xtrawl 0.1.1 → 0.1.3

package/dist/transport/transaction-id.js

@@ -1,3 +1,4 @@
+import { delay } from "../utils/abort.js";
 export class TransactionIdProvider {
     source;
     options;
@@ -45,7 +46,25 @@ export class TransactionIdProvider {
     async initialize() {
         try {
             const { ClientTransaction, fetchXDocument } = await import("x-client-transaction-id");
-            this.client = await withTimeout(fetchXDocument().then((document) => ClientTransaction.create(document)), 10_000);
+            // fetchXDocument cannot be cancelled. One bootstrap stays in-flight; a timeout
+            // abandons the wait and keeps the result if it later succeeds.
+            const work = fetchXDocument().then((document) => ClientTransaction.create(document));
+            const result = await Promise.race([
+                work.then((client) => ({ ok: true, client })),
+                delay(10_000).then(() => ({ ok: false })),
+            ]);
+            if (!result.ok) {
+                void work
+                    .then((client) => {
+                    this.client = client;
+                    this.readyAt = Date.now();
+                    this.retryAt = 0;
+                })
+                    .catch(() => undefined);
+                this.retryAt = Date.now() + 5 * 60_000;
+                return undefined;
+            }
+            this.client = result.client;
             this.readyAt = Date.now();
             this.retryAt = 0;
             return this.client;
@@ -56,19 +75,4 @@ export class TransactionIdProvider {
         }
     }
 }
-async function withTimeout(value, timeoutMs) {
-    let timer;
-    try {
-        return await Promise.race([
-            value,
-            new Promise((_resolve, reject) => {
-                timer = setTimeout(() => reject(new Error("Transaction bootstrap timed out.")), timeoutMs);
-            }),
-        ]);
-    }
-    finally {
-        if (timer)
-            clearTimeout(timer);
-    }
-}
 //# sourceMappingURL=transaction-id.js.map

package/dist/transport/transaction-id.js.map

@@ -1 +1 @@
-{"version":3,"file":"transaction-id.js","sourceRoot":"","sources":["../../src/transport/transaction-id.ts"],"names":[],"mappings":"AAWA,MAAM,OAAO,qBAAqB;IAOb;IACA;IAPX,MAAM,CAAqB;IAC3B,OAAO,GAAG,CAAC,CAAC;IACZ,OAAO,GAAG,CAAC,CAAC;IACZ,YAAY,CAA0C;IAE9D,YACmB,MAA4B,EAC5B,UAAgC,EAAE;QADlC,WAAM,GAAN,MAAM,CAAsB;QAC5B,YAAO,GAAP,OAAO,CAA2B;IAClD,CAAC;IAEG,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,GAAW;QAC1C,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAChE,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,qBAAqB,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;YACxB,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;YACjB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC;YACvC,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;QACxE,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QACvE,IAAI,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,SAAS,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC9D,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC;QACjC,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAChC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,CAAC;YACH,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;YACtF,IAAI,CAAC,MAAM,GAAG,MAAM,WAAW,CAC7B,cAAc,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EACvE,MAAM,CACP,CAAC;YACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC1B,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;YACjB,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC;YACvC,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF;AAED,KAAK,UAAU,WAAW,CAAI,KAAiB,EAAE,SAAiB;IAChE,IAAI,KAAgD,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,KAAK;YACL,IAAI,OAAO,CAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;gBAClC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YAC7F,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC"}
+{"version":3,"file":"transaction-id.js","sourceRoot":"","sources":["../../src/transport/transaction-id.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAK1C,MAAM,OAAO,qBAAqB;IAOb;IACA;IAPX,MAAM,CAAqB;IAC3B,OAAO,GAAG,CAAC,CAAC;IACZ,OAAO,GAAG,CAAC,CAAC;IACZ,YAAY,CAA0C;IAE9D,YACmB,MAA4B,EAC5B,UAAgC,EAAE;QADlC,WAAM,GAAN,MAAM,CAAsB;QAC5B,YAAO,GAAP,OAAO,CAA2B;IAClD,CAAC;IAEG,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,GAAW;QAC1C,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAChE,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,qBAAqB,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;YACxB,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;YACjB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC;YACvC,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;QACxE,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QACvE,IAAI,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,SAAS,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC9D,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC;QACjC,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAChC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,CAAC;YACH,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;YACtF,+EAA+E;YAC/E,+DAA+D;YAC/D,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YACrF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAChC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,MAAM,EAAE,CAAC,CAAC;gBACtD,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,CAAC,CAAC;aACnD,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,KAAK,IAAI;qBACN,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;oBACf,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;oBACrB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;oBAC1B,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;gBACnB,CAAC,CAAC;qBACD,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC1B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC;gBACvC,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC5B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC1B,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;YACjB,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC;YACvC,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF"}

