@apifuse/provider-sdk 2.2.0-beta.25 → 2.2.0-beta.27

package/dist/index.d.ts

@@ -30,6 +30,7 @@ export { type InstrumentationOptions, type InstrumentedProviderContext, wrapWith
 export { type PrevalidateResult, prevalidate } from "./runtime/prevalidate.js";
 export { getProviderBaseUrl } from "./runtime/provider.js";
 export { APIFUSE__CDP_POOL__URL, APIFUSE__RESOLVER__2CAPTCHA__API_KEY, APIFUSE__RESOLVER__CAPMONSTER__API_KEY, APIFUSE__RESOLVER__CAPSOLVER__API_KEY, APIFUSE__RESOLVER__TIMEOUT_MS, createResolverClientFromEnv, createUnsupportedResolverClient, DEFAULT_RESOLVER_TIMEOUT_MS, invalidateResolverSolution, type ResolverRuntimeOptions, } from "./runtime/resolver.js";
+export type { ResolverVendorTransport } from "./runtime/resolver-vendors/types.js";
 export { assertRequiredSecretsPresent, listMissingRequiredSecrets, MISSING_SECRET_CODE, } from "./runtime/secrets.js";
 export { createUnsupportedProviderRuntimeState, UnsupportedProviderStateError, } from "./runtime/state.js";
 export { createStealthClient } from "./runtime/stealth.js";

