@apifuse/provider-sdk 2.2.0-beta.30 → 2.2.0-beta.32

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @apifuse/provider-sdk Changelog
 
+## 2.2.0-beta.32
+
+- Release candidate for main commit 82f1c0c1de916a40c8c74b1d6470a493b134c0ed.
+
+## 2.2.0-beta.31
+
+- Release candidate for main commit 94006be0852918867d254dc23d0fa8420a07be9c.
+
 ## 2.2.0-beta.30
 
 - Release candidate for main commit ccf3d56bfcbe9683c6e7ad45dde8e6703467f9e7.

package/dist/error-resolution.js

@@ -18,6 +18,7 @@ export const SDK_OWNED_PROVIDER_ERROR_CODES = new Set([
     "RUNTIME_UNSUPPORTED",
     "PROVIDER_STATE_UNSUPPORTED",
     "CHOICE_TOKEN_MASTER_SECRET_NOT_CONFIGURED",
+    "CHOICE_WORD_ISSUANCE_INVALID",
     "CHOICE_STATE_PAYLOAD_TOO_LARGE",
     "CHOICE_STATE_UNAVAILABLE",
     "CHOICE_CONTEXT_REQUIRED",

package/dist/index.d.ts

@@ -17,7 +17,7 @@ export * from "./recipes/rest-api.js";
 export { createFlowContext, createScratchpad } from "./runtime/auth-flow.js";
 export type { BrowserClientOptions } from "./runtime/browser.js";
 export { APIFUSE__CACHE__KEY_PEPPER_ENV, createBypassProviderCache, createProviderCache, type ProviderCacheOptions, } from "./runtime/cache.js";
-export { type CreateProviderChoiceContextOptions, createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice.js";
+export { type CreateProviderChoiceContextOptions, createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, PROVIDER_RUNTIME_CHOICE_WORD_ISSUANCE_ENV, } from "./runtime/choice.js";
 export { type CreateCredentialContextOptions, createCredentialContext, } from "./runtime/credential.js";
 export { createEnvContext } from "./runtime/env.js";
 export { executeOperation } from "./runtime/executor.js";

package/dist/index.js

@@ -15,7 +15,7 @@ export * from "./recipes/gov-api.js";
 export * from "./recipes/rest-api.js";
 export { createFlowContext, createScratchpad } from "./runtime/auth-flow.js";
 export { APIFUSE__CACHE__KEY_PEPPER_ENV, createBypassProviderCache, createProviderCache, } from "./runtime/cache.js";
-export { createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice.js";
+export { createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, PROVIDER_RUNTIME_CHOICE_WORD_ISSUANCE_ENV, } from "./runtime/choice.js";
 export { createCredentialContext, } from "./runtime/credential.js";
 export { createEnvContext } from "./runtime/env.js";
 export { executeOperation } from "./runtime/executor.js";

