@apifuse/provider-sdk 2.2.0-beta.26 → 2.2.0-beta.28

package/dist/stateful/errors.d.ts

@@ -1,4 +1,9 @@
 export type StatefulControlPlaneOperation = "resolve" | "acquire" | "renew" | "release";
+export declare class StatefulRoutingDeadlineError extends Error {
+    readonly requestId: string;
+    readonly deadlineAt: string;
+    constructor(requestId: string, deadlineAt: string);
+}
 export declare class StatefulControlPlaneError extends Error {
     readonly code: string;
     readonly operation: StatefulControlPlaneOperation;

package/dist/stateful/errors.js

@@ -1,3 +1,13 @@
+export class StatefulRoutingDeadlineError extends Error {
+    requestId;
+    deadlineAt;
+    constructor(requestId, deadlineAt) {
+        super(`Stateful operation request ${requestId} deadline has expired.`);
+        this.name = "StatefulRoutingDeadlineError";
+        this.requestId = requestId;
+        this.deadlineAt = deadlineAt;
+    }
+}
 export class StatefulControlPlaneError extends Error {
     code;
     operation;

package/dist/stateful/stateful-provider-session-routing.d.ts

@@ -40,11 +40,7 @@ export interface StatefulSessionRouterOptions {
     readonly clock?: () => Date;
     readonly metricEmitter?: StatefulProviderMetricEmitter;
 }
-export declare class StatefulRoutingDeadlineError extends Error {
-    readonly requestId: string;
-    readonly deadlineAt: string;
-    constructor(requestId: string, deadlineAt: string);
-}
+export { StatefulRoutingDeadlineError } from "./errors.js";
 export declare class StatefulRoutingOwnershipError extends Error {
     readonly requestId: string;
     readonly sessionKey: SessionKey;

package/dist/stateful/stateful-provider-session-routing.js

@@ -1,15 +1,7 @@
+import { StatefulRoutingDeadlineError } from "./errors.js";
 import { NOOP_STATEFUL_PROVIDER_METRIC_EMITTER, } from "./stateful-provider-observability.js";
 export { forwardingContextFromStatefulRuntimeContext, isStatefulOperationRuntimeContext, providerContextFromStatefulRuntimeContext, statefulForwardingContextFromProviderRequest, withStatefulLocalProviderContext, } from "./stateful-provider-runtime-context.js";
-export class StatefulRoutingDeadlineError extends Error {
-    requestId;
-    deadlineAt;
-    constructor(requestId, deadlineAt) {
-        super(`Stateful operation request ${requestId} deadline has expired.`);
-        this.name = "StatefulRoutingDeadlineError";
-        this.requestId = requestId;
-        this.deadlineAt = deadlineAt;
-    }
-}
+export { StatefulRoutingDeadlineError } from "./errors.js";
 export class StatefulRoutingOwnershipError extends Error {
     requestId;
     sessionKey;

package/dist/stream.js

@@ -41,16 +41,22 @@ function sseFieldValue(value, field) {
 }
 export async function* readableBytes(body) {
     const reader = body.getReader();
+    let completed = false;
     try {
         for (;;) {
             const { value, done } = await reader.read();
-            if (done)
+            if (done) {
+                completed = true;
                 return;
+            }
             if (value)
                 yield value;
         }
     }
     finally {
+        if (!completed) {
+            await reader.cancel().catch(() => undefined);
+        }
         reader.releaseLock();
     }
 }

