universal-parcel-scraper 0.34.0-main.379 → 0.35.0-main.384

package/data/catalog.json

@@ -354,8 +354,8 @@
       "adapter": "postlogistics",
       "recognitionRank": 26
     },
-    "canaryUrl": "https://tracking.postlogistics.ch/public/trackandtrace",
-    "trackingUrlTemplate": "https://tracking.postlogistics.ch/public/trackandtrace/{trackingNumber}",
+    "canaryUrl": "https://apv.swisspost-cargo.com/public/trackandtrace",
+    "trackingUrlTemplate": "https://apv.swisspost-cargo.com/public/trackandtrace/{trackingNumber}",
     "linkRules": [
       {
         "domains": [

package/dist/browser/scraper.js

@@ -390,8 +390,8 @@ var ce = {
 			adapter: "postlogistics",
 			recognitionRank: 26
 		},
-		canaryUrl: "https://tracking.postlogistics.ch/public/trackandtrace",
-		trackingUrlTemplate: "https://tracking.postlogistics.ch/public/trackandtrace/{trackingNumber}",
+		canaryUrl: "https://apv.swisspost-cargo.com/public/trackandtrace",
+		trackingUrlTemplate: "https://apv.swisspost-cargo.com/public/trackandtrace/{trackingNumber}",
 		linkRules: [{
 			domains: ["tracking.postlogistics.ch"],
 			path: "^/public/trackandtrace/([^/?#]+)/?$"

package/dist/carriers/dpd/adapter.d.ts

@@ -35,14 +35,17 @@ export interface DPDTrackerOptions {
     trawl?: TrawlClient | null;
     recorder?: StepRecorder;
     userAgent?: string;
-    /** A further German tier, and the failures of the guest tier it may answer after. */
+    /** A further German tier, ahead of the guest tier when no postcode is given. */
     app?: DPDAppTier;
 }
 export interface DPDAppTier {
+    /** `leads` when the guest tier is still to come and needs time left. */
     run(number: string, context: {
         signal: AbortSignal;
         timeoutMs: number;
+        leads: boolean;
     }): Promise<CarrierResult>;
+    /** The failures of either tier the other may answer after. */
     recovers(error: unknown): boolean;
 }
 export declare class DPDTracker {

package/dist/carriers/dpd/adapter.js

@@ -550,11 +550,23 @@ export class DPDTracker {
             const kind = carrierErrorKind(error);
             return !context.signal?.aborted && kind !== null && PAGE_RECOVERS.has(kind);
         };
+        const app = this.app;
+        const appRecovers = (error) => !context.signal?.aborted && app.recovers(error);
+        // Without a postcode the app's scans are the richer history; with one, the
+        // guest tier's verified reply comes first.
+        const appLeads = app !== undefined && !resolvedPostcode;
+        const appStep = (leads) => ({
+            id: 'app',
+            ...(leads ? {} : { recovers: appRecovers }),
+            run: ({ signal, remainingMs }) => app.run(trackingNumber, { signal, timeoutMs: remainingMs, leads }),
+        });
         const result = await runSteps({
             carrier, budgetMs: lookup.budgetMs, signal: lookup.signal, recorder: this.recorder,
         }, [
+            ...(appLeads ? [appStep(true)] : []),
             {
                 id: 'direct',
+                ...(appLeads ? { recovers: appRecovers } : {}),
                 run: () => this.apiFetch(trackingNumber, resolvedPostcode, lookup).catch((error) => {
                     // The signal ends the guest tier a moment before the runner counts
                     // the budget as spent: the tier reports the budget itself, so the
@@ -569,11 +581,7 @@ export class DPDTracker {
                     id: 'page',
                     recovers: pageRecovers,
                     run: ({ previousError }) => this.pageFetch(trackingNumber, previousError !== undefined, lookup),
-                }] : this.app ? [{
-                    id: 'app',
-                    recovers: (error) => !context.signal?.aborted && this.app.recovers(error),
-                    run: ({ signal, remainingMs }) => this.app.run(trackingNumber, { signal, timeoutMs: remainingMs }),
-                }] : []),
+                }] : app && !appLeads ? [appStep(false)] : []),
         ]);
         result.tracking_url = this.country === 'DE'
             ? `https://tracking.dpd.de/status/en_US/parcel/${trackingNumber}`

package/dist/carriers/dpd-de/adapter.d.ts

@@ -1,3 +1,3 @@
 import type { AdapterFactory } from '../../core/adapter/index.js';
-/** Germany uses the same guest protocol, with its own business-unit selector, then the German app's service. */
+/** Germany reads the German app's service, then the guest protocol with its own business-unit selector. */
 export declare const adapter: AdapterFactory;

