@apifuse/provider-sdk 2.2.0-beta.61 → 2.2.0-beta.63

package/bin/apifuse-migrate-deployment.ts

@@ -0,0 +1,200 @@
+#!/usr/bin/env bun
+
+/**
+ * `apifuse migrate-deployment [path] [--check] [--json] [--drop-codeowners-lock]`
+ *
+ * Retires a provider repository's standalone `deploy.ts`. Deployment intent
+ * has one home — the `deployment` key on `defineProvider({...})` — and only
+ * the fields that differ from the runtime profile are written there. The
+ * command:
+ *
+ * 1. reads `deploy.ts`, subtracts the profile defaults, and proves the
+ *    resulting key resolves to exactly what the file declared;
+ * 2. writes the key into the declaration literal (after `runtime`), removes
+ *    a `deployment` extra from a `{ ...provider, deployment }` default export
+ *    and any `import ... from "./deploy"`;
+ * 3. deletes `deploy.ts` — after checking that no other repository source
+ *    (tests included) imports the module. The `.github/CODEOWNERS`
+ *    `/deploy.ts` lock stays unless `--drop-codeowners-lock` is passed: the
+ *    platform still honors a re-added legacy file until its fallback is
+ *    retired.
+ *
+ * Exit codes: 0 migrated or already migrated; 1 refused (the transform does
+ * not guess — a refusal names the manual step) or missing index.ts.
+ * `--check` reports without writing.
+ */
+
+import { existsSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join, relative, resolve } from "node:path";
+
+import type * as MigrateModule from "../src/cli/migrate-deployment-intent.js";
+
+/** Directories never scanned for deploy-module consumers. */
+const SKIPPED_DIRECTORIES = new Set([
+	"node_modules",
+	".git",
+	"dist",
+	"build",
+	"coverage",
+	".turbo",
+	"__generated__",
+]);
+const SOURCE_FILE = /\.(?:[cm]?[jt]s|[jt]sx)$/u;
+
+export const LEGACY_DEPLOY_FILE = "deploy.ts";
+export const CODEOWNERS_FILE = ".github/CODEOWNERS";
+
+export async function main(): Promise<void> {
+	// The transform needs the TypeScript compiler; load it here so a missing
+	// devDependency is a one-line report instead of an import stack trace.
+	let migrateDeploymentIntent: typeof MigrateModule.migrateDeploymentIntent;
+	let findDeployModuleConsumers: typeof MigrateModule.findDeployModuleConsumers;
+	try {
+		({ migrateDeploymentIntent, findDeployModuleConsumers } = await import(
+			"../src/cli/migrate-deployment-intent.js"
+		));
+	} catch (error) {
+		console.error(error instanceof Error ? error.message : String(error));
+		process.exit(1);
+	}
+	const args = normalizeArgs(process.argv.slice(2));
+	const check = args.includes("--check");
+	const json = args.includes("--json");
+	const dropCodeownersLock = args.includes("--drop-codeowners-lock");
+	const positional = args.filter((argument) => !argument.startsWith("--"));
+	const providerRoot = resolve(positional[0] ?? ".");
+	const indexPath = resolve(providerRoot, "index.ts");
+	const deployPath = resolve(providerRoot, LEGACY_DEPLOY_FILE);
+	const codeownersPath = resolve(providerRoot, CODEOWNERS_FILE);
+
+	const report = (payload: Record<string, unknown>, humanText: string): void => {
+		if (json) {
+			console.log(JSON.stringify({ schemaVersion: 1, providerRoot, ...payload }));
+		} else {
+			console.log(humanText);
+		}
+	};
+
+	if (!existsSync(indexPath)) {
+		report(
+			{ status: "refused", reason: "index.ts not found" },
+			`migrate-deployment: ${indexPath} not found.`,
+		);
+		process.exit(1);
+	}
+
+	const deploySource = existsSync(deployPath) ? readFileSync(deployPath, "utf8") : undefined;
+	const codeownersSource = existsSync(codeownersPath)
+		? readFileSync(codeownersPath, "utf8")
+		: undefined;
+	const result = migrateDeploymentIntent({
+		indexSource: readFileSync(indexPath, "utf8"),
+		deploySource,
+		codeownersSource,
+		dropCodeownersLock,
+		indexFileName: indexPath,