package/dist/lint.js

@@ -1,7 +1,84 @@
 import { SDK_RUNTIME_OWNED_ERROR_CODES, SDK_STATUS_MAPPED_PROVIDER_ERROR_CODES, } from "./error-resolution.js";
 import { lintPublicSchemaFieldNames } from "./public-schema-field-lint.js";
 import { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_SENSITIVE_META_KEY } from "./schema.js";
+// Operations that perform an auth-lifecycle action belong on the single
+// `auth.flow` interface, never on a provider operation:
+//   - entry (login / signin / authenticate) => auth.flow.start/continue
+//   - exit  (logout / signout / disconnect) => auth.flow.abort
+//
+// Matching works on `-`/`_` separated segments rather than a raw substring or a
+// leading anchor, so `shop-logout`, `shop_logout` and `user-sign-out-everywhere`
+// are all recognised: a domain prefix does not make the operation any less of an
+// auth-lifecycle action, and operation ids may use either separator.
+//
+// Vocabulary is split into two tiers because auth words collide with ordinary
+// domain verbs. Measured against the live fleet plus synthetic domain ids:
+//   - `authorize-payment`, `revoke-invitation`, `unlink-record`,
+//     `disconnect-device` are domain actions that never touch the connection
+//     credential, so these verbs are NOT matched as segments;
+//   - the same verbs as a complete operation id (`authorize`, `revoke`) do
+//     refer to the credential itself, so they are matched only in that form.
+// `exchange`, `callback`, `connect`, `session`, `token`, `credential`,
+// `password` and `otp` stay out entirely for the same reason.
+const AUTH_LIFECYCLE_SEGMENT_WORDS = new Set([
+    "login",
+    "logout",
+    "signin",
+    "signout",
+    "signup",
+    "authenticate",
+    "reauth",
+    "auth",
+]);
+// Ambiguous as a prefix, unambiguous when they are the whole operation id.
+const AUTH_LIFECYCLE_WHOLE_ID_WORDS = new Set([
+    "authorize",
+    "revoke",
+    "unlink",
+    "disconnect",
+]);
+// A verb stem followed by a direction word across two segments: `sign-out`,
+// `user_sign_up_flow`, and the spelled-out `log-in` / `shop-log-out` forms
+// (their fused equivalents `login`/`logout` live in the segment set above).
+// `sign` pairs match anywhere; `log` pairs match only at the END of the id,
+// because mid-id `log` is the noun in domain phrases measured against real
+// fleets (`audit-log-in-range`, `change-log-out-of-band` are reads of a log,
+// while `shop-log-out` is a logout).
+const AUTH_DIRECTION_PAIRS = new Map([
+    ["sign", { directions: new Set(["in", "out", "up"]), endOnly: false }],
+    ["log", { directions: new Set(["in", "out"]), endOnly: true }],
+]);
+// Legacy anchored form kept for token-plumbing words whose bare use is only
+// auth-related when it leads the operation id (`exchange-code`, `refresh`).
 const AUTH_OPERATION_ID_PATTERN = /^(?:auth[-_])?(?:login|exchange|continue|refresh|callback)(?:[-_]|$)/i;
+function isAuthLifecycleOperationId(operationId, authMode) {
+    const segments = operationId.toLowerCase().split(/[-_]+/).filter(Boolean);
+    if (segments.some((segment) => AUTH_LIFECYCLE_SEGMENT_WORDS.has(segment)))
+        return true;
+    // A verb stem + direction spread across two segments (`sign-out`,
+    // `sign_up`, `shop-log-out`); see AUTH_DIRECTION_PAIRS for positioning.
+    if (segments.some((segment, index) => {
+        const pair = AUTH_DIRECTION_PAIRS.get(segment);
+        if (pair === undefined || index + 1 >= segments.length)
+            return false;
+        if (!pair.directions.has(segments[index + 1]))
+            return false;
+        return pair.endOnly ? index + 2 === segments.length : true;
+    })) {
+        return true;
+    }
+    if (segments.length === 1 && AUTH_LIFECYCLE_WHOLE_ID_WORDS.has(segments[0])) {
+        return true;
+    }
+    // The legacy anchored pattern keeps its original scope. It matches ordinary
+    // domain ids such as `exchange-rates` and `refresh-catalog`, so extending it
+    // to `oauth2_proxied` would spread that behavior to providers it never
+    // applied to; proxied providers are covered by the segment tiers above.
+    if (authMode === "credentials" || authMode === "oauth2") {
+        return AUTH_OPERATION_ID_PATTERN.test(operationId);
+    }
+    return false;
+}
 function lintAllowedHosts(providerId, allowedHosts) {
     const prefix = providerId ? `Provider "${providerId}"` : "Provider";
     if (!allowedHosts) {
@@ -957,14 +1034,19 @@ export function lintProvider(provider, options = {}) {
     ];
     if (provider.operations) {
         const authMode = provider.auth?.mode;
-        if (authMode === "credentials" || authMode === "oauth2") {
+        // Every authenticated mode owns an auth.flow; `oauth2_proxied` was
+        // previously exempt, which let auth-lifecycle operations ship on
+        // proxied providers unchecked.
+        if (authMode === "credentials" ||
+            authMode === "oauth2" ||
+            authMode === "oauth2_proxied") {
             for (const operationKey of Object.keys(provider.operations)) {
-                if (AUTH_OPERATION_ID_PATTERN.test(operationKey)) {
+                if (isAuthLifecycleOperationId(operationKey, authMode)) {
                     diagnostics.push({
                         rule: "auth-operation-unsupported",
                         level: "error",
                         field: `operations.${operationKey}`,
-                        message: `Provider "${provider.id ?? "unknown"}" operation "${operationKey}" looks like a login/token/session exchange endpoint. Authenticated providers must expose login through the single auth.flow interface because Gateway persists only auth.flow complete turn data.credential as the connection credential. Move this logic into auth.flow.continue instead of a provider operation.`,
+                        message: `Provider "${provider.id ?? "unknown"}" operation "${operationKey}" performs an auth-lifecycle action (login, logout, token exchange or similar). Authenticated providers must expose the whole credential lifecycle through the single auth.flow interface because Gateway persists only auth.flow complete turn data.credential as the connection credential, and an operation that mutates the session outside that interface leaves the stored connection stale. Move sign-in logic into auth.flow.start/continue and sign-out/disconnect logic into auth.flow.abort (served by POST /auth/disconnect) instead of a provider operation.`,
                     });
                 }
             }

