@apifuse/provider-sdk 2.2.0-beta.36 → 2.2.0-beta.38

package/src/index.ts

@@ -34,8 +34,84 @@ export {
 	defineStreamOperation,
 	every,
 	type AuthStartNoInputGuard,
-	type ProviderConfig,
+	type ProviderBuilder,
+	type ProviderContextOf,
+	type ProviderDeclaration,
 } from "./define.js";
+export {
+	AssertionExpressionSchema,
+	AssertionPredicateSchema,
+	AssertStepSchema,
+	BoundedJsonPathSchema,
+	CandidateBlockSchema,
+	CandidatePolicySchema,
+	CredentialRefDeclarationSchema,
+	defineHealthScenario,
+	HealthScenarioSchema,
+	HealthStepSchema,
+	ExtractStepSchema,
+	FindFirstSchema,
+	GuardStepSchema,
+	JournalPolicySchema,
+	JsonTemplateSchema,
+	ManualTriggerPolicySchema,
+	OperandSchema,
+	OperationStepSchema,
+	QuantifierSchema,
+	ReferenceSchema,
+	RetryPolicySchema,
+	SafeRegexSchema,
+	ScopedAssertionExpressionSchema,
+	ScopedAssertionPredicateSchema,
+	ScopedItemReferenceSchema,
+	ScopedOperandSchema,
+	StepReferenceSchema,
+	RelativeDateNodeSchema,
+	ValueTypeSchema,
+} from "./health-scenario.js";
+export type {
+	AssertionExpression,
+	AssertionPredicate,
+	AttemptReference,
+	AssertResult,
+	AssertStep,
+	BoundedJsonPath,
+	CandidateBlock,
+	CandidatePolicy,
+	CandidateReference,
+	CredentialReference,
+	CredentialRefDeclaration,
+	EstablishedConnectionReference,
+	ExtractStep,
+	FindFirst,
+	GuardAttribution,
+	GuardReasonCode,
+	GuardResult,
+	GuardStep,
+	HealthScenario,
+	HealthStep,
+	JsonTemplate,
+	JournalPolicy,
+	ManualTriggerPolicy,
+	NonEmpty,
+	OperationResult,
+	OperationStep,
+	Operand,
+	Quantifier,
+	ReferenceNode,
+	Reference,
+	RelativeDateNode,
+	RetryPolicy,
+	SafeRegex,
+	ScopedAssertionExpression,
+	ScopedAssertionPredicate,
+	ScopedItemReference,
+	ScopedOperand,
+	StepBase,
+	StepReference,
+	ExtractResult,
+	ValueType,
+} from "./health-scenario.js";
 export type { DevServerOptions } from "./dev.js";
 export { createDevServer, startDevServer } from "./dev.js";
 export * from "./errors.js";
@@ -244,7 +320,6 @@ export type {
 	NativeNetworkDynamicGrantOptions,
 	NativeNetworkEgressGrant,
 	NativeProviderConfig,
-	NativeProviderContext,
 	NativeProxyDrainHandler,
 	NativeProxyEgressInfo,
 	NativeProxyExpiringEvent,
@@ -301,6 +376,7 @@ export type {
 	ProviderChallenge,
 	ProviderChallengeKind,
 	ProviderContext,
+	ProviderContextFor,
 	ProviderDefinition,
 	ProviderDeploymentOverrides,
 	ProviderFileRef,

