@apifuse/provider-sdk 2.2.0-beta.32 → 2.2.0-beta.35

package/dist/runtime/choice.js

@@ -3,7 +3,6 @@ import { assertFreshProviderChoiceIssuedAt, ProviderChoiceTokenError, } from "..
 import { isProviderError, ProviderError } from "../errors.js";
 import { CHOICE_WORDLIST_SIZE, choiceWordAt, HIGH_CHOICE_WORD_COUNT, isChoiceWord, STANDARD_CHOICE_WORD_COUNT, } from "./choice-wordlist.js";
 export const PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV = "APIFUSE__PROVIDER_RUNTIME__CHOICE_TOKEN_MASTER_SECRET";
-export const PROVIDER_RUNTIME_CHOICE_WORD_ISSUANCE_ENV = "APIFUSE__PROVIDER_RUNTIME__CHOICE_WORD_ISSUANCE";
 const PRIMARY_CHOICE_TOKEN_KID = "v1";
 const MANAGED_CHOICE_TOKEN_VERSION = 1;
 const SERVER_STORED_CHOICE_RECORD_VERSION = 1;
@@ -16,7 +15,6 @@ export function createProviderChoiceContext(options) {
         const issuedAtMs = issueOptions.nowMs ?? Date.now();
         const resolvedStorage = resolveIssueStorage(issueOptions.storage, issueOptions.payload);
         if (resolvedStorage.mode === "server") {
-            const issuance = resolveChoiceWordIssuance(options.env);
             const keys = hasRequestedChoiceBinding(issueOptions.bind)
                 ? deriveManagedChoiceKeys({
                     masterSecret: resolveMasterSecret(),
@@ -42,28 +40,8 @@ export function createProviderChoiceContext(options) {
                 ttl_ms: issueOptions.ttlMs,
                 binding,
             };
-            if (issuance === "legacy") {
-                const legacyKeys = keys ??
-                    deriveManagedChoiceKeys({
-                        masterSecret: resolveMasterSecret(),
-                        providerId: options.providerId,
-                        purpose: issueOptions.purpose,
-                        kid,
-                    });
-                return issueLegacyServerStoredChoice({
-                    baseEnvelope,
-                    issueOptions,
-                    storage: resolvedStorage.storage,
-                    contextState: options.state,
-                    kid,
-                    keys: legacyKeys,
-                    issuedAtMs,
-                });
-            }
             return issueWordServerStoredChoice({
-                baseEnvelope: {
-                    ...baseEnvelope,
-                },
+                baseEnvelope,
                 issueOptions,
                 storage: resolvedStorage.storage,
                 contextState: options.state,
@@ -139,10 +117,9 @@ export function createProviderChoiceContext(options) {
                 consumeMode,
             });
         }
-        // Legacy encrypted-envelope compatibility fallback. Removal is gated on
-        // the last legacy mint plus the maximum issued TTL; see ADR 0006.
-        // A structurally valid word token returns above, so lookup, expiry,
-        // consumption, and binding failures can never enter this branch.
+        // Inline choices continue to use the encrypted envelope. A structurally
+        // valid word token returns above, so lookup, expiry, consumption, and
+        // binding failures can never enter this branch.
         try {
             const [actualPrefix, tokenKid, encodedIv, encryptedPayload, authTag, signature] = parseManagedChoiceTokenParts(parseOptions.token);
             if (actualPrefix !== parseOptions.prefix ||
@@ -188,15 +165,12 @@ export function createProviderChoiceContext(options) {
                     required: true,
                 }),
             });
-            const payload = isServerChoiceHandlePayload(envelope.payload)
-                ? parseLegacyServerStoredChoice({
-                    handle: envelope.payload,
-                    storage: parseOptions.storage,
-                    contextState: options.state,
-                })
-                : envelope.payload;
+            if (isServerChoiceHandlePayload(envelope.payload)) {
+                throw wordChoiceNotFoundError();
+            }
+            const payload = envelope.payload;
             const parsed = consumeMode === "explicit"
-                ? Promise.resolve(payload).then((resolvedPayload) => createLegacyExplicitParseResult({
+                ? Promise.resolve(payload).then((resolvedPayload) => createInlineExplicitParseResult({
                     payload: resolvedPayload,
                     replayKey: digestChoiceReplayKey(parseOptions.token),
                     onConsume: () => emitChoiceTelemetry(options.onTelemetry, {
@@ -296,7 +270,7 @@ function emitChoiceTelemetry(onTelemetry, event) {
         // Observability must never change provider token semantics.
