jumpy-lion 0.1.6-beta.7 → 1.0.0-beta.0

package/dist/fingerprinting/fingerprint-injector.js

@@ -62,14 +62,112 @@
  */
 import { log } from 'crawlee';
 import { gotScraping } from 'got-scraping';
-import { createCustomFingerprintInjection } from './custom-fingerprint-injector.js';
-import { createStealthScript, createWebGLSpoofingScript, createAudioFingerprintSpoofingScript, createAdvancedCanvasProtectionScript, createClientRectSpoofingScript, createWebRTCSpoofingScript, createWebRTCDisableScript, createWebGPUSpoofingScript, createPlatformConsistencyScript, createMouseMovementHumanizationScript, createRuntimeEnableBypassScript, createFontSpoofingScript, createPerformanceSpoofingScript, createLocaleSpoofingScript, createUAClientHintsSpoofingScript, 
-// Stealth utilities (must be injected first)
-createStealthUtilsScript, 
-// Prototype integrity (must be injected early)
-createPrototypeIntegrityScript, 
-// 2024-2025 New modules
-createCDPDetectionBypassScript, createStorageConsistencyScript, createTimingConsistencyScript, createKeyboardHumanizationScript, createScrollHumanizationScript, createDataDomeBypassScript, createMediaCodecsSpoofingScript, } from './fingerprint-overrides/index.js';
+import { normalizePlatformVersion } from './hardware-realism.js';
+import { buildInjectionPlan, isNativeStealth, needsIpTimezoneLookup, } from './injection-planner.js';
+import { alignUserAgentWithBrowserVersion, alignUAClientHintsVersion } from './ua-alignment.js';
+import { canonicalBrandList } from './ua-ch-brands.js';
+/**
+ * Per-proxy-session cache of the ipinfo.io timezone lookup, held for process
+ * lifetime. Keyed by proxyUrl so concurrent pages on the SAME session share one
+ * in-flight fetch and every later page reuses the result - but two different
+ * proxy sessions get independent entries and NEVER bleed a timezone into one
+ * another. No-proxy lookups get their own dedicated key.
+ */
+const NO_PROXY_TIMEZONE_KEY = '__no_proxy__';
+const timezoneByProxy = new Map();
+/**
+ * Per-browser-process cache of the CDP `Browser.getVersion` probe. Keyed by the
+ * CDP connection's host:port - Chrome's remote-debugging port is unique per
+ * browser process, so every page/target of one browser shares a single probe
+ * while distinct browser processes stay independent. This is a version value,
+ * never proxy-session identity, so per-process keying is the correct scope.
+ */
+const chromeVersionByEndpoint = new Map();
+/**
+ * UA-CH platform/arch/version constants. Hoisted to module scope so they are
+ * allocated once per process rather than rebuilt on every page's
+ * setUserAgentWithMetadata call.
+ */
+const UA_PLATFORM_NAME_MAP = {
+    'Win32': 'Windows',
+    'MacIntel': 'macOS',
+    'Linux x86_64': 'Linux',
+};
+const UA_ARCH_MAP = {
+    'Win32': 'x86',
+    'MacIntel': 'arm',
+    'Linux x86_64': 'x86',
+};
+// The platformVersion candidate tables live in hardware-realism.ts so this path
+// and the native FingerprintConfig path cannot disagree - they did, and a Linux
+// profile ended up advertising a macOS version (issue #137).
+/**
+ * Cache of the deterministic UA-seed hash per userAgent string. The hash feeds
+ * the platformVersion candidate pick; it is a pure function of the UA string,
+ * so it is computed once per distinct UA rather than on every page injection.
+ */
+const uaSeedHashCache = new Map();
+/**
+ * Stable hash of the UA string. Same UA → same value across reloads/sessions;
+ * a different UA (different fingerprint seed) → a different value. Math-only
+ * hash (mod 2^31-1) to satisfy the no-bitwise lint rule.
+ */
+function uaSeedHash(userAgent) {
+    const cached = uaSeedHashCache.get(userAgent);
+    if (cached !== undefined)
+        return cached;
+    let hash = 0xCAFE1003;
+    for (let i = 0; i < userAgent.length; i++) {
+        hash = (hash * 31 + userAgent.charCodeAt(i)) % 0x7FFFFFFF;
+    }
+    uaSeedHashCache.set(userAgent, hash);
+    return hash;
+}
+/**
+ * The Apify-platform recommended settings, frozen once at module load. These
+ * are per-launch constants (no per-page or per-session variation), so the graph
+ * is built exactly once instead of on every page. Callers only ever spread this
+ * value into a fresh object; the deep freeze guards against accidental in-place
+ * mutation bleeding across pages.
+ */
+const APIFY_RECOMMENDED_SETTINGS = Object.freeze({
+    debug: false, // Disabled - anti-bot services detect debug console prefixes
+    enableAdvancedStealth: true,
+    bypassRuntimeEnable: true,
+    platform: 'Win32', // Spoof as Windows instead of Linux for better evasion
+    spoofWebGL: true,
+    spoofAudioContext: true,
+    spoofClientRects: true,
+    detectTimezone: true, // Auto-detect timezone from proxy
+    // New advanced spoofing options for 2025
+    spoofFonts: true,
+    spoofPerformance: true,
+    spoofLocale: true,
+    useFingerprintDefaults: true, // Use fingerprint-generator Windows values
+    // 2024-2025 DataDome bypass options
+    bypassCDPDetection: true,
+    spoofStorage: true,
+    spoofTiming: true,
+    enableDataDomeBypass: false, // Enable only when needed
+    // Humanization disabled by default for performance
+    humanization: Object.freeze({
+        mouse: true,
+        keyboard: true,
+        scroll: true,
+    }),
+    viewport: Object.freeze({
+        width: 1920,
+        height: 1080,
+        deviceScaleFactor: 1,
+        mobile: false,
+    }),
+});
+/** Test-only: drop the process-level runtime caches so runs start fresh. */
+export function resetInjectorRuntimeCachesForTesting() {
+    timezoneByProxy.clear();
+    chromeVersionByEndpoint.clear();
+    uaSeedHashCache.clear();
+}
 export class CdpFingerprintInjector {
     constructor(page) {
         Object.defineProperty(this, "page", {
@@ -89,38 +187,9 @@ export class CdpFingerprintInjector {
      * Use getDataDomeSettings() or enable humanization manually for anti-bot sites.
      */
     static getApifyRecommendedSettings() {
-        return {
-            debug: false, // Disabled - anti-bot services detect debug console prefixes
-            enableAdvancedStealth: true,
-            bypassRuntimeEnable: true,
-            platform: 'Win32', // Spoof as Windows instead of Linux for better evasion
-            spoofWebGL: true,
-            spoofAudioContext: true,
-            spoofClientRects: true,
-            detectTimezone: true, // Auto-detect timezone from proxy
-            // New advanced spoofing options for 2025
-            spoofFonts: true,
-            spoofPerformance: true,
-            spoofLocale: true,
-            useFingerprintDefaults: true, // Use fingerprint-generator Windows values
-            // 2024-2025 DataDome bypass options
-            bypassCDPDetection: true,
-            spoofStorage: true,
-            spoofTiming: true,
-            enableDataDomeBypass: false, // Enable only when needed
-            // Humanization disabled by default for performance
-            humanization: {
-                mouse: true,
-                keyboard: true,
-                scroll: true,
-            },
-            viewport: {
-                width: 1920,
-                height: 1080,
-                deviceScaleFactor: 1,
-                mobile: false,
-            },
-        };
+        // Frozen module-level constant - see APIFY_RECOMMENDED_SETTINGS. Callers
+        // spread it into a fresh object, so returning the shared value is safe.
