@apifuse/provider-sdk 2.2.0-beta.3 → 2.2.0-beta.4

package/dist/index.d.ts

@@ -1,42 +1,43 @@
-export * from "./auth";
-export * from "./ceremonies";
-export * from "./choice-token";
-export type { ApiFuseConfig, BrowserConfig, ProxyConfig, SessionConfig, } from "./config/loader";
-export { defineConfig, loadApiFuseConfig } from "./config/loader";
-export { canonicalJson, digestProviderContract, extractProviderContract, type JsonPrimitive, type JsonValue, PROVIDER_CONTRACT_SCHEMA_VERSION, type ProviderContractOperation, type ProviderContractSnapshot, } from "./contract";
-export { centered, delayed, defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, defineStreamOperation, every, type ProviderConfig, } from "./define";
-export type { DevServerOptions } from "./dev";
-export { createDevServer, startDevServer } from "./dev";
-export * from "./errors";
-export * from "./i18n";
-export { type LintDiagnostic, lintOperation, lintProvider, } from "./lint";
-export * from "./recipes/gov-api";
-export * from "./recipes/rest-api";
-export { createFlowContext, createScratchpad } from "./runtime/auth-flow";
-export type { BrowserClientOptions } from "./runtime/browser";
-export { BrowserClient, createBrowserClient } from "./runtime/browser";
-export { createBypassProviderCache, createProviderCache, type ProviderCacheOptions, resetProviderCacheForTests, } from "./runtime/cache";
-export { type CreateProviderChoiceContextOptions, createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice";
-export { type CreateCredentialContextOptions, createCredentialContext, } from "./runtime/credential";
-export { createEnvContext } from "./runtime/env";
-export { executeOperation } from "./runtime/executor";
-export { createHttpClient } from "./runtime/http";
-export type { Insight, InsightSeverity } from "./runtime/insights";
-export { generateInsights } from "./runtime/insights";
-export { type InstrumentationOptions, type InstrumentedProviderContext, wrapWithInstrumentation, } from "./runtime/instrumentation";
-export { type PrevalidateResult, prevalidate } from "./runtime/prevalidate";
-export { getProviderBaseUrl } from "./runtime/provider";
-export { createUnsupportedProviderRuntimeState, UnsupportedProviderStateError, } from "./runtime/state";
-export { createStealthClient } from "./runtime/stealth";
-export { APIFUSE__STT__BACKEND_ENV, APIFUSE__STT__CLOUDFLARE_API_TOKEN_ENV, APIFUSE__STT__MODEL_ENV, createSttClientFromEnv, createUnsupportedSttClient, extractVerificationCode, resolveSttPrompt, } from "./runtime/stt";
-export { type CreateTraceContextOptions, createTraceContext, type Span, type TraceContext, } from "./runtime/trace";
-export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, type SensitiveFieldKind, type SensitiveFieldOptions, type SensitivePath, sensitive, z, } from "./schema";
-export { createServerApp, type ServeOptions, serve } from "./server";
-export { getStealthProfile, listStealthProfiles } from "./stealth/profiles";
-export * from "./stream";
-export type { ApiFuseResponse, AuthConfig, AuthContext, AuthFlowDefinition, AuthFlowInputHandler, AuthFlowStartHandler, AuthMode, AuthTurn, Bcp47Locale, BrowserEngine, BrowserOptions, BrowserResourceBody, BrowserResourceDecision, BrowserResourceMethod, BrowserResourcePolicy, BrowserResourceRequest, BrowserResourceRoute, ConnectionMode, ContextDeclaration, CookieJar, ContextScratchpad, CredentialContext, CredentialDeclaration, E164PhoneNumber, EnvContext, FlowContext, FlowContextStore, HealthCheckAssertionContext, HealthCheckCase, HealthCheckCaseResult, HealthCheckSuite, HealthCheckUnsupported, HealthJourneyDefinition, HealthJourneyEventContext, HealthJourneyGatewayContext, HealthJourneyJournalContext, HealthJourneyManualTriggerPolicy, HealthJourneyRunContext, HealthJourneyRunResult, HealthJourneySchedule, HealthScheduleRandomization, HealthJourneySmsContext, HealthJourneyStep, HttpClient, HttpMethod, HttpResponse, HttpRetryOptions, HttpRetrySummary, HttpStreamResponse, IanaTimeZone, InferSchemaOutput, Iso3166Alpha2CountryCode, Iso4217CurrencyCode, Iso8601Duration, OperationAnnotations, OperationApprovalPolicy, OperationContractMetadata, OperationDefinition, OperationDeprecationMetadata, OperationDocMeta, OperationErrorCode, OperationHandlerResult, OperationInputExample, OperationLifecycle, OperationObservabilityConfig, OperationObservabilitySensitiveConfig, OperationRelationships, OperationRiskClass, OperationSensitivePath, OperationToolRouterMetadata, OperationTransport, OperationTransportKind, ProbeInterval, ProviderAccessConfig, ProviderAccessVisibility, ProviderCache, ProviderCacheGetOrSetOptions, ProviderCacheKeyOptions, ProviderCacheLookupMeta, ProviderCacheResponseMeta, ProviderCacheResult, ProviderChoiceBindingOptions, ProviderChoiceContext, ProviderChoiceIssueOptions, ProviderChoiceParseOptions, ProviderContext, ProviderDefinition, ProviderHealthMonitorConfig, ProviderHealthProbeConfig, ProviderLocale, ProviderLocaleKey, ProviderLocaleKeyInput, ProviderLogoProfile, ProviderLogoSource, ProviderMeta, ProviderProxyConfig, ProviderProxyMode, ProviderProxyPolicy, ProviderProxyProvider, ProviderProxySessionAffinity, ProviderPublicConnectionMode, ProviderPublicProfile, ProviderReviewed, ProviderRuntimeState, ProviderSecretDeclaration, ProviderStateDurationString, ProviderStateNamespace, ProviderStreamEvent, ProviderSttConfig, ProviderSttMode, ProviderSupportLevel, RequestOptions, Rfc3339Instant, SchemaLike, SmsOrigin, SmsOtpExtractionPattern, SmsOtpMatcherDefinition, SseMessage, StandardSchemaV1, StateCasResult, StateNamespaceOptions, StateValue, StateWriteOptions, StealthClient, StealthFetchOptions, StealthPlatform, StealthProfile, StealthRedirectHop, StealthRedirectRunOptions, StealthRedirectRunResult, StealthResponse, StealthSession, StealthSessionCookies, SttAudioInput, SttContext, SttPromptPolicy, SttSegment, SttTranscribeMode, SttTranscribeRequest, SttTranscript, SttUnsupportedOptionPolicy, SttUsage, SttVerificationCodeOptions, SttWarning, TraceConfig, TraceSpan, VerificationCodeCandidate, VerificationCodeCandidateSource, VerificationCodeExtractionResult, } from "./types";
-export { DEFAULT_OPERATION_TRANSPORT, HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, PROBE_INTERVALS, STREAM_CHUNK_BYTES_MAX, STREAM_CHUNK_BYTES_MIN, STREAM_HEARTBEAT_MS_MAX, STREAM_HEARTBEAT_MS_MIN, STREAM_IDLE_TIMEOUT_MS_MAX, STREAM_IDLE_TIMEOUT_MS_MIN, STREAM_MAX_DURATION_MS_MAX, STREAM_MAX_DURATION_MS_MIN, } from "./types";
-export * from "./utils/date";
-export * from "./utils/parse";
-export * from "./utils/text";
-export * from "./utils/transform";
+export * from "./auth.js";
+export * from "./ceremonies/index.js";
