@onekeyfe/react-native-sni-connect 3.0.71 → 3.0.73

package/ios/SniConnectClient.swift

@@ -1,27 +1,178 @@
 import Foundation
+import ObjectiveC
 import UIKit
 import EMASCurl
 
+@objc(SniConnectPinnedDNSResolverBase)
+private class SniConnectPinnedDNSResolverBase: NSObject, EMASCurlProtocolDNSResolver {
+  @objc class func resolveDomain(_ domain: String) -> String? {
+    PinnedDNSResolverFactory.resolve(domain: domain, resolverClass: self)
+  }
+}
+
+private enum PinnedDNSResolverFactory {
+  private static let queue = DispatchQueue(label: "com.onekey.sni.connect.pinned-dns-resolvers")
+  private static var nextClassID = 0
+  private static let registry = SniConnectPinnedResolverRegistry()
+
+  static func resolverClass(hostname: String, ip: String) throws -> EMASCurlProtocolDNSResolver.Type {
+    return try queue.sync {
+      let resolverClass = try registry.resolverClass(
+        hostname: hostname,
+        ip: ip,
+        allocateClass: allocateResolverClass
+      )
+      return resolverClass as! EMASCurlProtocolDNSResolver.Type
+    }
+  }
+
+  static func resolve(domain: String, resolverClass: AnyClass) -> String? {
+    return queue.sync {
+      registry.resolve(domain: domain, resolverClass: resolverClass)
+    }
+  }
+
+  static func remove(hostname: String, ip: String) {
+    queue.sync {
+      registry.release(hostname: hostname, ip: ip)
+    }
+  }
+
+  private static func allocateResolverClass() -> AnyClass {
+    while true {
+      nextClassID += 1
+      let className = "SniConnectPinnedDNSResolver_\(nextClassID)"
+      if let resolverClass = objc_allocateClassPair(
+        SniConnectPinnedDNSResolverBase.self,
+        className,
+        0
+      ) {
+        objc_registerClassPair(resolverClass)
+        return resolverClass
+      }
+    }
+  }
+}
+
+private final class SniConnectPinnedResolverLease {
+  private let hostname: String
+  private let ip: String
+  private let queue = DispatchQueue(label: "com.onekey.sni.connect.resolver-lease")
+  private var didRelease = false
+
+  init(hostname: String, ip: String) {
+    self.hostname = hostname
+    self.ip = ip
+  }
+
+  func release() -> Bool {
+    queue.sync {
+      if didRelease {
+        return false
+      }
+      PinnedDNSResolverFactory.remove(hostname: hostname, ip: ip)
+      didRelease = true
+      return true
+    }
+  }
+
+  func waitUntilReleased() async throws {
+    while !isReleased {
+      try Task.checkCancellation()
+      try await Task.sleep(nanoseconds: 10_000_000)
+    }
+  }
+
+  private var isReleased: Bool {
+    queue.sync {
+      didRelease
+    }
+  }
+}
+
+private final class SniConnectSessionInvalidationDelegate: NSObject, URLSessionDelegate {
+  private let hostname: String
+  private let ip: String
+  private let resolverLease: SniConnectPinnedResolverLease
+
+  init(hostname: String, ip: String, resolverLease: SniConnectPinnedResolverLease) {
+    self.hostname = hostname
+    self.ip = ip
+    self.resolverLease = resolverLease
+  }
+
+  func urlSession(_ session: URLSession, didBecomeInvalidWithError error: Error?) {
+    let releasedResolver = resolverLease.release()
+    SniConnectLog.info(SniConnectLog.event("sni_session_invalidated", [
+      ("hostname", hostname),
+      ("ipHash", SniConnectLog.shortHash(ip)),
+      ("releasedResolver", releasedResolver),
+      ("success", error == nil),
+    ]))
+  }
+}
+
 /// Core HTTPS client that enforces IP direct connection with SNI.
 final class SniConnectClient {
 
