@apifuse/provider-sdk 2.2.0-beta.47 → 2.2.0-beta.49

package/dist/types.d.ts

@@ -34,27 +34,13 @@ export declare namespace StandardSchemaV1 {
 export type SchemaLike = ZodType | StandardSchemaV1;
 /** Infer the validated output type produced by a Zod or Standard Schema. */
 export type InferSchemaOutput<TSchema extends SchemaLike> = TSchema extends ZodType ? ZodInfer<TSchema> : TSchema extends StandardSchemaV1<unknown, infer Output> ? Output : unknown;
-export interface OperationInputExample {
-    scenario: string;
+export interface OperationExample {
+    scenarioKey: ProviderLocaleKeyInput;
     input: unknown;
-    rationale?: string;
+    rationaleKey?: ProviderLocaleKeyInput;
 }
 export type OperationRiskClass = "read" | "write" | "destructive" | "external-send";
 export type OperationApprovalPolicy = "never" | "risk-based" | "always";
-export interface OperationToolRouterMetadata {
-    /** Optional MCP-safe override. Defaults to providerId__operationId. */
-    name?: string;
-    /** Safety class exposed to Tool Router clients and approval policy. */
-    riskClass?: OperationRiskClass;
-    /** OpenAI remote-MCP approval hint. Defaults from riskClass. */
-    approval?: OperationApprovalPolicy;
-    /** Canonical operation-level connection requirement consumed by the registry and Gateway. */
-    connectionMode?: "none" | "optional" | "required";
-    /** Override connection requirement when provider auth + openWorld inference is insufficient. */
-    requiresConnection?: boolean;
-    /** Public argument used to resolve the tenant-owned connection. Defaults to externalRef. */
-    connectionExternalRefParam?: string;
-}
 export type OperationSensitivePath = string;
 export interface OperationObservabilitySensitiveConfig {
     /**
@@ -76,37 +62,6 @@ export interface OperationObservabilityConfig {
      */
     sensitive?: OperationObservabilitySensitiveConfig;
 }
-export interface OperationAnnotations {
-    readOnly?: boolean;
-    destructive?: boolean;
-    idempotent?: boolean;
-    /**
-     * Marks the operation as callable without provider-level authentication.
-     *
-     * Provider-level `auth.mode` describes the **majority** auth model of a
-     * provider; individual operations can still opt out via `openWorld: true`
-     * when their handler does not consume `ctx.credential`. This is the
-     * canonical way to declare "this operation is public, even though the
-     * provider is `credentials`-mode" without splitting the provider into two.
-     *
-     * Health-check projections treat `openWorld: true` operations as
-     * connection-free probes (no `requiresConnection` required, no SA token
-     * lookup). Future gateway work MAY extend this annotation to bypass
-     * `X-ApiFuse-Connection-Id` enforcement at proxy time.
-     *
-     * Example: Naver Map's `search`, `geocode`, and directions operations
-     * call public Naver endpoints with no cookies, while `collections` and
-     * `export` consume the user's session cookie — the provider declares
-     * `auth.mode: "credentials"` (for the latter) and the former mark
-     * `openWorld: true`.
-     */
-    openWorld?: boolean;
-    rateLimit?: {
-        calls: number;
-        window: "minute" | "hour" | "day";
-    };
-    timeoutMs?: number;
-}
 export declare const OPERATION_TIMEOUT_MS_MIN = 1;
 export declare const OPERATION_TIMEOUT_MS_MAX = 60000;
 export declare const STREAM_HEARTBEAT_MS_MIN = 1000;
@@ -338,6 +293,11 @@ export type ChallengeSolution = {
     readonly userAgent: string;
     /** Epoch seconds copied from the upstream cookie's own expiry attribute; never a constant. */
     readonly expires?: number;
+    /**
+     * Epoch seconds conservatively estimated by the SDK when a resolver vendor omits
+     * the upstream cookie's expiry. `expires` takes precedence when both are present.
+     */
+    readonly sdkEstimatedExpires?: number;
 };
 export interface ProviderResolverConfig {
     /** Optional ordered override for the SDK-owned vendor fallback chain. */
@@ -786,17 +746,34 @@ export interface OperationErrorCode {
     description: string;
     retryable?: boolean;
 }
-export interface OperationDocMeta {
-    titleKey?: ProviderLocaleKeyInput;
-    descriptionKey?: ProviderLocaleKeyInput;
-    summaryKey?: ProviderLocaleKeyInput;
-    markdownKey?: ProviderLocaleKeyInput;
-    normalizationNotesKeys?: ProviderLocaleKeyInput[];
-    requestExample?: Record<string, unknown>;
-    responseExample?: unknown;
-    errorCodes?: OperationErrorCode[];
-}
