universal-parcel-scraper 0.49.2-main.558 → 0.49.2-main.561

package/dist/carriers/dpd/adapter.d.ts

@@ -3,6 +3,7 @@ import { ChallengeError, IndeterminateError, NotFoundError, type CarrierErrorOpt
 import type { CarrierResult } from '../../core/result/index.js';
 import type { StepRecorder } from '../../core/telemetry/index.js';
 import { TrawlClient } from '../../core/transport/index.js';
+import { type DpdParcelShop } from '../dpd-de/service.js';
 /** Cloudflare interrupted the consignee page with an interactive challenge. */
 export declare class DPDChallengeError extends ChallengeError {
     constructor(message?: string, options?: CarrierErrorOptions);
@@ -37,6 +38,15 @@ export interface DPDTrackerOptions {
     userAgent?: string;
     /** A further German tier, ahead of the guest tier when no postcode is given. */
     app?: DPDAppTier;
+    /** Finds the address of the Pickup shop a parcel waits at, by its PUDO id. */
+    shops?: DPDParcelShops;
+}
+export interface DPDParcelShops {
+    /** The shop, or nothing when it is not found in time; only the signal ends it with an error. */
+    parcelShop(id: string, options: {
+        signal: AbortSignal;
+        timeoutMs: number;
+    }): Promise<DpdParcelShop | undefined>;
 }
 export interface DPDAppTier {
     /** `leads` when the guest tier is still to come and needs time left. `postcode` is empty when none was given. */
@@ -61,6 +71,7 @@ export declare class DPDTracker {
     private readonly recorder?;
     private readonly userAgent;
     private readonly app?;
+    private readonly shops?;
     constructor(options?: DPDTrackerOptions);
     /** The browser service, resolved late so a malformed URL fails the page step, not construction. */
     private browserService;
@@ -77,6 +88,8 @@ export declare class DPDTracker {
      */
     recognizes(raw: string, context?: TrackingContext): Promise<boolean>;
     private apiFetch;
+    /** The shop's record, within the budget less a moment for the lookup to answer without it. */
+    private pickupShop;
     private detailsWithFreshToken;
     private parcelDetails;
     private accessToken;

package/dist/carriers/dpd/adapter.js

@@ -9,6 +9,7 @@ import { runSteps } from '../../core/runner/index.js';
 import { calendarDay, isoTime, explicitOffsetTime, zonedTime } from '../../core/time/index.js';
 import { TrawlClient, decodeText, fetchBounded, parseJsonBytes, userAgentOf } from '../../core/transport/index.js';
 import { isRecord } from '../../core/types.js';
+import { DpdAppService } from '../dpd-de/service.js';
 import { API_LABELS, PROOF_OF_DELIVERY_SCAN, apiStage, apiStatus, scanStage, wordingStatus, } from './status.js';
 // Protocol provenance:
 // - The myDPD Android application talks to a guest JSON API: a Firebase
@@ -48,6 +49,8 @@ const TOKEN_FAILURE_MEMORY_MS = 30_000;
 /** The browser service may spend the whole request timeout plus its own transport allowance. */
 const SOLVER_ALLOWANCE_MS = 15_000;
 const MAX_BYTES = 10_000_000;
+/** Left to a lookup that waited for its pickup shop's address, to answer without it. */
+const SHOP_RESERVE_MS = 5_000;
 /** Cloudflare interrupted the consignee page with an interactive challenge. */
 export class DPDChallengeError extends ChallengeError {
     constructor(message = 'DPD returned a Cloudflare browser challenge', options) {
@@ -175,11 +178,31 @@ function apiPickupPoint(payload, current, stage) {
     if (stage !== 'ready_for_pickup')
         return null;
     // ParcelShop collection points are operational locations, not private
-    // addresses. `receiverName` is the last fallback and is only read as text.
+    // addresses. The receiver's name is not one: it names the recipient.
     const value = firstText(...[current.pickupPoint, current.parcelShop, payload.pickupPoint, payload.parcelShop]
-        .map((candidate) => (isRecord(candidate) ? firstText(candidate.name, candidate.shopName) : candidate)), current.receiverName, payload.receiverName);
+        .map((candidate) => (isRecord(candidate) ? firstText(candidate.name, candidate.shopName) : candidate)));
     return value ? value.slice(0, 200) : null;
 }
+/** Scans at DPD's depots and hubs. */
+const DEPOT_SCANS = new Set(['ORI', 'SPL', 'HUI', 'HUS', 'DLI', 'DLS', 'DLQ', 'DLO']);
+/**
+ * The PUDO id of the shop the parcel waits at: that of the newest scan naming
+ * one, unless a depot scan came after it, as after the sender's drop-off at a
+ * shop. Verified replies only: `parcelHistory` names no shop.
+ */
+function pickupShopId(payload) {
+    const scans = (Array.isArray(payload.parcelEvents) ? payload.parcelEvents.filter(isRecord) : [])
+        .map((raw, index) => ({ raw, index, wallClock: `${clean(raw.date)}T${clean(raw.time)}` }))
+        .sort((left, right) => right.wallClock.localeCompare(left.wallClock) || left.index - right.index);
+    for (const { raw } of scans) {
+        const id = clean(raw.pudoId);
+        if (/^[A-Z]{2}\d{1,12}$/.test(id))
+            return id;
+        if (DEPOT_SCANS.has(scanCode(raw.eventType)))
+            return '';
+    }
+    return '';
+}
 function apiLocation(event) {
     const city = known(event.city);
     // A scan's own `country` wins even when it is a placeholder: `depotCountry`
@@ -329,7 +352,8 @@ export function parseDPDTrackingApi(payload, trackingNumber, postcodeVerified) {
         }
     };
     // Only the fields below leave a scan. `podUrl` embeds the parcel number, and
-    // `pudoId`, `buShortName` and `depotCountry` are DPD's own routing data.
+    // `pudoId`, `buShortName` and `depotCountry` are DPD's own routing data: a
+    // scan's `pudoId` only finds the address of the shop holding the parcel.
     for (const raw of parcelEvents) {
         const code = scanCode(raw.eventType);
         const wallClock = scanWallClock(raw);
@@ -538,6 +562,7 @@ export class DPDTracker {
     recorder;
     userAgent;
     app;
+    shops;
     #accessToken = '';
     #accessTokenExpiresAt = 0;
     #basicToken = '';
@@ -557,6 +582,7 @@ export class DPDTracker {
         this.recorder = options.recorder;
         this.userAgent = userAgentOf(options.userAgent);
         this.app = options.app;
+        this.shops = options.shops;
     }
     /** The browser service, resolved late so a malformed URL fails the page step, not construction. */
     browserService() {
@@ -680,6 +706,15 @@ export class DPDTracker {
             postcodeVerified = false;
         }
         const result = parseDPDTrackingApi(payload, trackingNumber, postcodeVerified);
+        const shopId = this.shops && result.current_stage === 'ready_for_pickup' ? pickupShopId(payload) : '';
+        if (shopId) {
+            // The reply names the shop, if at all, without its address: the shop's own
+            // record adds it. Without the record the result stays as it was.
+            const shop = await this.pickupShop(shopId, lookup);
+            const name = result.pickup_point || shop?.name.slice(0, 200);
+            if (shop && name)
+                result.pickup_point = `${name}\n${shop.address}`;
+        }
         // The guest service can answer for another business unit. A selected
         // German adapter must not project explicit evidence for another country.
         if (this.country === 'DE' && isRecord(payload.status)) {
@@ -692,6 +727,11 @@ export class DPDTracker {
             requireGuestActivity(payload, result);
         return result;
     }
+    /** The shop's record, within the budget less a moment for the lookup to answer without it. */
+    async pickupShop(id, lookup) {
+        const timeoutMs = Math.min(this.timeoutMs, lookup.remainingMs()) - SHOP_RESERVE_MS;
+        return timeoutMs > 0 ? this.shops.parcelShop(id, { signal: lookup.signal, timeoutMs }) : undefined;
+    }
     async detailsWithFreshToken(trackingNumber, postcode, lookup) {
         for (let attempt = 0; attempt < 2; attempt += 1) {
             const token = await this.accessToken(lookup);
@@ -984,6 +1024,8 @@ export const adapter = (environment) => {
         userAgent: environment.userAgent,
         // A host can follow a rotated key without waiting for a release.
         firebaseApiKey: environment.env.DPD_FIREBASE_API_KEY?.trim() || undefined,
+        // The German DPD app's service holds the group's Pickup shops, Swiss ones included.
+        shops: new DpdAppService({ fetcher: environment.fetcher, userAgent: environment.userAgent }),
     });
     return {
         id: 'dpd',

