@apifuse/provider-sdk 2.2.0-beta.26 → 2.2.0-beta.28

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @apifuse/provider-sdk Changelog
 
+## 2.2.0-beta.28
+
+- Release candidate for main commit 2936f1891d4e2326502f0585081f8a58060d6dd7.
+
+## 2.2.0-beta.27
+
+- Release candidate for main commit 579d9e7fd22d8414b151be2b71a43a0990456911.
+
 ## 2.2.0-beta.26
 
 - Release candidate for main commit 924fe13d1101e7840d799a562a7a70174355185d.

package/bin/apifuse-dev.ts

@@ -4,7 +4,6 @@ import { existsSync } from "node:fs";
 import { dirname, relative, resolve } from "node:path";
 import type { ProviderDefinition } from "../src/index.js";
 import {
-	createBrowserClient,
 	createCredentialContext,
 	createEnvContext,
 	createHttpClient,
@@ -12,12 +11,13 @@ import {
 	createProviderCache,
 	createProviderChoiceContext,
 	createUnsupportedResolverClient,
-	createStealthClient,
 	createSttClientFromEnv,
 	PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV,
 	ProviderError,
 } from "../src/index.js";
+import { createBrowserClient } from "../src/runtime/browser.js";
 import { createMemoryProviderRuntimeState } from "../src/runtime/state.js";
+import { createStealthClient } from "../src/runtime/stealth.js";
 import { createTraceContext } from "../src/runtime/trace.js";
 import type { BrowserClient, ProviderContext } from "../src/types.js";
 

package/bin/apifuse-pack-smoke.ts

@@ -224,7 +224,7 @@ function smokePackedStealthNative(consumerDir: string): void {
 			"--eval",
 			[
 				'import { createServer } from "node:http";',
-				'import { createStealthClient } from "@apifuse/provider-sdk";',
+				'import { createStealthClient } from "@apifuse/provider-sdk/runtime/stealth";',
 				"const server = createServer((_request, response) => {",
 				'  response.setHeader("set-cookie", "pack_native_cookie=landed; Path=/");',
 				'  response.end("packed native stealth ok");',

package/bin/apifuse-pack-types.ts

@@ -357,7 +357,8 @@ function setUpFixtureConsumer(consumerDir: string, tarballPath: string): void {
 	writeFileSync(
 		join(consumerDir, "consumer.ts"),
 		[
-			'import { defineProvider, invalidateResolverSolution, ProviderError, resolveProxy, SessionExpiredError, z } from "@apifuse/provider-sdk";',
+			'import { defineProvider, ProviderError, resolveProxy, SessionExpiredError, z } from "@apifuse/provider-sdk";',
+			'import { invalidateResolverSolution } from "@apifuse/provider-sdk/runtime/resolver";',
 			'import type { BrowserCookie, ChallengeSolution, NativeNetworkClient, NativeNetworkConnection, NativeProviderConfig, NativeProviderContext, NativeTcpEgressGrant, ProviderChallenge, ProviderContext, ProviderFileRef, ProviderFilesContext, ProviderResolvedFile, ProviderResolverConfig, ResolverContext, ResolverRuntimeOptions } from "@apifuse/provider-sdk";',
 			'import type { ProxyProtocol, ProxyResolutionOptions, ProxyResolutionSource, ProxyVendorName, RequestOptions, ResolvedProxyConfig } from "@apifuse/provider-sdk";',
 			'import { defineCredentialsAuth } from "@apifuse/provider-sdk/provider";',

package/bin/apifuse-perf.ts

@@ -11,7 +11,6 @@ import {
 	createBypassProviderCache,
 	createHttpClient,
 	createProviderChoiceContext,
-	createStealthClient,
 	createSttClientFromEnv,
 	executeOperation,
 	getProviderBaseUrl,
@@ -28,6 +27,7 @@ import {
 } from "../src/index.js";
 import { computeStats, groupSpansByName, type PerfStats } from "../src/runtime/perf.js";
 import { createMemoryProviderRuntimeState } from "../src/runtime/state.js";
+import { createStealthClient } from "../src/runtime/stealth.js";
 import { createTraceContext, resolveTraceContextOptions } from "../src/runtime/trace.js";
 import { renderWaterfall } from "../src/runtime/waterfall.js";
 import type { BrowserClient } from "../src/types.js";
@@ -458,9 +458,7 @@ async function loadFixtureReplay(providerDirectory: string): Promise<FixtureRepl
 async function assertProxyConfigured(provider: ProviderDefinition): Promise<void> {
 	const policy = provider.proxy;
 	if (!policy || typeof policy !== "object" || policy.mode === "disabled") {
-		throw new Error(
-			"--compare-proxy requires an enabled ProviderProxyPolicy on the provider.",
-		);
+		throw new Error("--compare-proxy requires an enabled ProviderProxyPolicy on the provider.");
 	}
 
