@apifuse/provider-sdk 2.2.0-beta.60 → 2.2.0-beta.61

package/src/server/serve-implementation.ts

@@ -1,3 +1,4 @@
+import { NativeTelemetryCollector } from "../runtime/native-telemetry.js";
 import { STATUS_CODES } from "node:http";
 import { readDiagnosticEnv, withDiagnosticEnv } from "../runtime/diagnostic-env.js";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -53,10 +54,8 @@ import {
 import { createScratchpad } from "../runtime/auth-flow.js";
 import type * as BrowserRuntimeModule from "../runtime/browser.js";
 import { createProviderCache } from "../runtime/cache.js";
-import {
-	createProviderChoiceContext,
-	PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV,
-} from "../runtime/choice.js";
+import type { HandleTelemetryEvent } from "../handle.js";
+import { createHandleContext } from "../runtime/handle.js";
 import { createCredentialContext } from "../runtime/credential.js";
 import {
 	bindDiagnosticSensitiveRegistry,
@@ -845,6 +844,7 @@ type RequestScopeContext = {
 	trace: RuntimeTraceContext;
 	telemetry: RequestTelemetry;
 	resolverTelemetry: ResolverTelemetryCollector;
+	nativeTelemetry: NativeTelemetryCollector;
 };
 
 function createProviderContext(
@@ -921,10 +921,7 @@ function createProviderContext(
 			scope.redact,
 		);
 
