@apifuse/provider-sdk 2.2.0-beta.27 → 2.2.0-beta.28

package/src/runtime/resolver-vendors/twocaptcha.ts

@@ -1,4 +1,5 @@
 import type { ChallengeSolution, ProviderChallenge } from "../../types.js";
+import type { TraceRecorder } from "../trace.js";
 import { assertResolverHostAllowed } from "./hosts.js";
 import {
 	type ResolverIdentity,
@@ -34,6 +35,7 @@ export interface TwoCaptchaResolverVendorAdapter extends ResolverVendorAdapter {
 		challenge: ProviderChallenge,
 		identity: ResolverIdentity | undefined,
 		signal: AbortSignal,
+		traceRecorder?: TraceRecorder,
 	): Promise<Extract<ChallengeSolution, { readonly form: "token" }>>;
 }
 
@@ -231,6 +233,28 @@ function endpoint(baseUrl: string, path: string): string {
 	return `${baseUrl.replace(/\/+$/u, "")}/${path}`;
 }
 
+function spanErrorAttributes(
+	error: unknown,
+	phase: TwoCaptchaOperationPhase,
+): Record<string, unknown> | undefined {
+	if (error instanceof ResolverVendorUnavailableError) {
+		return {
+			unavailability_reason: error.reason,
+			transport_phase: error.phase,
+		};
+	}
+	// The solve budget raises TwoCaptchaSolveTimeoutError inside the spanned closure and
+	// the outer catch converts it only after the span has been finalized, so the span has
+	// to recognize it here or slow solves lose exactly the attribution these spans add.
+	if (error instanceof TwoCaptchaSolveTimeoutError) {
+		return {
+			unavailability_reason: "timeout",
+			transport_phase: phase,
+		};
+	}
+	return undefined;
+}
+
 export function createTwoCaptchaResolverVendorAdapter(
 	options: TwoCaptchaResolverVendorOptions,
 ): TwoCaptchaResolverVendorAdapter {
@@ -248,7 +272,7 @@ export function createTwoCaptchaResolverVendorAdapter(
 			return resolverVendorSupports(TWOCAPTCHA_VENDOR_ID, kind);
 		},
 
-		async solve(challenge, identity, callerSignal) {
+		async solve(challenge, identity, callerSignal, traceRecorder) {
 			const apiKey = options.apiKey?.trim();
 			if (!apiKey) {
 				throw new ResolverVendorUnavailableError(TWOCAPTCHA_VENDOR_ID, "missing_credentials", {
@@ -285,62 +309,89 @@ export function createTwoCaptchaResolverVendorAdapter(
 			let phase: TwoCaptchaOperationPhase = "create_task";
 
