@2bad/walt 1.0.1 → 2.1.0

package/build/index.js

@@ -1,5 +1,6 @@
-import { normalizeTransaction } from "./api/transactions.js";
+import { WaltAuthError, WaltRequestError } from "./transport.js";
 import { WaltClient } from "./client.js";
+import { normalizeTransaction } from "./api/transactions.js";
+import { RefreshTokenSource } from "./refresh.js";
 import { TelegramTokenSource } from "./telegram/auth.js";
-import { WaltAuthError, WaltRequestError } from "./transport.js";
-export { TelegramTokenSource, WaltAuthError, WaltClient, WaltRequestError, normalizeTransaction };
+export { RefreshTokenSource, TelegramTokenSource, WaltAuthError, WaltClient, WaltRequestError, normalizeTransaction };

package/build/refresh.d.ts

@@ -0,0 +1,60 @@
+export type TokenState = {
+  jwt: string;
+  refreshToken: string;
+  sessionId: string;
+  expiresAt: number;
+  deviceSerial: string;
+};
+export type TokenStorage = {
+  load: () => Promise<TokenState | null>;
+  save: (state: TokenState) => Promise<void>;
+};
+export type RefreshTokenSourceOptions = {
+  /** Where to start. Without it the state comes from `storage.load()`. */
+  state?: TokenState;
+  /** `save` receives the new state after every renewal, rotated refresh token included. */
+  storage?: TokenStorage | undefined;
+  /** Origin of the web app, sent as `origin` and `referer`. */
+  baseUrl?: string | undefined;
+  /** Where the refresh requests go. */
+  authUrl?: string | undefined;
+  fetch?: typeof fetch | undefined;
+};
+export type AuthResponse = {
+  jwt: string;
+  refresh_token: string;
+  session_id: string;
+  access_token_expires_at: string;
+  access_token_expires_in: number;
+};
+/**
+ * Renews the access token from a stored refresh token over HTTPS, without Telegram.
+ * Throws `WaltAuthError` once the refresh token is rejected; a new token state is then needed.
+ */
+export declare class RefreshTokenSource {
+  protected readonly baseUrl: string;
+  protected readonly storage: TokenStorage | undefined;
+  protected state: TokenState | null;
+  private readonly authUrl;
+  private readonly fetchImpl;
+  private restored;
+  private pending;
+  constructor(options: RefreshTokenSourceOptions);
+  /**
+   * @param rejected - A token the API answered with 401. If it is the cached one, it is renewed even before expiry.
+   */
+  token(rejected?: string): Promise<string>;
+  private fresh;
+  private resolve;
+  private restore;
+  /**
+   * Called when there is no refresh token to use, or the server rejected it.
+   *
+   * @param cause - The rejection, if there was one.
+   * @returns The new jwt.
+   */
+  protected signIn(cause?: unknown): Promise<string>;
+  private refresh;
+  protected post(path: string, body: Record<string, unknown>): Promise<AuthResponse>;
+  protected store(data: AuthResponse, deviceSerial: string): Promise<string>;
+}