 export type StealthPlatform = "macos" | "windows" | "linux" | "android" | "ios";
+export type StealthBrowser = "chrome" | "firefox" | "safari";
+export type StealthOS = "windows" | "macos" | "linux" | "ios";
+/** A supported, fully resolved browser/OS fingerprint pair. */
+export type StealthProfileDescriptor = {
+    browser: "chrome";
+    os: "windows" | "macos" | "linux";
+} | {
+    browser: "firefox";
+    os: "windows" | "macos" | "linux";
+} | {
+    browser: "safari";
+    os: "macos" | "ios";
+};
+/**
+ * Browser/OS fingerprint selection. Chrome and macOS are the named defaults
+ * when their respective axes are omitted.
+ */
+export type StealthProfileSelection = {
+    browser?: "chrome";
+    os?: "windows" | "macos" | "linux";
+} | {
+    browser: "firefox";
+    os?: "windows" | "macos" | "linux";
+} | {
+    browser: "safari";
+    os?: "macos" | "ios";
+};
 export type BrowserEngine = "playwright-stealth" | "nodriver" | "selenium-uc";
 export interface BrowserOptions {
     headless?: boolean;
@@ -805,9 +782,7 @@ export interface BrowserOptions {
     engine?: BrowserEngine;
     requireCdpPool?: boolean;
 }
-export interface StealthProfile {
-    name: string;
-    platform: StealthPlatform;
+export type StealthProfile = StealthProfileDescriptor & {
     version: string;
     userAgent: string;
     tlsClientIdentifier?: string;
@@ -815,7 +790,7 @@ export interface StealthProfile {
     ja4?: string;
     h2Settings?: Record<string, unknown>;
     headerOrder?: string[];
-}
+};
 export type AuthMode = "none" | "platform-managed" | "credentials" | "oauth2" | "oauth2_proxied";
 export type ConnectionMode = AuthMode;
 export type ProviderReviewed = "first-party" | "community" | "staging";
@@ -890,8 +865,7 @@ export interface ProviderAccessConfig {
      *	 active customer organization has a provider-level access grant.
      *
      * This is intentionally provider-level only. It does not alter auth mode,
-     * operation schemas, health-check authoring, `openWorld`, or Connection
-     * requirements.
+     * operation schemas, health-check authoring, or Connection requirements.
      */
     visibility?: ProviderAccessVisibility;
 }
@@ -1052,7 +1026,12 @@ export interface HttpRedirectPolicy {
 }
 export type HttpRedirectFailureReason = Exclude<RedirectRunReason, "completed">;
 export type HttpMethod = "HEAD" | "head" | "GET" | "get" | "POST" | "post" | "PUT" | "put" | "DELETE" | "delete" | "OPTIONS" | "options" | "TRACE" | "trace" | "PATCH" | "patch";
-export interface StealthFetchOptions extends Omit<RequestOptions, "redirectPolicy"> {
+export interface StealthFetchOptions extends Omit<RequestOptions, "redirectPolicy" | "headers"> {
+    /**
+     * Request headers. Array values and case-insensitive duplicate names are
+     * combined in caller order using `", "`, matching Chrome's Fetch behavior.
+     */
+    headers?: Record<string, string | string[]>;
     method?: HttpMethod;
     body?: string | Buffer;
     redirect?: "follow" | "manual" | "error";
@@ -1069,14 +1048,18 @@ export interface StealthFetchOptions extends Omit<RequestOptions, "redirectPolic
      * operation-affinity proxy.
      */
     proxyAttemptOffset?: number;
-    /** Override the configured browser-like stealth profile for this request. */
-    profile?: string;
     /**
-     * Stealth transport certificate controls. Use only for proxy products that
-     * terminate CONNECT with a private CA instead of tunneling the origin
-     * certificate chain.
+     * SDK-specific stealth controls. Standard HTTP metadata such as language,
+     * referrer, and content type belongs in `headers`.
      */
-    stealth?: {
+    stealth?: StealthProfileSelection & {
+        /** Override the configured browser and/or OS for this request. */
+        /** Declare the Chrome request class when it cannot be inferred from the method. */
+        requestClass?: "navigation" | "xhr" | "post";
+        /**
+         * Use only for proxy products that terminate CONNECT with a private CA
+         * instead of tunneling the origin certificate chain.
+         */
         insecureSkipVerify?: boolean;
     };
 }
@@ -1249,6 +1232,8 @@ export interface ProviderFilesContext {
     has(input: string | ProviderFileRef): boolean;
     resolve(input: string | ProviderFileRef): Promise<ProviderResolvedFile>;
 }
+/** Where provider business logic executes relative to the capability engine. */
+export type ProviderRuntimeTarget = "vanilla" | "engine";
 export type NativeTcpTlsMode = "required" | "allowed" | "disabled";
 export interface NativeTcpPortRange {