package/dist/runtime/resolver-vendors/bindings.d.ts

@@ -1,8 +1,48 @@
 import type { ProviderChallenge } from "../../types.js";
 import type { ResolverIssuingIdentity } from "./types.js";
 export declare const RESOLVER_CHALLENGE_BINDINGS: {
-    readonly aws_waf: "portable";
-    readonly cloudflare_interstitial: "identity_scoped";
+    readonly turnstile: {
+        readonly cacheable: false;
+        readonly identityBinding: "none";
+        readonly directCacheable: false;
+    };
+    readonly recaptcha_v2: {
+        readonly cacheable: false;
+        readonly identityBinding: "none";
+        readonly directCacheable: false;
+    };
+    readonly recaptcha_v3: {
+        readonly cacheable: false;
+        readonly identityBinding: "none";
+        readonly directCacheable: false;
+    };
+    readonly hcaptcha: {
+        readonly cacheable: false;
+        readonly identityBinding: "none";
+        readonly directCacheable: false;
+    };
+    readonly cloudflare_interstitial: {
+        readonly cacheable: true;
+        readonly identityBinding: "identity_scoped";
+        readonly directCacheable: true;
+    };
+    readonly aws_waf: {
+        readonly cacheable: true;
+        readonly identityBinding: "portable";
+        readonly directCacheable: true;
+    };
+    readonly akamai_sec_cpt: {
+        readonly cacheable: true;
+        readonly identityBinding: "identity_scoped";
+        readonly directCacheable: false;
+    };
+    readonly akamai_sensor: {
+        readonly cacheable: true;
+        readonly identityBinding: "identity_scoped";
+        readonly directCacheable: false;
+    };
 };
+export declare function resolverChallengeIsCacheable(challenge: ProviderChallenge): boolean;
+export declare function resolverChallengeAllowsDirectCache(challenge: ProviderChallenge): boolean;
 export declare function resolverChallengeIsIdentityScoped(challenge: ProviderChallenge): boolean;
 export declare function resolverChallengeIssuingIdentity(challenge: ProviderChallenge, identity: ResolverIssuingIdentity): ResolverIssuingIdentity;

package/dist/runtime/resolver-vendors/bindings.js

@@ -1,14 +1,39 @@
+// An IP-bound artifact minted without any recorded egress identity is unsafe to
+// share. The Akamai kinds therefore reject direct caching, while Cloudflare
+// keeps its pre-existing direct-cache behavior pending measurement.
 export const RESOLVER_CHALLENGE_BINDINGS = {
-    aws_waf: "portable",
-    cloudflare_interstitial: "identity_scoped",
+    turnstile: { cacheable: false, identityBinding: "none", directCacheable: false },
+    recaptcha_v2: { cacheable: false, identityBinding: "none", directCacheable: false },
+    recaptcha_v3: { cacheable: false, identityBinding: "none", directCacheable: false },
+    hcaptcha: { cacheable: false, identityBinding: "none", directCacheable: false },
+    cloudflare_interstitial: {
+        cacheable: true,
+        identityBinding: "identity_scoped",
+        directCacheable: true,
+    },
+    aws_waf: { cacheable: true, identityBinding: "portable", directCacheable: true },
+    akamai_sec_cpt: {
+        cacheable: true,
+        identityBinding: "identity_scoped",
+        directCacheable: false,
+    },
+    akamai_sensor: {
+        cacheable: true,
+        identityBinding: "identity_scoped",
+        directCacheable: false,
+    },
 };
+export function resolverChallengeIsCacheable(challenge) {
+    return RESOLVER_CHALLENGE_BINDINGS[challenge.kind].cacheable;
+}
+export function resolverChallengeAllowsDirectCache(challenge) {
+    return RESOLVER_CHALLENGE_BINDINGS[challenge.kind].directCacheable;
+}
 export function resolverChallengeIsIdentityScoped(challenge) {
-    return (RESOLVER_CHALLENGE_BINDINGS[challenge.kind] ===
-        "identity_scoped");
+    return RESOLVER_CHALLENGE_BINDINGS[challenge.kind].identityBinding === "identity_scoped";
 }
 export function resolverChallengeIssuingIdentity(challenge, identity) {
-    const binding = RESOLVER_CHALLENGE_BINDINGS[challenge.kind];
-    if (binding === "portable") {
+    if (RESOLVER_CHALLENGE_BINDINGS[challenge.kind].identityBinding === "portable") {
         return { userAgent: identity.userAgent };
     }
     return identity;

