capskip 1.4.0 → 1.6.0

package/examples/hcaptcha.js

@@ -0,0 +1,98 @@
+'use strict';
+
+/**
+ * Solve an hCaptcha widget.
+ *
+ * hCaptcha is the checkbox widget behind many sign-up, login and checkout
+ * forms. CapSkip passes the widget in a real browser for the sitekey and page
+ * you send and returns the token the widget would have put in the form.
+ * Invisible widgets and hCaptcha Enterprise use the same method.
+ *
+ * You need two values, both read off the target page:
+ *
+ *   * sitekey - the public identifier of the widget, the same for every
+ *     visitor. Most pages carry it on the container as `data-sitekey`:
+ *     `<div class="h-captcha" data-sitekey="...">`. When a page builds the
+ *     widget with a script, look for the `sitekey` option of
+ *     `hcaptcha.render()`, or the `sitekey=` parameter in the address of the
+ *     hCaptcha iframe.
+ *   * url - the full URL of the page the widget is on.
+ *
+ * A widget with `data-size="invisible"` is invisible: pass `invisible: 1`.
+ * Some hCaptcha Enterprise sites pass an `rqdata` value to the widget through
+ * `hcaptcha.setData()` before it runs; send it as `data`. It is issued for one
+ * challenge and expires quickly, so read a fresh one for every task.
+ */
+
+const assert = require('node:assert');
+const { CapSkip } = require('capskip');
+
+const solver = new CapSkip({
+  apiKey: process.env.CAPSKIP_API_KEY || 'capskip',
+  host: process.env.CAPSKIP_HOST || '127.0.0.1',
+  port: Number(process.env.CAPSKIP_PORT || 8080),
+});
+
+// hCaptcha's own public demo page and its sitekey.
+const SITEKEY = 'a5f74b19-9e45-40e0-b45d-47ff91b7a6c2';
+const PAGE_URL = 'https://accounts.hcaptcha.com/demo';
+
+async function main() {
+  const result = await solver.hcaptcha(SITEKEY, PAGE_URL);
+
+  console.log('Captcha ID:', result.captchaId);
+  console.log('Token:     ', `${result.token.slice(0, 60)}...`);
+  console.log('respKey:   ', result.respKey ? `${result.respKey.slice(0, 40)}...` : '(empty)');
+  console.log('User-Agent:', result.userAgent || '(none reported)');
+
+  // --- Invisible and Enterprise widgets ------------------------------------
+  //
+  //   const result = await solver.hcaptcha(SITEKEY, PAGE_URL, {
+  //     invisible: 1,   // data-size="invisible"
+  //     data: rqdata,   // the rqdata the page passed to hcaptcha.setData()
+  //   });
+  //
+  // --- With a per-request proxy --------------------------------------------
+  // CapSkip does not force a proxy. At volume, though, hCaptcha scores the
+  // network a token comes from as well as the browser, so send a proxy with
+  // each task (or configure a pool in the app: Settings, Captcha types,
+  // hCaptcha, Configure Proxies). A proxy sent with a task always takes
+  // priority over the pool.
+  //
+  //   const result = await solver.hcaptcha(SITEKEY, PAGE_URL, {
+  //     proxy: { type: 'HTTP', uri: 'login:password@1.2.3.4:8080' },
+  //   });
+
+  // --- Submitting the token ------------------------------------------------
+  // The widget writes its token into a hidden textarea named
+  // h-captcha-response (and a copy named g-recaptcha-response). Put the token
+  // in both and submit the form, or call the widget's data-callback with it.
+  // Without a browser, post it as those form fields with the User-Agent from
+  // the result:
+  //
+  //   await fetch(FORM_URL, {
+  //     method: 'POST',
+  //     headers: { 'User-Agent': result.userAgent },
+  //     body: new URLSearchParams({
+  //       email: 'someone@example.com',
+  //       'h-captcha-response': result.token,
+  //       'g-recaptcha-response': result.token,
+  //     }),
+  //   });
+  //
+  // Tokens are single use and expire about two minutes after they are issued,
+  // so submit each one soon and solve again for the next form submission.
+  console.log('Form fields:', {
+    'h-captcha-response': `${result.token.slice(0, 40)}...`,
+    'g-recaptcha-response': `${result.token.slice(0, 40)}...`,
+  });
+
+  // `code` holds the same string as `token`, which is what you forward if you
+  // are porting code written against another solver's API.
+  assert.strictEqual(result.code, result.token);
+}
+
+main().catch((error) => {
+  console.error(`${error.name}: ${error.message}`);
+  process.exitCode = 1;
+});

