@apifuse/provider-sdk 2.2.0-beta.4 → 2.2.0-beta.41

package/bin/apifuse-migrate-shape.ts

@@ -0,0 +1,84 @@
+#!/usr/bin/env bun
+
+/**
+ * `apifuse migrate-shape [path] [--check] [--json]`
+ *
+ * Applies the provider authoring-shape migration (single-phase
+ * `defineProvider({...operations})` to the two-phase declaration builder) to
+ * a provider's `index.ts`. This is the source half of a breaking SDK bump:
+ * the pin bump and this transform must land in the same commit, because the
+ * single-phase shape default-exports a builder function under 2.2.0-beta.37+
+ * and the module stops loading.
+ *
+ * Exit codes: 0 migrated or already two-phase; 1 skipped (the transform
+ * refuses to guess) or the file is missing. `--check` reports without
+ * writing. A skip is a hard stop for fan-out callers — never pair a pin bump
+ * with a skipped migration.
+ */
+
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+import { migrateProviderShape } from "../src/cli/migrate-provider-shape.js";
+
+export async function main(): Promise<void> {
+	const args = process.argv.slice(3);
+	const check = args.includes("--check");
+	const json = args.includes("--json");
+	const positional = args.filter((argument) => !argument.startsWith("--"));
+	const providerRoot = resolve(positional[0] ?? ".");
+	const indexPath = resolve(providerRoot, "index.ts");
+
+	const report = (payload: Record<string, unknown>, humanText: string): void => {
+		if (json) {
+			console.log(JSON.stringify({ schemaVersion: 1, indexPath, ...payload }));
+		} else {
+			console.log(humanText);
+		}
+	};
+
+	if (!existsSync(indexPath)) {
+		report(
+			{ status: "skipped", reason: "index.ts not found" },
+			`migrate-shape: ${indexPath} not found.`,
+		);
+		process.exit(1);
+	}
+
+	const sourceText = readFileSync(indexPath, "utf8");
+	const result = migrateProviderShape(sourceText, indexPath);
+
+	if (result.status === "skipped") {
+		report(
+			{ status: "skipped", reason: result.reason },
+			`migrate-shape: skipped — ${result.reason}\nThis provider needs a manual migration; do not bump its SDK pin without one.`,
+		);
+		process.exit(1);
+	}
+
+	if (result.status === "unchanged") {
+		report(
+			{ status: "unchanged" },
+			"migrate-shape: already two-phase; nothing to do.",
+		);
+		return;
+	}
+
+	if (check) {
+		report(
+			{ status: "would-migrate", kind: result.kind },
+			`migrate-shape: would migrate (${result.kind}). Run without --check to write.`,
+		);
+		return;
+	}
+
+	writeFileSync(indexPath, result.code, "utf8");
+	report(
+		{ status: "migrated", kind: result.kind },
+		`migrate-shape: migrated (${result.kind}). Review the diff, then run \`apifuse check\` and \`bun test\`.`,
+	);
+}
+
+if (import.meta.main) {
+	await main();
+}

