@apifuse/provider-sdk 2.2.0-beta.68 → 2.2.0-beta.69

package/dist/runtime/stealth-owned-headers.js

@@ -1,20 +1,27 @@
+import { SDKError } from "../errors.js";
 /**
  * Header names the stealth transport owns.
  *
  * `ctx.stealth` composes these from the Chrome emulation and the request class,
  * so a caller value is rejected at request time with `SDKError` code
- * `STEALTH_HEADER_OVERRIDE_UNSUPPORTED` (`assertCallerHeadersSupported` in
- * stealth.ts). The `browser-version-literal` lint reports a subset of these
- * names — the `sec-fetch-*` and `sec-ch-ua*` families — in files that use
- * `ctx.stealth` (`isReportedOwnedHeaderName` in lint.ts). Both read this
- * module, so the lint cannot claim a rejection the runtime does not perform;
- * it reports deliberately less than the runtime rejects (host, connection,
+ * `STEALTH_HEADER_OVERRIDE_UNSUPPORTED` ({@link assertCallerHeadersSupported}).
+ * The offline test harness (`runStandardTests`) calls the same function on
+ * every `ctx.stealth` request it serves, so a provider test fails exactly where
+ * production would, whichever file or variable the header came from. That is
+ * the cross-file enforcement.
+ *
+ * The `browser-version-literal` lint reports a subset of these names — the
+ * `sec-fetch-*` and `sec-ch-ua*` families — in files that use `ctx.stealth`
+ * (`isReportedOwnedHeaderName` in lint.ts). Both read this module, so the lint
+ * cannot claim a rejection the runtime does not perform; it reports
+ * deliberately less than the runtime rejects (host, connection,
  * accept-encoding and a non-literal user-agent stay silent — see that
  * predicate for why), so a green `apifuse check` is not proof that no owned
  * header is set.
  *
- * Leaf module by design: no imports, so the lazily loaded CLI lint path does
- * not pull the stealth runtime in.
+ * Kept off the stealth runtime: the only import is `errors.js`, whose own
+ * imports are type-only, so the lazily loaded CLI lint path does not pull the
+ * stealth runtime in.
  */
 export const SDK_OWNED_EXACT_CHROME_HEADERS = new Set([
     "host",
@@ -35,3 +42,16 @@ export function isStealthOwnedHeaderName(name) {
     const lower = name.toLowerCase();
     return (SDK_OWNED_EXACT_CHROME_HEADERS.has(lower) || lower.startsWith(SDK_OWNED_CHROME_HEADER_PREFIX));
 }
+/**
+ * Throws `SDKError` `STEALTH_HEADER_OVERRIDE_UNSUPPORTED` for the first caller
+ * header `ctx.stealth` owns. An `undefined` value is skipped, as the transport
+ * drops it before sending. The stealth runtime and the offline test harness
+ * both call this, so the two cannot disagree about what is rejected.
+ */
+export function assertCallerHeadersSupported(headers) {
+    for (const [name, value] of Object.entries(headers)) {
+        if (value === undefined || !isStealthOwnedHeaderName(name))
+            continue;
+        throw new SDKError(`Stealth transport owns the "${name.toLowerCase()}" header; remove it from headers.`, { code: "STEALTH_HEADER_OVERRIDE_UNSUPPORTED" });
+    }
+}

package/dist/runtime/stealth-telemetry.d.ts

@@ -1,7 +1,7 @@
 import type { StealthBrowser, StealthChallengeClassification, StealthOS, StealthProfileDescriptor } from "../types.js";
 import { type ClosedEnum, type TelemetryContributor } from "./request-telemetry.js";
 export type StealthTelemetryErrorCode = "transport_network_error" | "transport_timeout" | "transport_cancelled" | "upstream_http_error" | "response_too_large" | "proxy_connect_failed" | "PROXY_POOL_STALE" | "PROXY_EDGE_AUTH_REJECTED" | "PROXY_AUTH_IP_DENIED" | "PROXY_EDGE_TLS_REJECTED" | "PROXY_REQUIRED" | "other";
-export type StealthTelemetryRequestClass = "navigation" | "script_navigation" | "xhr" | "post";
+export type StealthTelemetryRequestClass = "navigation" | "script_navigation" | "form_post" | "xhr" | "post";
 export type StealthTelemetryAttemptKind = "request" | "resolver" | "proxy_diagnostic";
 export type StealthTelemetrySbsdOutcome = StealthChallengeClassification["outcome"] | "detected" | "refetch_clear";
 export type StealthTelemetryDiagnostics = {