     readonly start: number;
@@ -1421,7 +1406,7 @@ export interface ProviderCache {
 export interface StealthClient {
     fetch(url: string, options?: StealthFetchOptions): Promise<StealthResponse>;
     createSession(opts?: {
-        profile?: string;
+        stealth?: StealthProfileSelection;
     }): StealthSession;
     close?(): void;
 }
@@ -1552,7 +1537,7 @@ export interface TraceConfig {
     exporter?: "console" | "json" | "otlp" | "none";
     endpoint?: string;
     otlp?: {
-        endpoint: string;
+        endpoint?: string;
         headers?: Record<string, string>;
         timeout?: number;
     };
@@ -1871,32 +1856,48 @@ export interface ProviderRuntimeState {
     forConnection(connectionId: string | undefined): ProviderRuntimeState;
     namespace(name: string, options: StateNamespaceOptions): ProviderStateNamespace;
 }
-export interface ProviderContext {
+/**
+ * The operation context exposed for one provider declaration. Capability
+ * bindings are present only when their corresponding declaration is present;
+ * trace and request remain ambient runtime bindings. Omitting the type
+ * parameter preserves the legacy full context shape for existing annotations.
+ */
+export type ProviderContext<TConfig = Record<string, unknown>> = {
+    request?: ProviderRequestContext;
+    trace: TraceContext;
+} & ("env" extends keyof TConfig ? {
     env: EnvContext;
+} : Record<never, never>) & ("credential" extends keyof TConfig ? {
     credential: CredentialContext;
-    request?: ProviderRequestContext;
+} : Record<never, never>) & ("http" extends keyof TConfig ? {
     http: HttpClient;
-    /** Present for requests carrying runtime-resolvable file references. */
+} : Record<never, never>) & ("files" extends keyof TConfig ? string extends keyof TConfig ? {
     readonly files?: ProviderFilesContext;
-    /** Native network capability selected by declaration-derived contexts. */
+} : {
+    readonly files: ProviderFilesContext;
+} : Record<never, never>) & ("native" extends keyof TConfig ? {
     readonly native: NativeContext;
+} : Record<never, never>) & ("cache" extends keyof TConfig ? {
     cache: ProviderCache;
+} : Record<never, never>) & ("state" extends keyof TConfig ? {
     state: ProviderRuntimeState;
+} : Record<never, never>) & ("stealth" extends keyof TConfig ? {
     stealth: StealthClient;
+} : Record<never, never>) & ("browser" extends keyof TConfig ? {
     browser: BrowserClient;
-    trace: TraceContext;
+} : Record<never, never>) & ("auth" extends keyof TConfig ? {
     auth: AuthContext;
+} : Record<never, never>) & ("ocr" extends keyof TConfig ? {
     ocr: OcrContext;
+} : Record<never, never>) & ("stt" extends keyof TConfig ? {
     stt: SttContext;
+} : Record<never, never>) & ("resolver" extends keyof TConfig ? {
     resolver: ResolverContext;
+} : Record<never, never>) & ("choice" extends keyof TConfig ? {
     choice: ProviderChoiceContext;
-}
-/**
- * The operation context exposed for one provider declaration. Capability
- * bindings are present only when their corresponding declaration is present;
- * trace and request remain ambient runtime bindings.
- */
-export type ProviderContextFor<TConfig> = Pick<ProviderContext, "trace" | "request"> & ("env" extends keyof TConfig ? Pick<ProviderContext, "env"> : Record<never, never>) & ("credential" extends keyof TConfig ? Pick<ProviderContext, "credential"> : Record<never, never>) & ("http" extends keyof TConfig ? Pick<ProviderContext, "http"> : Record<never, never>) & ("files" extends keyof TConfig ? Pick<ProviderContext, "files"> : Record<never, never>) & ("native" extends keyof TConfig ? Pick<ProviderContext, "native"> : Record<never, never>) & ("cache" extends keyof TConfig ? Pick<ProviderContext, "cache"> : Record<never, never>) & ("state" extends keyof TConfig ? Pick<ProviderContext, "state"> : Record<never, never>) & ("stealth" extends keyof TConfig ? Pick<ProviderContext, "stealth"> : Record<never, never>) & ("browser" extends keyof TConfig ? Pick<ProviderContext, "browser"> : Record<never, never>) & ("auth" extends keyof TConfig ? Pick<ProviderContext, "auth"> : Record<never, never>) & ("ocr" extends keyof TConfig ? Pick<ProviderContext, "ocr"> : Record<never, never>) & ("stt" extends keyof TConfig ? Pick<ProviderContext, "stt"> : Record<never, never>) & ("resolver" extends keyof TConfig ? Pick<ProviderContext, "resolver"> : Record<never, never>) & ("choice" extends keyof TConfig ? Pick<ProviderContext, "choice"> : Record<never, never>);
+} : Record<never, never>);
