@apifuse/provider-sdk 2.2.0-beta.25 → 2.2.0-beta.27

package/dist/runtime/stealth.js

@@ -1,13 +1,12 @@
 import { createHash } from "node:crypto";
-import { Impit } from "impit";
 import { Cookie, CookieJar as ToughCookieJar } from "tough-cookie";
 import { DEFAULT_SMARTPROXY_POOL_SIZE, invalidateProxyResolutionCacheAsync, ProxyResolutionError, policyResolvesRegistryVendorChain, resolvePolicyProxyPoolSpan, resolvePolicyTransportAttemptCap, resolveProxyConfigAsync, vendorFromResolvedSource, } from "../config/loader.js";
 import { SDKError, StealthCookieStoreVersionError, TransportError } from "../errors.js";
 import { getStealthProfile } from "../stealth/profiles.js";
 import { createProxyAuthIpDeniedError, createProxyEdgeAuthRejectedError, createProxyEdgeTlsRejectedError, createProxyPoolExhaustedError, createProxyPoolStaleError, isProxyAuthIpDeniedMessage, isProxyEdgeAuthRejectedMessage, isProxyEdgeTlsRejectedResponse, isProxyPoolRefreshableError, isProxyPoolStaleMessage, isProxyPoolStaleStatus, PROXY_EDGE_AUTH_REJECTED_CODE, PROXY_POOL_STALE_CODE, } from "./proxy-errors.js";
 import { computeProxyAttemptIndex, computeProxyTransportRetryDelayMs, createDefaultProxyTransportRetryOptions, normalizeProxyTransportRetryOptions, shouldRetryProxyTransportAttempt, validateUnsafeProxyTransportRetryMethods, } from "./proxy-retry-policy.js";
-import { evaluateRedirectHop, isRedirectStatus, resolveRedirectUrl, } from "./redirects.js";
-import { isSensitiveKey, redactSensitiveError, redactSensitiveRequestError, redactSensitiveText, redactUrlQueryParams, normalizeSensitiveParams, serializeRequestUrl, } from "./request-options.js";
+import { evaluateRedirectHop, isRedirectStatus, nextRedirectMethod, resolveRedirectUrl, } from "./redirects.js";
+import { isSensitiveKey, normalizeSensitiveParams, redactSensitiveError, redactSensitiveRequestError, redactSensitiveText, redactUrlQueryParams, serializeRequestUrl, } from "./request-options.js";
 const DEFAULT_PROFILE = "chrome-146";
 const MISSING_PROXY_WARNING = "[provider-sdk] Provider requested proxy routing, but no proxy URL was configured. Continuing without proxy.";
 const MAX_POLICY_PROXY_POOL_REFRESHES = 1;
@@ -16,6 +15,13 @@ const PROXY_CONNECT_FAILURE_BODY_PATTERN = /\bproxy\b.*\b(non[\s-]?200|connect|t
 const PROXY_AUTH_DIAGNOSTIC_URL = "http://example.com/";
 const PROXY_AUTH_DIAGNOSTIC_TIMEOUT_MS = 5_000;
 const STEALTH_PROXY_TRANSPORT_RETRY_ERROR_CODES = [PROXY_CONNECT_FAILURE_CODE];
+const MAX_STEALTH_REDIRECT_HOPS = 10;
+const REDIRECT_BODY_HEADERS = new Set([
+    "content-encoding",
+    "content-language",
+    "content-location",
+    "content-type",
+]);
 function sensitiveQueryParamNames(url) {
     const queryStart = url.indexOf("?");
     if (queryStart === -1)
@@ -37,25 +43,6 @@ const REMOVED_CHROME_PROFILE_NAMES = new Set([
     "chrome-130-psk",
     "edge-131",
 ]);
-const CHROME_IMPIT_BY_MAJOR = {
-    100: "chrome100",
-    101: "chrome101",
-    104: "chrome104",
-    107: "chrome107",
-    110: "chrome110",
-    116: "chrome116",
-    124: "chrome124",
-    125: "chrome125",
-    131: "chrome131",
-    136: "chrome136",
-    142: "chrome142",
-};
-const FIREFOX_IMPIT_BY_MAJOR = {
-    128: "firefox128",
-    133: "firefox133",
-    135: "firefox135",
-    144: "firefox144",
-};
 function isRecord(value) {
     return typeof value === "object" && value !== null;
 }
@@ -182,47 +169,93 @@ class CookieJarImpl {
         });
     }
 }
-function closestImpitBrowser(major, candidates) {
-    let closestMajor;
-    let closestBrowser;
-    for (const [candidateMajorText, browser] of Object.entries(candidates)) {
-        const candidateMajor = Number(candidateMajorText);
-        if (closestMajor === undefined ||
-            Math.abs(candidateMajor - major) < Math.abs(closestMajor - major)) {
