runline 0.32.0 → 0.34.0

package/dist/plugins/freshservice/src/index.js

@@ -1,40 +1,18 @@
-async function apiRequest(domain, apiKey, method, endpoint, body, qs) {
-    const url = new URL(`https://${domain}.freshservice.com/api/v2${endpoint}`);
-    if (qs) {
-        for (const [k, v] of Object.entries(qs)) {
-            if (v !== undefined && v !== null)
-                url.searchParams.set(k, String(v));
-        }
-    }
-    const opts = {
+import { credentialJson, pathSegment } from "../../_shared/credentials.js";
+import { freshserviceCredential } from "./credentials.js";
+function req(ctx, method, path, body, qs) {
+    return credentialJson(ctx, freshserviceCredential, "freshservice", {
+        target: "api",
+        path,
         method,
-        headers: {
-            Authorization: `Basic ${btoa(`${apiKey}:X`)}`,
-            "Content-Type": "application/json",
-        },
-    };
-    if (body &&
-        Object.keys(body).length > 0 &&
-        method !== "GET" &&
-        method !== "DELETE") {
-        opts.body = JSON.stringify(body);
-    }
-    const res = await fetch(url.toString(), opts);
-    if (!res.ok)
-        throw new Error(`Freshservice API error ${res.status}: ${await res.text()}`);
-    if (res.status === 204)
-        return { success: true };
-    return res.json();
-}
-function getConn(ctx) {
-    return {
-        domain: ctx.connection.config.domain,
-        apiKey: ctx.connection.config.apiKey,
-    };
-}
-function req(ctx, method, endpoint, body, qs) {
-    const { domain, apiKey } = getConn(ctx);
-    return apiRequest(domain, apiKey, method, endpoint, body, qs);
+        query: qs,
+        ...(body &&
+            Object.keys(body).length > 0 &&
+            method !== "GET" &&
+            method !== "DELETE"
+            ? { json: body }
+            : {}),
+    });
 }
 function unwrap(data) {
     if (data && typeof data === "object" && !Array.isArray(data)) {
@@ -44,7 +22,7 @@ function unwrap(data) {
     }
     return data;
 }
-function registerCrud(rl, resource, apiPath, singularKey, opts) {
+function registerCrud(rl, resource, apiPath, opts) {
     rl.registerAction(`${resource}.create`, {
         access: "write",
         description: `Create a ${resource}`,
@@ -69,7 +47,7 @@ function registerCrud(rl, resource, apiPath, singularKey, opts) {
             id: { type: "number", required: true, description: `${resource} ID` },
         },
         async execute(input, ctx) {
-            return unwrap(await req(ctx, "GET", `${apiPath}/${input.id}`));
+            return unwrap(await req(ctx, "GET", `${apiPath}/${pathSegment(input.id)}`));
         },
     });
     rl.registerAction(`${resource}.list`, {
@@ -102,7 +80,7 @@ function registerCrud(rl, resource, apiPath, singularKey, opts) {
         },
         async execute(input, ctx) {
             const { id, properties } = input;
-            return unwrap(await req(ctx, "PUT", `${apiPath}/${id}`, properties));
+            return unwrap(await req(ctx, "PUT", `${apiPath}/${pathSegment(id)}`, properties));
         },
     });
     if (!opts?.noDelete) {
@@ -113,7 +91,7 @@ function registerCrud(rl, resource, apiPath, singularKey, opts) {
                 id: { type: "number", required: true, description: `${resource} ID` },