-  // Active requests tracking for cancellation support
-  private var activeTasks: [String: Task<Response, Error>] = [:]
+  // Active requests tracking for cancellation support. Every task is tracked by
+  // token so cancelAllRequests() also covers requests that do not have a requestId.
+  private var activeTasksByToken: [UUID: Task<Response, Error>] = [:]
+  private var requestTokensById: [String: UUID] = [:]
   private let tasksQueue = DispatchQueue(label: "com.onekey.sni.connect.tasks", attributes: .concurrent)
+  private let requestLimiter = SniConnectRequestLimiter()
+
+  private struct SessionKey: Hashable {
+    let hostname: String
+    let ip: String
+  }
+
+  private struct SessionLease {
+    let session: URLSession
+    let sessionID: ObjectIdentifier
+  }
+
+  private struct ManagedSession {
+    let session: URLSession
+    let resolverLease: SniConnectPinnedResolverLease
+  }
+
+  private struct SessionInvalidation {
+    let managedSession: ManagedSession
+    let releaseResolverImmediately: Bool
+  }
+
+  private enum SessionAcquisition {
+    case ready(SessionLease)
+    case waitForResolverSlots([SniConnectPinnedResolverLease])
+  }
+
+  private static let maxCachedSessions = SniConnectPinnedResolverRegistry.defaultMaxEntries
+  private var sessionCache: [SessionKey: ManagedSession] = [:]
+  private var sessionAccessOrder: [SessionKey] = []
+  private var activeSessionCounts: [ObjectIdentifier: Int] = [:]
+  private let sessionsQueue = DispatchQueue(label: "com.onekey.sni.connect.sessions")
 
   // Token for the memory-warning observer (block-based observers are not removed
   // by `removeObserver(self)`, so the token must be retained and removed explicitly).
   private var memoryWarningObserver: NSObjectProtocol?
 
   init() {
+    SniConnectCoreDiagnostics.warnSink = { message in
+      SniConnectLog.warn(message)
+    }
+
     // Register for memory warnings to clean cache
     memoryWarningObserver = NotificationCenter.default.addObserver(
       forName: UIApplication.didReceiveMemoryWarningNotification,
       object: nil,
       queue: .main
-    ) { _ in
-      SniConnectLog.info("Memory warning received, cleaning DNS cache")
-      DNSResolver.cleanExpiredEntries()
+    ) { [weak self] _ in
+      SniConnectLog.info(SniConnectLog.event("sni_lifecycle", [
+        ("action", "memory_warning"),
+        ("cacheAction", "clear_dns_cache"),
+      ]))
+      self?.clearDNSCache()
     }
   }
 
@@ -55,7 +206,7 @@ final class SniConnectClient {
   }
 
   struct Response {
-    let data: Any
+    let data: String
     let status: Int
     let statusText: String
     let headers: [String: String] // Single-value headers (backward compatible)
@@ -72,7 +223,9 @@ final class SniConnectClient {
     case connectionRefused
     case networkUnreachable
     case requestTimeout
+    case resourceLimit(String)
     case httpError(code: Int, message: String)
+    case responseProcessingFailed(String)
     case cancelled
     case unknown(Error)
 
@@ -87,7 +240,9 @@ final class SniConnectClient {
       case .connectionRefused: return "SNI_CONNECTION_REFUSED"
       case .networkUnreachable: return "SNI_NETWORK_UNREACHABLE"
       case .requestTimeout: return "SNI_REQUEST_TIMEOUT"
+      case .resourceLimit: return "SNI_RESOURCE_LIMIT"
       case .httpError: return "SNI_HTTP_ERROR"
+      case .responseProcessingFailed: return "SNI_RESPONSE_FAILED"
       case .cancelled: return "SNI_CANCELLED"
       case .unknown: return "SNI_UNKNOWN_ERROR"
       }
@@ -113,8 +268,12 @@ final class SniConnectClient {
         return "Network unreachable"
       case .requestTimeout:
         return "Request timeout"
+      case .resourceLimit(let details):
+        return "Resource limit exceeded: \(details)"
       case .httpError(let code, let message):
         return "HTTP error \(code): \(message)"
+      case .responseProcessingFailed(let details):
+        return "Response processing failed: \(details)"
       case .cancelled:
         return "Request cancelled"
       case .unknown(let error):
@@ -124,6 +283,27 @@ final class SniConnectClient {
 
     /// Convert NSError to SniConnectError with detailed classification
     static func from(_ error: Error) -> SniConnectError {
+      if let timeout = error as? SniConnectTimeout, timeout == .deadlineExceeded {
+        return .requestTimeout
+      }
+      if error is CancellationError {
+        return .cancelled
+      }
+      if let coreError = error as? SniConnectCoreError {
+        switch coreError {
+        case .resourceLimit(let details):
+          return .resourceLimit(details)
+        }
+      }
+      if let validationError = error as? SniConnectValidation.ValidationError {
+        switch validationError {
+        case .resourceLimit(let details):
+          return .resourceLimit(details)
+        default:
+          break
+        }
+      }
+
       let nsError = error as NSError
 
