@apifuse/provider-sdk 2.2.0-beta.32 → 2.2.0-beta.35

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @apifuse/provider-sdk Changelog
 
+## 2.2.0-beta.35
+
+- Release candidate for main commit 027fa0087b883a6281bc6d8bdaaf6d0be382000f.
+
+## 2.2.0-beta.34
+
+- Release candidate for main commit 383a97e7d0ce995d098d5f95c9ffdcbeed13de31.
+
+## 2.2.0-beta.33
+
+- Release candidate for main commit e7d854ec3e859702b22e2b37eaa2ae6bd4545c80.
+
 ## 2.2.0-beta.32
 
 - Release candidate for main commit 82f1c0c1de916a40c8c74b1d6470a493b134c0ed.
@@ -46,6 +58,8 @@
 
 ## Unreleased
 
+- Server-stored provider choices now issue word-format tokens unconditionally. The runtime issuance setting and legacy issuance path were removed.
+- **Breaking:** Legacy encrypted server-handle choice tokens are no longer parsed. They are rejected with the uniform choice-not-found error; server-stored choices are now word-only. Encrypted inline choice tokens remain supported.
 - Added the `thrown-error-code-undeclared` authoring lint (warning level): `apifuse check` now statically flags literal `ProviderError`/`ValidationError` codes that are neither SDK-registered nor declared in any operation's `docs.errorCodes`, surfacing the runtime `unregistered_provider_error_code` signal at check time. The canonical SDK code→status mapping moved to `SDK_STATUS_MAPPED_PROVIDER_ERROR_CODES` in `error-resolution.ts`, shared by the runtime status resolver and the lint.
 
 ## 2.2.0-beta.21

package/dist/error-resolution.js

@@ -18,7 +18,6 @@ export const SDK_OWNED_PROVIDER_ERROR_CODES = new Set([
     "RUNTIME_UNSUPPORTED",
     "PROVIDER_STATE_UNSUPPORTED",
     "CHOICE_TOKEN_MASTER_SECRET_NOT_CONFIGURED",
-    "CHOICE_WORD_ISSUANCE_INVALID",
     "CHOICE_STATE_PAYLOAD_TOO_LARGE",
     "CHOICE_STATE_UNAVAILABLE",
     "CHOICE_CONTEXT_REQUIRED",

package/dist/index.d.ts

@@ -17,7 +17,7 @@ export * from "./recipes/rest-api.js";
 export { createFlowContext, createScratchpad } from "./runtime/auth-flow.js";
 export type { BrowserClientOptions } from "./runtime/browser.js";
 export { APIFUSE__CACHE__KEY_PEPPER_ENV, createBypassProviderCache, createProviderCache, type ProviderCacheOptions, } from "./runtime/cache.js";
-export { type CreateProviderChoiceContextOptions, createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, PROVIDER_RUNTIME_CHOICE_WORD_ISSUANCE_ENV, } from "./runtime/choice.js";
+export { type CreateProviderChoiceContextOptions, createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice.js";
 export { type CreateCredentialContextOptions, createCredentialContext, } from "./runtime/credential.js";
 export { createEnvContext } from "./runtime/env.js";
 export { executeOperation } from "./runtime/executor.js";

package/dist/index.js

@@ -15,7 +15,7 @@ export * from "./recipes/gov-api.js";
 export * from "./recipes/rest-api.js";
 export { createFlowContext, createScratchpad } from "./runtime/auth-flow.js";
 export { APIFUSE__CACHE__KEY_PEPPER_ENV, createBypassProviderCache, createProviderCache, } from "./runtime/cache.js";
-export { createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, PROVIDER_RUNTIME_CHOICE_WORD_ISSUANCE_ENV, } from "./runtime/choice.js";
+export { createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice.js";
 export { createCredentialContext, } from "./runtime/credential.js";
 export { createEnvContext } from "./runtime/env.js";
 export { executeOperation } from "./runtime/executor.js";

