@apifuse/provider-sdk 2.2.0-beta.7 → 2.2.0-beta.70

package/dist/runtime/stealth-akamai-sbsd.js

@@ -0,0 +1,142 @@
+import { normalizedResolverHostname } from "./resolver-vendors/hosts.js";
+/**
+ * Live SBSD `<script src>` paths are per-site obfuscated (zozo.jp captures, 2026-08-28:
+ * `/EdTyEb8Lyxqf/9iGcpl/GmKux0/DXObrkm53w/B1p4AQ/ZCF5f/VoJN08X?v=<uuid>` on the
+ * `Access Denied` shape, `/SHO9K/...?v=<uuid>&t=<token>` on the behavioral-tile hard shape).
+ * `/.well-known/sbsd` is only the POST endpoint string inside the deobfuscated
+ * script, never the page's script path. The stable shape is a same-origin script whose `v`
+ * is a UUID; cache-busted bundles (`?v=abc123`, hashes, semver) never match it.
+ */
+const SBSD_SCRIPT_VERSION = /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/iu;
+const SBSD_INTERSTITIAL_MAX_BYTES = 4_000;
+const SBSD_SCRIPT_DISCOVERY_MAX_BYTES = 4 * 1_024 * 1_024;
+const SBSD_CHALLENGE_TOKEN_MAX_BYTES = 1_024;
+const SBSD_INTERSTITIAL_MARKER = /sec-bc-tile-container|Access Denied|Reference #\d|Pardon Our Interruption|cpr_chlge/iu;
+function htmlAttribute(value) {
+    return value.replace(/&amp;/giu, "&");
+}
+function isDeclaredHost(url, allowedHosts) {
+    const hostname = normalizedResolverHostname(url.hostname);
+    return allowedHosts.some((host) => normalizedResolverHostname(host) === hostname);
+}
+export function findAkamaiSbsdScript(body, page) {
+    // Only markup carries the script tag; JSON and binary bodies skip the scan entirely.
+    if (!/^\s*</u.test(body) || Buffer.byteLength(body) > SBSD_SCRIPT_DISCOVERY_MAX_BYTES) {
+        return undefined;
+    }
+    let passiveScript;
+    for (const match of body.matchAll(/<script\b[^>]*\bsrc\s*=\s*["']([^"']+)["'][^>]*>/giu)) {
+        let script;
+        try {
+            // Relative sources resolve against the page URL, as the browser would.
+            script = new URL(htmlAttribute(match[1]), page);
+        }
+        catch {
+            continue;
+        }
+        const version = script.searchParams.get("v")?.trim();
+        if (script.origin !== page.origin || !version || !SBSD_SCRIPT_VERSION.test(version)) {
+            continue;
+        }
+        if (script.searchParams.get("t")?.trim())
+            return script;
+        passiveScript ??= script;
+    }
+    return passiveScript;
+}
+function isAkamaiSbsdInterstitial(body) {
+    return (Buffer.byteLength(body) < SBSD_INTERSTITIAL_MAX_BYTES && SBSD_INTERSTITIAL_MARKER.test(body));
+}
+function parseAkamaiSbsdChallengeToken(body) {
+    if (Buffer.byteLength(body) >= SBSD_INTERSTITIAL_MAX_BYTES)
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return undefined;
+    }
+    if (!parsed ||
+        typeof parsed !== "object" ||
+        Array.isArray(parsed) ||
+        !("cpr_chlge" in parsed) ||
+        parsed.cpr_chlge !== "true" ||
+        !("t" in parsed) ||
+        typeof parsed.t !== "string") {
+        return undefined;
+    }
+    const token = parsed.t.trim();
+    return token && Buffer.byteLength(token) <= SBSD_CHALLENGE_TOKEN_MAX_BYTES ? token : undefined;
+}
+export function detectAkamaiSbsdChallenge(response, pageUrl, jar, allowedHosts, state) {
+    let page;
+    try {
+        page = new URL(response.url ?? pageUrl);
+    }
+    catch {
+        return undefined;
+    }
+    if (!isDeclaredHost(page, allowedHosts))
+        return undefined;
+    const stateCookieName = jar.has("sbsd_o", page.toString())
+        ? "sbsd_o"
+        : jar.has("bm_so", page.toString())
+            ? "bm_so"
+            : undefined;
+    const interstitial = isAkamaiSbsdInterstitial(response.body);
+    // Without the state cookie (the jar already holds the Set-Cookie of this very response;
+    // the live capture sets bm_so on the page that carries the script) or an interstitial,
+    // nothing here is Akamai's: do not scan, and do not let an unrelated UUID-versioned
+    // bundle become the remembered script.
+    if (!stateCookieName && !interstitial)
+        return undefined;
+    const currentScript = findAkamaiSbsdScript(response.body, page);
+    if (currentScript) {
+        const version = currentScript.searchParams.get("v")?.trim();
+        if (version) {
+            // Clone rather than re-parse the pathname: a `//x` path would re-parse as a host.
+            const rememberedScript = new URL(currentScript);
+            rememberedScript.search = "";
+            rememberedScript.hash = "";
+            rememberedScript.searchParams.set("v", version);
+            state.rememberedScript = rememberedScript;
+        }
+    }
+    if (!stateCookieName)
+        return undefined;
+    const laterToken = parseAkamaiSbsdChallengeToken(response.body);
+    const rememberedScript = state.rememberedScript;
+    if (laterToken && rememberedScript && rememberedScript.origin === page.origin) {
+        return {
+            kind: "akamai_sbsd",
+            pageUrl: page.toString(),
+            scriptUrl: rememberedScript.toString(),
+            stateCookieName,
+            challengeToken: laterToken,
+        };
+    }
+    if (!currentScript || !interstitial)
+        return undefined;
+    return {
+        kind: "akamai_sbsd",
+        pageUrl: page.toString(),
+        scriptUrl: currentScript.toString(),
+        stateCookieName,
+    };
+}
+/**
+ * One in-flight solve per session, challenge, and bound identity: requests on one session
+ * may still pick a different wreq browser/OS or proxy, and a solve is only valid for the
+ * identity that ran it.
+ */
+export function akamaiSbsdChallengeKey(challenge, identity) {
+    return JSON.stringify([
+        new URL(challenge.scriptUrl).toString(),
+        challenge.challengeToken ?? "",
+        challenge.stateCookieName,
+        identity.wreqBrowser,
+        identity.wreqOs,
+        identity.proxyUrl ?? "",
+    ]);
+}

