@apifuse/provider-sdk 2.2.0-beta.23 → 2.2.0-beta.24

package/src/define.ts

@@ -20,21 +20,24 @@ import type {
 	HealthJourneySchedule,
 	HealthScheduleRandomization,
 	InferSchemaOutput,
+	NativeProviderConfig,
 	OperationDefinition,
 	OperationHandlerResult,
 	OperationHttpStreamTransport,
 	OperationSseTransport,
 	OperationTransport,
 	OperationWebSocketTransport,
-	NativeProviderConfig,
-	ProviderOcrConfig,
 	ProviderAccessConfig,
+	ProviderChallengeKind,
 	ProviderDefinition,
+	ProviderOcrConfig,
 	ProviderDeploymentOverrides,
 	ProviderHealthMonitorConfig,
 	ProviderProxyConfig,
 	ProviderProxyProvider,
 	ProviderPublicProfile,
+	ProviderResolverConfig,
+	ProviderResolverVendor,
 	ProviderReviewed,
 	ProviderSecretDeclaration,
 	ProviderStreamEvent,
@@ -126,6 +129,30 @@ const VALID_PROVIDER_PROXY_AFFINITIES = [
 ] as const;
 const VALID_PROVIDER_OCR_MODES = ["optional", "required"] as const;
 const VALID_PROVIDER_STT_MODES = ["optional", "required"] as const;
+function exhaustiveLiteralArray<TUnion extends string>() {
+	return <const TValues extends readonly TUnion[]>(
+		values: TValues,
+		..._missing: Exclude<TUnion, TValues[number]> extends never
+			? []
+			: ["Missing runtime values", Exclude<TUnion, TValues[number]>]
+	): TValues => values;
+}
+
+export const VALID_PROVIDER_RESOLVER_VENDORS = exhaustiveLiteralArray<ProviderResolverVendor>()([
+	"browser",
+	"capsolver",
+	"capmonster",
+	"2captcha",
+	"custom",
+] as const);
+export const VALID_PROVIDER_CHALLENGE_KINDS = exhaustiveLiteralArray<ProviderChallengeKind>()([
+	"turnstile",
+	"recaptcha_v2",
+	"recaptcha_v3",
+	"hcaptcha",
+	"cloudflare_interstitial",
+	"aws_waf",
+] as const);
 const SMARTPROXY_APP_KEY_SECRET = "APIFUSE__PROXY__SMARTPROXY_APP_KEY";
 const NODEMAVEN_USERNAME_SECRET = "APIFUSE__PROXY__NODEMAVEN_USERNAME";
 const NODEMAVEN_PASSWORD_SECRET = "APIFUSE__PROXY__NODEMAVEN_PASSWORD";
@@ -134,9 +161,8 @@ const NODEMAVEN_PASSWORD_SECRET = "APIFUSE__PROXY__NODEMAVEN_PASSWORD";
 // credential fails at build/validation time rather than during a live outage: a
 // declared-but-uncredentialed fallback leg is a silently dead SPOF, which is
 // exactly the failure class the multi-vendor chain exists to remove. Vendors
-// absent from this map (e.g. `custom`/`decodo`, whose credentials come from the
-// `APIFUSE__PROXY__URL` bring-your-own escape hatch, not provider secrets) impose
-// no declaration requirement.
+// absent from this map (the deprecated `custom`/`decodo` values have no managed
+// adapter) impose no declaration requirement.
 const VENDOR_REQUIRED_SECRETS: Partial<Record<ProviderProxyProvider, readonly string[]>> = {
 	smartproxy: [SMARTPROXY_APP_KEY_SECRET],
 	nodemaven: [NODEMAVEN_USERNAME_SECRET, NODEMAVEN_PASSWORD_SECRET],
@@ -252,6 +278,7 @@ export interface ProviderConfig<TOperations extends Record<string, ProviderOpera
 	proxy?: ProviderProxyConfig;
 	ocr?: ProviderOcrConfig;
 	stt?: ProviderSttConfig;
+	resolver?: ProviderResolverConfig;
 	browser?: { engine: BrowserEngine };
 	auth?: AuthConfig;
 	reviewed?: ProviderReviewed;
@@ -681,9 +708,21 @@ function validateProviderProxy(config: {
 	const deprecatedVendors = vendorChain.filter(
 		(vendor) => vendor === "decodo" || vendor === "custom",
 	);
+	if (
+		proxy.mode === "required" &&
+		vendorChain.length > 0 &&
+		deprecatedVendors.length === vendorChain.length
+	) {
+		throw new ValidationError(
+			`Provider "${config.id}" requires proxy egress but declares only deprecated proxy vendor(s): ${deprecatedVendors.join(", ")}.`,
+			{
+				fix: `Use proxy.provider or proxy.providers with "smartproxy" and/or "nodemaven".`,
+			},
+		);
+	}
 	if (deprecatedVendors.length > 0) {
 		console.warn(
-			`[provider-sdk] Provider "${config.id}" uses deprecated proxy vendor(s): ${deprecatedVendors.join(", ")}. Use "smartproxy"/"nodemaven", or the APIFUSE__PROXY__URL bring-your-own escape hatch.`,
+			`[provider-sdk] Provider "${config.id}" uses deprecated proxy vendor(s): ${deprecatedVendors.join(", ")}. Use "smartproxy"/"nodemaven".`,
 		);
 	}
 }
@@ -712,6 +751,53 @@ function validateProviderOcr(config: { id: string; ocr?: ProviderOcrConfig }): v
 	assertLiteralField(ocr.mode, "ocr.mode", VALID_PROVIDER_OCR_MODES, config.id);
 }
 
