runline 0.33.0 → 0.35.0

package/dist/plugins/wolt/src/shared.js

@@ -1,45 +1,26 @@
 import { randomUUID } from "node:crypto";
-import { authedFetch } from "../../_shared/authedFetch.js";
-import { arr, num, numOrNull, obj, pick, readBounded, seg as segment, } from "../../_shared/provider.js";
-import { coordinatedAccessToken } from "../../_shared/tokenRefresh.js";
+import { AuthError } from "runline";
+import { credentialRequest, pathSegment } from "../../_shared/credentials.js";
+import { arr, num, numOrNull, obj, pick } from "../../_shared/provider.js";
+import { CONSUMER, clientHeaders, RESTAURANT, woltCredential, } from "./credentials.js";
+import { answerOf, endpointOf } from "./public.js";
+export { AUTH, CONSUMER, clientHeaders, RESTAURANT, } from "./credentials.js";
+export { http, WoltError } from "./public.js";
 export { arr, num, numOrNull, obj, pick };
 /**
- * Transport and credentials for the Wolt consumer surface.
- *
- * Three hosts, two client personas. Catalogue reads are anonymous and go out as
- * the web app; everything authenticated goes out as the mobile app, because the
- * API only accepts the authed calls from a client that looks like the phone.
+ * The Wolt consumer surface. Catalogue reads are anonymous and go out as
+ * the web app (public.ts); everything authenticated goes out as the mobile
+ * app, signed through the declared credential, because the API only
+ * accepts the authed calls from a client that looks like the phone.
  */
-export const RESTAURANT = "restaurant-api.wolt.com";
-export const CONSUMER = "consumer-api.wolt.com";
-export const AUTH = "authentication.wolt.com";
 export const DEF_LAT = 32.0853;
 export const DEF_LON = 34.7818; // TLV
 export const AUDIENCE = "restaurant-api";
 export const CAPABILITIES = "access_confirmation";
-const MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
 const DEFAULT_TOKEN_TTL_MS = 3_600_000;
-const WEB_UA = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36";
-/** Mobile client headers; the authed endpoints reject anything that is not the app. */
-const MOBILE = {
-    "app-language": "en",
-    "app-locale": "en-US",
-    "client-version": "26.30.4",
-    clientversionnumber: "142026304",
-    platform: "Android",
-    "user-agent": "Wolt/26.30.4; Build/142026304; Android/16; Google sdk_gphone",
-};
-const WEB = {
-    "user-agent": WEB_UA,
-    "accept-language": "en",
-    "app-language": "en",
-    platform: "Web",
-    "client-version": "1.16.125",
-    origin: "https://wolt.com",
-    referer: "https://wolt.com/",
-};
 export const cfgOf = (ctx) => (ctx.connection.config || {});
-export const seg = (value, what) => segment(value, what, "wolt");
+/** A configured or caller-supplied value as one path segment; surrounding whitespace is not part of it. */
+export const seg = (value) => pathSegment(String(value ?? "").trim());
 /**
  * Normalize a phone to E.164 for Wolt, so a number given the local Israeli way
  * still routes. Handles intl "+972…"/"00972…", national "0500000000", and bare
@@ -58,77 +39,6 @@ export function normPhone(input) {
 export const formEncode = (body) => Object.entries(body)
     .map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(String(v ?? ""))}`)
     .join("&");
-/**
- * A failed request.
- *
- * The body stays private. Wolt puts meaningful data in its 4xx bodies — the
- * login escalation token, `error_code` — so the login flow needs to read it,