package/dist/provider.d.ts

@@ -5,7 +5,7 @@ export { assertFreshProviderChoiceIssuedAt, createProviderChoiceToken, ProviderC
 export { centered, delayed, defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, every, } from "./define.js";
 export { AuthError, HttpRedirectError, isProviderError, isSessionExpiredError, isTransportError, ProviderError, SessionExpiredError, TransportError, ValidationError, } from "./errors.js";
 export { getProviderLocalePath, providerLocaleKey, qualifyProviderLocaleKey, } from "./i18n/index.js";
-export { type CreateProviderChoiceContextOptions, createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice.js";
+export { type CreateProviderChoiceContextOptions, createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, PROVIDER_RUNTIME_CHOICE_WORD_ISSUANCE_ENV, } from "./runtime/choice.js";
 export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, type SensitiveFieldKind, type SensitiveFieldOptions, type SensitivePath, sensitive, z, } from "./schema.js";
 export type { AuthAbortData, AuthAbortRetry, AuthFlowTerminalContext, AuthMode, AuthSafeData, AuthSafeJson, FlowContext, HealthCheckAssertionContext, HealthCheckCase, HealthCheckSuite, HealthCheckUnsupported, HealthJourneyDefinition, HealthJourneyEventContext, HealthJourneyManualTriggerPolicy, HealthJourneyRunContext, HealthJourneyRunResult, HealthScheduleRandomization, HttpRedirectFailureReason, HttpRedirectPolicy, HttpRedirectPolicyMode, HttpRetryOptions, HttpRetrySummary, InferSchemaOutput, NativeContext, NativeNetworkClient, NativeNetworkCloseReason, NativeNetworkConnection, NativeNetworkConnectInput, NativeNetworkConnectOptions, NativeNetworkDynamicGrantOptions, NativeNetworkEgressGrant, NativeProviderConfig, NativeProviderContext, NativeProxyDrainHandler, NativeProxyEgressInfo, NativeProxyExpiringEvent, NativeProxyExpiringReason, NativeTcpDynamicEgressRule, NativeTcpEgressGrant, NativeTcpEgressRule, NativeTcpPortRange, NativeTcpTlsMode, NativeTlsConnectOptions, OperationApprovalPolicy, OperationContractMetadata, OperationDefinition, OperationDocMeta, OperationErrorCode, ProviderErrorStatus, OperationInputExample, OperationLifecycle, OperationObservabilityConfig, OperationObservabilitySensitiveConfig, OperationRelationships, OperationRiskClass, OperationSensitivePath, OperationToolRouterMetadata, OperationTransport, ProviderAccessVisibility, ProviderChoiceBindingOptions, ProviderChoiceConsumeMode, ProviderChoiceConsumeResult, ProviderChoiceContext, ProviderChoiceExplicitParseResult, ProviderChoiceIssueOptions, ProviderChoiceParseOptions, ProviderContext, ProviderDefinition, ProviderDeploymentOverrides, ProviderFileRef, ProviderFilesContext, ProviderLocale, ProviderLocaleKey, ProviderLocaleKeyInput, ProviderLogoProfile, ProviderProxyPolicy, ProxiedOAuthConfig, ProviderPublicConnectionMode, ProviderPublicProfile, ProviderResolvedFile, ProviderRuntimeState, ProviderStateDurationString, ProviderStateNamespace, ProviderSupportLevel, RedirectRunReason, SchemaLike, SmsOtpMatcherDefinition, StandardSchemaV1, StateCasResult, StateNamespaceOptions, StateNamespaceScope, StateValue, StateWriteOptions, } from "./types.js";
 export { NativeEgressGrantExpiredError, NativeEgressNotDeclaredError, NativeIdleTimeoutError, NativeNetworkError, NativeProxyExpiredError, } from "./runtime/native-network-errors.js";

package/dist/provider.js

@@ -4,7 +4,7 @@ export { assertFreshProviderChoiceIssuedAt, createProviderChoiceToken, ProviderC
 export { centered, delayed, defineHealthJourney, defineOperation, defineProvider, defineSmsOtpMatcher, every, } from "./define.js";
 export { AuthError, HttpRedirectError, isProviderError, isSessionExpiredError, isTransportError, ProviderError, SessionExpiredError, TransportError, ValidationError, } from "./errors.js";
 export { getProviderLocalePath, providerLocaleKey, qualifyProviderLocaleKey, } from "./i18n/index.js";
-export { createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, } from "./runtime/choice.js";
+export { createProviderChoiceContext, createTestProviderChoiceContext, PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV, PROVIDER_RUNTIME_CHOICE_WORD_ISSUANCE_ENV, } from "./runtime/choice.js";
 export { APIFUSE_DESCRIPTION_KEY_META_KEY, APIFUSE_REDACTION_MARKER, APIFUSE_SENSITIVE_KIND_META_KEY, APIFUSE_SENSITIVE_META_KEY, collectSensitivePaths, describeKey, field, fields, isSensitiveSchema, redactPayload, sensitive, z, } from "./schema.js";
 export { NativeEgressGrantExpiredError, NativeEgressNotDeclaredError, NativeIdleTimeoutError, NativeNetworkError, NativeProxyExpiredError, } from "./runtime/native-network-errors.js";
 export { HttpRetryAfterPolicy, HttpRetryDelayStrategy, HttpRetryJitter, HttpRetryPreset, HttpRetryUnsafeMethodPolicy, } from "./types.js";