package/dist/runtime/stealth-cookies.d.ts

@@ -0,0 +1,24 @@
+import type { CookieJar, StealthCookieStore, StealthCookieStoreV1, StealthSessionCookies } from "../types.js";
+/** Extract cookie values from Set-Cookie/header strings for request-scoped registration. */
+export declare function cookieValuesFromHeaders(headers: string | readonly string[]): string[];
+export declare class StealthCookieJar implements CookieJar, StealthSessionCookies {
+    private cookies;
+    private readonly defaultUrl;
+    private readonly register;
+    constructor(cookieStrings: readonly string[], defaultUrl?: string, register?: (value: string) => void);
+    setFromCookieStrings(cookieStrings: readonly string[], url?: string): void;
+    get(name: string, url?: string): string | undefined;
+    getAll(url?: string): Record<string, string>;
+    has(name: string, url?: string): boolean;
+    toString(url?: string): string;
+    toHeader(url?: string): string;
+    snapshot(): Record<string, string>;
+    restore(cookies: Record<string, string>): void;
+    serialize(): StealthCookieStoreV1;
+    deserialize(state: StealthCookieStore): void;
+    clear(): void;
+    find(predicate: (cookie: string) => boolean, url?: string): string | undefined;
+    names(url?: string): string[];
+    private normalizeUrl;
+    private getUniqueCookies;
+}