       // Check for URL-related errors
@@ -153,19 +333,20 @@ final class SniConnectClient {
     }
   }
 
-  private static let urlSession: URLSession = {
+  private static func makeURLSession(for key: SessionKey) throws -> ManagedSession {
     let configuration = URLSessionConfiguration.default
     configuration.requestCachePolicy = .reloadIgnoringLocalCacheData
     configuration.urlCache = nil
     configuration.httpCookieStorage = nil
     configuration.httpShouldSetCookies = false
+    configuration.connectionProxyDictionary = [:]
     configuration.shouldUseExtendedBackgroundIdleMode = false
 
     let curlConfig = EMASCurlConfiguration.default()
-    curlConfig.httpVersion = .HTTP2
+    curlConfig.httpVersion = .HTTP1
     curlConfig.connectTimeoutInterval = 2.5
-    curlConfig.enableBuiltInGzip = true
-    curlConfig.enableBuiltInRedirection = true
+    curlConfig.enableBuiltInGzip = false
+    curlConfig.enableBuiltInRedirection = false
     curlConfig.cacheEnabled = false
 
     // Enable full certificate validation for security.
@@ -174,165 +355,287 @@ final class SniConnectClient {
     // original hostname for SNI and certificate CN/SAN matching.
     curlConfig.certificateValidationEnabled = true
     curlConfig.domainNameVerificationEnabled = true
-    curlConfig.dnsResolver = DNSResolver.self
+    curlConfig.dnsResolver = try PinnedDNSResolverFactory.resolverClass(
+      hostname: key.hostname,
+      ip: key.ip
+    )
 
     EMASCurlProtocol.install(into: configuration, with: curlConfig)
-    return URLSession(configuration: configuration)
-  }()
-
-  @objc private final class DNSResolver: NSObject, EMASCurlProtocolDNSResolver {
-    private static let queue = DispatchQueue(label: "com.onekey.sni.connect.dns", attributes: .concurrent)
-    private static let cache = DNSCache()
-
-    /// Thread-safe hostname -> IP pin with TTL.
-    ///
-    /// LIMITATION: EMASCurl only exposes a process-global DNS resolver
-    /// (`setDNSResolver:`), which receives only the hostname. There is no
-    /// per-request DNS API, so the pin is keyed by hostname and the most recent
-    /// IP for a hostname wins. Concurrent requests to the SAME hostname targeting
-    /// DIFFERENT IPs are therefore not guaranteed to each hit their own IP. Normal
-    /// usage (one IP per hostname at a time) is unaffected.
-    private final class DNSCache {
-      private struct Entry {
-        let ip: String
-        let timestamp: TimeInterval
-      }
-
-      private var hostnameToEntry: [String: Entry] = [:]
-      private let maxSize = 100
-      private let ttl: TimeInterval = 300 // 5 minutes
+    SniConnectLog.info(SniConnectLog.event("sni_transport_config", [
+      ("hostname", key.hostname),
+      ("ipHash", SniConnectLog.shortHash(key.ip)),
+      ("ipFamily", SniConnectLog.ipFamily(key.ip)),
+      ("proxyMode", "no_proxy"),
+      ("pinnedResolver", true),
+      ("protocol", "http1"),
+      ("followRedirects", false),
+      ("cacheEnabled", false),
+    ]))
+    let resolverLease = SniConnectPinnedResolverLease(hostname: key.hostname, ip: key.ip)
+    let delegate = SniConnectSessionInvalidationDelegate(
+      hostname: key.hostname,
+      ip: key.ip,
+      resolverLease: resolverLease
+    )
+    return ManagedSession(
+      session: URLSession(configuration: configuration, delegate: delegate, delegateQueue: nil),
+      resolverLease: resolverLease
+    )
+  }
 
-      func get(_ domain: String) -> String? {
-        let key = domain.lowercased()
-        guard let entry = hostnameToEntry[key] else { return nil }
-        if Date().timeIntervalSince1970 - entry.timestamp > ttl {
-          return nil
+  private func sessionLease(for config: RequestConfig) async throws -> SessionLease {
+    let key = SessionKey(hostname: config.hostname.lowercased(), ip: config.ip)
+    while true {
+      let acquisition = try sessionsQueue.sync { () throws -> SessionAcquisition in
+        if let managedSession = sessionCache[key] {
+          markSessionUsed(key)
+          return .ready(retainSession(managedSession.session))
         }
-        return entry.ip
-      }
 
