@apifuse/provider-sdk 2.2.0-beta.61 → 2.2.0-beta.63

package/dist/runtime/stealth-telemetry.js

@@ -0,0 +1,179 @@
+import { Buffer } from "node:buffer";
+import { closedEnum } from "./request-telemetry.js";
+const MAX_ATTEMPT_SAMPLES = 24;
+const MAX_DIAGNOSTIC_TEXT = 300;
+function boundedInteger(value) {
+    if (!Number.isFinite(value))
+        return Number.MAX_SAFE_INTEGER;
+    return Math.min(Number.MAX_SAFE_INTEGER, Math.max(0, Math.floor(value)));
+}
+function saturatingAdd(a, b) {
+    if (!Number.isFinite(a) || !Number.isFinite(b))
+        return Number.MAX_SAFE_INTEGER;
+    return Math.min(Number.MAX_SAFE_INTEGER, boundedInteger(a) + boundedInteger(b));
+}
+function boundedText(value, redact) {
+    let result = value;
+    try {
+        result = redact?.(value) ?? value;
+    }
+    catch {
+        result = "[REDACTION_FAILED]";
+    }
+    const length = Math.min(result.length, MAX_DIAGNOSTIC_TEXT);
+    const units = Buffer.alloc(length * 2);
+    for (let index = 0; index < length; index += 1) {
+        units.writeUInt16LE(result.charCodeAt(index), index * 2);
+    }
+    return units.toString("utf16le");
+}
+function cloneDiagnostics(diagnostics, redact) {
+    if (!diagnostics)
+        return undefined;
+    const result = {
+        ...(diagnostics.name === undefined ? {} : { name: boundedText(diagnostics.name, redact) }),
+        ...(diagnostics.message === undefined
+            ? {}
+            : { message: boundedText(diagnostics.message, redact) }),
+        ...(diagnostics.code === undefined ? {} : { code: boundedText(diagnostics.code, redact) }),
+    };
+    return Object.keys(result).length > 0 ? result : undefined;
+}
+function cloneProfile(profile) {
+    return { browser: profile.browser, os: profile.os };
+}
+export class StealthTelemetryCollector {
+    key = "stealth";
+    #redact;
+    #attempts = 0;
+    #poolRefreshes = 0;
+    #redirectHops = 0;
+    #profileId;
+    #proxyUsed = false;
+    #requestClass;
+    #sbsdDetected;
+    #sbsdOutcome;
+    #safeRefetch = 0;
+    #lastStatus;
+    #ms = 0;
+    #attemptSamples = [];
+    #attemptSamplesDropped = 0;
+    constructor(options = {}) {
+        this.#redact = options.redact;
+    }
+    recordAttempt(event) {
+        const ms = boundedInteger(event.ms);
+        this.#attempts = saturatingAdd(this.#attempts, 1);
+        this.#ms = saturatingAdd(this.#ms, ms);
+        this.#profileId = cloneProfile(event.profileId);
+        this.#proxyUsed ||= event.proxyUsed;
+        this.#requestClass = event.requestClass;
+        if (event.status !== undefined)
+            this.#lastStatus = boundedInteger(event.status);
+        if (this.#attemptSamples.length >= MAX_ATTEMPT_SAMPLES) {
+            this.#attemptSamplesDropped = saturatingAdd(this.#attemptSamplesDropped, 1);
+            return;
+        }
+        const sample = {
+            n: this.#attempts,
+            ms,
+            ...(event.status === undefined ? {} : { status: boundedInteger(event.status) }),
+            ...(event.errorCode === undefined ? {} : { e: event.errorCode }),
+            ...(event.kind === undefined ? {} : { kind: event.kind }),
+            ...(event.diagnostics
+                ? { diagnostics: cloneDiagnostics(event.diagnostics, this.#redact) }
+                : {}),
+        };
+        if (sample.diagnostics === undefined)
+            delete sample.diagnostics;
+        this.#attemptSamples.push(sample);
+    }
+    recordPoolRefresh() {
+        this.#poolRefreshes = saturatingAdd(this.#poolRefreshes, 1);
+    }
+    recordRedirectHop() {
+        this.#redirectHops = saturatingAdd(this.#redirectHops, 1);
+    }
