@apifuse/provider-sdk 2.2.0-beta.22 → 2.2.0-beta.24

package/dist/config/loader.js

@@ -221,64 +221,7 @@ function serializeSmartproxyPool(pool) {
 }
 function normalizeProxyUrl(url) {
     const normalized = url?.trim();
-    return normalized ? applyStickyProxySession(normalized) : undefined;
-}
-function readPositiveIntegerEnv(name) {
-    const raw = process.env[name]?.trim();
-    if (!raw)
-        return undefined;
-    if (!/^[1-9]\d*$/.test(raw)) {
-        throw new Error(`${name} must be a positive integer`);
-    }
-    return raw;
-}
-function applyStickyProxySession(proxyUrl) {
-    let parsed;
-    try {
-        parsed = new URL(proxyUrl);
-    }
-    catch {
-        return proxyUrl;
-    }
-    if (!parsed.hostname || !parsed.username || !parsed.password) {
-        return proxyUrl;
-    }
-    // This rewrites sticky-session usernames for a bring-your-own *gateway* URL
-    // (APIFUSE__PROXY__URL). The `smartproxy` host here means a smartproxy.com /
-    // Decodo-family gateway that authenticates by username — NOT the
-    // api.smartproxy.org allocation vendor, whose endpoints are raw ip:port with
-    // no credentials and therefore return early above.
-    const host = parsed.hostname.toLowerCase();
-    if (!host.includes("smartproxy") && !host.includes("decodo")) {
-        return proxyUrl;
-    }
-    const username = decodeURIComponent(parsed.username);
-    const sessionId = process.env.APIFUSE__PROXY__SESSION_ID?.trim() || "apifuse-shared";
-    const sessionDuration = readPositiveIntegerEnv("APIFUSE__PROXY__SESSION_DURATION");
-    const stickyUsername = host.includes("smartproxy")
-        ? buildSmartproxyUsername(username, sessionId, sessionDuration)
-        : buildDecodoUsername(username, sessionId, sessionDuration ?? "60");
-    parsed.username = stickyUsername;
-    return parsed.toString();
-}
-function buildSmartproxyUsername(username, sessionId, sessionDuration) {
-    const parts = username.split("_");
-    const configuredLife = parts.find((part) => part.startsWith("life-"))?.slice("life-".length);
-    const baseUsername = parts
-        .filter((part) => !part.startsWith("session-") && !part.startsWith("life-"))
-        .join("_");
-    return `${baseUsername}_session-${sessionId}_life-${sessionDuration ?? configuredLife ?? "60"}`;
-}
-function buildDecodoUsername(username, sessionId, sessionDuration) {
-    const withoutSticky = username.replace(/-session-.+-sessionduration-\d+$/, "");
-    const baseUsername = withoutSticky.startsWith("user-") ? withoutSticky : `user-${withoutSticky}`;
-    return `${baseUsername}-session-${sessionId}-sessionduration-${sessionDuration}`;
-}
-function syncProxyEnv(config) {
-    const configProxyUrl = normalizeProxyUrl(config.proxy?.url);
-    if (!process.env.APIFUSE__PROXY__URL && configProxyUrl) {
-        process.env.APIFUSE__PROXY__URL = configProxyUrl;
-    }
+    return normalized || undefined;
 }
 export function resolveProxyConfig(options = {}) {
     const explicitProxyUrl = normalizeProxyUrl(options.proxy);
@@ -293,14 +236,6 @@ export function resolveProxyConfig(options = {}) {
     if (!legacyProxyRequested) {
         return { shouldWarn: false };
     }
-    const envProxyUrl = normalizeProxyUrl(process.env.APIFUSE__PROXY__URL);
-    if (envProxyUrl) {
-        return { shouldWarn: false, url: envProxyUrl };
-    }
-    const configuredProxyUrl = normalizeProxyUrl(options.apifuseConfig?.proxy?.url);
-    if (configuredProxyUrl) {
-        return { shouldWarn: false, url: configuredProxyUrl };
-    }
     return { shouldWarn: true };
 }
 export async function resolveProxyConfigAsync(options = {}) {
@@ -317,7 +252,17 @@ export async function resolveProxyConfigAsync(options = {}) {
     }
     const chain = resolveVendorChain(policy);
     if (chain.length === 0) {
-        // decodo/custom/env-static providers keep the legacy static-URL path.
+        const declared = declaredVendorChain(policy);
+        const deprecated = declared.filter((vendor) => vendor === "decodo" || vendor === "custom");
+        if (policy.mode === "required") {
+            const providerIds = declared.length > 0 ? declared.map((vendor) => `"${vendor}"`).join(", ") : "none";
+            const deprecatedDetail = deprecated.length > 0
+                ? ` Deprecated vendor(s): ${deprecated.map((vendor) => `"${vendor}"`).join(", ")}.`
+                : "";
+            throw new ProxyResolutionError("PROXY_REQUIRED", `Required proxy policy has no SDK-managed adapter for provider id(s): ${providerIds}.${deprecatedDetail} Use "smartproxy" or "nodemaven".`);
+        }
+        // Deprecated decodo/custom providers have no SDK-managed adapter. Optional
+        // policies preserve the warning-only behavior and may continue directly.
         return resolveProxyConfig({
             ...options,
             upstream: { proxy: true },
@@ -524,18 +469,21 @@ function resolvePolicy(options) {
 function isRegistryVendor(name) {
     return name === "smartproxy" || name === "nodemaven";
 }
+function declaredVendorChain(policy) {
+    const declared = policy.providers?.length
+        ? policy.providers
+        : [policy.provider ?? envDefaultProvider()];
+    return declared.filter((vendor) => vendor !== undefined);
+}
 /**
  * Ordered list of SDK-native proxy vendors declared by the policy. `providers`
  * takes precedence over the legacy singular `provider`; the platform default
  * env is the final fallback. Non-registry names (decodo/custom) are dropped so
- * an all-static chain falls through to the legacy env-URL path unchanged.
+ * an all-deprecated chain has no managed adapter.
  */
 export function resolveVendorChain(policy) {
-    const declared = policy.providers?.length
-        ? policy.providers
-        : [policy.provider ?? envDefaultProvider()];
     const chain = [];
-    for (const name of declared) {
+    for (const name of declaredVendorChain(policy)) {
         if (isRegistryVendor(name) && !chain.includes(name)) {
             chain.push(name);
         }
@@ -600,9 +548,8 @@ const UNSAFE_TRANSPORT_RETRY_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"
  *  - the method is safe/idempotent — an unsafe request must never be duplicated
  *    across the pool even if some framework default would allow it;
  *  - the policy resolves a non-empty *registry* vendor chain (smartproxy /
- *    nodemaven). Static vendors (custom / decodo) and credential-less policies
- *    resolve no allocator pool, so every attempt would hit the same endpoint
- *    with no possible crossover — they keep the retry budget.
+ *    nodemaven). Deprecated vendors (custom / decodo) resolve no managed pool,
+ *    so there is no possible endpoint crossover — they keep the retry budget.
  *
  * The widened cap is bounded by the chain's true maximum span (sum of each
  * vendor's max pool size), so a large NodeMaven pool (≤50) stays reachable and
@@ -621,8 +568,8 @@ const UNSAFE_TRANSPORT_RETRY_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"
  *    endpoint each attempt resolves (even a repeated one), so no de-duplication;
  *  - the method is safe/idempotent — an unsafe request is never duplicated;
  *  - the policy resolves a non-empty registry vendor chain (smartproxy /
- *    nodemaven). Static vendors (custom / decodo) resolve the same URL every
- *    attempt, so there is nothing to rotate or de-duplicate.
+ *    nodemaven). Deprecated vendors (custom / decodo) resolve no managed
+ *    endpoint, so there is nothing to rotate or de-duplicate.
  */
 export function policyRotatesTransportVendorChain(input) {
     if (!input.usesPolicyAllocator || !input.policy || input.explicitRetry) {
@@ -650,9 +597,8 @@ export function resolvePolicyTransportAttemptCap(input) {
  * A registry vendor chain (smartproxy/nodemaven) resolves a potentially
  * *different* endpoint per flat attempt index, so a transport retry should
  * advance across endpoints and de-duplicate once the chain stops yielding new
- * ones. Static/custom/decodo policies (empty registry chain) resolve the *same*
- * URL every attempt by design — retrying that same endpoint is intended, so the
- * transport loop must not de-duplicate them.
+ * ones. Deprecated custom/decodo policies have an empty registry chain and no
+ * managed endpoint, so the transport loop has nothing to rotate or de-duplicate.
  */
 export function policyResolvesRegistryVendorChain(policy) {
     return Boolean(policy) && resolveVendorChain(policy).length > 0;
@@ -1249,16 +1195,12 @@ export async function loadApiFuseConfig(dir = process.cwd()) {
     const tsPath = path.resolve(dir, "apifuse.config.ts");
     if (existsSync(tsPath)) {
         const config = await importConfig(tsPath);
-        const resolvedConfig = config ?? {};
-        syncProxyEnv(resolvedConfig);
-        return resolvedConfig;
+        return config ?? {};
     }
     const jsPath = path.resolve(dir, "apifuse.config.js");
     if (existsSync(jsPath)) {
         const config = await importConfig(jsPath);
-        const resolvedConfig = config ?? {};
-        syncProxyEnv(resolvedConfig);
-        return resolvedConfig;
+        return config ?? {};
     }
     return {};
 }

