@apifuse/provider-sdk 2.2.0-beta.27 → 2.2.0-beta.28

package/dist/stateful/errors.d.ts

@@ -1,4 +1,9 @@
 export type StatefulControlPlaneOperation = "resolve" | "acquire" | "renew" | "release";
+export declare class StatefulRoutingDeadlineError extends Error {
+    readonly requestId: string;
+    readonly deadlineAt: string;
+    constructor(requestId: string, deadlineAt: string);
+}
 export declare class StatefulControlPlaneError extends Error {
     readonly code: string;
     readonly operation: StatefulControlPlaneOperation;

package/dist/stateful/errors.js

@@ -1,3 +1,13 @@
+export class StatefulRoutingDeadlineError extends Error {
+    requestId;
+    deadlineAt;
+    constructor(requestId, deadlineAt) {
+        super(`Stateful operation request ${requestId} deadline has expired.`);
+        this.name = "StatefulRoutingDeadlineError";
+        this.requestId = requestId;
+        this.deadlineAt = deadlineAt;
+    }
+}
 export class StatefulControlPlaneError extends Error {
     code;
     operation;

package/dist/stateful/stateful-provider-session-routing.d.ts

@@ -40,11 +40,7 @@ export interface StatefulSessionRouterOptions {
     readonly clock?: () => Date;
     readonly metricEmitter?: StatefulProviderMetricEmitter;
 }
-export declare class StatefulRoutingDeadlineError extends Error {
-    readonly requestId: string;
-    readonly deadlineAt: string;
-    constructor(requestId: string, deadlineAt: string);
-}
+export { StatefulRoutingDeadlineError } from "./errors.js";
 export declare class StatefulRoutingOwnershipError extends Error {
     readonly requestId: string;
     readonly sessionKey: SessionKey;

package/dist/stateful/stateful-provider-session-routing.js

@@ -1,15 +1,7 @@
+import { StatefulRoutingDeadlineError } from "./errors.js";
 import { NOOP_STATEFUL_PROVIDER_METRIC_EMITTER, } from "./stateful-provider-observability.js";
 export { forwardingContextFromStatefulRuntimeContext, isStatefulOperationRuntimeContext, providerContextFromStatefulRuntimeContext, statefulForwardingContextFromProviderRequest, withStatefulLocalProviderContext, } from "./stateful-provider-runtime-context.js";
-export class StatefulRoutingDeadlineError extends Error {
-    requestId;
-    deadlineAt;
-    constructor(requestId, deadlineAt) {
-        super(`Stateful operation request ${requestId} deadline has expired.`);
-        this.name = "StatefulRoutingDeadlineError";
-        this.requestId = requestId;
-        this.deadlineAt = deadlineAt;
-    }
-}
+export { StatefulRoutingDeadlineError } from "./errors.js";
 export class StatefulRoutingOwnershipError extends Error {
     requestId;
     sessionKey;

package/dist/stream.js

@@ -41,16 +41,22 @@ function sseFieldValue(value, field) {
 }
 export async function* readableBytes(body) {
     const reader = body.getReader();
+    let completed = false;
     try {
         for (;;) {
             const { value, done } = await reader.read();
-            if (done)
+            if (done) {
+                completed = true;
                 return;
+            }
             if (value)
                 yield value;
         }
     }
     finally {
+        if (!completed) {
+            await reader.cancel().catch(() => undefined);
+        }
         reader.releaseLock();
     }
 }

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "2.2.0-beta.27",
+	"version": "2.2.0-beta.28",
 	"name": "@apifuse/provider-sdk",
 	"private": false,
 	"type": "module",
@@ -61,6 +61,31 @@
 			"import": "./dist/server/index.js",
 			"default": "./dist/server/index.js"
 		},
+		"./runtime/browser": {
+			"types": "./dist/runtime/browser.d.ts",
+			"import": "./dist/runtime/browser.js",
+			"default": "./dist/runtime/browser.js"
+		},
+		"./runtime/native-network": {
+			"types": "./dist/runtime/native-network.d.ts",
+			"import": "./dist/runtime/native-network.js",
+			"default": "./dist/runtime/native-network.js"
+		},
+		"./runtime/prevalidate": {
+			"types": "./dist/runtime/prevalidate.d.ts",
+			"import": "./dist/runtime/prevalidate.js",
+			"default": "./dist/runtime/prevalidate.js"
+		},
+		"./runtime/resolver": {
+			"types": "./dist/runtime/resolver.d.ts",
+			"import": "./dist/runtime/resolver.js",
+			"default": "./dist/runtime/resolver.js"
+		},
+		"./runtime/stealth": {
+			"types": "./dist/runtime/stealth.d.ts",
+			"import": "./dist/runtime/stealth.js",
+			"default": "./dist/runtime/stealth.js"
+		},
 		"./stateful": {
 			"types": "./dist/stateful/index.d.ts",
 			"import": "./dist/stateful/index.js",
@@ -97,6 +122,7 @@
 		"@biomejs/biome": "^2.5.0",
 		"@types/bun": "latest",
 		"@types/node": "^25.9.3",
+		"ajv": "^8.17",
 		"typescript": "6.0.3"
 	},
 	"dependencies": {
@@ -104,7 +130,6 @@
 		"@rgrove/parse-xml": "4.2.2",
 		"@types/ms": "^2.1.0",
 		"acorn": "^8.17.0",
-		"ajv": "^8.17",
 		"hono": "^4.12.25",
 		"ioredis": "^5.11.1",
 		"ms": "^2.1.3",