-            closestMajor = candidateMajor;
-            closestBrowser = browser;
+let wreqModulePromise;
+function getWreqModule() {
+    if (!wreqModulePromise) {
+        wreqModulePromise = import("wreq-js").catch((error) => {
+            throw new SDKError(`Stealth transport is unavailable on ${process.platform}-${process.arch}: the wreq-js native binary could not be loaded.`, {
+                code: "stealth_transport_unavailable",
+                cause: error instanceof Error ? error : undefined,
+            });
+        });
+    }
+    return wreqModulePromise;
+}
+function parseProfileIdentifier(identifier) {
+    const match = /^(safari_ios|safari_ipad|firefox_android|firefox_private|chrome|edge|firefox|opera|safari|okhttp)_(\d+(?:[._]\d+)*)$/.exec(identifier.toLowerCase());
+    if (!match?.[1] || !match[2])
+        return null;
+    return {
+        family: match[1],
+        version: match[2].split(/[._]/).map(Number),
+    };
+}
+function compareVersionDistance(target, left, right) {
+    const width = Math.max(target.length, left.length, right.length);
+    for (let index = 0; index < width; index += 1) {
+        const targetPart = target[index] ?? 0;
+        const leftDistance = Math.abs((left[index] ?? 0) - targetPart);
+        const rightDistance = Math.abs((right[index] ?? 0) - targetPart);
+        if (leftDistance !== rightDistance)
+            return leftDistance - rightDistance;
+    }
+    return 0;
+}
+function closestWreqProfile(identifier, wreqProfiles) {
+    const requested = parseProfileIdentifier(identifier);
+    if (!requested)
+        return undefined;
+    let closest;
+    for (const candidateName of wreqProfiles) {
+        const candidate = parseProfileIdentifier(candidateName);
+        if (!candidate || candidate.family !== requested.family)
+            continue;
+        if (!closest ||
+            compareVersionDistance(requested.version, candidate.version, closest.version) < 0) {
+            closest = { name: candidateName, version: candidate.version };
         }
     }
-    return closestBrowser ?? "chrome142";
+    return closest?.name;
+}
+function resolveDefaultWreqProfileMapping() {
+    let profile;
+    try {
+        profile = getStealthProfile(DEFAULT_PROFILE);
+    }
+    catch (error) {
+        throw new SDKError(`Default stealth profile "${DEFAULT_PROFILE}" cannot be mapped to a wreq-js browser profile.`, { cause: error instanceof Error ? error : undefined });
+    }
+    const identifier = profile.tlsClientIdentifier?.toLowerCase() ?? "";
+    if (!parseProfileIdentifier(identifier)) {
+        throw new SDKError(`Default stealth profile "${DEFAULT_PROFILE}" cannot be mapped to a wreq-js browser profile.`);
+    }
+    return { identifier, os: profile.platform };
 }
-function resolveImpitBrowser(profileName) {
+const DEFAULT_WREQ_PROFILE_MAPPING = resolveDefaultWreqProfileMapping();
+export function resolveWreqProfile(profileName, wreqProfiles) {
     if (REMOVED_CHROME_PROFILE_NAMES.has(profileName)) {
         throw new SDKError(`Unknown stealth profile: ${profileName}`);
     }
-    let profile;
+    let identifier;
+    let os;
     try {
-        profile = getStealthProfile(profileName);
+        const profile = getStealthProfile(profileName);
+        identifier = profile.tlsClientIdentifier?.toLowerCase() ?? "";
+        os = profile.platform;
     }
     catch {
         // Preserve the previous ctx.stealth.fetch() compatibility behavior: unknown
         // profile strings still run with the transport default instead of failing
         // before the request starts. Removed built-in profile aliases above remain
         // explicit errors so callers do not accidentally pin retired fingerprints.