     }
 }
-function createLegacyExplicitParseResult(options) {
+function createInlineExplicitParseResult(options) {
     return {
         status: "active",
         payload: options.payload,
@@ -307,20 +281,6 @@ function createLegacyExplicitParseResult(options) {
         },
     };
 }
-function resolveChoiceWordIssuance(env) {
-    const configured = env?.get(PROVIDER_RUNTIME_CHOICE_WORD_ISSUANCE_ENV);
-    const value = configured?.trim() ?? "";
-    if (value === "" || value === "legacy")
-        return "legacy";
-    if (value === "word")
-        return "word";
-    throw new ProviderError(`Unsupported provider choice word issuance mode "${value}". Expected "legacy" or "word".`, {
-        code: "CHOICE_WORD_ISSUANCE_INVALID",
-        category: "input_validation",
-        retryable: false,
-        details: { env: PROVIDER_RUNTIME_CHOICE_WORD_ISSUANCE_ENV },
-    });
-}
 function resolveChoiceMasterSecret(options) {
     const configured = options.masterSecret ?? options.env?.get(PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV);
     const trimmed = configured?.trim();
@@ -420,47 +380,6 @@ async function issueWordServerStoredChoice(options) {
         retryable: false,
     });
 }
-/**
- * Beta.28-compatible server handle issuance. The state stores the payload and
- * the client receives the existing six-part encrypted envelope whose payload
- * is a server-state handle.
- */
-async function issueLegacyServerStoredChoice(options) {
-    const serializedPayload = serializeChoicePayload(options.issueOptions.payload);
-    const payloadBytes = Buffer.byteLength(serializedPayload, "utf8");
-    if (payloadBytes > options.storage.maxValueBytes) {
-        throw new ProviderError("Provider choice payload exceeds state storage policy.", {
-            code: "CHOICE_STATE_PAYLOAD_TOO_LARGE",
-            category: "input_validation",
-            retryable: false,
-            details: { maxValueBytes: options.storage.maxValueBytes, payloadBytes },
-        });
-    }
-    const stateId = `choice_${randomBytes(16).toString("base64url")}`;
-    const namespace = resolveChoiceStateNamespace({
-        storage: options.storage,
-        contextState: options.contextState,
-        ttlMs: options.issueOptions.ttlMs,
-    });
-    await namespace.set(optionsStateKey(stateId), options.issueOptions.payload, {
-        ttl: stateTtl(options.storage, options.issueOptions.ttlMs),
-    });
-    const envelope = {
-        ...options.baseEnvelope,
-        payload: {
-            storage: "server",
-            state_id: stateId,
-            payload_digest: digestChoicePayload(serializedPayload),
-            created_at_ms: options.issuedAtMs,
-        },
-    };
-    return encryptManagedChoiceToken({
-        prefix: options.issueOptions.prefix,
-        kid: options.kid,
-        envelope,
-        keys: options.keys,
-    });
-}
 async function parseWordServerStoredChoice(options) {
     const storage = resolveParseStorage(options.parseOptions.storage);
     const namespace = resolveChoiceStateNamespace({
@@ -579,41 +498,6 @@ async function consumeWordServerStoredChoice(options) {
         throw wordChoiceNotFoundError();
     }
 }
-async function parseLegacyServerStoredChoice(options) {
-    const storage = resolveParseStorage(options.storage);
-    const namespace = resolveChoiceStateNamespace({
-        storage,
-        contextState: options.contextState,
-    });
-    // Reading a server-stored choice back deserializes a persisted value. A
-    // corrupt/undecodable value would otherwise surface as a raw JSON.parse
-    // SyntaxError (or another unexpected throwable) that escapes the choice error
-    // taxonomy, gets masked as internal_error 500, and is treated as retryable by
-    // the hub -> reservation restart loop (2026-07-22 catchtable RCA, candidate A).