package/src/auth-turn/index.ts

@@ -24,7 +24,7 @@ export const AUTH_TURN_SCHEMA_ARTIFACT_PATH = "dist/auth-turn/auth-turn.v1.schem
  *
  * This is the exact codification of the runtime validation the SDK applies to
  * ceremony outputs (see `validateCeremonyOutput` in `src/ceremonies`), which
- * compiles this same document. `kind` is an OPEN string on the wire: the known
+ * evaluates this same document. `kind` is an OPEN string on the wire: the known
  * kinds in {@link TURN_KINDS} are tooling metadata, never a wire constraint.
  *
  * The committed artifact at `src/auth-turn/auth-turn.v1.schema.json` (shipped

package/src/ceremonies/index.ts

@@ -1,7 +1,5 @@
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 
-import Ajv2020 from "ajv/dist/2020.js";
-
 import { AUTH_TURN_SCHEMA, type KnownAuthTurnKind } from "../auth-turn/index.js";
 import {
 	FlowExpiredError,
@@ -16,13 +14,14 @@ type TurnKind = KnownAuthTurnKind;
 type CeremonyHandler = AuthFlowInputHandler;
 
 type JsonObject = Record<string, unknown>;
-
-const ajv = new Ajv2020({ allErrors: true, strict: true, strictSchema: true });
-
-// Runtime ceremony-output validation derives from the exported versioned
-// contract: it compiles the exact AUTH_TURN_SCHEMA document shipped at
-// dist/auth-turn/auth-turn.v1.schema.json, so the two cannot drift.
-const validateAuthTurn = ajv.compile(AUTH_TURN_SCHEMA);
+type JsonSchemaNode = {
+	readonly additionalProperties?: boolean;
+	readonly minimum?: number;
+	readonly minLength?: number;
+	readonly properties?: Readonly<Record<string, JsonSchemaNode>>;
+	readonly required?: readonly string[];
+	readonly type?: "number" | "object" | "string";
+};
 
 const OAUTH2_STATE_KEY = "__oauth2_state";
 const OAUTH2_PKCE_VERIFIER_KEY = "__oauth2_pkce_verifier";
@@ -45,6 +44,56 @@ function isRecord(value: unknown): value is JsonObject {
 	return !!value && typeof value === "object" && !Array.isArray(value);
 }
 
+function validateSchemaNode(
+	value: unknown,
+	schema: JsonSchemaNode,
+	path: string,
+	errors: string[],
+): void {
+	if (schema.type === "object") {
+		if (!isRecord(value)) {
+			errors.push(`${path} must be object`);
+			return;
+		}
+		const properties = schema.properties ?? {};
+		for (const required of schema.required ?? []) {
+			if (!Object.hasOwn(value, required) || value[required] === undefined) {
+				errors.push(`${path} must have required property '${required}'`);
+			}
+		}
+		if (schema.additionalProperties === false) {
+			for (const key of Object.keys(value)) {
+				if (!Object.hasOwn(properties, key)) {
+					errors.push(`${path} must NOT have additional property '${key}'`);
+				}
+			}
+		}
+		for (const [key, childSchema] of Object.entries(properties)) {
+			if (Object.hasOwn(value, key) && value[key] !== undefined) {
+				validateSchemaNode(value[key], childSchema, `${path}/${key}`, errors);
+			}
+		}
+		return;
+	}
+
+	if (schema.type === "string") {
+		if (typeof value !== "string") {
+			errors.push(`${path} must be string`);
+		} else if (schema.minLength !== undefined && value.length < schema.minLength) {
+			errors.push(`${path} must NOT have fewer than ${schema.minLength} characters`);
+		}
+		return;
+	}
+
+	if (schema.type === "number") {
+		if (typeof value !== "number" || !Number.isFinite(value)) {
+			errors.push(`${path} must be number`);
+		} else if (schema.minimum !== undefined && value < schema.minimum) {
+			errors.push(`${path} must be >= ${schema.minimum}`);
+		}
+	}
+}
+
 function ensureRecord(value: unknown): JsonObject {
 	return isRecord(value) ? value : {};
 }
@@ -162,14 +211,17 @@ function withDeclaredFormFieldOrder(expectedInput: JsonObject): JsonObject {
 }
 