package/dist/carriers/dpd-de/app.d.ts

@@ -1,16 +1,9 @@
 import type { CarrierResult } from '../../core/result/index.js';
 import type { ClassifiedStatus } from '../../core/status/index.js';
-import { type XmlNode } from '../../core/transport/xml.js';
-export declare const DPD_DE_APP_API = "https://api.paketnavigator.de/services/v1/Navigator3Service.asmx";
+import type { XmlNode } from '../../core/transport/xml.js';
+import { type DpdDePartner } from './service.js';
 /** Activity the service places outside Germany; the app tier would read the same parcel. */
 export declare const DPD_DE_OTHER_COUNTRY = "other_country";
-/** The lookup stopped waiting for the session, which keeps opening for the next one. */
-export declare const DPD_DE_SESSION_OPENING = "session_opening";
-export interface DpdDePartner {
-    name: string;
-    token: string;
-    password: string;
-}
 /** The app's progress rail: one coarse state for the whole parcel. */
 export declare const DPD_DE_APP_RAIL: Readonly<Record<string, ClassifiedStatus>>;
 /**
@@ -21,11 +14,7 @@ export declare function parseDpdDeApp(data: XmlNode, scans: XmlNode, number: str
     result: CarrierResult;
     shop: string;
 };
-/**
- * The German app's SOAP service. Tracking needs an anonymous device session, which the
- * service takes tens of seconds to open and then accepts for hours: one is kept per client.
- * The opening runs on its own clock, so a lookup that stops waiting leaves it to the next.
- */
+/** DPD Germany's tracking through the German app's service, which keeps one session per client. */
 export declare class DpdDeAppClient {
     #private;
     constructor(options?: {
@@ -45,12 +34,4 @@ export declare class DpdDeAppClient {
         sessionWaitMs?: number;
         postcode?: string;
     }): Promise<CarrierResult>;
-    /** The shop's street and town, or nothing: the parcel is found, and its pickup point keeps its name without them. */
-    private shopAddress;
-    /**
-     * One session for every lookup. The opening runs while a lookup that asked for it is still
-     * running, even one that stopped waiting; each lookup waits until its signal or `waitMs` ends.
-     */
-    private session;
-    private call;
 }