 			try {
-				const createResult = await postJson(
-					fetchImpl,
-					endpoint(baseUrl, "createTask"),
-					{
-						clientKey: apiKey,
-						task: {
-							type: proxy ? "RecaptchaV2Task" : "RecaptchaV2TaskProxyless",
-							websiteURL: challenge.pageUrl,
-							websiteKey: challenge.siteKey,
-							isInvisible: false,
-							...(identity ? { userAgent: identity.userAgent } : {}),
-							...(proxy ?? {}),
-						},
-					},
-					solveController.signal,
-					phase,
-				);
-				const taskId = taskIdFrom(createResult.payload);
-				if (!createResult.ok || createResult.payload.errorId !== 0 || taskId === undefined) {
-					throw unavailableForPayload(createResult.payload, phase);
-				}
-
-				phase = "poll_result";
-				while (true) {
-					callerSignal.throwIfAborted();
-					const remainingMs = timeoutMs - (now() - startedAt);
-					if (remainingMs <= 0) throw new TwoCaptchaSolveTimeoutError();
-					await delay(Math.min(pollIntervalMs, remainingMs), solveController.signal);
-					callerSignal.throwIfAborted();
-					if (now() - startedAt >= timeoutMs) throw new TwoCaptchaSolveTimeoutError();
-
-					const pollResult = await postJson(
+				const createTask = async () => {
+					const createResult = await postJson(
 						fetchImpl,
-						endpoint(baseUrl, "getTaskResult"),
-						{ clientKey: apiKey, taskId },
+						endpoint(baseUrl, "createTask"),
+						{
+							clientKey: apiKey,
+							task: {
+								type: proxy ? "RecaptchaV2Task" : "RecaptchaV2TaskProxyless",
+								websiteURL: challenge.pageUrl,
+								websiteKey: challenge.siteKey,
+								isInvisible: false,
+								...(identity ? { userAgent: identity.userAgent } : {}),
+								...(proxy ?? {}),
+							},
+						},
 						solveController.signal,
 						phase,
 					);
-					if (!pollResult.ok || pollResult.payload.errorId !== 0) {
-						throw unavailableForPayload(pollResult.payload, phase);
-					}
-					if (pollResult.payload.status === "processing") continue;
-					if (pollResult.payload.status !== "ready") {
-						throw new ResolverVendorUnavailableError(TWOCAPTCHA_VENDOR_ID, "transport_failure", {
-							phase,
-						});
+					const taskId = taskIdFrom(createResult.payload);
+					if (!createResult.ok || createResult.payload.errorId !== 0 || taskId === undefined) {
+						throw unavailableForPayload(createResult.payload, phase);
 					}
+					return taskId;
+				};
+				const taskId = traceRecorder
+					? await traceRecorder.runSpan("resolver.vendor.create_task", createTask, {
+							attributes: {
+								vendor: TWOCAPTCHA_VENDOR_ID,
+								challenge_kind: challenge.kind,
+							},
+							onError: (error) => spanErrorAttributes(error, "create_task"),
+						})
+					: await createTask();
 
-					const token = tokenFrom(pollResult.payload);
-					if (!token?.trim()) {
-						throw new ResolverVendorUnavailableError(TWOCAPTCHA_VENDOR_ID, "transport_failure", {
+				phase = "poll_result";
+				const pollResult = async () => {
+					while (true) {
+						callerSignal.throwIfAborted();
+						const remainingMs = timeoutMs - (now() - startedAt);
+						if (remainingMs <= 0) throw new TwoCaptchaSolveTimeoutError();
+						await delay(Math.min(pollIntervalMs, remainingMs), solveController.signal);
+						callerSignal.throwIfAborted();
+						if (now() - startedAt >= timeoutMs) throw new TwoCaptchaSolveTimeoutError();
+
+						const pollResult = await postJson(
+							fetchImpl,
+							endpoint(baseUrl, "getTaskResult"),
+							{ clientKey: apiKey, taskId },
+							solveController.signal,
 							phase,
-						});
+						);
+						if (!pollResult.ok || pollResult.payload.errorId !== 0) {
+							throw unavailableForPayload(pollResult.payload, phase);
+						}
+						if (pollResult.payload.status === "processing") continue;
+						if (pollResult.payload.status !== "ready") {
+							throw new ResolverVendorUnavailableError(
+								TWOCAPTCHA_VENDOR_ID,
+								"transport_failure",
+								{ phase },
+							);
+						}
+
+						const token = tokenFrom(pollResult.payload);
+						if (!token?.trim()) {
+							throw new ResolverVendorUnavailableError(
+								TWOCAPTCHA_VENDOR_ID,
+								"transport_failure",
+								{ phase },
+							);
+						}
+						return { form: "token" as const, token };
 					}
-					return { form: "token", token };
-				}
+				};
+				return traceRecorder
+					? await traceRecorder.runSpan("resolver.vendor.poll_result", pollResult, {
+							attributes: {
+								vendor: TWOCAPTCHA_VENDOR_ID,
+								challenge_kind: challenge.kind,
+							},
+							onError: (error) => spanErrorAttributes(error, "poll_result"),
+						})
+					: await pollResult();
 			} catch (error) {
 				if (callerSignal.aborted) throw abortReason(callerSignal);
 				if (