package/dist/carriers/dpd-de/adapter.js

@@ -1,8 +1,9 @@
 import { CarrierError, carrierErrorKind } from '../../core/errors/index.js';
-import { recoverableByDefault } from '../../core/runner/index.js';
 import { DPDTracker } from '../dpd/adapter.js';
 import { DPD_DE_OTHER_COUNTRY, DpdDeAppClient } from './app.js';
-/** Germany uses the same guest protocol, with its own business-unit selector, then the German app's service. */
+/** Left to the guest API when the app's session is still opening ahead of it. */
+const GUEST_RESERVE_MS = 20_000;
+/** Germany reads the German app's service, then the guest protocol with its own business-unit selector. */
 export const adapter = (environment) => {
     const app = new DpdDeAppClient({ fetcher: environment.fetcher, userAgent: environment.userAgent });
     const tracker = new DPDTracker({
@@ -12,14 +13,18 @@ export const adapter = (environment) => {
         recorder: environment.recorder,
         userAgent: environment.userAgent,
         app: {
-            run: (number, context) => app.track(number, context),
-            // The app reads the same parcel, so it cannot place another country's delivery in Germany.
-            recovers: error => (recoverableByDefault(error) || carrierErrorKind(error) === 'schema')
+            run: (number, { signal, timeoutMs, leads }) => app.track(number, {
+                signal, timeoutMs, sessionWaitMs: leads ? Math.max(0, timeoutMs - GUEST_RESERVE_MS) : timeoutMs,
+            }),
+            // Each service has its own host, limits and outages, so either answers when
+            // the other fails. Both read the same parcel: neither can place another
+            // country's delivery in Germany, nor find a parcel the guest API does not know.
+            recovers: error => carrierErrorKind(error) !== 'not_found'
                 && !(error instanceof CarrierError && error.reason === DPD_DE_OTHER_COUNTRY),
         },
     });
     return {
-        id: 'dpd-de', recordsSteps: true, steps: ['direct', 'app'],
+        id: 'dpd-de', recordsSteps: true, steps: ['app', 'direct'],
         track: (input, context) => tracker.fetch(input.number, input.postcode ?? '', context),
     };
 };

package/dist/carriers/dpd-de/app.d.ts

@@ -4,6 +4,8 @@ import { type XmlNode } from '../../core/transport/xml.js';
 export declare const DPD_DE_APP_API = "https://api.paketnavigator.de/services/v1/Navigator3Service.asmx";
 /** Activity the service places outside Germany; the app tier would read the same parcel. */
 export declare const DPD_DE_OTHER_COUNTRY = "other_country";
+/** The lookup stopped waiting for the session, which keeps opening for the next one. */
+export declare const DPD_DE_SESSION_OPENING = "session_opening";
 export interface DpdDePartner {
     name: string;
     token: string;
@@ -18,6 +20,7 @@ export declare function parseDpdDeApp(data: XmlNode, scans: XmlNode, number: str
 /**
  * The German app's SOAP service. Tracking needs an anonymous device session, which the
  * service takes tens of seconds to open and then accepts for hours: one is kept per client.
+ * The opening runs on its own clock, so a lookup that stops waiting leaves it to the next.
  */
 export declare class DpdDeAppClient {
     #private;
@@ -27,11 +30,16 @@ export declare class DpdDeAppClient {
         userAgent?: string;
         now?: () => number;
     });
+    /** `sessionWaitMs` bounds the wait for a session still opening; the whole `timeoutMs` by default. */
     track(number: string, options: {
         signal: AbortSignal;
         timeoutMs: number;
+        sessionWaitMs?: number;
     }): Promise<CarrierResult>;
-    /** One session for every lookup; the lookup that opens it lends its signal, the others only wait. */
+    /**
+     * One session for every lookup. The opening runs while a lookup that asked for it is still
+     * running, even one that stopped waiting; each lookup waits until its signal or `waitMs` ends.
+     */
     private session;
     private call;
 }