+	});
+
+	if (result.status === "refused") {
+		report(
+			{ status: "refused", reason: result.reason },
+			`migrate-deployment: refused — ${result.reason}\nThis provider needs a manual migration; do not delete deploy.ts without one.`,
+		);
+		process.exit(1);
+	}
+
+	if (result.status === "unchanged") {
+		report(
+			{ status: "unchanged", notes: result.notes },
+			`migrate-deployment: already migrated; nothing to do.${formatNotes(result.notes)}`,
+		);
+		return;
+	}
+
+	if (result.removeDeployFile) {
+		// index.ts is accounted for by the transform; any other source that
+		// imports the module (a test, a helper) would break when it is deleted.
+		const consumers = findDeployModuleConsumers(
+			providerRoot,
+			collectOtherSources(providerRoot, [indexPath, deployPath]),
+		);
+		if (consumers.length > 0) {
+			const reason = `deploy.ts is still imported by ${consumers.join(", ")}; remove or rewrite those imports before migrating.`;
+			report(
+				{ status: "refused", reason },
+				`migrate-deployment: refused — ${reason}\nThis provider needs a manual migration; do not delete deploy.ts without one.`,
+			);
+			process.exit(1);
+		}
+	}
+
+	const touchedPaths: string[] = [];
+	if (result.indexChanged) touchedPaths.push("index.ts");
+	if (result.removeDeployFile) touchedPaths.push(LEGACY_DEPLOY_FILE);
+	if (result.codeownersChanged) touchedPaths.push(CODEOWNERS_FILE);
+	const payload = {
+		shape: result.shape,
+		legacy: result.legacy,
+		intent: result.intent,
+		resolved: result.resolved,
+		resolvedEqual: result.legacy === undefined ? undefined : true,
+		touchedPaths,
+		notes: result.notes,
+	};
+	const intentSummary =
+		Object.keys(result.intent).length === 0
+			? "profile defaults (no deployment key)"
+			: `deployment: ${JSON.stringify(result.intent)}`;
+
+	if (check) {
+		report(
+			{ status: "would-migrate", ...payload },
+			`migrate-deployment: would migrate (${intentSummary}; touches ${touchedPaths.join(", ")}). Run without --check to write.${formatNotes(result.notes)}`,
+		);
+		return;
+	}
+
+	if (result.indexChanged) writeFileSync(indexPath, result.indexSource, "utf8");
+	if (result.codeownersChanged && result.codeownersSource !== undefined) {
+		writeFileSync(codeownersPath, result.codeownersSource, "utf8");
+	}
+	if (result.removeDeployFile) rmSync(deployPath, { force: true });
+	report(
+		{ status: "migrated", ...payload },
+		`migrate-deployment: migrated (${intentSummary}; touched ${touchedPaths.join(", ")}). Review the diff, then run \`apifuse check\` and \`bun run type-check\`.${formatNotes(result.notes)}`,
+	);
+}
+
+function normalizeArgs(argv: string[]): string[] {
+	return argv[0] === "migrate-deployment" ? argv.slice(1) : argv;
+}
+
+/** Every source file under `providerRoot` except `excluded`, with text. */
+function collectOtherSources(
+	providerRoot: string,
+	excluded: readonly string[],
+): { readonly path: string; readonly text: string }[] {
+	const skip = new Set(excluded.map((file) => resolve(file)));
+	const files: { readonly path: string; readonly text: string }[] = [];
+	const walk = (directory: string): void => {
+		for (const entry of readdirSync(directory, { withFileTypes: true })) {
+			const absolute = join(directory, entry.name);
+			if (entry.isDirectory()) {
+				if (!SKIPPED_DIRECTORIES.has(entry.name)) walk(absolute);
+				continue;
+			}
+			if (!entry.isFile() || !SOURCE_FILE.test(entry.name) || skip.has(resolve(absolute))) continue;
+			files.push({ path: relative(providerRoot, absolute), text: readFileSync(absolute, "utf8") });
+		}
+	};
+	walk(providerRoot);
+	return files;
+}
+
+function formatNotes(notes: readonly string[]): string {
+	return notes.length === 0 ? "" : `\n${notes.map((note) => `  - ${note}`).join("\n")}`;
+}
+
+if (import.meta.main) {
+	await main();
+}