package/bin/apifuse-pack-check.ts

@@ -48,6 +48,13 @@ const requiredPaths = [
 	"src/cli/templates/provider/operations/ping.ts.tpl",
 	"src/cli/templates/provider/schemas/ping.ts.tpl",
 	"src/cli/templates/provider/upstream/README.md.tpl",
+	"src/cli/templates/provider/AGENTS.md.tpl",
+	"src/cli/templates/provider/.agents/skills/normalization-standards/SKILL.md.tpl",
+	"src/cli/templates/provider/.agents/skills/upstream-contract-verification/SKILL.md.tpl",
+	"src/cli/templates/provider/.agents/skills/fixtures-and-recording/SKILL.md.tpl",
+	"src/cli/templates/provider/.agents/skills/pagination-and-counts/SKILL.md.tpl",
+	"src/cli/templates/provider/.agents/skills/health-checks-and-fail-closed/SKILL.md.tpl",
+	"src/cli/templates/provider/.agents/skills/upstream-notes/README.md.tpl",
 	"dist/cli/templates/provider/.dockerignore.tpl",
 	"dist/cli/templates/provider/.gitignore.tpl",
 	"dist/cli/templates/provider/Dockerfile.tpl",
@@ -60,6 +67,13 @@ const requiredPaths = [
 	"dist/cli/templates/provider/operations/ping.ts.tpl",
 	"dist/cli/templates/provider/schemas/ping.ts.tpl",
 	"dist/cli/templates/provider/upstream/README.md.tpl",
+	"dist/cli/templates/provider/AGENTS.md.tpl",
+	"dist/cli/templates/provider/.agents/skills/normalization-standards/SKILL.md.tpl",
+	"dist/cli/templates/provider/.agents/skills/upstream-contract-verification/SKILL.md.tpl",
+	"dist/cli/templates/provider/.agents/skills/fixtures-and-recording/SKILL.md.tpl",
+	"dist/cli/templates/provider/.agents/skills/pagination-and-counts/SKILL.md.tpl",
+	"dist/cli/templates/provider/.agents/skills/health-checks-and-fail-closed/SKILL.md.tpl",
+	"dist/cli/templates/provider/.agents/skills/upstream-notes/README.md.tpl",
 	"dist/auth-turn/index.js",
 	"dist/auth-turn/index.d.ts",
 	"dist/auth-turn/auth-turn.v1.schema.json",
@@ -142,9 +156,9 @@ function assertPublicSmokeDocs(label: string, content: string): void {
 		);
 	}
 
-	if (!content.includes("impit")) {
+	if (!content.includes("wreq-js")) {
 		throw new Error(
-			`${label} must include impit stealth runtime guidance for TLS/browser bounties.`,
+			`${label} must include wreq-js stealth runtime guidance for TLS/browser bounties.`,
 		);
 	}
 
@@ -154,6 +168,12 @@ function assertPublicSmokeDocs(label: string, content: string): void {
 		);
 	}
 
+	if (!content.includes("Chrome, Firefox, and Safari")) {
+		throw new Error(
+			`${label} must document the browser families supported by the TypeScript stealth runtime.`,
+		);
+	}
+
 	if (
 		!content.includes('browser.engine: "playwright-stealth"') ||
 		!content.includes("nodriver")

package/bin/apifuse-pack-smoke.ts

@@ -59,6 +59,21 @@ try {
 	);
 
 	run("bun", ["install"], consumerDir);
+	run(
+		"bun",
+		[
+			"--eval",
+			[
+				'import { resolveProxy } from "@apifuse/provider-sdk";',
+				'if (typeof resolveProxy !== "function") throw new Error("resolveProxy is not exported");',
+				'const resolved = await resolveProxy({ proxy: "http://127.0.0.1:8080" });',
+				'if (resolved.url !== "http://127.0.0.1:8080") throw new Error("resolveProxy returned the wrong URL");',
+				'console.log("packed root resolveProxy export OK");',
+			].join("\n"),
+		],
+		consumerDir,
+	);
+	smokePackedStealthNative(consumerDir);
 
 	const cliBin = join(consumerDir, "node_modules", ".bin", "apifuse");
 	if (!existsSync(cliBin)) {
@@ -202,6 +217,43 @@ function run(command: string, args: string[], cwd: string): void {
 	}
 }
 
