@ardennguyen/zalo-agent-cli 1.0.7 → 2.1.0

package/node_modules/zca-js/dist/apis/loginQR.d.ts

@@ -0,0 +1,71 @@
+import { type SerializedCookie, type SerializedCookieJar } from "tough-cookie";
+import type { ContextBase } from "../context.js";
+export declare enum LoginQRCallbackEventType {
+    QRCodeGenerated = 0,
+    QRCodeExpired = 1,
+    QRCodeScanned = 2,
+    QRCodeDeclined = 3,
+    GotLoginInfo = 4
+}
+export type LoginQRCallbackEvent = {
+    type: LoginQRCallbackEventType.QRCodeGenerated;
+    data: {
+        code: string;
+        image: string;
+        options: {
+            enabledCheckOCR: boolean;
+            enabledMultiLayer: boolean;
+        };
+        token: string;
+    };
+    actions: {
+        saveToFile: (qrPath?: string) => Promise<unknown>;
+        retry: () => unknown;
+        abort: () => unknown;
+    };
+} | {
+    type: LoginQRCallbackEventType.QRCodeExpired;
+    data: null;
+    actions: {
+        retry: () => unknown;
+        abort: () => unknown;
+    };
+} | {
+    type: LoginQRCallbackEventType.QRCodeScanned;
+    data: {
+        avatar: string;
+        display_name: string;
+    };
+    actions: {
+        retry: () => unknown;
+        abort: () => unknown;
+    };
+} | {
+    type: LoginQRCallbackEventType.QRCodeDeclined;
+    data: {
+        code: string;
+    };
+    actions: {
+        retry: () => unknown;
+        abort: () => unknown;
+    };
+} | {
+    type: LoginQRCallbackEventType.GotLoginInfo;
+    data: {
+        cookie: SerializedCookie[];
+        imei: string;
+        userAgent: string;
+    };
+    actions: null;
+};
+export type LoginQRCallback = (event: LoginQRCallbackEvent) => unknown;
+export declare function loginQR(ctx: ContextBase, options: {
+    userAgent: string;
+    qrPath?: string;
+}, callback?: LoginQRCallback): Promise<{
+    userInfo: {
+        name: string;
+        avatar: string;
+    };
+    cookies: SerializedCookieJar["cookies"];
+} | null>;