package/dist/runtime/stealth.js

@@ -5,11 +5,12 @@ import { SDKError, TransportError } from "../errors.js";
 import { DEFAULT_STEALTH_BROWSER, DEFAULT_STEALTH_OS, getStealthProfile, resolverClientProfileFamily, resolveStealthProfileSelection, } from "../stealth/profiles.js";
 import { chrome149HeaderOrder } from "./chrome149-header-order.js";
 import { registerDiagnosticValue } from "./diagnostic-env.js";
-import { isStealthOwnedHeaderName } from "./stealth-owned-headers.js";
+import { assertCallerHeadersSupported } from "./stealth-owned-headers.js";
 import { ENGINE_CEREMONY_EGRESS_LEASE, } from "./egress-lease.js";
 import { createProxyAuthIpDeniedError, createProxyEdgeAuthRejectedError, createProxyEdgeTlsRejectedError, createProxyPoolExhaustedError, createProxyPoolStaleError, isProxyAuthIpDeniedMessage, isProxyEdgeAuthRejectedMessage, isProxyEdgeTlsRejectedResponse, isProxyPoolRefreshableError, isProxyPoolStaleMessage, isProxyPoolStaleStatus, PROXY_EDGE_AUTH_REJECTED_CODE, PROXY_POOL_STALE_CODE, } from "./proxy-errors.js";
 import { computeProxyAttemptIndex, computeProxyTransportRetryDelayMs, createDefaultProxyTransportRetryOptions, isProxyTransportRetryMethod, normalizeProxyTransportRetryOptions, shouldRetryProxyTransportAttempt, validateUnsafeProxyTransportRetryMethods, } from "./proxy-retry-policy.js";
-import { evaluateRedirectHop, isRedirectStatus, nextRedirectMethod, resolveRedirectUrl, } from "./redirects.js";
+import { redirectHopHeaders } from "./redirect-hop-headers.js";
+import { evaluateRedirectHop, invalidRedirectPolicy, isRedirectStatus, nextRedirectMethod, nextSameOriginRedirectHop, normalizeRedirectPolicy, resolveRedirectUrl, } from "./redirects.js";
 import { isSensitiveKey, normalizeSensitiveParams, redactSensitiveError, redactSensitiveRequestError, redactSensitiveText, redactUrlQueryParams, serializeRequestUrl, } from "./request-options.js";
 import { akamaiSbsdChallengeKey, detectAkamaiSbsdChallenge, } from "./stealth-akamai-sbsd.js";
 import { StealthCookieJar } from "./stealth-cookies.js";
@@ -37,12 +38,10 @@ function isBoundEgressTransportFailure(error) {
         (error.code !== undefined && BOUND_EGRESS_TRANSPORT_FAILURE_CODES.has(error.code)));
 }
 const MAX_STEALTH_REDIRECT_HOPS = 10;
-const REDIRECT_BODY_HEADERS = new Set([
-    "content-encoding",
-    "content-language",
-    "content-location",
-    "content-type",
-]);
+const STEALTH_REDIRECT_POLICY_TRANSPORT = {
+    label: "ctx.stealth",
+    maxHops: MAX_STEALTH_REDIRECT_HOPS,
+};
 function isRecord(value) {
     return typeof value === "object" && value !== null;
 }
@@ -179,6 +178,8 @@ function normalizedHeaderEntries(headers) {
 // installs Accept-Language via DevTools next to User-Agent; real Chrome only
 // receives it from //net (URLRequestHttpJob::AddExtraHeaders), after
 // Accept-Encoding and before Cookie, as al-placement-capture.json B/C show.
+// chrome-form-post-capture.json was taken without that option and needs no
+// adjustment.
 const CHROME_HEADER_ORDERS = {
     navigation: [
         "sec-ch-ua",
@@ -215,6 +216,27 @@ const CHROME_HEADER_ORDERS = {
         "cookie",
         "priority",
     ],
+    "form-post": [
+        "content-length",
+        "cache-control",
+        "sec-ch-ua",
+        "sec-ch-ua-mobile",
+        "sec-ch-ua-platform",
+        "upgrade-insecure-requests",
+        "content-type",
+        "user-agent",
+        "origin",
+        "accept",
+        "sec-fetch-site",
+        "sec-fetch-mode",
+        "sec-fetch-user",
+        "sec-fetch-dest",
+        "referer",
+        "accept-encoding",
+        "accept-language",
+        "cookie",
