runline 0.32.0 → 0.34.0

package/dist/plugins/wekan/src/index.js

@@ -1,30 +1,17 @@
-function getConn(ctx) {
-    const c = ctx.connection.config;
-    return {
-        url: c.url.replace(/\/$/, ""),
-        token: c.token,
-    };
-}
-async function api(conn, method, endpoint, body) {
-    const init = {
+import { credentialJson, pathSegment } from "../../_shared/credentials.js";
+import { wekanCredential } from "./credentials.js";
+function api(ctx, method, endpoint, body) {
+    return credentialJson(ctx, wekanCredential, "wekan", {
+        target: "api",
+        path: endpoint,
         method,
-        headers: {
-            Authorization: `Bearer ${conn.token}`,
-            "Content-Type": "application/json",
-            Accept: "application/json",
-        },
-    };
-    if (body && Object.keys(body).length > 0)
-        init.body = JSON.stringify(body);
-    const res = await fetch(`${conn.url}/api/${endpoint}`, init);
-    if (!res.ok)
-        throw new Error(`Wekan error ${res.status}: ${await res.text()}`);
-    const text = await res.text();
-    return text ? JSON.parse(text) : {};
+        ...(body && Object.keys(body).length > 0 ? { json: body } : {}),
+    });
 }
 export default function wekan(rl) {
     rl.setName("wekan");
     rl.setVersion("0.1.0");
+    rl.setCredential(wekanCredential);
     rl.setConnectionSchema({
         url: {
             type: "string",
@@ -48,7 +35,7 @@ export default function wekan(rl) {
             owner: { type: "string", required: true },
         },
         async execute(input, ctx) {
-            return api(getConn(ctx), "POST", "boards", input);
+            return api(ctx, "POST", "boards", input);
         },
     });
     rl.registerAction("board.get", {
@@ -56,7 +43,7 @@ export default function wekan(rl) {
         description: "Get a board",
         inputSchema: { boardId: { type: "string", required: true } },
         async execute(input, ctx) {
-            return api(getConn(ctx), "GET", `boards/${input.boardId}`);
+            return api(ctx, "GET", `boards/${pathSegment(input.boardId)}`);
         },
     });
     rl.registerAction("board.list", {
@@ -68,7 +55,7 @@ export default function wekan(rl) {
         },
         async execute(input, ctx) {
             const p = input;
-            const data = (await api(getConn(ctx), "GET", `users/${p.userId}/boards`));
+            const data = (await api(ctx, "GET", `users/${pathSegment(p.userId)}/boards`));
             return p.limit ? data.slice(0, p.limit) : data;
         },
     });
@@ -77,7 +64,7 @@ export default function wekan(rl) {
         description: "Delete a board",
         inputSchema: { boardId: { type: "string", required: true } },
         async execute(input, ctx) {
-            return api(getConn(ctx), "DELETE", `boards/${input.boardId}`);
+            return api(ctx, "DELETE", `boards/${pathSegment(input.boardId)}`);
         },
     });
     // ── List ────────────────────────────────────────────
@@ -90,7 +77,7 @@ export default function wekan(rl) {
         },
         async execute(input, ctx) {
             const p = input;
-            return api(getConn(ctx), "POST", `boards/${p.boardId}/lists`, {
+            return api(ctx, "POST", `boards/${pathSegment(p.boardId)}/lists`, {
                 title: p.title,
             });
         },
@@ -104,7 +91,7 @@ export default function wekan(rl) {
         },
         async execute(input, ctx) {
             const p = input;
-            return api(getConn(ctx), "GET", `boards/${p.boardId}/lists/${p.listId}`);
+            return api(ctx, "GET", `boards/${pathSegment(p.boardId)}/lists/${pathSegment(p.listId)}`);
         },
     });
     rl.registerAction("list.listAll", {
@@ -116,7 +103,7 @@ export default function wekan(rl) {
         },
         async execute(input, ctx) {
             const p = input;
-            const data = (await api(getConn(ctx), "GET", `boards/${p.boardId}/lists`));