package/dist/carriers/dpd-de/app.js

@@ -1,22 +1,10 @@
-import { createHash, randomBytes } from 'node:crypto';
 import { DateTime } from 'luxon';
-import { CarrierError, ChallengeError, IndeterminateError, SchemaError, TransportError } from '../../core/errors/index.js';
+import { CarrierError, IndeterminateError, SchemaError, TransportError } from '../../core/errors/index.js';
 import { calendarDay, isoTime, zonedTime } from '../../core/time/index.js';
-import { clean, decodeText, fetchBounded, userAgentOf } from '../../core/transport/index.js';
-import { xmlDocument } from '../../core/transport/xml.js';
+import { children, DpdAppService, invalid, one, optional, PostcodeRejected, scalar, SessionExpired, } from './service.js';
 import { DPD_DE_APP_SCANS, dpdDeScanKey } from './status.js';
-export const DPD_DE_APP_API = 'https://api.paketnavigator.de/services/v1/Navigator3Service.asmx';
 /** Activity the service places outside Germany; the app tier would read the same parcel. */
 export const DPD_DE_OTHER_COUNTRY = 'other_country';
-/** The lookup stopped waiting for the session, which keeps opening for the next one. */
-export const DPD_DE_SESSION_OPENING = 'session_opening';
-const SOAP = 'http://schemas.xmlsoap.org/soap/envelope/';
-const SERVICE = 'https://cloud.dpd.com/';
-const MAX_BYTES = 2_000_000;
-/** Opening a session has taken up to 42 seconds. */
-const SESSION_OPEN_MS = 75_000;
-// Shared partner credentials of the public app, distributed with the maintainer's approval.
-const PARTNER = { name: 'Android Paketnavigator3', token: 'A33363237662F5945576', password: '272 WetFd2mpXrgD' };
 /** The app's progress rail: one coarse state for the whole parcel. */
 export const DPD_DE_APP_RAIL = {
     ACCEPTED: { status: 'pending', stage: 'registered' },
@@ -27,26 +15,6 @@ export const DPD_DE_APP_RAIL = {
     // Set while the return travels and after it reaches the sender: its own scans tell them apart.
     RETURN_TO_SENDER: { status: 'exception', stage: 'exception' },
 };
-function invalid() { throw new SchemaError('DPD Germany', 'DPD Germany returned invalid tracking XML'); }
-function children(node, name, uri = SERVICE) {
-    return node.children.filter(child => child.name === name && child.uri === uri);
-}
-function one(node, name, uri = SERVICE) {
-    const matches = children(node, name, uri);
-    return matches.length === 1 ? matches[0] : invalid();
-}
-function scalar(node, name, max = 200) {
-    const matches = children(node, name);
-    if (matches.length > 1 || matches[0]?.children.length)
-        invalid();
-    return clean(matches[0]?.text ?? '', max);
-}
-function optional(node, name) {
-    const matches = children(node, name);
-    if (matches.length > 1)
-        invalid();
-    return matches[0];
-}
 const affirmative = (value) => value === 'true' || value === '1';
 const placeholderDay = (day) => day === '2000-01-01' || day === '0001-01-01';
 /** Validate source digits without assigning a zone to an offset-less estimate. */
@@ -98,13 +66,6 @@ function deliveryEstimate(tracking, announced) {
     // DeliveryDateTime is display text and can omit the year: never invent it.
     return day ?? announced ?? estimateDay(scalar(tracking, 'DeliveryDateTime', 64));
 }
-const escaped = (value) => value.replace(/[<>&"']/g, character => `&#${character.charCodeAt(0)};`);
-const elements = (fields) => Object.entries(fields)
-    .map(([name, value]) => `<${name}>${typeof value === 'string' ? escaped(value) : elements(value)}</${name}>`).join('');
-class SessionExpired extends Error {
-}
-class PostcodeRejected extends Error {
-}
 /** A two-letter country, where the service puts a placeholder three-letter one for an unknown depot. */
 function countryOf(node) {
     const country = node ? scalar(node, 'Country', 8) : '';
@@ -131,18 +92,6 @@ function shopOf(row) {
     }
     return undefined;
 }
-/** The street and town of the shop that `getParcelShopByID` returns, a line each, if it is the requested one. */
-function addressOf(result, id) {
-    const shop = one(result, 'ParcelShop');
-    if (scalar(shop, 'PUDOID', 40) !== id)
-        return '';
-    const address = one(shop, 'ShopAddress');
-    const street = scalar(address, 'Street', 120);
-    const city = scalar(address, 'City', 80);
-    if (!street || !city)
-        return '';
-    return `${[street, scalar(address, 'HouseNo', 20)].filter(Boolean).join(' ')}\n${[scalar(address, 'ZipCode', 16), city].filter(Boolean).join(' ')}`;
-}
 /** The measured length, width and height, in millimetres; the shipper's own figures are not read. */
 function dimensionsOf(order) {
     const sides = ['Length', 'Width', 'Height'].map(name => scalar(order, name, 16));
@@ -239,24 +188,11 @@ export function parseDpdDeApp(data, scans, number) {
     };
     return { result, shop: pickup?.id ?? '' };
 }
-/**
- * The German app's SOAP service. Tracking needs an anonymous device session, which the
- * service takes tens of seconds to open and then accepts for hours: one is kept per client.
- * The opening runs on its own clock, so a lookup that stops waiting leaves it to the next.
- */
+/** DPD Germany's tracking through the German app's service, which keeps one session per client. */
 export class DpdDeAppClient {
-    #partner;
-    #fetcher;
-    #userAgent;
-    #now;
-    #device = randomBytes(8).toString('hex');
-    #session = '';
-    #opening = null;
+    #service;
     constructor(options = {}) {
-        this.#partner = options.partner ?? PARTNER;
-        this.#fetcher = options.fetcher;
-        this.#userAgent = userAgentOf(options.userAgent);
-        this.#now = options.now ?? Date.now;
+        this.#service = new DpdAppService(options);
     }
     /**
      * `sessionWaitMs` bounds the wait for a session still opening; the whole `timeoutMs` by default.
@@ -273,9 +209,9 @@ export class DpdDeAppClient {
         const left = () => Math.max(1, Math.floor(deadline - performance.now()));
         try {
             for (let attempt = 0;; attempt += 1) {
-                const session = await this.session(options.signal, Math.min(left(), options.sessionWaitMs ?? Infinity));
+                const session = await this.#service.session(options.signal, Math.min(left(), options.sessionWaitMs ?? Infinity));
                 // Read-only: the parcel is neither added to the session nor redirected.
-                const tracking = (zip) => this.call('getTrackingData', { SessionToken: session, ParcelNo: number, DeliveryZipCode: zip,
+                const tracking = (zip) => this.#service.call('getTrackingData', { SessionToken: session, ParcelNo: number, DeliveryZipCode: zip,
                     UpdateNewDeliveryData: 'false', addParcelIfNoTrackingdataAvailable: 'false', ParcelFlowTypeID: 'receiving' }, options.signal, left());
                 try {
                     let data;
@@ -292,15 +228,14 @@ export class DpdDeAppClient {
                         data = await tracking('');
                         verified = false;
                     }
-                    const scans = await this.call('getTrackingScanList', { SessionToken: session, ParcelNo: number,
+                    const scans = await this.#service.call('getTrackingScanList', { SessionToken: session, ParcelNo: number,