+        return APIFY_RECOMMENDED_SETTINGS;
     }
     /**
      * Get settings specifically optimized for DataDome-protected sites.
@@ -165,12 +234,12 @@ export class CdpFingerprintInjector {
             process.env.CRAWLEE_HEADLESS === '1' ||
             process.env.HEADLESS === 'true';
         if (!isHeadless) {
-            log.info('⚠️ Headful mode detected - SKIPPING viewport override to preserve natural window behavior');
-            log.info('✅ Browser will use OS window dimensions - scrolling will work naturally');
+            log.debug('⚠️ Headful mode detected - SKIPPING viewport override to preserve natural window behavior');
+            log.debug('✅ Browser will use OS window dimensions - scrolling will work naturally');
             return; // Skip viewport override in headful mode
         }
         // Only apply viewport override in headless mode
-        log.info('Headless mode detected - applying viewport override');
+        log.debug('Headless mode detected - applying viewport override');
         let defaultViewport = {
             width: 1920,
             height: 1080,
@@ -189,7 +258,7 @@ export class CdpFingerprintInjector {
                 deviceScaleFactor: fingerprint.screen.devicePixelRatio || 1,
                 mobile: false,
             };
-            log.info('Viewport configured for scrolling', {
+            log.debug('Viewport configured for scrolling', {
                 screenHeight,
                 viewportHeight,
                 reservedSpace: 150,
@@ -198,10 +267,10 @@ export class CdpFingerprintInjector {
             });
         }
         const finalViewport = Object.assign(defaultViewport, viewport);
-        log.info('Final viewport settings (headless mode)', finalViewport);
+        log.debug('Final viewport settings (headless mode)', finalViewport);
         // CDP call to override device metrics (headless mode only)
         await this.page.client.Emulation.setDeviceMetricsOverride(finalViewport);
-        log.info('setDeviceMetricsOverride completed (headless mode)');
+        log.debug('setDeviceMetricsOverride completed (headless mode)');
     }
     async setExtraHTTPHeaders(headers) {
         await this.page.client.Network.setExtraHTTPHeaders({ headers });
@@ -212,35 +281,43 @@ export class CdpFingerprintInjector {
      * Without this, the browser sends its real client hints headers which
      * don't match the spoofed navigator.userAgentData values.
      */
-    async setUserAgentWithMetadata(userAgent, platform, uaClientHints) {
-        const platformMap = {
-            'Win32': 'Windows',
-            'MacIntel': 'macOS',
-            'Linux x86_64': 'Linux',
-        };
-        const platformName = platformMap[platform] || 'Windows';
+    async setUserAgentWithMetadata(userAgent, platform, uaClientHints, binaryFullVersion) {
+        const platformName = UA_PLATFORM_NAME_MAP[platform] || 'Windows';
         // Determine Chrome version from UA string
         const chromeVersionMatch = userAgent.match(/Chrome\/(\d+)\.(\d+)\.(\d+)\.(\d+)/);
         if (!chromeVersionMatch) {
             throw new Error(`Cannot derive Chrome version from user agent: ${userAgent}`);
         }
         const majorVersion = chromeVersionMatch[1];
-        const fullVersion = `${chromeVersionMatch[1]}.${chromeVersionMatch[2]}.${chromeVersionMatch[3]}.${chromeVersionMatch[4]}`;
-        const brands = uaClientHints?.brands || [
-            { brand: 'Google Chrome', version: majorVersion },
-            { brand: 'Chromium', version: majorVersion },
-            { brand: 'Not_A Brand', version: '24' },
-        ];
-        const archMap = {
-            'Win32': 'x86',
-            'MacIntel': 'arm',
-            'Linux x86_64': 'x86',
-        };
-        const platformVersionMap = {
-            'Win32': '15.0.0',
-            'MacIntel': '15.3.0',
-            'Linux x86_64': '6.8.0',
-        };
+        // UA-CH `fullVersion` must be the REAL build (147.0.7727.56), never the
+        // UA string's version. UA Reduction (Chrome 107+) freezes the UA to
+        // MAJOR.0.0.0 but leaves UA-CH untouched, so deriving it from the UA -
+        // as this method used to - put "147.0.0.0" into
+        // `sec-ch-ua-full-version` / `-full-version-list`: a shape no Chrome
+        // emits. It stayed hidden because high-entropy hints only ship after the
+        // origin asks via `accept-ch`, so the first document passed and every
+        // later XHR was refused (issue #131). Order: the probed binary build →
+        // the profile's own build → the reduced UA value, which is a bug worth
+        // logging rather than a value worth sending.
+        const uaDerivedVersion = `${majorVersion}.${chromeVersionMatch[2]}.${chromeVersionMatch[3]}.${chromeVersionMatch[4]}`;
+        const fullVersion = binaryFullVersion || uaClientHints?.uaFullVersion || uaDerivedVersion;
+        if (/^\d+\.0\.0\.0$/.test(fullVersion)) {
+            log.warning('[AntiDetect] UA-CH full version is the UA-reduced MAJOR.0.0.0 shape - no real Chrome '
+                + 'reports this in sec-ch-ua-full-version(-list). The binary version probe and the '
+                + 'profile both failed to supply a build number.', { fullVersion, userAgent });
+        }
+        // No profile brands (useFingerprintDefaults path): synthesize the exact
+        // list a real Chrome of this major emits - derived GREASE token, real
+        // brands, Chromium's own ordering. A hardcoded literal here paired a
+        // fixed GREASE with a moving major, which is what Naver rejects (#131).
+        const brands = uaClientHints?.brands || canonicalBrandList(majorVersion);
+        const fullVersionList = uaClientHints?.fullVersionList || canonicalBrandList(fullVersion);
+        // Stable hash of the UA string → index into the candidate list.
+        // Same UA → same platformVersion across reloads/sessions; different UA
+        // (different fingerprint seed) → different version. The hash is memoized
+        // per UA string (see uaSeedHashCache).
+        const _uaHash = uaSeedHash(userAgent);
+        const resolvedPlatformVersion = normalizePlatformVersion(platform, uaClientHints?.platformVersion, _uaHash);
         try {
             // NOTE: do NOT pass the top-level `platform` field. Chrome maps it
             // to `Settings::NavigatorPlatformOverride`, which then overrides
@@ -248,19 +325,31 @@ export class CdpFingerprintInjector {
             // (third_party/blink/renderer/core/frame/navigator.cc). The value
             // sent here is UA-CH form ("macOS"/"Windows"/"Linux"), but the
             // LEGACY `navigator.platform` must be "MacIntel"/"Win32"/
-            // "Linux x86_64" — passing the UA-CH string leaks a Chrome-
+            // "Linux x86_64" - passing the UA-CH string leaks a Chrome-
             // invariant violation that CreepJS flags immediately.
