@2bad/walt 0.0.0-stage → 1.0.0

package/build/telegram/auth.js

@@ -0,0 +1,164 @@
+import { BROWSER_HEADERS } from "../browser.js";
+import { defaultTokenPath, fileTokenStorage } from "./file-storage.js";
+import { Api, TelegramClient, errors } from "teleproto";
+import { StringSession } from "teleproto/sessions/index.js";
+// source/telegram/auth.ts
+const BASE_URL = "https://walletbot.me";
+const AUTH_URL = "https://alectryon.walletbot.me";
+const EXPIRY_SKEW_MS = 3e4;
+const MAX_FLOOD_WAIT_MS = 6e4;
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var AuthEndpointError = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+	}
+};
+var TelegramTokenSource = class {
+	client;
+	bot;
+	baseUrl;
+	authUrl;
+	fetchImpl;
+	storage;
+	maxFloodWaitMs;
+	deviceSerial;
+	deviceSerialKnown;
+	jwt = null;
+	refreshToken = null;
+	sessionId = null;
+	expiresAt = 0;
+	restored = false;
+	pending = null;
+	constructor(options) {
+		this.client = new TelegramClient(new StringSession(options.session), options.apiId, options.apiHash, { connectionRetries: 3 });
+		this.bot = options.bot ?? "walt";
+		this.deviceSerial = options.deviceSerial ?? `weba:${crypto.randomUUID()}`;
+		this.deviceSerialKnown = options.deviceSerial !== void 0;
+		this.baseUrl = options.baseUrl ?? BASE_URL;
+		this.authUrl = options.authUrl ?? AUTH_URL;
+		this.fetchImpl = options.fetch ?? fetch;
+		this.storage = options.storage === false ? void 0 : options.storage ?? fileTokenStorage(defaultTokenPath(options.session));
+		this.maxFloodWaitMs = options.maxFloodWaitMs ?? MAX_FLOOD_WAIT_MS;
+	}
+	/**
+	* @param rejected - A token the API answered with 401. If it is the cached one, it is renewed even before expiry.
+	*/
+	async token(rejected) {
+		if (rejected !== void 0 && rejected === this.jwt) this.expiresAt = 0;
+		if (this.fresh()) return this.jwt;
+		this.pending ??= this.resolve();
+		try {
+			return await this.pending;
+		} finally {
+			this.pending = null;
+		}
+	}
+	fresh() {
+		return this.jwt !== null && Date.now() < this.expiresAt - EXPIRY_SKEW_MS;
+	}
+	async resolve() {
+		await this.restore();
+		if (this.fresh()) return this.jwt;
+		if (this.refreshToken) try {
+			return await this.refresh();
+		} catch (error) {
+			if (!(error instanceof AuthEndpointError && error.status >= 400 && error.status < 500 && error.status !== 429)) throw error;
+			this.refreshToken = null;
+		}
+		return this.authenticate();
+	}
+	async restore() {
+		if (this.restored || !this.storage) return;
+		this.restored = true;
+		const state = await this.storage.load();
+		if (!state) return;
+		this.jwt = state.jwt;
+		this.refreshToken = state.refreshToken;
+		this.sessionId = state.sessionId;
+		this.expiresAt = state.expiresAt;
+		this.deviceSerial = state.deviceSerial;
+		this.deviceSerialKnown = true;
+	}
+	async authenticate() {
+		const initData = await this.requestInitData();
+		const serial = this.deviceSerialKnown ? { device_serial: this.deviceSerial } : { device_serial_fallback: this.deviceSerial };
+		const token = await this.store(await this.post("/alectryon/public-api/auth", {
+			web_view_init_data_raw: initData,
+			ep: "menu",
+			device_serial_multi_domain_backup_supported: true,
+			...serial
+		}));
+		this.deviceSerialKnown = true;
+		return token;
+	}
+	async requestInitData(retryAfterFlood = true) {
+		if (!this.client.connected) await this.client.connect();
+		let result;
+		try {
+			result = await this.client.invoke(new Api.messages.RequestWebView({
+				peer: this.bot,
+				bot: this.bot,
+				platform: "web",
+				fromBotMenu: true
+			}));
+		} catch (error) {
+			if (!retryAfterFlood || !(error instanceof errors.FloodWaitError)) throw error;
+			const waitMs = error.seconds * 1e3;
+			if (waitMs > this.maxFloodWaitMs) throw new Error(`telegram rate limited for ${error.seconds}s, above maxFloodWaitMs of ${this.maxFloodWaitMs}`);
+			await sleep(waitMs);
+			return this.requestInitData(false);
+		}
+		const initData = new URLSearchParams(new URL(result.url).hash.slice(1)).get("tgWebAppData");
+		if (!initData) throw new Error("no tgWebAppData in web view url");
+		return initData;
+	}
+	async refresh() {
+		return this.store(await this.post("/alectryon/public-api/auth-refresh", {
+			session_id: this.sessionId,
+			refresh_token: this.refreshToken,
+			device_serial: this.deviceSerial
+		}));
+	}
+	async post(path, body) {
+		const response = await this.fetchImpl(`${this.authUrl}${path}`, {
+			method: "POST",
+			headers: {
+				...BROWSER_HEADERS,
+				accept: "*/*",
+				"sec-fetch-site": new URL(this.authUrl).origin === new URL(this.baseUrl).origin ? "same-origin" : "same-site",
+				"content-type": "application/json",
+				origin: this.baseUrl,
+				referer: `${this.baseUrl}/`,
+				"x-wallet-tz-name": Intl.DateTimeFormat().resolvedOptions().timeZone,
+				"x-wallet-tz-offset": String(-(/* @__PURE__ */ new Date()).getTimezoneOffset())
+			},
+			body: JSON.stringify(body)
+		});
+		if (!response.ok) throw new AuthEndpointError(`${path} failed (${response.status}): ${await response.text()}`, response.status);
+		return await response.json();
+	}
+	async store(data) {
+		this.jwt = data.jwt;
+		this.refreshToken = data.refresh_token;
+		this.sessionId = data.session_id;
+		if (Number.isFinite(data.access_token_expires_in)) this.expiresAt = Date.now() + data.access_token_expires_in * 1e3;
+		else {
+			const parsed = Date.parse(data.access_token_expires_at);
+			this.expiresAt = Number.isNaN(parsed) ? Date.now() + 3e5 : parsed;
+		}
+		await this.storage?.save({
+			jwt: this.jwt,
+			refreshToken: this.refreshToken,
+			sessionId: this.sessionId,
+			expiresAt: this.expiresAt,
+			deviceSerial: this.deviceSerial
+		});
+		return this.jwt;
+	}
+	async disconnect() {
+		await this.client.disconnect();
+	}
+};
+export { TelegramTokenSource };