-        return "chrome142";
-    }
-    const identifier = profile.tlsClientIdentifier?.toLowerCase() ?? "";
-    const chromeMatch = /^(?:chrome|edge)_(\d+)/.exec(identifier);
-    if (chromeMatch?.[1]) {
-        return closestImpitBrowser(Number(chromeMatch[1]), CHROME_IMPIT_BY_MAJOR);
+        identifier = DEFAULT_WREQ_PROFILE_MAPPING.identifier;
+        os = DEFAULT_WREQ_PROFILE_MAPPING.os;
     }
-    const firefoxMatch = /^firefox_(\d+)/.exec(identifier);
-    if (firefoxMatch?.[1]) {
-        return closestImpitBrowser(Number(firefoxMatch[1]), FIREFOX_IMPIT_BY_MAJOR);
+    const browser = closestWreqProfile(identifier, wreqProfiles);
+    if (!browser) {
+        throw new SDKError(`Stealth profile "${profileName}" cannot be mapped to a wreq-js browser profile.`);
     }
-    if (identifier.startsWith("safari_")) {
-        throw new SDKError(`Stealth profile "${profileName}" uses a Safari stealth fingerprint, but TypeScript ctx.stealth uses impit which currently supports Chrome, Firefox, and OkHttp profiles only. Use a Chrome/Firefox stealth profile for ctx.stealth or ctx.browser for Safari-specific behavior.`);
-    }
-    throw new SDKError(`Stealth profile "${profileName}" cannot be mapped to an impit browser profile.`);
+    return { browser, os };
 }
 function resolveUrl(baseUrl, url) {
     return new URL(url, baseUrl).toString();
@@ -242,18 +275,6 @@ function normalizeHeaders(headers) {
 function hasOwn(object, key) {
     return Object.hasOwn(object, key);
 }
-function toImpitCookieJar(cookieJar) {
-    return {
-        setCookie(cookie, url, cb) {
-            cookieJar.setFromCookieStrings([cookie], url);
-            if (typeof cb === "function")
-                cb();
-        },
-        getCookieString(url) {
-            return cookieJar.toHeader(url);
-        },
-    };
-}
 function assertNoUnsupportedFingerprintOverrides(options) {
     if (!isRecord(options))
         return;
@@ -267,7 +288,7 @@ function assertNoUnsupportedFingerprintOverrides(options) {
         unsupported.push("stealth.h2");
     if (unsupported.length === 0)
         return;
-    throw new SDKError(`ctx.stealth.fetch uses impit-managed browser fingerprints and no longer accepts low-level stealth overrides: ${unsupported.join(", ")}. Use the profile option instead.`);
+    throw new SDKError(`ctx.stealth.fetch uses transport-managed browser fingerprints and no longer accepts low-level stealth overrides: ${unsupported.join(", ")}. Use the profile option instead.`);
 }
 function responseHeadersToRecord(headers) {
     const record = {};
@@ -348,23 +369,10 @@ function declaredContentLength(headers) {
     const parsed = Number(contentLength);
     return Number.isFinite(parsed) ? parsed : undefined;
 }
-function abortTransportResponse(response) {
-    if (!response.abort)
-        return false;
-    try {
-        response.abort();
-    }
-    catch {
-        // The size error remains the primary failure if impit has already closed the response.