package/dist/runtime/choice.d.ts

@@ -1,5 +1,6 @@
 import type { CredentialContext, EnvContext, ProviderChoiceConsumeMode, ProviderChoiceContext, ProviderRequestContext, ProviderRuntimeState } from "../types.js";
 export declare const PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV = "APIFUSE__PROVIDER_RUNTIME__CHOICE_TOKEN_MASTER_SECRET";
+export declare const PROVIDER_RUNTIME_CHOICE_WORD_ISSUANCE_ENV = "APIFUSE__PROVIDER_RUNTIME__CHOICE_WORD_ISSUANCE";
 export type ProviderChoiceTelemetryEvent = {
     readonly providerId: string;
     readonly purpose: string;

package/dist/runtime/choice.js

@@ -3,6 +3,7 @@ import { assertFreshProviderChoiceIssuedAt, ProviderChoiceTokenError, } from "..
 import { isProviderError, ProviderError } from "../errors.js";
 import { CHOICE_WORDLIST_SIZE, choiceWordAt, HIGH_CHOICE_WORD_COUNT, isChoiceWord, STANDARD_CHOICE_WORD_COUNT, } from "./choice-wordlist.js";
 export const PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV = "APIFUSE__PROVIDER_RUNTIME__CHOICE_TOKEN_MASTER_SECRET";
+export const PROVIDER_RUNTIME_CHOICE_WORD_ISSUANCE_ENV = "APIFUSE__PROVIDER_RUNTIME__CHOICE_WORD_ISSUANCE";
 const PRIMARY_CHOICE_TOKEN_KID = "v1";
 const MANAGED_CHOICE_TOKEN_VERSION = 1;
 const SERVER_STORED_CHOICE_RECORD_VERSION = 1;
@@ -15,28 +16,53 @@ export function createProviderChoiceContext(options) {
         const issuedAtMs = issueOptions.nowMs ?? Date.now();
         const resolvedStorage = resolveIssueStorage(issueOptions.storage, issueOptions.payload);
         if (resolvedStorage.mode === "server") {
+            const issuance = resolveChoiceWordIssuance(options.env);
+            const keys = hasRequestedChoiceBinding(issueOptions.bind)
+                ? deriveManagedChoiceKeys({
+                    masterSecret: resolveMasterSecret(),
+                    providerId: options.providerId,
+                    purpose: issueOptions.purpose,
+                    kid,
+                })
+                : undefined;
             const binding = hasRequestedChoiceBinding(issueOptions.bind)
                 ? createChoiceBinding({
-                    keys: deriveManagedChoiceKeys({
-                        masterSecret: resolveMasterSecret(),
-                        providerId: options.providerId,
-                        purpose: issueOptions.purpose,
-                        kid,
-                    }),
+                    keys: keys,
                     options: issueOptions.bind,
                     request: options.request,
                     credential: options.credential,
                     required: true,
                 })
                 : undefined;
-            return issueServerStoredChoice({
+            const baseEnvelope = {
+                v: MANAGED_CHOICE_TOKEN_VERSION,
+                provider_id: options.providerId,
+                purpose: issueOptions.purpose,
+                issued_at_ms: issuedAtMs,
+                ttl_ms: issueOptions.ttlMs,
+                binding,
+            };
+            if (issuance === "legacy") {
+                const legacyKeys = keys ??
+                    deriveManagedChoiceKeys({
+                        masterSecret: resolveMasterSecret(),
+                        providerId: options.providerId,
+                        purpose: issueOptions.purpose,
+                        kid,
+                    });
+                return issueLegacyServerStoredChoice({
+                    baseEnvelope,
+                    issueOptions,
+                    storage: resolvedStorage.storage,
+                    contextState: options.state,
+                    kid,
+                    keys: legacyKeys,
+                    issuedAtMs,
+                });
+            }
+            return issueWordServerStoredChoice({
                 baseEnvelope: {
-                    v: MANAGED_CHOICE_TOKEN_VERSION,
-                    provider_id: options.providerId,
-                    purpose: issueOptions.purpose,
-                    issued_at_ms: issuedAtMs,
-                    ttl_ms: issueOptions.ttlMs,
