@apifuse/provider-sdk 2.2.0-beta.31 → 2.2.0-beta.33

package/dist/runtime/choice.js

@@ -3,7 +3,6 @@ import { assertFreshProviderChoiceIssuedAt, ProviderChoiceTokenError, } from "..
 import { isProviderError, ProviderError } from "../errors.js";
 import { CHOICE_WORDLIST_SIZE, choiceWordAt, HIGH_CHOICE_WORD_COUNT, isChoiceWord, STANDARD_CHOICE_WORD_COUNT, } from "./choice-wordlist.js";
 export const PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV = "APIFUSE__PROVIDER_RUNTIME__CHOICE_TOKEN_MASTER_SECRET";
-export const PROVIDER_RUNTIME_CHOICE_WORD_ISSUANCE_ENV = "APIFUSE__PROVIDER_RUNTIME__CHOICE_WORD_ISSUANCE";
 const PRIMARY_CHOICE_TOKEN_KID = "v1";
 const MANAGED_CHOICE_TOKEN_VERSION = 1;
 const SERVER_STORED_CHOICE_RECORD_VERSION = 1;
@@ -16,7 +15,6 @@ export function createProviderChoiceContext(options) {
         const issuedAtMs = issueOptions.nowMs ?? Date.now();
         const resolvedStorage = resolveIssueStorage(issueOptions.storage, issueOptions.payload);
         if (resolvedStorage.mode === "server") {
-            const issuance = resolveChoiceWordIssuance(options.env);
             const keys = hasRequestedChoiceBinding(issueOptions.bind)
                 ? deriveManagedChoiceKeys({
                     masterSecret: resolveMasterSecret(),
@@ -42,28 +40,8 @@ export function createProviderChoiceContext(options) {
                 ttl_ms: issueOptions.ttlMs,
                 binding,
             };
-            if (issuance === "legacy") {
-                const legacyKeys = keys ??
-                    deriveManagedChoiceKeys({
-                        masterSecret: resolveMasterSecret(),
-                        providerId: options.providerId,
-                        purpose: issueOptions.purpose,
-                        kid,
-                    });
-                return issueLegacyServerStoredChoice({
-                    baseEnvelope,
-                    issueOptions,
-                    storage: resolvedStorage.storage,
-                    contextState: options.state,
-                    kid,
-                    keys: legacyKeys,
-                    issuedAtMs,
-                });
-            }
             return issueWordServerStoredChoice({
-                baseEnvelope: {
-                    ...baseEnvelope,
-                },
+                baseEnvelope,
                 issueOptions,
                 storage: resolvedStorage.storage,
                 contextState: options.state,
@@ -307,20 +285,6 @@ function createLegacyExplicitParseResult(options) {
         },
     };
 }
-function resolveChoiceWordIssuance(env) {
-    const configured = env?.get(PROVIDER_RUNTIME_CHOICE_WORD_ISSUANCE_ENV);
-    const value = configured?.trim() ?? "";
-    if (value === "" || value === "legacy")
-        return "legacy";
-    if (value === "word")
-        return "word";
-    throw new ProviderError(`Unsupported provider choice word issuance mode "${value}". Expected "legacy" or "word".`, {
-        code: "CHOICE_WORD_ISSUANCE_INVALID",
-        category: "input_validation",
-        retryable: false,
-        details: { env: PROVIDER_RUNTIME_CHOICE_WORD_ISSUANCE_ENV },
-    });
-}
 function resolveChoiceMasterSecret(options) {
     const configured = options.masterSecret ?? options.env?.get(PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV);
     const trimmed = configured?.trim();
@@ -420,47 +384,6 @@ async function issueWordServerStoredChoice(options) {
         retryable: false,
     });
 }
-/**
- * Beta.28-compatible server handle issuance. The state stores the payload and
- * the client receives the existing six-part encrypted envelope whose payload
- * is a server-state handle.
- */
-async function issueLegacyServerStoredChoice(options) {
-    const serializedPayload = serializeChoicePayload(options.issueOptions.payload);
-    const payloadBytes = Buffer.byteLength(serializedPayload, "utf8");
-    if (payloadBytes > options.storage.maxValueBytes) {
-        throw new ProviderError("Provider choice payload exceeds state storage policy.", {
-            code: "CHOICE_STATE_PAYLOAD_TOO_LARGE",
-            category: "input_validation",
-            retryable: false,
-            details: { maxValueBytes: options.storage.maxValueBytes, payloadBytes },
-        });
-    }
-    const stateId = `choice_${randomBytes(16).toString("base64url")}`;
-    const namespace = resolveChoiceStateNamespace({
-        storage: options.storage,
-        contextState: options.contextState,
-        ttlMs: options.issueOptions.ttlMs,
-    });
-    await namespace.set(optionsStateKey(stateId), options.issueOptions.payload, {
-        ttl: stateTtl(options.storage, options.issueOptions.ttlMs),
-    });
-    const envelope = {
-        ...options.baseEnvelope,
-        payload: {
-            storage: "server",
-            state_id: stateId,
-            payload_digest: digestChoicePayload(serializedPayload),
-            created_at_ms: options.issuedAtMs,
-        },
-    };
-    return encryptManagedChoiceToken({
-        prefix: options.issueOptions.prefix,
-        kid: options.kid,
-        envelope,
-        keys: options.keys,
-    });
-}
 async function parseWordServerStoredChoice(options) {
     const storage = resolveParseStorage(options.parseOptions.storage);
     const namespace = resolveChoiceStateNamespace({