package/dist/carriers/dpd-de/app.js

@@ -6,9 +6,13 @@ import { xmlDocument } from '../../core/transport/xml.js';
 export const DPD_DE_APP_API = 'https://api.paketnavigator.de/services/v1/Navigator3Service.asmx';
 /** Activity the service places outside Germany; the app tier would read the same parcel. */
 export const DPD_DE_OTHER_COUNTRY = 'other_country';
+/** The lookup stopped waiting for the session, which keeps opening for the next one. */
+export const DPD_DE_SESSION_OPENING = 'session_opening';
 const SOAP = 'http://schemas.xmlsoap.org/soap/envelope/';
 const SERVICE = 'https://cloud.dpd.com/';
 const MAX_BYTES = 2_000_000;
+/** Opening a session has taken up to 42 seconds. */
+const SESSION_OPEN_MS = 75_000;
 // Shared partner credentials of the public app, distributed with the maintainer's approval.
 const PARTNER = { name: 'Android Paketnavigator3', token: 'A33363237662F5945576', password: '272 WetFd2mpXrgD' };
 /** The app's progress rail: one coarse state for the whole parcel. */
@@ -120,6 +124,7 @@ export function parseDpdDeApp(data, scans, number) {
 /**
  * The German app's SOAP service. Tracking needs an anonymous device session, which the
  * service takes tens of seconds to open and then accepts for hours: one is kept per client.
+ * The opening runs on its own clock, so a lookup that stops waiting leaves it to the next.
  */
 export class DpdDeAppClient {
     #partner;
@@ -135,6 +140,7 @@ export class DpdDeAppClient {
         this.#userAgent = userAgentOf(options.userAgent);
         this.#now = options.now ?? Date.now;
     }
+    /** `sessionWaitMs` bounds the wait for a session still opening; the whole `timeoutMs` by default. */
     async track(number, options) {
         if (!/^\d{14}$/.test(number))
             throw new TypeError('DPD Germany app tracking takes 14 digits');
@@ -142,7 +148,7 @@ export class DpdDeAppClient {
         const left = () => Math.max(1, Math.floor(deadline - performance.now()));
         try {
             for (let attempt = 0;; attempt += 1) {
-                const session = await this.session(options.signal, left());
+                const session = await this.session(options.signal, Math.min(left(), options.sessionWaitMs ?? Infinity));
                 try {
                     const data = await this.call('getTrackingData', { SessionToken: session, ParcelNo: number, DeliveryZipCode: '',
                         UpdateNewDeliveryData: 'false', addParcelIfNoTrackingdataAvailable: 'false', ParcelFlowTypeID: 'receiving' }, options.signal, left());
@@ -168,32 +174,60 @@ export class DpdDeAppClient {
             throw new TransportError('DPD Germany', 'DPD Germany app request failed');
         }
     }
-    /** One session for every lookup; the lookup that opens it lends its signal, the others only wait. */
-    async session(signal, timeoutMs) {
+    /**
+     * One session for every lookup. The opening runs while a lookup that asked for it is still
+     * running, even one that stopped waiting; each lookup waits until its signal or `waitMs` ends.
+     */
+    async session(signal, waitMs) {
         if (this.#session)
             return this.#session;
+        signal.throwIfAborted();
         if (!this.#opening) {
-            const opening = this.call('getSessionFullState', { SessionToken: '', DeviceData: {
+            const controller = new AbortController();
+            const holders = new Set();
+            const token = this.call('getSessionFullState', { SessionToken: '', DeviceData: {
                     HardwareID: this.#device, BootSystemID: 'Android_Phone', Version: '15', AppVersion: '4.2.0',
-                } }, signal, timeoutMs).then(result => {
-                const token = scalar(one(result, 'SessionFullState'), 'SessionToken', 600);
-                if (!/^[A-Za-z0-9+/=]{16,512}$/.test(token))
+                } }, controller.signal, SESSION_OPEN_MS).then(result => {
+                const value = scalar(one(result, 'SessionFullState'), 'SessionToken', 600);
+                if (!/^[A-Za-z0-9+/=]{16,512}$/.test(value))
                     invalid();
-                return this.#session = token;
+                return this.#session = value;
             });
+            const release = () => {
+                for (const holder of holders)
+                    if (holder.aborted)
+                        holders.delete(holder);
+                if (!holders.size)
+                    controller.abort(new Error('No lookup is waiting for the DPD Germany session'));
+            };
+            const opening = { token, holders, release };
             this.#opening = opening;
-            void opening.catch(() => undefined).finally(() => { if (this.#opening === opening)
-                this.#opening = null; });
+            void token.catch(() => undefined).finally(() => {
+                if (this.#opening === opening)
+                    this.#opening = null;
+                for (const holder of holders)
+                    holder.removeEventListener('abort', release);
+            });
+        }
+        const { token, holders, release } = this.#opening;
+        if (!holders.has(signal)) {
+            holders.add(signal);
+            signal.addEventListener('abort', release, { once: true });
         }
-        const shared = this.#opening;
-        signal.throwIfAborted();
         let leave;
-        const left = new Promise((_resolve, reject) => { leave = () => reject(signal.reason); });
+        let timer;
+        const left = new Promise((_resolve, reject) => {
+            leave = () => reject(signal.reason);
+            timer = setTimeout(() => reject(new IndeterminateError('DPD Germany', 'DPD Germany app session is still opening', {
+                reason: DPD_DE_SESSION_OPENING,
+            })), Math.max(0, Math.min(waitMs, SESSION_OPEN_MS)));
+        });
         signal.addEventListener('abort', leave, { once: true });
         try {
-            return await Promise.race([shared, left]);
+            return await Promise.race([token, left]);
         }
         finally {
+            clearTimeout(timer);
             signal.removeEventListener('abort', leave);
         }
     }

package/dist/carriers/dpd-de/carrier.json

@@ -18,8 +18,8 @@
     "mode": "automatic",
     "adapter": "dpd-de",
     "steps": [
-      "direct",
-      "app"
+      "app",
+      "direct"
     ],
     "requirements": [
       {

package/dist/carriers/mondial-relay/adapter.d.ts

@@ -2,22 +2,31 @@ import type { AdapterFactory, TrackingContext } from '../../core/adapter/index.j
 import type { CarrierResult } from '../../core/result/index.js';
 import { type StepRecorder } from '../../core/telemetry/index.js';
 import { TrawlClient } from '../../core/transport/index.js';
+import { MondialRelayAppClient } from './app.js';
 interface MondialRelayCredential {
     shipment: string;
     postcode: string;
     canonicalShipment?: string;
+    /** Read from a checksummed label barcode, which needs no postcode. */
+    barcode?: true;
 }
 export declare function normalizeMondialRelayCredential(rawShipment: string, rawPostcode?: string): MondialRelayCredential;
 export declare function mondialRelayTrackingUrl(rawShipment: string, rawPostcode?: string): string;
 export declare function parseMondialRelayTrackingResponse(payload: unknown, rawShipment: string, rawPostcode?: string): CarrierResult;
 export interface MondialRelayTrackerOptions {
     timeoutMs?: number;
+    /** How long the app step may take before the website is tried. */
     directTimeoutMs?: number;
     /** Legacy configuration seam; `trawl` is preferred. */
     trawlUrl?: string;
     /** The browser service, or null when none is configured. */
     trawl?: TrawlClient | null;
+    /** An InPost account's refresh token for the app step; without one the website answers alone. */
+    appRefreshToken?: string;
+    /** Test seam for the app step; built from `appRefreshToken` when absent. */
+    app?: MondialRelayAppClient | null;
     fetcher?: typeof fetch;
+    userAgent?: string;
     recorder?: StepRecorder;
 }
 export declare class MondialRelayTracker {