package/node_modules/zca-js/dist/apis/loginQR.js

@@ -0,0 +1,376 @@
+import { CookieJar } from "tough-cookie";
+import { writeFile } from "node:fs/promises";
+import { ZaloApiError } from "../Errors/ZaloApiError.js";
+import { logger, request } from "../utils.js";
+import { ZaloApiLoginQRAborted } from "../Errors/ZaloApiLoginQRAborted.js";
+import { ZaloApiLoginQRDeclined } from "../Errors/ZaloApiLoginQRDeclined.js";
+export var LoginQRCallbackEventType;
+(function (LoginQRCallbackEventType) {
+    LoginQRCallbackEventType[LoginQRCallbackEventType["QRCodeGenerated"] = 0] = "QRCodeGenerated";
+    LoginQRCallbackEventType[LoginQRCallbackEventType["QRCodeExpired"] = 1] = "QRCodeExpired";
+    LoginQRCallbackEventType[LoginQRCallbackEventType["QRCodeScanned"] = 2] = "QRCodeScanned";
+    LoginQRCallbackEventType[LoginQRCallbackEventType["QRCodeDeclined"] = 3] = "QRCodeDeclined";
+    LoginQRCallbackEventType[LoginQRCallbackEventType["GotLoginInfo"] = 4] = "GotLoginInfo";
+})(LoginQRCallbackEventType || (LoginQRCallbackEventType = {}));
+// Client Hints (sec-ch-ua*) for the QR-login handshake, derived from
+// ctx.secChUa/secChUaPlatform/secChUaMobile when the caller supplies them
+// (see zalo-agent-cli's device-fingerprint generator), falling back to the
+// original hardcoded Chrome-130/Windows literals otherwise — so behavior is
+// unchanged for any caller that doesn't set these ctx fields.
+//
+// Why this exists: the User-Agent header sent for this whole handshake
+// (ctx.userAgent, defaulted in zalo.js to a Firefox UA string) previously
+// had NO relationship to these sec-ch-ua values at all — every request
+// claimed "Firefox/133.0" in User-Agent while separately, unconditionally
+// claiming Chromium/Chrome v130 via Client Hints. Real browsers never
+// produce that combination (Firefox doesn't send sec-ch-ua headers), and
+// it was identical across every zca-js install on earth regardless of what
+// was actually running the CLI. Deriving these from the same ctx fields
+// the caller controls for userAgent keeps the whole fingerprint internally
+// consistent.
+function secChUaHeaders(ctx) {
+    var _a, _b, _c;
+    return {
+        "sec-ch-ua": (_a = ctx.secChUa) !== null && _a !== void 0 ? _a : '"Chromium";v="130", "Google Chrome";v="130", "Not?A_Brand";v="99"',
+        "sec-ch-ua-mobile": (_b = ctx.secChUaMobile) !== null && _b !== void 0 ? _b : "?0",
+        "sec-ch-ua-platform": (_c = ctx.secChUaPlatform) !== null && _c !== void 0 ? _c : '"Windows"',
+    };
+}
+async function loadLoginPage(ctx) {
+    const response = await request(ctx, "https://id.zalo.me/account?continue=https%3A%2F%2Fchat.zalo.me%2F", {
+        headers: Object.assign({ accept: "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5", "cache-control": "max-age=0", priority: "u=0, i" }, secChUaHeaders(ctx), {
+            "sec-fetch-dest": "document",
+            "sec-fetch-mode": "navigate",
+            "sec-fetch-site": "same-site",
+            "sec-fetch-user": "?1",
+            "upgrade-insecure-requests": "1",
+            Referer: "https://chat.zalo.me/",
+            "Referrer-Policy": "strict-origin-when-cross-origin",
+        }),
+        method: "GET",
+    });
+    const html = await response.text();
+    const regex = /https:\/\/stc-zlogin\.zdn\.vn\/main-([\d.]+)\.js/;
+    const match = html.match(regex);
+    return match === null || match === void 0 ? void 0 : match[1];
+}
+// `continue` target for the id.zalo.me SSO handshake — "https://zalo.me/pc"
+// on getLoginInfo/verifyClient/generate, distinct from loadLoginPage/
+// waitingScan/waitingConfirm/checkSession's "https://chat.zalo.me/". TWO
+// live-tested attempts (2026-09-19) to unify these on "chat.zalo.me/" both
+// broke QR generation outright (phone reports the QR invalid/unreadable on
+// scan), even after adding the `cliGenQR=1` flag a live capture of the real
+// web client showed on its generate() call. Reverted both times. Whatever
+// the real server-side check is, it isn't fully explained by this request's
+// body fields alone — plausibly something header- or cookie-level from an
+// actual browser session (a CSRF/anti-forgery token embedded in the real
+// loadLoginPage HTML response and echoed back on later calls, which this
+// library never reads because it only regex-extracts the login version out
+// of that HTML — or an Origin/sec-fetch header combination a non-browser
+// HTTP client can't authentically reproduce). Leave `continue` alone here;
+// don't re-attempt this without capturing full REQUEST headers (not just
+// body) from a real browser session for comparison, not just the body.
+async function getLoginInfo(ctx, version) {
+    const form = new URLSearchParams();
