@apifuse/provider-sdk 2.2.0-beta.32 → 2.2.0-beta.35

package/src/runtime/choice.ts

@@ -39,8 +39,6 @@ import type {
 
 export const PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV =
 	"APIFUSE__PROVIDER_RUNTIME__CHOICE_TOKEN_MASTER_SECRET";
-export const PROVIDER_RUNTIME_CHOICE_WORD_ISSUANCE_ENV =
-	"APIFUSE__PROVIDER_RUNTIME__CHOICE_WORD_ISSUANCE";
 
 const PRIMARY_CHOICE_TOKEN_KID = "v1";
 const MANAGED_CHOICE_TOKEN_VERSION = 1;
@@ -133,7 +131,6 @@ export function createProviderChoiceContext(
 		const issuedAtMs = issueOptions.nowMs ?? Date.now();
 		const resolvedStorage = resolveIssueStorage(issueOptions.storage, issueOptions.payload);
 		if (resolvedStorage.mode === "server") {
-			const issuance = resolveChoiceWordIssuance(options.env);
 			const keys = hasRequestedChoiceBinding(issueOptions.bind)
 				? deriveManagedChoiceKeys({
 						masterSecret: resolveMasterSecret(),
@@ -159,29 +156,8 @@ export function createProviderChoiceContext(
 				ttl_ms: issueOptions.ttlMs,
 				binding,
 			} satisfies Omit<ManagedChoiceEnvelope, "payload">;
-			if (issuance === "legacy") {
-				const legacyKeys =
-					keys ??
-					deriveManagedChoiceKeys({
-						masterSecret: resolveMasterSecret(),
-						providerId: options.providerId,
-						purpose: issueOptions.purpose,
-						kid,
-					});
-				return issueLegacyServerStoredChoice({
-					baseEnvelope,
-					issueOptions,
-					storage: resolvedStorage.storage,
-					contextState: options.state,
-					kid,
-					keys: legacyKeys,
-					issuedAtMs,
-				});
-			}
 			return issueWordServerStoredChoice({
-				baseEnvelope: {
-					...baseEnvelope,
-				},
+				baseEnvelope,
 				issueOptions,
 				storage: resolvedStorage.storage,
 				contextState: options.state,
@@ -287,10 +263,9 @@ export function createProviderChoiceContext(
 			);
 		}
 
-		// Legacy encrypted-envelope compatibility fallback. Removal is gated on
-		// the last legacy mint plus the maximum issued TTL; see ADR 0006.
-		// A structurally valid word token returns above, so lookup, expiry,
-		// consumption, and binding failures can never enter this branch.
+		// Inline choices continue to use the encrypted envelope. A structurally
+		// valid word token returns above, so lookup, expiry, consumption, and
+		// binding failures can never enter this branch.
 		try {
 			const [actualPrefix, tokenKid, encodedIv, encryptedPayload, authTag, signature] =
 				parseManagedChoiceTokenParts(parseOptions.token);
@@ -345,17 +320,14 @@ export function createProviderChoiceContext(
 					required: true,
 				}),
 			});
-			const payload = isServerChoiceHandlePayload(envelope.payload)
-				? parseLegacyServerStoredChoice({
-						handle: envelope.payload,
-						storage: parseOptions.storage,
-						contextState: options.state,
-					})
-				: envelope.payload;
+			if (isServerChoiceHandlePayload(envelope.payload)) {
+				throw wordChoiceNotFoundError();
+			}
+			const payload = envelope.payload;
 			const parsed =
 				consumeMode === "explicit"
 					? Promise.resolve(payload).then((resolvedPayload) =>
-							createLegacyExplicitParseResult({
+							createInlineExplicitParseResult({
 								payload: resolvedPayload,
 								replayKey: digestChoiceReplayKey(parseOptions.token),
 								onConsume: () =>
@@ -495,7 +467,7 @@ function emitChoiceTelemetry(
 	}
 }
 
-function createLegacyExplicitParseResult(options: {
+function createInlineExplicitParseResult(options: {
 	readonly payload: ProviderChoiceTokenPayload;
 	readonly replayKey: string;
 	readonly onConsume: () => void;
@@ -511,22 +483,6 @@ function createLegacyExplicitParseResult(options: {
 	};
 }
 
