@apifuse/provider-sdk 2.2.0-beta.27 → 2.2.0-beta.28

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # @apifuse/provider-sdk Changelog
 
+## 2.2.0-beta.28
+
+- Release candidate for main commit 2936f1891d4e2326502f0585081f8a58060d6dd7.
+
 ## 2.2.0-beta.27
 
 - Release candidate for main commit 579d9e7fd22d8414b151be2b71a43a0990456911.

package/bin/apifuse-dev.ts

@@ -4,7 +4,6 @@ import { existsSync } from "node:fs";
 import { dirname, relative, resolve } from "node:path";
 import type { ProviderDefinition } from "../src/index.js";
 import {
-	createBrowserClient,
 	createCredentialContext,
 	createEnvContext,
 	createHttpClient,
@@ -12,12 +11,13 @@ import {
 	createProviderCache,
 	createProviderChoiceContext,
 	createUnsupportedResolverClient,
-	createStealthClient,
 	createSttClientFromEnv,
 	PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV,
 	ProviderError,
 } from "../src/index.js";
+import { createBrowserClient } from "../src/runtime/browser.js";
 import { createMemoryProviderRuntimeState } from "../src/runtime/state.js";
+import { createStealthClient } from "../src/runtime/stealth.js";
 import { createTraceContext } from "../src/runtime/trace.js";
 import type { BrowserClient, ProviderContext } from "../src/types.js";
 

package/bin/apifuse-pack-smoke.ts

@@ -224,7 +224,7 @@ function smokePackedStealthNative(consumerDir: string): void {
 			"--eval",
 			[
 				'import { createServer } from "node:http";',
-				'import { createStealthClient } from "@apifuse/provider-sdk";',
+				'import { createStealthClient } from "@apifuse/provider-sdk/runtime/stealth";',
 				"const server = createServer((_request, response) => {",
 				'  response.setHeader("set-cookie", "pack_native_cookie=landed; Path=/");',
 				'  response.end("packed native stealth ok");',

package/bin/apifuse-pack-types.ts

@@ -357,7 +357,8 @@ function setUpFixtureConsumer(consumerDir: string, tarballPath: string): void {
 	writeFileSync(
 		join(consumerDir, "consumer.ts"),
 		[
-			'import { defineProvider, invalidateResolverSolution, ProviderError, resolveProxy, SessionExpiredError, z } from "@apifuse/provider-sdk";',
+			'import { defineProvider, ProviderError, resolveProxy, SessionExpiredError, z } from "@apifuse/provider-sdk";',
+			'import { invalidateResolverSolution } from "@apifuse/provider-sdk/runtime/resolver";',
 			'import type { BrowserCookie, ChallengeSolution, NativeNetworkClient, NativeNetworkConnection, NativeProviderConfig, NativeProviderContext, NativeTcpEgressGrant, ProviderChallenge, ProviderContext, ProviderFileRef, ProviderFilesContext, ProviderResolvedFile, ProviderResolverConfig, ResolverContext, ResolverRuntimeOptions } from "@apifuse/provider-sdk";',
 			'import type { ProxyProtocol, ProxyResolutionOptions, ProxyResolutionSource, ProxyVendorName, RequestOptions, ResolvedProxyConfig } from "@apifuse/provider-sdk";',
 			'import { defineCredentialsAuth } from "@apifuse/provider-sdk/provider";',

package/bin/apifuse-perf.ts

@@ -11,7 +11,6 @@ import {
 	createBypassProviderCache,
 	createHttpClient,
 	createProviderChoiceContext,
-	createStealthClient,
 	createSttClientFromEnv,
 	executeOperation,
 	getProviderBaseUrl,
@@ -28,6 +27,7 @@ import {
 } from "../src/index.js";
 import { computeStats, groupSpansByName, type PerfStats } from "../src/runtime/perf.js";
 import { createMemoryProviderRuntimeState } from "../src/runtime/state.js";
+import { createStealthClient } from "../src/runtime/stealth.js";
 import { createTraceContext, resolveTraceContextOptions } from "../src/runtime/trace.js";
 import { renderWaterfall } from "../src/runtime/waterfall.js";
 import type { BrowserClient } from "../src/types.js";
@@ -458,9 +458,7 @@ async function loadFixtureReplay(providerDirectory: string): Promise<FixtureRepl
 async function assertProxyConfigured(provider: ProviderDefinition): Promise<void> {
 	const policy = provider.proxy;
 	if (!policy || typeof policy !== "object" || policy.mode === "disabled") {
-		throw new Error(
-			"--compare-proxy requires an enabled ProviderProxyPolicy on the provider.",
-		);
+		throw new Error("--compare-proxy requires an enabled ProviderProxyPolicy on the provider.");
 	}
 
 	const resolved = await resolveProxy({ proxyPolicy: policy });

package/bin/apifuse-record.ts

@@ -10,7 +10,6 @@ import {
 	createHttpClient,
 	createOcrClientFromEnv,
 	createProviderChoiceContext,
-	createStealthClient,
 	createSttClientFromEnv,
 	createUnsupportedResolverClient,
 	executeOperation,
@@ -33,6 +32,7 @@ import {
 	sanitizeFixtureString,
 } from "../src/fixture-sanitization.js";
 import { createMemoryProviderRuntimeState } from "../src/runtime/state.js";
+import { createStealthClient } from "../src/runtime/stealth.js";
 import {
 	REDACTED_QUERY_VALUE,
 	isSensitiveKey,

package/dist/auth-turn/index.d.ts

@@ -20,7 +20,7 @@ export declare const AUTH_TURN_SCHEMA_ARTIFACT_PATH = "dist/auth-turn/auth-turn.
  *
  * This is the exact codification of the runtime validation the SDK applies to
  * ceremony outputs (see `validateCeremonyOutput` in `src/ceremonies`), which
- * compiles this same document. `kind` is an OPEN string on the wire: the known
+ * evaluates this same document. `kind` is an OPEN string on the wire: the known
  * kinds in {@link TURN_KINDS} are tooling metadata, never a wire constraint.
  *
  * The committed artifact at `src/auth-turn/auth-turn.v1.schema.json` (shipped