             // The UA-CH value belongs only in userAgentMetadata.platform.
             await this.page.client.Network.setUserAgentOverride({
                 userAgent,
+                // `fullVersionList` is missing from the pinned
+                // devtools-protocol typings but has been part of
+                // Emulation.UserAgentMetadata since Chrome 100 (it superseded
+                // `fullVersion`). Sending it explicitly is what makes
+                // `sec-ch-ua-full-version-list` correct: given only
+                // `fullVersion`, Chrome pairs EVERY brand with it - including
+                // GREASE, which then carries the real build instead of its
+                // padded "<v>.0.0.0" (issue #131). We send both so an older
+                // browser still gets the legacy field.
                 userAgentMetadata: {
                     brands: brands.map(b => ({ brand: b.brand, version: b.version })),
+                    fullVersionList: fullVersionList.map(b => ({ brand: b.brand, version: b.version })),
                     fullVersion,
                     platform: platformName,
-                    platformVersion: uaClientHints?.platformVersion || platformVersionMap[platform] || '15.0.0',
-                    architecture: uaClientHints?.architecture || archMap[platform] || 'x86',
+                    platformVersion: resolvedPlatformVersion,
+                    architecture: uaClientHints?.architecture || UA_ARCH_MAP[platform] || 'x86',
                     model: uaClientHints?.model || '',
                     mobile: false,
+                    // The cast covers `fullVersionList`, absent from the pinned
+                    // devtools-protocol typings (see the note above).
                 },
             });
             log.debug('Set User-Agent with full client hints metadata');
@@ -272,18 +361,29 @@ export class CdpFingerprintInjector {
         }
     }
     async getTimezoneFromIp(proxyUrl) {
-        try {
-            const response = await gotScraping({
-                url: 'https://ipinfo.io/json',
-                proxyUrl,
-                responseType: 'json',
+        // Cache per proxy session for process lifetime: concurrent pages on the
+        // same session share the single in-flight fetch, and later pages reuse
+        // the resolved value. A failed lookup evicts its entry so a later page
+        // can retry instead of pinning a wrong timezone for the whole session.
+        const key = proxyUrl ?? NO_PROXY_TIMEZONE_KEY;
+        let pending = timezoneByProxy.get(key);
+        if (!pending) {
+            pending = this.fetchTimezoneFromIp(proxyUrl).catch((error) => {
+                timezoneByProxy.delete(key);
+                log.error('Failed to get timezone from IP:', { error });
+                return 'UTC';
             });
-            return response.body.timezone;
-        }
-        catch (error) {
-            log.error('Failed to get timezone from IP:', { error });
-            return 'UTC';
+            timezoneByProxy.set(key, pending);
         }
+        return pending;
+    }
+    async fetchTimezoneFromIp(proxyUrl) {
+        const response = await gotScraping({
+            url: 'https://ipinfo.io/json',
+            proxyUrl,
+            responseType: 'json',
+        });
+        return response.body.timezone;
     }
     async setTimezoneOverride(timezone) {
         await this.page.client.Emulation.setTimezoneOverride({
@@ -293,7 +393,7 @@ export class CdpFingerprintInjector {
     /**
      * Override ICU's default locale for the page via CDP. This makes Intl.DateTimeFormat,
      * Intl.NumberFormat, and Date.toLocaleString default to the supplied locale regardless
-     * of the browser binary's --lang setting — our reliable knob for the stock-Chrome path
+     * of the browser binary's --lang setting - our reliable knob for the stock-Chrome path
      * where we don't control the startup args.
      */
     async setLocaleOverride(locale) {
@@ -308,561 +408,160 @@ export class CdpFingerprintInjector {
     // into the single injection to avoid multiple addScriptToEvaluateOnNewDocument calls
     // which is a detection vector.
     /**
-     * Create a debug script that logs fingerprint override status to the console
+     * Identify the browser process behind this page's CDP connection. The
+     * remote-debugging host:port is unique per Chrome process, so it keys the
+     * per-browser-process version cache without bleeding across processes.
      */
-    createDebugScript(options) {
-        return `
-(() => {
-    // CDP Fingerprint Override Debug Logs
-    const DEBUG_PREFIX = '[CDP-FP-DEBUG]';
-    
-    console.log(DEBUG_PREFIX, '=== Fingerprint Override Status ===');
-    console.log(DEBUG_PREFIX, 'Timestamp:', new Date().toISOString());
-    
-    // Check navigator properties
-    console.log(DEBUG_PREFIX, 'Navigator Checks:');
-    console.log(DEBUG_PREFIX, '  - platform:', navigator.platform);
-    console.log(DEBUG_PREFIX, '  - userAgent:', navigator.userAgent.substring(0, 80) + '...');
-    console.log(DEBUG_PREFIX, '  - webdriver:', navigator.webdriver);
-    console.log(DEBUG_PREFIX, '  - hardwareConcurrency:', navigator.hardwareConcurrency);
-    console.log(DEBUG_PREFIX, '  - deviceMemory:', navigator.deviceMemory);
-    console.log(DEBUG_PREFIX, '  - language:', navigator.language);
-    console.log(DEBUG_PREFIX, '  - languages:', navigator.languages);
-    console.log(DEBUG_PREFIX, '  - maxTouchPoints:', navigator.maxTouchPoints);
-    console.log(DEBUG_PREFIX, '  - pdfViewerEnabled:', navigator.pdfViewerEnabled);
-    console.log(DEBUG_PREFIX, '  - plugins.length:', navigator.plugins?.length);
-    
-    // Check screen properties
-    console.log(DEBUG_PREFIX, 'Screen Checks:');
-    console.log(DEBUG_PREFIX, '  - colorDepth:', screen.colorDepth);
-    console.log(DEBUG_PREFIX, '  - pixelDepth:', screen.pixelDepth);
-    console.log(DEBUG_PREFIX, '  - availWidth:', screen.availWidth);
-    console.log(DEBUG_PREFIX, '  - availHeight:', screen.availHeight);
-    console.log(DEBUG_PREFIX, '  - devicePixelRatio:', window.devicePixelRatio);
-    
-    // Check window properties
-    console.log(DEBUG_PREFIX, 'Window Checks:');
-    console.log(DEBUG_PREFIX, '  - outerWidth:', window.outerWidth);
-    console.log(DEBUG_PREFIX, '  - outerHeight:', window.outerHeight);
-    console.log(DEBUG_PREFIX, '  - screenX:', window.screenX);
-    console.log(DEBUG_PREFIX, '  - screenY:', window.screenY);
-    
-    // Check chrome object
-    console.log(DEBUG_PREFIX, 'Chrome Object:');
-    console.log(DEBUG_PREFIX, '  - chrome exists:', typeof window.chrome !== 'undefined');
-    console.log(DEBUG_PREFIX, '  - chrome.runtime exists:', typeof window.chrome?.runtime !== 'undefined');
-    
-    // Check WebGL
-    try {
-        const canvas = document.createElement('canvas');
-        const gl = canvas.getContext('webgl') || canvas.getContext('experimental-webgl');
-        if (gl) {
-            const debugInfo = gl.getExtension('WEBGL_debug_renderer_info');
-            if (debugInfo) {
-                console.log(DEBUG_PREFIX, 'WebGL Checks:');
-                console.log(DEBUG_PREFIX, '  - vendor:', gl.getParameter(debugInfo.UNMASKED_VENDOR_WEBGL));
-                console.log(DEBUG_PREFIX, '  - renderer:', gl.getParameter(debugInfo.UNMASKED_RENDERER_WEBGL));
-            } else {
-                console.log(DEBUG_PREFIX, 'WebGL debug extension not available');
-            }
-        } else {
-            console.log(DEBUG_PREFIX, 'WebGL context not available');
-        }
-    } catch (e) {
-        console.log(DEBUG_PREFIX, 'WebGL check failed:', e.message);
-    }
-    
-    // Check automation markers
-    console.log(DEBUG_PREFIX, 'Automation Marker Checks:');
-    console.log(DEBUG_PREFIX, '  - $cdc_ properties:', Object.keys(window).filter(k => k.startsWith('$cdc_') || k.startsWith('cdc_')).length === 0 ? 'CLEAN' : 'DETECTED');
-    console.log(DEBUG_PREFIX, '  - webdriver properties:', Object.keys(window).filter(k => k.toLowerCase().includes('webdriver')).length === 0 ? 'CLEAN' : 'DETECTED');
-    
-    // Check permissions API
-    if (navigator.permissions) {
-        navigator.permissions.query({ name: 'notifications' }).then(result => {
-            console.log(DEBUG_PREFIX, 'Permissions:');
-            console.log(DEBUG_PREFIX, '  - notifications:', result.state);
-        }).catch(e => {
-            console.log(DEBUG_PREFIX, 'Permissions check failed:', e.message);
-        });
+    browserEndpointKey() {
+        const client = this.page.client;
+        return `${client?.host ?? 'localhost'}:${client?.port ?? ''}`;
     }
-    
-    // Check storage estimate
-    if (navigator.storage && navigator.storage.estimate) {
-        navigator.storage.estimate().then(estimate => {
-            console.log(DEBUG_PREFIX, 'Storage:');
-            console.log(DEBUG_PREFIX, '  - quota:', Math.round(estimate.quota / 1024 / 1024 / 1024) + ' GB');
-            console.log(DEBUG_PREFIX, '  - usage:', Math.round(estimate.usage / 1024) + ' KB');
-        }).catch(e => {
-            console.log(DEBUG_PREFIX, 'Storage check failed:', e.message);
-        });
+    async getActualChromeVersion() {
+        // Probe Browser.getVersion once per browser process. All of a browser's
+        // pages/targets share the same endpoint key, so the version is fetched
+        // once and reused; distinct browser processes stay independent. A failed
+        // probe evicts its entry so a later page can retry.