             },
             async execute(input, ctx) {
-                await req(ctx, "DELETE", `${apiPath}/${input.id}`);
+                await req(ctx, "DELETE", `${apiPath}/${pathSegment(input.id)}`);
                 return { success: true };
             },
         });
@@ -122,6 +100,7 @@ function registerCrud(rl, resource, apiPath, singularKey, opts) {
 export default function freshservice(rl) {
     rl.setName("freshservice");
     rl.setVersion("0.1.0");
+    rl.setCredential(freshserviceCredential);
     rl.setConnectionSchema({
         domain: {
             type: "string",
@@ -136,22 +115,22 @@ export default function freshservice(rl) {
             env: "FRESHSERVICE_API_KEY",
         },
     });
-    // 16 resources, all CRUD
-    registerCrud(rl, "agent", "/agents", "agent");
-    registerCrud(rl, "agentGroup", "/groups", "group");
-    registerCrud(rl, "announcement", "/announcements", "announcement");
-    registerCrud(rl, "asset", "/assets", "asset");
-    registerCrud(rl, "assetType", "/asset_types", "asset_type");
-    registerCrud(rl, "change", "/changes", "change");
-    registerCrud(rl, "department", "/departments", "department");
-    registerCrud(rl, "location", "/locations", "location");
-    registerCrud(rl, "problem", "/problems", "problem");
-    registerCrud(rl, "product", "/products", "product");
-    registerCrud(rl, "release", "/releases", "release");
-    registerCrud(rl, "requester", "/requesters", "requester");
-    registerCrud(rl, "requesterGroup", "/requester_groups", "requester_group");
-    registerCrud(rl, "software", "/applications", "application");
-    registerCrud(rl, "ticket", "/tickets", "ticket");
+    // 15 resources, all CRUD
+    registerCrud(rl, "agent", "agents");
+    registerCrud(rl, "agentGroup", "groups");
+    registerCrud(rl, "announcement", "announcements");
+    registerCrud(rl, "asset", "assets");
+    registerCrud(rl, "assetType", "asset_types");
+    registerCrud(rl, "change", "changes");
+    registerCrud(rl, "department", "departments");
+    registerCrud(rl, "location", "locations");
+    registerCrud(rl, "problem", "problems");
+    registerCrud(rl, "product", "products");
+    registerCrud(rl, "release", "releases");
+    registerCrud(rl, "requester", "requesters");
+    registerCrud(rl, "requesterGroup", "requester_groups");
+    registerCrud(rl, "software", "applications");
+    registerCrud(rl, "ticket", "tickets");
     // agentRole is read-only (get + list only)
     rl.registerAction("agentRole.get", {
         access: "read",
@@ -160,7 +139,7 @@ export default function freshservice(rl) {
             id: { type: "number", required: true, description: "Role ID" },
         },
         async execute(input, ctx) {
-            return unwrap(await req(ctx, "GET", `/roles/${input.id}`));
+            return unwrap(await req(ctx, "GET", `roles/${pathSegment(input.id)}`));
         },
     });
     rl.registerAction("agentRole.list", {
@@ -177,7 +156,7 @@ export default function freshservice(rl) {
                 qs.per_page = limit;
             if (page)
                 qs.page = page;
-            return unwrap(await req(ctx, "GET", "/roles", undefined, qs));
+            return unwrap(await req(ctx, "GET", "roles", undefined, qs));
         },
     });
 }