+    recordSbsd(event) {
+        if (typeof event === "string") {
+            this.#sbsdDetected = true;
+            this.#sbsdOutcome = event;
+            return;
+        }
+        if (!event)
+            return;
+        this.#sbsdDetected = (this.#sbsdDetected ?? false) || event.detected;
+        if (event.outcome !== undefined)
+            this.#sbsdOutcome = event.outcome;
+    }
+    recordSafeRefetch() {
+        this.#safeRefetch = saturatingAdd(this.#safeRefetch, 1);
+    }
+    toLogPayload() {
+        if (this.#attempts === 0 &&
+            this.#poolRefreshes === 0 &&
+            this.#redirectHops === 0 &&
+            this.#safeRefetch === 0 &&
+            this.#sbsdDetected === undefined) {
+            return undefined;
+        }
+        return {
+            attempts: this.#attempts,
+            poolRefreshes: this.#poolRefreshes,
+            redirectHops: this.#redirectHops,
+            ...(this.#profileId ? { profileId: cloneProfile(this.#profileId) } : {}),
+            proxyUsed: this.#proxyUsed,
+            ...(this.#requestClass ? { requestClass: this.#requestClass } : {}),
+            ...(this.#sbsdDetected === undefined ? {} : { sbsdDetected: this.#sbsdDetected }),
+            ...(this.#sbsdOutcome ? { sbsdOutcome: this.#sbsdOutcome } : {}),
+            safeRefetch: this.#safeRefetch,
+            ...(this.#lastStatus === undefined ? {} : { lastStatus: this.#lastStatus }),
+            ms: this.#ms,
+            ...(this.#attemptSamples.length > 0
+                ? {
+                    attemptSamples: this.#attemptSamples.map((sample) => ({
+                        ...sample,
+                        ...(sample.diagnostics
+                            ? {
+                                diagnostics: { ...sample.diagnostics },
+                            }
+                            : {}),
+                    })),
+                }
+                : {}),
+            ...(this.#attemptSamplesDropped > 0
+                ? { attemptSamplesDropped: this.#attemptSamplesDropped }
+                : {}),
+        };
+    }
+    toHeaderPayload(log) {
+        const attemptSamples = log.attemptSamples?.map((sample) => ({
+            n: sample.n,
+            ms: sample.ms,
+            ...(sample.status === undefined ? {} : { status: sample.status }),
+            ...(sample.e ? { e: closedEnum(sample.e) } : {}),
+            ...(sample.kind ? { kind: closedEnum(sample.kind) } : {}),
+        }));
+        return {
+            attempts: log.attempts,
+            poolRefreshes: log.poolRefreshes,
+            redirectHops: log.redirectHops,
+            ...(log.profileId
+                ? {
+                    profileId: {
+                        browser: closedEnum(log.profileId.browser),
+                        os: closedEnum(log.profileId.os),
+                    },
+                }
+                : {}),
+            proxyUsed: log.proxyUsed,
+            ...(log.requestClass ? { requestClass: closedEnum(log.requestClass) } : {}),
+            ...(log.sbsdDetected === undefined ? {} : { sbsdDetected: log.sbsdDetected }),
+            ...(log.sbsdOutcome ? { sbsdOutcome: closedEnum(log.sbsdOutcome) } : {}),
+            safeRefetch: log.safeRefetch,
+            ...(log.lastStatus === undefined ? {} : { lastStatus: log.lastStatus }),
+            ms: log.ms,
+            ...(attemptSamples && attemptSamples.length > 0 ? { attemptSamples } : {}),
+        };
+    }
+}

package/dist/runtime/stealth.d.ts

@@ -1,8 +1,12 @@
 import type { BrowserProfile, EmulationOS } from "wreq-js";
 import type { ProxyResolutionOptions } from "../config/loader.js";