+            const data = (await api(ctx, "GET", `boards/${pathSegment(p.boardId)}/lists`));
             return p.limit ? data.slice(0, p.limit) : data;
         },
     });
@@ -129,7 +116,7 @@ export default function wekan(rl) {
         },
         async execute(input, ctx) {
             const p = input;
-            return api(getConn(ctx), "DELETE", `boards/${p.boardId}/lists/${p.listId}`);
+            return api(ctx, "DELETE", `boards/${pathSegment(p.boardId)}/lists/${pathSegment(p.listId)}`);
         },
     });
     // ── Card ────────────────────────────────────────────
@@ -146,7 +133,7 @@ export default function wekan(rl) {
         },
         async execute(input, ctx) {
             const { boardId, listId, ...body } = input;
-            return api(getConn(ctx), "POST", `boards/${boardId}/lists/${listId}/cards`, body);
+            return api(ctx, "POST", `boards/${pathSegment(boardId)}/lists/${pathSegment(listId)}/cards`, body);
         },
     });
     rl.registerAction("card.get", {
@@ -159,7 +146,7 @@ export default function wekan(rl) {
         },
         async execute(input, ctx) {
             const p = input;
-            return api(getConn(ctx), "GET", `boards/${p.boardId}/lists/${p.listId}/cards/${p.cardId}`);
+            return api(ctx, "GET", `boards/${pathSegment(p.boardId)}/lists/${pathSegment(p.listId)}/cards/${pathSegment(p.cardId)}`);
         },
     });
     rl.registerAction("card.list", {
@@ -172,7 +159,7 @@ export default function wekan(rl) {
         },
         async execute(input, ctx) {
             const p = input;
-            const data = (await api(getConn(ctx), "GET", `boards/${p.boardId}/lists/${p.listId}/cards`));
+            const data = (await api(ctx, "GET", `boards/${pathSegment(p.boardId)}/lists/${pathSegment(p.listId)}/cards`));
             return p.limit ? data.slice(0, p.limit) : data;
         },
     });
@@ -187,7 +174,7 @@ export default function wekan(rl) {
         },
         async execute(input, ctx) {
             const p = input;
-            return api(getConn(ctx), "PUT", `boards/${p.boardId}/lists/${p.listId}/cards/${p.cardId}`, p.data);
+            return api(ctx, "PUT", `boards/${pathSegment(p.boardId)}/lists/${pathSegment(p.listId)}/cards/${pathSegment(p.cardId)}`, p.data);
         },
     });
     rl.registerAction("card.delete", {
@@ -200,7 +187,7 @@ export default function wekan(rl) {
         },
         async execute(input, ctx) {
             const p = input;
-            return api(getConn(ctx), "DELETE", `boards/${p.boardId}/lists/${p.listId}/cards/${p.cardId}`);
+            return api(ctx, "DELETE", `boards/${pathSegment(p.boardId)}/lists/${pathSegment(p.listId)}/cards/${pathSegment(p.cardId)}`);
         },
     });
     // ── Card Comment ────────────────────────────────────
@@ -215,7 +202,7 @@ export default function wekan(rl) {
         },
         async execute(input, ctx) {
             const p = input;
-            return api(getConn(ctx), "POST", `boards/${p.boardId}/cards/${p.cardId}/comments`, { authorId: p.authorId, comment: p.comment });
+            return api(ctx, "POST", `boards/${pathSegment(p.boardId)}/cards/${pathSegment(p.cardId)}/comments`, { authorId: p.authorId, comment: p.comment });
         },
     });
     rl.registerAction("cardComment.get", {
@@ -228,7 +215,7 @@ export default function wekan(rl) {
         },
         async execute(input, ctx) {
             const p = input;
-            return api(getConn(ctx), "GET", `boards/${p.boardId}/cards/${p.cardId}/comments/${p.commentId}`);
+            return api(ctx, "GET", `boards/${pathSegment(p.boardId)}/cards/${pathSegment(p.cardId)}/comments/${pathSegment(p.commentId)}`);
         },
     });
     rl.registerAction("cardComment.list", {
@@ -240,7 +227,7 @@ export default function wekan(rl) {
         },
         async execute(input, ctx) {
             const p = input;
-            return api(getConn(ctx), "GET", `boards/${p.boardId}/cards/${p.cardId}/comments`);
