runline 0.30.0 → 0.31.0

package/dist/plugins/wolt/src/orders.js

@@ -0,0 +1,349 @@
+import { createHash, randomUUID } from "node:crypto";
+import { selectAddress } from "./account.js";
+import { assortment, itemsById, optionDefinitions, } from "./catalog.js";
+import { arr, authed, CONSUMER, cfgOf, http, numOrNull, obj, pick, RESTAURANT, seg, WoltError, } from "./shared.js";
+export async function resolveCart(slug, cart) {
+    const a = await assortment(slug);
+    const items = itemsById(a);
+    const definitions = optionDefinitions(a);
+    const categoryOfItem = new Map();
+    for (const c of arr(a.categories)) {
+        const category = obj(c);
+        const categoryId = pick(category.id);
+        if (!categoryId)
+            continue;
+        for (const id of arr(category.item_ids)) {
+            const itemId = pick(id);
+            if (itemId && !categoryOfItem.has(itemId))
+                categoryOfItem.set(itemId, categoryId);
+        }
+    }
+    const menu_items = [];
+    const purchase_items = [];
+    const lines = [];
+    for (const line of cart) {
+        const item = items.get(line.id);
+        if (!item)
+            throw new Error(`wolt: item ${line.id} is not on venue ${slug}`);
+        const count = line.count ?? 1;
+        const categoryId = categoryOfItem.get(line.id) ?? null;
+        const basePrice = numOrNull(item.price) ?? 0;
+        let optionsTotal = 0;
+        const checkoutOptions = [];
+        const purchaseOptions = [];
+        for (const group of line.options ?? []) {
+            const onItem = arr(item.options)
+                .map(obj)
+                .find((o) => pick(o.id) === group.id);
+            if (!onItem)
+                throw new Error(`wolt: option group ${group.id} is not on item ${line.id}`);
+            const definition = obj(definitions.get(pick(onItem.option_id) ?? ""));
+            const values = group.values.map((v) => {
+                const declared = arr(definition.values)
+                    .map(obj)
+                    .find((d) => pick(d.id) === v.id);
+                if (!declared)
+                    throw new Error(`wolt: option ${v.id} is not a choice in group ${group.id}`);
+                const price = numOrNull(declared.price) ?? 0;
+                const valueCount = v.count ?? 1;
+                optionsTotal += price * valueCount;
+                return { id: v.id, price, count: valueCount };
+            });
+            checkoutOptions.push({ id: group.id, values });
+            purchaseOptions.push({
+                id: { $oid: group.id },
+                type: pick(definition.type) ?? "Multichoice",
+                values: values.map((v) => ({
+                    id: { $oid: v.id },
+                    price: v.price,
+                    count: v.count,
+                })),
+            });
+        }
+        const amount = (basePrice + optionsTotal) * count;
+        menu_items.push({
+            id: line.id,
+            count,
+            options: checkoutOptions,
+            base_price: basePrice,
+            end_amount: amount,
+            category_id: categoryId,
+            category_ids: categoryId ? [categoryId] : [],
+            exclude_from_discounts: false,
+            exclude_from_discounts_min_basket: false,
+            exclude_from_credits: false,
+            alcohol_permille: numOrNull(item.alcohol_permille) ?? 0,
+            restrictions: [],
+        });
+        purchase_items.push({
+            id: { $oid: line.id },
+            baseprice: basePrice,
+            options: purchaseOptions,
+            count,
+            end_amount: amount,
+            alcohol_percentage: 0,
+            checksum: pick(item.checksum),
+            substitution_settings: { is_allowed: true },
+            from_recommendation: false,
+        });
+        lines.push({ id: line.id, name: pick(item.name), count, amount });
+    }
+    return { menu_items, purchase_items, lines };
+}
+export async function estimate(venue, cart, method, tip) {
+    const menuItems = cart.map((line) => ({
+        id: line.id,
+        count: line.count ?? 1,
+        options: line.options ?? [],
+    }));
+    const r = await http(CONSUMER, "/order-xp/web/v1/pages/venue/pricing-estimates", {
+        method: "POST",
+        body: {