package/src/runtime/resolver-vendors/types.ts

@@ -112,6 +112,7 @@ export interface ResolverVendorAdapter {
 
 export type ResolverVendorUnavailableReason =
 	| "missing_credentials"
+	| "missing_proxy_identity"
 	| "missing_transport"
 	| "allocation_exhausted"
 	| "transport_failure"

package/src/runtime/resolver.ts

@@ -6,6 +6,7 @@ import type {
 	ProviderCache,
 	ProviderChallenge,
 	ProviderChallengeKind,
+	ProviderProxyMode,
 	ProviderResolverConfig,
 	ProviderResolverVendor,
 	ResolverContext,
@@ -29,14 +30,32 @@ import {
 	type ResolverVendorUnavailableReason,
 	resolverVendorSupports,
 } from "./resolver-vendors/types.js";
+import {
+	createUnsupportedResolverClient,
+	RESOLVER_INSTRUMENTATION_METADATA,
+} from "./resolver-shared.js";
+import {
+	APIFUSE__CDP_POOL__URL,
+	APIFUSE__RESOLVER__2CAPTCHA__API_KEY,
+	APIFUSE__RESOLVER__CAPMONSTER__API_KEY,
+	APIFUSE__RESOLVER__CAPSOLVER__API_KEY,
+	APIFUSE__RESOLVER__TIMEOUT_MS,
+	DEFAULT_RESOLVER_TIMEOUT_MS,
+} from "./resolver-config.js";
 import type { TraceRecorder } from "./trace.js";
 
-export const APIFUSE__RESOLVER__2CAPTCHA__API_KEY = "APIFUSE__RESOLVER__2CAPTCHA__API_KEY";
-export const APIFUSE__RESOLVER__CAPSOLVER__API_KEY = "APIFUSE__RESOLVER__CAPSOLVER__API_KEY";
-export const APIFUSE__RESOLVER__CAPMONSTER__API_KEY = "APIFUSE__RESOLVER__CAPMONSTER__API_KEY";
-export const APIFUSE__RESOLVER__TIMEOUT_MS = "APIFUSE__RESOLVER__TIMEOUT_MS";
-export const APIFUSE__CDP_POOL__URL = "APIFUSE__CDP_POOL__URL";
-export const DEFAULT_RESOLVER_TIMEOUT_MS = 180_000;
+export {
+	createUnsupportedResolverClient,
+	RESOLVER_INSTRUMENTATION_METADATA,
+} from "./resolver-shared.js";
+export {
+	APIFUSE__CDP_POOL__URL,
+	APIFUSE__RESOLVER__2CAPTCHA__API_KEY,
+	APIFUSE__RESOLVER__CAPMONSTER__API_KEY,
+	APIFUSE__RESOLVER__CAPSOLVER__API_KEY,
+	APIFUSE__RESOLVER__TIMEOUT_MS,
+	DEFAULT_RESOLVER_TIMEOUT_MS,
+} from "./resolver-config.js";
 
 type EnvLike = Record<string, string | undefined>;
 
@@ -75,6 +94,8 @@ type ResolverChainClient = ResolverContext & {
 export interface ResolverRuntimeOptions {
 	readonly allowedHosts?: readonly string[];
 	readonly cache?: ProviderCache;
+	/** Provider-declared proxy intent. The SDK never accepts a caller-built identity. */
+	readonly proxyMode?: ProviderProxyMode;
 	/** Server-owned context/proxy scope used only for identity-bound cache entries. */
 	readonly identityScope?: string;
 	/** SDK-owned transport already bound to the resolved proxy lease and client profile. */
@@ -143,10 +164,6 @@ const SAFE_CAUSE_MESSAGE_WORDS: ReadonlySet<string> = new Set([
 	"writing",
 ]);
 