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "capskip",
-  "version": "1.4.0",
-  "description": "Captcha solver for Node.js: solve reCAPTCHA v2/v3, Cloudflare Turnstile, GeeTest, AWS WAF and image captchas with CapSkip, a local unlimited captcha solver with no per-solve fees.",
+  "version": "1.6.0",
+  "description": "Captcha solver for Node.js: solve reCAPTCHA v2/v3, Cloudflare Turnstile, hCaptcha, GeeTest, AWS WAF, DataDome and image captchas with CapSkip, a local unlimited captcha solver with no per-solve fees.",
   "main": "src/index.js",
   "types": "types/index.d.ts",
   "exports": {
@@ -33,6 +33,9 @@
     "recaptcha-v2",
     "recaptcha-v3",
     "recaptcha-enterprise",
+    "hcaptcha",
+    "hcaptcha-solver",
+    "hcaptcha-enterprise",
     "cloudflare",
     "turnstile",
     "turnstile-solver",
@@ -41,6 +44,8 @@
     "geetest-solver",
     "aws-waf",
     "aws-waf-captcha",
+    "datadome",
+    "datadome-solver",
     "image-captcha",
     "ocr",
     "2captcha-alternative",

package/src/apiParams.js

@@ -59,6 +59,41 @@ const AMAZON_WAF_SCRIPTS = ['challenge_script', 'captcha_script', 'jsapiScript']
 // the three AWS WAF script files.
 const AMAZON_WAF_SCRIPT_PATH = /^(\/[A-Za-z0-9_-]+)+\/(challenge|captcha|jsapi)\.js$/;
 
+const HCAPTCHA_SUBMIT = new Set([
+  'method', 'sitekey', 'pageurl', 'invisible', 'data', 'useragent', 'json',
+  'proxy', 'proxytype',
+]);
+
+// What the server reads as "invisible widget" ("1" or "true") and as its
+// default. Strings are matched case-insensitively. A boolean would otherwise
+// reach the form body as 'true' or 'false', and the server reads 'false' as
+// neither, so every accepted form is normalized to the 1 the server reads.
+const HCAPTCHA_INVISIBLE_ON = [true, 1, '1', 'true'];
+const HCAPTCHA_INVISIBLE_OFF = [false, 0, '0', 'false'];
+
+const DATADOME_SUBMIT = new Set([
+  'method', 'captcha_url', 'pageurl', 'useragent', 'json', 'proxy', 'proxytype',
+]);
+
+// Every DataDome challenge is served from this domain or a subdomain of it
+// (geo.captcha-delivery.com in practice). CapSkip refuses any other host.
+const DATADOME_CHALLENGE_DOMAIN = 'captcha-delivery.com';
+
+// The two challenge pages: /captcha/ draws the slider, /interstitial/ runs the
+// device check. Any other path renders nothing to solve.
+const DATADOME_CHALLENGE_PATHS = ['/captcha', '/interstitial'];
+
+// A Chrome version as Chrome writes it in its User-Agent: four dotted numbers.
+const CHROME_VERSION = /\bChrome\/(\d+)\.\d+\.\d+\.\d+\b/;
+
+// Chrome-derived browsers and non-desktop builds. A User-Agent carrying any of
+// these is not stock Windows Chrome, so a cookie earned under it would be
+// refused on replay; the server answers ERROR_WRONG_USERAGENT for each.
+const NOT_STOCK_WINDOWS_CHROME = [
+  'Edg/', 'EdgA/', 'OPR/', 'YaBrowser/', 'SamsungBrowser/', 'Vivaldi/',
+  'HeadlessChrome/', 'CriOS/', 'Mobile', 'Android',
+];
+
 // CapSkip solves the puzzle family only. `avatar` is a different challenge
 // behind a different endpoint; the server refuses it at submit time rather than
 // answering it with a puzzle answer, which would bill for a solve the target
@@ -100,6 +135,10 @@ const PARAM_ALIASES = {
   challengeScript: 'challenge_script',
   captchaScript: 'captcha_script',
   jsapi_script: 'jsapiScript',
+  // DataDome: 2Captcha and the API document captcha_url; createTask-style
+  // callers arrive with captchaUrl.
+  captchaUrl: 'captcha_url',
+  captchaURL: 'captcha_url',
 };
 
 function has(obj, key) {
@@ -456,6 +495,240 @@ function validateAmazonWafSubmit(params) {
   }
 }
 
+const HTML_NAMED_ENTITIES = {
+  amp: '&', lt: '<', gt: '>', quot: '"', apos: "'", nbsp: ' ',
+};
+
+/**
+ * Decode HTML character references, as the server does before it parses a
+ * DataDome captcha_url: an iframe src copied out of the page source carries
+ * &amp; between its query parameters.
+ */
+function htmlUnescape(text) {
+  return text.replace(/&(#[0-9]+|#[xX][0-9a-fA-F]+|[A-Za-z]+);/g, (match, ref) => {
+    if (ref[0] === '#') {
+      const code = ref[1] === 'x' || ref[1] === 'X'
+        ? parseInt(ref.slice(2), 16)
+        : parseInt(ref.slice(1), 10);
+      try {
+        return String.fromCodePoint(code);
+      } catch (error) {
+        return match;
+      }
+    }
+    const named = HTML_NAMED_ENTITIES[ref.toLowerCase()];
+    return named === undefined ? match : named;
+  });
+}
+
+function isDataDomeHost(host) {
+  const lowered = String(host || '').toLowerCase();
+  return lowered === DATADOME_CHALLENGE_DOMAIN
+    || lowered.endsWith(`.${DATADOME_CHALLENGE_DOMAIN}`);
+}
+
+/**
+ * The query of a DataDome challenge URL as a URLSearchParams, or null if it is
+ * not one.
+ *
+ * Mirrors the server: an https URL on captcha-delivery.com (or a subdomain),
+ * path /captcha/ or /interstitial/, carrying initialCid, hash and cid. An
+ * iframe src copied HTML-escaped (&amp;) and a scheme-relative //geo... URL
+ * are both read the way the server reads them.
+ */
+function parseDataDomeCaptchaUrl(url) {
+  let text = htmlUnescape(String(url === undefined || url === null ? '' : url).trim());
+  if (text.startsWith('//')) {
+    text = `https:${text}`;
+  }
+  let parsed;
+  try {
+    parsed = new URL(text);
+  } catch (error) {
+    return null;
+  }
+  if (parsed.protocol !== 'https:' || !isDataDomeHost(parsed.hostname)) {
+    return null;
+  }
+  const pathname = parsed.pathname.replace(/\/+$/, '').toLowerCase();
+  if (!DATADOME_CHALLENGE_PATHS.includes(pathname)) {
+    return null;
+  }
+  const query = parsed.searchParams;
+  if (!['initialCid', 'hash', 'cid'].every((key) => query.get(key))) {
+    return null;
+  }
+  return query;
+}
+
+/**
+ * True for a stock Chrome-for-Windows User-Agent, the only kind CapSkip takes.
+ *
+ * DataDome ties the cookie to the browser that earned it, and CapSkip solves
+ * in Chrome on Windows, so a cookie for any other User-Agent would be refused
+ * on replay. The server also requires the same Chrome major version as its
+ * own browser; that part can only be checked there.
+ */
+function isDataDomeUserAgent(userAgent) {
+  const ua = String(userAgent === undefined || userAgent === null ? '' : userAgent);
+  return ua.includes('Windows NT ')
+    && CHROME_VERSION.test(ua)
+    && !NOT_STOCK_WINDOWS_CHROME.some((token) => ua.includes(token));
+}
+
+/**
+ * Drop unset optionals, and the empty ones too: a DataDome optional left as ''
+ * means "not sent" to the server, exactly like an absent one.
+ */
+function normalizeDataDomeSubmit(params) {
+  const out = {};
+  for (const [key, value] of Object.entries(dropUnset(params))) {
+    if (value !== '') {
+      out[key] = value;
+    }
+  }
+  return out;
+}
+
+/** An absolute http(s) URL with a host that is not DataDome's own. */
+function isDataDomePageUrl(pageurl) {
+  let parsed;
+  try {
+    parsed = new URL(pageurl);
+  } catch (error) {
+    return false;
+  }
+  return (parsed.protocol === 'http:' || parsed.protocol === 'https:')
+    && parsed.hostname !== ''
+    && !isDataDomeHost(parsed.hostname);
+}
+
+function validateDataDomeSubmit(params) {
+  // Without captcha_url the server answers ERROR_BAD_PARAMETERS and without
+  // pageurl ERROR_PAGEURL. Fail locally so a missing value costs no round-trip.
+  for (const key of ['captcha_url', 'pageurl']) {
+    if (!params[key]) {
+      throw new ValidationException(`'${key}' is required for DataDome.`);
+    }
+  }
+
+  const query = parseDataDomeCaptchaUrl(params.captcha_url);
+  if (query === null) {
+    throw new ValidationException(
+      "'captcha_url' must be the https address of a DataDome challenge on "
+      + 'captcha-delivery.com, under /captcha/ or /interstitial/ and carrying '
+      + `initialCid, hash and cid, got '${params.captcha_url}'. Take it from `
+      + "the block page's iframe src, or build it from the page's `var dd` object.",
+    );
+  }