-                    binding,
+                    ...baseEnvelope,
                 },
                 issueOptions,
                 storage: resolvedStorage.storage,
@@ -133,13 +159,7 @@ export function createProviderChoiceContext(options) {
                 purpose: parseOptions.purpose,
                 kid: tokenKid,
             });
-            const signedBody = [
-                parseOptions.prefix,
-                tokenKid,
-                encodedIv,
-                encryptedPayload,
-                authTag,
-            ].join(".");
+            const signedBody = [parseOptions.prefix, tokenKid, encodedIv, encryptedPayload, authTag].join(".");
             assertManagedChoiceSignature({
                 signedBody,
                 signature,
@@ -287,6 +307,20 @@ function createLegacyExplicitParseResult(options) {
         },
     };
 }
+function resolveChoiceWordIssuance(env) {
+    const configured = env?.get(PROVIDER_RUNTIME_CHOICE_WORD_ISSUANCE_ENV);
+    const value = configured?.trim() ?? "";
+    if (value === "" || value === "legacy")
+        return "legacy";
+    if (value === "word")
+        return "word";
+    throw new ProviderError(`Unsupported provider choice word issuance mode "${value}". Expected "legacy" or "word".`, {
+        code: "CHOICE_WORD_ISSUANCE_INVALID",
+        category: "input_validation",
+        retryable: false,
+        details: { env: PROVIDER_RUNTIME_CHOICE_WORD_ISSUANCE_ENV },
+    });
+}
 function resolveChoiceMasterSecret(options) {
     const configured = options.masterSecret ?? options.env?.get(PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV);
     const trimmed = configured?.trim();
@@ -336,7 +370,7 @@ function encryptManagedChoiceToken(options) {
         .digest("base64url");
     return `${signedBody}.${signature}`;
 }
-async function issueServerStoredChoice(options) {
+async function issueWordServerStoredChoice(options) {
     const serializedPayload = serializeChoicePayload(options.issueOptions.payload);
     const payloadDigest = digestChoicePayload(serializedPayload);
     const namespace = resolveChoiceStateNamespace({
@@ -386,6 +420,47 @@ async function issueServerStoredChoice(options) {
         retryable: false,
     });
 }
+/**
+ * Beta.28-compatible server handle issuance. The state stores the payload and
+ * the client receives the existing six-part encrypted envelope whose payload
+ * is a server-state handle.
+ */
+async function issueLegacyServerStoredChoice(options) {
+    const serializedPayload = serializeChoicePayload(options.issueOptions.payload);
+    const payloadBytes = Buffer.byteLength(serializedPayload, "utf8");
+    if (payloadBytes > options.storage.maxValueBytes) {
+        throw new ProviderError("Provider choice payload exceeds state storage policy.", {
+            code: "CHOICE_STATE_PAYLOAD_TOO_LARGE",
+            category: "input_validation",
+            retryable: false,
+            details: { maxValueBytes: options.storage.maxValueBytes, payloadBytes },
+        });
+    }
+    const stateId = `choice_${randomBytes(16).toString("base64url")}`;
+    const namespace = resolveChoiceStateNamespace({
+        storage: options.storage,
+        contextState: options.contextState,
+        ttlMs: options.issueOptions.ttlMs,
+    });
+    await namespace.set(optionsStateKey(stateId), options.issueOptions.payload, {
+        ttl: stateTtl(options.storage, options.issueOptions.ttlMs),
+    });
+    const envelope = {
+        ...options.baseEnvelope,
+        payload: {
+            storage: "server",
+            state_id: stateId,
+            payload_digest: digestChoicePayload(serializedPayload),
+            created_at_ms: options.issuedAtMs,
+        },
+    };
+    return encryptManagedChoiceToken({
+        prefix: options.issueOptions.prefix,
+        kid: options.kid,
+        envelope,
+        keys: options.keys,
+    });
+}
 async function parseWordServerStoredChoice(options) {
     const storage = resolveParseStorage(options.parseOptions.storage);
     const namespace = resolveChoiceStateNamespace({