-function resolveChoiceWordIssuance(env?: EnvContext): "legacy" | "word" {
-	const configured = env?.get(PROVIDER_RUNTIME_CHOICE_WORD_ISSUANCE_ENV);
-	const value = configured?.trim() ?? "";
-	if (value === "" || value === "legacy") return "legacy";
-	if (value === "word") return "word";
-	throw new ProviderError(
-		`Unsupported provider choice word issuance mode "${value}". Expected "legacy" or "word".`,
-		{
-			code: "CHOICE_WORD_ISSUANCE_INVALID",
-			category: "input_validation",
-			retryable: false,
-			details: { env: PROVIDER_RUNTIME_CHOICE_WORD_ISSUANCE_ENV },
-		},
-	);
-}
-
 function resolveChoiceMasterSecret(options: CreateProviderChoiceContextOptions): string {
 	const configured =
 		options.masterSecret ?? options.env?.get(PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV);
@@ -657,56 +613,6 @@ async function issueWordServerStoredChoice<TPayload extends ProviderChoiceTokenP
 	});
 }
 
-/**
- * Beta.28-compatible server handle issuance. The state stores the payload and
- * the client receives the existing six-part encrypted envelope whose payload
- * is a server-state handle.
- */
-async function issueLegacyServerStoredChoice<TPayload extends ProviderChoiceTokenPayload>(options: {
-	readonly baseEnvelope: Omit<ManagedChoiceEnvelope, "payload">;
-	readonly issueOptions: ProviderChoiceIssueOptions<TPayload>;
-	readonly storage: ServerProviderChoiceStorageOptions;
-	readonly contextState?: ProviderRuntimeState;
-	readonly kid: string;
-	readonly keys: ManagedChoiceKeys;
-	readonly issuedAtMs: number;
-}): Promise<string> {
-	const serializedPayload = serializeChoicePayload(options.issueOptions.payload);
-	const payloadBytes = Buffer.byteLength(serializedPayload, "utf8");
-	if (payloadBytes > options.storage.maxValueBytes) {
-		throw new ProviderError("Provider choice payload exceeds state storage policy.", {
-			code: "CHOICE_STATE_PAYLOAD_TOO_LARGE",
-			category: "input_validation",
-			retryable: false,
-			details: { maxValueBytes: options.storage.maxValueBytes, payloadBytes },
-		});
-	}
-	const stateId = `choice_${randomBytes(16).toString("base64url")}`;
-	const namespace = resolveChoiceStateNamespace({
-		storage: options.storage,
-		contextState: options.contextState,
-		ttlMs: options.issueOptions.ttlMs,
-	});
-	await namespace.set(optionsStateKey(stateId), options.issueOptions.payload, {
-		ttl: stateTtl(options.storage, options.issueOptions.ttlMs),
-	});
-	const envelope: ManagedChoiceEnvelope = {
-		...options.baseEnvelope,
-		payload: {
-			storage: "server",
-			state_id: stateId,
-			payload_digest: digestChoicePayload(serializedPayload),
-			created_at_ms: options.issuedAtMs,
-		},
-	};
-	return encryptManagedChoiceToken({
-		prefix: options.issueOptions.prefix,
-		kid: options.kid,
-		envelope,
-		keys: options.keys,
-	});
-}
-
 async function parseWordServerStoredChoice(options: {
 	readonly stateKey: string;
 	readonly parseOptions: ProviderChoiceParseOptions;
@@ -849,53 +755,6 @@ async function consumeWordServerStoredChoice(options: {
 	}
 }
 