package/dist/contract-types.d.ts

@@ -11,6 +11,7 @@ export interface ProviderContractSnapshot {
     readonly allowedHosts?: readonly string[];
     readonly stealth?: JsonValue;
     readonly proxy?: JsonValue;
+    readonly ocr?: JsonValue;
     readonly stt?: JsonValue;
     readonly browser?: JsonValue;
     readonly auth?: JsonValue;

package/dist/contract.js

@@ -7,6 +7,7 @@ export function extractProviderContract(provider) {
     const auth = extractAuth(provider.auth);
     const stealth = toJsonValue(provider.stealth);
     const proxy = toJsonValue(provider.proxy);
+    const ocr = toJsonValue(provider.ocr);
     const stt = toJsonValue(provider.stt);
     const browser = toJsonValue(provider.browser);
     const reviewed = toJsonValue(provider.reviewed);
@@ -30,6 +31,7 @@ export function extractProviderContract(provider) {
         ...(provider.allowedHosts ? { allowedHosts: [...provider.allowedHosts].sort() } : {}),
         ...(stealth === undefined ? {} : { stealth }),
         ...(proxy === undefined ? {} : { proxy }),
+        ...(ocr === undefined ? {} : { ocr }),
         ...(stt === undefined ? {} : { stt }),
         ...(browser === undefined ? {} : { browser }),
         ...(auth === undefined ? {} : { auth }),