+    form.append("continue", "https://zalo.me/pc");
+    form.append("v", version);
+    return await request(ctx, "https://id.zalo.me/account/logininfo", {
+        headers: Object.assign({ accept: "*/*", "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5", "content-type": "application/x-www-form-urlencoded", priority: "u=1, i" }, secChUaHeaders(ctx), {
+            "sec-fetch-dest": "empty",
+            "sec-fetch-mode": "cors",
+            "sec-fetch-site": "same-origin",
+            Referer: "https://id.zalo.me/account?continue=https%3A%2F%2Fzalo.me%2Fpc",
+            "Referrer-Policy": "strict-origin-when-cross-origin",
+        }),
+        body: form,
+        method: "POST",
+    })
+        .then((res) => res.json())
+        .catch(logger(ctx).error);
+}
+async function verifyClient(ctx, version) {
+    const form = new URLSearchParams();
+    form.append("type", "device");
+    form.append("continue", "https://zalo.me/pc");
+    form.append("v", version);
+    return await request(ctx, "https://id.zalo.me/account/verify-client", {
+        headers: Object.assign({ accept: "*/*", "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5", "content-type": "application/x-www-form-urlencoded", priority: "u=1, i" }, secChUaHeaders(ctx), {
+            "sec-fetch-dest": "empty",
+            "sec-fetch-mode": "cors",
+            "sec-fetch-site": "same-origin",
+            Referer: "https://id.zalo.me/account?continue=https%3A%2F%2Fzalo.me%2Fpc",
+            "Referrer-Policy": "strict-origin-when-cross-origin",
+        }),
+        body: form,
+        method: "POST",
+    })
+        .then((res) => res.json())
+        .catch(logger(ctx).error);
+}
+async function generate(ctx, version) {
+    const form = new URLSearchParams();
+    form.append("continue", "https://zalo.me/pc");
+    form.append("v", version);
+    return await request(ctx, "https://id.zalo.me/account/authen/qr/generate", {
+        headers: Object.assign({ accept: "*/*", "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5", "content-type": "application/x-www-form-urlencoded", priority: "u=1, i" }, secChUaHeaders(ctx), {
+            "sec-fetch-dest": "empty",
+            "sec-fetch-mode": "cors",
+            "sec-fetch-site": "same-origin",
+            Referer: "https://id.zalo.me/account?continue=https%3A%2F%2Fzalo.me%2Fpc",
+            "Referrer-Policy": "strict-origin-when-cross-origin",
+        }),
+        body: form,
+        method: "POST",
+    })
+        .then((res) => res.json())
+        .catch(logger(ctx).error);
+}
+async function saveQRCodeToFile(filepath, imageData) {
+    await writeFile(filepath, imageData, "base64");
+}
+async function waitingScan(ctx, version, code, signal) {
+    const form = new URLSearchParams();
+    form.append("code", code);
+    form.append("continue", "https://chat.zalo.me/");
+    form.append("v", version);
+    return await request(ctx, "https://id.zalo.me/account/authen/qr/waiting-scan", {
+        headers: Object.assign({ accept: "*/*", "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5", "content-type": "application/x-www-form-urlencoded", priority: "u=1, i" }, secChUaHeaders(ctx), {
+            "sec-fetch-dest": "empty",
+            "sec-fetch-mode": "cors",
+            "sec-fetch-site": "same-origin",
+            Referer: "https://id.zalo.me/account?continue=https%3A%2F%2Fchat.zalo.me%2F",
+            "Referrer-Policy": "strict-origin-when-cross-origin",
+        }),
+        body: form,
+        method: "POST",
+        signal,
+    })
+        .then((res) => res.json())
+        .then((data) => {
+        if (data.error_code == 8) {
+            return waitingScan(ctx, version, code, signal);
+        }
+        return data;
+    })
+        .catch((e) => {
+        if (!signal.aborted)
+            logger(ctx).error(e);
+    });
+}
+async function waitingConfirm(ctx, version, code, signal) {
+    // Live-captured 2026-09-19 from the real chat.zalo.me/id.zalo.me web
+    // client: its waiting-confirm request body is ONLY continue+code+v (the
+    // same three fields waitingScan sends) — never gToken/gAction. Sending
+    // those two extra, real-client-never-sends fields (as upstream zca-js
+    // did) is very likely why a decline on the phone was never observed
+    // here: the real client's identical 3-field long-poll got error_code
+    // -13 back in a single ~8s round trip the moment the phone declined,
+    // while zca-js kept getting error_code 8 (busy-wait) over and over
+    // until the outer 100s QR timer killed the whole login attempt. Dropped
+    // to match the real client exactly.
+    const form = new URLSearchParams();
+    form.append("code", code);