-async function parseLegacyServerStoredChoice(options: {
-	readonly handle: ServerChoiceHandlePayload;
-	readonly storage?: ProviderChoiceStorageOptions;
-	readonly contextState?: ProviderRuntimeState;
-}): Promise<ProviderChoiceTokenPayload> {
-	const storage = resolveParseStorage(options.storage);
-	const namespace = resolveChoiceStateNamespace({
-		storage,
-		contextState: options.contextState,
-	});
-	// Reading a server-stored choice back deserializes a persisted value. A
-	// corrupt/undecodable value would otherwise surface as a raw JSON.parse
-	// SyntaxError (or another unexpected throwable) that escapes the choice error
-	// taxonomy, gets masked as internal_error 500, and is treated as retryable by
-	// the hub -> reservation restart loop (2026-07-22 catchtable RCA, candidate A).
-	// Convert any non-branded throwable into a branded invalid_payload so it maps
-	// to a clean, non-retryable 400. Branded ProviderChoiceTokenError and genuine
-	// ProviderError (e.g. Redis-unavailable / state-unavailable) pass through so
-	// their category/retryable semantics are preserved.
-	let record: StateValue<ProviderChoiceTokenPayload> | null;
-	try {
-		record = await namespace.get<ProviderChoiceTokenPayload>(
-			optionsStateKey(options.handle.state_id),
-		);
-	} catch (error) {
-		if (error instanceof ProviderChoiceTokenError || isProviderError(error)) {
-			throw error;
-		}
-		throw new ProviderChoiceTokenError(
-			"invalid_payload",
-			"Provider choice token state payload could not be decoded.",
-		);
-	}
-	if (!record) {
-		throw new ProviderChoiceTokenError(
-			"invalid_payload",
-			"Provider choice token state payload is missing.",
-		);
-	}
-	const serializedPayload = serializeChoicePayload(record.value);
-	assertPayloadDigestMatches({
-		actual: digestChoicePayload(serializedPayload),
-		expected: options.handle.payload_digest,
-	});
-	return record.value;
-}
-
 function generateChoiceWordSequence(wordCount: number): string {
 	return Array.from({ length: wordCount }, () =>
 		choiceWordAt(randomInt(CHOICE_WORDLIST_SIZE)),

package/src/runtime/resolver-vendors/browser.ts

@@ -18,6 +18,8 @@ import {
 
 const BROWSER_VENDOR_ID = "browser" as const;
 const DEFAULT_COOKIE_POLL_INTERVAL_MS = 100;
+const AWS_WAF_CHALLENGE_INFRASTRUCTURE_HOST_SUFFIX = ".awswaf.com";
+const RESOLVER_DOCUMENT_CONTENT_SECURITY_POLICY = "connect-src http: https:; worker-src 'none'";
 
 const SUCCESS_COOKIE_NAMES = {
 	aws_waf: "aws-waf-token",
@@ -28,6 +30,22 @@ type SupportedBrowserChallengeKind = keyof typeof SUCCESS_COOKIE_NAMES;
 
 type BrowserClientFactory = (options: BrowserClientOptions) => BrowserClient;
 
+let createResolverBrowserClient: BrowserClientFactory = createBrowserClient;
+
+/** Internal test seam; deliberately not re-exported from the package root. */
+export function swapBrowserResolverClientFactoryForTests(
+	factory: BrowserClientFactory | undefined,
+): () => void {
+	const original = createResolverBrowserClient;
+	createResolverBrowserClient = factory ?? createBrowserClient;
+	let restored = false;
+	return () => {
+		if (restored) return;
+		restored = true;
+		createResolverBrowserClient = original;
+	};
+}
+
 export interface BrowserResolverVendorOptions {
 	readonly cdpUrl?: string;
 	readonly timeoutMs: number;
@@ -200,31 +218,77 @@ function selectSuccessCookie(
 