-      func set(_ ip: String, for domain: String) {
-        let key = domain.lowercased()
-        // Evict the oldest entry when at capacity (and this is a new host).
-        if hostnameToEntry.count >= maxSize && hostnameToEntry[key] == nil {
-          if let oldest = hostnameToEntry.min(by: { $0.value.timestamp < $1.value.timestamp })?.key {
-            hostnameToEntry.removeValue(forKey: oldest)
-          }
+        let pendingResolverSlots = evictSessionsIfNeeded(forPendingInsert: true)
+        if !pendingResolverSlots.isEmpty {
+          return .waitForResolverSlots(pendingResolverSlots)
         }
-        hostnameToEntry[key] = Entry(ip: ip, timestamp: Date().timeIntervalSince1970)
-      }
 
-      func clear() {
-        hostnameToEntry.removeAll()
+        let managedSession = try Self.makeURLSession(for: key)
+        sessionCache[key] = managedSession
+        markSessionUsed(key)
+        return .ready(retainSession(managedSession.session))
       }
 
-      func cleanExpired() {
-        let now = Date().timeIntervalSince1970
-        let expired = hostnameToEntry.filter { now - $0.value.timestamp > ttl }.map { $0.key }
-        for key in expired {
-          hostnameToEntry.removeValue(forKey: key)
+      switch acquisition {
+      case .ready(let lease):
+        return lease
+      case .waitForResolverSlots(let resolverLeases):
+        SniConnectLog.info(SniConnectLog.event("sni_resolver_slot_wait", [
+          ("hostname", key.hostname),
+          ("ipHash", SniConnectLog.shortHash(key.ip)),
+          ("waitCount", resolverLeases.count),
+        ]))
+        for resolverLease in resolverLeases {
+          try await resolverLease.waitUntilReleased()
         }
       }
     }
+  }
 
-    @objc static func resolveDomain(_ domain: String) -> String? {
-      var result: String?
-      queue.sync {
-        result = cache.get(domain)
-      }
-      return result
-    }
+  private func retainSession(_ session: URLSession) -> SessionLease {
+    let sessionID = ObjectIdentifier(session)
+    activeSessionCounts[sessionID, default: 0] += 1
+    return SessionLease(session: session, sessionID: sessionID)
+  }
 
-    static func setIP(_ ip: String, for host: String) {
-      queue.sync(flags: .barrier) {
-        cache.set(ip, for: host)
+  private func releaseSessionLease(_ lease: SessionLease) {
+    sessionsQueue.sync {
+      guard let count = activeSessionCounts[lease.sessionID] else {
+        return
+      }
+      if count > 1 {
+        activeSessionCounts[lease.sessionID] = count - 1
+      } else {
+        activeSessionCounts.removeValue(forKey: lease.sessionID)
       }
     }
+  }
+
+  private func markSessionUsed(_ key: SessionKey) {
+    sessionAccessOrder.removeAll { $0 == key }
+    sessionAccessOrder.append(key)
+  }
 
-    /// Clear all DNS cache entries
-    static func clearCache() {
-      queue.sync(flags: .barrier) {
-        cache.clear()
+  private func evictSessionsIfNeeded(forPendingInsert: Bool = false) -> [SniConnectPinnedResolverLease] {
+    var pendingResolverSlots: [SniConnectPinnedResolverLease] = []
+    let limit = forPendingInsert ? Self.maxCachedSessions - 1 : Self.maxCachedSessions
+    while sessionCache.count > limit, let evictedKey = sessionAccessOrder.first {
+      sessionAccessOrder.removeFirst()
+      if let managedSession = sessionCache.removeValue(forKey: evictedKey) {
+        if let pendingResolverSlot = invalidateSession(managedSession, for: evictedKey) {
+          pendingResolverSlots.append(pendingResolverSlot)
+        }
       }
+      SniConnectLog.info(SniConnectLog.event("sni_cache_evict", [
+        ("hostname", evictedKey.hostname),
+        ("ipHash", SniConnectLog.shortHash(evictedKey.ip)),
+        ("cacheSize", sessionCache.count),
+        ("limit", Self.maxCachedSessions),
+        ("reason", forPendingInsert ? "max_cached_sessions_pending_insert" : "max_cached_sessions"),
+      ]))
     }
+    return pendingResolverSlots
+  }
 