+function smokePackedStealthNative(consumerDir: string): void {
+	run(
+		"bun",
+		[
+			"--eval",
+			[
+				'import { createServer } from "node:http";',
+				'import { createStealthClient } from "@apifuse/provider-sdk/runtime/stealth";',
+				"const server = createServer((_request, response) => {",
+				'  response.setHeader("set-cookie", "pack_native_cookie=landed; Path=/");',
+				'  response.end("packed native stealth ok");',
+				"});",
+				"await new Promise((resolve, reject) => {",
+				'  server.once("error", reject);',
+				'  server.listen(0, "127.0.0.1", resolve);',
+				"});",
+				"const address = server.address();",
+				'if (!address || typeof address === "string") throw new Error("Local server has no TCP address");',
+				'const baseUrl = "http://127.0.0.1:" + address.port;',
+				'const session = createStealthClient(baseUrl).createSession({ profile: "safari-17" });',
+				"try {",
+				'  const response = await session.fetch("/native");',
+				'  if (response.body !== "packed native stealth ok") throw new Error("Unexpected stealth body: " + response.body);',
+				'  if (session.cookies.get("pack_native_cookie", baseUrl + "/native") !== "landed") {',
+				'    throw new Error("Packed stealth Set-Cookie did not land in the SDK jar");',
+				"  }",
+				'  console.log("packed native Safari stealth request OK");',
+				"} finally {",
+				"  session.close();",
+				"  await new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));",
+				"}",
+			].join("\n"),
+		],
+		consumerDir,
+	);
+}
+
 function assertGeneratedReadme(providerDir: string): void {
 	const readme = readFileSync(join(providerDir, "README.md"), "utf8");
 	if (!readme.includes('"requestId":"req_local_ping"')) {
@@ -213,8 +265,11 @@ function assertGeneratedReadme(providerDir: string): void {
 	if (!readme.includes("bunx playwright install chromium")) {
 		throw new Error("Generated README is missing browser runtime troubleshooting guidance.");
 	}
-	if (!readme.includes("impit")) {
-		throw new Error("Generated README is missing impit stealth runtime guidance.");
+	if (!readme.includes("wreq-js")) {
+		throw new Error("Generated README is missing wreq-js stealth runtime guidance.");
+	}
+	if (!readme.includes("Chrome, Firefox, and Safari")) {
+		throw new Error("Generated README is missing supported stealth browser families.");
 	}
 	if (!readme.includes("bun run submit-check")) {
 		throw new Error("Generated README must document the submit-check pre-submission workflow.");

package/bin/apifuse-pack-types.ts

@@ -18,7 +18,7 @@
 //   3. A Node (not bun) ESM runtime import — node does not tolerate
 //      extensionless relative specifiers, bun does.
 //
-// A deliberate negative control proves the fixture compiler actually fails on
+// Deliberate negative controls prove the fixture compiler actually fails on
 // type errors, so this check cannot rot into a false-positive green.
 
 import { execFileSync, spawnSync } from "node:child_process";
@@ -36,6 +36,263 @@ const PACK_RESULT_SCHEMA = z.array(
 const KEEP_TEMP = process.env.APIFUSE__PACK_TYPES__KEEP_TEMP === "1";
 const sdkRoot = process.cwd();
 