+    form.append("continue", "https://chat.zalo.me/");
+    form.append("v", version);
+    logger(ctx).info("Please confirm on your phone");
+    return await request(ctx, "https://id.zalo.me/account/authen/qr/waiting-confirm", {
+        headers: Object.assign({ accept: "*/*", "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5", "content-type": "application/x-www-form-urlencoded", priority: "u=1, i" }, secChUaHeaders(ctx), {
+            "sec-fetch-dest": "empty",
+            "sec-fetch-mode": "cors",
+            "sec-fetch-site": "same-origin",
+            Referer: "https://id.zalo.me/account?continue=https%3A%2F%2Fchat.zalo.me%2F",
+            "Referrer-Policy": "strict-origin-when-cross-origin",
+        }),
+        body: form,
+        method: "POST",
+        signal,
+    })
+        .then((res) => res.json())
+        .then((data) => {
+        if (data.error_code == 8) {
+            return waitingConfirm(ctx, version, code, signal);
+        }
+        return data;
+    })
+        .catch((e) => {
+        if (!signal.aborted)
+            logger(ctx).error(e);
+    });
+}
+async function checkSession(ctx) {
+    return await request(ctx, "https://id.zalo.me/account/checksession?continue=https%3A%2F%2Fchat.zalo.me%2Findex.html", {
+        headers: Object.assign({ accept: "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5", priority: "u=0, i" }, secChUaHeaders(ctx), {
+            "sec-fetch-dest": "document",
+            "sec-fetch-mode": "navigate",
+            "sec-fetch-site": "same-origin",
+            "upgrade-insecure-requests": "1",
+            Referer: "https://id.zalo.me/account?continue=https%3A%2F%2Fchat.zalo.me%2F",
+            "Referrer-Policy": "strict-origin-when-cross-origin",
+        }),
+        redirect: "manual",
+        method: "GET",
+    }).catch(logger(ctx).error);
+}
+async function getUserInfo(ctx) {
+    return await request(ctx, "https://jr.chat.zalo.me/jr/userinfo", {
+        headers: Object.assign({ accept: "*/*", "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5", priority: "u=1, i" }, secChUaHeaders(ctx), {
+            "sec-fetch-dest": "empty",
+            "sec-fetch-mode": "cors",
+            "sec-fetch-site": "same-site",
+            Referer: "https://chat.zalo.me/",
+            "Referrer-Policy": "strict-origin-when-cross-origin",
+        }),
+        method: "GET",
+    })
+        .then((res) => res.json())
+        .catch(logger(ctx).error);
+}
+export async function loginQR(ctx, options, callback) {
+    ctx.cookie = new CookieJar();
+    ctx.userAgent = options.userAgent;
+    // See secChUaHeaders() above — falls back to the original hardcoded
+    // Chrome-130/Windows literals when the caller (an older zalo-agent-cli,
+    // or any other zca-js consumer) doesn't pass these, so this is purely
+    // additive and doesn't change behavior for anyone not opting in.
+    ctx.secChUa = options.secChUa;
+    ctx.secChUaPlatform = options.secChUaPlatform;
+    ctx.secChUaMobile = options.secChUaMobile;
+    return new Promise(async (resolve, reject) => {
+        var _a;
+        const controller = new AbortController();
+        let qrTimeout = null;
+        function cleanUp() {
+            controller.abort();
+            if (qrTimeout) {
+                clearTimeout(qrTimeout);
+                qrTimeout = null;
+            }
+        }
+        try {
+            function retry() {
+                cleanUp();
+                return resolve(loginQR(ctx, options, callback));
+            }
+            function abort() {
+                cleanUp();
+                return reject(new ZaloApiLoginQRAborted());
+            }
+            if (ctx.options.logging)
+                console.log();
+            const loginVersion = await loadLoginPage(ctx);
+            if (!loginVersion)
+                throw new ZaloApiError("Cannot get API login version");
+            logger(ctx).info("Got login version:", loginVersion);
+            await getLoginInfo(ctx, loginVersion);
+            await verifyClient(ctx, loginVersion);
+            const qrGenResult = await generate(ctx, loginVersion);
+            if (!qrGenResult || !qrGenResult.data)
+                throw new ZaloApiError(`Unable to generate QRCode\nResponse: ${JSON.stringify(qrGenResult, null, 2)}`);
+            const qrData = qrGenResult.data;
+            if (callback) {
+                callback({
+                    type: LoginQRCallbackEventType.QRCodeGenerated,
+                    data: Object.assign(Object.assign({}, qrGenResult.data), { image: qrGenResult.data.image.replace(/^data:image\/png;base64,/, "") }),
+                    actions: {
+                        async saveToFile(qrPath) {
