@ih8e/express-cli 0.1.0

package/dist/index.js

@@ -0,0 +1,4056 @@
+#!/usr/bin/env node
+
+// src/cli/root.ts
+import { Command as Command15 } from "commander";
+
+// src/cli/auth.ts
+import { Command } from "commander";
+
+// src/types/config.ts
+import { z } from "zod";
+var configSchema = z.object({
+  host: z.string().min(1, "host is required \u2014 set EXPRESS_HOST or configure via `express config set host <host>`"),
+  protocol: z.enum(["https", "http"]).default("https"),
+  token: z.string().optional(),
+  locale: z.string().default("ru"),
+  platform: z.string().default("web"),
+  platform_package_id: z.string().default("ru.alfabank"),
+  app_version: z.string().default("3.66.47"),
+  output: z.enum(["table", "json"]).default("table")
+});
+var envSchema = z.object({
+  EXPRESS_HOST: z.string().optional(),
+  EXPRESS_TOKEN: z.string().optional(),
+  EXPRESS_LOCALE: z.string().optional(),
+  EXPRESS_OUTPUT: z.enum(["table", "json"]).optional()
+});
+
+// src/config/store.ts
+import Conf from "conf";
+var store = new Conf({
+  projectName: "express-cli",
+  defaults: {
+    config: {},
+    authToken: null,
+    refreshToken: null,
+    rtsAuthToken: null,
+    apigwKeys: null,
+    tokenExpiresAt: null,
+    etsAuthToken: null
+  }
+});
+function getStoredConfig() {
+  return store.get("config") ?? {};
+}
+function setStoredConfig(partial) {
+  const current = getStoredConfig();
+  store.set("config", { ...current, ...partial });
+}
+function getAuthToken() {
+  return store.get("authToken") ?? null;
+}
+function setAuthToken(token) {
+  if (token === null) {
+    store.delete("authToken");
+  } else {
+    store.set("authToken", token);
+  }
+}
+function getRtsAuthToken() {
+  return store.get("rtsAuthToken") ?? null;
+}
+function setRtsAuthToken(token) {
+  if (token === null) {
+    store.delete("rtsAuthToken");
+  } else {
+    store.set("rtsAuthToken", token);
+  }
+}
+function getRefreshToken() {
+  return store.get("refreshToken") ?? null;
+}
+function setRefreshToken(token) {
+  if (token === null) {
+    store.delete("refreshToken");
+  } else {
+    store.set("refreshToken", token);
+  }
+}
+function getTokenExpiresAt() {
+  return store.get("tokenExpiresAt") ?? null;
+}
+function setTokenExpiresAt(expiresAt) {
+  if (expiresAt === null) {
+    store.delete("tokenExpiresAt");
+  } else {
+    store.set("tokenExpiresAt", expiresAt);
+  }
+}
+function calcTokenExpiresAt(expiresIn) {
+  return Date.now() + Math.floor(expiresIn / 2) * 1e3;
+}
+function isTokenExpiringSoon() {
+  const expiresAt = getTokenExpiresAt();
+  if (!expiresAt) return true;
+  return Date.now() >= expiresAt;
+}
+function getEtsAuthToken() {
+  return store.get("etsAuthToken") ?? null;
+}
+function setEtsAuthToken(token) {
+  if (token === null) {
+    store.delete("etsAuthToken");
+  } else {
+    store.set("etsAuthToken", token);
+  }
+}
+function getApigwKeysRaw() {
+  return store.get("apigwKeys") ?? null;
+}
+function setApigwKeysRaw(data) {
+  if (data === null) {
+    store.delete("apigwKeys");
+  } else {
+    store.set("apigwKeys", data);
+  }
+}
+function clearAll() {
+  store.clear();
+}
+
+// src/config/loader.ts
+function loadConfig(cliOverrides = {}) {
+  const stored = getStoredConfig();
+  const env = {};
+  if (process.env.EXPRESS_HOST) env.host = process.env.EXPRESS_HOST;
+  if (process.env.EXPRESS_TOKEN) env.token = process.env.EXPRESS_TOKEN;
+  if (process.env.EXPRESS_LOCALE) env.locale = process.env.EXPRESS_LOCALE;
+  if (process.env.EXPRESS_OUTPUT) env.output = process.env.EXPRESS_OUTPUT;
+  const merged = {
+    ...stored,
+    ...env,
+    ...cliOverrides
+  };
+  if (!merged.token) {
+    const storedToken = getAuthToken();
+    if (storedToken) merged.token = storedToken;
+  }
+  return configSchema.parse(merged);
+}
+function getBaseUrl(config) {
+  return `${config.protocol}://${config.host}`;
+}
+function getDomain(ctsHost) {
+  const parts = ctsHost.split(".");
+  return parts.length > 2 ? parts.slice(1).join(".") : ctsHost;
+}
+function getEtsBaseUrl(config) {
+  return `https://ets.${getDomain(config.host)}`;
+}
+function getWebOrigin(config) {
+  return `https://${getDomain(config.host)}`;
+}
+
+// src/auth/import.ts
+async function importToken(token, cliOverrides = {}) {
+  const config = loadConfig(cliOverrides);
+  const baseUrl = getBaseUrl(config);
+  const url = `${baseUrl}/api/v1/phonebook/profiles/self`;
+  const res = await fetch(url, {
+    headers: {
+      Authorization: `Bearer ${token}`,
+      Accept: "application/json"
+    }
+  });
+  if (!res.ok) {
+    throw new Error(`Token validation failed: ${res.status} ${res.statusText}`);
+  }
+  const body = await res.json();
+  setAuthToken(token);
+  const profile = body.profile ?? body.result?.profile;
+  if (profile?.name) {
+    console.log(`Authenticated as: ${profile.name} (${profile.user_huid ?? "unknown huid"})`);
+  } else {
+    console.log("Token imported and validated successfully.");
+  }
+}
+function logout() {
+  setAuthToken(null);
+  console.log("Logged out. Token removed.");
+}
+function status() {
+  const token = getAuthToken();
+  if (!token) {
+    console.log("Not authenticated. Use `express auth import <token>` to login.");
+    return;
+  }
+  console.log(`Authenticated. Token: ${token.slice(0, 20)}...`);
+}
+
+// src/auth/keys.ts
+import { ed25519 } from "@noble/curves/ed25519.js";
+import { randomBytes } from "crypto";
+import nacl from "tweetnacl";
+function generateSigningKeyPair() {
+  const privateKey = ed25519.utils.randomSecretKey();
+  const publicKey = ed25519.getPublicKey(privateKey);
+  const keyId = crypto.randomUUID();
+  return { keyId, privateKey, publicKey };
+}
+function generateEncryptionKeyPair() {
+  const keyPair = nacl.box.keyPair();
+  const keyId = crypto.randomUUID();
+  return {
+    keyId,
+    privateKey: keyPair.secretKey,
+    publicKey: keyPair.publicKey
+  };
+}
+function saveApigwKeys(keys) {
+  const data = {
+    signingKey: {
+      keyId: keys.signingKey.keyId,
+      privateKey: Buffer.from(keys.signingKey.privateKey).toString("base64"),
+      publicKey: Buffer.from(keys.signingKey.publicKey).toString("base64")
+    },
+    encryptionKey: {
+      keyId: keys.encryptionKey.keyId,
+      privateKey: Buffer.from(keys.encryptionKey.privateKey).toString("base64"),
+      publicKey: Buffer.from(keys.encryptionKey.publicKey).toString("base64")
+    },
+    serverPublicKey: Buffer.from(keys.serverPublicKey).toString("base64"),
+    serverPublicKeyId: keys.serverPublicKeyId
+  };
+  if (keys.ctsKey) {
+    data.ctsKey = {
+      keyId: keys.ctsKey.keyId,
+      privateKey: Buffer.from(keys.ctsKey.privateKey).toString("base64"),
+      publicKey: Buffer.from(keys.ctsKey.publicKey).toString("base64")
+    };
+  }
+  setApigwKeysRaw(JSON.stringify(data));
+}
+function loadApigwKeys() {
+  const raw = getApigwKeysRaw();
+  if (!raw) return null;
+  try {
+    const data = JSON.parse(raw);
+    if (!data.encryptionKey || !data.serverPublicKey) {
+      return null;
+    }
+    return {
+      signingKey: {
+        keyId: data.signingKey.keyId,
+        privateKey: new Uint8Array(Buffer.from(data.signingKey.privateKey, "base64")),
+        publicKey: new Uint8Array(Buffer.from(data.signingKey.publicKey, "base64"))
+      },
+      encryptionKey: {
+        keyId: data.encryptionKey.keyId,
+        privateKey: new Uint8Array(Buffer.from(data.encryptionKey.privateKey, "base64")),
+        publicKey: new Uint8Array(Buffer.from(data.encryptionKey.publicKey, "base64"))
+      },
+      ctsKey: data.ctsKey ? {
+        keyId: data.ctsKey.keyId,
+        privateKey: new Uint8Array(Buffer.from(data.ctsKey.privateKey, "base64")),
+        publicKey: new Uint8Array(Buffer.from(data.ctsKey.publicKey, "base64"))
+      } : void 0,
+      serverPublicKey: new Uint8Array(Buffer.from(data.serverPublicKey, "base64")),
+      serverPublicKeyId: data.serverPublicKeyId ?? data.rtsKeyId ?? data.encryptionKeyId ?? ""
+    };
+  } catch {
+    return null;
+  }
+}
+function signEd25519(privateKey, message) {
+  return ed25519.sign(message, privateKey);
+}
+function encryptToken(token, serverPublicKey, rtsPrivateKey) {
+  const message = new TextEncoder().encode(token);
+  const nonce = randomBytes(nacl.box.nonceLength);
+  const encrypted = nacl.box(message, nonce, serverPublicKey, rtsPrivateKey);
+  if (!encrypted) {
+    throw new Error("crypto_box encryption failed");
+  }
+  const combined = new Uint8Array(nonce.length + encrypted.length);
+  combined.set(nonce, 0);
+  combined.set(encrypted, nonce.length);
+  return Buffer.from(combined).toString("base64");
+}
+function generateNonce() {
+  return Buffer.from(randomBytes(32)).toString("base64");
+}
+function publicKeyToBase64(publicKey) {
+  return Buffer.from(publicKey).toString("base64");
+}
+function clearApigwKeys() {
+  setApigwKeysRaw(null);
+}