 import type { StealthClient, StealthProfileDescriptor, StealthProfileSelection, StealthResponse } from "../types.js";
+export type { StealthTelemetryAttemptEvent, StealthTelemetryAttemptKind, StealthTelemetryDiagnostics, StealthTelemetryErrorCode, StealthTelemetryRequestClass, StealthTelemetrySbsdEvent, StealthTelemetrySbsdOutcome, StealthTelemetrySink, } from "./stealth-telemetry.js";
+import type { StealthTelemetrySink } from "./stealth-telemetry.js";
 export declare const DEFAULT_STEALTH_PROFILE: StealthProfileDescriptor;
 export type StealthClientOptions = ProxyResolutionOptions & {
+    /** Request-scoped stealth transport observations. */
+    stealthTelemetry?: StealthTelemetrySink;
     warn?: (message: string) => void;
     /** Abort all requests issued by this client. */
     signal?: AbortSignal;
@@ -54,4 +58,3 @@ export declare function resolveWreqProfile(selection: StealthProfileSelection, w
 };
 export declare function normalizeResponse(response: StealthTransportResponse, requestUrl?: string, maxBodyBytes?: number): Promise<StealthResponse>;
 export declare function createStealthClient(baseUrl: string, clientOptions?: StealthClientOptions): StealthClient;
-export {};

package/dist/runtime/stealth.js

@@ -4,6 +4,8 @@ import { DEFAULT_SMARTPROXY_POOL_SIZE, invalidateProxyResolutionCacheAsync, Prox
 import { SDKError, TransportError } from "../errors.js";
 import { DEFAULT_STEALTH_BROWSER, DEFAULT_STEALTH_OS, getStealthProfile, resolverClientProfileFamily, resolveStealthProfileSelection, } from "../stealth/profiles.js";
 import { chrome149HeaderOrder } from "./chrome149-header-order.js";
+import { registerDiagnosticValue } from "./diagnostic-env.js";
+import { isStealthOwnedHeaderName } from "./stealth-owned-headers.js";
 import { ENGINE_CEREMONY_EGRESS_LEASE, } from "./egress-lease.js";
 import { createProxyAuthIpDeniedError, createProxyEdgeAuthRejectedError, createProxyEdgeTlsRejectedError, createProxyPoolExhaustedError, createProxyPoolStaleError, isProxyAuthIpDeniedMessage, isProxyEdgeAuthRejectedMessage, isProxyEdgeTlsRejectedResponse, isProxyPoolRefreshableError, isProxyPoolStaleMessage, isProxyPoolStaleStatus, PROXY_EDGE_AUTH_REJECTED_CODE, PROXY_POOL_STALE_CODE, } from "./proxy-errors.js";
 import { computeProxyAttemptIndex, computeProxyTransportRetryDelayMs, createDefaultProxyTransportRetryOptions, isProxyTransportRetryMethod, normalizeProxyTransportRetryOptions, shouldRetryProxyTransportAttempt, validateUnsafeProxyTransportRetryMethods, } from "./proxy-retry-policy.js";
@@ -171,15 +173,6 @@ function normalizedHeaderEntries(headers) {
     }
     return entries;
 }
-const SDK_OWNED_EXACT_CHROME_HEADERS = new Set([
-    "host",
-    "connection",
-    "user-agent",
-    "sec-ch-ua",
-    "sec-ch-ua-mobile",
-    "sec-ch-ua-platform",
-    "accept-encoding",
-]);
 // Non-pseudo-header order of real Chrome 149. The fixture captures
 // (chrome-ground-truth-capture.json, chrome-extended-capture.json,
 // h1-casing-capture.json) were taken through Playwright's `locale` option, which
@@ -344,7 +337,7 @@ function normalizedCallerHeaderEntriesFromRecord(headers) {
 }
 function assertCallerHeadersSupported(entries) {
     for (const [name] of entries) {
-        if (SDK_OWNED_EXACT_CHROME_HEADERS.has(name) || name.startsWith("sec-fetch-")) {
+        if (isStealthOwnedHeaderName(name)) {
             throw new SDKError(`Stealth transport owns the "${name}" header; remove it from headers.`, {
                 code: "STEALTH_HEADER_OVERRIDE_UNSUPPORTED",
             });
@@ -895,7 +888,99 @@ function discardStealthRedirectBody(response) {
         // failure must not replace or delay that decision.