+/** Backwards-compatible name for a declaration-derived provider context. */
+export type ProviderContextFor<TConfig> = ProviderContext<TConfig>;
 export interface ProxiedOAuthConfig {
     authorizeUrl: string;
     tokenUrl: string;
@@ -1943,33 +1944,29 @@ export interface OperationContractMetadata {
     deprecation?: OperationDeprecationMetadata;
 }
 export interface OperationDefinition<TInput extends SchemaLike = SchemaLike, TOutput extends SchemaLike = SchemaLike, TContext = ProviderContext> {
-    /**
-     * Short English display title for the operation. The SDK passes it through
-     * verbatim; the APIFuse registry derives the operation's en locale title
-     * baseline from it (`docs.titleKey` remains available as an explicit key
-     * override).
-     */
-    title?: string;
-    /**
-     * Raw English operation description. The SDK passes it through verbatim;
-     * keyed descriptions via `descriptionKey` remain the primary flow, and
-     * provider lint rules for raw prose descriptions still apply.
-     */
-    description?: string;
+    /** Canonical operation-level connection requirement. */
+    connectionMode?: "none" | "optional" | "required";
+    /** Public argument used to resolve the tenant-owned connection. Defaults to externalRef. */
+    connectionExternalRefParam?: string;
+    /** Safety source of truth exposed to clients and approval policy. */
+    riskClass: OperationRiskClass;
+    /** Approval override. Omit when the risk-class default is correct. */
+    approval?: OperationApprovalPolicy;
+    timeoutMs?: number;
+    titleKey?: ProviderLocaleKeyInput;
     descriptionKey?: ProviderLocaleKeyInput;
-    docs?: OperationDocMeta;
+    summaryKey?: ProviderLocaleKeyInput;
+    markdownKey?: ProviderLocaleKeyInput;
     whenToUseKeys?: readonly ProviderLocaleKeyInput[];
     whenNotToUseKeys?: readonly ProviderLocaleKeyInput[];
-    derivations?: Record<string, string>;
-    inputExamples?: readonly OperationInputExample[];
-    annotations?: OperationAnnotations;
+    normalizationNotesKeys?: readonly ProviderLocaleKeyInput[];
+    errorCodes?: readonly OperationErrorCode[];
+    examples?: readonly OperationExample[];
     contract?: OperationContractMetadata;
     tags?: readonly string[];
     relatedOperations?: OperationRelationships;
-    toolRouter?: OperationToolRouterMetadata;
     observability?: OperationObservabilityConfig;
     transport?: OperationTransport;
-    retryOnAuthRefresh?: boolean;
     input: TInput;
     output: TOutput;
     handler(ctx: TContext, input: InferSchemaOutput<TInput>): OperationHandlerResult<InferSchemaOutput<TOutput>> | Promise<OperationHandlerResult<InferSchemaOutput<TOutput>>>;
@@ -2032,18 +2029,24 @@ export interface ProviderDefinition<TContext = ProviderContext> {
     id: string;
     version: string;
     runtime: "standard" | "shared" | "browser";
+    /**
+     * `vanilla` executes provider business logic outside the engine; `engine`
+     * keeps session-bearing provider logic in the engine process.
+     *
+     * Omitted only for definitions authored before the engine migration. New
+     * providers should declare the target explicitly.
+     */
+    runtimeTarget?: ProviderRuntimeTarget;
     /**
      * Optional deployment overrides, passed through verbatim from
      * `defineProvider({ deployment })`. Validation and profile resolution are
      * owned by the APIFuse registry builder, not the SDK.
      */
     deployment?: ProviderDeploymentOverrides;
+    http?: Record<string, never> | true;
     allowedHosts?: string[];
     native?: NativeProviderConfig;
-    stealth?: {
-        profile: string;
-        platform: StealthPlatform;
-    };
+    stealth?: StealthProfileSelection;
     proxy?: ProviderProxyConfig;
     ocr?: ProviderOcrConfig;
     stt?: ProviderSttConfig;
@@ -2052,11 +2055,16 @@ export interface ProviderDefinition<TContext = ProviderContext> {
         engine: BrowserEngine;
     };
     auth?: AuthConfig;
+    choice?: Record<string, never> | true;
     reviewed?: ProviderReviewed;
     access?: ProviderAccessConfig;
     secrets?: ProviderSecretDeclaration[];
+    env?: Record<string, never> | true;
     credential?: CredentialDeclaration;
     context?: ContextDeclaration;
+    state?: Record<string, never> | true;
+    cache?: Record<string, never> | true;
+    files?: Record<string, never> | true;
     meta: ProviderMeta;
     operations: Record<string, OperationDefinition<SchemaLike, SchemaLike, TContext>>;
     healthMonitor?: ProviderHealthMonitorConfig;