package/bin/apifuse-pack-check.ts

@@ -82,11 +82,18 @@ const requiredPaths = [
 	"dist/auth-turn/fixtures/invalid/unknown-top-level-field.json",
 	"src/auth-turn/auth-turn.v1.schema.json",
 ];
+// Test material must never reach the published tarball: it carries no consumer
+// value and the `.deploy.ts.txt` codemod fixtures describe internal provider
+// deployment intent. The `files` negations in package.json do the excluding;
+// these patterns are the ratchet that fails the build when a new test directory
+// escapes them (top-level negations do not cover nested `__tests__`).
+const isPackagedTestMaterial = (path: string): boolean =>
+	path.startsWith("__tests__/") ||
+	path.includes("/__tests__/") ||
+	path.endsWith(".test.ts") ||
+	path.endsWith(".spec.ts");
 const forbiddenMatches = filePaths.filter(
-	(path) =>
-		path.startsWith("src/__tests__/") ||
-		path === "src/index.test.ts" ||
-		path === "bin/apifuse-init.ts",
+	(path) => isPackagedTestMaterial(path) || path === "bin/apifuse-init.ts",
 );
 const missingRequiredPaths = requiredPaths.filter(
 	(path) => !filePaths.includes(path),

package/bin/apifuse-pack-types.ts

@@ -22,7 +22,7 @@
 // type errors, so this check cannot rot into a false-positive green.
 