package/dist/transport/types.d.ts

@@ -0,0 +1,28 @@
+import type { fetch as UndiciFetch } from "undici";
+import type { ProxySettings } from "../domain/accounts.js";
+import type { ApiHttpMode } from "../config/types.js";
+import type { SessionFactory } from "../domain/http.js";
+export interface SessionBuilderOptions {
+    readonly bearerToken: string;
+    readonly defaultProxy?: string | ProxySettings;
+    readonly userAgent?: string;
+    readonly httpMode?: ApiHttpMode;
+    readonly impersonate?: string;
+    readonly fetcher?: typeof UndiciFetch;
+    readonly factory?: SessionFactory;
+}
+export interface ReadableHttpResponse {
+    readonly body?: {
+        getReader(): ReadableStreamDefaultReader<Uint8Array>;
+        cancel?(reason?: unknown): Promise<void>;
+    } | null;
+    text(): Promise<string>;
+}
+export interface TransactionIdSource {
+    readonly create?: (method: string, url: string) => Promise<string | undefined>;
+}
+export interface TransactionIdOptions {
+    readonly enabled?: boolean;
+    readonly ttlMs?: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/transport/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/transport/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,QAAQ,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,aAAa,CAAC;IAC/C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,WAAW,CAAC;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC;CACnC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACd,SAAS,IAAI,2BAA2B,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC1C,GAAG,IAAI,CAAC;IACT,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAChF;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB"}

package/dist/transport/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/transport/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/transport/types.ts"],"names":[],"mappings":""}

package/dist/utils/abort.d.ts

@@ -0,0 +1,6 @@
+export declare function isAbortError(error: unknown): boolean;
+export declare function abortError(message?: string): Error;
+export declare function throwIfAborted(signal?: AbortSignal): void;
+export declare function combineSignals(...signals: Array<AbortSignal | undefined>): AbortSignal | undefined;
+export declare function delay(ms: number, signal?: AbortSignal): Promise<void>;
+//# sourceMappingURL=abort.d.ts.map

package/dist/utils/abort.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"abort.d.ts","sourceRoot":"","sources":["../../src/utils/abort.ts"],"names":[],"mappings":"AAAA,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEpD;AAED,wBAAgB,UAAU,CAAC,OAAO,SAA+B,GAAG,KAAK,CAIxE;AAED,wBAAgB,cAAc,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,CAEzD;AAED,wBAAgB,cAAc,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,WAAW,GAAG,SAAS,CAAC,GAAG,WAAW,GAAG,SAAS,CAMlG;AAED,wBAAsB,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB3E"}

package/dist/utils/abort.js

@@ -0,0 +1,45 @@
+export function isAbortError(error) {
+    return error instanceof Error && error.name === "AbortError";
+}
+export function abortError(message = "The operation was aborted.") {
+    const error = new Error(message);
+    error.name = "AbortError";
+    return error;
+}
+export function throwIfAborted(signal) {
+    if (signal?.aborted)
+        throw abortError();
+}
+export function combineSignals(...signals) {
+    const active = signals.filter((signal) => Boolean(signal));
+    const first = active[0];
+    if (!first)
+        return undefined;
+    if (active.length === 1)
+        return first;
+    return AbortSignal.any(active);
+}
+export async function delay(ms, signal) {
+    throwIfAborted(signal);
+    if (ms <= 0)
+        return;
+    await new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        const onAbort = () => {
+            clearTimeout(timer);
+            reject(abortError());
+        };
+        if (!signal)
+            return;
+        if (signal.aborted) {
+            clearTimeout(timer);
+            reject(abortError());
+            return;
+        }
+        signal.addEventListener("abort", onAbort, { once: true });
+    });
+}
+//# sourceMappingURL=abort.js.map

