest,
+	OcrResult,
+	OcrWarning,
 	OperationAnnotations,
 	OperationApprovalPolicy,
 	OperationContractMetadata,
@@ -274,6 +298,7 @@ export type {
 	ProviderLogoProfile,
 	ProviderLogoSource,
 	ProviderMeta,
+	ProviderOcrConfig,
 	ProviderProxyConfig,
 	ProviderProxyMode,
 	ProviderProxyPolicy,

package/src/lint.ts

@@ -1,5 +1,9 @@
 import type { ZodType } from "zod";
 
+import {
+	SDK_RUNTIME_OWNED_ERROR_CODES,
+	SDK_STATUS_MAPPED_PROVIDER_ERROR_CODES,
+} from "./error-resolution.js";
 import { lintPublicSchemaFieldNames } from "./public-schema-field-lint.js";
 import { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_SENSITIVE_META_KEY } from "./schema.js";
 
@@ -799,6 +803,303 @@ function lintSelfHostedBrowserPatterns(
 	return diagnostics;
 }
 
+const THROWN_ERROR_CONSTRUCTION_PATTERN = /new\s+(?:ProviderError|ValidationError)\s*\(/g;
+
+const TEST_SOURCE_FILE_PATTERN = /(?:^|\/)(?:__tests__|__mocks__)\/|\.(?:test|spec)\.[cm]?[jt]sx?$/;
+
+/**
+ * Skips a string literal starting at `startIndex` (which must point at the
+ * opening quote). Returns the index of the closing quote, or -1 when the
+ * literal is unterminated. Template literals handle nested `${...}`
+ * expressions, including strings inside them.
+ */
+function skipStringLiteral(source: string, startIndex: number): number {
+	const quote = source[startIndex];
+	for (let index = startIndex + 1; index < source.length; index++) {
+		const char = source[index];
+		if (char === "\\") {
+			index++;
+			continue;
+		}
+		if (quote === "`" && char === "$" && source[index + 1] === "{") {
+			index = skipTemplateExpression(source, index + 2);
+			if (index < 0) {
+				return -1;
+			}
+			continue;
+		}
+		if (char === quote) {
+			return index;
+		}
+		if (quote !== "`" && char === "\n") {
+			return -1;
+		}
+	}
+	return -1;
+}
+
+function skipTemplateExpression(source: string, startIndex: number): number {
+	let depth = 1;
+	for (let index = startIndex; index < source.length; index++) {
+		const char = source[index];
+		if (char === '"' || char === "'" || char === "`") {
+			index = skipStringLiteral(source, index);
+			if (index < 0) {
+				return -1;
+			}
+			continue;
+		}
+		if (char === "{") {
+			depth++;
+		} else if (char === "}") {
+			depth--;
+			if (depth === 0) {
+				return index;
+			}
+		}
+	}
+	return -1;
+}
+
+/**
+ * Extracts the argument text of a call whose opening paren has already been
+ * consumed (`startIndex` points just past it). Returns undefined when the
+ * call never closes in this source, which the caller treats as "skip
+ * silently" — this scanner is conservative by design.
+ */
+function extractBalancedCallArguments(source: string, startIndex: number): string | undefined {
+	let depth = 1;
+	for (let index = startIndex; index < source.length; index++) {
+		const char = source[index];
+		if (char === '"' || char === "'" || char === "`") {
+			index = skipStringLiteral(source, index);
+			if (index < 0) {
+				return undefined;
+			}
+			continue;
+		}
+		if (char === "/" && source[index + 1] === "/") {
+			const newline = source.indexOf("\n", index);
+			if (newline === -1) {
+				return undefined;
+			}
+			index = newline;
+			continue;
+		}
+		if (char === "/" && source[index + 1] === "*") {
+			const end = source.indexOf("*/", index + 2);
+			if (end === -1) {
+				return undefined;
+			}
+			index = end + 1;
+			continue;
+		}
+		if (char === "(") {
+			depth++;
+		} else if (char === ")") {
+			depth--;
+			if (depth === 0) {
+				return source.slice(startIndex, index);
+			}
+		}
+	}
+	return undefined;
+}
+
+/**
+ * Collects literal string values of top-level `code:` properties inside a
+ * ProviderError/ValidationError options object. Only plain `"..."` / `'...'`
+ * literals at options-object depth count; computed codes (identifiers,
+ * ternaries, template substitutions, concatenations, escapes) are skipped
