@apifuse/provider-sdk 2.2.0-beta.27 → 2.2.0-beta.29

package/dist/runtime/resolver.js

@@ -1,16 +1,17 @@
 import { createHash } from "node:crypto";
+import { resolveProxyConfigAsync, } from "../config/loader.js";
 import { ProviderError } from "../errors.js";
+import { getStealthProfile } from "../stealth/profiles.js";
 import { resolverChallengeAllowsDirectCache, resolverChallengeIsCacheable, resolverChallengeIsIdentityScoped, resolverChallengeIssuingIdentity, } from "./resolver-vendors/bindings.js";
 import { createBrowserResolverVendorAdapter } from "./resolver-vendors/browser.js";
 import { assertResolverHostAllowed } from "./resolver-vendors/hosts.js";
 import { createTwoCaptchaResolverVendorAdapter } from "./resolver-vendors/twocaptcha.js";
 import { RESOLVER_VENDOR_CAPABILITIES, ResolverVendorUnavailableError, resolverVendorSupports, } from "./resolver-vendors/types.js";
-export const APIFUSE__RESOLVER__2CAPTCHA__API_KEY = "APIFUSE__RESOLVER__2CAPTCHA__API_KEY";
-export const APIFUSE__RESOLVER__CAPSOLVER__API_KEY = "APIFUSE__RESOLVER__CAPSOLVER__API_KEY";
-export const APIFUSE__RESOLVER__CAPMONSTER__API_KEY = "APIFUSE__RESOLVER__CAPMONSTER__API_KEY";
-export const APIFUSE__RESOLVER__TIMEOUT_MS = "APIFUSE__RESOLVER__TIMEOUT_MS";
-export const APIFUSE__CDP_POOL__URL = "APIFUSE__CDP_POOL__URL";
-export const DEFAULT_RESOLVER_TIMEOUT_MS = 180_000;
+import { createUnsupportedResolverClient, RESOLVER_INSTRUMENTATION_METADATA, } from "./resolver-shared.js";
+import { APIFUSE__CDP_POOL__URL, APIFUSE__RESOLVER__2CAPTCHA__API_KEY, APIFUSE__RESOLVER__CAPMONSTER__API_KEY, APIFUSE__RESOLVER__CAPSOLVER__API_KEY, APIFUSE__RESOLVER__TIMEOUT_MS, DEFAULT_RESOLVER_TIMEOUT_MS, } from "./resolver-config.js";
+import { DEFAULT_PROFILE } from "./stealth.js";
+export { createUnsupportedResolverClient, RESOLVER_INSTRUMENTATION_METADATA, } from "./resolver-shared.js";
+export { APIFUSE__CDP_POOL__URL, APIFUSE__RESOLVER__2CAPTCHA__API_KEY, APIFUSE__RESOLVER__CAPMONSTER__API_KEY, APIFUSE__RESOLVER__CAPSOLVER__API_KEY, APIFUSE__RESOLVER__TIMEOUT_MS, DEFAULT_RESOLVER_TIMEOUT_MS, } from "./resolver-config.js";
 const RESOLVER_SOLUTION_CACHE_NAMESPACE = "resolver-solution";
 const RESOLVER_SOLUTION_INDEX_CACHE_NAMESPACE = "resolver-solution-index";
 const MIN_RESOLVER_CACHE_TTL_MS = 1_000;
@@ -52,7 +53,6 @@ const SAFE_CAUSE_MESSAGE_WORDS = new Set([
     "while",
     "writing",
 ]);
-export const RESOLVER_INSTRUMENTATION_METADATA = Symbol.for("@apifuse/provider-sdk/runtime/resolver-instrumentation-metadata");
 const resolverAdapterRegistry = {
     "2captcha"(configuration, timeoutMs, allowedHosts) {
         return createTwoCaptchaResolverVendorAdapter({
@@ -87,6 +87,20 @@ export function swapResolverAdapterFactoryForTests(vendor, factory) {
             resolverAdapterRegistry[vendor] = original;
     };
 }
+let resolveDefaultResolverUserAgent = () => getStealthProfile(DEFAULT_PROFILE).userAgent;
+/** Internal test seam; deliberately not re-exported from the package root. */
+export function swapResolverDefaultUserAgentForTests(resolver) {
+    const original = resolveDefaultResolverUserAgent;
+    resolveDefaultResolverUserAgent =
+        resolver ?? (() => getStealthProfile(DEFAULT_PROFILE).userAgent);
+    let restored = false;
+    return () => {
+        if (restored)
+            return;
+        restored = true;
+        resolveDefaultResolverUserAgent = original;
+    };
+}
 // This is the sole allowlist for declared vendors whose registry entry may be absent.