package/dist/plugins/freshworksCrm/src/credentials.js

@@ -0,0 +1,16 @@
+import { hostLabel, staticCredential } from "../../_shared/credentials.js";
+/**
+ * The API key in Freshworks' `Token token=` Authorization scheme, sent to
+ * the connection's own bundle domain.
+ */
+export const freshworksCrmCredential = staticCredential({
+    id: "freshworksCrm",
+    auth: { kind: "apiKey", header: "Authorization", prefix: "Token token=" },
+    local: { secret: "apiKey" },
+    targets: (config) => ({
+        api: {
+            baseUrl: `https://${hostLabel(config.domain)}.myfreshworks.com/crm/sales/api/`,
+            methods: ["GET", "POST", "PUT", "DELETE"],
+        },
+    }),
+});

package/dist/plugins/freshworksCrm/src/index.js

@@ -1,40 +1,18 @@
-async function apiRequest(domain, apiKey, method, endpoint, body, qs) {
-    const url = new URL(`https://${domain}.myfreshworks.com/crm/sales/api${endpoint}`);
-    if (qs) {
-        for (const [k, v] of Object.entries(qs)) {
-            if (v !== undefined && v !== null)
-                url.searchParams.set(k, String(v));
-        }
-    }
-    const opts = {
-        method,
-        headers: {
-            Authorization: `Token token=${apiKey}`,
-            "Content-Type": "application/json",
-        },
-    };
-    if (body &&
-        Object.keys(body).length > 0 &&
-        method !== "GET" &&
-        method !== "DELETE") {
-        opts.body = JSON.stringify(body);
-    }
-    const res = await fetch(url.toString(), opts);
-    if (!res.ok)
-        throw new Error(`Freshworks CRM API error ${res.status}: ${await res.text()}`);
-    if (res.status === 204)
-        return { success: true };
-    return res.json();
-}
-function getConn(ctx) {
-    return {
-        domain: ctx.connection.config.domain,
-        apiKey: ctx.connection.config.apiKey,
-    };
-}
+import { credentialJson, pathSegment } from "../../_shared/credentials.js";
+import { freshworksCrmCredential } from "./credentials.js";
 function req(ctx, method, endpoint, body, qs) {
-    const { domain, apiKey } = getConn(ctx);
-    return apiRequest(domain, apiKey, method, endpoint, body, qs);
+    return credentialJson(ctx, freshworksCrmCredential, "freshworksCrm", {
+        target: "api",
+        path: endpoint.replace(/^\//, ""),
+        method,
+        query: qs,
+        ...(body &&
+            Object.keys(body).length > 0 &&
+            method !== "GET" &&
+            method !== "DELETE"
+            ? { json: body }
+            : {}),
+    });
 }
 function unwrap(data) {
     if (data && typeof data === "object" && !Array.isArray(data)) {
@@ -68,7 +46,7 @@ function registerCrud(rl, resource, apiPath, wrapKey, opts) {
                 id: { type: "number", required: true, description: `${resource} ID` },
             },
             async execute(input, ctx) {
-                return unwrap(await req(ctx, "GET", `${apiPath}/${input.id}`));
+                return unwrap(await req(ctx, "GET", `${apiPath}/${pathSegment(input.id)}`));
             },
         });
     }
@@ -104,7 +82,9 @@ function registerCrud(rl, resource, apiPath, wrapKey, opts) {
         },
         async execute(input, ctx) {
             const { id, properties } = input;
-            return unwrap(await req(ctx, "PUT", `${apiPath}/${id}`, { [wrapKey]: properties }));
+            return unwrap(await req(ctx, "PUT", `${apiPath}/${pathSegment(id)}`, {
+                [wrapKey]: properties,
+            }));
         },
     });
     if (!opts?.noDelete) {
@@ -115,7 +95,7 @@ function registerCrud(rl, resource, apiPath, wrapKey, opts) {
                 id: { type: "number", required: true, description: `${resource} ID` },
             },
             async execute(input, ctx) {
-                await req(ctx, "DELETE", `${apiPath}/${input.id}`);
+                await req(ctx, "DELETE", `${apiPath}/${pathSegment(input.id)}`);
                 return { success: true };
             },
         });
@@ -124,6 +104,7 @@ function registerCrud(rl, resource, apiPath, wrapKey, opts) {
 export default function freshworksCrm(rl) {
     rl.setName("freshworksCrm");
     rl.setVersion("0.1.0");
+    rl.setCredential(freshworksCrmCredential);
     rl.setConnectionSchema({
         domain: {
             type: "string",

package/dist/plugins/getresponse/src/credentials.js

@@ -0,0 +1,22 @@
+import { staticCredential } from "../../_shared/credentials.js";
+/**
+ * An API key, sent as `X-Auth-Token: api-key {key}` to GetResponse's v3
+ * API base.
+ */
+export const getresponseCredential = staticCredential({
+    id: "getresponse",
+    auth: { kind: "apiKey", header: "X-Auth-Token", prefix: "api-key " },
+    local: { secret: "apiKey" },
+    targets: {
+        api: {
+            baseUrl: "https://api.getresponse.com/v3/",
+            methods: ["GET", "POST", "DELETE"],
+        },
+    },
+    probe: {
+        target: "api",
+        path: "accounts",
+        method: "GET",
+        acceptedStatuses: [200],
+    },
+});