 async function solveInPage(
 	page: BrowserPage,
+	challengeKind: SupportedBrowserChallengeKind,
 	pageUrl: string,
+	allowedHosts: readonly string[],
 	successCookieName: string,
 	pollIntervalMs: number,
 	signal: AbortSignal,
 ): Promise<Extract<ChallengeSolution, { readonly form: "cookies" }>> {
-	await raceWithAbort(() => page.goto(pageUrl), signal);
-
-	while (true) {
-		const cookies = await raceWithAbort(() => page.cookies(), signal);
-		const successCookie = selectSuccessCookie(cookies, successCookieName, pageUrl);
-		if (successCookie) {
+	return await page.withResourcePolicy(
+		{
+			allowedMethods: ["GET", "HEAD", "POST"],
+			documentContentSecurityPolicy: RESOLVER_DOCUMENT_CONTENT_SECURITY_POLICY,
+			routes: [
+				{
+					match: () => true,
+					handle: (request) => ({
+						action: isResolverBrowserRequestAllowed(request.url, challengeKind, allowedHosts)
+							? "continue"
+							: "block",
+					}),
+				},
+			],
+		},
+		async () => {
 			const userAgent = await raceWithAbort(
-				() => page.evaluate<string>("navigator.userAgent"),
+				() => page.userAgent(),
 				signal,
 			);
-			return {
-				form: "cookies",
-				cookies: { [successCookieName]: successCookie.value },
-				userAgent,
-				...(successCookie.expires === undefined ? {} : { expires: successCookie.expires }),
-			};
-		}
+			await raceWithAbort(() => page.goto(pageUrl), signal);
+
+			while (true) {
+				const cookies = await raceWithAbort(() => page.cookies(), signal);
+				const successCookie = selectSuccessCookie(cookies, successCookieName, pageUrl);
+				if (successCookie) {
+					return {
+						form: "cookies",
+						cookies: { [successCookieName]: successCookie.value },
+						userAgent,
+						...(successCookie.expires === undefined ? {} : { expires: successCookie.expires }),
+					};
+				}
+
+				await abortableDelay(pollIntervalMs, signal);
+			}
+		},
+	);
+}
 
-		await abortableDelay(pollIntervalMs, signal);
+function isResolverBrowserRequestAllowed(
+	targetUrl: string,
+	challengeKind: SupportedBrowserChallengeKind,
+	allowedHosts: readonly string[],
+): boolean {
+	try {
+		assertResolverHostAllowed(targetUrl, allowedHosts);
+		return true;
+	} catch {
+		if (challengeKind !== "aws_waf") return false;
 	}
+
+	let target: URL;
+	try {
+		target = new URL(targetUrl);
+	} catch {
+		return false;
+	}
+	const hostname = normalizedResolverHostname(target.hostname);
+	return (
+		target.protocol === "https:" &&
+		hostname.length > AWS_WAF_CHALLENGE_INFRASTRUCTURE_HOST_SUFFIX.length &&
+		hostname.endsWith(AWS_WAF_CHALLENGE_INFRASTRUCTURE_HOST_SUFFIX)
+	);
 }
 
 const POOL_ALLOCATION_EXHAUSTED_CODES = new Set([
@@ -297,7 +361,7 @@ async function closeBrowserClient(
 export function createBrowserResolverVendorAdapter(
 	options: BrowserResolverVendorOptions,
 ): BrowserResolverVendorAdapter {
-	const createClient = options.createClient ?? createBrowserClient;
+	const createClient = options.createClient ?? createResolverBrowserClient;
 	const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_COOKIE_POLL_INTERVAL_MS;
 
 	return {
@@ -352,12 +416,15 @@ export function createBrowserResolverVendorAdapter(
 					cdpUrl: cdpUrl ?? "",
 					...(proxyUrl === undefined ? {} : { proxy: proxyUrl }),
 					requireCdpPool: cdpUrl !== undefined,
+					serviceWorkers: "block",
 				});
 				const contextOperation = client.withIsolatedContext(async (page) => {
 					handlerEntered = true;
 					return await solveInPage(
 						page,
+						challengeKind,
 						challenge.pageUrl,
+						options.allowedHosts,
 						SUCCESS_COOKIE_NAMES[challengeKind],
 						pollIntervalMs,
 						solveController.signal,

package/src/runtime/resolver-vendors/capsolver.ts

@@ -1,5 +1,7 @@
+import { getStealthProfile } from "../../stealth/profiles.js";
 import type { ChallengeSolution, ProviderChallenge } from "../../types.js";
 import { redactSensitiveText } from "../request-options.js";
+import { DEFAULT_PROFILE } from "../stealth.js";
 import type { TraceRecorder } from "../trace.js";
 import { assertResolverHostAllowed } from "./hosts.js";
 import {
@@ -39,7 +41,7 @@ export interface CapsolverResolverVendorAdapter extends ResolverVendorAdapter {
 		identity: ResolverIdentity | undefined,
 		signal: AbortSignal,
 		traceRecorder?: TraceRecorder,
-	): Promise<Extract<ChallengeSolution, { readonly form: "token" }>>;
+	): Promise<ChallengeSolution>;
 }
 