package/dist/carriers/mondial-relay/adapter.js

@@ -7,6 +7,7 @@ import { NOOP_RECORDER } from '../../core/telemetry/index.js';
 import { isoTime, zonedTime } from '../../core/time/index.js';
 import { cleanScalar, TRAWL_TRANSPORT_ALLOWANCE_MS, trawlBody, TrawlClient } from '../../core/transport/index.js';
 import { isRecord } from '../../core/types.js';
+import { MondialRelayAppClient } from './app.js';
 import { classifyStatus, milestoneNumberStatus } from './status.js';
 // Protocol provenance (inspected 2026-08-30):
 // https://www.mondialrelay.fr/versioned-assets/2nMAiuVI9Rv9J3kZacblPYCfCABwzS-qZ3m7eFBQn4A/Scripts/vue/tracking/js/app.js
@@ -20,7 +21,8 @@ const TRACKING_API = 'https://www.mondialrelay.fr/api/tracking';
 const MAX_DIRECT_BYTES = 2_000_000;
 const MAX_TRAWL_BYTES = 10_000_000;
 const DEFAULT_TIMEOUT_MS = 90_000;
-const DEFAULT_DIRECT_TIMEOUT_MS = 20_000;
+/** The app answers in about a second; past this the website gets the rest of the budget. */
+const DEFAULT_DIRECT_TIMEOUT_MS = 10_000;
 const ZONE = 'Europe/Paris';
 const CREDENTIAL_MESSAGE = 'Mondial Relay tracking requires an 8-, 10-, or 12-digit shipment number followed by '
     + 'the 5-digit recipient postcode';
@@ -42,7 +44,7 @@ export function normalizeMondialRelayCredential(rawShipment, rawPostcode = '') {
             throw new InvalidInputError('Mondial Relay', 'Invalid Mondial Relay barcode or postcode');
         }
         // The public alias carries brand/shipment/parcel sequence, not a postcode.
-        return { shipment: shipment.slice(0, 12), postcode, canonicalShipment: shipment.slice(2, 10) };
+        return { shipment: shipment.slice(0, 12), postcode, canonicalShipment: shipment.slice(2, 10), barcode: true };
     }
     if (!postcode && /^(?:\d{13}|\d{15}|\d{17})$/.test(shipment)) {
         postcode = shipment.slice(-5);
@@ -264,6 +266,7 @@ export class MondialRelayTracker {
     directTimeoutMs;
     trawlUrl;
     #trawl;
+    #app;
     #fetcher;
     #recorder;
     #serialize = singleFlight();
@@ -272,6 +275,9 @@ export class MondialRelayTracker {
         this.directTimeoutMs = Math.max(1_000, Math.min(this.timeoutMs, options.directTimeoutMs ?? DEFAULT_DIRECT_TIMEOUT_MS));
         this.trawlUrl = (options.trawlUrl ?? '').trim();
         this.#trawl = options.trawl;
+        this.#app = options.app !== undefined ? options.app : options.appRefreshToken?.trim()
+            ? new MondialRelayAppClient({ refreshToken: options.appRefreshToken, fetcher: options.fetcher, userAgent: options.userAgent })
+            : null;
         this.#fetcher = options.fetcher;
         this.#recorder = options.recorder ?? NOOP_RECORDER;
         if (!Number.isFinite(this.timeoutMs) || this.timeoutMs <= 0) {
@@ -286,16 +292,16 @@ export class MondialRelayTracker {
     }
     async fetch(rawShipment, rawPostcode = '', context = {}) {
         // One lookup at a time: the page token and the API call have to stay on the
-        // same solved browser identity.
+        // same solved browser identity, and the app's access token is renewed once.
         return takeTurn(this.#serialize, 'Mondial Relay', context, (left) => this.#lookup(normalizeMondialRelayCredential(rawShipment, rawPostcode), left));
     }
     async #lookup(credential, context) {
-        // Cloudflare blocks every non-browser client with an HTTP 403 WAF block
-        // (verified from multiple networks, 2026-09-10), so a direct attempt only
-        // burns time and reports a fallback on each sync. There is one step, and
-        // it is the browser.
+        // Cloudflare blocks every non-browser client of the website with an HTTP
+        // 403 WAF block (verified from multiple networks, 2026-09-10). The app's
+        // backend answers plain HTTP, but only for a signed-in account.
+        const app = this.#app;
         const trawl = this.#browserService();
-        if (!trawl) {
+        if (!app && !trawl) {
             throw new ChallengeError('Mondial Relay', 'Mondial Relay challenged direct tracking; configure FLARESOLVERR_URL for browser fallback');
         }
         return runSteps({
@@ -304,8 +310,21 @@ export class MondialRelayTracker {
             carrier: 'mondial-relay', budgetMs: context.budgetMs ?? this.timeoutMs + TRAWL_TRANSPORT_ALLOWANCE_MS, signal: context.signal,
             recorder: this.#recorder,
         }, [
+            {
+                id: 'app',
+                enabled: app !== null,
+                run: async ({ remainingMs, signal }) => {
+                    // The app filters on the recipient postcode only; a label barcode is its own proof.
+                    const query = { shipment: credential.shipment, postcode: credential.barcode ? '' : credential.postcode };
+                    const result = await app.track(query, { signal, timeoutMs: Math.min(remainingMs, this.directTimeoutMs) });
+                    return this.#link(result, credential, 'mobile-app-response');
+                },
+            },
             {
                 id: 'trawl',
+                enabled: trawl !== null,
+                // The website is a separate service: no failure of the app settles the lookup.
+                recovers: () => true,
                 run: ({ remainingMs, signal }) => this.#trawlResult(trawl, credential, performance.now() + remainingMs, signal),
             },
         ]);
@@ -338,7 +357,9 @@ export class MondialRelayTracker {
         });
     }
     #finish(payload, credential, trackingSource) {
-        const result = parseTrackingResponse(payload, credential);
+        return this.#link(parseTrackingResponse(payload, credential), credential, trackingSource);
+    }
+    #link(result, credential, trackingSource) {
         const url = new URL(TRACKING_PAGE);
         url.searchParams.set('numeroExpedition', credential.shipment);
         result.tracking_url = url.toString();
@@ -349,13 +370,15 @@ export class MondialRelayTracker {
 export const adapter = (environment) => {
     const tracker = new MondialRelayTracker({
         fetcher: environment.fetcher,
+        userAgent: environment.userAgent,
         trawl: environment.trawl,
+        appRefreshToken: environment.env.MONDIAL_RELAY_REFRESH_TOKEN,
         recorder: environment.recorder,
     });
     return {
         id: 'mondial-relay', recordsSteps: true,
-        // Cloudflare refuses every non-browser client, so there is no direct tier.
-        steps: ['trawl'],
+        // Cloudflare refuses every non-browser client of the website; the app step needs an account.
+        steps: ['app', 'trawl'],
         track: (input, context) => tracker.fetch(input.number, input.postcode ?? '', context),
     };
 };