package/src/provider.ts

@@ -35,6 +35,86 @@ export {
 	defineSmsOtpMatcher,
 	every,
 } from "./define.js";
+export type {
+	ProviderBuilder,
+	ProviderContextOf,
+	ProviderDeclaration,
+} from "./define.js";
+export type { JsonPrimitive, JsonValue } from "./contract-json.js";
+export {
+	AssertionExpressionSchema,
+	AssertionPredicateSchema,
+	AssertStepSchema,
+	BoundedJsonPathSchema,
+	CandidateBlockSchema,
+	CandidatePolicySchema,
+	CredentialRefDeclarationSchema,
+	defineHealthScenario,
+	HealthScenarioSchema,
+	HealthStepSchema,
+	ExtractStepSchema,
+	FindFirstSchema,
+	GuardStepSchema,
+	JournalPolicySchema,
+	JsonTemplateSchema,
+	ManualTriggerPolicySchema,
+	OperandSchema,
+	OperationStepSchema,
+	QuantifierSchema,
+	ReferenceSchema,
+	RetryPolicySchema,
+	SafeRegexSchema,
+	ScopedAssertionExpressionSchema,
+	ScopedAssertionPredicateSchema,
+	ScopedItemReferenceSchema,
+	ScopedOperandSchema,
+	StepReferenceSchema,
+	RelativeDateNodeSchema,
+	ValueTypeSchema,
+} from "./health-scenario.js";
+export type {
+	AssertionExpression,
+	AssertionPredicate,
+	AttemptReference,
+	AssertResult,
+	AssertStep,
+	BoundedJsonPath,
+	CandidateBlock,
+	CandidatePolicy,
+	CandidateReference,
+	CredentialReference,
+	CredentialRefDeclaration,
+	EstablishedConnectionReference,
+	ExtractStep,
+	FindFirst,
+	GuardAttribution,
+	GuardReasonCode,
+	GuardResult,
+	GuardStep,
+	HealthScenario,
+	HealthStep,
+	JsonTemplate,
+	JournalPolicy,
+	ManualTriggerPolicy,
+	NonEmpty,
+	OperationResult,
+	OperationStep,
+	Operand,
+	Quantifier,
+	ReferenceNode,
+	Reference,
+	RelativeDateNode,
+	RetryPolicy,
+	SafeRegex,
+	ScopedAssertionExpression,
+	ScopedAssertionPredicate,
+	ScopedItemReference,
+	ScopedOperand,
+	StepBase,
+	StepReference,
+	ExtractResult,
+	ValueType,
+} from "./health-scenario.js";
 export {
 	AuthError,
 	HttpRedirectError,
@@ -107,7 +187,6 @@ export type {
 	NativeNetworkDynamicGrantOptions,
 	NativeNetworkEgressGrant,
 	NativeProviderConfig,
-	NativeProviderContext,
 	NativeProxyDrainHandler,
 	NativeProxyEgressInfo,
 	NativeProxyExpiringEvent,
@@ -142,6 +221,7 @@ export type {
 	ProviderChoiceIssueOptions,
 	ProviderChoiceParseOptions,
 	ProviderContext,
+	ProviderContextFor,
 	ProviderDefinition,
 	ProviderDeploymentOverrides,
 	ProviderFileRef,

package/src/runtime/browser.ts

@@ -804,8 +804,11 @@ class PlaywrightBrowserPage implements BrowserPageContract {
 		private readonly proxy: LaunchOptions["proxy"] = undefined,
 	) {}
 
-	async goto(url: string): Promise<void> {
-		await this.page.goto(url);
+	async goto(
+		url: string,
+		options?: { readonly timeout?: number; readonly waitUntil?: "load" | "domcontentloaded" },
+	): Promise<void> {
+		await this.page.goto(url, options);
 	}
 
 	async evaluate<T>(fn: string | (() => T)): Promise<T> {
@@ -1492,17 +1495,33 @@ class CdpPoolBrowserPage implements BrowserPageContract {
 		return this.pageId;
 	}
 
-	async goto(url: string): Promise<void> {
+	async goto(
+		url: string,
+		options?: { readonly timeout?: number; readonly waitUntil?: "load" | "domcontentloaded" },
+	): Promise<void> {
 		await this.initialize();
 		const startedAt = Date.now();
-		let loadEventSeen = false;
-		const unsubscribe = this.pageClient.on("Page.loadEventFired", () => {
-			loadEventSeen = true;
+		const timeout = options?.timeout ?? DEFAULT_WAIT_TIMEOUT_MS;
+		const waitUntil = options?.waitUntil ?? "load";
+		let expectedEventSeen = false;
+		const eventName =
+			waitUntil === "domcontentloaded" ? "Page.domContentEventFired" : "Page.loadEventFired";
+		const unsubscribe = this.pageClient.on(eventName, () => {
+			expectedEventSeen = true;
 		});
 
 		try {
-			await this.pageClient.send("Page.navigate", { url });
-			await this.waitForDocumentReady(startedAt + DEFAULT_WAIT_TIMEOUT_MS, () => loadEventSeen);
+			const navigation = (await this.pageClient.send("Page.navigate", { url })) as {
+				readonly errorText?: unknown;
+			};
+			if (typeof navigation.errorText === "string" && navigation.errorText.length > 0) {
+				throw new Error(`Page.navigate failed: ${navigation.errorText} at ${url}`);
+			}
+			await this.waitForDocumentReady(
+				startedAt + timeout,
+				() => expectedEventSeen,
+				waitUntil,
+			);
 		} finally {
 			unsubscribe();
 		}
@@ -1866,12 +1885,16 @@ class CdpPoolBrowserPage implements BrowserPageContract {
 