package/dist/auth-turn/index.js

@@ -18,7 +18,7 @@ export const AUTH_TURN_SCHEMA_ARTIFACT_PATH = "dist/auth-turn/auth-turn.v1.schem
  *
  * This is the exact codification of the runtime validation the SDK applies to
  * ceremony outputs (see `validateCeremonyOutput` in `src/ceremonies`), which
- * compiles this same document. `kind` is an OPEN string on the wire: the known
+ * evaluates this same document. `kind` is an OPEN string on the wire: the known
  * kinds in {@link TURN_KINDS} are tooling metadata, never a wire constraint.
  *
  * The committed artifact at `src/auth-turn/auth-turn.v1.schema.json` (shipped

package/dist/ceremonies/index.js

@@ -1,12 +1,6 @@
 import { createHash, randomBytes, randomUUID } from "node:crypto";
-import Ajv2020 from "ajv/dist/2020.js";
 import { AUTH_TURN_SCHEMA } from "../auth-turn/index.js";
 import { FlowExpiredError, ProviderSecretError, TurnValidationError, ValidationError, } from "../errors.js";
-const ajv = new Ajv2020({ allErrors: true, strict: true, strictSchema: true });
-// Runtime ceremony-output validation derives from the exported versioned
-// contract: it compiles the exact AUTH_TURN_SCHEMA document shipped at
-// dist/auth-turn/auth-turn.v1.schema.json, so the two cannot drift.
-const validateAuthTurn = ajv.compile(AUTH_TURN_SCHEMA);
 const OAUTH2_STATE_KEY = "__oauth2_state";
 const OAUTH2_PKCE_VERIFIER_KEY = "__oauth2_pkce_verifier";
 export const OAUTH2_PROXIED_AUTH_PROXY_ORIGIN_ENV_KEY = "APIFUSE__AUTH_PROXY__URL";
@@ -26,6 +20,50 @@ const FORM_FIELD_ORDER_EXTENSION = "x-apifuse-field-order";
 function isRecord(value) {
     return !!value && typeof value === "object" && !Array.isArray(value);
 }
+function validateSchemaNode(value, schema, path, errors) {
+    if (schema.type === "object") {
+        if (!isRecord(value)) {
+            errors.push(`${path} must be object`);
+            return;
+        }
+        const properties = schema.properties ?? {};
+        for (const required of schema.required ?? []) {
+            if (!Object.hasOwn(value, required) || value[required] === undefined) {
+                errors.push(`${path} must have required property '${required}'`);
+            }
+        }
+        if (schema.additionalProperties === false) {
+            for (const key of Object.keys(value)) {
+                if (!Object.hasOwn(properties, key)) {
+                    errors.push(`${path} must NOT have additional property '${key}'`);
+                }
+            }
+        }
+        for (const [key, childSchema] of Object.entries(properties)) {
+            if (Object.hasOwn(value, key) && value[key] !== undefined) {
+                validateSchemaNode(value[key], childSchema, `${path}/${key}`, errors);
+            }
+        }
+        return;
+    }
+    if (schema.type === "string") {
+        if (typeof value !== "string") {
+            errors.push(`${path} must be string`);
+        }
+        else if (schema.minLength !== undefined && value.length < schema.minLength) {
+            errors.push(`${path} must NOT have fewer than ${schema.minLength} characters`);
+        }
+        return;
+    }
+    if (schema.type === "number") {
+        if (typeof value !== "number" || !Number.isFinite(value)) {
+            errors.push(`${path} must be number`);
+        }
+        else if (schema.minimum !== undefined && value < schema.minimum) {
+            errors.push(`${path} must be >= ${schema.minimum}`);
+        }
+    }
+}
 function ensureRecord(value) {
     return isRecord(value) ? value : {};
 }
@@ -114,11 +152,14 @@ function withDeclaredFormFieldOrder(expectedInput) {
     };
 }
 export function validateCeremonyOutput(turn) {
-    if (!validateAuthTurn(turn)) {
-        const detail = validateAuthTurn.errors
-            ?.map((error) => `${error.instancePath || "$"} ${error.message ?? "invalid"}`)
-            .join("; ");
-        throw new TurnValidationError(detail || "Invalid AuthTurn output");
+    // Evaluate the exact exported versioned schema without eagerly initializing
+    // a general-purpose JSON Schema compiler in every provider process. Contract
+    // parity tests compare this focused evaluator with AJV over all fixtures and
+    // edge probes, so the runtime and shipped document remain locked together.
+    const errors = [];
+    validateSchemaNode(turn, AUTH_TURN_SCHEMA, "", errors);
+    if (errors.length > 0) {
+        throw new TurnValidationError(errors.join("; "));
     }
     return turn;
 }

package/dist/config/loader.d.ts

@@ -1,4 +1,4 @@
-import { Redis } from "ioredis";
+import type { Redis } from "ioredis";
 import type { ProviderProxyPolicy, TraceConfig } from "../types.js";
 import { type ProxyProtocol } from "../runtime/proxy-nodemaven.js";
 export type { ProxyProtocol } from "../runtime/proxy-nodemaven.js";