-    // Convert any non-branded throwable into a branded invalid_payload so it maps
-    // to a clean, non-retryable 400. Branded ProviderChoiceTokenError and genuine
-    // ProviderError (e.g. Redis-unavailable / state-unavailable) pass through so
-    // their category/retryable semantics are preserved.
-    let record;
-    try {
-        record = await namespace.get(optionsStateKey(options.handle.state_id));
-    }
-    catch (error) {
-        if (error instanceof ProviderChoiceTokenError || isProviderError(error)) {
-            throw error;
-        }
-        throw new ProviderChoiceTokenError("invalid_payload", "Provider choice token state payload could not be decoded.");
-    }
-    if (!record) {
-        throw new ProviderChoiceTokenError("invalid_payload", "Provider choice token state payload is missing.");
-    }
-    const serializedPayload = serializeChoicePayload(record.value);
-    assertPayloadDigestMatches({
-        actual: digestChoicePayload(serializedPayload),
-        expected: options.handle.payload_digest,
-    });
-    return record.value;
-}
 function generateChoiceWordSequence(wordCount) {
     return Array.from({ length: wordCount }, () => choiceWordAt(randomInt(CHOICE_WORDLIST_SIZE))).join("-");
 }

package/dist/runtime/resolver-vendors/browser.d.ts

@@ -3,6 +3,8 @@ import { type BrowserClientOptions } from "../browser.js";
 import type { TraceRecorder } from "../trace.js";
 import { type ResolverIdentity, type ResolverVendorAdapter } from "./types.js";
 type BrowserClientFactory = (options: BrowserClientOptions) => BrowserClient;
+/** Internal test seam; deliberately not re-exported from the package root. */
+export declare function swapBrowserResolverClientFactoryForTests(factory: BrowserClientFactory | undefined): () => void;
 export interface BrowserResolverVendorOptions {
     readonly cdpUrl?: string;
     readonly timeoutMs: number;

package/dist/runtime/resolver-vendors/browser.js

@@ -5,10 +5,25 @@ import { assertResolverHostAllowed, normalizedResolverHostname } from "./hosts.j
 import { ResolverVendorUnavailableError, } from "./types.js";
 const BROWSER_VENDOR_ID = "browser";
 const DEFAULT_COOKIE_POLL_INTERVAL_MS = 100;
+const AWS_WAF_CHALLENGE_INFRASTRUCTURE_HOST_SUFFIX = ".awswaf.com";
+const RESOLVER_DOCUMENT_CONTENT_SECURITY_POLICY = "connect-src http: https:; worker-src 'none'";
 const SUCCESS_COOKIE_NAMES = {
     aws_waf: "aws-waf-token",
     cloudflare_interstitial: "cf_clearance",
 };
+let createResolverBrowserClient = createBrowserClient;
+/** Internal test seam; deliberately not re-exported from the package root. */
+export function swapBrowserResolverClientFactoryForTests(factory) {
+    const original = createResolverBrowserClient;
+    createResolverBrowserClient = factory ?? createBrowserClient;
+    let restored = false;
+    return () => {
+        if (restored)
+            return;
+        restored = true;
+        createResolverBrowserClient = original;
+    };
+}
 class BrowserSolveTimeoutError extends Error {
     constructor() {
         super("Browser resolver solve budget elapsed");
@@ -126,22 +141,58 @@ function selectSuccessCookie(cookies, successCookieName, pageUrl) {
         cookieDomainSpecificity(right) - cookieDomainSpecificity(left) ||
         right.path.length - left.path.length)[0];
 }
-async function solveInPage(page, pageUrl, successCookieName, pollIntervalMs, signal) {
-    await raceWithAbort(() => page.goto(pageUrl), signal);
-    while (true) {
-        const cookies = await raceWithAbort(() => page.cookies(), signal);
-        const successCookie = selectSuccessCookie(cookies, successCookieName, pageUrl);
-        if (successCookie) {
-            const userAgent = await raceWithAbort(() => page.evaluate("navigator.userAgent"), signal);
-            return {
-                form: "cookies",
-                cookies: { [successCookieName]: successCookie.value },
-                userAgent,
-                ...(successCookie.expires === undefined ? {} : { expires: successCookie.expires }),
-            };
+async function solveInPage(page, challengeKind, pageUrl, allowedHosts, successCookieName, pollIntervalMs, signal) {
+    return await page.withResourcePolicy({
+        allowedMethods: ["GET", "HEAD", "POST"],
+        documentContentSecurityPolicy: RESOLVER_DOCUMENT_CONTENT_SECURITY_POLICY,
+        routes: [
+            {
+                match: () => true,
+                handle: (request) => ({
+                    action: isResolverBrowserRequestAllowed(request.url, challengeKind, allowedHosts)
+                        ? "continue"