package/dist/utils/abort.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"abort.js","sourceRoot":"","sources":["../../src/utils/abort.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAO,GAAG,4BAA4B;IAC/D,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IACjC,KAAK,CAAC,IAAI,GAAG,YAAY,CAAC;IAC1B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAoB;IACjD,IAAI,MAAM,EAAE,OAAO;QAAE,MAAM,UAAU,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAG,OAAuC;IACvE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAyB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,EAAU,EAAE,MAAoB;IAC1D,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO;IACpB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QACvB,CAAC,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/utils/redact.d.ts

@@ -0,0 +1,5 @@
+import type { ProxySettings } from "../domain/accounts.js";
+export declare function redactProxy(proxy: string | ProxySettings): string | ProxySettings;
+export declare function redactText(value: string): string;
+export declare function redactUnknown(value: unknown): unknown;
+//# sourceMappingURL=redact.d.ts.map

package/dist/utils/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/utils/redact.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAI3D,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,GAAG,MAAM,GAAG,aAAa,CAejF;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUhD;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAUrD"}

package/dist/utils/redact.js

@@ -0,0 +1,42 @@
+const REDACTED = "[redacted]";
+export function redactProxy(proxy) {
+    if (typeof proxy !== "string")
+        return {
+            ...proxy,
+            ...(proxy.username ? { username: REDACTED } : {}),
+            ...(proxy.password ? { password: REDACTED } : {}),
+        };
+    try {
+        const value = new URL(proxy.includes("://") ? proxy : `http://${proxy}`);
+        if (value.username)
+            value.username = REDACTED;
+        if (value.password)
+            value.password = REDACTED;
+        return value.toString();
+    }
+    catch {
+        return REDACTED;
+    }
+}
+export function redactText(value) {
+    return value
+        .replace(/auth_token=[^;\s&]+/giu, `auth_token=${REDACTED}`)
+        .replace(/\bct0=[^;\s&]+/giu, `ct0=${REDACTED}`)
+        .replace(/Bearer\s+[A-Za-z0-9._%~+-]+/giu, `Bearer ${REDACTED}`)
+        .replace(/Cookie:\s*[^\n]+/giu, `Cookie: ${REDACTED}`)
+        .replace(/(?:password|passwd|secret|csrf|ct0|auth_token)\s*[:=]\s*([^\s,;]+)/giu, (match, secret) => match.replace(secret, REDACTED));
+}
+export function redactUnknown(value) {
+    if (typeof value === "string")
+        return redactText(value);
+    if (Array.isArray(value))
+        return value.map(redactUnknown);
+    if (!value || typeof value !== "object")
+        return value;
+    return Object.fromEntries(Object.entries(value).map(([key, child]) => {
+        if (/password|token|cookie|secret|authorization|csrf|proxy/iu.test(key))
+            return [key, REDACTED];
+        return [key, redactUnknown(child)];
+    }));
+}
+//# sourceMappingURL=redact.js.map

package/dist/utils/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/utils/redact.ts"],"names":[],"mappings":"AAEA,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B,MAAM,UAAU,WAAW,CAAC,KAA6B;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAC3B,OAAO;YACL,GAAG,KAAK;YACR,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC;IACJ,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;QACzE,IAAI,KAAK,CAAC,QAAQ;YAAE,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC9C,IAAI,KAAK,CAAC,QAAQ;YAAE,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC9C,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,KAAK;SACT,OAAO,CAAC,wBAAwB,EAAE,cAAc,QAAQ,EAAE,CAAC;SAC3D,OAAO,CAAC,mBAAmB,EAAE,OAAO,QAAQ,EAAE,CAAC;SAC/C,OAAO,CAAC,gCAAgC,EAAE,UAAU,QAAQ,EAAE,CAAC;SAC/D,OAAO,CAAC,qBAAqB,EAAE,WAAW,QAAQ,EAAE,CAAC;SACrD,OAAO,CACN,uEAAuE,EACvE,CAAC,KAAK,EAAE,MAAc,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAC3D,CAAC;AACN,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QACzC,IAAI,yDAAyD,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAChG,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CACH,CAAC;AACJ,CAAC"}