+ * silently so the rule never guesses.
+ */
+function collectLiteralErrorCodeValues(args: string): string[] {
+	const codes: string[] = [];
+	let braceDepth = 0;
+	let parenDepth = 0;
+	let bracketDepth = 0;
+	let previousSignificantChar = "";
+	for (let index = 0; index < args.length; index++) {
+		const char = args[index] ?? "";
+		if (char === '"' || char === "'" || char === "`") {
+			const end = skipStringLiteral(args, index);
+			if (end < 0) {
+				return codes;
+			}
+			index = end;
+			previousSignificantChar = char;
+			continue;
+		}
+		if (char === "/" && args[index + 1] === "/") {
+			const newline = args.indexOf("\n", index);
+			if (newline === -1) {
+				return codes;
+			}
+			index = newline;
+			continue;
+		}
+		if (char === "/" && args[index + 1] === "*") {
+			const end = args.indexOf("*/", index + 2);
+			if (end === -1) {
+				return codes;
+			}
+			index = end + 1;
+			continue;
+		}
+		if (/\s/.test(char)) {
+			continue;
+		}
+		if (char === "{") {
+			braceDepth++;
+		} else if (char === "}") {
+			braceDepth--;
+		} else if (char === "(") {
+			parenDepth++;
+		} else if (char === ")") {
+			parenDepth--;
+		} else if (char === "[") {
+			bracketDepth++;
+		} else if (char === "]") {
+			bracketDepth--;
+		} else if (
+			braceDepth === 1 &&
+			parenDepth === 0 &&
+			bracketDepth === 0 &&
+			(previousSignificantChar === "{" || previousSignificantChar === ",") &&
+			args.startsWith("code", index)
+		) {
+			let cursor = index + "code".length;
+			while (cursor < args.length && /\s/.test(args[cursor] ?? "")) {
+				cursor++;
+			}
+			if (args[cursor] === ":") {
+				cursor++;
+				while (cursor < args.length && /\s/.test(args[cursor] ?? "")) {
+					cursor++;
+				}
+				const quote = args[cursor];
+				if (quote === '"' || quote === "'") {
+					const end = skipStringLiteral(args, cursor);
+					if (end > cursor) {
+						const value = args.slice(cursor + 1, end);
+						let after = end + 1;
+						while (after < args.length && /\s/.test(args[after] ?? "")) {
+							after++;
+						}
+						const nextChar = after < args.length ? (args[after] ?? "") : "";
+						if (!value.includes("\\") && (nextChar === "," || nextChar === "}" || nextChar === "")) {
+							codes.push(value);
+						}
+						index = end;
+						previousSignificantChar = quote;
+						continue;
+					}
+					return codes;
+				}
+			}
+		}
+		previousSignificantChar = char;
+	}
+	return codes;
+}
+
+function collectLiteralThrownErrorCodes(source: string): string[] {
+	const codes: string[] = [];
+	THROWN_ERROR_CONSTRUCTION_PATTERN.lastIndex = 0;
+	for (
+		let match = THROWN_ERROR_CONSTRUCTION_PATTERN.exec(source);
+		match;
+		match = THROWN_ERROR_CONSTRUCTION_PATTERN.exec(source)
+	) {
+		const argsStart = match.index + match[0].length;
+		const args = extractBalancedCallArguments(source, argsStart);
+		if (args !== undefined) {
+			codes.push(...collectLiteralErrorCodeValues(args));
+		}
+		THROWN_ERROR_CONSTRUCTION_PATTERN.lastIndex = argsStart;
+	}
+	return codes;
+}
+
+/**
+ * Static counterpart of the runtime `unregistered_provider_error_code`
+ * signal (honest-provider-error-contract Phase 3.5.5): flags
+ * `new ProviderError(...)` / `new ValidationError(...)` constructions whose
+ * literal `code` is neither SDK-registered (SDK_RUNTIME_OWNED_ERROR_CODES
+ * plus the canonical status-mapped codes shared with serve.ts toStatusCode)
+ * nor declared in any operation's docs.errorCodes. At runtime such a code
+ * serves HTTP 500 and emits the signal; this rule surfaces it at check time.
+ *
+ * A throw site cannot be attributed to a specific operation statically —
+ * providers routinely throw from helpers shared across operations — so this
+ * rule matches against the provider-level union of declared codes. That is
+ * the honest scope: it will not catch a code declared only on the "wrong"
