@apifuse/provider-sdk 2.2.0-beta.23 → 2.2.0-beta.24

package/dist/config/loader.js

@@ -221,64 +221,7 @@ function serializeSmartproxyPool(pool) {
 }
 function normalizeProxyUrl(url) {
     const normalized = url?.trim();
-    return normalized ? applyStickyProxySession(normalized) : undefined;
-}
-function readPositiveIntegerEnv(name) {
-    const raw = process.env[name]?.trim();
-    if (!raw)
-        return undefined;
-    if (!/^[1-9]\d*$/.test(raw)) {
-        throw new Error(`${name} must be a positive integer`);
-    }
-    return raw;
-}
-function applyStickyProxySession(proxyUrl) {
-    let parsed;
-    try {
-        parsed = new URL(proxyUrl);
-    }
-    catch {
-        return proxyUrl;
-    }
-    if (!parsed.hostname || !parsed.username || !parsed.password) {
-        return proxyUrl;
-    }
-    // This rewrites sticky-session usernames for a bring-your-own *gateway* URL
-    // (APIFUSE__PROXY__URL). The `smartproxy` host here means a smartproxy.com /
-    // Decodo-family gateway that authenticates by username — NOT the
-    // api.smartproxy.org allocation vendor, whose endpoints are raw ip:port with
-    // no credentials and therefore return early above.
-    const host = parsed.hostname.toLowerCase();
-    if (!host.includes("smartproxy") && !host.includes("decodo")) {
-        return proxyUrl;
-    }
-    const username = decodeURIComponent(parsed.username);
-    const sessionId = process.env.APIFUSE__PROXY__SESSION_ID?.trim() || "apifuse-shared";
-    const sessionDuration = readPositiveIntegerEnv("APIFUSE__PROXY__SESSION_DURATION");
-    const stickyUsername = host.includes("smartproxy")
-        ? buildSmartproxyUsername(username, sessionId, sessionDuration)
-        : buildDecodoUsername(username, sessionId, sessionDuration ?? "60");
-    parsed.username = stickyUsername;
-    return parsed.toString();
-}
-function buildSmartproxyUsername(username, sessionId, sessionDuration) {
-    const parts = username.split("_");
-    const configuredLife = parts.find((part) => part.startsWith("life-"))?.slice("life-".length);
-    const baseUsername = parts
-        .filter((part) => !part.startsWith("session-") && !part.startsWith("life-"))
-        .join("_");
-    return `${baseUsername}_session-${sessionId}_life-${sessionDuration ?? configuredLife ?? "60"}`;
-}
-function buildDecodoUsername(username, sessionId, sessionDuration) {
-    const withoutSticky = username.replace(/-session-.+-sessionduration-\d+$/, "");
-    const baseUsername = withoutSticky.startsWith("user-") ? withoutSticky : `user-${withoutSticky}`;
-    return `${baseUsername}-session-${sessionId}-sessionduration-${sessionDuration}`;
-}
-function syncProxyEnv(config) {
-    const configProxyUrl = normalizeProxyUrl(config.proxy?.url);
-    if (!process.env.APIFUSE__PROXY__URL && configProxyUrl) {
-        process.env.APIFUSE__PROXY__URL = configProxyUrl;
-    }
+    return normalized || undefined;
 }
 export function resolveProxyConfig(options = {}) {
     const explicitProxyUrl = normalizeProxyUrl(options.proxy);
@@ -293,14 +236,6 @@ export function resolveProxyConfig(options = {}) {
     if (!legacyProxyRequested) {
         return { shouldWarn: false };
     }
-    const envProxyUrl = normalizeProxyUrl(process.env.APIFUSE__PROXY__URL);
-    if (envProxyUrl) {
-        return { shouldWarn: false, url: envProxyUrl };
-    }
-    const configuredProxyUrl = normalizeProxyUrl(options.apifuseConfig?.proxy?.url);
-    if (configuredProxyUrl) {
-        return { shouldWarn: false, url: configuredProxyUrl };
-    }
     return { shouldWarn: true };
 }
 export async function resolveProxyConfigAsync(options = {}) {
@@ -317,7 +252,17 @@ export async function resolveProxyConfigAsync(options = {}) {
     }
     const chain = resolveVendorChain(policy);
     if (chain.length === 0) {
-        // decodo/custom/env-static providers keep the legacy static-URL path.
+        const declared = declaredVendorChain(policy);
+        const deprecated = declared.filter((vendor) => vendor === "decodo" || vendor === "custom");
+        if (policy.mode === "required") {
+            const providerIds = declared.length > 0 ? declared.map((vendor) => `"${vendor}"`).join(", ") : "none";
+            const deprecatedDetail = deprecated.length > 0
+                ? ` Deprecated vendor(s): ${deprecated.map((vendor) => `"${vendor}"`).join(", ")}.`
+                : "";
+            throw new ProxyResolutionError("PROXY_REQUIRED", `Required proxy policy has no SDK-managed adapter for provider id(s): ${providerIds}.${deprecatedDetail} Use "smartproxy" or "nodemaven".`);
+        }
+        // Deprecated decodo/custom providers have no SDK-managed adapter. Optional
+        // policies preserve the warning-only behavior and may continue directly.
         return resolveProxyConfig({
             ...options,
             upstream: { proxy: true },
@@ -524,18 +469,21 @@ function resolvePolicy(options) {
 function isRegistryVendor(name) {
     return name === "smartproxy" || name === "nodemaven";
 }
+function declaredVendorChain(policy) {
+    const declared = policy.providers?.length
+        ? policy.providers
+        : [policy.provider ?? envDefaultProvider()];
+    return declared.filter((vendor) => vendor !== undefined);
+}
 /**
  * Ordered list of SDK-native proxy vendors declared by the policy. `providers`
  * takes precedence over the legacy singular `provider`; the platform default
  * env is the final fallback. Non-registry names (decodo/custom) are dropped so
- * an all-static chain falls through to the legacy env-URL path unchanged.
+ * an all-deprecated chain has no managed adapter.
  */
 export function resolveVendorChain(policy) {
-    const declared = policy.providers?.length
-        ? policy.providers
-        : [policy.provider ?? envDefaultProvider()];
     const chain = [];
-    for (const name of declared) {
+    for (const name of declaredVendorChain(policy)) {
         if (isRegistryVendor(name) && !chain.includes(name)) {
             chain.push(name);
         }
@@ -600,9 +548,8 @@ const UNSAFE_TRANSPORT_RETRY_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"
  *  - the method is safe/idempotent — an unsafe request must never be duplicated
  *    across the pool even if some framework default would allow it;
  *  - the policy resolves a non-empty *registry* vendor chain (smartproxy /
- *    nodemaven). Static vendors (custom / decodo) and credential-less policies
- *    resolve no allocator pool, so every attempt would hit the same endpoint
- *    with no possible crossover — they keep the retry budget.
+ *    nodemaven). Deprecated vendors (custom / decodo) resolve no managed pool,
+ *    so there is no possible endpoint crossover — they keep the retry budget.
  *
  * The widened cap is bounded by the chain's true maximum span (sum of each
  * vendor's max pool size), so a large NodeMaven pool (≤50) stays reachable and
@@ -621,8 +568,8 @@ const UNSAFE_TRANSPORT_RETRY_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"
  *    endpoint each attempt resolves (even a repeated one), so no de-duplication;
  *  - the method is safe/idempotent — an unsafe request is never duplicated;
  *  - the policy resolves a non-empty registry vendor chain (smartproxy /
- *    nodemaven). Static vendors (custom / decodo) resolve the same URL every
- *    attempt, so there is nothing to rotate or de-duplicate.
+ *    nodemaven). Deprecated vendors (custom / decodo) resolve no managed
+ *    endpoint, so there is nothing to rotate or de-duplicate.
  */
 export function policyRotatesTransportVendorChain(input) {
     if (!input.usesPolicyAllocator || !input.policy || input.explicitRetry) {
@@ -650,9 +597,8 @@ export function resolvePolicyTransportAttemptCap(input) {
  * A registry vendor chain (smartproxy/nodemaven) resolves a potentially
  * *different* endpoint per flat attempt index, so a transport retry should
  * advance across endpoints and de-duplicate once the chain stops yielding new
- * ones. Static/custom/decodo policies (empty registry chain) resolve the *same*
- * URL every attempt by design — retrying that same endpoint is intended, so the
- * transport loop must not de-duplicate them.
+ * ones. Deprecated custom/decodo policies have an empty registry chain and no
+ * managed endpoint, so the transport loop has nothing to rotate or de-duplicate.
  */
 export function policyResolvesRegistryVendorChain(policy) {
     return Boolean(policy) && resolveVendorChain(policy).length > 0;
@@ -1249,16 +1195,12 @@ export async function loadApiFuseConfig(dir = process.cwd()) {
     const tsPath = path.resolve(dir, "apifuse.config.ts");
     if (existsSync(tsPath)) {
         const config = await importConfig(tsPath);
-        const resolvedConfig = config ?? {};
-        syncProxyEnv(resolvedConfig);
-        return resolvedConfig;
+        return config ?? {};
     }
     const jsPath = path.resolve(dir, "apifuse.config.js");
     if (existsSync(jsPath)) {
         const config = await importConfig(jsPath);
-        const resolvedConfig = config ?? {};
-        syncProxyEnv(resolvedConfig);
-        return resolvedConfig;
+        return config ?? {};
     }
     return {};
 }