     }
 }
-async function fetchStealthRedirectChain(transport, cookieJar, requestUrl, method, options, signal, buildHeaders) {
+/** Telemetry must never replace a transport result, including with caller-provided sinks. */
+function emitStealthTelemetry(sink, record) {
+    if (!sink)
+        return;
+    try {
+        record(sink);
+    }
+    catch {
+        /* The request owns its result. */
+    }
+}
+function stripStealthCookieMaterial(text, cookieNames) {
+    // Header-shaped Cookie/Set-Cookie material is redacted wholesale, including
+    // foreign names. Bare pairs outside a header are limited to jar-known names:
+    // a foreign bare name is indistinguishable from benign key=value prose and is
+    // therefore covered only when layer 1 registered its value.
+    let result = text.replace(/(^|[^\p{L}\p{N}_-])[\t ]*(?:cookie|set-cookie)[\t ]*(?::|=)[^\r\n]*/giu, "$1[REDACTED]");
+    result = result.replace(/"(?:cookie|set-cookie)"[\t ]*:[\t ]*"(?:\\.|[^"\\])*"/giu, "[REDACTED]");
+    for (const name of cookieNames) {
+        const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        result = result.replace(new RegExp(`(^|[;,&?\\s])${escaped}\\s*=\\s*[^;,\\s&\\r\\n]+`, "giu"), "$1[REDACTED]");
+    }
+    return result;
+}
+function startStealthExchange(telemetry, method, options, signal) {
+    if (!telemetry)
+        return () => { };
+    const startedAt = Date.now();
+    const requestClass = chromeRequestClass(method, options.stealth?.requestClass);
+    let recorded = false;
+    return (status, error) => {
+        if (recorded)
+            return;
+        recorded = true;
+        emitStealthTelemetry(telemetry?.sink, (sink) => {
+            let code;
+            if (error !== undefined) {
+                try {
+                    code = signal?.aborted
+                        ? "transport_cancelled"
+                        : normalizeStealthTransportError(error).code;
+                }
+                catch {
+                    code = "other";
+                }
+            }
+            const knownCodes = [
+                "transport_network_error",
+                "transport_timeout",
+                "transport_cancelled",
+                "upstream_http_error",
+                "response_too_large",
+                "proxy_connect_failed",
+                "PROXY_POOL_STALE",
+                "PROXY_EDGE_AUTH_REJECTED",
+                "PROXY_AUTH_IP_DENIED",
+                "PROXY_EDGE_TLS_REJECTED",
+                "PROXY_REQUIRED",
+            ];
+            const errorCode = code
+                ? knownCodes.includes(code)
+                    ? code
+                    : "other"
+                : status !== undefined && status >= 400
+                    ? "upstream_http_error"
+                    : undefined;
+            const strip = (text) => stripStealthCookieMaterial(text, telemetry.cookieJar?.names() ?? []);
+            sink.recordAttempt({
+                ms: Date.now() - startedAt,
+                profileId: telemetry.profileId,
+                proxyUsed: telemetry.proxyUsed,
+                kind: telemetry.kind,
+                requestClass: requestClass === "navigation" && options.stealth?.userActivation === false
+                    ? "script_navigation"
+                    : requestClass,
+                ...(status === undefined ? {} : { status }),
+                ...(errorCode ? { errorCode } : {}),
+                ...(error === undefined
+                    ? {}
+                    : {
+                        diagnostics: {
+                            name: strip(error instanceof Error ? error.name : "Error"),
+                            message: strip(error instanceof Error ? error.message : String(error)),
+                            ...(error instanceof Error && "code" in error && typeof error.code === "string"
+                                ? { code: strip(error.code) }
+                                : {}),
+                        },
+                    }),
+            });
+        });
+    };
+}
+async function fetchStealthRedirectChain(transport, cookieJar, requestUrl, method, options, signal, buildHeaders, telemetry) {