 	private async waitForDocumentReady(
 		deadline: number,
-		isLoadEventSeen: () => boolean,
+		isExpectedEventSeen: () => boolean,
+		waitUntil: "load" | "domcontentloaded",
 	): Promise<void> {
 		while (Date.now() < deadline) {
 			const readyState = await this.evaluate<string>("document.readyState");
-			if (readyState === "complete" || readyState === "interactive") {
-				if (isLoadEventSeen() || readyState === "complete") {
+			const documentReady =
+				readyState === "complete" ||
+				(waitUntil === "domcontentloaded" && readyState === "interactive");
+			if (documentReady) {
+				if (isExpectedEventSeen() || readyState === "complete") {
 					return;
 				}
 			}

package/src/runtime/resolver-public.ts

@@ -8,10 +8,12 @@ export {
 	createResolverClient,
 	createResolverClientFromEnv,
 	createUnsupportedResolverClient,
+	DEFAULT_RESOLVER_VENDOR_PREFERENCE,
 	DEFAULT_RESOLVER_TIMEOUT_MS,
 	invalidateResolverSolution,
 	RESOLVER_ADAPTER_REGISTRY,
 	RESOLVER_INSTRUMENTATION_METADATA,
+	resolveProviderResolverVendors,
 	type ResolverAdapterFactory,
 	type ResolverInstrumentationMetadata,
 	type ResolverRuntimeOptions,

package/src/runtime/resolver-vendors/browser.ts

@@ -18,6 +18,7 @@ import {
 
 const BROWSER_VENDOR_ID = "browser" as const;
 const DEFAULT_COOKIE_POLL_INTERVAL_MS = 100;
+const NAVIGATION_BLOCKED_ERROR_TEXT = "net::ERR_BLOCKED_BY_CLIENT";
 const AWS_WAF_CHALLENGE_INFRASTRUCTURE_HOST_SUFFIX = ".awswaf.com";
 const RESOLVER_DOCUMENT_CONTENT_SECURITY_POLICY = "connect-src http: https:; worker-src 'none'";
 
@@ -65,12 +66,41 @@ export interface BrowserResolverVendorAdapter extends ResolverVendorAdapter {
 }
 
 class BrowserSolveTimeoutError extends Error {
-	constructor() {
-		super("Browser resolver solve budget elapsed");
+	constructor(blockedRequests: readonly string[]) {
+		super(
+			`Browser resolver solve budget elapsed${formatBlockedRequests(blockedRequests)}`,
+		);
 		this.name = "BrowserSolveTimeoutError";
 	}
 }
 
+class BrowserNavigationBlockedError extends Error {
+	readonly code = "RESOLVER_BROWSER_NAVIGATION_BLOCKED";
+
+	constructor(
+		readonly navigationUrl: string,
+		readonly blockedUrls: readonly string[],
+		options: ErrorOptions,
+	) {
+		super(
+			`Browser resolver navigation was blocked for ${navigationUrl}${formatBlockedRequests(blockedUrls)}`,
+			options,
+		);
+		this.name = "BrowserNavigationBlockedError";
+	}
+}
+
+function formatBlockedRequests(blockedRequests: readonly string[]): string {
+	if (blockedRequests.length === 0) return "";
+	const displayed = blockedRequests.slice(0, 5);
+	const remainder = blockedRequests.length - displayed.length;
+	return `; blocked ${blockedRequests.length} requests: [${displayed.join(", ")}]${remainder > 0 ? ` (+${remainder} more)` : ""}`;
+}
+
+function isNavigationBlockedError(error: unknown): error is Error {
+	return error instanceof Error && error.message.includes(NAVIGATION_BLOCKED_ERROR_TEXT);
+}
+
 class BrowserCleanupTimeoutError extends Error {
 	constructor(timeoutMs: number) {
 		super(`Browser resolver cleanup exceeded ${timeoutMs}ms`);
@@ -223,6 +253,8 @@ async function solveInPage(
 	allowedHosts: readonly string[],
 	successCookieName: string,
 	pollIntervalMs: number,
+	gotoTimeoutMs: number,
+	blockedRequests: Set<string>,
 	signal: AbortSignal,
 ): Promise<Extract<ChallengeSolution, { readonly form: "cookies" }>> {
 	return await page.withResourcePolicy(
@@ -232,11 +264,13 @@ async function solveInPage(
 			routes: [
 				{
 					match: () => true,
-					handle: (request) => ({
-						action: isResolverBrowserRequestAllowed(request.url, challengeKind, allowedHosts)
-							? "continue"
-							: "block",
-					}),
+					handle: (request) => {
+						if (isResolverBrowserRequestAllowed(request.url, challengeKind, allowedHosts)) {
+							return { action: "continue" };
+						}
+						blockedRequests.add(request.url);
+						return { action: "block" };
+					},
 				},
 			],
 		},
@@ -245,7 +279,19 @@ async function solveInPage(
 				() => page.userAgent(),
 				signal,
 			);
-			await raceWithAbort(() => page.goto(pageUrl), signal);
+			try {
+				await raceWithAbort(
+					() =>
+						page.goto(pageUrl, {
+							timeout: gotoTimeoutMs,
+							waitUntil: "domcontentloaded",
+						}),
+					signal,
+				);
+			} catch (error) {
+				if (!isNavigationBlockedError(error)) throw error;
+				throw new BrowserNavigationBlockedError(pageUrl, [...blockedRequests], { cause: error });
+			}
 