package/dist/runtime/resolver-vendors/capsolver.d.ts

@@ -0,0 +1,24 @@
+import type { ChallengeSolution, ProviderChallenge } from "../../types.js";
+import type { TraceRecorder } from "../trace.js";
+import { type ResolverIdentity, type ResolverVendorAdapter } from "./types.js";
+type Delay = (ms: number, signal: AbortSignal) => Promise<void>;
+export interface CapsolverResolverVendorOptions {
+    readonly apiKey?: string;
+    readonly timeoutMs?: number;
+    readonly pollIntervalMs?: number;
+    readonly allowedHosts: readonly string[];
+    readonly fetchImpl?: typeof fetch;
+    readonly baseUrl?: string;
+    /** Test-only clock override; supplying it disables the real-time deadline timer. */
+    readonly now?: () => number;
+    /** Test-only delay override used with `now` to exercise polling without sleeping. */
+    readonly delay?: Delay;
+}
+export interface CapsolverResolverVendorAdapter extends ResolverVendorAdapter {
+    readonly id: "capsolver";
+    solve(challenge: ProviderChallenge, identity: ResolverIdentity | undefined, signal: AbortSignal, traceRecorder?: TraceRecorder): Promise<Extract<ChallengeSolution, {
+        readonly form: "token";
+    }>>;
+}
+export declare function createCapsolverResolverVendorAdapter(options: CapsolverResolverVendorOptions): CapsolverResolverVendorAdapter;
+export {};