+  // t=bv is DataDome saying the address that fetched the block page is
+  // banned. Nothing sent from it can pass, and the server refuses the task
+  // with ERROR_PROXY_BANNED, so say so before the round-trip.
+  if (query.get('t') === 'bv') {
+    throw new ValidationException(
+      'This DataDome block page bans the IP address that requested it '
+      + '(t=bv), so no solve from that address can pass. Change the address '
+      + '(proxy), request the page again and submit the new captcha_url.',
+    );
+  }
+
+  const pageurl = String(params.pageurl).trim();
+  if (!isDataDomePageUrl(pageurl)) {
+    throw new ValidationException(
+      "'pageurl' must be the full http or https URL of the page that "
+      + `returned the DataDome block page, got '${pageurl}'.`,
+    );
+  }
+
+  const userAgent = params.useragent;
+  if (userAgent !== undefined && userAgent !== null && userAgent !== ''
+      && !isDataDomeUserAgent(userAgent)) {
+    throw new ValidationException(
+      "DataDome 'userAgent' must be a stock Chrome for Windows User-Agent "
+      + 'with the same major version as the browser CapSkip solves with, got '
+      + `'${userAgent}'. The cookie only works with the User-Agent that `
+      + "earned it. Leave it out and CapSkip uses its own browser's, which "
+      + 'the result reports as `userAgent`.',
+    );
+  }
+
+  const unknown = unknownKeys(params, DATADOME_SUBMIT);
+  if (unknown.length > 0) {
+    throw new ValidationException(
+      `Unsupported parameters for DataDome: ${reprList(unknown)}.`,
+    );
+  }
+}
+
+/**
+ * Drop unset and empty optionals, and send `invisible` as the 1 the server
+ * reads. `invisible: 0` is the server's default, so it is not sent at all.
+ */
+function normalizeHCaptchaSubmit(params) {
+  const out = {};
+  for (const [key, value] of Object.entries(dropUnset(params))) {
+    if (value !== '') {
+      out[key] = value;
+    }
+  }
+  if (has(out, 'invisible')) {
+    const raw = out.invisible;
+    const key = typeof raw === 'string' ? raw.toLowerCase() : raw;
+    if (HCAPTCHA_INVISIBLE_ON.includes(key)) {
+      out.invisible = 1;
+    } else if (HCAPTCHA_INVISIBLE_OFF.includes(key)) {
+      delete out.invisible;
+    } else {
+      const shown = typeof raw === 'string' ? `'${raw}'` : String(raw);
+      throw new ValidationException(
+        `invisible must be 0 or 1 (or a boolean) for hCaptcha, not ${shown}.`,
+      );
+    }
+  }
+  return out;
+}
+
+/** An absolute http(s) URL with a host. */
+function isHttpUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch (error) {
+    return false;
+  }
+  return (parsed.protocol === 'http:' || parsed.protocol === 'https:')
+    && parsed.hostname !== '';
+}
+
+function validateHCaptchaSubmit(params) {
+  // The server answers ERROR_RECAPTCHA_INVALID_SITEKEY for a missing sitekey
+  // and ERROR_PAGEURL for a page URL that is missing or not http(s). Fail
+  // locally so neither costs a round-trip.
+  const sitekey = params.sitekey;
+  if (sitekey === undefined || sitekey === null || !String(sitekey).trim()) {
+    throw new ValidationException("'sitekey' is required for hCaptcha.");
+  }
+  const rawPageurl = params.pageurl;
+  const pageurl = rawPageurl === undefined || rawPageurl === null
+    ? ''
+    : String(rawPageurl).trim();
+  if (!pageurl) {
+    throw new ValidationException("'pageurl' is required for hCaptcha.");
+  }
+  if (!isHttpUrl(pageurl)) {
+    throw new ValidationException(
+      `pageurl must be an absolute http or https URL for hCaptcha, not '${pageurl}'.`,
+    );
+  }
+
+  const unknown = unknownKeys(params, HCAPTCHA_SUBMIT);
+  if (unknown.length > 0) {
+    throw new ValidationException(
+      `Unsupported parameters for hCaptcha: ${reprList(unknown)}.`,
+    );
+  }
+}
+
 function validateProxyType(params) {
   const proxytype = params.proxytype;
   if (proxytype === undefined || proxytype === null || proxytype === '') {
@@ -496,6 +769,12 @@ function prepareSubmitParams(params, captchaType, version = 'v2') {
   } else if (captchaType === 'amazon_waf') {
     prepared = normalizeAmazonWafSubmit(prepared);
     validateAmazonWafSubmit(prepared);
+  } else if (captchaType === 'datadome') {
+    prepared = normalizeDataDomeSubmit(prepared);
+    validateDataDomeSubmit(prepared);
+  } else if (captchaType === 'hcaptcha') {
+    prepared = normalizeHCaptchaSubmit(prepared);
+    validateHCaptchaSubmit(prepared);
   }
 