package/dist/runtime/stealth-cookies.js

@@ -0,0 +1,131 @@
+import { Cookie, CookieJar as ToughCookieJar } from "tough-cookie";
+import { SDKError, StealthCookieStoreVersionError } from "../errors.js";
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+const LEGACY_COOKIE_ORIGIN = "https://legacy-cookie.invalid/";
+/** Extract cookie values from Set-Cookie/header strings for request-scoped registration. */
+export function cookieValuesFromHeaders(headers) {
+    const values = [];
+    for (const header of typeof headers === "string" ? [headers] : headers) {
+        const cookie = Cookie.parse(header);
+        if (cookie?.value)
+            values.push(cookie.value);
+    }
+    return values;
+}
+export class StealthCookieJar {
+    cookies;
+    defaultUrl;
+    register;
+    constructor(cookieStrings, defaultUrl = LEGACY_COOKIE_ORIGIN, register) {
+        this.cookies = new ToughCookieJar(undefined, {
+            allowSecureOnLocal: false,
+            rejectPublicSuffixes: true,
+        });
+        this.defaultUrl = this.normalizeUrl(defaultUrl) ?? LEGACY_COOKIE_ORIGIN;
+        this.register = register;
+        this.setFromCookieStrings(cookieStrings);
+    }
+    setFromCookieStrings(cookieStrings, url = this.defaultUrl) {
+        const cookieUrl = this.normalizeUrl(url);
+        if (!cookieUrl)
+            return;
+        for (const cookieString of cookieStrings) {
+            for (const value of cookieValuesFromHeaders(cookieString))
+                this.register?.(value);
+            this.cookies.setCookieSync(cookieString, cookieUrl, { ignoreError: true });
+        }
+    }
+    get(name, url) {
+        return this.getAll(url)[name];
+    }
+    getAll(url) {
+        return Object.fromEntries(this.getUniqueCookies(url ?? this.defaultUrl).map((cookie) => [cookie.key, cookie.value]));
+    }
+    has(name, url) {
+        return Object.hasOwn(this.getAll(url), name);
+    }
+    toString(url) {
+        return this.getUniqueCookies(url ?? this.defaultUrl)
+            .map((cookie) => cookie.cookieString())
+            .join("; ");
+    }
+    toHeader(url) {
+        return this.toString(url);
+    }
+    snapshot() {
+        const entries = [];
+        for (const cookie of this.serialize().jar.cookies) {
+            if (typeof cookie.key === "string" && typeof cookie.value === "string" && cookie.key) {
+                entries.push([cookie.key, cookie.value]);
+            }
+        }
+        return Object.fromEntries(entries);
+    }
+    restore(cookies) {
+        this.clear();
+        for (const [name, value] of Object.entries(cookies)) {
+            if (!name)
+                continue;
+            this.register?.(value);
+            this.cookies.setCookieSync(new Cookie({ key: name, path: "/", value }), this.defaultUrl, {
+                ignoreError: true,
+            });
+        }
+    }
+    serialize() {
+        const jar = this.cookies.serializeSync();
+        if (!jar) {
+            throw new SDKError("Stealth cookie store could not be serialized", {
+                code: "stealth_cookie_store_serialize_failed",
+            });
+        }
+        return { version: 1, jar };
+    }
+    deserialize(state) {
+        const version = isRecord(state) ? state.version : undefined;
+        if (version !== 1) {
+            throw new StealthCookieStoreVersionError(version);
+        }
+        const restored = ToughCookieJar.deserializeSync(state.jar);
+        Reflect.set(restored, "allowSecureOnLocal", false);
+        this.cookies = restored;
+    }
+    clear() {
+        this.cookies.removeAllCookiesSync();
+    }
+    find(predicate, url) {
+        for (const cookie of this.getUniqueCookies(url ?? this.defaultUrl)) {
+            const cookieString = cookie.cookieString();
+            if (predicate(cookieString))
+                return cookieString;
+        }
+        return undefined;
+    }
+    names(url) {
+        return this.getUniqueCookies(url ?? this.defaultUrl).map((cookie) => cookie.key);
+    }
+    normalizeUrl(url) {
+        try {
+            return new URL(url).toString();
+        }
+        catch {
+            return undefined;
+        }
+    }
+    getUniqueCookies(url) {
+        const cookieUrl = this.normalizeUrl(url);
+        if (!cookieUrl)
+            return [];
+        const names = new Set();
+        return this.cookies.getCookiesSync(cookieUrl).filter((cookie) => {
+            if (cookie.value)
+                this.register?.(cookie.value);
+            if (names.has(cookie.key))
+                return false;
+            names.add(cookie.key);
+            return true;
+        });
+    }
+}