-export const RESOLVER_INSTRUMENTATION_METADATA = Symbol.for(
-	"@apifuse/provider-sdk/runtime/resolver-instrumentation-metadata",
-);
-
 export type ResolverInstrumentationMetadata = {
 	readonly target: ResolverContext;
 	readonly traceRecorder: TraceRecorder;
@@ -340,7 +357,9 @@ function sanitizeCauseMessage(message: string): string {
 		.map((token) => {
 			if (token === "[REDACTED]" || /^[a-z][a-z\d+.-]*:\/\/[^\s]+$/i.test(token)) return token;
 			const word = token.replace(/^[^a-z\d]+|[^a-z\d]+$/gi, "");
-			return word.length > 0 && word.length <= 32 && SAFE_CAUSE_MESSAGE_WORDS.has(word.toLowerCase())
+			return word.length > 0 &&
+				word.length <= 32 &&
+				SAFE_CAUSE_MESSAGE_WORDS.has(word.toLowerCase())
 				? token
 				: "[REDACTED]";
 		});
@@ -691,6 +710,7 @@ function createResolverChainClient(options: {
 	readonly unavailableReason?: string;
 	readonly cache?: ProviderCache;
 	readonly identity?: ResolverIdentity;
+	readonly proxyMode?: ProviderProxyMode;
 	readonly identityScope?: string;
 	readonly transport?: ResolverVendorTransport;
 	readonly createTransport?: ResolverRuntimeOptions["createTransport"];
@@ -715,6 +735,19 @@ function createResolverChainClient(options: {
 			const supportingEntries = options.entries.filter((entry) => entry.supports(challenge.kind));
 			if (supportingEntries.length === 0) throwUnsupportedKind(challenge.kind);
 			signal.throwIfAborted();
+			// A required proxy policy is checked before the cache. Solutions minted under a
+			// previous release are shared and long-lived, so consulting the cache first would
+			// keep reporting success without a proxy identity until every old entry expired.
+			const requiredProxyIdentityMissing =
+				options.proxyMode === "required" && options.identity === undefined;
+			if (requiredProxyIdentityMissing) {
+				throwExhausted(
+					supportingEntries.map((entry) => ({
+						vendor: entry.id,
+						reason: "missing_proxy_identity" as const,
+					})),
+				);
+			}
 			if (options.cache && resolverChallengeIsCacheable(challenge)) {
 				const cached = await findCachedSolution(
 					options.cache,
@@ -804,6 +837,7 @@ export function createResolverClient(options: {
 	readonly unavailableReason?: string;
 	readonly cache?: ProviderCache;
 	readonly identity?: ResolverIdentity;
+	readonly proxyMode?: ProviderProxyMode;
 	readonly transport?: ResolverVendorTransport;
 	readonly createTransport?: ResolverRuntimeOptions["createTransport"];
 	readonly clientProfile?: string;
@@ -819,6 +853,7 @@ export function createResolverClient(options: {
 		unavailableReason: options.unavailableReason,
 		cache: options.cache,
 		identity: options.identity,
+		proxyMode: options.proxyMode,
 		transport: options.transport,
 		createTransport: options.createTransport,
 		clientProfile: options.clientProfile,
@@ -853,17 +888,6 @@ function resolveVendorAvailability(
 		: { vendor, available: false, reason: "missing_credentials" };
 }
 
-export function createUnsupportedResolverClient(reason?: string): ResolverContext {
-	return {
-		async solve() {
-			throw new ProviderError(reason ?? "Resolver runtime is not configured", {
-				code: "RESOLVER_UNAVAILABLE",
-				fix: "Declare resolver on the provider definition and configure vendor credentials.",
-			});
-		},
-	};
-}
-
 export function bindResolverSignal(
 	resolver: ResolverContext,
 	defaultSignal: AbortSignal | undefined,
@@ -921,6 +945,7 @@ function createResolverClientFromEnvInternal(
 			};
 		}),
 		cache: options.cache,
+		proxyMode: options.proxyMode,
 		identityScope: options.identityScope,
 		transport: options.transport,
 		createTransport: options.createTransport,