package/dist/define.d.ts

@@ -1,4 +1,4 @@
-import type { AuthConfig, BrowserEngine, ContextDeclaration, CredentialDeclaration, HealthJourneyDefinition, HealthJourneySchedule, HealthScheduleRandomization, InferSchemaOutput, OperationDefinition, OperationHandlerResult, OperationHttpStreamTransport, OperationSseTransport, OperationWebSocketTransport, NativeProviderConfig, ProviderAccessConfig, ProviderDefinition, ProviderDeploymentOverrides, ProviderHealthMonitorConfig, ProviderProxyConfig, ProviderPublicProfile, ProviderReviewed, ProviderSecretDeclaration, ProviderStreamEvent, ProviderSttConfig, SchemaLike, SmsOtpMatcherDefinition, StealthPlatform } from "./types.js";
+import type { AuthConfig, BrowserEngine, ContextDeclaration, CredentialDeclaration, HealthJourneyDefinition, HealthJourneySchedule, HealthScheduleRandomization, InferSchemaOutput, NativeProviderConfig, OperationDefinition, OperationHandlerResult, OperationHttpStreamTransport, OperationSseTransport, OperationWebSocketTransport, ProviderAccessConfig, ProviderDefinition, ProviderOcrConfig, ProviderDeploymentOverrides, ProviderHealthMonitorConfig, ProviderProxyConfig, ProviderPublicProfile, ProviderResolverConfig, ProviderReviewed, ProviderSecretDeclaration, ProviderStreamEvent, ProviderSttConfig, SchemaLike, SmsOtpMatcherDefinition, StealthPlatform } from "./types.js";
 type ProviderImplementationSourceAccess = "official_api" | "private_api" | "browser_flow" | "hybrid";
 type ProviderImplementationCredentialStrategy = "apifuse_managed" | "workspace_secret" | "user_oauth" | "user_session" | "none";
 interface ProviderImplementationProfile {
@@ -8,6 +8,8 @@ interface ProviderImplementationProfile {
     operatorNotes?: string;
     visibility: "internal" | "operator";
 }
+export declare const VALID_PROVIDER_RESOLVER_VENDORS: readonly ["browser", "capsolver", "capmonster", "2captcha", "custom"];
+export declare const VALID_PROVIDER_CHALLENGE_KINDS: readonly ["turnstile", "recaptcha_v2", "recaptcha_v3", "hcaptcha", "cloudflare_interstitial", "aws_waf"];
 type ProviderOperation = OperationDefinition<SchemaLike, SchemaLike>;
 type OperationConfig<TInput extends SchemaLike, TOutput extends SchemaLike> = Omit<OperationDefinition<TInput, TOutput>, "handler"> & {
     handler(ctx: Parameters<OperationDefinition<TInput, TOutput>["handler"]>[0], input: InferSchemaOutput<TInput>): OperationHandlerResult<InferSchemaOutput<TOutput>> | Promise<OperationHandlerResult<InferSchemaOutput<TOutput>>>;
@@ -55,7 +57,9 @@ export interface ProviderConfig<TOperations extends Record<string, ProviderOpera
         platform: StealthPlatform;
     };
     proxy?: ProviderProxyConfig;
+    ocr?: ProviderOcrConfig;
     stt?: ProviderSttConfig;
+    resolver?: ProviderResolverConfig;
     browser?: {
         engine: BrowserEngine;
     };

package/dist/define.js

@@ -47,7 +47,26 @@ const VALID_PROVIDER_PROXY_AFFINITIES = [
     "auth-flow",
     "connection",
 ];
+const VALID_PROVIDER_OCR_MODES = ["optional", "required"];
 const VALID_PROVIDER_STT_MODES = ["optional", "required"];
+function exhaustiveLiteralArray() {
+    return (values, ..._missing) => values;
+}
+export const VALID_PROVIDER_RESOLVER_VENDORS = exhaustiveLiteralArray()([
+    "browser",
+    "capsolver",
+    "capmonster",
+    "2captcha",
+    "custom",
+]);
+export const VALID_PROVIDER_CHALLENGE_KINDS = exhaustiveLiteralArray()([
+    "turnstile",
+    "recaptcha_v2",
+    "recaptcha_v3",
+    "hcaptcha",
+    "cloudflare_interstitial",
+    "aws_waf",
+]);
 const SMARTPROXY_APP_KEY_SECRET = "APIFUSE__PROXY__SMARTPROXY_APP_KEY";
 const NODEMAVEN_USERNAME_SECRET = "APIFUSE__PROXY__NODEMAVEN_USERNAME";
 const NODEMAVEN_PASSWORD_SECRET = "APIFUSE__PROXY__NODEMAVEN_PASSWORD";
@@ -56,9 +75,8 @@ const NODEMAVEN_PASSWORD_SECRET = "APIFUSE__PROXY__NODEMAVEN_PASSWORD";
 // credential fails at build/validation time rather than during a live outage: a
 // declared-but-uncredentialed fallback leg is a silently dead SPOF, which is
 // exactly the failure class the multi-vendor chain exists to remove. Vendors
-// absent from this map (e.g. `custom`/`decodo`, whose credentials come from the
-// `APIFUSE__PROXY__URL` bring-your-own escape hatch, not provider secrets) impose
-// no declaration requirement.
+// absent from this map (the deprecated `custom`/`decodo` values have no managed
+// adapter) impose no declaration requirement.
 const VENDOR_REQUIRED_SECRETS = {
     smartproxy: [SMARTPROXY_APP_KEY_SECRET],
     nodemaven: [NODEMAVEN_USERNAME_SECRET, NODEMAVEN_PASSWORD_SECRET],
@@ -361,8 +379,15 @@ function validateProviderProxy(config) {
     // `decodo`/`custom` are deprecated vendor values (string-union members, so the
     // @deprecated symbol gate can't catch them — warn at validation time instead).
     const deprecatedVendors = vendorChain.filter((vendor) => vendor === "decodo" || vendor === "custom");
+    if (proxy.mode === "required" &&
+        vendorChain.length > 0 &&
+        deprecatedVendors.length === vendorChain.length) {
+        throw new ValidationError(`Provider "${config.id}" requires proxy egress but declares only deprecated proxy vendor(s): ${deprecatedVendors.join(", ")}.`, {
+            fix: `Use proxy.provider or proxy.providers with "smartproxy" and/or "nodemaven".`,
+        });
+    }
     if (deprecatedVendors.length > 0) {
-        console.warn(`[provider-sdk] Provider "${config.id}" uses deprecated proxy vendor(s): ${deprecatedVendors.join(", ")}. Use "smartproxy"/"nodemaven", or the APIFUSE__PROXY__URL bring-your-own escape hatch.`);
+        console.warn(`[provider-sdk] Provider "${config.id}" uses deprecated proxy vendor(s): ${deprecatedVendors.join(", ")}. Use "smartproxy"/"nodemaven".`);
     }
 }
 function validateProviderStt(config) {
@@ -377,6 +402,46 @@ function validateProviderStt(config) {
     rejectUnknownFields(stt, new Set(["mode"]), "stt");
     assertLiteralField(stt.mode, "stt.mode", VALID_PROVIDER_STT_MODES, config.id);
 }
+function validateProviderOcr(config) {
+    const ocr = config.ocr;
+    if (ocr === undefined)
+        return;
+    if (!ocr || typeof ocr !== "object" || Array.isArray(ocr)) {
+        throw new ValidationError(`Provider "${config.id}" has invalid ocr: must be an object.`, {
+            fix: `Use ocr: { mode: "required" } or ocr: { mode: "optional" }.`,
+        });
+    }
+    rejectUnknownFields(ocr, new Set(["mode"]), "ocr");
+    assertLiteralField(ocr.mode, "ocr.mode", VALID_PROVIDER_OCR_MODES, config.id);
+}
+function validateProviderResolver(config) {
+    const resolver = config.resolver;
+    if (resolver === undefined)
+        return;
+    if (!resolver || typeof resolver !== "object" || Array.isArray(resolver)) {
+        throw new ValidationError(`Provider "${config.id}" has invalid resolver: must be an object.`, {
+            fix: `Set resolver for provider "${config.id}" to { vendors: ["2captcha"], kinds: ["turnstile"] }.`,
+        });
+    }
+    rejectUnknownFields(resolver, new Set(["vendors", "kinds"]), "resolver", config.id);
+    validateResolverLiteralArray(resolver.vendors, "resolver.vendors", VALID_PROVIDER_RESOLVER_VENDORS, config.id);
+    validateResolverLiteralArray(resolver.kinds, "resolver.kinds", VALID_PROVIDER_CHALLENGE_KINDS, config.id);
+}
+function validateResolverLiteralArray(value, field, validValues, providerId) {
+    if (!Array.isArray(value)) {
+        throw new ValidationError(`Provider "${providerId}" has invalid ${field}: must be an array.`, {
+            fix: `Set ${field} for provider "${providerId}" to an array containing only: ${validValues.join(", ")}.`,
+        });
+    }
+    for (const [index, item] of value.entries()) {
+        if (typeof item === "string" && validValues.some((validValue) => validValue === item)) {
+            continue;
+        }
+        throw new ValidationError(`Provider "${providerId}" has invalid ${field}[${index}]: ${JSON.stringify(item)}. Expected one of: ${validValues.join(", ")}`, {
+            fix: `Set ${field}[${index}] for provider "${providerId}" to one of ${validValues.map((validValue) => `"${validValue}"`).join(", ")}.`,
+        });
+    }
+}
 function validateOperationIds(providerId, operations) {
     for (const operationName of Object.keys(operations)) {
         if (!OPERATION_ID_REGEX.test(operationName))
@@ -751,14 +816,18 @@ function suggestField(unknown, candidates) {
     }
     return best;
 }
-function rejectUnknownFields(value, allowed, fieldPath) {
+function rejectUnknownFields(value, allowed, fieldPath, providerId) {
     for (const key of Object.keys(value)) {
         if (allowed.has(key))
             continue;
         const hint = suggestField(key, allowed);
         throw new ValidationError(hint
             ? `Unknown field "${key}" on ${fieldPath}. Did you mean "${hint}"?`
-            : `Unknown field "${key}" on ${fieldPath}.`, { fix: `Remove ${fieldPath}.${key} or rename it.` });
+            : `Unknown field "${key}" on ${fieldPath}.`, {
+            fix: providerId
+                ? `Remove ${fieldPath}.${key} from provider "${providerId}" or rename it.`
+                : `Remove ${fieldPath}.${key} or rename it.`,
+        });
     }
 }
 function assertBoundedIntegerMs(value, fieldPath, options) {
@@ -1538,7 +1607,9 @@ export function defineProvider(config) {
         throw error;
     }
     validateProviderProxy(config);
+    validateProviderOcr(config);
     validateProviderStt(config);
+    validateProviderResolver(config);
     if (config.runtime === "browser" && !config.browser)
         throw new ProviderError(`Provider "${config.id}" must define browser.engine when runtime is "browser"`, {
             fix: 'Add browser: { engine: "playwright-stealth" } for TypeScript providers, or another supported engine for your runtime',
@@ -1556,7 +1627,9 @@ export function defineProvider(config) {
         native: config.native,
         stealth: config.stealth,
         proxy: config.proxy,
+        ocr: config.ocr,
         stt: config.stt,
+        resolver: config.resolver,
         browser: config.browser,
         auth: config.auth,
         reviewed: config.reviewed,