     let currentUrl = requestUrl;
     let currentMethod = method;
     let currentBody = options.body === undefined ? undefined : normalizeBody(options.body);
@@ -903,80 +988,98 @@ async function fetchStealthRedirectChain(transport, cookieJar, requestUrl, metho
     let followedHops = 0;
     let response;
     const deadline = options.timeout ? performance.now() + options.timeout : undefined;
-    while (true) {
-        throwIfAmbientAborted(signal);
-        const headers = { ...currentHeaders };
-        if (!hasHeader(headers, "cookie")) {
-            const cookieHeader = cookieJar.toHeader(currentUrl);
-            if (cookieHeader)
-                headers.cookie = cookieHeader;
-        }
-        const requestInit = {
-            headers: buildHeaders
-                ? buildHeaders(currentUrl, currentMethod, currentBody, headers)
-                : headers,
-            method: currentMethod,
-            redirect: "manual",
-            ...(new URL(currentUrl).protocol === "http:" ? { disableDefaultHeaders: true } : {}),
-            ...(signal ? { signal } : {}),
-        };
-        if (currentBody !== undefined)
-            requestInit.body = currentBody;
-        await transport.clearCookies();
-        throwIfAmbientAborted(signal);
-        const remainingTimeout = deadline === undefined ? undefined : Math.ceil(deadline - performance.now());
-        if (remainingTimeout !== undefined && remainingTimeout <= 0) {
-            throw new TransportError("Request timed out", {
-                code: "transport_timeout",
-                status: 0,
-            });
-        }
-        if (remainingTimeout !== undefined)
-            requestInit.timeout = remainingTimeout;
-        response = await transport.fetch(currentUrl, requestInit);
-        if (signal?.aborted) {
-            discardStealthRedirectBody(response);
-            throw toAmbientCancellationError(signal);
-        }
-        cookieJar.setFromCookieStrings(setCookieHeadersFromResponse(response.headers), response.url ?? currentUrl);
-        if (!isRedirectStatus(response.status) || options.redirect === "manual")
-            break;
-        if (options.redirect === "error") {
-            discardStealthRedirectBody(response);
-            throw new TransportError("Stealth request encountered a redirect", {
-                code: "transport_network_error",
-                status: 0,
-            });
-        }
-        const nextUrl = resolveRedirectUrl(response.headers.get("location") ?? undefined, response.url ?? currentUrl);
-        if (!nextUrl)
-            break;
-        if (followedHops >= MAX_STEALTH_REDIRECT_HOPS) {
+    let finishExchange;
+    let status;
+    let exchangeError;
+    try {
+        while (true) {
+            throwIfAmbientAborted(signal);
+            const headers = { ...currentHeaders };
+            if (!hasHeader(headers, "cookie")) {
+                const cookieHeader = cookieJar.toHeader(currentUrl);
+                if (cookieHeader)
+                    headers.cookie = cookieHeader;
+            }
+            const requestInit = {
+                headers: buildHeaders
+                    ? buildHeaders(currentUrl, currentMethod, currentBody, headers)
+                    : headers,
+                method: currentMethod,
+                redirect: "manual",
+                ...(new URL(currentUrl).protocol === "http:" ? { disableDefaultHeaders: true } : {}),
+                ...(signal ? { signal } : {}),
+            };
+            if (currentBody !== undefined)
+                requestInit.body = currentBody;
+            await transport.clearCookies();
+            throwIfAmbientAborted(signal);
+            const remainingTimeout = deadline === undefined ? undefined : Math.ceil(deadline - performance.now());
+            if (remainingTimeout !== undefined && remainingTimeout <= 0) {
+                throw new TransportError("Request timed out", {
+                    code: "transport_timeout",
+                    status: 0,
+                });
+            }