- * but those same bodies carry access and refresh tokens. `details()` is the
- * only way in, and the message never contains any of it.
- */
-export class WoltError extends Error {
-    status;
-    endpoint;
-    #body;
-    constructor(status, endpoint, body) {
-        const retired = status === 410 ? " (endpoint retired by Wolt)" : "";
-        super(`wolt: request failed (HTTP ${status})${retired} on ${endpoint}`);
-        this.name = "WoltError";
-        this.status = status;
-        this.endpoint = endpoint;
-        this.#body = body;
-    }
-    /** The parsed body, for the branches that must read it. Never logged. */
-    details() {
-        try {
-            return obj(JSON.parse(this.#body));
-        }
-        catch {
-            return {};
-        }
-    }
-}
-function endpointOf(host, path) {
-    return `${host}${path.split("?")[0]}`;
-}
-export async function http(host, path, opts = {}) {
-    const endpoint = endpointOf(host, path);
-    const text = await httpText(host, path, opts);
-    // Wolt answers 200 with nothing at all on endpoints it has retired.
-    if (!text.trim())
-        throw new Error(`wolt: ${endpoint} returned an empty body (endpoint retired)`);
-    try {
-        return obj(JSON.parse(text));
-    }
-    catch {
-        throw new Error(`wolt: non-JSON response from ${endpoint}`);
-    }
-}
-async function httpText(host, path, opts = {}) {
-    const { method = "GET", body = null, headers = {}, web = true } = opts;
-    const payload = body == null
-        ? null
-        : typeof body === "string"
-            ? body
-            : JSON.stringify(body);
-    const merged = {
-        ...(web ? WEB : {}),
-        accept: "application/json",
-        ...headers,
-    };
-    if (payload && !merged["content-type"])
-        merged["content-type"] = "application/json";
-    const endpoint = endpointOf(host, path);
-    const res = await authedFetch(`https://${host}${path}`, {
-        method,
-        headers: merged,
-        body: payload,
-    });
-    const text = await readBounded(res, MAX_RESPONSE_BYTES, `wolt: response exceeded the size limit on ${endpoint}`);
-    if (res.status >= 400)
-        throw new WoltError(res.status, endpoint, text);
-    return text;
-}
 // ---------- identity ----------
 const ravelinDeviceId = () => `rvnand-6-${(randomUUID() + randomUUID()).replace(/-/g, "").toUpperCase().slice(0, 64)}`;
 const hex32 = () => (randomUUID() + randomUUID()).replace(/-/g, "").slice(0, 32);
@@ -151,68 +61,49 @@ export async function ensureIdentity(ctx) {
         await ctx.updateConnection(patch);
     return cfgOf(ctx);
 }
-/** Headers every authenticated or login call carries. */
-export function clientHeaders(cfg) {
-    return {
-        ...MOBILE,
-        "w-wolt-session-id": cfg.woltSessionId ?? randomUUID(),
-        "x-wolt-visitor-id": cfg.visitorId ?? randomUUID(),
-    };
-}
 // ---------- credentials ----------
 export function expiresAt(expiresIn) {
     const seconds = numOrNull(expiresIn);
     return Date.now() + (seconds ? seconds * 1000 : DEFAULT_TOKEN_TTL_MS);
 }
 /**
- * The refresh grant. Called only from inside an update owner and always with
- * explicit values, so it can never re-enter the connection store.
+ * What a failed renewal means to the owner: no stored login, or a refresh