 // Remove a vendor here when its adapter is registered.
 const KNOWN_UNIMPLEMENTED_RESOLVER_VENDORS = new Set([
@@ -175,6 +189,8 @@ function adapterRequiresTransport(adapter, kind) {
 function sanitizeDiagnosticUrl(rawUrl) {
     try {
         const parsed = new URL(rawUrl);
+        if (parsed.username || parsed.password)
+            return "[REDACTED_PROXY_URL]";
         return `${parsed.protocol}//${parsed.host}`;
     }
     catch {
@@ -190,10 +206,14 @@ function sanitizeCauseMessage(message) {
         .split(/\s+/)
         .filter(Boolean)
         .map((token) => {
-        if (token === "[REDACTED]" || /^[a-z][a-z\d+.-]*:\/\/[^\s]+$/i.test(token))
+        if (token === "[REDACTED]" ||
+            token === "[REDACTED_PROXY_URL]" ||
+            /^[a-z][a-z\d+.-]*:\/\/[^\s]+$/i.test(token))
             return token;
         const word = token.replace(/^[^a-z\d]+|[^a-z\d]+$/gi, "");
-        return word.length > 0 && word.length <= 32 && SAFE_CAUSE_MESSAGE_WORDS.has(word.toLowerCase())
+        return word.length > 0 &&
+            word.length <= 32 &&
+            SAFE_CAUSE_MESSAGE_WORDS.has(word.toLowerCase())
             ? token
             : "[REDACTED]";
     });
@@ -450,6 +470,47 @@ export async function invalidateResolverSolution(resolver, challenge, solution)
         onSuccess: (outcome) => ({ outcome }),
     });
 }
+async function resolveResolverIdentity(proxyIntent) {
+    const userAgentSource = proxyIntent.userAgent ? "declared" : "defaulted";
+    let proxyUrl;
+    try {
+        const resolved = await resolveProxyConfigAsync({
+            upstream: proxyIntent.upstream,
+            affinityKey: proxyIntent.affinityKey,
+            telemetry: proxyIntent.telemetry
+                ? {
+                    ...proxyIntent.telemetry,
+                    recordProxyResolution(event) {
+                        proxyIntent.telemetry?.recordProxyResolution({
+                            ...event,
+                            userAgentSource,
+                        });
+                    },
+                }
+                : undefined,
+        });
+        proxyUrl = resolved.url;
+        if (!proxyUrl)
+            return { unavailableReason: "missing_proxy_identity", userAgentSource };
+    }
+    catch {
+        // Lease failures contain infrastructure detail that must not cross the resolver
+        // boundary. A required policy is classified by the existing fail-closed guard.