package/dist/config/loader.js

@@ -1,7 +1,7 @@
 import { createHash, randomUUID } from "node:crypto";
 import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
 import path from "node:path";
-import { Redis } from "ioredis";
 import { NODEMAVEN_DEFAULT_PROTOCOL, NODEMAVEN_FILTER_ENV, NODEMAVEN_MAX_POOL_SIZE, NODEMAVEN_PASSWORD_ENV, NODEMAVEN_USERNAME_ENV, hasNodemavenCredentials, nodemavenPoolSize, synthesizeNodemavenProxy, } from "../runtime/proxy-nodemaven.js";
 // "smartproxy" here is api.smartproxy.org — a residential proxy with an IP
 // extraction API (app_key → raw ip:port pool). It is NOT the company formerly
@@ -34,6 +34,7 @@ export class ProxyResolutionError extends Error {
     }
 }
 const proxyCache = new Map();
+const require = createRequire(import.meta.url);
 const proxyInflight = new Map();
 const invalidatedProxyKeys = new Map();
 const redisClients = new Map();
@@ -84,7 +85,8 @@ function getProxyRedis() {
     const existing = redisClients.get(redisUrl);
     if (existing)
         return existing;
-    const redis = new Redis(redisUrl, {
+    const { Redis: RedisClient } = require("ioredis");
+    const redis = new RedisClient(redisUrl, {
         connectTimeout: REDIS_TIMEOUT_MS,
         enableOfflineQueue: false,
         lazyConnect: true,

