@apifuse/provider-sdk 2.2.0-beta.59 → 2.2.0-beta.61

package/src/server/trace-output.ts

@@ -1,4 +1,11 @@
 import { isSensitiveFixtureKey, REDACTED_FIXTURE_VALUE } from "../fixture-sanitization.js";
+import {
+	type DiagnosticRedactor,
+	redactedKeyAllocator,
+	isRedactedKey,
+	REDACTION_FAILED,
+	redactDiagnosticText,
+} from "../runtime/diagnostic-redactor.js";
 import {
 	OTEL_EXPORTER_OTLP_ENDPOINT,
 	OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,
@@ -22,6 +29,16 @@ import type { TraceConfig } from "../types.js";
 
 type EnvLike = Record<string, string | undefined>;
 
+const TRACE_RESOURCE_ATTRIBUTE_SANITIZER = Symbol.for(
+	"@apifuse/provider-sdk/runtime/trace-resource-attribute-sanitizer",
+);
+
+type ResourceAttributesWithSanitizer = Record<string, string> & {
+	[TRACE_RESOURCE_ATTRIBUTE_SANITIZER]?: (
+		attributes: Record<string, string>,
+	) => Record<string, string>;
+};
+
 // Warn once per environment object: process.env in production, each injected env in tests.
 const warnedEnvironments = new WeakSet<EnvLike>();
 const warnedResourceEnvironments = new WeakSet<EnvLike>();
@@ -73,22 +90,52 @@ function resolveServerOTLPExportOptions(
 function resolveExportResourceAttributes(
 	requestAttributes: Record<string, string>,
 	env: EnvLike,
-): Record<string, string> {
+	redact?: DiagnosticRedactor,
+): {
+	attributes: Record<string, string>;
+	sanitize: (attributes: Record<string, string>) => Record<string, string>;
+} {
 	const resolution = resolveOTLPResourceAttributes({}, env);
 	warnDiscardedResourceAttributes(env, resolution);
-	const operatorAttributes = Object.fromEntries(
-		Object.entries(resolution.attributes).map(([key, value]) => [
-			sanitizeSpanNameForOutput(key),
-			isSensitiveFixtureKey(key) ? REDACTED_FIXTURE_VALUE : sanitizeSpanNameForOutput(value),
-		]),
-	);
-	const sanitizedRequestAttributes = Object.fromEntries(
-		Object.entries(sanitizeTraceAttributes(requestAttributes)).map(([key, value]) => [
-			key,
-			String(value),
-		]),
-	);
-	return { ...operatorAttributes, ...sanitizedRequestAttributes };
+	const operatorAttributes = resolution.attributes;
+	const requestKeys = new Set(Object.keys(requestAttributes));
+	return {
+		// Keep the raw snapshot private until export. A credential registered after
+		// trace creation must be matched before any key or value is bounded.
+		attributes: { ...operatorAttributes, ...requestAttributes },
+		sanitize(attributes) {
+			const nextKey = redactedKeyAllocator(Object.keys(attributes));
+			const sanitizedOperatorAttributes: Record<string, string> = {};
+			const rawRequestAttributes: Record<string, string> = {};
+			for (const [key, value] of Object.entries(attributes)) {
+				const unchangedOperatorValue = !requestKeys.has(key) && operatorAttributes[key] === value;
+				if (unchangedOperatorValue) {
+					const redactedKey = isRedactedKey(key) ? key : redactDiagnosticText(key, redact);
+					const keyChanged = redactedKey !== key;
+					const sanitizedKey = keyChanged ? nextKey() : sanitizeSpanNameForOutput(key);
+					sanitizedOperatorAttributes[sanitizedKey] = keyChanged
+						? redactedKey === REDACTION_FAILED
+							? REDACTION_FAILED
+							: REDACTED_FIXTURE_VALUE
+						: isSensitiveFixtureKey(key)
+							? REDACTED_FIXTURE_VALUE
+							: sanitizeSpanNameForOutput(value, redact);
+				} else {
+					rawRequestAttributes[key] = value;
+				}
+			}
+			const sanitizedRequestAttributes = Object.fromEntries(
+				Object.entries(
+					sanitizeTraceAttributes(
+						rawRequestAttributes,
+						redact,
+						Object.keys(sanitizedOperatorAttributes),
+					),
+				).map(([key, value]) => [key, String(value)]),
+			);
+			return { ...sanitizedOperatorAttributes, ...sanitizedRequestAttributes };
+		},
+	};
 }
 