+function importCtsKey(privateKeyB64, keyId) {
+  const existing = loadApigwKeys();
+  if (!existing) {
+    throw new Error("No apigw keys yet. Run 'express auth login' or 'express auth qr' first.");
+  }
+  const privateKey = new Uint8Array(Buffer.from(privateKeyB64, "base64"));
+  if (privateKey.length !== nacl.box.secretKeyLength) {
+    throw new Error(`Invalid private key length: ${privateKey.length} bytes (expected ${nacl.box.secretKeyLength})`);
+  }
+  const publicKey = nacl.box.keyPair.fromSecretKey(privateKey).publicKey;
+  const ctsKey = { keyId, privateKey, publicKey };
+  saveApigwKeys({ ...existing, ctsKey });
+  return ctsKey;
+}
+function decryptRegistrationData(registrationDataB64, encryptionKey) {
+  const raw = Uint8Array.from(Buffer.from(registrationDataB64, "base64"));
+  const nonce = raw.slice(0, nacl.secretbox.nonceLength);
+  const ciphertext = raw.slice(nacl.secretbox.nonceLength);
+  const plaintext = nacl.secretbox.open(ciphertext, nonce, encryptionKey);
+  if (!plaintext) {
+    throw new Error("Failed to decrypt registration_data");
+  }
+  const json = new TextDecoder().decode(plaintext);
+  return JSON.parse(json);
+}
+function decryptRtsToken(encryptedRtsTokenB64, serverPublicKey, rtsPrivateKey) {
+  const raw = Uint8Array.from(Buffer.from(encryptedRtsTokenB64, "base64"));
+  const nonce = raw.slice(0, nacl.box.nonceLength);
+  const ciphertext = raw.slice(nacl.box.nonceLength);
+  const plaintext = nacl.box.open(ciphertext, nonce, serverPublicKey, rtsPrivateKey);
+  if (!plaintext) {
+    throw new Error("Failed to decrypt encrypted_rts_token");
+  }
+  return new TextDecoder().decode(plaintext);
+}
+function extractRtsKeyIdFromToken(token) {
+  const parts = token.split(".");
+  if (parts.length < 2) return "";
+  const bytes = Buffer.from(parts[1], "base64");
+  const text = bytes.toString("latin1");
+  const uuidRegex = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/g;
+  const uuids = [];
+  let match;
+  while ((match = uuidRegex.exec(text)) !== null) {
+    uuids.push(match[0]);
+  }
+  return uuids.length >= 4 ? uuids[3] : "";
+}
+
+// src/auth/apigw-signer.ts
+import { sha256 } from "@noble/hashes/sha2.js";
+function buildSigningInput(method, path, created, nonce, rtsAccessToken, digest) {
+  return buildSigningInputInternal(method, path, created, nonce, rtsAccessToken, digest);
+}
+function buildQrSigningInput(method, path, created, nonce, digest) {
+  return buildSigningInputInternal(method, path, created, nonce, void 0, digest);
+}
+function buildSigningInputInternal(method, path, created, nonce, rtsAccessToken, digest) {
+  const lines = [];
+  const headerNames = [];
+  lines.push(`(request-target): ${method.toLowerCase()} ${path}`);
+  headerNames.push("(request-target)");
+  lines.push(`(created): ${created}`);
+  headerNames.push("(created)");
+  if (rtsAccessToken) {
+    lines.push(`(rts-access-token): ${rtsAccessToken}`);
+    headerNames.push("(rts-access-token)");
+  }
+  lines.push(`express-request-nonce: ${nonce}`);
+  headerNames.push("express-request-nonce");
+  if (digest) {
+    lines.push(`digest: SHA-256=${digest}`);
+    headerNames.push("digest");
+  }
+  return {
+    signingString: lines.join("\n"),
+    signedHeaders: headerNames.join(" ")
+  };
+}
+function computeDigest(body) {
+  const hash = sha256(new TextEncoder().encode(body));
+  return Buffer.from(hash).toString("base64");
+}
+async function signApigwRequest(params) {
+  const keys = loadApigwKeys();
+  if (!keys) {
+    throw new Error("Apigw keys not initialized. Run 'express auth login' first.");
+  }
+  const urlObj = new URL(params.url.startsWith("http") ? params.url : `${params.baseUrl}${params.url}`);
+  const path = urlObj.pathname + urlObj.search;
+  const created = Math.floor(Date.now() / 1e3);
+  const nonce = generateNonce();
+  let digest;
+  if (params.body) {
+    digest = computeDigest(params.body);
+  }
+  const tokenForSigning = params.etsAuthToken || params.rtsToken || params.ctsToken;
+  const { signingString, signedHeaders } = buildSigningInput(
+    params.method,
+    path,
+    created,
+    nonce,
+    tokenForSigning,
+    digest
+  );
+  if (process.env.EXPRESS_DEBUG) {
+    console.log(`  [DEBUG] path: ${path}`);
+    console.log(`  [DEBUG] signedHeaders: ${signedHeaders}`);
+    console.log(`  [DEBUG] signingString:
+${signingString}`);
+    console.log(`  [DEBUG] signingKey keyId: ${keys.signingKey.keyId}`);
+    console.log(`  [DEBUG] encryptionKey keyId: ${keys.encryptionKey.keyId}`);
+  }
+  const signature = signEd25519(keys.signingKey.privateKey, new TextEncoder().encode(signingString));
+  const signatureBase64 = Buffer.from(signature).toString("base64");
+  let serverPublicKey = keys.serverPublicKey;
+  try {
+    const etsBaseUrl = params.baseUrl;
+    const kdcStartRes = await fetch(`${etsBaseUrl}/api/v1/kdc/start`, {
+      headers: {
+        Accept: "application/json"
+      }
+    });
+    if (kdcStartRes.ok) {
+      const kdcStartData = await kdcStartRes.json();
+      if (kdcStartData.result) {
+        serverPublicKey = new Uint8Array(Buffer.from(kdcStartData.result, "base64"));
+        if (process.env.EXPRESS_DEBUG) {
+          console.log(`  [DEBUG] ETS server public key (curve25519): ${kdcStartData.result}`);
+        }
+        keys.serverPublicKey = serverPublicKey;
+        keys.serverPublicKeyId = "kdc-start-ets";
+        saveApigwKeys(keys);
+      }
+    }
+  } catch {
+  }
+  const tokenToEncrypt = params.etsAuthToken || params.rtsToken || params.ctsToken;
+  const encryptedToken = encryptToken(tokenToEncrypt, serverPublicKey, keys.encryptionKey.privateKey);
+  if (process.env.EXPRESS_DEBUG) {
+    console.log(`  [DEBUG] ctsToken length: ${params.ctsToken.length}`);
+    console.log(`  [DEBUG] rtsToken: ${params.rtsToken ? `present (${params.rtsToken.length} chars)` : "not set"}`);
+    console.log(`  [DEBUG] etsAuthToken: ${params.etsAuthToken ? `present (${params.etsAuthToken.length} chars)` : "not set"}`);
+    console.log(`  [DEBUG] tokenToEncrypt: ${tokenToEncrypt.length} chars (source: ${params.etsAuthToken ? "etsAuthToken" : params.rtsToken ? "rtsToken" : "ctsToken"})`);
+    console.log(`  [DEBUG] serverPublicKey b64: ${Buffer.from(serverPublicKey).toString("base64")}`);
+    console.log(`  [DEBUG] encryptionPrivateKey b64: ${Buffer.from(keys.encryptionKey.privateKey).toString("base64")}`);
+    console.log(`  [DEBUG] encryptionPublicKey b64: ${Buffer.from(keys.encryptionKey.publicKey).toString("base64")}`);
+    console.log(`  [DEBUG] encryptedToken length: ${encryptedToken.length}`);
+  }
+  return {
+    Authorization: `keyId="${keys.encryptionKey.keyId}",token="${encryptedToken}"`,
+    "Express-Proxy-Authorization": `Bearer ${params.ctsToken}`,
+    "Express-Request-Nonce": nonce,
+    ...digest && { Digest: `SHA-256=${digest}` },
+    Signature: `keyId="${keys.signingKey.keyId}",algorithm="ed25519",headers="${signedHeaders}",signature="${signatureBase64}",created=${created}`,
+    ...params.body && { "Content-Type": "application/json" }
+  };
+}
+function signQrRequest(params) {
+  const urlObj = new URL(params.url);
+  const path = urlObj.pathname + urlObj.search;
+  const created = Math.floor(Date.now() / 1e3);
+  const nonce = generateNonce();
+  const digest = computeDigest(params.body);
+  const { signingString, signedHeaders } = buildQrSigningInput(
+    params.method,
+    path,
+    created,
+    nonce,
+    digest
+  );
+  const signature = signEd25519(params.privateKey, new TextEncoder().encode(signingString));
+  const signatureBase64 = Buffer.from(signature).toString("base64");
+  if (process.env.EXPRESS_DEBUG) {
+    console.log(`  [DEBUG QR] path: ${path}`);
+    console.log(`  [DEBUG QR] signedHeaders: ${signedHeaders}`);
+    console.log(`  [DEBUG QR] signingString:
+${signingString}`);
+  }
+  return {
+    "Express-Request-Nonce": nonce,
+    Digest: `SHA-256=${digest}`,
+    Signature: `keyId="${params.registrationId}",algorithm="ed25519",headers="${signedHeaders}",signature="${signatureBase64}",created=${created}`,
+    "Content-Type": "application/json"
+  };
+}
+
+// src/auth/device-login.ts
+import nacl2 from "tweetnacl";
+import { randomUUID } from "crypto";
+async function fetchCurrentAccountCtsKey(baseUrl, token, userHuid, webOrigin) {
+  try {
+    const res = await fetch(`${baseUrl}/api/v1/kdc/keys/?user_huids=${userHuid}`, {
+      headers: { Accept: "application/json", Authorization: `Bearer ${token}`, Origin: webOrigin }
+    });
+    if (!res.ok) return null;
+    const data = await res.json();
+    return data.result?.find((k) => k.kind === "cts")?.id ?? null;
+  } catch {
+    return null;
+  }
+}
+function extractResult(data) {
+  return data.result ?? data;
+}
+async function deviceLogin(cliOverrides = {}) {
+  const config = loadConfig(cliOverrides);
+  const baseUrl = getBaseUrl(config);
