universal-parcel-scraper 0.3.1-main.311 → 0.3.1-main.313

package/dist/carriers/amazon-shipping/adapter.js

@@ -181,7 +181,7 @@ export function parseAmazonShippingTrackingResponse(payload, zone = 'Europe/Pari
     const identitySummary = isRecord(progress.summary) ? progress.summary : {};
     const identityMetadata = isRecord(identitySummary.metadata) ? identitySummary.metadata : {};
     for (const identity of [payload.trackingId, payload.trackingID, progress.trackingId, metadataValue(identityMetadata, 'trackingId')]) {
-        if (trackingNumber && identity != null && String(identity).toUpperCase() !== trackingNumber) {
+        if (trackingNumber && identity != null && (typeof identity !== 'string' || identity.toUpperCase() !== trackingNumber)) {
             throw new SchemaError(PROVIDER, 'Amazon Shipping returned a different tracking number');
         }
     }

package/dist/carriers/ciblex/parser.js

@@ -33,7 +33,7 @@ function safeLocation(raw) {
     const value = clean(raw, 100);
     // Free-form places can contain the recipient address. Retain only the
     // established operational-depot label with a repeated department code.
-    return /^([\p{Letter}\p{Mark} .'\/-]{1,70}) (\d{2,3}) \(\2\)$/u.test(value) ? value : '';
+    return /^([\p{Letter}\p{Mark} .'/-]{1,70}) (\d{2,3}) \(\2\)$/u.test(value) ? value : '';
 }
 export function parseCiblexTrackingHtml(html, raw) {
     const number = normalizeCiblexTrackingNumber(raw);

package/dist/carriers/correos-spain/adapter.js

@@ -58,7 +58,8 @@ export function parseCorreosSpainTrackingResponse(payload, trackingNumber) {
     if (returned !== requested)
         throw new SchemaError('Correos', 'Correos returned a different shipment');
     const error = envelope.error;
-    if (!isRecord(error) || error.codError == null) {
+    if (!isRecord(error) || (typeof error.codError !== 'string'
+        && (typeof error.codError !== 'number' || !Number.isFinite(error.codError)))) {
         throw new SchemaError('Correos', 'Correos returned a response without a result envelope');
     }
     // Any non-zero codError (e.g. "3" Sin Trazabilidad) means unknown or