package/dist/provider.d.ts

@@ -5,7 +5,7 @@ export { assertFreshProviderChoiceIssuedAt, createProviderChoiceToken, ProviderC
 export { centered, delayed, defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, every, } from "./define.js";
 export { AuthError, HttpRedirectError, isProviderError, isSessionExpiredError, isTransportError, ProviderError, SessionExpiredError, TransportError, ValidationError, } from "./errors.js";
 export { getProviderLocalePath, providerLocaleKey, qualifyProviderLocaleKey, } from "./i18n/index.js";
-export { type CreateProviderChoiceContextOptions, createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, PROVIDER_RUNTIME_CHOICE_WORD_ISSUANCE_ENV, } from "./runtime/choice.js";
+export { type CreateProviderChoiceContextOptions, createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice.js";
 export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, type SensitiveFieldKind, type SensitiveFieldOptions, type SensitivePath, sensitive, z, } from "./schema.js";
 export type { AuthAbortData, AuthAbortRetry, AuthFlowTerminalContext, AuthMode, AuthSafeData, AuthSafeJson, FlowContext, HealthCheckAssertionContext, HealthCheckCase, HealthCheckSuite, HealthCheckUnsupported, HealthJourneyDefinition, HealthJourneyEventContext, HealthJourneyManualTriggerPolicy, HealthJourneyRunContext, HealthJourneyRunResult, HealthScheduleRandomization, HttpRedirectFailureReason, HttpRedirectPolicy, HttpRedirectPolicyMode, HttpRetryOptions, HttpRetrySummary, InferSchemaOutput, NativeContext, NativeNetworkClient, NativeNetworkCloseReason, NativeNetworkConnection, NativeNetworkConnectInput, NativeNetworkConnectOptions, NativeNetworkDynamicGrantOptions, NativeNetworkEgressGrant, NativeProviderConfig, NativeProviderContext, NativeProxyDrainHandler, NativeProxyEgressInfo, NativeProxyExpiringEvent, NativeProxyExpiringReason, NativeTcpDynamicEgressRule, NativeTcpEgressGrant, NativeTcpEgressRule, NativeTcpPortRange, NativeTcpTlsMode, NativeTlsConnectOptions, OperationApprovalPolicy, OperationContractMetadata, OperationDefinition, OperationDocMeta, OperationErrorCode, ProviderErrorStatus, OperationInputExample, OperationLifecycle, OperationObservabilityConfig, OperationObservabilitySensitiveConfig, OperationRelationships, OperationRiskClass, OperationSensitivePath, OperationToolRouterMetadata, OperationTransport, ProviderAccessVisibility, ProviderChoiceBindingOptions, ProviderChoiceConsumeMode, ProviderChoiceConsumeResult, ProviderChoiceContext, ProviderChoiceExplicitParseResult, ProviderChoiceIssueOptions, ProviderChoiceParseOptions, ProviderContext, ProviderDefinition, ProviderDeploymentOverrides, ProviderFileRef, ProviderFilesContext, ProviderLocale, ProviderLocaleKey, ProviderLocaleKeyInput, ProviderLogoProfile, ProviderProxyPolicy, ProxiedOAuthConfig, ProviderPublicConnectionMode, ProviderPublicProfile, ProviderResolvedFile, ProviderRuntimeState, ProviderStateDurationString, ProviderStateNamespace, ProviderSupportLevel, RedirectRunReason, SchemaLike, SmsOtpMatcherDefinition, StandardSchemaV1, StateCasResult, StateNamespaceOptions, StateNamespaceScope, StateValue, StateWriteOptions, } from "./types.js";
 export { NativeEgressGrantExpiredError, NativeEgressNotDeclaredError, NativeIdleTimeoutError, NativeNetworkError, NativeProxyExpiredError, } from "./runtime/native-network-errors.js";

package/dist/provider.js

@@ -4,7 +4,7 @@ export { assertFreshProviderChoiceIssuedAt, createProviderChoiceToken, ProviderC
 export { centered, delayed, defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, every, } from "./define.js";
 export { AuthError, HttpRedirectError, isProviderError, isSessionExpiredError, isTransportError, ProviderError, SessionExpiredError, TransportError, ValidationError, } from "./errors.js";
 export { getProviderLocalePath, providerLocaleKey, qualifyProviderLocaleKey, } from "./i18n/index.js";
-export { createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, PROVIDER_RUNTIME_CHOICE_WORD_ISSUANCE_ENV, } from "./runtime/choice.js";
+export { createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice.js";
 export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, sensitive, z, } from "./schema.js";
 export { NativeEgressGrantExpiredError, NativeEgressNotDeclaredError, NativeIdleTimeoutError, NativeNetworkError, NativeProxyExpiredError, } from "./runtime/native-network-errors.js";
 export { HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, } from "./types.js";