+            return api(ctx, "GET", `boards/${pathSegment(p.boardId)}/cards/${pathSegment(p.cardId)}/comments`);
         },
     });
     rl.registerAction("cardComment.delete", {
@@ -253,7 +240,7 @@ export default function wekan(rl) {
         },
         async execute(input, ctx) {
             const p = input;
-            return api(getConn(ctx), "DELETE", `boards/${p.boardId}/cards/${p.cardId}/comments/${p.commentId}`);
+            return api(ctx, "DELETE", `boards/${pathSegment(p.boardId)}/cards/${pathSegment(p.cardId)}/comments/${pathSegment(p.commentId)}`);
         },
     });
     // ── Checklist ───────────────────────────────────────
@@ -272,7 +259,7 @@ export default function wekan(rl) {
         },
         async execute(input, ctx) {
             const p = input;
-            return api(getConn(ctx), "POST", `boards/${p.boardId}/cards/${p.cardId}/checklists`, { title: p.title, items: p.items });
+            return api(ctx, "POST", `boards/${pathSegment(p.boardId)}/cards/${pathSegment(p.cardId)}/checklists`, { title: p.title, items: p.items });
         },
     });
     rl.registerAction("checklist.get", {
@@ -285,7 +272,7 @@ export default function wekan(rl) {
         },
         async execute(input, ctx) {
             const p = input;
-            return api(getConn(ctx), "GET", `boards/${p.boardId}/cards/${p.cardId}/checklists/${p.checklistId}`);
+            return api(ctx, "GET", `boards/${pathSegment(p.boardId)}/cards/${pathSegment(p.cardId)}/checklists/${pathSegment(p.checklistId)}`);
         },
     });
     rl.registerAction("checklist.list", {
@@ -297,7 +284,7 @@ export default function wekan(rl) {
         },
         async execute(input, ctx) {
             const p = input;
-            return api(getConn(ctx), "GET", `boards/${p.boardId}/cards/${p.cardId}/checklists`);
+            return api(ctx, "GET", `boards/${pathSegment(p.boardId)}/cards/${pathSegment(p.cardId)}/checklists`);
         },
     });
     rl.registerAction("checklist.delete", {
@@ -310,7 +297,7 @@ export default function wekan(rl) {
         },
         async execute(input, ctx) {
             const p = input;
-            return api(getConn(ctx), "DELETE", `boards/${p.boardId}/cards/${p.cardId}/checklists/${p.checklistId}`);
+            return api(ctx, "DELETE", `boards/${pathSegment(p.boardId)}/cards/${pathSegment(p.cardId)}/checklists/${pathSegment(p.checklistId)}`);
         },
     });
     // ── Checklist Item ──────────────────────────────────
@@ -325,7 +312,7 @@ export default function wekan(rl) {
         },
         async execute(input, ctx) {
             const p = input;
-            return api(getConn(ctx), "GET", `boards/${p.boardId}/cards/${p.cardId}/checklists/${p.checklistId}/items/${p.itemId}`);
+            return api(ctx, "GET", `boards/${pathSegment(p.boardId)}/cards/${pathSegment(p.cardId)}/checklists/${pathSegment(p.checklistId)}/items/${pathSegment(p.itemId)}`);
         },
     });
     rl.registerAction("checklistItem.update", {
@@ -340,7 +327,7 @@ export default function wekan(rl) {
         },
         async execute(input, ctx) {
             const p = input;
-            return api(getConn(ctx), "PUT", `boards/${p.boardId}/cards/${p.cardId}/checklists/${p.checklistId}/items/${p.itemId}`, p.data);
+            return api(ctx, "PUT", `boards/${pathSegment(p.boardId)}/cards/${pathSegment(p.cardId)}/checklists/${pathSegment(p.checklistId)}/items/${pathSegment(p.itemId)}`, p.data);
         },
     });
     rl.registerAction("checklistItem.delete", {
@@ -354,7 +341,7 @@ export default function wekan(rl) {
         },
         async execute(input, ctx) {
             const p = input;
-            return api(getConn(ctx), "DELETE", `boards/${p.boardId}/cards/${p.cardId}/checklists/${p.checklistId}/items/${p.itemId}`);
+            return api(ctx, "DELETE", `boards/${pathSegment(p.boardId)}/cards/${pathSegment(p.cardId)}/checklists/${pathSegment(p.checklistId)}/items/${pathSegment(p.itemId)}`);
         },
     });
 }