+                        : "block",
+                }),
+            },
+        ],
+    }, async () => {
+        const userAgent = await raceWithAbort(() => page.userAgent(), signal);
+        await raceWithAbort(() => page.goto(pageUrl), signal);
+        while (true) {
+            const cookies = await raceWithAbort(() => page.cookies(), signal);
+            const successCookie = selectSuccessCookie(cookies, successCookieName, pageUrl);
+            if (successCookie) {
+                return {
+                    form: "cookies",
+                    cookies: { [successCookieName]: successCookie.value },
+                    userAgent,
+                    ...(successCookie.expires === undefined ? {} : { expires: successCookie.expires }),
+                };
+            }
+            await abortableDelay(pollIntervalMs, signal);
         }
-        await abortableDelay(pollIntervalMs, signal);
+    });
+}
+function isResolverBrowserRequestAllowed(targetUrl, challengeKind, allowedHosts) {
+    try {
+        assertResolverHostAllowed(targetUrl, allowedHosts);
+        return true;
+    }
+    catch {
+        if (challengeKind !== "aws_waf")
+            return false;
+    }
+    let target;
+    try {
+        target = new URL(targetUrl);
+    }
+    catch {
+        return false;
     }
+    const hostname = normalizedResolverHostname(target.hostname);
+    return (target.protocol === "https:" &&
+        hostname.length > AWS_WAF_CHALLENGE_INFRASTRUCTURE_HOST_SUFFIX.length &&
+        hostname.endsWith(AWS_WAF_CHALLENGE_INFRASTRUCTURE_HOST_SUFFIX));
 }
 const POOL_ALLOCATION_EXHAUSTED_CODES = new Set([
     -32_001, // queue full
@@ -188,7 +239,7 @@ async function closeBrowserClient(client, timeoutMs, challengeKind, traceRecorde
     await runBoundedCleanup(() => close.call(client), timeoutMs, challengeKind, "client.close", traceRecorder);
 }
 export function createBrowserResolverVendorAdapter(options) {
-    const createClient = options.createClient ?? createBrowserClient;
+    const createClient = options.createClient ?? createResolverBrowserClient;
     const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_COOKIE_POLL_INTERVAL_MS;
     return {
         id: BROWSER_VENDOR_ID,
@@ -235,10 +286,11 @@ export function createBrowserResolverVendorAdapter(options) {
                     cdpUrl: cdpUrl ?? "",
                     ...(proxyUrl === undefined ? {} : { proxy: proxyUrl }),
                     requireCdpPool: cdpUrl !== undefined,
+                    serviceWorkers: "block",
                 });
                 const contextOperation = client.withIsolatedContext(async (page) => {
                     handlerEntered = true;
-                    return await solveInPage(page, challenge.pageUrl, SUCCESS_COOKIE_NAMES[challengeKind], pollIntervalMs, solveController.signal);
+                    return await solveInPage(page, challengeKind, challenge.pageUrl, options.allowedHosts, SUCCESS_COOKIE_NAMES[challengeKind], pollIntervalMs, solveController.signal);
                 });
                 try {
                     return await raceWithAbort(() => contextOperation, solveController.signal);

package/dist/runtime/resolver-vendors/capsolver.d.ts

@@ -16,9 +16,7 @@ export interface CapsolverResolverVendorOptions {
 }
 export interface CapsolverResolverVendorAdapter extends ResolverVendorAdapter {
     readonly id: "capsolver";
-    solve(challenge: ProviderChallenge, identity: ResolverIdentity | undefined, signal: AbortSignal, traceRecorder?: TraceRecorder): Promise<Extract<ChallengeSolution, {
-        readonly form: "token";
-    }>>;
+    solve(challenge: ProviderChallenge, identity: ResolverIdentity | undefined, signal: AbortSignal, traceRecorder?: TraceRecorder): Promise<ChallengeSolution>;
 }
 export declare function createCapsolverResolverVendorAdapter(options: CapsolverResolverVendorOptions): CapsolverResolverVendorAdapter;
 export {};

package/dist/runtime/resolver-vendors/capsolver.js

@@ -1,4 +1,6 @@
+import { getStealthProfile } from "../../stealth/profiles.js";
 import { redactSensitiveText } from "../request-options.js";
+import { DEFAULT_PROFILE } from "../stealth.js";
 import { assertResolverHostAllowed } from "./hosts.js";
 import { ResolverChallengeVerdictError, ResolverVendorUnavailableError, resolverVendorSupports, } from "./types.js";
 const CAPSOLVER_VENDOR_ID = "capsolver";
@@ -138,14 +140,45 @@ function parseCreateTaskResponse(payload) {
 }
 function parsePollResultResponse(payload) {
     const solution = isJsonRecord(payload.solution) ? payload.solution : undefined;