package/build/telegram/file-storage.d.ts

@@ -0,0 +1,3 @@
+import { TokenStorage } from "./auth.js";
+export declare const defaultTokenPath: (session: string) => string;
+export declare const fileTokenStorage: (path: string) => TokenStorage;

package/build/telegram/file-storage.js

@@ -0,0 +1,33 @@
+import { createHash } from "node:crypto";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+// source/telegram/file-storage.ts
+const defaultTokenPath = (session) => {
+	const cacheHome = process.env["XDG_CACHE_HOME"] || join(homedir(), ".cache");
+	const account = createHash("sha256").update(session).digest("hex").slice(0, 16);
+	return join(cacheHome, "walt", `${account}.json`);
+};
+const fileTokenStorage = (path) => ({
+	load: async () => {
+		try {
+			return JSON.parse(await readFile(path, "utf8"));
+		} catch {
+			return null;
+		}
+	},
+	save: async (state) => {
+		const temp = `${path}.${process.pid}.tmp`;
+		try {
+			await mkdir(dirname(path), {
+				recursive: true,
+				mode: 448
+			});
+			await writeFile(temp, JSON.stringify(state), { mode: 384 });
+			await rename(temp, path);
+		} catch (error) {
+			if (!(error instanceof Error && "code" in error)) throw error;
+		}
+	}
+});
+export { defaultTokenPath, fileTokenStorage };

package/build/transport.d.ts

@@ -0,0 +1,40 @@
+export declare class WaltAuthError extends Error {}
+export declare class WaltRequestError extends Error {
+  /** HTTP status, or `0` when the request never got a response. */
+  readonly status: number;
+  /** From a `retry-after` given in seconds. */
+  readonly retryAfterMs: number | null;
+  /** The response body, parsed when it is JSON, such as `{ code: 'market_order_max_limit_error', detail }`. */
+  readonly body: unknown;
+  constructor(message: string, status: number, retryAfterMs: number | null, body: unknown, options?: ErrorOptions);
+}
+export declare class Transport {
+  private readonly baseUrl;
+  private readonly fetchImpl;
+  private readonly tokenProvider;
+  private readonly traceId;
+  private readonly baggage;
+  private readonly retries;
+  private readonly retryDelayMs;
+  private readonly maxConcurrent;
+  private token;
+  private pending;
+  private active;
+  private readonly waiting;
+  constructor(options: {
+    tokenProvider: (rejected?: string) => Promise<string>;
+    baseUrl: string;
+    fetch: typeof fetch;
+    retries: number;
+    retryDelayMs: number;
+    maxConcurrent: number;
+  });
+  get<T>(path: string): Promise<T>;
+  post<T>(path: string, body: unknown, retries?: number): Promise<T>;
+  private ensureToken;
+  private mintToken;
+  private acquire;
+  private release;
+  private send;
+  private request;
+}