package/dist/plugins/wolt/src/account.js

@@ -1,3 +1,4 @@
+import { refuseUnderHost } from "../../_shared/credentials.js";
 import { AUDIENCE, AUTH, arr, authed, CAPABILITIES, CONSUMER, cfgOf, clientHeaders, ensureIdentity, expiresAt, formEncode, http, normPhone, obj, pick, RESTAURANT, WoltError, } from "./shared.js";
 async function authJson(ctx, path, body, extra = {}) {
     return http(AUTH, path, {
@@ -114,6 +115,7 @@ async function finish(ctx, grant) {
     };
 }
 export async function redeemLink(ctx, link) {
+    refuseUnderHost(ctx);
     await ensureIdentity(ctx);
     const cfg = cfgOf(ctx);
     const token = linkToken(link);
@@ -134,6 +136,7 @@ export async function redeemLink(ctx, link) {
     }
 }
 export async function requestEmailCode(ctx, email, captcha) {
+    refuseUnderHost(ctx);
     await ensureIdentity(ctx);
     await ctx.updateConnection({ pendingEmail: email, pendingPhone: undefined });
     const r = await authJson(ctx, "/v3/users/email_login", { email, audience: AUDIENCE, email_code_support: true }, captchaHeader(captcha));
@@ -171,6 +174,7 @@ export async function loginMethods(ctx, phone) {
     return { phone: normalized, methods };
 }
 export async function requestSmsCode(ctx, input) {
+    refuseUnderHost(ctx);
     await ensureIdentity(ctx);
     const normalized = normPhone(input.phone);
     await ctx.updateConnection({ pendingPhone: normalized });
@@ -224,6 +228,7 @@ export async function requestSmsCode(ctx, input) {
  * error keeps its body privately.
  */
 export async function submitCode(ctx, code) {
+    refuseUnderHost(ctx);
     const cfg = cfgOf(ctx);
     if (!cfg.pendingEmail && !cfg.pendingPhone)
         throw new Error("wolt: no login in progress — run account.requestEmailCode or account.requestSmsCode first");
@@ -299,6 +304,7 @@ async function startEmailConfirmation(ctx, token, context) {
     };
 }
 export async function submitConfirmation(ctx, code) {
+    refuseUnderHost(ctx);
     const cfg = cfgOf(ctx);
     if (!cfg.pendingConfirmationToken)
         throw new Error("wolt: no confirmation in progress — account.submitCode reports when one is needed");

package/dist/plugins/wolt/src/catalog.js

@@ -50,7 +50,7 @@ export async function nearby(lat, lon, limit, openOnly) {
 /** A venue's static page plus its live status; the live half is best-effort. */
 export async function venue(slug, lat, lon) {
     const params = new URLSearchParams({ lat: String(lat), lon: String(lon) });
-    const name = seg(slug, "slug");
+    const name = seg(slug);
     const [staticPage, dynamic] = await Promise.all([
         http(CONSUMER, `/order-xp/web/v1/pages/venue/slug/${name}/static?${params}`),
         http(CONSUMER, `/order-xp/web/v1/venue/slug/${name}/dynamic/?selected_delivery_method=homedelivery`).catch(() => null),
@@ -77,7 +77,7 @@ export async function venue(slug, lat, lon) {
 }
 export async function assortment(slug, language = "en") {
     const params = new URLSearchParams({ language });
-    return http(CONSUMER, `/consumer-api/consumer-assortment/v1/venues/slug/${seg(slug, "slug")}/assortment?${params}`);
+    return http(CONSUMER, `/consumer-api/consumer-assortment/v1/venues/slug/${seg(slug)}/assortment?${params}`);
 }
 function optionGroupOf(raw, definitions) {
     const group = obj(raw);