package/dist/runtime/resolver-vendors/browser.d.ts

@@ -3,6 +3,8 @@ import { type BrowserClientOptions } from "../browser.js";
 import type { TraceRecorder } from "../trace.js";
 import { type ResolverIdentity, type ResolverVendorAdapter } from "./types.js";
 type BrowserClientFactory = (options: BrowserClientOptions) => BrowserClient;
+/** Internal test seam; deliberately not re-exported from the package root. */
+export declare function swapBrowserResolverClientFactoryForTests(factory: BrowserClientFactory | undefined): () => void;
 export interface BrowserResolverVendorOptions {
     readonly cdpUrl?: string;
     readonly timeoutMs: number;

package/dist/runtime/resolver-vendors/browser.js

@@ -5,10 +5,25 @@ import { assertResolverHostAllowed, normalizedResolverHostname } from "./hosts.j
 import { ResolverVendorUnavailableError, } from "./types.js";
 const BROWSER_VENDOR_ID = "browser";
 const DEFAULT_COOKIE_POLL_INTERVAL_MS = 100;
+const AWS_WAF_CHALLENGE_INFRASTRUCTURE_HOST_SUFFIX = ".awswaf.com";
+const RESOLVER_DOCUMENT_CONTENT_SECURITY_POLICY = "connect-src http: https:; worker-src 'none'";
 const SUCCESS_COOKIE_NAMES = {
     aws_waf: "aws-waf-token",
     cloudflare_interstitial: "cf_clearance",
 };
+let createResolverBrowserClient = createBrowserClient;
+/** Internal test seam; deliberately not re-exported from the package root. */
+export function swapBrowserResolverClientFactoryForTests(factory) {
+    const original = createResolverBrowserClient;
+    createResolverBrowserClient = factory ?? createBrowserClient;
+    let restored = false;
+    return () => {
+        if (restored)
+            return;
+        restored = true;
+        createResolverBrowserClient = original;
+    };
+}
 class BrowserSolveTimeoutError extends Error {
     constructor() {
         super("Browser resolver solve budget elapsed");
@@ -126,22 +141,58 @@ function selectSuccessCookie(cookies, successCookieName, pageUrl) {
         cookieDomainSpecificity(right) - cookieDomainSpecificity(left) ||
         right.path.length - left.path.length)[0];
 }
-async function solveInPage(page, pageUrl, successCookieName, pollIntervalMs, signal) {
-    await raceWithAbort(() => page.goto(pageUrl), signal);
-    while (true) {
-        const cookies = await raceWithAbort(() => page.cookies(), signal);
-        const successCookie = selectSuccessCookie(cookies, successCookieName, pageUrl);
-        if (successCookie) {
-            const userAgent = await raceWithAbort(() => page.evaluate("navigator.userAgent"), signal);
-            return {
-                form: "cookies",
-                cookies: { [successCookieName]: successCookie.value },
-                userAgent,
-                ...(successCookie.expires === undefined ? {} : { expires: successCookie.expires }),
-            };
+async function solveInPage(page, challengeKind, pageUrl, allowedHosts, successCookieName, pollIntervalMs, signal) {
+    return await page.withResourcePolicy({
+        allowedMethods: ["GET", "HEAD", "POST"],
+        documentContentSecurityPolicy: RESOLVER_DOCUMENT_CONTENT_SECURITY_POLICY,
+        routes: [
+            {
+                match: () => true,
+                handle: (request) => ({
+                    action: isResolverBrowserRequestAllowed(request.url, challengeKind, allowedHosts)
+                        ? "continue"
+                        : "block",
+                }),
+            },
+        ],
+    }, async () => {
+        const userAgent = await raceWithAbort(() => page.evaluate("navigator.userAgent"), signal);
+        await raceWithAbort(() => page.goto(pageUrl), signal);
+        while (true) {
+            const cookies = await raceWithAbort(() => page.cookies(), signal);
+            const successCookie = selectSuccessCookie(cookies, successCookieName, pageUrl);
+            if (successCookie) {
+                return {
+                    form: "cookies",