package/dist/runtime/resolver-vendors/browser.d.ts

@@ -10,15 +10,11 @@ export interface BrowserResolverVendorOptions {
     readonly allowedHosts: readonly string[];
     readonly createClient?: BrowserClientFactory;
 }
-export type BrowserResolverSolution = Extract<ChallengeSolution, {
-    readonly form: "cookies";
-}> & {
-    /** Unix seconds from the cookie that proved the challenge cleared. */
-    readonly expires?: number;
-};
 export interface BrowserResolverVendorAdapter extends ResolverVendorAdapter {
     readonly id: "browser";
-    solve(challenge: ProviderChallenge, identity: ResolverIdentity | undefined, signal: AbortSignal, traceRecorder?: TraceRecorder): Promise<BrowserResolverSolution>;
+    solve(challenge: ProviderChallenge, identity: ResolverIdentity | undefined, signal: AbortSignal, traceRecorder?: TraceRecorder): Promise<Extract<ChallengeSolution, {
+        readonly form: "cookies";
+    }>>;
 }
 export declare function createBrowserResolverVendorAdapter(options: BrowserResolverVendorOptions): BrowserResolverVendorAdapter;
 export {};

package/dist/runtime/resolver-vendors/browser.js

@@ -1,6 +1,7 @@
-import { isProviderError, ProviderError } from "../../errors.js";
+import { isProviderError } from "../../errors.js";
 import { createBrowserClient } from "../browser.js";
 import { resolverChallengeIssuingIdentity } from "./bindings.js";
+import { assertResolverHostAllowed, normalizedResolverHostname } from "./hosts.js";
 import { ResolverVendorUnavailableError, } from "./types.js";
 const BROWSER_VENDOR_ID = "browser";
 const DEFAULT_COOKIE_POLL_INTERVAL_MS = 100;
@@ -94,32 +95,16 @@ async function abortableDelay(ms, signal) {
 function isSupportedKind(kind) {
     return Object.hasOwn(SUCCESS_COOKIE_NAMES, kind);
 }
-function normalizedHostname(hostname) {
-    return hostname.trim().toLowerCase().replace(/\.$/, "");
-}
-function assertChallengeHostAllowed(pageUrl, allowedHosts) {
-    const challengeHost = normalizedHostname(new URL(pageUrl).hostname);
-    const isAllowed = allowedHosts.some((host) => {
-        const declaredHost = normalizedHostname(host);
-        return declaredHost.length > 0 && !declaredHost.includes("*") && declaredHost === challengeHost;
-    });
-    if (isAllowed)
-        return;
-    throw new ProviderError(`Resolver challenge host "${challengeHost}" is not declared`, {
-        code: "RESOLVER_HOST_NOT_ALLOWED",
-        fix: "Add the exact challenge hostname to the provider's allowedHosts declaration.",
-    });
-}
 function cookieDomainSpecificity(cookie) {
-    return normalizedHostname(cookie.domain.replace(/^\./, "")).length;
+    return normalizedResolverHostname(cookie.domain.replace(/^\./, "")).length;
 }
 function isHostOnlyCookieFor(cookie, hostname) {
     return (!cookie.domain.startsWith(".") &&
-        normalizedHostname(cookie.domain) === normalizedHostname(hostname));
+        normalizedResolverHostname(cookie.domain) === normalizedResolverHostname(hostname));
 }
 function cookieAppliesToUrl(cookie, url) {
-    const cookieDomain = normalizedHostname(cookie.domain.replace(/^\./, ""));
-    const requestHostname = normalizedHostname(url.hostname);
+    const cookieDomain = normalizedResolverHostname(cookie.domain.replace(/^\./, ""));
+    const requestHostname = normalizedResolverHostname(url.hostname);
     const domainMatches = cookieDomain.length > 0 &&
         (requestHostname === cookieDomain ||
             (cookie.domain.startsWith(".") && requestHostname.endsWith(`.${cookieDomain}`)));
@@ -226,7 +211,7 @@ export function createBrowserResolverVendorAdapter(options) {
             if (!isSupportedKind(challenge.kind)) {
                 throw new TypeError(`Browser resolver does not support ${challenge.kind}`);
             }
-            assertChallengeHostAllowed(challenge.pageUrl, options.allowedHosts);
+            assertResolverHostAllowed(challenge.pageUrl, options.allowedHosts);
             const challengeKind = challenge.kind;
             callerSignal.throwIfAborted();
             const solveController = new AbortController();