package/dist/error-resolution.js

@@ -28,6 +28,7 @@ export const SDK_OWNED_PROVIDER_ERROR_CODES = new Set([
     "flow_expired",
     "turn_validation_error",
     "context_access_error",
+    "OCR_UPSTREAM_FAILED",
     "UNSUPPORTED_STT_OPTION",
     "INVALID_STT_AUDIO",
     "STT_AUDIO_TOO_LARGE",
@@ -82,6 +83,8 @@ export const SDK_OWNED_PROVIDER_ERROR_CODES = new Set([
 export const SDK_RUNTIME_OWNED_ERROR_CODES = new Set([
     ...SDK_OWNED_PROVIDER_ERROR_CODES,
     "reauth_required",
+    "OCR_UNAVAILABLE",
+    "UNSUPPORTED_OCR_BACKEND",
     "STT_UNAVAILABLE",
     "UNSUPPORTED_STT_BACKEND",
     "OUTPUT_VALIDATION_FAILED",
@@ -111,6 +114,8 @@ export const SDK_STATUS_MAPPED_PROVIDER_ERROR_CODES = new Map([
     ["UPSTREAM_REJECTED", 409],
     ["UPSTREAM_ERROR", 502],
     ["BLOCKED", 502],
+    ["OCR_UNAVAILABLE", 503],
+    ["UNSUPPORTED_OCR_BACKEND", 503],
     ["STT_UNAVAILABLE", 503],
     ["UNSUPPORTED_STT_BACKEND", 503],
     ["STATEFUL_FORWARDING_REPLAY_CACHE_FULL", 503],