-	const env = createEnvContext([
-		...providerSecretNames(provider),
-		PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV,
-	]);
+	const env = createEnvContext([...providerSecretNames(provider)]);
 	const credential = createCredentialContext({
 		allowedKeys: provider.credential?.keys,
 		mode: request.connection?.mode,
@@ -971,6 +968,8 @@ function createProviderContext(
 			? {
 					native: {
 						network: capabilityModules.nativeNetwork!.createNativeNetworkClient({
+							telemetry: scope.telemetry.proxy,
+							nativeTelemetry: scope.nativeTelemetry,
 							egress: provider.native.network,
 							proxyPolicy: resolveNativeProxyPolicy(provider),
 							affinityKey: proxyClientOptions.affinityKey,
@@ -1004,16 +1003,14 @@ function createProviderContext(
 						createUnsupportedResolverClient("Provider does not declare resolver capability"),
 					signal,
 				),
-		choice: createProviderChoiceContext({
+		handle: createHandleContext({
 			providerId: provider.id,
-			env,
 			request: requestContext,
-			credential,
 			state: requestState,
 			onTelemetry: (event) =>
 				(options.logger ?? defaultProviderServerLogger)({
 					level: "info",
-					event: "provider_choice_token",
+					event: "provider_handle",
 					...event,
 				}),
 		}),
@@ -1213,6 +1210,8 @@ function createAuthFlowContext(
 			? {
 					native: {
 						network: capabilityModules.nativeNetwork!.createNativeNetworkClient({
+							telemetry: scope.telemetry.proxy,
+							nativeTelemetry: scope.nativeTelemetry,
 							egress: provider.native.network,
 							proxyPolicy: resolveNativeProxyPolicy(provider),
 							affinityKey: proxyClientOptions.affinityKey,
@@ -1318,18 +1317,10 @@ export type ProviderServerLogEvent =
 			providerId: string;
 			missingSecrets: string[];
 	  }
-	| {
+	| ({
 			level: "info";
-			event: "provider_choice_token";
-			providerId: string;
-			purpose: string;
-			operation: "parse" | "consume";
-			format: "word" | "legacy";
-			outcome: "success" | "not-found" | "invalid" | "unsupported" | "error";
-			consumeMode: "never" | "on-parse" | "explicit";
-			consumed: boolean;
-			replay: boolean;
-	  }
+			event: "provider_handle";
+	  } & HandleTelemetryEvent)
 	| {
 			level: "warn";
 			event: "provider_cleanup_failed";
@@ -1549,6 +1540,48 @@ function toErrorResponse(
 // narrowing from a ProviderError-typed value would collapse the negative branch
 // to `never`. Narrowing from unknown avoids that while still recognizing errors
 // from a duplicate SDK module instance.
+function ownErrorCode(error: unknown): string | undefined {
+	if (error === null || (typeof error !== "object" && typeof error !== "function")) {
+		return undefined;
+	}
+	try {
+		const descriptor = Object.getOwnPropertyDescriptor(error, "code");
+		return descriptor && Object.hasOwn(descriptor, "value") && typeof descriptor.value === "string"
+			? descriptor.value
+			: undefined;
+	} catch {
+		return undefined;
+	}
+}
+
+function errorChainHasCode(error: unknown, expected: string): boolean {
+	const seen = new Set<object>();
+	let current = error;
+	for (let depth = 0; depth < 5; depth++) {
+		if (current === null || (typeof current !== "object" && typeof current !== "function")) {
+			return false;
+		}
+		if (seen.has(current)) return false;
+		seen.add(current);
+		let code: string | undefined;
+		try {
+			code = providerErrorCode(current) ?? ownErrorCode(current);
+		} catch {
+			code = ownErrorCode(current);
+		}
+		if (code === expected) return true;
+		let cause: PropertyDescriptor | undefined;
+		try {
+			cause = Object.getOwnPropertyDescriptor(current, "cause");
+		} catch {
+			return false;
+		}
+		if (!cause || !Object.hasOwn(cause, "value")) return false;
+		current = cause.value;
+	}
+	return false;
+}
+
 function providerObservabilityDetails(
 	error: unknown,
 	declaredErrorCode?: OperationErrorCode,
@@ -1577,26 +1610,45 @@ function providerObservabilityDetails(
 			retryable: providerErrorOption(error, "retryable") ?? declaredRetryable ?? false,
 		};
 	}
+	// Native proxy resolution throws ProxyResolutionError directly, while HTTP
+	// normalizes it beneath a transport_network_error cause and stealth retains
+	// the original code. Preserve proxy attribution across all three forms.
+	if (errorChainHasCode(error, "PROXY_REQUIRED")) {
+		return {
+			category: "proxy_pool",
+			taxonomyVersion: PROVIDER_OBSERVABILITY_TAXONOMY_VERSION,
+			retryable: true,
+		};
+	}
 	if (!isTransportError(error)) {
 		return undefined;
 	}
+	const errorCode = providerErrorCode(error);
 	const isProxyPoolCode =
-		providerErrorCode(error) === PROXY_POOL_EXHAUSTED_CODE ||
-		providerErrorCode(error) === PROXY_EDGE_AUTH_REJECTED_CODE ||
-		providerErrorCode(error) === "PROXY_ALLOCATION_FAILED";
+		errorCode === PROXY_POOL_EXHAUSTED_CODE ||
+		errorCode === PROXY_EDGE_AUTH_REJECTED_CODE ||
+		errorCode === "PROXY_ALLOCATION_FAILED" ||
+		errorCode === "native_proxy_expired" ||
+		errorCode === "native_proxy_invalid";
 	const category =
 		providerErrorOption(error, "category") ??
 		(isProxyPoolCode
 			? "proxy_pool"
-			: providerErrorCode(error) === PROXY_AUTH_IP_DENIED_CODE
+			: errorCode === PROXY_AUTH_IP_DENIED_CODE
 				? "anti_bot_blocked"
-				: providerErrorCode(error) === "transport_timeout"
+				: errorCode === "transport_timeout" ||
+						errorCode === "native_connection_timeout" ||
+						errorCode === "native_connection_idle_timeout"
 					? "timeout"
-					: providerErrorCode(error) === "transport_network_error"
+					: errorCode === "transport_network_error" ||
+							errorCode === "native_connection_failed" ||
+							errorCode === "native_connection_closed"
 						? "network"
-						: error.upstreamStatus
-							? categoryForStatus(error.upstreamStatus)
-							: "upstream_http");
+						: errorCode === "native_connection_aborted"
+							? "client_cancelled"
+							: error.upstreamStatus
+								? categoryForStatus(error.upstreamStatus)
+								: "upstream_http");
 	return {
 		category,
 		taxonomyVersion: PROVIDER_OBSERVABILITY_TAXONOMY_VERSION,
@@ -2223,9 +2275,11 @@ function createRequestScope(input: {
 	bindDiagnosticSensitiveRegistry(trace, sensitiveRegistry);
 	const proxyCollector = new ProxyTelemetryCollector();
 	const resolverCollector = new ResolverTelemetryCollector({ redact });
+	const nativeCollector = new NativeTelemetryCollector({ redact });
 	const telemetry = new RequestTelemetry(trace);
 	telemetry.register(proxyCollector);
 	telemetry.register(resolverCollector);
+	telemetry.register(nativeCollector);
 	let rootRunner: <T>(fn: () => Promise<T>) => Promise<T> = (fn) => fn();
 	let resolveRoot!: (outcome: RequestTerminalOutcome) => void;
 	const rootTerminal = new Promise<RequestTerminalOutcome>((resolve) => {
@@ -2307,6 +2361,7 @@ function createRequestScope(input: {
 		trace,
 		telemetry,
 		resolverTelemetry: resolverCollector,
+		nativeTelemetry: nativeCollector,
 		seedCredentials(rawBody, kind): void {
 			const harvested = rawRequestCredentials(rawBody, kind);
 			sensitiveRegistry.add(harvested.values);