+        return { unavailableReason: "missing_proxy_identity", userAgentSource };
+    }
+    try {
+        const userAgent = proxyIntent.userAgent || resolveDefaultResolverUserAgent();
+        if (!userAgent)
+            return { unavailableReason: "missing_client_profile", userAgentSource };
+        return {
+            identity: { proxyUrl, userAgent },
+            userAgentSource,
+        };
+    }
+    catch {
+        return { unavailableReason: "missing_client_profile", userAgentSource };
+    }
+}
 function createResolverChainClient(options) {
     assertClientProfileTransportContract(options.clientProfile, options.transport);
     const client = {
@@ -465,8 +526,23 @@ function createResolverChainClient(options) {
             if (supportingEntries.length === 0)
                 throwUnsupportedKind(challenge.kind);
             signal.throwIfAborted();
+            const identityResolution = options.proxyIntent
+                ? await resolveResolverIdentity(options.proxyIntent)
+                : { identity: options.identity };
+            const identity = identityResolution.identity;
+            signal.throwIfAborted();
+            // Resolve a required proxy lease before consulting the cache. Solutions minted
+            // under a previous release are shared and long-lived, but a portable cached token
+            // must not bypass the upstream admission policy when no lease can be resolved.
+            const requiredProxyIdentityMissing = options.proxyIntent?.mode === "required" && identity === undefined;
+            if (requiredProxyIdentityMissing) {
+                throwExhausted(supportingEntries.map((entry) => ({
+                    vendor: entry.id,
+                    reason: identityResolution.unavailableReason ?? "missing_proxy_identity",
+                })));
+            }
             if (options.cache && resolverChallengeIsCacheable(challenge)) {
-                const cached = await findCachedSolution(options.cache, challenge, options.identity, options.identityScope);
+                const cached = await findCachedSolution(options.cache, challenge, identity, options.identityScope);
                 if (cached)
                     return cached;
             }
@@ -489,7 +565,7 @@ function createResolverChainClient(options) {
                         const transport = unrestrictedTransport
                             ? restrictResolverTransport(unrestrictedTransport, options.allowedHosts ?? [])
                             : undefined;
-                        return adapter.solve(challenge, options.identity, signal, traceRecorder, transport);
+                        return adapter.solve(challenge, identity, signal, traceRecorder, transport);
                     };
                     const solution = traceRecorder
                         ? await traceRecorder.runSpan("resolver.vendor.attempt", solveAttempt, {
@@ -497,6 +573,7 @@ function createResolverChainClient(options) {
                                 vendor: adapter.id,
                                 challenge_kind: challenge.kind,
                                 client_profile: options.clientProfile,
+                                resolver_identity_source: identityResolution.userAgentSource,
                             },
                             onError(error) {
                                 return error instanceof ResolverVendorUnavailableError
@@ -509,9 +586,9 @@ function createResolverChainClient(options) {
                         resolverChallengeIsCacheable(challenge) &&
                         solution.form === "cookies" &&
                         solutionExpiryMs(solution) !== undefined) {
-                        const issuingIdentity = adapter.getIssuingIdentity?.(solution, options.identity, challenge) ??
+                        const issuingIdentity = adapter.getIssuingIdentity?.(solution, identity, challenge) ??