 			while (true) {
 				const cookies = await raceWithAbort(() => page.cookies(), signal);
@@ -304,6 +350,7 @@ function poolErrorCode(error: Error): number | undefined {
 
 function knownUnavailableReason(
 	error: unknown,
+	beforePageSolve = false,
 ): "allocation_exhausted" | "missing_credentials" | "transport_failure" | undefined {
 	// Source-grounded mappings:
 	// - apps/cdp-pool/src/index.ts: the JSON-RPC codes and messages below.
@@ -338,7 +385,10 @@ function knownUnavailableReason(
 		return "transport_failure";
 	}
 
-	return undefined;
+	// Browser creation, Playwright launch, and CDP connection all happen before the
+	// isolated-page handler is entered. Errors after that boundary belong to the
+	// challenge solve and must retain their existing classification.
+	return beforePageSolve ? "transport_failure" : undefined;
 }
 
 async function closeBrowserClient(
@@ -400,11 +450,12 @@ export function createBrowserResolverVendorAdapter(
 				throw new ResolverVendorUnavailableError(BROWSER_VENDOR_ID, "not_implemented");
 			}
 
+			const blockedRequests = new Set<string>();
 			const solveController = new AbortController();
 			const onCallerAbort = () => solveController.abort(abortReason(callerSignal));
 			callerSignal.addEventListener("abort", onCallerAbort, { once: true });
 			const timeout = setTimeout(
-				() => solveController.abort(new BrowserSolveTimeoutError()),
+				() => solveController.abort(new BrowserSolveTimeoutError([...blockedRequests])),
 				options.timeoutMs,
 			);
 
@@ -427,6 +478,8 @@ export function createBrowserResolverVendorAdapter(
 						options.allowedHosts,
 						SUCCESS_COOKIE_NAMES[challengeKind],
 						pollIntervalMs,
+						options.timeoutMs,
+						blockedRequests,
 						solveController.signal,
 					);
 				});
@@ -457,10 +510,15 @@ export function createBrowserResolverVendorAdapter(
 						cause: error,
 					});
 				}
+				if (error instanceof BrowserNavigationBlockedError) {
+					throw new ResolverVendorUnavailableError(BROWSER_VENDOR_ID, "transport_failure", {
+						cause: error,
+					});
+				}
 				if (error instanceof ResolverVendorUnavailableError) {
 					throw error;
 				}
-				const reason = knownUnavailableReason(error);
+				const reason = knownUnavailableReason(error, !handlerEntered);
 				if (reason) {
 					throw new ResolverVendorUnavailableError(BROWSER_VENDOR_ID, reason, { cause: error });
 				}

package/src/runtime/resolver-vendors/types.ts

@@ -2,6 +2,7 @@ import type {
 	ChallengeSolution,
 	ProviderChallenge,
 	ProviderChallengeKind,
+	ProviderResolverConfig,
 	ProviderResolverVendor,
 } from "../../types.js";
 import type { TraceRecorder } from "../trace.js";
@@ -42,6 +43,16 @@ export const RESOLVER_VENDOR_CAPABILITIES = {
 	],
 } as const satisfies Readonly<Record<ProviderResolverVendor, readonly ProviderChallengeKind[]>>;
 