 	const resolved = await resolveProxy({ proxyPolicy: policy });

package/bin/apifuse-record.ts

@@ -10,7 +10,6 @@ import {
 	createHttpClient,
 	createOcrClientFromEnv,
 	createProviderChoiceContext,
-	createStealthClient,
 	createSttClientFromEnv,
 	createUnsupportedResolverClient,
 	executeOperation,
@@ -33,6 +32,7 @@ import {
 	sanitizeFixtureString,
 } from "../src/fixture-sanitization.js";
 import { createMemoryProviderRuntimeState } from "../src/runtime/state.js";
+import { createStealthClient } from "../src/runtime/stealth.js";
 import {
 	REDACTED_QUERY_VALUE,
 	isSensitiveKey,

package/dist/auth-turn/index.d.ts

@@ -20,7 +20,7 @@ export declare const AUTH_TURN_SCHEMA_ARTIFACT_PATH = "dist/auth-turn/auth-turn.
  *
  * This is the exact codification of the runtime validation the SDK applies to
  * ceremony outputs (see `validateCeremonyOutput` in `src/ceremonies`), which
- * compiles this same document. `kind` is an OPEN string on the wire: the known
+ * evaluates this same document. `kind` is an OPEN string on the wire: the known
  * kinds in {@link TURN_KINDS} are tooling metadata, never a wire constraint.
  *
  * The committed artifact at `src/auth-turn/auth-turn.v1.schema.json` (shipped

package/dist/auth-turn/index.js

@@ -18,7 +18,7 @@ export const AUTH_TURN_SCHEMA_ARTIFACT_PATH = "dist/auth-turn/auth-turn.v1.schem
  *
  * This is the exact codification of the runtime validation the SDK applies to
  * ceremony outputs (see `validateCeremonyOutput` in `src/ceremonies`), which
- * compiles this same document. `kind` is an OPEN string on the wire: the known
+ * evaluates this same document. `kind` is an OPEN string on the wire: the known
  * kinds in {@link TURN_KINDS} are tooling metadata, never a wire constraint.
  *
  * The committed artifact at `src/auth-turn/auth-turn.v1.schema.json` (shipped

package/dist/ceremonies/index.js

@@ -1,12 +1,6 @@
 import { createHash, randomBytes, randomUUID } from "node:crypto";
-import Ajv2020 from "ajv/dist/2020.js";
 import { AUTH_TURN_SCHEMA } from "../auth-turn/index.js";
 import { FlowExpiredError, ProviderSecretError, TurnValidationError, ValidationError, } from "../errors.js";
-const ajv = new Ajv2020({ allErrors: true, strict: true, strictSchema: true });
-// Runtime ceremony-output validation derives from the exported versioned
-// contract: it compiles the exact AUTH_TURN_SCHEMA document shipped at
-// dist/auth-turn/auth-turn.v1.schema.json, so the two cannot drift.
-const validateAuthTurn = ajv.compile(AUTH_TURN_SCHEMA);
 const OAUTH2_STATE_KEY = "__oauth2_state";
 const OAUTH2_PKCE_VERIFIER_KEY = "__oauth2_pkce_verifier";
 export const OAUTH2_PROXIED_AUTH_PROXY_ORIGIN_ENV_KEY = "APIFUSE__AUTH_PROXY__URL";
@@ -26,6 +20,50 @@ const FORM_FIELD_ORDER_EXTENSION = "x-apifuse-field-order";
 function isRecord(value) {
     return !!value && typeof value === "object" && !Array.isArray(value);
 }
+function validateSchemaNode(value, schema, path, errors) {
+    if (schema.type === "object") {
+        if (!isRecord(value)) {
+            errors.push(`${path} must be object`);
+            return;
+        }
+        const properties = schema.properties ?? {};
+        for (const required of schema.required ?? []) {
+            if (!Object.hasOwn(value, required) || value[required] === undefined) {
+                errors.push(`${path} must have required property '${required}'`);
+            }
+        }
+        if (schema.additionalProperties === false) {
+            for (const key of Object.keys(value)) {
+                if (!Object.hasOwn(properties, key)) {
+                    errors.push(`${path} must NOT have additional property '${key}'`);
+                }
+            }
+        }
+        for (const [key, childSchema] of Object.entries(properties)) {
+            if (Object.hasOwn(value, key) && value[key] !== undefined) {
+                validateSchemaNode(value[key], childSchema, `${path}/${key}`, errors);
+            }
+        }
+        return;
+    }
+    if (schema.type === "string") {
+        if (typeof value !== "string") {
+            errors.push(`${path} must be string`);
+        }
+        else if (schema.minLength !== undefined && value.length < schema.minLength) {
+            errors.push(`${path} must NOT have fewer than ${schema.minLength} characters`);
+        }
+        return;
+    }
+    if (schema.type === "number") {
+        if (typeof value !== "number" || !Number.isFinite(value)) {
+            errors.push(`${path} must be number`);
+        }
+        else if (schema.minimum !== undefined && value < schema.minimum) {
+            errors.push(`${path} must be >= ${schema.minimum}`);
+        }
+    }
+}
 function ensureRecord(value) {
     return isRecord(value) ? value : {};
 }
@@ -114,11 +152,14 @@ function withDeclaredFormFieldOrder(expectedInput) {
     };
 }
 export function validateCeremonyOutput(turn) {
-    if (!validateAuthTurn(turn)) {
-        const detail = validateAuthTurn.errors
-            ?.map((error) => `${error.instancePath || "$"} ${error.message ?? "invalid"}`)
-            .join("; ");
-        throw new TurnValidationError(detail || "Invalid AuthTurn output");
+    // Evaluate the exact exported versioned schema without eagerly initializing
+    // a general-purpose JSON Schema compiler in every provider process. Contract
+    // parity tests compare this focused evaluator with AJV over all fixtures and
+    // edge probes, so the runtime and shipped document remain locked together.
+    const errors = [];
+    validateSchemaNode(turn, AUTH_TURN_SCHEMA, "", errors);
+    if (errors.length > 0) {
+        throw new TurnValidationError(errors.join("; "));
     }
     return turn;
 }