+            if (remainingTimeout !== undefined)
+                requestInit.timeout = remainingTimeout;
+            status = undefined;
+            finishExchange = startStealthExchange(telemetry, currentMethod, options, signal);
+            response = await transport.fetch(currentUrl, requestInit);
+            status = response.status;
+            if (signal?.aborted) {
+                discardStealthRedirectBody(response);
+                throw toAmbientCancellationError(signal);
+            }
+            cookieJar.setFromCookieStrings(setCookieHeadersFromResponse(response.headers), response.url ?? currentUrl);
+            if (!isRedirectStatus(response.status) || options.redirect === "manual")
+                break;
+            if (options.redirect === "error") {
+                discardStealthRedirectBody(response);
+                throw new TransportError("Stealth request encountered a redirect", {
+                    code: "transport_network_error",
+                    status: 0,
+                });
+            }
+            const nextUrl = resolveRedirectUrl(response.headers.get("location") ?? undefined, response.url ?? currentUrl);
+            if (!nextUrl)
+                break;
+            if (followedHops >= MAX_STEALTH_REDIRECT_HOPS) {
+                discardStealthRedirectBody(response);
+                throw new TransportError(`Stealth request exceeded the ${MAX_STEALTH_REDIRECT_HOPS}-redirect limit`, { code: "transport_network_error", status: 0 });
+            }
+            assertStealthRedirectUrl(nextUrl);
             discardStealthRedirectBody(response);
-            throw new TransportError(`Stealth request exceeded the ${MAX_STEALTH_REDIRECT_HOPS}-redirect limit`, { code: "transport_network_error", status: 0 });
-        }
-        assertStealthRedirectUrl(nextUrl);
-        discardStealthRedirectBody(response);
-        const nextMethod = nextRedirectMethod(response.status, currentMethod);
-        if (nextMethod !== currentMethod) {
-            currentBody = undefined;
-            currentHeaders = withoutRedirectBodyHeaders(currentHeaders);
+            const nextMethod = nextRedirectMethod(response.status, currentMethod);
+            if (nextMethod !== currentMethod) {
+                currentBody = undefined;
+                currentHeaders = withoutRedirectBodyHeaders(currentHeaders);
+            }
+            currentMethod = nextMethod;
+            currentUrl = nextUrl;
+            followedHops += 1;
+            emitStealthTelemetry(telemetry?.sink, (sink) => sink.recordRedirectHop());
+            finishExchange(status);
+            finishExchange = undefined;
         }
-        currentMethod = nextMethod;
-        currentUrl = nextUrl;
-        followedHops += 1;
+        const normalized = await normalizeResponseWithSignal(response, currentUrl, options.maxBodyBytes, signal);
+        if (followedHops > 0)
+            normalized.redirected = true;
+        return { normalized, response };
+    }
+    catch (error) {
+        exchangeError = error;
+        throw error;
+    }
+    finally {
+        finishExchange?.(status, exchangeError);
     }
-    const normalized = await normalizeResponseWithSignal(response, currentUrl, options.maxBodyBytes, signal);
-    if (followedHops > 0)
-        normalized.redirected = true;
-    return { normalized, response };
 }
 function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
     const clients = new Map();
     let closed = false;
     let hasWarnedMissingProxy = false;
     const warn = clientOptions.warn ?? console.warn;
-    const cookieJar = new StealthCookieJar([], baseUrl);
+    const cookieJar = new StealthCookieJar([], baseUrl, registerDiagnosticValue);
     const akamaiSbsdState = { transactions: new Map() };
     const challengedReplays = new WeakMap();
     const ceremonyEgressLease = clientOptions[ENGINE_CEREMONY_EGRESS_LEASE];
@@ -1316,6 +1419,8 @@ function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
                     // StealthFetchOptions), any other non-2xx honours it, and the proxy attempt is
                     // recorded once per delivered response.