package/dist/carriers/mondial-relay/app.d.ts

@@ -0,0 +1,42 @@
+import type { CarrierResult } from '../../core/result/index.js';
+export declare const MONDIAL_RELAY_APP_API = "https://mobile-app-bff.mondialrelay.app/api/";
+/**
+ * The backend's bot screen refuses Node's built-in fetch, which offers
+ * HTTP/2, and answers the same request over plain HTTP/1.1.
+ */
+export declare const http1Fetch: typeof fetch;
+/** A normalized credential: 8, 10 or 12 digits, or a barcode's 12-digit alias, and a postcode. */
+export interface MondialRelayAppQuery {
+    shipment: string;
+    postcode: string;
+}
+/**
+ * The app's parcel detail: a headline, milestones and their dated events. It
+ * carries no delivery estimate, and its relay, barcode and contact fields are
+ * never read.
+ */
+export declare function parseMondialRelayApp(payload: unknown, uid: string): CarrierResult;
+/**
+ * The consumer app's backend, signed in as one InPost account. Searching
+ * needs no link between that account and the parcel. Requests carry the
+ * app's shared signature; the account's refresh token renews a two-hour
+ * access token, kept per client.
+ */
+export declare class MondialRelayAppClient {
+    #private;
+    constructor(options: {
+        refreshToken: string;
+        fetcher?: typeof fetch;
+        userAgent?: string;
+        now?: () => number;
+    });
+    /**
+     * One parcel, found by its shipment and the recipient postcode, or by a
+     * barcode's brand and shipment alone. A search that does not single out the
+     * parcel is inconclusive: the website also accepts the sender's postcode.
+     */
+    track(query: MondialRelayAppQuery, options: {
+        signal: AbortSignal;
+        timeoutMs: number;
+    }): Promise<CarrierResult>;
+}