 /** Server-only trace output policy. Shared programmatic trace callers stay in-memory. */
@@ -96,12 +143,14 @@ export function resolveServerTraceContextOptions(
 	config: TraceConfig,
 	resourceAttributes: Record<string, string>,
 	env: EnvLike = process.env,
+	redact?: DiagnosticRedactor,
 ): CreateTraceContextOptions {
 	const resolved = resolveTraceContextOptions(config);
 	const outputEnabled = config.enabled !== false && config.exporter !== "none";
 	const consoleHook =
 		outputEnabled && (config.exporter === "console" || config.exporter === "json")
-			? (span: Span) => console.log(JSON.stringify(sanitizeSpanForOutput(span, resourceAttributes)))
+			? (span: Span) =>
+					console.log(JSON.stringify(sanitizeSpanForOutput(span, resourceAttributes, redact)))
 			: undefined;
 	const onSpan =
 		consoleHook && resolved.onSpan
@@ -114,15 +163,26 @@ export function resolveServerTraceContextOptions(
 		outputEnabled && config.exporter === "otlp"
 			? resolveServerOTLPExportOptions(config, env)
 			: undefined;
+	const exportResources = exportOptions
+		? resolveExportResourceAttributes(resourceAttributes, env, redact)
+		: undefined;
+	if (exportResources) {
+		Object.defineProperty(
+			exportResources.attributes as ResourceAttributesWithSanitizer,
+			TRACE_RESOURCE_ATTRIBUTE_SANITIZER,
+			{ value: exportResources.sanitize },
+		);
+	}
 
 	return {
 		maxSpans: resolved.maxSpans,
 		onSpan,
+		...(redact ? { redact } : {}),
 		...(exportOptions
 			? {
 					exportOptions,
-					resourceAttributes: resolveExportResourceAttributes(resourceAttributes, env),
-					sanitizeSpanForExport: (span: Span) => sanitizeSpanForOutput(span),
+					resourceAttributes: exportResources?.attributes,
+					sanitizeSpanForExport: (span: Span) => sanitizeSpanForOutput(span, undefined, redact),
 				}
 			: {}),
 	};

package/src/testing/run.ts

@@ -2,7 +2,13 @@ import { describe, expect, it } from "bun:test";
 
 import { ProviderError } from "../errors.js";
 import { createProviderCache } from "../runtime/cache.js";
-import { createTestProviderChoiceContext } from "../runtime/choice.js";
+import { createTestHandleContext } from "../runtime/handle.js";
+
+/**
+ * Stable connection scope for the local test harness so bound handles (drafts,
+ * default cursors) can be exercised exactly as in a connected production call.
+ */
+const STANDARD_TEST_CONNECTION_ID = "standard-test-connection";
 import { createMemoryProviderRuntimeState } from "../runtime/state.js";
 import { createUnsupportedOcrClient } from "../runtime/ocr.js";
 import { createUnsupportedSttClient } from "../runtime/stt.js";
@@ -319,7 +325,7 @@ function createUpstreamContext(
 		getAccessToken: () => undefined,
 		getScopes: () => [],
 	};
-	const request = { headers: {} };
+	const request = { headers: {}, connectionId: STANDARD_TEST_CONNECTION_ID };
 	const state = createMemoryProviderRuntimeState();
 	const nativeEgress = provider.native
 		? createNativeEgressAuthorization({ egress: provider.native.network })
@@ -578,10 +584,9 @@ function createUpstreamContext(
 		resolver: {
 			solve: async () => unsupported("ctx.resolver.solve"),
 		},
-		choice: createTestProviderChoiceContext({
+		handle: createTestHandleContext({
 			providerId: `standard-test-${operationName}`,
 			request,
-			credential,
 			state,
 		}),
 	} as ProviderContext;
@@ -622,7 +627,7 @@ export function createSnapshotContext(rawFixture: unknown): ProviderContext {
 		getAccessToken: () => undefined,
 		getScopes: () => [],
 	};
-	const request = { headers: {} };
+	const request = { headers: {}, connectionId: STANDARD_TEST_CONNECTION_ID };
 	const state = createMemoryProviderRuntimeState();
 	const streamCaptureGroup = findStreamCaptureGroup(rawFixture);
 	let nextCaptureItem = 0;
@@ -709,10 +714,9 @@ export function createSnapshotContext(rawFixture: unknown): ProviderContext {
 		resolver: {
 			solve: async () => unsupported("ctx.resolver.solve"),
 		},
-		choice: createTestProviderChoiceContext({
+		handle: createTestHandleContext({
 			providerId: "standard-test",
 			request,
-			credential,
 			state,
 		}),
 	} satisfies Omit<ProviderContext, "native"> as unknown as ProviderContext;