+function validateProviderResolver(config: { id: string; resolver?: ProviderResolverConfig }): void {
+	const resolver = config.resolver;
+	if (resolver === undefined) return;
+	if (!resolver || typeof resolver !== "object" || Array.isArray(resolver)) {
+		throw new ValidationError(`Provider "${config.id}" has invalid resolver: must be an object.`, {
+			fix: `Set resolver for provider "${config.id}" to { vendors: ["2captcha"], kinds: ["turnstile"] }.`,
+		});
+	}
+	rejectUnknownFields(resolver, new Set(["vendors", "kinds"]), "resolver", config.id);
+	validateResolverLiteralArray(
+		resolver.vendors,
+		"resolver.vendors",
+		VALID_PROVIDER_RESOLVER_VENDORS,
+		config.id,
+	);
+	validateResolverLiteralArray(
+		resolver.kinds,
+		"resolver.kinds",
+		VALID_PROVIDER_CHALLENGE_KINDS,
+		config.id,
+	);
+}
+
+function validateResolverLiteralArray<TValue extends string>(
+	value: readonly TValue[],
+	field: string,
+	validValues: readonly TValue[],
+	providerId: string,
+): void {
+	if (!Array.isArray(value)) {
+		throw new ValidationError(`Provider "${providerId}" has invalid ${field}: must be an array.`, {
+			fix: `Set ${field} for provider "${providerId}" to an array containing only: ${validValues.join(", ")}.`,
+		});
+	}
+	for (const [index, item] of value.entries()) {
+		if (typeof item === "string" && validValues.some((validValue) => validValue === item)) {
+			continue;
+		}
+		throw new ValidationError(
+			`Provider "${providerId}" has invalid ${field}[${index}]: ${JSON.stringify(item)}. Expected one of: ${validValues.join(", ")}`,
+			{
+				fix: `Set ${field}[${index}] for provider "${providerId}" to one of ${validValues.map((validValue) => `"${validValue}"`).join(", ")}.`,
+			},
+		);
+	}
+}
+
 function validateOperationIds(
 	providerId: string,
 	operations: Record<string, ProviderOperation>,
@@ -1309,7 +1395,12 @@ function suggestField(unknown: string, candidates: ReadonlySet<string>): string
 	return best;
 }
 
-function rejectUnknownFields(value: object, allowed: ReadonlySet<string>, fieldPath: string): void {
+function rejectUnknownFields(
+	value: object,
+	allowed: ReadonlySet<string>,
+	fieldPath: string,
+	providerId?: string,
+): void {
 	for (const key of Object.keys(value)) {
 		if (allowed.has(key)) continue;
 		const hint = suggestField(key, allowed);
@@ -1317,7 +1408,11 @@ function rejectUnknownFields(value: object, allowed: ReadonlySet<string>, fieldP
 			hint
 				? `Unknown field "${key}" on ${fieldPath}. Did you mean "${hint}"?`
 				: `Unknown field "${key}" on ${fieldPath}.`,
-			{ fix: `Remove ${fieldPath}.${key} or rename it.` },
+			{
+				fix: providerId
+					? `Remove ${fieldPath}.${key} from provider "${providerId}" or rename it.`
+					: `Remove ${fieldPath}.${key} or rename it.`,
+			},
 		);
 	}
 }
@@ -2403,6 +2498,7 @@ export function defineProvider<
 	validateProviderProxy(config);
 	validateProviderOcr(config);
 	validateProviderStt(config);
+	validateProviderResolver(config);
 	if (config.runtime === "browser" && !config.browser)
 		throw new ProviderError(
 			`Provider "${config.id}" must define browser.engine when runtime is "browser"`,
@@ -2428,6 +2524,7 @@ export function defineProvider<
 		proxy: config.proxy,
 		ocr: config.ocr,
 		stt: config.stt,
+		resolver: config.resolver,
 		browser: config.browser,
 		auth: config.auth,
 		reviewed: config.reviewed,