package/dist/runtime/stealth-owned-headers.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Header names the stealth transport owns.
+ *
+ * `ctx.stealth` composes these from the Chrome emulation and the request class,
+ * so a caller value is rejected at request time with `SDKError` code
+ * `STEALTH_HEADER_OVERRIDE_UNSUPPORTED` ({@link assertCallerHeadersSupported}).
+ * The offline test harness (`runStandardTests`) calls the same function on
+ * every `ctx.stealth` request it serves, so a provider test fails exactly where
+ * production would, whichever file or variable the header came from. That is
+ * the cross-file enforcement.
+ *
+ * The `browser-version-literal` lint reports a subset of these names — the
+ * `sec-fetch-*` and `sec-ch-ua*` families — in files that use `ctx.stealth`
+ * (`isReportedOwnedHeaderName` in lint.ts). Both read this module, so the lint
+ * cannot claim a rejection the runtime does not perform; it reports
+ * deliberately less than the runtime rejects (host, connection,
+ * accept-encoding and a non-literal user-agent stay silent — see that
+ * predicate for why), so a green `apifuse check` is not proof that no owned
+ * header is set.
+ *
+ * Kept off the stealth runtime: the only import is `errors.js`, whose own
+ * imports are type-only, so the lazily loaded CLI lint path does not pull the
+ * stealth runtime in.
+ */
+export declare const SDK_OWNED_EXACT_CHROME_HEADERS: ReadonlySet<string>;
+export declare const SDK_OWNED_CHROME_HEADER_PREFIX = "sec-fetch-";
+/**
+ * True when `ctx.stealth` rejects a caller value for `name` (case-insensitive):
+ * an exact member of {@link SDK_OWNED_EXACT_CHROME_HEADERS} or any
+ * `sec-fetch-*` name.
+ */
+export declare function isStealthOwnedHeaderName(name: string): boolean;
+/**
+ * Throws `SDKError` `STEALTH_HEADER_OVERRIDE_UNSUPPORTED` for the first caller
+ * header `ctx.stealth` owns. An `undefined` value is skipped, as the transport
+ * drops it before sending. The stealth runtime and the offline test harness
+ * both call this, so the two cannot disagree about what is rejected.
+ */
+export declare function assertCallerHeadersSupported(headers: Readonly<Record<string, string | readonly string[] | undefined>>): void;

package/dist/runtime/stealth-owned-headers.js

@@ -0,0 +1,57 @@
+import { SDKError } from "../errors.js";
+/**
+ * Header names the stealth transport owns.
+ *
+ * `ctx.stealth` composes these from the Chrome emulation and the request class,
+ * so a caller value is rejected at request time with `SDKError` code
+ * `STEALTH_HEADER_OVERRIDE_UNSUPPORTED` ({@link assertCallerHeadersSupported}).
+ * The offline test harness (`runStandardTests`) calls the same function on
+ * every `ctx.stealth` request it serves, so a provider test fails exactly where
+ * production would, whichever file or variable the header came from. That is
+ * the cross-file enforcement.
+ *
+ * The `browser-version-literal` lint reports a subset of these names — the
+ * `sec-fetch-*` and `sec-ch-ua*` families — in files that use `ctx.stealth`
+ * (`isReportedOwnedHeaderName` in lint.ts). Both read this module, so the lint
+ * cannot claim a rejection the runtime does not perform; it reports
+ * deliberately less than the runtime rejects (host, connection,
+ * accept-encoding and a non-literal user-agent stay silent — see that
+ * predicate for why), so a green `apifuse check` is not proof that no owned
+ * header is set.
+ *
+ * Kept off the stealth runtime: the only import is `errors.js`, whose own
+ * imports are type-only, so the lazily loaded CLI lint path does not pull the
+ * stealth runtime in.
+ */
+export const SDK_OWNED_EXACT_CHROME_HEADERS = new Set([
+    "host",
+    "connection",
+    "user-agent",
+    "sec-ch-ua",
+    "sec-ch-ua-mobile",
+    "sec-ch-ua-platform",
+    "accept-encoding",
+]);
+export const SDK_OWNED_CHROME_HEADER_PREFIX = "sec-fetch-";
+/**
+ * True when `ctx.stealth` rejects a caller value for `name` (case-insensitive):
+ * an exact member of {@link SDK_OWNED_EXACT_CHROME_HEADERS} or any
+ * `sec-fetch-*` name.
+ */
+export function isStealthOwnedHeaderName(name) {
+    const lower = name.toLowerCase();
+    return (SDK_OWNED_EXACT_CHROME_HEADERS.has(lower) || lower.startsWith(SDK_OWNED_CHROME_HEADER_PREFIX));
+}
+/**
+ * Throws `SDKError` `STEALTH_HEADER_OVERRIDE_UNSUPPORTED` for the first caller
+ * header `ctx.stealth` owns. An `undefined` value is skipped, as the transport
+ * drops it before sending. The stealth runtime and the offline test harness
+ * both call this, so the two cannot disagree about what is rejected.
+ */
+export function assertCallerHeadersSupported(headers) {
+    for (const [name, value] of Object.entries(headers)) {
+        if (value === undefined || !isStealthOwnedHeaderName(name))
+            continue;
+        throw new SDKError(`Stealth transport owns the "${name.toLowerCase()}" header; remove it from headers.`, { code: "STEALTH_HEADER_OVERRIDE_UNSUPPORTED" });
+    }
+}