+                            var _a;
+                            if (qrPath === void 0) { qrPath = (_a = options.qrPath) !== null && _a !== void 0 ? _a : "qr.png"; }
+                            await saveQRCodeToFile(qrPath, qrData.image.replace(/^data:image\/png;base64,/, ""));
+                            logger(ctx).info("Scan the QR code at", `'${qrPath}'`, "to proceed with login");
+                        },
+                        retry,
+                        abort,
+                    },
+                });
+            }
+            else {
+                const qrPath = (_a = options.qrPath) !== null && _a !== void 0 ? _a : "qr.png";
+                await saveQRCodeToFile(qrPath, qrData.image.replace(/^data:image\/png;base64,/, ""));
+                logger(ctx).info("Scan the QR code at", `'${qrPath}'`, "to proceed with login");
+            }
+            qrTimeout = setTimeout(() => {
+                cleanUp();
+                logger(ctx).info("QR expired!");
+                if (callback) {
+                    callback({
+                        type: LoginQRCallbackEventType.QRCodeExpired,
+                        data: null,
+                        actions: {
+                            retry,
+                            abort,
+                        },
+                    });
+                }
+                else {
+                    retry();
+                }
+            }, 100000);
+            const scanResult = await waitingScan(ctx, loginVersion, qrGenResult.data.code, controller.signal);
+            if (!scanResult || !scanResult.data)
+                throw new ZaloApiError("Cannot get scan result");
+            if (callback) {
+                callback({
+                    type: LoginQRCallbackEventType.QRCodeScanned,
+                    data: scanResult.data,
+                    actions: {
+                        retry,
+                        abort,
+                    },
+                });
+            }
+            const confirmResult = await waitingConfirm(ctx, loginVersion, qrGenResult.data.code, controller.signal);
+            if (!confirmResult)
+                throw new ZaloApiError("Cannot get confirm result");
+            clearTimeout(qrTimeout);
+            if (confirmResult.error_code == -13) {
+                // Decline is a terminal state — settle the outer Promise
+                // either way. Upstream zca-js only rejected in the
+                // no-callback branch; with a callback, it fired the
+                // QRCodeDeclined event and then just `return`ed, leaving
+                // the Promise this function returns permanently pending
+                // (the caller's `await loginQR(...)` — e.g.
+                // zalo-agent-cli's `await loginWithQR(...)` — would hang
+                // until the unrelated 100s qrTimeout eventually fired,
+                // misreporting the decline as an expiry). Now the callback
+                // (when present) still fires first for UI purposes, but
+                // this always rejects afterward so the promise settles
+                // immediately.
+                if (callback) {
+                    callback({
+                        type: LoginQRCallbackEventType.QRCodeDeclined,
+                        data: {
+                            code: qrData.code,
+                        },
+                        actions: {
+                            retry,
+                            abort,
+                        },
+                    });
+                }
+                logger(ctx).error("QRCode login declined");
+                cleanUp();
+                return reject(new ZaloApiLoginQRDeclined());
+            }
+            else if (confirmResult.error_code != 0) {
+                throw new ZaloApiError(`An error has occurred.\nResponse: ${JSON.stringify(confirmResult, null, 2)}`);
+            }
+            const checkSessionResult = await checkSession(ctx);
+            if (!checkSessionResult)
+                throw new ZaloApiError("Cannot get session, login failed");
+            logger(ctx).info("Successfully logged into the account", scanResult.data.display_name);
+            const userInfo = await getUserInfo(ctx);
+            if (!userInfo || !userInfo.data)
+                throw new ZaloApiError("Can't get account info");
+            if (!userInfo.data.logged)
+                throw new ZaloApiError("Can't login");
+            resolve({
+                cookies: ctx.cookie.toJSON().cookies,
+                userInfo: userInfo.data.info,
+            });
+        }
+        catch (error) {
+            cleanUp();
+            reject(error);
+        }
+    });
+}

