@apifuse/provider-sdk 2.2.0-beta.24 → 2.2.0-beta.26

package/src/server/serve.ts

@@ -4,6 +4,7 @@ import { join } from "node:path";
 import { Hono } from "hono";
 import { z } from "zod";
 import { AuthAbortError, createAuthFlowHelpers } from "../auth.js";
+import { validateFailClosedDeclaration } from "../declaration-validation.js";
 import {
 	SDK_OWNED_PROVIDER_ERROR_CODES,
 	SDK_RUNTIME_OWNED_ERROR_CODES,
@@ -1840,6 +1841,11 @@ export function createServerApp(
 	provider: ProviderDefinition,
 	options: ProviderServerOptions = {},
 ): Hono {
+	// Fail-closed validation runs here rather than only in serve(): createServerApp
+	// is a public export, so a cast-bypassed declaration would otherwise reach the
+	// request path unvalidated. serve() calls into this function, so validating
+	// here covers both entry points exactly once per app construction.
+	validateFailClosedDeclaration(provider);
 	validateStatefulServerConfig(options);
 	const app = new Hono();
 	const logger = options.logger ?? defaultProviderServerLogger;
@@ -2439,6 +2445,8 @@ export async function serve(
 	provider: ProviderDefinition,
 	options: ServeOptions = {},
 ): Promise<ProviderServerHandle> {
+	// Declaration validation happens inside createServerApp (the shared app
+	// construction path), so serve() does not duplicate the call here.
 	const bunRuntime = getBunServeRuntime();
 
 	if (bunRuntime === undefined) {

package/src/stealth/profiles.ts

@@ -68,7 +68,7 @@ const FIREFOX_H2_SETTINGS = {
 };
 
 const SAFARI_H2_SETTINGS = {
-	HEADER_TABLE_SIZE: 4096,
+	// Safari 17 also sends a connection-level WINDOW_UPDATE increment of 10485760.
 	ENABLE_PUSH: 0,
 	INITIAL_WINDOW_SIZE: 4194304,
 	MAX_CONCURRENT_STREAMS: 100,
@@ -192,9 +192,9 @@ const STEALTH_PROFILES: Record<string, StealthProfile> = {
 	}),
 	"firefox-132": createProfile("firefox-132", {
 		platform: "macos",
-		version: "132.0",
+		version: "133.0",
 		userAgent:
-			"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0",
+			"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0",
 		tlsClientIdentifier: "firefox_132",
 		ja3: FIREFOX_JA3,
 		h2Settings: FIREFOX_H2_SETTINGS,
@@ -210,6 +210,16 @@ const STEALTH_PROFILES: Record<string, StealthProfile> = {
 		h2Settings: SAFARI_H2_SETTINGS,
 		headerOrder: SAFARI_HEADER_ORDER,
 	}),
+	"safari-17": createProfile("safari-17", {
+		platform: "macos",
+		version: "17.0",
+		userAgent:
+			"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15",
+		tlsClientIdentifier: "safari_17_0",
+		ja3: SAFARI_JA3,
+		h2Settings: SAFARI_H2_SETTINGS,
+		headerOrder: SAFARI_HEADER_ORDER,
+	}),
 	"safari-15": createProfile("safari-15", {
 		platform: "macos",
 		version: "15.6.1",
@@ -232,9 +242,9 @@ const STEALTH_PROFILES: Record<string, StealthProfile> = {
 	}),
 	"ios-safari-18": createProfile("ios-safari-18", {
 		platform: "ios",
-		version: "18.0",
+		version: "18.1.1",
 		userAgent:
-			"Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Mobile/15E148 Safari/604.1",
+			"Mozilla/5.0 (iPhone; CPU iPhone OS 18_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1.1 Mobile/15E148 Safari/604.1",
 		tlsClientIdentifier: "safari_ios_18_0",
 		ja3: SAFARI_JA3,
 		h2Settings: SAFARI_H2_SETTINGS,
@@ -242,9 +252,9 @@ const STEALTH_PROFILES: Record<string, StealthProfile> = {
 	}),
 	"ios-safari-17": createProfile("ios-safari-17", {
 		platform: "ios",
-		version: "17.0",
+		version: "17.2",
 		userAgent:
-			"Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1",
+			"Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Mobile/15E148 Safari/604.1",
 		tlsClientIdentifier: "safari_ios_17_0",
 		ja3: SAFARI_JA3,
 		h2Settings: SAFARI_H2_SETTINGS,