+        "priority",
+    ],
 };
 const CHROME_H1_HEADER_ORDERS = {
     navigation: [
@@ -271,6 +293,28 @@ const CHROME_H1_HEADER_ORDERS = {
         "accept-language",
         "cookie",
     ],
+    "form-post": [
+        "host",
+        "connection",
+        "content-length",
+        "cache-control",
+        "sec-ch-ua",
+        "sec-ch-ua-mobile",
+        "sec-ch-ua-platform",
+        "upgrade-insecure-requests",
+        "content-type",
+        "user-agent",
+        "origin",
+        "accept",
+        "sec-fetch-site",
+        "sec-fetch-mode",
+        "sec-fetch-user",
+        "sec-fetch-dest",
+        "referer",
+        "accept-encoding",
+        "accept-language",
+        "cookie",
+    ],
 };
 const CHROME_H1_HEADER_NAMES = {
     host: "Host",
@@ -293,6 +337,25 @@ const CHROME_H1_HEADER_NAMES = {
     origin: "Origin",
     range: "Range",
 };
+/**
+ * What each request class sends besides its header order, one row per public
+ * `stealth.requestClass`:
+ *
+ * - `fetchMetadata: "navigate"` is a document navigation: `Sec-Fetch-Mode:
+ *   navigate`, `Sec-Fetch-Dest: document`, `Sec-Fetch-User: ?1` unless
+ *   `userActivation` is false, `Upgrade-Insecure-Requests: 1`, and the
+ *   profile's `Accept` and `Priority`. `"cors"` is a script fetch: `cors` /
+ *   `empty`, `Accept: *\/*`, `Priority: u=1, i`.
+ * - `bodyful` sends `Content-Length`.
+ * - `validateCache` sends `Cache-Control: max-age=0`, which Chrome adds to a
+ *   form submission (chrome-form-post-capture.json).
+ */
+const CHROME_REQUEST_CLASSES = {
+    navigation: { fetchMetadata: "navigate", bodyful: false, validateCache: false },
+    "form-post": { fetchMetadata: "navigate", bodyful: true, validateCache: true },
+    xhr: { fetchMetadata: "cors", bodyful: false, validateCache: false },
+    post: { fetchMetadata: "cors", bodyful: true, validateCache: false },
+};
 function chromeHeaderOrder(requestClass, isHttp1, caller) {
     if (isHttp1)
         return CHROME_H1_HEADER_ORDERS[requestClass];
@@ -320,29 +383,11 @@ function chromeHeaderOrder(requestClass, isHttp1, caller) {
     }
     return order;
 }
-function normalizedCallerHeaderEntries(headers) {
-    const entries = normalizedHeaderEntries(headers);
-    assertCallerHeadersSupported(entries);
-    return entries;
-}
 function normalizedCallerHeaderEntriesFromRecord(headers) {
     // The record has been through normalizeHeaders (lowercase, merged names); the
     // lowercase here only guards later insertions such as the cookie jar's header.
-    const entries = Object.entries(headers).map(([name, value]) => [
-        name.toLowerCase(),
-        value,
-    ]);
-    assertCallerHeadersSupported(entries);
-    return entries;
-}
-function assertCallerHeadersSupported(entries) {
-    for (const [name] of entries) {
-        if (isStealthOwnedHeaderName(name)) {
-            throw new SDKError(`Stealth transport owns the "${name}" header; remove it from headers.`, {
-                code: "STEALTH_HEADER_OVERRIDE_UNSUPPORTED",
-            });
-        }
-    }
+    assertCallerHeadersSupported(headers);
+    return Object.entries(headers).map(([name, value]) => [name.toLowerCase(), value]);
 }
 function chromeRequestClass(method, requestedClass) {
     if (requestedClass)
@@ -374,9 +419,10 @@ function buildChromeHeaderTuples(options) {
     const caller = new Map(callerEntries);
     const emulation = new Map(Array.from(options.emulationHeaders, ([name, value]) => [name.toLowerCase(), value]));
     const requestClass = chromeRequestClass(options.method, options.requestClass);
+    const shape = CHROME_REQUEST_CLASSES[requestClass];