-    }
-    return true;
-}
 async function readResponseBodyWithLimit(response, maxBodyBytes) {
     const contentLength = declaredContentLength(response.headers);
     if (contentLength !== undefined && contentLength > maxBodyBytes) {
-        if (!abortTransportResponse(response)) {
-            await response.body?.cancel().catch(() => undefined);
-        }
+        await response.body?.cancel().catch(() => undefined);
         throw responseTooLargeError(maxBodyBytes, contentLength);
     }
     if (!response.body) {
@@ -382,10 +390,11 @@ async function readResponseBodyWithLimit(response, maxBodyBytes) {
             const { done, value } = await reader.read();
             if (done)
                 break;
+            if (!value)
+                continue;
             receivedBytes += value.byteLength;
             if (receivedBytes > maxBodyBytes) {
                 await reader.cancel().catch(() => undefined);
-                abortTransportResponse(response);
                 throw responseTooLargeError(maxBodyBytes, receivedBytes);
             }
             chunks.push(value);
@@ -566,31 +575,138 @@ function locationHeader(headers) {
     }
     return undefined;
 }
+function withoutRedirectBodyHeaders(headers) {
+    return Object.fromEntries(Object.entries(headers).filter(([name]) => !REDIRECT_BODY_HEADERS.has(name.toLowerCase())));
+}
+function assertStealthRedirectUrl(url) {
+    const protocol = new URL(url).protocol;
+    if (protocol !== "http:" && protocol !== "https:") {
+        throw new TransportError(`Stealth redirect target scheme "${protocol}" is not allowed`, {
+            code: "transport_invalid_url",
+            status: 0,
+        });
+    }
+}
+function discardStealthRedirectBody(response) {
+    try {
+        const cancellation = response.body?.cancel();
+        if (cancellation)
+            void cancellation.catch(() => undefined);
+    }
+    catch {
+        // Redirect handling is decided from status and headers. A cancellation
+        // failure must not replace or delay that decision.
+    }
+}
+async function fetchStealthRedirectChain(transport, cookieJar, requestUrl, method, options) {
+    let currentUrl = requestUrl;
+    let currentMethod = method;
+    let currentBody = options.body === undefined ? undefined : normalizeBody(options.body);
+    let currentHeaders = { ...(options.headers ?? {}) };
+    let followedHops = 0;
+    let response;
+    const deadline = options.timeout ? performance.now() + options.timeout : undefined;
+    while (true) {
+        const headers = { ...currentHeaders };
+        if (!hasHeader(headers, "Cookie")) {
+            const cookieHeader = cookieJar.toHeader(currentUrl);
+            if (cookieHeader)
+                headers.Cookie = cookieHeader;
+        }
+        const requestInit = {
+            headers: normalizeHeaders(headers),
+            method: currentMethod,
+            redirect: "manual",
+        };
+        if (currentBody !== undefined)
+            requestInit.body = currentBody;
+        await transport.clearCookies();
+        const remainingTimeout = deadline === undefined ? undefined : Math.ceil(deadline - performance.now());
+        if (remainingTimeout !== undefined && remainingTimeout <= 0) {
+            throw new TransportError("Request timed out", {
+                code: "transport_timeout",
+                status: 0,
+            });
+        }
+        if (remainingTimeout !== undefined)
+            requestInit.timeout = remainingTimeout;
+        response = await transport.fetch(currentUrl, requestInit);
+        cookieJar.setFromCookieStrings(setCookieHeadersFromResponse(response.headers), response.url ?? currentUrl);
+        if (!isRedirectStatus(response.status) || options.redirect === "manual")
+            break;
+        if (options.redirect === "error") {
+            discardStealthRedirectBody(response);
+            throw new TransportError("Stealth request encountered a redirect", {
+                code: "transport_network_error",