                         DeliveryZipCode: verified ? postcode : '' }, options.signal, left());
                     const { result, shop } = parseDpdDeApp(data, scans, number);
                     // The scans name the shop without its address, which the shop's own record adds.
-                    if (shop) {
-                        const address = await this.shopAddress(session, shop, options.signal, left());
-                        if (address)
-                            result.pickup_point = `${result.pickup_point}\n${address}`;
-                    }
+                    // Without it, the parcel is found all the same and its pickup point keeps the name alone.
+                    const address = shop ? (await this.#service.parcelShop(shop, { signal: options.signal, timeoutMs: left() }))?.address : undefined;
+                    if (address)
+                        result.pickup_point = `${result.pickup_point}\n${address}`;
                     if (verified !== undefined)
                         result.dpd_postcode_verified = verified;
                     return result;
@@ -308,8 +243,7 @@ export class DpdDeAppClient {
                 catch (error) {
                     if (!(error instanceof SessionExpired) || attempt)
                         throw error;
-                    if (this.#session === session)
-                        this.#session = '';
+                    this.#service.expire(session);
                 }
             }
         }
@@ -324,103 +258,4 @@ export class DpdDeAppClient {
             throw new TransportError('DPD Germany', 'DPD Germany app request failed');
         }
     }
-    /** The shop's street and town, or nothing: the parcel is found, and its pickup point keeps its name without them. */
-    async shopAddress(session, id, signal, timeoutMs) {
-        try {
-            return addressOf(await this.call('getParcelShopByID', { SessionToken: session, ParcelShopID: '0', PudoID: id,
-                ParcelShopOnly: 'false' }, signal, timeoutMs), id);
-        }
-        catch {
-            signal.throwIfAborted();
-            return '';
-        }
-    }
-    /**
-     * One session for every lookup. The opening runs while a lookup that asked for it is still
-     * running, even one that stopped waiting; each lookup waits until its signal or `waitMs` ends.
-     */
-    async session(signal, waitMs) {
-        if (this.#session)
-            return this.#session;
-        signal.throwIfAborted();
-        if (!this.#opening) {
-            const controller = new AbortController();
-            const holders = new Set();
-            const token = this.call('getSessionFullState', { SessionToken: '', DeviceData: {
-                    HardwareID: this.#device, BootSystemID: 'Android_Phone', Version: '15', AppVersion: '4.2.0',
-                } }, controller.signal, SESSION_OPEN_MS).then(result => {
-                const value = scalar(one(result, 'SessionFullState'), 'SessionToken', 600);
-                if (!/^[A-Za-z0-9+/=]{16,512}$/.test(value))
-                    invalid();
-                return this.#session = value;
-            });
-            const release = () => {
-                for (const holder of holders)
-                    if (holder.aborted)
-                        holders.delete(holder);
-                if (!holders.size)
-                    controller.abort(new Error('No lookup is waiting for the DPD Germany session'));
-            };
-            const opening = { token, holders, release };
-            this.#opening = opening;
-            void token.catch(() => undefined).finally(() => {
-                if (this.#opening === opening)
-                    this.#opening = null;
-                for (const holder of holders)
-                    holder.removeEventListener('abort', release);
-            });
-        }
-        const { token, holders, release } = this.#opening;
-        if (!holders.has(signal)) {
-            holders.add(signal);
-            signal.addEventListener('abort', release, { once: true });
-        }
-        let leave;
-        let timer;
-        const left = new Promise((_resolve, reject) => {
-            leave = () => reject(signal.reason);
-            timer = setTimeout(() => reject(new IndeterminateError('DPD Germany', 'DPD Germany app session is still opening', {
-                reason: DPD_DE_SESSION_OPENING,
-            })), Math.max(0, Math.min(waitMs, SESSION_OPEN_MS)));
-        });
-        signal.addEventListener('abort', leave, { once: true });
-        try {
-            return await Promise.race([token, left]);
-        }
-        finally {
-            clearTimeout(timer);
-            signal.removeEventListener('abort', leave);
-        }
-    }
-    async call(operation, fields, signal, timeoutMs) {
-        // The service checks a key derived from the minute of the UTC day.
-        const now = new Date(this.#now());
-        const phase = String((now.getUTCHours() * 60 + now.getUTCMinutes() + 1000) * 3);
-        const key = phase + createHash('md5').update(`${phase}${this.#partner.name}0${operation}${this.#partner.password}`).digest('base64').slice(0, 16);
-        const body = `<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="${SOAP}"><soap:Body><${operation} xmlns="${SERVICE}"><${operation}Request>${elements({
-            Version: '100', Language: 'de_EN', PartnerCredentials: { Name: this.#partner.name, Token: this.#partner.token, KeyPhase: key }, ...fields,
-        })}</${operation}Request></${operation}></soap:Body></soap:Envelope>`;
-        const { response, bytes } = await fetchBounded(DPD_DE_APP_API, { method: 'POST', signal, body,
-            headers: { 'Content-Type': 'text/xml; charset=utf-8', SOAPAction: `"${SERVICE}${operation}"`, Accept: 'text/xml', 'User-Agent': this.#userAgent } }, {
-            provider: 'DPD Germany', maxBytes: MAX_BYTES, timeoutMs, fetcher: this.#fetcher, allowHttpStatuses: [404, 410],
-        });
-        if (response.status !== 200)
-            throw new TransportError('DPD Germany', 'DPD Germany app service is unavailable', { status: response.status });
-        const root = xmlDocument(decodeText(bytes), MAX_BYTES) ?? invalid();
-        if (root.name !== 'Envelope' || root.uri !== SOAP)
-            invalid();
-        const result = one(one(one(root, 'Body', SOAP), `${operation}Response`), `${operation}Result`);
-        const codes = children(result, 'ErrorDataList').flatMap(list => children(list, 'ErrorData')).map(error => scalar(error, 'ErrorCode', 80));
-        if (codes.some(code => code === 'ERROR_PARTNER' || code === 'ERROR_KEYPHASE')) {
-            throw new ChallengeError('DPD Germany', 'DPD Germany refused the app credential');
-        }
-        if (codes.includes('ERROR_SESSION_NOT_VALID'))
-            throw new SessionExpired();
-        if (codes.includes('ERROR_TRACKING_DELIVERYZIPCODE_NOT_VALID'))
-            throw new PostcodeRejected();
-        // "No tracking data" also answers for parcels the scan list still knows: it proves no absence.
-        if (scalar(result, 'Ack', 8) !== 'true')
-            throw new IndeterminateError('DPD Germany', 'DPD Germany returned no confirmed parcel');
-        return result;
-    }
 }