package/dist/define.d.ts

@@ -1,4 +1,4 @@
-import type { AuthConfig, BrowserEngine, ContextDeclaration, CredentialDeclaration, HealthJourneyDefinition, HealthJourneySchedule, HealthScheduleRandomization, InferSchemaOutput, OperationDefinition, OperationHandlerResult, OperationHttpStreamTransport, OperationSseTransport, OperationWebSocketTransport, NativeProviderConfig, ProviderOcrConfig, ProviderAccessConfig, ProviderDefinition, ProviderDeploymentOverrides, ProviderHealthMonitorConfig, ProviderProxyConfig, ProviderPublicProfile, ProviderReviewed, ProviderSecretDeclaration, ProviderStreamEvent, ProviderSttConfig, SchemaLike, SmsOtpMatcherDefinition, StealthPlatform } from "./types.js";
+import type { AuthConfig, BrowserEngine, ContextDeclaration, CredentialDeclaration, HealthJourneyDefinition, HealthJourneySchedule, HealthScheduleRandomization, InferSchemaOutput, NativeProviderConfig, OperationDefinition, OperationHandlerResult, OperationHttpStreamTransport, OperationSseTransport, OperationWebSocketTransport, ProviderAccessConfig, ProviderDefinition, ProviderOcrConfig, ProviderDeploymentOverrides, ProviderHealthMonitorConfig, ProviderProxyConfig, ProviderPublicProfile, ProviderResolverConfig, ProviderReviewed, ProviderSecretDeclaration, ProviderStreamEvent, ProviderSttConfig, SchemaLike, SmsOtpMatcherDefinition, StealthPlatform } from "./types.js";
 type ProviderImplementationSourceAccess = "official_api" | "private_api" | "browser_flow" | "hybrid";
 type ProviderImplementationCredentialStrategy = "apifuse_managed" | "workspace_secret" | "user_oauth" | "user_session" | "none";
 interface ProviderImplementationProfile {
@@ -8,6 +8,8 @@ interface ProviderImplementationProfile {
     operatorNotes?: string;
     visibility: "internal" | "operator";
 }
+export declare const VALID_PROVIDER_RESOLVER_VENDORS: readonly ["browser", "capsolver", "capmonster", "2captcha", "custom"];
+export declare const VALID_PROVIDER_CHALLENGE_KINDS: readonly ["turnstile", "recaptcha_v2", "recaptcha_v3", "hcaptcha", "cloudflare_interstitial", "aws_waf"];
 type ProviderOperation = OperationDefinition<SchemaLike, SchemaLike>;
 type OperationConfig<TInput extends SchemaLike, TOutput extends SchemaLike> = Omit<OperationDefinition<TInput, TOutput>, "handler"> & {
     handler(ctx: Parameters<OperationDefinition<TInput, TOutput>["handler"]>[0], input: InferSchemaOutput<TInput>): OperationHandlerResult<InferSchemaOutput<TOutput>> | Promise<OperationHandlerResult<InferSchemaOutput<TOutput>>>;
@@ -57,6 +59,7 @@ export interface ProviderConfig<TOperations extends Record<string, ProviderOpera
     proxy?: ProviderProxyConfig;
     ocr?: ProviderOcrConfig;
     stt?: ProviderSttConfig;
+    resolver?: ProviderResolverConfig;
     browser?: {
         engine: BrowserEngine;
     };