     const referer = caller.get("referer");
     const fetchSite = secFetchSite(options.requestUrl, referer);
-    const isNavigation = requestClass === "navigation";
+    const isNavigation = shape.fetchMetadata === "navigate";
     const values = new Map([
         ["sec-ch-ua", requiredEmulationHeader(emulation, "sec-ch-ua")],
         ["sec-ch-ua-mobile", requiredEmulationHeader(emulation, "sec-ch-ua-mobile")],
@@ -403,6 +449,8 @@ function buildChromeHeaderTuples(options) {
         if (options.userActivation !== false)
             values.set("sec-fetch-user", "?1");
     }
+    if (shape.validateCache)
+        values.set("cache-control", "max-age=0");
     for (const [name, value] of callerEntries)
         values.set(name, value);
     for (const name of ["content-type", "origin", "referer"]) {
@@ -410,7 +458,10 @@ function buildChromeHeaderTuples(options) {
         if (value !== undefined)
             values.set(name, value);
     }
-    if (requestClass === "post") {
+    // A bodyful class keeps its class across a 301/302/303 that rewrites the method
+    // to GET (a form submission's redirect stays a validated navigation), but the
+    // rewritten request has no body and Chrome sends no Content-Length for it.
+    if (shape.bodyful && options.method !== "GET" && options.method !== "HEAD") {
         values.set("content-length", caller.get("content-length") ?? String(Buffer.byteLength(options.body ?? "")));
     }
     const isHttp1 = new URL(options.requestUrl).protocol === "http:";
@@ -865,8 +916,25 @@ function locationHeader(headers) {
     }
     return undefined;
 }
-function withoutRedirectBodyHeaders(headers) {
-    return Object.fromEntries(Object.entries(headers).filter(([name]) => !REDIRECT_BODY_HEADERS.has(name.toLowerCase())));
+/**
+ * Snapshot a caller's `redirectPolicy` before the first send. The policy acts
+ * on redirects the transport follows, so it requires the default
+ * `redirect: "follow"`.
+ */
+function snapshotStealthRedirectPolicy(options) {
+    let policy;
+    try {
+        policy = normalizeRedirectPolicy(options.redirectPolicy, STEALTH_REDIRECT_POLICY_TRANSPORT);
+    }
+    catch (error) {
+        if (error instanceof TransportError)
+            throw error;
+        throw invalidRedirectPolicy(STEALTH_REDIRECT_POLICY_TRANSPORT, "could not be read safely", error instanceof Error ? error : undefined);
+    }
+    if (policy && options.redirect !== undefined && options.redirect !== "follow") {
+        throw invalidRedirectPolicy(STEALTH_REDIRECT_POLICY_TRANSPORT, `it applies to followed redirects and cannot be combined with redirect: "${options.redirect}"`);
+    }
+    return policy;
 }
 function assertStealthRedirectUrl(url) {
     const protocol = new URL(url).protocol;
@@ -962,7 +1030,9 @@ function startStealthExchange(telemetry, method, options, signal) {
                 kind: telemetry.kind,
                 requestClass: requestClass === "navigation" && options.stealth?.userActivation === false
                     ? "script_navigation"
-                    : requestClass,
+                    : requestClass === "form-post"
+                        ? "form_post"
+                        : requestClass,
                 ...(status === undefined ? {} : { status }),
                 ...(errorCode ? { errorCode } : {}),
                 ...(error === undefined
@@ -988,6 +1058,10 @@ async function fetchStealthRedirectChain(transport, cookieJar, requestUrl, metho
     let followedHops = 0;
     let response;
     const deadline = options.timeout ? performance.now() + options.timeout : undefined;