package/dist/carriers/dpd-de/service.d.ts

@@ -0,0 +1,59 @@
+import { type XmlNode } from '../../core/transport/xml.js';
+export declare const DPD_DE_APP_API = "https://api.paketnavigator.de/services/v1/Navigator3Service.asmx";
+/** The lookup stopped waiting for the session, which keeps opening for the next one. */
+export declare const DPD_DE_SESSION_OPENING = "session_opening";
+export interface DpdDePartner {
+    name: string;
+    token: string;
+    password: string;
+}
+export declare function invalid(): never;
+export declare function children(node: XmlNode, name: string, uri?: string): XmlNode[];
+export declare function one(node: XmlNode, name: string, uri?: string): XmlNode;
+export declare function scalar(node: XmlNode, name: string, max?: number): string;
+export declare function optional(node: XmlNode, name: string): XmlNode | undefined;
+type Fields = {
+    readonly [name: string]: string | Fields;
+};
+/** The service no longer accepts the session. */
+export declare class SessionExpired extends Error {
+}
+/** DPD does not hold the postcode to be the recipient's. */
+export declare class PostcodeRejected extends Error {
+}
+/** A Pickup shop as its own record names it: its name, then its street and its town on a line each. */
+export interface DpdParcelShop {
+    name: string;
+    address: string;
+}
+/**
+ * The service needs an anonymous device session, which it takes tens of seconds to open and then
+ * accepts for hours: one is kept per instance. The opening runs on its own clock, so a lookup that
+ * stops waiting leaves it to the next.
+ */
+export declare class DpdAppService {
+    #private;
+    constructor(options?: {
+        partner?: DpdDePartner;
+        fetcher?: typeof fetch;
+        userAgent?: string;
+        now?: () => number;
+    });
+    /**
+     * The Pickup shop with this PUDO id, or nothing when the service does not answer it within
+     * `timeoutMs`, including the wait for a session. Only the signal ends it with an error.
+     */
+    parcelShop(id: string, options: {
+        signal: AbortSignal;
+        timeoutMs: number;
+    }): Promise<DpdParcelShop | undefined>;
+    /** Forgets a session the service refused, unless another lookup already replaced it. */
+    expire(session: string): void;
+    /**
+     * One session for every lookup. The opening runs while a lookup that asked for it is still
+     * running, even one that stopped waiting; each lookup waits until its signal or `waitMs` ends.
+     */
+    session(signal: AbortSignal, waitMs: number): Promise<string>;
+    call(operation: string, fields: Fields, signal: AbortSignal, timeoutMs: number): Promise<XmlNode>;
+}
+export {};