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "2.2.0-beta.47",
+	"version": "2.2.0-beta.49",
 	"name": "@apifuse/provider-sdk",
 	"private": false,
 	"type": "module",
@@ -113,6 +113,7 @@
 		"check": "bun run lint && bun run type-check && bun run lint:deprecated && bun run lint:test-typesafety && bun run build",
 		"api:update": "bun run build && bun scripts/api-reports.ts update",
 		"api:check": "bun run build && bun scripts/api-reports.ts check",
+		"verify:chrome-headers": "bun scripts/verify-chrome-header-parity.ts",
 		"changeset:check": "bun scripts/check-changeset.ts",
 		"pack:check": "bun run build && bun bin/apifuse-pack-check.ts",
 		"pack:smoke": "bun run build && bun bin/apifuse-pack-smoke.ts",

package/src/cli/__tests__/fixtures/migrate-operation-declaration/approval-override.ts.txt

@@ -0,0 +1,6 @@
+const reserveOperation = defineOperation<ProviderContext>()({
+	toolRouter: { riskClass: "write", approval: "always" },
+	input: InputSchema,
+	output: OutputSchema,
+	handler,
+});

package/src/cli/__tests__/fixtures/migrate-operation-declaration/codemod-syntax.ts.txt

@@ -0,0 +1,3 @@
+const migrated = {
+	riskClass: "read",;
+};

package/src/cli/__tests__/fixtures/migrate-operation-declaration/connection-precedence.ts.txt

@@ -0,0 +1,10 @@
+const connectOperation = defineOperation<ProviderContext>()({
+	annotations: { readOnly: true },
+	toolRouter: {
+		connectionMode: "optional",
+		requiresConnection: true,
+	},
+	input: InputSchema,
+	output: OutputSchema,
+	handler,
+});

package/src/cli/__tests__/fixtures/migrate-operation-declaration/docs-conflict.ts.txt