+            purchase_plan: {
+                venue: {
+                    id: venue.id,
+                    country: venue.country,
+                    currency: venue.currency,
+                },
+                delivery_method: method,
+                menu_items: menuItems,
+                courier_tip: tip,
+                use_promo_discount_ids: [],
+            },
+        },
+    });
+    return {
+        venue: { id: venue.id, slug: venue.slug, name: venue.name },
+        currency: venue.currency,
+        items: menuItems,
+        estimate: r,
+    };
+}
+async function checkout(ctx, venue, address, menuItems, tip) {
+    const cfg = cfgOf(ctx);
+    const [longitude, latitude] = address.coordinates ?? [null, null];
+    return authed(ctx, CONSUMER, "/order-xp/mobile/v2/pages/checkout", {
+        method: "POST",
+        body: {
+            purchase_plan: {
+                delivery: {
+                    delivery_coordinates: { latitude, longitude },
+                    delivery_info_id: address.id,
+                },
+                venue: {
+                    id: venue.id,
+                    country: venue.country,
+                    currency: venue.currency,
+                },
+                delivery_method: "homedelivery",
+                menu_items: menuItems,
+                use_cash: false,
+                selected_offer_ids: [],
+                pre_considered_discount_ids: [],
+                courier_tip: tip,
+                use_loyalty_points_amount: 0,
+                use_credits_and_tokens: true,
+                did_client_disable_purchase: false,
+                payment_methods: cfg.paymentMethodId
+                    ? [{ id: cfg.paymentMethodId, type: "card" }]
+                    : [],
+                delivery_config: { method: "homedelivery", schedule: "standard" },
+                is_partial_address: false,
+            },
+        },
+    });
+}
+function deliveryEstimate(checkoutBody, venue) {
+    const configs = arr(checkoutBody.delivery_configs).map(obj);
+    const chosen = configs.find((c) => pick(c.method) === "homedelivery" &&
+        pick(c.schedule) === "standard" &&
+        numOrNull(obj(c.estimate).max) !== null) ?? configs.find((c) => numOrNull(obj(c.estimate).max) !== null);
+    const range = obj(chosen?.estimate);
+    const min = numOrNull(range.min);
+    const max = numOrNull(range.max);
+    if (min !== null && max !== null)
+        return `${min}-${max}`;
+    const declared = obj(venue.estimate_range);
+    const dmin = numOrNull(declared.min);
+    const dmax = numOrNull(declared.max);
+    if (dmin !== null && dmax !== null)
+        return `${dmin}-${dmax}`;
+    const single = venue.live_estimate_minutes ?? venue.estimate_minutes;
+    return single !== null ? `${single}-${single + 10}` : "30-45";
+}
+export async function planOrder(ctx, venue, addresses, wantedAddress, slug, cart, tip) {
+    const address = selectAddress(addresses, wantedAddress);
+    const resolved = await resolveCart(slug, cart);
+    const body = await checkout(ctx, venue, address, resolved.menu_items, tip);
+    if (body.purchasing_disabled === true) {
+        const reason = pick(obj(body.call_to_action).text) ??
+            "Wolt has disabled purchasing here";
+        throw new Error(`wolt: this order cannot be placed — ${reason}`);
+    }
+    const validation = obj(body.purchase_validation);
+    const payable = numOrNull(validation.end_amount) ?? numOrNull(body.payable_amount);
+    // Without a total there is nothing to show a person and nothing to bind a
+    // confirmation to, and the purchase would post a null amount.
+    if (payable === null)
+        throw new Error("wolt: the checkout returned no payable amount, so this order cannot be priced");
+    return {
+        venue,
+        address,
+        cart: resolved,
+        checkout: body,
+        payable_amount: payable,
+        delivery_price: numOrNull(validation.delivery_price),
+        estimate_minutes: deliveryEstimate(body, venue),
+        tip,
+    };
+}
+/**
+ * A fingerprint of everything a person agrees to when they say yes: the venue,
+ * every line and its amount, where it is going, and the total. Re-derived on the
+ * confirming call, so a total that moved in between cannot be charged against
+ * the old consent.