package/dist/define.js

@@ -49,6 +49,24 @@ const VALID_PROVIDER_PROXY_AFFINITIES = [
 ];
 const VALID_PROVIDER_OCR_MODES = ["optional", "required"];
 const VALID_PROVIDER_STT_MODES = ["optional", "required"];
+function exhaustiveLiteralArray() {
+    return (values, ..._missing) => values;
+}
+export const VALID_PROVIDER_RESOLVER_VENDORS = exhaustiveLiteralArray()([
+    "browser",
+    "capsolver",
+    "capmonster",
+    "2captcha",
+    "custom",
+]);
+export const VALID_PROVIDER_CHALLENGE_KINDS = exhaustiveLiteralArray()([
+    "turnstile",
+    "recaptcha_v2",
+    "recaptcha_v3",
+    "hcaptcha",
+    "cloudflare_interstitial",
+    "aws_waf",
+]);
 const SMARTPROXY_APP_KEY_SECRET = "APIFUSE__PROXY__SMARTPROXY_APP_KEY";
 const NODEMAVEN_USERNAME_SECRET = "APIFUSE__PROXY__NODEMAVEN_USERNAME";
 const NODEMAVEN_PASSWORD_SECRET = "APIFUSE__PROXY__NODEMAVEN_PASSWORD";
@@ -57,9 +75,8 @@ const NODEMAVEN_PASSWORD_SECRET = "APIFUSE__PROXY__NODEMAVEN_PASSWORD";
 // credential fails at build/validation time rather than during a live outage: a
 // declared-but-uncredentialed fallback leg is a silently dead SPOF, which is
 // exactly the failure class the multi-vendor chain exists to remove. Vendors
-// absent from this map (e.g. `custom`/`decodo`, whose credentials come from the
-// `APIFUSE__PROXY__URL` bring-your-own escape hatch, not provider secrets) impose
-// no declaration requirement.
+// absent from this map (the deprecated `custom`/`decodo` values have no managed
+// adapter) impose no declaration requirement.
 const VENDOR_REQUIRED_SECRETS = {
     smartproxy: [SMARTPROXY_APP_KEY_SECRET],
     nodemaven: [NODEMAVEN_USERNAME_SECRET, NODEMAVEN_PASSWORD_SECRET],
@@ -362,8 +379,15 @@ function validateProviderProxy(config) {
     // `decodo`/`custom` are deprecated vendor values (string-union members, so the
     // @deprecated symbol gate can't catch them — warn at validation time instead).
     const deprecatedVendors = vendorChain.filter((vendor) => vendor === "decodo" || vendor === "custom");
+    if (proxy.mode === "required" &&
+        vendorChain.length > 0 &&
+        deprecatedVendors.length === vendorChain.length) {
+        throw new ValidationError(`Provider "${config.id}" requires proxy egress but declares only deprecated proxy vendor(s): ${deprecatedVendors.join(", ")}.`, {
+            fix: `Use proxy.provider or proxy.providers with "smartproxy" and/or "nodemaven".`,
+        });
+    }
     if (deprecatedVendors.length > 0) {
-        console.warn(`[provider-sdk] Provider "${config.id}" uses deprecated proxy vendor(s): ${deprecatedVendors.join(", ")}. Use "smartproxy"/"nodemaven", or the APIFUSE__PROXY__URL bring-your-own escape hatch.`);
+        console.warn(`[provider-sdk] Provider "${config.id}" uses deprecated proxy vendor(s): ${deprecatedVendors.join(", ")}. Use "smartproxy"/"nodemaven".`);
     }
 }
 function validateProviderStt(config) {
@@ -390,6 +414,34 @@ function validateProviderOcr(config) {
     rejectUnknownFields(ocr, new Set(["mode"]), "ocr");
     assertLiteralField(ocr.mode, "ocr.mode", VALID_PROVIDER_OCR_MODES, config.id);
 }
+function validateProviderResolver(config) {
+    const resolver = config.resolver;
+    if (resolver === undefined)
+        return;
+    if (!resolver || typeof resolver !== "object" || Array.isArray(resolver)) {
+        throw new ValidationError(`Provider "${config.id}" has invalid resolver: must be an object.`, {
+            fix: `Set resolver for provider "${config.id}" to { vendors: ["2captcha"], kinds: ["turnstile"] }.`,
+        });
+    }
+    rejectUnknownFields(resolver, new Set(["vendors", "kinds"]), "resolver", config.id);
+    validateResolverLiteralArray(resolver.vendors, "resolver.vendors", VALID_PROVIDER_RESOLVER_VENDORS, config.id);
+    validateResolverLiteralArray(resolver.kinds, "resolver.kinds", VALID_PROVIDER_CHALLENGE_KINDS, config.id);
+}
+function validateResolverLiteralArray(value, field, validValues, providerId) {
+    if (!Array.isArray(value)) {
+        throw new ValidationError(`Provider "${providerId}" has invalid ${field}: must be an array.`, {
+            fix: `Set ${field} for provider "${providerId}" to an array containing only: ${validValues.join(", ")}.`,
+        });
+    }
+    for (const [index, item] of value.entries()) {
+        if (typeof item === "string" && validValues.some((validValue) => validValue === item)) {
+            continue;
+        }
+        throw new ValidationError(`Provider "${providerId}" has invalid ${field}[${index}]: ${JSON.stringify(item)}. Expected one of: ${validValues.join(", ")}`, {
+            fix: `Set ${field}[${index}] for provider "${providerId}" to one of ${validValues.map((validValue) => `"${validValue}"`).join(", ")}.`,
+        });
+    }
+}
 function validateOperationIds(providerId, operations) {
     for (const operationName of Object.keys(operations)) {
         if (!OPERATION_ID_REGEX.test(operationName))
@@ -764,14 +816,18 @@ function suggestField(unknown, candidates) {
     }
     return best;
 }
-function rejectUnknownFields(value, allowed, fieldPath) {
+function rejectUnknownFields(value, allowed, fieldPath, providerId) {
     for (const key of Object.keys(value)) {
         if (allowed.has(key))
             continue;
         const hint = suggestField(key, allowed);
         throw new ValidationError(hint
             ? `Unknown field "${key}" on ${fieldPath}. Did you mean "${hint}"?`
-            : `Unknown field "${key}" on ${fieldPath}.`, { fix: `Remove ${fieldPath}.${key} or rename it.` });
+            : `Unknown field "${key}" on ${fieldPath}.`, {
+            fix: providerId
+                ? `Remove ${fieldPath}.${key} from provider "${providerId}" or rename it.`
+                : `Remove ${fieldPath}.${key} or rename it.`,
+        });
     }
 }
 function assertBoundedIntegerMs(value, fieldPath, options) {
@@ -1553,6 +1609,7 @@ export function defineProvider(config) {
     validateProviderProxy(config);
     validateProviderOcr(config);
     validateProviderStt(config);
+    validateProviderResolver(config);
     if (config.runtime === "browser" && !config.browser)
         throw new ProviderError(`Provider "${config.id}" must define browser.engine when runtime is "browser"`, {
             fix: 'Add browser: { engine: "playwright-stealth" } for TypeScript providers, or another supported engine for your runtime',
@@ -1572,6 +1629,7 @@ export function defineProvider(config) {
         proxy: config.proxy,
         ocr: config.ocr,
         stt: config.stt,
+        resolver: config.resolver,
         browser: config.browser,
         auth: config.auth,
         reviewed: config.reviewed,