+export * from "./choice-token.js";
+export type { ApiFuseConfig, BrowserConfig, ProxyConfig, SessionConfig, } from "./config/loader.js";
+export { defineConfig, loadApiFuseConfig } from "./config/loader.js";
+export { canonicalJson, digestProviderContract, extractProviderContract, type JsonPrimitive, type JsonValue, PROVIDER_CONTRACT_SCHEMA_VERSION, type ProviderContractOperation, type ProviderContractSnapshot, } from "./contract.js";
+export { centered, delayed, defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, defineStreamOperation, every, type ProviderConfig, } from "./define.js";
+export type { DevServerOptions } from "./dev.js";
+export { createDevServer, startDevServer } from "./dev.js";
+export * from "./errors.js";
+export * from "./user-input.js";
+export * from "./i18n/index.js";
+export { type LintDiagnostic, lintOperation, lintProvider, } from "./lint.js";
+export * from "./recipes/gov-api.js";
+export * from "./recipes/rest-api.js";
+export { createFlowContext, createScratchpad } from "./runtime/auth-flow.js";
+export type { BrowserClientOptions } from "./runtime/browser.js";
+export { BrowserClient, createBrowserClient } from "./runtime/browser.js";
+export { createBypassProviderCache, createProviderCache, type ProviderCacheOptions, resetProviderCacheForTests, } from "./runtime/cache.js";
+export { type CreateProviderChoiceContextOptions, createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice.js";
+export { type CreateCredentialContextOptions, createCredentialContext, } from "./runtime/credential.js";
+export { createEnvContext } from "./runtime/env.js";
+export { executeOperation } from "./runtime/executor.js";
+export { createHttpClient } from "./runtime/http.js";
+export type { Insight, InsightSeverity } from "./runtime/insights.js";
+export { generateInsights } from "./runtime/insights.js";
+export { type InstrumentationOptions, type InstrumentedProviderContext, wrapWithInstrumentation, } from "./runtime/instrumentation.js";
+export { type PrevalidateResult, prevalidate } from "./runtime/prevalidate.js";
+export { getProviderBaseUrl } from "./runtime/provider.js";
+export { createUnsupportedProviderRuntimeState, UnsupportedProviderStateError, } from "./runtime/state.js";
+export { createStealthClient } from "./runtime/stealth.js";
+export { APIFUSE__STT__BACKEND_ENV, APIFUSE__STT__CLOUDFLARE_API_TOKEN_ENV, APIFUSE__STT__MODEL_ENV, createSttClientFromEnv, createUnsupportedSttClient, extractVerificationCode, resolveSttPrompt, } from "./runtime/stt.js";
+export { type CreateTraceContextOptions, createTraceContext, type Span, type TraceContext, } from "./runtime/trace.js";
+export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, type SensitiveFieldKind, type SensitiveFieldOptions, type SensitivePath, sensitive, z, } from "./schema.js";
+export { createServerApp, type ServeOptions, serve } from "./server/index.js";
+export { getStealthProfile, listStealthProfiles } from "./stealth/profiles.js";
+export * from "./stream.js";
+export type { ApiFuseResponse, AuthConfig, AuthContext, AuthFlowDefinition, AuthFlowInputHandler, AuthFlowStartHandler, AuthMode, AuthTurn, Bcp47Locale, BrowserEngine, BrowserOptions, BrowserResourceBody, BrowserResourceDecision, BrowserResourceMethod, BrowserResourcePolicy, BrowserResourceRequest, BrowserResourceRoute, ConnectionMode, ContextDeclaration, CookieJar, ContextScratchpad, CredentialContext, CredentialDeclaration, E164PhoneNumber, EnvContext, FlowContext, FlowContextStore, HealthCheckAssertionContext, HealthCheckCase, HealthCheckCaseResult, HealthCheckSuite, HealthCheckUnsupported, HealthJourneyDefinition, HealthJourneyEventContext, HealthJourneyGatewayContext, HealthJourneyJournalContext, HealthJourneyManualTriggerPolicy, HealthJourneyRunContext, HealthJourneyRunResult, HealthJourneySchedule, HealthScheduleRandomization, HealthJourneySmsContext, HealthJourneyStep, HttpClient, HttpMethod, HttpResponse, HttpRetryOptions, HttpRetrySummary, HttpStreamResponse, IanaTimeZone, InferSchemaOutput, Iso3166Alpha2CountryCode, Iso4217CurrencyCode, Iso8601Duration, OperationAnnotations, OperationApprovalPolicy, OperationContractMetadata, OperationDefinition, OperationDeprecationMetadata, OperationDocMeta, OperationErrorCode, OperationHandlerResult, OperationInputExample, OperationLifecycle, OperationObservabilityConfig, OperationObservabilitySensitiveConfig, OperationRelationships, OperationRiskClass, OperationSensitivePath, OperationToolRouterMetadata, OperationTransport, OperationTransportKind, ProbeInterval, ProviderAccessConfig, ProviderAccessVisibility, ProviderCache, ProviderCacheGetOrSetOptions, ProviderCacheKeyOptions, ProviderCacheLookupMeta, ProviderCacheResponseMeta, ProviderCacheResult, ProviderChoiceBindingOptions, ProviderChoiceContext, ProviderChoiceIssueOptions, ProviderChoiceParseOptions, ProviderContext, ProviderDefinition, ProviderDeploymentOverrides, ProviderHealthMonitorConfig, ProviderHealthProbeConfig, ProviderLocale, ProviderLocaleKey, ProviderLocaleKeyInput, ProviderLogoProfile, ProviderLogoSource, ProviderMeta, ProviderProxyConfig, ProviderProxyMode, ProviderProxyPolicy, ProviderProxyProvider, ProviderProxySessionAffinity, ProviderPublicConnectionMode, ProviderPublicProfile, ProviderReviewed, ProviderRuntimeState, ProviderSecretDeclaration, ProviderStateDurationString, ProviderStateNamespace, ProviderStreamEvent, ProviderSttConfig, ProviderSttMode, ProviderSupportLevel, RequestOptions, Rfc3339Instant, SchemaLike, SmsOrigin, SmsOtpExtractionPattern, SmsOtpMatcherDefinition, SseMessage, StandardSchemaV1, StateCasResult, StateNamespaceOptions, StateValue, StateWriteOptions, StealthClient, StealthFetchOptions, StealthPlatform, StealthProfile, StealthRedirectHop, StealthRedirectRunOptions, StealthRedirectRunResult, StealthResponse, StealthSession, StealthSessionCookies, SttAudioInput, SttContext, SttPromptPolicy, SttSegment, SttTranscribeMode, SttTranscribeRequest, SttTranscript, SttUnsupportedOptionPolicy, SttUsage, SttVerificationCodeOptions, SttWarning, TraceConfig, TraceSpan, VerificationCodeCandidate, VerificationCodeCandidateSource, VerificationCodeExtractionResult, } from "./types.js";
+export { DEFAULT_OPERATION_TRANSPORT, HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, PROBE_INTERVALS, STREAM_CHUNK_BYTES_MAX, STREAM_CHUNK_BYTES_MIN, STREAM_HEARTBEAT_MS_MAX, STREAM_HEARTBEAT_MS_MIN, STREAM_IDLE_TIMEOUT_MS_MAX, STREAM_IDLE_TIMEOUT_MS_MIN, STREAM_MAX_DURATION_MS_MAX, STREAM_MAX_DURATION_MS_MIN, } from "./types.js";
+export * from "./utils/date.js";
+export * from "./utils/parse.js";
+export * from "./utils/text.js";
+export * from "./utils/transform.js";