package/dist/index.d.ts

@@ -16,29 +16,30 @@ export * from "./recipes/gov-api.js";
 export * from "./recipes/rest-api.js";
 export { createFlowContext, createScratchpad } from "./runtime/auth-flow.js";
 export type { BrowserClientOptions } from "./runtime/browser.js";
-export { BrowserClient, createBrowserClient } from "./runtime/browser.js";
 export { APIFUSE__CACHE__KEY_PEPPER_ENV, createBypassProviderCache, createProviderCache, type ProviderCacheOptions, resetProviderCacheForTests, } from "./runtime/cache.js";
 export { type CreateProviderChoiceContextOptions, createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice.js";
 export { type CreateCredentialContextOptions, createCredentialContext, } from "./runtime/credential.js";
 export { createEnvContext } from "./runtime/env.js";
 export { executeOperation } from "./runtime/executor.js";
 export { createHttpClient } from "./runtime/http.js";
-export { createNativeNetworkClient, createEnvVendorCredentialResolver, deriveNativeCredentialAffinityKey, NativeEgressGrantExpiredError, NativeEgressNotDeclaredError, NativeIdleTimeoutError, NativeNetworkError, NativeProxyExpiredError, resolveNativeGatewayProxy, type NativeGatewayProxy, type NativeGatewayProxyResolutionInput, type NativeGatewayProxySkipReason, type NativeGatewayProxySynthesizer, type NativeGatewayProxySynthesisResult, type NativeGatewayProxySynthesisInput, type NativeNetworkClientOptions, type NativeNetworkErrorCode, type VendorCredentialLookup, type VendorCredentialResolver, } from "./runtime/native-network.js";
+export { NativeEgressGrantExpiredError, NativeEgressNotDeclaredError, NativeIdleTimeoutError, NativeNetworkError, NativeProxyExpiredError, } from "./runtime/native-network-errors.js";
+export type { NativeGatewayProxy, NativeGatewayProxyResolutionInput, NativeGatewayProxySkipReason, NativeGatewayProxySynthesizer, NativeGatewayProxySynthesisResult, NativeGatewayProxySynthesisInput, NativeNetworkClientOptions, NativeNetworkErrorCode, VendorCredentialLookup, VendorCredentialResolver, } from "./runtime/native-network.js";
 export type { Insight, InsightSeverity } from "./runtime/insights.js";
 export { generateInsights } from "./runtime/insights.js";
 export { type InstrumentationOptions, type InstrumentedProviderContext, wrapWithInstrumentation, } from "./runtime/instrumentation.js";
-export { type PrevalidateResult, prevalidate } from "./runtime/prevalidate.js";
+export type { PrevalidateResult } from "./runtime/prevalidate.js";
 export { getProviderBaseUrl } from "./runtime/provider.js";
-export { APIFUSE__CDP_POOL__URL, APIFUSE__RESOLVER__2CAPTCHA__API_KEY, APIFUSE__RESOLVER__CAPMONSTER__API_KEY, APIFUSE__RESOLVER__CAPSOLVER__API_KEY, APIFUSE__RESOLVER__TIMEOUT_MS, createResolverClientFromEnv, createUnsupportedResolverClient, DEFAULT_RESOLVER_TIMEOUT_MS, invalidateResolverSolution, type ResolverRuntimeOptions, } from "./runtime/resolver.js";
+export { APIFUSE__CDP_POOL__URL, APIFUSE__RESOLVER__2CAPTCHA__API_KEY, APIFUSE__RESOLVER__CAPMONSTER__API_KEY, APIFUSE__RESOLVER__CAPSOLVER__API_KEY, APIFUSE__RESOLVER__TIMEOUT_MS, DEFAULT_RESOLVER_TIMEOUT_MS, } from "./runtime/resolver-config.js";
+export { createUnsupportedResolverClient } from "./runtime/resolver-shared.js";
+export type { ResolverRuntimeOptions } from "./runtime/resolver.js";
 export type { ResolverVendorTransport } from "./runtime/resolver-vendors/types.js";
 export { assertRequiredSecretsPresent, listMissingRequiredSecrets, MISSING_SECRET_CODE, } from "./runtime/secrets.js";
 export { createUnsupportedProviderRuntimeState, UnsupportedProviderStateError, } from "./runtime/state.js";
-export { createStealthClient } from "./runtime/stealth.js";
 export { APIFUSE__OCR__API_KEY_ENV, APIFUSE__OCR__BACKEND_ENV, APIFUSE__OCR__BASE_URL_ENV, APIFUSE__OCR__CLOUDFLARE_API_TOKEN_ENV, APIFUSE__OCR__MODEL_ENV, CLOUDFLARE_ACCOUNT_ID_ENV, CLOUDFLARE_WORKERS_AI_OCR_BACKEND, createCloudflareWorkersAiOcrClient, createOcrClientFromEnv, createOpenAiCompatibleOcrClient, createUnsupportedOcrClient, DEFAULT_CLOUDFLARE_WORKERS_AI_OCR_MODEL, extractCaptchaCandidates, OPENAI_COMPATIBLE_OCR_BACKEND, } from "./runtime/ocr.js";
 export { APIFUSE__STT__BACKEND_ENV, APIFUSE__STT__CLOUDFLARE_API_TOKEN_ENV, APIFUSE__STT__MODEL_ENV, createSttClientFromEnv, createUnsupportedSttClient, extractVerificationCode, resolveSttPrompt, } from "./runtime/stt.js";
 export { type CreateTraceContextOptions, createTraceContext, type Span, type TraceContext, } from "./runtime/trace.js";
 export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, type SensitiveFieldKind, type SensitiveFieldOptions, type SensitivePath, sensitive, z, } from "./schema.js";
-export { createServerApp, ERROR_OBSERVABILITY_HEADER, type ServeOptions, serve, } from "./server/index.js";
+export { createServerApp, createServerAppAsync, ERROR_OBSERVABILITY_HEADER, type ServeOptions, serve, } from "./server/serve.js";
 export { getStealthProfile, listStealthProfiles } from "./stealth/profiles.js";
 export * from "./stream.js";
 export type { ApiFuseResponse, AuthConfig, AuthContext, AuthFlowDefinition, AuthFlowInputHandler, AuthFlowStartHandler, AuthMode, AuthTurn, Bcp47Locale, BrowserCookie, BrowserEngine, BrowserOptions, BrowserResourceBody, BrowserResourceDecision, BrowserResourceMethod, BrowserResourcePolicy, BrowserResourceRequest, BrowserResourceRoute, ChallengeSolution, ConnectionMode, ContextDeclaration, CookieJar, ContextScratchpad, CredentialContext, CredentialDeclaration, E164PhoneNumber, EnvContext, FlowContext, FlowContextStore, HealthCheckAssertionContext, HealthCheckCase, HealthCheckCaseResult, HealthCheckSuite, HealthCheckUnsupported, HealthJourneyDefinition, HealthJourneyEventContext, HealthJourneyGatewayContext, HealthJourneyJournalContext, HealthJourneyManualTriggerPolicy, HealthJourneyRunContext, HealthJourneyRunResult, HealthJourneySchedule, HealthScheduleRandomization, HealthJourneySmsContext, HealthJourneyStep, HttpClient, HttpMethod, HttpRedirectFailureReason, HttpRedirectPolicy, HttpRedirectPolicyMode, HttpResponse, HttpRetryOptions, HttpRetrySummary, HttpStreamResponse, IanaTimeZone, InferSchemaOutput, Iso3166Alpha2CountryCode, Iso4217CurrencyCode, Iso8601Duration, NativeContext, NativeNetworkClient, NativeNetworkCloseReason, NativeNetworkConnection, NativeNetworkConnectInput, NativeNetworkConnectOptions, NativeNetworkDynamicGrantOptions, NativeNetworkEgressGrant, NativeProviderConfig, NativeProviderContext, NativeProxyDrainHandler, NativeProxyEgressInfo, NativeProxyExpiringEvent, NativeProxyExpiringReason, NativeTcpDynamicEgressRule, NativeTcpEgressGrant, NativeTcpEgressRule, NativeTcpPortRange, NativeTcpTlsMode, NativeTlsConnectOptions, OcrCaptchaCandidate, OcrCaptchaOptions, OcrCaptchaResult, OcrContext, OcrImageInput, OcrRecognizeRequest, OcrResult, OcrWarning, OperationAnnotations, OperationApprovalPolicy, OperationContractMetadata, OperationDefinition, OperationDeprecationMetadata, OperationDocMeta, OperationErrorCode, ProviderErrorStatus, OperationHandlerResult, OperationInputExample, OperationLifecycle, OperationObservabilityConfig, OperationObservabilitySensitiveConfig, OperationRelationships, OperationRiskClass, OperationSensitivePath, OperationToolRouterMetadata, OperationTransport, OperationTransportKind, ProbeInterval, ProviderAccessConfig, ProviderAccessVisibility, ProviderCache, ProviderCacheGetOrSetOptions, ProviderCacheKeyOptions, ProviderCacheLookupMeta, ProviderCacheResponseMeta, ProviderCacheResult, ProviderChoiceBindingOptions, ProviderChoiceContext, ProviderChoiceIssueOptions, ProviderChoiceParseOptions, ProviderChallenge, ProviderChallengeKind, ProviderContext, ProviderDefinition, ProviderDeploymentOverrides, ProviderFileRef, ProviderFilesContext, ProviderHealthMonitorConfig, ProviderHealthProbeConfig, ProviderLocale, ProviderLocaleKey, ProviderLocaleKeyInput, ProviderLogoProfile, ProviderLogoSource, ProviderMeta, ProviderOcrConfig, ProviderProxyConfig, ProviderProxyMode, ProviderProxyPolicy, ProxiedOAuthConfig, ProviderProxyProvider, ProviderProxySessionAffinity, ProviderPublicConnectionMode, ProviderPublicProfile, ProviderReviewed, ProviderResolvedFile, ProviderResolverConfig, ProviderResolverVendor, ProviderRuntimeState, ProviderSecretDeclaration, ProviderStateDurationString, ProviderStateNamespace, ProviderStreamEvent, ProviderSttConfig, ProviderSttMode, ProviderSupportLevel, RequestOptions, RedirectRunReason, ResolverContext, Rfc3339Instant, SchemaLike, SmsOrigin, SmsOtpExtractionPattern, SmsOtpMatcherDefinition, SseMessage, StandardSchemaV1, StateCasResult, StateNamespaceOptions, StateNamespaceScope, StateValue, StateWriteOptions, StealthClient, StealthCookieStore, StealthCookieStoreV1, StealthFetchOptions, StealthPlatform, StealthProfile, StealthRedirectHop, StealthRedirectRunOptions, StealthRedirectRunResult, StealthResponse, StealthSession, StealthSessionCookies, SttAudioInput, SttContext, SttPromptPolicy, SttSegment, SttTranscribeMode, SttTranscribeRequest, SttTranscript, SttUnsupportedOptionPolicy, SttUsage, SttVerificationCodeOptions, SttWarning, TraceConfig, TraceSpan, VerificationCodeCandidate, VerificationCodeCandidateSource, VerificationCodeExtractionResult, } from "./types.js";