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export * from "./auth.js";
 export * from "./ceremonies/index.js";
 export * from "./choice-token.js";
-export type { ApiFuseConfig, BrowserConfig, ProxyConfig, ProxyProtocol, ProxyResolutionOptions, ProxyResolutionSource, ProxyVendorName, ResolvedProxyConfig, SessionConfig, } from "./config/loader.js";
+export type { ApiFuseConfig, BrowserConfig, ProxyProtocol, ProxyResolutionOptions, ProxyResolutionSource, ProxyVendorName, ResolvedProxyConfig, SessionConfig, } from "./config/loader.js";
 export { defineConfig, loadApiFuseConfig, resolveProxy } from "./config/loader.js";
 export { canonicalJson, digestProviderContract, extractProviderContract, type JsonPrimitive, type JsonValue, PROVIDER_CONTRACT_SCHEMA_VERSION, type ProviderContractOperation, type ProviderContractSnapshot, } from "./contract.js";
 export { centered, delayed, defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, defineStreamOperation, every, type ProviderConfig, } from "./define.js";
@@ -29,6 +29,7 @@ export { generateInsights } from "./runtime/insights.js";
 export { type InstrumentationOptions, type InstrumentedProviderContext, wrapWithInstrumentation, } from "./runtime/instrumentation.js";
 export { type PrevalidateResult, prevalidate } from "./runtime/prevalidate.js";
 export { getProviderBaseUrl } from "./runtime/provider.js";
+export { APIFUSE__CDP_POOL__URL, APIFUSE__RESOLVER__2CAPTCHA__API_KEY, APIFUSE__RESOLVER__CAPMONSTER__API_KEY, APIFUSE__RESOLVER__CAPSOLVER__API_KEY, APIFUSE__RESOLVER__TIMEOUT_MS, createResolverClientFromEnv, createUnsupportedResolverClient, DEFAULT_RESOLVER_TIMEOUT_MS, invalidateResolverSolution, type ResolverRuntimeOptions, } from "./runtime/resolver.js";
 export { assertRequiredSecretsPresent, listMissingRequiredSecrets, MISSING_SECRET_CODE, } from "./runtime/secrets.js";
 export { createUnsupportedProviderRuntimeState, UnsupportedProviderStateError, } from "./runtime/state.js";
 export { createStealthClient } from "./runtime/stealth.js";
@@ -39,7 +40,7 @@ export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SEN
 export { createServerApp, ERROR_OBSERVABILITY_HEADER, type ServeOptions, serve, } from "./server/index.js";
 export { getStealthProfile, listStealthProfiles } from "./stealth/profiles.js";
 export * from "./stream.js";
-export type { ApiFuseResponse, AuthConfig, AuthContext, AuthFlowDefinition, AuthFlowInputHandler, AuthFlowStartHandler, AuthMode, AuthTurn, Bcp47Locale, BrowserEngine, BrowserOptions, BrowserResourceBody, BrowserResourceDecision, BrowserResourceMethod, BrowserResourcePolicy, BrowserResourceRequest, BrowserResourceRoute, ConnectionMode, ContextDeclaration, CookieJar, ContextScratchpad, CredentialContext, CredentialDeclaration, E164PhoneNumber, EnvContext, FlowContext, FlowContextStore, HealthCheckAssertionContext, HealthCheckCase, HealthCheckCaseResult, HealthCheckSuite, HealthCheckUnsupported, HealthJourneyDefinition, HealthJourneyEventContext, HealthJourneyGatewayContext, HealthJourneyJournalContext, HealthJourneyManualTriggerPolicy, HealthJourneyRunContext, HealthJourneyRunResult, HealthJourneySchedule, HealthScheduleRandomization, HealthJourneySmsContext, HealthJourneyStep, HttpClient, HttpMethod, HttpRedirectFailureReason, HttpRedirectPolicy, HttpRedirectPolicyMode, HttpResponse, HttpRetryOptions, HttpRetrySummary, HttpStreamResponse, IanaTimeZone, InferSchemaOutput, Iso3166Alpha2CountryCode, Iso4217CurrencyCode, Iso8601Duration, NativeContext, NativeNetworkClient, NativeNetworkCloseReason, NativeNetworkConnection, NativeNetworkConnectInput, NativeNetworkConnectOptions, NativeNetworkDynamicGrantOptions, NativeNetworkEgressGrant, NativeProviderConfig, NativeProviderContext, NativeProxyDrainHandler, NativeProxyEgressInfo, NativeProxyExpiringEvent, NativeProxyExpiringReason, NativeTcpDynamicEgressRule, NativeTcpEgressGrant, NativeTcpEgressRule, NativeTcpPortRange, NativeTcpTlsMode, NativeTlsConnectOptions, OcrCaptchaCandidate, OcrCaptchaOptions, OcrCaptchaResult, OcrContext, OcrImageInput, OcrRecognizeRequest, OcrResult, OcrWarning, OperationAnnotations, OperationApprovalPolicy, OperationContractMetadata, OperationDefinition, OperationDeprecationMetadata, OperationDocMeta, OperationErrorCode, ProviderErrorStatus, OperationHandlerResult, OperationInputExample, OperationLifecycle, OperationObservabilityConfig, OperationObservabilitySensitiveConfig, OperationRelationships, OperationRiskClass, OperationSensitivePath, OperationToolRouterMetadata, OperationTransport, OperationTransportKind, ProbeInterval, ProviderAccessConfig, ProviderAccessVisibility, ProviderCache, ProviderCacheGetOrSetOptions, ProviderCacheKeyOptions, ProviderCacheLookupMeta, ProviderCacheResponseMeta, ProviderCacheResult, ProviderChoiceBindingOptions, ProviderChoiceContext, ProviderChoiceIssueOptions, ProviderChoiceParseOptions, ProviderContext, ProviderDefinition, ProviderDeploymentOverrides, ProviderFileRef, ProviderFilesContext, ProviderHealthMonitorConfig, ProviderHealthProbeConfig, ProviderLocale, ProviderLocaleKey, ProviderLocaleKeyInput, ProviderLogoProfile, ProviderLogoSource, ProviderMeta, ProviderOcrConfig, ProviderProxyConfig, ProviderProxyMode, ProviderProxyPolicy, ProxiedOAuthConfig, ProviderProxyProvider, ProviderProxySessionAffinity, ProviderPublicConnectionMode, ProviderPublicProfile, ProviderReviewed, ProviderResolvedFile, ProviderRuntimeState, ProviderSecretDeclaration, ProviderStateDurationString, ProviderStateNamespace, ProviderStreamEvent, ProviderSttConfig, ProviderSttMode, ProviderSupportLevel, RequestOptions, RedirectRunReason, Rfc3339Instant, SchemaLike, SmsOrigin, SmsOtpExtractionPattern, SmsOtpMatcherDefinition, SseMessage, StandardSchemaV1, StateCasResult, StateNamespaceOptions, StateValue, StateWriteOptions, StealthClient, StealthCookieStore, StealthCookieStoreV1, StealthFetchOptions, StealthPlatform, StealthProfile, StealthRedirectHop, StealthRedirectRunOptions, StealthRedirectRunResult, StealthResponse, StealthSession, StealthSessionCookies, SttAudioInput, SttContext, SttPromptPolicy, SttSegment, SttTranscribeMode, SttTranscribeRequest, SttTranscript, SttUnsupportedOptionPolicy, SttUsage, SttVerificationCodeOptions, SttWarning, TraceConfig, TraceSpan, VerificationCodeCandidate, VerificationCodeCandidateSource, VerificationCodeExtractionResult, } from "./types.js";
+export type { ApiFuseResponse, AuthConfig, AuthContext, AuthFlowDefinition, AuthFlowInputHandler, AuthFlowStartHandler, AuthMode, AuthTurn, Bcp47Locale, BrowserCookie, BrowserEngine, BrowserOptions, BrowserResourceBody, BrowserResourceDecision, BrowserResourceMethod, BrowserResourcePolicy, BrowserResourceRequest, BrowserResourceRoute, ChallengeSolution, ConnectionMode, ContextDeclaration, CookieJar, ContextScratchpad, CredentialContext, CredentialDeclaration, E164PhoneNumber, EnvContext, FlowContext, FlowContextStore, HealthCheckAssertionContext, HealthCheckCase, HealthCheckCaseResult, HealthCheckSuite, HealthCheckUnsupported, HealthJourneyDefinition, HealthJourneyEventContext, HealthJourneyGatewayContext, HealthJourneyJournalContext, HealthJourneyManualTriggerPolicy, HealthJourneyRunContext, HealthJourneyRunResult, HealthJourneySchedule, HealthScheduleRandomization, HealthJourneySmsContext, HealthJourneyStep, HttpClient, HttpMethod, HttpRedirectFailureReason, HttpRedirectPolicy, HttpRedirectPolicyMode, HttpResponse, HttpRetryOptions, HttpRetrySummary, HttpStreamResponse, IanaTimeZone, InferSchemaOutput, Iso3166Alpha2CountryCode, Iso4217CurrencyCode, Iso8601Duration, NativeContext, NativeNetworkClient, NativeNetworkCloseReason, NativeNetworkConnection, NativeNetworkConnectInput, NativeNetworkConnectOptions, NativeNetworkDynamicGrantOptions, NativeNetworkEgressGrant, NativeProviderConfig, NativeProviderContext, NativeProxyDrainHandler, NativeProxyEgressInfo, NativeProxyExpiringEvent, NativeProxyExpiringReason, NativeTcpDynamicEgressRule, NativeTcpEgressGrant, NativeTcpEgressRule, NativeTcpPortRange, NativeTcpTlsMode, NativeTlsConnectOptions, OcrCaptchaCandidate, OcrCaptchaOptions, OcrCaptchaResult, OcrContext, OcrImageInput, OcrRecognizeRequest, OcrResult, OcrWarning, OperationAnnotations, OperationApprovalPolicy, OperationContractMetadata, OperationDefinition, OperationDeprecationMetadata, OperationDocMeta, OperationErrorCode, ProviderErrorStatus, OperationHandlerResult, OperationInputExample, OperationLifecycle, OperationObservabilityConfig, OperationObservabilitySensitiveConfig, OperationRelationships, OperationRiskClass, OperationSensitivePath, OperationToolRouterMetadata, OperationTransport, OperationTransportKind, ProbeInterval, ProviderAccessConfig, ProviderAccessVisibility, ProviderCache, ProviderCacheGetOrSetOptions, ProviderCacheKeyOptions, ProviderCacheLookupMeta, ProviderCacheResponseMeta, ProviderCacheResult, ProviderChoiceBindingOptions, ProviderChoiceContext, ProviderChoiceIssueOptions, ProviderChoiceParseOptions, ProviderChallenge, ProviderChallengeKind, ProviderContext, ProviderDefinition, ProviderDeploymentOverrides, ProviderFileRef, ProviderFilesContext, ProviderHealthMonitorConfig, ProviderHealthProbeConfig, ProviderLocale, ProviderLocaleKey, ProviderLocaleKeyInput, ProviderLogoProfile, ProviderLogoSource, ProviderMeta, ProviderOcrConfig, ProviderProxyConfig, ProviderProxyMode, ProviderProxyPolicy, ProxiedOAuthConfig, ProviderProxyProvider, ProviderProxySessionAffinity, ProviderPublicConnectionMode, ProviderPublicProfile, ProviderReviewed, ProviderResolvedFile, ProviderResolverConfig, ProviderResolverVendor, ProviderRuntimeState, ProviderSecretDeclaration, ProviderStateDurationString, ProviderStateNamespace, ProviderStreamEvent, ProviderSttConfig, ProviderSttMode, ProviderSupportLevel, RequestOptions, RedirectRunReason, ResolverContext, Rfc3339Instant, SchemaLike, SmsOrigin, SmsOtpExtractionPattern, SmsOtpMatcherDefinition, SseMessage, StandardSchemaV1, StateCasResult, StateNamespaceOptions, StateNamespaceScope, StateValue, StateWriteOptions, StealthClient, StealthCookieStore, StealthCookieStoreV1, StealthFetchOptions, StealthPlatform, StealthProfile, StealthRedirectHop, StealthRedirectRunOptions, StealthRedirectRunResult, StealthResponse, StealthSession, StealthSessionCookies, SttAudioInput, SttContext, SttPromptPolicy, SttSegment, SttTranscribeMode, SttTranscribeRequest, SttTranscript, SttUnsupportedOptionPolicy, SttUsage, SttVerificationCodeOptions, SttWarning, TraceConfig, TraceSpan, VerificationCodeCandidate, VerificationCodeCandidateSource, VerificationCodeExtractionResult, } from "./types.js";
 export { DEFAULT_OPERATION_TRANSPORT, HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, PROBE_INTERVALS, STREAM_CHUNK_BYTES_MAX, STREAM_CHUNK_BYTES_MIN, STREAM_HEARTBEAT_MS_MAX, STREAM_HEARTBEAT_MS_MIN, STREAM_IDLE_TIMEOUT_MS_MAX, STREAM_IDLE_TIMEOUT_MS_MIN, STREAM_MAX_DURATION_MS_MAX, STREAM_MAX_DURATION_MS_MIN, } from "./types.js";
 export * from "./utils/date.js";
 export * from "./utils/parse.js";