+/**
+ * SDK-owned fallback policy for hosted resolver vendors. Capability support is
+ * applied separately, so each provider receives only vendors that support one
+ * or more of its declared challenge kinds.
+ */
+export const DEFAULT_RESOLVER_VENDOR_PREFERENCE = [
+	"capsolver",
+	"2captcha",
+] as const satisfies readonly ProviderResolverVendor[];
+
 export function resolverVendorSupports(
 	vendor: ProviderResolverVendor,
 	kind: ProviderChallengeKind,
@@ -49,6 +60,16 @@ export function resolverVendorSupports(
 	return (RESOLVER_VENDOR_CAPABILITIES[vendor] as readonly ProviderChallengeKind[]).includes(kind);
 }
 
+/** Resolves an explicit provider override or the SDK-owned default vendor chain. */
+export function resolveProviderResolverVendors(
+	config: ProviderResolverConfig,
+): readonly ProviderResolverVendor[] {
+	if (config.vendors !== undefined) return config.vendors;
+	return DEFAULT_RESOLVER_VENDOR_PREFERENCE.filter((vendor) =>
+		config.kinds.some((kind) => resolverVendorSupports(vendor, kind)),
+	);
+}
+
 export interface ResolverIdentity {
 	readonly proxyUrl: string;
 	readonly userAgent: string;

package/src/runtime/resolver.ts

@@ -35,6 +35,7 @@ import {
 	type ResolverVendorTransport,
 	ResolverVendorUnavailableError,
 	type ResolverVendorUnavailableReason,
+	resolveProviderResolverVendors,
 	resolverVendorSupports,
 } from "./resolver-vendors/types.js";
 import {
@@ -64,6 +65,10 @@ export {
 	APIFUSE__RESOLVER__TIMEOUT_MS,
 	DEFAULT_RESOLVER_TIMEOUT_MS,
 } from "./resolver-config.js";
+export {
+	DEFAULT_RESOLVER_VENDOR_PREFERENCE,
+	resolveProviderResolverVendors,
+} from "./resolver-vendors/types.js";
 
 type EnvLike = Record<string, string | undefined>;
 
@@ -340,10 +345,12 @@ function assertKnownResolverVendor(vendor: string): asserts vendor is ProviderRe
 	throw new Error(`Unknown resolver vendor "${vendor}" in resolver configuration`);
 }
 
-function throwUnsupportedKind(kind: ProviderChallengeKind): never {
+function throwUnsupportedKind(kind: ProviderChallengeKind, usingDefaultVendors: boolean): never {
 	throw new ProviderError(`Resolver vendor chain does not support kind "${kind}"`, {
 		code: "RESOLVER_KIND_UNSUPPORTED_BY_CHAIN",
-		fix: `Add a resolver vendor that supports "${kind}" to the provider's resolver.vendors declaration.`,
+		fix: usingDefaultVendors
+			? `No SDK default resolver vendor supports "${kind}". Declare an explicit resolver.vendors override with a supporting vendor.`
+			: `Add a resolver vendor that supports "${kind}" to the provider's resolver.vendors declaration.`,
 	});
 }
 
@@ -814,6 +821,7 @@ function createResolverChainClient(options: {
 	readonly kinds: readonly ProviderChallengeKind[];
 	readonly entries: readonly ResolverChainEntry[];
 	readonly unavailableReason?: string;
+	readonly usingDefaultVendors?: boolean;
 	readonly cache?: ProviderCache;
 	readonly identity?: ResolverIdentity;
 	readonly proxyIntent?: ResolverRuntimeOptions["proxyIntent"];
@@ -839,7 +847,9 @@ function createResolverChainClient(options: {
 			}
 
 			const supportingEntries = options.entries.filter((entry) => entry.supports(challenge.kind));
-			if (supportingEntries.length === 0) throwUnsupportedKind(challenge.kind);
+			if (supportingEntries.length === 0) {
+				throwUnsupportedKind(challenge.kind, options.usingDefaultVendors ?? false);
+			}
 			signal.throwIfAborted();
 			const identityResolution = options.proxyIntent
 				? await resolveResolverIdentity(options.proxyIntent)
@@ -1033,7 +1043,8 @@ function createResolverClientFromEnvInternal(
 	}
 	assertClientProfileTransportContract(config.clientProfile, options.transport);
 