+  const etsBaseUrl = getEtsBaseUrl(config);
+  const webOrigin = getWebOrigin(config);
+  const currentToken = config.token ?? getAuthToken();
+  if (!currentToken) {
+    throw new Error("No Bearer token. Run 'express auth import <token>' first, then 'express auth login'.");
+  }
+  console.log("Step 1/5: Registering device with AD integration...");
+  const adBody = JSON.stringify({
+    app_version: config.app_version,
+    device: "Chrome 149.0",
+    device_software: "macOS 10.15.7",
+    manufacturer: "Google",
+    platform: config.platform,
+    locale: config.locale,
+    platform_package_id: config.platform_package_id,
+    device_meta: {
+      pushes: false,
+      timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
+      permissions: { notifications: true }
+    },
+    device_hostname: null
+  });
+  const adRes = await fetch(`${baseUrl}/api/v1/ad_integration/token`, {
+    method: "PUT",
+    headers: {
+      "Accept": "application/json, text/plain, */*",
+      "Content-Type": "application/json",
+      "Authorization": `Bearer ${currentToken}`,
+      "Origin": webOrigin,
+      "Referer": `${webOrigin}/`,
+      "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36",
+      "Accept-Language": "ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7",
+      "Cache-Control": "no-cache",
+      "Pragma": "no-cache",
+      "sec-ch-ua": '"Google Chrome";v="149", "Chromium";v="149", "Not)A;Brand";v="24"',
+      "sec-ch-ua-mobile": "?0",
+      "sec-ch-ua-platform": '"macOS"'
+    },
+    body: adBody
+  });
+  const adText = await adRes.text();
+  if (!adRes.ok) {
+    throw new Error(`AD integration failed (${adRes.status}): ${adText.slice(0, 500)}`);
+  }
+  console.log(`  AD integration: ${adText.slice(0, 200)}`);
+  console.log("Step 2/5: Fetching user profile and server public key...");
+  const selfProfileRes = await fetch(`${baseUrl}/api/v1/phonebook/profiles/self`, {
+    headers: {
+      "Accept": "application/json, text/plain, */*",
+      "Authorization": `Bearer ${currentToken}`,
+      "Origin": webOrigin,
+      "Referer": `${webOrigin}/`
+    }
+  });
+  let userHuid = "";
+  let serverId = "";
+  if (selfProfileRes.ok) {
+    const selfData = await selfProfileRes.json();
+    userHuid = selfData.profile?.user_huid ?? "";
+    serverId = selfData.profile?.server_id ?? userHuid;
+    console.log(`  User HUID: ${userHuid || "unknown"}`);
+  }
+  let serverPublicKey = new Uint8Array(0);
+  let serverPublicKeyId = "";
+  const existingKeys = loadApigwKeys();
+  if (existingKeys?.serverPublicKey?.length) {
+    serverPublicKey = existingKeys.serverPublicKey;
+    serverPublicKeyId = existingKeys.serverPublicKeyId;
+    console.log(`  Server public key (cached): ${serverPublicKeyId || "unknown"}`);
+  }
+  if (!serverPublicKey.length) {
+    try {
+      const kdcStartRes = await fetch(`${etsBaseUrl}/api/v1/kdc/start`, {
+        headers: { Accept: "application/json" }
+      });
+      if (kdcStartRes.ok) {
+        const kdcStartData = await kdcStartRes.json();
+        if (kdcStartData.result) {
+          serverPublicKey = new Uint8Array(Buffer.from(kdcStartData.result, "base64"));
+          serverPublicKeyId = "kdc-start-ets";
+          console.log(`  Server public key (from ets): ${serverPublicKeyId}`);
+        }
+      }
+    } catch {
+    }
+  }
+  if (!serverPublicKey.length && serverId) {
+    const kdcFetchUrl = `${baseUrl}/api/v1/kdc/keys/?ids=${serverId}`;
+    const kdcFetchRes = await fetch(kdcFetchUrl, {
+      headers: {
+        "Accept": "application/json",
+        "Authorization": `Bearer ${currentToken}`
+      }
+    });
+    if (kdcFetchRes.ok) {
+      const kdcFetchData = JSON.parse(await kdcFetchRes.text());
+      const kdcKeys = kdcFetchData.result ?? kdcFetchData;
+      const serverKey = Array.isArray(kdcKeys) ? kdcKeys.find((k) => (k.kind === "rest" || k.kind === "rts") && k.user_huid === serverId) : null;
+      if (!serverKey && Array.isArray(kdcKeys) && kdcKeys.length > 0) {
+        const first = kdcKeys[0];
+        serverPublicKey = new Uint8Array(Buffer.from(first.body, "base64"));
+        serverPublicKeyId = first.id;
+      } else if (serverKey) {
+        serverPublicKey = new Uint8Array(Buffer.from(serverKey.body, "base64"));
+        serverPublicKeyId = serverKey.id;
+      }
+      console.log(`  Server public key (from KDC): ${serverPublicKeyId || "not found"}`);
+    }
+  }
+  if (!serverPublicKey.length) {
+    throw new Error("Could not fetch server public key from KDC");
+  }
+  console.log("Step 3/5: Registering keys with KDC...");
+  let apigwSigningKey;
+  let apigwEncryptionKey;
+  if (existingKeys?.signingKey && existingKeys?.encryptionKey) {
+    apigwSigningKey = existingKeys.signingKey;
+    apigwEncryptionKey = existingKeys.encryptionKey;
+    console.log(`  Reusing existing signing key: ${apigwSigningKey.keyId}`);
+    console.log(`  Reusing existing encryption key: ${apigwEncryptionKey.keyId}`);
+  } else {
+    apigwSigningKey = generateSigningKeyPair();
+    apigwEncryptionKey = generateEncryptionKeyPair();
+    const apigwKeyPublicBase64 = publicKeyToBase64(apigwSigningKey.publicKey);
+    console.log(`  Signing key: id=${apigwSigningKey.keyId} pub=${apigwKeyPublicBase64}`);
+    const kdcUrl = `${baseUrl}/api/v2/kdc/keys/${userHuid}`;
+    const kdcBody = JSON.stringify({
+      key: apigwKeyPublicBase64,
+      kind: "ed25519",
+      algo: "ed25519",
+      id: apigwSigningKey.keyId
+    });
+    const [kdcRes, etsKdcRes] = await Promise.all([
+      fetch(kdcUrl, {
+        method: "POST",
+        headers: {
+          "Accept": "application/json, text/plain, */*",
+          "Authorization": `Bearer ${currentToken}`,
+          "Content-Type": "application/json",
+          "Origin": webOrigin,
+          "Referer": `${webOrigin}/`
+        },
+        body: kdcBody
+      }),
+      fetch(`${etsBaseUrl}/api/v2/kdc/keys/${userHuid}`, {
+        method: "POST",
+        headers: {
+          "Accept": "application/json, text/plain, */*",
+          "Authorization": `Bearer ${currentToken}`,
+          "Content-Type": "application/json",
+          "Origin": webOrigin,
+          "Referer": `${webOrigin}/`
+        },
+        body: kdcBody
+      })
+    ]);
+    if (!kdcRes.ok) {
+      const kdcErrText = await kdcRes.text().catch(() => "");
+      console.log(`  Warning: CTS KDC signing key registration failed (${kdcRes.status}): ${kdcErrText.slice(0, 200)}`);
+    } else {
+      console.log(`  Signing key registered in CTS: ${apigwSigningKey.keyId}`);
+    }
+    if (!etsKdcRes.ok) {
+      const etsErrText = await etsKdcRes.text().catch(() => "");
+      console.log(`  Warning: ETS KDC signing key registration failed (${etsKdcRes.status}): ${etsErrText.slice(0, 200)}`);
+    } else {
+      console.log(`  Signing key registered in ETS: ${apigwSigningKey.keyId}`);
+    }
+    const encryptionKeyPublicBase64 = publicKeyToBase64(apigwEncryptionKey.publicKey);
+    const kdcEncBody = JSON.stringify({
+      key: encryptionKeyPublicBase64,
+      kind: "rts",
+      algo: "xsalsa20",
+      id: apigwEncryptionKey.keyId
+    });
+    const kdcEncRes = await fetch(kdcUrl, {
+      method: "POST",
+      headers: {
+        "Accept": "application/json, text/plain, */*",
+        "Authorization": `Bearer ${currentToken}`,
+        "Content-Type": "application/json",
+        "Origin": webOrigin,
+        "Referer": `${webOrigin}/`
+      },
+      body: kdcEncBody
+    });
+    const etsKdcEncRes = await fetch(`${etsBaseUrl}/api/v2/kdc/keys/${userHuid}`, {
+      method: "POST",
+      headers: {
+        "Accept": "application/json, text/plain, */*",
+        "Authorization": `Bearer ${currentToken}`,
+        "Content-Type": "application/json",
+        "Origin": webOrigin,
+        "Referer": `${webOrigin}/`
+      },
+      body: kdcEncBody
+    });
+    if (!kdcEncRes.ok) {
+      const kdcErrText = await kdcEncRes.text().catch(() => "");
+      console.log(`  Warning: CTS KDC encryption key registration failed (${kdcEncRes.status}): ${kdcErrText.slice(0, 200)}`);
+    } else {
+      console.log(`  Encryption key registered in CTS: ${apigwEncryptionKey.keyId}`);
+    }
+    if (!etsKdcEncRes.ok) {
+      const etsErrText = await etsKdcEncRes.text().catch(() => "");
+      console.log(`  Warning: ETS KDC encryption key registration failed (${etsKdcEncRes.status}): ${etsErrText.slice(0, 200)}`);
+    } else {
+      console.log(`  Encryption key registered in ETS: ${apigwEncryptionKey.keyId}`);
+    }
+  }
+  let ctsKey = existingKeys?.ctsKey;
+  if (!ctsKey) {
+    const currentCts = await fetchCurrentAccountCtsKey(baseUrl, currentToken, userHuid, webOrigin);
+    if (currentCts) {
+      throw new Error(
+        `Account already has a shared CTS key (${currentCts}) that this CLI doesn't hold.
