@apifuse/provider-sdk 2.2.0-beta.62 → 2.2.0-beta.64

package/bin/apifuse-dev.ts

@@ -11,20 +11,18 @@ import {
 	createProviderCache,
 	createHandleContext,
 	createProviderEnvironment,
-	createUnsupportedResolverClient,
 	createSttClientFromEnv,
-	readEngineProxyCredentials,
 	type ProviderDefinition,
 	type ProviderEngineBindingCandidates,
 	ProviderError,
-	type ProviderProxyPolicy,
 } from "../src/index.js";
+import { createCliResolverRuntime } from "../src/cli/resolver-runtime.js";
+import { assertProcessEngineModeSupported } from "../src/runtime/engine-mode.js";
 import { createBrowserClient } from "../src/runtime/browser.js";
-import { createResolverClientFromEnv } from "../src/runtime/resolver.js";
 import { createMemoryProviderRuntimeState } from "../src/runtime/state.js";
 import { createStealthClient } from "../src/runtime/stealth.js";
+import type { ResolverTelemetryCollector } from "../src/runtime/resolver-telemetry.js";
 import { createTraceContext } from "../src/runtime/trace.js";
-import { getStealthProfile } from "../src/stealth/profiles.js";
 import type { BrowserClient, ProviderContext } from "../src/types.js";
 
 const HELP_TEXT = `Usage: apifuse dev [path]
@@ -43,6 +41,9 @@ export async function main() {
 	const providerModule = await import(resolve(providerPath, "index.ts"));
 	const provider = assertProviderDefinition(providerModule.default, providerPath);
 
+	// Fail fast before the server starts: this is a developer tool, and an
+	// explicit remote request must never silently fall back to in-process.
+	assertProcessEngineModeSupported();
 	const { startDevServer } = await import("../src/dev.js");
 	const port = Number(process.env.APIFUSE__RUNTIME__PORT) || 3900;
 
@@ -50,6 +51,7 @@ export async function main() {
 
 	console.log("\nEndpoints:");
 	console.log(`  GET  http://localhost:${port}/health`);
+	console.log(`  GET  http://localhost:${port}/readyz`);
 
 	for (const operationId of Object.keys(provider.operations)) {
 		console.log(`  POST http://localhost:${port}/v1/${operationId}`);
@@ -81,18 +83,17 @@ export async function main() {
 
 export function createProviderContext(provider: ProviderDefinition): {
 	ctx: ProviderContext;
+	resolverTelemetry: ResolverTelemetryCollector;
 } {
 	const providerEnvironment = createProviderEnvironment(
 		process.env,
 		provider.secrets?.map((secret) => secret.name) ?? [],
 	);
 	const providerEnv = { get: (key: string) => readDiagnosticEnv(key, providerEnvironment) };
-	const engineCredentials = readEngineProxyCredentials();
 	const credential = createCredentialContext();
 	const state = createMemoryProviderRuntimeState();
 	const cache = createProviderCache({ providerId: provider.id });
-	const proxyPolicy = resolveNativeProxyPolicy(provider);
-	const stealthProfile = provider.stealth ? getStealthProfile(provider.stealth) : undefined;
+	const { resolver, resolverTelemetry } = createCliResolverRuntime(provider, cache);
 	const candidates: ProviderEngineBindingCandidates = {
 		env: providerEnv,
 		credential,
@@ -113,21 +114,7 @@ export function createProviderContext(provider: ProviderDefinition): {
 		}),
 		ocr: createOcrClientFromEnv(provider.ocr),
 		stt: createSttClientFromEnv(provider.stt),
-		resolver: provider.resolver
-			? createResolverClientFromEnv(provider.resolver, engineCredentials, {
-					allowedHosts: provider.allowedHosts,
-					cache,
-					...(proxyPolicy
-						? {
-								proxyIntent: {
-									mode: proxyPolicy.mode,
-									upstream: { proxy: provider.proxy },
-									...(stealthProfile ? { userAgent: stealthProfile.userAgent } : {}),
-								},
-							}
-						: {}),
-				})
-			: createUnsupportedResolverClient("Provider does not declare resolver capability"),
+		resolver,
 		handle: createHandleContext({
 			providerId: provider.id,
 			// Local dev is a single-user session: one stable connection scope so
@@ -141,14 +128,7 @@ export function createProviderContext(provider: ProviderDefinition): {
 		bindings: candidates,
 	}) as ProviderContext;
 