package/dist/runtime/stealth-telemetry.d.ts

@@ -0,0 +1,92 @@
+import type { StealthBrowser, StealthChallengeClassification, StealthOS, StealthProfileDescriptor } from "../types.js";
+import { type ClosedEnum, type TelemetryContributor } from "./request-telemetry.js";
+export type StealthTelemetryErrorCode = "transport_network_error" | "transport_timeout" | "transport_cancelled" | "upstream_http_error" | "response_too_large" | "proxy_connect_failed" | "PROXY_POOL_STALE" | "PROXY_EDGE_AUTH_REJECTED" | "PROXY_AUTH_IP_DENIED" | "PROXY_EDGE_TLS_REJECTED" | "PROXY_REQUIRED" | "other";
+export type StealthTelemetryRequestClass = "navigation" | "script_navigation" | "form_post" | "xhr" | "post";
+export type StealthTelemetryAttemptKind = "request" | "resolver" | "proxy_diagnostic";
+export type StealthTelemetrySbsdOutcome = StealthChallengeClassification["outcome"] | "detected" | "refetch_clear";
+export type StealthTelemetryDiagnostics = {
+    readonly name?: string;
+    readonly message?: string;
+    readonly code?: string;
+};
+export type StealthTelemetryAttemptEvent = {
+    readonly ms: number;
+    readonly status?: number;
+    readonly errorCode?: StealthTelemetryErrorCode;
+    readonly diagnostics?: StealthTelemetryDiagnostics;
+    readonly profileId: StealthProfileDescriptor;
+    readonly proxyUsed: boolean;
+    readonly requestClass: StealthTelemetryRequestClass;
+    readonly kind?: StealthTelemetryAttemptKind;
+};
+export type StealthTelemetrySbsdEvent = {
+    readonly detected: boolean;
+    readonly outcome?: StealthTelemetrySbsdOutcome;
+};
+export interface StealthTelemetrySink {
+    recordAttempt(event: StealthTelemetryAttemptEvent): void;
+    recordPoolRefresh(): void;
+    recordRedirectHop(): void;
+    recordSbsd(event?: StealthTelemetrySbsdEvent | StealthTelemetrySbsdOutcome): void;
+    recordSafeRefetch(): void;
+}
+export type StealthTelemetryAttemptSample = {
+    n: number;
+    ms: number;
+    status?: number;
+    e?: StealthTelemetryErrorCode;
+    kind?: StealthTelemetryAttemptKind;
+    diagnostics?: StealthTelemetryDiagnostics;
+};
+export type StealthTelemetryLogPayload = {
+    attempts: number;
+    poolRefreshes: number;
+    redirectHops: number;
+    profileId?: StealthProfileDescriptor;
+    proxyUsed: boolean;
+    requestClass?: StealthTelemetryRequestClass;
+    sbsdDetected?: boolean;
+    sbsdOutcome?: StealthTelemetrySbsdOutcome;
+    safeRefetch: number;
+    lastStatus?: number;
+    ms: number;
+    attemptSamples?: StealthTelemetryAttemptSample[];
+    attemptSamplesDropped?: number;
+};
+export type StealthTelemetryHeaderPayload = {
+    attempts: number;
+    poolRefreshes: number;
+    redirectHops: number;
+    profileId?: {
+        browser: ClosedEnum<StealthBrowser>;
+        os: ClosedEnum<StealthOS>;
+    };
+    proxyUsed: boolean;
+    requestClass?: ClosedEnum<StealthTelemetryRequestClass>;
+    sbsdDetected?: boolean;
+    sbsdOutcome?: ClosedEnum<StealthTelemetrySbsdOutcome>;
+    safeRefetch: number;
+    lastStatus?: number;
+    ms: number;
+    attemptSamples?: {
+        n: number;
+        ms: number;
+        status?: number;
+        e?: ClosedEnum<StealthTelemetryErrorCode>;
+        kind?: ClosedEnum<StealthTelemetryAttemptKind>;
+    }[];
+};
+export declare class StealthTelemetryCollector implements StealthTelemetrySink, TelemetryContributor<StealthTelemetryLogPayload, StealthTelemetryHeaderPayload> {
+    #private;
+    readonly key: "stealth";
+    constructor(options?: {
+        redact?: (text: string) => string;
+    });
+    recordAttempt(event: StealthTelemetryAttemptEvent): void;
+    recordPoolRefresh(): void;
+    recordRedirectHop(): void;
+    recordSbsd(event?: StealthTelemetrySbsdEvent | StealthTelemetrySbsdOutcome): void;
+    recordSafeRefetch(): void;
+    toLogPayload(): StealthTelemetryLogPayload | undefined;
+    toHeaderPayload(log: StealthTelemetryLogPayload): StealthTelemetryHeaderPayload;
+}