+Minting a new one would break your other devices. Import the shared key instead:
+  express auth import-cts <private_key_b64> ${currentCts}
+(extract it from a logged-in web client: IndexedDB authState \u2192 encryptionKeys \u2192 user.privateKeys.cts)`
+      );
+    }
+    const ctsKeyPair = nacl2.box.keyPair();
+    const ctsKeyId = crypto.randomUUID();
+    ctsKey = {
+      keyId: ctsKeyId,
+      privateKey: ctsKeyPair.secretKey,
+      publicKey: ctsKeyPair.publicKey
+    };
+    const ctsKeyPubB64 = Buffer.from(ctsKeyPair.publicKey).toString("base64");
+    const ctsKeyBody = JSON.stringify({ key: ctsKeyPubB64, kind: "cts", algo: "xsalsa20", id: ctsKeyId });
+    const [ctsCtsRes, etsCtsRes] = await Promise.all([
+      fetch(`${baseUrl}/api/v2/kdc/keys/${userHuid}`, {
+        method: "POST",
+        headers: {
+          "Accept": "application/json, text/plain, */*",
+          "Authorization": `Bearer ${currentToken}`,
+          "Content-Type": "application/json",
+          "Origin": webOrigin,
+          "Referer": `${webOrigin}/`
+        },
+        body: ctsKeyBody
+      }),
+      fetch(`${etsBaseUrl}/api/v2/kdc/keys/${userHuid}`, {
+        method: "POST",
+        headers: {
+          "Accept": "application/json, text/plain, */*",
+          "Authorization": `Bearer ${currentToken}`,
+          "Content-Type": "application/json",
+          "Origin": webOrigin,
+          "Referer": `${webOrigin}/`
+        },
+        body: ctsKeyBody
+      })
+    ]);
+    if (!ctsCtsRes.ok) {
+      const errText = await ctsCtsRes.text().catch(() => "");
+      console.log(`  Warning: CTS encryption key registration failed (${ctsCtsRes.status}): ${errText.slice(0, 200)}`);
+    } else {
+      console.log(`  CTS encryption key registered in CTS: ${ctsKeyId.slice(0, 8)}...`);
+    }
+    if (!etsCtsRes.ok) {
+      const errText = await etsCtsRes.text().catch(() => "");
+      console.log(`  Warning: CTS encryption key registration in ETS failed (${etsCtsRes.status}): ${errText.slice(0, 200)}`);
+    } else {
+      console.log(`  CTS encryption key registered in ETS: ${ctsKeyId.slice(0, 8)}...`);
+    }
+  }
+  const apigwKeys = {
+    signingKey: apigwSigningKey,
+    encryptionKey: apigwEncryptionKey,
+    serverPublicKey,
+    serverPublicKeyId,
+    ctsKey
+  };
+  const previousKeysRaw = getApigwKeysRaw();
+  saveApigwKeys(apigwKeys);
+  console.log("Step 4/5: Activating device...");
+  const activationBody = JSON.stringify({
+    app_version: config.app_version,
+    locale: config.locale,
+    device_meta: {
+      pushes: false,
+      timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
+      permissions: { notifications: true }
+    },
+    device_hostname: null
+  });
+  const activationUrl = `${etsBaseUrl}/api/v1/apigw/api/v1/authentication/activation`;
+  const activationHeaders = await signApigwRequest({
+    method: "PUT",
+    url: activationUrl,
+    baseUrl: etsBaseUrl,
+    body: activationBody,
+    ctsToken: currentToken
+  });
+  const actRes = await fetch(activationUrl, {
+    method: "PUT",
+    headers: {
+      "Accept": "application/json, text/plain, */*",
+      ...activationHeaders,
+      "Origin": webOrigin,
+      "Referer": `${webOrigin}/`,
+      "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36",
+      "Accept-Language": "ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7",
+      "Cache-Control": "no-cache",
+      "Pragma": "no-cache",
+      "sec-ch-ua": '"Google Chrome";v="149", "Chromium";v="149", "Not)A;Brand";v="24"',
+      "sec-ch-ua-mobile": "?0",
+      "sec-ch-ua-platform": '"macOS"'
+    },
+    body: activationBody
+  });
+  const actText = await actRes.text();
+  if (!actRes.ok) {
+    if (previousKeysRaw) {
+      setApigwKeysRaw(previousKeysRaw);
+      console.log("  (Rolled back to previous apigw keys)");
+    } else {
+      clearApigwKeys();
+    }
+    throw new Error(`Device activation failed (${actRes.status}): ${actText.slice(0, 500)}`);
+  }
+  console.log(`  Activation response: ${actText.slice(0, 300)}`);
+  let actData;
+  try {
+    actData = JSON.parse(actText);
+  } catch {
+    console.log("  (non-JSON activation response, continuing)");
+    actData = {};
+  }
+  const actResult = extractResult(actData);
+  const newAccessToken = actResult.access_token;
+  if (newAccessToken) {
+    setAuthToken(newAccessToken);
+    console.log("  Device activated. Token refreshed.");
+  } else {
+    console.log("  Device activated (using existing token).");
+  }
+  const effectiveToken = newAccessToken ?? currentToken;
+  const udid = randomUUID();
+  const pushBody = JSON.stringify({
+    phone: null,
+    token: null,
+    platform: "web_chrome",
+    user_huid: userHuid,
+    locale: config.locale,
+    udid,
+    encryption_key: "",
+    auth_key: "",
+    platform_package_id: config.platform_package_id
+  });
+  console.log("Step 5/5: Registering push token...");
+  const pushHeaders = await signApigwRequest({
+    method: "PUT",
+    url: `${etsBaseUrl}/api/v1/apigw/api/v1/push_service/protected/token`,
+    baseUrl: etsBaseUrl,
+    body: pushBody,
+    ctsToken: effectiveToken
+  });
+  const pushRes = await fetch(`${etsBaseUrl}/api/v1/apigw/api/v1/push_service/protected/token`, {
+    method: "PUT",
+    headers: {
+      "Accept": "application/json, text/plain, */*",
+      ...pushHeaders,
+      "Origin": webOrigin,
+      "Referer": `${webOrigin}/`,
+      "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36"
+    },
+    body: pushBody
+  });
+  const pushText = await pushRes.text();
+  console.log(`  Push token: ${pushRes.status} \u2014 ${pushText.slice(0, 200)}`);
+  console.log("Login complete! Apigw endpoints are now available.");
+}
+
+// src/auth/qr-login.ts
+import { randomUUID as randomUUID2, randomBytes as randomBytes2 } from "crypto";
+import qrcode from "qrcode-terminal";
+import nacl3 from "tweetnacl";
+function extractResult2(data) {
+  return data.result ?? data;
+}
+async function fetchCurrentAccountCtsKey2(baseUrl, accessToken, userHuid, webOrigin) {
+  try {
+    const res = await fetch(`${baseUrl}/api/v1/kdc/keys/?user_huids=${userHuid}`, {
+      headers: { ...commonHeaders(webOrigin), Authorization: `Bearer ${accessToken}` }
+    });
+    if (!res.ok) return null;
+    const data = await res.json();
+    return data.result?.find((k) => k.kind === "cts")?.id ?? null;
+  } catch {
+    return null;
+  }
+}
+function commonHeaders(webOrigin) {
+  return {
+    "Accept": "application/json, text/plain, */*",
+    "Accept-Language": "ru-RU,ru;q=0.9",
+    "Connection": "keep-alive",
+    "Origin": webOrigin,
+    "Referer": `${webOrigin}/`,
+    "Sec-Fetch-Dest": "empty",
+    "Sec-Fetch-Mode": "cors",
+    "Sec-Fetch-Site": "same-site",
+    "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36",
+    "sec-ch-ua": '"Google Chrome";v="149", "Chromium";v="149", "Not)A;Brand";v="24"',
+    "sec-ch-ua-mobile": "?0",
+    "sec-ch-ua-platform": '"macOS"'
+  };
+}
+async function qrLogin(cliOverrides = {}) {
+  const config = loadConfig(cliOverrides);
+  const etsBaseUrl = getEtsBaseUrl(config);
+  const webOrigin = getWebOrigin(config);
+  const qrSigningKey = generateSigningKeyPair();
+  const registrationId = qrSigningKey.keyId;
+  const registrationToken = Buffer.from(randomBytes2(64)).toString("base64");
+  const signPubKey = publicKeyToBase64(qrSigningKey.publicKey);
+  const udid = randomUUID2();
+  const encryptionKey = randomBytes2(32);
+  const qrBody = JSON.stringify({
+    registration_id: registrationId,
+    registration_token: registrationToken,
+    sign_pub_key: signPubKey,
+    udid,
+    app_version: config.app_version,
+    device: "Chrome 149.0",
+    device_software: "macOS 10.15.7",
+    device_hostname: null,
+    device_meta: {
+      pushes: false,
+      timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
+      permissions: { notifications: false }
+    },
+    locale: config.locale,
+    manufacturer: "Google",
+    platform: "web",
+    platform_package_id: "com.pyligrim.alphach"
+  });
+  const qrPayload = JSON.stringify({
+    registration_id: registrationId,
+    registration_token: registrationToken,