   // Skipped for 'normal', which rejects proxy outright with a clearer message.
@@ -518,6 +797,10 @@ module.exports = {
   FRIENDLY_CAPTCHA_SUBMIT,
   AMAZON_WAF_SUBMIT,
   AMAZON_WAF_SCRIPTS,
+  DATADOME_SUBMIT,
+  DATADOME_CHALLENGE_DOMAIN,
+  DATADOME_CHALLENGE_PATHS,
+  HCAPTCHA_SUBMIT,
   CAPY_VERSIONS,
   FRIENDLY_CAPTCHA_VERSIONS,
   PROXY_TYPES,
@@ -537,6 +820,13 @@ module.exports = {
   isAmazonWafScriptUrl,
   normalizeAmazonWafSubmit,
   validateAmazonWafSubmit,
+  htmlUnescape,
+  parseDataDomeCaptchaUrl,
+  isDataDomeUserAgent,
+  normalizeDataDomeSubmit,
+  validateDataDomeSubmit,
+  normalizeHCaptchaSubmit,
+  validateHCaptchaSubmit,
   validateProxyType,
   prepareSubmitParams,
 };

package/src/index.js

@@ -27,5 +27,5 @@ module.exports = {
   NetworkException,
   ApiException,
   TimeoutException,
-  version: '1.4.0',
+  version: '1.6.0',
 };

package/src/solver.js

@@ -83,6 +83,17 @@ function applyPollResult(result, polled) {
     if (userAgent) {
       result.userAgent = userAgent;
     }
+    // DataDome names the proxy a task was solved through when the task sent
+    // none and CapSkip took one from its own DataDome proxy list. The cookie
+    // only works from that address, so it is reported rather than dropped.
+    if (polled.proxy) {
+      result.proxy = polled.proxy;
+    }
+    // hCaptcha hands the widget a second value next to the token. It is
+    // carried even when empty, which is how the server reports "none".
+    if (Object.prototype.hasOwnProperty.call(polled, 'respKey')) {
+      result.respKey = polled.respKey;
+    }
     // ALTCHA's createTask-shaped `solution` object. Carried through so
     // applyAltchaSolution can read the counter the server already worked out,
     // which is the only reliable source for a proof-of-work v2 answer; that
@@ -277,6 +288,24 @@ function applyAmazonWafSolution(result) {
   return expandObjectAnswer(result, AMAZON_WAF_FIELDS);
 }
 