package/dist/index.js

@@ -26,6 +26,7 @@ export { generateInsights } from "./runtime/insights.js";
 export { wrapWithInstrumentation, } from "./runtime/instrumentation.js";
 export { prevalidate } from "./runtime/prevalidate.js";
 export { getProviderBaseUrl } from "./runtime/provider.js";
+export { APIFUSE__CDP_POOL__URL, APIFUSE__RESOLVER__2CAPTCHA__API_KEY, APIFUSE__RESOLVER__CAPMONSTER__API_KEY, APIFUSE__RESOLVER__CAPSOLVER__API_KEY, APIFUSE__RESOLVER__TIMEOUT_MS, createResolverClientFromEnv, createUnsupportedResolverClient, DEFAULT_RESOLVER_TIMEOUT_MS, invalidateResolverSolution, } from "./runtime/resolver.js";
 export { assertRequiredSecretsPresent, listMissingRequiredSecrets, MISSING_SECRET_CODE, } from "./runtime/secrets.js";
 export { createUnsupportedProviderRuntimeState, UnsupportedProviderStateError, } from "./runtime/state.js";
 export { createStealthClient } from "./runtime/stealth.js";

package/dist/provider.d.ts

@@ -7,6 +7,6 @@ export { AuthError, HttpRedirectError, isProviderError, isSessionExpiredError, i
 export { getProviderLocalePath, providerLocaleKey, qualifyProviderLocaleKey, } from "./i18n/index.js";
 export { type CreateProviderChoiceContextOptions, createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice.js";
 export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, type SensitiveFieldKind, type SensitiveFieldOptions, type SensitivePath, sensitive, z, } from "./schema.js";
-export type { AuthAbortData, AuthAbortRetry, AuthFlowTerminalContext, AuthMode, AuthSafeData, AuthSafeJson, FlowContext, HealthCheckAssertionContext, HealthCheckCase, HealthCheckSuite, HealthCheckUnsupported, HealthJourneyDefinition, HealthJourneyEventContext, HealthJourneyManualTriggerPolicy, HealthJourneyRunContext, HealthJourneyRunResult, HealthScheduleRandomization, HttpRedirectFailureReason, HttpRedirectPolicy, HttpRedirectPolicyMode, HttpRetryOptions, HttpRetrySummary, InferSchemaOutput, NativeContext, NativeNetworkClient, NativeNetworkCloseReason, NativeNetworkConnection, NativeNetworkConnectInput, NativeNetworkConnectOptions, NativeNetworkDynamicGrantOptions, NativeNetworkEgressGrant, NativeProviderConfig, NativeProviderContext, NativeProxyDrainHandler, NativeProxyEgressInfo, NativeProxyExpiringEvent, NativeProxyExpiringReason, NativeTcpDynamicEgressRule, NativeTcpEgressGrant, NativeTcpEgressRule, NativeTcpPortRange, NativeTcpTlsMode, NativeTlsConnectOptions, OperationApprovalPolicy, OperationContractMetadata, OperationDefinition, OperationDocMeta, OperationErrorCode, ProviderErrorStatus, OperationInputExample, OperationLifecycle, OperationObservabilityConfig, OperationObservabilitySensitiveConfig, OperationRelationships, OperationRiskClass, OperationSensitivePath, OperationToolRouterMetadata, OperationTransport, ProviderAccessVisibility, ProviderChoiceBindingOptions, ProviderChoiceContext, ProviderChoiceIssueOptions, ProviderChoiceParseOptions, ProviderContext, ProviderDefinition, ProviderDeploymentOverrides, ProviderFileRef, ProviderFilesContext, ProviderLocale, ProviderLocaleKey, ProviderLocaleKeyInput, ProviderLogoProfile, ProviderProxyPolicy, ProxiedOAuthConfig, ProviderPublicConnectionMode, ProviderPublicProfile, ProviderResolvedFile, ProviderRuntimeState, ProviderStateDurationString, ProviderStateNamespace, ProviderSupportLevel, RedirectRunReason, SchemaLike, SmsOtpMatcherDefinition, StandardSchemaV1, StateCasResult, StateNamespaceOptions, StateValue, StateWriteOptions, } from "./types.js";
+export type { AuthAbortData, AuthAbortRetry, AuthFlowTerminalContext, AuthMode, AuthSafeData, AuthSafeJson, FlowContext, HealthCheckAssertionContext, HealthCheckCase, HealthCheckSuite, HealthCheckUnsupported, HealthJourneyDefinition, HealthJourneyEventContext, HealthJourneyManualTriggerPolicy, HealthJourneyRunContext, HealthJourneyRunResult, HealthScheduleRandomization, HttpRedirectFailureReason, HttpRedirectPolicy, HttpRedirectPolicyMode, HttpRetryOptions, HttpRetrySummary, InferSchemaOutput, NativeContext, NativeNetworkClient, NativeNetworkCloseReason, NativeNetworkConnection, NativeNetworkConnectInput, NativeNetworkConnectOptions, NativeNetworkDynamicGrantOptions, NativeNetworkEgressGrant, NativeProviderConfig, NativeProviderContext, NativeProxyDrainHandler, NativeProxyEgressInfo, NativeProxyExpiringEvent, NativeProxyExpiringReason, NativeTcpDynamicEgressRule, NativeTcpEgressGrant, NativeTcpEgressRule, NativeTcpPortRange, NativeTcpTlsMode, NativeTlsConnectOptions, OperationApprovalPolicy, OperationContractMetadata, OperationDefinition, OperationDocMeta, OperationErrorCode, ProviderErrorStatus, OperationInputExample, OperationLifecycle, OperationObservabilityConfig, OperationObservabilitySensitiveConfig, OperationRelationships, OperationRiskClass, OperationSensitivePath, OperationToolRouterMetadata, OperationTransport, ProviderAccessVisibility, ProviderChoiceBindingOptions, ProviderChoiceContext, ProviderChoiceIssueOptions, ProviderChoiceParseOptions, ProviderContext, ProviderDefinition, ProviderDeploymentOverrides, ProviderFileRef, ProviderFilesContext, ProviderLocale, ProviderLocaleKey, ProviderLocaleKeyInput, ProviderLogoProfile, ProviderProxyPolicy, ProxiedOAuthConfig, ProviderPublicConnectionMode, ProviderPublicProfile, ProviderResolvedFile, ProviderRuntimeState, ProviderStateDurationString, ProviderStateNamespace, ProviderSupportLevel, RedirectRunReason, SchemaLike, SmsOtpMatcherDefinition, StandardSchemaV1, StateCasResult, StateNamespaceOptions, StateNamespaceScope, StateValue, StateWriteOptions, } from "./types.js";
 export { createNativeNetworkClient, createEnvVendorCredentialResolver, deriveNativeCredentialAffinityKey, NativeEgressGrantExpiredError, NativeEgressNotDeclaredError, NativeIdleTimeoutError, NativeNetworkError, NativeProxyExpiredError, resolveNativeGatewayProxy, type NativeGatewayProxy, type NativeGatewayProxyResolutionInput, type NativeGatewayProxySkipReason, type NativeGatewayProxySynthesizer, type NativeGatewayProxySynthesisResult, type NativeGatewayProxySynthesisInput, type NativeNetworkClientOptions, type NativeNetworkErrorCode, type VendorCredentialLookup, type VendorCredentialResolver, } from "./runtime/native-network.js";
 export { HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, } from "./types.js";