package/src/testing/run.ts

@@ -2,7 +2,13 @@ import { describe, expect, it } from "bun:test";
 
 import { ProviderError } from "../errors.js";
 import { createProviderCache } from "../runtime/cache.js";
-import { createTestProviderChoiceContext } from "../runtime/choice.js";
+import { createTestHandleContext } from "../runtime/handle.js";
+
+/**
+ * Stable connection scope for the local test harness so bound handles (drafts,
+ * default cursors) can be exercised exactly as in a connected production call.
+ */
+const STANDARD_TEST_CONNECTION_ID = "standard-test-connection";
 import { createMemoryProviderRuntimeState } from "../runtime/state.js";
 import { createUnsupportedOcrClient } from "../runtime/ocr.js";
 import { createUnsupportedSttClient } from "../runtime/stt.js";
@@ -319,7 +325,7 @@ function createUpstreamContext(
 		getAccessToken: () => undefined,
 		getScopes: () => [],
 	};
-	const request = { headers: {} };
+	const request = { headers: {}, connectionId: STANDARD_TEST_CONNECTION_ID };
 	const state = createMemoryProviderRuntimeState();
 	const nativeEgress = provider.native
 		? createNativeEgressAuthorization({ egress: provider.native.network })
@@ -578,10 +584,9 @@ function createUpstreamContext(
 		resolver: {
 			solve: async () => unsupported("ctx.resolver.solve"),
 		},
-		choice: createTestProviderChoiceContext({
+		handle: createTestHandleContext({
 			providerId: `standard-test-${operationName}`,
 			request,
-			credential,
 			state,
 		}),
 	} as ProviderContext;
@@ -622,7 +627,7 @@ export function createSnapshotContext(rawFixture: unknown): ProviderContext {
 		getAccessToken: () => undefined,
 		getScopes: () => [],
 	};
-	const request = { headers: {} };
+	const request = { headers: {}, connectionId: STANDARD_TEST_CONNECTION_ID };
 	const state = createMemoryProviderRuntimeState();
 	const streamCaptureGroup = findStreamCaptureGroup(rawFixture);
 	let nextCaptureItem = 0;
@@ -709,10 +714,9 @@ export function createSnapshotContext(rawFixture: unknown): ProviderContext {
 		resolver: {
 			solve: async () => unsupported("ctx.resolver.solve"),
 		},
-		choice: createTestProviderChoiceContext({
+		handle: createTestHandleContext({
 			providerId: "standard-test",
 			request,
-			credential,
 			state,
 		}),
 	} satisfies Omit<ProviderContext, "native"> as unknown as ProviderContext;

package/src/types.ts

@@ -1,4 +1,5 @@
 import type ms from "ms";
+import type { HandleContext, HandleKind } from "./handle.js";
 import type { HealthScenario } from "./health-scenario.js";
 import type { SerializedCookieJar } from "tough-cookie";
 
@@ -1997,140 +1998,6 @@ export interface ProviderRequestContext {
 	headers: Record<string, string>;
 }
 