package/node_modules/zca-js/dist/apis/logoutV2.js

@@ -0,0 +1,79 @@
+import { ZaloApiError } from "../Errors/ZaloApiError.js";
+import { apiFactory } from "../utils.js";
+
+// CONFIRMED live 2026-09-19 against a real account. Mirrors Zalo Web's own
+// `ServiceURL.logoutV2(imei, compId?)` (commandId 12743, POST
+// /api/v2/login/logOut), reverse-engineered from the production webpack
+// bundle:
+//   static logoutV2(e,t=void 0){
+//     const a = _.b.getDevDomainV3() + "/api/v2/login/logOut?" + this._getCommonParams();
+//     let s = { time, imei: e, computer_name, language };
+//     if (t !== void 0) s.compId = t;
+//     return this._post(a, "params=" + encodeURIComponent(encodeAES(JSON.stringify(s))), null, 12743);
+//   }
+//
+// DOMAIN — resolved by trial (each guess live-tested against a real
+// account):
+//   1. `zpwServiceMap.aext` (aextra-wpa.chat.zalo.me) — the accessor
+//      `getListDevice` uses. DISPROVEN: real HTTP 404.
+//   2. `zpwServiceMap.zavi` (wpa.zaloapp.com) — DISPROVEN: reachable, but a
+//      real API error ({error_code:102, "session key was improperly
+//      submitted..."}) — `zaloapp.com` is a different registrable domain
+//      from `zalo.me`, so the zpw_sek session cookie (scoped to `.zalo.me`)
+//      never reached it.
+//   3. `https://wpa.chat.zalo.me` (HARDCODED, not from zpwServiceMap) —
+//      CONFIRMED CORRECT, live-tested 2026-09-19. Matches `getSettings.js`
+//      in this same package (a genuinely working, authenticated,
+//      hardcoded-domain call) and the known hardcoded PRE-login host this
+//      package's `login.js` already uses. Live response:
+//      `{"error_code":0,"error_message":"Successful.","data":1}`.
+//   4. `https://stg-wpa.chat.zalo.me` — what the real production webpack
+//      bundle's `getDevDomainV3()` singleton actually returned when called
+//      live in-browser 2026-09-18 (via webpack-jsonp module-cache capture,
+//      zero real requests made). CONFIRMED CORRECT end-to-end, live-tested
+//      2026-09-19 via a real `logout --purge`: "Server session invalidated
+//      for imei e239d3d5…", no fallback warning — a real authenticated
+//      call against this domain, not just the direct-call capture. ACTIVE
+//      BELOW. Candidate #3 above is left documented as the previously-
+//      confirmed fallback in case this domain is ever retired/changed, but
+//      is no longer needed.
+//
+// ENCRYPTION — the response body above is CONFIRMED to be plain JSON, not
+// the usual AES-encrypted `data` field most zca-js API responses use.
+// `utils.resolve()` defaults to `isEncrypted = true`, which tried to
+// AES-decrypt the literal number `1` and, because crypto-js silently
+// returns an empty string on bad ciphertext/padding rather than throwing,
+// produced "Failed to parse response data: SyntaxError: Unexpected end of
+// JSON input" (from `JSON.parse("")`) even though the call had already
+// succeeded server-side. Fixed by passing `isEncrypted = false` to
+// `utils.resolve()` here so `result.data` is used as-is.
+//
+// (Earlier iterations of this file also had a real bug where
+// `utils.resolve(response)` was called without `await` — since it wraps
+// an `async function`, that returned a pending Promise instead of the
+// actual result, which silently broke a since-removed multi-candidate
+// fallback loop. Not relevant now that the domain is confirmed and this
+// is back to a single direct call, but noted here in case this file ever
+// grows a retry/fallback again: always `await utils.resolve(...)`.)
+export const logoutV2Factory = apiFactory()((api, ctx, utils) => {
+    const serviceURL = utils.makeURL("https://stg-wpa.chat.zalo.me/api/v2/login/logOut");
+    return async function logoutV2(compId = undefined) {
+        const params = {
+            time: Date.now(),
+            imei: ctx.imei,
+            computer_name: "Web",
+            language: ctx.language || "vi"
+        };
+        if (compId !== undefined) params.compId = compId;
+        const encryptedParams = utils.encodeAES(JSON.stringify(params));
+        if (!encryptedParams) throw new ZaloApiError("Failed to encrypt message");
+        const response = await utils.request(serviceURL, {
+            method: "POST",
+            body: new URLSearchParams({
+                params: encryptedParams,
+            }),
+        });
+        // isEncrypted = false — see the file header note above.
+        return await utils.resolve(response, undefined, false);
+    };
+});