-    /// Clean expired DNS cache entries
-    static func cleanExpiredEntries() {
-      queue.sync(flags: .barrier) {
-        cache.cleanExpired()
-      }
+  private func invalidateSession(
+    _ managedSession: ManagedSession,
+    for key: SessionKey
+  ) -> SniConnectPinnedResolverLease? {
+    let releaseResolverImmediately = activeSessionCounts[ObjectIdentifier(managedSession.session)] == nil
+    managedSession.session.finishTasksAndInvalidate()
+    if releaseResolverImmediately {
+      _ = managedSession.resolverLease.release()
+      return nil
     }
+    return managedSession.resolverLease
   }
 
-  /// Clear all DNS cache entries
+  /// Drop cached sessions so future requests cannot reuse keep-alive connections
+  /// from a previously pinned destination. Idle sessions release their resolver
+  /// slot immediately; sessions with active requests release it when invalidation
+  /// completes.
   func clearDNSCache() {
-    DNSResolver.clearCache()
-    SniConnectLog.info("DNS cache cleared")
+    let invalidations = sessionsQueue.sync { () -> [SessionInvalidation] in
+      let invalidations = sessionCache.map { _, managedSession in
+        SessionInvalidation(
+          managedSession: managedSession,
+          releaseResolverImmediately: activeSessionCounts[ObjectIdentifier(managedSession.session)] == nil
+        )
+      }
+      sessionCache.removeAll()
+      sessionAccessOrder.removeAll()
+      return invalidations
+    }
+    var releasedResolverCount = 0
+    for invalidation in invalidations {
+      invalidation.managedSession.session.finishTasksAndInvalidate()
+      if invalidation.releaseResolverImmediately {
+        if invalidation.managedSession.resolverLease.release() {
+          releasedResolverCount += 1
+        }
+      }
+    }
+    SniConnectLog.info(SniConnectLog.event("sni_lifecycle", [
+      ("action", "clear_dns_cache"),
+      ("sessionCount", invalidations.count),
+      ("releasedResolverCount", releasedResolverCount),
+      ("success", true),
+    ]))
   }
 
   /// Cancel a request by ID
-  func cancelRequest(requestId: String) {
-    tasksQueue.async(flags: .barrier) { [weak self] in
-      guard let task = self?.activeTasks[requestId] else {
-        SniConnectLog.warn("No active request found with ID: \(requestId)")
-        return
+  func cancelRequest(requestId: String) -> Bool {
+    return tasksQueue.sync(flags: .barrier) { [weak self] in
+      guard let self = self, let token = self.requestTokensById.removeValue(forKey: requestId),
+            let task = self.activeTasksByToken.removeValue(forKey: token) else {
+        SniConnectLog.warn(SniConnectLog.event("sni_cancel", [
+          ("requestIdHash", SniConnectLog.shortHash(requestId)),
+          ("success", false),
+        ]))
+        return false
       }
       task.cancel()
-      self?.activeTasks.removeValue(forKey: requestId)
-      SniConnectLog.info("Request cancelled: \(requestId)")
+      SniConnectLog.info(SniConnectLog.event("sni_cancel", [
+        ("requestIdHash", SniConnectLog.shortHash(requestId)),
+        ("success", true),
+      ]))
+      return true
     }
   }
 
   /// Cancel all active requests
   func cancelAllRequests() {
-    tasksQueue.async(flags: .barrier) { [weak self] in
+    tasksQueue.sync(flags: .barrier) { [weak self] in
       guard let self = self else { return }
-      let count = self.activeTasks.count
-      for (_, task) in self.activeTasks {
+      let tasks = Array(self.activeTasksByToken.values)
+      for task in tasks {
         task.cancel()
       }
-      self.activeTasks.removeAll()
-      SniConnectLog.info("Cancelled \(count) active requests")
+      self.activeTasksByToken.removeAll()
+      self.requestTokensById.removeAll()
+      SniConnectLog.info(SniConnectLog.event("sni_cancel_all", [
+        ("cancelledCount", tasks.count),
+        ("success", true),
+      ]))
     }
   }
 
   /// Register an active task immediately after creation, before JS can cancel it.
-  func registerTask(_ task: Task<Response, Error>, for requestId: String) {
+  func registerTask(_ task: Task<Response, Error>, for requestId: String?) -> UUID {
+    let token = UUID()
     tasksQueue.sync(flags: .barrier) { [weak self] in
-      self?.activeTasks[requestId] = task
+      guard let self = self else { return }
+      if let requestId = requestId, let previousToken = self.requestTokensById[requestId],
+         let previousTask = self.activeTasksByToken.removeValue(forKey: previousToken) {
+        previousTask.cancel()
+        SniConnectLog.warn(SniConnectLog.event("sni_duplicate_request_id", [
+          ("requestIdHash", SniConnectLog.shortHash(requestId)),
+          ("action", "cancel_previous"),
+        ]))
+      }
+      self.activeTasksByToken[token] = task
+      if let requestId = requestId {
+        self.requestTokensById[requestId] = token
+      }
     }
+    return token
   }
 
