@apifuse/provider-sdk 2.2.0-beta.7 → 2.2.0-beta.70

package/dist/runtime/stealth.js

@@ -1,191 +1,494 @@
 import { createHash } from "node:crypto";
-import { Impit } from "impit";
-import { DEFAULT_SMARTPROXY_POOL_SIZE, invalidateProxyResolutionCacheAsync, ProxyResolutionError, resolveProxyConfigAsync, SMARTPROXY_MAX_POOL_SIZE, } from "../config/loader.js";
+import { Cookie } from "tough-cookie";
+import { DEFAULT_SMARTPROXY_POOL_SIZE, invalidateProxyResolutionCacheAsync, ProxyResolutionError, policyResolvesRegistryVendorChain, resolvePolicyProxyPoolSpan, resolvePolicyTransportAttemptCap, resolveProxyConfigAsync, vendorFromResolvedSource, } from "../config/loader.js";
 import { SDKError, TransportError } from "../errors.js";
-import { getStealthProfile } from "../stealth/profiles.js";
+import { DEFAULT_STEALTH_BROWSER, DEFAULT_STEALTH_OS, getStealthProfile, resolverClientProfileFamily, resolveStealthProfileSelection, } from "../stealth/profiles.js";
+import { chrome149HeaderOrder } from "./chrome149-header-order.js";
+import { registerDiagnosticValue } from "./diagnostic-env.js";
+import { assertCallerHeadersSupported } from "./stealth-owned-headers.js";
+import { ENGINE_CEREMONY_EGRESS_LEASE, } from "./egress-lease.js";
 import { createProxyAuthIpDeniedError, createProxyEdgeAuthRejectedError, createProxyEdgeTlsRejectedError, createProxyPoolExhaustedError, createProxyPoolStaleError, isProxyAuthIpDeniedMessage, isProxyEdgeAuthRejectedMessage, isProxyEdgeTlsRejectedResponse, isProxyPoolRefreshableError, isProxyPoolStaleMessage, isProxyPoolStaleStatus, PROXY_EDGE_AUTH_REJECTED_CODE, PROXY_POOL_STALE_CODE, } from "./proxy-errors.js";
-import { computeProxyAttemptIndex, computeProxyTransportRetryDelayMs, createDefaultProxyTransportRetryOptions, normalizeProxyTransportRetryOptions, shouldRetryProxyTransportAttempt, validateUnsafeProxyTransportRetryMethods, } from "./proxy-retry-policy.js";
-import { appendQueryParams } from "./request-options.js";
-const DEFAULT_PROFILE = "chrome-146";
+import { computeProxyAttemptIndex, computeProxyTransportRetryDelayMs, createDefaultProxyTransportRetryOptions, isProxyTransportRetryMethod, normalizeProxyTransportRetryOptions, shouldRetryProxyTransportAttempt, validateUnsafeProxyTransportRetryMethods, } from "./proxy-retry-policy.js";
+import { redirectHopHeaders } from "./redirect-hop-headers.js";
+import { evaluateRedirectHop, invalidRedirectPolicy, isRedirectStatus, nextRedirectMethod, nextSameOriginRedirectHop, normalizeRedirectPolicy, resolveRedirectUrl, } from "./redirects.js";
+import { isSensitiveKey, normalizeSensitiveParams, redactSensitiveError, redactSensitiveRequestError, redactSensitiveText, redactUrlQueryParams, serializeRequestUrl, } from "./request-options.js";
+import { akamaiSbsdChallengeKey, detectAkamaiSbsdChallenge, } from "./stealth-akamai-sbsd.js";
+import { StealthCookieJar } from "./stealth-cookies.js";
+export const DEFAULT_STEALTH_PROFILE = Object.freeze({
+    browser: DEFAULT_STEALTH_BROWSER,
+    os: DEFAULT_STEALTH_OS,
+});
 const MISSING_PROXY_WARNING = "[provider-sdk] Provider requested proxy routing, but no proxy URL was configured. Continuing without proxy.";
-const MAX_POLICY_PROXY_RETRY_ATTEMPTS = SMARTPROXY_MAX_POOL_SIZE;
 const MAX_POLICY_PROXY_POOL_REFRESHES = 1;
 const PROXY_CONNECT_FAILURE_CODE = "proxy_connect_failed";
 const PROXY_CONNECT_FAILURE_BODY_PATTERN = /\bproxy\b.*\b(non[\s-]?200|connect|tunnel)|\bconnect\b.*\bproxy\b|\btunnel\b/i;
 const PROXY_AUTH_DIAGNOSTIC_URL = "http://example.com/";
 const PROXY_AUTH_DIAGNOSTIC_TIMEOUT_MS = 5_000;
 const STEALTH_PROXY_TRANSPORT_RETRY_ERROR_CODES = [PROXY_CONNECT_FAILURE_CODE];
-const REMOVED_CHROME_PROFILE_NAMES = new Set([
-    "chrome-120",
-    "chrome-124",
-    "chrome-129",
-    "chrome-130",
-    "chrome-131",
-    "chrome-133",
-    "chrome-144",
-    "chrome-146-psk",
-    "chrome-131-psk",
-    "chrome-130-psk",
-    "edge-131",
+// Failures that mean the bound ceremony endpoint did not carry the request to the origin.
+// Proxy-level refusals are covered by isProxyPoolRefreshableError; PROXY_AUTH_IP_DENIED is
+// deliberately absent because another endpoint of the same vendor is denied just the same.
+const BOUND_EGRESS_TRANSPORT_FAILURE_CODES = new Set([
+    PROXY_CONNECT_FAILURE_CODE,
+    "transport_network_error",
+    "transport_timeout",
 ]);
-const CHROME_IMPIT_BY_MAJOR = {
-    100: "chrome100",
-    101: "chrome101",
-    104: "chrome104",
-    107: "chrome107",
-    110: "chrome110",
-    116: "chrome116",
-    124: "chrome124",
-    125: "chrome125",
-    131: "chrome131",
-    136: "chrome136",
-    142: "chrome142",
-};
-const FIREFOX_IMPIT_BY_MAJOR = {
-    128: "firefox128",
-    133: "firefox133",
-    135: "firefox135",
-    144: "firefox144",
+function isBoundEgressTransportFailure(error) {
+    return (isProxyPoolRefreshableError(error) ||
+        (error.code !== undefined && BOUND_EGRESS_TRANSPORT_FAILURE_CODES.has(error.code)));
+}
+const MAX_STEALTH_REDIRECT_HOPS = 10;
+const STEALTH_REDIRECT_POLICY_TRANSPORT = {
+    label: "ctx.stealth",
+    maxHops: MAX_STEALTH_REDIRECT_HOPS,
 };
 function isRecord(value) {
     return typeof value === "object" && value !== null;
 }
-class CookieJarImpl {
-    cookies;
-    constructor(cookieStrings) {
-        this.cookies = {};
-        this.setFromCookieStrings(cookieStrings);
-    }
-    setFromCookieStrings(cookieStrings) {
-        for (const cookieString of cookieStrings) {
-            const [nameValue] = cookieString.split(";");
-            if (!nameValue) {
-                continue;
-            }
-            const separatorIndex = nameValue.indexOf("=");
-            if (separatorIndex === -1) {
-                continue;
-            }
-            const name = nameValue.slice(0, separatorIndex).trim();
-            const value = nameValue.slice(separatorIndex + 1).trim();
-            if (name)
-                this.cookies[name] = value;
-        }
-    }
-    get(name) {
-        return this.cookies[name];
-    }
-    getAll() {
-        return { ...this.cookies };
-    }
-    has(name) {
-        return Object.hasOwn(this.cookies, name);
-    }
-    toString() {
-        return Object.entries(this.cookies)
-            .map(([name, value]) => `${name}=${value}`)
-            .join("; ");
-    }
-    toHeader() {
-        return this.toString();
+function sensitiveQueryParamNames(url) {
+    const queryStart = url.indexOf("?");
+    if (queryStart === -1)
+        return [];
+    const fragmentStart = url.indexOf("#", queryStart);
+    const query = url.slice(queryStart + 1, fragmentStart === -1 ? undefined : fragmentStart);
+    return [...new URLSearchParams(query).keys()].filter(isSensitiveKey);
+}
+function assertAkamaiSbsdClientProfile(declared, session) {
+    if (declared === undefined || resolverClientProfileFamily(declared) === session.browser)
+        return;
+    throw new SDKError(`Resolver client profile "${declared}" does not match the initiating stealth session browser "${session.browser}"`, {
+        code: "RESOLVER_CLIENT_PROFILE_MISMATCH",
+        fix: "Make resolver.clientProfile name the provider stealth browser family (chrome, firefox, or safari).",
+    });
+}
+let wreqModulePromise;
+function getWreqModule() {
+    if (!wreqModulePromise) {
+        wreqModulePromise = import("wreq-js").catch((error) => {
+            throw new SDKError(`Stealth transport is unavailable on ${process.platform}-${process.arch}: the wreq-js native binary could not be loaded.`, {
+                code: "stealth_transport_unavailable",
+                cause: error instanceof Error ? error : undefined,
+            });
+        });
     }
-    snapshot() {
-        return this.getAll();
+    return wreqModulePromise;
+}
+function parseProfileIdentifier(identifier) {
+    const match = /^(safari_ios|safari_ipad|firefox_android|firefox_private|chrome|edge|firefox|opera|safari|okhttp)_(\d+(?:[._]\d+)*)$/.exec(identifier.toLowerCase());
+    if (!match?.[1] || !match[2])
+        return null;
+    return {
+        family: match[1],
+        version: match[2].split(/[._]/).map(Number),
+    };
+}
+function compareVersionDistance(target, left, right) {
+    const width = Math.max(target.length, left.length, right.length);
+    for (let index = 0; index < width; index += 1) {
+        const targetPart = target[index] ?? 0;
+        const leftDistance = Math.abs((left[index] ?? 0) - targetPart);
+        const rightDistance = Math.abs((right[index] ?? 0) - targetPart);
+        if (leftDistance !== rightDistance)
+            return leftDistance - rightDistance;
     }
-    restore(cookies) {
-        this.clear();
-        for (const [name, value] of Object.entries(cookies)) {
-            if (name)
-                this.cookies[name] = value;
+    return 0;
+}
+function closestWreqProfile(identifier, wreqProfiles) {
+    const requested = parseProfileIdentifier(identifier);
+    if (!requested)
+        return undefined;
+    let closest;
+    for (const candidateName of wreqProfiles) {
+        const candidate = parseProfileIdentifier(candidateName);
+        if (!candidate || candidate.family !== requested.family)
+            continue;
+        if (!closest ||
+            compareVersionDistance(requested.version, candidate.version, closest.version) < 0) {
+            closest = { name: candidateName, version: candidate.version };
         }
     }
-    clear() {
-        for (const name of Object.keys(this.cookies)) {
-            delete this.cookies[name];
-        }
+    return closest?.name;
+}
+export function resolveWreqProfile(selection, wreqProfiles) {
+    const profile = getStealthProfile(selection);
+    const identifier = profile.tlsClientIdentifier?.toLowerCase() ?? "";
+    const os = profile.os;
+    const browser = closestWreqProfile(identifier, wreqProfiles);
+    if (!browser) {
+        throw new SDKError(`Stealth profile ${profile.browser}/${profile.os} cannot be mapped to a wreq-js browser profile.`);
     }
-    find(predicate) {
-        for (const [name, value] of Object.entries(this.cookies)) {
-            const cookie = `${name}=${value}`;
-            if (predicate(cookie)) {
-                return cookie;
-            }
-        }
-        return undefined;
+    return { browser, os };
+}
+function resolveUrl(baseUrl, url) {
+    return new URL(url, baseUrl).toString();
+}
+function resolveRequestUrl(baseUrl, url) {
+    try {
+        return resolveUrl(baseUrl, url);
     }
+    catch (error) {
+        // Both inputs are caller-owned, so an unparsable URL is a programming error, never a
+        // transport condition: not retryable, not the upstream's fault. Classify it here rather
+        // than in normalizeStealthTransportError, which also sees ERR_INVALID_URL from malformed
+        // upstream redirect targets. The fixed message keeps the URL (and any inline query
+        // values) out of the diagnostic surface; the runtime TypeError stays in `cause`.
