scripter-x 1.0.24 → 1.0.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scripter-x",
-  "version": "1.0.24",
+  "version": "1.0.25",
   "description": "ScripterX — local Flipkart session extractor (runs on your residential IP, syncs to marthunt)",
   "type": "module",
   "bin": {

package/src/flipkart.js

@@ -85,6 +85,7 @@ export class FlipkartLogin {
     this.reqId = null;
     this.sn = '';
     this.vid = '';
+    this.isNewUser = false; // set by sendOtp: new number → verify as SIGNUP, not LOGIN
   }
 
   async sendOtp(mobile) {
@@ -117,37 +118,78 @@ export class FlipkartLogin {
     // no requestId on a 200 = soft anti-bot throttle — also retryable (often clears on retry).
     if (!rid) throw new TransientError('blocked while sending OTP (no requestId — throttled)');
     this.reqId = rid;
+    // NEW vs EXISTING account: for an UNREGISTERED number FK still sends the OTP but
+    // routes the flow to signup. The reliable signals (verified against captures):
+    //   • landingPageAction.url starts with "/signup"  (existing accounts: no such url)
+    //   • eVar79 tracking is "New|…|Sign-Up|…"          (existing: "Existing|…|Sign-In|…")
+    // NOTE: a bare "isNewUser":true appears even for EXISTING accounts (unrelated page
+    // flag) — do NOT use it. verifyOtp uses type:SIGNUP when isNewUser, else LOGIN.
+    const landingUrl = data?.RESPONSE?.actionResponseContext?.landingPageAction?.url || '';
+    const eVar79 = data?.RESPONSE?.pageResponse?.pageData?.trackingContext?.tracking?.eVar79 || '';
+    this.isNewUser = /^\/signup\b/.test(landingUrl)
+      || /\bSign-?Up\b/i.test(eVar79)
+      || /^New\b/i.test(eVar79);
     this.sn = this.jar.SN || '';
     this.vid = this.sn ? this.sn.split('.')[0] : '';
     return rid;
   }
 
-  async verifyOtp(mobile, otp) {
+  // Low-level OTP verify with an explicit action type ("LOGIN" for existing
+  // accounts, "SIGNUP" for brand-new numbers). Returns { res, text, data }.
+  async _verifyWith(type, mobile, otp) {
     await throttle.wait();
     const secureToken = this.vid ? `${this.vid}:${this.vid}` : '';
     const body = { actionRequestContext: {
-      type: 'LOGIN', loginIdPrefix: '+91', loginId: mobile.slice(-10), password: null,
+      type, loginIdPrefix: '+91', loginId: mobile.slice(-10), password: null,
       otp, otpRequestId: this.reqId, remainingAttempts: 5, phoneNumberFormat: 'E164',
-      loginType: 'MOBILE', verificationType: 'OTP', sourceContext: 'GO_LOGIN', churned: false,
-      otpRegex: null, data: null, clientQueryParamMap: null } };
+      loginType: 'MOBILE', verificationType: 'OTP', sourceContext: type === 'SIGNUP' ? 'DEFAULT' : 'GO_LOGIN',
+      churned: false, otpRegex: null, data: null, clientQueryParamMap: null } };
     const res = await fetch(`${NATIVE_HOST}/1/action/view`, {
       method: 'POST', body: JSON.stringify(body),
       headers: {
         'User-Agent': 'okhttp/4.9.2', 'X-User-Agent': nativeUa(this.vid),
         'Content-Type': 'application/json; charset=UTF-8',
-        'x-request-metaInfo': '{"actionType":"LOGIN","pageUri":"questContext"}',
+        'x-request-metaInfo': `{"actionType":"${type}","pageUri":"questContext"}`,
         at: this.jar.at || '', sn: this.sn, secureToken, secureCookie: this.jar.S || '',
         Cookie: cookieHeader(this.jar),
       },
     });
     const text = await res.text();
+    let data = null;
+    try { data = JSON.parse(text); } catch { /* caller handles */ }
+    return { res, text, data };
+  }
+
+  async verifyOtp(mobile, otp) {
+    // New number → SIGNUP (FK rejects LOGIN with "account does not exist"); existing → LOGIN.
+    const primary = this.isNewUser ? 'SIGNUP' : 'LOGIN';
+    const fallback = this.isNewUser ? 'LOGIN' : 'SIGNUP';
+
+    let { res, text, data } = await this._verifyWith(primary, mobile, otp);
     // 529/5xx = Flipkart overloaded / soft-blocking this IP — NOT the OTP's fault.
     if (res.status === 429 || res.status === 529 || res.status >= 500) {
       throw new TransientError(`Flipkart busy (HTTP ${res.status}) — will retry`);
     }
-    let data;
-    try { data = JSON.parse(text); } catch { throw new TransientError('Flipkart returned a non-JSON response — will retry'); }
-    const env = data.SESSION;
+    if (!data) throw new TransientError('Flipkart returned a non-JSON response — will retry');
+
+    let env = data.SESSION;
+    // If the primary type didn't log in AND the failure looks like a wrong account-type
+    // (not a wrong OTP), retry once with the other type. This auto-creates a new account
+    // when a number we thought existed doesn't (and vice-versa) — same OTP, no extra SMS.
+    if ((!env || !env.isLoggedIn)) {
+      const fkMsg0 = flipkartErrorMessage(data, text);
+      const low0 = (fkMsg0 + ' ' + text).toLowerCase();
+      const wrongType = /does not exist|not registered|no account|sign\s*up|signup|already (registered|exists)|please login/.test(low0);
+      const wrongOtp = /incorrect|wrong|invalid|expired|otp.*not.*match|verification code/.test(low0);
+      if (wrongType && !wrongOtp) {
+        const r2 = await this._verifyWith(fallback, mobile, otp);
+        if (r2.data && r2.data.SESSION && r2.data.SESSION.isLoggedIn) {
+          ({ res, text, data } = r2);
+          env = data.SESSION;
+        }
+      }
+    }
+
     if (!env || !env.isLoggedIn) {
       // pull Flipkart's own human message if present (the real reason)
       const fkMsg = flipkartErrorMessage(data, text);