+        const key = this.browserEndpointKey();
+        let pending = chromeVersionByEndpoint.get(key);
+        if (!pending) {
+            pending = this.probeActualChromeVersion().catch(() => {
+                chromeVersionByEndpoint.delete(key);
+                return null;
+            });
+            chromeVersionByEndpoint.set(key, pending);
+        }
+        return pending;
     }
-    
-    // Log applied options
-    console.log(DEBUG_PREFIX, 'Applied Options:');
-    console.log(DEBUG_PREFIX, '  - platform:', '${options.platform || "auto"}');
-    console.log(DEBUG_PREFIX, '  - enableAdvancedStealth:', ${options.enableAdvancedStealth !== false});
-    console.log(DEBUG_PREFIX, '  - bypassCDPDetection:', ${options.bypassCDPDetection !== false});
-    console.log(DEBUG_PREFIX, '  - spoofStorage:', ${options.spoofStorage !== false});
-    console.log(DEBUG_PREFIX, '  - spoofTiming:', ${options.spoofTiming !== false});
-    console.log(DEBUG_PREFIX, '  - enableDataDomeBypass:', ${options.enableDataDomeBypass || false});
-    console.log(DEBUG_PREFIX, '  - humanization.mouse:', ${options.humanization?.mouse || false});
-    console.log(DEBUG_PREFIX, '  - humanization.keyboard:', ${options.humanization?.keyboard || false});
-    console.log(DEBUG_PREFIX, '  - humanization.scroll:', ${options.humanization?.scroll || false});
-    
-    console.log(DEBUG_PREFIX, '=== End Fingerprint Override Status ===');
-})();
-`;
+    async probeActualChromeVersion() {
+        const versionInfo = await this.page.client.Browser.getVersion();
+        const product = versionInfo.product || '';
+        const match = product.match(/(?:Chrome|HeadlessChrome)\/(\d+\.\d+\.\d+\.\d+)/);
+        return match ? match[1] : null;
     }
     /**
-     * Extract relevant data from fingerprint for overrides
+     * Mutate the shared fingerprint's navigator UA surfaces (userAgent, appVersion,
+     * userAgentData brands, and the headers UA) to the real binary version, in
+     * place. This is the SAME object Crawlee/BrowserPool's built-in
+     * FingerprintInjector reads in its postPageCreate hook, so aligning it here
+     * keeps navigator.userAgent, the Sec-CH-UA brands, and the wire User-Agent
+     * header all on the real binary version instead of the generator's (#104).
+     * No-op when the version couldn't be probed or the profile has no UA.
      */
-    extractFingerprintData(fingerprint) {
-        const webglConfig = {};
-        const platformConfig = {};
-        let uaClientHints;
-        // Extract WebGL data from videoCard if available
-        if (fingerprint.videoCard) {
-            webglConfig.vendor = fingerprint.videoCard.vendor;
-            webglConfig.renderer = fingerprint.videoCard.renderer;
-            webglConfig.vendorUnmasked = fingerprint.videoCard.vendor;
-            webglConfig.rendererUnmasked = fingerprint.videoCard.renderer;
-        }
-        // Extract platform data if available
-        if (fingerprint.navigator) {
-            platformConfig.platform = fingerprint.navigator.platform;
-            platformConfig.vendor = fingerprint.navigator.vendor;
-            platformConfig.vendorSub = fingerprint.navigator.vendorSub;
-            platformConfig.productSub = fingerprint.navigator.productSub;
-            platformConfig.hardwareConcurrency = fingerprint.navigator.hardwareConcurrency;
-            platformConfig.maxTouchPoints = fingerprint.navigator.maxTouchPoints;
-            platformConfig.language = fingerprint.navigator.language;
-            platformConfig.languages = fingerprint.navigator.languages;
-            platformConfig.oscpu = fingerprint.navigator.oscpu;
-            platformConfig.userAgent = fingerprint.navigator.userAgent;
-            platformConfig.appVersion = fingerprint.navigator.appVersion;
-            platformConfig.appName = fingerprint.navigator.appName;
-            platformConfig.appCodeName = fingerprint.navigator.appCodeName;
-            platformConfig.product = fingerprint.navigator.product;
-            // Extract UA-CH data from generated fingerprint
-            // This ensures navigator.userAgentData brands/versions match the UA string
-            if (fingerprint.navigator.userAgentData) {
-                const uad = fingerprint.navigator.userAgentData;
-                uaClientHints = {
-                    brands: uad.brands,
-                    fullVersionList: uad.fullVersionList,
-                    mobile: uad.mobile,
-                    platform: uad.platform,
-                    architecture: uad.architecture,
-                    bitness: uad.bitness,
-                    model: uad.model,
-                    platformVersion: uad.platformVersion,
-                    uaFullVersion: uad.uaFullVersion,
-                    wow64: uad.wow64,
-                };
+    alignFingerprintUserAgent(fp, actualChromeVersion) {
+        if (!actualChromeVersion)
+            return;
+        const navigator = fp?.fingerprint?.navigator;
+        if (!navigator?.userAgent)
+            return;
+        navigator.userAgent = alignUserAgentWithBrowserVersion(navigator.userAgent, actualChromeVersion);
+        if (navigator.appVersion) {
+            navigator.appVersion = alignUserAgentWithBrowserVersion(navigator.appVersion, actualChromeVersion);
+        }
+        if (navigator.userAgentData) {
+            navigator.userAgentData = alignUAClientHintsVersion(navigator.userAgentData, actualChromeVersion);
+        }
+        // Keep the generator headers coherent too, so anything that replays them
+        // (Crawlee's hook, header injection) carries the aligned UA.