+    // Snapshotted and validated by session.fetch before the first send.
+    const redirectPolicy = options.redirectPolicy;
+    const initialOrigin = new URL(requestUrl).origin;
+    const visitedRequests = new Set([`${method} ${requestUrl}`]);
     let finishExchange;
     let status;
     let exchangeError;
@@ -1040,23 +1114,42 @@ async function fetchStealthRedirectChain(transport, cookieJar, requestUrl, metho
                     status: 0,
                 });
             }
-            const nextUrl = resolveRedirectUrl(response.headers.get("location") ?? undefined, response.url ?? currentUrl);
-            if (!nextUrl)
-                break;
-            if (followedHops >= MAX_STEALTH_REDIRECT_HOPS) {
+            let nextUrl;
+            let nextMethod;
+            if (redirectPolicy) {
+                discardStealthRedirectBody(response);
+                ({ nextUrl, nextMethod } = nextSameOriginRedirectHop({
+                    policy: redirectPolicy,
+                    initialOrigin,
+                    currentUrl,
+                    responseUrl: response.url ?? currentUrl,
+                    status: response.status,
+                    method: currentMethod,
+                    location: response.headers.get("location") ?? undefined,
+                    followedHops,
+                    visitedRequests,
+                }));
+            }
+            else {
+                const location = resolveRedirectUrl(response.headers.get("location") ?? undefined, response.url ?? currentUrl);
+                if (!location)
+                    break;
+                if (followedHops >= MAX_STEALTH_REDIRECT_HOPS) {
+                    discardStealthRedirectBody(response);
+                    throw new TransportError(`Stealth request exceeded the ${MAX_STEALTH_REDIRECT_HOPS}-redirect limit`, { code: "transport_network_error", status: 0 });
+                }
                 discardStealthRedirectBody(response);
-                throw new TransportError(`Stealth request exceeded the ${MAX_STEALTH_REDIRECT_HOPS}-redirect limit`, { code: "transport_network_error", status: 0 });
+                nextUrl = location;
+                nextMethod = nextRedirectMethod(response.status, currentMethod);
             }
             assertStealthRedirectUrl(nextUrl);
-            discardStealthRedirectBody(response);
-            const nextMethod = nextRedirectMethod(response.status, currentMethod);
-            if (nextMethod !== currentMethod) {
+            currentHeaders = redirectHopHeaders({ from: currentUrl, to: nextUrl, methodChanged: nextMethod !== currentMethod }, currentHeaders);
+            if (nextMethod !== currentMethod)
                 currentBody = undefined;
-                currentHeaders = withoutRedirectBodyHeaders(currentHeaders);
-            }
             currentMethod = nextMethod;
             currentUrl = nextUrl;
             followedHops += 1;
+            visitedRequests.add(`${currentMethod} ${currentUrl}`);
             emitStealthTelemetry(telemetry?.sink, (sink) => sink.recordRedirectHop());
             finishExchange(status);
             finishExchange = undefined;
@@ -1155,10 +1248,15 @@ function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
         let entry = clients.get(cacheKey);
         if (!entry) {
             entry = {
+                // The header shape only partitions sessions; it is never handed to wreq as
+                // session `defaultHeaders`. wreq merges those into every request that lacks
+                // one of their names, so a header the SDK left off on purpose — a credential