 class CapsolverSolveTimeoutError extends Error {
@@ -91,7 +93,15 @@ interface CapsolverCreateTaskResponse extends CapsolverResponseErrorFields {
 
 interface CapsolverPollResultResponse extends CapsolverResponseErrorFields {
 	readonly status: string | undefined;
-	readonly solution: { readonly token: string | undefined } | undefined;
+	readonly solution:
+		| {
+					readonly token: string | undefined;
+					readonly cookie: string | undefined;
+					readonly gRecaptchaResponse: string | undefined;
+					readonly cookies: Readonly<Record<string, string>> | undefined;
+					readonly userAgent: string | undefined;
+				}
+		| undefined;
 }
 
 class CapsolverVerdictError extends ResolverChallengeVerdictError {
@@ -233,15 +243,52 @@ function parseCreateTaskResponse(payload: JsonRecord): CapsolverCreateTaskRespon
 
 function parsePollResultResponse(payload: JsonRecord): CapsolverPollResultResponse {
 	const solution = isJsonRecord(payload.solution) ? payload.solution : undefined;
+	const cookies = solution && isJsonRecord(solution.cookies)
+		? Object.fromEntries(
+				Object.entries(solution.cookies).filter(
+					(entry): entry is [string, string] => typeof entry[1] === "string",
+				),
+			)
+		: undefined;
 	return {
 		...responseErrorFields(payload),
 		status: typeof payload.status === "string" ? payload.status : undefined,
-		solution: solution
-			? { token: typeof solution.token === "string" ? solution.token : undefined }
+			solution: solution
+			? {
+					token: typeof solution.token === "string" ? solution.token : undefined,
+					cookie: typeof solution.cookie === "string" ? solution.cookie : undefined,
+					gRecaptchaResponse:
+						typeof solution.gRecaptchaResponse === "string"
+							? solution.gRecaptchaResponse
+							: undefined,
+					cookies,
+					userAgent: typeof solution.userAgent === "string" ? solution.userAgent : undefined,
+				  }
 			: undefined,
 	};
 }
 
+function proxyForCapsolver(
+	proxyUrl: string,
+): { readonly value: string; readonly sensitive: readonly string[] } | undefined {
+	try {
+		const url = new URL(proxyUrl);
+		const protocol = url.protocol.slice(0, -1).toLowerCase();
+		const scheme = protocol === "http" || protocol === "socks5" ? protocol : undefined;
+		const port = Number(url.port || (scheme === "socks5" ? 1080 : 80));
+		if (!scheme || !url.hostname || !Number.isInteger(port) || port <= 0 || port > 65_535) {
+			return undefined;
+		}
+		const username = url.username ? decodeURIComponent(url.username) : "";
+		const password = url.password ? decodeURIComponent(url.password) : "";
+		if (username.includes(":") || password.includes(":")) return undefined;
+		const value = `${scheme}:${url.hostname}:${port}${username || password ? `:${username}:${password}` : ""}`;
+		return { value, sensitive: [proxyUrl, value, username, password].filter(Boolean) };
+	} catch {
+		return undefined;
+	}
+}
+
 function isAllocationExhausted(payload: CapsolverResponseErrorFields): boolean {
 	const code = payload.errorCode?.toLowerCase() ?? "";
 	const description = payload.errorDescription?.toLowerCase() ?? "";
@@ -403,7 +450,7 @@ export function createCapsolverResolverVendorAdapter(
 			return resolverVendorSupports(CAPSOLVER_VENDOR_ID, kind);
 		},
 