package/dist/runtime/resolver-vendors/capsolver.js

@@ -0,0 +1,402 @@
+import { redactSensitiveText } from "../request-options.js";
+import { assertResolverHostAllowed } from "./hosts.js";
+import { ResolverChallengeVerdictError, ResolverVendorUnavailableError, resolverVendorSupports, } from "./types.js";
+const CAPSOLVER_VENDOR_ID = "capsolver";
+const DEFAULT_CAPSOLVER_BASE_URL = "https://api.capsolver.com";
+const DEFAULT_POLL_INTERVAL_MS = 2_000;
+const DEFAULT_TIMEOUT_MS = 120_000;
+class CapsolverSolveTimeoutError extends Error {
+    constructor() {
+        super("Capsolver resolver solve budget elapsed");
+        this.name = "CapsolverSolveTimeoutError";
+    }
+}
+class CapsolverUnavailableError extends ResolverVendorUnavailableError {
+    errorCode;
+    errorDescription;
+    responseStatus;
+    responseContentType;
+    responseLength;
+    constructor(reason, options) {
+        super(CAPSOLVER_VENDOR_ID, reason, options);
+        this.errorCode = options.errorCode;
+        this.errorDescription = options.errorDescription;
+        this.responseStatus = options.responseStatus;
+        this.responseContentType = options.responseContentType;
+        this.responseLength = options.responseLength;
+    }
+}
+class CapsolverVerdictError extends ResolverChallengeVerdictError {
+    phase;
+    errorCode;
+    errorDescription;
+    constructor(options) {
+        super(CAPSOLVER_VENDOR_ID, "solve_failed", options);
+        this.phase = options.phase;
+        this.errorCode = options.errorCode;
+        this.errorDescription = options.errorDescription;
+    }
+}
+function isJsonRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function abortReason(signal) {
+    return signal.reason ?? new DOMException("The operation was aborted", "AbortError");
+}
+function containsSensitiveValue(value, sensitiveValues) {
+    const secrets = sensitiveValues.filter((secret) => secret.length > 0);
+    if (secrets.length === 0)
+        return false;
+    const seen = new Set();
+    const inspect = (candidate) => {
+        if (typeof candidate === "string") {
+            return secrets.some((secret) => candidate.includes(secret));
+        }
+        if (candidate === null || (typeof candidate !== "object" && typeof candidate !== "function")) {
+            return false;
+        }
+        if (seen.has(candidate))
+            return false;
+        seen.add(candidate);
+        try {
+            for (const property of Reflect.ownKeys(candidate)) {
+                if (typeof property === "string" && inspect(property))
+                    return true;
+                const descriptor = Object.getOwnPropertyDescriptor(candidate, property);
+                if (!descriptor)
+                    return true;
+                if ("value" in descriptor && inspect(descriptor.value))
+                    return true;
+                if (descriptor.get !== undefined || descriptor.set !== undefined)
+                    return true;
+            }
+        }
+        catch {
+            return true;
+        }
+        return false;
+    };
+    return inspect(value);
+}
+function safeCauseOptions(error, sensitiveValues) {
+    return containsSensitiveValue(error, sensitiveValues) ? {} : { cause: error };
+}
+function sanitizedJsonParseCause() {
+    return new SyntaxError("Upstream response failed");
+}
+function raceWithAbort(operation, signal, phase, sensitiveValues = []) {
+    if (signal.aborted)
+        return Promise.reject(abortReason(signal));
+    return new Promise((resolve, reject) => {
+        const cleanup = () => signal.removeEventListener("abort", onAbort);
+        const onAbort = () => {
+            cleanup();
+            reject(abortReason(signal));
+        };
+        signal.addEventListener("abort", onAbort, { once: true });
+        operation().then((value) => {
+            cleanup();
+            resolve(value);
+        }, (error) => {
+            cleanup();
+            if (phase === undefined) {
+                reject(error);
+                return;
+            }
+            reject(new ResolverVendorUnavailableError(CAPSOLVER_VENDOR_ID, "transport_failure", {
+                ...safeCauseOptions(error, sensitiveValues),
+                phase,
+            }));
+        });
+    });
+}
+async function abortableDelay(ms, signal) {
+    let timer;
+    try {
+        await raceWithAbort(() => new Promise((resolve) => {
+            timer = setTimeout(resolve, ms);
+        }), signal);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}
+function responseErrorFields(payload) {
+    return {
+        errorId: typeof payload.errorId === "number" ? payload.errorId : undefined,
+        errorCode: typeof payload.errorCode === "string" ? payload.errorCode : undefined,
+        errorDescription: typeof payload.errorDescription === "string" ? payload.errorDescription : undefined,
+    };
+}
+function parseCreateTaskResponse(payload) {
+    const taskId = payload.taskId;
+    return {
+        ...responseErrorFields(payload),
+        taskId: typeof taskId === "string" || typeof taskId === "number" ? taskId : undefined,
+    };
+}
+function parsePollResultResponse(payload) {
+    const solution = isJsonRecord(payload.solution) ? payload.solution : undefined;
+    return {
+        ...responseErrorFields(payload),
+        status: typeof payload.status === "string" ? payload.status : undefined,
+        solution: solution
+            ? { token: typeof solution.token === "string" ? solution.token : undefined }
+            : undefined,
+    };
+}
+function isAllocationExhausted(payload) {
+    const code = payload.errorCode?.toLowerCase() ?? "";
+    const description = payload.errorDescription?.toLowerCase() ?? "";
+    return (code === "error_zero_balance" ||