+const NEGATIVE_CONTROLS = [
+	{
+		filename: "negative-control-provider-error-name.ts",
+		expectedCode: "TS2322",
+		description: "ProviderError.name remains a string",
+		source: [
+			'import { ProviderError } from "@apifuse/provider-sdk";',
+			"",
+			"// Intentionally wrong: name is a string. If this file compiles, the",
+			"// fixture consumer is not actually type-checking and the guard is void.",
+			'export const mustNotCompile: number = new ProviderError("boom").name;',
+			"",
+		].join("\n"),
+	},
+	{
+		filename: "negative-control-unknown-resolver-vendor.ts",
+		expectedCode: "TS2322",
+		description: "ProviderResolverConfig rejects an unknown vendor",
+		source: [
+			'import type { ProviderResolverConfig } from "@apifuse/provider-sdk";',
+			"",
+			"export const mustNotCompile: ProviderResolverConfig = {",
+			'\tvendors: ["unknown-vendor"],',
+			'\tkinds: ["turnstile"],',
+			"};",
+			"",
+		].join("\n"),
+	},
+	{
+		filename: "negative-control-define-provider-resolver-vendor.ts",
+		expectedCode: "TS2322",
+		description: "defineProvider rejects an unknown resolver vendor",
+		source: [
+			'import { defineProvider, z } from "@apifuse/provider-sdk";',
+			"",
+			"export const mustNotCompile = defineProvider({",
+			'\tid: "invalid-resolver-vendor",',
+			'\tversion: "1.0.0",',
+			'\truntime: "standard",',
+			'\tresolver: { vendors: ["unknown-vendor"], kinds: ["turnstile"] },',
+			'\tmeta: { displayName: "Invalid Resolver Vendor", descriptionKey: "meta.description", category: "test" },',
+			"})({",
+			"\toperations: {",
+			"\t\tprobe: {",
+			"\t\t\tinput: z.object({}),",
+			"\t\t\toutput: z.object({ ok: z.boolean() }),",
+			"\t\t\thandler: async () => ({ ok: true }),",
+			'\t\t\thealthCheckUnsupported: { reason: "type fixture" },',
+			"\t\t},",
+			"\t},",
+			"});",
+			"",
+		].join("\n"),
+	},
+	{
+		filename: "negative-control-unknown-challenge-kind.ts",
+		expectedCode: "TS2820",
+		description: "ProviderChallenge rejects an unknown challenge kind",
+		source: [
+			'import type { ProviderChallenge } from "@apifuse/provider-sdk";',
+			"",
+			"export const mustNotCompile: ProviderChallenge = {",
+			'\tkind: "funcaptcha",',
+			'\tsiteKey: "key",',
+			'\tpageUrl: "https://example.com",',
+			"};",
+			"",
+		].join("\n"),
+	},
+	{
+		filename: "negative-control-provider-challenge-kind.ts",
+		expectedCode: "TS2820",
+		description: "ProviderChallengeKind rejects an unknown challenge kind",
+		source: [
+			'import type { ProviderChallengeKind } from "@apifuse/provider-sdk";',
+			"",
+			'export const mustNotCompile: ProviderChallengeKind = "funcaptcha";',
+			"",
+		].join("\n"),
+	},
+	{
+		filename: "negative-control-cookie-solution-token-read.ts",
+		expectedCode: "TS2339",
+		description: "ChallengeSolution requires narrowing before reading token",
+		source: [
+			'import type { ChallengeSolution } from "@apifuse/provider-sdk";',
+			"",
+			"export function mustNotCompile(solution: ChallengeSolution): string {",
+			"\treturn solution.token;",
+			"}",
+			"",
+		].join("\n"),
+	},
+	{
+		filename: "negative-control-cookie-challenge-site-key.ts",
+		expectedCode: "TS2353",
+		description: "cookie-family challenges reject token-family fields",
+		source: [
+			'import type { ProviderChallenge } from "@apifuse/provider-sdk";',
+			"",
+			"export const mustNotCompile: ProviderChallenge = {",
+			'\tkind: "cloudflare_interstitial",',
+			'\tpageUrl: "https://example.com",',
+			'\tsiteKey: "not-allowed",',
+			"};",
+			"",
+		].join("\n"),
+	},
+	{
+		filename: "negative-control-aws-waf-site-key-type.ts",
+		expectedCode: "TS2322",
+		description: "aws_waf siteKey must be a string",
+		source: [
+			'import type { ProviderChallenge } from "@apifuse/provider-sdk";',
+			"",
+			"export const mustNotCompile: ProviderChallenge = {",
+			'\tkind: "aws_waf",',
+			'\tpageUrl: "https://example.com",',
+			"\tsiteKey: 123,",
+			"};",
+			"",
+		].join("\n"),
+	},
+	{
+		filename: "negative-control-aws-waf-context-type.ts",