+    registration_key: Buffer.from(encryptionKey).toString("base64"),
+    version: 1
+  });
+  console.log("Step 1/7: Scan this QR code with your eXpress app:\n");
+  qrcode.generate(qrPayload, { small: true }, (qr) => {
+    console.log(qr);
+  });
+  console.log(`
+  registration_id: ${registrationId}`);
+  console.log("  Waiting for scan (server long-polling)...\n");
+  const etsUrl = `${etsBaseUrl}/api/v1/authentication/qr/mobile_to_web/request`;
+  const qrHeaders = signQrRequest({
+    method: "POST",
+    url: etsUrl,
+    body: qrBody,
+    registrationId,
+    privateKey: qrSigningKey.privateKey
+  });
+  let qrRes;
+  try {
+    qrRes = await fetch(etsUrl, {
+      method: "POST",
+      headers: { ...commonHeaders(webOrigin), ...qrHeaders },
+      body: qrBody
+    });
+  } catch (err) {
+    throw new Error(`QR request network error: ${err.message}`);
+  }
+  const qrText = await qrRes.text();
+  if (!qrRes.ok) {
+    console.log(`  Response (${qrRes.status}): ${qrText.slice(0, 500)}`);
+    throw new Error(`QR request failed (${qrRes.status}): ${qrText.slice(0, 500)}`);
+  }
+  let qrData;
+  try {
+    qrData = JSON.parse(qrText);
+  } catch {
+    throw new Error(`Invalid QR response: ${qrText.slice(0, 500)}`);
+  }
+  if (process.env.EXPRESS_DEBUG) {
+    console.log(`  [DEBUG] QR full response: ${qrText.slice(0, 1e3)}`);
+  }
+  const qrResult = extractResult2(qrData);
+  const ctsRegistrationToken = qrResult.cts_registration_token ?? "";
+  const rtsRegistrationToken = qrResult.rts_registration_token ?? "";
+  const registrationData = qrResult.registration_data ?? "";
+  console.log("  QR scanned! Got tokens from server.");
+  if (process.env.EXPRESS_DEBUG) {
+    console.log(`  [DEBUG] registration_data length: ${registrationData.length}`);
+    console.log(`  [DEBUG] registration_data raw: ${registrationData.slice(0, 100)}...`);
+    console.log(`  [DEBUG] encryptionKey (registration_key) hex: ${Buffer.from(encryptionKey).toString("hex")}`);
+  }
+  if (!ctsRegistrationToken && !rtsRegistrationToken) {
+    throw new Error(`No tokens in QR response: ${qrText.slice(0, 500)}`);
+  }
+  let rtsPrivateKey = null;
+  let rtsPublicKeyId = "";
+  let qrCtsPrivateKey = null;
+  let qrCtsKeyId = "";
+  if (registrationData) {
+    try {
+      const raw = Uint8Array.from(Buffer.from(registrationData, "base64"));
+      if (process.env.EXPRESS_DEBUG) {
+        console.log(`  [DEBUG] registration_data decoded length: ${raw.length}`);
+        console.log(`  [DEBUG] first 40 bytes hex: ${Buffer.from(raw.slice(0, 40)).toString("hex")}`);
+        console.log(`  [DEBUG] encryptionKey hex: ${Buffer.from(encryptionKey).toString("hex")}`);
+        console.log(`  [DEBUG] encryptionKey length: ${encryptionKey.length}`);
+      }
+      const decrypted = decryptRegistrationData(registrationData, encryptionKey);
+      if (process.env.EXPRESS_DEBUG) {
+        console.log("  Decrypted registration_data:", JSON.stringify(decrypted).slice(0, 500));
+      }
+      if (decrypted && typeof decrypted === "object") {
+        const data = decrypted;
+        if (typeof data.rts_priv_key_body === "string") {
+          rtsPrivateKey = new Uint8Array(Buffer.from(data.rts_priv_key_body, "base64"));
+        }
+        if (typeof data.rts_pub_key_id === "string") {
+          rtsPublicKeyId = data.rts_pub_key_id;
+        }
+        if (typeof data.cts_priv_key_body === "string" && typeof data.cts_pub_key_id === "string") {
+          qrCtsPrivateKey = new Uint8Array(Buffer.from(data.cts_priv_key_body, "base64"));
+          qrCtsKeyId = data.cts_pub_key_id;
+        }
+      }
+    } catch (err) {
+      console.log(`  Warning: could not decrypt registration_data: ${err.message}`);
+    }
+  }
+  console.log("\nStep 2/7: Confirming with ETS...");
+  const confirmUrl = `${etsBaseUrl}/api/v1/authentication/register_confirm/qr`;
+  const confirmBody = JSON.stringify({
+    registration_id: registrationId,
+    temp_token: rtsRegistrationToken
+  });
+  const confirmHeaders = signQrRequest({
+    method: "POST",
+    url: confirmUrl,
+    body: confirmBody,
+    registrationId,
+    privateKey: qrSigningKey.privateKey
+  });
+  const confirmRes = await fetch(confirmUrl, {
+    method: "POST",
+    headers: { ...commonHeaders(webOrigin), ...confirmHeaders },
+    body: confirmBody
+  });
+  const confirmText = await confirmRes.text();
+  if (!confirmRes.ok) {
+    throw new Error(`ETS register_confirm failed (${confirmRes.status}): ${confirmText.slice(0, 500)}`);
+  }
+  const confirmData = extractResult2(JSON.parse(confirmText));
+  const userHuid = confirmData.user_huid ?? "";
+  const etsAuthToken = confirmData.auth_token ?? "";
+  console.log(`  ETS confirmed. User: ${userHuid || "unknown"}`);
+  if (etsAuthToken) {
+    setEtsAuthToken(etsAuthToken);
+    if (process.env.EXPRESS_DEBUG) {
+      console.log(`  [DEBUG] ETS auth_token saved (${etsAuthToken.length} chars)`);
+    }
+  }
+  if (!ctsRegistrationToken) {
+    throw new Error("No cts_registration_token \u2014 cannot confirm with CTS");
+  }
+  console.log("\nStep 3/7: Confirming with CTS (AD integration)...");
+  const ctsUrl = `${getBaseUrl(config)}/api/v1/ad_integration/register_confirm/qr`;
+  const adConfirmBody = JSON.stringify({
+    rts_registration_id: registrationId,
+    temp_token: ctsRegistrationToken,
+    ets: true
+  });
+  const adConfirmHeaders = signQrRequest({
+    method: "POST",
+    url: ctsUrl,
+    body: adConfirmBody,
+    registrationId,
+    privateKey: qrSigningKey.privateKey
+  });
+  const adRes = await fetch(ctsUrl, {
+    method: "POST",
+    headers: { ...commonHeaders(webOrigin), ...adConfirmHeaders },
+    body: adConfirmBody
+  });
+  const adText = await adRes.text();
+  if (!adRes.ok) {
+    throw new Error(`AD integration confirm failed (${adRes.status}): ${adText.slice(0, 500)}`);
+  }
+  const adData = extractResult2(JSON.parse(adText));
+  const accessToken = adData.access_token;
+  const refreshToken2 = adData.refresh_token;
+  const expiresIn = adData.expires_in;
+  const serverId = adData.server_id ?? userHuid;
+  const encryptedRtsToken = adData.encrypted_rts_token;
+  if (process.env.EXPRESS_DEBUG) {
+    const adDataRaw = JSON.parse(adText);
+    console.log(`  [DEBUG] AD confirm full result keys: ${JSON.stringify(Object.keys(adDataRaw.result || adDataRaw))}`);
+    if (encryptedRtsToken) {
+      console.log(`  [DEBUG] encrypted_rts_token found: ${encryptedRtsToken.slice(0, 60)}...`);
+    } else {
+      console.log(`  [DEBUG] encrypted_rts_token NOT found in response`);
+    }
+  }
+  if (!accessToken) {
+    throw new Error(`No access_token in AD confirm response: ${adText.slice(0, 500)}`);
+  }
+  setAuthToken(accessToken);
+  if (refreshToken2) {
+    setRefreshToken(refreshToken2);
+  }
+  if (typeof expiresIn === "number") {
+    setTokenExpiresAt(calcTokenExpiresAt(expiresIn));
+    console.log(`  Token expires in ${expiresIn}s (refresh after ${(expiresIn / 2 / 60).toFixed(0)} min)`);
+  }
+  console.log(`  CTS confirmed. Access token: ${accessToken.slice(0, 40)}...`);
+  console.log("\nStep 4/7: Registering device token...");
+  const tokenUrl = `${getBaseUrl(config)}/api/v1/ad_integration/token`;
+  const tokenBody = JSON.stringify({
+    app_version: config.app_version,
+    device: "Chrome 149.0",
+    device_software: "macOS 10.15.7",
+    manufacturer: "Google",
+    platform: "web",
+    locale: config.locale,
+    platform_package_id: "com.pyligrim.alphach",
+    device_meta: {
+      pushes: false,
+      timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
+      permissions: { notifications: false }
+    },
+    device_hostname: null
+  });
+  const tokenRes = await fetch(tokenUrl, {
+    method: "PUT",
+    headers: {
+      ...commonHeaders(webOrigin),
+      Authorization: `Bearer ${accessToken}`,
+      "Content-Type": "application/json"
+    },
+    body: tokenBody
+  });
+  if (!tokenRes.ok) {
+    const tokenErrText = await tokenRes.text().catch(() => "");
+    console.log(`  Warning: device token registration failed (${tokenRes.status}): ${tokenErrText.slice(0, 200)}`);
+  } else {
+    console.log("  Device token registered.");