package/dist/runtime/auth-flow.d.ts

@@ -1,4 +1,4 @@
-import type { ContextScratchpad, EnvContext, FlowContext, HttpClient, OcrContext, StealthClient, SttContext } from "../types.js";
+import type { ContextScratchpad, EnvContext, FlowContext, HttpClient, OcrContext, ProviderRuntimeState, StealthClient, SttContext } from "../types.js";
 export declare function createScratchpad(allowedKeys: string[], initial?: Record<string, unknown>): ContextScratchpad;
 export declare function createFlowContext(options: {
     flowId?: string;
@@ -9,6 +9,8 @@ export declare function createFlowContext(options: {
     providerId: string;
     connectionId?: string;
     externalRef?: string;
+    /** Host-agnostic: callers pass an already-scoped runtime state, which this helper forwards verbatim. */
+    state?: ProviderRuntimeState;
     allowedKeys: string[];
     initialContext?: Record<string, unknown>;
     ocr?: OcrContext;

package/dist/runtime/auth-flow.js

@@ -40,6 +40,7 @@ export function createFlowContext(options) {
         tenantId: options.tenantId,
         providerId: options.providerId,
         http: options.http,
+        state: options.state,
         stealth: options.stealth,
         env: options.env,
         context: createScratchpad(options.allowedKeys, options.initialContext),

package/dist/runtime/browser.d.ts

@@ -5,6 +5,7 @@ export type BrowserClientOptions = BrowserOptions & {
     cdpUrl?: string;
     executablePath?: string;
     extraArgs?: string[];
+    serviceWorkers?: "allow" | "block";
 };
 export declare class BrowserClient implements BrowserClientContract {
     private readonly client;