package/dist/carriers/ctt/adapter.js

@@ -2,7 +2,7 @@ import { lookupBudget } from '../../core/adapter/index.js';
 import { IndeterminateError, InvalidInputError, MaintenanceError, NotFoundError, SchemaError } from '../../core/errors/index.js';
 import { isValidS10TrackingNumber } from '../../core/detection/index.js';
 import { explicitOffsetTime } from '../../core/time/index.js';
-import { clean, decodeText, escapeRegExp, fetchBounded, parseJsonBytes, UpstreamHttpError, } from '../../core/transport/index.js';
+import { clean, decodeText, escapeRegExp, fetchBounded, parseJsonBytes, } from '../../core/transport/index.js';
 import { isRecord } from '../../core/types.js';
 import { classifyCttStatus } from './status.js';
 // Protocol provenance:
@@ -17,8 +17,7 @@ import { classifyCttStatus } from './status.js';
 //   rotates on every frontend deploy (derived at runtime from keyless version
 //   endpoints and the screen bundle — never pinned). A browser User-Agent is
 //   mandatory (Cloudflare error 1010 otherwise).
-// - Live verification 2026-09-10, including a delivered parcel whose whole
-//   history mapped: Found:true carries ObjectEventsFromQuery; Found:false is
+// - Found:true carries ObjectEventsFromQuery; Found:false is
 //   BOTH genuine unknown and backend outage, told apart only via the sibling
 //   DataActionCheckIPLocked call (made solely on Found:false — a found parcel
 //   already proves health).
@@ -178,7 +177,10 @@ export class CttTracker {
             IPClient: '',
         }, null, true, true, budget);
         const record = isRecord(payload.data) ? payload.data.ObjectEventsFromQuery : undefined;
-        if (!isRecord(record) || !record.Found) {
+        if (!isRecord(record) || typeof record.Found !== 'boolean') {
+            throw new CttApiError('missing shipment Found flag');
+        }
+        if (!record.Found) {
             // Found:false is both genuine unknown and backend outage: a found parcel
             // already proves health, so the sibling check runs solely on negatives.
             if (await this.isMaintenance(budget))
@@ -190,6 +192,8 @@ export class CttTracker {
     async isMaintenance(budget) {
         const payload = await this.callAction(MAINTENANCE_ACTION, {}, null, true, true, budget);
         const data = isRecord(payload.data) ? payload.data : {};
+        if (typeof data.IsMaintenance !== 'boolean')
+            throw new CttApiError('missing maintenance flag');
         return data.IsMaintenance === true;
     }
     async callAction(action, variables, session, retrySession, retryVersion, budget) {
@@ -217,7 +221,7 @@ export class CttTracker {
             timeoutMs: Math.min(this.timeoutMs, budget.remainingMs()),
             maxBytes: MAX_RESPONSE_BYTES,
             retryTransient: true,
-            allowHttpError: true,
+            allowHttpStatuses: [403],
             fetcher: this.fetcher,
         });
         if (response.status === 403) {
@@ -227,8 +231,6 @@ export class CttTracker {
             }
             throw new CttApiError('anonymous session bootstrap failed');
         }
-        if (!response.ok)
-            throw new UpstreamHttpError('CTT tracking', response.status);
         const payload = parseJsonBytes(bytes, 'CTT tracking');
         if (!isRecord(payload))
             throw new CttApiError('unexpected body (not a JSON object)');
@@ -256,7 +258,7 @@ export class CttTracker {
     async ensureModuleVersion(budget) {
         if (this.moduleVersion !== null)
             return;
-        const { response, bytes } = await fetchBounded(MODULE_VERSION_URL, {
+        const { bytes } = await fetchBounded(MODULE_VERSION_URL, {
             signal: budget.signal,
             headers: { Accept: 'application/json', 'User-Agent': BROWSER_USER_AGENT },
         }, {
@@ -264,11 +266,8 @@ export class CttTracker {
             timeoutMs: Math.min(this.timeoutMs, budget.remainingMs()),
             maxBytes: MAX_RESPONSE_BYTES,
             retryTransient: true,
-            allowHttpError: true,
             fetcher: this.fetcher,
         });
-        if (!response.ok)
-            throw new UpstreamHttpError('CTT tracking', response.status);
         const payload = parseJsonBytes(bytes, 'CTT tracking');
         const token = isRecord(payload) && typeof payload.versionToken === 'string' ? payload.versionToken : '';
         if (!token)
@@ -297,7 +296,7 @@ export class CttTracker {
         return parseJsonBytes((await this.fetchBytes(url, budget)).bytes, 'CTT tracking');
     }
     async fetchBytes(url, budget) {
-        const { response, bytes } = await fetchBounded(url, {
+        const { bytes } = await fetchBounded(url, {
             signal: budget.signal,
             headers: { Accept: 'application/json, text/plain, */*', 'User-Agent': BROWSER_USER_AGENT },
         }, {
@@ -305,11 +304,8 @@ export class CttTracker {
             timeoutMs: Math.min(this.timeoutMs, budget.remainingMs()),
             maxBytes: MAX_SCRIPT_BYTES,
             retryTransient: true,
-            allowHttpError: true,
             fetcher: this.fetcher,
         });
-        if (!response.ok)
-            throw new UpstreamHttpError('CTT tracking', response.status);
         return { bytes };
     }
 }

package/dist/carriers/ctt-express/parser.js

@@ -49,9 +49,10 @@ export function parseCttExpress(payload, number) {
     if (history.item_code !== `${requested}001`)
         throw new SchemaError('CTT Express', 'CTT Express returned a different package');
     const events = [];
+    const rows = history.events;
     // Newest provider positions win equal-clock ties. Preserve duplicates until
     // their chronological leg is known so an earlier return start is not lost.
-    for (const row of [...history.events].reverse()) {
+    for (const row of [...rows].reverse()) {
         if (!isRecord(row) || row.type !== 'STATUS' || !['ITEM_STATUS_V2', 'ITEM_STATUS_CHANGE_V1'].includes(clean(row.source, 64))) {
             throw new SchemaError('CTT Express', 'CTT Express returned an unsupported scan source');
         }

package/dist/carriers/dachser/adapter.js

@@ -3,7 +3,7 @@ export { validateDachserTrackingUrl } from '../../core/catalog/urls.js';
 import { DateTime } from 'luxon';
 import { lookupBudget } from '../../core/adapter/index.js';
 import { InputRequiredError, InvalidInputError, NotFoundError, SchemaError, UpstreamHttpError } from '../../core/errors/index.js';
-import { fetchBounded, parseJsonBytes, userAgentOf } from '../../core/transport/index.js';
+import { cleanScalar, fetchBounded, parseJsonBytes, userAgentOf } from '../../core/transport/index.js';
 import { isRecord } from '../../core/types.js';
 import { eventLabel, plainText, shipmentStatus } from './status.js';
 const DACHSER_HOST = 'customeriberia.dachser.com';
@@ -20,7 +20,7 @@ const DATE_FORMATS = [
     'yyyy-MM-dd',
 ];
 function normalizeTrackingNumber(raw) {
-    return String(raw ?? '').replace(/[\s.-]/g, '').toUpperCase();
+    return cleanScalar(raw, 64).replace(/[\s.-]/g, '').toUpperCase();
 }
 /**
  * Validate and canonicalize a pasted Dachser capability URL.
@@ -51,7 +51,7 @@ export function dachserApiUrl(trackingUrl, trackingNumber) {
  * that do carry an offset keep it; everything else is read in Europe/Madrid.
  */
 function parseDateTime(raw) {
-    const value = String(raw ?? '').trim();
+    const value = typeof raw === 'string' ? raw.trim() : '';
     if (!value)
         return null;
     let parsed = DateTime.fromISO(value, { zone: 'Europe/Madrid', setZone: true });