package/dist/runtime/stealth-telemetry.js

@@ -0,0 +1,179 @@
+import { Buffer } from "node:buffer";
+import { closedEnum } from "./request-telemetry.js";
+const MAX_ATTEMPT_SAMPLES = 24;
+const MAX_DIAGNOSTIC_TEXT = 300;
+function boundedInteger(value) {
+    if (!Number.isFinite(value))
+        return Number.MAX_SAFE_INTEGER;
+    return Math.min(Number.MAX_SAFE_INTEGER, Math.max(0, Math.floor(value)));
+}
+function saturatingAdd(a, b) {
+    if (!Number.isFinite(a) || !Number.isFinite(b))
+        return Number.MAX_SAFE_INTEGER;
+    return Math.min(Number.MAX_SAFE_INTEGER, boundedInteger(a) + boundedInteger(b));
+}
+function boundedText(value, redact) {
+    let result = value;
+    try {
+        result = redact?.(value) ?? value;
+    }
+    catch {
+        result = "[REDACTION_FAILED]";
+    }
+    const length = Math.min(result.length, MAX_DIAGNOSTIC_TEXT);
+    const units = Buffer.alloc(length * 2);
+    for (let index = 0; index < length; index += 1) {
+        units.writeUInt16LE(result.charCodeAt(index), index * 2);
+    }
+    return units.toString("utf16le");
+}
+function cloneDiagnostics(diagnostics, redact) {
+    if (!diagnostics)
+        return undefined;
+    const result = {
+        ...(diagnostics.name === undefined ? {} : { name: boundedText(diagnostics.name, redact) }),
+        ...(diagnostics.message === undefined
+            ? {}
+            : { message: boundedText(diagnostics.message, redact) }),
+        ...(diagnostics.code === undefined ? {} : { code: boundedText(diagnostics.code, redact) }),
+    };
+    return Object.keys(result).length > 0 ? result : undefined;
+}
+function cloneProfile(profile) {
+    return { browser: profile.browser, os: profile.os };
+}
+export class StealthTelemetryCollector {
+    key = "stealth";
+    #redact;
+    #attempts = 0;
+    #poolRefreshes = 0;
+    #redirectHops = 0;
+    #profileId;
+    #proxyUsed = false;
+    #requestClass;
+    #sbsdDetected;
+    #sbsdOutcome;
+    #safeRefetch = 0;
+    #lastStatus;
+    #ms = 0;
+    #attemptSamples = [];
+    #attemptSamplesDropped = 0;
+    constructor(options = {}) {
+        this.#redact = options.redact;
+    }
+    recordAttempt(event) {
+        const ms = boundedInteger(event.ms);
+        this.#attempts = saturatingAdd(this.#attempts, 1);
+        this.#ms = saturatingAdd(this.#ms, ms);
+        this.#profileId = cloneProfile(event.profileId);
+        this.#proxyUsed ||= event.proxyUsed;
+        this.#requestClass = event.requestClass;
+        if (event.status !== undefined)
+            this.#lastStatus = boundedInteger(event.status);
+        if (this.#attemptSamples.length >= MAX_ATTEMPT_SAMPLES) {
+            this.#attemptSamplesDropped = saturatingAdd(this.#attemptSamplesDropped, 1);
+            return;
+        }
+        const sample = {
+            n: this.#attempts,
+            ms,
+            ...(event.status === undefined ? {} : { status: boundedInteger(event.status) }),
+            ...(event.errorCode === undefined ? {} : { e: event.errorCode }),
+            ...(event.kind === undefined ? {} : { kind: event.kind }),
+            ...(event.diagnostics
+                ? { diagnostics: cloneDiagnostics(event.diagnostics, this.#redact) }
+                : {}),
+        };
+        if (sample.diagnostics === undefined)
+            delete sample.diagnostics;
+        this.#attemptSamples.push(sample);
+    }
+    recordPoolRefresh() {
+        this.#poolRefreshes = saturatingAdd(this.#poolRefreshes, 1);
+    }
+    recordRedirectHop() {