+    const cookies = solution && isJsonRecord(solution.cookies)
+        ? Object.fromEntries(Object.entries(solution.cookies).filter((entry) => typeof entry[1] === "string"))
+        : undefined;
     return {
         ...responseErrorFields(payload),
         status: typeof payload.status === "string" ? payload.status : undefined,
         solution: solution
-            ? { token: typeof solution.token === "string" ? solution.token : undefined }
+            ? {
+                token: typeof solution.token === "string" ? solution.token : undefined,
+                cookie: typeof solution.cookie === "string" ? solution.cookie : undefined,
+                gRecaptchaResponse: typeof solution.gRecaptchaResponse === "string"
+                    ? solution.gRecaptchaResponse
+                    : undefined,
+                cookies,
+                userAgent: typeof solution.userAgent === "string" ? solution.userAgent : undefined,
+            }
             : undefined,
     };
 }
+function proxyForCapsolver(proxyUrl) {
+    try {
+        const url = new URL(proxyUrl);
+        const protocol = url.protocol.slice(0, -1).toLowerCase();
+        const scheme = protocol === "http" || protocol === "socks5" ? protocol : undefined;
+        const port = Number(url.port || (scheme === "socks5" ? 1080 : 80));
+        if (!scheme || !url.hostname || !Number.isInteger(port) || port <= 0 || port > 65_535) {
+            return undefined;
+        }
+        const username = url.username ? decodeURIComponent(url.username) : "";
+        const password = url.password ? decodeURIComponent(url.password) : "";
+        if (username.includes(":") || password.includes(":"))
+            return undefined;
+        const value = `${scheme}:${url.hostname}:${port}${username || password ? `:${username}:${password}` : ""}`;
+        return { value, sensitive: [proxyUrl, value, username, password].filter(Boolean) };
+    }
+    catch {
+        return undefined;
+    }
+}
 function isAllocationExhausted(payload) {
     const code = payload.errorCode?.toLowerCase() ?? "";
     const description = payload.errorDescription?.toLowerCase() ?? "";
@@ -266,7 +299,7 @@ export function createCapsolverResolverVendorAdapter(options) {
         supports(kind) {
             return resolverVendorSupports(CAPSOLVER_VENDOR_ID, kind);
         },
-        async solve(challenge, _identity, callerSignal, traceRecorder) {
+        async solve(challenge, identity, callerSignal, traceRecorder) {
             const apiKey = options.apiKey?.trim();
             if (!apiKey) {
                 throw new ResolverVendorUnavailableError(CAPSOLVER_VENDOR_ID, "missing_credentials", {
@@ -276,17 +309,34 @@ export function createCapsolverResolverVendorAdapter(options) {
             if (!resolverVendorSupports(CAPSOLVER_VENDOR_ID, challenge.kind)) {
                 throw new TypeError(`Capsolver resolver does not support ${challenge.kind}`);
             }
-            if (challenge.kind !== "turnstile") {
-                throw new ResolverVendorUnavailableError(CAPSOLVER_VENDOR_ID, "not_implemented", {
+            const proxy = identity ? proxyForCapsolver(identity.proxyUrl) : undefined;
+            if (challenge.kind === "aws_waf" && identity && !proxy) {
+                throw new ResolverVendorUnavailableError(CAPSOLVER_VENDOR_ID, "transport_failure", {
+                    phase: "create_task",
+                });
+            }
+            if (challenge.kind === "cloudflare_interstitial" && !identity) {
+                throw new ResolverVendorUnavailableError(CAPSOLVER_VENDOR_ID, "missing_proxy_identity", {
                     phase: "create_task",
                 });
             }
+            if (identity && !proxy) {
+                throw new ResolverVendorUnavailableError(CAPSOLVER_VENDOR_ID, "transport_failure", {
+                    phase: "create_task",
+                });
+            }
+            const challengeFields = challenge;
             const sensitiveValues = [
                 apiKey,
                 challenge.pageUrl,
-                challenge.siteKey,
-                ...(challenge.action !== undefined ? [challenge.action] : []),
-                ...(challenge.cdata !== undefined ? [challenge.cdata] : []),
+                ...(typeof challengeFields.siteKey === "string" ? [challengeFields.siteKey] : []),
+                ...(typeof challengeFields.action === "string" ? [challengeFields.action] : []),
+                ...(typeof challengeFields.cdata === "string" ? [challengeFields.cdata] : []),