package/dist/carriers/dachser/status.js

@@ -1,6 +1,6 @@
 /** Lower-cased, accent-free text, for language-independent matching. */
 export function plainText(raw) {
-    return String(raw ?? '')
+    return (typeof raw === 'string' ? raw : '')
         .toLocaleLowerCase()
         .normalize('NFKD')
         .replace(/\p{M}/gu, '');

package/dist/carriers/dhl-ecommerce/status.js

@@ -34,7 +34,7 @@ export function stageFor(event) {
     // A terminal provider code outranks an intuitive translated label.
     if (event.statusCode === 'delivered')
         return 'delivered';
-    const translated = trackingLanguageStage(String(event.description ?? ''));
+    const translated = trackingLanguageStage(typeof event.description === 'string' ? event.description : '');
     if (translated)
         return translated;
     switch (event.statusCode) {

package/dist/carriers/dpd/adapter.js

@@ -442,7 +442,7 @@ export function parseDPDTrackingHtml(html, trackingNumber) {
     };
 }
 function durationSeconds(value, fallback) {
-    const match = /^(\d+)s?$/.exec(String(value ?? ''));
+    const match = /^(\d+)s?$/.exec(typeof value === 'string' || typeof value === 'number' ? String(value) : '');
     return match ? Number(match[1]) : fallback;
 }
 /** `shared`, for as long as the lookup waiting on it is live: its own signal ends the wait, not the shared work. */

package/dist/carriers/estafeta/parser.js

@@ -50,7 +50,7 @@ export function parseEstafetaLookup(html, rawNumber) {
         throw new SchemaError('Estafeta', 'Estafeta returned a different history target');
     const state = cards.find('.stateDescription.fontColorCurrentProcess');
     const messages = cards.find('.fontColorCurrentProcessMessage');
-    const parts = messages.contents().filter((_, node) => node.type === 'text').map((_, node) => clean($(node).text(), 100)).get().filter(Boolean);
+    const parts = messages.contents().filter((_, node) => node.nodeType === 3).map((_, node) => clean($(node).text(), 100)).get().filter(Boolean);
     if (state.length !== 1 || messages.length !== 1 || parts.length < 2)
         throw new SchemaError('Estafeta', 'Estafeta returned incomplete latest activity');
     return { number, guide, state: clean(state.text(), 200), latestClock: parts[0], latestDate: parts[1] };

package/dist/carriers/fedex/adapter.js

@@ -279,7 +279,8 @@ export class FedExTracker {
                     throw error;
                 // An unreadable or unrelated reply; the rendered page may still name a challenge.
                 captureError ??= error instanceof SyntaxError
-                    ? new SchemaError('FedEx', 'FedEx returned unreadable tracking JSON', { cause: error }) : error;
+                    ? new SchemaError('FedEx', 'FedEx returned unreadable tracking JSON', { cause: error })
+                    : error instanceof Error ? error : new SchemaError('FedEx', 'FedEx returned invalid tracking data', { cause: error });
             }
         }
         if (parseFedExTrackingHtml(page.html) === 'challenged') {

package/dist/carriers/gls-de/adapter.js

@@ -1,6 +1,6 @@
 import { lookupBudget } from '../../core/adapter/index.js';
 import { NotFoundError, SchemaError, UpstreamHttpError } from '../../core/errors/index.js';
-import { fetchBounded, parseJsonBytes } from '../../core/transport/index.js';
+import { cleanScalar, fetchBounded, parseJsonBytes } from '../../core/transport/index.js';
 import { isRecord } from '../../core/types.js';
 import { glsSwitzerlandDetailApiUrl, glsDeliveryReference, glsSwitzerlandOverviewApiUrl, GLSSwitzerlandTrackingError, normalizeGLSSwitzerlandPostcode, normalizeGLSSwitzerlandTrackingNumber, parseGLSSwitzerlandTrackingResponse, selectGLSParcel, } from '../gls-ch/adapter.js';
 // GLS's GROUP recipient service covers German and Swiss parcels. Keep the
@@ -53,7 +53,7 @@ export class GLSGermanyTracker {
         }
         const owners = Array.isArray(parcel.owners) ? parcel.owners.filter(isRecord) : [];
         const owner = owners.find((row) => row.type === 'REQUEST');
-        const detail = await this.request(glsSwitzerlandDetailApiUrl(String(parcel.tuNo), postcode, this.now(), String(owner?.code ?? ''), '4,5'), budget);
+        const detail = await this.request(glsSwitzerlandDetailApiUrl(String(parcel.tuNo), postcode, this.now(), cleanScalar(owner?.code, 64), '4,5'), budget);
         try {
             const result = parseGLSSwitzerlandTrackingResponse(detail, String(parcel.tuNo));
             // Both services use CET/CEST; expose the regional timezone to clients.