package/dist/index.js

@@ -14,27 +14,25 @@ export { lintOperation, lintProvider, } from "./lint.js";
 export * from "./recipes/gov-api.js";
 export * from "./recipes/rest-api.js";
 export { createFlowContext, createScratchpad } from "./runtime/auth-flow.js";
-export { BrowserClient, createBrowserClient } from "./runtime/browser.js";
 export { APIFUSE__CACHE__KEY_PEPPER_ENV, createBypassProviderCache, createProviderCache, resetProviderCacheForTests, } from "./runtime/cache.js";
 export { createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice.js";
 export { createCredentialContext, } from "./runtime/credential.js";
 export { createEnvContext } from "./runtime/env.js";
 export { executeOperation } from "./runtime/executor.js";
 export { createHttpClient } from "./runtime/http.js";
-export { createNativeNetworkClient, createEnvVendorCredentialResolver, deriveNativeCredentialAffinityKey, NativeEgressGrantExpiredError, NativeEgressNotDeclaredError, NativeIdleTimeoutError, NativeNetworkError, NativeProxyExpiredError, resolveNativeGatewayProxy, } from "./runtime/native-network.js";
+export { NativeEgressGrantExpiredError, NativeEgressNotDeclaredError, NativeIdleTimeoutError, NativeNetworkError, NativeProxyExpiredError, } from "./runtime/native-network-errors.js";
 export { generateInsights } from "./runtime/insights.js";
 export { wrapWithInstrumentation, } from "./runtime/instrumentation.js";
-export { prevalidate } from "./runtime/prevalidate.js";
 export { getProviderBaseUrl } from "./runtime/provider.js";
-export { APIFUSE__CDP_POOL__URL, APIFUSE__RESOLVER__2CAPTCHA__API_KEY, APIFUSE__RESOLVER__CAPMONSTER__API_KEY, APIFUSE__RESOLVER__CAPSOLVER__API_KEY, APIFUSE__RESOLVER__TIMEOUT_MS, createResolverClientFromEnv, createUnsupportedResolverClient, DEFAULT_RESOLVER_TIMEOUT_MS, invalidateResolverSolution, } from "./runtime/resolver.js";
+export { APIFUSE__CDP_POOL__URL, APIFUSE__RESOLVER__2CAPTCHA__API_KEY, APIFUSE__RESOLVER__CAPMONSTER__API_KEY, APIFUSE__RESOLVER__CAPSOLVER__API_KEY, APIFUSE__RESOLVER__TIMEOUT_MS, DEFAULT_RESOLVER_TIMEOUT_MS, } from "./runtime/resolver-config.js";
+export { createUnsupportedResolverClient } from "./runtime/resolver-shared.js";
 export { assertRequiredSecretsPresent, listMissingRequiredSecrets, MISSING_SECRET_CODE, } from "./runtime/secrets.js";
 export { createUnsupportedProviderRuntimeState, UnsupportedProviderStateError, } from "./runtime/state.js";
-export { createStealthClient } from "./runtime/stealth.js";
 export { APIFUSE__OCR__API_KEY_ENV, APIFUSE__OCR__BACKEND_ENV, APIFUSE__OCR__BASE_URL_ENV, APIFUSE__OCR__CLOUDFLARE_API_TOKEN_ENV, APIFUSE__OCR__MODEL_ENV, CLOUDFLARE_ACCOUNT_ID_ENV, CLOUDFLARE_WORKERS_AI_OCR_BACKEND, createCloudflareWorkersAiOcrClient, createOcrClientFromEnv, createOpenAiCompatibleOcrClient, createUnsupportedOcrClient, DEFAULT_CLOUDFLARE_WORKERS_AI_OCR_MODEL, extractCaptchaCandidates, OPENAI_COMPATIBLE_OCR_BACKEND, } from "./runtime/ocr.js";
 export { APIFUSE__STT__BACKEND_ENV, APIFUSE__STT__CLOUDFLARE_API_TOKEN_ENV, APIFUSE__STT__MODEL_ENV, createSttClientFromEnv, createUnsupportedSttClient, extractVerificationCode, resolveSttPrompt, } from "./runtime/stt.js";
 export { createTraceContext, } from "./runtime/trace.js";
 export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, sensitive, z, } from "./schema.js";
-export { createServerApp, ERROR_OBSERVABILITY_HEADER, serve, } from "./server/index.js";
+export { createServerApp, createServerAppAsync, ERROR_OBSERVABILITY_HEADER, serve, } from "./server/serve.js";
 export { getStealthProfile, listStealthProfiles } from "./stealth/profiles.js";
 export * from "./stream.js";
 export { DEFAULT_OPERATION_TRANSPORT, HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, PROBE_INTERVALS, STREAM_CHUNK_BYTES_MAX, STREAM_CHUNK_BYTES_MIN, STREAM_HEARTBEAT_MS_MAX, STREAM_HEARTBEAT_MS_MIN, STREAM_IDLE_TIMEOUT_MS_MAX, STREAM_IDLE_TIMEOUT_MS_MIN, STREAM_MAX_DURATION_MS_MAX, STREAM_MAX_DURATION_MS_MIN, } from "./types.js";