package/dist/runtime/browser.js

@@ -15,7 +15,7 @@ function toResourceBody(body) {
     return Buffer.from(body);
 }
 function isResourceMethod(method) {
-    return method === "GET" || method === "HEAD";
+    return method === "GET" || method === "HEAD" || method === "POST";
 }
 async function toResourceRequest(request) {
     const method = request.method().toUpperCase();
@@ -59,6 +59,68 @@ function getCdpPausedRequestId(params) {
     }
     return params.requestId;
 }
+function isCdpResponseStage(params) {
+    return (isRecord(params) &&
+        (typeof params.responseStatusCode === "number" ||
+            typeof params.responseErrorReason === "string"));
+}
+function toCdpPausedDocumentResponse(params) {
+    if (!isRecord(params) ||
+        typeof params.requestId !== "string" ||
+        typeof params.responseStatusCode !== "number" ||
+        params.resourceType !== "Document" ||
+        !isRecord(params.request)) {
+        return null;
+    }
+    const responseCode = params.responseStatusCode;
+    const responseHeaders = Array.isArray(params.responseHeaders)
+        ? params.responseHeaders.flatMap((header) => {
+            if (!isRecord(header) ||
+                typeof header.name !== "string" ||
+                typeof header.value !== "string") {
+                return [];
+            }
+            return [{ name: header.name, value: header.value }];
+        })
+        : [];
+    return {
+        hasBody: String(params.request.method ?? "").toUpperCase() !== "HEAD" &&
+            responseCode >= 200 &&
+            (responseCode < 300 || responseCode >= 400) &&
+            responseCode !== 204 &&
+            responseCode !== 205 &&
+            responseCode !== 304,
+        requestId: params.requestId,
+        responseCode,
+        responseHeaders,
+    };
+}
+function toCdpDocumentFulfillParams(response, body, contentSecurityPolicy) {
+    const responseBody = typeof body.body === "string" ? body.body : "";
+    return {
+        body: body.base64Encoded ? responseBody : Buffer.from(responseBody).toString("base64"),
+        requestId: response.requestId,
+        responseCode: response.responseCode,
+        responseHeaders: [
+            ...response.responseHeaders,
+            { name: "Content-Security-Policy", value: contentSecurityPolicy },
+        ],
+    };
+}
+function resourcePolicyFetchPatterns(policy) {
+    return [
+        { requestStage: "Request", urlPattern: "*" },
+        ...(policy.documentContentSecurityPolicy
+            ? [
+                {
+                    requestStage: "Response",
+                    resourceType: "Document",
+                    urlPattern: "*",
+                },
+            ]
+            : []),
+    ];
+}
 function toCdpResourceHeaders(value) {
     if (!isRecord(value)) {
         return {};
@@ -104,6 +166,128 @@ async function fulfillResourceRoute(route, decision) {
         status: decision.status ?? 200,
     });
 }
+async function decideResourceRequest(policy, request) {
+    for (const resourceRoute of policy.routes) {
+        if (matchesResourceRoute(resourceRoute.match, request)) {
+            return await resourceRoute.handle(request);
+        }
+    }
+    return { action: "block" };
+}
+async function abortResourceRoute(route) {
+    await route.abort("blockedbyclient");
+}
+async function handleCdpResourceRequest(session, policy, allowedMethods, params) {
+    const paused = toCdpResourceRequest(params);
+    const requestId = paused?.requestId ?? getCdpPausedRequestId(params);
+    if (!requestId)
+        return;
+    try {
+        if (!paused || !allowedMethods.has(paused.request.method)) {
+            await session.send("Fetch.failRequest", { errorReason: "BlockedByClient", requestId });
+            return;
+        }
+        const decision = await decideResourceRequest(policy, paused.request);
+        switch (decision.action) {
+            case "continue":
+                await session.send("Fetch.continueRequest", { requestId });
+                return;
+            case "fulfill":
+                await session.send("Fetch.fulfillRequest", toCdpFulfillParams(requestId, decision));
+                return;
+            case "block":
+                await session.send("Fetch.failRequest", { errorReason: "BlockedByClient", requestId });
+                return;
+        }
+    }
+    catch {
+        await session
+            .send("Fetch.failRequest", { errorReason: "BlockedByClient", requestId })
+            .catch(() => undefined);
+    }
+}
+async function handleCdpDocumentResponse(session, contentSecurityPolicy, params) {
+    const requestId = getCdpPausedRequestId(params);
+    if (!requestId)
+        return;
+    try {
+        const response = toCdpPausedDocumentResponse(params);
+        if (!response)
+            throw new Error("CDP document response metadata is unavailable");
+        if (!response.hasBody) {
+            await session.send("Fetch.continueResponse", {
+                requestId,
+                responseCode: response.responseCode,