-	return { ctx };
-}
-
-function resolveNativeProxyPolicy(provider: ProviderDefinition): ProviderProxyPolicy | undefined {
-	if (typeof provider.proxy === "object") return provider.proxy;
-	if (provider.proxy === true) return { mode: "optional" };
-	if (provider.proxy === false) return { mode: "disabled" };
-	return undefined;
+	return { ctx, resolverTelemetry };
 }
 
 function normalizeArgs(argv: string[]): string[] {

package/bin/apifuse-migrate-deployment.ts

@@ -0,0 +1,200 @@
+#!/usr/bin/env bun
+
+/**
+ * `apifuse migrate-deployment [path] [--check] [--json] [--drop-codeowners-lock]`
+ *
+ * Retires a provider repository's standalone `deploy.ts`. Deployment intent
+ * has one home — the `deployment` key on `defineProvider({...})` — and only
+ * the fields that differ from the runtime profile are written there. The
+ * command:
+ *
+ * 1. reads `deploy.ts`, subtracts the profile defaults, and proves the
+ *    resulting key resolves to exactly what the file declared;
+ * 2. writes the key into the declaration literal (after `runtime`), removes
+ *    a `deployment` extra from a `{ ...provider, deployment }` default export
+ *    and any `import ... from "./deploy"`;
+ * 3. deletes `deploy.ts` — after checking that no other repository source
+ *    (tests included) imports the module. The `.github/CODEOWNERS`
+ *    `/deploy.ts` lock stays unless `--drop-codeowners-lock` is passed: the
+ *    platform still honors a re-added legacy file until its fallback is
+ *    retired.
+ *
+ * Exit codes: 0 migrated or already migrated; 1 refused (the transform does
+ * not guess — a refusal names the manual step) or missing index.ts.
+ * `--check` reports without writing.
+ */
+
+import { existsSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join, relative, resolve } from "node:path";
+
+import type * as MigrateModule from "../src/cli/migrate-deployment-intent.js";
+
+/** Directories never scanned for deploy-module consumers. */
+const SKIPPED_DIRECTORIES = new Set([
+	"node_modules",
+	".git",
+	"dist",
+	"build",
+	"coverage",
+	".turbo",
+	"__generated__",
+]);
+const SOURCE_FILE = /\.(?:[cm]?[jt]s|[jt]sx)$/u;
+
+export const LEGACY_DEPLOY_FILE = "deploy.ts";
+export const CODEOWNERS_FILE = ".github/CODEOWNERS";
+
+export async function main(): Promise<void> {
+	// The transform needs the TypeScript compiler; load it here so a missing
+	// devDependency is a one-line report instead of an import stack trace.
+	let migrateDeploymentIntent: typeof MigrateModule.migrateDeploymentIntent;
+	let findDeployModuleConsumers: typeof MigrateModule.findDeployModuleConsumers;
+	try {
+		({ migrateDeploymentIntent, findDeployModuleConsumers } = await import(
+			"../src/cli/migrate-deployment-intent.js"
+		));
+	} catch (error) {
+		console.error(error instanceof Error ? error.message : String(error));
+		process.exit(1);
+	}
+	const args = normalizeArgs(process.argv.slice(2));
+	const check = args.includes("--check");
+	const json = args.includes("--json");
+	const dropCodeownersLock = args.includes("--drop-codeowners-lock");
+	const positional = args.filter((argument) => !argument.startsWith("--"));
+	const providerRoot = resolve(positional[0] ?? ".");
+	const indexPath = resolve(providerRoot, "index.ts");
+	const deployPath = resolve(providerRoot, LEGACY_DEPLOY_FILE);
+	const codeownersPath = resolve(providerRoot, CODEOWNERS_FILE);
+
+	const report = (payload: Record<string, unknown>, humanText: string): void => {
+		if (json) {
+			console.log(JSON.stringify({ schemaVersion: 1, providerRoot, ...payload }));
+		} else {
+			console.log(humanText);
+		}
+	};
+
+	if (!existsSync(indexPath)) {
+		report(
+			{ status: "refused", reason: "index.ts not found" },
+			`migrate-deployment: ${indexPath} not found.`,
+		);
+		process.exit(1);
+	}
+
+	const deploySource = existsSync(deployPath) ? readFileSync(deployPath, "utf8") : undefined;
+	const codeownersSource = existsSync(codeownersPath)
+		? readFileSync(codeownersPath, "utf8")
+		: undefined;
+	const result = migrateDeploymentIntent({
+		indexSource: readFileSync(indexPath, "utf8"),
+		deploySource,
+		codeownersSource,
+		dropCodeownersLock,
+		indexFileName: indexPath,
+	});
+
+	if (result.status === "refused") {
+		report(
+			{ status: "refused", reason: result.reason },
+			`migrate-deployment: refused — ${result.reason}\nThis provider needs a manual migration; do not delete deploy.ts without one.`,
+		);
+		process.exit(1);
+	}
+
+	if (result.status === "unchanged") {
+		report(
+			{ status: "unchanged", notes: result.notes },
+			`migrate-deployment: already migrated; nothing to do.${formatNotes(result.notes)}`,
+		);
+		return;
+	}
+
+	if (result.removeDeployFile) {
+		// index.ts is accounted for by the transform; any other source that
+		// imports the module (a test, a helper) would break when it is deleted.
+		const consumers = findDeployModuleConsumers(
+			providerRoot,
+			collectOtherSources(providerRoot, [indexPath, deployPath]),
+		);
+		if (consumers.length > 0) {
+			const reason = `deploy.ts is still imported by ${consumers.join(", ")}; remove or rewrite those imports before migrating.`;
+			report(
+				{ status: "refused", reason },
+				`migrate-deployment: refused — ${reason}\nThis provider needs a manual migration; do not delete deploy.ts without one.`,
+			);
+			process.exit(1);
+		}
+	}
+
+	const touchedPaths: string[] = [];
+	if (result.indexChanged) touchedPaths.push("index.ts");
+	if (result.removeDeployFile) touchedPaths.push(LEGACY_DEPLOY_FILE);
+	if (result.codeownersChanged) touchedPaths.push(CODEOWNERS_FILE);
+	const payload = {
+		shape: result.shape,
+		legacy: result.legacy,
+		intent: result.intent,
+		resolved: result.resolved,
+		resolvedEqual: result.legacy === undefined ? undefined : true,
+		touchedPaths,
+		notes: result.notes,
+	};
+	const intentSummary =
+		Object.keys(result.intent).length === 0
+			? "profile defaults (no deployment key)"
+			: `deployment: ${JSON.stringify(result.intent)}`;
+
+	if (check) {
+		report(
+			{ status: "would-migrate", ...payload },
+			`migrate-deployment: would migrate (${intentSummary}; touches ${touchedPaths.join(", ")}). Run without --check to write.${formatNotes(result.notes)}`,
+		);
+		return;
+	}
+
+	if (result.indexChanged) writeFileSync(indexPath, result.indexSource, "utf8");
+	if (result.codeownersChanged && result.codeownersSource !== undefined) {
+		writeFileSync(codeownersPath, result.codeownersSource, "utf8");
+	}
+	if (result.removeDeployFile) rmSync(deployPath, { force: true });
+	report(
+		{ status: "migrated", ...payload },
+		`migrate-deployment: migrated (${intentSummary}; touched ${touchedPaths.join(", ")}). Review the diff, then run \`apifuse check\` and \`bun run type-check\`.${formatNotes(result.notes)}`,
+	);
+}
+
+function normalizeArgs(argv: string[]): string[] {
+	return argv[0] === "migrate-deployment" ? argv.slice(1) : argv;
+}
+
+/** Every source file under `providerRoot` except `excluded`, with text. */
+function collectOtherSources(
+	providerRoot: string,
+	excluded: readonly string[],
+): { readonly path: string; readonly text: string }[] {
+	const skip = new Set(excluded.map((file) => resolve(file)));
+	const files: { readonly path: string; readonly text: string }[] = [];
+	const walk = (directory: string): void => {
+		for (const entry of readdirSync(directory, { withFileTypes: true })) {
+			const absolute = join(directory, entry.name);
+			if (entry.isDirectory()) {
+				if (!SKIPPED_DIRECTORIES.has(entry.name)) walk(absolute);
+				continue;
+			}
+			if (!entry.isFile() || !SOURCE_FILE.test(entry.name) || skip.has(resolve(absolute))) continue;
+			files.push({ path: relative(providerRoot, absolute), text: readFileSync(absolute, "utf8") });
+		}
+	};
+	walk(providerRoot);
+	return files;
+}
+
+function formatNotes(notes: readonly string[]): string {
+	return notes.length === 0 ? "" : `\n${notes.map((note) => `  - ${note}`).join("\n")}`;
+}
+
+if (import.meta.main) {
+	await main();
+}