   /// Unregister a completed or failed task
-  private func unregisterTask(requestId: String?) {
-    guard let requestId = requestId else { return }
+  func unregisterTask(requestId: String?, token: UUID) {
     tasksQueue.async(flags: .barrier) { [weak self] in
-      self?.activeTasks.removeValue(forKey: requestId)
+      self?.activeTasksByToken.removeValue(forKey: token)
+      if let requestId = requestId, self?.requestTokensById[requestId] == token {
+        self?.requestTokensById.removeValue(forKey: requestId)
+      }
     }
   }
 
   func performRequest(config: RequestConfig) async throws -> Response {
+    let startedAt = Date()
     // Check if task is cancelled
     try Task.checkCancellation()
 
-    defer {
-      unregisterTask(requestId: config.requestId)
-    }
-
     // Validate every caller-controlled field before it reaches the network layer.
     let method: String
     let normalizedPath: String
+    let normalizedHeaders: [String: String]
     do {
+      try SniConnectValidation.validateRequestId(config.requestId)
       try SniConnectValidation.validatePublicIP(config.ip)
       try SniConnectValidation.validateHostname(config.hostname)
-      try SniConnectValidation.validateHeaders(config.headers)
+      normalizedHeaders = try SniConnectValidation.normalizeHeaders(config.headers)
       method = try SniConnectValidation.normalizeMethod(config.method)
       normalizedPath = try SniConnectValidation.normalizePath(config.path)
+      try SniConnectValidation.validateTimeout(config.effectiveTotalTimeout)
+      try SniConnectValidation.validateBody(config.body)
+      try SniConnectValidation.validateMethodBody(method: method, body: config.body)
     } catch {
-      throw SniConnectError.invalidConfig("\(error)")
+      let sniError = SniConnectError.invalidConfig("\(error)")
+      SniConnectLog.error(SniConnectLog.event("sni_request_result", [
+        ("result", "error"),
+        ("code", sniError.code),
+        ("nativeErrorClass", String(describing: type(of: error))),
+        ("requestIdHash", SniConnectLog.shortHash(config.requestId)),
+        ("hostname", config.hostname.lowercased()),
+        ("ipHash", SniConnectLog.shortHash(config.ip)),
+        ("ipFamily", SniConnectLog.ipFamily(config.ip)),
+        ("method", config.method.uppercased()),
+        ("timeoutMs", Int(config.effectiveTotalTimeout)),
+        ("elapsedMs", SniConnectLog.elapsedMs(since: startedAt)),
+      ]))
+      throw sniError
     }
 
-    DNSResolver.setIP(config.ip, for: config.hostname)
+    let requestSlot: SniConnectRequestLimiter.Token
+    do {
+      requestSlot = try requestLimiter.acquire(hostname: config.hostname, ip: config.ip)
+    } catch {
+      let sniError = SniConnectError.resourceLimit("\(error)")
+      SniConnectLog.error(SniConnectLog.event("sni_request_result", [
+        ("result", "error"),
+        ("code", sniError.code),
+        ("nativeErrorClass", String(describing: type(of: error))),
+        ("requestIdHash", SniConnectLog.shortHash(config.requestId)),
+        ("hostname", config.hostname.lowercased()),
+        ("ipHash", SniConnectLog.shortHash(config.ip)),
+        ("ipFamily", SniConnectLog.ipFamily(config.ip)),
+        ("method", method),
+        ("timeoutMs", Int(config.effectiveTotalTimeout)),
+        ("elapsedMs", SniConnectLog.elapsedMs(since: startedAt)),
+      ]))
+      throw sniError
+    }
+    defer {
+      requestSlot.release()
+    }
 
     let url = try Self.buildURL(hostname: config.hostname, normalizedPath: normalizedPath)
 
@@ -343,20 +646,17 @@ final class SniConnectClient {
     let totalTimeoutSeconds = config.effectiveTotalTimeout / 1000.0
     let connectTimeoutSeconds = config.effectiveConnectTimeout / 1000.0
 