 import { execFileSync, spawnSync } from "node:child_process";
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { z } from "zod";
@@ -293,14 +293,14 @@ const NEGATIVE_CONTROLS = [
 		].join("\n"),
 	},
 	{
-		filename: "negative-control-telemetry-header-vendor.ts",
+		filename: "negative-control-proxy-telemetry-vendor.ts",
 		expectedCode: "TS2322",
-		description: "gateway telemetry headers reject an unbranded vendor string",
+		description: "proxy gateway telemetry rejects an unbranded vendor string",
 		source: [
 			'import type { TelemetryContributor } from "@apifuse/provider-sdk";',
 			"",
 			"const bad: TelemetryContributor<{}, { vendor: string }> = {",
-			'\tkey: "resolver",',
+			'\tkey: "proxy",',
 			"\ttoLogPayload: () => ({}),",
 			'\ttoHeaderPayload: () => ({ vendor: "free-text" }),',
 			"};",
@@ -472,8 +472,195 @@ const NEGATIVE_CONTROLS = [
 			"export const ingestible: GatewayIngestible<NativeTelemetryHeaderPayload> = header;",
 		].join("\n"),
 	},
+	{
+		filename: "negative-control-http-telemetry-free-text.ts",
+		expectedCode: "TS2322",
+		description: "HTTP gateway telemetry rejects a free-string diagnostic field",
+		source: [
+			'import type { HttpTelemetryHeaderPayload, GatewayIngestible } from "@apifuse/provider-sdk";',
+			"type UnsafeHttpHeader = HttpTelemetryHeaderPayload & { message: string };",
+			"declare const header: HttpTelemetryHeaderPayload;",
+			'export const mustNotCompile: GatewayIngestible<UnsafeHttpHeader> = { ...header, message: "upstream free text" };',
+			"",
+		].join("\n"),
+	},
+	{
+		filename: "positive-control-http-telemetry-contributor.ts",
+		expectedCode: "",
+		description: "HTTP contributor satisfies the gateway and tenant projection contracts",
+		source: [
+			'import { HttpTelemetryCollector, type HttpTelemetryHeaderPayload, type HttpTelemetryLogPayload, type HttpTelemetryRetryPayload, type GatewayIngestible, type TenantNeutral, type TelemetryContributor } from "@apifuse/provider-sdk";',
+			'import { HttpTelemetryCollector as ServerHttpCollector } from "@apifuse/provider-sdk/server";',
+			"export const http: TelemetryContributor<HttpTelemetryLogPayload, HttpTelemetryHeaderPayload> = new HttpTelemetryCollector();",
+			"declare const header: HttpTelemetryHeaderPayload;",
+			"export const ingestible: GatewayIngestible<HttpTelemetryHeaderPayload> = header;",
+			"export const retry: TenantNeutral<HttpTelemetryRetryPayload> | undefined = new ServerHttpCollector().toTenantRetryPayload();",
+			"",
+		].join("\n"),
+	},
+	{
+		filename: "negative-control-stealth-telemetry-diagnostics.ts",
+		expectedCode: "TS2322",
+		description: "stealth gateway telemetry rejects a free-string header field",
+		source: [
+			'import { type GatewayIngestible, type StealthTelemetryHeaderPayload } from "@apifuse/provider-sdk";',
+			"type UnsafeHeader = StealthTelemetryHeaderPayload & { diagnostics: string };",
+			"declare const unsafeHeader: UnsafeHeader;",
+			"export const mustNotCompile: GatewayIngestible<UnsafeHeader> = unsafeHeader;",
+			"",
+		].join("\n"),
+	},
+	{
+		filename: "positive-control-stealth-telemetry-contributor.ts",
+		expectedCode: "",
+		description: "stealth telemetry contributor satisfies the gateway-ingestible contract",
+		source: [
+			'import { StealthTelemetryCollector, type GatewayIngestible, type StealthTelemetryHeaderPayload, type StealthTelemetryLogPayload, type TelemetryContributor } from "@apifuse/provider-sdk";',
+			"",
+			"export const stealth: TelemetryContributor<StealthTelemetryLogPayload, StealthTelemetryHeaderPayload> = new StealthTelemetryCollector();",
+			"declare const header: StealthTelemetryHeaderPayload;",
+			"export const ingestible: GatewayIngestible<StealthTelemetryHeaderPayload> = header;",
+			"",
+		].join("\n"),
+	},
+	{
+		filename: "negative-control-ocr-telemetry-free-text.ts",
+		expectedCode: "TS2322",
+		description: "ocr gateway telemetry rejects a free-string field",
+		source: [
+			'import type { GatewayIngestible, OcrTelemetryHeaderPayload } from "@apifuse/provider-sdk";',
+			"type Unsafe = OcrTelemetryHeaderPayload & { message: string };",
+			"declare const value: Unsafe;",
+			"export const bad: GatewayIngestible<Unsafe> = value;",
+		].join("\n"),
+	},
+	{
+		filename: "positive-control-ocr-telemetry-contributor.ts",
+		expectedCode: "",