package/bin/apifuse-pack-check.ts

@@ -82,11 +82,18 @@ const requiredPaths = [
 	"dist/auth-turn/fixtures/invalid/unknown-top-level-field.json",
 	"src/auth-turn/auth-turn.v1.schema.json",
 ];
+// Test material must never reach the published tarball: it carries no consumer
+// value and the `.deploy.ts.txt` codemod fixtures describe internal provider
+// deployment intent. The `files` negations in package.json do the excluding;
+// these patterns are the ratchet that fails the build when a new test directory
+// escapes them (top-level negations do not cover nested `__tests__`).
+const isPackagedTestMaterial = (path: string): boolean =>
+	path.startsWith("__tests__/") ||
+	path.includes("/__tests__/") ||
+	path.endsWith(".test.ts") ||
+	path.endsWith(".spec.ts");
 const forbiddenMatches = filePaths.filter(
-	(path) =>
-		path.startsWith("src/__tests__/") ||
-		path === "src/index.test.ts" ||
-		path === "bin/apifuse-init.ts",
+	(path) => isPackagedTestMaterial(path) || path === "bin/apifuse-init.ts",
 );
 const missingRequiredPaths = requiredPaths.filter(
 	(path) => !filePaths.includes(path),

package/bin/apifuse-pack-types.ts

@@ -22,7 +22,7 @@
 // type errors, so this check cannot rot into a false-positive green.
 