package/dist/carriers/mondial-relay/app.js

@@ -0,0 +1,259 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { request } from 'node:https';
+import { Readable } from 'node:stream';
+import { DateTime } from 'luxon';
+import { CarrierError, ChallengeError, IndeterminateError, SchemaError, TransportError, UpstreamHttpError } from '../../core/errors/index.js';
+import { EXPLICIT_OFFSET_PATTERN } from '../../core/time/index.js';
+import { cleanScalar, decodeText, fetchBounded, userAgentOf } from '../../core/transport/index.js';
+import { isRecord } from '../../core/types.js';
+import { classifyStatus, milestoneNumberStatus } from './status.js';
+export const MONDIAL_RELAY_APP_API = 'https://mobile-app-bff.mondialrelay.app/api/';
+const TOKEN_URL = 'https://account.inpost-group.com/oauth2/token';
+const CLIENT_ID = 'mondialrelay-mobile';
+// Shared request-signing secret of the public app, distributed with the maintainer's approval.
+const SIGNING_SECRET = 'VCzt4PzS8ynJE2yy7zNBiQbTE3pkncqEyvrUsCDbXupGn8yqRrPDov2FYiAVfuUx';
+const MAX_BYTES = 2_000_000;
+/** An access token this close to its stated expiry is renewed first. */
+const EXPIRY_MARGIN_MS = 60_000;
+const ZONE = 'Europe/Paris';
+/**
+ * The backend's bot screen refuses Node's built-in fetch, which offers
+ * HTTP/2, and answers the same request over plain HTTP/1.1.
+ */
+export const http1Fetch = (input, init = {}) => new Promise((resolve, reject) => {
+    const url = input instanceof Request ? input.url : String(input);
+    const sent = init.body ?? undefined;
+    if (sent !== undefined && typeof sent !== 'string' && !(sent instanceof URLSearchParams))
+        throw new TypeError('Only text bodies are sent');
+    const body = sent?.toString();
+    const headers = Object.fromEntries(new Headers(init.headers));
+    if (body !== undefined)
+        headers['content-length'] = String(Buffer.byteLength(body));
+    const outgoing = request(url, { method: init.method ?? 'GET', headers, signal: init.signal ?? undefined }, (incoming) => {
+        const status = incoming.statusCode ?? 0;
+        const replied = new Headers();
+        for (let index = 0; index + 1 < incoming.rawHeaders.length; index += 2)
+            replied.append(incoming.rawHeaders[index], incoming.rawHeaders[index + 1]);
+        try {
+            const stream = [204, 205, 304].includes(status) ? null : Readable.toWeb(incoming);
+            resolve(new Response(stream, { status, statusText: incoming.statusMessage, headers: replied }));
+        }
+        catch (error) {
+            incoming.destroy();
+            reject(error);
+        }
+    });
+    outgoing.on('error', reject);
+    outgoing.end(body);
+});
+function invalid(message = 'Mondial Relay app returned invalid tracking data') {
+    throw new SchemaError('Mondial Relay', message);
+}
+function json(bytes) {
+    try {
+        return JSON.parse(decodeText(bytes));
+    }
+    catch {
+        return invalid();
+    }
+}
+/** The app sends UTC instants; they are shown on Paris clocks, as the website does. */
+function eventTime(value) {
+    const raw = cleanScalar(value, 64);
+    if (!EXPLICIT_OFFSET_PATTERN.test(raw))
+        return null;
+    const parsed = DateTime.fromISO(raw, { setZone: true }).setZone(ZONE);
+    const iso = parsed.isValid ? parsed.toISO({ suppressMilliseconds: true }) : null;
+    return iso ? { iso, timestamp: parsed.toMillis() } : null;
+}
+/** The highest milestone with a date: its wording, else its position on the app's rail. */
+function milestoneStatus(steps) {
+    const reached = steps
+        .filter((step) => eventTime(step.date) && Number.isFinite(Number(step.number)))
+        .sort((left, right) => Number(right.number) - Number(left.number))[0];
+    if (!reached)
+        return null;
+    const worded = classifyStatus(cleanScalar(reached.status, 200));
+    return worded.status !== 'unknown' ? worded : milestoneNumberStatus(Number(reached.number));
+}
+/**
+ * The app's parcel detail: a headline, milestones and their dated events. It
+ * carries no delivery estimate, and its relay, barcode and contact fields are
+ * never read.
+ */
+export function parseMondialRelayApp(payload, uid) {
+    if (!Array.isArray(payload))
+        invalid();
+    const parcel = payload.find((entry) => isRecord(entry) && isRecord(entry.expedition)
+        && cleanScalar(entry.expedition.shipmentUid, 16) === uid);
+    if (!parcel)
+        invalid('Mondial Relay returned a different shipment');
+    const expedition = parcel.expedition;
+    if (!isRecord(parcel.detail) || !Array.isArray(parcel.detail.steps))
+        invalid();
+    const steps = parcel.detail.steps.filter(isRecord);
+    const parsed = [];
+    const seen = new Set();
+    for (const step of steps) {
+        for (const raw of Array.isArray(step.events) ? step.events : []) {
+            if (!isRecord(raw))
+                continue;
+            const time = eventTime(raw.date);
+            const description = cleanScalar(raw.label, 500);
+            if (!time || !description)
+                continue;
+            const identity = JSON.stringify([time.iso, description]);
+            if (seen.has(identity))
+                continue;
+            seen.add(identity);
+            const classified = classifyStatus(description);
+            parsed.push({ event: { time: time.iso, location: '', description, stage: classified.stage }, classified, timestamp: time.timestamp });
+        }
+    }
+    parsed.sort((left, right) => right.timestamp - left.timestamp);
+    const events = parsed.slice(0, 100).map(({ event }) => event);
+    const hint = cleanScalar(expedition.stepHint, 200);
+    const hinted = classifyStatus(hint);
+    const current = hinted.status !== 'unknown'
+        ? hinted
+        : parsed.find(({ classified }) => classified.status !== 'unknown')?.classified ?? milestoneStatus(steps);
+    if (!events.length && !current)
+        throw new IndeterminateError('Mondial Relay', 'Mondial Relay app returned no shipment activity');
+    return {
+        status: current?.status ?? 'unknown',
+        ...(current ? { current_stage: current.stage } : {}),
+        last_status_text: hint || events[0]?.description || 'Tracking information received',
+        last_update: events[0]?.time ?? null,
+        expected_delivery: null,
+        timezone: ZONE,
+        events,
+        source: 'mondial_relay_app',
+    };
+}
+/**
+ * The consumer app's backend, signed in as one InPost account. Searching
+ * needs no link between that account and the parcel. Requests carry the
+ * app's shared signature; the account's refresh token renews a two-hour
+ * access token, kept per client.
+ */
+export class MondialRelayAppClient {
+    #refreshToken;