+                // dropped on a cross-origin redirect hop, the body headers after POST -> GET,
+                // a cookie for another host — would come back with the first request's value.
+                // Every request already sends its complete ordered header list.
                 session: wreq.createSession({
                     browser,
                     os,
-                    ...(defaultHeaders ? { defaultHeaders } : {}),
                     ...(proxyUrl ? { proxy: proxyUrl } : {}),
                     ...(ignoreTlsErrors ? { insecure: true } : {}),
                     timeout: 30_000,
@@ -1332,7 +1430,12 @@ function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
             const { hasExplicitRetryPolicy, method, stealthRetryOptions } = (() => {
                 try {
                     const method = normalizeMethod(options.method ?? "GET");
-                    normalizedCallerHeaderEntries(options.headers ?? {});
+                    assertCallerHeadersSupported(options.headers ?? {});
+                    // Replace the caller's object with the validated copy: the walker, a
+                    // retry and an explicit replay all read this snapshot.
+                    const redirectPolicy = snapshotStealthRedirectPolicy(options);
+                    if (redirectPolicy)
+                        options.redirectPolicy = redirectPolicy;
                     const hasExplicitRetryPolicy = options.retry !== undefined;
                     const stealthRetryOptions = normalizeProxyTransportRetryOptions(options.retry, {
                         extraErrorCodes: STEALTH_PROXY_TRANSPORT_RETRY_ERROR_CODES,
@@ -1900,10 +2003,11 @@ function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
                 const maxHops = options.maxHops === undefined || !Number.isFinite(options.maxHops)
                     ? 10
                     : Math.max(0, Math.floor(options.maxHops));
-                const { url: _url, maxHops: _maxHops, stopWhen, params, sensitiveParams, ...fetchOptions } = options;
+                const { url: _url, maxHops: _maxHops, stopWhen, params, sensitiveParams, headers: initialHeaders, ...fetchOptions } = options;
                 const hops = [];
                 let method = normalizeMethod(options.method ?? "GET");
                 let body = options.body;
+                let headers = initialHeaders;
                 let response;
                 const visitedRequests = new Set();
                 const initialParams = params
@@ -1956,6 +2060,7 @@ function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
                     try {
                         response = await session.fetch(currentUrl, {
                             ...fetchOptions,
+                            ...(headers ? { headers } : {}),
                             body,
                             method,
                             ...(hopIndex === 0 && initialParams ? { params: initialParams } : {}),
@@ -2042,6 +2147,13 @@ function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
                             cookieStore: cookieJar.serialize(),
                         };
                     }
+                    if (headers) {
+                        headers = redirectHopHeaders({
+                            from: currentUrl,
+                            to: decision.nextUrl,
+                            methodChanged: decision.nextMethod !== method,
+                        }, headers);
+                    }
                     if (decision.nextMethod !== method) {
                         body = undefined;
                     }