+ * token Wolt no longer honours — both mended by the owner login.
  */
-async function refreshGrant(cfg) {
-    return http(AUTH, "/v1/wauth2/access_token", {
-        method: "POST",
-        web: false,
-        body: formEncode({
-            grant_type: "refresh_token",
-            refresh_token: cfg.refreshToken,
-            device_token: cfg.deviceToken ?? "",
-        }),
-        headers: {
-            ...clientHeaders(cfg),
-            "content-type": "application/x-www-form-urlencoded",
-        },
-    });
-}
-export async function accessToken(ctx, force = false) {
-    const cfg = await ensureIdentity(ctx);
-    if (!cfg.refreshToken)
-        throw new Error("wolt: not connected — run the owner login (account.requestEmailCode / account.requestSmsCode / account.redeemLink)");
-    // Renewal runs under the store's update ownership, so parallel actions
-    // coalesce onto one grant. Wolt rotates the refresh token on every grant, so
-    // a race would persist one the provider has already replaced.
-    return coordinatedAccessToken(ctx, async (current) => {
-        const resp = await refreshGrant(current);
-        const issued = pick(resp.access_token);
-        if (!issued)
-            throw new Error("wolt: token refresh returned no access_token — the refresh token has expired, re-run the owner login");
-        const rotated = pick(resp.refresh_token);
-        return {
-            accessToken: issued,
-            accessTokenExpiresAt: expiresAt(resp.expires_in),
-            ...(rotated ? { refreshToken: rotated } : {}),
-        };
-    }, force);
+function sessionError(error) {
+    if (!(error instanceof AuthError))
+        return error;
+    if (error.code === "invalid_credentials")
+        return new Error("wolt: not connected — run the owner login (account.requestEmailCode / account.requestSmsCode / account.redeemLink)");
+    if (error.code === "reconnect_required" ||
+        (error.code === "provider_rejected" &&
+            (error.status === 400 || error.status === 401)))
+        return new Error("wolt: the refresh token has expired — re-run the owner login");
+    return error;
 }
+/** Wolt's signed APIs, by the target each is declared as. */
+const TARGETS = {
+    [RESTAURANT]: "restaurant",
+    [CONSUMER]: "consumer",
+};
+/** A call as the mobile app, signed with the session's access token and renewed on demand. */
 export async function authed(ctx, host, path, opts = {}) {
-    const token = await accessToken(ctx);
-    const cfg = cfgOf(ctx);
-    return http(host, path, {
-        ...opts,
-        web: false,
-        headers: {
-            ...clientHeaders(cfg),
-            authorization: `Bearer ${token}`,
-            ...(opts.headers ?? {}),
-        },
-    });
+    const target = Object.hasOwn(TARGETS, host) ? TARGETS[host] : undefined;
+    if (!target)
+        throw new AuthError("request_not_allowed");
+    const cfg = await ensureIdentity(ctx);
+    let res;
+    try {
+        res = await credentialRequest(ctx, woltCredential, {
+            target,
+            path: path.replace(/^\//, ""),
+            method: opts.method ?? "GET",
+            headers: clientHeaders(cfg),
+            ...(opts.body == null ? {} : { json: opts.body }),
+        });
+    }
+    catch (error) {
+        throw sessionError(error);
+    }
+    return answerOf(res.status, endpointOf(host, path), await res.text());
 }