+    #fetcher;
+    #userAgent;
+    #now;
+    #access = null;
+    #renewing = null;
+    constructor(options) {
+        this.#refreshToken = options.refreshToken.trim();
+        if (!this.#refreshToken)
+            throw new TypeError('Mondial Relay app tracking needs a refresh token');
+        this.#fetcher = options.fetcher ?? http1Fetch;
+        this.#userAgent = userAgentOf(options.userAgent);
+        this.#now = options.now ?? Date.now;
+    }
+    /**
+     * One parcel, found by its shipment and the recipient postcode, or by a
+     * barcode's brand and shipment alone. A search that does not single out the
+     * parcel is inconclusive: the website also accepts the sender's postcode.
+     */
+    async track(query, options) {
+        const { shipment, postcode } = query;
+        if (!/^(?:\d{8}|\d{10}|\d{12})$/.test(shipment))
+            throw new TypeError('Mondial Relay app tracking takes 8, 10 or 12 digits');
+        const deadline = performance.now() + options.timeoutMs;
+        const left = () => Math.max(1, Math.floor(deadline - performance.now()));
+        try {
+            const search = await this.#get('parcels-search', postcode
+                ? { shipmentUid: shipment.length === 8 ? shipment : shipment.slice(2, 10), postcode }
+                : { shipmentUid: shipment.slice(0, 10) }, options.signal, left);
+            if (!isRecord(search) || !Array.isArray(search.list))
+                invalid();
+            const matches = search.list.flatMap((entry) => {
+                const uid = isRecord(entry) && isRecord(entry.expedition) ? cleanScalar(entry.expedition.shipmentUid, 16) : '';
+                // The 10-digit UID is the brand followed by the shipment.
+                return /^\d{10}$/.test(uid) && (shipment.length === 8 ? uid.slice(2) === shipment : uid === shipment.slice(0, 10)) ? [uid] : [];
+            });
+            const uids = [...new Set(matches)];
+            if (uids.length !== 1)
+                throw new IndeterminateError('Mondial Relay', 'Mondial Relay app could not single out the shipment');
+            const detail = await this.#get('parcels-detail', { shipmentUids: uids[0], parcelType: 'received' }, options.signal, left);
+            return parseMondialRelayApp(detail, uids[0]);
+        }
+        catch (error) {
+            options.signal.throwIfAborted();
+            // Transport diagnostics carry the bearer token and the postcode.
+            if (error instanceof CarrierError)
+                throw new CarrierError(error.kind, 'Mondial Relay', `Mondial Relay app tracking failed (${error.kind})`, {
+                    status: error.status, retryAfterMs: error.retryAfterMs, reason: error.reason,
+                });
+            throw new TransportError('Mondial Relay', 'Mondial Relay app request failed');
+        }
+    }
+    /** A signed request; a rejected access token is renewed once. */
+    async #get(path, query, signal, left) {
+        const url = new URL(path, MONDIAL_RELAY_APP_API);
+        for (const [name, value] of Object.entries(query))
+            url.searchParams.set(name, value);
+        for (let attempt = 0;; attempt += 1) {
+            const token = await this.#accessToken(signal, left);
+            const nonce = randomUUID();
+            const clock = String(Math.floor(this.#now() / 1000));
+            const sha256 = (value) => createHash('sha256').update(value).digest('hex');
+            const { response, bytes } = await fetchBounded(url, { signal, headers: {
+                    Accept: 'application/json', 'Accept-Language': 'fr-FR', 'User-Agent': this.#userAgent, 'X-OriginApp': 'MR',
+                    'X-MR-Param1': nonce, 'X-MR-Param2': clock, 'X-MR-API-KEY': sha256(sha256(SIGNING_SECRET + nonce + clock)),
+                    Authorization: `Bearer ${token}`,
+                } }, { provider: 'Mondial Relay', maxBytes: MAX_BYTES, timeoutMs: left(), fetcher: this.#fetcher, allowHttpStatuses: [401, 403, 404] });
+            if (response.status === 401 && !attempt) {
+                if (this.#access?.token === token)
+                    this.#access = null;
+                continue;
+            }
+            if ([401, 403].includes(response.status))
+                throw new ChallengeError('Mondial Relay', 'Mondial Relay refused the app request');
+            // A missing parcel is an empty search; a 404 is a moved route.
+            if (response.status === 404)
+                throw new TransportError('Mondial Relay', 'Mondial Relay app service is unavailable', { status: 404 });
+            if (response.status !== 200)
+                throw new UpstreamHttpError('Mondial Relay', response.status);
+            return json(bytes);
+        }
+    }
+    /** The current access token, renewed by one request at a time. */
+    async #accessToken(signal, left) {
+        if (this.#access && this.#access.expiresAt - EXPIRY_MARGIN_MS > this.#now())
+            return this.#access.token;
+        signal.throwIfAborted();
+        this.#renewing ??= this.#renew(left()).finally(() => { this.#renewing = null; });
+        const renewing = this.#renewing;
+        let leave;
+        const aborted = new Promise((_resolve, reject) => {
+            leave = () => reject(signal.reason);
+            signal.addEventListener('abort', leave, { once: true });
+        });
+        try {
+            return await Promise.race([renewing, aborted]);
+        }
+        finally {
+            signal.removeEventListener('abort', leave);
+        }
+    }
+    async #renew(timeoutMs) {
+        const body = new URLSearchParams({ client_id: CLIENT_ID, grant_type: 'refresh_token', refresh_token: this.#refreshToken });
+        const { response, bytes } = await fetchBounded(TOKEN_URL, { method: 'POST', body, headers: {
+                Accept: 'application/json', 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': this.#userAgent,
+            } }, { provider: 'Mondial Relay', maxBytes: 100_000, timeoutMs, fetcher: this.#fetcher, allowHttpStatuses: [400, 401] });
+        // An expired or revoked sign-in needs a new one; the website still answers meanwhile.
+        if (response.status !== 200)
+            throw new ChallengeError('Mondial Relay', 'Mondial Relay refused the account token');
+        const reply = json(bytes);
+        if (!isRecord(reply))
+            invalid();
+        const token = cleanScalar(reply.access_token, 8_192);
+        const lifetime = Number(reply.expires_in);
+        if (!/^[\w-]+\.[\w-]+\.[\w-]+$/.test(token) || !Number.isFinite(lifetime) || lifetime <= 0)
+            invalid();
+        this.#access = { token, expiresAt: this.#now() + lifetime * 1000 };
+        return token;
+    }
+}