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "2.2.0-beta.26",
+	"version": "2.2.0-beta.28",
 	"name": "@apifuse/provider-sdk",
 	"private": false,
 	"type": "module",
@@ -61,6 +61,31 @@
 			"import": "./dist/server/index.js",
 			"default": "./dist/server/index.js"
 		},
+		"./runtime/browser": {
+			"types": "./dist/runtime/browser.d.ts",
+			"import": "./dist/runtime/browser.js",
+			"default": "./dist/runtime/browser.js"
+		},
+		"./runtime/native-network": {
+			"types": "./dist/runtime/native-network.d.ts",
+			"import": "./dist/runtime/native-network.js",
+			"default": "./dist/runtime/native-network.js"
+		},
+		"./runtime/prevalidate": {
+			"types": "./dist/runtime/prevalidate.d.ts",
+			"import": "./dist/runtime/prevalidate.js",
+			"default": "./dist/runtime/prevalidate.js"
+		},
+		"./runtime/resolver": {
+			"types": "./dist/runtime/resolver.d.ts",
+			"import": "./dist/runtime/resolver.js",
+			"default": "./dist/runtime/resolver.js"
+		},
+		"./runtime/stealth": {
+			"types": "./dist/runtime/stealth.d.ts",
+			"import": "./dist/runtime/stealth.js",
+			"default": "./dist/runtime/stealth.js"
+		},
 		"./stateful": {
 			"types": "./dist/stateful/index.d.ts",
 			"import": "./dist/stateful/index.js",
@@ -97,6 +122,7 @@
 		"@biomejs/biome": "^2.5.0",
 		"@types/bun": "latest",
 		"@types/node": "^25.9.3",
+		"ajv": "^8.17",
 		"typescript": "6.0.3"
 	},
 	"dependencies": {
@@ -104,7 +130,6 @@
 		"@rgrove/parse-xml": "4.2.2",
 		"@types/ms": "^2.1.0",
 		"acorn": "^8.17.0",
-		"ajv": "^8.17",
 		"hono": "^4.12.25",
 		"ioredis": "^5.11.1",
 		"ms": "^2.1.3",

package/src/auth-turn/index.ts

@@ -24,7 +24,7 @@ export const AUTH_TURN_SCHEMA_ARTIFACT_PATH = "dist/auth-turn/auth-turn.v1.schem
  *
  * This is the exact codification of the runtime validation the SDK applies to
  * ceremony outputs (see `validateCeremonyOutput` in `src/ceremonies`), which
- * compiles this same document. `kind` is an OPEN string on the wire: the known
+ * evaluates this same document. `kind` is an OPEN string on the wire: the known
  * kinds in {@link TURN_KINDS} are tooling metadata, never a wire constraint.
  *
  * The committed artifact at `src/auth-turn/auth-turn.v1.schema.json` (shipped

package/src/ceremonies/index.ts

@@ -1,7 +1,5 @@
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 
-import Ajv2020 from "ajv/dist/2020.js";
-
 import { AUTH_TURN_SCHEMA, type KnownAuthTurnKind } from "../auth-turn/index.js";
 import {
 	FlowExpiredError,
@@ -16,13 +14,14 @@ type TurnKind = KnownAuthTurnKind;
 type CeremonyHandler = AuthFlowInputHandler;
 
 type JsonObject = Record<string, unknown>;
-
-const ajv = new Ajv2020({ allErrors: true, strict: true, strictSchema: true });
-
-// Runtime ceremony-output validation derives from the exported versioned
-// contract: it compiles the exact AUTH_TURN_SCHEMA document shipped at
-// dist/auth-turn/auth-turn.v1.schema.json, so the two cannot drift.
-const validateAuthTurn = ajv.compile(AUTH_TURN_SCHEMA);
+type JsonSchemaNode = {
+	readonly additionalProperties?: boolean;
+	readonly minimum?: number;
+	readonly minLength?: number;
+	readonly properties?: Readonly<Record<string, JsonSchemaNode>>;
+	readonly required?: readonly string[];
+	readonly type?: "number" | "object" | "string";
+};
 
 const OAUTH2_STATE_KEY = "__oauth2_state";
 const OAUTH2_PKCE_VERIFIER_KEY = "__oauth2_pkce_verifier";
@@ -45,6 +44,56 @@ function isRecord(value: unknown): value is JsonObject {
 	return !!value && typeof value === "object" && !Array.isArray(value);
 }
 