package/dist/plugins/getresponse/src/index.js

@@ -1,35 +1,24 @@
-const BASE_URL = "https://api.getresponse.com/v3";
-async function apiRequest(apiKey, method, endpoint, body, qs) {
-    const url = new URL(`${BASE_URL}${endpoint}`);
-    if (qs) {
-        for (const [k, v] of Object.entries(qs)) {
-            if (v !== undefined && v !== null)
-                url.searchParams.set(k, String(v));
-        }
-    }
-    const opts = {
-        method,
-        headers: {
-            "X-Auth-Token": `api-key ${apiKey}`,
-            "Content-Type": "application/json",
-        },
-    };
-    if (body &&
+import { credentialJson, pathSegment } from "../../_shared/credentials.js";
+import { getresponseCredential } from "./credentials.js";
+function apiRequest(ctx, method, path, body, qs) {
+    const json = body &&
         Object.keys(body).length > 0 &&
         method !== "GET" &&
-        method !== "DELETE") {
-        opts.body = JSON.stringify(body);
-    }
-    const res = await fetch(url.toString(), opts);
-    if (!res.ok)
-        throw new Error(`GetResponse API error ${res.status}: ${await res.text()}`);
-    if (res.status === 204 || res.status === 202)
-        return { success: true };
-    return res.json();
+        method !== "DELETE"
+        ? body
+        : undefined;
+    return credentialJson(ctx, getresponseCredential, "getresponse", {
+        target: "api",
+        path,
+        method,
+        query: qs,
+        ...(json !== undefined ? { json } : {}),
+    });
 }
 export default function getresponse(rl) {
     rl.setName("getresponse");
     rl.setVersion("0.1.0");
+    rl.setCredential(getresponseCredential);
     rl.setConnectionSchema({
         apiKey: {
             type: "string",
@@ -38,7 +27,6 @@ export default function getresponse(rl) {
             env: "GETRESPONSE_API_KEY",
         },
     });
-    const key = (ctx) => ctx.connection.config.apiKey;
     rl.registerAction("contact.create", {
         access: "write",
         description: "Create a contact",
@@ -77,7 +65,7 @@ export default function getresponse(rl) {
                 body.tags = tags;
             if (customFieldValues)
                 body.customFieldValues = customFieldValues;
-            await apiRequest(key(ctx), "POST", "/contacts", body);
+            await apiRequest(ctx, "POST", "contacts", body);
             return { success: true };
         },
     });
@@ -97,7 +85,7 @@ export default function getresponse(rl) {
             const qs = {};
             if (fields)
                 qs.fields = fields;
-            return apiRequest(key(ctx), "GET", `/contacts/${contactId}`, undefined, qs);
+            return apiRequest(ctx, "GET", `contacts/${pathSegment(contactId)}`, undefined, qs);
         },
     });
     rl.registerAction("contact.list", {
@@ -145,7 +133,7 @@ export default function getresponse(rl) {
                 qs["query[campaignId]"] = campaignId;
             if (sortBy)
                 qs[`sort[${sortBy}]`] = sortOrder ?? "ASC";
-            return apiRequest(key(ctx), "GET", "/contacts", undefined, qs);
+            return apiRequest(ctx, "GET", "contacts", undefined, qs);
         },
     });
     rl.registerAction("contact.update", {
@@ -181,7 +169,7 @@ export default function getresponse(rl) {
                 body.tags = tags;
             if (customFieldValues)
                 body.customFieldValues = customFieldValues;
-            return apiRequest(key(ctx), "POST", `/contacts/${contactId}`, body);
+            return apiRequest(ctx, "POST", `contacts/${pathSegment(contactId)}`, body);
         },
     });
     rl.registerAction("contact.delete", {
@@ -207,7 +195,7 @@ export default function getresponse(rl) {
                 qs.messageId = messageId;
             if (ipAddress)
                 qs.ipAddress = ipAddress;
-            await apiRequest(key(ctx), "DELETE", `/contacts/${contactId}`, undefined, qs);
+            await apiRequest(ctx, "DELETE", `contacts/${pathSegment(contactId)}`, undefined, qs);
             return { success: true };
         },
     });