package/src/trace-sanitization.ts

@@ -4,20 +4,33 @@ import {
 	REDACTED_FIXTURE_VALUE,
 	sanitizeDiagnosticText,
 } from "./fixture-sanitization.js";
+import {
+	type DiagnosticRedactor,
+	diagnosticStructuredRedactor,
+	redactDiagnosticAttributeKey,
+	copyDiagnosticAttributeTypes,
+	isDiagnosticBigintAttribute,
+	redactedKeyAllocator,
+	isRedactedKey,
+	redactCriticalDiagnosticText,
+	diagnosticAttributeRedactor,
+	REDACTION_FAILED,
+	redactDiagnosticText,
+} from "./runtime/diagnostic-redactor.js";
 import type { TraceSpan } from "./types.js";
 
 const MAX_TRACE_TEXT_LENGTH = 300;
 
-function sanitizeTraceText(value: string): string {
-	const encoded = sanitizeDiagnosticText(value);
+function sanitizeTraceText(value: string, redact?: DiagnosticRedactor): string {
+	const encoded = sanitizeDiagnosticText(redactDiagnosticText(value, redact));
 	return encoded.length > MAX_TRACE_TEXT_LENGTH
 		? `${encoded.slice(0, MAX_TRACE_TEXT_LENGTH)}… [truncated]`
 		: encoded;
 }
 
 /** Span names are SDK-authored identifiers; retain them while preventing log injection. */
-export function sanitizeSpanNameForOutput(value: string): string {
-	const encoded = encodeDiagnosticControls(value);
+export function sanitizeSpanNameForOutput(value: string, redact?: DiagnosticRedactor): string {
+	const encoded = encodeDiagnosticControls(redactDiagnosticText(value, redact));
 	return encoded.length > MAX_TRACE_TEXT_LENGTH
 		? `${encoded.slice(0, MAX_TRACE_TEXT_LENGTH)}… [truncated]`
 		: encoded;
@@ -25,39 +38,73 @@ export function sanitizeSpanNameForOutput(value: string): string {
 