package/dist/plugins/woocommerce/src/credentials.js

@@ -0,0 +1,16 @@
+import { httpsBase, staticCredential } from "../../_shared/credentials.js";
+/**
+ * The store's consumer key and secret as a Basic pair, beneath the
+ * connection's own store URL. The store must be HTTPS.
+ */
+export const woocommerceCredential = staticCredential({
+    id: "woocommerce",
+    auth: { kind: "basic" },
+    local: { username: "consumerKey", password: "consumerSecret" },
+    targets: (config) => ({
+        api: {
+            baseUrl: httpsBase(config.url, "wp-json/wc/v3/"),
+            methods: ["GET", "POST", "PUT", "DELETE"],
+        },
+    }),
+});

package/dist/plugins/woocommerce/src/index.js

@@ -1,40 +1,21 @@
-function getConn(ctx) {
-    const c = ctx.connection.config;
-    return {
-        url: c.url.replace(/\/$/, ""),
-        consumerKey: c.consumerKey,
-        consumerSecret: c.consumerSecret,
-    };
-}
-async function apiRequest(conn, method, endpoint, body, qs) {
-    const url = new URL(`${conn.url}/wp-json/wc/v3${endpoint}`);
-    if (qs) {
-        for (const [k, v] of Object.entries(qs)) {
-            if (v !== undefined && v !== null)
-                url.searchParams.set(k, String(v));
-        }
-    }
-    const init = {
+import { credentialJson, pathSegment } from "../../_shared/credentials.js";
+import { woocommerceCredential } from "./credentials.js";
+function apiRequest(ctx, method, path, body, qs) {
+    return credentialJson(ctx, woocommerceCredential, "woocommerce", {
+        target: "api",
+        path,
         method,
-        headers: {
-            Authorization: `Basic ${btoa(`${conn.consumerKey}:${conn.consumerSecret}`)}`,
-            "Content-Type": "application/json",
-        },
-    };
-    if (body && Object.keys(body).length > 0)
-        init.body = JSON.stringify(body);
-    const res = await fetch(url.toString(), init);
-    if (!res.ok)
-        throw new Error(`WooCommerce error ${res.status}: ${await res.text()}`);
-    return res.json();
+        query: qs,
+        ...(body && Object.keys(body).length > 0 ? { json: body } : {}),
+    });
 }
-function registerCrud(rl, resource, plural, conn, createSchema) {
+function registerCrud(rl, resource, plural, createSchema) {
     rl.registerAction(`${resource}.create`, {
         access: "write",
         description: `Create a ${resource}`,
         inputSchema: createSchema,
         async execute(input, ctx) {
-            return apiRequest(conn(ctx), "POST", `/${plural}`, input);
+            return apiRequest(ctx, "POST", plural, input);
         },
     });
     rl.registerAction(`${resource}.get`, {
@@ -42,7 +23,7 @@ function registerCrud(rl, resource, plural, conn, createSchema) {
         description: `Get a ${resource} by ID`,
         inputSchema: { id: { type: "string", required: true } },
         async execute(input, ctx) {
-            return apiRequest(conn(ctx), "GET", `/${plural}/${input.id}`);
+            return apiRequest(ctx, "GET", `${plural}/${pathSegment(input.id)}`);
         },
     });
     rl.registerAction(`${resource}.list`, {
@@ -62,7 +43,7 @@ function registerCrud(rl, resource, plural, conn, createSchema) {
                 qs.search = p.search;
             if (p.status)
                 qs.status = p.status;
-            return apiRequest(conn(ctx), "GET", `/${plural}`, undefined, qs);
+            return apiRequest(ctx, "GET", plural, undefined, qs);
         },
     });
     rl.registerAction(`${resource}.update`, {
@@ -74,7 +55,7 @@ function registerCrud(rl, resource, plural, conn, createSchema) {
         },
         async execute(input, ctx) {
             const p = input;
-            return apiRequest(conn(ctx), "PUT", `/${plural}/${p.id}`, p.data);
+            return apiRequest(ctx, "PUT", `${plural}/${pathSegment(p.id)}`, p.data);
         },
     });
     rl.registerAction(`${resource}.delete`, {
@@ -82,13 +63,14 @@ function registerCrud(rl, resource, plural, conn, createSchema) {
         description: `Delete a ${resource}`,
         inputSchema: { id: { type: "string", required: true } },
         async execute(input, ctx) {
-            return apiRequest(conn(ctx), "DELETE", `/${plural}/${input.id}`, undefined, { force: "true" });
+            return apiRequest(ctx, "DELETE", `${plural}/${pathSegment(input.id)}`, undefined, { force: "true" });
         },
     });
 }
 export default function woocommerce(rl) {
     rl.setName("woocommerce");
     rl.setVersion("0.1.0");
+    rl.setCredential(woocommerceCredential);
     rl.setConnectionSchema({
         url: {
             type: "string",
@@ -109,7 +91,7 @@ export default function woocommerce(rl) {
             env: "WOOCOMMERCE_CONSUMER_SECRET",
         },
     });
-    registerCrud(rl, "product", "products", getConn, {
+    registerCrud(rl, "product", "products", {
         name: { type: "string", required: true },
         type: {
             type: "string",
@@ -120,7 +102,7 @@ export default function woocommerce(rl) {
         description: { type: "string", required: false },
         sku: { type: "string", required: false },
     });
-    registerCrud(rl, "order", "orders", getConn, {
+    registerCrud(rl, "order", "orders", {
         status: {
             type: "string",
             required: false,
@@ -134,7 +116,7 @@ export default function woocommerce(rl) {
         },
         payment_method: { type: "string", required: false },
     });
-    registerCrud(rl, "customer", "customers", getConn, {
+    registerCrud(rl, "customer", "customers", {
         email: { type: "string", required: true },
         first_name: { type: "string", required: false },
         last_name: { type: "string", required: false },