package/dist/index.js

@@ -1,38 +1,39 @@
 // @apifuse/provider-sdk
-export * from "./auth";
-export * from "./ceremonies";
-export * from "./choice-token";
-export { defineConfig, loadApiFuseConfig } from "./config/loader";
-export { canonicalJson, digestProviderContract, extractProviderContract, PROVIDER_CONTRACT_SCHEMA_VERSION, } from "./contract";
-export { centered, delayed, defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, defineStreamOperation, every, } from "./define";
-export { createDevServer, startDevServer } from "./dev";
-export * from "./errors";
-export * from "./i18n";
-export { lintOperation, lintProvider, } from "./lint";
-export * from "./recipes/gov-api";
-export * from "./recipes/rest-api";
-export { createFlowContext, createScratchpad } from "./runtime/auth-flow";
-export { BrowserClient, createBrowserClient } from "./runtime/browser";
-export { createBypassProviderCache, createProviderCache, resetProviderCacheForTests, } from "./runtime/cache";
-export { createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice";
-export { createCredentialContext, } from "./runtime/credential";
-export { createEnvContext } from "./runtime/env";
-export { executeOperation } from "./runtime/executor";
-export { createHttpClient } from "./runtime/http";
-export { generateInsights } from "./runtime/insights";
-export { wrapWithInstrumentation, } from "./runtime/instrumentation";
-export { prevalidate } from "./runtime/prevalidate";
-export { getProviderBaseUrl } from "./runtime/provider";
-export { createUnsupportedProviderRuntimeState, UnsupportedProviderStateError, } from "./runtime/state";
-export { createStealthClient } from "./runtime/stealth";
-export { APIFUSE__STT__BACKEND_ENV, APIFUSE__STT__CLOUDFLARE_API_TOKEN_ENV, APIFUSE__STT__MODEL_ENV, createSttClientFromEnv, createUnsupportedSttClient, extractVerificationCode, resolveSttPrompt, } from "./runtime/stt";
-export { createTraceContext, } from "./runtime/trace";
-export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, sensitive, z, } from "./schema";
-export { createServerApp, serve } from "./server";
-export { getStealthProfile, listStealthProfiles } from "./stealth/profiles";
-export * from "./stream";
-export { DEFAULT_OPERATION_TRANSPORT, HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, PROBE_INTERVALS, STREAM_CHUNK_BYTES_MAX, STREAM_CHUNK_BYTES_MIN, STREAM_HEARTBEAT_MS_MAX, STREAM_HEARTBEAT_MS_MIN, STREAM_IDLE_TIMEOUT_MS_MAX, STREAM_IDLE_TIMEOUT_MS_MIN, STREAM_MAX_DURATION_MS_MAX, STREAM_MAX_DURATION_MS_MIN, } from "./types";
-export * from "./utils/date";
-export * from "./utils/parse";
-export * from "./utils/text";
-export * from "./utils/transform";
+export * from "./auth.js";
+export * from "./ceremonies/index.js";
+export * from "./choice-token.js";
+export { defineConfig, loadApiFuseConfig } from "./config/loader.js";
+export { canonicalJson, digestProviderContract, extractProviderContract, PROVIDER_CONTRACT_SCHEMA_VERSION, } from "./contract.js";
+export { centered, delayed, defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, defineStreamOperation, every, } from "./define.js";
+export { createDevServer, startDevServer } from "./dev.js";
+export * from "./errors.js";
+export * from "./user-input.js";
+export * from "./i18n/index.js";
+export { lintOperation, lintProvider, } from "./lint.js";
+export * from "./recipes/gov-api.js";
+export * from "./recipes/rest-api.js";
+export { createFlowContext, createScratchpad } from "./runtime/auth-flow.js";
+export { BrowserClient, createBrowserClient } from "./runtime/browser.js";
+export { createBypassProviderCache, createProviderCache, resetProviderCacheForTests, } from "./runtime/cache.js";
+export { createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice.js";
+export { createCredentialContext, } from "./runtime/credential.js";
+export { createEnvContext } from "./runtime/env.js";
+export { executeOperation } from "./runtime/executor.js";
+export { createHttpClient } from "./runtime/http.js";
+export { generateInsights } from "./runtime/insights.js";
+export { wrapWithInstrumentation, } from "./runtime/instrumentation.js";
+export { prevalidate } from "./runtime/prevalidate.js";
+export { getProviderBaseUrl } from "./runtime/provider.js";
+export { createUnsupportedProviderRuntimeState, UnsupportedProviderStateError, } from "./runtime/state.js";
+export { createStealthClient } from "./runtime/stealth.js";