+                ...(typeof challengeFields.blockedHtml === "string" ? [challengeFields.blockedHtml] : []),
+                ...(typeof challengeFields.captchaScript === "string" ? [challengeFields.captchaScript] : []),
+                ...(typeof challengeFields.context === "string" ? [challengeFields.context] : []),
+                ...(typeof challengeFields.iv === "string" ? [challengeFields.iv] : []),
+                ...(proxy?.sensitive ?? []),
             ];
             assertResolverHostAllowed(challenge.pageUrl, options.allowedHosts);
             callerSignal.throwIfAborted();
@@ -300,21 +350,69 @@ export function createCapsolverResolverVendorAdapter(options) {
             let phase = "create_task";
             try {
                 const createTask = async () => {
-                    const metadata = {
-                        ...(challenge.action !== undefined ? { action: challenge.action } : {}),
-                        ...(challenge.cdata !== undefined ? { cdata: challenge.cdata } : {}),
-                    };
-                    const createResult = await postJson(fetchImpl, endpoint(baseUrl, "createTask"), {
-                        clientKey: apiKey,
-                        task: {
-                            type: "AntiTurnstileTaskProxyLess",
+                    const task = challenge.kind === "aws_waf"
+                        ? {
+                            type: proxy ? "AntiAwsWafTask" : "AntiAwsWafTaskProxyLess",
                             websiteURL: challenge.pageUrl,
-                            websiteKey: challenge.siteKey,
-                            ...(challenge.action !== undefined || challenge.cdata !== undefined
-                                ? { metadata }
+                            ...(challenge.siteKey !== undefined ? { awsKey: challenge.siteKey } : {}),
+                            ...(challenge.iv !== undefined ? { awsIv: challenge.iv } : {}),
+                            ...(challenge.context !== undefined ? { awsContext: challenge.context } : {}),
+                            ...(challenge.captchaScript !== undefined
+                                ? { awsChallengeJS: challenge.captchaScript }
                                 : {}),
-                        },
-                    }, solveController.signal, phase, sensitiveValues, parseCreateTaskResponse);
+                            ...(proxy ? { proxy: proxy.value } : {}),
+                        }
+                        : challenge.kind === "turnstile"
+                            ? {
+                                type: "AntiTurnstileTaskProxyLess",
+                                websiteURL: challenge.pageUrl,
+                                websiteKey: challenge.siteKey,
+                                ...(challenge.action !== undefined || challenge.cdata !== undefined
+                                    ? {
+                                        metadata: {
+                                            ...(challenge.action !== undefined ? { action: challenge.action } : {}),
+                                            ...(challenge.cdata !== undefined ? { cdata: challenge.cdata } : {}),
+                                        },
+                                    }
+                                    : {}),
+                            }
+                            : challenge.kind === "recaptcha_v2"
+                                ? {
+                                    type: proxy ? "ReCaptchaV2Task" : "ReCaptchaV2TaskProxyLess",
+                                    websiteURL: challenge.pageUrl,
+                                    websiteKey: challenge.siteKey,
+                                    ...(proxy ? { proxy: proxy.value } : {}),
+                                }
+                                : challenge.kind === "recaptcha_v3"
+                                    ? {
+                                        type: proxy ? "ReCaptchaV3Task" : "ReCaptchaV3TaskProxyLess",
+                                        websiteURL: challenge.pageUrl,
+                                        websiteKey: challenge.siteKey,
+                                        pageAction: challenge.action,
+                                        ...(challenge.minScore !== undefined ? { minScore: challenge.minScore } : {}),
+                                        ...(proxy ? { proxy: proxy.value } : {}),
+                                    }
+                                    : challenge.kind === "hcaptcha"
+                                        ? {
+                                            type: proxy ? "HCaptchaTask" : "HCaptchaTaskProxyLess",