package/src/index.ts

@@ -6,7 +6,6 @@ export * from "./choice-token.js";
 export type {
 	ApiFuseConfig,
 	BrowserConfig,
-	ProxyConfig,
 	ProxyProtocol,
 	ProxyResolutionOptions,
 	ProxyResolutionSource,
@@ -101,6 +100,18 @@ export {
 } from "./runtime/instrumentation.js";
 export { type PrevalidateResult, prevalidate } from "./runtime/prevalidate.js";
 export { getProviderBaseUrl } from "./runtime/provider.js";
+export {
+	APIFUSE__CDP_POOL__URL,
+	APIFUSE__RESOLVER__2CAPTCHA__API_KEY,
+	APIFUSE__RESOLVER__CAPMONSTER__API_KEY,
+	APIFUSE__RESOLVER__CAPSOLVER__API_KEY,
+	APIFUSE__RESOLVER__TIMEOUT_MS,
+	createResolverClientFromEnv,
+	createUnsupportedResolverClient,
+	DEFAULT_RESOLVER_TIMEOUT_MS,
+	invalidateResolverSolution,
+	type ResolverRuntimeOptions,
+} from "./runtime/resolver.js";
 export {
 	assertRequiredSecretsPresent,
 	listMissingRequiredSecrets,
@@ -177,6 +188,7 @@ export type {
 	AuthMode,
 	AuthTurn,
 	Bcp47Locale,
+	BrowserCookie,
 	BrowserEngine,
 	BrowserOptions,
 	BrowserResourceBody,
@@ -185,6 +197,7 @@ export type {
 	BrowserResourcePolicy,
 	BrowserResourceRequest,
 	BrowserResourceRoute,
+	ChallengeSolution,
 	ConnectionMode,
 	ContextDeclaration,
 	CookieJar,
@@ -285,6 +298,8 @@ export type {
 	ProviderChoiceContext,
 	ProviderChoiceIssueOptions,
 	ProviderChoiceParseOptions,
+	ProviderChallenge,
+	ProviderChallengeKind,
 	ProviderContext,
 	ProviderDefinition,
 	ProviderDeploymentOverrides,
@@ -309,6 +324,8 @@ export type {
 	ProviderPublicProfile,
 	ProviderReviewed,
 	ProviderResolvedFile,
+	ProviderResolverConfig,
+	ProviderResolverVendor,
 	ProviderRuntimeState,
 	ProviderSecretDeclaration,
 	ProviderStateDurationString,
@@ -319,6 +336,7 @@ export type {
 	ProviderSupportLevel,
 	RequestOptions,
 	RedirectRunReason,
+	ResolverContext,
 	Rfc3339Instant,
 	SchemaLike,
 	SmsOrigin,
@@ -328,6 +346,7 @@ export type {
 	StandardSchemaV1,
 	StateCasResult,
 	StateNamespaceOptions,
+	StateNamespaceScope,
 	StateValue,
 	StateWriteOptions,
 	StealthClient,

package/src/provider.ts

@@ -162,6 +162,7 @@ export type {
 	StandardSchemaV1,
 	StateCasResult,
 	StateNamespaceOptions,
+	StateNamespaceScope,
 	StateValue,
 	StateWriteOptions,
 } from "./types.js";

package/src/runtime/auth-flow.ts

@@ -10,6 +10,7 @@ import type {
 	SttContext,
 } from "../types.js";
 import { createUnsupportedOcrClient } from "./ocr.js";
+import { createUnsupportedResolverClient } from "./resolver.js";
 import { createUnsupportedSttClient } from "./stt.js";
 