+/**
+ * Expose the DataDome cookie as `cookie`, ready for a Cookie header.
+ *
+ * `code` keeps the cookie exactly as DataDome set it, attributes included
+ * (`datadome=...; Max-Age=...; Domain=...; Path=/; Secure; SameSite=Lax`),
+ * for a cookie jar. `cookie` is the part before the first semicolon, the
+ * `datadome=...` pair a request sends back. `userAgent` and, when CapSkip
+ * picked the proxy, `proxy` are carried through from the poll as they are.
+ * An answer that is not a string is left untouched.
+ */
+function applyDataDomeSolution(result) {
+  const { code } = result;
+  if (typeof code === 'string' && code) {
+    result.cookie = code.split(';', 1)[0].trim();
+  }
+  return result;
+}
+
 /**
  * Expose a single-token answer as `token`, named for the form field it fills.
  *
@@ -301,6 +330,20 @@ function applyTokenSolution(result) {
   return result;
 }
 
+/**
+ * Expose the hCaptcha token as `token`, next to its `respKey`.
+ *
+ * `code` keeps the token as the server sent it and `token` is the same string,
+ * for the `h-captcha-response` field. `respKey` is always present, empty when
+ * the widget handed out none, so callers can read it without a key check.
+ */
+function applyHCaptchaSolution(result) {
+  applyTokenSolution(result);
+  const { respKey } = result;
+  result.respKey = typeof respKey === 'string' ? respKey : '';
+  return result;
+}
+
 // CapSkip's in.php returns OK|<id> by default, or {"status":1,"request":"<id>"}
 // when the submit carried json=1. Accept both so submitting with json=1 works.
 function parseSubmitResponse(response) {
@@ -326,7 +369,8 @@ function parseSubmitResponse(response) {
 
 /**
  * Client for the CapSkip local captcha solver (image, reCAPTCHA, Turnstile,
- * GeeTest v3, ALTCHA, Capy Puzzle, CaptchaFox, Friendly Captcha, AWS WAF).
+ * GeeTest v3, ALTCHA, Capy Puzzle, CaptchaFox, Friendly Captcha, AWS WAF,
+ * DataDome, hCaptcha).
  */
 class CapSkip {
   constructor({
@@ -620,6 +664,116 @@ class CapSkip {
     return applyAmazonWafSolution(result);
   }
 