package/dist/plugins/wolt/src/credentials.js

@@ -0,0 +1,64 @@
+import { grantSchema } from "../../_shared/credentials.js";
+export const RESTAURANT = "restaurant-api.wolt.com";
+export const CONSUMER = "consumer-api.wolt.com";
+export const AUTH = "authentication.wolt.com";
+/** Mobile client headers; the authed endpoints reject anything that is not the app. */
+const MOBILE = {
+    "app-language": "en",
+    "app-locale": "en-US",
+    "client-version": "26.30.4",
+    clientversionnumber: "142026304",
+    platform: "Android",
+    "user-agent": "Wolt/26.30.4; Build/142026304; Android/16; Google sdk_gphone",
+};
+/** Headers every authenticated or login call carries: the app, and this device's session. */
+export function clientHeaders(config) {
+    return {
+        ...MOBILE,
+        "w-wolt-session-id": String(config.woltSessionId ?? ""),
+        "x-wolt-visitor-id": String(config.visitorId ?? ""),
+    };
+}
+/**
+ * The owner's Wolt session: a refresh token, renewed at Wolt's token
+ * endpoint as the mobile app does it — its headers, and the device token
+ * the session is bound to — into access tokens that sign the restaurant
+ * and consumer APIs. Wolt rotates the refresh token on every grant. The
+ * device identifiers are public config; the owner login seeds the grant.
+ */
+export const woltCredential = (config) => {
+    const headers = clientHeaders(config);
+    const api = (host) => ({
+        baseUrl: `https://${host}/`,
+        methods: ["GET", "POST", "PUT"],
+        allowedHeaders: Object.keys(headers),
+        maxResponseBytes: 8 * 1024 * 1024,
+    });
+    return {
+        type: {
+            id: "wolt",
+            methods: {
+                oauth2: {
+                    schema: grantSchema,
+                    authentication: {
+                        kind: "oauth2",
+                        field: "grant",
+                        renewal: "refresh",
+                        definition: {
+                            id: "wolt.oauth2",
+                            provider: "wolt",
+                            refresh: {
+                                url: `https://${AUTH}/v1/wauth2/access_token`,
+                                clientAuthentication: "none",
+                                headers,
+                                parameters: { device_token: String(config.deviceToken ?? "") },
+                            },
+                        },
+                    },
+                    targets: { restaurant: api(RESTAURANT), consumer: api(CONSUMER) },
+                },
+            },
+        },
+        method: "oauth2",
+    };
+};

package/dist/plugins/wolt/src/index.js

@@ -1,8 +1,10 @@
 import * as t from "typebox";
+import { refuseUnderHost } from "../../_shared/credentials.js";
 import { discoverPaymentMethod, listAddresses, loginMethods, redeemLink, requestEmailCode, requestSmsCode, status, submitCode, submitConfirmation, whoami, } from "./account.js";
 import { item, menu, nearby, search, venue } from "./catalog.js";
+import { woltCredential } from "./credentials.js";
 import { cancelOrder, estimate, orderStatus, planOrder, previewOf, purchase, quoteFor, } from "./orders.js";
-import { accessToken, cfgOf, DEF_LAT, DEF_LON, num, } from "./shared.js";
+import { authed, cfgOf, DEF_LAT, DEF_LON, num, RESTAURANT, } from "./shared.js";
 /**
  * wolt — Wolt (food and grocery delivery, Israel and global) consumer connector.
  *
@@ -101,6 +103,7 @@ function coords(input, ctx) {
 export default function wolt(rl) {
     rl.setName("wolt");
     rl.setVersion("0.1.0");
+    rl.setCredential(woltCredential);
     rl.setConnectionSchema(t.Object({
         refreshToken: t.Optional(t.String({
             env: "WOLT_REFRESH_TOKEN",
@@ -354,10 +357,12 @@ export default function wolt(rl) {
     });
     rl.registerAction("account.refresh", {
         access: "write",
-        description: "Force a token refresh. Wolt rotates its refresh token on every grant, so an untouched session eventually lapses; a recurring 'call wolt.account.refresh()' every ~12h keeps it alive. Also the cheapest proof that stored credentials still work.",
+        description: "Force a token refresh and prove it on a live call. Wolt rotates its refresh token on every grant, so an untouched session eventually lapses; a recurring 'call wolt.account.refresh()' every ~12h keeps it alive. Runs where the grant lives: locally, not under a host that keeps it.",
         inputSchema: t.Object({}, STRICT),
         async execute(_input, ctx) {
-            await accessToken(ctx, true);
+            refuseUnderHost(ctx);
+            await ctx.updateConnection({ accessTokenExpiresAt: 1 });
+            await authed(ctx, RESTAURANT, "/v1/user/me");
             const cfg = cfgOf(ctx);
             return {
                 refreshed: true,