package/dist/carriers/mondial-relay/carrier.json

@@ -35,6 +35,7 @@
       }
     ],
     "steps": [
+      "app",
       "trawl"
     ]
   },

package/dist/carriers/postlogistics/adapter.d.ts

@@ -1,9 +1,11 @@
 /**
  * PostLogistics tracking.
  *
- * The public tracker at `tracking.postlogistics.ch` posts the identifier to
- * `eosapi.postlogistics.ch/api/trackandtrace/public`. The response says what
- * the identifier was:
+ * PostLogistics now trades as Swiss Post Cargo, and its tracker moved to
+ * `apv.swisspost-cargo.com`, which posts the identifier to
+ * `eosapi.swisspost-cargo.com/api/trackandtrace/public`. The former
+ * `postlogistics.ch` hosts answer 404. The response says what the identifier
+ * was:
  *
  * - `Type` 1: a barcode. The answer may contain several shipments, so only the
  *   one whose `Identifier` equals the requested barcode is read.

package/dist/carriers/postlogistics/adapter.js

@@ -1,9 +1,11 @@
 /**
  * PostLogistics tracking.
  *
- * The public tracker at `tracking.postlogistics.ch` posts the identifier to
- * `eosapi.postlogistics.ch/api/trackandtrace/public`. The response says what
- * the identifier was:
+ * PostLogistics now trades as Swiss Post Cargo, and its tracker moved to
+ * `apv.swisspost-cargo.com`, which posts the identifier to
+ * `eosapi.swisspost-cargo.com/api/trackandtrace/public`. The former
+ * `postlogistics.ch` hosts answer 404. The response says what the identifier
+ * was:
  *
  * - `Type` 1: a barcode. The answer may contain several shipments, so only the
  *   one whose `Identifier` equals the requested barcode is read.
@@ -28,7 +30,7 @@ import { postlogisticsIdentifier } from './number.js';
 import { POSTLOGISTICS_IMAGE_CODE, postlogisticsStage, postlogisticsStatus } from './status.js';
 const PROVIDER = 'PostLogistics';
 const UPSTREAM = 'PostLogistics tracking';
-const TRACK_URL = 'https://eosapi.postlogistics.ch/api/trackandtrace/public?culture=fr-FR';
+const TRACK_URL = 'https://eosapi.swisspost-cargo.com/api/trackandtrace/public?culture=fr-FR';
 const DEFAULT_TIMEOUT_MS = 15_000;
 const BASE_HEADERS = {
     Accept: 'application/json, text/plain, */*',
@@ -146,8 +148,8 @@ export class PostlogisticsTracker {
                     ...BASE_HEADERS,
                     'User-Agent': this.userAgent,
                     'Content-Type': 'application/json',
-                    Origin: 'https://tracking.postlogistics.ch',
-                    Referer: 'https://tracking.postlogistics.ch/',
+                    Origin: 'https://apv.swisspost-cargo.com',
+                    Referer: 'https://apv.swisspost-cargo.com/',
                 },
                 body: JSON.stringify({ Identifier: identifier }),
                 signal: budget.signal,

package/dist/carriers/postlogistics/carrier.json

@@ -28,8 +28,8 @@
     "eta"
   ],
   "portal": {
-    "url": "https://tracking.postlogistics.ch/public/trackandtrace/{trackingNumber}",
-    "canaryUrl": "https://tracking.postlogistics.ch/public/trackandtrace",
+    "url": "https://apv.swisspost-cargo.com/public/trackandtrace/{trackingNumber}",
+    "canaryUrl": "https://apv.swisspost-cargo.com/public/trackandtrace",
     "shows": [
       "status",
       "history",

package/dist/data/catalog.json

@@ -354,8 +354,8 @@
             "adapter": "postlogistics",
             "recognitionRank": 26
         },
-        "canaryUrl": "https://tracking.postlogistics.ch/public/trackandtrace",
-        "trackingUrlTemplate": "https://tracking.postlogistics.ch/public/trackandtrace/{trackingNumber}",
+        "canaryUrl": "https://apv.swisspost-cargo.com/public/trackandtrace",
+        "trackingUrlTemplate": "https://apv.swisspost-cargo.com/public/trackandtrace/{trackingNumber}",
         "linkRules": [
             {
                 "domains": [

package/dist/generated/catalog.d.ts

@@ -236,8 +236,8 @@ export declare const CARRIER_CATALOG: {
             readonly adapter: "postlogistics";
             readonly recognitionRank: 26;
         };
-        readonly canaryUrl: "https://tracking.postlogistics.ch/public/trackandtrace";
-        readonly trackingUrlTemplate: "https://tracking.postlogistics.ch/public/trackandtrace/{trackingNumber}";
+        readonly canaryUrl: "https://apv.swisspost-cargo.com/public/trackandtrace";
+        readonly trackingUrlTemplate: "https://apv.swisspost-cargo.com/public/trackandtrace/{trackingNumber}";
         readonly linkRules: readonly [{
             readonly domains: readonly ["tracking.postlogistics.ch"];
             readonly path: "^/public/trackandtrace/([^/?#]+)/?$";

package/dist/generated/catalog.js

@@ -355,8 +355,8 @@ export const CARRIER_CATALOG = {
             "adapter": "postlogistics",
             "recognitionRank": 26
         },
-        "canaryUrl": "https://tracking.postlogistics.ch/public/trackandtrace",
-        "trackingUrlTemplate": "https://tracking.postlogistics.ch/public/trackandtrace/{trackingNumber}",
+        "canaryUrl": "https://apv.swisspost-cargo.com/public/trackandtrace",
+        "trackingUrlTemplate": "https://apv.swisspost-cargo.com/public/trackandtrace/{trackingNumber}",
         "linkRules": [
             {
                 "domains": [

package/dist/server/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Universal Parcel Scraper",
-    "version": "0.34.0"
+    "version": "0.35.0"
   },
   "paths": {
     "/health": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "universal-parcel-scraper",
-  "version": "0.34.0-main.379",
+  "version": "0.35.0-main.384",
   "description": "Self-hosted parcel tracking: carrier detection, dedicated scrapers and optional universal providers.",
   "type": "module",
   "license": "Apache-2.0",