package/dist/runtime/resolver-vendors/hosts.d.ts

@@ -0,0 +1,2 @@
+export declare function normalizedResolverHostname(hostname: string): string;
+export declare function assertResolverHostAllowed(targetUrl: string, allowedHosts: readonly string[]): void;

package/dist/runtime/resolver-vendors/hosts.js

@@ -0,0 +1,33 @@
+import { ProviderError } from "../../errors.js";
+export function normalizedResolverHostname(hostname) {
+    return hostname.trim().toLowerCase().replace(/\.$/, "");
+}
+export function assertResolverHostAllowed(targetUrl, allowedHosts) {
+    let targetUrlObject;
+    try {
+        targetUrlObject = new URL(targetUrl);
+    }
+    catch {
+        throw new ProviderError("Resolver target URL is invalid", {
+            code: "RESOLVER_HOST_NOT_ALLOWED",
+            fix: "Use a valid URL whose exact hostname appears in the provider's allowedHosts declaration.",
+        });
+    }
+    if (targetUrlObject.protocol !== "http:" && targetUrlObject.protocol !== "https:") {
+        throw new ProviderError(`Resolver target URL scheme "${targetUrlObject.protocol}" is not allowed`, {
+            code: "RESOLVER_HOST_NOT_ALLOWED",
+            fix: "Use an http or https URL whose exact hostname appears in the provider's allowedHosts declaration.",
+        });
+    }
+    const targetHost = normalizedResolverHostname(targetUrlObject.hostname);
+    const isAllowed = allowedHosts.some((host) => {
+        const declaredHost = normalizedResolverHostname(host);
+        return declaredHost.length > 0 && !declaredHost.includes("*") && declaredHost === targetHost;
+    });
+    if (isAllowed)
+        return;
+    throw new ProviderError(`Resolver target host "${targetHost}" is not declared`, {
+        code: "RESOLVER_HOST_NOT_ALLOWED",
+        fix: "Add the exact target hostname to the provider's allowedHosts declaration.",
+    });
+}