+        throw new TransportError("Invalid request URL", {
+            code: "transport_invalid_url",
+            status: 0,
+            category: "provider_error",
+            retryable: false,
+            ...(error instanceof Error ? { cause: error } : {}),
+        });
+    }
+}
+function headerEntriesFromHeaders(headers) {
+    return Array.from(headers.entries());
+}
+function normalizeHeaders(headers) {
+    return Object.fromEntries(normalizedHeaderEntries(headers));
 }
-function closestImpitBrowser(major, candidates) {
-    let closestMajor;
-    let closestBrowser;
-    for (const [candidateMajorText, browser] of Object.entries(candidates)) {
-        const candidateMajor = Number(candidateMajorText);
-        if (closestMajor === undefined ||
-            Math.abs(candidateMajor - major) < Math.abs(closestMajor - major)) {
-            closestMajor = candidateMajor;
-            closestBrowser = browser;
+function trimOuterHttpWhitespace(value) {
+    return value.replace(/^[\t\n\r ]+|[\t\n\r ]+$/g, "");
+}
+function normalizedHeaderEntries(headers) {
+    const entries = [];
+    const indices = new Map();
+    for (const [originalName, originalValue] of Object.entries(headers)) {
+        if (originalValue === undefined)
+            continue;
+        const name = originalName.toLowerCase();
+        const value = (Array.isArray(originalValue) ? originalValue : [originalValue])
+            .map(trimOuterHttpWhitespace)
+            .join(", ");
+        const existingIndex = indices.get(name);
+        if (existingIndex === undefined) {
+            indices.set(name, entries.length);
+            entries.push([name, value]);
+            continue;
         }
+        const existing = entries[existingIndex];
+        if (existing)
+            existing[1] = `${existing[1]}, ${value}`;
     }
-    return closestBrowser ?? "chrome142";
+    return entries;
 }
-function resolveImpitBrowser(profileName) {
-    if (REMOVED_CHROME_PROFILE_NAMES.has(profileName)) {
-        throw new SDKError(`Unknown stealth profile: ${profileName}`);
+// Non-pseudo-header order of real Chrome 149. The fixture captures
+// (chrome-ground-truth-capture.json, chrome-extended-capture.json,
+// h1-casing-capture.json) were taken through Playwright's `locale` option, which
+// installs Accept-Language via DevTools next to User-Agent; real Chrome only
+// receives it from //net (URLRequestHttpJob::AddExtraHeaders), after
+// Accept-Encoding and before Cookie, as al-placement-capture.json B/C show.
+// chrome-form-post-capture.json was taken without that option and needs no
+// adjustment.
+const CHROME_HEADER_ORDERS = {
+    navigation: [
+        "sec-ch-ua",
+        "sec-ch-ua-mobile",
+        "sec-ch-ua-platform",
+        "upgrade-insecure-requests",
+        "user-agent",
+        "accept",
+        "sec-fetch-site",
+        "sec-fetch-mode",
+        "sec-fetch-user",
+        "sec-fetch-dest",
+        "accept-encoding",
+        "accept-language",
+        "cookie",
+        "priority",
+    ],
+    // xhr has no fixed table: it is emulated by chrome149HeaderOrder.
+    post: [
+        "content-length",
+        "sec-ch-ua-platform",
+        "user-agent",
+        "sec-ch-ua",
+        "content-type",
+        "sec-ch-ua-mobile",
+        "accept",
+        "origin",
+        "sec-fetch-site",
+        "sec-fetch-mode",
+        "sec-fetch-dest",
+        "referer",
+        "accept-encoding",
+        "accept-language",
+        "cookie",
+        "priority",
+    ],
+    "form-post": [
+        "content-length",
+        "cache-control",
+        "sec-ch-ua",
+        "sec-ch-ua-mobile",
+        "sec-ch-ua-platform",
+        "upgrade-insecure-requests",
+        "content-type",
+        "user-agent",
+        "origin",
+        "accept",
+        "sec-fetch-site",
+        "sec-fetch-mode",
+        "sec-fetch-user",
+        "sec-fetch-dest",
+        "referer",
+        "accept-encoding",
+        "accept-language",
+        "cookie",
+        "priority",
+    ],
+};
+const CHROME_H1_HEADER_ORDERS = {
+    navigation: [
+        "host",
+        "connection",
+        "sec-ch-ua",
+        "sec-ch-ua-mobile",
+        "sec-ch-ua-platform",
+        "upgrade-insecure-requests",
+        "user-agent",
+        "accept",
+        "sec-fetch-site",
+        "sec-fetch-mode",
+        "sec-fetch-user",
+        "sec-fetch-dest",
+        "accept-encoding",
+        "accept-language",
+        "cookie",
+    ],
+    xhr: [
+        "host",
+        "connection",
+        "sec-ch-ua-platform",
+        "cache-control",
+        "x-requested-with",
+        "user-agent",
+        "sec-ch-ua",
+        "sec-ch-ua-mobile",
+        "accept",
+        "sec-fetch-site",
+        "sec-fetch-mode",
+        "sec-fetch-dest",
+        "referer",
+        "accept-encoding",
+        "accept-language",
+        "cookie",
+    ],
+    post: [
+        "host",
+        "connection",
+        "content-length",
+        "sec-ch-ua-platform",
+        "user-agent",
+        "sec-ch-ua",
+        "content-type",
+        "sec-ch-ua-mobile",
+        "accept",
+        "origin",
+        "sec-fetch-site",
+        "sec-fetch-mode",
+        "sec-fetch-dest",
+        "referer",
+        "accept-encoding",
+        "accept-language",
+        "cookie",
+    ],
+    "form-post": [
+        "host",
+        "connection",
+        "content-length",
+        "cache-control",
+        "sec-ch-ua",
+        "sec-ch-ua-mobile",
+        "sec-ch-ua-platform",
+        "upgrade-insecure-requests",
+        "content-type",
+        "user-agent",
+        "origin",
+        "accept",
+        "sec-fetch-site",
+        "sec-fetch-mode",
+        "sec-fetch-user",
+        "sec-fetch-dest",
+        "referer",
+        "accept-encoding",
+        "accept-language",
+        "cookie",
+    ],
+};
+const CHROME_H1_HEADER_NAMES = {
+    host: "Host",
+    connection: "Connection",
+    "upgrade-insecure-requests": "Upgrade-Insecure-Requests",
+    "user-agent": "User-Agent",
+    "accept-language": "Accept-Language",
+    accept: "Accept",
+    "sec-fetch-site": "Sec-Fetch-Site",
+    "sec-fetch-mode": "Sec-Fetch-Mode",
+    "sec-fetch-user": "Sec-Fetch-User",
+    "sec-fetch-dest": "Sec-Fetch-Dest",
+    "accept-encoding": "Accept-Encoding",
+    cookie: "Cookie",
+    "cache-control": "Cache-Control",
+    "x-requested-with": "X-Requested-With",
+    referer: "Referer",
+    "content-length": "Content-Length",
+    "content-type": "Content-Type",
+    origin: "Origin",
+    range: "Range",
+};
+/**
+ * What each request class sends besides its header order, one row per public
+ * `stealth.requestClass`:
+ *
+ * - `fetchMetadata: "navigate"` is a document navigation: `Sec-Fetch-Mode:
+ *   navigate`, `Sec-Fetch-Dest: document`, `Sec-Fetch-User: ?1` unless
+ *   `userActivation` is false, `Upgrade-Insecure-Requests: 1`, and the
+ *   profile's `Accept` and `Priority`. `"cors"` is a script fetch: `cors` /
+ *   `empty`, `Accept: *\/*`, `Priority: u=1, i`.
+ * - `bodyful` sends `Content-Length`.
+ * - `validateCache` sends `Cache-Control: max-age=0`, which Chrome adds to a
+ *   form submission (chrome-form-post-capture.json).
+ */
+const CHROME_REQUEST_CLASSES = {
+    navigation: { fetchMetadata: "navigate", bodyful: false, validateCache: false },
+    "form-post": { fetchMetadata: "navigate", bodyful: true, validateCache: true },
+    xhr: { fetchMetadata: "cors", bodyful: false, validateCache: false },
+    post: { fetchMetadata: "cors", bodyful: true, validateCache: false },
+};
+function chromeHeaderOrder(requestClass, isHttp1, caller) {
+    if (isHttp1)
+        return CHROME_H1_HEADER_ORDERS[requestClass];
+    if (requestClass !== "xhr")
+        return CHROME_HEADER_ORDERS[requestClass];
+    // Cookie and Referer are forbidden Fetch headers, so they never enter the page
+    // Fetch Headers map the emulator models. Range does occupy a map bucket
+    // (m1-capture.json range_*), but HttpCache::Transaction removes it from the
+    // request headers and PartialData re-adds it at the tail.
+    const order = chrome149HeaderOrder([...caller.keys()].filter((name) => name !== "cookie" && name !== "referer"));
+    if (caller.has("range"))
+        order.splice(order.indexOf("range"), 1);
+    // //net appends Accept-Encoding and, unless the caller supplied one,
+    // Accept-Language (URLRequestHttpJob::AddExtraHeaders), then writes the Cookie
+    // header (SetCookieHeaderAndStart); the HTTP cache re-adds a caller Range after
+    // that, and the HTTP/2 Priority header stays last.
+    let insertAt = order.indexOf("accept-encoding") + 1;
+    if (order[insertAt] === "accept-language")
+        insertAt += 1;
+    for (const name of ["cookie", "range"]) {
+        if (!caller.has(name))
+            continue;
+        order.splice(insertAt, 0, name);
+        insertAt += 1;
     }
-    let profile;
+    return order;
+}
+function normalizedCallerHeaderEntriesFromRecord(headers) {
+    // The record has been through normalizeHeaders (lowercase, merged names); the
+    // lowercase here only guards later insertions such as the cookie jar's header.
+    assertCallerHeadersSupported(headers);
+    return Object.entries(headers).map(([name, value]) => [name.toLowerCase(), value]);
+}
+function chromeRequestClass(method, requestedClass) {
+    if (requestedClass)
+        return requestedClass;
+    if (method === "POST")
+        return "post";
+    return "navigation";
+}
+function secFetchSite(requestUrl, referer) {
+    if (!referer)
+        return "none";
     try {
-        profile = getStealthProfile(profileName);
+        return new URL(referer).origin === new URL(requestUrl).origin ? "same-origin" : "cross-site";
     }
     catch {
-        // Preserve the previous ctx.stealth.fetch() compatibility behavior: unknown
-        // profile strings still run with the transport default instead of failing
-        // before the request starts. Removed built-in profile aliases above remain
-        // explicit errors so callers do not accidentally pin retired fingerprints.
-        return "chrome142";
+        return "cross-site";
     }
-    const identifier = profile.tlsClientIdentifier?.toLowerCase() ?? "";
-    const chromeMatch = /^(?:chrome|edge)_(\d+)/.exec(identifier);
-    if (chromeMatch?.[1]) {
-        return closestImpitBrowser(Number(chromeMatch[1]), CHROME_IMPIT_BY_MAJOR);
+}
+function requiredEmulationHeader(headers, name) {
+    const value = headers.get(name);
+    if (value !== undefined)
+        return value;
+    throw new SDKError(`wreq-js Chrome emulation exposes no ${name} header.`, {
+        code: "STEALTH_PROFILE_UNAVAILABLE",
+    });
+}
+function buildChromeHeaderTuples(options) {
+    const callerEntries = normalizedCallerHeaderEntriesFromRecord(options.headers);
+    const caller = new Map(callerEntries);
+    const emulation = new Map(Array.from(options.emulationHeaders, ([name, value]) => [name.toLowerCase(), value]));
+    const requestClass = chromeRequestClass(options.method, options.requestClass);
+    const shape = CHROME_REQUEST_CLASSES[requestClass];
+    const referer = caller.get("referer");
+    const fetchSite = secFetchSite(options.requestUrl, referer);
+    const isNavigation = shape.fetchMetadata === "navigate";
+    const values = new Map([
+        ["sec-ch-ua", requiredEmulationHeader(emulation, "sec-ch-ua")],
+        ["sec-ch-ua-mobile", requiredEmulationHeader(emulation, "sec-ch-ua-mobile")],
+        ["sec-ch-ua-platform", requiredEmulationHeader(emulation, "sec-ch-ua-platform")],
+        ["user-agent", requiredEmulationHeader(emulation, "user-agent")],
+        [
+            "accept-language",
+            caller.get("accept-language") ??
+                options.acceptLanguage ??
+                requiredEmulationHeader(emulation, "accept-language"),
+        ],
+        ["accept", isNavigation ? requiredEmulationHeader(emulation, "accept") : "*/*"],
+        [
+            "accept-encoding",
+            caller.has("range") ? "identity" : requiredEmulationHeader(emulation, "accept-encoding"),
+        ],
+        ["priority", isNavigation ? requiredEmulationHeader(emulation, "priority") : "u=1, i"],
+        ["sec-fetch-site", fetchSite],
+        ["sec-fetch-mode", isNavigation ? "navigate" : "cors"],
+        ["sec-fetch-dest", isNavigation ? "document" : "empty"],
+    ]);
+    if (isNavigation) {
+        values.set("upgrade-insecure-requests", "1");
+        if (options.userActivation !== false)
+            values.set("sec-fetch-user", "?1");
     }
-    const firefoxMatch = /^firefox_(\d+)/.exec(identifier);
-    if (firefoxMatch?.[1]) {
-        return closestImpitBrowser(Number(firefoxMatch[1]), FIREFOX_IMPIT_BY_MAJOR);
+    if (shape.validateCache)
+        values.set("cache-control", "max-age=0");
+    for (const [name, value] of callerEntries)
+        values.set(name, value);
+    for (const name of ["content-type", "origin", "referer"]) {
+        const value = caller.get(name);
+        if (value !== undefined)
+            values.set(name, value);
     }
-    if (identifier.startsWith("safari_")) {
-        throw new SDKError(`Stealth profile "${profileName}" uses a Safari stealth fingerprint, but TypeScript ctx.stealth uses impit which currently supports Chrome, Firefox, and OkHttp profiles only. Use a Chrome/Firefox stealth profile for ctx.stealth or ctx.browser for Safari-specific behavior.`);
+    // A bodyful class keeps its class across a 301/302/303 that rewrites the method
+    // to GET (a form submission's redirect stays a validated navigation), but the
+    // rewritten request has no body and Chrome sends no Content-Length for it.