+export { APIFUSE__STT__BACKEND_ENV, APIFUSE__STT__CLOUDFLARE_API_TOKEN_ENV, APIFUSE__STT__MODEL_ENV, createSttClientFromEnv, createUnsupportedSttClient, extractVerificationCode, resolveSttPrompt, } from "./runtime/stt.js";
+export { createTraceContext, } from "./runtime/trace.js";
+export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, sensitive, z, } from "./schema.js";
+export { createServerApp, serve } from "./server/index.js";
+export { getStealthProfile, listStealthProfiles } from "./stealth/profiles.js";
+export * from "./stream.js";
+export { DEFAULT_OPERATION_TRANSPORT, HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, PROBE_INTERVALS, STREAM_CHUNK_BYTES_MAX, STREAM_CHUNK_BYTES_MIN, STREAM_HEARTBEAT_MS_MAX, STREAM_HEARTBEAT_MS_MIN, STREAM_IDLE_TIMEOUT_MS_MAX, STREAM_IDLE_TIMEOUT_MS_MIN, STREAM_MAX_DURATION_MS_MAX, STREAM_MAX_DURATION_MS_MIN, } from "./types.js";
+export * from "./utils/date.js";
+export * from "./utils/parse.js";
+export * from "./utils/text.js";
+export * from "./utils/transform.js";

package/dist/lint.js

@@ -1,5 +1,5 @@
-import { lintPublicSchemaFieldNames } from "./public-schema-field-lint";
-import { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_SENSITIVE_META_KEY, } from "./schema";
+import { lintPublicSchemaFieldNames } from "./public-schema-field-lint.js";
+import { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_SENSITIVE_META_KEY } from "./schema.js";
 const AUTH_OPERATION_ID_PATTERN = /^(?:auth[-_])?(?:login|exchange|continue|refresh|callback)(?:[-_]|$)/i;
 function lintAllowedHosts(providerId, allowedHosts) {
     const prefix = providerId ? `Provider "${providerId}"` : "Provider";
@@ -120,8 +120,7 @@ function lintAuthModel(provider) {
         });
     }
     if (hasReusableSecretKeys(credentialKeys) &&
-        (!provider.credential?.storesReusableSecret ||
-            !provider.credential.justification)) {
+        (!provider.credential?.storesReusableSecret || !provider.credential.justification)) {
         diagnostics.push({
             rule: "credential-reusable-secret",
             level: "error",
@@ -131,8 +130,7 @@ function lintAuthModel(provider) {
     }
     if (typeof provider.auth?.flow?.refresh === "function" &&
         hasReusableReloginSecretKeys(credentialKeys) &&
-        (!provider.credential?.storesReusableSecret ||
-            !provider.credential.justification)) {
+        (!provider.credential?.storesReusableSecret || !provider.credential.justification)) {
         diagnostics.push({
             rule: "auth-refresh-reusable-secret",
             level: "error",
@@ -149,8 +147,7 @@ function lintAuthModel(provider) {
         });
     }
     const authFlowSource = getAuthFlowSource(provider);
-    if (authFlowSource.includes("ctx.context") &&
-        (provider.context?.keys?.length ?? 0) === 0) {
+    if (authFlowSource.includes("ctx.context") && (provider.context?.keys?.length ?? 0) === 0) {
         diagnostics.push({
             rule: "context-keys-required",
             level: "warn",
@@ -435,8 +432,7 @@ function isComplexSchema(schema, seen = new Set()) {
         const childChildren = getChildSchemas(child);
         return childChildren.length > 0;
     });
-    return (hasNestedComposite ||
-        children.some(({ schema: child }) => isComplexSchema(child, seen)));
+    return hasNestedComposite || children.some(({ schema: child }) => isComplexSchema(child, seen));
 }
 function hasBidirectionalFixtures(fixtures) {
     if (!fixtures || typeof fixtures !== "object") {
@@ -448,9 +444,7 @@ function getOperationSource(operation) {
     if (operation.source) {
         return operation.source;
     }
-    return typeof operation.handler === "function"
-        ? operation.handler.toString()
-        : "";
+    return typeof operation.handler === "function" ? operation.handler.toString() : "";
 }
 function lintStealthTransportUsage(provider) {
     if (provider.stealth || !provider.operations) {
@@ -621,8 +615,7 @@ export function lintOperation(op) {
             message: "Operation whenToUse must use whenToUseKeys instead of raw static prose.",
         });
     }
-    if ((op.whenNotToUse?.length ?? 0) > 0 &&
-        !(op.whenNotToUseKeys?.length ?? 0)) {
+    if ((op.whenNotToUse?.length ?? 0) > 0 && !(op.whenNotToUseKeys?.length ?? 0)) {
         diagnostics.push({
             rule: "operation-when-not-to-use-raw-prose",
             level: "error",