                     const finalizeAttempt = (attemptResponse, attemptNormalized) => {
+                        if (attemptNormalized.challenge)
+                            emitStealthTelemetry(clientOptions.stealthTelemetry, (sink) => sink.recordSbsd(attemptNormalized.challenge.outcome));
                         if (!attemptNormalized.challenge &&
                             attemptResponse.status >= 400 &&
                             options.throwOnHttpError !== false) {
@@ -1406,7 +1511,15 @@ function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
                                 initialHeaders.cookie = cookieHeader;
                         }
                         const defaultHeaders = buildOrderedHeaders?.(requestUrl, method, requestBody, initialHeaders);
-                        const fetchOnBoundSession = (fetchUrl, fetchMethod, fetchOptions, fetchSignal, orderedHeaders = buildOrderedHeaders, sessionDefaultHeaders = defaultHeaders) => withClient(requestProfile, proxy, ignoreTlsErrors, (transport) => fetchStealthRedirectChain(transport, cookieJar, fetchUrl, fetchMethod, fetchOptions, fetchSignal, orderedHeaders), fetchSignal, sessionDefaultHeaders);
+                        const fetchOnBoundSession = (fetchUrl, fetchMethod, fetchOptions, fetchSignal, orderedHeaders = buildOrderedHeaders, sessionDefaultHeaders = defaultHeaders, kind = "request") => withClient(requestProfile, proxy, ignoreTlsErrors, (transport) => fetchStealthRedirectChain(transport, cookieJar, fetchUrl, fetchMethod, fetchOptions, fetchSignal, orderedHeaders, clientOptions.stealthTelemetry
+                            ? {
+                                sink: clientOptions.stealthTelemetry,
+                                profileId: requestProfile,
+                                proxyUsed: Boolean(proxy),
+                                kind,
+                                cookieJar,
+                            }
+                            : undefined), fetchSignal, sessionDefaultHeaders);
                         const throwProxyTransportFault = (faultResponse, faultBody) => {
                             if (!proxy)
                                 return;
@@ -1440,7 +1553,10 @@ function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
                         const detected = akamaiSbsd
                             ? detectAkamaiSbsdChallenge(normalized, requestUrl, cookieJar, akamaiSbsd.allowedHosts, akamaiSbsdState)
                             : undefined;
+                        if (akamaiSbsd && !detected)
+                            emitStealthTelemetry(clientOptions.stealthTelemetry, (sink) => sink.recordSbsd({ detected: false }));
                         if (detected && akamaiSbsd) {
+                            emitStealthTelemetry(clientOptions.stealthTelemetry, (sink) => sink.recordSbsd("detected"));
                             if (challengeSolveAttempted || challengeRefetchAttempted) {
                                 normalized.challenge = {
                                     challenge: detected,
@@ -1506,7 +1622,7 @@ function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
                                         ...(init.maxBodyBytes === undefined
                                             ? {}
                                             : { maxBodyBytes: init.maxBodyBytes }),
-                                    }, boundSignal, resolverBuildHeaders, resolverBuildHeaders?.(transportUrl, init.method, init.body, normalizeHeaders(transportHeaders)));
+                                    }, boundSignal, resolverBuildHeaders, resolverBuildHeaders?.(transportUrl, init.method, init.body, normalizeHeaders(transportHeaders)), "resolver");
                                     return {
                                         status: result.normalized.status,
                                         headers: result.normalized.headers,
@@ -1562,6 +1678,7 @@ function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
                                     }
                                     const transactionResult = await transaction.result;
                                     if (!transactionResult.solved) {
+                                        emitStealthTelemetry(clientOptions.stealthTelemetry, (sink) => sink.recordSbsd("solve_failed"));
                                         if (ownsTransaction) {
                                             // The proxy delivered the challenged response; the resolver failed.