-    // Set total request timeout
+    // URLRequest.timeoutInterval is not a full request deadline. Keep it aligned
+    // with the caller timeout as a transport guard; the wall-clock deadline below
+    // enforces total request time including response body reads.
     mutableRequest.timeoutInterval = totalTimeoutSeconds
     mutableRequest.cachePolicy = .reloadIgnoringLocalCacheData
 
-    // Explicitly set Host header for SNI
-    mutableRequest.setValue(config.hostname, forHTTPHeaderField: "Host")
-
-    for (key, value) in config.headers {
-      if key.caseInsensitiveCompare("host") == .orderedSame {
-        // Host header is already set above, skip duplicate
-        continue
-      }
+    for (key, value) in normalizedHeaders {
       mutableRequest.setValue(value, forHTTPHeaderField: key)
     }
+    mutableRequest.setValue(config.hostname, forHTTPHeaderField: "Host")
+    mutableRequest.setValue("identity", forHTTPHeaderField: "Accept-Encoding")
 
     if let bodyString = config.body, let bodyData = bodyString.data(using: .utf8) {
       mutableRequest.httpBody = bodyData
@@ -366,39 +666,95 @@ final class SniConnectClient {
     EMASCurlProtocol.setConnectTimeoutIntervalFor(mutableRequest, connectTimeoutInterval: connectTimeoutSeconds)
     let request = mutableRequest as URLRequest
 
+    SniConnectLog.info(SniConnectLog.event("sni_request_start", [
+      ("requestIdHash", SniConnectLog.shortHash(config.requestId)),
+      ("hostname", config.hostname.lowercased()),
+      ("ipHash", SniConnectLog.shortHash(config.ip)),
+      ("ipFamily", SniConnectLog.ipFamily(config.ip)),
+      ("method", method),
+      ("timeoutMs", Int(config.effectiveTotalTimeout)),
+      ("connectTimeoutMs", Int(config.effectiveConnectTimeout)),
+      ("headerCount", normalizedHeaders.count),
+      ("bodyBytes", config.body?.data(using: .utf8)?.count ?? 0),
+    ]))
+
     do {
-      let (data, response) = try await Self.urlSession.data(for: request)
-      guard let httpResponse = response as? HTTPURLResponse else {
-        let errorMsg = "Invalid HTTP response type"
-        SniConnectLog.error(errorMsg)
-        throw SniConnectError.invalidConfig(errorMsg)
-      }
+      return try await SniConnectWallClockDeadline.run(timeoutMilliseconds: config.effectiveTotalTimeout) {
+        let lease = try await sessionLease(for: config)
+        defer {
+          releaseSessionLease(lease)
+        }
+        let (bodyBytes, response) = try await lease.session.bytes(for: request)
+        guard let httpResponse = response as? HTTPURLResponse else {
+          throw SniConnectError.responseProcessingFailed("Invalid HTTP response type")
+        }
 
-      let status = httpResponse.statusCode
-      let parsedData = Self.parseResponseData(data)
-      let (headers, multiValueHeaders) = Self.extractHeaders(from: httpResponse)
-      let statusText = HTTPURLResponse.localizedString(forStatusCode: status)
+        let status = httpResponse.statusCode
+        let data = try await Self.readResponseBody(
+          bodyBytes,
+          expectedLength: httpResponse.expectedContentLength
+        )
+        let responseText = SniConnectResponseText.decode(data)
+        let headerMaps = SniConnectResponseHeaders.make(from: httpResponse.allHeaderFields)
+        let statusText = ""
+
+        // 4xx/5xx are returned to JS as a normal response (the caller inspects
+        // `status`); we only record it for diagnostics.
+        let resultLog = SniConnectLog.event("sni_request_result", [
+          ("result", "response"),
+          ("status", status),
+          ("requestIdHash", SniConnectLog.shortHash(config.requestId)),
+          ("hostname", config.hostname.lowercased()),
+          ("ipHash", SniConnectLog.shortHash(config.ip)),
+          ("ipFamily", SniConnectLog.ipFamily(config.ip)),
+          ("method", method),
+          ("timeoutMs", Int(config.effectiveTotalTimeout)),
+          ("responseBytes", data.count),
+          ("elapsedMs", SniConnectLog.elapsedMs(since: startedAt)),
+        ])
+        if status >= 400 {
+          SniConnectLog.warn(resultLog)
+        } else {
+          SniConnectLog.info(resultLog)
+        }
 