+                responseHeaders: [...response.responseHeaders],
+            });
+            return;
+        }
+        const body = await session.send("Fetch.getResponseBody", {
+            requestId: response.requestId,
+        });
+        await session.send("Fetch.fulfillRequest", toCdpDocumentFulfillParams(response, body, contentSecurityPolicy));
+    }
+    catch {
+        await session
+            .send("Fetch.failRequest", { errorReason: "BlockedByClient", requestId })
+            .catch(() => undefined);
+    }
+}
+function getCdpAuthRequiredRequestId(params) {
+    if (!isRecord(params) || typeof params.requestId !== "string") {
+        return null;
+    }
+    return params.requestId;
+}
+function isCdpProxyAuthChallenge(params) {
+    return (isRecord(params) &&
+        isRecord(params.authChallenge) &&
+        params.authChallenge.source === "Proxy");
+}
+async function handleCdpAuthRequired(session, proxy, authAttempts, params) {
+    const requestId = getCdpAuthRequiredRequestId(params);
+    if (!requestId)
+        return;
+    // Chromium can emit another challenge after rejected credentials. Cancel a
+    // retry so incorrect credentials fail promptly instead of looping forever.
+    const response = isCdpProxyAuthChallenge(params) && !authAttempts.has(requestId)
+        ? (() => {
+            authAttempts.add(requestId);
+            return {
+                authChallengeResponse: {
+                    password: proxy.password,
+                    response: "ProvideCredentials",
+                    username: proxy.username,
+                },
+                requestId,
+            };
+        })()
+        : {
+            authChallengeResponse: { response: "CancelAuth" },
+            requestId,
+        };
+    await session.send("Fetch.continueWithAuth", response).catch(() => undefined);
+}
+function createResourcePolicyHandler(policy, allowedMethods) {
+    return async (route) => {
+        const request = await toResourceRequest(route.request());
+        if (!request || !allowedMethods.has(request.method)) {
+            await abortResourceRoute(route);
+            return;
+        }
+        const decision = await decideResourceRequest(policy, request);
+        switch (decision.action) {
+            case "continue":
+                await route.continue();
+                return;
+            case "fulfill":
+                await fulfillResourceRoute(route, decision);
+                return;
+            case "block":
+                await abortResourceRoute(route);
+        }
+    };
+}
 function getDefaultCdpPoolUrl(env = process.env) {
     return env.APIFUSE__CDP_POOL__URL;
 }
@@ -139,7 +323,7 @@ function formatExpression(fn) {
     }
     return `(${fn.toString()})()`;
 }
-function toLaunchOptions(options) {
+function toLaunchOptions(options, proxy) {
     return {
         // `extraArgs` is optional, but playwright-extra's stealth evasions mutate
         // `options.args` unguarded (navigator.webdriver does
@@ -150,7 +334,49 @@ function toLaunchOptions(options) {
         args: options.extraArgs ?? [],
         executablePath: options.executablePath,
         headless: options.headless ?? true,
-        proxy: options.proxy ? { server: options.proxy } : undefined,
+        proxy,
+    };
+}
+function hasProxyCredentials(proxy) {
+    return proxy?.username !== undefined && proxy.password !== undefined;
+}
+function toPlaywrightProxy(proxy) {
+    if (!proxy)
+        return undefined;
+    const schemeEnd = proxy.indexOf("://");
+    const authorityStart = schemeEnd >= 0 ? schemeEnd + 3 : 0;
+    const remainder = proxy.slice(authorityStart);
+    const authorityEnd = remainder.search(/[/?#]/);
+    const authority = remainder.slice(0, authorityEnd >= 0 ? authorityEnd : undefined);
+    if (!authority.includes("@")) {
+        return { server: proxy };
+    }
+    let parsed;
+    try {
+        parsed = new URL(proxy);
+    }
+    catch {
+        throw new ProviderError("Browser proxy URL is invalid", {
+            code: "BROWSER_PROXY_INVALID",
+            fix: "Use a valid proxy URL.",
+        });
+    }
+    let username;
+    let password;
+    try {
+        username = decodeURIComponent(parsed.username);
+        password = decodeURIComponent(parsed.password);
+    }
+    catch {
+        throw new ProviderError("Browser proxy credentials use invalid percent-encoding", {
+            code: "BROWSER_PROXY_INVALID",
+            fix: "Percent-encode the proxy username and password as URL userinfo.",
+        });
+    }
+    return {
+        server: `${parsed.protocol}//${parsed.host}`,
+        username,
+        password,
     };
 }
 class PlaywrightBrowserLocator {
@@ -315,10 +541,12 @@ async function loadSeleniumBase() {
 }
 class PlaywrightBrowserPage {
     page;
+    proxy;
     id = "main";
     pageId;
-    constructor(page) {
+    constructor(page, proxy = undefined) {
         this.page = page;
+        this.proxy = proxy;
     }
     async goto(url) {
         await this.page.goto(url);
@@ -329,6 +557,9 @@ class PlaywrightBrowserPage {