package/dist/runtime/resolver-vendors/twocaptcha.d.ts

@@ -0,0 +1,23 @@
+import type { ChallengeSolution, ProviderChallenge } from "../../types.js";
+import { type ResolverIdentity, type ResolverVendorAdapter } from "./types.js";
+type Delay = (ms: number, signal: AbortSignal) => Promise<void>;
+export interface TwoCaptchaResolverVendorOptions {
+    readonly apiKey?: string;
+    readonly timeoutMs?: number;
+    readonly pollIntervalMs?: number;
+    readonly allowedHosts: readonly string[];
+    readonly fetchImpl?: typeof fetch;
+    readonly baseUrl?: string;
+    /** Test-only clock override; supplying it disables the real-time deadline timer. */
+    readonly now?: () => number;
+    /** Test-only delay override used with `now` to exercise polling without sleeping. */
+    readonly delay?: Delay;
+}
+export interface TwoCaptchaResolverVendorAdapter extends ResolverVendorAdapter {
+    readonly id: "2captcha";
+    solve(challenge: ProviderChallenge, identity: ResolverIdentity | undefined, signal: AbortSignal): Promise<Extract<ChallengeSolution, {
+        readonly form: "token";
+    }>>;
+}
+export declare function createTwoCaptchaResolverVendorAdapter(options: TwoCaptchaResolverVendorOptions): TwoCaptchaResolverVendorAdapter;
+export {};