package/src/types.ts

@@ -366,9 +366,29 @@ export type ProviderChallenge =
 	| {
 			readonly kind: "aws_waf";
 			readonly pageUrl: string;
+			/** `window.gokuProps.key`; solver vendors require it, while `"browser"` does not. */
+			readonly siteKey?: string;
 			readonly captchaScript?: string;
 			readonly context?: string;
 			readonly iv?: string;
+		}
+	| {
+			readonly kind: "akamai_sec_cpt";
+			readonly pageUrl: string;
+			/** The admitted challenge document, needed for tile/context extraction. */
+			readonly challengeHtml?: string;
+		}
+	| {
+			readonly kind: "akamai_sensor";
+			readonly pageUrl: string;
+			/** Upstream sensor script URL the payload must be POSTed to. */
+			readonly scriptUrl: string;
+			/** Current `_abck` cookie value, rotates each round. */
+			readonly abck?: string;
+			/** Current `bm_sz` / `ak_bmsc` value when the upstream set one. */
+			readonly bmsz?: string;
+			/** Bot Manager major version when known ("3" measured on zozo.jp). */
+			readonly version?: string;
 		};
 
 export type ProviderChallengeKind = ProviderChallenge["kind"];
@@ -386,6 +406,8 @@ export type ChallengeSolution =
 			readonly form: "cookies";
 			readonly cookies: Readonly<Record<string, string>>;
 			readonly userAgent: string;
+			/** Epoch seconds copied from the upstream cookie's own expiry attribute; never a constant. */
+			readonly expires?: number;
 		};
 
 export interface ProviderResolverConfig {
@@ -393,6 +415,13 @@ export interface ProviderResolverConfig {
 	readonly vendors: readonly ProviderResolverVendor[];
 	/** Challenge kinds this provider is permitted to request. */
 	readonly kinds: readonly ProviderChallengeKind[];
+	/**
+	 * Client fingerprint profile the SDK must use when reaching this upstream.
+	 * Measured on zozo.jp: Chrome/Firefox profiles are refused 403 before any
+	 * challenge is served, while a Safari profile is admitted. Provider-declared
+	 * because only the provider knows its upstream's admission rule.
+	 */
+	readonly clientProfile?: string;
 }
 
 export type SttAudioInput = {
@@ -628,9 +657,13 @@ export interface HealthJourneyDefinition {
 	requiredSecrets?: readonly string[];
 	manualTrigger?: HealthJourneyManualTriggerPolicy;
 	steps: readonly [HealthJourneyStep, ...HealthJourneyStep[]];
-	run?: (
-		ctx: HealthJourneyRunContext,
-	) => Promise<HealthJourneyRunResult | undefined>;
+	/**
+	 * Required: a journey always declares `coversOperations`, and the health
+	 * monitor reports a run-less journey as `journey_run_missing`. Declaration
+	 * validation rejects a missing `run` (`health-journey-executable`), so this
+	 * is typed required to fail at compile time rather than at boot.
+	 */
+	run: (ctx: HealthJourneyRunContext) => Promise<HealthJourneyRunResult | undefined>;
 }
 
 /**
@@ -1615,9 +1648,9 @@ export interface NativeProviderConfig {
 
 export interface ProviderCacheKeyOptions {
 	/**
-	 * Additional field names to omit from stable key material. The SDK always
-	 * omits known secret-bearing names such as serviceKey, authorization,
-	 * cookie, token, password, and secret.
+	 * Additional field names whose values are hashed in stable key material. The
+	 * SDK always hashes values under known secret-bearing names such as serviceKey,
+	 * authorization, cookie, token, password, and secret.
 	 */
 	redactFields?: string[];
 }