+                status: 0,
+            });
+        }
+        const nextUrl = resolveRedirectUrl(response.headers.get("location") ?? undefined, response.url ?? currentUrl);
+        if (!nextUrl)
+            break;
+        if (followedHops >= MAX_STEALTH_REDIRECT_HOPS) {
+            discardStealthRedirectBody(response);
+            throw new TransportError(`Stealth request exceeded the ${MAX_STEALTH_REDIRECT_HOPS}-redirect limit`, { code: "transport_network_error", status: 0 });
+        }
+        assertStealthRedirectUrl(nextUrl);
+        discardStealthRedirectBody(response);
+        const nextMethod = nextRedirectMethod(response.status, currentMethod);
+        if (nextMethod !== currentMethod) {
+            currentBody = undefined;
+            currentHeaders = withoutRedirectBodyHeaders(currentHeaders);
+        }
+        currentMethod = nextMethod;
+        currentUrl = nextUrl;
+        followedHops += 1;
+    }
+    const normalized = await normalizeResponse(response, currentUrl, options.maxBodyBytes);
+    if (followedHops > 0)
+        normalized.redirected = true;
+    return { normalized, response };
+}
 function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
     const clients = new Map();
     let closed = false;
     let hasWarnedMissingProxy = false;
     const warn = clientOptions.warn ?? console.warn;
     const cookieJar = new CookieJarImpl([], baseUrl);
-    const impitCookieJar = toImpitCookieJar(cookieJar);
-    function getClient(profileName, proxyUrl, ignoreTlsErrors) {
+    async function getClientEntry(profileName, proxyUrl, ignoreTlsErrors) {
         if (closed) {
             throw new TransportError("Stealth session is closed", { status: 0 });
         }
-        const browser = resolveImpitBrowser(profileName);
+        const wreq = await getWreqModule();
+        const { browser, os } = resolveWreqProfile(profileName, wreq.getProfiles());
         const cacheKey = JSON.stringify({ browser, proxyUrl, ignoreTlsErrors });
-        let client = clients.get(cacheKey);
-        if (!client) {
-            client = new Impit({
-                browser,
-                cookieJar: impitCookieJar,
-                ...(proxyUrl ? { proxyUrl } : {}),
-                ...(ignoreTlsErrors ? { ignoreTlsErrors: true } : {}),
-                timeout: 30_000,
-            });
-            clients.set(cacheKey, client);
+        let entry = clients.get(cacheKey);
+        if (!entry) {
+            entry = {
+                session: wreq.createSession({
+                    browser,
+                    os,
+                    ...(proxyUrl ? { proxy: proxyUrl } : {}),
+                    ...(ignoreTlsErrors ? { insecure: true } : {}),
+                    timeout: 30_000,
+                }),
+                tail: Promise.resolve(),
+            };
+            clients.set(cacheKey, entry);
+        }
+        return entry;
+    }
+    async function withClient(profileName, proxyUrl, ignoreTlsErrors, operation) {
+        const entry = await getClientEntry(profileName, proxyUrl, ignoreTlsErrors);
+        const previous = entry.tail;
+        let release;
+        entry.tail = new Promise((resolve) => {
+            release = resolve;
+        });
+        await previous;
+        try {
+            return await operation(await entry.session);
+        }
+        finally {
+            release();
         }
-        return client;
     }
     async function resolveRequestProxy(options, proxyAttempt, refreshEpoch) {
         const resolvedProxy = await resolveProxyConfigAsync({
@@ -602,7 +718,7 @@ function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
                 proxyAttemptOffset: options?.proxyAttemptOffset,
                 retryAttemptOffset: proxyAttempt,
             }),
-            // The impit stealth transport tunnels both HTTP CONNECT and SOCKS5,
+            // The stealth transport tunnels both HTTP CONNECT and SOCKS5,
             // preserving the client TLS fingerprint end-to-end.