+    if (shape.bodyful && options.method !== "GET" && options.method !== "HEAD") {
+        values.set("content-length", caller.get("content-length") ?? String(Buffer.byteLength(options.body ?? "")));
     }
-    throw new SDKError(`Stealth profile "${profileName}" cannot be mapped to an impit browser profile.`);
-}
-function resolveUrl(baseUrl, url) {
-    return new URL(url, baseUrl).toString();
-}
-function headerEntriesFromHeaders(headers) {
-    return Array.from(headers.entries());
-}
-function normalizeHeaders(headers) {
-    const normalized = {};
-    for (const [name, value] of Object.entries(headers)) {
+    const isHttp1 = new URL(options.requestUrl).protocol === "http:";
+    if (isHttp1) {
+        values.set("host", new URL(options.requestUrl).host);
+        values.set("connection", "keep-alive");
+    }
+    const order = chromeHeaderOrder(requestClass, isHttp1, caller);
+    const tuples = [];
+    const placed = new Set();
+    for (const name of order) {
+        const value = values.get(name);
         if (value === undefined)
             continue;
-        normalized[name] = Array.isArray(value) ? value.join(", ") : value;
+        tuples.push([isHttp1 ? (CHROME_H1_HEADER_NAMES[name] ?? name) : name, value]);
+        placed.add(name);
     }
-    return normalized;
+    for (const [name, value] of callerEntries) {
+        if (placed.has(name))
+            continue;
+        tuples.push([isHttp1 ? (CHROME_H1_HEADER_NAMES[name] ?? name) : name, value]);
+    }
+    return tuples;
 }
 function hasOwn(object, key) {
     return Object.hasOwn(object, key);
 }
-function toImpitCookieJar(cookieJar) {
-    return {
-        setCookie(cookie, _url, cb) {
-            cookieJar.setFromCookieStrings([cookie]);
-            if (typeof cb === "function")
-                cb();
-        },
-        getCookieString(_url) {
-            return cookieJar.toString();
-        },
-    };
-}
 function assertNoUnsupportedFingerprintOverrides(options) {
     if (!isRecord(options))
         return;
@@ -199,7 +502,7 @@ function assertNoUnsupportedFingerprintOverrides(options) {
         unsupported.push("stealth.h2");
     if (unsupported.length === 0)
         return;
-    throw new SDKError(`ctx.stealth.fetch uses impit-managed browser fingerprints and no longer accepts low-level stealth overrides: ${unsupported.join(", ")}. Use the profile option instead.`);
+    throw new SDKError(`ctx.stealth.fetch uses transport-managed browser fingerprints and no longer accepts low-level stealth overrides: ${unsupported.join(", ")}. Use stealth.browser and stealth.os instead.`);
 }
 function responseHeadersToRecord(headers) {
     const record = {};
@@ -214,6 +517,29 @@ function setCookieHeadersFromResponse(headers) {
     const setCookie = headers.get("set-cookie");
     return setCookie ? splitCombinedSetCookieHeader(setCookie) : [];
 }
+function resolverCookiesFromResponse(response, requestUrl) {
+    const responseUrl = response.url ?? requestUrl;
+    return setCookieHeadersFromResponse(response.headers).flatMap((cookieString) => {
+        const cookie = Cookie.parse(cookieString);
+        if (!cookie?.key)
+            return [];
+        const expires = cookie.expires instanceof Date && Number.isFinite(cookie.expires.getTime())
+            ? cookie.expires.getTime() / 1_000
+            : undefined;
+        return [
+            {
+                name: cookie.key,
+                value: cookie.value,
+                ...(expires === undefined ? {} : { expires }),
+                httpOnly: cookie.httpOnly,
+                secure: cookie.secure,
+                ...(cookie.domain ? { domain: cookie.domain } : { domain: new URL(responseUrl).hostname }),
+                ...(cookie.path ? { path: cookie.path } : {}),
+                ...(cookie.sameSite ? { sameSite: cookie.sameSite } : {}),
+            },
+        ];
+    });
+}
 function splitCombinedSetCookieHeader(headerValue) {
     const cookieNamePattern = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+=/;
     const cookieStrings = [];
@@ -234,10 +560,15 @@ function splitCombinedSetCookieHeader(headerValue) {
         cookieStrings.push(finalCookie);
     return cookieStrings;
 }
-export async function normalizeResponse(response, requestUrl) {
+export async function normalizeResponse(response, requestUrl, maxBodyBytes) {
+    return normalizeResponseWithSignal(response, requestUrl, maxBodyBytes);
+}
+async function normalizeResponseWithSignal(response, requestUrl, maxBodyBytes, signal) {
     const headers = Object.fromEntries(response.headers.entries());
-    const cookies = new CookieJarImpl(setCookieHeadersFromResponse(response.headers));
-    const bodyBytes = await response.arrayBuffer();
+    const cookies = new StealthCookieJar(setCookieHeadersFromResponse(response.headers), response.url ?? requestUrl);
+    const bodyBytes = maxBodyBytes === undefined
+        ? await readResponseArrayBuffer(response, signal)
+        : await readResponseBodyWithLimit(response, maxBodyBytes, signal);
     const body = new TextDecoder().decode(bodyBytes);
     return {
         status: response.status,
@@ -263,17 +594,141 @@ export async function normalizeResponse(response, requestUrl) {
         },
     };
 }
+async function readResponseArrayBuffer(response, signal) {
+    if (!signal)
+        return response.arrayBuffer();
+    throwIfAmbientAborted(signal);
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const settle = (operation) => {
+            if (settled)
+                return;
+            settled = true;
+            signal.removeEventListener("abort", onAbort);
+            operation();
+        };
+        const onAbort = () => {
+            const error = toAmbientCancellationError(signal);
+            try {
+                void response.body?.cancel().catch(() => undefined);
+            }
+            catch {
+                // Preserve the cancellation error if accessing or cancelling the body fails.
+            }
+            settle(() => reject(error));
+        };
+        signal.addEventListener("abort", onAbort, { once: true });
+        try {
+            void response.arrayBuffer().then((body) => settle(() => resolve(body)), (error) => settle(() => reject(error)));
+        }
+        catch (error) {
+            settle(() => reject(error));
+        }
+        if (signal.aborted)
+            onAbort();
+    });
+}
+function responseTooLargeError(maxBodyBytes, observedBytes) {
+    return new TransportError(`Response body exceeded maxBodyBytes limit of ${maxBodyBytes} bytes (observed ${observedBytes} bytes)`, {
+        code: "response_too_large",
+        category: "upstream_http",
+        retryable: false,
+        status: 0,
+    });
+}
+function declaredContentLength(headers) {
+    const contentLength = headers.get("content-length")?.trim();
+    if (!contentLength || !/^\d+$/.test(contentLength))
+        return undefined;
+    const parsed = Number(contentLength);
+    return Number.isFinite(parsed) ? parsed : undefined;
+}
+async function readResponseBodyWithLimit(response, maxBodyBytes, signal) {
+    throwIfAmbientAborted(signal);
+    const contentLength = declaredContentLength(response.headers);
+    if (contentLength !== undefined && contentLength > maxBodyBytes) {
+        await response.body?.cancel().catch(() => undefined);
+        throw responseTooLargeError(maxBodyBytes, contentLength);
+    }
+    if (!response.body) {
+        throw new TransportError("Response body stream is unavailable", {
+            code: "transport_stream_unavailable",
+            category: "upstream_http",
+            status: 0,
+        });
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let receivedBytes = 0;
+    try {
+        while (true) {
+            const { done, value } = await readResponseBodyChunk(reader, signal);
+            if (done)
+                break;
+            if (!value)
+                continue;
+            receivedBytes += value.byteLength;
+            if (receivedBytes > maxBodyBytes) {
+                await reader.cancel().catch(() => undefined);
+                throw responseTooLargeError(maxBodyBytes, receivedBytes);
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    return concatenateResponseBodyChunks(chunks, receivedBytes);
+}
+function concatenateResponseBodyChunks(chunks, receivedBytes) {
+    const bodyBytes = new Uint8Array(receivedBytes);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bodyBytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return bodyBytes.buffer;
+}
+function readResponseBodyChunk(reader, signal) {
+    if (!signal)
+        return reader.read();
+    throwIfAmbientAborted(signal);
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const settle = (operation) => {
+            if (settled)
+                return;
+            settled = true;
+            signal.removeEventListener("abort", onAbort);
+            operation();
+        };
+        const onAbort = () => {
+            const error = toAmbientCancellationError(signal);
+            void reader.cancel().catch(() => undefined);
+            settle(() => reject(error));
+        };
+        signal.addEventListener("abort", onAbort, { once: true });
+        void reader.read().then((chunk) => settle(() => resolve(chunk)), (error) => settle(() => reject(error)));
+        if (signal.aborted)
+            onAbort();
+    });
+}
 function normalizeBody(body) {
     if (body === undefined) {
-        return "";
+        return undefined;
     }
     if (typeof body === "string") {
         return body;
     }
     if (Buffer.isBuffer(body)) {
-        return body.toString();
+        return Buffer.from(body);
     }
-    return String(body);
+    // `StealthFetchOptions.body` is `string | Buffer`; anything else is a provider fault,
+    // caught before the first request so a later replay can send the same bytes.
+    throw new SDKError("Stealth request bodies must be a string or Buffer", {
+        code: "STEALTH_BODY_UNSUPPORTED",
+        fix: "Supply a string or Buffer body; streams and typed arrays are not snapshotted.",
+    });
 }
 function isPolicyManagedProxy(options) {
     const policy = options.proxyPolicy ?? options.upstream?.proxy;
@@ -315,6 +770,10 @@ function proxyPoolIndexFromDiagnostics(diagnostics) {
     }
     return Math.floor(value);
 }
+function positiveDiagnosticNumber(diagnostics, name) {
+    const value = diagnostics?.[name];
+    return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : undefined;
+}
 function proxyEndpointHash(proxyUrl) {
     if (!proxyUrl)
         return undefined;
@@ -395,8 +854,38 @@ function normalizeStealthTransportError(error) {
         cause: error instanceof Error ? error : undefined,
     });
 }
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
+function toAmbientCancellationError(signal, error = signal.reason) {
+    if (error instanceof TransportError && error.code === "transport_cancelled") {
+        return error;
+    }
+    return new TransportError("Request cancelled", {
+        code: "transport_cancelled",
+        status: 0,
+        retryable: false,
+        ...(error !== undefined
+            ? { cause: error instanceof Error ? error : new Error(String(error)) }
+            : {}),
+    });
+}
+function throwIfAmbientAborted(signal) {
+    if (signal?.aborted)
+        throw toAmbientCancellationError(signal);
+}
+function sleep(ms, signal) {
+    if (!signal)
+        return new Promise((resolve) => setTimeout(resolve, ms));
+    throwIfAmbientAborted(signal);
+    return new Promise((resolve, reject) => {
+        const onAbort = () => {
+            clearTimeout(timer);
+            reject(toAmbientCancellationError(signal));
+        };
+        const timer = setTimeout(() => {
+            signal.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        signal.addEventListener("abort", onAbort, { once: true });
+    });
 }
 function normalizeMethod(method) {
     switch (method.toUpperCase()) {
@@ -420,16 +909,6 @@ function normalizeMethod(method) {
             throw new SDKError(`Unsupported stealth method: ${method}`);
     }
 }
-function isRedirectStatus(status) {
-    return [301, 302, 303, 307, 308].includes(status);
-}
-function nextRedirectMethod(status, method) {
-    if (status === 303 && method !== "HEAD")
-        return "GET";
-    if ((status === 301 || status === 302) && method === "POST")
-        return "GET";
-    return method;
-}
 function locationHeader(headers) {
     for (const [name, value] of Object.entries(headers)) {
         if (name.toLowerCase() === "location")
@@ -437,44 +916,441 @@ function locationHeader(headers) {
     }
     return undefined;
 }
+/**
+ * Snapshot a caller's `redirectPolicy` before the first send. The policy acts
+ * on redirects the transport follows, so it requires the default
+ * `redirect: "follow"`.
+ */
+function snapshotStealthRedirectPolicy(options) {
+    let policy;
+    try {
+        policy = normalizeRedirectPolicy(options.redirectPolicy, STEALTH_REDIRECT_POLICY_TRANSPORT);
+    }
+    catch (error) {
+        if (error instanceof TransportError)
+            throw error;
+        throw invalidRedirectPolicy(STEALTH_REDIRECT_POLICY_TRANSPORT, "could not be read safely", error instanceof Error ? error : undefined);
+    }
+    if (policy && options.redirect !== undefined && options.redirect !== "follow") {
+        throw invalidRedirectPolicy(STEALTH_REDIRECT_POLICY_TRANSPORT, `it applies to followed redirects and cannot be combined with redirect: "${options.redirect}"`);
+    }
+    return policy;
+}
+function assertStealthRedirectUrl(url) {
+    const protocol = new URL(url).protocol;
+    if (protocol !== "http:" && protocol !== "https:") {
+        throw new TransportError(`Stealth redirect target scheme "${protocol}" is not allowed`, {
+            code: "transport_invalid_url",
+            status: 0,
+        });
+    }
+}
+function discardStealthRedirectBody(response) {
+    try {
+        const cancellation = response.body?.cancel();
+        if (cancellation)
+            void cancellation.catch(() => undefined);
+    }
+    catch {
+        // Redirect handling is decided from status and headers. A cancellation
+        // failure must not replace or delay that decision.