-export interface ProviderChoiceBindingOptions {
-	connection?: boolean;
-	credentialKeys?: readonly string[];
-}
-
-export type ProviderChoiceConsumeMode = "never" | "on-parse" | "explicit";
-
-export type ProviderChoiceConsumeResult =
-	| { readonly status: "consumed" }
-	| { readonly status: "already-consumed" }
-	| { readonly status: "unsupported" };
-
-export type ProviderChoiceExplicitParseResult =
-	| {
-			readonly status: "active";
-			readonly payload: Record<string, unknown>;
-			/** Stable, opaque key for provider-owned idempotency records. */
-			readonly replayKey: string;
-			/** Atomically claims a word token. Inline tokens report unsupported. */
-			consume(): Promise<ProviderChoiceConsumeResult>;
-	  }
-	| {
-			readonly status: "consumed";
-			/** Use this key to read the provider-owned result before returning an error. */
-			readonly replayKey: string;
-	  };
-
-export type ProviderChoiceStorageOptions =
-	| {
-			readonly mode: "inline";
-		}
-	| {
-			readonly mode: "server";
-			readonly namespace: string;
-			readonly state?: ProviderRuntimeState;
-			readonly ttl?: ProviderStateDurationString;
-			readonly maxEntries: number;
-			readonly maxValueBytes: number;
-			readonly unavailable?: "reject";
-		}
-	| {
-			readonly mode: "auto";
-			readonly namespace: string;
-			readonly state?: ProviderRuntimeState;
-			readonly ttl?: ProviderStateDurationString;
-			readonly maxInlineBytes: number;
-			readonly maxEntries: number;
-			readonly maxValueBytes: number;
-			readonly unavailable?: "reject";
-		};
-
-export interface ProviderChoiceIssueOptions<
-	TPayload extends Record<string, unknown>,
-> {
-	prefix: string;
-	purpose: string;
-	payload: TPayload;
-	ttlMs: number;
-	nowMs?: number;
-	bind?: ProviderChoiceBindingOptions;
-	/** Server storage only: standard emits four words; high emits five. */
-	strength?: "standard" | "high";
-	storage?: ProviderChoiceStorageOptions;
-}
-
-export interface ProviderChoiceParseOptions {
-	token: string;
-	prefix: string;
-	purpose: string;
-	ttlMs?: number;
-	nowMs?: number;
-	futureToleranceMs?: number;
-	bind?: ProviderChoiceBindingOptions;
-	storage?: ProviderChoiceStorageOptions;
-	/** Defaults to never, preserving reusable choice-token parse semantics. */
-	consume?: ProviderChoiceConsumeMode;
-}
-
-export interface ProviderChoiceContext {
-	issue<TPayload extends Record<string, unknown>>(
-		options: ProviderChoiceIssueOptions<TPayload> & {
-			readonly storage?: { readonly mode: "inline" };
-		},
-	): string;
-	issue<TPayload extends Record<string, unknown>>(
-		options: ProviderChoiceIssueOptions<TPayload> & {
-			readonly storage: Extract<
-				ProviderChoiceStorageOptions,
-				{ readonly mode: "server" }
-			>;
-		},
-	): Promise<string>;
-	issue<TPayload extends Record<string, unknown>>(
-		options: ProviderChoiceIssueOptions<TPayload> & {
-			readonly storage: Extract<
-				ProviderChoiceStorageOptions,
-				{ readonly mode: "auto" }
-			>;
-		},
-	): string | Promise<string>;
-	issue<TPayload extends Record<string, unknown>>(
-		options: ProviderChoiceIssueOptions<TPayload>,
-	): string | Promise<string>;
-	parse(
-		options: ProviderChoiceParseOptions & { readonly consume: "explicit" },
-	): Promise<ProviderChoiceExplicitParseResult>;
-	parse(
-		options: ProviderChoiceParseOptions & {
-			readonly storage?: { readonly mode: "inline" };
-		},
-	): Record<string, unknown>;
-	parse(
-		options: ProviderChoiceParseOptions & {
-			readonly storage: Extract<
-				ProviderChoiceStorageOptions,
-				{ readonly mode: "server" }
-			>;
-		},
-	): Promise<Record<string, unknown>>;
-	parse(
-		options: ProviderChoiceParseOptions & {
-			readonly storage: Extract<
-				ProviderChoiceStorageOptions,
-				{ readonly mode: "auto" }
-			>;
-		},
-	): Record<string, unknown> | Promise<Record<string, unknown>>;
-	parse(
-		options: ProviderChoiceParseOptions,
-	):
-		| Record<string, unknown>
-		| Promise<Record<string, unknown> | ProviderChoiceExplicitParseResult>;
-}
-
 export interface ContextScratchpad {
 	get(key: string): unknown;
 	set(key: string, value: unknown): void;
@@ -2402,8 +2269,8 @@ export type ProviderContext<TConfig = Record<string, unknown>> = {
 	& ("ocr" extends keyof TConfig ? { ocr: OcrContext } : Record<never, never>)
 	& ("stt" extends keyof TConfig ? { stt: SttContext } : Record<never, never>)
 	& ("resolver" extends keyof TConfig ? { resolver: ResolverContext } : Record<never, never>)
-	& ("choice" extends keyof TConfig
-		? { choice: ProviderChoiceContext }
+	& ("handle" extends keyof TConfig
+		? { handle: HandleContext }
 		: Record<never, never>);
 