             transportProtocols: ["http", "socks5"],
             ...(refreshEpoch === undefined ? {} : { proxyRefreshEpoch: refreshEpoch }),
@@ -729,24 +845,7 @@ function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
                         const profileName = options.profile ?? defaultProfile;
                         serializedUrl = serializeRequestUrl(resolveUrl(baseUrl, url), options.params, sensitiveParams);
                         const { requestUrl } = serializedUrl;
-                        const headers = { ...(options.headers ?? {}) };
-                        if (!hasHeader(headers, "Cookie")) {
-                            const cookieHeader = cookieJar.toHeader(requestUrl);
-                            if (cookieHeader)
-                                headers.Cookie = cookieHeader;
-                        }
-                        const requestInit = {
-                            headers: normalizeHeaders(headers),
-                            method,
-                            ...(options.redirect ? { redirect: options.redirect } : {}),
-                            ...(options.timeout ? { timeout: options.timeout } : {}),
-                        };
-                        if (options.body !== undefined) {
-                            requestInit.body = normalizeBody(options.body);
-                        }
-                        const response = await getClient(profileName, proxy, ignoreTlsErrors).fetch(requestUrl, requestInit);
-                        const normalized = await normalizeResponse(response, requestUrl, options.maxBodyBytes);
-                        cookieJar.setFromCookieStrings(setCookieHeadersFromResponse(response.headers), response.url ?? requestUrl);
+                        const { normalized, response } = await withClient(profileName, proxy, ignoreTlsErrors, (transport) => fetchStealthRedirectChain(transport, cookieJar, requestUrl, method, options));
                         if (proxy && isProxyConnectFailureResponse(response, normalized.body)) {
                             throw createProxyConnectFailureError(normalized.body);
                         }
@@ -1043,18 +1142,29 @@ function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
         },
         close() {
             closed = true;
+            for (const client of clients.values()) {
+                void client.session
+                    .then((session) => session.close())
+                    .catch((error) => {
+                    const message = error instanceof Error ? error.message : String(error);
+                    warn(`[provider-sdk] Failed to close stealth transport session: ${message}`);
+                });
+            }
             clients.clear();
         },
     };
     return session;
     async function classifyProxyAuthDiagnostic(profileName, proxy) {
         try {
-            const response = await getClient(profileName, proxy, false).fetch(PROXY_AUTH_DIAGNOSTIC_URL, {
-                method: "GET",
-                timeout: PROXY_AUTH_DIAGNOSTIC_TIMEOUT_MS,
+            return await withClient(profileName, proxy, false, async (client) => {
+                await client.clearCookies();
+                const response = await client.fetch(PROXY_AUTH_DIAGNOSTIC_URL, {
+                    method: "GET",
+                    timeout: PROXY_AUTH_DIAGNOSTIC_TIMEOUT_MS,
+                });
+                const normalized = await normalizeResponse(response);
+                return classifyProxyAuthDiagnosticMessage(normalized.body);
             });
-            const normalized = await normalizeResponse(response);
-            return classifyProxyAuthDiagnosticMessage(normalized.body);
         }
         catch (error) {
             const message = error instanceof Error

package/dist/server/serve.js

@@ -3,6 +3,7 @@ import { join } from "node:path";
 import { Hono } from "hono";
 import { z } from "zod";
 import { AuthAbortError, createAuthFlowHelpers } from "../auth.js";
+import { validateFailClosedDeclaration } from "../declaration-validation.js";
 import { SDK_OWNED_PROVIDER_ERROR_CODES, SDK_RUNTIME_OWNED_ERROR_CODES, SDK_STATUS_MAPPED_PROVIDER_ERROR_CODES, } from "../error-resolution.js";
 import { AuthError, isProviderError, isSessionExpiredError, isTransportError, isValidationError, ProviderError, } from "../errors.js";
 import { loadProviderLocaleCatalogs, localizeAuthTurn, } from "../i18n/catalog.js";
@@ -1298,6 +1299,11 @@ function parseStatefulForwardingEnvelope(rawBody) {
     });
 }
 export function createServerApp(provider, options = {}) {
+    // Fail-closed validation runs here rather than only in serve(): createServerApp
+    // is a public export, so a cast-bypassed declaration would otherwise reach the
+    // request path unvalidated. serve() calls into this function, so validating
+    // here covers both entry points exactly once per app construction.