+		description: "ocr telemetry contributor satisfies the gateway-ingestible contract",
+		source: [
+			'import { OcrTelemetryCollector, type TelemetryContributor, type OcrTelemetryLogPayload, type OcrTelemetryHeaderPayload } from "@apifuse/provider-sdk";',
+			"export const ocr: TelemetryContributor<OcrTelemetryLogPayload, OcrTelemetryHeaderPayload> = new OcrTelemetryCollector();",
+		].join("\n"),
+	},
+	{
+		filename: "negative-control-stt-telemetry-free-text.ts",
+		expectedCode: "TS2322",
+		description: "stt gateway telemetry rejects a free-string field",
+		source: [
+			'import type { GatewayIngestible, SttTelemetryHeaderPayload } from "@apifuse/provider-sdk";',
+			"type Unsafe = SttTelemetryHeaderPayload & { message: string };",
+			"declare const value: Unsafe;",
+			"export const bad: GatewayIngestible<Unsafe> = value;",
+		].join("\n"),
+	},
+	{
+		filename: "positive-control-stt-telemetry-contributor.ts",
+		expectedCode: "",
+		description: "stt telemetry contributor satisfies the gateway-ingestible contract",
+		source: [
+			'import { SttTelemetryCollector, type TelemetryContributor, type SttTelemetryLogPayload, type SttTelemetryHeaderPayload } from "@apifuse/provider-sdk";',
+			"export const stt: TelemetryContributor<SttTelemetryLogPayload, SttTelemetryHeaderPayload> = new SttTelemetryCollector();",
+		].join("\n"),
+	},
+	{
+		filename: "negative-control-browser-telemetry-free-text.ts",
+		expectedCode: "TS2322",
+		description: "browser gateway telemetry rejects a free-string field",
+		source: [
+			'import type { BrowserTelemetryHeaderPayload, GatewayIngestible } from "@apifuse/provider-sdk";',
+			"declare const header: BrowserTelemetryHeaderPayload;",
+			"type Unsafe = BrowserTelemetryHeaderPayload & { message: string };",
+			'export const bad: GatewayIngestible<Unsafe> = { ...header, message: "free text" };',
+		].join("\n"),
+	},
+	{
+		filename: "positive-control-browser-telemetry-contributor.ts",
+		expectedCode: "",
+		description: "browser telemetry contributor satisfies the gateway-ingestible contract",
+		source: [
+			'import { BrowserTelemetryCollector, type BrowserTelemetryHeaderPayload, type BrowserTelemetryLogPayload, type TelemetryContributor } from "@apifuse/provider-sdk";',
+			"export const browser: TelemetryContributor<BrowserTelemetryLogPayload, BrowserTelemetryHeaderPayload> = new BrowserTelemetryCollector();",
+		].join("\n"),
+	},
+	{
+		filename: "negative-control-cache-telemetry-free-text.ts",
+		expectedCode: "TS2322",
+		description: "cache gateway telemetry rejects raw cache-key samples",
+		source: [
+			'import type { TelemetryContributor } from "@apifuse/provider-sdk";',
+			"const bad: TelemetryContributor<{}, { key: string }> = {",
+			'\tkey: "cache",',
+			"\ttoLogPayload: () => ({}),",
+			'\ttoHeaderPayload: () => ({ key: "raw" }),',
+			"};",
+		].join("\n"),
+	},
+	{
+		filename: "positive-control-cache-telemetry-contributor.ts",
+		expectedCode: "",
+		description: "cache telemetry contributor satisfies the public contributor contract",
+		source: [
+			'import { CacheTelemetryCollector, type TelemetryContributor, type CacheTelemetryHeaderPayload, type CacheTelemetryLogPayload } from "@apifuse/provider-sdk";',
+			"export const cache: TelemetryContributor<CacheTelemetryLogPayload, CacheTelemetryHeaderPayload> = new CacheTelemetryCollector();",
+		].join("\n"),
+	},
+	{
+		filename: "negative-control-state-telemetry-free-text.ts",
+		expectedCode: "TS2322",
+		description: "state gateway telemetry rejects raw state-key samples",
+		source: [
+			'import type { TelemetryContributor } from "@apifuse/provider-sdk";',
+			"const bad: TelemetryContributor<{}, { key: string }> = {",
+			'\tkey: "state",',
+			"\ttoLogPayload: () => ({}),",
+			'\ttoHeaderPayload: () => ({ key: "raw" }),',
+			"};",
+		].join("\n"),
+	},
+	{
+		filename: "positive-control-state-telemetry-contributor.ts",
+		expectedCode: "",
+		description: "state telemetry contributor satisfies the public contributor contract",
+		source: [
+			'import { StateTelemetryCollector, type TelemetryContributor, type StateTelemetryHeaderPayload, type StateTelemetryLogPayload } from "@apifuse/provider-sdk";',
+			"export const state: TelemetryContributor<StateTelemetryLogPayload, StateTelemetryHeaderPayload> = new StateTelemetryCollector();",
+		].join("\n"),
+	},
 ] as const;
 