 import { execFileSync, spawnSync } from "node:child_process";
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { z } from "zod";
@@ -293,14 +293,14 @@ const NEGATIVE_CONTROLS = [
 		].join("\n"),
 	},
 	{
-		filename: "negative-control-telemetry-header-vendor.ts",
+		filename: "negative-control-proxy-telemetry-vendor.ts",
 		expectedCode: "TS2322",
-		description: "gateway telemetry headers reject an unbranded vendor string",
+		description: "proxy gateway telemetry rejects an unbranded vendor string",
 		source: [
 			'import type { TelemetryContributor } from "@apifuse/provider-sdk";',
 			"",
 			"const bad: TelemetryContributor<{}, { vendor: string }> = {",
-			'\tkey: "resolver",',
+			'\tkey: "proxy",',
 			"\ttoLogPayload: () => ({}),",
 			'\ttoHeaderPayload: () => ({ vendor: "free-text" }),',
 			"};",
@@ -450,6 +450,28 @@ const NEGATIVE_CONTROLS = [
 			"",
 		].join("\n"),
 	},
+	{
+		filename: "negative-control-native-telemetry-description.ts",
+		expectedCode: "TS2322",
+		description: "native gateway telemetry rejects free-string diagnostic fields",
+		source: [
+			'import type { GatewayIngestible, NativeTelemetryHeaderPayload } from "@apifuse/provider-sdk";',
+			"type UnsafeHeader = NativeTelemetryHeaderPayload & { vendorErrorMessage: string };",
+			"declare const header: NativeTelemetryHeaderPayload;",
+			'export const mustNotCompile: GatewayIngestible<UnsafeHeader> = { ...header, vendorErrorMessage: "free text stays log-only" };',
+		].join("\n"),
+	},
+	{
+		filename: "positive-control-native-telemetry-contributor.ts",
+		expectedCode: "",
+		description: "native telemetry contributor satisfies the gateway-ingestible contract",
+		source: [
+			'import { NativeTelemetryCollector, type GatewayIngestible, type NativeTelemetryHeaderPayload, type NativeTelemetryLogPayload, type TelemetryContributor } from "@apifuse/provider-sdk";',
+			"export const native: TelemetryContributor<NativeTelemetryLogPayload, NativeTelemetryHeaderPayload> = new NativeTelemetryCollector();",
+			"declare const header: NativeTelemetryHeaderPayload;",
+			"export const ingestible: GatewayIngestible<NativeTelemetryHeaderPayload> = header;",
+		].join("\n"),
+	},
 	{
 		filename: "negative-control-http-telemetry-free-text.ts",
 		expectedCode: "TS2322",
@@ -476,8 +498,169 @@ const NEGATIVE_CONTROLS = [
 			"",
 		].join("\n"),
 	},
+	{
+		filename: "negative-control-stealth-telemetry-diagnostics.ts",
+		expectedCode: "TS2322",
+		description: "stealth gateway telemetry rejects a free-string header field",
+		source: [
+			'import { type GatewayIngestible, type StealthTelemetryHeaderPayload } from "@apifuse/provider-sdk";',
+			"type UnsafeHeader = StealthTelemetryHeaderPayload & { diagnostics: string };",
+			"declare const unsafeHeader: UnsafeHeader;",
+			"export const mustNotCompile: GatewayIngestible<UnsafeHeader> = unsafeHeader;",
+			"",
+		].join("\n"),
+	},
+	{
+		filename: "positive-control-stealth-telemetry-contributor.ts",
+		expectedCode: "",
+		description: "stealth telemetry contributor satisfies the gateway-ingestible contract",
+		source: [
+			'import { StealthTelemetryCollector, type GatewayIngestible, type StealthTelemetryHeaderPayload, type StealthTelemetryLogPayload, type TelemetryContributor } from "@apifuse/provider-sdk";',
+			"",
+			"export const stealth: TelemetryContributor<StealthTelemetryLogPayload, StealthTelemetryHeaderPayload> = new StealthTelemetryCollector();",
+			"declare const header: StealthTelemetryHeaderPayload;",
+			"export const ingestible: GatewayIngestible<StealthTelemetryHeaderPayload> = header;",
+			"",
+		].join("\n"),
+	},
+	{
+		filename: "negative-control-ocr-telemetry-free-text.ts",
+		expectedCode: "TS2322",
+		description: "ocr gateway telemetry rejects a free-string field",
+		source: [
+			'import type { GatewayIngestible, OcrTelemetryHeaderPayload } from "@apifuse/provider-sdk";',
+			"type Unsafe = OcrTelemetryHeaderPayload & { message: string };",
+			"declare const value: Unsafe;",
+			"export const bad: GatewayIngestible<Unsafe> = value;",
+		].join("\n"),
+	},
+	{
+		filename: "positive-control-ocr-telemetry-contributor.ts",
+		expectedCode: "",
+		description: "ocr telemetry contributor satisfies the gateway-ingestible contract",
+		source: [