+		expectedCode: "TS2322",
+		description: "aws_waf context must be a string",
+		source: [
+			'import type { ProviderChallenge } from "@apifuse/provider-sdk";',
+			"",
+			"export const mustNotCompile: ProviderChallenge = {",
+			'\tkind: "aws_waf",',
+			'\tpageUrl: "https://example.com",',
+			"\tcontext: 123,",
+			"};",
+			"",
+		].join("\n"),
+	},
+	{
+		filename: "negative-control-aws-waf-unknown-field.ts",
+		expectedCode: "TS2353",
+		description: "aws_waf rejects fields it does not declare",
+		source: [
+			'import type { ProviderChallenge } from "@apifuse/provider-sdk";',
+			"",
+			"export const mustNotCompile: ProviderChallenge = {",
+			'\tkind: "aws_waf",',
+			'\tpageUrl: "https://example.com",',
+			"\tunknownField: 1,",
+			"};",
+			"",
+		].join("\n"),
+	},
+	{
+		filename: "negative-control-recaptcha-v3-action.ts",
+		expectedCode: "TS2322",
+		description: "recaptcha_v3 challenges require action",
+		source: [
+			'import type { ProviderChallenge } from "@apifuse/provider-sdk";',
+			"",
+			"export const mustNotCompile: ProviderChallenge = {",
+			'\tkind: "recaptcha_v3",',
+			'\tsiteKey: "key",',
+			'\tpageUrl: "https://example.com",',
+			"};",
+			"",
+		].join("\n"),
+	},
+	{
+		filename: "negative-control-browser-cookie-expires.ts",
+		expectedCode: "TS2322",
+		description: "BrowserCookie.expires remains optional for session cookies",
+		source: [
+			'import type { BrowserCookie } from "@apifuse/provider-sdk";',
+			"",
+			"export function mustNotCompile(cookie: BrowserCookie): number {",
+			"\treturn cookie.expires;",
+			"}",
+			"",
+		].join("\n"),
+	},
+	{
+		filename: "negative-control-resolver-runtime-identity.ts",
+		expectedCode: "TS2353",
+		description: "ResolverRuntimeOptions does not accept caller-synthesized identity",
+		source: [
+			'import type { ResolverRuntimeOptions } from "@apifuse/provider-sdk";',
+			"",
+			"export const mustNotCompile: ResolverRuntimeOptions = {",
+			'\tidentity: "caller-controlled",',
+			"};",
+			"",
+		].join("\n"),
+	},
+	{
+		filename: "negative-control-resolver-runtime-adapter-factories.ts",
+		expectedCode: "TS2353",
+		description: "ResolverRuntimeOptions does not accept caller-supplied adapter factories",
+		source: [
+			'import type { ResolverRuntimeOptions } from "@apifuse/provider-sdk";',
+			"",
+			"export const mustNotCompile: ResolverRuntimeOptions = {",
+			"\tadapterFactories: {},",
+			"};",
+			"",
+		].join("\n"),
+	},
+	{
+		filename: "negative-control-resolver-default-user-agent-test-seam.ts",
+		expectedCode: "TS2305",
+		description: "the resolver subpath does not expose its default user-agent test seam",
+		source: [
+			'import { swapResolverDefaultUserAgentForTests } from "@apifuse/provider-sdk/runtime/resolver";',
+			"",
+			"export const mustNotCompile = swapResolverDefaultUserAgentForTests;",
+			"",
+		].join("\n"),
+	},
+	{
+		filename: "negative-control-cache-reset-test-seam.ts",
+		expectedCode: "TS2305",
+		description: "the package root does not expose its cache-reset test seam",
+		source: [
+			'import { resetProviderCacheForTests } from "@apifuse/provider-sdk";',
+			"",
+			"export const mustNotCompile = resetProviderCacheForTests;",
+			"",
+		].join("\n"),
+	},
+	{
+		filename: "negative-control-resolver-runtime-allowed-hosts.ts",
+		expectedCode: "TS2322",
+		description: "ResolverRuntimeOptions.allowedHosts accepts only host strings",
+		source: [
+			'import type { ResolverRuntimeOptions } from "@apifuse/provider-sdk";',
+			"",
+			"export const mustNotCompile: ResolverRuntimeOptions = {",
+			'\tallowedHosts: ["example.com", 42],',
+			"};",
+			"",
+		].join("\n"),
+	},
+	{
+		filename: "negative-control-resolver-signal.ts",
+		expectedCode: "TS2345",
+		description: "ResolverContext.solve accepts only AbortSignal as its optional signal",
+		source: [
+			'import type { ProviderChallenge, ResolverContext } from "@apifuse/provider-sdk";',
+			"",
+			"declare const resolver: ResolverContext;",