                             resolverChallengeIssuingIdentity(challenge, {
-                                ...(options.identity ? { proxyUrl: options.identity.proxyUrl } : {}),
+                                ...(identity ? { proxyUrl: identity.proxyUrl } : {}),
                                 userAgent: solution.userAgent,
                             });
                         if (issuingIdentity) {
@@ -544,6 +621,7 @@ export function createResolverClient(options) {
         unavailableReason: options.unavailableReason,
         cache: options.cache,
         identity: options.identity,
+        proxyIntent: options.proxyIntent,
         transport: options.transport,
         createTransport: options.createTransport,
         clientProfile: options.clientProfile,
@@ -570,16 +648,6 @@ function resolveVendorAvailability(vendor, env) {
         ? { vendor, available: true, configuration }
         : { vendor, available: false, reason: "missing_credentials" };
 }
-export function createUnsupportedResolverClient(reason) {
-    return {
-        async solve() {
-            throw new ProviderError(reason ?? "Resolver runtime is not configured", {
-                code: "RESOLVER_UNAVAILABLE",
-                fix: "Declare resolver on the provider definition and configure vendor credentials.",
-            });
-        },
-    };
-}
 export function bindResolverSignal(resolver, defaultSignal) {
     if (!defaultSignal)
         return resolver;
@@ -620,6 +688,7 @@ function createResolverClientFromEnvInternal(config, env, options, adapterFactor
             };
         }),
         cache: options.cache,
+        proxyIntent: options.proxyIntent,
         identityScope: options.identityScope,
         transport: options.transport,
         createTransport: options.createTransport,

package/dist/runtime/state.js

@@ -4,7 +4,6 @@ import { ProviderError } from "../errors.js";
 import { createProviderRedisClient, ensureRedisReady, withRedisTimeout, } from "./redis.js";
 const DEFAULT_REDIS_TIMEOUT_MS = 250;
 const REDIS_STATE_PREFIX = "apifuse:provider-state:v2";
-const LEGACY_REDIS_STATE_PREFIX = "apifuse:provider-state:v1";
 const PROVIDER_SCOPE_DISCRIMINATOR = "scope:provider";
 const MISSING_CONNECTION_SCOPE_DISCRIMINATOR = "scope:connection:missing";
 const SET_WITH_QUOTA_SCRIPT = `
@@ -15,7 +14,6 @@ local index_ttl = tonumber(ARGV[4])
 local envelope = ARGV[5]
 
 redis.call("ZREMRANGEBYSCORE", KEYS[2], "-inf", now)
-redis.call("ZREM", KEYS[2], KEYS[3])
 local indexed = redis.call("ZSCORE", KEYS[2], KEYS[1])
 if not indexed and redis.call("ZCARD", KEYS[2]) >= max_entries then
 	return {0, false}
@@ -24,14 +22,10 @@ end
 redis.call("SET", KEYS[1], envelope, "PXAT", expires_at)
 redis.call("ZADD", KEYS[2], expires_at, KEYS[1])
 redis.call("PEXPIRE", KEYS[2], index_ttl)
-if ARGV[6] == "1" then
-	redis.call("SET", KEYS[3], ARGV[7], "PX", index_ttl)
-end
 return {1, envelope}
 `;
 const COMPARE_AND_SET_WITH_QUOTA_SCRIPT = `
 local current = redis.call("GET", KEYS[1])
-local scoped_present = current and true or false
 if current then
 	local ok, decoded = pcall(cjson.decode, current)
 	if ok and type(decoded) == "table" and decoded.deleted == true then
@@ -44,42 +38,6 @@ local max_entries = tonumber(ARGV[3])
 local expires_at = tonumber(ARGV[4])
 local index_ttl = tonumber(ARGV[5])
 local envelope = ARGV[6]
-local allow_legacy_claim = ARGV[7] == "1"
-local legacy_tombstone = ARGV[8]
-
-if not scoped_present then
-	local legacy = redis.call("GET", KEYS[3])
-	if legacy then
-		local ok, decoded = pcall(cjson.decode, legacy)