package/dist/carriers/heppner/adapter.js

@@ -80,7 +80,7 @@ export function parseHeppnerCapability(rawCapability, rawTrackingNumber, rawPost
         || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(capability)) {
         throw new SchemaError('Heppner', 'Heppner returned an invalid tracking capability');
     }
-    let decoded = '';
+    let decoded;
     try {
         decoded = Buffer.from(capability, 'base64').toString('utf8');
     }

package/dist/carriers/hermes/adapter.js

@@ -1,6 +1,6 @@
 import { lookupBudget } from '../../core/adapter/index.js';
 import { NotFoundError, SchemaError } from '../../core/errors/index.js';
-import { fetchBounded, parseJsonBytes, userAgentOf } from '../../core/transport/index.js';
+import { cleanScalar, fetchBounded, parseJsonBytes, userAgentOf } from '../../core/transport/index.js';
 import { isRecord } from '../../core/types.js';
 import { hermesEventStage, hermesStatus } from './status.js';
 export { hermesStatus };
@@ -11,7 +11,7 @@ const HERMES_API = 'https://myhes.de/api/request/auftragsdaten';
 const PROVIDER = 'Hermes';
 const DEFAULT_TIMEOUT_MS = 15_000;
 function normalizeHermesTrackingNumber(raw) {
-    return String(raw ?? '').replace(/[\s.-]/g, '').toUpperCase();
+    return cleanScalar(raw, 64).replace(/[\s.-]/g, '').toUpperCase();
 }
 export function parseHermesTrackingResponse(payload, trackingNumber) {
     if (!isRecord(payload))
@@ -43,19 +43,24 @@ export function parseHermesTrackingResponse(payload, trackingNumber) {
         && order.auftragsart == null
         && order.statusjourneyDto == null)
         throw new NotFoundError(PROVIDER);
-    const meaningfulEvents = rawEvents.filter((event) => (String(event.sendungsstatus ?? '').trim()
-        && String(event.sendungsstatusBuchungszeitpunkt ?? '').trim()));
-    meaningfulEvents.sort((left, right) => String(right.sendungsstatusBuchungszeitpunkt ?? '')
-        .localeCompare(String(left.sendungsstatusBuchungszeitpunkt ?? '')));
+    const meaningfulEvents = rawEvents.flatMap((event) => {
+        const description = event.sendungsstatus;
+        const time = event.sendungsstatusBuchungszeitpunkt;
+        if ((description != null && typeof description !== 'string') || (time != null && typeof time !== 'string')) {
+            throw new SchemaError(PROVIDER, 'Hermes returned invalid tracking history');
+        }
+        return description?.trim() && time?.trim() ? [{ description, time, statusId: event.sendungsstatusId }] : [];
+    });
+    meaningfulEvents.sort((left, right) => right.time.localeCompare(left.time));
     const events = meaningfulEvents.map((event) => ({
-        time: String(event.sendungsstatusBuchungszeitpunkt ?? ''),
+        time: event.time,
         location: '',
-        description: String(event.sendungsstatus),
-        stage: hermesEventStage(event.sendungsstatusId, event.sendungsstatus),
+        description: event.description,
+        stage: hermesEventStage(event.statusId, event.description),
     }));
     return {
         status: meaningfulEvents[0]
-            ? hermesStatus(meaningfulEvents[0].sendungsstatusId, meaningfulEvents[0].sendungsstatus)
+            ? hermesStatus(meaningfulEvents[0].statusId, meaningfulEvents[0].description)
             : 'pending',
         last_status_text: events[0]?.description ?? '',
         last_update: events[0]?.time || null,

package/dist/carriers/hermes/status.js

@@ -25,7 +25,7 @@ export const HERMES_STATUS = new Map([
     [430, 'out_for_delivery'],
 ]);
 function normalizedText(raw) {
-    return String(raw ?? '').toLocaleLowerCase('de-DE').normalize('NFKD').replace(/\p{M}/gu, '');
+    return (typeof raw === 'string' ? raw : '').toLocaleLowerCase('de-DE').normalize('NFKD').replace(/\p{M}/gu, '');
 }
 export function hermesStatus(rawStatusId, rawDescription = '') {
     if (!['string', 'number'].includes(typeof rawStatusId))