+ * operation, and it never claims per-operation attribution it cannot prove.
+ * Only literal string codes are checked; computed/dynamic codes and test
+ * sources are skipped silently. Warning level: the long tail of existing
+ * providers converges gradually, so this must not fail `apifuse check`.
+ */
+function lintUndeclaredThrownErrorCodes(provider: {
+	authFlowSource?: string;
+	providerSourceFiles?: Record<string, string>;
+	operations?: Record<
+		string,
+		{
+			handler?: unknown;
+			source?: string;
+			docs?: { errorCodes?: ReadonlyArray<{ code: string }> };
+		}
+	>;
+}): LintDiagnostic[] {
+	const knownCodes = new Set<string>([
+		...SDK_RUNTIME_OWNED_ERROR_CODES,
+		...SDK_STATUS_MAPPED_PROVIDER_ERROR_CODES.keys(),
+	]);
+	for (const operation of Object.values(provider.operations ?? {})) {
+		for (const entry of operation.docs?.errorCodes ?? []) {
+			if (typeof entry?.code === "string") {
+				knownCodes.add(entry.code);
+			}
+		}
+	}
+
+	const sources: Array<{ field: string; source: string }> = [];
+	const sourceFiles = Object.entries(provider.providerSourceFiles ?? {}).filter(
+		([filePath]) => !TEST_SOURCE_FILE_PATTERN.test(filePath),
+	);
+	if (sourceFiles.length > 0) {
+		for (const [filePath, source] of sourceFiles) {
+			sources.push({ field: `sourceFiles.${filePath}`, source });
+		}
+	} else {
+		if (provider.authFlowSource) {
+			sources.push({ field: "auth.flow", source: provider.authFlowSource });
+		}
+		for (const [operationKey, operation] of Object.entries(provider.operations ?? {})) {
+			const source = getOperationSource(operation);
+			if (source) {
+				sources.push({ field: `operations.${operationKey}.handler`, source });
+			}
+		}
+	}
+
+	const diagnostics: LintDiagnostic[] = [];
+	for (const { field, source } of sources) {
+		const undeclaredCodes = new Set(
+			collectLiteralThrownErrorCodes(source).filter((code) => !knownCodes.has(code)),
+		);
+		for (const code of undeclaredCodes) {
+			diagnostics.push({
+				rule: "thrown-error-code-undeclared",
+				level: "warn",
+				field,
+				message: `Thrown error code "${code}" (${field}) is neither SDK-registered nor declared in any operation's docs.errorCodes; at runtime it serves HTTP 500 and emits the unregistered_provider_error_code signal. Declare it in the owning operation's docs.errorCodes with status and retryable.`,
+			});
+		}
+	}
+	return diagnostics;
+}
+
 export function lintOperation(op: {
 	description?: string;
 	descriptionKey?: string;
@@ -941,6 +1242,7 @@ export function lintProvider(
 				derivations?: Record<string, string>;
 				handler?: unknown;
 				source?: string;
+				docs?: { errorCodes?: ReadonlyArray<{ code: string }> };
 			}
 		>;
 		meta?: {
@@ -958,6 +1260,7 @@ export function lintProvider(
 		...lintCredentialWriteUsage(provider),
 		...lintPlaywrightDirectImports(provider),
 		...lintSelfHostedBrowserPatterns(provider, options),
+		...lintUndeclaredThrownErrorCodes(provider),
 	];
 
 	if (provider.operations) {

package/src/runtime/auth-flow.ts

@@ -5,9 +5,11 @@ import type {
 	EnvContext,
 	FlowContext,
 	HttpClient,
+	OcrContext,
 	StealthClient,
 	SttContext,
 } from "../types.js";
+import { createUnsupportedOcrClient } from "./ocr.js";
 import { createUnsupportedSttClient } from "./stt.js";
 
 function normalizeAllowedKeys(allowedKeys: string[]): Set<string> {
@@ -58,6 +60,7 @@ export function createFlowContext(options: {
 	externalRef?: string;
 	allowedKeys: string[];
 	initialContext?: Record<string, unknown>;
+	ocr?: OcrContext;
 	stt?: SttContext;
 }): FlowContext {
 	return {
@@ -70,6 +73,7 @@ export function createFlowContext(options: {
 		stealth: options.stealth,
 		env: options.env,
 		context: createScratchpad(options.allowedKeys, options.initialContext),
+		ocr: options.ocr ?? createUnsupportedOcrClient(),
 		stt: options.stt ?? createUnsupportedSttClient(),
 		auth: createAuthFlowHelpers(),
 	};