+    }
+}
+/** Telemetry must never replace a transport result, including with caller-provided sinks. */
+function emitStealthTelemetry(sink, record) {
+    if (!sink)
+        return;
+    try {
+        record(sink);
+    }
+    catch {
+        /* The request owns its result. */
+    }
+}
+function stripStealthCookieMaterial(text, cookieNames) {
+    // Header-shaped Cookie/Set-Cookie material is redacted wholesale, including
+    // foreign names. Bare pairs outside a header are limited to jar-known names:
+    // a foreign bare name is indistinguishable from benign key=value prose and is
+    // therefore covered only when layer 1 registered its value.
+    let result = text.replace(/(^|[^\p{L}\p{N}_-])[\t ]*(?:cookie|set-cookie)[\t ]*(?::|=)[^\r\n]*/giu, "$1[REDACTED]");
+    result = result.replace(/"(?:cookie|set-cookie)"[\t ]*:[\t ]*"(?:\\.|[^"\\])*"/giu, "[REDACTED]");
+    for (const name of cookieNames) {
+        const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        result = result.replace(new RegExp(`(^|[;,&?\\s])${escaped}\\s*=\\s*[^;,\\s&\\r\\n]+`, "giu"), "$1[REDACTED]");
+    }
+    return result;
+}
+function startStealthExchange(telemetry, method, options, signal) {
+    if (!telemetry)
+        return () => { };
+    const startedAt = Date.now();
+    const requestClass = chromeRequestClass(method, options.stealth?.requestClass);
+    let recorded = false;
+    return (status, error) => {
+        if (recorded)
+            return;
+        recorded = true;
+        emitStealthTelemetry(telemetry?.sink, (sink) => {
+            let code;
+            if (error !== undefined) {
+                try {
+                    code = signal?.aborted
+                        ? "transport_cancelled"
+                        : normalizeStealthTransportError(error).code;
+                }
+                catch {
+                    code = "other";
+                }
+            }
+            const knownCodes = [
+                "transport_network_error",
+                "transport_timeout",
+                "transport_cancelled",
+                "upstream_http_error",
+                "response_too_large",
+                "proxy_connect_failed",
+                "PROXY_POOL_STALE",
+                "PROXY_EDGE_AUTH_REJECTED",
+                "PROXY_AUTH_IP_DENIED",
+                "PROXY_EDGE_TLS_REJECTED",
+                "PROXY_REQUIRED",
+            ];
+            const errorCode = code
+                ? knownCodes.includes(code)
+                    ? code
+                    : "other"
+                : status !== undefined && status >= 400
+                    ? "upstream_http_error"
+                    : undefined;
+            const strip = (text) => stripStealthCookieMaterial(text, telemetry.cookieJar?.names() ?? []);
+            sink.recordAttempt({
+                ms: Date.now() - startedAt,
+                profileId: telemetry.profileId,
+                proxyUsed: telemetry.proxyUsed,
+                kind: telemetry.kind,
+                requestClass: requestClass === "navigation" && options.stealth?.userActivation === false
+                    ? "script_navigation"
+                    : requestClass === "form-post"
+                        ? "form_post"
+                        : requestClass,
+                ...(status === undefined ? {} : { status }),
+                ...(errorCode ? { errorCode } : {}),
+                ...(error === undefined
+                    ? {}
+                    : {
+                        diagnostics: {
+                            name: strip(error instanceof Error ? error.name : "Error"),
+                            message: strip(error instanceof Error ? error.message : String(error)),
+                            ...(error instanceof Error && "code" in error && typeof error.code === "string"
+                                ? { code: strip(error.code) }
+                                : {}),
+                        },
+                    }),
+            });
+        });
+    };
+}
+async function fetchStealthRedirectChain(transport, cookieJar, requestUrl, method, options, signal, buildHeaders, telemetry) {
+    let currentUrl = requestUrl;
+    let currentMethod = method;
+    let currentBody = options.body === undefined ? undefined : normalizeBody(options.body);
+    let currentHeaders = normalizeHeaders({ ...(options.headers ?? {}) });
+    let followedHops = 0;
+    let response;
+    const deadline = options.timeout ? performance.now() + options.timeout : undefined;
+    // Snapshotted and validated by session.fetch before the first send.
+    const redirectPolicy = options.redirectPolicy;
+    const initialOrigin = new URL(requestUrl).origin;
+    const visitedRequests = new Set([`${method} ${requestUrl}`]);
+    let finishExchange;
+    let status;
+    let exchangeError;
+    try {
+        while (true) {
+            throwIfAmbientAborted(signal);
+            const headers = { ...currentHeaders };
+            if (!hasHeader(headers, "cookie")) {
+                const cookieHeader = cookieJar.toHeader(currentUrl);
+                if (cookieHeader)
+                    headers.cookie = cookieHeader;
+            }
+            const requestInit = {
+                headers: buildHeaders
+                    ? buildHeaders(currentUrl, currentMethod, currentBody, headers)
+                    : headers,
+                method: currentMethod,
+                redirect: "manual",
+                ...(new URL(currentUrl).protocol === "http:" ? { disableDefaultHeaders: true } : {}),
+                ...(signal ? { signal } : {}),
+            };
+            if (currentBody !== undefined)
+                requestInit.body = currentBody;
+            await transport.clearCookies();
+            throwIfAmbientAborted(signal);
+            const remainingTimeout = deadline === undefined ? undefined : Math.ceil(deadline - performance.now());
+            if (remainingTimeout !== undefined && remainingTimeout <= 0) {
+                throw new TransportError("Request timed out", {
+                    code: "transport_timeout",
+                    status: 0,
+                });
+            }
+            if (remainingTimeout !== undefined)
+                requestInit.timeout = remainingTimeout;
+            status = undefined;
+            finishExchange = startStealthExchange(telemetry, currentMethod, options, signal);
+            response = await transport.fetch(currentUrl, requestInit);
+            status = response.status;
+            if (signal?.aborted) {
+                discardStealthRedirectBody(response);
+                throw toAmbientCancellationError(signal);
+            }
+            cookieJar.setFromCookieStrings(setCookieHeadersFromResponse(response.headers), response.url ?? currentUrl);
+            if (!isRedirectStatus(response.status) || options.redirect === "manual")
+                break;
+            if (options.redirect === "error") {
+                discardStealthRedirectBody(response);
+                throw new TransportError("Stealth request encountered a redirect", {
+                    code: "transport_network_error",
+                    status: 0,
+                });
+            }
+            let nextUrl;
+            let nextMethod;
+            if (redirectPolicy) {
+                discardStealthRedirectBody(response);
+                ({ nextUrl, nextMethod } = nextSameOriginRedirectHop({
+                    policy: redirectPolicy,
+                    initialOrigin,
+                    currentUrl,
+                    responseUrl: response.url ?? currentUrl,
+                    status: response.status,
+                    method: currentMethod,
+                    location: response.headers.get("location") ?? undefined,
+                    followedHops,
+                    visitedRequests,
+                }));
+            }
+            else {
+                const location = resolveRedirectUrl(response.headers.get("location") ?? undefined, response.url ?? currentUrl);
+                if (!location)
+                    break;
+                if (followedHops >= MAX_STEALTH_REDIRECT_HOPS) {
+                    discardStealthRedirectBody(response);
+                    throw new TransportError(`Stealth request exceeded the ${MAX_STEALTH_REDIRECT_HOPS}-redirect limit`, { code: "transport_network_error", status: 0 });
+                }
+                discardStealthRedirectBody(response);
+                nextUrl = location;
+                nextMethod = nextRedirectMethod(response.status, currentMethod);
+            }
+            assertStealthRedirectUrl(nextUrl);
+            currentHeaders = redirectHopHeaders({ from: currentUrl, to: nextUrl, methodChanged: nextMethod !== currentMethod }, currentHeaders);
+            if (nextMethod !== currentMethod)
+                currentBody = undefined;
+            currentMethod = nextMethod;
+            currentUrl = nextUrl;
+            followedHops += 1;
+            visitedRequests.add(`${currentMethod} ${currentUrl}`);
+            emitStealthTelemetry(telemetry?.sink, (sink) => sink.recordRedirectHop());
+            finishExchange(status);
+            finishExchange = undefined;
+        }
+        const normalized = await normalizeResponseWithSignal(response, currentUrl, options.maxBodyBytes, signal);
+        if (followedHops > 0)
+            normalized.redirected = true;
+        return { normalized, response };
+    }
+    catch (error) {
+        exchangeError = error;
+        throw error;
+    }
+    finally {
+        finishExchange?.(status, exchangeError);
+    }
+}
 function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
     const clients = new Map();
     let closed = false;
     let hasWarnedMissingProxy = false;
     const warn = clientOptions.warn ?? console.warn;
-    const cookieJar = new CookieJarImpl([]);
-    const impitCookieJar = toImpitCookieJar(cookieJar);
-    function getClient(profileName, proxyUrl, ignoreTlsErrors) {
+    const cookieJar = new StealthCookieJar([], baseUrl, registerDiagnosticValue);
+    const akamaiSbsdState = { transactions: new Map() };
+    const challengedReplays = new WeakMap();
+    const ceremonyEgressLease = clientOptions[ENGINE_CEREMONY_EGRESS_LEASE];
+    // The lease is shared by every session of this client; this is the lease generation this
+    // session's challenge state and replay records were built against.
+    let observedEgressGeneration = ceremonyEgressLease?.generation ?? 0;
+    const automaticChallengeRefetchPolicy = {
+        ...createDefaultProxyTransportRetryOptions({ label: "Stealth" }),
+        methods: ["GET"],
+    };
+    function clearAkamaiSbsdState() {
+        akamaiSbsdState.rememberedScript = undefined;
+        akamaiSbsdState.transactions.clear();
+        akamaiSbsdState.completedSuccessKey = undefined;
+    }
+    function currentEgressGeneration() {
+        return ceremonyEgressLease?.generation ?? 0;
+    }
+    /**
+     * Whoever dropped the binding (this session by expiry or release, or another session of
+     * the same client), the challenge state that was only valid on the retired endpoint goes
+     * with it, and replay records made against the old generation stop matching.
+     */
+    function syncCeremonyEgress() {
+        const generation = currentEgressGeneration();
+        if (generation === observedEgressGeneration)
+            return;
+        observedEgressGeneration = generation;
+        clearAkamaiSbsdState();
+    }
+    /**
+     * A binding past its vendor session lifetime is dropped, together with the challenge
+     * state that was only valid on that endpoint, so this request selects and binds afresh.
+     */
+    function expireCeremonyEgressLease() {
+        ceremonyEgressLease?.dropExpiredBinding();
+        syncCeremonyEgress();
+    }
+    /**
+     * The lease is best effort (ADR-0010: a raw Smartproxy endpoint is not a vendor-guaranteed
+     * lease). When the attempt that ran on the bound endpoint fails at the transport (the
+     * proxy refused it, the tunnel never opened, the socket died or timed out) the binding is
+     * released so the ceremony can leave a dead endpoint before its lifetime elapses. Origin
+     * responses, however bad, keep the binding: the endpoint is alive. Returns true when a
+     * binding was released.
+     */
+    function releaseFailedCeremonyEgress(attemptProxyUrl, error) {
+        const bound = ceremonyEgressLease?.binding;
+        if (!ceremonyEgressLease ||
+            !bound ||
+            !attemptProxyUrl ||
+            attemptProxyUrl !== bound.proxyUrl ||
+            !isBoundEgressTransportFailure(error)) {
+            return false;
+        }
+        ceremonyEgressLease.dropBinding();
+        syncCeremonyEgress();
+        return true;
+    }
+    async function getClientEntry(profile, proxyUrl, ignoreTlsErrors, defaultHeaders) {
         if (closed) {
             throw new TransportError("Stealth session is closed", { status: 0 });
         }
-        const browser = resolveImpitBrowser(profileName);
-        const cacheKey = JSON.stringify({ browser, proxyUrl, ignoreTlsErrors });
-        let client = clients.get(cacheKey);
-        if (!client) {
-            client = new Impit({
-                browser,
-                cookieJar: impitCookieJar,
-                ...(proxyUrl ? { proxyUrl } : {}),
-                ...(ignoreTlsErrors ? { ignoreTlsErrors: true } : {}),
-                timeout: 30_000,
-            });
-            clients.set(cacheKey, client);
+        const wreq = await getWreqModule();
+        const { browser, os } = resolveWreqProfile(profile, wreq.getProfiles());
+        const cacheKey = JSON.stringify({
+            browser,
+            os,
+            proxyUrl,
+            ignoreTlsErrors,
+            headerOrder: defaultHeaders?.map(([name]) => name),
+        });
+        let entry = clients.get(cacheKey);
+        if (!entry) {
+            entry = {
+                // The header shape only partitions sessions; it is never handed to wreq as
+                // session `defaultHeaders`. wreq merges those into every request that lacks
+                // one of their names, so a header the SDK left off on purpose — a credential
+                // dropped on a cross-origin redirect hop, the body headers after POST -> GET,
+                // a cookie for another host — would come back with the first request's value.
+                // Every request already sends its complete ordered header list.