package/dist/runtime/auth-flow.js

@@ -1,6 +1,7 @@
 import { ContextAccessError } from "../errors.js";
 import { createAuthFlowHelpers } from "../auth.js";
 import { createUnsupportedOcrClient } from "./ocr.js";
+import { createUnsupportedResolverClient } from "./resolver.js";
 import { createUnsupportedSttClient } from "./stt.js";
 function normalizeAllowedKeys(allowedKeys) {
     return new Set(allowedKeys.filter((key) => key.trim().length > 0));
@@ -44,6 +45,7 @@ export function createFlowContext(options) {
         context: createScratchpad(options.allowedKeys, options.initialContext),
         ocr: options.ocr ?? createUnsupportedOcrClient(),
         stt: options.stt ?? createUnsupportedSttClient(),
+        resolver: createUnsupportedResolverClient("Resolver is not available in auth flow context"),
         auth: createAuthFlowHelpers(),
     };
 }

package/dist/runtime/browser.js

@@ -357,6 +357,9 @@ class PlaywrightBrowserPage {
     async close() {
         await this.page.close();
     }
+    async cookies() {
+        return (await this.page.context().cookies()).map(toBrowserCookie);
+    }
     async withResourcePolicy(policy, run) {
         const allowedMethods = new Set(policy.allowedMethods ?? DEFAULT_RESOURCE_METHODS);
         const handler = async (route) => {
@@ -586,6 +589,48 @@ function flattenCdpFrameTree(node, out = []) {
 function isRecord(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }
+function isBrowserCookieSameSite(value) {
+    return value === "Strict" || value === "Lax" || value === "None";
+}
+function toBrowserCookie(cookie) {
+    return {
+        name: cookie.name,
+        value: cookie.value,
+        domain: cookie.domain,
+        path: cookie.path,
+        ...(cookie.expires !== undefined && cookie.expires > 0 ? { expires: cookie.expires } : {}),
+        httpOnly: cookie.httpOnly,
+        secure: cookie.secure,
+        ...(isBrowserCookieSameSite(cookie.sameSite) ? { sameSite: cookie.sameSite } : {}),
+    };
+}
+function parseCdpCookies(value) {
+    if (!Array.isArray(value)) {
+        throw new Error("CDP Network.getCookies returned an invalid cookie list");
+    }
+    return value.map((cookie) => {
+        if (!isRecord(cookie) ||
+            typeof cookie.name !== "string" ||
+            typeof cookie.value !== "string" ||
+            typeof cookie.domain !== "string" ||
+            typeof cookie.path !== "string" ||
+            typeof cookie.expires !== "number" ||
+            typeof cookie.httpOnly !== "boolean" ||
+            typeof cookie.secure !== "boolean") {
+            throw new Error("CDP Network.getCookies returned an invalid cookie");
+        }
+        return toBrowserCookie({
+            name: cookie.name,
+            value: cookie.value,
+            domain: cookie.domain,
+            path: cookie.path,
+            expires: cookie.expires,
+            httpOnly: cookie.httpOnly,
+            secure: cookie.secure,
+            sameSite: cookie.sameSite,
+        });
+    });
+}
 function parsePoolAcquireResponse(value) {
     if (!isRecord(value) ||
         typeof value.pageId !== "string" ||
@@ -864,6 +909,11 @@ class CdpPoolBrowserPage {
         });
         return Buffer.from(String(result.data ?? ""), "base64");
     }
+    async cookies() {
+        await this.initialize();
+        const result = await this.pageClient.send("Network.getCookies");
+        return parseCdpCookies(result.cookies);
+    }
     async close() {
         if (this.closed) {
             return;