package/dist/runtime/trace.js

@@ -76,7 +76,7 @@ function normalizeAttributes(attributes, redact, retainBigints = false) {
             ? redactedKey === REDACTION_FAILED
                 ? REDACTION_FAILED
                 : REDACTED_QUERY_VALUE
-            : normalizeAttributeValue(value, diagnosticAttributeRedactor(key, redact), retainBigints);
+            : normalizeAttributeValue(value, diagnosticAttributeRedactor(key, redact, value), retainBigints);
         return [normalizedKey, normalizedValue];
     })
         .filter((entry) => entry[1] !== undefined);
@@ -103,7 +103,7 @@ function prepareResourceAttributesForExport(attributes, redact, sanitize) {
                 ? redactedKey === REDACTION_FAILED
                     ? REDACTION_FAILED
                     : REDACTED_QUERY_VALUE
-                : sanitizeSpanNameForOutput(value, diagnosticAttributeRedactor(key, redact)),
+                : sanitizeSpanNameForOutput(value, diagnosticAttributeRedactor(key, redact, value)),
         ];
     }));
 }

package/dist/server/serve-implementation.js

@@ -41,6 +41,7 @@ import { getProviderBaseUrl, getProviderStealthBaseUrl } from "../runtime/provid
 import { PROXY_AUTH_IP_DENIED_CODE, PROXY_EDGE_AUTH_REJECTED_CODE, PROXY_POOL_EXHAUSTED_CODE, } from "../runtime/proxy-errors.js";
 import { PROVIDER_TELEMETRY_HEADER, ProxyTelemetryCollector, } from "../runtime/proxy-telemetry.js";
 import { closedEnum, RequestTelemetry, tenantOpaqueKeys, } from "../runtime/request-telemetry.js";
+import { resolverSpanAttributes } from "../runtime/resolver-span-attributes.js";
 import { bindResolverTelemetry, createUnsupportedResolverClient, inheritResolverTelemetryBinding, } from "../runtime/resolver-shared.js";
 import { ResolverTelemetryCollector, } from "../runtime/resolver-telemetry.js";
 import { createResolverRuntimeOptions, resolveNativeProxyPolicy, } from "../runtime/resolver-runtime-options.js";
@@ -385,7 +386,7 @@ function createStealthChallengeDetection(provider, resolverRuntime, resolverOver
                         const solve = () => resolver.solve(challenge, solveSignal, recorder ?? undefined);
                         return recorder
                             ? recorder.runSpan("resolver.solve", solve, {
-                                attributes: { challenge_kind: challenge.kind },
+                                attributes: resolverSpanAttributes({ challenge_kind: challenge.kind }),
                             })
                             : solve();
                     },

package/dist/testing/run.js

@@ -8,6 +8,7 @@ import { createTestHandleContext } from "../runtime/handle.js";
  */
 const STANDARD_TEST_CONNECTION_ID = "standard-test-connection";
 import { createMemoryProviderRuntimeState } from "../runtime/state.js";
+import { assertCallerHeadersSupported } from "../runtime/stealth-owned-headers.js";
 import { createUnsupportedOcrClient } from "../runtime/ocr.js";
 import { createUnsupportedSttClient } from "../runtime/stt.js";
 import { createNativeEgressAuthorization, NativeNetworkError, snapshotNativeConnectInput, snapshotNativeGrantInput, } from "../runtime/native-network.js";
@@ -213,13 +214,19 @@ function createUpstreamContext(provider, operationName, upstreamStub) {
         return normalizeUpstreamResponse(canned);
     };
     const httpCall = async (method, url, body, options) => toHttpResponse(await dispatch({ transport: "http", method, url, body, options }));
-    const stealthCall = async (url, options) => toStealthResponse(await dispatch({
-        transport: "stealth",
-        method: options?.method?.toUpperCase() ?? "GET",
-        url,
-        body: options?.body,
-        options,
-    }), url);
+    // The production transport rejects owned headers (User-Agent, Sec-Fetch-*,
+    // sec-ch-ua*, ...) before any byte is sent; the fake applies the same
+    // function, so a provider test fails exactly where production would.
+    const stealthCall = async (url, options) => {
+        assertCallerHeadersSupported(options?.headers ?? {});
+        return toStealthResponse(await dispatch({
+            transport: "stealth",
+            method: options?.method?.toUpperCase() ?? "GET",
+            url,
+            body: options?.body,
+            options,
+        }), url);
+    };
     const createBrowserPage = () => {
         let currentUrl = "about:blank";
         let currentResponse;

package/dist/trace-sanitization.js

@@ -22,7 +22,7 @@ export function sanitizeTraceAttributes(attributes, redact, reservedKeys = []) {
         const sanitizedKey = keyChanged ? nextKey() : sanitizeTraceText(key);
         const valueRedactor = typeof value === "bigint" || isDiagnosticBigintAttribute(attributes, key)
             ? diagnosticStructuredRedactor(redact)
-            : diagnosticAttributeRedactor(key, redact);
+            : diagnosticAttributeRedactor(key, redact, value);
         const sanitizedValue = keyChanged
             ? redactedKey === REDACTION_FAILED
                 ? REDACTION_FAILED