package/dist/runtime/resolver-vendors/twocaptcha.js

@@ -0,0 +1,264 @@
+import { assertResolverHostAllowed } from "./hosts.js";
+import { ResolverVendorUnavailableError, resolverVendorSupports, } from "./types.js";
+const TWOCAPTCHA_VENDOR_ID = "2captcha";
+const DEFAULT_TWOCAPTCHA_BASE_URL = "https://api.2captcha.com";
+const DEFAULT_POLL_INTERVAL_MS = 3_000;
+const DEFAULT_TIMEOUT_MS = 180_000;
+class TwoCaptchaSolveTimeoutError extends Error {
+    constructor() {
+        super("2captcha resolver solve budget elapsed");
+        this.name = "TwoCaptchaSolveTimeoutError";
+    }
+}
+function isJsonRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function abortReason(signal) {
+    return signal.reason ?? new DOMException("The operation was aborted", "AbortError");
+}
+function raceWithAbort(operation, signal, phase) {
+    if (signal.aborted)
+        return Promise.reject(abortReason(signal));
+    return new Promise((resolve, reject) => {
+        const cleanup = () => signal.removeEventListener("abort", onAbort);
+        const onAbort = () => {
+            cleanup();
+            reject(abortReason(signal));
+        };
+        signal.addEventListener("abort", onAbort, { once: true });
+        operation().then((value) => {
+            cleanup();
+            resolve(value);
+        }, (error) => {
+            cleanup();
+            if (phase === undefined) {
+                reject(error);
+                return;
+            }
+            reject(new ResolverVendorUnavailableError(TWOCAPTCHA_VENDOR_ID, "transport_failure", {
+                cause: error,
+                phase,
+            }));
+        });
+    });
+}
+async function abortableDelay(ms, signal) {
+    let timer;
+    try {
+        await raceWithAbort(() => new Promise((resolve) => {
+            timer = setTimeout(resolve, ms);
+        }), signal);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}
+function parseProxyConfiguration(proxyUrl) {
+    try {
+        const url = new URL(proxyUrl);
+        const protocol = url.protocol.slice(0, -1).toLowerCase();
+        const proxyType = protocol === "socks4" || protocol === "socks5"
+            ? protocol
+            : protocol === "http" || protocol === "https"
+                ? "http"
+                : undefined;
+        const defaultPort = proxyType === "http" ? 80 : 1080;
+        const proxyPort = Number(url.port || defaultPort);
+        if (!proxyType || !url.hostname || !Number.isInteger(proxyPort) || proxyPort <= 0) {
+            return undefined;
+        }
+        const proxyLogin = url.username ? decodeURIComponent(url.username) : undefined;
+        const proxyPassword = url.password ? decodeURIComponent(url.password) : undefined;
+        return {
+            proxyType,
+            proxyAddress: url.hostname,
+            proxyPort,
+            ...(proxyLogin ? { proxyLogin } : {}),
+            ...(proxyPassword ? { proxyPassword } : {}),
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+function errorText(payload, key) {
+    const value = payload[key];
+    return typeof value === "string" ? value : "";
+}
+function isAllocationExhausted(payload) {
+    const code = errorText(payload, "errorCode").toLowerCase();
+    const description = errorText(payload, "errorDescription").toLowerCase();
+    return (code === "error_zero_balance" ||
+        /(?:insufficient|zero|no|not enough)\s+(?:balance|funds|credit)/u.test(`${code} ${description}`));
+}
+function unavailableForPayload(payload, phase) {
+    return new ResolverVendorUnavailableError(TWOCAPTCHA_VENDOR_ID, isAllocationExhausted(payload) ? "allocation_exhausted" : "transport_failure", { phase });
+}
+async function postJson(fetchImpl, url, body, signal, phase) {
+    const response = await raceWithAbort(() => fetchImpl(url, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(body),
+        signal,
+        redirect: "error",
+    }), signal, phase);
+    let responseText;
+    try {
+        responseText = await raceWithAbort(() => response.text(), signal, phase);
+    }
+    catch (error) {
+        if (error instanceof ResolverVendorUnavailableError)
+            throw error;
+        throw new ResolverVendorUnavailableError(TWOCAPTCHA_VENDOR_ID, "transport_failure", {
+            cause: error,
+            phase,
+        });
+    }
+    let payload;
+    try {
+        payload = JSON.parse(responseText);
+    }
+    catch {
+        // JSON parse errors may contain response-body excerpts, so do not retain them as causes.
+        throw new ResolverVendorUnavailableError(TWOCAPTCHA_VENDOR_ID, "transport_failure", {
+            phase,
+        });
+    }
+    if (!isJsonRecord(payload)) {
+        throw new ResolverVendorUnavailableError(TWOCAPTCHA_VENDOR_ID, "transport_failure", {
+            phase,
+        });
+    }
+    return { ok: response.ok, payload };
+}
+function taskIdFrom(payload) {
+    const taskId = payload.taskId;
+    return typeof taskId === "string" || typeof taskId === "number" ? taskId : undefined;
+}
+function tokenFrom(payload) {
+    const solution = payload.solution;
+    if (!isJsonRecord(solution))
+        return undefined;
+    if (typeof solution.gRecaptchaResponse === "string")
+        return solution.gRecaptchaResponse;
+    return typeof solution.token === "string" ? solution.token : undefined;
+}
+function endpoint(baseUrl, path) {
+    return `${baseUrl.replace(/\/+$/u, "")}/${path}`;
+}
+export function createTwoCaptchaResolverVendorAdapter(options) {
+    const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    const baseUrl = options.baseUrl ?? DEFAULT_TWOCAPTCHA_BASE_URL;