-		if ok and type(decoded) == "table" and decoded.deleted == true then
-			legacy = false
-		end
-	end
-	if legacy and not allow_legacy_claim then
-		return {-1, false}
-	end
-	if legacy then
-		local legacy_ttl = redis.call("PTTL", KEYS[3])
-		if legacy_ttl == -1 then
-			legacy_ttl = index_ttl
-		elseif legacy_ttl < 1 then
-			legacy_ttl = 1
-		end
-		if legacy_ttl > 0 then
-			redis.call("ZREMRANGEBYSCORE", KEYS[2], "-inf", now)
-			redis.call("ZREM", KEYS[2], KEYS[3])
-			local indexed = redis.call("ZSCORE", KEYS[2], KEYS[1])
-			if not indexed and redis.call("ZCARD", KEYS[2]) >= max_entries then
-				return {0, false}
-			end
-			redis.call("SET", KEYS[1], legacy, "PX", legacy_ttl)
-			redis.call("ZADD", KEYS[2], now + legacy_ttl, KEYS[1])
-			redis.call("PEXPIRE", KEYS[2], index_ttl)
-			redis.call("SET", KEYS[3], legacy_tombstone, "PX", index_ttl)
-			current = legacy
-		end
-	end
-end
 
 local current_version = 0
 local current_decoded = false
@@ -96,7 +54,6 @@ if current_version ~= tonumber(ARGV[1]) then
 end
 
 redis.call("ZREMRANGEBYSCORE", KEYS[2], "-inf", now)
-redis.call("ZREM", KEYS[2], KEYS[3])
 local indexed = redis.call("ZSCORE", KEYS[2], KEYS[1])
 if not indexed and redis.call("ZCARD", KEYS[2]) >= max_entries then
 	return {0, false}
@@ -110,60 +67,13 @@ end
 redis.call("SET", KEYS[1], envelope, "PXAT", expires_at)
 redis.call("ZADD", KEYS[2], expires_at, KEYS[1])
 redis.call("PEXPIRE", KEYS[2], index_ttl)
-if allow_legacy_claim then
-	redis.call("SET", KEYS[3], legacy_tombstone, "PX", index_ttl)
-end
 return {1, envelope}
 `;
 const DELETE_WITH_INDEX_SCRIPT = `
 redis.call("SET", KEYS[1], ARGV[1], "PX", ARGV[2])
-if ARGV[3] == "1" then
-	redis.call("SET", KEYS[3], ARGV[1], "PX", ARGV[2])
-end
-redis.call("ZREM", KEYS[2], KEYS[1], KEYS[3])
+redis.call("ZREM", KEYS[2], KEYS[1])
 return 1
 `;
-// A v1 key has no connection discriminator, so it cannot safely be exposed to
-// every v2 scope. The first concrete connection (or explicit provider scope) to
-// request a key atomically adopts that value and tombstones v1. The missing-
-// connection sentinel never claims legacy state.
-const CLAIM_LEGACY_SCRIPT = `
-local scoped = redis.call("GET", KEYS[1])
-if scoped then
-	return {1, scoped}
-end
-
-local legacy = redis.call("GET", KEYS[3])
-if not legacy then
-	return {1, false}
-end
-local ok, decoded = pcall(cjson.decode, legacy)
-if ok and type(decoded) == "table" and decoded.deleted == true then
-	return {1, false}
-end
-local legacy_ttl = redis.call("PTTL", KEYS[3])
-if legacy_ttl == -1 then
-	legacy_ttl = tonumber(ARGV[3])
-elseif legacy_ttl < 1 then
-	legacy_ttl = 1
-end
-
-local now = tonumber(ARGV[1])
-local max_entries = tonumber(ARGV[2])
-local index_ttl = tonumber(ARGV[3])
-redis.call("ZREMRANGEBYSCORE", KEYS[2], "-inf", now)
-redis.call("ZREM", KEYS[2], KEYS[3])
-local indexed = redis.call("ZSCORE", KEYS[2], KEYS[1])
-if not indexed and redis.call("ZCARD", KEYS[2]) >= max_entries then
-	return {0, false}
-end
-
-redis.call("SET", KEYS[1], legacy, "PX", legacy_ttl)
-redis.call("ZADD", KEYS[2], now + legacy_ttl, KEYS[1])
-redis.call("PEXPIRE", KEYS[2], index_ttl)
-redis.call("SET", KEYS[3], ARGV[4], "PX", index_ttl)
-return {1, legacy}
-`;
 const redisBackends = new Map();
 function getRedisBackend(redisUrl, injectedRedis) {
     const existing = redisBackends.get(redisUrl);
@@ -210,12 +120,6 @@ function providerStatePrefix(providerId, namespace, scopeDiscriminator) {
 function providerStateKey(providerId, namespace, scopeDiscriminator, key) {