package/dist/plugins/gett/src/credentials.js

@@ -0,0 +1,64 @@
+import { AuthError } from "runline";
+import { grantSchema, pathSegment } from "../../_shared/credentials.js";
+export const HOST = "b2cgateway.gett.com";
+export const APP_VERSION = "10.48.187";
+/** What the Android app sends on every call: its own identity, and the device's. */
+export function appHeaders(config) {
+    return {
+        "user-agent": `Gett/android/${APP_VERSION}`,
+        "app-platform": "android",
+        "app-version": APP_VERSION,
+        "x-device-id": String(config.deviceId ?? ""),
+        "x-client-device-unique-id": String(config.clientDeviceUniqueId ?? ""),
+        "x-country-code": "IL",
+    };
+}
+/**
+ * The owner's Gett session: a long-lived refresh token, renewed at the
+ * account's GL token endpoint — as the app does it, with the app's headers
+ * and the refresh token as bearer — into access tokens that sign every call
+ * to the gateway. The phone and device IDs are public config; the owner
+ * login seeds the grant.
+ */
+export const gettCredential = (config) => {
+    if (typeof config.phone !== "string" || !config.phone.trim())
+        throw new AuthError("invalid_credentials");
+    const phone = pathSegment(config.phone.trim());
+    const headers = appHeaders(config);
+    return {
+        type: {
+            id: "gett",
+            methods: {
+                oauth2: {
+                    schema: grantSchema,
+                    authentication: {
+                        kind: "oauth2",
+                        field: "grant",
+                        renewal: "refresh",
+                        definition: {
+                            id: "gett.oauth2",
+                            provider: "gett",
+                            // `?lc=en` is required: without it the grant 400s with an empty body.
+                            refresh: {
+                                url: `https://${HOST}/gl/api/v2/phone/${phone}/auth/token?lc=en`,
+                                clientAuthentication: "none",
+                                encoding: "json",
+                                headers,
+                                refreshTokenBearer: true,
+                            },
+                        },
+                    },
+                    targets: {
+                        api: {
+                            baseUrl: `https://${HOST}/`,
+                            methods: ["GET", "POST"],
+                            allowedHeaders: Object.keys(headers),
+                            maxResponseBytes: 4 * 1024 * 1024,
+                        },
+                    },
+                },
+            },
+        },
+        method: "oauth2",
+    };
+};

package/dist/plugins/gett/src/index.js

@@ -1,8 +1,10 @@
 import * as t from "typebox";
+import { refuseUnderHost } from "../../_shared/credentials.js";
+import { gettCredential } from "./credentials.js";
 import { search } from "./places.js";
 import { book, optionsOf, plan, previewOf, quoteFor } from "./rides.js";
 import { createSession, identityOf, requestCode, status, verifyCard, verifyCode, } from "./session.js";
-import { accepted, accessToken, arr, authed, cfgOf, DEF_LAT, DEF_LON, num, numOrNull, obj, pick, seg, } from "./shared.js";
+import { accepted, arr, authed, cfgOf, DEF_LAT, DEF_LON, num, numOrNull, obj, pick, seg, } from "./shared.js";
 /**
  * gett — Gett (taxi, Israel) consumer connector.
  *
@@ -51,6 +53,7 @@ function bias(input, ctx) {
 export default function gett(rl) {
     rl.setName("gett");
     rl.setVersion("0.1.0");
+    rl.setCredential(gettCredential);
     rl.setConnectionSchema(t.Object({
         phone: t.Optional(t.String({
             env: "GETT_PHONE",
@@ -143,10 +146,12 @@ export default function gett(rl) {
     });
     rl.registerAction("account.refresh", {
         access: "write",
-        description: "Force a fresh access token from the stored refresh token. Rarely needed: every action renews on demand, and the refresh token is long-lived (~90 days), so no keepalive schedule is required. Useful to prove a stored session is still good.",
+        description: "Force a fresh access token from the stored refresh token and prove it on a live call. Rarely needed: every action renews on demand, and the refresh token is long-lived (~90 days), so no keepalive schedule is required. Runs where the grant lives: locally, not under a host that keeps it.",
         inputSchema: t.Object({}, STRICT),
         async execute(_input, ctx) {
-            await accessToken(ctx, true);
+            refuseUnderHost(ctx);
+            await ctx.updateConnection({ accessTokenExpiresAt: 1 });
+            await createSession(ctx, DEF_LAT, DEF_LON);
             const cfg = cfgOf(ctx);
             return {
                 refreshed: true,
@@ -309,7 +314,7 @@ export default function gett(rl) {
         async execute(input, ctx) {
             const { order_id } = input;
             const cfg = cfgOf(ctx);
-            const r = await authed(ctx, `/gl/server/3_3/phone/${seg(cfg.phone, "phone")}/orders/${seg(order_id, "order_id")}`);
+            const r = await authed(ctx, `/gl/server/3_3/phone/${seg(cfg.phone)}/orders/${seg(order_id)}`);
             return {
                 order_id: pick(r.id) ?? order_id,
                 status: pick(r.status),
@@ -339,8 +344,8 @@ export default function gett(rl) {
             const cfg = cfgOf(ctx);
             if (!cfg.allowOrdering)
                 throw new Error("gett ride.cancel: ordering is disabled for this connection (set allowOrdering:true).");
-            const phone = seg(cfg.phone, "phone");
-            const order = seg(order_id, "order_id");
+            const phone = seg(cfg.phone);
+            const order = seg(order_id);
             // The reason is optional metadata; a rejection there must not block the
             // cancel, but the caller is told whether it landed rather than left to guess.
             let reasonRecorded = null;