@@ -0,0 +1,8 @@
+const searchOperation = defineOperation<ProviderContext>()({
+	riskClass: "read",
+	titleKey: "operations.search.title",
+	docs: { titleKey: "operations.search.otherTitle" },
+	input: InputSchema,
+	output: OutputSchema,
+	handler,
+});

package/src/cli/__tests__/fixtures/migrate-operation-declaration/examples-map.ts.txt

@@ -0,0 +1,5 @@
+import { searchOperation } from "./search";
+
+export const operations = {
+	search: searchOperation,
+};

package/src/cli/__tests__/fixtures/migrate-operation-declaration/examples-operation.ts.txt

@@ -0,0 +1,16 @@
+export const searchOperation = defineOperation<ProviderContext>()({
+	annotations: { readOnly: true },
+	inputExamples: [
+		{
+			scenario: "Search by a precise phrase",
+			input: {
+				query: `京都
+  ホテル`,
+			},
+			rationale: "Shows whitespace preservation",
+		},
+	],
+	input: InputSchema,
+	output: OutputSchema,
+	handler,
+});

package/src/cli/__tests__/fixtures/migrate-operation-declaration/factory-map.ts.txt

@@ -0,0 +1,3 @@
+export default buildProvider({
+	operations: createTabelogProvider(client),
+});

package/src/cli/__tests__/fixtures/migrate-operation-declaration/hoist-all.ts.txt

@@ -0,0 +1,31 @@
+const searchOperation = defineOperation<ProviderContext>()({
+	annotations: {
+		readOnly: true,
+		openWorld: true,
+		idempotent: true,
+		rateLimit: { requests: 10 },
+		timeoutMs: 30_000,
+	},
+	toolRouter: {
+		name: "ignored",
+		requiresConnection: false,
+		connectionExternalRefParam: "accountId",
+	},
+	docs: {
+		titleKey: "operations.search.title",
+		descriptionKey: "operations.search.description",
+		summaryKey: "operations.search.summary",
+		markdownKey: "operations.search.markdown",
+		normalizationNotesKeys: ["operations.search.normalization.one"],
+		errorCodes: [{ code: "UPSTREAM" }],
+		requestExample: { query: "old" },
+		responseExample: { items: [] },
+	},
+	derivations: { value: "unused" } as unknown as Derivations,
+	retryOnAuthRefresh: true as unknown as boolean,
+	title: "Raw title" as unknown as string,
+	description: "Raw description" as unknown as string,
+	input: InputSchema,
+	output: OutputSchema,
+	handler,
+});

package/src/cli/__tests__/fixtures/migrate-operation-declaration/hoisted-const.ts.txt

@@ -0,0 +1,11 @@
+const annotations = {
+	readOnly: true,
+	timeoutMs: 15_000,
+} as const;
+
+const detailOperation = defineOperation<ProviderContext>()({
+	annotations,
+	input: InputSchema,
+	output: OutputSchema,
+	handler,
+});

package/src/cli/__tests__/fixtures/migrate-operation-declaration/imported-spread.ts.txt

@@ -0,0 +1,11 @@
+import { toolRouterDefaults } from "./tool-router-defaults.js";
+
+const importedSpreadOperation = defineOperation<ProviderContext>()({
+	annotations: { readOnly: true },
+	toolRouter: {
+		...toolRouterDefaults,
+	},
+	input: InputSchema,
+	output: OutputSchema,
+	handler,
+});

package/src/cli/__tests__/fixtures/migrate-operation-declaration/inline-map.ts.txt

@@ -0,0 +1,11 @@
+const provider = buildProvider({
+	operations: {
+		ping: {
+			annotations: { readOnly: true },
+			docs: { descriptionKey: "operations.ping.description" },
+			input: InputSchema,
+			output: OutputSchema,
+			handler,
+		},
+	},
+});

package/src/cli/__tests__/fixtures/migrate-operation-declaration/inline-spread-cast-tail.ts.txt

@@ -0,0 +1,21 @@
+const castTailOperation = defineOperation<ProviderContext>()({
+	annotations: {
+		...({ timeoutMs: 15_000 as Milliseconds } as unknown as LegacyAnnotations),
+	},
+	toolRouter: {
+		...({
+			riskClass: "write" as const,
+			approval: "always" as ApprovalMode,
+			connectionMode: "none" as ConnectionMode,
+		} as unknown as LegacyToolRouter),
+	},
+	docs: {
+		...({
+			titleKey: "operations.castTail.title" as const,
+			descriptionKey: "operations.castTail.description" as LocaleKey,
+		} as unknown as LegacyDocs),
+	},
+	input: InputSchema,
+	output: OutputSchema,
+	handler,
+});

package/src/cli/__tests__/fixtures/migrate-operation-declaration/inline-spread-ekitan.ts.txt