 function normalizeAllowedKeys(allowedKeys: string[]): Set<string> {
@@ -75,6 +76,7 @@ export function createFlowContext(options: {
 		context: createScratchpad(options.allowedKeys, options.initialContext),
 		ocr: options.ocr ?? createUnsupportedOcrClient(),
 		stt: options.stt ?? createUnsupportedSttClient(),
+		resolver: createUnsupportedResolverClient("Resolver is not available in auth flow context"),
 		auth: createAuthFlowHelpers(),
 	};
 }

package/src/runtime/browser.ts

@@ -6,6 +6,7 @@ import type {
 	BrowserChallengeRequest,
 	BrowserChallengeResult,
 	BrowserClient as BrowserClientContract,
+	BrowserCookie,
 	BrowserEngine,
 	BrowserFrame,
 	BrowserLocator,
@@ -545,6 +546,10 @@ class PlaywrightBrowserPage implements BrowserPageContract {
 		await this.page.close();
 	}
 
+	async cookies(): Promise<readonly BrowserCookie[]> {
+		return (await this.page.context().cookies()).map(toBrowserCookie);
+	}
+
 	async withResourcePolicy<T>(policy: BrowserResourcePolicy, run: () => Promise<T>): Promise<T> {
 		const allowedMethods = new Set(policy.allowedMethods ?? DEFAULT_RESOURCE_METHODS);
 		const handler = async (route: Route): Promise<void> => {
@@ -845,6 +850,64 @@ function isRecord(value: unknown): value is Record<string, unknown> {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
+function isBrowserCookieSameSite(value: unknown): value is BrowserCookie["sameSite"] {
+	return value === "Strict" || value === "Lax" || value === "None";
+}
+
+function toBrowserCookie(cookie: {
+	readonly name: string;
+	readonly value: string;
+	readonly domain: string;
+	readonly path: string;
+	readonly expires?: number;
+	readonly httpOnly: boolean;
+	readonly secure: boolean;
+	readonly sameSite?: unknown;
+}): BrowserCookie {
+	return {
+		name: cookie.name,
+		value: cookie.value,
+		domain: cookie.domain,
+		path: cookie.path,
+		...(cookie.expires !== undefined && cookie.expires > 0 ? { expires: cookie.expires } : {}),
+		httpOnly: cookie.httpOnly,
+		secure: cookie.secure,
+		...(isBrowserCookieSameSite(cookie.sameSite) ? { sameSite: cookie.sameSite } : {}),
+	};
+}
+
+function parseCdpCookies(value: unknown): readonly BrowserCookie[] {
+	if (!Array.isArray(value)) {
+		throw new Error("CDP Network.getCookies returned an invalid cookie list");
+	}
+
+	return value.map((cookie) => {
+		if (
+			!isRecord(cookie) ||
+			typeof cookie.name !== "string" ||
+			typeof cookie.value !== "string" ||
+			typeof cookie.domain !== "string" ||
+			typeof cookie.path !== "string" ||
+			typeof cookie.expires !== "number" ||
+			typeof cookie.httpOnly !== "boolean" ||
+			typeof cookie.secure !== "boolean"
+		) {
+			throw new Error("CDP Network.getCookies returned an invalid cookie");
+		}
+
+		return toBrowserCookie({
+			name: cookie.name,
+			value: cookie.value,
+			domain: cookie.domain,
+			path: cookie.path,
+			expires: cookie.expires,
+			httpOnly: cookie.httpOnly,
+			secure: cookie.secure,
+			sameSite: cookie.sameSite,
+		});
+	});
+}
+
 function parsePoolAcquireResponse(value: unknown): PoolAcquireResponse {
 	if (
 		!isRecord(value) ||
@@ -1200,6 +1263,12 @@ class CdpPoolBrowserPage implements BrowserPageContract {
 		return Buffer.from(String(result.data ?? ""), "base64");
 	}
 
+	async cookies(): Promise<readonly BrowserCookie[]> {
+		await this.initialize();
+		const result = await this.pageClient.send("Network.getCookies");
+		return parseCdpCookies(result.cookies);
+	}
+
 	async close(): Promise<void> {
 		if (this.closed) {
 			return;

package/src/runtime/http.ts

@@ -517,7 +517,6 @@ async function resolveNativeProxy(
 	const resolvedProxy = await resolveProxyConfigAsync({
 		proxy: options.proxy ?? clientOptions.proxy,
 		upstream: clientOptions.upstream,
-		apifuseConfig: clientOptions.apifuseConfig,
 		proxyPolicy: clientOptions.proxyPolicy,
 		affinityKey: clientOptions.affinityKey,
 		proxyAttempt: computeProxyAttemptIndex({

package/src/runtime/instrumentation.ts

@@ -23,6 +23,7 @@ import {
 	getTraceRecorder,
 	type TraceContext,
 } from "./trace.js";
+import { RESOLVER_INSTRUMENTATION_METADATA } from "./resolver.js";
 
 export interface InstrumentationOptions extends CreateTraceContextOptions {}
 
@@ -30,7 +31,7 @@ export type InstrumentedProviderContext<T extends ProviderContext> = Omit<T, "tr
 	trace: TraceContext;
 };
 