package/dist/plugins/wordpress/src/credentials.js

@@ -0,0 +1,16 @@
+import { httpsBase, staticCredential } from "../../_shared/credentials.js";
+/**
+ * A user's application password as the Basic pair, on the connection's own
+ * site beneath /wp-json/wp/v2/.
+ */
+export const wordpressCredential = staticCredential({
+    id: "wordpress",
+    auth: { kind: "basic" },
+    local: { username: "username", password: "password" },
+    targets: (config) => ({
+        api: {
+            baseUrl: httpsBase(config.url, "wp-json/wp/v2/"),
+            methods: ["GET", "POST", "DELETE"],
+        },
+    }),
+});

package/dist/plugins/wordpress/src/index.js

@@ -1,35 +1,15 @@
-function getConn(ctx) {
-    const c = ctx.connection.config;
-    return {
-        url: c.url.replace(/\/$/, ""),
-        username: c.username,
-        password: c.password,
-    };
-}
-async function apiRequest(conn, method, endpoint, body, qs) {
-    const url = new URL(`${conn.url}/wp-json/wp/v2${endpoint}`);
-    if (qs) {
-        for (const [k, v] of Object.entries(qs)) {
-            if (v !== undefined && v !== null)
-                url.searchParams.set(k, String(v));
-        }
-    }
-    const init = {
+import { credentialJson, pathSegment } from "../../_shared/credentials.js";
+import { wordpressCredential } from "./credentials.js";
+async function apiRequest(ctx, method, path, body, qs) {
+    return credentialJson(ctx, wordpressCredential, "wordpress", {
+        target: "api",
+        path,
         method,
-        headers: {
-            Authorization: `Basic ${btoa(`${conn.username}:${conn.password}`)}`,
-            "Content-Type": "application/json",
-            Accept: "application/json",
-        },
-    };
-    if (body && Object.keys(body).length > 0)
-        init.body = JSON.stringify(body);
-    const res = await fetch(url.toString(), init);
-    if (!res.ok)
-        throw new Error(`WordPress error ${res.status}: ${await res.text()}`);
-    return res.json();
+        query: qs,
+        ...(body && Object.keys(body).length > 0 ? { json: body } : {}),
+    });
 }
-function registerContentCrud(rl, resource, plural, conn) {
+function registerContentCrud(rl, resource, plural) {
     rl.registerAction(`${resource}.create`, {
         access: "write",
         description: `Create a ${resource}`,
@@ -44,7 +24,7 @@ function registerContentCrud(rl, resource, plural, conn) {
             slug: { type: "string", required: false },
         },
         async execute(input, ctx) {
-            return apiRequest(conn(ctx), "POST", `/${plural}`, input);
+            return apiRequest(ctx, "POST", plural, input);
         },
     });
     rl.registerAction(`${resource}.get`, {
@@ -52,7 +32,7 @@ function registerContentCrud(rl, resource, plural, conn) {
         description: `Get a ${resource} by ID`,
         inputSchema: { id: { type: "string", required: true } },
         async execute(input, ctx) {
-            return apiRequest(conn(ctx), "GET", `/${plural}/${input.id}`);
+            return apiRequest(ctx, "GET", `${plural}/${pathSegment(input.id)}`);
         },
     });
     rl.registerAction(`${resource}.list`, {
@@ -75,7 +55,7 @@ function registerContentCrud(rl, resource, plural, conn) {
                 qs.status = p.status;
             if (p.orderby)
                 qs.orderby = p.orderby;
-            return apiRequest(conn(ctx), "GET", `/${plural}`, undefined, qs);
+            return apiRequest(ctx, "GET", plural, undefined, qs);
         },
     });
     rl.registerAction(`${resource}.update`, {
@@ -90,7 +70,7 @@ function registerContentCrud(rl, resource, plural, conn) {
         },
         async execute(input, ctx) {
