emusks 2.0.16 → 2.0.18

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "emusks",
-  "version": "2.0.16",
+  "version": "2.0.18",
   "description": "Reverse-engineered Twitter API client. Log in and interact with the unofficial X API using any client identity — web, Android, iOS, or TweetDeck",
   "keywords": [
     "client",

package/src/v1.1.js

@@ -20,11 +20,36 @@ export default async function v1_1(queryName, { params, body, headers } = {}) {
   const url = new URL(finalUrl);
   const pathname = url.pathname;
 
+  // v1.1 endpoints want form-urlencoded bodies. helpers historically passed
+  // `body: JSON.stringify(...)`, which twitter silently rejected — the most
+  // recent example was friendships/create returning "Cannot find specified
+  // user" because user_id wasn't extractable from a JSON body. if the caller
+  // hasn't set its own content-type, transparently convert a JSON-string body
+  // into form-urlencoded so existing helpers Just Work.
+  const callerSetContentType = headers && Object.keys(headers).some(
+    (k) => k.toLowerCase() === "content-type",
+  );
+  let finalBody = body;
+  let coercedContentType = null;
+  if (!callerSetContentType && typeof finalBody === "string" && finalBody.startsWith("{")) {
+    try {
+      const parsed = JSON.parse(finalBody);
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        finalBody = new URLSearchParams(
+          Object.fromEntries(
+            Object.entries(parsed).map(([k, v]) => [k, v == null ? "" : String(v)]),
+          ),
+        ).toString();
+        coercedContentType = "application/x-www-form-urlencoded";
+      }
+    } catch {}
+  }
+
   const requestHeaders = {
     accept: "*/*",
     "accept-language": "en-US,en;q=0.9",
     authorization: `Bearer ${this.auth.client.bearer}`,
-    "content-type": "application/json",
+    "content-type": coercedContentType ?? "application/json",
     "x-csrf-token": this.auth.csrfToken,
     "x-twitter-active-user": "yes",
     "x-twitter-auth-type": "OAuth2Session",
@@ -48,17 +73,45 @@ export default async function v1_1(queryName, { params, body, headers } = {}) {
 
   const cycleTLS = await getCycleTLS();
 
-  return await cycleTLS(
+  const res = await cycleTLS(
     finalUrl,
     {
       headers: requestHeaders,
       userAgent: this.auth.client.fingerprints.userAgent,
       ja3: this.auth.client.fingerprints.ja3,
       ja4r: this.auth.client.fingerprints.ja4r,
-      body: body || undefined,
+      body: finalBody || undefined,
       proxy: this.proxy || undefined,
       referrer: "https://x.com/",
     },
     method,
   );
+
+  // surface twitter errors instead of returning silently. matches the pattern
+  // in graphql.js (it checks res.errors after .json()). without this, callers
+  // that just `await res.json()` swallow 4xx error bodies — e.g. profile
+  // updates over 160 chars used to no-op silently.
+  let bodyText;
+  try {
+    bodyText = await res.text();
+  } catch {
+    return res;
+  }
+  let bodyJson;
+  if (bodyText) {
+    try { bodyJson = JSON.parse(bodyText); } catch {}
+  }
+  if (bodyJson?.errors?.length) {
+    const messages = bodyJson.errors
+      .map((e) => e.message || (e.code != null ? `code ${e.code}` : "unknown"))
+      .join("; ");
+    throw new Error(`twitter v1.1 ${queryName} ${res.status}: ${messages}`);
+  }
+  // re-expose the response so existing helpers keep working
+  return {
+    status: res.status,
+    headers: res.headers,
+    json: async () => bodyJson,
+    text: async () => bodyText,
+  };
 }