+                                            websiteURL: challenge.pageUrl,
+                                            websiteKey: challenge.siteKey,
+                                            ...(proxy ? { proxy: proxy.value } : {}),
+                                        }
+                                        : challenge.kind === "cloudflare_interstitial"
+                                            ? {
+                                                type: "AntiCloudflareTask",
+                                                websiteURL: challenge.pageUrl,
+                                                proxy: proxy?.value,
+                                                ...(identity?.userAgent ? { userAgent: identity.userAgent } : {}),
+                                                ...(challenge.kind === "cloudflare_interstitial" && challenge.blockedHtml !== undefined
+                                                    ? { html: challenge.blockedHtml }
+                                                    : {}),
+                                            }
+                                            : (() => {
+                                                throw new TypeError(`Capsolver resolver does not support ${challenge.kind}`);
+                                            })();
+                    const createResult = await postJson(fetchImpl, endpoint(baseUrl, "createTask"), { clientKey: apiKey, task }, solveController.signal, phase, sensitiveValues, parseCreateTaskResponse);
                     const taskId = createResult.payload.taskId;
                     if (!createResult.ok || createResult.payload.errorId !== 0 || taskId === undefined) {
                         throw unavailableForPayload(createResult.payload, phase, sensitiveValues);
@@ -352,15 +450,41 @@ export function createCapsolverResolverVendorAdapter(options) {
                             case "ready":
                                 break;
                             default:
-                                throw new ResolverVendorUnavailableError(CAPSOLVER_VENDOR_ID, "transport_failure", { phase });
+                                throw new ResolverVendorUnavailableError(CAPSOLVER_VENDOR_ID, "transport_failure", {
+                                    phase,
+                                });
+                        }
+                        const solutionValue = challenge.kind === "aws_waf"
+                            ? result.payload.solution?.cookie
+                            : result.payload.solution?.token ?? result.payload.solution?.gRecaptchaResponse;
+                        if (challenge.kind === "cloudflare_interstitial") {
+                            const cookies = result.payload.solution?.cookies;
+                            const clearance = cookies?.cf_clearance ?? solutionValue;
+                            if (!clearance?.trim()) {
+                                throw new ResolverVendorUnavailableError(CAPSOLVER_VENDOR_ID, "transport_failure", {
+                                    phase,
+                                });
+                            }
+                            return {
+                                form: "cookies",
+                                cookies: cookies && Object.keys(cookies).length > 0 ? cookies : { cf_clearance: clearance },
+                                userAgent: result.payload.solution?.userAgent ??
+                                    identity?.userAgent ??
+                                    getStealthProfile(DEFAULT_PROFILE).userAgent,
+                            };
                         }
-                        const token = result.payload.solution?.token;
-                        if (!token?.trim()) {
+                        if (!solutionValue?.trim()) {
                             throw new ResolverVendorUnavailableError(CAPSOLVER_VENDOR_ID, "transport_failure", {
                                 phase,
                             });
                         }
-                        return { form: "token", token };
+                        return challenge.kind === "aws_waf"
+                            ? {
+                                form: "cookies",
+                                cookies: { "aws-waf-token": solutionValue },
+                                userAgent: identity?.userAgent ?? getStealthProfile(DEFAULT_PROFILE).userAgent,
+                            }
+                            : { form: "token", token: solutionValue };
                     }
                 };
                 return traceRecorder