 export function sanitizeTraceAttributes(
 	attributes: Record<string, unknown>,
+	redact?: DiagnosticRedactor,
+	reservedKeys: Iterable<string> = [],
 ): Record<string, string | number | boolean> {
-	return Object.fromEntries(
-		Object.entries(attributes).map(([key, value]) => [
-			sanitizeTraceText(key),
-			isSensitiveFixtureKey(key)
-				? REDACTED_FIXTURE_VALUE
-				: typeof value === "string"
-					? sanitizeTraceText(value)
-					: typeof value === "number" || typeof value === "boolean"
-						? value
-						: sanitizeTraceText(String(value)),
-		]),
+	const nextKey = redactedKeyAllocator([...Object.keys(attributes), ...reservedKeys]);
+	return copyDiagnosticAttributeTypes(
+		attributes,
+		Object.fromEntries(
+			Object.entries(attributes).map(([key, value]) => {
+				const redactedKey = isRedactedKey(key) ? key : redactDiagnosticAttributeKey(key, redact);
+				const keyChanged = redactedKey !== key;
+				const sanitizedKey = keyChanged ? nextKey() : sanitizeTraceText(key);
+				const valueRedactor =
+					typeof value === "bigint" || isDiagnosticBigintAttribute(attributes, key)
+						? diagnosticStructuredRedactor(redact)
+						: diagnosticAttributeRedactor(key, redact);
+				const sanitizedValue = keyChanged
+					? redactedKey === REDACTION_FAILED
+						? REDACTION_FAILED
+						: REDACTED_FIXTURE_VALUE
+					: isSensitiveFixtureKey(key)
+						? REDACTED_FIXTURE_VALUE
+						: typeof value === "bigint" || isDiagnosticBigintAttribute(attributes, key)
+							? String(value).length < 8
+								? String(value)
+								: sanitizeTraceText(String(value), valueRedactor)
+							: typeof value === "string"
+								? sanitizeTraceText(value, valueRedactor)
+								: typeof value === "number" || typeof value === "boolean"
+									? (() => {
+											if (String(value).length < 8) return value;
+											const redacted = redactDiagnosticText(
+												String(value),
+												diagnosticStructuredRedactor(valueRedactor),
+											);
+											return redacted === String(value) ? value : sanitizeTraceText(redacted);
+										})()
+									: sanitizeTraceText(String(value), valueRedactor);
+				return [sanitizedKey, sanitizedValue];
+			}),
+		),
 	);
 }
 
 export function sanitizeSpanForOutput(
 	span: TraceSpan,
 	additionalAttributes?: Record<string, string>,
+	redact?: DiagnosticRedactor,
 ): TraceSpan {
 	// Keep this schema explicit so future fields are not silently added to a
 	// process output path before their trust boundary has been reviewed.
 	return {
-		id: span.id,
-		name: sanitizeSpanNameForOutput(span.name),
+		id: redactCriticalDiagnosticText(span.id, redact),
+		name: sanitizeSpanNameForOutput(redactCriticalDiagnosticText(span.name, redact)),
 		startedAt: span.startedAt,
 		endedAt: span.endedAt,
 		duration_ms: span.duration_ms,
 		status: span.status,
-		attributes: sanitizeTraceAttributes({
-			...span.attributes,
-			...(additionalAttributes ?? {}),
-		}),
-		...(span.error !== undefined ? { error: sanitizeTraceText(span.error) } : {}),
-		...(span.parentId !== undefined ? { parentId: span.parentId } : {}),
+		attributes: sanitizeTraceAttributes(
+			copyDiagnosticAttributeTypes(span.attributes, {
+				...span.attributes,
+				...(additionalAttributes ?? {}),
+			}),
+			redact,
+		),
+		...(span.error !== undefined ? { error: sanitizeTraceText(span.error, redact) } : {}),
+		...(span.parentId !== undefined
+			? { parentId: redactCriticalDiagnosticText(span.parentId, redact) }
+			: {}),
 	};
 }

package/src/types.ts

@@ -1,4 +1,5 @@
 import type ms from "ms";
+import type { HandleContext, HandleKind } from "./handle.js";
 import type { HealthScenario } from "./health-scenario.js";
 import type { SerializedCookieJar } from "tough-cookie";
 
@@ -1997,140 +1998,6 @@ export interface ProviderRequestContext {
 	headers: Record<string, string>;
 }
 