+        const headers = fp?.headers;
+        if (headers) {
+            for (const key of Object.keys(headers)) {
+                if (key.toLowerCase() === 'user-agent') {
+                    headers[key] = alignUserAgentWithBrowserVersion(headers[key], actualChromeVersion);
+                }
             }
         }
-        if (fingerprint.screen) {
-            platformConfig.devicePixelRatio = fingerprint.screen.devicePixelRatio;
-            platformConfig.screenDepth = fingerprint.screen.pixelDepth;
-            platformConfig.colorDepth = fingerprint.screen.colorDepth;
-        }
-        return { webglConfig, platformConfig, uaClientHints };
-    }
-    async getActualChromeVersion() {
-        try {
-            const versionInfo = await this.page.client.Browser.getVersion();
-            const product = versionInfo.product || '';
-            const match = product.match(/(?:Chrome|HeadlessChrome)\/(\d+\.\d+\.\d+\.\d+)/);
-            return match ? match[1] : null;
-        }
-        catch {
-            return null;
-        }
     }
-    alignUserAgentWithBrowserVersion(userAgent, browserVersion) {
-        if (!browserVersion || !userAgent) {
-            return userAgent;
-        }
-        const uaMatch = userAgent.match(/Chrome\/(\d+\.\d+\.\d+\.\d+)/);
-        if (!uaMatch) {
-            return userAgent;
-        }
-        // Chrome UA Reduction (shipped Chrome 107+) freezes minor/build/patch to 0.0.0 in the
-        // User-Agent string. The full build version lives only in UA-CH uaFullVersion.
-        // We must use major.0.0.0 here or risk producing a non-existent version string like
-        // "Chrome/147.0.7727.56" which is trivially detectable.
-        const majorVersion = browserVersion.split('.')[0];
-        const frozenVersion = `${majorVersion}.0.0.0`;
-        if (uaMatch[1] === frozenVersion) {
-            return userAgent;
+    async attachToPage(browserFingerprintWithHeaders, options) {
+        // Native-stealth fast-path: the plan is built WITHOUT any CDP probe.
+        // Issuing CDP calls here (Browser.getVersion, Emulation.* overrides,
+        // Page.enable) would introduce exactly the artifacts the C++
+        // source-tree edits are designed to hide.
+        if (isNativeStealth(options)) {
+            const plan = buildInjectionPlan({
+                browserFingerprintWithHeaders,
+                options,
+                actualChromeVersion: null,
+            });
+            await this.applyPlan(plan, browserFingerprintWithHeaders, options);
+            return;
         }
-        const alignedUA = userAgent.replace(/Chrome\/\d+\.\d+\.\d+\.\d+/, `Chrome/${frozenVersion}`);
-        log.warning('User-Agent version mismatch detected. Aligning UA with running Chrome binary.', {
-            previousVersion: uaMatch[1],
-            binaryVersion: browserVersion,
-            alignedTo: frozenVersion,
+        // Legacy timezone path still needs the ipinfo.io lookup; the resolved
+        // triple (when present) wins inside the planner.
+        const ipTimezone = needsIpTimezoneLookup(options)
+            ? await this.getTimezoneFromIp(options?.proxyUrl)
+            : undefined;
+        const actualChromeVersion = await this.getActualChromeVersion();
+        // Align the SHARED fingerprint's navigator UA fields to the real binary
+        // version, in place, before building the plan. Crawlee/BrowserPool's own
+        // FingerprintInjector runs its postPageCreate hook AFTER this injector and
+        // writes navigator.userAgent from this very fingerprint object - with the
+        // raw generator version (e.g. Chrome/144) while our wire header + this
+        // page are aligned to the real binary (e.g. Chrome/150). That leaves a
+        // navigator-vs-header (and vs Browser.getVersion) mismatch - an instant
+        // detection signal (issue #104). Aligning the shared object here makes
+        // Crawlee's later injection emit the same aligned version everywhere.
+        this.alignFingerprintUserAgent(browserFingerprintWithHeaders, actualChromeVersion);
+        const plan = buildInjectionPlan({
+            browserFingerprintWithHeaders,
+            options,
+            actualChromeVersion,
+            ipTimezone,
         });
-        return alignedUA;
+        await this.applyPlan(plan, browserFingerprintWithHeaders, options);
     }
     /**
-     * Align UA-CH brand versions with the actual running Chrome binary version.
-     * Updates "Chromium" and "Google Chrome" brand major/full versions while
-     * preserving the "Not_A Brand" GREASE token from the profile as-is.
+     * Apply an InjectionPlan to the page. All CDP traffic for fingerprint
+     * injection happens here; every decision was made in the planner.
      */
-    alignUAClientHintsVersion(uaClientHints, fullVersion) {
-        const majorVersion = fullVersion.split('.')[0];
-        const alignBrands = (brands) => brands.map(b => b.brand === 'Not_A Brand' ? b : { ...b, version: majorVersion });
-        const alignFullList = (list) => list.map(b => b.brand === 'Not_A Brand' ? b : { ...b, version: fullVersion });
-        return {
-            ...uaClientHints,
-            brands: uaClientHints.brands ? alignBrands(uaClientHints.brands) : uaClientHints.brands,
-            fullVersionList: uaClientHints.fullVersionList
-                ? alignFullList(uaClientHints.fullVersionList)
-                : uaClientHints.fullVersionList,
-            uaFullVersion: fullVersion,
-        };
-    }
-    async attachToPage(browserFingerprintWithHeaders, options) {
-        const { fingerprint, headers } = browserFingerprintWithHeaders;
-        // Locale/timezone resolution priority:
-        //   1. Resolved triple from browser-plugin (user locale → proxy country → fingerprint)
-        //   2. Legacy options.timezone / options.detectTimezone → ipinfo.io lookup
-        // Resolved values always win so fingerprintOptions.locale: 'ko-KR' coherently
-        // propagates to every locale surface.
-        const resolvedTimezone = options?.resolvedLocale?.timezone;
-        const resolvedLocale = options?.resolvedLocale?.locale;
-        const shouldFetchTimezone = !resolvedTimezone && (options?.timezone || options?.detectTimezone);
-        const timezone = resolvedTimezone
-            ?? (shouldFetchTimezone ? await this.getTimezoneFromIp(options?.proxyUrl) : undefined);
-        if (timezone) {
-            await this.setTimezoneOverride(timezone);
-        }
-        if (resolvedLocale) {
-            await this.setLocaleOverride(resolvedLocale);
-        }
-        // NOTE: Page.enable() is required for addScriptToEvaluateOnNewDocument to work
-        // We enable it lazily just before script injection to minimize detection surface
-        await this.page.ensurePageEnabled();
-        // Filter headers to only include those that can be injected via CDP
-        const filteredHeaders = {};
-        const allowedHeaders = ['accept', 'accept-encoding', 'accept-language', 'user-agent', 'referer', 'sec-ch-ua', 'sec-ch-ua-mobile', 'sec-ch-ua-platform', 'sec-ch-ua-full-version-list'];
-        for (const [key, value] of Object.entries(headers)) {
-            if (allowedHeaders.includes(key.toLowerCase()) && typeof value === 'string') {
-                filteredHeaders[key] = value;
-            }
-        }
-        // Resolved Accept-Language wins over whatever the fingerprint-generator headers had
-        // so that fingerprintOptions.locale: 'ko-KR' reaches the wire.