package/dist/types.d.ts

@@ -1193,7 +1193,23 @@ export interface StealthFetchOptions extends Omit<RequestOptions, "redirectPolic
     headers?: Record<string, string | string[]>;
     method?: HttpMethod;
     body?: string | Buffer;
+    /**
+     * Defaults to `"follow"`. Every followed hop drops the request-body headers
+     * when the method changes, `Authorization` and `Proxy-Authorization` when it
+     * leaves the current origin, and an explicit `Cookie` when it leaves the
+     * current site (scheme plus registrable domain); after that the session
+     * cookie jar supplies cookies for the new site.
+     */
     redirect?: "follow" | "manual" | "error";
+    /**
+     * Opt-in same-origin redirect enforcement, the ctx.http `redirectPolicy`
+     * for the stealth transport. A redirect whose target leaves the initial
+     * origin, exceeds `maxHops` (at most 10, the stealth redirect limit),
+     * loops, or has no usable `Location` throws `HttpRedirectError` before any
+     * request is sent to that target. Requires the default
+     * `redirect: "follow"`.
+     */
+    redirectPolicy?: HttpRedirectPolicy;
     /**
      * Maximum decoded response-body bytes to buffer. When set, the stealth
      * transport aborts the response and throws `response_too_large` if the
@@ -1219,13 +1235,21 @@ export interface StealthFetchOptions extends Omit<RequestOptions, "redirectPolic
          * replacement for hand-set `Sec-Fetch-*` headers, which the transport
          * rejects; it drives `Sec-Fetch-Mode`/`Dest`/`User`, `Accept`, `Priority`,
          * and `Upgrade-Insecure-Requests`.
+         *
+         * `form-post` is an HTML `<form method="post">` submission: a navigation
+         * (`navigate`/`document`, the document `Accept`, `Upgrade-Insecure-Requests`)
+         * that carries a body, in the header order Chrome uses for it, with
+         * `Cache-Control: max-age=0` and the caller's `Content-Type`, `Origin` and
+         * `Referer` in place. It is never inferred, since a form submission and a
+         * script `fetch()` POST look the same to the transport.
          */
-        requestClass?: "navigation" | "xhr" | "post";
+        requestClass?: "navigation" | "form-post" | "xhr" | "post";
         /**
-         * Whether a `navigation` request carries a user gesture and therefore
-         * `Sec-Fetch-User: ?1` (default `true`). Set `false` for script-driven
-         * navigations such as `location.replace`, which Chrome sends without it.
-         * Ignored for the `xhr` and `post` request classes.
+         * Whether a `navigation` or `form-post` request carries a user gesture and
+         * therefore `Sec-Fetch-User: ?1` (default `true`). Set `false` for
+         * script-driven navigations such as `location.replace` or
+         * `form.submit()`, which Chrome sends without it. Ignored for the `xhr` and
+         * `post` request classes.
          */
         userActivation?: boolean;
         /**
@@ -1321,7 +1345,7 @@ export interface StealthRedirectHop {
     location?: string;
     nextUrl?: string;
 }
-export interface StealthRedirectRunOptions extends Omit<StealthFetchOptions, "redirect"> {
+export interface StealthRedirectRunOptions extends Omit<StealthFetchOptions, "redirect" | "redirectPolicy"> {
     url: string;
     maxHops?: number;
     stopWhen?: (hop: StealthRedirectHop) => boolean | Promise<boolean>;

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "2.2.0-beta.68",
+	"version": "2.2.0-beta.69",
 	"name": "@apifuse/provider-sdk",
 	"private": false,
 	"type": "module",
@@ -140,7 +140,7 @@
 	},
 	"dependencies": {
 		"@clack/prompts": "^1.5.1",
-		"@rgrove/parse-xml": "4.2.2",
+		"@rgrove/parse-xml": "4.2.3",
 		"@types/ms": "^2.1.0",
 		"acorn": "^8.17.0",
 		"hono": "^4.12.25",