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export * from "./auth.js";
 export * from "./ceremonies/index.js";
 export * from "./choice-token.js";
-export type { ApiFuseConfig, BrowserConfig, ProxyConfig, ProxyProtocol, ProxyResolutionOptions, ProxyResolutionSource, ProxyVendorName, ResolvedProxyConfig, SessionConfig, } from "./config/loader.js";
+export type { ApiFuseConfig, BrowserConfig, ProxyProtocol, ProxyResolutionOptions, ProxyResolutionSource, ProxyVendorName, ResolvedProxyConfig, SessionConfig, } from "./config/loader.js";
 export { defineConfig, loadApiFuseConfig, resolveProxy } from "./config/loader.js";
 export { canonicalJson, digestProviderContract, extractProviderContract, type JsonPrimitive, type JsonValue, PROVIDER_CONTRACT_SCHEMA_VERSION, type ProviderContractOperation, type ProviderContractSnapshot, } from "./contract.js";
 export { centered, delayed, defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, defineStreamOperation, every, type ProviderConfig, } from "./define.js";
@@ -29,16 +29,18 @@ export { generateInsights } from "./runtime/insights.js";
 export { type InstrumentationOptions, type InstrumentedProviderContext, wrapWithInstrumentation, } from "./runtime/instrumentation.js";
 export { type PrevalidateResult, prevalidate } from "./runtime/prevalidate.js";
 export { getProviderBaseUrl } from "./runtime/provider.js";
+export { APIFUSE__CDP_POOL__URL, APIFUSE__RESOLVER__2CAPTCHA__API_KEY, APIFUSE__RESOLVER__CAPMONSTER__API_KEY, APIFUSE__RESOLVER__CAPSOLVER__API_KEY, APIFUSE__RESOLVER__TIMEOUT_MS, createResolverClientFromEnv, createUnsupportedResolverClient, DEFAULT_RESOLVER_TIMEOUT_MS, invalidateResolverSolution, type ResolverRuntimeOptions, } from "./runtime/resolver.js";
 export { assertRequiredSecretsPresent, listMissingRequiredSecrets, MISSING_SECRET_CODE, } from "./runtime/secrets.js";
 export { createUnsupportedProviderRuntimeState, UnsupportedProviderStateError, } from "./runtime/state.js";
 export { createStealthClient } from "./runtime/stealth.js";
+export { APIFUSE__OCR__API_KEY_ENV, APIFUSE__OCR__BACKEND_ENV, APIFUSE__OCR__BASE_URL_ENV, APIFUSE__OCR__CLOUDFLARE_API_TOKEN_ENV, APIFUSE__OCR__MODEL_ENV, CLOUDFLARE_ACCOUNT_ID_ENV, CLOUDFLARE_WORKERS_AI_OCR_BACKEND, createCloudflareWorkersAiOcrClient, createOcrClientFromEnv, createOpenAiCompatibleOcrClient, createUnsupportedOcrClient, DEFAULT_CLOUDFLARE_WORKERS_AI_OCR_MODEL, extractCaptchaCandidates, OPENAI_COMPATIBLE_OCR_BACKEND, } from "./runtime/ocr.js";
 export { APIFUSE__STT__BACKEND_ENV, APIFUSE__STT__CLOUDFLARE_API_TOKEN_ENV, APIFUSE__STT__MODEL_ENV, createSttClientFromEnv, createUnsupportedSttClient, extractVerificationCode, resolveSttPrompt, } from "./runtime/stt.js";
 export { type CreateTraceContextOptions, createTraceContext, type Span, type TraceContext, } from "./runtime/trace.js";
 export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, type SensitiveFieldKind, type SensitiveFieldOptions, type SensitivePath, sensitive, z, } from "./schema.js";
 export { createServerApp, ERROR_OBSERVABILITY_HEADER, type ServeOptions, serve, } from "./server/index.js";
 export { getStealthProfile, listStealthProfiles } from "./stealth/profiles.js";
 export * from "./stream.js";
-export type { ApiFuseResponse, AuthConfig, AuthContext, AuthFlowDefinition, AuthFlowInputHandler, AuthFlowStartHandler, AuthMode, AuthTurn, Bcp47Locale, BrowserEngine, BrowserOptions, BrowserResourceBody, BrowserResourceDecision, BrowserResourceMethod, BrowserResourcePolicy, BrowserResourceRequest, BrowserResourceRoute, ConnectionMode, ContextDeclaration, CookieJar, ContextScratchpad, CredentialContext, CredentialDeclaration, E164PhoneNumber, EnvContext, FlowContext, FlowContextStore, HealthCheckAssertionContext, HealthCheckCase, HealthCheckCaseResult, HealthCheckSuite, HealthCheckUnsupported, HealthJourneyDefinition, HealthJourneyEventContext, HealthJourneyGatewayContext, HealthJourneyJournalContext, HealthJourneyManualTriggerPolicy, HealthJourneyRunContext, HealthJourneyRunResult, HealthJourneySchedule, HealthScheduleRandomization, HealthJourneySmsContext, HealthJourneyStep, HttpClient, HttpMethod, HttpRedirectFailureReason, HttpRedirectPolicy, HttpRedirectPolicyMode, HttpResponse, HttpRetryOptions, HttpRetrySummary, HttpStreamResponse, IanaTimeZone, InferSchemaOutput, Iso3166Alpha2CountryCode, Iso4217CurrencyCode, Iso8601Duration, NativeContext, NativeNetworkClient, NativeNetworkCloseReason, NativeNetworkConnection, NativeNetworkConnectInput, NativeNetworkConnectOptions, NativeNetworkDynamicGrantOptions, NativeNetworkEgressGrant, NativeProviderConfig, NativeProviderContext, NativeProxyDrainHandler, NativeProxyEgressInfo, NativeProxyExpiringEvent, NativeProxyExpiringReason, NativeTcpDynamicEgressRule, NativeTcpEgressGrant, NativeTcpEgressRule, NativeTcpPortRange, NativeTcpTlsMode, NativeTlsConnectOptions, OperationAnnotations, OperationApprovalPolicy, OperationContractMetadata, OperationDefinition, OperationDeprecationMetadata, OperationDocMeta, OperationErrorCode, ProviderErrorStatus, OperationHandlerResult, OperationInputExample, OperationLifecycle, OperationObservabilityConfig, OperationObservabilitySensitiveConfig, OperationRelationships, OperationRiskClass, OperationSensitivePath, OperationToolRouterMetadata, OperationTransport, OperationTransportKind, ProbeInterval, ProviderAccessConfig, ProviderAccessVisibility, ProviderCache, ProviderCacheGetOrSetOptions, ProviderCacheKeyOptions, ProviderCacheLookupMeta, ProviderCacheResponseMeta, ProviderCacheResult, ProviderChoiceBindingOptions, ProviderChoiceContext, ProviderChoiceIssueOptions, ProviderChoiceParseOptions, ProviderContext, ProviderDefinition, ProviderDeploymentOverrides, ProviderFileRef, ProviderFilesContext, ProviderHealthMonitorConfig, ProviderHealthProbeConfig, ProviderLocale, ProviderLocaleKey, ProviderLocaleKeyInput, ProviderLogoProfile, ProviderLogoSource, ProviderMeta, ProviderProxyConfig, ProviderProxyMode, ProviderProxyPolicy, ProxiedOAuthConfig, ProviderProxyProvider, ProviderProxySessionAffinity, ProviderPublicConnectionMode, ProviderPublicProfile, ProviderReviewed, ProviderResolvedFile, ProviderRuntimeState, ProviderSecretDeclaration, ProviderStateDurationString, ProviderStateNamespace, ProviderStreamEvent, ProviderSttConfig, ProviderSttMode, ProviderSupportLevel, RequestOptions, RedirectRunReason, Rfc3339Instant, SchemaLike, SmsOrigin, SmsOtpExtractionPattern, SmsOtpMatcherDefinition, SseMessage, StandardSchemaV1, StateCasResult, StateNamespaceOptions, StateValue, StateWriteOptions, StealthClient, StealthCookieStore, StealthCookieStoreV1, StealthFetchOptions, StealthPlatform, StealthProfile, StealthRedirectHop, StealthRedirectRunOptions, StealthRedirectRunResult, StealthResponse, StealthSession, StealthSessionCookies, SttAudioInput, SttContext, SttPromptPolicy, SttSegment, SttTranscribeMode, SttTranscribeRequest, SttTranscript, SttUnsupportedOptionPolicy, SttUsage, SttVerificationCodeOptions, SttWarning, TraceConfig, TraceSpan, VerificationCodeCandidate, VerificationCodeCandidateSource, VerificationCodeExtractionResult, } from "./types.js";
+export type { ApiFuseResponse, AuthConfig, AuthContext, AuthFlowDefinition, AuthFlowInputHandler, AuthFlowStartHandler, AuthMode, AuthTurn, Bcp47Locale, BrowserCookie, BrowserEngine, BrowserOptions, BrowserResourceBody, BrowserResourceDecision, BrowserResourceMethod, BrowserResourcePolicy, BrowserResourceRequest, BrowserResourceRoute, ChallengeSolution, ConnectionMode, ContextDeclaration, CookieJar, ContextScratchpad, CredentialContext, CredentialDeclaration, E164PhoneNumber, EnvContext, FlowContext, FlowContextStore, HealthCheckAssertionContext, HealthCheckCase, HealthCheckCaseResult, HealthCheckSuite, HealthCheckUnsupported, HealthJourneyDefinition, HealthJourneyEventContext, HealthJourneyGatewayContext, HealthJourneyJournalContext, HealthJourneyManualTriggerPolicy, HealthJourneyRunContext, HealthJourneyRunResult, HealthJourneySchedule, HealthScheduleRandomization, HealthJourneySmsContext, HealthJourneyStep, HttpClient, HttpMethod, HttpRedirectFailureReason, HttpRedirectPolicy, HttpRedirectPolicyMode, HttpResponse, HttpRetryOptions, HttpRetrySummary, HttpStreamResponse, IanaTimeZone, InferSchemaOutput, Iso3166Alpha2CountryCode, Iso4217CurrencyCode, Iso8601Duration, NativeContext, NativeNetworkClient, NativeNetworkCloseReason, NativeNetworkConnection, NativeNetworkConnectInput, NativeNetworkConnectOptions, NativeNetworkDynamicGrantOptions, NativeNetworkEgressGrant, NativeProviderConfig, NativeProviderContext, NativeProxyDrainHandler, NativeProxyEgressInfo, NativeProxyExpiringEvent, NativeProxyExpiringReason, NativeTcpDynamicEgressRule, NativeTcpEgressGrant, NativeTcpEgressRule, NativeTcpPortRange, NativeTcpTlsMode, NativeTlsConnectOptions, OcrCaptchaCandidate, OcrCaptchaOptions, OcrCaptchaResult, OcrContext, OcrImageInput, OcrRecognizeRequest, OcrResult, OcrWarning, OperationAnnotations, OperationApprovalPolicy, OperationContractMetadata, OperationDefinition, OperationDeprecationMetadata, OperationDocMeta, OperationErrorCode, ProviderErrorStatus, OperationHandlerResult, OperationInputExample, OperationLifecycle, OperationObservabilityConfig, OperationObservabilitySensitiveConfig, OperationRelationships, OperationRiskClass, OperationSensitivePath, OperationToolRouterMetadata, OperationTransport, OperationTransportKind, ProbeInterval, ProviderAccessConfig, ProviderAccessVisibility, ProviderCache, ProviderCacheGetOrSetOptions, ProviderCacheKeyOptions, ProviderCacheLookupMeta, ProviderCacheResponseMeta, ProviderCacheResult, ProviderChoiceBindingOptions, ProviderChoiceContext, ProviderChoiceIssueOptions, ProviderChoiceParseOptions, ProviderChallenge, ProviderChallengeKind, ProviderContext, ProviderDefinition, ProviderDeploymentOverrides, ProviderFileRef, ProviderFilesContext, ProviderHealthMonitorConfig, ProviderHealthProbeConfig, ProviderLocale, ProviderLocaleKey, ProviderLocaleKeyInput, ProviderLogoProfile, ProviderLogoSource, ProviderMeta, ProviderOcrConfig, ProviderProxyConfig, ProviderProxyMode, ProviderProxyPolicy, ProxiedOAuthConfig, ProviderProxyProvider, ProviderProxySessionAffinity, ProviderPublicConnectionMode, ProviderPublicProfile, ProviderReviewed, ProviderResolvedFile, ProviderResolverConfig, ProviderResolverVendor, ProviderRuntimeState, ProviderSecretDeclaration, ProviderStateDurationString, ProviderStateNamespace, ProviderStreamEvent, ProviderSttConfig, ProviderSttMode, ProviderSupportLevel, RequestOptions, RedirectRunReason, ResolverContext, Rfc3339Instant, SchemaLike, SmsOrigin, SmsOtpExtractionPattern, SmsOtpMatcherDefinition, SseMessage, StandardSchemaV1, StateCasResult, StateNamespaceOptions, StateNamespaceScope, StateValue, StateWriteOptions, StealthClient, StealthCookieStore, StealthCookieStoreV1, StealthFetchOptions, StealthPlatform, StealthProfile, StealthRedirectHop, StealthRedirectRunOptions, StealthRedirectRunResult, StealthResponse, StealthSession, StealthSessionCookies, SttAudioInput, SttContext, SttPromptPolicy, SttSegment, SttTranscribeMode, SttTranscribeRequest, SttTranscript, SttUnsupportedOptionPolicy, SttUsage, SttVerificationCodeOptions, SttWarning, TraceConfig, TraceSpan, VerificationCodeCandidate, VerificationCodeCandidateSource, VerificationCodeExtractionResult, } from "./types.js";
 export { DEFAULT_OPERATION_TRANSPORT, HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, PROBE_INTERVALS, STREAM_CHUNK_BYTES_MAX, STREAM_CHUNK_BYTES_MIN, STREAM_HEARTBEAT_MS_MAX, STREAM_HEARTBEAT_MS_MIN, STREAM_IDLE_TIMEOUT_MS_MAX, STREAM_IDLE_TIMEOUT_MS_MIN, STREAM_MAX_DURATION_MS_MAX, STREAM_MAX_DURATION_MS_MIN, } from "./types.js";
 export * from "./utils/date.js";
 export * from "./utils/parse.js";