-        if (options?.resolvedLocale?.languages) {
-            filteredHeaders['accept-language'] = options.resolvedLocale.languages;
-            delete filteredHeaders['Accept-Language'];
-        }
-        const originalUserAgent = fingerprint?.navigator?.userAgent
-            || filteredHeaders['user-agent']
-            || filteredHeaders['User-Agent']
-            || '';
-        const actualChromeVersion = await this.getActualChromeVersion();
-        const userAgent = this.alignUserAgentWithBrowserVersion(originalUserAgent, actualChromeVersion);
-        if (userAgent) {
-            filteredHeaders['user-agent'] = userAgent;
-            delete filteredHeaders['User-Agent'];
-        }
-        // Create custom fingerprint injection scripts
-        log.info('Creating custom fingerprint injection scripts');
-        const customFingerprintScripts = createCustomFingerprintInjection(fingerprint, {
-            debug: options?.debug !== false,
-            throwOnError: true,
-        });
-        // Prepare all scripts to inject - stealth utils and runtime bypass MUST be first
-        // These scripts set up protections BEFORE page JavaScript runs
-        // Check if DataDome bypass is enabled (via either option name)
-        const isDataDomeBypassEnabled = options?.enableDataDomeBypass || options?.bypassDatadome;
-        const shouldMaskAutomation = options?.maskAutomationFlags !== false;
-        // When the C++ anti-detect browser is in use, every fingerprint surface
-        // is handled by patches in /Users/petr/cromite-src/src/third_party/blink/:
-        //   navigator (webdriver/platform/UA/UA-CH/plugins/deviceMemory/hwConc)
-        //   screen / outerWidth / devicePixelRatio
-        //   WebGL / WebGPU / canvas noise / audio noise / rect noise / measureText
-        //   timezone / language / accept-language HTTP header / battery
-        //   performance.now quantization / Runtime.enable bypass / CDP artifacts
-        //   chrome.runtime stub / inspector sourceURL
-        //
-        // CDP-side overrides (Network.setUserAgentOverride, Emulation.setDeviceMetrics,
-        // Emulation.setTimezone, addScriptToEvaluateOnNewDocument) are strictly
-        // incompatible with native stealth: they either duplicate what the C++
-        // patches already do (double-override → inconsistency) or they introduce
-        // CDP artifacts the C++ patches are specifically trying to hide.
-        // → skip the ENTIRE injection pipeline. No JS overrides, no CDP overrides,
-        // no humanization — native C++ is the single source of truth.
-        const nativeStealth = options?.useNativeStealth === true;
-        if (nativeStealth) {
-            log.info('[AntiDetect] useNativeStealth=true: skipping ALL JS + CDP overrides '
+    async applyPlan(plan, browserFingerprintWithHeaders, options) {
+        const { fingerprint } = browserFingerprintWithHeaders;
+        if (plan.kind === 'native') {
+            log.debug('[AntiDetect] useNativeStealth=true: skipping ALL JS + CDP overrides '
                 + '(viewport, UA, headers, timezone, mouse/keyboard/scroll humanization, '
                 + 'event prototype patches). C++ patches are the single source of truth: '
                 + '0040 (PointerEvent.pressure NaN→0.5), 0039 (getCoalescedEvents non-empty), '
                 + 'and the upstream Chromium ConvertWidgetPointToScreenPoint / TimeClamper '
                 + 'paths cover screenX/Y and event.timeStamp.');
-            // Exception: when the user has explicitly pinned a locale, force the
-            // Accept-Language header via CDP. Chrome's profile default is `en-US,en;q=0.9`
-            // even when `--lang=ko-KR` is set, and older native-stealth binaries that
-            // predate patch 0026-accept-language-http-header will leak that default.
-            // Setting a single HTTP header is not a fingerprintable CDP artifact — unlike
-            // Runtime.enable or inspector traces — so it's safe to enable narrowly.
-            if (options?.resolvedLocale?.languages) {
+            // Exception: Accept-Language header. Chrome's profile default is
+            // `en-US,en;q=0.9` even when `--lang=ko-KR` is set; native-stealth
+            // binaries predating the accept-language header patch leak that
+            // default. A single HTTP header is not a fingerprintable CDP
+            // artifact (unlike Runtime.enable or inspector traces).
+            if (plan.acceptLanguage) {
                 await this.page.ensureNetworkEnabled();
                 await this.page.client.Network.setExtraHTTPHeaders({
-                    headers: { 'Accept-Language': options.resolvedLocale.languages },
+                    headers: { 'Accept-Language': plan.acceptLanguage },
                 });
             }
             return;
         }
-        const scriptsToInject = [
-            createStealthUtilsScript(), // Must be first - provides guards and toString spoofing
-            createPrototypeIntegrityScript(), // Second - provides native-like property descriptor masking
-        ];
-        if (shouldMaskAutomation && !nativeStealth) {
-            // C++ patch 0005 strips CDP artifacts natively — skip JS bypass when native stealth active
-            scriptsToInject.push(createRuntimeEnableBypassScript()); // Protects against CDP detection via Error stack analysis
+        if (plan.timezone) {
+            await this.setTimezoneOverride(plan.timezone);
         }
-        // CRITICAL: DataDome bypass must be injected early for stack trace sanitization
-        // and performance.memory spoofing to work before other scripts run
-        if (isDataDomeBypassEnabled) {
-            scriptsToInject.push(createDataDomeBypassScript());
-            log.info('DataDome bypass enabled - injected early in script chain');
-        }
-        // Add custom fingerprint scripts
-        scriptsToInject.push(...customFingerprintScripts);
-        // Bundle stealth protections into the main script instead of separate injection
-        // Having multiple addScriptToEvaluateOnNewDocument calls is a detection vector
-        if (shouldMaskAutomation) {
-            scriptsToInject.push(createStealthScript());
-        }
-        // Extract fingerprint data if we should use it
-        // When useFingerprintDefaults is true (or undefined), use hardcoded defaults
-        // When useFingerprintDefaults is false, use the generated fingerprint data
-        const shouldUseFingerprintData = options?.useFingerprintDefaults === false;
-        const { webglConfig, platformConfig, uaClientHints: rawUaClientHints } = shouldUseFingerprintData
-            ? this.extractFingerprintData(fingerprint)
-            : { webglConfig: undefined, platformConfig: undefined, uaClientHints: undefined };
-        // Align UA-CH brand/full-version fields with the actual running binary so the
-        // fingerprint profile version (132-135) doesn't contradict the real binary (147+).