+    validateFailClosedDeclaration(provider);
     validateStatefulServerConfig(options);
     const app = new Hono();
     const logger = options.logger ?? defaultProviderServerLogger;
@@ -1626,6 +1632,8 @@ const DEFAULT_SHUTDOWN_TIMEOUT_MS = 30_000;
 const DEFAULT_SHUTDOWN_SIGNALS = ["SIGTERM", "SIGINT"];
 const processSignalCoordinators = new Map();
 export async function serve(provider, options = {}) {
+    // Declaration validation happens inside createServerApp (the shared app
+    // construction path), so serve() does not duplicate the call here.
     const bunRuntime = getBunServeRuntime();
     if (bunRuntime === undefined) {
         throw new ProviderError("Bun runtime is required to start the provider server", {

package/dist/stealth/profiles.js

@@ -57,7 +57,7 @@ const FIREFOX_H2_SETTINGS = {
     MAX_HEADER_LIST_SIZE: 65536,
 };
 const SAFARI_H2_SETTINGS = {
-    HEADER_TABLE_SIZE: 4096,
+    // Safari 17 also sends a connection-level WINDOW_UPDATE increment of 10485760.
     ENABLE_PUSH: 0,
     INITIAL_WINDOW_SIZE: 4194304,
     MAX_CONCURRENT_STREAMS: 100,
@@ -162,8 +162,8 @@ const STEALTH_PROFILES = {
     }),
     "firefox-132": createProfile("firefox-132", {
         platform: "macos",
-        version: "132.0",
-        userAgent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0",
+        version: "133.0",
+        userAgent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0",
         tlsClientIdentifier: "firefox_132",
         ja3: FIREFOX_JA3,
         h2Settings: FIREFOX_H2_SETTINGS,
@@ -178,6 +178,15 @@ const STEALTH_PROFILES = {
         h2Settings: SAFARI_H2_SETTINGS,
         headerOrder: SAFARI_HEADER_ORDER,
     }),
+    "safari-17": createProfile("safari-17", {
+        platform: "macos",
+        version: "17.0",
+        userAgent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15",
+        tlsClientIdentifier: "safari_17_0",
+        ja3: SAFARI_JA3,
+        h2Settings: SAFARI_H2_SETTINGS,
+        headerOrder: SAFARI_HEADER_ORDER,
+    }),
     "safari-15": createProfile("safari-15", {
         platform: "macos",
         version: "15.6.1",
@@ -198,8 +207,8 @@ const STEALTH_PROFILES = {
     }),
     "ios-safari-18": createProfile("ios-safari-18", {
         platform: "ios",
-        version: "18.0",
-        userAgent: "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Mobile/15E148 Safari/604.1",
+        version: "18.1.1",
+        userAgent: "Mozilla/5.0 (iPhone; CPU iPhone OS 18_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1.1 Mobile/15E148 Safari/604.1",
         tlsClientIdentifier: "safari_ios_18_0",
         ja3: SAFARI_JA3,
         h2Settings: SAFARI_H2_SETTINGS,
@@ -207,8 +216,8 @@ const STEALTH_PROFILES = {
     }),
     "ios-safari-17": createProfile("ios-safari-17", {
         platform: "ios",
-        version: "17.0",
-        userAgent: "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1",
+        version: "17.2",
+        userAgent: "Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Mobile/15E148 Safari/604.1",
         tlsClientIdentifier: "safari_ios_17_0",
         ja3: SAFARI_JA3,
         h2Settings: SAFARI_H2_SETTINGS,

package/dist/types.d.ts

@@ -298,9 +298,27 @@ export type ProviderChallenge = {
 } | {
     readonly kind: "aws_waf";
     readonly pageUrl: string;