                                             // Surface that failure as-is: it is not a transport fault to normalize
@@ -1596,9 +1713,12 @@ function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
                                     attemptRecorded = false;
                                     attemptStartedAt = Date.now();
                                 }
+                                if (!explicitReplay)
+                                    emitStealthTelemetry(clientOptions.stealthTelemetry, (sink) => sink.recordSafeRefetch());
                                 const replayed = await fetchOnBoundSession(requestUrl, method, replayOptions, clientOptions.signal);
                                 throwProxyTransportFault(replayed.response, replayed.normalized.body);
                                 const persisted = detectAkamaiSbsdChallenge(replayed.normalized, requestUrl, cookieJar, akamaiSbsd.allowedHosts, akamaiSbsdState);
+                                emitStealthTelemetry(clientOptions.stealthTelemetry, (sink) => sink.recordSbsd(persisted ? "challenge_persisted" : "refetch_clear"));
                                 if (persisted) {
                                     replayed.normalized.challenge = {
                                         challenge: persisted,
@@ -1718,6 +1838,7 @@ function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
                     stalePoolError &&
                     refreshAttempt < MAX_POLICY_PROXY_POOL_REFRESHES) {
                     throwIfAmbientAborted(clientOptions.signal);
+                    emitStealthTelemetry(clientOptions.stealthTelemetry, (sink) => sink.recordPoolRefresh());
                     await invalidateProxyResolutionCacheAsync({
                         proxyPolicy: clientOptions.proxyPolicy,
                         upstream: clientOptions.upstream,
@@ -1924,6 +2045,7 @@ function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
                     if (decision.nextMethod !== method) {
                         body = undefined;
                     }
+                    emitStealthTelemetry(clientOptions.stealthTelemetry, (sink) => sink.recordRedirectHop());
                     method = decision.nextMethod;
                     currentUrl = decision.nextUrl;
                 }
@@ -1967,13 +2089,34 @@ function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
                 throwIfAmbientAborted(clientOptions.signal);
                 await client.clearCookies();
                 throwIfAmbientAborted(clientOptions.signal);
-                const response = await client.fetch(PROXY_AUTH_DIAGNOSTIC_URL, {
-                    method: "GET",
-                    timeout: PROXY_AUTH_DIAGNOSTIC_TIMEOUT_MS,
-                    ...(clientOptions.signal ? { signal: clientOptions.signal } : {}),
-                });
-                const normalized = await normalizeResponseWithSignal(response, undefined, undefined, clientOptions.signal);
-                return classifyProxyAuthDiagnosticMessage(normalized.body);
+                const finishExchange = startStealthExchange(clientOptions.stealthTelemetry
+                    ? {
+                        sink: clientOptions.stealthTelemetry,
+                        profileId: profile,
+                        proxyUsed: true,
+                        kind: "proxy_diagnostic",
+                        cookieJar,
+                    }
+                    : undefined, "GET", {}, clientOptions.signal);
+                let status;
+                let exchangeError;
+                try {
+                    const response = await client.fetch(PROXY_AUTH_DIAGNOSTIC_URL, {
+                        method: "GET",
+                        timeout: PROXY_AUTH_DIAGNOSTIC_TIMEOUT_MS,
+                        ...(clientOptions.signal ? { signal: clientOptions.signal } : {}),
+                    });
+                    status = response.status;
+                    const normalized = await normalizeResponseWithSignal(response, undefined, undefined, clientOptions.signal);
+                    return classifyProxyAuthDiagnosticMessage(normalized.body);
+                }
+                catch (error) {
+                    exchangeError = error;
+                    throw error;
+                }
+                finally {
+                    finishExchange(status, exchangeError);
+                }
             }, clientOptions.signal);
         }
         catch (error) {