+                    cookies: { [successCookieName]: successCookie.value },
+                    userAgent,
+                    ...(successCookie.expires === undefined ? {} : { expires: successCookie.expires }),
+                };
+            }
+            await abortableDelay(pollIntervalMs, signal);
         }
-        await abortableDelay(pollIntervalMs, signal);
+    });
+}
+function isResolverBrowserRequestAllowed(targetUrl, challengeKind, allowedHosts) {
+    try {
+        assertResolverHostAllowed(targetUrl, allowedHosts);
+        return true;
+    }
+    catch {
+        if (challengeKind !== "aws_waf")
+            return false;
+    }
+    let target;
+    try {
+        target = new URL(targetUrl);
+    }
+    catch {
+        return false;
     }
+    const hostname = normalizedResolverHostname(target.hostname);
+    return (target.protocol === "https:" &&
+        hostname.length > AWS_WAF_CHALLENGE_INFRASTRUCTURE_HOST_SUFFIX.length &&
+        hostname.endsWith(AWS_WAF_CHALLENGE_INFRASTRUCTURE_HOST_SUFFIX));
 }
 const POOL_ALLOCATION_EXHAUSTED_CODES = new Set([
     -32_001, // queue full
@@ -188,7 +239,7 @@ async function closeBrowserClient(client, timeoutMs, challengeKind, traceRecorde
     await runBoundedCleanup(() => close.call(client), timeoutMs, challengeKind, "client.close", traceRecorder);
 }
 export function createBrowserResolverVendorAdapter(options) {
-    const createClient = options.createClient ?? createBrowserClient;
+    const createClient = options.createClient ?? createResolverBrowserClient;
     const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_COOKIE_POLL_INTERVAL_MS;
     return {
         id: BROWSER_VENDOR_ID,
@@ -235,10 +286,11 @@ export function createBrowserResolverVendorAdapter(options) {
                     cdpUrl: cdpUrl ?? "",
                     ...(proxyUrl === undefined ? {} : { proxy: proxyUrl }),
                     requireCdpPool: cdpUrl !== undefined,
+                    serviceWorkers: "block",
                 });
                 const contextOperation = client.withIsolatedContext(async (page) => {
                     handlerEntered = true;
-                    return await solveInPage(page, challenge.pageUrl, SUCCESS_COOKIE_NAMES[challengeKind], pollIntervalMs, solveController.signal);
+                    return await solveInPage(page, challengeKind, challenge.pageUrl, options.allowedHosts, SUCCESS_COOKIE_NAMES[challengeKind], pollIntervalMs, solveController.signal);
                 });
                 try {
                     return await raceWithAbort(() => contextOperation, solveController.signal);

package/dist/runtime/resolver-vendors/capsolver.d.ts

@@ -0,0 +1,22 @@
+import type { ChallengeSolution, ProviderChallenge } from "../../types.js";
+import type { TraceRecorder } from "../trace.js";
+import { type ResolverIdentity, type ResolverVendorAdapter } from "./types.js";
+type Delay = (ms: number, signal: AbortSignal) => Promise<void>;
+export interface CapsolverResolverVendorOptions {
+    readonly apiKey?: string;
+    readonly timeoutMs?: number;
+    readonly pollIntervalMs?: number;
+    readonly allowedHosts: readonly string[];
+    readonly fetchImpl?: typeof fetch;
+    readonly baseUrl?: string;
+    /** Test-only clock override; supplying it disables the real-time deadline timer. */
+    readonly now?: () => number;
+    /** Test-only delay override used with `now` to exercise polling without sleeping. */
+    readonly delay?: Delay;
+}
+export interface CapsolverResolverVendorAdapter extends ResolverVendorAdapter {
+    readonly id: "capsolver";
+    solve(challenge: ProviderChallenge, identity: ResolverIdentity | undefined, signal: AbortSignal, traceRecorder?: TraceRecorder): Promise<ChallengeSolution>;
+}
+export declare function createCapsolverResolverVendorAdapter(options: CapsolverResolverVendorOptions): CapsolverResolverVendorAdapter;
+export {};