package/dist/provider.d.ts

@@ -1,11 +1,11 @@
-export { AuthAbortError, credentialsAuthChallenge, createAuthFlowHelpers, defineCredentialsAuth, } from "./auth";
-export type { CredentialsAuthChallengeDefinition, CredentialsAuthChallengeRequest, CredentialsAuthCompleteResult, CredentialsAuthCredential, CredentialsAuthField, CredentialsAuthFields, CredentialsAuthFieldType, CredentialsAuthInput, CredentialsAuthLoginResult, DefineCredentialsAuthOptions, DefinedCredentialsAuth, } from "./auth";
-export { createFormCeremony } from "./ceremonies";
-export { assertFreshProviderChoiceIssuedAt, createProviderChoiceToken, ProviderChoiceTokenError, type ProviderChoiceTokenErrorReason, type ProviderChoiceTokenPayload, parseProviderChoiceToken, } from "./choice-token";
-export { centered, delayed, defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, every, } from "./define";
-export { AuthError, isProviderError, isSessionExpiredError, isTransportError, ProviderError, SessionExpiredError, TransportError, ValidationError, } from "./errors";
-export { getProviderLocalePath, providerLocaleKey, qualifyProviderLocaleKey, } from "./i18n";
-export { type CreateProviderChoiceContextOptions, createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice";
-export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, type SensitiveFieldKind, type SensitiveFieldOptions, type SensitivePath, sensitive, z, } from "./schema";
-export type { AuthAbortData, AuthAbortRetry, AuthFlowTerminalContext, AuthMode, AuthSafeData, AuthSafeJson, FlowContext, HealthCheckAssertionContext, HealthCheckCase, HealthCheckSuite, HealthCheckUnsupported, HealthJourneyDefinition, HealthJourneyEventContext, HealthJourneyManualTriggerPolicy, HealthJourneyRunContext, HealthJourneyRunResult, HealthScheduleRandomization, HttpRetryOptions, HttpRetrySummary, InferSchemaOutput, OperationApprovalPolicy, OperationContractMetadata, OperationDefinition, OperationDocMeta, OperationErrorCode, OperationInputExample, OperationLifecycle, OperationObservabilityConfig, OperationObservabilitySensitiveConfig, OperationRelationships, OperationRiskClass, OperationSensitivePath, OperationToolRouterMetadata, OperationTransport, ProviderAccessVisibility, ProviderChoiceBindingOptions, ProviderChoiceContext, ProviderChoiceIssueOptions, ProviderChoiceParseOptions, ProviderContext, ProviderDefinition, ProviderLocale, ProviderLocaleKey, ProviderLocaleKeyInput, ProviderLogoProfile, ProviderProxyPolicy, ProviderPublicConnectionMode, ProviderPublicProfile, ProviderRuntimeState, ProviderStateDurationString, ProviderStateNamespace, ProviderSupportLevel, SchemaLike, SmsOtpMatcherDefinition, StandardSchemaV1, StateCasResult, StateNamespaceOptions, StateValue, StateWriteOptions, } from "./types";
-export { HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, } from "./types";
+export { AuthAbortError, credentialsAuthChallenge, createAuthFlowHelpers, defineCredentialsAuth, } from "./auth.js";
+export type { CredentialsAuthChallengeDefinition, CredentialsAuthChallengeRequest, CredentialsAuthCompleteResult, CredentialsAuthCredential, CredentialsAuthField, CredentialsAuthFields, CredentialsAuthFieldType, CredentialsAuthInput, CredentialsAuthLoginResult, DefineCredentialsAuthOptions, DefinedCredentialsAuth, } from "./auth.js";
+export { createFormCeremony } from "./ceremonies/index.js";
+export { assertFreshProviderChoiceIssuedAt, createProviderChoiceToken, ProviderChoiceTokenError, type ProviderChoiceTokenErrorReason, type ProviderChoiceTokenPayload, parseProviderChoiceToken, } from "./choice-token.js";
+export { centered, delayed, defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, every, } from "./define.js";
+export { AuthError, isProviderError, isSessionExpiredError, isTransportError, ProviderError, SessionExpiredError, TransportError, ValidationError, } from "./errors.js";
+export { getProviderLocalePath, providerLocaleKey, qualifyProviderLocaleKey, } from "./i18n/index.js";
+export { type CreateProviderChoiceContextOptions, createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice.js";
+export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, type SensitiveFieldKind, type SensitiveFieldOptions, type SensitivePath, sensitive, z, } from "./schema.js";
+export type { AuthAbortData, AuthAbortRetry, AuthFlowTerminalContext, AuthMode, AuthSafeData, AuthSafeJson, FlowContext, HealthCheckAssertionContext, HealthCheckCase, HealthCheckSuite, HealthCheckUnsupported, HealthJourneyDefinition, HealthJourneyEventContext, HealthJourneyManualTriggerPolicy, HealthJourneyRunContext, HealthJourneyRunResult, HealthScheduleRandomization, HttpRetryOptions, HttpRetrySummary, InferSchemaOutput, OperationApprovalPolicy, OperationContractMetadata, OperationDefinition, OperationDocMeta, OperationErrorCode, OperationInputExample, OperationLifecycle, OperationObservabilityConfig, OperationObservabilitySensitiveConfig, OperationRelationships, OperationRiskClass, OperationSensitivePath, OperationToolRouterMetadata, OperationTransport, ProviderAccessVisibility, ProviderChoiceBindingOptions, ProviderChoiceContext, ProviderChoiceIssueOptions, ProviderChoiceParseOptions, ProviderContext, ProviderDefinition, ProviderDeploymentOverrides, ProviderLocale, ProviderLocaleKey, ProviderLocaleKeyInput, ProviderLogoProfile, ProviderProxyPolicy, ProviderPublicConnectionMode, ProviderPublicProfile, ProviderRuntimeState, ProviderStateDurationString, ProviderStateNamespace, ProviderSupportLevel, SchemaLike, SmsOtpMatcherDefinition, StandardSchemaV1, StateCasResult, StateNamespaceOptions, StateValue, StateWriteOptions, } from "./types.js";
+export { HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, } from "./types.js";