package/docs/architecture/overview.md

@@ -32,13 +32,16 @@ CLI / library facade
 - `pool` owns per-page leases, heartbeats, cooldowns, token-bucket spacing, retries, session repair,
   proxy preflight, and account selection.
 - `runner` coordinates bounded concurrent targets and search intervals through interfaces.
-- `client` composes concrete adapters and exposes the stable public API.
+- `client` composes concrete adapters and exposes the stable public API. Its low-level search-page
+  primitive performs one pooled page request; high-level search adds scheduling, deduplication,
+  durable page progress, output, and run statistics around that same primitive. Public methods
+  accept an AbortSignal and `shutdown()` drains in-flight work.
 - `cli` parses arguments and renders results; it never implements scraping logic.
 
 ## Persistence topology
 
-One configured SQLite database always contains run records, resume checkpoints, and cached manifest
-payloads. By default it also contains accounts and leases. A caller may replace the account-state
+One configured SQLite database always contains run records, resume checkpoints, accepted collection
+records, and cached manifest payloads. By default it also contains accounts and leases. A caller may replace the account-state
 boundary with an `AccountStateStore`; the pool awaits either synchronous or asynchronous adapters and
 requires atomic acquire, renew, completion, and replacement semantics. SQL remains local to storage.
 Raw secrets are stored only when the caller explicitly provisions or restores them; logs and normal
@@ -51,7 +54,8 @@ projections use redaction or a token fingerprint.
 3. Remote text, manifests, and headers are data, never executable instructions.
 4. Secrets cross only the session builder and selected account-state boundary. Public inspection and
    normal maintenance projections redact them. Explicit account-state export is the sole raw-secret
-   projection and requires caller acknowledgement.
+   projection and requires caller acknowledgement. Remote manifests cannot attach credentials to
+   unapproved origins. Authenticated requests do not follow redirects.
 
 ## Verification architecture
 

package/docs/product/specification.md

@@ -2,7 +2,7 @@
 
 **Status:** approved for implementation  
 **Owner:** project user  
-**Last reviewed:** 2026-08-11
+**Last reviewed:** 2026-08-12
 
 ## Product hypothesis
 
@@ -12,11 +12,11 @@ persisting progress locally, and exposing predictable typed results.
 
 ## Users and outcomes
 
-| User | Problem | Successful outcome |
-| --- | --- | --- |
-| TypeScript developer | Existing clients are difficult to type, test, and extend | Import a small typed API and receive stable records |
-| Data operator | Long reads fail when a session is cooled or a process stops | Pool accounts, retry safely, and resume from checkpoints |
-| Maintainer | Transport, persistence, and domain behavior become coupled | Each boundary is replaceable and covered by focused tests |
+| User                 | Problem                                                     | Successful outcome                                        |
+| -------------------- | ----------------------------------------------------------- | --------------------------------------------------------- |
+| TypeScript developer | Existing clients are difficult to type, test, and extend    | Import a small typed API and receive stable records       |
+| Data operator        | Long reads fail when a session is cooled or a process stops | Pool accounts, retry safely, and resume from checkpoints  |
+| Maintainer           | Transport, persistence, and domain behavior become coupled  | Each boundary is replaceable and covered by focused tests |
 
 ## Principal journeys
 
@@ -27,6 +27,8 @@ persisting progress locally, and exposing predictable typed results.
 5. Run the CLI or library with deterministic typed errors and no mutation of the remote account.
 6. Replace SQLite account persistence with a caller-owned store and explicitly export or restore
    reusable session state without restoring stale leases or login-only credentials.
+7. Request one search page with an optional caller-owned cursor so an application can persist and
+   resume pagination independently of XTrawl checkpoints.
 