-		async solve(challenge, _identity, callerSignal, traceRecorder) {
+		async solve(challenge, identity, callerSignal, traceRecorder) {
 			const apiKey = options.apiKey?.trim();
 			if (!apiKey) {
 				throw new ResolverVendorUnavailableError(CAPSOLVER_VENDOR_ID, "missing_credentials", {
@@ -413,17 +460,34 @@ export function createCapsolverResolverVendorAdapter(
 			if (!resolverVendorSupports(CAPSOLVER_VENDOR_ID, challenge.kind)) {
 				throw new TypeError(`Capsolver resolver does not support ${challenge.kind}`);
 			}
-			if (challenge.kind !== "turnstile") {
-				throw new ResolverVendorUnavailableError(CAPSOLVER_VENDOR_ID, "not_implemented", {
+			const proxy = identity ? proxyForCapsolver(identity.proxyUrl) : undefined;
+			if (challenge.kind === "aws_waf" && identity && !proxy) {
+				throw new ResolverVendorUnavailableError(CAPSOLVER_VENDOR_ID, "transport_failure", {
 					phase: "create_task",
 				});
 			}
+			if (challenge.kind === "cloudflare_interstitial" && !identity) {
+				throw new ResolverVendorUnavailableError(CAPSOLVER_VENDOR_ID, "missing_proxy_identity", {
+					phase: "create_task",
+				});
+			}
+			if (identity && !proxy) {
+				throw new ResolverVendorUnavailableError(CAPSOLVER_VENDOR_ID, "transport_failure", {
+					phase: "create_task",
+				});
+			}
+			const challengeFields = challenge as unknown as Record<string, unknown>;
 			const sensitiveValues = [
 				apiKey,
 				challenge.pageUrl,
-				challenge.siteKey,
-				...(challenge.action !== undefined ? [challenge.action] : []),
-				...(challenge.cdata !== undefined ? [challenge.cdata] : []),
+				...(typeof challengeFields.siteKey === "string" ? [challengeFields.siteKey] : []),
+				...(typeof challengeFields.action === "string" ? [challengeFields.action] : []),
+				...(typeof challengeFields.cdata === "string" ? [challengeFields.cdata] : []),
+				...(typeof challengeFields.blockedHtml === "string" ? [challengeFields.blockedHtml] : []),
+				...(typeof challengeFields.captchaScript === "string" ? [challengeFields.captchaScript] : []),
+				...(typeof challengeFields.context === "string" ? [challengeFields.context] : []),
+				...(typeof challengeFields.iv === "string" ? [challengeFields.iv] : []),
+				...(proxy?.sensitive ?? []),
 			];
 
 			assertResolverHostAllowed(challenge.pageUrl, options.allowedHosts);
@@ -440,24 +504,73 @@ export function createCapsolverResolverVendorAdapter(
 