package/dist/provider.d.ts

@@ -8,5 +8,6 @@ export { getProviderLocalePath, providerLocaleKey, qualifyProviderLocaleKey, } f
 export { type CreateProviderChoiceContextOptions, createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice.js";
 export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, type SensitiveFieldKind, type SensitiveFieldOptions, type SensitivePath, sensitive, z, } from "./schema.js";
 export type { AuthAbortData, AuthAbortRetry, AuthFlowTerminalContext, AuthMode, AuthSafeData, AuthSafeJson, FlowContext, HealthCheckAssertionContext, HealthCheckCase, HealthCheckSuite, HealthCheckUnsupported, HealthJourneyDefinition, HealthJourneyEventContext, HealthJourneyManualTriggerPolicy, HealthJourneyRunContext, HealthJourneyRunResult, HealthScheduleRandomization, HttpRedirectFailureReason, HttpRedirectPolicy, HttpRedirectPolicyMode, HttpRetryOptions, HttpRetrySummary, InferSchemaOutput, NativeContext, NativeNetworkClient, NativeNetworkCloseReason, NativeNetworkConnection, NativeNetworkConnectInput, NativeNetworkConnectOptions, NativeNetworkDynamicGrantOptions, NativeNetworkEgressGrant, NativeProviderConfig, NativeProviderContext, NativeProxyDrainHandler, NativeProxyEgressInfo, NativeProxyExpiringEvent, NativeProxyExpiringReason, NativeTcpDynamicEgressRule, NativeTcpEgressGrant, NativeTcpEgressRule, NativeTcpPortRange, NativeTcpTlsMode, NativeTlsConnectOptions, OperationApprovalPolicy, OperationContractMetadata, OperationDefinition, OperationDocMeta, OperationErrorCode, ProviderErrorStatus, OperationInputExample, OperationLifecycle, OperationObservabilityConfig, OperationObservabilitySensitiveConfig, OperationRelationships, OperationRiskClass, OperationSensitivePath, OperationToolRouterMetadata, OperationTransport, ProviderAccessVisibility, ProviderChoiceBindingOptions, ProviderChoiceContext, ProviderChoiceIssueOptions, ProviderChoiceParseOptions, ProviderContext, ProviderDefinition, ProviderDeploymentOverrides, ProviderFileRef, ProviderFilesContext, ProviderLocale, ProviderLocaleKey, ProviderLocaleKeyInput, ProviderLogoProfile, ProviderProxyPolicy, ProxiedOAuthConfig, ProviderPublicConnectionMode, ProviderPublicProfile, ProviderResolvedFile, ProviderRuntimeState, ProviderStateDurationString, ProviderStateNamespace, ProviderSupportLevel, RedirectRunReason, SchemaLike, SmsOtpMatcherDefinition, StandardSchemaV1, StateCasResult, StateNamespaceOptions, StateNamespaceScope, StateValue, StateWriteOptions, } from "./types.js";
-export { createNativeNetworkClient, createEnvVendorCredentialResolver, deriveNativeCredentialAffinityKey, NativeEgressGrantExpiredError, NativeEgressNotDeclaredError, NativeIdleTimeoutError, NativeNetworkError, NativeProxyExpiredError, resolveNativeGatewayProxy, type NativeGatewayProxy, type NativeGatewayProxyResolutionInput, type NativeGatewayProxySkipReason, type NativeGatewayProxySynthesizer, type NativeGatewayProxySynthesisResult, type NativeGatewayProxySynthesisInput, type NativeNetworkClientOptions, type NativeNetworkErrorCode, type VendorCredentialLookup, type VendorCredentialResolver, } from "./runtime/native-network.js";
+export { NativeEgressGrantExpiredError, NativeEgressNotDeclaredError, NativeIdleTimeoutError, NativeNetworkError, NativeProxyExpiredError, } from "./runtime/native-network-errors.js";
+export type { NativeGatewayProxy, NativeGatewayProxyResolutionInput, NativeGatewayProxySkipReason, NativeGatewayProxySynthesizer, NativeGatewayProxySynthesisResult, NativeGatewayProxySynthesisInput, NativeNetworkClientOptions, NativeNetworkErrorCode, VendorCredentialLookup, VendorCredentialResolver, } from "./runtime/native-network.js";
 export { HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, } from "./types.js";

package/dist/provider.js

@@ -6,5 +6,5 @@ export { AuthError, HttpRedirectError, isProviderError, isSessionExpiredError, i
 export { getProviderLocalePath, providerLocaleKey, qualifyProviderLocaleKey, } from "./i18n/index.js";
 export { createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice.js";
 export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, sensitive, z, } from "./schema.js";
-export { createNativeNetworkClient, createEnvVendorCredentialResolver, deriveNativeCredentialAffinityKey, NativeEgressGrantExpiredError, NativeEgressNotDeclaredError, NativeIdleTimeoutError, NativeNetworkError, NativeProxyExpiredError, resolveNativeGatewayProxy, } from "./runtime/native-network.js";
+export { NativeEgressGrantExpiredError, NativeEgressNotDeclaredError, NativeIdleTimeoutError, NativeNetworkError, NativeProxyExpiredError, } from "./runtime/native-network-errors.js";
 export { HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, } from "./types.js";

package/dist/runtime/auth-flow.js

@@ -1,7 +1,7 @@
 import { ContextAccessError } from "../errors.js";
 import { createAuthFlowHelpers } from "../auth.js";
 import { createUnsupportedOcrClient } from "./ocr.js";
-import { createUnsupportedResolverClient } from "./resolver.js";
+import { createUnsupportedResolverClient } from "./resolver-shared.js";
 import { createUnsupportedSttClient } from "./stt.js";
 function normalizeAllowedKeys(allowedKeys) {
     return new Set(allowedKeys.filter((key) => key.trim().length > 0));

package/dist/runtime/http.d.ts

@@ -4,5 +4,6 @@ export type HttpClientOptions = ProxyResolutionOptions & {
     warn?: (message: string) => void;
     userAgent?: string;
     onRetrySummary?: (summary: HttpRetrySummary) => void;
+    signal?: AbortSignal;
 };
 export declare function createHttpClient(baseUrl?: string, clientOptions?: HttpClientOptions): HttpClient;