package/dist/config/loader.d.ts

@@ -1,4 +1,4 @@
-import { Redis } from "ioredis";
+import type { Redis } from "ioredis";
 import type { ProviderProxyPolicy, TraceConfig } from "../types.js";
 import { type ProxyProtocol } from "../runtime/proxy-nodemaven.js";
 export type { ProxyProtocol } from "../runtime/proxy-nodemaven.js";

package/dist/config/loader.js

@@ -1,7 +1,7 @@
 import { createHash, randomUUID } from "node:crypto";
 import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
 import path from "node:path";
-import { Redis } from "ioredis";
 import { NODEMAVEN_DEFAULT_PROTOCOL, NODEMAVEN_FILTER_ENV, NODEMAVEN_MAX_POOL_SIZE, NODEMAVEN_PASSWORD_ENV, NODEMAVEN_USERNAME_ENV, hasNodemavenCredentials, nodemavenPoolSize, synthesizeNodemavenProxy, } from "../runtime/proxy-nodemaven.js";
 // "smartproxy" here is api.smartproxy.org — a residential proxy with an IP
 // extraction API (app_key → raw ip:port pool). It is NOT the company formerly
@@ -34,6 +34,7 @@ export class ProxyResolutionError extends Error {
     }
 }
 const proxyCache = new Map();
+const require = createRequire(import.meta.url);
 const proxyInflight = new Map();
 const invalidatedProxyKeys = new Map();
 const redisClients = new Map();
@@ -84,7 +85,8 @@ function getProxyRedis() {
     const existing = redisClients.get(redisUrl);
     if (existing)
         return existing;
-    const redis = new Redis(redisUrl, {
+    const { Redis: RedisClient } = require("ioredis");
+    const redis = new RedisClient(redisUrl, {
         connectTimeout: REDIS_TIMEOUT_MS,
         enableOfflineQueue: false,
         lazyConnect: true,

package/dist/contract-serialization.d.ts

@@ -1,23 +1,4 @@
 import { type JsonValue } from "./contract-json.js";
 import type { SchemaLike } from "./types.js";
-interface DescribeSchemaOptions {
-    readonly eventName?: string;
-    readonly operationId?: string;
-    readonly outputTextTrust?: boolean;
-}
-export declare class OutputTextTrustProjectionError extends Error {
-    readonly schemaPath: string;
-    readonly operationId?: string | undefined;
-    readonly eventName?: string | undefined;
-    readonly classification: "untrusted";
-    readonly code = "output_text_trust_projection_failed";
-    constructor(schemaPath: string, cause: unknown, operationId?: string | undefined, eventName?: string | undefined);
-}
-export declare class OutputTextTrustProjectionMarkerError extends TypeError {
-    readonly schemaPath: string;
-    readonly code = "invalid_output_text_trust_projection_marker";
-    constructor(schemaPath: string);
-}
-export declare function describeSchema(schema: SchemaLike, options?: DescribeSchemaOptions): JsonValue;
+export declare function describeSchema(schema: SchemaLike): JsonValue;
 export declare function serializeSmsMatcher(value: Record<string, unknown>): Record<string, unknown>;
-export {};