 			try {
 				const createTask = async () => {
-					const metadata = {
-						...(challenge.action !== undefined ? { action: challenge.action } : {}),
-						...(challenge.cdata !== undefined ? { cdata: challenge.cdata } : {}),
-					};
+					const task =
+						challenge.kind === "aws_waf"
+							? {
+									type: proxy ? "AntiAwsWafTask" : "AntiAwsWafTaskProxyLess",
+									websiteURL: challenge.pageUrl,
+									...(challenge.siteKey !== undefined ? { awsKey: challenge.siteKey } : {}),
+									...(challenge.iv !== undefined ? { awsIv: challenge.iv } : {}),
+									...(challenge.context !== undefined ? { awsContext: challenge.context } : {}),
+									...(challenge.captchaScript !== undefined
+										? { awsChallengeJS: challenge.captchaScript }
+										: {}),
+									...(proxy ? { proxy: proxy.value } : {}),
+								}
+							: challenge.kind === "turnstile"
+								? {
+										type: "AntiTurnstileTaskProxyLess",
+										websiteURL: challenge.pageUrl,
+										websiteKey: challenge.siteKey,
+										...(challenge.action !== undefined || challenge.cdata !== undefined
+											? {
+													metadata: {
+														...(challenge.action !== undefined ? { action: challenge.action } : {}),
+														...(challenge.cdata !== undefined ? { cdata: challenge.cdata } : {}),
+													},
+												}
+											: {}),
+									}
+							: challenge.kind === "recaptcha_v2"
+								? {
+										type: proxy ? "ReCaptchaV2Task" : "ReCaptchaV2TaskProxyLess",
+										websiteURL: challenge.pageUrl,
+										websiteKey: challenge.siteKey,
+										...(proxy ? { proxy: proxy.value } : {}),
+									}
+							: challenge.kind === "recaptcha_v3"
+								? {
+										type: proxy ? "ReCaptchaV3Task" : "ReCaptchaV3TaskProxyLess",
+										websiteURL: challenge.pageUrl,
+										websiteKey: challenge.siteKey,
+										pageAction: challenge.action,
+										...(challenge.minScore !== undefined ? { minScore: challenge.minScore } : {}),
+										...(proxy ? { proxy: proxy.value } : {}),
+									}
+							: challenge.kind === "hcaptcha"
+								? {
+										type: proxy ? "HCaptchaTask" : "HCaptchaTaskProxyLess",
+										websiteURL: challenge.pageUrl,
+										websiteKey: challenge.siteKey,
+										...(proxy ? { proxy: proxy.value } : {}),
+									}
+							: challenge.kind === "cloudflare_interstitial"
+								? {
+										type: "AntiCloudflareTask",
+										websiteURL: challenge.pageUrl,
+										proxy: proxy?.value,
+										...(identity?.userAgent ? { userAgent: identity.userAgent } : {}),
+										...(challenge.kind === "cloudflare_interstitial" && challenge.blockedHtml !== undefined
+											? { html: challenge.blockedHtml }
+											: {}),
+									}
+								: (() => {
+										throw new TypeError(`Capsolver resolver does not support ${challenge.kind}`);
+									})();
 					const createResult = await postJson(
 						fetchImpl,
 						endpoint(baseUrl, "createTask"),
-						{
-							clientKey: apiKey,
-							task: {
-								type: "AntiTurnstileTaskProxyLess",
-								websiteURL: challenge.pageUrl,
-								websiteKey: challenge.siteKey,
-								...(challenge.action !== undefined || challenge.cdata !== undefined
-									? { metadata }
-									: {}),
-							},
-						},
+						{ clientKey: apiKey, task },
 						solveController.signal,
 						phase,
 						sensitiveValues,
@@ -508,20 +621,44 @@ export function createCapsolverResolverVendorAdapter(
 							case "ready":
 								break;
 							default:
-								throw new ResolverVendorUnavailableError(
-									CAPSOLVER_VENDOR_ID,
-									"transport_failure",
-									{ phase },
-								);
+								throw new ResolverVendorUnavailableError(CAPSOLVER_VENDOR_ID, "transport_failure", {
+									phase,
+								});
 						}
 
-						const token = result.payload.solution?.token;
-						if (!token?.trim()) {
+						const solutionValue =
+							challenge.kind === "aws_waf"
+								? result.payload.solution?.cookie
+								: result.payload.solution?.token ?? result.payload.solution?.gRecaptchaResponse;
+						if (challenge.kind === "cloudflare_interstitial") {
+							const cookies = result.payload.solution?.cookies;
+							const clearance = cookies?.cf_clearance ?? solutionValue;
+							if (!clearance?.trim()) {
+								throw new ResolverVendorUnavailableError(CAPSOLVER_VENDOR_ID, "transport_failure", {
+									phase,
+								});
+							}
+							return {
+								form: "cookies" as const,
+								cookies: cookies && Object.keys(cookies).length > 0 ? cookies : { cf_clearance: clearance },
+								userAgent:
+									result.payload.solution?.userAgent ??
+									identity?.userAgent ??
+									getStealthProfile(DEFAULT_PROFILE).userAgent,
+							};
+						}
+						if (!solutionValue?.trim()) {
 							throw new ResolverVendorUnavailableError(CAPSOLVER_VENDOR_ID, "transport_failure", {
 								phase,
 							});
 						}
-						return { form: "token" as const, token };
+						return challenge.kind === "aws_waf"
+							? {
+									form: "cookies" as const,
+									cookies: { "aws-waf-token": solutionValue },
+									userAgent: identity?.userAgent ?? getStealthProfile(DEFAULT_PROFILE).userAgent,
+								}
+							: { form: "token" as const, token: solutionValue };
 					}
 				};
 				return traceRecorder