-type InstrumentedNamespace = "http" | "stealth" | "browser" | "session" | "state";
+type InstrumentedNamespace = "http" | "stealth" | "browser" | "session" | "state" | "resolver";
 
 const BROWSER_PAGE_METHODS = new Set(["goto", "fill", "click", "type", "waitForSelector"]);
 const DIAGNOSTIC_BASE_URL = "http://apifuse-instrumentation.invalid";
@@ -621,15 +622,47 @@ function wrapNamespace<T extends object>(
 	}
 
 	const wrappedMethods = new Map<PropertyKey, unknown>();
+	const resolverMetadata =
+		namespace === "resolver" ? { target, traceRecorder: recorder } : undefined;
 
 	return new Proxy(target, {
 		get(namespaceTarget, property, receiver) {
+			if (property === RESOLVER_INSTRUMENTATION_METADATA && resolverMetadata) {
+				return resolverMetadata;
+			}
 			const value = Reflect.get(namespaceTarget, property, receiver);
 
 			if (typeof value !== "function" || property === "constructor") {
 				return value;
 			}
 
+			if (namespace === "resolver" && property === "solve") {
+				if (wrappedMethods.has(property)) {
+					return wrappedMethods.get(property);
+				}
+
+				const wrapped = (...args: unknown[]) => {
+					const challenge = args[0];
+					const challengeKind =
+						typeof challenge === "object" &&
+						challenge !== null &&
+						"kind" in challenge &&
+						typeof challenge.kind === "string"
+							? challenge.kind
+							: undefined;
+					return recorder.runSpan(
+						"resolver.solve",
+						() => Reflect.apply(value, namespaceTarget, [args[0], args[1], recorder]),
+						{
+							attributes: challengeKind ? { challenge_kind: challengeKind } : undefined,
+						},
+					);
+				};
+
+				wrappedMethods.set(property, wrapped);
+				return wrapped;
+			}
+
 			if (namespace === "browser" && property === "newPage") {
 				if (wrappedMethods.has(property)) {
 					return wrappedMethods.get(property);
@@ -838,7 +871,8 @@ export function wrapWithInstrumentation<T extends ProviderContext>(
 				property === "stealth" ||
 				property === "browser" ||
 				property === "session" ||
-				property === "state"
+				property === "state" ||
+				property === "resolver"
 			) {
 				const namespace = property;
 				if (wrappedTargets.has(namespace)) {

package/src/runtime/resolver-vendors/bindings.ts

@@ -0,0 +1,31 @@
+import type { ProviderChallenge, ProviderChallengeKind } from "../../types.js";
+import type { ResolverIssuingIdentity } from "./types.js";
+
+export const RESOLVER_CHALLENGE_BINDINGS = {
+	aws_waf: "portable",
+	cloudflare_interstitial: "identity_scoped",
+} as const satisfies Partial<
+	Readonly<Record<ProviderChallengeKind, "identity_scoped" | "portable">>
+>;
+
+export function resolverChallengeIsIdentityScoped(challenge: ProviderChallenge): boolean {
+	return (
+		RESOLVER_CHALLENGE_BINDINGS[challenge.kind as keyof typeof RESOLVER_CHALLENGE_BINDINGS] ===
+		"identity_scoped"
+	);
+}
+
+export function resolverChallengeIssuingIdentity(
+	challenge: ProviderChallenge,
+	identity: ResolverIssuingIdentity,
+): ResolverIssuingIdentity {
+	const binding = (
+		RESOLVER_CHALLENGE_BINDINGS as Partial<
+			Readonly<Record<ProviderChallengeKind, "identity_scoped" | "portable">>
+		>
+	)[challenge.kind];
+	if (binding === "portable") {
+		return { userAgent: identity.userAgent };
+	}
+	return identity;
+}