+			"declare const challenge: ProviderChallenge;",
+			"resolver.solve(challenge, { aborted: false });",
+			"",
+		].join("\n"),
+	},
+] as const;
+
 const tempRoot = mkdtempSync(join(tmpdir(), "apifuse-provider-sdk-pack-types-"));
 const packDir = join(tempRoot, "pack");
 const consumerDir = join(tempRoot, "consumer");
@@ -123,12 +380,16 @@ function setUpFixtureConsumer(consumerDir: string, tarballPath: string): void {
 	writeFileSync(
 		join(consumerDir, "consumer.ts"),
 		[
-			'import { ProviderError, SessionExpiredError, z } from "@apifuse/provider-sdk";',
+			'import { defineProvider, ProviderError, resolveProxy, SessionExpiredError, z } from "@apifuse/provider-sdk";',
+			'import { invalidateResolverSolution } from "@apifuse/provider-sdk/runtime/resolver";',
+			'import type { BrowserCookie, ChallengeSolution, NativeContext, NativeNetworkClient, NativeNetworkConnection, NativeProviderConfig, NativeTcpEgressGrant, ProviderChallenge, ProviderContext, ProviderFileRef, ProviderFilesContext, ProviderResolvedFile, ProviderResolverConfig, ResolverContext, ResolverRuntimeOptions } from "@apifuse/provider-sdk";',
+			'import type { ProxyProtocol, ProxyResolutionOptions, ProxyResolutionSource, ProxyVendorName, RequestOptions, ResolvedProxyConfig } from "@apifuse/provider-sdk";',
 			'import { defineCredentialsAuth } from "@apifuse/provider-sdk/provider";',
+			'import type { NativeNetworkClient as ProviderEntryNativeNetworkClient, ProviderFilesContext as ProviderEntryFilesContext } from "@apifuse/provider-sdk/provider";',
 			'import { extractProviderContract } from "@apifuse/provider-sdk/contract";',
 			'import { AUTH_TURN_SCHEMA } from "@apifuse/provider-sdk/auth-turn";',
 			'import { serve } from "@apifuse/provider-sdk/server";',
-			'import { runStandardTests } from "@apifuse/provider-sdk/testing";',
+			'import { resetProviderCacheForTests, runStandardTests } from "@apifuse/provider-sdk/testing";',
 			"",
 			"// ProviderError must keep its inherited Error members under nodenext.",
 			"// When dist d.ts imports fail to resolve, the class type degrades and",
@@ -143,6 +404,44 @@ function setUpFixtureConsumer(consumerDir: string, tarballPath: string): void {
 			"// Re-exported zod must keep .refine() callback parameter inference.",
 			"const refined = z.object({ shopId: z.string() }).refine((value) => value.shopId.length > 0);",
 			'const refinedString = z.string().refine((value) => value.startsWith("tabelog:"));',
+			'const proxyOptions: ProxyResolutionOptions = { proxyPolicy: { mode: "disabled" } };',
+			'const proxyProtocol: ProxyProtocol = "http";',
+			"const proxyResult: Promise<ResolvedProxyConfig> = resolveProxy(proxyOptions);",
+			'const proxySource: ProxyResolutionSource = "smartproxy-allocator";',
+			'const proxyVendor: ProxyVendorName = "smartproxy";',
+			'const requestFile: ProviderFileRef = { type: "request_file", id: "photo", filename: "photo.jpg", mime_type: "image/jpeg", size: 4 };',
+			'const resolvedFile: ProviderResolvedFile = { type: "request_file", id: requestFile.id, filename: requestFile.filename, size: requestFile.size, sha256: requestFile.sha256, mimeType: requestFile.mime_type, arrayBuffer: async () => new ArrayBuffer(0), bytes: async () => new Uint8Array(), stream: () => new ReadableStream<Uint8Array>() };',
+			"const files: ProviderFilesContext = { has: () => true, resolve: async () => resolvedFile };",
+			"const providerEntryFiles: ProviderEntryFilesContext = files;",
+			"const connection: NativeNetworkConnection = { read: async () => null, write: async () => {}, close: async () => {} };",
+			"const network: NativeNetworkClient = { connectTcp: async () => connection, connectTls: async () => connection, grantTcpEgress: () => ({ revoke() {} }) };",
+			"const providerEntryNetwork: ProviderEntryNativeNetworkClient = network;",
+			"const nativeContext: NativeContext = { network };",
+			'const grant: NativeTcpEgressGrant = network.grantTcpEgress({ sourceHost: "booking-loco.kakao.com", sourcePort: 443, host: "loco.kakao.com", port: 5228, tls: "disabled" });',