-      // 4xx/5xx are returned to JS as a normal response (the caller inspects
-      // `status`); we only record it for diagnostics.
-      if status >= 400 {
-        SniConnectLog.warn("HTTP \(status) for \(config.hostname)")
+        return Response(
+          data: responseText,
+          status: status,
+          statusText: statusText,
+          headers: headerMaps.singleValueHeaders,
+          multiValueHeaders: headerMaps.multiValueHeaders
+        )
       }
-
-      return Response(
-        data: parsedData,
-        status: status,
-        statusText: statusText,
-        headers: headers,
-        multiValueHeaders: multiValueHeaders
-      )
     } catch let error as SniConnectError {
-      SniConnectLog.error("[\(error.code)] \(error.message)")
+      SniConnectLog.error(SniConnectLog.event("sni_request_result", [
+        ("result", "error"),
+        ("code", error.code),
+        ("nativeErrorClass", String(describing: type(of: error))),
+        ("requestIdHash", SniConnectLog.shortHash(config.requestId)),
+        ("hostname", config.hostname.lowercased()),
+        ("ipHash", SniConnectLog.shortHash(config.ip)),
+        ("ipFamily", SniConnectLog.ipFamily(config.ip)),
+        ("method", method),
+        ("timeoutMs", Int(config.effectiveTotalTimeout)),
+        ("elapsedMs", SniConnectLog.elapsedMs(since: startedAt)),
+      ]))
       throw error
     } catch {
       // Convert generic errors to specific SniConnectError types
       let sniError = SniConnectError.from(error)
-      SniConnectLog.error("[\(sniError.code)] \(sniError.message)")
+      SniConnectLog.error(SniConnectLog.event("sni_request_result", [
+        ("result", "error"),
+        ("code", sniError.code),
+        ("nativeErrorClass", String(describing: type(of: error))),
+        ("requestIdHash", SniConnectLog.shortHash(config.requestId)),
+        ("hostname", config.hostname.lowercased()),
+        ("ipHash", SniConnectLog.shortHash(config.ip)),
+        ("ipFamily", SniConnectLog.ipFamily(config.ip)),
+        ("method", method),
+        ("timeoutMs", Int(config.effectiveTotalTimeout)),
+        ("elapsedMs", SniConnectLog.elapsedMs(since: startedAt)),
+      ]))
       throw sniError
     }
   }
@@ -425,48 +781,29 @@ final class SniConnectClient {
     return url
   }
 
-  private static func parseResponseData(_ data: Data) -> Any {
-    guard !data.isEmpty else {
-      return ""
+  private static func readResponseBody(
+    _ bodyBytes: URLSession.AsyncBytes,
+    expectedLength: Int64
+  ) async throws -> Data {
+    let maxBytes = SniConnectValidation.maxResponseBodyBytes
+    if expectedLength > Int64(maxBytes) {
+      throw SniConnectError.responseProcessingFailed("Response body too large")
     }
 
-    if let jsonObject = try? JSONSerialization.jsonObject(with: data, options: []) {
-      return jsonObject
+    var data = Data()
+    if expectedLength > 0 {
+      data.reserveCapacity(min(Int(expectedLength), maxBytes))
     }
 
-    if let text = String(data: data, encoding: .utf8) {
-      return text
-    }
-
-    return data.base64EncodedString()
-  }
-
-  /// Extract headers from HTTP response
-  /// Returns both single-value headers (for backward compatibility) and multi-value headers
-  private static func extractHeaders(from response: HTTPURLResponse) -> ([String: String], [String: [String]]) {
-    var singleValueHeaders: [String: String] = [:]
-    var multiValueHeaders: [String: [String]] = [:]
-
-    // Group headers by normalized key (lowercase)
-    var headerGroups: [String: [String]] = [:]
-
-    for (key, value) in response.allHeaderFields {
-      let headerKey = String(describing: key).lowercased()
-      let headerValue = String(describing: value)
-
-      if headerGroups[headerKey] == nil {
-        headerGroups[headerKey] = []
+    for try await byte in bodyBytes {
+      try Task.checkCancellation()
+      if data.count >= maxBytes {
+        throw SniConnectError.responseProcessingFailed("Response body too large")
       }
-      headerGroups[headerKey]?.append(headerValue)
+      var nextByte = byte
+      data.append(&nextByte, count: 1)
     }
-
-    // Process grouped headers
-    for (key, values) in headerGroups {
-      // For backward compatibility, single-value headers use the last value
-      singleValueHeaders[key] = values.last
-      multiValueHeaders[key] = values
-    }
-
-    return (singleValueHeaders, multiValueHeaders)
+    return data
   }
+
 }