+                session: wreq.createSession({
+                    browser,
+                    os,
+                    ...(proxyUrl ? { proxy: proxyUrl } : {}),
+                    ...(ignoreTlsErrors ? { insecure: true } : {}),
+                    timeout: 30_000,
+                }),
+                tail: Promise.resolve(),
+            };
+            clients.set(cacheKey, entry);
         }
-        return client;
+        return entry;
     }
-    async function resolveRequestProxy(options, proxyAttempt) {
+    async function withClient(profile, proxyUrl, ignoreTlsErrors, operation, signal, defaultHeaders) {
+        throwIfAmbientAborted(signal);
+        const entry = await getClientEntry(profile, proxyUrl, ignoreTlsErrors, defaultHeaders);
+        throwIfAmbientAborted(signal);
+        const previous = entry.tail;
+        let release;
+        entry.tail = new Promise((resolve) => {
+            release = resolve;
+        });
+        let acquired = false;
+        try {
+            await waitForClientTurn(previous, signal);
+            acquired = true;
+            throwIfAmbientAborted(signal);
+            const client = await entry.session;
+            throwIfAmbientAborted(signal);
+            const result = await operation(client);
+            throwIfAmbientAborted(signal);
+            return result;
+        }
+        finally {
+            if (acquired) {
+                release();
+            }
+            else {
+                void previous.then(release, release);
+            }
+        }
+    }
+    async function waitForClientTurn(previous, signal) {
+        if (!signal) {
+            await previous;
+            return;
+        }
+        throwIfAmbientAborted(signal);
+        await new Promise((resolve, reject) => {
+            let settled = false;
+            const settle = (operation) => {
+                if (settled)
+                    return;
+                settled = true;
+                signal.removeEventListener("abort", onAbort);
+                operation();
+            };
+            const onAbort = () => settle(() => reject(toAmbientCancellationError(signal)));
+            signal.addEventListener("abort", onAbort, { once: true });
+            void previous.then(() => settle(resolve), (error) => settle(() => reject(error)));
+            if (signal.aborted)
+                onAbort();
+        });
+    }
+    async function resolveRequestProxy(options, proxyAttempt, refreshEpoch) {
+        const bound = ceremonyEgressLease?.binding;
+        if (bound) {
+            if (options?.proxy !== undefined || options?.proxyAttemptOffset !== undefined) {
+                throw new SDKError("A ceremony-bound egress cannot be overridden by provider request options", {
+                    code: "EGRESS_LEASE_BINDING_INVALID",
+                    fix: "Remove `proxy` and `proxyAttemptOffset` from stealth requests made inside an auth ceremony.",
+                });
+            }
+            return {
+                url: bound.proxyUrl,
+                poolIndex: bound.poolIndex,
+                proxyHash: proxyEndpointHash(bound.proxyUrl),
+                vendor: bound.vendor,
+                refreshEpoch: bound.refreshEpoch,
+                lifetimeMinutes: bound.lifetimeMinutes,
+            };
+        }
         const resolvedProxy = await resolveProxyConfigAsync({
             proxy: options?.proxy ?? clientOptions.proxy,
             upstream: clientOptions.upstream,
-            apifuseConfig: clientOptions.apifuseConfig,
             affinityKey: clientOptions.affinityKey,
             proxyAttempt: computeProxyAttemptIndex({
                 baseProxyAttempt: clientOptions.proxyAttempt,
                 proxyAttemptOffset: options?.proxyAttemptOffset,
                 retryAttemptOffset: proxyAttempt,
             }),
+            // The stealth transport tunnels both HTTP CONNECT and SOCKS5,
+            // preserving the client TLS fingerprint end-to-end.
+            transportProtocols: ["http", "socks5"],
+            ...(refreshEpoch === undefined ? {} : { proxyRefreshEpoch: refreshEpoch }),
             telemetry: clientOptions.telemetry,
+            engineCredentials: clientOptions.engineCredentials,
         });
         if (resolvedProxy.shouldWarn && !hasWarnedMissingProxy) {
             hasWarnedMissingProxy = true;
@@ -484,50 +1360,152 @@ function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
             url: resolvedProxy.url,
             poolIndex: proxyPoolIndexFromDiagnostics(resolvedProxy.diagnostics),
             proxyHash: proxyEndpointHash(resolvedProxy.url),
+            vendor: vendorFromResolvedSource(resolvedProxy.source),
+            refreshEpoch: refreshEpoch ?? 0,
+            ...(positiveDiagnosticNumber(resolvedProxy.diagnostics, "lifetimeMinutes") === undefined
+                ? {}
+                : {
+                    lifetimeMinutes: positiveDiagnosticNumber(resolvedProxy.diagnostics, "lifetimeMinutes"),
+                }),
         };
     }
+    function bindCeremonyEgress(attemptProxy) {
+        const lease = ceremonyEgressLease;
+        if (!lease || !attemptProxy?.url || !attemptProxy.vendor)
+            return;
+        if (lease.binding) {
+            // A concurrent request on this session may have bound the ceremony while this one
+            // was in flight on an endpoint it selected before the binding existed (pool
+            // rotation after a transport failure). Its response reached the origin from an
+            // egress the handle does not name; accepting it would split the ceremony identity.
+            if (attemptProxy.url !== lease.binding.proxyUrl) {
+                throw new SDKError("The response arrived on an egress other than the ceremony's bound endpoint", {
+                    code: "EGRESS_LEASE_BINDING_INVALID",
+                });
+            }
+            return;
+        }
+        if (attemptProxy.poolIndex === undefined ||
+            attemptProxy.lifetimeMinutes === undefined ||
+            !clientOptions.affinityKey) {
+            // Registry vendors always report pool index and session lifetime; missing either
+            // is an SDK fault, not something the caller can correct.
+            throw new SDKError("The selected egress cannot be represented by a ceremony lease", {
+                code: "EGRESS_LEASE_BINDING_INVALID",
+            });
+        }
+        const binding = {
+            vendor: attemptProxy.vendor,
+            proxyUrl: attemptProxy.url,
+            poolIndex: attemptProxy.poolIndex,
+            affinityKey: clientOptions.affinityKey,
+            refreshEpoch: attemptProxy.refreshEpoch ?? 0,
+            lifetimeMinutes: attemptProxy.lifetimeMinutes,
+        };
+        lease.bind(binding);
+    }
     const session = {
-        async fetch(url, options = {}) {
-            const method = normalizeMethod(options.method ?? "GET");
-            const hasExplicitRetryPolicy = options.retry !== undefined;
-            const stealthRetryOptions = normalizeProxyTransportRetryOptions(options.retry, {
-                extraErrorCodes: STEALTH_PROXY_TRANSPORT_RETRY_ERROR_CODES,
-                label: "Stealth",
-            }) ??
-                (hasExplicitRetryPolicy
-                    ? undefined
-                    : createDefaultProxyTransportRetryOptions({
+        async fetch(url, callerOptions = {}) {
+            expireCeremonyEgressLease();
+            const requestBody = normalizeBody(callerOptions.body);
+            // Snapshot the caller's headers with the body before the first send: the first
+            // request and an explicit replay both use this copy, so a caller mutating its own
+            // objects afterwards cannot make the two sends differ.
+            const options = {
+                ...callerOptions,
+                ...(callerOptions.headers
+                    ? {
+                        headers: Object.fromEntries(Object.entries(callerOptions.headers).map(([name, value]) => [
+                            name,
+                            Array.isArray(value) ? [...value] : value,
+                        ])),
+                    }
+                    : {}),
+                ...(requestBody === undefined ? {} : { body: requestBody }),
+            };
+            const requestProfile = resolveStealthProfileSelection(options.stealth, defaultProfile);
+            let challengeSolveAttempted = false;
+            let challengeRefetchAttempted = false;
+            let challengeSolveFailure;
+            const { hasExplicitRetryPolicy, method, stealthRetryOptions } = (() => {
+                try {
+                    const method = normalizeMethod(options.method ?? "GET");
+                    assertCallerHeadersSupported(options.headers ?? {});
+                    // Replace the caller's object with the validated copy: the walker, a
+                    // retry and an explicit replay all read this snapshot.
+                    const redirectPolicy = snapshotStealthRedirectPolicy(options);
+                    if (redirectPolicy)
+                        options.redirectPolicy = redirectPolicy;
+                    const hasExplicitRetryPolicy = options.retry !== undefined;
+                    const stealthRetryOptions = normalizeProxyTransportRetryOptions(options.retry, {
                         extraErrorCodes: STEALTH_PROXY_TRANSPORT_RETRY_ERROR_CODES,
                         label: "Stealth",
-                    }));
-            if (stealthRetryOptions) {
-                validateUnsafeProxyTransportRetryMethods(stealthRetryOptions, "Stealth");
-            }
+                    }) ??
+                        (hasExplicitRetryPolicy
+                            ? undefined
+                            : createDefaultProxyTransportRetryOptions({
+                                extraErrorCodes: STEALTH_PROXY_TRANSPORT_RETRY_ERROR_CODES,
+                                label: "Stealth",
+                            }));
+                    if (stealthRetryOptions) {
+                        validateUnsafeProxyTransportRetryMethods(stealthRetryOptions, "Stealth");
+                    }
+                    return { hasExplicitRetryPolicy, method, stealthRetryOptions };
+                }
+                catch (error) {
+                    throw redactSensitiveRequestError(error, url, options.sensitiveParams);
+                }
+            })();
+            throwIfAmbientAborted(clientOptions.signal);
             const hasPolicyProxy = isPolicyManagedProxy(clientOptions);
             const usesPolicyAllocator = hasPolicyProxy && !options.proxy && !clientOptions.proxy;
             const retryAttemptCap = Math.max(1, stealthRetryOptions?.attempts ?? 1);
-            const policyProxyAttemptCap = Math.max(1, Math.min(MAX_POLICY_PROXY_RETRY_ATTEMPTS, clientOptions.proxyPolicy?.session?.poolSize ??
+            // Span the whole vendor chain: successive attempts rotate one vendor's
+            // pool, then fail over to the next vendor via the flat attempt index.
+            const policyProxy = clientOptions.proxyPolicy ??
                 (typeof clientOptions.upstream?.proxy === "object"
-                    ? clientOptions.upstream.proxy.session?.poolSize
-                    : undefined) ??
-                DEFAULT_SMARTPROXY_POOL_SIZE));
-            const maxAttempts = usesPolicyAllocator ? policyProxyAttemptCap : retryAttemptCap;
+                    ? clientOptions.upstream.proxy
+                    : undefined);
+            // The pool span is already bounded by each vendor's max pool size
+            // (smartproxy ≤20, nodemaven ≤50), so the configured span never exceeds
+            // the chain's true maximum — a large NodeMaven pool stays fully
+            // reachable rather than being truncated at an arbitrary ceiling.
+            const policyProxyAttemptCap = Math.max(1, policyProxy ? resolvePolicyProxyPoolSpan(policyProxy) : DEFAULT_SMARTPROXY_POOL_SIZE);
+            // A registry vendor chain (smartproxy/nodemaven) is the only policy whose
+            // successive attempts resolve a *different* endpoint, so it is the only one
+            // that may widen the attempt cap to the pool span, de-duplicate endpoints,
+            // and drive allocator stale-pool refresh. Deprecated custom/decodo policies
+            // have no managed endpoint to rotate or refresh, so they follow the ordinary
+            // transport-retry budget instead.
+            const rotatesRegistryChain = usesPolicyAllocator && policyResolvesRegistryVendorChain(policyProxy);
+            const unboundMaxAttempts = rotatesRegistryChain ? policyProxyAttemptCap : retryAttemptCap;
+            // A bound ceremony has exactly one endpoint to try; releasing the binding after a
+            // transport failure widens the budget back to the ordinary rotation span.
+            let maxAttempts = ceremonyEgressLease?.binding ? 1 : unboundMaxAttempts;
+            const dedupeAllocatorEndpoints = rotatesRegistryChain;
             let lastError;
             for (let refreshAttempt = 0; refreshAttempt <= MAX_POLICY_PROXY_POOL_REFRESHES; refreshAttempt += 1) {
                 let stalePoolError;
                 let stalePoolDiagnosticProxy;
                 const attemptedProxies = new Set();
                 for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+                    throwIfAmbientAborted(clientOptions.signal);
                     let proxy;
                     let attemptProxy;
-                    const attemptStartedAt = Date.now();
+                    // Reuse the exact serialization used by this outbound attempt in its catch path.
+                    let serializedUrl;
+                    let fallbackSensitiveValues = [];
+                    let fallbackRequestUrl;
+                    let fallbackRedactedUrl;
+                    let attemptStartedAt = Date.now();
                     let attemptRecorded = false;
+                    const attemptEgressGeneration = currentEgressGeneration();
                     const recordProxyAttempt = (outcome, errorCode, status) => {
                         if (attemptRecorded || !proxy)
                             return;
                         attemptRecorded = true;
                         clientOptions.telemetry?.recordProxyAttempt?.({
-                            provider: "smartproxy",
+                            provider: attemptProxy?.vendor ?? "smartproxy",
                             attempt: attempt + 1,
                             ...(attemptProxy?.poolIndex === undefined
                                 ? {}
@@ -539,75 +1517,373 @@ function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
                             durationMs: Date.now() - attemptStartedAt,
                         });
                     };
+                    // Shared tail of the first fetch, the automatic refetch, and an explicit replay: a
+                    // classified challenge is returned whatever `throwOnHttpError` says (documented on
+                    // StealthFetchOptions), any other non-2xx honours it, and the proxy attempt is
+                    // recorded once per delivered response.