package/dist/carriers/dpd-de/service.js

@@ -0,0 +1,200 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { ChallengeError, IndeterminateError, SchemaError, TransportError } from '../../core/errors/index.js';
+import { clean, decodeText, fetchBounded, userAgentOf } from '../../core/transport/index.js';
+import { xmlDocument } from '../../core/transport/xml.js';
+// The German DPD app's SOAP service, shared between carriers. DPD Germany tracks parcels
+// through it, and DPD Switzerland reads the address of the Pickup shop holding a parcel
+// from it: `getParcelShopByID` answers for the group's shops, Swiss ones included.
+export const DPD_DE_APP_API = 'https://api.paketnavigator.de/services/v1/Navigator3Service.asmx';
+/** The lookup stopped waiting for the session, which keeps opening for the next one. */
+export const DPD_DE_SESSION_OPENING = 'session_opening';
+const SOAP = 'http://schemas.xmlsoap.org/soap/envelope/';
+const SERVICE = 'https://cloud.dpd.com/';
+const MAX_BYTES = 2_000_000;
+/** Opening a session has taken up to 42 seconds. */
+const SESSION_OPEN_MS = 75_000;
+// Shared partner credentials of the public app, distributed with the maintainer's approval.
+const PARTNER = { name: 'Android Paketnavigator3', token: 'A33363237662F5945576', password: '272 WetFd2mpXrgD' };
+export function invalid() { throw new SchemaError('DPD Germany', 'DPD Germany returned invalid tracking XML'); }
+export function children(node, name, uri = SERVICE) {
+    return node.children.filter(child => child.name === name && child.uri === uri);
+}
+export function one(node, name, uri = SERVICE) {
+    const matches = children(node, name, uri);
+    return matches.length === 1 ? matches[0] : invalid();
+}
+export function scalar(node, name, max = 200) {
+    const matches = children(node, name);
+    if (matches.length > 1 || matches[0]?.children.length)
+        invalid();
+    return clean(matches[0]?.text ?? '', max);
+}
+export function optional(node, name) {
+    const matches = children(node, name);
+    if (matches.length > 1)
+        invalid();
+    return matches[0];
+}
+const escaped = (value) => value.replace(/[<>&"']/g, character => `&#${character.charCodeAt(0)};`);
+const elements = (fields) => Object.entries(fields)
+    .map(([name, value]) => `<${name}>${typeof value === 'string' ? escaped(value) : elements(value)}</${name}>`).join('');
+/** The service no longer accepts the session. */
+export class SessionExpired extends Error {
+}
+/** DPD does not hold the postcode to be the recipient's. */
+export class PostcodeRejected extends Error {
+}
+/** The shop that `getParcelShopByID` returns, if it is the requested one and has a street and a town. */
+function shopOf(result, id) {
+    const shop = one(result, 'ParcelShop');
+    if (scalar(shop, 'PUDOID', 40) !== id)
+        return undefined;
+    const address = one(shop, 'ShopAddress');
+    const street = scalar(address, 'Street', 120);
+    const city = scalar(address, 'City', 80);
+    if (!street || !city)
+        return undefined;
+    return {
+        name: scalar(address, 'Company', 120),
+        address: `${[street, scalar(address, 'HouseNo', 20)].filter(Boolean).join(' ')}\n${[scalar(address, 'ZipCode', 16), city].filter(Boolean).join(' ')}`,
+    };
+}
+/**
+ * The service needs an anonymous device session, which it takes tens of seconds to open and then
+ * accepts for hours: one is kept per instance. The opening runs on its own clock, so a lookup that
+ * stops waiting leaves it to the next.
+ */
+export class DpdAppService {
+    #partner;
+    #fetcher;
+    #userAgent;
+    #now;
+    #device = randomBytes(8).toString('hex');
+    #session = '';
+    #opening = null;
+    constructor(options = {}) {
+        this.#partner = options.partner ?? PARTNER;
+        this.#fetcher = options.fetcher;
+        this.#userAgent = userAgentOf(options.userAgent);
+        this.#now = options.now ?? Date.now;
+    }
+    /**
+     * The Pickup shop with this PUDO id, or nothing when the service does not answer it within
+     * `timeoutMs`, including the wait for a session. Only the signal ends it with an error.
+     */
+    async parcelShop(id, options) {
+        const deadline = performance.now() + options.timeoutMs;
+        const left = () => Math.max(1, Math.floor(deadline - performance.now()));
+        try {
+            for (let attempt = 0;; attempt += 1) {
+                const session = await this.session(options.signal, left());
+                try {
+                    return shopOf(await this.call('getParcelShopByID', { SessionToken: session, ParcelShopID: '0', PudoID: id,
+                        ParcelShopOnly: 'false' }, options.signal, left()), id);
+                }
+                catch (error) {
+                    if (!(error instanceof SessionExpired) || attempt)
+                        throw error;
+                    this.expire(session);
+                }
+            }
+        }
+        catch {
+            options.signal.throwIfAborted();
+            return undefined;
+        }
+    }
+    /** Forgets a session the service refused, unless another lookup already replaced it. */
+    expire(session) {
+        if (this.#session === session)
+            this.#session = '';
+    }
+    /**
+     * One session for every lookup. The opening runs while a lookup that asked for it is still
+     * running, even one that stopped waiting; each lookup waits until its signal or `waitMs` ends.
+     */
+    async session(signal, waitMs) {
+        if (this.#session)
+            return this.#session;
+        signal.throwIfAborted();
+        if (!this.#opening) {
+            const controller = new AbortController();
+            const holders = new Set();
+            const token = this.call('getSessionFullState', { SessionToken: '', DeviceData: {
+                    HardwareID: this.#device, BootSystemID: 'Android_Phone', Version: '15', AppVersion: '4.2.0',
+                } }, controller.signal, SESSION_OPEN_MS).then(result => {
+                const value = scalar(one(result, 'SessionFullState'), 'SessionToken', 600);
+                if (!/^[A-Za-z0-9+/=]{16,512}$/.test(value))
+                    invalid();
+                return this.#session = value;
+            });
+            const release = () => {
+                for (const holder of holders)
+                    if (holder.aborted)
+                        holders.delete(holder);
+                if (!holders.size)
+                    controller.abort(new Error('No lookup is waiting for the DPD Germany session'));
+            };
+            const opening = { token, holders, release };
+            this.#opening = opening;
+            void token.catch(() => undefined).finally(() => {
+                if (this.#opening === opening)
+                    this.#opening = null;
+                for (const holder of holders)
+                    holder.removeEventListener('abort', release);
+            });
+        }
+        const { token, holders, release } = this.#opening;
+        if (!holders.has(signal)) {
+            holders.add(signal);
+            signal.addEventListener('abort', release, { once: true });
+        }
+        let leave;
+        let timer;
+        const left = new Promise((_resolve, reject) => {
+            leave = () => reject(signal.reason);
+            timer = setTimeout(() => reject(new IndeterminateError('DPD Germany', 'DPD Germany app session is still opening', {
+                reason: DPD_DE_SESSION_OPENING,
+            })), Math.max(0, Math.min(waitMs, SESSION_OPEN_MS)));
+        });
+        signal.addEventListener('abort', leave, { once: true });
+        try {
+            return await Promise.race([token, left]);
+        }
+        finally {
+            clearTimeout(timer);
+            signal.removeEventListener('abort', leave);
+        }
+    }
+    async call(operation, fields, signal, timeoutMs) {
+        // The service checks a key derived from the minute of the UTC day.
+        const now = new Date(this.#now());
+        const phase = String((now.getUTCHours() * 60 + now.getUTCMinutes() + 1000) * 3);
+        const key = phase + createHash('md5').update(`${phase}${this.#partner.name}0${operation}${this.#partner.password}`).digest('base64').slice(0, 16);
+        const body = `<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:soap="${SOAP}"><soap:Body><${operation} xmlns="${SERVICE}"><${operation}Request>${elements({
+            Version: '100', Language: 'de_EN', PartnerCredentials: { Name: this.#partner.name, Token: this.#partner.token, KeyPhase: key }, ...fields,
+        })}</${operation}Request></${operation}></soap:Body></soap:Envelope>`;
+        const { response, bytes } = await fetchBounded(DPD_DE_APP_API, { method: 'POST', signal, body,
+            headers: { 'Content-Type': 'text/xml; charset=utf-8', SOAPAction: `"${SERVICE}${operation}"`, Accept: 'text/xml', 'User-Agent': this.#userAgent } }, {
+            provider: 'DPD Germany', maxBytes: MAX_BYTES, timeoutMs, fetcher: this.#fetcher, allowHttpStatuses: [404, 410],
+        });
+        if (response.status !== 200)
+            throw new TransportError('DPD Germany', 'DPD Germany app service is unavailable', { status: response.status });
+        const root = xmlDocument(decodeText(bytes), MAX_BYTES) ?? invalid();
+        if (root.name !== 'Envelope' || root.uri !== SOAP)
+            invalid();
+        const result = one(one(one(root, 'Body', SOAP), `${operation}Response`), `${operation}Result`);
+        const codes = children(result, 'ErrorDataList').flatMap(list => children(list, 'ErrorData')).map(error => scalar(error, 'ErrorCode', 80));
+        if (codes.some(code => code === 'ERROR_PARTNER' || code === 'ERROR_KEYPHASE')) {
+            throw new ChallengeError('DPD Germany', 'DPD Germany refused the app credential');
+        }
+        if (codes.includes('ERROR_SESSION_NOT_VALID'))
+            throw new SessionExpired();
+        if (codes.includes('ERROR_TRACKING_DELIVERYZIPCODE_NOT_VALID'))
+            throw new PostcodeRejected();
+        // "No tracking data" also answers for parcels the scan list still knows: it proves no absence.
+        if (scalar(result, 'Ack', 8) !== 'true')
+            throw new IndeterminateError('DPD Germany', 'DPD Germany returned no confirmed parcel');
+        return result;
+    }
+}