package/dist/provider.js

@@ -1,9 +1,9 @@
-export { AuthAbortError, credentialsAuthChallenge, createAuthFlowHelpers, defineCredentialsAuth, } from "./auth";
-export { createFormCeremony } from "./ceremonies";
-export { assertFreshProviderChoiceIssuedAt, createProviderChoiceToken, ProviderChoiceTokenError, parseProviderChoiceToken, } from "./choice-token";
-export { centered, delayed, defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, every, } from "./define";
-export { AuthError, isProviderError, isSessionExpiredError, isTransportError, ProviderError, SessionExpiredError, TransportError, ValidationError, } from "./errors";
-export { getProviderLocalePath, providerLocaleKey, qualifyProviderLocaleKey, } from "./i18n";
-export { createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice";
-export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, sensitive, z, } from "./schema";
-export { HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, } from "./types";
+export { AuthAbortError, credentialsAuthChallenge, createAuthFlowHelpers, defineCredentialsAuth, } from "./auth.js";
+export { createFormCeremony } from "./ceremonies/index.js";
+export { assertFreshProviderChoiceIssuedAt, createProviderChoiceToken, ProviderChoiceTokenError, parseProviderChoiceToken, } from "./choice-token.js";
+export { centered, delayed, defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, every, } from "./define.js";
+export { AuthError, isProviderError, isSessionExpiredError, isTransportError, ProviderError, SessionExpiredError, TransportError, ValidationError, } from "./errors.js";
+export { getProviderLocalePath, providerLocaleKey, qualifyProviderLocaleKey, } from "./i18n/index.js";
+export { createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice.js";
+export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, sensitive, z, } from "./schema.js";
+export { HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, } from "./types.js";

package/dist/public-schema-field-lint.d.ts

@@ -1,2 +1,2 @@
-import type { LintDiagnostic } from "./lint";
+import type { LintDiagnostic } from "./lint.js";
 export declare function lintPublicSchemaFieldNames(providerId: string | undefined, operationId: string, input: unknown, output: unknown, enforce: boolean): LintDiagnostic[];

package/dist/recipes/gov-api.js

@@ -1,4 +1,4 @@
-import { unwrapEnvelope } from "../utils/parse";
+import { unwrapEnvelope } from "../utils/parse.js";
 function getResultCode(raw) {
     if (!raw || typeof raw !== "object") {
         return undefined;

package/dist/runtime/auth-flow.d.ts

@@ -1,4 +1,4 @@
-import type { ContextScratchpad, EnvContext, FlowContext, HttpClient, StealthClient, SttContext } from "../types";
+import type { ContextScratchpad, EnvContext, FlowContext, HttpClient, StealthClient, SttContext } from "../types.js";
 export declare function createScratchpad(allowedKeys: string[], initial?: Record<string, unknown>): ContextScratchpad;
 export declare function createFlowContext(options: {
     http: HttpClient;

package/dist/runtime/auth-flow.js

@@ -1,6 +1,6 @@
-import { ContextAccessError } from "../errors";
-import { createAuthFlowHelpers } from "../auth";
-import { createUnsupportedSttClient } from "./stt";
+import { ContextAccessError } from "../errors.js";
+import { createAuthFlowHelpers } from "../auth.js";
+import { createUnsupportedSttClient } from "./stt.js";
 function normalizeAllowedKeys(allowedKeys) {
     return new Set(allowedKeys.filter((key) => key.trim().length > 0));
 }

package/dist/runtime/browser.d.ts

@@ -1,4 +1,4 @@
-import type { BrowserChallengeRequest, BrowserChallengeResult, BrowserClient as BrowserClientContract, BrowserEngine, BrowserOptions, BrowserPage } from "../types";
+import type { BrowserChallengeRequest, BrowserChallengeResult, BrowserClient as BrowserClientContract, BrowserEngine, BrowserOptions, BrowserPage } from "../types.js";
 type BrowserPageContract = BrowserPage;
 export type BrowserClientOptions = BrowserOptions & {
     allowedHosts?: string[];