package/dist/plugins/gett/src/login.js

@@ -0,0 +1,24 @@
+import { refuseUnderHost } from "../../_shared/credentials.js";
+import { readBounded } from "../../_shared/provider.js";
+import { appHeaders, HOST } from "./credentials.js";
+import { bodyOf, endpointOf } from "./shared.js";
+/**
+ * One unsigned login call. It carries no stored credential — the phone, the
+ * texted code and the card digits come from the person logging in — and its
+ * answer may carry the tokens the login then stores.
+ */
+export async function loginRequest(ctx, path, body) {
+    refuseUnderHost(ctx);
+    const res = await fetch(`https://${HOST}${path}`, {
+        method: "POST",
+        headers: {
+            ...appHeaders(ctx.connection.config),
+            accept: "application/json",
+            "content-type": "application/json; charset=UTF-8",
+        },
+        body: JSON.stringify(body),
+        redirect: "error",
+    });
+    const text = await readBounded(res, 4 * 1024 * 1024, `gett: response exceeded the size limit on ${endpointOf(path)}`);
+    return bodyOf(new Response(text, { status: res.status }), path);
+}

package/dist/plugins/gett/src/session.js

@@ -1,5 +1,8 @@
-import { APP_VERSION, accepted, arr, authed, cfgOf, DEF_LAT, DEF_LON, ensureDevice, expiresAt, http, normPhone, num, numOrNull, obj, pick, seg, } from "./shared.js";
+import { refuseUnderHost } from "../../_shared/credentials.js";
+import { loginRequest } from "./login.js";
+import { APP_VERSION, accepted, arr, authed, cfgOf, DEF_LAT, DEF_LON, ensureDevice, expiresAt, normPhone, num, numOrNull, obj, pick, seg, } from "./shared.js";
 export async function requestCode(ctx, phone) {
+    refuseUnderHost(ctx);
     await ensureDevice(ctx);
     let cfg = cfgOf(ctx);
     if (phone) {
@@ -18,7 +21,7 @@ export async function requestCode(ctx, phone) {
         appsflyer_uid: `${Date.now()}-${Math.floor(Math.random() * 1e18)}`,
         gaid: "",
     };
-    const r = await http(ctx, `/gl/api/v2/phone/${seg(cfg.phone, "phone")}/auth/otp/challenge`, { method: "POST", body });
+    const r = await loginRequest(ctx, `/gl/api/v2/phone/${seg(cfg.phone)}/auth/otp/challenge`, body);
     // Gett answers 200 even when it refuses to send, so a refusal is reported
     // rather than an SMS claimed that will never arrive.
     const status = pick(r.status);
@@ -52,10 +55,11 @@ function tokensIn(r) {
     return null;
 }
 export async function verifyCode(ctx, code) {
+    refuseUnderHost(ctx);
     const cfg = cfgOf(ctx);
     if (!cfg.phone)
         throw new Error("gett: no phone — call account.requestCode first");
-    const r = await http(ctx, `/gl/api/v2/phone/${seg(cfg.phone, "phone")}/auth/otp/verify`, { method: "POST", body: { code } });
+    const r = await loginRequest(ctx, `/gl/api/v2/phone/${seg(cfg.phone)}/auth/otp/verify`, { code });
     const toks = tokensIn(r);
     if (toks) {
         const warnings = await finishTokens(ctx, toks);
@@ -79,13 +83,11 @@ export async function verifyCode(ctx, code) {
     };
 }
 export async function verifyCard(ctx, digits) {
+    refuseUnderHost(ctx);
     const cfg = cfgOf(ctx);
     if (!cfg.pendingTempCode)
         throw new Error("gett: no pending MFA — call account.verifyCode first");