 /** Backwards-compatible name for a declaration-derived provider context. */
@@ -2588,7 +2455,7 @@ export interface ProviderDefinition<TContext = ProviderContext> {
 		engine: BrowserEngine;
 	};
 	auth?: AuthConfig;
-	choice?: Record<string, never> | true;
+	handle?: readonly HandleKind[];
 	reviewed?: ProviderReviewed;
 	access?: ProviderAccessConfig;
 	secrets?: ProviderSecretDeclaration[];

package/dist/choice-token.d.ts

@@ -1,24 +0,0 @@
-export type ProviderChoiceTokenPayload = Record<string, unknown>;
-export type ProviderChoiceTokenErrorReason = "invalid_shape" | "invalid_signature" | "invalid_payload" | "invalid_binding" | "stale";
-export declare class ProviderChoiceTokenError extends Error {
-    readonly reason: ProviderChoiceTokenErrorReason;
-    constructor(reason: ProviderChoiceTokenErrorReason, message: string);
-}
-export interface CreateProviderChoiceTokenOptions<TPayload extends ProviderChoiceTokenPayload> {
-    prefix: string;
-    payload: TPayload;
-    secret: string;
-}
-export interface ParseProviderChoiceTokenOptions {
-    token: string;
-    prefix: string;
-    secret: string;
-}
-export interface FreshProviderChoiceIssuedAtOptions {
-    ttlMs: number;
-    nowMs?: number;
-    futureToleranceMs?: number;
-}
-export declare function createProviderChoiceToken<TPayload extends ProviderChoiceTokenPayload>(options: CreateProviderChoiceTokenOptions<TPayload>): string;
-export declare function parseProviderChoiceToken(options: ParseProviderChoiceTokenOptions): ProviderChoiceTokenPayload;
-export declare function assertFreshProviderChoiceIssuedAt(issuedAtMs: unknown, options: FreshProviderChoiceIssuedAtOptions): number;