+  /**
+   * Solve a DataDome challenge and return the `datadome` cookie.
+   *
+   * `captchaUrl` and `url` are required; everything else goes in `options`:
+   *
+   * - `captchaUrl` is the address of the challenge iframe on
+   *   geo.captcha-delivery.com, under /captcha/ (slider) or /interstitial/
+   *   (device check). Take the iframe's src from the block page, or build it
+   *   from the page's `var dd` object as the API docs show.
+   * - `url` is the page that returned the block page.
+   * - `options.userAgent` is the one you will send with the cookie. It must be
+   *   Chrome for Windows with the same major version as the browser CapSkip
+   *   solves with; leave it out and CapSkip uses that browser's own.
+   * - `options.proxy` is the proxy your later requests go through, as a URI
+   *   string or `{ type: 'HTTP', uri: 'login:password@IP:PORT' }`.
+   *
+   * DataDome ties the cookie to the IP address and User-Agent that earned it.
+   * The result carries:
+   *
+   * - `code` -- the cookie exactly as DataDome set it, attributes included;
+   * - `cookie` -- just the `datadome=...` pair, for a Cookie header;
+   * - `userAgent` -- the User-Agent the cookie was earned with. Send it with
+   *   every request that carries the cookie;
+   * - `proxy` -- present only when you sent no proxy and CapSkip solved
+   *   through its own DataDome proxy list: that proxy as `host:port`. The
+   *   cookie works only through it.
+   */
+  async dataDome(captchaUrl, url, options = {}) {
+    // An unset value is dropped rather than sent as undefined, so
+    // `dataDome(undefined, url, { captchaUrl })` reaches the alias without
+    // tripping the conflict check; an empty one is dropped during validation,
+    // since the server reads '' as "not sent".
+    const given = {};
+    const add = (key, value) => {
+      if (value !== undefined && value !== null) {
+        given[key] = value;
+      }
+    };
+    add('captcha_url', captchaUrl);
+    add('url', url);
+    for (const [key, value] of Object.entries(options)) {
+      add(key, value);
+    }
+
+    // A real browser session, slider or device check, so it gets the longer
+    // of the two timeouts unless the caller asked for a specific one.
+    const result = await this.solve({
+      timeout: this.recaptchaTimeout,
+      ...given,
+      method: 'datadome',
+      poll_json: 1,
+    });
+    return applyDataDomeSolution(result);
+  }
+
+  /**
+   * Solve an hCaptcha widget and return its token.
+   *
+   * `sitekey` and `url` are required; everything else goes in `options`:
+   *
+   * - `sitekey` is the widget's `data-sitekey` (or the `sitekey` option of
+   *   `hcaptcha.render()`).
+   * - `url` is the full address of the page the widget is on. `pageurl` in
+   *   `options` is accepted in its place.
+   * - `options.invisible` is `1` (or `true`) for a `data-size="invisible"`
+   *   widget.
+   * - `options.data` is the `rqdata` value an hCaptcha Enterprise site passes
+   *   to `hcaptcha.setData()`. It is single use and expires quickly, so fetch
+   *   a fresh one for every task.
+   * - `options.userAgent` is the User-Agent you will submit the form with.
+   *   CapSkip uses it only when it matches the browser it solves with.
+   * - `options.proxy` is a URI string or
+   *   `{ type: 'HTTP', uri: 'login:password@IP:PORT' }`.
+   *
+   * hCaptcha Enterprise and invisible widgets use this same method.
+   *
+   * The result carries the token as both `code` and `token` (for the
+   * `h-captcha-response` and `g-recaptcha-response` fields), `respKey` (the
+   * second value hCaptcha hands the widget; most sites never read it, and it
+   * can be empty), and `userAgent`, the User-Agent the token was earned with.
+   * Submit the token with that User-Agent, soon: hCaptcha tokens are single
+   * use and expire about two minutes after they are issued.
+   */
+  async hcaptcha(sitekey, url, options = {}) {
+    // An unset value is dropped rather than sent as undefined, so
+    // `hcaptcha(sitekey, undefined, { pageurl })` reaches the alias without
+    // tripping the conflict check; an empty one is dropped during validation.
+    const given = {};
+    const add = (key, value) => {
+      if (value !== undefined && value !== null) {
+        given[key] = value;
+      }
+    };
+    add('sitekey', sitekey);
+    add('url', url);
+    for (const [key, value] of Object.entries(options)) {
+      add(key, value);
+    }
+
+    // A real browser session, like reCAPTCHA, so it gets the longer of the
+    // two timeouts unless the caller asked for a specific one.
+    const result = await this.solve({
+      timeout: this.recaptchaTimeout,
+      ...given,
+      method: 'hcaptcha',
+      poll_json: 1,
+    });
+    return applyHCaptchaSolution(result);
+  }
+
   async solve(options = {}) {
     const {
       timeout = 0,
@@ -723,6 +877,12 @@ class CapSkip {
     if (method === 'amazon_waf') {
       return prepareSubmitParams(params, 'amazon_waf');
     }
+    if (method === 'datadome') {
+      return prepareSubmitParams(params, 'datadome');
+    }
+    if (method === 'hcaptcha') {
+      return prepareSubmitParams(params, 'hcaptcha');
+    }
     return applyProxy(applyParamAliases(params));
   }
 }
@@ -738,6 +898,8 @@ module.exports = {
   applyAltchaSolution,
   applyCapySolution,
   applyAmazonWafSolution,
+  applyDataDomeSolution,
+  applyHCaptchaSolution,
   expandObjectAnswer,
   applyTokenSolution,
 };