+ */
+export function quoteFor(plan) {
+    const material = JSON.stringify([
+        plan.venue.id ?? plan.venue.slug ?? "",
+        plan.address.id ?? "",
+        plan.cart.lines.map((l) => [l.id, l.count, l.amount]),
+        plan.payable_amount,
+        plan.venue.currency ?? "",
+        plan.tip,
+    ]);
+    return `q_${createHash("sha256").update(material).digest("hex").slice(0, 16)}`;
+}
+export function previewOf(plan) {
+    return {
+        venue: {
+            id: plan.venue.id,
+            slug: plan.venue.slug,
+            name: plan.venue.name,
+        },
+        deliver_to: {
+            id: plan.address.id,
+            address: plan.address.address,
+            city: plan.address.city,
+        },
+        items: plan.cart.lines,
+        delivery_price: plan.delivery_price,
+        tip: plan.tip,
+        payable_amount: plan.payable_amount,
+        currency: plan.venue.currency,
+        estimate_minutes: plan.estimate_minutes,
+    };
+}
+export async function purchase(ctx, plan) {
+    const cfg = cfgOf(ctx);
+    if (!cfg.paymentMethodId)
+        throw new Error("wolt: no saved card (paymentMethodId) — a saved card is required, Google Pay cannot be replayed headless");
+    const validation = obj(plan.checkout.purchase_validation);
+    const [longitude, latitude] = plan.address.coordinates ?? [null, null];
+    const r = await authed(ctx, RESTAURANT, "/v2/purchases", {
+        method: "POST",
+        body: {
+            venue_id: plan.venue.id,
+            checkout_id: plan.checkout.id,
+            payment_method_id: cfg.paymentMethodId,
+            payment_method_type: "card",
+            end_amount: plan.payable_amount,
+            end_amount_rounding: numOrNull(validation.end_amount_rounding) ?? 0,
+            items: plan.cart.purchase_items,
+            client_pre_estimate: plan.estimate_minutes,
+            signature_datetime: { $date: Date.now() },
+            client_nonce: randomUUID(),
+            delivery_method: "homedelivery",
+            currency: plan.venue.currency,
+            preorder: false,
+            no_credits_or_tokens: false,
+            credits_amount: numOrNull(validation.credits_amount) ?? 0,
+            delivery_price: plan.delivery_price ?? 0,
+            delivery_info: {
+                id: { $oid: plan.address.id },
+                delivery_comments: "\n",
+                location: {
+                    address: plan.address.address,
+                    city: plan.address.city,
+                    coordinates: { coordinates: [longitude, latitude], type: "Point" },
+                },
+                use_last_100m_address_picker: true,
+            },
+            tip_amount: plan.tip,
+            language: "en",
+            additional_checkout_options: { no_contact_delivery: false },
+            ravelin_device_id: cfg.ravelinDeviceId,
+            browser_info: {
+                color_depth: 32,
+                screen_width: 1080,
+                screen_height: 2400,
+                time_zone_offset: -180,
+                java_enabled: false,
+                language: "en",
+                ravelin_device_id: cfg.ravelinDeviceId,
+            },
+            to: { id: { $oid: plan.venue.id }, type: "venue" },
+            signature: "N/A",
+            type: "purchase",
+            device_channel: "app",
+            pricing_model_version: 2023,
+            use_self_service_cancellation: false,
+            discounts: arr(validation.discounts),
+            surcharges: arr(validation.surcharges),
+            offers: arr(validation.offers),
+            menu_items_source: "consumer-assortment",
+        },
+    });
+    const first = obj(Array.isArray(r.results) ? r.results[0] : r.results);
+    const orderId = pick(obj(first.id).$oid, first.id, obj(r.id).$oid, r.id, r.purchase_id);
+    return { order_id: orderId };
+}
+export async function orderStatus(ctx, orderId) {
+    const id = seg(orderId, "order_id");
+    const [tracking, page] = await Promise.all([
+        authed(ctx, RESTAURANT, `/v2/order_details/purchase_tracking/${id}`),
+        authed(ctx, CONSUMER, `/order-xp/v1/pages/order-tracking/${id}`).catch(() => null),
+    ]);
+    const details = obj(tracking.order_details);
+    const context = obj(obj(page ?? {}).purchase_context);
+    const eta = numOrNull(obj(details.delivery_eta).$date);
+    return {
+        order_id: orderId,
+        status: pick(context.purchase_status),
+        venue: pick(context.venue_name),
+        eta: eta !== null ? new Date(eta).toISOString() : null,
+        delivery_distance: numOrNull(details.delivery_distance),
+        handshake_code: pick(details.delivery_handshake_code),
+        couriers: arr(tracking.drivers).map((d) => ({
+            name: pick(obj(d).name),
+            coordinates: obj(d).coordinates ?? obj(d).location ?? null,
+        })),
+        currency: pick(details.currency),
+        poll_after_seconds: numOrNull(tracking.expires_in_seconds),
+    };
+}
+export async function cancelOrder(ctx, orderId, reason) {
+    const id = seg(orderId, "order_id");
+    try {
+        await authed(ctx, RESTAURANT, `/v2/purchases/${id}/cancel`, {
+            method: "PUT",
+            body: { cancellation_reason: reason },
+        });
+        return { cancelled: true, order_id: orderId, reason };
+    }
+    catch (e) {
+        // A refusal is the normal outcome once the venue has accepted, so it comes
+        // back as an answer rather than an exception. error_code 4051 is that case.