package/src/runtime/state.ts

@@ -18,7 +18,6 @@ import {
 
 const DEFAULT_REDIS_TIMEOUT_MS = 250;
 const REDIS_STATE_PREFIX = "apifuse:provider-state:v2";
-const LEGACY_REDIS_STATE_PREFIX = "apifuse:provider-state:v1";
 const PROVIDER_SCOPE_DISCRIMINATOR = "scope:provider";
 const MISSING_CONNECTION_SCOPE_DISCRIMINATOR = "scope:connection:missing";
 const SET_WITH_QUOTA_SCRIPT = `
@@ -29,7 +28,6 @@ local index_ttl = tonumber(ARGV[4])
 local envelope = ARGV[5]
 
 redis.call("ZREMRANGEBYSCORE", KEYS[2], "-inf", now)
-redis.call("ZREM", KEYS[2], KEYS[3])
 local indexed = redis.call("ZSCORE", KEYS[2], KEYS[1])
 if not indexed and redis.call("ZCARD", KEYS[2]) >= max_entries then
 	return {0, false}
@@ -38,15 +36,11 @@ end
 redis.call("SET", KEYS[1], envelope, "PXAT", expires_at)
 redis.call("ZADD", KEYS[2], expires_at, KEYS[1])
 redis.call("PEXPIRE", KEYS[2], index_ttl)
-if ARGV[6] == "1" then
-	redis.call("SET", KEYS[3], ARGV[7], "PX", index_ttl)
-end
 return {1, envelope}
 `;
 
 const COMPARE_AND_SET_WITH_QUOTA_SCRIPT = `
 local current = redis.call("GET", KEYS[1])
-local scoped_present = current and true or false
 if current then
 	local ok, decoded = pcall(cjson.decode, current)
 	if ok and type(decoded) == "table" and decoded.deleted == true then
@@ -59,42 +53,6 @@ local max_entries = tonumber(ARGV[3])
 local expires_at = tonumber(ARGV[4])
 local index_ttl = tonumber(ARGV[5])
 local envelope = ARGV[6]
-local allow_legacy_claim = ARGV[7] == "1"
-local legacy_tombstone = ARGV[8]
-
-if not scoped_present then
-	local legacy = redis.call("GET", KEYS[3])
-	if legacy then
-		local ok, decoded = pcall(cjson.decode, legacy)
-		if ok and type(decoded) == "table" and decoded.deleted == true then
-			legacy = false
-		end
-	end
-	if legacy and not allow_legacy_claim then
-		return {-1, false}
-	end
-	if legacy then
-		local legacy_ttl = redis.call("PTTL", KEYS[3])
-		if legacy_ttl == -1 then
-			legacy_ttl = index_ttl
-		elseif legacy_ttl < 1 then
-			legacy_ttl = 1
-		end
-		if legacy_ttl > 0 then
-			redis.call("ZREMRANGEBYSCORE", KEYS[2], "-inf", now)
-			redis.call("ZREM", KEYS[2], KEYS[3])
-			local indexed = redis.call("ZSCORE", KEYS[2], KEYS[1])
-			if not indexed and redis.call("ZCARD", KEYS[2]) >= max_entries then
-				return {0, false}
-			end
-			redis.call("SET", KEYS[1], legacy, "PX", legacy_ttl)
-			redis.call("ZADD", KEYS[2], now + legacy_ttl, KEYS[1])
-			redis.call("PEXPIRE", KEYS[2], index_ttl)
-			redis.call("SET", KEYS[3], legacy_tombstone, "PX", index_ttl)
-			current = legacy
-		end
-	end
-end
 
 local current_version = 0
 local current_decoded = false
@@ -111,7 +69,6 @@ if current_version ~= tonumber(ARGV[1]) then
 end
 