+			'import { OcrTelemetryCollector, type TelemetryContributor, type OcrTelemetryLogPayload, type OcrTelemetryHeaderPayload } from "@apifuse/provider-sdk";',
+			"export const ocr: TelemetryContributor<OcrTelemetryLogPayload, OcrTelemetryHeaderPayload> = new OcrTelemetryCollector();",
+		].join("\n"),
+	},
+	{
+		filename: "negative-control-stt-telemetry-free-text.ts",
+		expectedCode: "TS2322",
+		description: "stt gateway telemetry rejects a free-string field",
+		source: [
+			'import type { GatewayIngestible, SttTelemetryHeaderPayload } from "@apifuse/provider-sdk";',
+			"type Unsafe = SttTelemetryHeaderPayload & { message: string };",
+			"declare const value: Unsafe;",
+			"export const bad: GatewayIngestible<Unsafe> = value;",
+		].join("\n"),
+	},
+	{
+		filename: "positive-control-stt-telemetry-contributor.ts",
+		expectedCode: "",
+		description: "stt telemetry contributor satisfies the gateway-ingestible contract",
+		source: [
+			'import { SttTelemetryCollector, type TelemetryContributor, type SttTelemetryLogPayload, type SttTelemetryHeaderPayload } from "@apifuse/provider-sdk";',
+			"export const stt: TelemetryContributor<SttTelemetryLogPayload, SttTelemetryHeaderPayload> = new SttTelemetryCollector();",
+		].join("\n"),
+	},
+	{
+		filename: "negative-control-browser-telemetry-free-text.ts",
+		expectedCode: "TS2322",
+		description: "browser gateway telemetry rejects a free-string field",
+		source: [
+			'import type { BrowserTelemetryHeaderPayload, GatewayIngestible } from "@apifuse/provider-sdk";',
+			"declare const header: BrowserTelemetryHeaderPayload;",
+			"type Unsafe = BrowserTelemetryHeaderPayload & { message: string };",
+			'export const bad: GatewayIngestible<Unsafe> = { ...header, message: "free text" };',
+		].join("\n"),
+	},
+	{
+		filename: "positive-control-browser-telemetry-contributor.ts",
+		expectedCode: "",
+		description: "browser telemetry contributor satisfies the gateway-ingestible contract",
+		source: [
+			'import { BrowserTelemetryCollector, type BrowserTelemetryHeaderPayload, type BrowserTelemetryLogPayload, type TelemetryContributor } from "@apifuse/provider-sdk";',
+			"export const browser: TelemetryContributor<BrowserTelemetryLogPayload, BrowserTelemetryHeaderPayload> = new BrowserTelemetryCollector();",
+		].join("\n"),
+	},
+	{
+		filename: "negative-control-cache-telemetry-free-text.ts",
+		expectedCode: "TS2322",
+		description: "cache gateway telemetry rejects raw cache-key samples",
+		source: [
+			'import type { TelemetryContributor } from "@apifuse/provider-sdk";',
+			"const bad: TelemetryContributor<{}, { key: string }> = {",
+			'\tkey: "cache",',
+			"\ttoLogPayload: () => ({}),",
+			'\ttoHeaderPayload: () => ({ key: "raw" }),',
+			"};",
+		].join("\n"),
+	},
+	{
+		filename: "positive-control-cache-telemetry-contributor.ts",
+		expectedCode: "",
+		description: "cache telemetry contributor satisfies the public contributor contract",
+		source: [
+			'import { CacheTelemetryCollector, type TelemetryContributor, type CacheTelemetryHeaderPayload, type CacheTelemetryLogPayload } from "@apifuse/provider-sdk";',
+			"export const cache: TelemetryContributor<CacheTelemetryLogPayload, CacheTelemetryHeaderPayload> = new CacheTelemetryCollector();",
+		].join("\n"),
+	},
+	{
+		filename: "negative-control-state-telemetry-free-text.ts",
+		expectedCode: "TS2322",
+		description: "state gateway telemetry rejects raw state-key samples",
+		source: [
+			'import type { TelemetryContributor } from "@apifuse/provider-sdk";',
+			"const bad: TelemetryContributor<{}, { key: string }> = {",
+			'\tkey: "state",',
+			"\ttoLogPayload: () => ({}),",
+			'\ttoHeaderPayload: () => ({ key: "raw" }),',
+			"};",
+		].join("\n"),
+	},
+	{
+		filename: "positive-control-state-telemetry-contributor.ts",
+		expectedCode: "",
+		description: "state telemetry contributor satisfies the public contributor contract",
+		source: [
+			'import { StateTelemetryCollector, type TelemetryContributor, type StateTelemetryHeaderPayload, type StateTelemetryLogPayload } from "@apifuse/provider-sdk";',
+			"export const state: TelemetryContributor<StateTelemetryLogPayload, StateTelemetryHeaderPayload> = new StateTelemetryCollector();",
+		].join("\n"),
+	},
 ] as const;
 