+                    const finalizeAttempt = (attemptResponse, attemptNormalized) => {
+                        if (attemptNormalized.challenge)
+                            emitStealthTelemetry(clientOptions.stealthTelemetry, (sink) => sink.recordSbsd(attemptNormalized.challenge.outcome));
+                        if (!attemptNormalized.challenge &&
+                            attemptResponse.status >= 400 &&
+                            options.throwOnHttpError !== false) {
+                            throw new TransportError(`Upstream request failed with status ${attemptResponse.status}`, { code: "upstream_http_error", status: attemptResponse.status });
+                        }
+                        recordProxyAttempt("ok", undefined, attemptResponse.status);
+                        return attemptNormalized;
+                    };
+                    const redactAttemptError = (error) => redactSensitiveError(error, serializedUrl?.sensitiveValues ?? fallbackSensitiveValues, serializedUrl?.requestUrl ?? fallbackRequestUrl, serializedUrl?.redactedUrl ?? fallbackRedactedUrl);
+                    // Cancellation and resolver failures leave the transport path here, redacted; any
+                    // other failure becomes the TransportError the retry decision reasons about.
+                    const normalizeAttemptError = (error) => {
+                        let normalizedError;
+                        try {
+                            throwIfAmbientAborted(clientOptions.signal);
+                            normalizedError = normalizeStealthTransportError(error);
+                        }
+                        catch (normalizationError) {
+                            if (normalizationError instanceof TransportError &&
+                                normalizationError.code === "transport_cancelled") {
+                                recordProxyAttempt("error", proxyAttemptErrorCode(normalizationError), proxyAttemptStatus(normalizationError));
+                            }
+                            throw redactAttemptError(normalizationError);
+                        }
+                        if (challengeSolveFailure && error === challengeSolveFailure) {
+                            throw redactAttemptError(challengeSolveFailure.error);
+                        }
+                        return normalizedError;
+                    };
+                    const recordAttemptFailure = (normalizedError) => {
+                        const redactedError = redactAttemptError(normalizedError);
+                        recordProxyAttempt("error", proxyAttemptErrorCode(redactedError), proxyAttemptStatus(redactedError));
+                        return redactedError;
+                    };
                     try {
+                        throwIfAmbientAborted(clientOptions.signal);
+                        const sensitiveParams = normalizeSensitiveParams(options.sensitiveParams);
+                        const structural = redactUrlQueryParams(url, Object.keys(sensitiveParams ?? {}));
+                        fallbackSensitiveValues = [
+                            ...new Set([
+                                ...Object.values(sensitiveParams ?? {}).map(String),
+                                ...structural.sensitiveValues,
+                            ]),
+                        ].filter((value) => value !== "");
+                        fallbackRequestUrl = url;
+                        fallbackRedactedUrl = structural.redactedUrl;
                         assertNoUnsupportedFingerprintOverrides(options);
-                        attemptProxy = await resolveRequestProxy(options, attempt);
+                        attemptProxy = await resolveRequestProxy(options, attempt, refreshAttempt);
+                        throwIfAmbientAborted(clientOptions.signal);
                         proxy = attemptProxy.url;
-                        if (proxy && usesPolicyAllocator) {
+                        if (proxy && dedupeAllocatorEndpoints) {
+                            // An under-filled allocation repeats endpoints (via the modulo
+                            // pool mapping) before the flat offset crosses into the next
+                            // vendor. Skip an already-tried endpoint and advance the offset
+                            // rather than breaking — breaking here would strand the request on
+                            // the primary vendor and never reach the fallback leg.
                             if (attemptedProxies.has(proxy)) {
-                                break;
+                                continue;
                             }
                             attemptedProxies.add(proxy);
                         }
                         const ignoreTlsErrors = Boolean(options.stealth?.insecureSkipVerify ??
                             (!hasPolicyProxy && proxy && clientOptions.proxyStealth?.insecureSkipVerify));
-                        const profileName = options.profile ?? defaultProfile;
-                        const requestUrl = appendQueryParams(resolveUrl(baseUrl, url), options.params);
-                        const headers = { ...(options.headers ?? {}) };
-                        if (!hasHeader(headers, "Cookie")) {
-                            const cookieHeader = cookieJar.toString();
+                        serializedUrl = serializeRequestUrl(resolveRequestUrl(baseUrl, url), options.params, sensitiveParams);
+                        const { requestUrl } = serializedUrl;
+                        const wreq = await getWreqModule();
+                        const mapping = resolveWreqProfile(requestProfile, wreq.getProfiles());
+                        const emulationHeaders = Array.from(wreq.getEmulationHeaders(mapping.browser, mapping.os), ([name, value]) => [String(name), String(value)]);
+                        const chromeEmulationHeaders = mapping.browser.startsWith("chrome_")
+                            ? emulationHeaders
+                            : undefined;
+                        const buildOrderedHeaders = chromeEmulationHeaders
+                            ? (currentUrl, currentMethod, currentBody, currentHeaders) => buildChromeHeaderTuples({
+                                emulationHeaders: chromeEmulationHeaders,
+                                method: currentMethod,
+                                body: currentBody,
+                                headers: currentHeaders,
+                                requestUrl: currentUrl,
+                                acceptLanguage: clientOptions.stealth?.acceptLanguage,
+                                requestClass: options.stealth?.requestClass,
+                                userActivation: options.stealth?.userActivation,
+                            })
+                            : undefined;
+                        const initialHeaders = normalizeHeaders({ ...(options.headers ?? {}) });
+                        if (!hasHeader(initialHeaders, "cookie")) {
+                            const cookieHeader = cookieJar.toHeader(requestUrl);
                             if (cookieHeader)
-                                headers.Cookie = cookieHeader;
+                                initialHeaders.cookie = cookieHeader;
                         }
-                        const requestInit = {
-                            headers: normalizeHeaders(headers),
-                            method,
-                            ...(options.redirect ? { redirect: options.redirect } : {}),
-                            ...(options.timeout ? { timeout: options.timeout } : {}),
-                        };
-                        if (options.body !== undefined) {
-                            requestInit.body = normalizeBody(options.body);
-                        }
-                        const response = await getClient(profileName, proxy, ignoreTlsErrors).fetch(requestUrl, requestInit);
-                        const normalized = await normalizeResponse(response, requestUrl);
-                        cookieJar.setFromCookieStrings(setCookieHeadersFromResponse(response.headers));
-                        if (proxy && isProxyConnectFailureResponse(response, normalized.body)) {
-                            throw createProxyConnectFailureError(normalized.body);
-                        }
-                        if (response.status >= 400) {
-                            if (proxy &&
-                                usesPolicyAllocator &&
-                                isProxyEdgeTlsRejectedResponse(response.status, [JSON.stringify(responseHeadersToRecord(response.headers)), normalized.body].join("\n"))) {
-                                throw createProxyEdgeTlsRejectedError(response.status);
+                        const defaultHeaders = buildOrderedHeaders?.(requestUrl, method, requestBody, initialHeaders);
+                        const fetchOnBoundSession = (fetchUrl, fetchMethod, fetchOptions, fetchSignal, orderedHeaders = buildOrderedHeaders, sessionDefaultHeaders = defaultHeaders, kind = "request") => withClient(requestProfile, proxy, ignoreTlsErrors, (transport) => fetchStealthRedirectChain(transport, cookieJar, fetchUrl, fetchMethod, fetchOptions, fetchSignal, orderedHeaders, clientOptions.stealthTelemetry
+                            ? {
+                                sink: clientOptions.stealthTelemetry,
+                                profileId: requestProfile,
+                                proxyUsed: Boolean(proxy),
+                                kind,
+                                cookieJar,
+                            }
+                            : undefined), fetchSignal, sessionDefaultHeaders);
+                        const throwProxyTransportFault = (faultResponse, faultBody) => {
+                            if (!proxy)
+                                return;
+                            if (isProxyConnectFailureResponse(faultResponse, faultBody)) {
+                                throw createProxyConnectFailureError(faultBody);
                             }
-                            if (proxy && isProxyAuthIpDeniedMessage(normalized.body)) {
+                            if (faultResponse.status < 400)
+                                return;
+                            if (usesPolicyAllocator &&
+                                isProxyEdgeTlsRejectedResponse(faultResponse.status, [JSON.stringify(responseHeadersToRecord(faultResponse.headers)), faultBody].join("\n"))) {
+                                throw createProxyEdgeTlsRejectedError(faultResponse.status);
+                            }
+                            if (isProxyAuthIpDeniedMessage(faultBody)) {
                                 throw createProxyAuthIpDeniedError();
                             }
-                            if (proxy && isProxyEdgeAuthRejectedMessage(normalized.body)) {
+                            if (isProxyEdgeAuthRejectedMessage(faultBody)) {
                                 throw createProxyEdgeAuthRejectedError();
                             }
-                            if (proxy &&
-                                isProxyPoolStaleStatus(response.status) &&
-                                isProxyPoolStaleMessage(normalized.body)) {
-                                throw createProxyPoolStaleError(response.status);
+                            if (isProxyPoolStaleStatus(faultResponse.status) &&
+                                isProxyPoolStaleMessage(faultBody)) {
+                                throw createProxyPoolStaleError(faultResponse.status);
                             }
-                        }
-                        if (response.status >= 400 && options.throwOnHttpError !== false) {
-                            throw new TransportError(`Upstream request failed with status ${response.status}`, {
-                                code: "upstream_http_error",
-                                status: response.status,
+                        };
+                        let { normalized, response } = await fetchOnBoundSession(requestUrl, method, options, clientOptions.signal);
+                        throwProxyTransportFault(response, normalized.body);
+                        // Commit only after the selected endpoint reached the origin. A failed
+                        // proxy attempt may rotate pool index; the successful exact endpoint is
+                        // the one sealed into the ceremony handle.
+                        bindCeremonyEgress(attemptProxy);
+                        const akamaiSbsd = clientOptions.stealth?.challengeRuntime?.akamaiSbsd;
+                        const detected = akamaiSbsd
+                            ? detectAkamaiSbsdChallenge(normalized, requestUrl, cookieJar, akamaiSbsd.allowedHosts, akamaiSbsdState)
+                            : undefined;
+                        if (akamaiSbsd && !detected)
+                            emitStealthTelemetry(clientOptions.stealthTelemetry, (sink) => sink.recordSbsd({ detected: false }));
+                        if (detected && akamaiSbsd) {
+                            emitStealthTelemetry(clientOptions.stealthTelemetry, (sink) => sink.recordSbsd("detected"));
+                            if (challengeSolveAttempted || challengeRefetchAttempted) {
+                                normalized.challenge = {
+                                    challenge: detected,
+                                    outcome: "challenge_persisted",
+                                };
+                                return finalizeAttempt(response, normalized);
+                            }
+                            const automaticReplayEligible = isProxyTransportRetryMethod(method, automaticChallengeRefetchPolicy, { body: requestBody, headers: options.headers });
+                            if (automaticReplayEligible && !akamaiSbsd.solve) {
+                                normalized.challenge = {
+                                    challenge: detected,
+                                    outcome: "resolver_unavailable",
+                                };
+                                return finalizeAttempt(response, normalized);
+                            }
+                            const emulationHeaderMap = new Map(emulationHeaders.map(([name, value]) => [name.toLowerCase(), value]));
+                            const initiatingHeaders = normalizeHeaders({ ...(options.headers ?? {}) });
+                            // Mirror what the protected request actually sent: `stealth.acceptLanguage` is
+                            // applied by the Chrome header builder only; Safari/Firefox sessions send the
+                            // emulation default.
+                            const sessionHeaders = {
+                                "User-Agent": requiredEmulationHeader(emulationHeaderMap, "user-agent"),
+                                "Accept-Language": initiatingHeaders["accept-language"] ??
+                                    (chromeEmulationHeaders ? clientOptions.stealth?.acceptLanguage : undefined) ??
+                                    requiredEmulationHeader(emulationHeaderMap, "accept-language"),
+                            };
+                            const resolverBuildHeaders = chromeEmulationHeaders
+                                ? (currentUrl, currentMethod, currentBody, currentHeaders) => buildChromeHeaderTuples({
+                                    emulationHeaders: chromeEmulationHeaders,
+                                    method: currentMethod,
+                                    body: currentBody,
+                                    headers: currentHeaders,
+                                    requestUrl: currentUrl,
+                                    acceptLanguage: clientOptions.stealth?.acceptLanguage,
+                                })
+                                : undefined;
+                            const resolverTransport = {
+                                sessionHeaders,
+                                getCookie(name, cookieUrl) {
+                                    return cookieJar.get(name, cookieUrl);
+                                },
+                                async fetch(transportUrl, init) {
+                                    const boundSignal = clientOptions.signal
+                                        ? AbortSignal.any([clientOptions.signal, init.signal])
+                                        : init.signal;
+                                    const transportHeaders = { ...(init.headers ?? {}) };
+                                    if (resolverBuildHeaders) {
+                                        for (const name of Object.keys(transportHeaders)) {
+                                            if (name.toLowerCase() === "user-agent") {
+                                                delete transportHeaders[name];
+                                            }
+                                        }
+                                    }
+                                    // Session defaults come from this request's own shape, never from the
+                                    // initiating request: its defaults carry the upstream Cookie header,
+                                    // which wreq would otherwise merge into the Hyper /ip call.