+        /(?:insufficient|zero|no|not enough)\s+(?:balance|funds|credit)/u.test(`${code} ${description}`));
+}
+function isNegativeVerdict(payload) {
+    return payload.errorCode?.toLowerCase() === "error_captcha_unsolvable";
+}
+function safeVendorDetail(value, sensitiveValues) {
+    const redacted = redactSensitiveText(value, sensitiveValues);
+    return containsSensitiveValue(redacted, sensitiveValues) ? "[REDACTED]" : redacted;
+}
+function vendorErrorDetails(payload, sensitiveValues) {
+    const errorCode = payload.errorCode?.trim();
+    const errorDescription = payload.errorDescription?.trim();
+    return {
+        ...(errorCode ? { errorCode: safeVendorDetail(errorCode, sensitiveValues) } : {}),
+        ...(errorDescription
+            ? { errorDescription: safeVendorDetail(payload.errorDescription ?? "", sensitiveValues) }
+            : {}),
+    };
+}
+function unavailableForPayload(payload, phase, sensitiveValues) {
+    const details = vendorErrorDetails(payload, sensitiveValues);
+    if (isNegativeVerdict(payload)) {
+        return new CapsolverVerdictError({ phase, ...details });
+    }
+    return new CapsolverUnavailableError(isAllocationExhausted(payload) ? "allocation_exhausted" : "transport_failure", { phase, ...details });
+}
+async function postJson(fetchImpl, url, body, signal, phase, sensitiveValues, parseResponse) {
+    const response = await raceWithAbort(() => fetchImpl(url, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(body),
+        signal,
+        redirect: "error",
+    }), signal, phase, sensitiveValues);
+    let responseText;
+    try {
+        responseText = await raceWithAbort(() => response.text(), signal, phase, sensitiveValues);
+    }
+    catch (error) {
+        if (error instanceof ResolverVendorUnavailableError)
+            throw error;
+        throw new ResolverVendorUnavailableError(CAPSOLVER_VENDOR_ID, "transport_failure", {
+            cause: error,
+            phase,
+        });
+    }
+    let payload;
+    try {
+        payload = JSON.parse(responseText);
+    }
+    catch {
+        const contentType = response.headers.get("content-type");
+        throw new CapsolverUnavailableError("transport_failure", {
+            cause: sanitizedJsonParseCause(),
+            phase,
+            responseStatus: response.status,
+            responseContentType: contentType
+                ? safeVendorDetail(contentType.slice(0, 128), sensitiveValues)
+                : undefined,
+            responseLength: responseText.length,
+        });
+    }
+    if (!isJsonRecord(payload)) {
+        throw new ResolverVendorUnavailableError(CAPSOLVER_VENDOR_ID, "transport_failure", {
+            phase,
+        });
+    }
+    return { ok: response.ok, payload: parseResponse(payload) };
+}
+function endpoint(baseUrl, path) {
+    return `${baseUrl.replace(/\/+$/u, "")}/${path}`;
+}
+function spanErrorAttributes(error, phase) {
+    if (error instanceof ResolverVendorUnavailableError) {
+        return {
+            unavailability_reason: error.reason,
+            transport_phase: error.phase,
+            ...(error instanceof CapsolverUnavailableError
+                ? {
+                    vendor_error_code: error.errorCode,
+                    vendor_error_description: error.errorDescription,
+                    response_status: error.responseStatus,
+                    response_content_type: error.responseContentType,
+                    response_length: error.responseLength,
+                }
+                : {}),
+        };
+    }
+    if (error instanceof CapsolverVerdictError) {
+        return {
+            verdict_reason: error.reason,
+            transport_phase: error.phase,
+            vendor_error_code: error.errorCode,
+            vendor_error_description: error.errorDescription,
+        };
+    }
+    if (error instanceof CapsolverSolveTimeoutError) {
+        return {
+            unavailability_reason: "timeout",
+            transport_phase: phase,
+        };
+    }
+    return undefined;
+}
+export function createCapsolverResolverVendorAdapter(options) {
+    const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    const baseUrl = options.baseUrl ?? DEFAULT_CAPSOLVER_BASE_URL;
+    const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const now = options.now ?? Date.now;
+    const delay = options.delay ?? abortableDelay;
+    return {
+        id: CAPSOLVER_VENDOR_ID,
+        supports(kind) {
+            return resolverVendorSupports(CAPSOLVER_VENDOR_ID, kind);
+        },
+        async solve(challenge, _identity, callerSignal, traceRecorder) {
+            const apiKey = options.apiKey?.trim();
+            if (!apiKey) {
+                throw new ResolverVendorUnavailableError(CAPSOLVER_VENDOR_ID, "missing_credentials", {
+                    phase: "create_task",
+                });
+            }
+            if (!resolverVendorSupports(CAPSOLVER_VENDOR_ID, challenge.kind)) {
+                throw new TypeError(`Capsolver resolver does not support ${challenge.kind}`);
+            }
+            if (challenge.kind !== "turnstile") {
+                throw new ResolverVendorUnavailableError(CAPSOLVER_VENDOR_ID, "not_implemented", {
+                    phase: "create_task",
+                });
+            }
+            const sensitiveValues = [
+                apiKey,
+                challenge.pageUrl,
+                challenge.siteKey,
+                ...(challenge.action !== undefined ? [challenge.action] : []),
+                ...(challenge.cdata !== undefined ? [challenge.cdata] : []),
+            ];
+            assertResolverHostAllowed(challenge.pageUrl, options.allowedHosts);
+            callerSignal.throwIfAborted();
+            const solveController = new AbortController();