package/build/refresh.js

@@ -0,0 +1,130 @@
+import { BROWSER_HEADERS } from "./browser.js";
+import { WaltAuthError } from "./transport.js";
+// source/refresh.ts
+const BASE_URL = "https://walletbot.me";
+const AUTH_URL = "https://alectryon.walletbot.me";
+const EXPIRY_SKEW_MS = 3e4;
+var AuthEndpointError = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+	}
+};
+const isRejection = (error) => error instanceof AuthEndpointError && error.status >= 400 && error.status < 500 && error.status !== 429;
+/**
+* Renews the access token from a stored refresh token over HTTPS, without Telegram.
+* Throws `WaltAuthError` once the refresh token is rejected; a new token state is then needed.
+*/
+var RefreshTokenSource = class {
+	baseUrl;
+	storage;
+	state;
+	authUrl;
+	fetchImpl;
+	restored;
+	pending = null;
+	constructor(options) {
+		this.state = options.state ?? null;
+		this.storage = options.storage;
+		this.restored = options.state !== void 0;
+		this.baseUrl = options.baseUrl ?? BASE_URL;
+		this.authUrl = options.authUrl ?? AUTH_URL;
+		this.fetchImpl = options.fetch ?? fetch;
+	}
+	/**
+	* @param rejected - A token the API answered with 401. If it is the cached one, it is renewed even before expiry.
+	*/
+	async token(rejected) {
+		if (this.state && rejected !== void 0 && rejected === this.state.jwt) this.state = {
+			...this.state,
+			expiresAt: 0
+		};
+		if (this.state && this.fresh(this.state)) return this.state.jwt;
+		this.pending ??= this.resolve();
+		try {
+			return await this.pending;
+		} finally {
+			this.pending = null;
+		}
+	}
+	fresh(state) {
+		return Date.now() < state.expiresAt - EXPIRY_SKEW_MS;
+	}
+	async resolve() {
+		await this.restore();
+		const state = this.state;
+		if (state && this.fresh(state)) return state.jwt;
+		if (state?.refreshToken) try {
+			return await this.refresh(state);
+		} catch (error) {
+			if (!isRejection(error)) throw error;
+			this.state = {
+				...state,
+				refreshToken: ""
+			};
+			return this.signIn(error);
+		}
+		return this.signIn();
+	}
+	async restore() {
+		if (this.restored || !this.storage) return;
+		this.restored = true;
+		this.state = await this.storage.load();
+	}
+	/**
+	* Called when there is no refresh token to use, or the server rejected it.
+	*
+	* @param cause - The rejection, if there was one.
+	* @returns The new jwt.
+	*/
+	signIn(cause) {
+		const message = this.state ? "refresh token rejected, a new token state is needed" : "no token state to refresh";
+		return Promise.reject(new WaltAuthError(message, { cause }));
+	}
+	async refresh(state) {
+		const data = await this.post("/alectryon/public-api/auth-refresh", {
+			session_id: state.sessionId,
+			refresh_token: state.refreshToken,
+			device_serial: state.deviceSerial
+		});
+		return this.store(data, state.deviceSerial);
+	}
+	async post(path, body) {
+		const response = await this.fetchImpl(`${this.authUrl}${path}`, {
+			method: "POST",
+			headers: {
+				...BROWSER_HEADERS,
+				accept: "*/*",
+				"sec-fetch-site": new URL(this.authUrl).origin === new URL(this.baseUrl).origin ? "same-origin" : "same-site",
+				"content-type": "application/json",
+				origin: this.baseUrl,
+				referer: `${this.baseUrl}/`,
+				"x-wallet-tz-name": Intl.DateTimeFormat().resolvedOptions().timeZone,
+				"x-wallet-tz-offset": String(-(/* @__PURE__ */ new Date()).getTimezoneOffset())
+			},
+			body: JSON.stringify(body)
+		});
+		if (!response.ok) throw new AuthEndpointError(`${path} failed (${response.status}): ${await response.text()}`, response.status);
+		return await response.json();
+	}
+	async store(data, deviceSerial) {
+		let expiresAt;
+		if (Number.isFinite(data.access_token_expires_in)) expiresAt = Date.now() + data.access_token_expires_in * 1e3;
+		else {
+			const parsed = Date.parse(data.access_token_expires_at);
+			expiresAt = Number.isNaN(parsed) ? Date.now() + 3e5 : parsed;
+		}
+		const state = {
+			jwt: data.jwt,
+			refreshToken: data.refresh_token,
+			sessionId: data.session_id,
+			expiresAt,
+			deviceSerial
+		};
+		this.state = state;
+		await this.storage?.save(state);
+		return state.jwt;
+	}
+};
+export { RefreshTokenSource };

package/build/telegram/auth.d.ts

@@ -1,14 +1,4 @@
-export type TokenState = {
-  jwt: string;
-  refreshToken: string;
-  sessionId: string;
-  expiresAt: number;
-  deviceSerial: string;
-};
-export type TokenStorage = {
-  load: () => Promise<TokenState | null>;
-  save: (state: TokenState) => Promise<void>;
-};
+import { RefreshTokenSource, TokenStorage } from "../refresh.js";
 export type TelegramTokenSourceOptions = {
   session: string;
   apiId: number;
@@ -24,34 +14,15 @@ export type TelegramTokenSourceOptions = {
   storage?: TokenStorage | false;
   maxFloodWaitMs?: number;
 };
-export declare class TelegramTokenSource {
+/** Signs in over Telegram, then renews like `RefreshTokenSource`, signing in again when the refresh token is rejected. */
+export declare class TelegramTokenSource extends RefreshTokenSource {
   private readonly client;
   private readonly bot;
-  private readonly baseUrl;
-  private readonly authUrl;
-  private readonly fetchImpl;
-  private readonly storage;
   private readonly maxFloodWaitMs;
-  private deviceSerial;
-  private deviceSerialKnown;
-  private jwt;
-  private refreshToken;
-  private sessionId;
-  private expiresAt;
-  private restored;
-  private pending;
+  private readonly knownDeviceSerial;
+  private readonly newDeviceSerial;
   constructor(options: TelegramTokenSourceOptions);
-  /**
-   * @param rejected - A token the API answered with 401. If it is the cached one, it is renewed even before expiry.
-   */
-  token(rejected?: string): Promise<string>;
-  private fresh;
-  private resolve;
-  private restore;
-  private authenticate;
+  protected signIn(): Promise<string>;
   private requestInitData;
-  private refresh;
-  private post;
-  private store;
   disconnect(): Promise<void>;
 }