+assertTelemetryContributorControls();
+
+function assertTelemetryContributorControls(): void {
+	const requestTelemetry = readFileSync(join(sdkRoot, "src/runtime/request-telemetry.ts"), "utf8");
+	const priorityMatch = requestTelemetry.match(
+		/const HEADER_PRIORITY = \[([\s\S]*?)\] as const satisfies/,
+	);
+	if (!priorityMatch) throw new Error("Could not read request telemetry header priority list");
+
+	const priority = [...priorityMatch[1].matchAll(/"([a-z]+)"/g)].map((match) => match[1]);
+	const shipped = priority.filter((name) =>
+		existsSync(join(sdkRoot, "src/runtime", `${name}-telemetry.ts`)),
+	);
+	const missing: string[] = [];
+	for (const name of shipped) {
+		const hasPositive = NEGATIVE_CONTROLS.some(
+			({ filename }) => filename === `positive-control-${name}-telemetry-contributor.ts`,
+		);
+		const hasNegative = NEGATIVE_CONTROLS.some(({ filename }) =>
+			filename.startsWith(`negative-control-${name}-telemetry-`),
+		);
+		if (!hasNegative || !hasPositive) {
+			missing.push(
+				`${name} (${hasNegative ? "negative" : "missing negative"}, ${hasPositive ? "positive" : "missing positive"})`,
+			);
+		}
+	}
+	if (missing.length > 0) {
+		throw new Error(`Missing telemetry contributor pack controls: ${missing.join(", ")}`);
+	}
+}
+
 const tempRoot = mkdtempSync(join(tmpdir(), "apifuse-provider-sdk-pack-types-"));
 const packDir = join(tempRoot, "pack");
 const consumerDir = join(tempRoot, "consumer");