package/dist/choice-token.js

@@ -1,74 +0,0 @@
-import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes, timingSafeEqual, } from "node:crypto";
-export class ProviderChoiceTokenError extends Error {
-    reason;
-    constructor(reason, message) {
-        super(message);
-        this.name = "ProviderChoiceTokenError";
-        this.reason = reason;
-    }
-}
-export function createProviderChoiceToken(options) {
-    const iv = randomBytes(12);
-    const cipher = createCipheriv("aes-256-gcm", choiceEncryptionKey(options.secret), iv);
-    const encryptedPayload = Buffer.concat([
-        cipher.update(JSON.stringify(options.payload), "utf8"),
-        cipher.final(),
-    ]).toString("base64url");
-    const authTag = cipher.getAuthTag().toString("base64url");
-    const encodedIv = iv.toString("base64url");
-    const signature = signProviderChoiceTokenBody(`${options.prefix}.${encodedIv}.${encryptedPayload}.${authTag}`, options.secret);
-    return `${options.prefix}.${encodedIv}.${encryptedPayload}.${authTag}.${signature}`;
-}
-export function parseProviderChoiceToken(options) {
-    const [actualPrefix, encodedIv, encryptedPayload, authTag, signature, ...extra] = options.token.split(".");
-    if (actualPrefix !== options.prefix ||
-        !encodedIv ||
-        !encryptedPayload ||
-        !authTag ||
-        !signature ||
-        extra.length > 0) {
-        throw new ProviderChoiceTokenError("invalid_shape", "Provider choice token shape is invalid.");
-    }
-    const signedBody = `${options.prefix}.${encodedIv}.${encryptedPayload}.${authTag}`;
-    const expectedSignature = signProviderChoiceTokenBody(signedBody, options.secret);
-    const actualBuffer = Buffer.from(signature);
-    const expectedBuffer = Buffer.from(expectedSignature);
-    if (actualBuffer.length !== expectedBuffer.length ||
-        !timingSafeEqual(actualBuffer, expectedBuffer)) {
-        throw new ProviderChoiceTokenError("invalid_signature", "Provider choice token signature is invalid.");
-    }
-    try {
-        const decipher = createDecipheriv("aes-256-gcm", choiceEncryptionKey(options.secret), Buffer.from(encodedIv, "base64url"));
-        decipher.setAuthTag(Buffer.from(authTag, "base64url"));
-        const decrypted = Buffer.concat([
-            decipher.update(Buffer.from(encryptedPayload, "base64url")),
-            decipher.final(),
-        ]).toString("utf8");
-        const parsed = JSON.parse(decrypted);
-        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-            throw new Error("payload is not an object");
-        }
-        return Object.fromEntries(Object.entries(parsed));
-    }
-    catch {
-        throw new ProviderChoiceTokenError("invalid_payload", "Provider choice token payload is invalid.");
-    }
-}
-export function assertFreshProviderChoiceIssuedAt(issuedAtMs, options) {
-    const parsed = typeof issuedAtMs === "number" ? issuedAtMs : Number(issuedAtMs);
-    const nowMs = options.nowMs ?? Date.now();
-    const futureToleranceMs = options.futureToleranceMs ?? 30_000;
-    if (!Number.isFinite(parsed) ||
-        parsed <= 0 ||
-        nowMs - parsed > options.ttlMs ||
-        parsed - nowMs > futureToleranceMs) {
-        throw new ProviderChoiceTokenError("stale", "Provider choice token is stale.");
-    }
-    return parsed;
-}
-function choiceEncryptionKey(secret) {
-    return createHash("sha256").update(secret).digest();
-}
-function signProviderChoiceTokenBody(body, secret) {
-    return createHmac("sha256", secret).update(body).digest("base64url");
-}

package/dist/runtime/choice-wordlist.d.ts

@@ -1,9 +0,0 @@
-export declare const CHOICE_WORDLIST_SIZE = 1296;
-export declare const CHOICE_WORD_ENTROPY_BITS: number;
-export declare const STANDARD_CHOICE_WORD_COUNT = 4;
-export declare const HIGH_CHOICE_WORD_COUNT = 5;
-export declare const STANDARD_CHOICE_ENTROPY_BITS: number;
-export declare const HIGH_CHOICE_ENTROPY_BITS: number;
-export declare const EFF_SHORT_WORDLIST_2: readonly string[];
-export declare function choiceWordAt(index: number): string;
-export declare function isChoiceWord(value: string): boolean;

package/dist/runtime/choice.d.ts

@@ -1,27 +0,0 @@
-import type { CredentialContext, EnvContext, ProviderChoiceConsumeMode, ProviderChoiceContext, ProviderRequestContext, ProviderRuntimeState } from "../types.js";
-export declare const PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV = "APIFUSE__PROVIDER_RUNTIME__CHOICE_TOKEN_MASTER_SECRET";
-export type ProviderChoiceTelemetryEvent = {
-    readonly providerId: string;
-    readonly purpose: string;
-    readonly operation: "parse" | "consume";
-    readonly format: "word" | "legacy";
-    readonly outcome: "success" | "not-found" | "invalid" | "unsupported" | "error";
-    readonly consumeMode: ProviderChoiceConsumeMode;
-    readonly consumed: boolean;
-    readonly replay: boolean;
-};
-export type CreateProviderChoiceContextOptions = {
-    readonly providerId: string;
-    readonly env?: EnvContext;
-    readonly request?: ProviderRequestContext;
-    readonly credential?: CredentialContext;
-    readonly state?: ProviderRuntimeState;
-    readonly masterSecret?: string;
-    readonly kid?: string;
-    /** Receives allowlisted metadata only; token and payload values are never included. */
-    readonly onTelemetry?: (event: ProviderChoiceTelemetryEvent) => void;
-};
-export declare function createProviderChoiceContext(options: CreateProviderChoiceContextOptions): ProviderChoiceContext;
-export declare function createTestProviderChoiceContext(options: Omit<CreateProviderChoiceContextOptions, "masterSecret"> & {
-    readonly masterSecret?: string;
-}): ProviderChoiceContext;