     return `${providerStatePrefix(providerId, namespace, scopeDiscriminator)}:${key}`;
 }
-function legacyProviderStatePrefix(providerId, namespace) {
-    return `${LEGACY_REDIS_STATE_PREFIX}:${providerId ?? "default"}:${namespace}`;
-}
-function legacyProviderStateKey(providerId, namespace, key) {
-    return `${legacyProviderStatePrefix(providerId, namespace)}:${key}`;
-}
 function publicStateKey(redisKey, prefixes) {
     for (const prefix of prefixes) {
         const prefixWithSeparator = `${prefix}:`;
@@ -311,9 +215,6 @@ class RedisProviderStateNamespace {
     redisKey(key) {
         return providerStateKey(this.providerId, this.namespaceName, this.scopeDiscriminator, key);
     }
-    legacyRedisKey(key) {
-        return legacyProviderStateKey(this.providerId, this.namespaceName, key);
-    }
     statePrefix() {
         return providerStatePrefix(this.providerId, this.namespaceName, this.scopeDiscriminator);
     }
@@ -324,9 +225,6 @@ class RedisProviderStateNamespace {
         const namespaceIdentity = Buffer.from(providerStatePrefix(this.providerId, this.namespaceName, this.scopeDiscriminator), "utf8").toString("base64url");
         return `${REDIS_STATE_PREFIX}:index:${namespaceIdentity}`;
     }
-    canClaimLegacy() {
-        return this.scopeDiscriminator !== MISSING_CONNECTION_SCOPE_DISCRIMINATOR;
-    }
     async indexedKeys(limit) {
         await requireRedisReady(this.backend.redis);
         const now = Date.now();
@@ -337,15 +235,7 @@ class RedisProviderStateNamespace {
     }
     async readRaw(key) {
         await requireRedisReady(this.backend.redis);
-        if (!this.canClaimLegacy()) {
-            return await withRequiredRedis(() => this.backend.redis.get(this.redisKey(key)));
-        }
-        const tombstone = JSON.stringify({ deleted: true });
-        const result = await withRequiredRedis(() => this.backend.redis.eval(CLAIM_LEGACY_SCRIPT, 3, this.redisKey(key), this.indexKey(), this.legacyRedisKey(key), String(Date.now()), String(this.options.maxEntries), String(parseStateDurationMs(this.options.maxTtl)), tombstone));
-        if (Array.isArray(result) && Number(result[0]) === 0) {
-            throw this.quotaExceeded();
-        }
-        return Array.isArray(result) && typeof result[1] === "string" ? result[1] : null;
+        return await withRequiredRedis(() => this.backend.redis.get(this.redisKey(key)));
     }
     enforceValueSize(value) {
         const bytes = Buffer.byteLength(JSON.stringify(value), "utf8");
@@ -406,7 +296,7 @@ class RedisProviderStateNamespace {
         const timing = this.writeTiming(options?.ttl);
         const envelope = redisEnvelope(value, version, createdAt, timing.expiresAt);
         await requireRedisReady(this.backend.redis);
-        const result = await withRequiredRedis(() => this.backend.redis.eval(SET_WITH_QUOTA_SCRIPT, 3, this.redisKey(key), this.indexKey(), this.legacyRedisKey(key), String(Date.now()), String(this.options.maxEntries), String(timing.expiresAtMs), String(timing.indexTtlMs), JSON.stringify(envelope), this.canClaimLegacy() ? "1" : "0", JSON.stringify({ deleted: true })));
+        const result = await withRequiredRedis(() => this.backend.redis.eval(SET_WITH_QUOTA_SCRIPT, 2, this.redisKey(key), this.indexKey(), String(Date.now()), String(this.options.maxEntries), String(timing.expiresAtMs), String(timing.indexTtlMs), JSON.stringify(envelope)));
         if (!Array.isArray(result) || Number(result[0]) !== 1) {
             throw this.quotaExceeded();
         }
@@ -431,7 +321,7 @@ class RedisProviderStateNamespace {