package/dist/plugins/wolt/src/orders.js

@@ -299,7 +299,7 @@ export async function purchase(ctx, plan) {
     return { order_id: orderId };
 }
 export async function orderStatus(ctx, orderId) {
-    const id = seg(orderId, "order_id");
+    const id = seg(orderId);
     const [tracking, page] = await Promise.all([
         authed(ctx, RESTAURANT, `/v2/order_details/purchase_tracking/${id}`),
         authed(ctx, CONSUMER, `/order-xp/v1/pages/order-tracking/${id}`).catch(() => null),
@@ -323,7 +323,7 @@ export async function orderStatus(ctx, orderId) {
     };
 }
 export async function cancelOrder(ctx, orderId, reason) {
-    const id = seg(orderId, "order_id");
+    const id = seg(orderId);
     try {
         await authed(ctx, RESTAURANT, `/v2/purchases/${id}/cancel`, {
             method: "PUT",

package/dist/plugins/wolt/src/public.js

@@ -0,0 +1,91 @@
+import { obj, readBounded } from "../../_shared/provider.js";
+/**
+ * The requests that carry no stored credential: anonymous catalogue reads,
+ * sent as the web app, and the owner login's steps, whose inputs come from
+ * the person logging in. Everything signed goes through `authed` instead.
+ */
+const MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
+const WEB_UA = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36";
+const WEB = {
+    "user-agent": WEB_UA,
+    "accept-language": "en",
+    "app-language": "en",
+    platform: "Web",
+    "client-version": "1.16.125",
+    origin: "https://wolt.com",
+    referer: "https://wolt.com/",
+};
+/**
+ * A failed request.
+ *
+ * The body stays private. Wolt puts meaningful data in its 4xx bodies — the
+ * login escalation token, `error_code` — so the login flow needs to read it,
+ * but those same bodies carry access and refresh tokens. `details()` is the
+ * only way in, and the message never contains any of it.
+ */
+export class WoltError extends Error {
+    status;
+    endpoint;
+    #body;
+    constructor(status, endpoint, body) {
+        const retired = status === 410 ? " (endpoint retired by Wolt)" : "";
+        super(`wolt: request failed (HTTP ${status})${retired} on ${endpoint}`);
+        this.name = "WoltError";
+        this.status = status;
+        this.endpoint = endpoint;
+        this.#body = body;
+    }
+    /** The parsed body, for the branches that must read it. Never logged. */
+    details() {
+        try {
+            return obj(JSON.parse(this.#body));
+        }
+        catch {
+            return {};
+        }
+    }
+}
+export function endpointOf(host, path) {
+    return `${host}${path.split("?")[0]}`;
+}
+/**
+ * An answer's body as an object. A failure keeps its body privately; Wolt
+ * answers 200 with nothing at all on endpoints it has retired.
+ */
+export function answerOf(status, endpoint, text) {
+    if (status >= 400)
+        throw new WoltError(status, endpoint, text);
+    if (!text.trim())
+        throw new Error(`wolt: ${endpoint} returned an empty body (endpoint retired)`);
+    try {
+        return obj(JSON.parse(text));
+    }
+    catch {
+        throw new Error(`wolt: non-JSON response from ${endpoint}`);
+    }
+}
+/** One unsigned request; redirects are refused, as for every other call. */
+export async function http(host, path, opts = {}) {
+    const { method = "GET", body = null, headers = {}, web = true } = opts;
+    const payload = body == null
+        ? null
+        : typeof body === "string"
+            ? body
+            : JSON.stringify(body);
+    const merged = {
+        ...(web ? WEB : {}),
+        accept: "application/json",
+        ...headers,
+    };
+    if (payload && !merged["content-type"])
+        merged["content-type"] = "application/json";
+    const endpoint = endpointOf(host, path);
+    const res = await fetch(`https://${host}${path}`, {
+        method,
+        headers: merged,
+        body: payload,
+        redirect: "error",
+    });
+    const text = await readBounded(res, MAX_RESPONSE_BYTES, `wolt: response exceeded the size limit on ${endpoint}`);
+    return answerOf(res.status, endpoint, text);
+}