 export function validateCeremonyOutput(turn: unknown): AuthTurn {
-	if (!validateAuthTurn(turn)) {
-		const detail = validateAuthTurn.errors
-			?.map((error) => `${error.instancePath || "$"} ${error.message ?? "invalid"}`)
-			.join("; ");
-		throw new TurnValidationError(detail || "Invalid AuthTurn output");
+	// Evaluate the exact exported versioned schema without eagerly initializing
+	// a general-purpose JSON Schema compiler in every provider process. Contract
+	// parity tests compare this focused evaluator with AJV over all fixtures and
+	// edge probes, so the runtime and shipped document remain locked together.
+	const errors: string[] = [];
+	validateSchemaNode(turn, AUTH_TURN_SCHEMA, "", errors);
+	if (errors.length > 0) {
+		throw new TurnValidationError(errors.join("; "));
 	}
 
-	return turn;
+	return turn as AuthTurn;
 }
 
 export function createOAuth2Ceremony(options: {
@@ -285,9 +337,7 @@ export function createOAuth2ProxiedStart(
 				}
 				const clientId = getRequiredEnv(ctx, options.clientIdEnvKey);
 				if (!ctx.flowId) {
-					throw new ValidationError(
-						"OAuth2 proxied start requires the gateway flow id.",
-					);
+					throw new ValidationError("OAuth2 proxied start requires the gateway flow id.");
 				}
 
 				const authorizePath = new URL(options.authorizeUrl).pathname;

package/src/config/loader.ts

@@ -1,8 +1,9 @@
 import { createHash, randomUUID } from "node:crypto";
 import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
 import path from "node:path";
 
-import { Redis } from "ioredis";
+import type { Redis } from "ioredis";
 
 import type { ProviderProxyPolicy, ProviderProxyProvider, TraceConfig } from "../types.js";
 import {
@@ -217,6 +218,7 @@ type ProxyRedisClient = Pick<
 >;
 
 const proxyCache = new Map<string, CachedProxyPool>();
+const require = createRequire(import.meta.url);
 const proxyInflight = new Map<string, Promise<SmartproxyAllocationResult>>();
 const invalidatedProxyKeys = new Map<string, number>();
 const redisClients = new Map<string, ProxyRedisClient>();
@@ -276,7 +278,8 @@ function getProxyRedis(): ProxyRedisClient | undefined {
 	const existing = redisClients.get(redisUrl);
 	if (existing) return existing;
 
-	const redis = new Redis(redisUrl, {
+	const { Redis: RedisClient } = require("ioredis") as typeof import("ioredis");
+	const redis = new RedisClient(redisUrl, {
 		connectTimeout: REDIS_TIMEOUT_MS,
 		enableOfflineQueue: false,
 		lazyConnect: true,