package/dist/carriers/posti/adapter.js

@@ -4,12 +4,14 @@ import { runSteps } from '../../core/runner/index.js';
 import { explicitOffsetTime } from '../../core/time/index.js';
 import { clean, fetchBounded, parseJsonBytes, userAgentOf } from '../../core/transport/index.js';
 import { isRecord } from '../../core/types.js';
+import { isPostiAbroadLabel } from './identity.js';
 import { postiEventStage, postiStatus } from './status.js';
 const TOKEN_URL = 'https://auth-service.posti.fi/api/v1/anonymous_token';
 const GRAPHQL_URL = 'https://graphql.posti.fi/graphql';
 const DEFAULT_TIMEOUT_MS = 15_000;
 // The public tracking page uses this operation with PUBLIC_SHIPMENTS. Select
-// only tracking fields; no account, recipient, address, payment or pickup code.
+// only tracking fields and the pickup point's own address; no account,
+// recipient address, payment or pickup code.
 const QUERY = `query SearchShipments($searchTerms: [String!]!, $locale: String) {
   consumerSearchShipments(page: 1, pageSize: 20, type: PUBLIC_SHIPMENTS, searchTerms: $searchTerms, locale: $locale) {
     totalHits
@@ -17,7 +19,7 @@ const QUERY = `query SearchShipments($searchTerms: [String!]!, $locale: String)
       displayId
       status { main subStatus }
       measurements { weight { unit value } height { unit value } width { unit value } length { unit value } }
-      pickupPoint { address { publicName city } }
+      pickupPoint { type address { publicName streetAddress postcode city } }
       events { city eventDescription reasonDescription timestamp }
       packages { trackingNumber }
     }
@@ -47,6 +49,27 @@ function assertGraphql(payload) {
     if (payload.errors != null && !Array.isArray(payload.errors))
         throw new SchemaError('Posti');
 }
+// Pickup point types whose address is a public business's: Posti's lockers and
+// service points. A private locker stands in the recipient's building.
+const PUBLIC_POINTS = new Set(['LOCKER', 'LOCKER_OUTDOOR', 'POSTI_SERVICE_POINT']);
+/**
+ * The pickup point's name, then its street and "postcode city", as Posti's
+ * tracker lays them out. A private locker, or a point of unknown type, keeps
+ * only its town after the name: its street could be the recipient's.
+ */
+function pickupPoint(raw) {
+    const point = isRecord(raw) ? raw : {};
+    const address = isRecord(point.address) ? point.address : {};
+    const name = clean(address.publicName, 160);
+    if (!name)
+        return null;
+    const street = clean(address.streetAddress, 120);
+    const city = clean(address.city, 80);
+    if (street && city && typeof point.type === 'string' && PUBLIC_POINTS.has(point.type)) {
+        return [name, street, [clean(address.postcode, 16), city].filter(Boolean).join(' ')].join('\n');
+    }
+    return [name, city].filter(Boolean).join('\n');
+}
 function measurement(raw, units) {
     if (!isRecord(raw) || typeof raw.unit !== 'string' || !Object.hasOwn(units, raw.unit.toLowerCase()))
         return null;
@@ -87,17 +110,17 @@ export function parse(payload, trackingNumber) {
         if (!isRecord(event) || typeof event.eventDescription !== 'string')
             throw new SchemaError('Posti');
         const description = clean(event.eventDescription);
+        const city = clean(event.city, 160);
         return {
             description: [description, clean(event.reasonDescription)].filter(Boolean).join(' '),
             time: explicitOffsetTime(event.timestamp)?.iso ?? '',
-            location: clean(event.city, 160),
+            location: isPostiAbroadLabel(city) ? '' : city,
             stage: postiEventStage(description),
         };
     }).sort((left, right) => (Date.parse(right.time || '') || 0) - (Date.parse(left.time || '') || 0)).slice(0, 100);
     const current = postiStatus(hit.status.main, hit.status.subStatus);
     const measurements = isRecord(hit.measurements) ? hit.measurements : {};
     const dimensions = ['length', 'width', 'height'].map((field) => measurement(measurements[field], { cm: 1, mm: 0.1, m: 100 }));
-    const pickup = isRecord(hit.pickupPoint) && isRecord(hit.pickupPoint.address) ? hit.pickupPoint.address : {};
     return {
         status: current?.status ?? 'unknown',
         ...(current ? { current_stage: current.stage } : {}),
@@ -106,7 +129,8 @@ export function parse(payload, trackingNumber) {
         provider_status: hit.status.main,
         weight_kg: measurement(measurements.weight, { kg: 1, g: 0.001 }),
         dimensions_text: dimensions.every((value) => value !== null) ? `${dimensions.join(' × ')} cm` : null,
-        pickup_point: [clean(pickup.publicName, 160), clean(pickup.city, 80)].filter(Boolean).join(', ') || null,
+        // Posti's tracker shows the point at any status, a planned one in transit included.
+        pickup_point: current?.stage === 'ready_for_pickup' ? pickupPoint(hit.pickupPoint) : null,
         timezone: 'Europe/Helsinki',
         events,
     };

package/dist/carriers/posti/identity.d.ts

@@ -0,0 +1,8 @@
+import type { SameInstantIdentityPolicy } from '../../core/catalog/eventIdentity.js';
+/**
+ * Whether a scan's town is Posti's "ULKOMAILLA" ("abroad"), which it gives,
+ * untranslated, to scans outside Finland. It names no place, and the public
+ * reply carries no country to put in its stead.
+ */
+export declare function isPostiAbroadLabel(location: string): boolean;
+export declare const sameInstantIdentityPolicy: SameInstantIdentityPolicy;

package/dist/carriers/posti/identity.js

@@ -0,0 +1,15 @@
+import { matchesDroppedLocation } from '../../core/catalog/locationIdentity.js';
+/**
+ * Whether a scan's town is Posti's "ULKOMAILLA" ("abroad"), which it gives,
+ * untranslated, to scans outside Finland. It names no place, and the public
+ * reply carries no country to put in its stead.
+ */
+export function isPostiAbroadLabel(location) {
+    return location.replace(/\s+/g, ' ').trim().toLocaleUpperCase('fi-FI') === 'ULKOMAILLA';
+}
+// Scans stored with that label as their location lose it and keep their row.
+export const sameInstantIdentityPolicy = {
+    sourceCarrierId: 'posti', storedSources: ['posti'], requireProviderCode: false,
+    matchEachScan: true,
+    matches: (incoming, stored) => matchesDroppedLocation(incoming, stored, isPostiAbroadLabel),
+};