+        if (!(e instanceof WoltError))
+            throw e;
+        const code = numOrNull(e.details().error_code);
+        return {
+            cancelled: false,
+            order_id: orderId,
+            error_code: code,
+            note: code === 4051
+                ? "The venue already accepted this order, so self-service cancellation is closed. Wolt support can still help."
+                : "Wolt refused the cancellation.",
+        };
+    }
+}

package/dist/plugins/wolt/src/shared.js

@@ -0,0 +1,218 @@
+import { randomUUID } from "node:crypto";
+import { authedFetch } from "../../_shared/authedFetch.js";
+import { arr, num, numOrNull, obj, pick, readBounded, seg as segment, } from "../../_shared/provider.js";
+import { coordinatedAccessToken } from "../../_shared/tokenRefresh.js";
+export { arr, num, numOrNull, obj, pick };
+/**
+ * Transport and credentials for the Wolt consumer surface.
+ *
+ * Three hosts, two client personas. Catalogue reads are anonymous and go out as
+ * the web app; everything authenticated goes out as the mobile app, because the
+ * API only accepts the authed calls from a client that looks like the phone.
+ */
+export const RESTAURANT = "restaurant-api.wolt.com";
+export const CONSUMER = "consumer-api.wolt.com";
+export const AUTH = "authentication.wolt.com";
+export const DEF_LAT = 32.0853;
+export const DEF_LON = 34.7818; // TLV
+export const AUDIENCE = "restaurant-api";
+export const CAPABILITIES = "access_confirmation";
+const MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
+const DEFAULT_TOKEN_TTL_MS = 3_600_000;
+const WEB_UA = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36";
+/** Mobile client headers; the authed endpoints reject anything that is not the app. */
+const MOBILE = {
+    "app-language": "en",
+    "app-locale": "en-US",
+    "client-version": "26.30.4",
+    clientversionnumber: "142026304",
+    platform: "Android",
+    "user-agent": "Wolt/26.30.4; Build/142026304; Android/16; Google sdk_gphone",
+};
+const WEB = {
+    "user-agent": WEB_UA,
+    "accept-language": "en",
+    "app-language": "en",
+    platform: "Web",
+    "client-version": "1.16.125",
+    origin: "https://wolt.com",
+    referer: "https://wolt.com/",
+};
+export const cfgOf = (ctx) => (ctx.connection.config || {});
+export const seg = (value, what) => segment(value, what, "wolt");
+/**
+ * Normalize a phone to E.164 for Wolt, so a number given the local Israeli way
+ * still routes. Handles intl "+972…"/"00972…", national "0500000000", and bare
+ * local "500000000" alike. Idempotent.
+ */
+export function normPhone(input) {
+    let digits = String(input).replace(/[^\d]/g, "");
+    if (digits.startsWith("00"))
+        digits = digits.slice(2); // intl exit code
+    if (digits.startsWith("972"))
+        return `+${digits}`;
+    if (digits.startsWith("0"))
+        return `+972${digits.slice(1)}`;
+    return `+972${digits}`;
+}
+export const formEncode = (body) => Object.entries(body)
+    .map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(String(v ?? ""))}`)
+    .join("&");
+/**
+ * A failed request.
+ *
+ * The body stays private. Wolt puts meaningful data in its 4xx bodies — the
+ * login escalation token, `error_code` — so the login flow needs to read it,
+ * but those same bodies carry access and refresh tokens. `details()` is the
+ * only way in, and the message never contains any of it.
+ */
+export class WoltError extends Error {
+    status;
+    endpoint;
+    #body;
+    constructor(status, endpoint, body) {
+        const retired = status === 410 ? " (endpoint retired by Wolt)" : "";
+        super(`wolt: request failed (HTTP ${status})${retired} on ${endpoint}`);
+        this.name = "WoltError";
+        this.status = status;
+        this.endpoint = endpoint;
+        this.#body = body;
+    }
+    /** The parsed body, for the branches that must read it. Never logged. */
+    details() {
+        try {
+            return obj(JSON.parse(this.#body));
+        }
+        catch {
+            return {};
+        }
+    }
+}
+function endpointOf(host, path) {
+    return `${host}${path.split("?")[0]}`;
+}
+export async function http(host, path, opts = {}) {
+    const endpoint = endpointOf(host, path);
+    const text = await httpText(host, path, opts);
+    // Wolt answers 200 with nothing at all on endpoints it has retired.