package/dist/runtime/browser.js

@@ -1,5 +1,5 @@
 import { createRequire } from "node:module";
-import { ProviderError } from "../errors";
+import { ProviderError } from "../errors.js";
 const require = createRequire(import.meta.url);
 const DEFAULT_WAIT_TIMEOUT_MS = 30_000;
 const SELECTOR_POLL_INTERVAL_MS = 100;
@@ -83,13 +83,14 @@ function matchesResourceRoute(match, request) {
 function toCdpFulfillParams(requestId, decision) {
     const body = toResourceBody(decision.body);
     return {
-        ...(body === undefined
-            ? {}
-            : { body: Buffer.from(body).toString("base64") }),
+        ...(body === undefined ? {} : { body: Buffer.from(body).toString("base64") }),
         ...(decision.headers === undefined
             ? {}
             : {
-                responseHeaders: Object.entries(decision.headers).map(([name, value]) => ({ name, value })),
+                responseHeaders: Object.entries(decision.headers).map(([name, value]) => ({
+                    name,
+                    value,
+                })),
             }),
         requestId,
         responseCode: decision.status ?? 200,
@@ -574,16 +575,13 @@ function parsePoolAcquireResponse(value) {
             code: "BROWSER_RUNTIME_UNSUPPORTED",
         });
     }
-    if (value.browserContextId !== undefined &&
-        typeof value.browserContextId !== "string") {
+    if (value.browserContextId !== undefined && typeof value.browserContextId !== "string") {
         throw new ProviderError("CDP Pool returned an invalid acquire response", {
             code: "BROWSER_RUNTIME_UNSUPPORTED",
         });
     }
     return {
-        ...(value.browserContextId
-            ? { browserContextId: value.browserContextId }
-            : {}),
+        ...(value.browserContextId ? { browserContextId: value.browserContextId } : {}),
         pageId: value.pageId,
         wsEndpoint: value.wsEndpoint,
     };
@@ -605,9 +603,7 @@ function parseCdpFrameTreeNode(value) {
         frame: {
             id: frameId,
             name: typeof value.frame.name === "string" ? value.frame.name : undefined,
-            parentId: typeof value.frame.parentId === "string"
-                ? value.frame.parentId
-                : undefined,
+            parentId: typeof value.frame.parentId === "string" ? value.frame.parentId : undefined,
             url: typeof value.frame.url === "string" ? value.frame.url : undefined,
         },
         ...(childFrames ? { childFrames } : {}),
@@ -620,9 +616,7 @@ function getCdpExecutionContext(params) {
     const contextId = params.context.id;
     const auxData = params.context.auxData;
     return {
-        frameId: isRecord(auxData) && typeof auxData.frameId === "string"
-            ? auxData.frameId
-            : undefined,
+        frameId: isRecord(auxData) && typeof auxData.frameId === "string" ? auxData.frameId : undefined,
         id: typeof contextId === "number" ? contextId : undefined,
     };
 }
@@ -773,8 +767,7 @@ class CdpPoolBrowserPage {
             returnByValue: true,
         });
         if (result.exceptionDetails) {
-            throw new Error(String(result.exceptionDetails.text ??
-                "Browser evaluation failed"));
+            throw new Error(String(result.exceptionDetails.text ?? "Browser evaluation failed"));
         }
         return result.result?.value;
     }
@@ -859,9 +852,7 @@ class CdpPoolBrowserPage {
         this.closed = true;
         try {
             await this.release({
-                ...(this.browserContextId
-                    ? { browserContextId: this.browserContextId }
-                    : {}),
+                ...(this.browserContextId ? { browserContextId: this.browserContextId } : {}),
                 pageId: this.pageId,
             });
         }
@@ -1002,12 +993,8 @@ class CdpPoolBrowserClient {
     }
     async acquirePage(options) {
         const acquireResult = parsePoolAcquireResponse(await this.poolClient.send("acquire", {
-            ...(this.allowedHosts.length > 0
-                ? { allowedHosts: this.allowedHosts }
-                : {}),
-            ...(options?.isolatedContext
-                ? { isolationMode: "browserContext" }
-                : {}),
+            ...(this.allowedHosts.length > 0 ? { allowedHosts: this.allowedHosts } : {}),
+            ...(options?.isolatedContext ? { isolationMode: "browserContext" } : {}),
         }));
         const pageClient = new JsonRpcWebSocketClient(acquireResult.wsEndpoint);
         const page = new CdpPoolBrowserPage(acquireResult.pageId, acquireResult.browserContextId, pageClient, async (request) => {
@@ -1223,8 +1210,7 @@ async function solveRecaptchaChallenge(page, request) {
 async function findRecaptchaFrame(frames, siteKey) {
     for (const frame of frames) {
         const url = await frame.url();
-        const matchesRecaptcha = url.includes("google.com/recaptcha") ||
-            url.includes("recaptcha.net/recaptcha");
+        const matchesRecaptcha = url.includes("google.com/recaptcha") || url.includes("recaptcha.net/recaptcha");
         const matchesSiteKey = !siteKey || url.includes(siteKey);
         if (matchesRecaptcha && matchesSiteKey) {
             return frame;

package/dist/runtime/cache.d.ts

@@ -1,4 +1,4 @@
-import type { ProviderCache } from "../types";
+import type { ProviderCache } from "../types.js";
 export type ProviderCacheOptions = {
     providerId: string;
     redisUrl?: string;

package/dist/runtime/cache.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
-import { providerCacheRedisUrlFromEnv } from "../config/loader";
-import { createProviderRedisClient, ensureRedisReady, withRedisTimeout, } from "./redis";
+import { providerCacheRedisUrlFromEnv } from "../config/loader.js";
+import { createProviderRedisClient, ensureRedisReady, withRedisTimeout, } from "./redis.js";
 const DEFAULT_PREFIX = "apifuse:provider-cache:v1";
 const DEFAULT_MEMORY_MAX_ENTRIES = 1_000;
 const DEFAULT_REDIS_TIMEOUT_MS = 150;
@@ -71,10 +71,7 @@ function normalizeKeyPart(value, extra) {
     return value;
 }
 function stableHash(value) {
-    return createHash("sha256")
-        .update(JSON.stringify(value))
-        .digest("hex")
-        .slice(0, 32);
+    return createHash("sha256").update(JSON.stringify(value)).digest("hex").slice(0, 32);
 }
 function jitteredTtlMs(ttlMs, jitterPct) {
     if (!jitterPct || jitterPct <= 0)
@@ -282,8 +279,7 @@ export function createProviderCache(options) {
         async delete(key) {
             backend.memory.delete(key);
             const redis = backend.redis;
-            if (!redis ||
-                !(await ensureRedisReady(redis, DEFAULT_REDIS_TIMEOUT_MS))) {
+            if (!redis || !(await ensureRedisReady(redis, DEFAULT_REDIS_TIMEOUT_MS))) {
                 return;
             }
             await withRedisFallback(() => redis.del(key));

package/dist/runtime/choice.d.ts

@@ -1,4 +1,4 @@
-import type { CredentialContext, EnvContext, ProviderChoiceContext, ProviderRequestContext, ProviderRuntimeState } from "../types";
+import type { CredentialContext, EnvContext, ProviderChoiceContext, ProviderRequestContext, ProviderRuntimeState } from "../types.js";
 export declare const PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV = "APIFUSE__PROVIDER_RUNTIME__CHOICE_TOKEN_MASTER_SECRET";
 export type CreateProviderChoiceContextOptions = {
     readonly providerId: string;