-export interface ProviderChoiceBindingOptions {
-	connection?: boolean;
-	credentialKeys?: readonly string[];
-}
-
-export type ProviderChoiceConsumeMode = "never" | "on-parse" | "explicit";
-
-export type ProviderChoiceConsumeResult =
-	| { readonly status: "consumed" }
-	| { readonly status: "already-consumed" }
-	| { readonly status: "unsupported" };
-
-export type ProviderChoiceExplicitParseResult =
-	| {
-			readonly status: "active";
-			readonly payload: Record<string, unknown>;
-			/** Stable, opaque key for provider-owned idempotency records. */
-			readonly replayKey: string;
-			/** Atomically claims a word token. Inline tokens report unsupported. */
-			consume(): Promise<ProviderChoiceConsumeResult>;
-	  }
-	| {
-			readonly status: "consumed";
-			/** Use this key to read the provider-owned result before returning an error. */
-			readonly replayKey: string;
-	  };
-
-export type ProviderChoiceStorageOptions =
-	| {
-			readonly mode: "inline";
-		}
-	| {
-			readonly mode: "server";
-			readonly namespace: string;
-			readonly state?: ProviderRuntimeState;
-			readonly ttl?: ProviderStateDurationString;
-			readonly maxEntries: number;
-			readonly maxValueBytes: number;
-			readonly unavailable?: "reject";
-		}
-	| {
-			readonly mode: "auto";
-			readonly namespace: string;
-			readonly state?: ProviderRuntimeState;
-			readonly ttl?: ProviderStateDurationString;
-			readonly maxInlineBytes: number;
-			readonly maxEntries: number;
-			readonly maxValueBytes: number;
-			readonly unavailable?: "reject";
-		};
-
-export interface ProviderChoiceIssueOptions<
-	TPayload extends Record<string, unknown>,
-> {
-	prefix: string;
-	purpose: string;
-	payload: TPayload;
-	ttlMs: number;
-	nowMs?: number;
-	bind?: ProviderChoiceBindingOptions;
-	/** Server storage only: standard emits four words; high emits five. */
-	strength?: "standard" | "high";
-	storage?: ProviderChoiceStorageOptions;
-}
-
-export interface ProviderChoiceParseOptions {
-	token: string;
-	prefix: string;
-	purpose: string;
-	ttlMs?: number;
-	nowMs?: number;
-	futureToleranceMs?: number;
-	bind?: ProviderChoiceBindingOptions;
-	storage?: ProviderChoiceStorageOptions;
-	/** Defaults to never, preserving reusable choice-token parse semantics. */
-	consume?: ProviderChoiceConsumeMode;
-}
-
-export interface ProviderChoiceContext {
-	issue<TPayload extends Record<string, unknown>>(
-		options: ProviderChoiceIssueOptions<TPayload> & {
-			readonly storage?: { readonly mode: "inline" };
-		},
-	): string;
-	issue<TPayload extends Record<string, unknown>>(
-		options: ProviderChoiceIssueOptions<TPayload> & {
-			readonly storage: Extract<
-				ProviderChoiceStorageOptions,
-				{ readonly mode: "server" }
-			>;
-		},
-	): Promise<string>;
-	issue<TPayload extends Record<string, unknown>>(
-		options: ProviderChoiceIssueOptions<TPayload> & {
-			readonly storage: Extract<
-				ProviderChoiceStorageOptions,
-				{ readonly mode: "auto" }
-			>;
-		},
-	): string | Promise<string>;
-	issue<TPayload extends Record<string, unknown>>(
-		options: ProviderChoiceIssueOptions<TPayload>,
-	): string | Promise<string>;
-	parse(
-		options: ProviderChoiceParseOptions & { readonly consume: "explicit" },
-	): Promise<ProviderChoiceExplicitParseResult>;
-	parse(
-		options: ProviderChoiceParseOptions & {
-			readonly storage?: { readonly mode: "inline" };
-		},
-	): Record<string, unknown>;
-	parse(
-		options: ProviderChoiceParseOptions & {
-			readonly storage: Extract<
-				ProviderChoiceStorageOptions,
-				{ readonly mode: "server" }
-			>;
-		},
-	): Promise<Record<string, unknown>>;
-	parse(
-		options: ProviderChoiceParseOptions & {
-			readonly storage: Extract<
-				ProviderChoiceStorageOptions,
-				{ readonly mode: "auto" }
-			>;
-		},
-	): Record<string, unknown> | Promise<Record<string, unknown>>;
-	parse(
-		options: ProviderChoiceParseOptions,
-	):
-		| Record<string, unknown>
-		| Promise<Record<string, unknown> | ProviderChoiceExplicitParseResult>;
-}
-
 export interface ContextScratchpad {
 	get(key: string): unknown;
 	set(key: string, value: unknown): void;
@@ -2402,8 +2269,8 @@ export type ProviderContext<TConfig = Record<string, unknown>> = {
 	& ("ocr" extends keyof TConfig ? { ocr: OcrContext } : Record<never, never>)
 	& ("stt" extends keyof TConfig ? { stt: SttContext } : Record<never, never>)
 	& ("resolver" extends keyof TConfig ? { resolver: ResolverContext } : Record<never, never>)
-	& ("choice" extends keyof TConfig
-		? { choice: ProviderChoiceContext }
+	& ("handle" extends keyof TConfig
+		? { handle: HandleContext }
 		: Record<never, never>);
 