             const { id, ...fields } = input;
-            return apiRequest(conn(ctx), "POST", `/${plural}/${id}`, fields);
+            return apiRequest(ctx, "POST", `${plural}/${pathSegment(id)}`, fields);
         },
     });
     rl.registerAction(`${resource}.delete`, {
@@ -105,13 +85,14 @@ function registerContentCrud(rl, resource, plural, conn) {
             const qs = {};
             if (p.force)
                 qs.force = "true";
-            return apiRequest(conn(ctx), "DELETE", `/${plural}/${p.id}`, undefined, qs);
+            return apiRequest(ctx, "DELETE", `${plural}/${pathSegment(p.id)}`, undefined, qs);
         },
     });
 }
 export default function wordpress(rl) {
     rl.setName("wordpress");
     rl.setVersion("0.1.0");
+    rl.setCredential(wordpressCredential);
     rl.setConnectionSchema({
         url: {
             type: "string",
@@ -132,8 +113,8 @@ export default function wordpress(rl) {
             env: "WORDPRESS_PASSWORD",
         },
     });
-    registerContentCrud(rl, "post", "posts", getConn);
-    registerContentCrud(rl, "page", "pages", getConn);
+    registerContentCrud(rl, "post", "posts");
+    registerContentCrud(rl, "page", "pages");
     // ── User ────────────────────────────────────────────
     rl.registerAction("user.create", {
         access: "write",
@@ -145,7 +126,7 @@ export default function wordpress(rl) {
             name: { type: "string", required: false },
         },
         async execute(input, ctx) {
-            return apiRequest(getConn(ctx), "POST", "/users", input);
+            return apiRequest(ctx, "POST", "users", input);
         },
     });
     rl.registerAction("user.get", {
@@ -153,7 +134,7 @@ export default function wordpress(rl) {
         description: "Get a user by ID",
         inputSchema: { id: { type: "string", required: true } },
         async execute(input, ctx) {
-            return apiRequest(getConn(ctx), "GET", `/users/${input.id}`);
+            return apiRequest(ctx, "GET", `users/${pathSegment(input.id)}`);
         },
     });
     rl.registerAction("user.list", {
@@ -170,7 +151,7 @@ export default function wordpress(rl) {
                 qs.per_page = p.limit;
             if (p.search)
                 qs.search = p.search;
-            return apiRequest(getConn(ctx), "GET", "/users", undefined, qs);
+            return apiRequest(ctx, "GET", "users", undefined, qs);
         },
     });
     rl.registerAction("user.update", {
@@ -184,7 +165,7 @@ export default function wordpress(rl) {
         },
         async execute(input, ctx) {
             const { id, ...fields } = input;
-            return apiRequest(getConn(ctx), "POST", `/users/${id}`, fields);
+            return apiRequest(ctx, "POST", `users/${pathSegment(id)}`, fields);
         },
     });
     rl.registerAction("user.delete", {
@@ -198,7 +179,7 @@ export default function wordpress(rl) {
             },
         },
         async execute(input, ctx) {
-            return apiRequest(getConn(ctx), "DELETE", "/users/me", undefined, {
+            return apiRequest(ctx, "DELETE", "users/me", undefined, {
                 reassign: input.reassign,
                 force: "true",
             });

package/dist/plugins/xai/src/credentials.js

@@ -0,0 +1,13 @@
+import { staticCredential } from "../../_shared/credentials.js";
+/** An API key, sent as a bearer to xAI's one API origin. */
+export const xaiCredential = staticCredential({
+    id: "xai",
+    auth: { kind: "bearer" },
+    local: { secret: "apiKey" },
+    targets: {
+        api: {
+            baseUrl: "https://api.x.ai/v1/",
+            methods: ["POST"],
+        },
+    },
+});