package/dist/carriers/hermes-de/adapter.js

@@ -42,7 +42,7 @@ export function normalizeHermesGermanyNumber(raw) {
 }
 export function parseHermesGermanyResponse(payload, trackingNumber) {
     const requested = normalizeHermesGermanyNumber(trackingNumber);
-    if (!Array.isArray(payload) || payload.some((entry) => !isRecord(entry))) {
+    if (!Array.isArray(payload) || !payload.every(isRecord)) {
         throw new SchemaError(CARRIER, 'Hermes Germany returned an invalid tracking response');
     }
     if (!payload.length)

package/dist/carriers/india-post/adapter.js

@@ -417,7 +417,7 @@ export class IndiaPostTracker {
         const initial = initialTrackComponent(page.html, normalized);
         if (initial.status === 'Completed') {
             const cached = parseIndiaPostTrackingHtml(page.html, normalized);
-            const syncedAt = Date.parse(String(cached.source_synced_at ?? ''));
+            const syncedAt = typeof cached.source_synced_at === 'string' ? Date.parse(cached.source_synced_at) : NaN;
             if (Number.isFinite(syncedAt) && this.now().getTime() - syncedAt < REFRESH_AFTER_MS)
                 return cached;
             // What the page's Refresh button sends. A failed refresh still leaves

package/dist/carriers/inpost/adapter.js

@@ -1,7 +1,7 @@
 import { accepted, lookupBudget, recognizeFromLookup } from '../../core/adapter/index.js';
-import { InvalidInputError, NotFoundError, SchemaError } from '../../core/errors/index.js';
+import { IndeterminateError, InvalidInputError, NotFoundError, SchemaError } from '../../core/errors/index.js';
 import { explicitOffsetTime } from '../../core/time/index.js';
-import { clean, fetchBounded, parseJsonBytes, UpstreamHttpError, userAgentOf } from '../../core/transport/index.js';
+import { clean, fetchBounded, parseJsonBytes, userAgentOf } from '../../core/transport/index.js';
 import { isRecord } from '../../core/types.js';
 import { classifyInpostStatus } from './status.js';
 // Protocol provenance:
@@ -12,12 +12,9 @@ import { classifyInpostStatus } from './status.js';
 //   (api-shipx-pl.easypack24.net, keyless, but its success shape is
 //   unconfirmed) and the inposteasy.com per-country hubs below. Only the
 //   inposteasy hub is implemented here; ShipX remains a future lead.
-// - Live verification 2026-09-10: GET
-//   https://inposteasy.com/api/tracking/000000000000000000000000 returns
-//   HTTP 404 with a structured NOT_FOUND problem body in ~0.2s, no cookies,
-//   headers or account. Long-expired corpus numbers return the same 404.
-// - Public cross-border status vocabulary live-confirmed on IT/PT/GB
-//   consignments 2026-08-31 by the prior-art client; the map lives in status.ts.
+// - Unknown or expired numbers return an identity-bound NOT_FOUND problem,
+//   optionally JSON-encoded inside the tracking-error wrapper's detail field.
+// - The public cross-border status vocabulary lives in status.ts.
 const TRACKING_ENDPOINT = 'https://inposteasy.com/api/tracking';
 const DEFAULT_TIMEOUT_MS = 15_000;
 /** The pause `fetchBounded` takes before its one retry of a failed request. */
@@ -34,6 +31,23 @@ export function normalizeInpostTrackingNumber(raw) {
     }
     return value;
 }
+function isNotFoundProblem(payload, trackingNumber) {
+    if (!isRecord(payload) || payload.status !== 404
+        || payload.instance !== `/api/tracking/${trackingNumber}`)
+        return false;
+    if (payload.type === '/errors/external/not-found' && payload.title === 'NOT_FOUND')
+        return true;
+    if (payload.type !== '/errors/external/tracking-error' || typeof payload.detail !== 'string')
+        return false;
+    try {
+        const nested = JSON.parse(payload.detail.replace(/^Tracking client failed\. /, ''));
+        return isRecord(nested) && nested.type === '/errors/external/not-found'
+            && nested.title === 'NOT_FOUND' && nested.status === 404 && nested.instance === payload.instance;
+    }
+    catch {
+        return false;
+    }
+}
 export function parseInpostTrackingResponse(payload, trackingNumber) {
     const requested = normalizeInpostTrackingNumber(trackingNumber);
     if (!isRecord(payload))
@@ -129,13 +143,19 @@ export class InpostTracker {
             timeoutMs: Math.min(this.timeoutMs, budget.remainingMs()),
             maxBytes: MAX_RESPONSE_BYTES,
             retryTransient: true,
-            allowHttpError: true,
+            allowHttpStatuses: [404],
             fetcher: this.fetcher,
         });
-        if (response.status === 404)
-            throw new NotFoundError('InPost');
-        if (!response.ok)
-            throw new UpstreamHttpError('InPost tracking', response.status);
+        if (response.status === 404) {
+            let problem;
+            try {
+                problem = parseJsonBytes(bytes, 'InPost tracking');
+            }
+            catch { /* An HTML error page proves no shipment outcome. */ }
+            if (isNotFoundProblem(problem, trackingNumber))
+                throw new NotFoundError('InPost');
+            throw new IndeterminateError('InPost', 'InPost returned an unrecognized not-found response');
+        }
         return parseInpostTrackingResponse(parseJsonBytes(bytes, 'InPost tracking'), trackingNumber);
     }
 }