 redis.call("ZREMRANGEBYSCORE", KEYS[2], "-inf", now)
-redis.call("ZREM", KEYS[2], KEYS[3])
 local indexed = redis.call("ZSCORE", KEYS[2], KEYS[1])
 if not indexed and redis.call("ZCARD", KEYS[2]) >= max_entries then
 	return {0, false}
@@ -125,63 +82,15 @@ end
 redis.call("SET", KEYS[1], envelope, "PXAT", expires_at)
 redis.call("ZADD", KEYS[2], expires_at, KEYS[1])
 redis.call("PEXPIRE", KEYS[2], index_ttl)
-if allow_legacy_claim then
-	redis.call("SET", KEYS[3], legacy_tombstone, "PX", index_ttl)
-end
 return {1, envelope}
 `;
 
 const DELETE_WITH_INDEX_SCRIPT = `
 redis.call("SET", KEYS[1], ARGV[1], "PX", ARGV[2])
-if ARGV[3] == "1" then
-	redis.call("SET", KEYS[3], ARGV[1], "PX", ARGV[2])
-end
-redis.call("ZREM", KEYS[2], KEYS[1], KEYS[3])
+redis.call("ZREM", KEYS[2], KEYS[1])
 return 1
 `;
 
-// A v1 key has no connection discriminator, so it cannot safely be exposed to
-// every v2 scope. The first concrete connection (or explicit provider scope) to
-// request a key atomically adopts that value and tombstones v1. The missing-
-// connection sentinel never claims legacy state.
-const CLAIM_LEGACY_SCRIPT = `
-local scoped = redis.call("GET", KEYS[1])
-if scoped then
-	return {1, scoped}
-end
-
-local legacy = redis.call("GET", KEYS[3])
-if not legacy then
-	return {1, false}
-end
-local ok, decoded = pcall(cjson.decode, legacy)
-if ok and type(decoded) == "table" and decoded.deleted == true then
-	return {1, false}
-end
-local legacy_ttl = redis.call("PTTL", KEYS[3])
-if legacy_ttl == -1 then
-	legacy_ttl = tonumber(ARGV[3])
-elseif legacy_ttl < 1 then
-	legacy_ttl = 1
-end
-
-local now = tonumber(ARGV[1])
-local max_entries = tonumber(ARGV[2])
-local index_ttl = tonumber(ARGV[3])
-redis.call("ZREMRANGEBYSCORE", KEYS[2], "-inf", now)
-redis.call("ZREM", KEYS[2], KEYS[3])
-local indexed = redis.call("ZSCORE", KEYS[2], KEYS[1])
-if not indexed and redis.call("ZCARD", KEYS[2]) >= max_entries then
-	return {0, false}
-end
-
-redis.call("SET", KEYS[1], legacy, "PX", legacy_ttl)
-redis.call("ZADD", KEYS[2], now + legacy_ttl, KEYS[1])
-redis.call("PEXPIRE", KEYS[2], index_ttl)
-redis.call("SET", KEYS[3], ARGV[4], "PX", index_ttl)
-return {1, legacy}
-`;
-
 type RedisProviderRuntimeStateOptions = {
 	readonly redisUrl: string;
 	readonly providerId?: string;
@@ -268,18 +177,6 @@ function providerStateKey(
 	return `${providerStatePrefix(providerId, namespace, scopeDiscriminator)}:${key}`;
 }
 
-function legacyProviderStatePrefix(providerId: string | undefined, namespace: string): string {
-	return `${LEGACY_REDIS_STATE_PREFIX}:${providerId ?? "default"}:${namespace}`;
-}
-
-function legacyProviderStateKey(
-	providerId: string | undefined,
-	namespace: string,
-	key: string,
-): string {
-	return `${legacyProviderStatePrefix(providerId, namespace)}:${key}`;
-}
-
 function publicStateKey(redisKey: string, prefixes: readonly string[]): string {
 	for (const prefix of prefixes) {
 		const prefixWithSeparator = `${prefix}:`;
@@ -391,10 +288,6 @@ class RedisProviderStateNamespace implements ProviderStateNamespace {
 		);
 	}
 