package/dist/index.js

@@ -26,9 +26,11 @@ export { generateInsights } from "./runtime/insights.js";
 export { wrapWithInstrumentation, } from "./runtime/instrumentation.js";
 export { prevalidate } from "./runtime/prevalidate.js";
 export { getProviderBaseUrl } from "./runtime/provider.js";
+export { APIFUSE__CDP_POOL__URL, APIFUSE__RESOLVER__2CAPTCHA__API_KEY, APIFUSE__RESOLVER__CAPMONSTER__API_KEY, APIFUSE__RESOLVER__CAPSOLVER__API_KEY, APIFUSE__RESOLVER__TIMEOUT_MS, createResolverClientFromEnv, createUnsupportedResolverClient, DEFAULT_RESOLVER_TIMEOUT_MS, invalidateResolverSolution, } from "./runtime/resolver.js";
 export { assertRequiredSecretsPresent, listMissingRequiredSecrets, MISSING_SECRET_CODE, } from "./runtime/secrets.js";
 export { createUnsupportedProviderRuntimeState, UnsupportedProviderStateError, } from "./runtime/state.js";
 export { createStealthClient } from "./runtime/stealth.js";
+export { APIFUSE__OCR__API_KEY_ENV, APIFUSE__OCR__BACKEND_ENV, APIFUSE__OCR__BASE_URL_ENV, APIFUSE__OCR__CLOUDFLARE_API_TOKEN_ENV, APIFUSE__OCR__MODEL_ENV, CLOUDFLARE_ACCOUNT_ID_ENV, CLOUDFLARE_WORKERS_AI_OCR_BACKEND, createCloudflareWorkersAiOcrClient, createOcrClientFromEnv, createOpenAiCompatibleOcrClient, createUnsupportedOcrClient, DEFAULT_CLOUDFLARE_WORKERS_AI_OCR_MODEL, extractCaptchaCandidates, OPENAI_COMPATIBLE_OCR_BACKEND, } from "./runtime/ocr.js";
 export { APIFUSE__STT__BACKEND_ENV, APIFUSE__STT__CLOUDFLARE_API_TOKEN_ENV, APIFUSE__STT__MODEL_ENV, createSttClientFromEnv, createUnsupportedSttClient, extractVerificationCode, resolveSttPrompt, } from "./runtime/stt.js";
 export { createTraceContext, } from "./runtime/trace.js";
 export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, sensitive, z, } from "./schema.js";