+                                    const result = await fetchOnBoundSession(transportUrl, init.method, {
+                                        method: init.method,
+                                        headers: transportHeaders,
+                                        ...(init.body === undefined ? {} : { body: init.body }),
+                                        redirect: "manual",
+                                        throwOnHttpError: false,
+                                        ...(init.maxBodyBytes === undefined
+                                            ? {}
+                                            : { maxBodyBytes: init.maxBodyBytes }),
+                                    }, boundSignal, resolverBuildHeaders, resolverBuildHeaders?.(transportUrl, init.method, init.body, normalizeHeaders(transportHeaders)), "resolver");
+                                    return {
+                                        status: result.normalized.status,
+                                        headers: result.normalized.headers,
+                                        body: result.normalized.body,
+                                        cookies: resolverCookiesFromResponse(result.response, transportUrl),
+                                    };
+                                },
+                            };
+                            // `options` is already the fetch-start snapshot; the replay gets its own copy
+                            // of the body bytes so the transport cannot alias the first send's buffer.
+                            const replayOptions = {
+                                ...options,
+                                ...(Buffer.isBuffer(requestBody) ? { body: Buffer.from(requestBody) } : {}),
+                            };
+                            const transactionKey = akamaiSbsdChallengeKey(detected, {
+                                wreqBrowser: mapping.browser,
+                                wreqOs: mapping.os,
+                                proxyUrl: proxy,
                             });
+                            const challenged = { normalized, response };
+                            const solveAndReplay = async (explicitReplay) => {
+                                if (!akamaiSbsd.solve) {
+                                    throw new SDKError("No resolver is available for the challenged request", {
+                                        code: "RESOLVER_UNAVAILABLE",
+                                    });
+                                }
+                                // Only a solve that will actually run on this session needs the profile match.
+                                assertAkamaiSbsdClientProfile(akamaiSbsd.clientProfile, requestProfile);
+                                // A safe request that already solved this exact challenge on this identity
+                                // left the session cookies valid: the explicit replay reuses them once
+                                // instead of paying for a second solve.
+                                const reuseCompletedSuccess = explicitReplay && akamaiSbsdState.completedSuccessKey === transactionKey;
+                                if (reuseCompletedSuccess)
+                                    akamaiSbsdState.completedSuccessKey = undefined;
+                                let ownsTransaction = false;
+                                if (!reuseCompletedSuccess) {
+                                    let transaction = akamaiSbsdState.transactions.get(transactionKey);
+                                    if (!transaction) {
+                                        akamaiSbsdState.completedSuccessKey = undefined;
+                                        challengeSolveAttempted = true;
+                                        ownsTransaction = true;
+                                        // The solve spans several round trips, so it runs under the client's ambient
+                                        // signal and the resolver's own timeouts, not this fetch's per-request `timeout`.
+                                        transaction = {
+                                            result: akamaiSbsd
+                                                .solve(detected, resolverTransport, clientOptions.signal ?? new AbortController().signal)
+                                                .then(() => ({ solved: true }), (error) => ({ solved: false, error }))
+                                                .finally(() => {
+                                                akamaiSbsdState.transactions.delete(transactionKey);
+                                            }),
+                                        };
+                                        akamaiSbsdState.transactions.set(transactionKey, transaction);
+                                    }
+                                    const transactionResult = await transaction.result;
+                                    if (!transactionResult.solved) {
+                                        emitStealthTelemetry(clientOptions.stealthTelemetry, (sink) => sink.recordSbsd("solve_failed"));
+                                        if (ownsTransaction) {
+                                            // The proxy delivered the challenged response; the resolver failed.
+                                            // Surface that failure as-is: it is not a transport fault to normalize
+                                            // or retry.
+                                            if (!explicitReplay) {
+                                                recordProxyAttempt("ok", undefined, challenged.response.status);
+                                            }
+                                            challengeSolveFailure = { error: transactionResult.error };
+                                            throw challengeSolveFailure;
+                                        }
+                                        return {
+                                            normalized: {
+                                                ...challenged.normalized,
+                                                challenge: { challenge: detected, outcome: "solve_failed" },
+                                            },
+                                            response: challenged.response,
+                                        };
+                                    }
+                                }
+                                challengeRefetchAttempted = true;
+                                // An explicit replay is a new transport exchange on the bound endpoint and
+                                // gets its own proxy-attempt record timed from here, not from the initiating
+                                // fetch (the caller's think time in between is not transport duration); the
+                                // automatic refetch stays within the initiating attempt's record.
+                                if (explicitReplay) {
+                                    // The solve above may have taken seconds; if another session of this client
+                                    // moved the ceremony meanwhile, the mutation must not go out on the retired
+                                    // endpoint.
+                                    if (currentEgressGeneration() !== attemptEgressGeneration) {
+                                        throw new SDKError("The ceremony's egress binding changed while the replay was being solved", { code: "REPLAY_SESSION_MISMATCH" });
+                                    }
+                                    attemptRecorded = false;
+                                    attemptStartedAt = Date.now();
+                                }
+                                if (!explicitReplay)
+                                    emitStealthTelemetry(clientOptions.stealthTelemetry, (sink) => sink.recordSafeRefetch());
+                                const replayed = await fetchOnBoundSession(requestUrl, method, replayOptions, clientOptions.signal);
+                                throwProxyTransportFault(replayed.response, replayed.normalized.body);
+                                const persisted = detectAkamaiSbsdChallenge(replayed.normalized, requestUrl, cookieJar, akamaiSbsd.allowedHosts, akamaiSbsdState);
+                                emitStealthTelemetry(clientOptions.stealthTelemetry, (sink) => sink.recordSbsd(persisted ? "challenge_persisted" : "refetch_clear"));
+                                if (persisted) {
+                                    replayed.normalized.challenge = {
+                                        challenge: persisted,
+                                        outcome: "challenge_persisted",
+                                    };
+                                }
+                                else if (ownsTransaction && !explicitReplay) {
+                                    akamaiSbsdState.completedSuccessKey = transactionKey;
+                                }
+                                return replayed;
+                            };
+                            if (!automaticReplayEligible) {
+                                normalized.challenge = {
+                                    challenge: detected,
+                                    outcome: "replay_required",
+                                };
+                                challengedReplays.set(normalized, {
+                                    consumed: false,
+                                    generation: attemptEgressGeneration,
+                                    async replay() {
+                                        try {
+                                            const replayed = await solveAndReplay(true);
+                                            return finalizeAttempt(replayed.response, replayed.normalized);
+                                        }
+                                        catch (error) {
+                                            const normalizedError = normalizeAttemptError(error);
+                                            releaseFailedCeremonyEgress(proxy, normalizedError);
+                                            throw recordAttemptFailure(normalizedError);
+                                        }
+                                    },
+                                });
+                                return finalizeAttempt(response, normalized);
+                            }
+                            ({ normalized, response } = await solveAndReplay(false));
                         }
-                        recordProxyAttempt("ok", undefined, response.status);
-                        return normalized;
+                        return finalizeAttempt(response, normalized);
                     }
                     catch (error) {
-                        const normalizedError = normalizeStealthTransportError(error);
-                        recordProxyAttempt("error", proxyAttemptErrorCode(normalizedError), proxyAttemptStatus(normalizedError));
-                        lastError = normalizedError;
-                        if (proxy && usesPolicyAllocator && isProxyPoolRefreshableError(normalizedError)) {
-                            stalePoolError = normalizedError;
-                            if (shouldRunProxyAuthDiagnostic(normalizedError)) {
+                        const normalizedError = normalizeAttemptError(error);
+                        const retryErrorCode = proxyAttemptErrorCode(normalizedError);
+                        const refreshableProxyError = isProxyPoolRefreshableError(normalizedError);
+                        const runProxyAuthDiagnostic = shouldRunProxyAuthDiagnostic(normalizedError);
+                        const redactedError = recordAttemptFailure(normalizedError);
+                        lastError = redactedError;
+                        const releasedBoundEgress = releaseFailedCeremonyEgress(proxy, normalizedError);
+                        if (releasedBoundEgress) {
+                            // The request now proceeds as an unbound one with the full rotation budget;
+                            // the attempt spent on the dead endpoint does not count against it.
+                            maxAttempts = attempt + 1 + unboundMaxAttempts;
+                        }
+                        if (challengeSolveAttempted || challengeRefetchAttempted) {
+                            // The single refetch is spent (owner or waiter of a shared solve): another
+                            // transport attempt would replay the original request and may rotate the
+                            // proxy the solved jar is bound to.
+                            throw redactedError;
+                        }
+                        if (proxy && rotatesRegistryChain && refreshableProxyError) {
+                            // Also the path a released bound endpoint takes after a proxy-level refusal:
+                            // the stale-pool bookkeeping here is what drives allocator invalidation and the
+                            // refresh pass when the fresh selection lands on the same endpoint again.
+                            stalePoolError = redactedError;
+                            if (runProxyAuthDiagnostic) {
                                 stalePoolDiagnosticProxy = proxy;
                             }
                             if (attempt + 1 < maxAttempts) {
@@ -615,37 +1891,67 @@ function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
                             }
                             break;
                         }
-                        if (attempt + 1 <
-                            (stealthRetryOptions
-                                ? Math.min(maxAttempts, stealthRetryOptions.attempts)
-                                : maxAttempts) &&
+                        if (releasedBoundEgress &&
+                            attempt + 1 < maxAttempts &&
+                            retryErrorCode === PROXY_CONNECT_FAILURE_CODE) {
+                            // The tunnel to the released endpoint never opened, so the origin never saw the
+                            // request: selecting and binding a fresh endpoint in this request is safe for
+                            // any method. Ambiguous failures (reset, timeout) fall through to the ordinary
+                            // method-aware retry decision below with the binding already released.
+                            continue;
+                        }
+                        // Cap the number of transport retries. For a policy-allocator chain,
+                        // every attempt resolves a *different* endpoint/vendor (poolIndex
+                        // rotates across the concatenated vendor pool spans), so a transport
+                        // failure is a signal to advance to the next endpoint — potentially
+                        // crossing into the fallback vendor — not to retry the same endpoint.
+                        // Truncating that rotation at the per-endpoint retry budget would
+                        // strand the request on the primary vendor and never reach the
+                        // fallback, since the crossover only happens once the flat attempt
+                        // index exceeds the primary vendor's pool size (~10-20).
+                        // resolvePolicyTransportAttemptCap widens to the full chain span only
+                        // for implicit, safe-method allocator requests; explicit retry
+                        // policies (their documented `attempts` ceiling), unsafe methods, and
+                        // static/non-registry vendors keep the per-endpoint retry budget.
+                        const transportRetryCap = resolvePolicyTransportAttemptCap({
+                            policy: policyProxy,
+                            usesPolicyAllocator,
+                            retryAttempts: stealthRetryOptions?.attempts ?? 1,
+                            explicitRetry: hasExplicitRetryPolicy,
+                            method,
+                        });
+                        if (attempt + 1 < transportRetryCap &&
                             shouldRetryProxyTransportAttempt({
-                                error: normalizedError,
+                                error: { code: retryErrorCode },
                                 explicitRetry: hasExplicitRetryPolicy,
                                 method,
                                 options: stealthRetryOptions,
                                 proxyUsed: Boolean(proxy),
                             })) {
                             if (stealthRetryOptions) {
-                                await sleep(computeProxyTransportRetryDelayMs(stealthRetryOptions, attempt + 1));
+                                await sleep(computeProxyTransportRetryDelayMs(stealthRetryOptions, attempt + 1), clientOptions.signal);
                             }
+                            throwIfAmbientAborted(clientOptions.signal);
                             continue;
                         }
-                        throw normalizedError;
+                        throw redactedError;
                     }
                 }
-                if (usesPolicyAllocator &&
+                if (rotatesRegistryChain &&
                     stalePoolError &&
                     refreshAttempt < MAX_POLICY_PROXY_POOL_REFRESHES) {
+                    throwIfAmbientAborted(clientOptions.signal);
+                    emitStealthTelemetry(clientOptions.stealthTelemetry, (sink) => sink.recordPoolRefresh());
                     await invalidateProxyResolutionCacheAsync({
                         proxyPolicy: clientOptions.proxyPolicy,
                         upstream: clientOptions.upstream,
                         affinityKey: clientOptions.affinityKey,
                     });
+                    throwIfAmbientAborted(clientOptions.signal);
                     continue;
                 }
                 const proxyAuthDiagnostic = stalePoolError && stalePoolDiagnosticProxy
-                    ? await classifyProxyAuthDiagnostic(options.profile ?? defaultProfile, stalePoolDiagnosticProxy)
+                    ? await classifyProxyAuthDiagnostic(requestProfile, stalePoolDiagnosticProxy)
                     : undefined;
                 if (proxyAuthDiagnostic === "source_ip_denied") {
                     throw createProxyAuthIpDeniedError(stalePoolError instanceof Error ? stalePoolError : undefined);
@@ -662,89 +1968,198 @@ function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
                 }
                 break;
             }
+            throwIfAmbientAborted(clientOptions.signal);
             throw normalizeStealthTransportError(lastError);
         },
+        async replayChallenged(challengedResponse) {
+            // Lease expiry is evaluated when a fetch starts, not here: the replay belongs to the
+            // exchange that was challenged on the bound endpoint (Akamai state is IP-bound), so a
+            // lifetime boundary crossed during the solve does not move it elsewhere. The next
+            // fetch drops the expired binding and rebinds.
+            const replay = challengedReplays.get(challengedResponse);
+            if (!replay || challengedResponse.challenge?.outcome !== "replay_required") {
+                throw new SDKError("The challenged response does not belong to this stealth session", {
+                    code: "REPLAY_SESSION_MISMATCH",
+                });
+            }
+            syncCeremonyEgress();
+            if (replay.generation !== currentEgressGeneration()) {
+                // The ceremony rebound to another egress after this request ran (in this session or
+                // another of the same client); solving and replaying on the retired endpoint would
+                // split the identity the handle names.