package/dist/carriers/mondial-relay/adapter.js

@@ -227,7 +227,7 @@ function trawlJson(response) {
     const $ = load(response.html);
     candidates.push($('pre').first().text(), $('body').text(), response.html);
     for (const candidate of candidates) {
-        const cleaned = candidate.trim().replace(/^/, '');
+        const cleaned = candidate.trim().replace(/^\uFEFF/, '');
         if (!cleaned)
             continue;
         try {

package/dist/carriers/nacex/parser.js

@@ -96,7 +96,7 @@ export function parseNacex(html, raw) {
         }
         const mapped = classifyNacexStatus(label);
         const movement = mapped && ['accepted', 'in_transit', 'out_for_delivery', 'ready_for_pickup'].includes(mapped.stage);
-        const trailing = clean(cell.contents().filter((_, node) => node.type === 'text').map((_, node) => $(node).text()).get().join(' '), 300);
+        const trailing = clean(cell.contents().filter((_, node) => node.nodeType === 3).map((_, node) => $(node).text()).get().join(' '), 300);
         // The same trailing column holds a recipient after delivery. Only the
         // observed depot/locality shape of a mapped movement scan is a location.
         const locality = movement && /^\d{4}(?:-\d{1,3})?\s*-\s*([\p{L}][\p{L}\s.()-]{1,99})$/u.exec(trailing)?.[1];

package/dist/carriers/poste-italiane/adapter.js

@@ -124,7 +124,7 @@ export function parsePosteItalianeTrackingResponse(payload, trackingNumber) {
     const events = parsed.slice(0, MAX_EVENTS_TO_RETURN).map(({ event }) => event);
     // Envelope stato "5" forces delivered; otherwise the newest mapped event wins
     // and unmapped wording stays unknown with its raw text preserved.
-    if (String(payload.stato ?? '') === '5') {
+    if (payload.stato === '5' || payload.stato === 5) {
         return {
             status: 'delivered',
             current_stage: 'delivered',

package/dist/carriers/sunyou/adapter.js

@@ -14,7 +14,7 @@ import { randomInt } from 'node:crypto';
 import { DateTime } from 'luxon';
 import { lookupBudget } from '../../core/adapter/index.js';
 import { NotFoundError, SchemaError } from '../../core/errors/index.js';
-import { decodeText, fetchBounded, userAgentOf } from '../../core/transport/index.js';
+import { cleanScalar, decodeText, fetchBounded, userAgentOf } from '../../core/transport/index.js';
 import { isRecord } from '../../core/types.js';
 import { sunYouStatus } from './status.js';
 const PROVIDER = 'SunYou';
@@ -99,7 +99,7 @@ export function parseSunYouTrackingResponse(value, trackingNumber) {
     const item = identified.find((candidate) => comparableIdentifier(candidate.orderNo) === requested);
     if (!item)
         throw new SchemaError(PROVIDER, 'SunYou returned a different shipment');
-    const displayStatus = String(item.displayStatus ?? '');
+    const displayStatus = cleanScalar(item.displayStatus, 16);
     if (displayStatus === '0')
         throw new NotFoundError(PROVIDER);
     if (item.has !== true)

package/dist/carriers/swiss-post/adapter.js

@@ -29,14 +29,15 @@ const HEADERS = {
  * deliberately not used here.
  */
 function text(value, limit = 500) {
-    return String(value ?? '').trim().slice(0, limit);
+    return typeof value === 'string' || (typeof value === 'number' && Number.isFinite(value))
+        ? String(value).trim().slice(0, limit) : '';
 }
 /** Whether the lookup was cancelled or has spent its budget, rather than a request failing on its own. */
 function ended(budget) {
     return budget.signal.aborted || budget.remainingMs() <= BUDGET_SLACK_MS;
 }
 function comparableShipmentNumber(value) {
-    return String(value ?? '').replace(/[\s.-]/g, '').toUpperCase();
+    return text(value, 64).replace(/[\s.-]/g, '').toUpperCase();
 }
 function datePart(value) {
     return /(?<!\d)(\d{4}-\d{2}-\d{2})(?!\d)/.exec(text(value))?.[1] ?? null;