package/dist/runtime/http.js

@@ -11,10 +11,42 @@ function isHttpStatusOutcome(outcome) {
 function isDedupeSkipOutcome(outcome) {
     return "kind" in outcome && outcome.kind === "dedupe-skip";
 }
-async function sleep(ms) {
+function toAmbientCancellationError(signal, error = signal.reason) {
+    if (error instanceof TransportError && error.code === "transport_cancelled") {
+        return error;
+    }
+    return new TransportError("Request cancelled", {
+        code: "transport_cancelled",
+        status: 0,
+        retryable: false,
+        ...(error !== undefined
+            ? { cause: error instanceof Error ? error : new Error(String(error)) }
+            : {}),
+    });
+}
+function throwIfAmbientAborted(signal) {
+    if (signal?.aborted)
+        throw toAmbientCancellationError(signal);
+}
+async function sleep(ms, signal) {
+    throwIfAmbientAborted(signal);
     if (ms <= 0)
         return;
-    await new Promise((resolve) => setTimeout(resolve, ms));
+    if (!signal) {
+        await new Promise((resolve) => setTimeout(resolve, ms));
+        return;
+    }
+    await new Promise((resolve, reject) => {
+        const onAbort = () => {
+            clearTimeout(timer);
+            reject(toAmbientCancellationError(signal));
+        };
+        const timer = setTimeout(() => {
+            signal.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        signal.addEventListener("abort", onAbort, { once: true });
+    });
 }
 function toUpstreamHttpError(status) {
     return new TransportError(`Upstream request failed with status ${status}`, {
@@ -53,7 +85,17 @@ function parseJson(body) {
 function isTimeoutMessage(message) {
     return /\b(timed out|timeout|deadline exceeded)\b/i.test(message);
 }
-function toHttpTransportError(error) {
+function toHttpTransportError(error, ambientSignal, timeoutSignal) {
+    if (ambientSignal?.aborted) {
+        return toAmbientCancellationError(ambientSignal, error);
+    }
+    if (timeoutSignal?.aborted) {
+        return new TransportError("Request timed out", {
+            code: "transport_timeout",
+            status: 0,
+            ...(error instanceof Error ? { cause: error } : {}),
+        });
+    }
     if (error instanceof TransportError) {
         if (error.code) {
             return error;
@@ -125,6 +167,76 @@ function requireNativeResponseBody(response) {
     }
     return response.body;
 }
+function mergeAbortSignals(...signals) {
+    const activeSignals = signals.filter((signal) => signal != null);
+    if (activeSignals.length === 0)
+        return undefined;
+    if (activeSignals.length === 1)
+        return activeSignals[0];
+    return AbortSignal.any(activeSignals);
+}
+function cancelStreamOnAbort(body, signal) {
+    if (!signal)
+        return body;
+    let reader;
+    let finished = false;
+    let streamController;
+    const cleanup = () => signal.removeEventListener("abort", onAbort);
+    const onAbort = () => {
+        if (finished)
+            return;
+        finished = true;
+        cleanup();
+        const reason = toAmbientCancellationError(signal);
+        streamController?.error(reason);
+        const cancellation = reader ? reader.cancel(reason) : body.cancel(reason);
+        void cancellation.catch(() => undefined).finally(() => reader?.releaseLock());
+    };
+    return new ReadableStream({
+        start(controller) {
+            streamController = controller;
+            signal.addEventListener("abort", onAbort, { once: true });
+            if (signal.aborted)
+                onAbort();
+        },
+        async pull(controller) {
+            try {
+                reader ??= body.getReader();
+                const chunk = await reader.read();
+                if (finished)
+                    return;
+                if (chunk.done) {
+                    finished = true;
+                    cleanup();
+                    controller.close();
+                    reader.releaseLock();
+                    return;
+                }
+                controller.enqueue(chunk.value);
+            }
+            catch (error) {
+                if (finished)
+                    return;
+                finished = true;
+                cleanup();
+                controller.error(error);
+                reader?.releaseLock();
+            }
+        },
+        async cancel(reason) {
+            if (finished)
+                return;
+            finished = true;
+            cleanup();
+            try {
+                await (reader ? reader.cancel(reason) : body.cancel(reason));
+            }
+            finally {
+                reader?.releaseLock();
+            }
+        },
+    }, { highWaterMark: 0 });
+}
 function sanitizeStreamErrors(body, serializedUrl) {
     if (serializedUrl.sensitiveValues.length === 0)
         return body;
@@ -154,9 +266,9 @@ function sanitizeStreamErrors(body, serializedUrl) {
         },
     }, { highWaterMark: 0 });
 }
-function toNativeHttpStreamResponse(response, serializedUrl) {
+function toNativeHttpStreamResponse(response, serializedUrl, signal) {
     const headers = Object.fromEntries(response.headers.entries());
-    const body = sanitizeStreamErrors(requireNativeResponseBody(response), serializedUrl);
+    const body = sanitizeStreamErrors(cancelStreamOnAbort(requireNativeResponseBody(response), signal), serializedUrl);
     return {
         body,
         headers,
@@ -418,15 +530,18 @@ async function fetchNativeHttp(baseUrl, url, method, options, clientOptions, war
     const serializedUrl = serializeHttpRequestUrl(baseUrl, url, options);
     const { requestUrl } = serializedUrl;
     const controller = options.timeout ? new AbortController() : undefined;
+    const signal = mergeAbortSignals(clientOptions.signal, controller?.signal);
     const timeoutHandle = options.timeout
         ? setTimeout(() => controller?.abort(), options.timeout)
         : undefined;
     let proxy;
     try {
+        throwIfAmbientAborted(clientOptions.signal);
         // Resolve inside the try (and after the timeout is armed) so allocator
         // failures are branded as TransportErrors and count against the request
         // deadline, exactly as an inline resolve would.
         proxy = await resolveNativeProxy(options, clientOptions, warn, proxyAttemptOffset);