package/bin/apifuse-record.ts

@@ -14,7 +14,6 @@ import {
 	createHandleContext,
 	createProviderEnvironment,
 	createSttClientFromEnv,
-	createUnsupportedResolverClient,
 	executeOperation,
 	type HttpClient,
 	type HttpResponse,
@@ -23,13 +22,13 @@ import {
 	type ProviderDefinition,
 	type ProviderEngineBindingCandidates,
 	ProviderError,
-	readEngineProxyCredentials,
-	type ProviderProxyPolicy,
 	type RequestOptions,
 	type StealthClient,
 	TransportError,
 	ValidationError,
 } from "../src/index.js";
+import { createCliResolverRuntime } from "../src/cli/resolver-runtime.js";
+import { assertProcessEngineModeSupported } from "../src/runtime/engine-mode.js";
 import type { JsonValue } from "../src/contract-json.js";
 import {
 	isSensitiveFixtureKey,
@@ -37,7 +36,6 @@ import {
 	sanitizeDiagnosticText,
 	sanitizeFixtureString,
 } from "../src/fixture-sanitization.js";
-import { createResolverClientFromEnv } from "../src/runtime/resolver.js";
 import {
 	isSensitiveKey,
 	normalizeSensitiveParams,
@@ -50,10 +48,10 @@ import {
 	requestOptionsFromHttpInvocation,
 	serializeRequestUrl,
 } from "../src/runtime/request-options.js";
+import type { ResolverTelemetryCollector } from "../src/runtime/resolver-telemetry.js";
 import { createMemoryProviderRuntimeState } from "../src/runtime/state.js";
 import { createStealthClient } from "../src/runtime/stealth.js";
 import { parseSchema } from "../src/schema.js";
-import { getStealthProfile } from "../src/stealth/profiles.js";
 import {
 	captureStreamEvidence,
 	createStreamCaptureEnvelope,
@@ -107,6 +105,8 @@ export async function main() {
 		const args = parseArgs(normalizeArgs(process.argv.slice(2)));
 		const location = resolveProviderLocation(args.providerPath);
 		const provider = await loadProvider(location.rootDir);
+		// The capture context attaches in-process; refuse an explicit remote request instead of ignoring it.
+		assertProcessEngineModeSupported();
 		const operationName = resolveOperationName(provider, args.operation);
 		const operation = provider.operations[operationName];
 		const parsedParams = await parseParams(operation, args.params);
@@ -140,6 +140,12 @@ export async function main() {
 				);
 			}
 			throw operationError;
+		} finally {
+			const telemetryLine = formatResolverTelemetry(
+				capture.resolverTelemetry,
+				capture.getCapturedSensitiveParams().values,
+			);
+			if (telemetryLine) console.log(telemetryLine);
 		}
 		const captured = await capture.getCapturedRaw();
 