         }
         return await this.page.evaluate(fn);
     }
+    async userAgent() {
+        return await this.evaluate("navigator.userAgent");
+    }
     async waitForSelector(selector, options) {
         await this.page.waitForSelector(selector, options);
     }
@@ -368,40 +599,102 @@ class PlaywrightBrowserPage {
     }
     async withResourcePolicy(policy, run) {
         const allowedMethods = new Set(policy.allowedMethods ?? DEFAULT_RESOURCE_METHODS);
+        const policyHandler = createResourcePolicyHandler(policy, allowedMethods);
+        const context = this.page.context();
         const handler = async (route) => {
-            const request = await toResourceRequest(route.request());
-            if (!request || !allowedMethods.has(request.method)) {
-                await route.abort("blockedbyclient");
+            try {
+                // Context routing sees a popup's first request before the late `page`
+                // event. Fail every secondary page closed so no redirect can escape
+                // the per-page CDP interception while that session is being attached.
+                if (route.request().frame().page() !== this.page) {
+                    await abortResourceRoute(route);
+                    return;
+                }
+            }
+            catch {
+                await abortResourceRoute(route);
                 return;
             }
-            for (const resourceRoute of policy.routes) {
-                if (!matchesResourceRoute(resourceRoute.match, request)) {
-                    continue;
+            await policyHandler(route);
+        };
+        const sessions = new Set();
+        const pendingAttachments = new Set();
+        const proxy = hasProxyCredentials(this.proxy) ? this.proxy : undefined;
+        let active = true;
+        const attachPage = async (page) => {
+            const session = await context.newCDPSession(page);
+            if (!active) {
+                await session.detach();
+                return;
+            }
+            const onRequestPaused = (params) => {
+                if (isCdpResponseStage(params) && policy.documentContentSecurityPolicy) {
+                    void handleCdpDocumentResponse(session, policy.documentContentSecurityPolicy, params);
+                    return;
                 }
-                const decision = await resourceRoute.handle(request);
-                switch (decision.action) {
-                    case "fulfill":
-                        await fulfillResourceRoute(route, decision);
-                        return;
-                    case "block":
-                        await route.abort("blockedbyclient");
-                        return;
+                void handleCdpResourceRequest(session, policy, allowedMethods, params);
+            };
+            const authAttempts = new Set();
+            const onAuthRequired = (params) => {
+                if (!proxy)
+                    return;
+                void handleCdpAuthRequired(session, proxy, authAttempts, params);
+            };
+            session.on("Fetch.requestPaused", onRequestPaused);
+            if (proxy) {
+                session.on("Fetch.authRequired", onAuthRequired);
+            }
+            try {
+                await session.send("Fetch.enable", {
+                    ...(proxy ? { handleAuthRequests: true } : {}),
+                    patterns: resourcePolicyFetchPatterns(policy),
+                });
+                sessions.add(session);
+            }
+            catch (error) {
+                session.off("Fetch.requestPaused", onRequestPaused);
+                if (proxy) {
+                    session.off("Fetch.authRequired", onAuthRequired);
                 }
+                await session.detach().catch(() => undefined);
+                throw error;
             }
-            await route.abort("blockedbyclient");
         };
-        await this.page.route(RESOURCE_POLICY_ROUTE_PATTERN, handler);
+        const onPage = (page) => {
+            const attachment = attachPage(page)
+                .catch(async () => {
+                await page.close().catch(() => undefined);
+            })
+                .finally(() => pendingAttachments.delete(attachment));
+            pendingAttachments.add(attachment);
+        };
+        await context.route(RESOURCE_POLICY_ROUTE_PATTERN, handler);
         try {
-            return await run();
+            context.on("page", onPage);
+            try {
+                await attachPage(this.page);
+                return await run();
+            }
+            finally {
+                context.off("page", onPage);
+            }
         }
         finally {
-            await this.page.unroute(RESOURCE_POLICY_ROUTE_PATTERN, handler);
+            active = false;
+            await context.unroute(RESOURCE_POLICY_ROUTE_PATTERN, handler);
+            await Promise.allSettled(pendingAttachments);
+            await Promise.all([...sessions].map(async (session) => {