 /** Backwards-compatible name for a declaration-derived provider context. */
@@ -2588,7 +2455,7 @@ export interface ProviderDefinition<TContext = ProviderContext> {
 		engine: BrowserEngine;
 	};
 	auth?: AuthConfig;
-	choice?: Record<string, never> | true;
+	handle?: readonly HandleKind[];
 	reviewed?: ProviderReviewed;
 	access?: ProviderAccessConfig;
 	secrets?: ProviderSecretDeclaration[];

package/dist/choice-token.d.ts

@@ -1,24 +0,0 @@
-export type ProviderChoiceTokenPayload = Record<string, unknown>;
-export type ProviderChoiceTokenErrorReason = "invalid_shape" | "invalid_signature" | "invalid_payload" | "invalid_binding" | "stale";
-export declare class ProviderChoiceTokenError extends Error {
-    readonly reason: ProviderChoiceTokenErrorReason;
-    constructor(reason: ProviderChoiceTokenErrorReason, message: string);
-}
-export interface CreateProviderChoiceTokenOptions<TPayload extends ProviderChoiceTokenPayload> {
-    prefix: string;
-    payload: TPayload;
-    secret: string;
-}
-export interface ParseProviderChoiceTokenOptions {
-    token: string;
-    prefix: string;
-    secret: string;
-}
-export interface FreshProviderChoiceIssuedAtOptions {
-    ttlMs: number;
-    nowMs?: number;
-    futureToleranceMs?: number;
-}
-export declare function createProviderChoiceToken<TPayload extends ProviderChoiceTokenPayload>(options: CreateProviderChoiceTokenOptions<TPayload>): string;
-export declare function parseProviderChoiceToken(options: ParseProviderChoiceTokenOptions): ProviderChoiceTokenPayload;
-export declare function assertFreshProviderChoiceIssuedAt(issuedAtMs: unknown, options: FreshProviderChoiceIssuedAtOptions): number;

package/dist/choice-token.js

@@ -1,74 +0,0 @@
-import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes, timingSafeEqual, } from "node:crypto";
-export class ProviderChoiceTokenError extends Error {
-    reason;
-    constructor(reason, message) {
-        super(message);
-        this.name = "ProviderChoiceTokenError";
-        this.reason = reason;
-    }
-}
-export function createProviderChoiceToken(options) {
-    const iv = randomBytes(12);
-    const cipher = createCipheriv("aes-256-gcm", choiceEncryptionKey(options.secret), iv);
-    const encryptedPayload = Buffer.concat([
-        cipher.update(JSON.stringify(options.payload), "utf8"),
-        cipher.final(),
-    ]).toString("base64url");
-    const authTag = cipher.getAuthTag().toString("base64url");
-    const encodedIv = iv.toString("base64url");
-    const signature = signProviderChoiceTokenBody(`${options.prefix}.${encodedIv}.${encryptedPayload}.${authTag}`, options.secret);
-    return `${options.prefix}.${encodedIv}.${encryptedPayload}.${authTag}.${signature}`;
-}
-export function parseProviderChoiceToken(options) {
-    const [actualPrefix, encodedIv, encryptedPayload, authTag, signature, ...extra] = options.token.split(".");
-    if (actualPrefix !== options.prefix ||
-        !encodedIv ||
-        !encryptedPayload ||
-        !authTag ||
-        !signature ||
-        extra.length > 0) {
-        throw new ProviderChoiceTokenError("invalid_shape", "Provider choice token shape is invalid.");
-    }
-    const signedBody = `${options.prefix}.${encodedIv}.${encryptedPayload}.${authTag}`;
-    const expectedSignature = signProviderChoiceTokenBody(signedBody, options.secret);
-    const actualBuffer = Buffer.from(signature);
-    const expectedBuffer = Buffer.from(expectedSignature);
-    if (actualBuffer.length !== expectedBuffer.length ||
-        !timingSafeEqual(actualBuffer, expectedBuffer)) {
-        throw new ProviderChoiceTokenError("invalid_signature", "Provider choice token signature is invalid.");
-    }
-    try {
-        const decipher = createDecipheriv("aes-256-gcm", choiceEncryptionKey(options.secret), Buffer.from(encodedIv, "base64url"));
-        decipher.setAuthTag(Buffer.from(authTag, "base64url"));
-        const decrypted = Buffer.concat([
-            decipher.update(Buffer.from(encryptedPayload, "base64url")),
-            decipher.final(),
-        ]).toString("utf8");
-        const parsed = JSON.parse(decrypted);
-        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-            throw new Error("payload is not an object");
-        }
-        return Object.fromEntries(Object.entries(parsed));
-    }
-    catch {
-        throw new ProviderChoiceTokenError("invalid_payload", "Provider choice token payload is invalid.");
-    }
-}
-export function assertFreshProviderChoiceIssuedAt(issuedAtMs, options) {
-    const parsed = typeof issuedAtMs === "number" ? issuedAtMs : Number(issuedAtMs);
-    const nowMs = options.nowMs ?? Date.now();
-    const futureToleranceMs = options.futureToleranceMs ?? 30_000;
-    if (!Number.isFinite(parsed) ||
-        parsed <= 0 ||
-        nowMs - parsed > options.ttlMs ||
-        parsed - nowMs > futureToleranceMs) {
-        throw new ProviderChoiceTokenError("stale", "Provider choice token is stale.");
-    }
-    return parsed;
-}
-function choiceEncryptionKey(secret) {
-    return createHash("sha256").update(secret).digest();
-}
-function signProviderChoiceTokenBody(body, secret) {
-    return createHmac("sha256", secret).update(body).digest("base64url");
-}