+			'const nativeConfig: NativeProviderConfig = { network: { tcp: [{ host: "booking-loco.kakao.com", ports: [443], tls: "required" }] } };',
+			"const providerContext = undefined as unknown as ProviderContext;",
+			"const optionalFiles: ProviderFilesContext | undefined = providerContext.files;",
+			"const native: NativeContext = providerContext.native;",
+			"export const providerResolver: ResolverContext = providerContext.resolver;",
+			'export const resolverRuntimeOptions: ResolverRuntimeOptions = { allowedHosts: ["example.com"], cache: providerContext.cache };',
+			"",
+			'export const turnstileChallenge: ProviderChallenge = { kind: "turnstile", siteKey: "key", pageUrl: "https://example.com" };',
+			"export const abortableResolverSolve = providerResolver.solve(turnstileChallenge, new AbortController().signal);",
+			'export const recaptchaV2Challenge: ProviderChallenge = { kind: "recaptcha_v2", siteKey: "key", pageUrl: "https://example.com" };',
+			'export const recaptchaV3Challenge: ProviderChallenge = { kind: "recaptcha_v3", siteKey: "key", pageUrl: "https://example.com", action: "login" };',
+			'export const hcaptchaChallenge: ProviderChallenge = { kind: "hcaptcha", siteKey: "key", pageUrl: "https://example.com" };',
+			'export const cloudflareInterstitialChallenge: ProviderChallenge = { kind: "cloudflare_interstitial", pageUrl: "https://example.com", blockedHtml: "<html></html>" };',
+			'export const awsWafChallenge: ProviderChallenge = { kind: "aws_waf", pageUrl: "https://example.com", captchaScript: "script" };',
+			'export const tokenSolution: ChallengeSolution = { form: "token", token: "solved-token" };',
+			'export const cookieSolution: ChallengeSolution = { form: "cookies", cookies: { cf_clearance: "clearance" }, userAgent: "fixture-agent" };',
+			"export const invalidation = invalidateResolverSolution(providerContext.resolver, awsWafChallenge, cookieSolution);",
+			'export const resolverConfig: ProviderResolverConfig = { vendors: ["browser", "capsolver"], kinds: ["cloudflare_interstitial", "turnstile"] };',
+			'export const resolverProvider = defineProvider({ id: "pack-types-resolver", version: "1.0.0", runtime: "standard", resolver: resolverConfig, meta: { displayName: "Pack Types Resolver", descriptionKey: "meta.description", category: "test" } })({ operations: { probe: { input: z.object({}), output: z.object({ ok: z.boolean() }), handler: async () => ({ ok: true }), healthCheckUnsupported: { reason: "type fixture" } } } });',
+			"export const resolverContext: ResolverContext = { solve: async () => tokenSolution };",
+			'export const browserCookie: BrowserCookie = { name: "persistent-id", value: "persistent-token", domain: "example.com", path: "/", expires: 1786698176, httpOnly: true, secure: true };',
+			'const browserPage = undefined as unknown as Awaited<ReturnType<ProviderContext["browser"]["newPage"]>>;',
+			"export const browserCookies: Promise<readonly BrowserCookie[]> = browserPage.cookies();",
+			'const queryCredentialOptions: RequestOptions = { sensitiveParams: { serviceKey: "type-test-key" } };',
 			"",
 			"export const witnesses = {",
 			"	inheritedName,",
@@ -152,27 +451,39 @@ function setUpFixtureConsumer(consumerDir: string, tarballPath: string): void {
 			"	sessionExpired,",
 			"	refined,",
 			"	refinedString,",
+			"	proxyResult,",
+			"	proxyProtocol,",
+			"	proxySource,",
+			"	proxyVendor,",
+			"	requestFile,",
+			"	resolvedFile,",
+			"	files,",
+			"	providerEntryFiles,",
+			"	connection,",
+			"	network,",
+			"	providerEntryNetwork,",
+			"	nativeContext,",
+			"	grant,",
+			"	nativeConfig,",
+			"	optionalFiles,",
+			"	native,",
+			"	browserCookie,",
+			"	browserCookies,",
+			"	queryCredentialOptions,",
 			"	defineCredentialsAuth,",
 			"	extractProviderContract,",
 			"	AUTH_TURN_SCHEMA,",
 			"	serve,",
+			"	resetProviderCacheForTests,",
 			"	runStandardTests,",
 			"};",
 			"",
 		].join("\n"),
 	);
 