package/dist/provider.d.ts

@@ -7,6 +7,6 @@ export { AuthError, HttpRedirectError, isProviderError, isSessionExpiredError, i
 export { getProviderLocalePath, providerLocaleKey, qualifyProviderLocaleKey, } from "./i18n/index.js";
 export { type CreateProviderChoiceContextOptions, createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice.js";
 export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, type SensitiveFieldKind, type SensitiveFieldOptions, type SensitivePath, sensitive, z, } from "./schema.js";
-export type { AuthAbortData, AuthAbortRetry, AuthFlowTerminalContext, AuthMode, AuthSafeData, AuthSafeJson, FlowContext, HealthCheckAssertionContext, HealthCheckCase, HealthCheckSuite, HealthCheckUnsupported, HealthJourneyDefinition, HealthJourneyEventContext, HealthJourneyManualTriggerPolicy, HealthJourneyRunContext, HealthJourneyRunResult, HealthScheduleRandomization, HttpRedirectFailureReason, HttpRedirectPolicy, HttpRedirectPolicyMode, HttpRetryOptions, HttpRetrySummary, InferSchemaOutput, NativeContext, NativeNetworkClient, NativeNetworkCloseReason, NativeNetworkConnection, NativeNetworkConnectInput, NativeNetworkConnectOptions, NativeNetworkDynamicGrantOptions, NativeNetworkEgressGrant, NativeProviderConfig, NativeProviderContext, NativeProxyDrainHandler, NativeProxyEgressInfo, NativeProxyExpiringEvent, NativeProxyExpiringReason, NativeTcpDynamicEgressRule, NativeTcpEgressGrant, NativeTcpEgressRule, NativeTcpPortRange, NativeTcpTlsMode, NativeTlsConnectOptions, OperationApprovalPolicy, OperationContractMetadata, OperationDefinition, OperationDocMeta, OperationErrorCode, ProviderErrorStatus, OperationInputExample, OperationLifecycle, OperationObservabilityConfig, OperationObservabilitySensitiveConfig, OperationRelationships, OperationRiskClass, OperationSensitivePath, OperationToolRouterMetadata, OperationTransport, ProviderAccessVisibility, ProviderChoiceBindingOptions, ProviderChoiceContext, ProviderChoiceIssueOptions, ProviderChoiceParseOptions, ProviderContext, ProviderDefinition, ProviderDeploymentOverrides, ProviderFileRef, ProviderFilesContext, ProviderLocale, ProviderLocaleKey, ProviderLocaleKeyInput, ProviderLogoProfile, ProviderProxyPolicy, ProxiedOAuthConfig, ProviderPublicConnectionMode, ProviderPublicProfile, ProviderResolvedFile, ProviderRuntimeState, ProviderStateDurationString, ProviderStateNamespace, ProviderSupportLevel, RedirectRunReason, SchemaLike, SmsOtpMatcherDefinition, StandardSchemaV1, StateCasResult, StateNamespaceOptions, StateValue, StateWriteOptions, } from "./types.js";
+export type { AuthAbortData, AuthAbortRetry, AuthFlowTerminalContext, AuthMode, AuthSafeData, AuthSafeJson, FlowContext, HealthCheckAssertionContext, HealthCheckCase, HealthCheckSuite, HealthCheckUnsupported, HealthJourneyDefinition, HealthJourneyEventContext, HealthJourneyManualTriggerPolicy, HealthJourneyRunContext, HealthJourneyRunResult, HealthScheduleRandomization, HttpRedirectFailureReason, HttpRedirectPolicy, HttpRedirectPolicyMode, HttpRetryOptions, HttpRetrySummary, InferSchemaOutput, NativeContext, NativeNetworkClient, NativeNetworkCloseReason, NativeNetworkConnection, NativeNetworkConnectInput, NativeNetworkConnectOptions, NativeNetworkDynamicGrantOptions, NativeNetworkEgressGrant, NativeProviderConfig, NativeProviderContext, NativeProxyDrainHandler, NativeProxyEgressInfo, NativeProxyExpiringEvent, NativeProxyExpiringReason, NativeTcpDynamicEgressRule, NativeTcpEgressGrant, NativeTcpEgressRule, NativeTcpPortRange, NativeTcpTlsMode, NativeTlsConnectOptions, OperationApprovalPolicy, OperationContractMetadata, OperationDefinition, OperationDocMeta, OperationErrorCode, ProviderErrorStatus, OperationInputExample, OperationLifecycle, OperationObservabilityConfig, OperationObservabilitySensitiveConfig, OperationRelationships, OperationRiskClass, OperationSensitivePath, OperationToolRouterMetadata, OperationTransport, ProviderAccessVisibility, ProviderChoiceBindingOptions, ProviderChoiceContext, ProviderChoiceIssueOptions, ProviderChoiceParseOptions, ProviderContext, ProviderDefinition, ProviderDeploymentOverrides, ProviderFileRef, ProviderFilesContext, ProviderLocale, ProviderLocaleKey, ProviderLocaleKeyInput, ProviderLogoProfile, ProviderProxyPolicy, ProxiedOAuthConfig, ProviderPublicConnectionMode, ProviderPublicProfile, ProviderResolvedFile, ProviderRuntimeState, ProviderStateDurationString, ProviderStateNamespace, ProviderSupportLevel, RedirectRunReason, SchemaLike, SmsOtpMatcherDefinition, StandardSchemaV1, StateCasResult, StateNamespaceOptions, StateNamespaceScope, StateValue, StateWriteOptions, } from "./types.js";
 export { createNativeNetworkClient, createEnvVendorCredentialResolver, deriveNativeCredentialAffinityKey, NativeEgressGrantExpiredError, NativeEgressNotDeclaredError, NativeIdleTimeoutError, NativeNetworkError, NativeProxyExpiredError, resolveNativeGatewayProxy, type NativeGatewayProxy, type NativeGatewayProxyResolutionInput, type NativeGatewayProxySkipReason, type NativeGatewayProxySynthesizer, type NativeGatewayProxySynthesisResult, type NativeGatewayProxySynthesisInput, type NativeNetworkClientOptions, type NativeNetworkErrorCode, type VendorCredentialLookup, type VendorCredentialResolver, } from "./runtime/native-network.js";
 export { HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, } from "./types.js";

package/dist/runtime/auth-flow.d.ts

@@ -1,4 +1,4 @@
-import type { ContextScratchpad, EnvContext, FlowContext, HttpClient, StealthClient, SttContext } from "../types.js";
+import type { ContextScratchpad, EnvContext, FlowContext, HttpClient, OcrContext, StealthClient, SttContext } from "../types.js";
 export declare function createScratchpad(allowedKeys: string[], initial?: Record<string, unknown>): ContextScratchpad;
 export declare function createFlowContext(options: {
     flowId?: string;
@@ -11,5 +11,6 @@ export declare function createFlowContext(options: {
     externalRef?: string;
     allowedKeys: string[];
     initialContext?: Record<string, unknown>;
+    ocr?: OcrContext;
     stt?: SttContext;
 }): FlowContext;

package/dist/runtime/auth-flow.js

@@ -1,5 +1,7 @@
 import { ContextAccessError } from "../errors.js";
 import { createAuthFlowHelpers } from "../auth.js";
+import { createUnsupportedOcrClient } from "./ocr.js";
+import { createUnsupportedResolverClient } from "./resolver.js";
 import { createUnsupportedSttClient } from "./stt.js";
 function normalizeAllowedKeys(allowedKeys) {
     return new Set(allowedKeys.filter((key) => key.trim().length > 0));
@@ -41,7 +43,9 @@ export function createFlowContext(options) {
         stealth: options.stealth,
         env: options.env,
         context: createScratchpad(options.allowedKeys, options.initialContext),
+        ocr: options.ocr ?? createUnsupportedOcrClient(),
         stt: options.stt ?? createUnsupportedSttClient(),
+        resolver: createUnsupportedResolverClient("Resolver is not available in auth flow context"),
         auth: createAuthFlowHelpers(),
     };
 }