package/node_modules/zca-js/dist/apis/lostFocus.d.ts

@@ -0,0 +1,4 @@
+export type LostFocusResponse = {
+    status: boolean;
+};
+export declare const lostFocusFactory: (ctx: import("../context.js").ContextBase, api: import("../apis.js").API) => () => Promise<LostFocusResponse>;

package/node_modules/zca-js/dist/apis/lostFocus.js

@@ -0,0 +1,23 @@
+import { ZaloApiError } from "../Errors/ZaloApiError.js";
+import { apiFactory } from "../utils.js";
+export const lostFocusFactory = apiFactory()((api, _ctx, utils) => {
+    const serviceURL = utils.makeURL(`${api.zpwServiceMap.profile[0]}/api/social/profile/changefgtobg`);
+    /**
+     * Lost focus
+     *
+     * @throws {ZaloApiError}
+     */
+    return async function lostFocus() {
+        const params = {};
+        const encryptedParams = utils.encodeAES(JSON.stringify(params));
+        if (!encryptedParams)
+            throw new ZaloApiError("Failed to encrypt params");
+        const response = await utils.request(serviceURL, {
+            method: "POST",
+            body: new URLSearchParams({
+                params: encryptedParams,
+            }),
+        });
+        return utils.resolve(response);
+    };
+});

package/node_modules/zca-js/dist/apis/parseLink.d.ts

@@ -0,0 +1,21 @@
+export type ParseLinkErrorMaps = Record<string, number>;
+export type ParseLinkResponse = {
+    data: {
+        thumb: string;
+        title: string;
+        desc: string;
+        src: string;
+        href: string;
+        media: {
+            type: number;
+            count: number;
+            mediaTitle: string;
+            artist: string;
+            streamUrl: string;
+            stream_icon: string;
+        };
+        stream_icon: string;
+    };
+    error_maps: ParseLinkErrorMaps;
+};
+export declare const parseLinkFactory: (ctx: import("../context.js").ContextBase, api: import("../apis.js").API) => (link: string) => Promise<ParseLinkResponse>;