package/build/transport.js

@@ -0,0 +1,177 @@
+import { BROWSER_HEADERS, SENTRY_PUBLIC_KEY, SENTRY_RELEASE } from "./browser.js";
+import { randomBytes } from "node:crypto";
+// source/transport.ts
+var WaltAuthError = class extends Error {};
+var WaltRequestError = class extends Error {
+	/** HTTP status, or `0` when the request never got a response. */
+	status;
+	/** From a `retry-after` given in seconds. */
+	retryAfterMs;
+	/** The response body, parsed when it is JSON, such as `{ code: 'market_order_max_limit_error', detail }`. */
+	body;
+	constructor(message, status, retryAfterMs, body, options) {
+		super(message, options);
+		this.status = status;
+		this.retryAfterMs = retryAfterMs;
+		this.body = body;
+	}
+};
+const RETRYABLE_STATUS = /* @__PURE__ */ new Set([
+	0,
+	429,
+	502,
+	503,
+	504
+]);
+const MAX_RETRY_DELAY_MS = 3e4;
+const hex = (bytes) => randomBytes(bytes).toString("hex");
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const parseBody = (text) => {
+	try {
+		return JSON.parse(text);
+	} catch {
+		return text;
+	}
+};
+const retryAfterOf = (response) => {
+	const header = response.headers.get("retry-after");
+	return header !== null && /^\d+$/.test(header.trim()) ? Number(header.trim()) * 1e3 : null;
+};
+const telegramUserIdOf = (token) => {
+	try {
+		const payload = token.split(".")[1] ?? "";
+		const id = JSON.parse(Buffer.from(payload, "base64url").toString("utf8")).web_view_init_data?.user?.id;
+		return typeof id === "number" ? id : null;
+	} catch {
+		return null;
+	}
+};
+var Transport = class {
+	baseUrl;
+	fetchImpl;
+	tokenProvider;
+	traceId = hex(16);
+	baggage;
+	retries;
+	retryDelayMs;
+	maxConcurrent;
+	token = null;
+	pending = null;
+	active = 0;
+	waiting = [];
+	constructor(options) {
+		this.tokenProvider = options.tokenProvider;
+		this.baseUrl = options.baseUrl;
+		this.fetchImpl = options.fetch;
+		this.retries = options.retries;
+		this.retryDelayMs = options.retryDelayMs;
+		this.maxConcurrent = options.maxConcurrent;
+		this.baggage = [
+			"sentry-environment=production",
+			`sentry-release=${SENTRY_RELEASE}`,
+			`sentry-public_key=${SENTRY_PUBLIC_KEY}`,
+			`sentry-trace_id=${this.traceId}`,
+			"sentry-transaction=%2Fwv",
+			"sentry-sampled=false",
+			`sentry-sample_rand=${Math.random()}`,
+			"sentry-sample_rate=0.01"
+		].join(",");
+	}
+	get(path) {
+		return this.request(path, void 0, this.retries);
+	}
+	post(path, body, retries = this.retries) {
+		return this.request(path, body, retries);
+	}
+	async ensureToken(rejected) {
+		if (this.token) return this.token;
+		this.pending ??= this.mintToken(rejected);
+		try {
+			return await this.pending;
+		} finally {
+			this.pending = null;
+		}
+	}
+	async mintToken(rejected) {
+		const token = await this.tokenProvider(rejected);
+		this.token = token;
+		return token;
+	}
+	async acquire() {
+		if (this.active < this.maxConcurrent) {
+			this.active++;
+			return;
+		}
+		return new Promise((resolve) => {
+			this.waiting.push(() => {
+				this.active++;
+				resolve();
+			});
+		});
+	}
+	release() {
+		this.active--;
+		this.waiting.shift()?.();
+	}
+	async send(path, body, rejected) {
+		const token = await this.ensureToken(rejected);
+		const method = body === void 0 ? "GET" : "POST";
+		const jwt = token.replace(/^Bearer\s+/i, "");
+		const userId = telegramUserIdOf(jwt);
+		const headers = {
+			...BROWSER_HEADERS,
+			accept: "application/json",
+			authorization: path.startsWith("/emporos/") ? `Bearer ${jwt}` : jwt,
+			referer: `${this.baseUrl}/main?ep=menu${userId === null ? "" : `&tgWebAppUserId=${userId}`}`,
+			baggage: this.baggage,
+			"sentry-trace": `${this.traceId}-${hex(8)}-0`,
+			traceparent: `00-${hex(16)}-${hex(8)}-01`
+		};
+		if (method === "POST") {
+			headers["content-type"] = "application/json";
+			headers["origin"] = this.baseUrl;
+		}
+		let response;
+		try {
+			response = await this.fetchImpl(`${this.baseUrl}${path}`, {
+				method,
+				headers,
+				body: method === "POST" ? JSON.stringify(body) : null
+			});
+		} catch (cause) {
+			throw new WaltRequestError(`${method} ${path} failed (no response)`, 0, null, null, { cause });
+		}
+		if (response.status === 401) {
+			if (rejected !== void 0) throw new WaltAuthError("token rejected after refresh");
+			if (this.token === token) this.token = null;
+			return this.send(path, body, token);
+		}
+		let text;
+		try {
+			text = await response.text();
+		} catch (cause) {
+			throw new WaltRequestError(`${method} ${path} failed (body not received)`, 0, null, null, { cause });
+		}
+		if (!response.ok) throw new WaltRequestError(`${method} ${path} failed (${response.status})`, response.status, retryAfterOf(response), parseBody(text));
+		try {
+			return JSON.parse(text);
+		} catch (cause) {
+			throw new WaltRequestError(`${method} ${path} returned a body that is not JSON (${response.status})`, response.status, null, text, { cause });
+		}
+	}
+	async request(path, body, retries) {
+		await this.acquire();
+		try {
+			for (let attempt = 0;; attempt++) try {
+				return await this.send(path, body);
+			} catch (error) {
+				if (!(error instanceof WaltRequestError && RETRYABLE_STATUS.has(error.status)) || attempt >= retries) throw error;
+				const backoff = Math.min(MAX_RETRY_DELAY_MS, this.retryDelayMs * 2 ** attempt);
+				await sleep(error.retryAfterMs ?? backoff / 2 + Math.random() * (backoff / 2));
+			}
+		} finally {
+			this.release();
+		}
+	}
+};
+export { Transport, WaltAuthError, WaltRequestError };