+                await session.send("Fetch.disable").catch(() => undefined);
+                await session.detach().catch(() => undefined);
+            }));
         }
     }
 }
 class PlaywrightBrowserClient {
     options;
     browser = null;
+    parsedProxy;
+    proxyParsed = false;
     engine = "playwright-stealth";
     constructor(options = {}) {
         this.options = options;
@@ -411,13 +704,17 @@ class PlaywrightBrowserClient {
             return this.browser;
         }
         const chromium = await loadChromiumLauncher(this.options);
-        this.browser = await chromium.launch(toLaunchOptions(this.options));
+        if (!this.proxyParsed) {
+            this.parsedProxy = toPlaywrightProxy(this.options.proxy);
+            this.proxyParsed = true;
+        }
+        this.browser = await chromium.launch(toLaunchOptions(this.options, this.parsedProxy));
         return this.browser;
     }
     async newPage() {
         const browser = await this.ensureBrowser();
         const page = await browser.newPage();
-        return new PlaywrightBrowserPage(page);
+        return new PlaywrightBrowserPage(page, this.parsedProxy);
     }
     async rawPage() {
         throw new ProviderError("ctx.browser.rawPage() requires a CDP pool", {
@@ -427,9 +724,9 @@ class PlaywrightBrowserClient {
     }
     async withIsolatedContext(handler) {
         const browser = await this.ensureBrowser();
-        const context = await browser.newContext();
+        const context = await browser.newContext({ serviceWorkers: this.options.serviceWorkers });
         const page = await context.newPage();
-        const browserPage = new PlaywrightBrowserPage(page);
+        const browserPage = new PlaywrightBrowserPage(page, this.parsedProxy);
         try {
             return await handler(browserPage);
         }
@@ -823,6 +1120,9 @@ class CdpPoolBrowserPage {
         await this.initialize();
         return await this.evaluateWithContext(fn);
     }
+    async userAgent() {
+        return await this.evaluate("navigator.userAgent");
+    }
     async evaluateInFrame(frameId, fn) {
         await this.initialize();
         const contextId = await this.getFrameExecutionContextId(frameId);
@@ -966,7 +1266,7 @@ class CdpPoolBrowserPage {
         const unsubscribe = this.pageClient.on("Fetch.requestPaused", handlePausedRequest);
         try {
             await this.pageClient.send("Fetch.enable", {
-                patterns: [{ requestStage: "Request", urlPattern: "*" }],
+                patterns: resourcePolicyFetchPatterns(policy),
             });
         }
         catch (error) {
@@ -991,6 +1291,24 @@ class CdpPoolBrowserPage {
             return;
         }
         try {
+            if (isCdpResponseStage(params) && policy.documentContentSecurityPolicy) {
+                const response = toCdpPausedDocumentResponse(params);
+                if (!response)
+                    throw new Error("CDP document response metadata is unavailable");
+                if (!response.hasBody) {
+                    await this.pageClient.send("Fetch.continueResponse", {
+                        requestId,
+                        responseCode: response.responseCode,
+                        responseHeaders: [...response.responseHeaders],
+                    });
+                    return;
+                }
+                const body = await this.pageClient.send("Fetch.getResponseBody", {
+                    requestId: response.requestId,
+                });
+                await this.pageClient.send("Fetch.fulfillRequest", toCdpDocumentFulfillParams(response, body, policy.documentContentSecurityPolicy));
+                return;
+            }
             const parsed = toCdpResourceRequest(params);
             if (!parsed || !allowedMethods.has(parsed.request.method)) {
                 await this.failCdpResourceRequest(requestId);
@@ -1002,6 +1320,11 @@ class CdpPoolBrowserPage {
                 }
                 const decision = await resourceRoute.handle(parsed.request);
                 switch (decision.action) {
+                    case "continue":
+                        await this.pageClient.send("Fetch.continueRequest", {
+                            requestId: parsed.requestId,
+                        });
+                        return;
                     case "fulfill":
                         await this.pageClient.send("Fetch.fulfillRequest", toCdpFulfillParams(parsed.requestId, decision));
                         return;

package/dist/runtime/choice.d.ts

@@ -1,6 +1,5 @@
 import type { CredentialContext, EnvContext, ProviderChoiceConsumeMode, ProviderChoiceContext, ProviderRequestContext, ProviderRuntimeState } from "../types.js";
 export declare const PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV = "APIFUSE__PROVIDER_RUNTIME__CHOICE_TOKEN_MASTER_SECRET";
-export declare const PROVIDER_RUNTIME_CHOICE_WORD_ISSUANCE_ENV = "APIFUSE__PROVIDER_RUNTIME__CHOICE_WORD_ISSUANCE";
 export type ProviderChoiceTelemetryEvent = {
     readonly providerId: string;
     readonly purpose: string;