package/dist/carriers/the-courier-guy/parser.js

@@ -43,8 +43,9 @@ export function parseCourierGuy(payload, rawNumber) {
         throw new SchemaError('The Courier Guy');
     // Cancelled, never-collected DD bookings omit their count. This bounded
     // precollection timeline cannot complete a delivered or moving shipment.
+    const customReference = shipment.custom_tracking_reference;
     const cancelledCollection = shipment.parcel_count == null && shipment.status === 'cancelled'
-        && typeof shipment.custom_tracking_reference === 'string' && /^DD-[A-Z0-9]{6}$/.test(shipment.custom_tracking_reference)
+        && typeof customReference === 'string' && /^DD-[A-Z0-9]{6}$/.test(customReference)
         && Array.isArray(shipment.parcel_tracking_references)
         && shipment.parcel_tracking_references.length === 1
         && shipment.tracking_events.every(row => isRecord(row) && row.parcel_id === 0
@@ -53,7 +54,7 @@ export function parseCourierGuy(payload, rawNumber) {
         || !shipment.parcel_tracking_references.length
         || shipment.parcel_tracking_references.length > 500
         || shipment.parcel_tracking_references.some(ref => typeof ref !== 'string'
-            || (!/^[A-Z0-9]{5,40}$/.test(ref) && !(cancelledCollection && ref === `${shipment.custom_tracking_reference}/1`)))
+            || (!/^[A-Z0-9]{5,40}$/.test(ref) && !(cancelledCollection && ref === `${customReference}/1`)))
         || new Set(shipment.parcel_tracking_references).size !== shipment.parcel_tracking_references.length)
         throw new SchemaError('The Courier Guy', 'Invalid shipment pieces');
     if (!cancelledCollection && (!Number.isSafeInteger(shipment.parcel_count) || shipment.parcel_count < 1

package/dist/carriers/ukrposhta/parser.js

@@ -102,7 +102,7 @@ export function parseUkrposhtaHistory(payload, overview) {
     // Both native histories are current-first. Keep that order across foreign
     // wall clocks or missing dates instead of sorting them as UTC instants.
     let returnLeg = false;
-    const events = Array(rows.length);
+    const events = new Array(rows.length);
     for (let index = rows.length - 1; index >= 0; index--) {
         const row = rows[index];
         if (ukrposhtaReturnCue(row.label))

package/dist/carriers/uniuni/parser.js

@@ -82,9 +82,10 @@ export function parseUniuni(payload, rawNumber) {
         throw new SchemaError(PROVIDER);
     const events = [];
     const seen = new Set();
+    const scans = item.spath_list;
     // The public client displays this oldest-first list in reverse. Keep that
     // sequence when the newest clock is incomplete, including equal-time scans.
-    for (const scan of [...item.spath_list].reverse()) {
+    for (const scan of [...scans].reverse()) {
         if (!isRecord(scan))
             throw new SchemaError(PROVIDER, 'UniUni returned an incomplete scan');
         const description = clean(scan.description_en, 500);

package/dist/carriers/ups/adapter.js

@@ -245,7 +245,7 @@ function expectedDelivery(detail, today) {
 export function parseUPSTrackingResponse(payload, trackingNumber, today = new Date()) {
     if (!isRecord(payload))
         throw new SchemaError('UPS');
-    if (String(payload.statusCode ?? '') !== '200') {
+    if (payload.statusCode !== '200' && payload.statusCode !== 200) {
         throw new IndeterminateError('UPS', clean(payload.statusText) || 'UPS tracking is unavailable');
     }
     if (!Array.isArray(payload.trackDetails) || payload.trackDetails.length === 0)
@@ -437,7 +437,7 @@ export class UPSTracker {
             }
             catch (error) {
                 // An unreadable or unrelated reply; the rendered page may still answer.
-                captureError = error;
+                captureError = error instanceof Error ? error : new SchemaError('UPS', 'UPS returned invalid tracking data', { cause: error });
             }
         }
         try {