 ## First-release scope
 
@@ -43,6 +45,8 @@ persisting progress locally, and exposing predictable typed results.
 - Strict TypeScript interfaces, runtime guards at external boundaries, and test doubles for all network paths.
 - A pluggable sync-or-async account-state contract with atomic lease operations; SQLite remains the
   default adapter while run history, checkpoints, and manifest cache remain local.
+- A low-level `searchPage()` method that supports the full search-filter vocabulary and returns
+  normalized posts plus an opaque `nextCursor`; high-level `search()` remains automatic.
 
 ## Explicit exclusions
 
@@ -81,7 +85,9 @@ persisting progress locally, and exposing predictable typed results.
 - [x] Harness structural validation and context-budget evaluation pass.
 - [x] A fresh agent can identify the current work and next action from `.harness/state/` without chat history.
 - [x] A caller-owned asynchronous account store can provision, lease, complete, export, and restore
-  account state through the public API, with deterministic contract tests.
+      account state through the public API, with deterministic contract tests.
+- [x] A caller can pass a search cursor, receive the next cursor, and paginate without creating run
+      records or reading and writing the internal checkpoint store.
 
 ## Open decisions
 
@@ -89,7 +95,11 @@ persisting progress locally, and exposing predictable typed results.
 - Async methods are the canonical library surface. A blocking synchronous wrapper is intentionally excluded because it would compromise Node event-loop safety.
 - Account-state snapshots require an explicit secret acknowledgement, are runtime validated and
   versioned, and exclude active leases plus password, email-password, and two-factor login fields.
+- `searchPage()` exposes normalized posts and only the opaque next cursor. Query metadata and
+  persistence remain caller-owned; `search()` composes the same page primitive for automatic runs.
 
 ## Immediate next action
 
-Keep the bundled manifest current and use the opt-in live suite after GraphQL protocol changes.
+Add the read-only MCP server for agent-harness operation after the recovery, cancellation, and
+credential-destination bounds. Keep credentials out of tool results and preserve account-pool
+limits. MCP remains a follow-on product task.

package/docs/security/data-boundary.md

@@ -17,6 +17,9 @@
 - HTTP, HTTPS, and SOCKS5 proxies are normalized and passed to the HTTP adapter. Health checks carry
   no session cookies, and proxy credentials are redacted from inspection and diagnostics.
 - External payloads are parsed as `unknown` and narrowed before use.
+- Remote manifests are untrusted. GraphQL endpoints must be HTTPS on an allowed X origin and a
+  read-only GraphQL path before session cookies, CSRF, or bearer tokens are attached. Authenticated
+  requests do not follow redirects. Tests may add synthetic origins through `allowedManifestOrigins`.
 
 ## Local state
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xtrawl",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Scrape public X posts, profiles, followers, and following",
   "license": "MIT",
   "type": "module",
@@ -62,6 +62,7 @@
     "package:check": "node scripts/package-check.mjs",
     "harness:validate": "python3 scripts/harness/validate.py",
     "harness:budget": "python3 scripts/harness/budget.py",
+    "bench": "npm run build && node scripts/bench.mjs",
     "prepack": "npm run build",
     "prepublishOnly": "npm run verify",
     "prepare": "husky"
@@ -76,13 +77,13 @@
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@types/jest": "^29.5.14",
-    "@types/node": "^25.2.3",
+    "@types/jest": "^30.0.0",
+    "@types/node": "^26.4.0",
     "@typescript-eslint/eslint-plugin": "^8.62.1",
     "@typescript-eslint/parser": "^8.62.1",
     "eslint": "^10.6.0",
     "husky": "^9.1.7",
-    "jest": "^29.7.0",
+    "jest": "^30.5.0",
     "prettier": "^3.9.4",
     "ts-jest": "^29.3.4",
     "typescript": "^5.9.3"