package/dist/runtime/http.js

@@ -376,7 +376,6 @@ async function resolveNativeProxy(options, clientOptions, warn, proxyAttemptOffs
     const resolvedProxy = await resolveProxyConfigAsync({
         proxy: options.proxy ?? clientOptions.proxy,
         upstream: clientOptions.upstream,
-        apifuseConfig: clientOptions.apifuseConfig,
         proxyPolicy: clientOptions.proxyPolicy,
         affinityKey: clientOptions.affinityKey,
         proxyAttempt: computeProxyAttemptIndex({

package/dist/runtime/instrumentation.js

@@ -1,6 +1,7 @@
 import { readableBytes, readableLines, readableTextChunks } from "../stream.js";
 import { parseHttpRequestInvocation, isSensitiveKey, redactSensitiveError, redactSensitiveText, redactUrlQueryParams, requestOptionsFromHttpInvocation, serializeRequestUrl, } from "./request-options.js";
 import { createTraceContext, getTraceRecorder, } from "./trace.js";
+import { RESOLVER_INSTRUMENTATION_METADATA } from "./resolver.js";
 const BROWSER_PAGE_METHODS = new Set(["goto", "fill", "click", "type", "waitForSelector"]);
 const DIAGNOSTIC_BASE_URL = "http://apifuse-instrumentation.invalid";
 function isThenable(value) {
@@ -420,12 +421,35 @@ function wrapNamespace(namespace, target, trace, shouldInstrument) {
         return target;
     }
     const wrappedMethods = new Map();
+    const resolverMetadata = namespace === "resolver" ? { target, traceRecorder: recorder } : undefined;
     return new Proxy(target, {
         get(namespaceTarget, property, receiver) {
+            if (property === RESOLVER_INSTRUMENTATION_METADATA && resolverMetadata) {
+                return resolverMetadata;
+            }
             const value = Reflect.get(namespaceTarget, property, receiver);
             if (typeof value !== "function" || property === "constructor") {
                 return value;
             }
+            if (namespace === "resolver" && property === "solve") {
+                if (wrappedMethods.has(property)) {
+                    return wrappedMethods.get(property);
+                }
+                const wrapped = (...args) => {
+                    const challenge = args[0];
+                    const challengeKind = typeof challenge === "object" &&
+                        challenge !== null &&
+                        "kind" in challenge &&
+                        typeof challenge.kind === "string"
+                        ? challenge.kind
+                        : undefined;
+                    return recorder.runSpan("resolver.solve", () => Reflect.apply(value, namespaceTarget, [args[0], args[1], recorder]), {
+                        attributes: challengeKind ? { challenge_kind: challengeKind } : undefined,
+                    });
+                };
+                wrappedMethods.set(property, wrapped);
+                return wrapped;
+            }
             if (namespace === "browser" && property === "newPage") {
                 if (wrappedMethods.has(property)) {
                     return wrappedMethods.get(property);
@@ -573,7 +597,8 @@ export function wrapWithInstrumentation(ctx, options = {}) {
                 property === "stealth" ||
                 property === "browser" ||
                 property === "session" ||
-                property === "state") {
+                property === "state" ||
+                property === "resolver") {
                 const namespace = property;
                 if (wrappedTargets.has(namespace)) {
                     return wrappedTargets.get(namespace);

package/dist/runtime/resolver-vendors/bindings.d.ts

@@ -0,0 +1,8 @@
+import type { ProviderChallenge } from "../../types.js";
+import type { ResolverIssuingIdentity } from "./types.js";
+export declare const RESOLVER_CHALLENGE_BINDINGS: {
+    readonly aws_waf: "portable";
+    readonly cloudflare_interstitial: "identity_scoped";
+};
+export declare function resolverChallengeIsIdentityScoped(challenge: ProviderChallenge): boolean;
+export declare function resolverChallengeIssuingIdentity(challenge: ProviderChallenge, identity: ResolverIssuingIdentity): ResolverIssuingIdentity;

package/dist/runtime/resolver-vendors/bindings.js

@@ -0,0 +1,15 @@
+export const RESOLVER_CHALLENGE_BINDINGS = {
+    aws_waf: "portable",
+    cloudflare_interstitial: "identity_scoped",
+};
+export function resolverChallengeIsIdentityScoped(challenge) {
+    return (RESOLVER_CHALLENGE_BINDINGS[challenge.kind] ===
+        "identity_scoped");
+}
+export function resolverChallengeIssuingIdentity(challenge, identity) {
+    const binding = RESOLVER_CHALLENGE_BINDINGS[challenge.kind];
+    if (binding === "portable") {
+        return { userAgent: identity.userAgent };
+    }
+    return identity;
+}

package/dist/runtime/resolver-vendors/browser.d.ts

@@ -0,0 +1,24 @@
+import type { BrowserClient, ChallengeSolution, ProviderChallenge } from "../../types.js";
+import { type BrowserClientOptions } from "../browser.js";
+import type { TraceRecorder } from "../trace.js";
+import { type ResolverIdentity, type ResolverVendorAdapter } from "./types.js";
+type BrowserClientFactory = (options: BrowserClientOptions) => BrowserClient;
+export interface BrowserResolverVendorOptions {
+    readonly cdpUrl?: string;
+    readonly timeoutMs: number;
+    readonly pollIntervalMs?: number;
+    readonly allowedHosts: readonly string[];
+    readonly createClient?: BrowserClientFactory;
+}
+export type BrowserResolverSolution = Extract<ChallengeSolution, {
+    readonly form: "cookies";
+}> & {
+    /** Unix seconds from the cookie that proved the challenge cleared. */
+    readonly expires?: number;
+};
+export interface BrowserResolverVendorAdapter extends ResolverVendorAdapter {
+    readonly id: "browser";
+    solve(challenge: ProviderChallenge, identity: ResolverIdentity | undefined, signal: AbortSignal, traceRecorder?: TraceRecorder): Promise<BrowserResolverSolution>;
+}
+export declare function createBrowserResolverVendorAdapter(options: BrowserResolverVendorOptions): BrowserResolverVendorAdapter;
+export {};