-        const uaClientHints = rawUaClientHints && actualChromeVersion
-            ? this.alignUAClientHintsVersion(rawUaClientHints, actualChromeVersion)
-            : rawUaClientHints;
-        // Add advanced features based on options
-        if (options?.enableAdvancedStealth !== false) {
-            // UA Client Hints spoofing — skipped when C++ patch 0003 handles it natively
-            if (!nativeStealth) {
-                scriptsToInject.push(createUAClientHintsSpoofingScript(options?.platform, shouldUseFingerprintData ? uaClientHints : undefined));
-            }
-            // WebGL spoofing — skipped when C++ patch 0004 handles it natively
-            if (!nativeStealth && options?.spoofWebGL !== false) {
-                scriptsToInject.push(createWebGLSpoofingScript(shouldUseFingerprintData ? webglConfig : undefined));
-            }
-            // Audio fingerprint spoofing — skipped when C++ patch 0010 handles it natively
-            if (!nativeStealth && options?.spoofAudioContext !== false) {
-                scriptsToInject.push(createAudioFingerprintSpoofingScript());
-            }
-            // Canvas protection — skipped when C++ patch 0009 handles it natively
-            if (!nativeStealth) {
-                scriptsToInject.push(createAdvancedCanvasProtectionScript());
-            }
-            // Client rect spoofing — skipped when C++ patch 0011 handles it natively
-            if (!nativeStealth && options?.spoofClientRects !== false) {
-                scriptsToInject.push(createClientRectSpoofingScript());
-            }
-            // (Coalesced PointerEvents are now handled in C++ — see Cromite anti-detect
-            // edit in third_party/blink/renderer/core/events/pointer_event.cc::getCoalescedEvents.
-            // The previous JS spoof in coalesced-events-spoofing.ts has been removed because
-            // a prototype getter on PointerEvent.prototype is detectable; the C++ fix is invisible.)
-            // Media codec spoofing — always keep (canPlayType behavioral)
-            scriptsToInject.push(createMediaCodecsSpoofingScript());
-            // WebRTC handling policy — always keep (fake device IDs; C++ handles IP only)
-            if (options?.webRtcPolicy === 'disable') {
-                scriptsToInject.push(createWebRTCDisableScript());
-            }
-            else {
-                scriptsToInject.push(createWebRTCSpoofingScript());
-            }
-            // WebGPU spoofing — skipped when C++ patch 0012 handles it natively
-            if (!nativeStealth) {
-                scriptsToInject.push(createWebGPUSpoofingScript(options?.useExperimentalFingerprints));
-            }
-            // Font spoofing — skipped when Cromite built-in allowlist handles it
-            if (!nativeStealth && options?.spoofFonts !== false) {
-                scriptsToInject.push(createFontSpoofingScript());
-            }
-            // Performance spoofing — skipped when Cromite built-in perf.now clamping handles it
-            if (!nativeStealth && options?.spoofPerformance !== false) {
-                scriptsToInject.push(createPerformanceSpoofingScript());
-            }
-            // Locale spoofing — always keep (Intl.NumberFormat formatting part not in C++).
-            // Bake the resolved locale/languages in as literals so the script reports values
-            // that match the navigator/header overrides instead of hardcoded en-US.
-            if (options?.spoofLocale !== false) {
-                scriptsToInject.push(createLocaleSpoofingScript({
-                    locale: options?.resolvedLocale?.locale ?? 'en-US',
-                    languages: options?.resolvedLocale?.languages ?? 'en-US,en;q=0.9',
-                }));
-            }
-            // CDP Detection Bypass — skipped when C++ patches 0001+0005 handle it natively
-            if (!nativeStealth && options?.bypassCDPDetection !== false) {
-                scriptsToInject.push(createCDPDetectionBypassScript());
-            }
-            // Storage consistency — always keep (CDP-level quota spoofing)
-            if (options?.spoofStorage !== false) {
-                scriptsToInject.push(createStorageConsistencyScript());
-            }
-            // Timing consistency — always keep (Date.now alignment; C++ handles perf.now)
-            if (options?.spoofTiming !== false) {
-                scriptsToInject.push(createTimingConsistencyScript());
-            }
-            // DataDome-specific bypass - already injected early if enabled
-            // (see isDataDomeBypassEnabled check at the beginning of scriptsToInject)
-            // Mouse movement humanization (browser context) - disabled by default
-            // Bundled here so the bezier-curve utility counts as part of the single
-            // addScriptToEvaluateOnNewDocument call (multiple calls are detectable).
-            if (options?.humanization?.mouse || options?.humanizeInteractions) {
-                scriptsToInject.push(createMouseMovementHumanizationScript());
-            }
-            // Keyboard humanization (browser context) - disabled by default
-            if (options?.humanization?.keyboard) {
-                scriptsToInject.push(createKeyboardHumanizationScript());
-            }
-            // Scroll humanization (browser context) - disabled by default
-            if (options?.humanization?.scroll) {
-                scriptsToInject.push(createScrollHumanizationScript());
-            }
-        }
-        // Apply platform consistency script — skipped when C++ patches 0002+0006 handle it natively
-        if (!nativeStealth && options?.platform) {
-            // Build the config to pass: when using real fingerprint data, align its UA with
-            // the actual binary version; when using hardcoded defaults, inject a minimal
-            // version-aligned UA so we don't bake in the static Chrome/134.0.0.0 fallback.
-            let platformConfigForScript = shouldUseFingerprintData ? platformConfig : undefined;
-            if (platformConfigForScript?.userAgent && actualChromeVersion) {
-                // Align dynamic fingerprint UA with the actual running binary version.
-                platformConfigForScript = {
-                    ...platformConfigForScript,
-                    userAgent: this.alignUserAgentWithBrowserVersion(platformConfigForScript.userAgent, actualChromeVersion),
-                    appVersion: platformConfigForScript.appVersion
-                        ? this.alignUserAgentWithBrowserVersion(platformConfigForScript.appVersion, actualChromeVersion)
-                        : platformConfigForScript.appVersion,
-                };
-            }
-            else if (!platformConfigForScript && actualChromeVersion && options.platform === 'Win32') {
-                // useFingerprintDefaults=true path: override only the UA/appVersion fields so the
-                // hardcoded Win32 defaults pick up the real Chrome version instead of Chrome/134.
-                const alignedUA = `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${actualChromeVersion} Safari/537.36`;
-                platformConfigForScript = {
-                    userAgent: alignedUA,
-                    appVersion: `5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${actualChromeVersion} Safari/537.36`,
-                };
-            }
-            scriptsToInject.push(createPlatformConsistencyScript(options.platform, platformConfigForScript));
-        }
-        // CRITICAL: Clean scripts to remove CDP detection patterns
-        const isDebug = options?.debug === true;
-        const cleanScript = (script) => {
-            let cleaned = script
-                // Remove sourceURL patterns that reveal CDP injection
-                .replace(/\/\/# sourceURL=[^\n]*/g, '')
-                .replace(/\/\/@ sourceURL=[^\n]*/g, '')
-                // Remove sourceMappingURL patterns
-                .replace(/\/\/# sourceMappingURL=[^\n]*/g, '')
-                // Remove puppeteer/playwright markers
-                .replace(/__puppeteer_evaluation_script__/g, 'anonymous')
-                .replace(/__playwright_evaluation_script__/g, 'anonymous')
-                // Remove CDP-specific comments
-                .replace(/\/\*\s*__CDP_[A-Z_]+__\s*\*\//g, '');
-            // CRITICAL: Strip ALL console output from injected scripts in production.
-            // Anti-bot services hook console.log and detect debug prefixes like
-            // [CDP-FP-DEBUG], [DD-BYPASS], [RUNTIME-ENABLE-BYPASS], etc.