package/dist/runtime/choice-wordlist.d.ts

@@ -1,9 +0,0 @@
-export declare const CHOICE_WORDLIST_SIZE = 1296;
-export declare const CHOICE_WORD_ENTROPY_BITS: number;
-export declare const STANDARD_CHOICE_WORD_COUNT = 4;
-export declare const HIGH_CHOICE_WORD_COUNT = 5;
-export declare const STANDARD_CHOICE_ENTROPY_BITS: number;
-export declare const HIGH_CHOICE_ENTROPY_BITS: number;
-export declare const EFF_SHORT_WORDLIST_2: readonly string[];
-export declare function choiceWordAt(index: number): string;
-export declare function isChoiceWord(value: string): boolean;

package/dist/runtime/choice.d.ts

@@ -1,27 +0,0 @@
-import type { CredentialContext, EnvContext, ProviderChoiceConsumeMode, ProviderChoiceContext, ProviderRequestContext, ProviderRuntimeState } from "../types.js";
-export declare const PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV = "APIFUSE__PROVIDER_RUNTIME__CHOICE_TOKEN_MASTER_SECRET";
-export type ProviderChoiceTelemetryEvent = {
-    readonly providerId: string;
-    readonly purpose: string;
-    readonly operation: "parse" | "consume";
-    readonly format: "word" | "legacy";
-    readonly outcome: "success" | "not-found" | "invalid" | "unsupported" | "error";
-    readonly consumeMode: ProviderChoiceConsumeMode;
-    readonly consumed: boolean;
-    readonly replay: boolean;
-};
-export type CreateProviderChoiceContextOptions = {
-    readonly providerId: string;
-    readonly env?: EnvContext;
-    readonly request?: ProviderRequestContext;
-    readonly credential?: CredentialContext;
-    readonly state?: ProviderRuntimeState;
-    readonly masterSecret?: string;
-    readonly kid?: string;
-    /** Receives allowlisted metadata only; token and payload values are never included. */
-    readonly onTelemetry?: (event: ProviderChoiceTelemetryEvent) => void;
-};
-export declare function createProviderChoiceContext(options: CreateProviderChoiceContextOptions): ProviderChoiceContext;
-export declare function createTestProviderChoiceContext(options: Omit<CreateProviderChoiceContextOptions, "masterSecret"> & {
-    readonly masterSecret?: string;
-}): ProviderChoiceContext;