package/dist/core/catalog/eventIdentity.js

@@ -5,10 +5,11 @@ import { sameInstantIdentityPolicy as dpd } from '../../carriers/dpd/app.js';
 import { sameInstantIdentityPolicy as dpdFrance } from '../../carriers/dpd-fr/identity.js';
 import { sameInstantIdentityPolicy as indiaPost } from '../../carriers/india-post/app.js';
 import { sameInstantIdentityPolicy as mondialRelay } from '../../carriers/mondial-relay/identity.js';
+import { sameInstantIdentityPolicy as posti } from '../../carriers/posti/identity.js';
 import { sameInstantIdentityPolicy as ups } from '../../carriers/ups/app.js';
 import { sameInstantIdentityPolicy as swissPost } from '../../carriers/swiss-post/app.js';
 import { sameInstantIdentityPolicy as universal } from '../../providers/shared/app.js';
-const policies = new Map([aliexpress, australiaPost, chronopost, dpd, dpdFrance, indiaPost, mondialRelay, ups, swissPost, universal].map((policy) => [policy.sourceCarrierId, policy]));
+const policies = new Map([aliexpress, australiaPost, chronopost, dpd, dpdFrance, indiaPost, mondialRelay, posti, ups, swissPost, universal].map((policy) => [policy.sourceCarrierId, policy]));
 /** Unlisted sources cannot identify a reworded scan by its instant alone. */
 export function sameInstantIdentityPolicy(sourceCarrierId, options = {}) {
     const policy = policies.get(sourceCarrierId);

package/dist/providers/parcelsapp/adapter.js

@@ -10,6 +10,7 @@
 import { load } from 'cheerio';
 import { DateTime } from 'luxon';
 import timers from 'node:timers/promises';
+import { isPostiAbroadLabel } from '../../carriers/posti/identity.js';
 import { carrierTimezone } from '../../core/catalog/index.js';
 import { brandTimeZones, carrierIdFromName, carrierNameCountryZone } from '../../core/catalog/hints.js';
 import { CarrierError, carrierErrorKind, ChallengeError, IndeterminateError, InputRequiredError, NoHistoryError, SchemaError, UpstreamHttpError, UpstreamNetworkError } from '../../core/errors/index.js';
@@ -236,8 +237,9 @@ function parseHistory(payload, trackingNumber, timezone = null) {
         }
         if (parsed) {
             const location = typeof raw.location === 'string' ? raw.location.replace(/\s+/g, ' ').trim().slice(0, 200) : '';
-            // Some Chronopost rows put the service label in the location field.
-            if (location && !/^Type de livraison\s*:/i.test(location))
+            // Some Chronopost rows put the service label in the location field, and
+            // Posti names scans outside Finland "ULKOMAILLA" (abroad).
+            if (location && !/^Type de livraison\s*:/i.test(location) && !isPostiAbroadLabel(location))
                 parsed.location = location;
             events.push(parsed);
             scanCarriers.add(name);

package/dist/providers/shared/app.js

@@ -1,6 +1,9 @@
-import { matchesLocationEnrichment } from '../../core/catalog/locationIdentity.js';
+import { matchesDroppedLocation, matchesLocationEnrichment } from '../../core/catalog/locationIdentity.js';
+import { isPostiAbroadLabel } from '../../carriers/posti/identity.js';
+// A copy may add a place, or drop Posti's "abroad" label it was once stored with.
 export const sameInstantIdentityPolicy = {
     sourceCarrierId: 'unknown', storedSources: ['unknown'], requireProviderCode: false,
     matchEachScan: true,
-    matches: matchesLocationEnrichment,
+    matches: (incoming, stored) => matchesLocationEnrichment(incoming, stored)
+        || matchesDroppedLocation(incoming, stored, isPostiAbroadLabel),
 };

package/dist/providers/shared/result.d.ts

@@ -5,7 +5,10 @@ export declare function numberOf(raw: string): string;
 export declare function text(value: unknown): string;
 export declare function isNotice(description: string): boolean;
 export declare function hasPrivateDeliveryDetails(description: string): boolean;
-/** The place a provider reports for a scan, unless it holds private delivery details. */
+/**
+ * The place a provider reports for a scan, unless it holds private delivery
+ * details or is Posti's "abroad" label.
+ */
 export declare function place(value: unknown): string;
 export declare function eventStage(description: string): Stage | undefined;
 /** Retain the decision before delivery wording is redacted or a stage is projected. */

package/dist/providers/shared/result.js

@@ -12,6 +12,7 @@ import { DateTime } from 'luxon';
 import { trackingLanguageStage } from '../../core/status/index.js';
 import { deliveryForecastRemainder, nonterminalEnglishReturn } from '../../core/status/language.js';
 import { IndeterminateError, InvalidInputError } from '../../core/errors/index.js';
+import { isPostiAbroadLabel } from '../../carriers/posti/identity.js';
 const STAGES = {
     InfoReceived: 'registered', InTransit: 'in_transit', AvailableForPickup: 'ready_for_pickup',
     OutForDelivery: 'out_for_delivery', DeliveryFailure: 'failed_attempt', Delivered: 'delivered',
@@ -35,10 +36,13 @@ export function isNotice(description) {
 export function hasPrivateDeliveryDetails(description) {
     return /\bpin\s*:|(?:access|security|pickup|collection) code|(?:door|house) (?:no\b|number)|signed (?:for )?by|signature|numero civico|firmato da|signe par|signé par|code (?:de retrait|d['’]acc[eè]s)|num[eé]ro de (?:rue|maison)|abholcode|zugangscode|hausnummer|unterschrieben von|codice (?:di ritiro|di accesso)|c[oó]digo (?:pin|secreto|de (?:recogida|retirada|retiro|acceso|acesso|entrega|seguridad|seguran[cç]a|levantamento|recolha|desbloqueo|desbloqueio|apertura|abertura))|firmad[oa] por|firma del destinatari|assinad[oa] por|assinatura|n[uú]mero (?:de (?:portal|puerta|casa|piso|vivienda|pol[ií]cia)|da (?:porta|casa))|(?:porta|puerta) n\.?\s?[º°]|n\.?\s?[º°] (?:de |da )?porta/i.test(description);
 }
-/** The place a provider reports for a scan, unless it holds private delivery details. */
+/**
+ * The place a provider reports for a scan, unless it holds private delivery
+ * details or is Posti's "abroad" label.
+ */
 export function place(value) {
     const location = text(value).slice(0, 200);
-    return location && !hasPrivateDeliveryDetails(location) ? location : '';
+    return location && !hasPrivateDeliveryDetails(location) && !isPostiAbroadLabel(location) ? location : '';
 }
 function sourceEventStage(description, includeBroadMovement = true) {
     // Public aggregators retain the carrier's French wording even in English.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "universal-parcel-scraper",
-  "version": "0.49.2-main.558",
+  "version": "0.49.2-main.561",
   "description": "Self-hosted parcel tracking: carrier detection, dedicated scrapers and optional universal providers.",
   "type": "module",
   "license": "Apache-2.0",