package/build/telegram/auth.js

@@ -1,97 +1,40 @@
-import { BROWSER_HEADERS } from "../browser.js";
+import { RefreshTokenSource } from "../refresh.js";
 import { defaultTokenPath, fileTokenStorage } from "./file-storage.js";
 import { Api, TelegramClient, errors } from "teleproto";
 import { StringSession } from "teleproto/sessions/index.js";
 // source/telegram/auth.ts
-const BASE_URL = "https://walletbot.me";
-const AUTH_URL = "https://alectryon.walletbot.me";
-const EXPIRY_SKEW_MS = 3e4;
 const MAX_FLOOD_WAIT_MS = 6e4;
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-var AuthEndpointError = class extends Error {
-	status;
-	constructor(message, status) {
-		super(message);
-		this.status = status;
-	}
-};
-var TelegramTokenSource = class {
+/** Signs in over Telegram, then renews like `RefreshTokenSource`, signing in again when the refresh token is rejected. */
+var TelegramTokenSource = class extends RefreshTokenSource {
 	client;
 	bot;
-	baseUrl;
-	authUrl;
-	fetchImpl;
-	storage;
 	maxFloodWaitMs;
-	deviceSerial;
-	deviceSerialKnown;
-	jwt = null;
-	refreshToken = null;
-	sessionId = null;
-	expiresAt = 0;
-	restored = false;
-	pending = null;
+	knownDeviceSerial;
+	newDeviceSerial = `weba:${crypto.randomUUID()}`;
 	constructor(options) {
+		super({
+			storage: options.storage === false ? void 0 : options.storage ?? fileTokenStorage(defaultTokenPath(options.session)),
+			baseUrl: options.baseUrl,
+			authUrl: options.authUrl,
+			fetch: options.fetch
+		});
 		this.client = new TelegramClient(new StringSession(options.session), options.apiId, options.apiHash, { connectionRetries: 3 });
 		this.bot = options.bot ?? "walt";
-		this.deviceSerial = options.deviceSerial ?? `weba:${crypto.randomUUID()}`;
-		this.deviceSerialKnown = options.deviceSerial !== void 0;
-		this.baseUrl = options.baseUrl ?? BASE_URL;
-		this.authUrl = options.authUrl ?? AUTH_URL;
-		this.fetchImpl = options.fetch ?? fetch;
-		this.storage = options.storage === false ? void 0 : options.storage ?? fileTokenStorage(defaultTokenPath(options.session));
+		this.knownDeviceSerial = options.deviceSerial;
 		this.maxFloodWaitMs = options.maxFloodWaitMs ?? MAX_FLOOD_WAIT_MS;
 	}
-	/**
-	* @param rejected - A token the API answered with 401. If it is the cached one, it is renewed even before expiry.
-	*/
-	async token(rejected) {
-		if (rejected !== void 0 && rejected === this.jwt) this.expiresAt = 0;
-		if (this.fresh()) return this.jwt;
-		this.pending ??= this.resolve();
-		try {
-			return await this.pending;
-		} finally {
-			this.pending = null;
-		}
-	}
-	fresh() {
-		return this.jwt !== null && Date.now() < this.expiresAt - EXPIRY_SKEW_MS;
-	}
-	async resolve() {
-		await this.restore();
-		if (this.fresh()) return this.jwt;
-		if (this.refreshToken) try {
-			return await this.refresh();
-		} catch (error) {
-			if (!(error instanceof AuthEndpointError && error.status >= 400 && error.status < 500 && error.status !== 429)) throw error;
-			this.refreshToken = null;
-		}
-		return this.authenticate();
-	}
-	async restore() {