-	if (config.vendors.length === 0) {
+	const vendors = resolveProviderResolverVendors(config);
+	if (config.vendors !== undefined && config.vendors.length === 0) {
 		return createResolverChainClient({
 			kinds: config.kinds,
 			entries: [],
@@ -1047,7 +1058,7 @@ function createResolverClientFromEnvInternal(
 
 	return createResolverChainClient({
 		kinds: config.kinds,
-		entries: config.vendors.map((configuredVendor) => {
+		entries: vendors.map((configuredVendor) => {
 			assertKnownResolverVendor(configuredVendor);
 			const vendor = configuredVendor;
 			return {
@@ -1062,6 +1073,7 @@ function createResolverClientFromEnvInternal(
 					),
 			};
 		}),
+		usingDefaultVendors: config.vendors === undefined,
 		cache: options.cache,
 		proxyIntent: options.proxyIntent,
 		identityScope: options.identityScope,

package/src/server/serve-implementation.ts

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import { existsSync } from "node:fs";
 import { createRequire } from "node:module";
 import { join } from "node:path";
@@ -745,7 +746,7 @@ function createProviderContext(
 					...event,
 				}),
 		}),
-	});
+	} as ProviderContext);
 	wrappedContext = context;
 	return context;
 }
@@ -1441,6 +1442,41 @@ function extractRequestId(raw: unknown): string | undefined {
 	return typeof value === "string" ? value : undefined;
 }
 
+type ProviderErrorCauseFrame = {
+	errorClass: string;
+	code?: string;
+	messageLength: number;
+	messageFingerprint: string;
+};
+
+const MAX_PROVIDER_ERROR_CAUSE_FRAMES = 5;
+
+function providerErrorCauseChain(error: unknown): ProviderErrorCauseFrame[] | undefined {
+	if (!(error instanceof Error) && !isProviderError(error)) return undefined;
+
+	const seen = new Set<object>([error]);
+	const frames: ProviderErrorCauseFrame[] = [];
+	let cause = error.cause;
+
+	while (
+		frames.length < MAX_PROVIDER_ERROR_CAUSE_FRAMES &&
+		(cause instanceof Error || isProviderError(cause)) &&
+		!seen.has(cause)
+	) {
+		seen.add(cause);
+		const message = cause.message;
+		frames.push({
+			errorClass: cause.name,
+			...(isProviderError(cause) && typeof cause.code === "string" ? { code: cause.code } : {}),
+			messageLength: message.length,
+			messageFingerprint: createHash("sha256").update(message).digest("hex").slice(0, 12),
+		});
+		cause = cause.cause;
+	}
+
+	return frames.length > 0 ? frames : undefined;
+}
+
 function logProviderError(
 	logger: ProviderServerLogger | unknown,
 	provider: ProviderDefinition,
@@ -1461,6 +1497,7 @@ function logProviderError(
 				: "internal_error";
 	const errorClass = error instanceof Error ? error.name : typeof error;
 	const message = error instanceof Error ? error.message : String(error);
+	const causeChain = providerErrorCauseChain(error);
 	const details = errorObservabilityDetails(error, declaredErrorCode);
 	const isUnregisteredProviderErrorCode =
 		status === 500 &&
@@ -1482,6 +1519,7 @@ function logProviderError(
 		code,
 		errorClass,
 		message,
+		...(causeChain ? { causeChain } : {}),
 		...(details.upstreamStatus ? { upstreamStatus: details.upstreamStatus } : {}),
 		errorCategory: details.category,
 		taxonomyVersion: details.taxonomyVersion,

package/src/testing/run.ts

@@ -525,7 +525,7 @@ function createUpstreamContext(
 		...(provider.native
 			? {
 					native: {
-					network: {
+						network: {
 							connectTcp: async (options) => {
 								const request = snapshotNativeConnectInput(options);
 								requireNativeEgress().assertConnect(request, "disabled");
@@ -578,7 +578,7 @@ function createUpstreamContext(
 			credential,
 			state,
 		}),
-	};
+	} as ProviderContext;
 }
 
 function createNativeConnection(
@@ -709,7 +709,7 @@ export function createSnapshotContext(rawFixture: unknown): ProviderContext {
 			credential,
 			state,
 		}),
-	};
+	} satisfies Omit<ProviderContext, "native"> as unknown as ProviderContext;
 	snapshotCaptureStates.set(context, {
 		assertConsumed() {
 			if (streamCaptureGroup && nextCaptureItem !== streamCaptureGroup.items.length) {