+        this.#redirectHops = saturatingAdd(this.#redirectHops, 1);
+    }
+    recordSbsd(event) {
+        if (typeof event === "string") {
+            this.#sbsdDetected = true;
+            this.#sbsdOutcome = event;
+            return;
+        }
+        if (!event)
+            return;
+        this.#sbsdDetected = (this.#sbsdDetected ?? false) || event.detected;
+        if (event.outcome !== undefined)
+            this.#sbsdOutcome = event.outcome;
+    }
+    recordSafeRefetch() {
+        this.#safeRefetch = saturatingAdd(this.#safeRefetch, 1);
+    }
+    toLogPayload() {
+        if (this.#attempts === 0 &&
+            this.#poolRefreshes === 0 &&
+            this.#redirectHops === 0 &&
+            this.#safeRefetch === 0 &&
+            this.#sbsdDetected === undefined) {
+            return undefined;
+        }
+        return {
+            attempts: this.#attempts,
+            poolRefreshes: this.#poolRefreshes,
+            redirectHops: this.#redirectHops,
+            ...(this.#profileId ? { profileId: cloneProfile(this.#profileId) } : {}),
+            proxyUsed: this.#proxyUsed,
+            ...(this.#requestClass ? { requestClass: this.#requestClass } : {}),
+            ...(this.#sbsdDetected === undefined ? {} : { sbsdDetected: this.#sbsdDetected }),
+            ...(this.#sbsdOutcome ? { sbsdOutcome: this.#sbsdOutcome } : {}),
+            safeRefetch: this.#safeRefetch,
+            ...(this.#lastStatus === undefined ? {} : { lastStatus: this.#lastStatus }),
+            ms: this.#ms,
+            ...(this.#attemptSamples.length > 0
+                ? {
+                    attemptSamples: this.#attemptSamples.map((sample) => ({
+                        ...sample,
+                        ...(sample.diagnostics
+                            ? {
+                                diagnostics: { ...sample.diagnostics },
+                            }
+                            : {}),
+                    })),
+                }
+                : {}),
+            ...(this.#attemptSamplesDropped > 0
+                ? { attemptSamplesDropped: this.#attemptSamplesDropped }
+                : {}),
+        };
+    }
+    toHeaderPayload(log) {
+        const attemptSamples = log.attemptSamples?.map((sample) => ({
+            n: sample.n,
+            ms: sample.ms,
+            ...(sample.status === undefined ? {} : { status: sample.status }),
+            ...(sample.e ? { e: closedEnum(sample.e) } : {}),
+            ...(sample.kind ? { kind: closedEnum(sample.kind) } : {}),
+        }));
+        return {
+            attempts: log.attempts,
+            poolRefreshes: log.poolRefreshes,
+            redirectHops: log.redirectHops,
+            ...(log.profileId
+                ? {
+                    profileId: {
+                        browser: closedEnum(log.profileId.browser),
+                        os: closedEnum(log.profileId.os),
+                    },
+                }
+                : {}),
+            proxyUsed: log.proxyUsed,
+            ...(log.requestClass ? { requestClass: closedEnum(log.requestClass) } : {}),
+            ...(log.sbsdDetected === undefined ? {} : { sbsdDetected: log.sbsdDetected }),
+            ...(log.sbsdOutcome ? { sbsdOutcome: closedEnum(log.sbsdOutcome) } : {}),
+            safeRefetch: log.safeRefetch,
+            ...(log.lastStatus === undefined ? {} : { lastStatus: log.lastStatus }),
+            ms: log.ms,
+            ...(attemptSamples && attemptSamples.length > 0 ? { attemptSamples } : {}),
+        };
+    }
+}