package/src/index.ts

@@ -50,7 +50,6 @@ export * from "./recipes/gov-api.js";
 export * from "./recipes/rest-api.js";
 export { createFlowContext, createScratchpad } from "./runtime/auth-flow.js";
 export type { BrowserClientOptions } from "./runtime/browser.js";
-export { BrowserClient, createBrowserClient } from "./runtime/browser.js";
 export {
 	APIFUSE__CACHE__KEY_PEPPER_ENV,
 	createBypassProviderCache,
@@ -72,25 +71,23 @@ export { createEnvContext } from "./runtime/env.js";
 export { executeOperation } from "./runtime/executor.js";
 export { createHttpClient } from "./runtime/http.js";
 export {
-	createNativeNetworkClient,
-	createEnvVendorCredentialResolver,
-	deriveNativeCredentialAffinityKey,
 	NativeEgressGrantExpiredError,
 	NativeEgressNotDeclaredError,
 	NativeIdleTimeoutError,
 	NativeNetworkError,
 	NativeProxyExpiredError,
-	resolveNativeGatewayProxy,
-	type NativeGatewayProxy,
-	type NativeGatewayProxyResolutionInput,
-	type NativeGatewayProxySkipReason,
-	type NativeGatewayProxySynthesizer,
-	type NativeGatewayProxySynthesisResult,
-	type NativeGatewayProxySynthesisInput,
-	type NativeNetworkClientOptions,
-	type NativeNetworkErrorCode,
-	type VendorCredentialLookup,
-	type VendorCredentialResolver,
+} from "./runtime/native-network-errors.js";
+export type {
+	NativeGatewayProxy,
+	NativeGatewayProxyResolutionInput,
+	NativeGatewayProxySkipReason,
+	NativeGatewayProxySynthesizer,
+	NativeGatewayProxySynthesisResult,
+	NativeGatewayProxySynthesisInput,
+	NativeNetworkClientOptions,
+	NativeNetworkErrorCode,
+	VendorCredentialLookup,
+	VendorCredentialResolver,
 } from "./runtime/native-network.js";
 export type { Insight, InsightSeverity } from "./runtime/insights.js";
 export { generateInsights } from "./runtime/insights.js";
@@ -99,7 +96,7 @@ export {
 	type InstrumentedProviderContext,
 	wrapWithInstrumentation,
 } from "./runtime/instrumentation.js";
-export { type PrevalidateResult, prevalidate } from "./runtime/prevalidate.js";
+export type { PrevalidateResult } from "./runtime/prevalidate.js";
 export { getProviderBaseUrl } from "./runtime/provider.js";
 export {
 	APIFUSE__CDP_POOL__URL,
@@ -107,12 +104,10 @@ export {
 	APIFUSE__RESOLVER__CAPMONSTER__API_KEY,
 	APIFUSE__RESOLVER__CAPSOLVER__API_KEY,
 	APIFUSE__RESOLVER__TIMEOUT_MS,
-	createResolverClientFromEnv,
-	createUnsupportedResolverClient,
 	DEFAULT_RESOLVER_TIMEOUT_MS,
-	invalidateResolverSolution,
-	type ResolverRuntimeOptions,
-} from "./runtime/resolver.js";
+} from "./runtime/resolver-config.js";
+export { createUnsupportedResolverClient } from "./runtime/resolver-shared.js";
+export type { ResolverRuntimeOptions } from "./runtime/resolver.js";
 export type { ResolverVendorTransport } from "./runtime/resolver-vendors/types.js";
 export {
 	assertRequiredSecretsPresent,
@@ -123,7 +118,6 @@ export {
 	createUnsupportedProviderRuntimeState,
 	UnsupportedProviderStateError,
 } from "./runtime/state.js";
-export { createStealthClient } from "./runtime/stealth.js";
 export {
 	APIFUSE__OCR__API_KEY_ENV,
 	APIFUSE__OCR__BACKEND_ENV,
@@ -174,10 +168,11 @@ export {
 } from "./schema.js";
 export {
 	createServerApp,
+	createServerAppAsync,
 	ERROR_OBSERVABILITY_HEADER,
 	type ServeOptions,
 	serve,
-} from "./server/index.js";
+} from "./server/serve.js";
 export { getStealthProfile, listStealthProfiles } from "./stealth/profiles.js";
 export * from "./stream.js";
 export type {

package/src/provider.ts

@@ -167,25 +167,23 @@ export type {
 	StateWriteOptions,
 } from "./types.js";
 export {
-	createNativeNetworkClient,
-	createEnvVendorCredentialResolver,
-	deriveNativeCredentialAffinityKey,
 	NativeEgressGrantExpiredError,
 	NativeEgressNotDeclaredError,
 	NativeIdleTimeoutError,
 	NativeNetworkError,
 	NativeProxyExpiredError,
-	resolveNativeGatewayProxy,
-	type NativeGatewayProxy,
-	type NativeGatewayProxyResolutionInput,
-	type NativeGatewayProxySkipReason,
-	type NativeGatewayProxySynthesizer,
-	type NativeGatewayProxySynthesisResult,
-	type NativeGatewayProxySynthesisInput,
-	type NativeNetworkClientOptions,
-	type NativeNetworkErrorCode,
-	type VendorCredentialLookup,
-	type VendorCredentialResolver,
+} from "./runtime/native-network-errors.js";
+export type {
+	NativeGatewayProxy,
+	NativeGatewayProxyResolutionInput,
+	NativeGatewayProxySkipReason,
+	NativeGatewayProxySynthesizer,
+	NativeGatewayProxySynthesisResult,
+	NativeGatewayProxySynthesisInput,
+	NativeNetworkClientOptions,
+	NativeNetworkErrorCode,
+	VendorCredentialLookup,
+	VendorCredentialResolver,
 } from "./runtime/native-network.js";
 export {
 	HttpRetryAfterPolicy,

package/src/runtime/auth-flow.ts

@@ -10,7 +10,7 @@ import type {
 	SttContext,
 } from "../types.js";
 import { createUnsupportedOcrClient } from "./ocr.js";
-import { createUnsupportedResolverClient } from "./resolver.js";
+import { createUnsupportedResolverClient } from "./resolver-shared.js";
 import { createUnsupportedSttClient } from "./stt.js";
 
 function normalizeAllowedKeys(allowedKeys: string[]): Set<string> {