-	writeFileSync(
-		join(consumerDir, "negative-control.ts"),
-		[
-			'import { ProviderError } from "@apifuse/provider-sdk";',
-			"",
-			"// Intentionally wrong: name is a string. If this file compiles, the",
-			"// fixture consumer is not actually type-checking and the guard is void.",
-			'export const mustNotCompile: number = new ProviderError("boom").name;',
-			"",
-		].join("\n"),
-	);
+	for (const negativeControl of NEGATIVE_CONTROLS) {
+		writeFileSync(join(consumerDir, negativeControl.filename), negativeControl.source);
+	}
 }
 
 function compileFixtureConsumer(consumerDir: string): void {
@@ -184,31 +495,38 @@ function compileFixtureConsumer(consumerDir: string): void {
 }
 
 function assertNegativeControlFails(consumerDir: string): void {
-	const result = spawnSync(
-		"bun",
-		[
-			join(consumerDir, "node_modules", ".bin", "tsc"),
-			"--target",
-			"ES2022",
-			"--module",
-			"nodenext",
-			"--moduleResolution",
-			"nodenext",
-			"--strict",
-			"--noEmit",
-			"negative-control.ts",
-		],
-		{ cwd: consumerDir, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] },
-	);
-	if (result.status === 0) {
-		throw new Error(
-			"Negative control compiled cleanly: the fixture consumer is not detecting type errors, so the nodenext guard proves nothing.",
-		);
-	}
-	if (!`${result.stdout}\n${result.stderr}`.includes("TS2322")) {
-		throw new Error(
-			`Negative control failed for an unexpected reason (wanted TS2322):\n${result.stdout}\n${result.stderr}`,
+	for (const negativeControl of NEGATIVE_CONTROLS) {
+		const result = spawnSync(
+			"bun",
+			[
+				join(consumerDir, "node_modules", ".bin", "tsc"),
+				"--target",
+				"ES2022",
+				"--module",
+				"nodenext",
+				"--moduleResolution",
+				"nodenext",
+				"--strict",
+				"--noEmit",
+				negativeControl.filename,
+			],
+			{ cwd: consumerDir, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] },
 		);
+		if (result.status === 0) {
+			throw new Error(
+				'Negative control "' +
+					negativeControl.description +
+					'" (' +
+					negativeControl.filename +
+					") compiled cleanly: the fixture consumer is not detecting its error, so the guard proves nothing.",
+			);
+		}
+		const output = `${result.stdout}\n${result.stderr}`;
+		if (!output.includes(negativeControl.expectedCode)) {
+			throw new Error(
+				`Negative control "${negativeControl.description}" (${negativeControl.filename}) failed for an unexpected reason (wanted ${negativeControl.expectedCode}):\n${output}`,
+			);
+		}
 	}
 }