package/dist/carriers/yto/parser.js

@@ -34,10 +34,11 @@ export function parseYto(payload, trackingNumber) {
     if (!item.waybillProcessInfo.length)
         throw new IndeterminateError(PROVIDER, 'YTO returned no shipment history');
     const events = [];
+    const history = item.waybillProcessInfo;
     let returning = false;
     // The official client uses the first row as current. Read oldest first to
     // preserve a return leg when later scans use ordinary movement/signature codes.
-    for (const raw of [...item.waybillProcessInfo].reverse()) {
+    for (const raw of [...history].reverse()) {
         if (!isRecord(raw) || normalizeTrackingNumber(clean(raw.waybillNo, 64)) !== number) {
             throw new SchemaError(PROVIDER, 'YTO returned mixed or incomplete shipment history');
         }

package/dist/carriers/yunda/adapter.js

@@ -42,10 +42,10 @@ export class YundaTracker {
                             throw error;
                         }
                     };
-                    const type = yundaEnvelope(await request('/index.php/api/order.record/captcha_type?' + params));
+                    const type = yundaEnvelope(await request('/index.php/api/order.record/captcha_type?' + params.toString()));
                     if (type.data !== 1)
                         throw new ChallengeError('Yunda Express', 'Yunda requires an unsupported verification type');
-                    const captcha = yundaEnvelope(await request('/index.php/api/order.record/captcha?' + params));
+                    const captcha = yundaEnvelope(await request('/index.php/api/order.record/captcha?' + params.toString()));
                     if (!isRecord(captcha.data))
                         throw new SchemaError('Yunda Express');
                     const coordinate = await solveYundaSlider(captcha.data, signal);

package/dist/core/transport/trawl.js

@@ -10,7 +10,7 @@
  */
 import { CarrierError, UpstreamHttpError } from '../errors/index.js';
 import { decodeText, fetchBounded, parseJsonBytes } from './boundedFetch.js';
-import { clean } from './text.js';
+import { cleanScalar } from './text.js';
 import { isRecord } from '../types.js';
 export class TrawlError extends CarrierError {
     constructor(provider, message, options) {
@@ -186,7 +186,7 @@ export class TrawlClient {
         if (!isRecord(value))
             throw new TrawlError(options.provider, 'The browser service returned an invalid response');
         if (value.error) {
-            throw new TrawlError(options.provider, clean(String(value.error), 200) || 'The browser service could not fetch the page');
+            throw new TrawlError(options.provider, cleanScalar(value.error, 200) || 'The browser service could not fetch the page');
         }
         const statusCode = Number(value.statusCode);
         if (Number.isInteger(statusCode) && statusCode >= 400)

package/dist/server/index.js

@@ -53,11 +53,15 @@ async function body(request) {
         throw new HttpError(413, 'Request body is too large');
     const chunks = [];
     let length = 0;
-    for await (const chunk of request) {
-        length += chunk.length;
+    const stream = request;
+    for await (const chunk of stream) {
+        if (typeof chunk !== 'string' && !Buffer.isBuffer(chunk))
+            throw new HttpError(400, 'Invalid request body');
+        const bytes = Buffer.from(chunk);
+        length += bytes.length;
         if (length > limit)
             throw new HttpError(413, 'Request body is too large');
-        chunks.push(Buffer.from(chunk));
+        chunks.push(bytes);
     }
     let parsed;
     try {
@@ -204,7 +208,7 @@ export function createTrackingServer(options = {}) {
             pending.delete(key);
         }
     }
-    const server = createServer(async (request, response) => {
+    async function handleRequest(request, response) {
         const started = performance.now();
         let route = 'unknown';
         response.on('finish', () => {
@@ -297,6 +301,9 @@ export function createTrackingServer(options = {}) {
                 json(response, 502, { error: 'Tracking is temporarily unavailable' });
             }
         }
+    }
+    const server = createServer((request, response) => {
+        void handleRequest(request, response).catch(() => response.destroy());
     });
     server.requestTimeout = 15_000;
     server.headersTimeout = 10_000;

package/dist/server/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Universal Parcel Scraper",
-    "version": "0.3.0"
+    "version": "0.3.1"
   },
   "paths": {
     "/health": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "universal-parcel-scraper",
-  "version": "0.3.1-main.311",
+  "version": "0.3.1-main.313",
   "description": "Self-hosted parcel tracking: carrier detection, dedicated scrapers and optional universal providers.",
   "type": "module",
   "license": "Apache-2.0",
@@ -58,7 +58,7 @@
     "build": "node scripts/build.mjs",
     "prepare": "npm run build",
     "typecheck": "tsc --noEmit",
-    "lint": "eslint . --max-warnings=0 --pass-on-unpruned-suppressions",
+    "lint": "eslint . --max-warnings=0",
     "test": "vitest run",
     "test:scripts": "node --test trawl/*.test.mjs scripts/*.test.mjs",
     "generate": "node scripts/generate-catalog.mjs && node scripts/generate-registry.mjs --strict && node scripts/generate-region-towns.mjs && node scripts/coverage-tables.mjs && node scripts/generate-readme.mjs",