-		if (this.restored || !this.storage) return;
-		this.restored = true;
-		const state = await this.storage.load();
-		if (!state) return;
-		this.jwt = state.jwt;
-		this.refreshToken = state.refreshToken;
-		this.sessionId = state.sessionId;
-		this.expiresAt = state.expiresAt;
-		this.deviceSerial = state.deviceSerial;
-		this.deviceSerialKnown = true;
-	}
-	async authenticate() {
+	async signIn() {
 		const initData = await this.requestInitData();
-		const serial = this.deviceSerialKnown ? { device_serial: this.deviceSerial } : { device_serial_fallback: this.deviceSerial };
-		const token = await this.store(await this.post("/alectryon/public-api/auth", {
+		const known = this.state?.deviceSerial ?? this.knownDeviceSerial;
+		const serial = known === void 0 ? { device_serial_fallback: this.newDeviceSerial } : { device_serial: known };
+		const data = await this.post("/alectryon/public-api/auth", {
 			web_view_init_data_raw: initData,
 			ep: "menu",
 			device_serial_multi_domain_backup_supported: true,
 			...serial
-		}));
-		this.deviceSerialKnown = true;
-		return token;
+		});
+		return this.store(data, known ?? this.newDeviceSerial);
 	}
 	async requestInitData(retryAfterFlood = true) {
 		if (!this.client.connected) await this.client.connect();
@@ -114,49 +57,6 @@ var TelegramTokenSource = class {
 		if (!initData) throw new Error("no tgWebAppData in web view url");
 		return initData;
 	}
-	async refresh() {
-		return this.store(await this.post("/alectryon/public-api/auth-refresh", {
-			session_id: this.sessionId,
-			refresh_token: this.refreshToken,
-			device_serial: this.deviceSerial
-		}));
-	}
-	async post(path, body) {
-		const response = await this.fetchImpl(`${this.authUrl}${path}`, {
-			method: "POST",
-			headers: {
-				...BROWSER_HEADERS,
-				accept: "*/*",
-				"sec-fetch-site": new URL(this.authUrl).origin === new URL(this.baseUrl).origin ? "same-origin" : "same-site",
-				"content-type": "application/json",
-				origin: this.baseUrl,
-				referer: `${this.baseUrl}/`,
-				"x-wallet-tz-name": Intl.DateTimeFormat().resolvedOptions().timeZone,
-				"x-wallet-tz-offset": String(-(/* @__PURE__ */ new Date()).getTimezoneOffset())
-			},
-			body: JSON.stringify(body)
-		});
-		if (!response.ok) throw new AuthEndpointError(`${path} failed (${response.status}): ${await response.text()}`, response.status);
-		return await response.json();
-	}
-	async store(data) {
-		this.jwt = data.jwt;
-		this.refreshToken = data.refresh_token;
-		this.sessionId = data.session_id;
-		if (Number.isFinite(data.access_token_expires_in)) this.expiresAt = Date.now() + data.access_token_expires_in * 1e3;
-		else {
-			const parsed = Date.parse(data.access_token_expires_at);
-			this.expiresAt = Number.isNaN(parsed) ? Date.now() + 3e5 : parsed;
-		}
-		await this.storage?.save({
-			jwt: this.jwt,
-			refreshToken: this.refreshToken,
-			sessionId: this.sessionId,
-			expiresAt: this.expiresAt,
-			deviceSerial: this.deviceSerial
-		});
-		return this.jwt;
-	}
 	async disconnect() {
 		await this.client.disconnect();
 	}