package/dist/runtime/choice.js

@@ -1,6 +1,6 @@
 import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes, timingSafeEqual, } from "node:crypto";
-import { assertFreshProviderChoiceIssuedAt, ProviderChoiceTokenError, } from "../choice-token";
-import { ProviderError } from "../errors";
+import { assertFreshProviderChoiceIssuedAt, ProviderChoiceTokenError, } from "../choice-token.js";
+import { ProviderError } from "../errors.js";
 export const PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV = "APIFUSE__PROVIDER_RUNTIME__CHOICE_TOKEN_MASTER_SECRET";
 const PRIMARY_CHOICE_TOKEN_KID = "v1";
 const MANAGED_CHOICE_TOKEN_VERSION = 1;
@@ -53,7 +53,7 @@ export function createProviderChoiceContext(options) {
         });
     }
     function parse(parseOptions) {
-        const [actualPrefix, tokenKid, encodedIv, encryptedPayload, authTag, signature,] = parseManagedChoiceTokenParts(parseOptions.token);
+        const [actualPrefix, tokenKid, encodedIv, encryptedPayload, authTag, signature] = parseManagedChoiceTokenParts(parseOptions.token);
         if (actualPrefix !== parseOptions.prefix ||
             tokenKid !== kid ||
             !encodedIv ||
@@ -68,13 +68,7 @@ export function createProviderChoiceContext(options) {
             purpose: parseOptions.purpose,
             kid: tokenKid,
         });
-        const signedBody = [
-            parseOptions.prefix,
-            tokenKid,
-            encodedIv,
-            encryptedPayload,
-            authTag,
-        ].join(".");
+        const signedBody = [parseOptions.prefix, tokenKid, encodedIv, encryptedPayload, authTag].join(".");
         assertManagedChoiceSignature({
             signedBody,
             signature,
@@ -117,13 +111,11 @@ export function createProviderChoiceContext(options) {
 export function createTestProviderChoiceContext(options) {
     return createProviderChoiceContext({
         ...options,
-        masterSecret: options.masterSecret ??
-            "apifuse-test-provider-runtime-choice-token-master-secret",
+        masterSecret: options.masterSecret ?? "apifuse-test-provider-runtime-choice-token-master-secret",
     });
 }
 function resolveChoiceMasterSecret(options) {
-    const configured = options.masterSecret ??
-        options.env?.get(PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV);
+    const configured = options.masterSecret ?? options.env?.get(PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV);
     const trimmed = configured?.trim();
     if (trimmed)
         return trimmed;
@@ -165,13 +157,7 @@ function encryptManagedChoiceToken(options) {
     ]).toString("base64url");
     const authTag = cipher.getAuthTag().toString("base64url");
     const encodedIv = iv.toString("base64url");
-    const signedBody = [
-        options.prefix,
-        options.kid,
-        encodedIv,
-        encryptedPayload,
-        authTag,
-    ].join(".");
+    const signedBody = [options.prefix, options.kid, encodedIv, encryptedPayload, authTag].join(".");
     const signature = createHmac("sha256", options.keys.signing)
         .update(signedBody)
         .digest("base64url");
@@ -345,9 +331,7 @@ function isManagedChoiceEnvelope(value) {
         typeof value.issued_at_ms === "number" &&
         "ttl_ms" in value &&
         typeof value.ttl_ms === "number" &&
-        (!("binding" in value) ||
-            value.binding === undefined ||
-            isChoiceBinding(value.binding)));
+        (!("binding" in value) || value.binding === undefined || isChoiceBinding(value.binding)));
 }
 function isChoicePayload(value) {
     return Boolean(value && typeof value === "object" && !Array.isArray(value));
@@ -355,29 +339,23 @@ function isChoicePayload(value) {
 function isChoiceBinding(value) {
     if (!value || typeof value !== "object" || Array.isArray(value))
         return false;
-    return ((!("connection_hash" in value) ||
-        typeof value.connection_hash === "string") &&
+    return ((!("connection_hash" in value) || typeof value.connection_hash === "string") &&
         (!("credential_hash" in value) || typeof value.credential_hash === "string"));
 }
 function assertManagedChoiceEnvelope(envelope, options) {
-    if (envelope.provider_id !== options.providerId ||
-        envelope.purpose !== options.purpose) {
+    if (envelope.provider_id !== options.providerId || envelope.purpose !== options.purpose) {
         throw new ProviderChoiceTokenError("invalid_payload", "Provider choice token payload is invalid.");
     }
     assertFreshProviderChoiceIssuedAt(envelope.issued_at_ms, {
         // Clamp to the issuer's embedded TTL so a caller-supplied value cannot
         // silently extend token validity past the deadline the issuer intended.
-        ttlMs: options.ttlMs != null
-            ? Math.min(options.ttlMs, envelope.ttl_ms)
-            : envelope.ttl_ms,
+        ttlMs: options.ttlMs != null ? Math.min(options.ttlMs, envelope.ttl_ms) : envelope.ttl_ms,
         nowMs: options.nowMs,
         futureToleranceMs: options.futureToleranceMs,
     });
 }
 function createChoiceBinding(options) {
-    const connectionHash = options.options?.connection
-        ? hashRequiredConnection(options)
-        : undefined;
+    const connectionHash = options.options?.connection ? hashRequiredConnection(options) : undefined;
     const credentialHash = options.options?.credentialKeys?.length
         ? hashCredentialKeys(options)
         : undefined;

package/dist/runtime/credential.d.ts

@@ -1,4 +1,4 @@
-import type { AuthMode, CredentialContext } from "../types";
+import type { AuthMode, CredentialContext } from "../types.js";
 export interface CreateCredentialContextOptions {
     allowedKeys?: string[];
     mode?: AuthMode;