+function validateSchemaNode(
+	value: unknown,
+	schema: JsonSchemaNode,
+	path: string,
+	errors: string[],
+): void {
+	if (schema.type === "object") {
+		if (!isRecord(value)) {
+			errors.push(`${path} must be object`);
+			return;
+		}
+		const properties = schema.properties ?? {};
+		for (const required of schema.required ?? []) {
+			if (!Object.hasOwn(value, required) || value[required] === undefined) {
+				errors.push(`${path} must have required property '${required}'`);
+			}
+		}
+		if (schema.additionalProperties === false) {
+			for (const key of Object.keys(value)) {
+				if (!Object.hasOwn(properties, key)) {
+					errors.push(`${path} must NOT have additional property '${key}'`);
+				}
+			}
+		}
+		for (const [key, childSchema] of Object.entries(properties)) {
+			if (Object.hasOwn(value, key) && value[key] !== undefined) {
+				validateSchemaNode(value[key], childSchema, `${path}/${key}`, errors);
+			}
+		}
+		return;
+	}
+
+	if (schema.type === "string") {
+		if (typeof value !== "string") {
+			errors.push(`${path} must be string`);
+		} else if (schema.minLength !== undefined && value.length < schema.minLength) {
+			errors.push(`${path} must NOT have fewer than ${schema.minLength} characters`);
+		}
+		return;
+	}
+
+	if (schema.type === "number") {
+		if (typeof value !== "number" || !Number.isFinite(value)) {
+			errors.push(`${path} must be number`);
+		} else if (schema.minimum !== undefined && value < schema.minimum) {
+			errors.push(`${path} must be >= ${schema.minimum}`);
+		}
+	}
+}
+
 function ensureRecord(value: unknown): JsonObject {
 	return isRecord(value) ? value : {};
 }
@@ -162,14 +211,17 @@ function withDeclaredFormFieldOrder(expectedInput: JsonObject): JsonObject {
 }
 
 export function validateCeremonyOutput(turn: unknown): AuthTurn {
-	if (!validateAuthTurn(turn)) {
-		const detail = validateAuthTurn.errors
-			?.map((error) => `${error.instancePath || "$"} ${error.message ?? "invalid"}`)
-			.join("; ");
-		throw new TurnValidationError(detail || "Invalid AuthTurn output");
+	// Evaluate the exact exported versioned schema without eagerly initializing
+	// a general-purpose JSON Schema compiler in every provider process. Contract
+	// parity tests compare this focused evaluator with AJV over all fixtures and
+	// edge probes, so the runtime and shipped document remain locked together.
+	const errors: string[] = [];
+	validateSchemaNode(turn, AUTH_TURN_SCHEMA, "", errors);
+	if (errors.length > 0) {
+		throw new TurnValidationError(errors.join("; "));
 	}
 
-	return turn;
+	return turn as AuthTurn;
 }
 
 export function createOAuth2Ceremony(options: {
@@ -285,9 +337,7 @@ export function createOAuth2ProxiedStart(
 				}
 				const clientId = getRequiredEnv(ctx, options.clientIdEnvKey);
 				if (!ctx.flowId) {
-					throw new ValidationError(
-						"OAuth2 proxied start requires the gateway flow id.",
-					);
+					throw new ValidationError("OAuth2 proxied start requires the gateway flow id.");
 				}
 
 				const authorizePath = new URL(options.authorizeUrl).pathname;

package/src/config/loader.ts

@@ -1,8 +1,9 @@
 import { createHash, randomUUID } from "node:crypto";
 import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
 import path from "node:path";
 
-import { Redis } from "ioredis";
+import type { Redis } from "ioredis";
 
 import type { ProviderProxyPolicy, ProviderProxyProvider, TraceConfig } from "../types.js";
 import {
@@ -217,6 +218,7 @@ type ProxyRedisClient = Pick<
 >;
 
 const proxyCache = new Map<string, CachedProxyPool>();
+const require = createRequire(import.meta.url);
 const proxyInflight = new Map<string, Promise<SmartproxyAllocationResult>>();
 const invalidatedProxyKeys = new Map<string, number>();
 const redisClients = new Map<string, ProxyRedisClient>();
@@ -276,7 +278,8 @@ function getProxyRedis(): ProxyRedisClient | undefined {
 	const existing = redisClients.get(redisUrl);
 	if (existing) return existing;
 
-	const redis = new Redis(redisUrl, {
+	const { Redis: RedisClient } = require("ioredis") as typeof import("ioredis");
+	const redis = new RedisClient(redisUrl, {
 		connectTimeout: REDIS_TIMEOUT_MS,
 		enableOfflineQueue: false,
 		lazyConnect: true,