+    const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const now = options.now ?? Date.now;
+    const delay = options.delay ?? abortableDelay;
+    return {
+        id: TWOCAPTCHA_VENDOR_ID,
+        supports(kind) {
+            return resolverVendorSupports(TWOCAPTCHA_VENDOR_ID, kind);
+        },
+        async solve(challenge, identity, callerSignal) {
+            const apiKey = options.apiKey?.trim();
+            if (!apiKey) {
+                throw new ResolverVendorUnavailableError(TWOCAPTCHA_VENDOR_ID, "missing_credentials", {
+                    phase: "create_task",
+                });
+            }
+            if (!resolverVendorSupports(TWOCAPTCHA_VENDOR_ID, challenge.kind)) {
+                throw new TypeError(`2captcha resolver does not support ${challenge.kind}`);
+            }
+            if (challenge.kind !== "recaptcha_v2") {
+                // AWS WAF remains deferred because its challenge variant has no required site key.
+                throw new ResolverVendorUnavailableError(TWOCAPTCHA_VENDOR_ID, "not_implemented", {
+                    phase: "create_task",
+                });
+            }
+            assertResolverHostAllowed(challenge.pageUrl, options.allowedHosts);
+            callerSignal.throwIfAborted();
+            const proxy = identity ? parseProxyConfiguration(identity.proxyUrl) : undefined;
+            if (identity && !proxy) {
+                throw new ResolverVendorUnavailableError(TWOCAPTCHA_VENDOR_ID, "transport_failure", {
+                    phase: "create_task",
+                });
+            }
+            const solveController = new AbortController();
+            const onCallerAbort = () => solveController.abort(abortReason(callerSignal));
+            callerSignal.addEventListener("abort", onCallerAbort, { once: true });
+            const timeout = options.now
+                ? undefined
+                : setTimeout(() => solveController.abort(new TwoCaptchaSolveTimeoutError()), timeoutMs);
+            const startedAt = now();
+            let phase = "create_task";
+            try {
+                const createResult = await postJson(fetchImpl, endpoint(baseUrl, "createTask"), {
+                    clientKey: apiKey,
+                    task: {
+                        type: proxy ? "RecaptchaV2Task" : "RecaptchaV2TaskProxyless",
+                        websiteURL: challenge.pageUrl,
+                        websiteKey: challenge.siteKey,
+                        isInvisible: false,
+                        ...(identity ? { userAgent: identity.userAgent } : {}),
+                        ...(proxy ?? {}),
+                    },
+                }, solveController.signal, phase);
+                const taskId = taskIdFrom(createResult.payload);
+                if (!createResult.ok || createResult.payload.errorId !== 0 || taskId === undefined) {
+                    throw unavailableForPayload(createResult.payload, phase);
+                }
+                phase = "poll_result";
+                while (true) {
+                    callerSignal.throwIfAborted();
+                    const remainingMs = timeoutMs - (now() - startedAt);
+                    if (remainingMs <= 0)
+                        throw new TwoCaptchaSolveTimeoutError();
+                    await delay(Math.min(pollIntervalMs, remainingMs), solveController.signal);
+                    callerSignal.throwIfAborted();
+                    if (now() - startedAt >= timeoutMs)
+                        throw new TwoCaptchaSolveTimeoutError();
+                    const pollResult = await postJson(fetchImpl, endpoint(baseUrl, "getTaskResult"), { clientKey: apiKey, taskId }, solveController.signal, phase);
+                    if (!pollResult.ok || pollResult.payload.errorId !== 0) {
+                        throw unavailableForPayload(pollResult.payload, phase);
+                    }
+                    if (pollResult.payload.status === "processing")
+                        continue;
+                    if (pollResult.payload.status !== "ready") {
+                        throw new ResolverVendorUnavailableError(TWOCAPTCHA_VENDOR_ID, "transport_failure", {
+                            phase,
+                        });
+                    }
+                    const token = tokenFrom(pollResult.payload);
+                    if (!token?.trim()) {
+                        throw new ResolverVendorUnavailableError(TWOCAPTCHA_VENDOR_ID, "transport_failure", {
+                            phase,
+                        });
+                    }
+                    return { form: "token", token };
+                }
+            }
+            catch (error) {
+                if (callerSignal.aborted)
+                    throw abortReason(callerSignal);
+                if (error instanceof TwoCaptchaSolveTimeoutError ||
+                    solveController.signal.reason instanceof TwoCaptchaSolveTimeoutError) {
+                    throw new ResolverVendorUnavailableError(TWOCAPTCHA_VENDOR_ID, "timeout", {
+                        cause: error,
+                        phase,
+                    });
+                }
+                if (error instanceof ResolverVendorUnavailableError)
+                    throw error;
+                throw new ResolverVendorUnavailableError(TWOCAPTCHA_VENDOR_ID, "transport_failure", {
+                    cause: error,
+                    phase,
+                });
+            }
+            finally {
+                if (timeout !== undefined)
+                    clearTimeout(timeout);
+                callerSignal.removeEventListener("abort", onCallerAbort);
+            }
+        },
+    };
+}