-	private legacyRedisKey(key: string): string {
-		return legacyProviderStateKey(this.providerId, this.namespaceName, key);
-	}
-
 	private statePrefix(): string {
 		return providerStatePrefix(
 			this.providerId,
@@ -418,10 +311,6 @@ class RedisProviderStateNamespace implements ProviderStateNamespace {
 		return `${REDIS_STATE_PREFIX}:index:${namespaceIdentity}`;
 	}
 
-	private canClaimLegacy(): boolean {
-		return this.scopeDiscriminator !== MISSING_CONNECTION_SCOPE_DISCRIMINATOR;
-	}
-
 	private async indexedKeys(limit: number): Promise<string[]> {
 		await requireRedisReady(this.backend.redis);
 		const now = Date.now();
@@ -440,27 +329,7 @@ class RedisProviderStateNamespace implements ProviderStateNamespace {
 
 	private async readRaw(key: string): Promise<string | null> {
 		await requireRedisReady(this.backend.redis);
-		if (!this.canClaimLegacy()) {
-			return await withRequiredRedis(() => this.backend.redis.get(this.redisKey(key)));
-		}
-		const tombstone = JSON.stringify({ deleted: true } satisfies RedisStateTombstone);
-		const result = await withRequiredRedis(() =>
-			this.backend.redis.eval(
-				CLAIM_LEGACY_SCRIPT,
-				3,
-				this.redisKey(key),
-				this.indexKey(),
-				this.legacyRedisKey(key),
-				String(Date.now()),
-				String(this.options.maxEntries),
-				String(parseStateDurationMs(this.options.maxTtl)),
-				tombstone,
-			),
-		);
-		if (Array.isArray(result) && Number(result[0]) === 0) {
-			throw this.quotaExceeded();
-		}
-		return Array.isArray(result) && typeof result[1] === "string" ? result[1] : null;
+		return await withRequiredRedis(() => this.backend.redis.get(this.redisKey(key)));
 	}
 
 	private enforceValueSize(value: unknown): void {
@@ -534,17 +403,14 @@ class RedisProviderStateNamespace implements ProviderStateNamespace {
 		const result = await withRequiredRedis(() =>
 			this.backend.redis.eval(
 				SET_WITH_QUOTA_SCRIPT,
-				3,
+				2,
 				this.redisKey(key),
 				this.indexKey(),
-				this.legacyRedisKey(key),
 				String(Date.now()),
 				String(this.options.maxEntries),
 				String(timing.expiresAtMs),
 				String(timing.indexTtlMs),
 				JSON.stringify(envelope),
-				this.canClaimLegacy() ? "1" : "0",
-				JSON.stringify({ deleted: true } satisfies RedisStateTombstone),
 			),
 		);
 		if (!Array.isArray(result) || Number(result[0]) !== 1) {
@@ -590,18 +456,15 @@ class RedisProviderStateNamespace implements ProviderStateNamespace {
 		const result = await withRequiredRedis(() =>
 			this.backend.redis.eval(
 				COMPARE_AND_SET_WITH_QUOTA_SCRIPT,
-				3,
+				2,
 				this.redisKey(key),
 				this.indexKey(),
-				this.legacyRedisKey(key),
 				String(expectedVersion),
 				String(Date.now()),
 				String(this.options.maxEntries),
 				String(timing.expiresAtMs),
 				String(timing.indexTtlMs),
 				JSON.stringify(envelope),
-				this.canClaimLegacy() ? "1" : "0",
-				JSON.stringify({ deleted: true } satisfies RedisStateTombstone),
 			),
 		);
 		if (Array.isArray(result) && Number(result[0]) === 0) {
@@ -627,13 +490,11 @@ class RedisProviderStateNamespace implements ProviderStateNamespace {
 		await withRequiredRedis(() =>
 			this.backend.redis.eval(
 				DELETE_WITH_INDEX_SCRIPT,
-				3,
+				2,
 				this.redisKey(key),
 				this.indexKey(),
-				this.legacyRedisKey(key),
 				tombstone,
 				String(parseStateDurationMs(this.options.maxTtl)),
-				this.canClaimLegacy() ? "1" : "0",
 			),
 		);
 	}