-    const r = await http(ctx, `/gl/api/v2/phone/${seg(cfg.phone, "phone")}/auth/mfa/verify`, {
-        method: "POST",
-        body: { temp_code: cfg.pendingTempCode, card_digits: digits },
-    });
+    const r = await loginRequest(ctx, `/gl/api/v2/phone/${seg(cfg.phone)}/auth/mfa/verify`, { temp_code: cfg.pendingTempCode, card_digits: digits });
     const toks = tokensIn(r);
     if (!toks) {
         const reported = pick(r.status);
@@ -96,13 +98,12 @@ export async function verifyCard(ctx, digits) {
     return { warnings, ...(await status(ctx)) };
 }
 /**
- * Store the IL-scoped tokens, convert to the GL family the app uses for ongoing
- * refresh, then learn identity and the saved card.
+ * Store the login's tokens, then learn identity and the saved card.
  *
- * The conversion and the discovery are both optional: an IL token still serves
- * reads, and a missing card only blocks booking. Neither failure is allowed to
- * lose a login that otherwise succeeded, so both are reported as warnings rather
- * than swallowed or thrown.
+ * The tokens are IL-scoped; the first renewal, at the GL token endpoint the
+ * credential declares, is what converts them to the GL family the app keeps
+ * refreshing. The discovery is optional: a missing card only blocks booking,
+ * so its failure is reported as a warning rather than losing the login.
  */
 async function finishTokens(ctx, toks) {
     const warnings = [];
@@ -111,30 +112,6 @@ async function finishTokens(ctx, toks) {
         accessToken: pick(toks.access_token),
         accessTokenExpiresAt: expiresAt(toks.expires_in),
     });
-    const cfg = cfgOf(ctx);
-    try {
-        // `?lc=en` is required here too: the conversion 400s without it even with a
-        // valid IL bearer.
-        const gl = await http(ctx, `/gl/api/v2/phone/${seg(cfg.phone, "phone")}/auth/token?lc=en`, {
-            method: "POST",
-            token: cfg.accessToken,
-            body: { grant_type: "refresh_token", refresh_token: cfg.refreshToken },
-        });
-        const patch = {};
-        const rotated = pick(gl.refresh_token);
-        const issued = pick(gl.access_token);
-        if (rotated)
-            patch.refreshToken = rotated;
-        if (issued) {
-            patch.accessToken = issued;
-            patch.accessTokenExpiresAt = expiresAt(gl.expires_in);
-        }
-        if (Object.keys(patch).length)
-            await ctx.updateConnection(patch);
-    }
-    catch (e) {
-        warnings.push(`IL->GL token conversion failed (${e.message}); reads work, but the session may need an earlier re-login.`);
-    }
     try {
         await createSession(ctx, DEF_LAT, DEF_LON);
     }
@@ -203,7 +180,7 @@ export async function createSession(ctx, lat, lon) {
         platform: "android",
         gaid: cfg.gaid,
     };
-    const r = await authed(ctx, `/gl/rider-facade/phone/${seg(cfg.phone, "phone")}/create_session`, { method: "POST", body });
+    const r = await authed(ctx, `/gl/rider-facade/phone/${seg(cfg.phone)}/create_session`, { method: "POST", body });
     const profile = obj(r.user_profile);
     const patch = {};
     const globalUserId = pick(profile.global_user_id);