+    /** `window.gokuProps.key`; solver vendors require it, while `"browser"` does not. */
+    readonly siteKey?: string;
     readonly captchaScript?: string;
     readonly context?: string;
     readonly iv?: string;
+} | {
+    readonly kind: "akamai_sec_cpt";
+    readonly pageUrl: string;
+    /** The admitted challenge document, needed for tile/context extraction. */
+    readonly challengeHtml?: string;
+} | {
+    readonly kind: "akamai_sensor";
+    readonly pageUrl: string;
+    /** Upstream sensor script URL the payload must be POSTed to. */
+    readonly scriptUrl: string;
+    /** Current `_abck` cookie value, rotates each round. */
+    readonly abck?: string;
+    /** Current `bm_sz` / `ak_bmsc` value when the upstream set one. */
+    readonly bmsz?: string;
+    /** Bot Manager major version when known ("3" measured on zozo.jp). */
+    readonly version?: string;
 };
 export type ProviderChallengeKind = ProviderChallenge["kind"];
 /**
@@ -317,12 +335,21 @@ export type ChallengeSolution = {
     readonly form: "cookies";
     readonly cookies: Readonly<Record<string, string>>;
     readonly userAgent: string;
+    /** Epoch seconds copied from the upstream cookie's own expiry attribute; never a constant. */
+    readonly expires?: number;
 };
 export interface ProviderResolverConfig {
     /** Ordered vendor fallback chain, tried first to last. */
     readonly vendors: readonly ProviderResolverVendor[];
     /** Challenge kinds this provider is permitted to request. */
     readonly kinds: readonly ProviderChallengeKind[];
+    /**
+     * Client fingerprint profile the SDK must use when reaching this upstream.
+     * Measured on zozo.jp: Chrome/Firefox profiles are refused 403 before any
+     * challenge is served, while a Safari profile is admitted. Provider-declared
+     * because only the provider knows its upstream's admission rule.
+     */
+    readonly clientProfile?: string;
 }
 export type SttAudioInput = {
     kind: "base64";
@@ -534,7 +561,13 @@ export interface HealthJourneyDefinition {
     requiredSecrets?: readonly string[];
     manualTrigger?: HealthJourneyManualTriggerPolicy;
     steps: readonly [HealthJourneyStep, ...HealthJourneyStep[]];
-    run?: (ctx: HealthJourneyRunContext) => Promise<HealthJourneyRunResult | undefined>;
+    /**
+     * Required: a journey always declares `coversOperations`, and the health
+     * monitor reports a run-less journey as `journey_run_missing`. Declaration
+     * validation rejects a missing `run` (`health-journey-executable`), so this
+     * is typed required to fail at compile time rather than at boot.
+     */
+    run: (ctx: HealthJourneyRunContext) => Promise<HealthJourneyRunResult | undefined>;
 }
 /**
  * Health-check authoring surface owned by `@apifuse/provider-sdk`.

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "2.2.0-beta.25",
+	"version": "2.2.0-beta.27",
 	"name": "@apifuse/provider-sdk",
 	"private": false,
 	"type": "module",
@@ -106,7 +106,6 @@
 		"acorn": "^8.17.0",
 		"ajv": "^8.17",
 		"hono": "^4.12.25",
-		"impit": "0.14.1",
 		"ioredis": "^5.11.1",
 		"ms": "^2.1.3",
 		"playwright": "^1.55.1",
@@ -116,6 +115,7 @@
 		"safe-regex": "^2.1",
 		"socks": "^2.8.9",
 		"tough-cookie": "^6.0.2",
+		"wreq-js": "3.0.0",
 		"zod": "^4.4.3"
 	},
 	"repository": {