package/build/telegram/file-storage.d.ts

@@ -1,3 +1,3 @@
-import { TokenStorage } from "./auth.js";
+import { TokenStorage } from "../refresh.js";
 export declare const defaultTokenPath: (session: string) => string;
 export declare const fileTokenStorage: (path: string) => TokenStorage;

package/build/transport.js

@@ -1,5 +1,4 @@
 import { BROWSER_HEADERS, SENTRY_PUBLIC_KEY, SENTRY_RELEASE } from "./browser.js";
-import { randomBytes } from "node:crypto";
 // source/transport.ts
 var WaltAuthError = class extends Error {};
 var WaltRequestError = class extends Error {
@@ -23,8 +22,13 @@ const RETRYABLE_STATUS = /* @__PURE__ */ new Set([
 	503,
 	504
 ]);
+const BEARER_SERVICES = [
+	"/emporos/",
+	"/portmone/",
+	"/kandelabr/"
+];
 const MAX_RETRY_DELAY_MS = 3e4;
-const hex = (bytes) => randomBytes(bytes).toString("hex");
+const hex = (bytes) => Array.from(crypto.getRandomValues(new Uint8Array(bytes)), (byte) => byte.toString(16).padStart(2, "0")).join("");
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 const parseBody = (text) => {
 	try {
@@ -39,8 +43,9 @@ const retryAfterOf = (response) => {
 };
 const telegramUserIdOf = (token) => {
 	try {
-		const payload = token.split(".")[1] ?? "";
-		const id = JSON.parse(Buffer.from(payload, "base64url").toString("utf8")).web_view_init_data?.user?.id;
+		const payload = (token.split(".")[1] ?? "").replaceAll("-", "+").replaceAll("_", "/");
+		const bytes = Uint8Array.from(atob(payload), (char) => char.charCodeAt(0));
+		const id = JSON.parse(new TextDecoder().decode(bytes)).web_view_init_data?.user?.id;
 		return typeof id === "number" ? id : null;
 	} catch {
 		return null;
@@ -121,7 +126,7 @@ var Transport = class {
 		const headers = {
 			...BROWSER_HEADERS,
 			accept: "application/json",
-			authorization: path.startsWith("/emporos/") ? `Bearer ${jwt}` : jwt,
+			authorization: BEARER_SERVICES.some((prefix) => path.startsWith(prefix)) ? `Bearer ${jwt}` : jwt,
 			referer: `${this.baseUrl}/main?ep=menu${userId === null ? "" : `&tgWebAppUserId=${userId}`}`,
 			baggage: this.baggage,
 			"sentry-trace": `${this.traceId}-${hex(8)}-0`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@2bad/walt",
-  "version": "1.0.1",
+  "version": "2.1.0",
   "description": "Client for the Walt (ex. Wallet) API in Telegram to track a crypto portfolio and exchange between assets",
   "keywords": [
     "telegram",
@@ -33,37 +33,43 @@
         "types": "./build/index.d.ts",
         "default": "./build/index.js"
       }
+    },
+    "./client": {
+      "import": {
+        "types": "./build/core.d.ts",
+        "default": "./build/core.js"
+      }
     }
   },
   "bin": {
-    "telegram-login": "./build/bin/login.js"
+    "walt": "./build/bin/walt.js"
   },
   "files": [
     "build"
   ],
   "dependencies": {
-    "teleproto": "1.232.0"
+    "teleproto": "1.232.1"
   },
   "devDependencies": {
     "@2bad/axiom": "2.1.0",
     "@2bad/tsconfig": "4.0.0",
     "@arethetypeswrong/cli": "0.18.5",
     "@types/node": "26.6.6",
-    "@vitest/coverage-v8": "5.0.5",
+    "@vitest/coverage-v8": "5.1.0",
     "npm-run-all2": "9.0.4",
-    "oxfmt": "0.75.0",
-    "oxlint": "1.90.0",
+    "oxfmt": "0.76.0",
+    "oxlint": "1.91.0",
     "publint": "0.3.25",
-    "tsdown": "0.23.4",
+    "tsdown": "0.23.5",
     "typescript": "7.0.2",
-    "vitest": "5.0.5"
+    "vitest": "5.1.0"
   },
   "engines": {
     "node": ">=26"
   },
   "volta": {
     "node": "26.13.0",
-    "pnpm": "12.16.1"
+    "pnpm": "12.18.0"
   },
   "scripts": {
     "build": "tsdown",
@@ -74,7 +80,7 @@
     "fix": "run-p fix:**",
     "fix:code": "oxlint --fix ./source",
     "fix:format": "oxfmt ./source ./examples",
-    "telegram:login": "node --env-file-if-exists=.env source/bin/login.ts",
+    "telegram:login": "run-s build && node --env-file-if-exists=.env build/bin/walt.js login",
     "example": "run-s build && node --env-file-if-exists=.env examples/portfolio.ts",
     "preversion": "run-s check test build",
     "test": "vitest run",

package/build/bin/login.js

@@ -1,30 +0,0 @@
-#!/usr/bin/env node
-import { TelegramClient } from "teleproto";
-import { StringSession } from "teleproto/sessions/index.js";
-import { createInterface } from "node:readline/promises";
-import { stdin, stdout } from "node:process";
-// source/bin/login.ts
-const rl = createInterface({
-	input: stdin,
-	output: stdout
-});
-const ask = (question) => rl.question(question);
-const apiId = Number(process.env["TG_API_ID"] || await ask("API id (from https://my.telegram.org): "));
-if (!Number.isSafeInteger(apiId) || apiId <= 0) {
-	console.error("The API id must be the number shown at https://my.telegram.org");
-	process.exit(1);
-}
-const apiHash = process.env["TG_API_HASH"] || await ask("API hash: ");
-const client = new TelegramClient(new StringSession(""), apiId, apiHash, { connectionRetries: 3 });
-await client.start({
-	phoneNumber: () => ask("Phone (+country...): "),
-	phoneCode: () => ask("Code you received: "),
-	password: () => ask("2FA password (blank if none): "),
-	onError: (error) => console.error(error)
-});
-rl.close();
-console.log("\nLogged in. Save this as TG_SESSION (keep it secret):\n");
-console.log(client.session.save());
-await client.disconnect();
-process.exit(0);
-export {};