+    if (!text.trim())
+        throw new Error(`wolt: ${endpoint} returned an empty body (endpoint retired)`);
+    try {
+        return obj(JSON.parse(text));
+    }
+    catch {
+        throw new Error(`wolt: non-JSON response from ${endpoint}`);
+    }
+}
+async function httpText(host, path, opts = {}) {
+    const { method = "GET", body = null, headers = {}, web = true } = opts;
+    const payload = body == null
+        ? null
+        : typeof body === "string"
+            ? body
+            : JSON.stringify(body);
+    const merged = {
+        ...(web ? WEB : {}),
+        accept: "application/json",
+        ...headers,
+    };
+    if (payload && !merged["content-type"])
+        merged["content-type"] = "application/json";
+    const endpoint = endpointOf(host, path);
+    const res = await authedFetch(`https://${host}${path}`, {
+        method,
+        headers: merged,
+        body: payload,
+    });
+    const text = await readBounded(res, MAX_RESPONSE_BYTES, `wolt: response exceeded the size limit on ${endpoint}`);
+    if (res.status >= 400)
+        throw new WoltError(res.status, endpoint, text);
+    return text;
+}
+// ---------- identity ----------
+const ravelinDeviceId = () => `rvnand-6-${(randomUUID() + randomUUID()).replace(/-/g, "").toUpperCase().slice(0, 64)}`;
+const hex32 = () => (randomUUID() + randomUUID()).replace(/-/g, "").slice(0, 32);
+/**
+ * Device identity, generated once and then persisted. Wolt binds the session and
+ * its fraud fingerprint to these, so regenerating them invalidates the login.
+ */
+export async function ensureIdentity(ctx) {
+    const cfg = cfgOf(ctx);
+    const patch = {};
+    if (!cfg.visitorId)
+        patch.visitorId = randomUUID();
+    if (!cfg.ravelinDeviceId)
+        patch.ravelinDeviceId = ravelinDeviceId();
+    if (!cfg.deviceToken)
+        patch.deviceToken = hex32();
+    if (!cfg.woltSessionId)
+        patch.woltSessionId = randomUUID();
+    if (Object.keys(patch).length)
+        await ctx.updateConnection(patch);
+    return cfgOf(ctx);
+}
+/** Headers every authenticated or login call carries. */
+export function clientHeaders(cfg) {
+    return {
+        ...MOBILE,
+        "w-wolt-session-id": cfg.woltSessionId ?? randomUUID(),
+        "x-wolt-visitor-id": cfg.visitorId ?? randomUUID(),
+    };
+}
+// ---------- credentials ----------
+export function expiresAt(expiresIn) {
+    const seconds = numOrNull(expiresIn);
+    return Date.now() + (seconds ? seconds * 1000 : DEFAULT_TOKEN_TTL_MS);
+}
+/**
+ * The refresh grant. Called only from inside an update owner and always with
+ * explicit values, so it can never re-enter the connection store.
+ */
+async function refreshGrant(cfg) {
+    return http(AUTH, "/v1/wauth2/access_token", {
+        method: "POST",
+        web: false,
+        body: formEncode({
+            grant_type: "refresh_token",
+            refresh_token: cfg.refreshToken,
+            device_token: cfg.deviceToken ?? "",
+        }),
+        headers: {
+            ...clientHeaders(cfg),
+            "content-type": "application/x-www-form-urlencoded",
+        },
+    });
+}
+export async function accessToken(ctx, force = false) {
+    const cfg = await ensureIdentity(ctx);
+    if (!cfg.refreshToken)
+        throw new Error("wolt: not connected — run the owner login (account.requestEmailCode / account.requestSmsCode / account.redeemLink)");
+    // Renewal runs under the store's update ownership, so parallel actions
+    // coalesce onto one grant. Wolt rotates the refresh token on every grant, so
+    // a race would persist one the provider has already replaced.
+    return coordinatedAccessToken(ctx, async (current) => {
+        const resp = await refreshGrant(current);
+        const issued = pick(resp.access_token);
+        if (!issued)
+            throw new Error("wolt: token refresh returned no access_token — the refresh token has expired, re-run the owner login");
+        const rotated = pick(resp.refresh_token);
+        return {
+            accessToken: issued,
+            accessTokenExpiresAt: expiresAt(resp.expires_in),
+            ...(rotated ? { refreshToken: rotated } : {}),
+        };
+    }, force);
+}
+export async function authed(ctx, host, path, opts = {}) {
+    const token = await accessToken(ctx);
+    const cfg = cfgOf(ctx);
+    return http(host, path, {
+        ...opts,
+        web: false,
+        headers: {
+            ...clientHeaders(cfg),
+            authorization: `Bearer ${token}`,
+            ...(opts.headers ?? {}),
+        },
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runline",
-  "version": "0.30.0",
+  "version": "0.31.0",
   "description": "Code mode for agents \u2014 turn any API or command into a callable action",
   "type": "module",
   "main": "dist/index.js",