         const timing = this.writeTiming(options?.ttl);
         const envelope = redisEnvelope(value, expectedVersion + 1, createdAt, timing.expiresAt);
         await requireRedisReady(this.backend.redis);
-        const result = await withRequiredRedis(() => this.backend.redis.eval(COMPARE_AND_SET_WITH_QUOTA_SCRIPT, 3, this.redisKey(key), this.indexKey(), this.legacyRedisKey(key), String(expectedVersion), String(Date.now()), String(this.options.maxEntries), String(timing.expiresAtMs), String(timing.indexTtlMs), JSON.stringify(envelope), this.canClaimLegacy() ? "1" : "0", JSON.stringify({ deleted: true })));
+        const result = await withRequiredRedis(() => this.backend.redis.eval(COMPARE_AND_SET_WITH_QUOTA_SCRIPT, 2, this.redisKey(key), this.indexKey(), String(expectedVersion), String(Date.now()), String(this.options.maxEntries), String(timing.expiresAtMs), String(timing.indexTtlMs), JSON.stringify(envelope)));
         if (Array.isArray(result) && Number(result[0]) === 0) {
             throw this.quotaExceeded();
         }
@@ -449,7 +339,7 @@ class RedisProviderStateNamespace {
     async delete(key) {
         await requireRedisReady(this.backend.redis);
         const tombstone = JSON.stringify({ deleted: true });
-        await withRequiredRedis(() => this.backend.redis.eval(DELETE_WITH_INDEX_SCRIPT, 3, this.redisKey(key), this.indexKey(), this.legacyRedisKey(key), tombstone, String(parseStateDurationMs(this.options.maxTtl)), this.canClaimLegacy() ? "1" : "0"));
+        await withRequiredRedis(() => this.backend.redis.eval(DELETE_WITH_INDEX_SCRIPT, 2, this.redisKey(key), this.indexKey(), tombstone, String(parseStateDurationMs(this.options.maxTtl))));
     }
     async increment(key, field, delta = 1, options) {
         const current = (await this.get(key))?.value ?? {};

package/dist/runtime/stealth-cookies.d.ts

@@ -0,0 +1,20 @@
+import type { CookieJar, StealthCookieStore, StealthCookieStoreV1, StealthSessionCookies } from "../types.js";
+export declare class StealthCookieJar implements CookieJar, StealthSessionCookies {
+    private cookies;
+    private readonly defaultUrl;
+    constructor(cookieStrings: readonly string[], defaultUrl?: string);
+    setFromCookieStrings(cookieStrings: readonly string[], url?: string): void;
+    get(name: string, url?: string): string | undefined;
+    getAll(url?: string): Record<string, string>;
+    has(name: string, url?: string): boolean;
+    toString(url?: string): string;
+    toHeader(url?: string): string;
+    snapshot(): Record<string, string>;
+    restore(cookies: Record<string, string>): void;
+    serialize(): StealthCookieStoreV1;
+    deserialize(state: StealthCookieStore): void;
+    clear(): void;
+    find(predicate: (cookie: string) => boolean, url?: string): string | undefined;
+    private normalizeUrl;
+    private getUniqueCookies;
+}

package/dist/runtime/stealth-cookies.js

@@ -0,0 +1,111 @@
+import { Cookie, CookieJar as ToughCookieJar } from "tough-cookie";
+import { SDKError, StealthCookieStoreVersionError } from "../errors.js";
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+const LEGACY_COOKIE_ORIGIN = "https://legacy-cookie.invalid/";
+export class StealthCookieJar {
+    cookies;
+    defaultUrl;
+    constructor(cookieStrings, defaultUrl = LEGACY_COOKIE_ORIGIN) {
+        this.cookies = new ToughCookieJar(undefined, {
+            allowSecureOnLocal: false,
+            rejectPublicSuffixes: true,
+        });
+        this.defaultUrl = this.normalizeUrl(defaultUrl) ?? LEGACY_COOKIE_ORIGIN;
+        this.setFromCookieStrings(cookieStrings);