+                throw new SDKError("The challenged response predates the ceremony's current egress binding", { code: "REPLAY_SESSION_MISMATCH" });
+            }
+            if (replay.consumed) {
+                throw new SDKError("The challenged request has already used its one replay budget", {
+                    code: "REPLAY_ALREADY_ATTEMPTED",
+                });
+            }
+            replay.consumed = true;
+            return replay.replay();
+        },
         cookies: cookieJar,
         redirects: {
             async run(options) {
                 const maxHops = options.maxHops === undefined || !Number.isFinite(options.maxHops)
                     ? 10
                     : Math.max(0, Math.floor(options.maxHops));
+                const { url: _url, maxHops: _maxHops, stopWhen, params, sensitiveParams, headers: initialHeaders, ...fetchOptions } = options;
                 const hops = [];
-                let currentUrl = resolveUrl(baseUrl, options.url);
                 let method = normalizeMethod(options.method ?? "GET");
                 let body = options.body;
+                let headers = initialHeaders;
                 let response;
                 const visitedRequests = new Set();
-                const { url: _url, maxHops: _maxHops, stopWhen, params, ...fetchOptions } = options;
+                const initialParams = params
+                    ? Object.fromEntries(Object.entries(params).map(([key, value]) => [
+                        key,
+                        Array.isArray(value) ? [...value] : value,
+                    ]))
+                    : undefined;
+                const normalizedSensitiveParams = normalizeSensitiveParams(sensitiveParams);
+                const initialSensitiveParams = normalizedSensitiveParams
+                    ? { ...normalizedSensitiveParams }
+                    : undefined;
+                const sensitiveParamNames = initialSensitiveParams
+                    ? Object.keys(initialSensitiveParams)
+                    : [];
+                const callerStructural = redactUrlQueryParams(options.url, sensitiveParamNames);
+                const sensitiveValues = new Set([
+                    ...Object.values(initialSensitiveParams ?? {}),
+                    ...callerStructural.sensitiveValues,
+                ].filter((value) => value !== ""));
+                const redactRedirectUrl = (value) => {
+                    const structural = redactUrlQueryParams(value, [
+                        ...new Set([...sensitiveParamNames, ...sensitiveQueryParamNames(value)]),
+                    ]);
+                    for (const sensitiveValue of structural.sensitiveValues) {
+                        sensitiveValues.add(sensitiveValue);
+                    }
+                    return redactSensitiveText(structural.redactedUrl, [...sensitiveValues]);
+                };
+                let currentUrl;
+                let initialUrl;
+                try {
+                    currentUrl = resolveUrl(baseUrl, options.url);
+                    redactRedirectUrl(currentUrl);
+                    initialUrl = serializeRequestUrl(currentUrl, initialParams, initialSensitiveParams);
+                    for (const value of initialUrl.sensitiveValues) {
+                        if (value !== "")
+                            sensitiveValues.add(value);
+                    }
+                }
+                catch (error) {
+                    throw redactSensitiveError(error, [...sensitiveValues], options.url, redactRedirectUrl(options.url));
+                }
                 for (let hopIndex = 0; hopIndex <= maxHops; hopIndex += 1) {
-                    visitedRequests.add(`${method} ${currentUrl}`);
-                    response = await session.fetch(currentUrl, {
-                        ...fetchOptions,
-                        body,
-                        method,
-                        ...(hopIndex === 0 && params ? { params } : {}),
-                        redirect: "manual",
-                        throwOnHttpError: false,
-                    });
+                    const outboundUrl = hopIndex === 0 ? initialUrl.requestUrl : serializeRequestUrl(currentUrl).requestUrl;
+                    // Preserve params-only loop bookkeeping from before sensitiveParams:
+                    // the first visited key is the caller's resolved URL, not its expanded query.
+                    const visitedUrl = hopIndex === 0 && !initialSensitiveParams ? currentUrl : outboundUrl;
+                    visitedRequests.add(`${method} ${visitedUrl}`);
+                    try {
+                        response = await session.fetch(currentUrl, {
+                            ...fetchOptions,
+                            ...(headers ? { headers } : {}),
+                            body,
+                            method,
+                            ...(hopIndex === 0 && initialParams ? { params: initialParams } : {}),
+                            ...(hopIndex === 0 && initialSensitiveParams
+                                ? { sensitiveParams: initialSensitiveParams }
+                                : {}),
+                            redirect: "manual",
+                            throwOnHttpError: false,
+                        });
+                    }
+                    catch (error) {
+                        throw redactSensitiveError(error, [...sensitiveValues], outboundUrl, redactRedirectUrl(outboundUrl));
+                    }
+                    // StealthResponse.url is programmatic metadata and remains raw. Only the
+                    // redirect hop emitted below is a diagnostic surface.
+                    const responseUrl = response.url ?? (hopIndex === 0 && initialSensitiveParams ? outboundUrl : currentUrl);
                     if (!isRedirectStatus(response.status)) {
                         return {
                             final: response,
                             hops,
                             reason: "completed",
                             cookies: cookieJar.snapshot(),
+                            cookieStore: cookieJar.serialize(),
                         };
                     }
                     const location = locationHeader(response.headers);
-                    const nextUrl = location
-                        ? new URL(location, response.url ?? currentUrl).toString()
-                        : undefined;
-                    const hop = {
-                        url: response.url ?? currentUrl,
+                    const redactedResponseUrl = redactRedirectUrl(responseUrl);
+                    const redactedLocation = location ? redactRedirectUrl(location) : undefined;
+                    let nextUrl;
+                    try {
+                        nextUrl = resolveRedirectUrl(location, responseUrl);
+                    }
+                    catch (error) {
+                        throw redactSensitiveError(error, [...sensitiveValues], location, redactedLocation);
+                    }
+                    const realHop = {
+                        url: responseUrl,
                         status: response.status,
                         method,
                         ...(location ? { location } : {}),
                         ...(nextUrl ? { nextUrl } : {}),
                     };
+                    const hop = {
+                        ...realHop,
+                        url: redactedResponseUrl,
+                        ...(redactedLocation ? { location: redactedLocation } : {}),
+                        ...(nextUrl ? { nextUrl: redactRedirectUrl(nextUrl) } : {}),
+                    };
                     hops.push(hop);
-                    if (stopWhen && (await stopWhen(hop))) {
-                        return {
-                            final: response,
-                            hops,
-                            reason: "stopped",
-                            cookies: cookieJar.snapshot(),
-                        };
+                    let shouldStop = false;
+                    if (stopWhen) {
+                        try {
+                            shouldStop = await stopWhen(realHop);
+                        }
+                        catch (error) {
+                            let sanitizedError = error;
+                            for (const [rawUrl, safeUrl] of [
+                                [responseUrl, redactedResponseUrl],
+                                [location, redactedLocation],
+                                [nextUrl, nextUrl ? redactRedirectUrl(nextUrl) : undefined],
+                            ]) {
+                                if (!rawUrl || !safeUrl)
+                                    continue;
+                                sanitizedError = redactSensitiveError(sanitizedError, [...sensitiveValues], rawUrl, safeUrl);
+                            }
+                            throw sanitizedError;
+                        }
                     }
-                    if (!nextUrl) {
+                    const decision = evaluateRedirectHop({
+                        status: response.status,
+                        method,
+                        nextUrl,
+                        shouldStop,
+                        redirectCount: hops.length,
+                        maxHops,
+                        visitedRequests,
+                    });
+                    if (decision.kind === "stop") {
                         return {
                             final: response,
                             hops,
-                            reason: "missing_location",
+                            reason: decision.reason,
                             cookies: cookieJar.snapshot(),
+                            cookieStore: cookieJar.serialize(),
                         };
                     }
-                    if (hops.length > maxHops) {
-                        return {
-                            final: response,
-                            hops,
-                            reason: "max_hops",
-                            cookies: cookieJar.snapshot(),
-                        };
+                    if (headers) {
+                        headers = redirectHopHeaders({
+                            from: currentUrl,
+                            to: decision.nextUrl,
+                            methodChanged: decision.nextMethod !== method,
+                        }, headers);
                     }
-                    const nextMethod = nextRedirectMethod(response.status, method);
-                    if (nextMethod !== method) {
+                    if (decision.nextMethod !== method) {
                         body = undefined;
                     }
-                    if (visitedRequests.has(`${nextMethod} ${nextUrl}`)) {
-                        return {
-                            final: response,
-                            hops,
-                            reason: "loop",
-                            cookies: cookieJar.snapshot(),
-                        };
-                    }
-                    method = nextMethod;
-                    currentUrl = nextUrl;
+                    emitStealthTelemetry(clientOptions.stealthTelemetry, (sink) => sink.recordRedirectHop());
+                    method = decision.nextMethod;
+                    currentUrl = decision.nextUrl;
                 }
                 if (!response) {
                     response = await session.fetch(currentUrl, {
@@ -761,25 +2176,63 @@ function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
                     hops,
                     reason: "max_hops",
                     cookies: cookieJar.snapshot(),
+                    cookieStore: cookieJar.serialize(),
                 };
             },
         },
         close() {
             closed = true;
+            clearAkamaiSbsdState();
+            for (const client of clients.values()) {
+                void client.session
+                    .then((session) => session.close())
+                    .catch((error) => {
+                    const message = error instanceof Error ? error.message : String(error);
+                    warn(`[provider-sdk] Failed to close stealth transport session: ${message}`);
+                });
+            }
             clients.clear();
         },
     };
     return session;
-    async function classifyProxyAuthDiagnostic(profileName, proxy) {
+    async function classifyProxyAuthDiagnostic(profile, proxy) {
         try {
-            const response = await getClient(profileName, proxy, false).fetch(PROXY_AUTH_DIAGNOSTIC_URL, {
-                method: "GET",
-                timeout: PROXY_AUTH_DIAGNOSTIC_TIMEOUT_MS,
-            });
-            const normalized = await normalizeResponse(response);
-            return classifyProxyAuthDiagnosticMessage(normalized.body);
+            return await withClient(profile, proxy, false, async (client) => {
+                throwIfAmbientAborted(clientOptions.signal);
+                await client.clearCookies();
+                throwIfAmbientAborted(clientOptions.signal);
+                const finishExchange = startStealthExchange(clientOptions.stealthTelemetry
+                    ? {
+                        sink: clientOptions.stealthTelemetry,
+                        profileId: profile,
+                        proxyUsed: true,
+                        kind: "proxy_diagnostic",
+                        cookieJar,
+                    }
+                    : undefined, "GET", {}, clientOptions.signal);
+                let status;
+                let exchangeError;
+                try {
+                    const response = await client.fetch(PROXY_AUTH_DIAGNOSTIC_URL, {
+                        method: "GET",
+                        timeout: PROXY_AUTH_DIAGNOSTIC_TIMEOUT_MS,
+                        ...(clientOptions.signal ? { signal: clientOptions.signal } : {}),
+                    });
+                    status = response.status;
+                    const normalized = await normalizeResponseWithSignal(response, undefined, undefined, clientOptions.signal);
+                    return classifyProxyAuthDiagnosticMessage(normalized.body);
+                }
+                catch (error) {
+                    exchangeError = error;
+                    throw error;
+                }
+                finally {
+                    finishExchange(status, exchangeError);
+                }
+            }, clientOptions.signal);
         }
         catch (error) {
+            throwIfAmbientAborted(clientOptions.signal);
             const message = error instanceof Error
                 ? [error.message, error.cause instanceof Error ? error.cause.message : ""]
                     .filter(Boolean)
@@ -808,13 +2261,15 @@ function hasHeader(headers, name) {
     const needle = name.toLowerCase();
     return Object.keys(headers).some((key) => key.toLowerCase() === needle);
 }
-export function createStealthClient(baseUrl, defaultProfileOrOptions = DEFAULT_PROFILE, clientOptions = {}) {
-    const defaultProfile = typeof defaultProfileOrOptions === "string" ? defaultProfileOrOptions : DEFAULT_PROFILE;
-    const resolvedClientOptions = typeof defaultProfileOrOptions === "string" ? clientOptions : defaultProfileOrOptions;
+export function createStealthClient(baseUrl, clientOptions = {}) {
+    if (typeof clientOptions === "string") {
+        resolveStealthProfileSelection(clientOptions);
+    }
+    const defaultProfile = resolveStealthProfileSelection(clientOptions.stealth);
     let sharedSession = null;
     function getSharedSession() {
         if (!sharedSession) {
-            sharedSession = createSessionFetcher(baseUrl, defaultProfile, resolvedClientOptions);
+            sharedSession = createSessionFetcher(baseUrl, defaultProfile, clientOptions);
         }
         return sharedSession;
     }
@@ -823,8 +2278,8 @@ export function createStealthClient(baseUrl, defaultProfileOrOptions = DEFAULT_P
             return getSharedSession().fetch(url, options);
         },
         createSession(opts) {
-            const sessionProfile = opts?.profile ?? defaultProfile;
-            return createSessionFetcher(baseUrl, sessionProfile, resolvedClientOptions);
+            const sessionProfile = resolveStealthProfileSelection(opts?.stealth, defaultProfile);
+            return createSessionFetcher(baseUrl, sessionProfile, clientOptions);
         },
         close() {
             sharedSession?.close();