4 Commits

Include renames

Author	SHA1	Message	Date
flan	0a218acd45	Report the item a cart action actually acted on ... _cart_action scraped the first .item-name off the item page, which belongs to whatever is in the mini-cart rather than the item being added — so an add announced someone else's groceries in its event payload. Callers pass the name they resolved instead; verified by an add/remove round trip against a live order.	2026-08-03 20:23:49 +00:00
flan	5e9d721a0f	Add restore, and separate the produce box from add-ons ... Restore is POST /s/submit/restore-delivery, wired to switch.turn_off. Its popup only exists once an order is actually skipped, which is why it could not be found earlier; verified end to end by skipping Aug 18 and restoring it. Fixes two bugs found while testing that. async_fetch treated popup and AJAX fragments as full pages, so the signed-in heuristic read them as logged out and skip could never run. And the to-do list mixed box produce with add-ons, which would have invited deletes with no endpoint behind them: only add-ons are add/removable, so the entity is now scoped to those.	2026-08-03 20:20:15 +00:00
flan	551d3240a2	Add control entities: box to-do list, skip switch, donate button, subscriptions ... The to-do list exists so Home Assistant's own conversation agent can manage the order through HassListAddItem rather than through anything bespoke. Skip is a switch because skipped/not-skipped is state worth reading back; donate is a button because it cannot be undone. Un-skip raises rather than guessing at an endpoint that has never been observed. Fixes subscription parsing, which matched the heading row and so reported zero on an account that has one.	2026-08-03 20:13:32 +00:00
flan	213c16d98e	Add the write-action layer and a daily upstream compatibility check ... actions.py covers skip, donate, cart add/remove, subscriptions and vacation holds. Every mutating endpoint on the site is guarded by rotating per-render tokens, so each action re-derives them from a live page rather than storing anything; skip additionally compares the date the server states in its confirmation against the date it was asked to skip, and refuses on a mismatch. All actions default to dry_run. tools/compat.py records what the integration assumes about a site that offers no API and no stability contract, and CI asserts it daily. Only the unauthenticated surface is covered: checking the rest would mean putting a personal account password in public repo secrets.	2026-08-03 20:02:58 +00:00