+        throwIfAmbientAborted(clientOptions.signal);
         // For a registry allocator chain, skip an endpoint a prior attempt already
         // tried rather than re-issuing the same request. Returning the sentinel
         // (instead of breaking) lets the loop keep advancing the flat offset until
@@ -441,7 +556,7 @@ async function fetchNativeHttp(baseUrl, url, method, options, clientOptions, war
             headers: options.headers,
             method,
             ...(proxy ? { proxy } : {}),
-            signal: controller?.signal,
+            ...(signal ? { signal } : {}),
         };
         if (options.body !== undefined) {
             requestInit.body = normalizeNativeFetchBody(options.body);
@@ -471,7 +586,7 @@ async function fetchNativeHttp(baseUrl, url, method, options, clientOptions, war
         if (error instanceof SyntaxError) {
             throw redactSensitiveError(error, serializedUrl.sensitiveValues, serializedUrl.requestUrl, serializedUrl.redactedUrl);
         }
-        const transportError = redactSensitiveError(toHttpTransportError(error), serializedUrl.sensitiveValues, serializedUrl.requestUrl, serializedUrl.redactedUrl);
+        const transportError = redactSensitiveError(toHttpTransportError(error, clientOptions.signal, controller?.signal), serializedUrl.sensitiveValues, serializedUrl.requestUrl, serializedUrl.redactedUrl);
         transportError.proxyUsed = Boolean(proxy);
         throw transportError;
     }
@@ -484,16 +599,19 @@ async function fetchNativeHttpStream(baseUrl, url, method, options, clientOption
     const serializedUrl = serializeHttpRequestUrl(baseUrl, url, options);
     const { requestUrl } = serializedUrl;
     const controller = options.timeout ? new AbortController() : undefined;
+    const signal = mergeAbortSignals(clientOptions.signal, controller?.signal);
     const timeoutHandle = options.timeout
         ? setTimeout(() => controller?.abort(), options.timeout)
         : undefined;
     try {
+        throwIfAmbientAborted(clientOptions.signal);
         const proxy = await resolveNativeProxy(options, clientOptions, warn);
+        throwIfAmbientAborted(clientOptions.signal);
         const requestInit = {
             headers: options.headers,
             method,
             ...(proxy ? { proxy } : {}),
-            signal: controller?.signal,
+            ...(signal ? { signal } : {}),
         };
         if (options.body !== undefined) {
             requestInit.body = normalizeNativeFetchBody(options.body);
@@ -506,13 +624,15 @@ async function fetchNativeHttpStream(baseUrl, url, method, options, clientOption
                 status: response.status,
             });
         }
-        return toNativeHttpStreamResponse(response, serializedUrl);
+        // Per-call timeout remains header-scoped, while the ambient request signal
+        // stays attached to the response body for its full consumption lifetime.
+        return toNativeHttpStreamResponse(response, serializedUrl, clientOptions.signal);
     }
     catch (error) {
         if (error instanceof SyntaxError) {
             throw redactSensitiveError(error, serializedUrl.sensitiveValues, serializedUrl.requestUrl, serializedUrl.redactedUrl);
         }
-        throw redactSensitiveError(toHttpTransportError(error), serializedUrl.sensitiveValues, serializedUrl.requestUrl, serializedUrl.redactedUrl);
+        throw redactSensitiveError(toHttpTransportError(error, clientOptions.signal, controller?.signal), serializedUrl.sensitiveValues, serializedUrl.requestUrl, serializedUrl.redactedUrl);
     }
     finally {
         if (timeoutHandle)
@@ -616,6 +736,7 @@ export function createHttpClient(baseUrl, clientOptions = {}) {
         const dedupeContext = dedupeAllocatorEndpoints ? { attempted: new Set() } : undefined;
         const executeOnce = (proxyAttemptOffset = 0) => fetchNativeHttp(baseUrl, url, methodName, attemptOptions, clientOptions, warnOnce, statusRetryEnabled ? retryOptions?.statusCodes : undefined, proxyAttemptOffset, dedupeContext);
         if (!retryEnabled || !retryOptions) {
+            throwIfAmbientAborted(clientOptions.signal);
             const outcome = await executeOnce();
             if (isDedupeSkipOutcome(outcome)) {
                 // Single-shot path never de-duplicates (dedupeContext is undefined),
@@ -639,6 +760,7 @@ export function createHttpClient(baseUrl, clientOptions = {}) {
         // allocations skip offsets.
         let issued = 0;
         for (let attempt = 1; attempt <= transportAttemptCap; attempt += 1) {
+            throwIfAmbientAborted(clientOptions.signal);
             // Whether this offset actually issued a request (vs. a skipped duplicate),
             // so the catch counts a thrown *transport* failure once without
             // double-counting a status outcome that already incremented before it
@@ -657,7 +779,7 @@ export function createHttpClient(baseUrl, clientOptions = {}) {
                 if (isHttpStatusOutcome(outcome)) {
                     lastStatus = outcome.status;
                     if (outcome.retryable && issued < retryOptions.attempts) {
-                        await sleep(computeProxyTransportRetryDelayMs(retryOptions, attempt, outcome.headers));
+                        await sleep(computeProxyTransportRetryDelayMs(retryOptions, attempt, outcome.headers), clientOptions.signal);
                         continue;
                     }
                     throw toUpstreamHttpError(outcome.status);
@@ -680,6 +802,7 @@ export function createHttpClient(baseUrl, clientOptions = {}) {
                 return response;
             }
             catch (error) {
+                throwIfAmbientAborted(clientOptions.signal);
                 if (!issuedThisAttempt)
                     issued += 1;
                 lastError = error;
@@ -694,7 +817,7 @@ export function createHttpClient(baseUrl, clientOptions = {}) {
                         options: retryOptions,
                         proxyUsed,
                     })) {
-                    await sleep(computeProxyTransportRetryDelayMs(retryOptions, attempt));
+                    await sleep(computeProxyTransportRetryDelayMs(retryOptions, attempt), clientOptions.signal);
                     continue;
                 }
                 throw error;