package/node_modules/zca-js/dist/apis/parseLink.js

@@ -0,0 +1,27 @@
+import { ZaloApiError } from "../Errors/ZaloApiError.js";
+import { apiFactory } from "../utils.js";
+export const parseLinkFactory = apiFactory()((api, ctx, utils) => {
+    const serviceURL = utils.makeURL(`${api.zpwServiceMap.file[0]}/api/message/parselink`);
+    /**
+     * Parse link
+     *
+     * @param link link to parse
+     *
+     * @throws {ZaloApiError}
+     *
+     */
+    return async function parseLink(link) {
+        const params = {
+            link,
+            version: 1, // version 0 is not available errorMaps || version 1 is errorMaps (for response)
+            imei: ctx.imei,
+        };
+        const encryptedParams = utils.encodeAES(JSON.stringify(params));
+        if (!encryptedParams)
+            throw new ZaloApiError("Failed to encrypt params");
+        const response = await utils.request(utils.makeURL(serviceURL, { params: encryptedParams }), {
+            method: "GET",
+        });
+        return utils.resolve(response);
+    };
+});

package/node_modules/zca-js/dist/apis/pullMobileMsg.js

@@ -0,0 +1,22 @@
+import { ZaloApiError } from "../Errors/ZaloApiError.js";
+import { apiFactory } from "../utils.js";
+
+export const pullMobileMsgFactory = apiFactory()((api, _, utils) => {
+    const serviceURL = utils.makeURL(`${api.zpwServiceMap.file[0]}/api/message/pull_mobile_msg`);
+    return async function pullMobileMsg(publicKey, fromSeqId = 0, isRetry = 0, tempKey = "") {
+        const params = {
+            pc_name: "Web",
+            public_key: publicKey,
+            from_seq_id: fromSeqId,
+            is_retry: isRetry,
+            min_seq_id: 0,
+            temp_key: tempKey
+        };
+        const encryptedParams = utils.encodeAES(JSON.stringify(params));
+        if (!encryptedParams) throw new ZaloApiError("Failed to encrypt message");
+        const response = await utils.request(`${serviceURL}&params=${encodeURIComponent(encryptedParams)}`, {
+            method: "GET"
+        });
+        return utils.resolve(response);
+    };
+});

package/node_modules/zca-js/dist/apis/registerCatalog.d.ts

@@ -0,0 +1,2 @@
+export type RegisterCatalogResponse = "";
+export declare const registerCatalogFactory: (ctx: import("../context.js").ContextBase, api: import("../apis.js").API) => (enable: boolean) => Promise<"">;

package/node_modules/zca-js/dist/apis/registerCatalog.js

@@ -0,0 +1,27 @@
+import { ZaloApiError } from "../Errors/ZaloApiError.js";
+import { apiFactory } from "../utils.js";
+export const registerCatalogFactory = apiFactory()((api, _ctx, utils) => {
+    const serviceURL = utils.makeURL(`${api.zpwServiceMap.catalog[0]}/api/prodcatalog/catalog/register`);
+    /**
+     * Register catalog?
+     *
+     * @param enable enable or disable catalog
+     *
+     * @throws {ZaloApiError}
+     */
+    return async function registerCatalog(enable) {
+        const params = {
+            enable: enable ? 1 : 0,
+        };
+        const encryptedParams = utils.encodeAES(JSON.stringify(params));
+        if (!encryptedParams)
+            throw new ZaloApiError("Failed to encrypt params");
+        const response = await utils.request(serviceURL, {
+            method: "POST",
+            body: new URLSearchParams({
+                params: encryptedParams,
+            }),
+        });
+        return utils.resolve(response);
+    };
+});

package/node_modules/zca-js/dist/apis/rejectFriendRequest.d.ts

@@ -0,0 +1,2 @@
+export type RejectFriendRequestResponse = "";
+export declare const rejectFriendRequestFactory: (ctx: import("../context.js").ContextBase, api: import("../apis.js").API) => (friendId: string) => Promise<"">;