@@ -0,0 +1,11 @@
+const getStationInfoOperation = defineOperation<ProviderContext>()({
+	toolRouter: {
+		riskClass: "read",
+		approval: "never",
+		requiresConnection: false,
+		...{ connectionMode: "none" as const },
+	},
+	input: InputSchema,
+	output: OutputSchema,
+	handler,
+});

package/src/cli/__tests__/fixtures/migrate-operation-declaration/inline-spread-override.ts.txt

@@ -0,0 +1,14 @@
+const overrideOperation = defineOperation<ProviderContext>()({
+	toolRouter: {
+		riskClass: "read",
+		connectionMode: "required" as const,
+		...{
+			connectionMode: "none" as const,
+			approval: "never" as const,
+		},
+		approval: "always" as const,
+	},
+	input: InputSchema,
+	output: OutputSchema,
+	handler,
+});

package/src/cli/__tests__/fixtures/migrate-operation-declaration/missing-english-locale.ts.txt

@@ -0,0 +1,7 @@
+const searchOperation = defineOperation<ProviderContext>()({
+	annotations: { readOnly: true },
+	inputExamples: [{ scenario: "Search by title", input: { query: "castle" } }],
+	input: InputSchema,
+	output: OutputSchema,
+	handler,
+});

package/src/cli/__tests__/fixtures/migrate-operation-declaration/no-safety.ts.txt

@@ -0,0 +1,6 @@
+const unknownOperation = defineOperation<ProviderContext>()({
+	annotations: { readOnly: false, destructive: false },
+	input: InputSchema,
+	output: OutputSchema,
+	handler,
+});

package/src/cli/__tests__/fixtures/migrate-operation-declaration/non-literal.ts.txt

@@ -0,0 +1,7 @@
+const READ_ONLY = true;
+const searchOperation = defineOperation<ProviderContext>()({
+	annotations: { readOnly: READ_ONLY },
+	input: InputSchema,
+	output: OutputSchema,
+	handler,
+});

package/src/cli/__tests__/fixtures/migrate-operation-declaration/redundant-approval.ts.txt

@@ -0,0 +1,6 @@
+const searchOperation = defineOperation<ProviderContext>()({
+	toolRouter: { riskClass: "read", approval: "never" },
+	input: InputSchema,
+	output: OutputSchema,
+	handler,
+});

package/src/cli/__tests__/fixtures/migrate-operation-declaration/safety-conflict.ts.txt

@@ -0,0 +1,7 @@
+const cancelOperation = defineOperation<ProviderContext>()({
+	annotations: { destructive: true },
+	toolRouter: { riskClass: "write" },
+	input: InputSchema,
+	output: OutputSchema,
+	handler,
+});

package/src/cli/__tests__/fixtures/migrate-operation-declaration/stream.ts.txt

@@ -0,0 +1,7 @@
+const downloadOperation = defineStreamOperation<ProviderContext>()({
+	annotations: { readOnly: true },
+	toolRouter: { connectionMode: "optional" },
+	input: InputSchema,
+	output: OutputSchema,
+	handler,
+});

package/src/cli/__tests__/fixtures/migrate-operation-declaration/tool-router-spread.ts.txt

@@ -0,0 +1,15 @@
+const requiredConnection = {
+	requiresConnection: true,
+	connectionExternalRefParam: "profileId",
+} as const;
+
+const updateOperation = defineOperation<ProviderContext>()({
+	annotations: { destructive: true },
+	toolRouter: {
+		...requiredConnection,
+		approval: "always",
+	},
+	input: InputSchema,
+	output: OutputSchema,
+	handler,
+});

package/src/cli/__tests__/fixtures/migrate-operation-declaration/unparseable.ts.txt

@@ -0,0 +1,4 @@
+const brokenOperation = defineOperation<ProviderContext>()({
+	annotations: { readOnly: true },
+	input:,
+});