@@ -256,6 +262,25 @@ function parseArgs(argv: string[]): CliArgs {
 	return { append, providerPath, operation, params, sanitize };
 }
 
+/**
+ * The `resolver` sibling of the server request log, printed once per recorded invocation. The
+ * collector redacts at record time with the values registered so far; the mandatory query-secret
+ * pass over the final line also covers values captured after a solve and short low-entropy values
+ * the diagnostic redactor does not match, the same way handleCliError treats CLI errors.
+ */
+export function formatResolverTelemetry(
+	collector: ResolverTelemetryCollector,
+	sensitiveValues: readonly string[] = [],
+): string | undefined {
+	const resolver = collector.toLogPayload();
+	return resolver
+		? `[apifuse record] Resolver telemetry ${redactSensitiveText(
+				JSON.stringify({ resolver }),
+				sensitiveValues,
+			)}`
+		: undefined;
+}
+
 function handleCliError(error: unknown, sensitiveValues: readonly string[] = []): never {
 	const message = redactSensitiveText(formatCliError(error), sensitiveValues);
 	console.error(`[apifuse record] ${message}`);
@@ -430,13 +455,6 @@ function resolveOperationBaseUrl(provider: ProviderRuntime, operationName: strin
 	return baseUrl;
 }
 
-function resolveNativeProxyPolicy(provider: ProviderDefinition): ProviderProxyPolicy | undefined {
-	if (typeof provider.proxy === "object") return provider.proxy;
-	if (provider.proxy === true) return { mode: "optional" };
-	if (provider.proxy === false) return { mode: "disabled" };
-	return undefined;
-}
-
 export function createCaptureContext(
 	provider: ProviderRuntime,
 	baseUrl: string,
@@ -454,8 +472,19 @@ export function createCaptureContext(
 	let capturedSse: { order: number; method: string; path: string } | undefined;
 	const sensitiveParamNames = new Set<string>();
 	const sensitiveParamValues = new Set<string>();
+	const cache = createBypassProviderCache({ providerId: provider.id });
+	const { resolver, resolverTelemetry, registerSensitiveValues } = createCliResolverRuntime(
+		provider,
+		cache,
+	);
 	const captureSensitiveParams = (url: string, options?: SensitiveRequestOptions) => {
-		captureSensitiveRequestValues(url, options, sensitiveParamNames, sensitiveParamValues);
+		try {
+			captureSensitiveRequestValues(url, options, sensitiveParamNames, sensitiveParamValues);
+		} finally {
+			// Resolver telemetry redacts at record time, so the vendor diagnostics of a later solve
+			// must not echo a query secret captured here (same guarantee as handleCliError).
+			registerSensitiveValues([...sensitiveParamValues]);
+		}
 	};
 	const getCapturedSensitiveParams = (): CapturedSensitiveParams => ({
 		names: [...sensitiveParamNames],
@@ -521,7 +550,6 @@ export function createCaptureContext(
 		provider.secrets?.map((secret) => secret.name) ?? [],
 	);
 	const env = { get: (key: string) => readDiagnosticEnv(key, providerEnvironment) };
-	const engineCredentials = readEngineProxyCredentials();
 	const credential = {
 		mode: "none" as const,
 		get: () => undefined,
@@ -530,9 +558,6 @@ export function createCaptureContext(
 		getScopes: () => [],
 	};
 	const state = createMemoryProviderRuntimeState();
-	const cache = createBypassProviderCache({ providerId: provider.id });
-	const proxyPolicy = resolveNativeProxyPolicy(provider);
-	const stealthProfile = provider.stealth ? getStealthProfile(provider.stealth) : undefined;
 	const candidates: ProviderEngineBindingCandidates = {
 		env,
 		credential,
@@ -567,21 +592,7 @@ export function createCaptureContext(
 		},
 		ocr: createOcrClientFromEnv(provider.ocr),
 		stt: createSttClientFromEnv(provider.stt),
-		resolver: provider.resolver
-			? createResolverClientFromEnv(provider.resolver, engineCredentials, {
-					allowedHosts: provider.allowedHosts,
-					cache,
-					...(proxyPolicy
-						? {
-								proxyIntent: {
-									mode: proxyPolicy.mode,
-									upstream: { proxy: provider.proxy },
-									...(stealthProfile ? { userAgent: stealthProfile.userAgent } : {}),
-								},
-							}
-						: {}),
-				})
-			: createUnsupportedResolverClient("Provider does not declare resolver capability"),
+		resolver,
 		handle: createHandleContext({
 			providerId: provider.id,
 			request: { headers: {}, connectionId: "local-record" },
@@ -595,6 +606,7 @@ export function createCaptureContext(
 
 	return {
 		ctx,
+		resolverTelemetry,
 		getCapturedRaw: async () => {
 			if (streamCaptures.length === 0) {
 				if (capturedSse) throw unsupportedSseCaptureError(capturedSse);

package/bin/apifuse-test.ts

@@ -687,4 +687,6 @@ function extractLastMatch(
 	return matches[matches.length - 1];
 }
 
-void main();
+if (import.meta.main) {
+	await main();
+}

package/dist/cli/commands.d.ts

@@ -1,4 +1,4 @@
-export type ApifuseCommandName = "create" | "dev" | "check" | "sync-assets" | "migrate-shape" | "migrate-operation-declaration" | "submit-check" | "bounty-check" | "record" | "test" | "perf";
+export type ApifuseCommandName = "create" | "dev" | "check" | "sync-assets" | "migrate-shape" | "migrate-operation-declaration" | "migrate-deployment" | "submit-check" | "bounty-check" | "record" | "test" | "perf";
 export type ApifuseCommandManifest = {
     name: ApifuseCommandName;
     summary: string;

package/dist/cli/commands.js

@@ -47,6 +47,16 @@ export const COMMAND_MANIFEST = {
         ],
         modulePath: "./apifuse-migrate-operation-declaration",
     },
+    "migrate-deployment": {
+        name: "migrate-deployment",
+        summary: "Retire a legacy deploy.ts: hoist its non-default values into the defineProvider() deployment key and delete the file.",
+        usage: "apifuse migrate-deployment [path] [--check] [--json] [--drop-codeowners-lock]",
+        examples: [
+            "apifuse migrate-deployment .",
+            "apifuse migrate-deployment . --check --json",
+        ],
+        modulePath: "./apifuse-migrate-deployment",
+    },
     "submit-check": {
         name: "submit-check",
         summary: "Score provider bounty submission readiness and emit checklist evidence.",
@@ -100,6 +110,7 @@ export const COMMAND_ORDER = [
     "sync-assets",
     "migrate-shape",
     "migrate-operation-declaration",
+    "migrate-deployment",
     "submit-check",
     "record",
     "test",