+assertTelemetryContributorControls();
+
+function assertTelemetryContributorControls(): void {
+	const requestTelemetry = readFileSync(join(sdkRoot, "src/runtime/request-telemetry.ts"), "utf8");
+	const priorityMatch = requestTelemetry.match(
+		/const HEADER_PRIORITY = \[([\s\S]*?)\] as const satisfies/,
+	);
+	if (!priorityMatch) throw new Error("Could not read request telemetry header priority list");
+
+	const priority = [...priorityMatch[1].matchAll(/"([a-z]+)"/g)].map((match) => match[1]);
+	const shipped = priority.filter((name) =>
+		existsSync(join(sdkRoot, "src/runtime", `${name}-telemetry.ts`)),
+	);
+	const missing: string[] = [];
+	for (const name of shipped) {
+		const hasPositive = NEGATIVE_CONTROLS.some(
+			({ filename }) => filename === `positive-control-${name}-telemetry-contributor.ts`,
+		);
+		const hasNegative = NEGATIVE_CONTROLS.some(({ filename }) =>
+			filename.startsWith(`negative-control-${name}-telemetry-`),
+		);
+		if (!hasNegative || !hasPositive) {
+			missing.push(
+				`${name} (${hasNegative ? "negative" : "missing negative"}, ${hasPositive ? "positive" : "missing positive"})`,
+			);
+		}
+	}
+	if (missing.length > 0) {
+		throw new Error(`Missing telemetry contributor pack controls: ${missing.join(", ")}`);
+	}
+}
+
 const tempRoot = mkdtempSync(join(tmpdir(), "apifuse-provider-sdk-pack-types-"));
 const packDir = join(tempRoot, "pack");
 const consumerDir = join(tempRoot, "consumer");