+    }
+    setFromCookieStrings(cookieStrings, url = this.defaultUrl) {
+        const cookieUrl = this.normalizeUrl(url);
+        if (!cookieUrl)
+            return;
+        for (const cookieString of cookieStrings) {
+            this.cookies.setCookieSync(cookieString, cookieUrl, { ignoreError: true });
+        }
+    }
+    get(name, url) {
+        return this.getAll(url)[name];
+    }
+    getAll(url) {
+        return Object.fromEntries(this.getUniqueCookies(url ?? this.defaultUrl).map((cookie) => [cookie.key, cookie.value]));
+    }
+    has(name, url) {
+        return Object.hasOwn(this.getAll(url), name);
+    }
+    toString(url) {
+        return this.getUniqueCookies(url ?? this.defaultUrl)
+            .map((cookie) => cookie.cookieString())
+            .join("; ");
+    }
+    toHeader(url) {
+        return this.toString(url);
+    }
+    snapshot() {
+        const entries = [];
+        for (const cookie of this.serialize().jar.cookies) {
+            if (typeof cookie.key === "string" && typeof cookie.value === "string" && cookie.key) {
+                entries.push([cookie.key, cookie.value]);
+            }
+        }
+        return Object.fromEntries(entries);
+    }
+    restore(cookies) {
+        this.clear();
+        for (const [name, value] of Object.entries(cookies)) {
+            if (!name)
+                continue;
+            this.cookies.setCookieSync(new Cookie({ key: name, path: "/", value }), this.defaultUrl, {
+                ignoreError: true,
+            });
+        }
+    }
+    serialize() {
+        const jar = this.cookies.serializeSync();
+        if (!jar) {
+            throw new SDKError("Stealth cookie store could not be serialized", {
+                code: "stealth_cookie_store_serialize_failed",
+            });
+        }
+        return { version: 1, jar };
+    }
+    deserialize(state) {
+        const version = isRecord(state) ? state.version : undefined;
+        if (version !== 1) {
+            throw new StealthCookieStoreVersionError(version);
+        }
+        const restored = ToughCookieJar.deserializeSync(state.jar);
+        Reflect.set(restored, "allowSecureOnLocal", false);
+        this.cookies = restored;
+    }
+    clear() {
+        this.cookies.removeAllCookiesSync();
+    }
+    find(predicate, url) {
+        for (const cookie of this.getUniqueCookies(url ?? this.defaultUrl)) {
+            const cookieString = cookie.cookieString();
+            if (predicate(cookieString))
+                return cookieString;
+        }
+        return undefined;
+    }
+    normalizeUrl(url) {
+        try {
+            return new URL(url).toString();
+        }
+        catch {
+            return undefined;
+        }
+    }
+    getUniqueCookies(url) {
+        const cookieUrl = this.normalizeUrl(url);
+        if (!cookieUrl)
+            return [];
+        const names = new Set();
+        return this.cookies.getCookiesSync(cookieUrl).filter((cookie) => {
+            if (names.has(cookie.key))
+                return false;
+            names.add(cookie.key);
+            return true;
+        });
+    }
+}

package/dist/runtime/stealth.d.ts

@@ -1,6 +1,7 @@
 import type { BrowserProfile, EmulationOS } from "wreq-js";
 import type { ProxyResolutionOptions } from "../config/loader.js";
 import type { StealthClient, StealthResponse } from "../types.js";
+export declare const DEFAULT_PROFILE = "chrome-146";
 export type StealthClientOptions = ProxyResolutionOptions & {
     warn?: (message: string) => void;
     /**