-            if (!isDebug) {
-                cleaned = cleaned
-                    .replace(/^\s*console\.(log|warn|info|debug)\s*\([^;]*\);?\s*$/gm, '')
-                    .replace(/^\s*const\s+(DEBUG_PREFIX|ERROR_PREFIX)\s*=\s*[^;]*;\s*$/gm, '');
-            }
-            return cleaned;
-        };
-        // Add debug scripts into the bundle only when explicitly enabled
-        if (isDebug) {
-            scriptsToInject.push(this.createDebugScript(options || {}));
-        }
-        // BUNDLE ALL SCRIPTS INTO ONE to minimize CDP interactions
-        log.info(`Bundling ${scriptsToInject.length} fingerprint scripts into single injection`);
-        // Extract proxy seed key for deterministic fingerprint seeding.
-        // Priority: session ID from Apify proxy URL > full proxy URL > null.
-        // Apify proxy URLs look like: http://groups-RESIDENTIAL,session-abc123:pw@proxy.apify.com:8000
-        let proxySeedKey = null;
-        if (options?.proxyUrl) {
-            try {
-                const proxyUsername = new URL(options.proxyUrl).username;
-                const sessionMatch = proxyUsername.match(/session-([^,&]+)/i);
-                proxySeedKey = sessionMatch ? sessionMatch[1] : options.proxyUrl;
-            }
-            catch {
-                proxySeedKey = options.proxyUrl;
-            }
-        }
-        // Preamble: create shared stealth store accessible by all module IIFEs via closure.
-        // seedKey: proxy session ID or proxy URL - used by _stableHash for deterministic fingerprints.
-        const preamble = `var __stealth = { debug: ${isDebug}, seedKey: ${proxySeedKey ? JSON.stringify(proxySeedKey) : 'null'} };`;
-        // Neutralize the CDP-injection stack-frame tell. V8 renders scripts
-        // registered via Page.addScriptToEvaluateOnNewDocument that carry no
-        // sourceURL as "<anonymous>" in Error.stack — a well-known detection
-        // vector (DataDome, CreepJS, fpscanner all check for it). Appending
-        // `//# sourceURL=about:blank` makes V8 render stack frames as if the
-        // script loaded from about:blank, which is indistinguishable from
-        // a normal bootstrap script on a fresh page.
-        //
-        // Note: the cleanScript pass above strips *existing* sourceURL comments
-        // in the per-module scripts (to avoid the comment naming a file path
-        // that reveals our repo layout). We then stamp exactly one sourceURL
-        // on the outer bundle so the final script V8 sees has a clean name.
-        const bundledScript = `${preamble}\n\n${scriptsToInject
-            .map(script => cleanScript(script))
-            .join('\n\n')}\n//# sourceURL=about:blank\n`;
-        // Validate bundled script for syntax errors
-        try {
-            // eslint-disable-next-line no-new-func, no-new
-            new Function(bundledScript);
-            log.info('✓ Bundled script passed syntax validation');
-        }
-        catch (error) {
-            log.error('✗ Bundled script has syntax error:', { error });
-            // Fall back to individual script validation to find the culprit
-            scriptsToInject.forEach((script, index) => {
-                try {
-                    // eslint-disable-next-line no-new-func, no-new
-                    new Function(script);
-                }
-                catch (e) {
-                    const scriptPreview = script.substring(0, 300);
-                    log.error(`✗ Error in script ${index + 1}:`, { error: e, scriptPreview });
-                }
-            });
-            throw new Error(`Bundled script has syntax error: ${error}`);
+        if (plan.locale) {
+            await this.setLocaleOverride(plan.locale);
         }
+        // NOTE: Page.enable() is required for addScriptToEvaluateOnNewDocument to work
+        // We enable it lazily just before script injection to minimize detection surface
+        await this.page.ensurePageEnabled();
         // Inject SINGLE bundled script - reduces CDP detection surface
         try {
-            log.info('Injecting single bundled fingerprint script (minimizes CDP detection)');
+            log.debug('Injecting single bundled fingerprint script (minimizes CDP detection)');
             await Promise.all([
-                this.setViewport(options?.viewport, fingerprint),
-                this.setExtraHTTPHeaders(filteredHeaders),
+                this.setViewport(plan.viewport, fingerprint),
+                this.setExtraHTTPHeaders(plan.headers),
                 // Set User-Agent with full client hints metadata (Sec-CH-UA-* HTTP headers)
-                userAgent ? this.setUserAgentWithMetadata(userAgent, options?.platform || 'Win32', shouldUseFingerprintData ? uaClientHints : undefined) : Promise.resolve(),
+                plan.userAgent ? this.setUserAgentWithMetadata(plan.userAgent, plan.platform, plan.uaClientHints, plan.binaryFullVersion) : Promise.resolve(),
                 // Single script injection instead of many - reduces CDP detection surface
                 (async () => {
                     try {
                         await this.page.client.Page.addScriptToEvaluateOnNewDocument({
-                            source: bundledScript,
+                            source: plan.bundledScript,
                         });
-                        log.info('✓ Bundled script injected successfully');
+                        log.debug('✓ Bundled script injected successfully');
                     }
                     catch (error) {
-                        const scriptPreview = bundledScript.substring(0, 200).split('\n')[0];
+                        const scriptPreview = plan.bundledScript.substring(0, 200).split('\n')[0];
                         log.error('✗ Failed to inject bundled script:', {
                             error,
                             scriptPreview,
@@ -871,24 +570,19 @@ export class CdpFingerprintInjector {
                     }
                 })(),
             ]);
-            log.info('✓ Fingerprint injection complete (single bundled script)');
+            log.debug('✓ Fingerprint injection complete (single bundled script)');
         }
         catch (error) {
             log.error('✗ Failed to inject fingerprint scripts:', { error });
             throw error; // Rethrow to make injection failures visible
         }
-        // NOTE: Mouse/keyboard/scroll humanization browser-context scripts are now
+        // NOTE: Mouse/keyboard/scroll humanization browser-context scripts are
         // bundled into the single addScriptToEvaluateOnNewDocument call above.
         // Multiple addScriptToEvaluateOnNewDocument registrations are themselves
-        // a bot-detection signal — keep the count at 1.
-        // NOTE: setupRuntimeEnableBypass REMOVED - it uses Runtime.evaluate which is itself a detection vector!
-        // The bypass script is now included in the bundled stealth scripts injected via addScriptToEvaluateOnNewDocument
-        // This runs BEFORE page JavaScript, avoiding Runtime domain activation
-        const enableMouseHumanization = options?.humanization?.mouse || options?.humanizeInteractions;
-        // Debug and viewport debug scripts are now bundled into the main injection above
-        log.info('Enhanced fingerprint attached with settings:', {
+        // a bot-detection signal - keep the count at 1.
+        log.debug('Enhanced fingerprint attached with settings:', {
             proxy: options?.proxyUrl,
-            timezone,
+            timezone: plan.timezone,
             advancedStealth: options?.enableAdvancedStealth !== false,
             bypassRuntimeEnable: options?.bypassRuntimeEnable,
             platform: options?.platform,
@@ -900,7 +594,7 @@ export class CdpFingerprintInjector {
             enableDataDomeBypass: options?.enableDataDomeBypass,
             webRtcPolicy: options?.webRtcPolicy || 'spoof',
             humanization: {
-                mouse: enableMouseHumanization || false,
+                mouse: Boolean(options?.humanization?.mouse || options?.humanizeInteractions),
                 keyboard: options?.humanization?.keyboard || false,
                 scroll: options?.humanization?.scroll || false,
             },