+  }
+  console.log("\nStep 5/7: Registering signing key + fetching server key...");
+  if (process.env.EXPRESS_DEBUG) {
+    console.log(`  [DEBUG] serverId: ${serverId}`);
+    console.log(`  [DEBUG] userHuid: ${userHuid}`);
+  }
+  const apigwSigningKey = generateSigningKeyPair();
+  const apigwKeyPublicBase64 = publicKeyToBase64(apigwSigningKey.publicKey);
+  const kdcSignUrl = `${getBaseUrl(config)}/api/v2/kdc/keys/${userHuid}`;
+  const kdcSignBody = JSON.stringify({
+    key: apigwKeyPublicBase64,
+    kind: "ed25519",
+    algo: "ed25519",
+    id: apigwSigningKey.keyId
+  });
+  const [kdcSignRes, etsKdcSignRes, etsKdcStartRes] = await Promise.all([
+    fetch(kdcSignUrl, {
+      method: "POST",
+      headers: {
+        ...commonHeaders(webOrigin),
+        Authorization: `Bearer ${accessToken}`,
+        "Content-Type": "application/json"
+      },
+      body: kdcSignBody
+    }),
+    fetch(`${etsBaseUrl}/api/v2/kdc/keys/${userHuid}`, {
+      method: "POST",
+      headers: {
+        ...commonHeaders(webOrigin),
+        Authorization: `Bearer ${etsAuthToken}`,
+        "Content-Type": "application/json"
+      },
+      body: kdcSignBody
+    }),
+    fetch(`${etsBaseUrl}/api/v1/kdc/start`, {
+      headers: {
+        ...commonHeaders(webOrigin)
+      }
+    })
+  ]);
+  if (!kdcSignRes.ok) {
+    const kdcErrText = await kdcSignRes.text().catch(() => "");
+    console.log(`  Warning: CTS KDC signing key registration failed (${kdcSignRes.status}): ${kdcErrText.slice(0, 200)}`);
+  } else {
+    const kdcSignData = await kdcSignRes.json().catch(() => null);
+    console.log(`  Signing key registered in CTS: ${apigwSigningKey.keyId}`, kdcSignData ? JSON.stringify(kdcSignData).slice(0, 200) : "");
+  }
+  if (!etsKdcSignRes.ok) {
+    const etsErrText = await etsKdcSignRes.text().catch(() => "");
+    console.log(`  Warning: ETS KDC signing key registration failed (${etsKdcSignRes.status}): ${etsErrText.slice(0, 200)}`);
+  } else {
+    const etsSignData = await etsKdcSignRes.json().catch(() => null);
+    console.log(`  Signing key registered in ETS: ${apigwSigningKey.keyId}`, etsSignData ? JSON.stringify(etsSignData).slice(0, 200) : "");
+  }
+  let serverPublicKey = new Uint8Array(0);
+  let serverPublicKeyId = "";
+  if (etsKdcStartRes.ok) {
+    const kdcStartText = await etsKdcStartRes.text();
+    if (process.env.EXPRESS_DEBUG) {
+      console.log(`  [DEBUG] ETS KDC start response: ${kdcStartText.slice(0, 500)}`);
+    }
+    try {
+      const kdcStartData = JSON.parse(kdcStartText);
+      const keyBody = kdcStartData.result ?? kdcStartText;
+      serverPublicKey = new Uint8Array(Buffer.from(keyBody, "base64"));
+      serverPublicKeyId = "kdc-start-ets";
+      const rawB64 = Buffer.from(serverPublicKey).toString("base64");
+      console.log(`  ETS server public key from /kdc/start: ${rawB64} (curve25519, used directly)`);
+    } catch {
+      try {
+        serverPublicKey = new Uint8Array(Buffer.from(kdcStartText, "base64"));
+      } catch {
+      }
+    }
+  }
+  if (!serverPublicKey.length) {
+    if (process.env.EXPRESS_DEBUG && !etsKdcStartRes.ok) {
+      console.log(`  [DEBUG] ETS KDC start status: ${etsKdcStartRes.status}`);
+      try {
+        console.log(`  [DEBUG] ETS KDC start body: ${(await etsKdcStartRes.text()).slice(0, 500)}`);
+      } catch {
+      }
+    }
+    throw new Error("Could not fetch server public key from ETS /kdc/start");
+  }
+  if (rtsPrivateKey) {
+    const rtsPubKeyB64 = Buffer.from(nacl3.box.keyPair.fromSecretKey(rtsPrivateKey).publicKey).toString("base64");
+    const rtsKeyBody = JSON.stringify({ key: rtsPubKeyB64, kind: "rts", algo: "xsalsa20", id: rtsPublicKeyId });
+    const [ctsRtsRes, etsRtsRes] = await Promise.all([
+      fetch(kdcSignUrl, {
+        method: "POST",
+        headers: {
+          ...commonHeaders(webOrigin),
+          Authorization: `Bearer ${accessToken}`,
+          "Content-Type": "application/json"
+        },
+        body: rtsKeyBody
+      }),
+      fetch(`${etsBaseUrl}/api/v2/kdc/keys/${userHuid}`, {
+        method: "POST",
+        headers: {
+          ...commonHeaders(webOrigin),
+          Authorization: `Bearer ${etsAuthToken}`,
+          "Content-Type": "application/json"
+        },
+        body: rtsKeyBody
+      })
+    ]);
+    if (!ctsRtsRes.ok) {
+      const errText = await ctsRtsRes.text().catch(() => "");
+      console.log(`  Warning: CTS RTS key registration failed (${ctsRtsRes.status}): ${errText.slice(0, 200)}`);
+    } else {
+      console.log(`  RTS key registered in CTS: ${rtsPublicKeyId}`);
+    }
+    if (!etsRtsRes.ok) {
+      const errText = await etsRtsRes.text().catch(() => "");
+      console.log(`  Warning: ETS RTS key registration failed (${etsRtsRes.status}): ${errText.slice(0, 200)}`);
+    } else {
+      console.log(`  RTS key registered in ETS: ${rtsPublicKeyId}`);
+    }
+  }
+  if (!rtsPrivateKey) {
+    const fallbackKeyPair = nacl3.box.keyPair();
+    rtsPrivateKey = fallbackKeyPair.secretKey;
+    rtsPublicKeyId = crypto.randomUUID();
+    const encPubB64 = Buffer.from(fallbackKeyPair.publicKey).toString("base64");
+    const rtsFallbackBody = JSON.stringify({ key: encPubB64, kind: "rts", algo: "xsalsa20", id: rtsPublicKeyId });
+    const [ctsEncRes, etsEncRes] = await Promise.all([
+      fetch(kdcSignUrl, {
+        method: "POST",
+        headers: {
+          ...commonHeaders(webOrigin),
+          Authorization: `Bearer ${accessToken}`,
+          "Content-Type": "application/json"
+        },
+        body: rtsFallbackBody
+      }),
+      fetch(`${etsBaseUrl}/api/v2/kdc/keys/${userHuid}`, {
+        method: "POST",
+        headers: {
+          ...commonHeaders(webOrigin),
+          Authorization: `Bearer ${etsAuthToken}`,
+          "Content-Type": "application/json"
+        },
+        body: rtsFallbackBody
+      })
+    ]);
+    if (!ctsEncRes.ok) {
+      const errText = await ctsEncRes.text().catch(() => "");
+      console.log(`  Warning: CTS fallback RTS key registration failed (${ctsEncRes.status}): ${errText.slice(0, 200)}`);
+    } else {
+      console.log(`  Fallback encryption key registered in CTS: ${rtsPublicKeyId}`);
+    }
+    if (!etsEncRes.ok) {
+      const errText = await etsEncRes.text().catch(() => "");
+      console.log(`  Warning: ETS fallback RTS key registration failed (${etsEncRes.status}): ${errText.slice(0, 200)}`);
+    } else {
+      console.log(`  Fallback encryption key registered in ETS: ${rtsPublicKeyId}`);
+    }
+  }
+  const rtsPublicKey = nacl3.box.keyPair.fromSecretKey(rtsPrivateKey).publicKey;
+  let rtsAuthToken = "";
+  if (encryptedRtsToken && rtsPrivateKey && serverPublicKey.length) {
+    try {
+      rtsAuthToken = decryptRtsToken(encryptedRtsToken, serverPublicKey, rtsPrivateKey);
+      setRtsAuthToken(rtsAuthToken);
+      if (process.env.EXPRESS_DEBUG) {
+        console.log(`  [DEBUG] Decrypted RTS auth token: ${rtsAuthToken.slice(0, 60)}...`);
+      }
+      console.log(`  RTS auth token decrypted from encrypted_rts_token`);
+    } catch (err) {
+      console.log(`  Warning: could not decrypt encrypted_rts_token: ${err.message}`);
+    }
+  }
+  const rtsIdFromToken = extractRtsKeyIdFromToken(accessToken);
+  if (rtsIdFromToken && process.env.EXPRESS_DEBUG) {
+    console.log(`  [DEBUG] rts_id from CTS token: ${rtsIdFromToken}`);
+  }
+  const existingCts = loadApigwKeys()?.ctsKey;
+  let ctsKey;
+  if (qrCtsPrivateKey && qrCtsKeyId) {
+    ctsKey = {
+      keyId: qrCtsKeyId,
+      privateKey: qrCtsPrivateKey,
+      publicKey: nacl3.box.keyPair.fromSecretKey(qrCtsPrivateKey).publicKey
+    };
+    console.log(`  Using CTS key from QR handshake: ${qrCtsKeyId.slice(0, 8)}... (shared account key)`);
+  } else if (existingCts) {
+    ctsKey = existingCts;
+    console.log(`  Reusing existing CTS key: ${existingCts.keyId.slice(0, 8)}... (not re-registering)`);
+  } else {
+    const currentCts = await fetchCurrentAccountCtsKey2(getBaseUrl(config), accessToken, userHuid, webOrigin);
+    if (currentCts) {
+      throw new Error(
+        `Account already has a shared CTS key (${currentCts}) that this CLI doesn't hold.