+            const onCallerAbort = () => solveController.abort(abortReason(callerSignal));
+            callerSignal.addEventListener("abort", onCallerAbort, { once: true });
+            const timeout = options.now
+                ? undefined
+                : setTimeout(() => solveController.abort(new CapsolverSolveTimeoutError()), timeoutMs);
+            const startedAt = now();
+            let phase = "create_task";
+            try {
+                const createTask = async () => {
+                    const metadata = {
+                        ...(challenge.action !== undefined ? { action: challenge.action } : {}),
+                        ...(challenge.cdata !== undefined ? { cdata: challenge.cdata } : {}),
+                    };
+                    const createResult = await postJson(fetchImpl, endpoint(baseUrl, "createTask"), {
+                        clientKey: apiKey,
+                        task: {
+                            type: "AntiTurnstileTaskProxyLess",
+                            websiteURL: challenge.pageUrl,
+                            websiteKey: challenge.siteKey,
+                            ...(challenge.action !== undefined || challenge.cdata !== undefined
+                                ? { metadata }
+                                : {}),
+                        },
+                    }, solveController.signal, phase, sensitiveValues, parseCreateTaskResponse);
+                    const taskId = createResult.payload.taskId;
+                    if (!createResult.ok || createResult.payload.errorId !== 0 || taskId === undefined) {
+                        throw unavailableForPayload(createResult.payload, phase, sensitiveValues);
+                    }
+                    return taskId;
+                };
+                const taskId = traceRecorder
+                    ? await traceRecorder.runSpan("resolver.vendor.create_task", createTask, {
+                        attributes: {
+                            vendor: CAPSOLVER_VENDOR_ID,
+                            challenge_kind: challenge.kind,
+                        },
+                        onError: (error) => spanErrorAttributes(error, "create_task"),
+                    })
+                    : await createTask();
+                phase = "poll_result";
+                const pollResult = async () => {
+                    while (true) {
+                        callerSignal.throwIfAborted();
+                        const remainingMs = timeoutMs - (now() - startedAt);
+                        if (remainingMs <= 0)
+                            throw new CapsolverSolveTimeoutError();
+                        await delay(Math.min(pollIntervalMs, remainingMs), solveController.signal);
+                        callerSignal.throwIfAborted();
+                        if (now() - startedAt >= timeoutMs)
+                            throw new CapsolverSolveTimeoutError();
+                        const result = await postJson(fetchImpl, endpoint(baseUrl, "getTaskResult"), { clientKey: apiKey, taskId }, solveController.signal, phase, sensitiveValues, parsePollResultResponse);
+                        if (!result.ok || result.payload.errorId !== 0) {
+                            throw unavailableForPayload(result.payload, phase, sensitiveValues);
+                        }
+                        switch (result.payload.status) {
+                            case "idle":
+                            case "processing":
+                                continue;
+                            case "ready":
+                                break;
+                            default:
+                                throw new ResolverVendorUnavailableError(CAPSOLVER_VENDOR_ID, "transport_failure", { phase });
+                        }
+                        const token = result.payload.solution?.token;
+                        if (!token?.trim()) {
+                            throw new ResolverVendorUnavailableError(CAPSOLVER_VENDOR_ID, "transport_failure", {
+                                phase,
+                            });
+                        }
+                        return { form: "token", token };
+                    }
+                };
+                return traceRecorder
+                    ? await traceRecorder.runSpan("resolver.vendor.poll_result", pollResult, {
+                        attributes: {
+                            vendor: CAPSOLVER_VENDOR_ID,
+                            challenge_kind: challenge.kind,
+                        },
+                        onError: (error) => spanErrorAttributes(error, "poll_result"),
+                    })
+                    : await pollResult();
+            }
+            catch (error) {
+                if (callerSignal.aborted)
+                    throw abortReason(callerSignal);
+                if (error instanceof CapsolverSolveTimeoutError ||
+                    solveController.signal.reason instanceof CapsolverSolveTimeoutError) {
+                    throw new ResolverVendorUnavailableError(CAPSOLVER_VENDOR_ID, "timeout", {
+                        cause: error,
+                        phase,
+                    });
+                }
+                if (error instanceof ResolverVendorUnavailableError ||
+                    error instanceof ResolverChallengeVerdictError) {
+                    throw error;
+                }
+                throw new ResolverVendorUnavailableError(CAPSOLVER_VENDOR_ID, "transport_failure", {
+                    ...safeCauseOptions(error, sensitiveValues),
+                    phase,
+                });
+            }
+            finally {
+                if (timeout !== undefined)
+                    clearTimeout(timeout);
+                callerSignal.removeEventListener("abort", onCallerAbort);
+            }
+        },
+    };
+}