package/package.json

@@ -1,6 +1,84 @@
 {
   "name": "@2bad/walt",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "1.0.0",
+  "description": "Client for the Walt (ex. Wallet) API in Telegram to track a crypto portfolio and exchange between assets",
+  "keywords": [
+    "telegram",
+    "walt",
+    "wallet",
+    "crypto",
+    "portfolio"
+  ],
+  "homepage": "https://github.com/2BAD/walt#readme",
+  "bugs": {
+    "url": "https://github.com/2BAD/walt/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/2BAD/walt.git"
+  },
+  "license": "MIT",
+  "author": "2BAD (https://github.com/2BAD)",
+  "contributors": [
+    {
+      "name": "Jason Hyde",
+      "email": "github@2bad.me",
+      "url": "https://github.com/mrhyde"
+    }
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./build/index.d.ts",
+        "default": "./build/index.js"
+      }
+    }
+  },
+  "bin": {
+    "telegram-login": "./build/bin/login.js"
+  },
+  "files": [
+    "build"
+  ],
+  "dependencies": {
+    "teleproto": "1.232.0"
+  },
+  "devDependencies": {
+    "@2bad/axiom": "2.1.0",
+    "@2bad/tsconfig": "4.0.0",
+    "@arethetypeswrong/cli": "0.18.5",
+    "@types/node": "26.6.6",
+    "@vitest/coverage-v8": "5.0.5",
+    "npm-run-all2": "9.0.4",
+    "oxfmt": "0.75.0",
+    "oxlint": "1.90.0",
+    "publint": "0.3.25",
+    "tsdown": "0.23.4",
+    "typescript": "7.0.2",
+    "vitest": "5.0.5"
+  },
+  "engines": {
+    "node": ">=26"
+  },
+  "volta": {
+    "node": "26.13.0",
+    "pnpm": "12.16.1"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "check": "run-p check:**",
+    "check:code": "oxlint ./source",
+    "check:format": "oxfmt --check ./source ./examples",
+    "check:types": "tsc --noEmit",
+    "fix": "run-p fix:**",
+    "fix:code": "oxlint --fix ./source",
+    "fix:format": "oxfmt ./source ./examples",
+    "telegram:login": "node --env-file-if-exists=.env source/bin/login.ts",
+    "example": "run-s build && node --env-file-if-exists=.env examples/portfolio.ts",
+    "preversion": "run-s check test build",
+    "test": "vitest run",
+    "test:integration": "vitest run integration --coverage",
+    "test:unit": "vitest run unit --coverage"
+  }
 }