+Minting a new one would break your other devices (they can't fetch its private key).
+Instead, extract the key from a logged-in web client (IndexedDB authState \u2192 encryptionKeys \u2192 user.privateKeys.cts) and run:
+  express auth import-cts <private_key_b64> ${currentCts}
+Then re-run login, or just use 'auth refresh' for tokens.`
+      );
+    }
+    console.log("  No existing account CTS key found \u2014 minting a new one (first device).");
+    const ctsKeyPair = nacl3.box.keyPair();
+    const ctsKeyId = crypto.randomUUID();
+    const ctsKeyPubB64 = Buffer.from(ctsKeyPair.publicKey).toString("base64");
+    const ctsKeyBody = JSON.stringify({ key: ctsKeyPubB64, kind: "cts", algo: "xsalsa20", id: ctsKeyId });
+    const ctsCtsKeyRes = await fetch(kdcSignUrl, {
+      method: "POST",
+      headers: {
+        ...commonHeaders(webOrigin),
+        Authorization: `Bearer ${accessToken}`,
+        "Content-Type": "application/json"
+      },
+      body: ctsKeyBody
+    });
+    if (!ctsCtsKeyRes.ok) {
+      const errText = await ctsCtsKeyRes.text().catch(() => "");
+      console.log(`  Warning: CTS encryption key registration failed (${ctsCtsKeyRes.status}): ${errText.slice(0, 200)}`);
+    } else {
+      console.log(`  CTS encryption key registered: ${ctsKeyId.slice(0, 8)}...`);
+    }
+    ctsKey = {
+      keyId: ctsKeyId,
+      privateKey: ctsKeyPair.secretKey,
+      publicKey: ctsKeyPair.publicKey
+    };
+  }
+  const apigwKeys = {
+    signingKey: apigwSigningKey,
+    encryptionKey: {
+      keyId: rtsPublicKeyId,
+      privateKey: rtsPrivateKey,
+      publicKey: rtsPublicKey
+    },
+    ctsKey,
+    serverPublicKey,
+    serverPublicKeyId
+  };
+  saveApigwKeys(apigwKeys);
+  console.log("\nStep 6/7: Activating apigw via ETS...");
+  const activationUrl = `${etsBaseUrl}/api/v1/apigw/api/v1/authentication/activation`;
+  const activationBody = JSON.stringify({
+    app_version: config.app_version,
+    locale: config.locale,
+    device_meta: {
+      pushes: false,
+      timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
+      permissions: { notifications: false }
+    },
+    device_hostname: null
+  });
+  const activationHeaders = await signApigwRequest({
+    method: "PUT",
+    url: activationUrl,
+    baseUrl: etsBaseUrl,
+    body: activationBody,
+    ctsToken: accessToken,
+    rtsToken: rtsAuthToken || void 0,
+    etsAuthToken: etsAuthToken || void 0
+  });
+  const activationRes = await fetch(activationUrl, {
+    method: "PUT",
+    headers: { ...commonHeaders(webOrigin), ...activationHeaders },
+    body: activationBody
+  });
+  if (!activationRes.ok) {
+    const actErrText = await activationRes.text().catch(() => "");
+    console.log(`  Warning: apigw activation failed (${activationRes.status}): ${actErrText.slice(0, 200)}`);
+  } else {
+    console.log("  Apigw activated.");
+  }
+  console.log(`
+  User HUID: ${userHuid || "unknown"}`);
+  console.log(`  Signing key: ${apigwSigningKey.keyId.slice(0, 8)}...`);
+  console.log(`  Encryption key: ${rtsPublicKeyId.slice(0, 8)}...`);
+  console.log(`  Server key: ${serverPublicKeyId.slice(0, 8)}...`);
+  console.log("\nQR login complete! You are now authenticated.");
+}
+
+// src/auth/token-refresh.ts
+var refreshPromise = null;
+async function refreshToken(cliOverrides = {}) {
+  if (refreshPromise) return refreshPromise;
+  refreshPromise = doRefresh(cliOverrides);
+  try {
+    return await refreshPromise;
+  } finally {
+    refreshPromise = null;
+  }
+}
+async function doRefresh(cliOverrides = {}) {
+  const currentToken = getAuthToken();
+  const rt = getRefreshToken();
+  if (!currentToken || !rt) return false;
+  const config = loadConfig(cliOverrides);
+  const baseUrl = getBaseUrl(config);
+  const webOrigin = getWebOrigin(config);
+  try {
+    const res = await fetch(`${baseUrl}/api/v1/ad_integration/token/refresh`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json, text/plain, */*",
+        "Accept-Language": "ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7",
+        "Cache-Control": "no-cache",
+        Connection: "keep-alive",
+        Origin: webOrigin,
+        Pragma: "no-cache",
+        Referer: `${webOrigin}/`,
+        "Sec-Fetch-Dest": "empty",
+        "Sec-Fetch-Mode": "cors",
+        "Sec-Fetch-Site": "same-site",
+        "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36",
+        Authorization: `Bearer ${currentToken}`
+      },
+      body: JSON.stringify({ refresh_token: rt })
+    });
+    if (!res.ok) {
+      return false;
+    }
+    const text = await res.text();
+    const data = JSON.parse(text);
+    const result = data.result ?? data;
+    const newAccessToken = result.cts_access_token;
+    const newRefreshToken = result.refresh_token;
+    const expiresIn = result.expires_in;
+    if (!newAccessToken) return false;
+    setAuthToken(newAccessToken);
+    if (newRefreshToken) setRefreshToken(newRefreshToken);
+    if (typeof expiresIn === "number") {
+      setTokenExpiresAt(calcTokenExpiresAt(expiresIn));
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/cli/auth.ts
+function createAuthCommand() {
+  const cmd = new Command("auth");
+  cmd.description("Authentication management");
+  cmd.command("import <token>").description("Import Bearer token from browser").option("--host <host>", "eXpress host").action(async (token, opts) => {
+    try {
+      await importToken(token, opts.host ? { host: opts.host } : {});
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+  cmd.command("login").description("Full device login (ed25519 signing for apigw endpoints)").option("--host <host>", "eXpress host").action(async (opts) => {
+    try {
+      await deviceLogin(opts.host ? { host: opts.host } : {});
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+  cmd.command("qr").description("QR-code login (scan with eXpress mobile app)").option("--host <host>", "eXpress host").action(async (opts) => {
+    try {
+      await qrLogin(opts.host ? { host: opts.host } : {});
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+  cmd.command("import-cts <private_key_b64> <key_id>").description("Import the account's shared CTS (E2E) key so the CLI decrypts like your phone/desktop. Get both values from the web client's IndexedDB (authState \u2192 encryptionKeys \u2192 user.privateKeys.cts: body + publicKeyId).").action((privateKeyB64, keyId) => {
+    try {
+      const ctsKey = importCtsKey(privateKeyB64, keyId);
+      const pub = Buffer.from(ctsKey.publicKey).toString("base64");
+      console.log(`CTS key imported: ${keyId}`);
+      console.log(`  derived public key: ${pub}`);
+      console.log("  Verify this matches the KDC 'body' for this key_id. Do NOT run 'auth login/qr' with a different device now \u2014 it would re-register a new key and break sync.");
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+  cmd.command("logout").description("Remove stored authentication token and apigw keys").action(() => {
+    clearApigwKeys();
+    logout();
+  });
+  cmd.command("status").description("Show current authentication status").action(() => {
+    status();
+    const expiresAt = getTokenExpiresAt();
+    const hasRefresh = !!getRefreshToken();
+    if (expiresAt) {
+      const remaining = Math.max(0, Math.floor((expiresAt - Date.now()) / 1e3));
+      const expired = remaining === 0;
+      console.log(`Token: ${expired ? "EXPIRED" : `expires in ${remaining}s (~${(remaining / 60).toFixed(0)} min)`}`);
+      console.log(`Refresh: ${hasRefresh ? "available" : "not available"}`);
+    } else {
+      console.log("Token: expiry unknown");
+      console.log(`Refresh: ${hasRefresh ? "available" : "not available"}`);
+    }
+    const keys = loadApigwKeys();
+    if (keys) {
+      console.log(`Apigw: enabled (signing: ${keys.signingKey.keyId.slice(0, 8)}..., encryption: ${keys.encryptionKey.keyId.slice(0, 8)}..., server: ${keys.serverPublicKeyId.slice(0, 8)}...)`);
+    } else {
+      console.log("Apigw: not configured. Run 'express auth login' or 'express auth qr' to enable.");
+    }
+  });
+  cmd.command("refresh").description("Refresh access token using refresh token").action(async () => {
+    try {
+      const refreshed = await refreshToken();
+      if (refreshed) {
+        const expiresAt = getTokenExpiresAt();
+        const remaining = expiresAt ? Math.max(0, Math.floor((expiresAt - Date.now()) / 1e3)) : 0;
+        console.log(`Token refreshed successfully (expires in ${remaining}s)`);
+      } else {
+        console.error("Failed to refresh token. Re-authenticate with `express auth qr`.");
+        process.exit(1);
+      }
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+  return cmd;
+}
+
+// src/cli/api.ts
+import { Command as Command2 } from "commander";
+
+// src/api/client.ts
+var ApiClient = class {
+  config;
+  baseUrl;
+  etsBaseUrl;
+  webOrigin;
+  constructor(cliOverrides = {}) {
+    this.config = loadConfig(cliOverrides);
+    this.baseUrl = getBaseUrl(this.config);
+    this.etsBaseUrl = getEtsBaseUrl(this.config);
+    this.webOrigin = getWebOrigin(this.config);
+  }
+  getToken() {
+    const token = this.config.token ?? getAuthToken();
+    if (!token) {
+      throw new Error("Not authenticated. Use `express auth import <token>` to login.");
+    }
+    return token;
+  }
+  isApigwPath(path) {
+    return path.includes("/apigw/");
+  }
+  resolveUrl(path) {
+    if (path.startsWith("http")) return path;
+    if (this.isApigwPath(path)) {
+      return `${this.etsBaseUrl}${path}`;
+    }
+    return `${this.baseUrl}${path}`;
+  }
+  async request(path, options = {}, retry = true) {
+    if (retry && isTokenExpiringSoon()) {
+      await refreshToken(this.config);
+    }
+    let token = this.getToken();
+    const url = this.resolveUrl(path);
+    const headers = {
+      Accept: "application/json",
+      ...this.isApigwPath(path) ? await this.buildApigwHeaders(options.method ?? "GET", path, token, options.body) : { Authorization: `Bearer ${token}` },
+      Origin: this.webOrigin,
+      ...options.headers ?? {}
+    };
+    if (options.body && !headers["Content-Type"]) {
+      headers["Content-Type"] = "application/json";
+    }
+    const res = await fetch(url, {
+      ...options,
+      headers
+    });
+    if (res.status === 401 && retry) {
+      const text = await res.text().catch(() => "");
+      const isExpired = text.includes("token_expired");
+      if (isExpired) {
+        const refreshed = await refreshToken(this.config);
+        if (refreshed) {
+          const newToken = this.getToken();
+          const newHeaders = {
+            Accept: "application/json",
+            ...this.isApigwPath(path) ? await this.buildApigwHeaders(options.method ?? "GET", path, newToken, options.body) : { Authorization: `Bearer ${newToken}` },
+            Origin: this.webOrigin,
+            ...options.headers ?? {}
+          };
+          if (options.body && !newHeaders["Content-Type"]) {
+            newHeaders["Content-Type"] = "application/json";
+          }
+          const retryRes = await fetch(url, { ...options, headers: newHeaders });
+          return this.handleResponse(retryRes);
+        }
+      }
+      throw new Error("Token expired and refresh failed. Please re-authenticate with `express auth qr`.");
+    }
+    return this.handleResponse(res);
+  }
+  async handleResponse(res) {
+    if (res.status === 204) {
+      return void 0;
+    }
+    if (!res.ok) {
+      const text2 = await res.text().catch(() => "");
+      throw new Error(`API error ${res.status}: ${res.statusText}${text2 ? ` \u2014 ${text2.slice(0, 200)}` : ""}`);
+    }
+    const text = await res.text();
+    if (!text) {
+      return void 0;
+    }
+    const data = JSON.parse(text);
+    if (data && typeof data === "object" && "result" in data) {
+      return data.result;
+    }
+    return data;
+  }
+  async buildApigwHeaders(method, path, ctsToken, body) {
+    const rtsToken = getRtsAuthToken() ?? void 0;
+    const etsAuthToken = getEtsAuthToken() ?? void 0;
+    const etsBaseUrl = this.etsBaseUrl;
+    const signed = await signApigwRequest({
+      method,
+      url: path.startsWith("http") ? path : `${etsBaseUrl}${path}`,
+      baseUrl: etsBaseUrl,
+      body,
+      ctsToken,
+      rtsToken,
+      etsAuthToken
+    });
+    return {
+      Authorization: signed.Authorization,
+      "Express-Proxy-Authorization": signed["Express-Proxy-Authorization"],
+      "Express-Request-Nonce": signed["Express-Request-Nonce"],
+      ...signed.Digest && { Digest: signed.Digest },
+      Signature: signed.Signature
+    };
+  }
+  async get(path) {
+    return this.request(path, { method: "GET" });
+  }
+  async post(path, body) {
+    const jsonBody = body ? JSON.stringify(body) : void 0;
+    return this.request(path, {
+      method: "POST",
+      body: jsonBody
+    });
+  }
+  async put(path, body) {
+    const jsonBody = body ? JSON.stringify(body) : void 0;
+    return this.request(path, {
+      method: "PUT",
+      body: jsonBody
+    });
+  }
+  async delete(path) {
+    return this.request(path, { method: "DELETE" });
+  }
+  async rawRequest(path, options = {}) {
+    const token = this.getToken();
+    const url = this.resolveUrl(path);
+    const headers = {
+      Accept: "application/json",
+      ...this.isApigwPath(path) ? await this.buildApigwHeaders(options.method ?? "GET", path, token, options.body) : { Authorization: `Bearer ${token}` },
+      Origin: this.webOrigin,
+      ...options.headers ?? {}
+    };
+    if (options.body && !headers["Content-Type"]) {
+      headers["Content-Type"] = "application/json";
+    }
+    return fetch(url, { ...options, headers });
+  }
+  async downloadFile(url) {
+    const token = this.getToken();
+    const fullUrl = url.startsWith("http") ? url : `${this.baseUrl}${url}`;
+    return fetch(fullUrl, {
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Referer: `${this.webOrigin}/`,
+        Accept: "*/*"
+      }
+    });
+  }
+  isApigwReady() {
+    return loadApigwKeys() !== null;
+  }
+};
+
+// src/cli/output.ts
+import chalk from "chalk";
+import Table from "cli-table3";
+function formatOutput(data, format) {
+  if (format === "json") {
+    return JSON.stringify(data, null, 2);
+  }
+  if (typeof data === "string") return data;
+  if (typeof data === "number" || typeof data === "boolean") return String(data);
+  return JSON.stringify(data, null, 2);
+}
+function formatProfileTable(profiles) {
+  const table = new Table({
+    head: ["Name", "Email", "AD Login", "Department", "Position", "HUID"],
+    style: { head: ["cyan"] }
+  });
+  for (const p of profiles) {
+    table.push([
+      p.name ?? "-",
+      p.email ?? "-",
+      p.ad_login ?? "-",
+      p.department ?? "-",
+      p.company_position ?? "-",
+      p.user_huid ? p.user_huid.slice(0, 8) + "..." : "-"
+    ]);
+  }
+  return table.toString();
+}
+function formatStatusTable(statuses) {
+  const table = new Table({
+    head: ["HUID", "Status", "Last Seen"],
+    style: { head: ["cyan"] }
+  });
+  const statusColors = {
+    online: chalk.green,
+    offline: chalk.gray,
+    away: chalk.yellow,
+    dnd: chalk.red,
+    invisible: chalk.gray
+  };
+  for (const s of statuses) {
+    const color = statusColors[s.status] ?? chalk.white;
+    table.push([
+      s.huid ? s.huid.slice(0, 8) + "..." : "-",
+      color(s.status),
+      s.last_seen ?? "-"
+    ]);
+  }
+  return table.toString();
+}
+
+// src/cli/api.ts
+function createApiCommand() {
+  const cmd = new Command2("api");
+  cmd.description("Make arbitrary API request").argument("<path>", "API path (e.g. /api/v1/phonebook/profiles/self)").option("-X, --method <method>", "HTTP method", "GET").option("-d, --data <data>", "Request body (JSON)").option("--host <host>", "eXpress host").option("-o, --output <format>", "Output format", "json").action(async (path, opts) => {
+    try {
+      const client = new ApiClient(opts.host ? { host: opts.host } : void 0);
+      let body;
+      if (opts.data) {
+        try {
+          body = JSON.parse(opts.data);
+        } catch {
+          throw new Error("Invalid JSON in --data");
+        }
+      }
+      const method = opts.method.toUpperCase();
+      const res = await client.rawRequest(path, {
+        method,
+        body: body ? JSON.stringify(body) : void 0
+      });
+      const text = await res.text();
+      console.log(`Response: status=${res.status}, content-type=${res.headers.get("content-type")}, body=${text.length} chars`);
+      if (!text) {
+        return;
+      }
+      let data;
+      try {
+        data = JSON.parse(text);
+      } catch {
+        console.log(`Response: status=${res.status}, non-JSON body (${text.length} chars): ${text.slice(0, 500)}`);
+        return;
+      }
+      if (!res.ok) {
+        console.error(`API error ${res.status}:`, JSON.stringify(data, null, 2));
+        process.exit(1);
+      }
+      console.log(formatOutput(data, opts.output));
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+  return cmd;
+}
+
+// src/cli/config-cmd.ts
+import { Command as Command3 } from "commander";
+function createConfigCommand() {
+  const cmd = new Command3("config");
+  cmd.description("Configuration management");
+  cmd.command("get [key]").description("Get config value(s)").option("-o, --output <format>", "Output format", "json").action((key, opts) => {
+    const config = getStoredConfig();
+    const data = key ? { [key]: config[key] } : config;
+    console.log(formatOutput(data, opts?.output ?? "json"));
+  });
+  cmd.command("set <key> <value>").description("Set config value").action((key, value) => {
+    const current = getStoredConfig();
+    let parsed = value;
+    try {
+      parsed = JSON.parse(value);
+    } catch {
+    }
+    setStoredConfig({ ...current, [key]: parsed });
+    console.log(`Set ${key} = ${JSON.stringify(parsed)}`);
+  });
+  cmd.command("list").description("List all config values").option("-o, --output <format>", "Output format", "json").action((opts) => {
+    console.log(formatOutput(getStoredConfig(), opts.output));
+  });
+  cmd.command("reset").description("Reset all configuration and tokens").action(() => {
+    clearAll();
+    console.log("All configuration and tokens cleared.");
+  });
+  return cmd;
+}
+
+// src/cli/status.ts
+import { Command as Command4 } from "commander";
+
+// src/api/user.ts
+var UserApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  async getSelfProfile() {
+    const data = await this.client.get("/api/v1/phonebook/profiles/self");
+    return data.profile;
+  }
+  async getProfilesByHuid(huids) {
+    const data = await this.client.post("/api/v1/phonebook/cts_profiles/query", { huids });
+    if (!data) return [];
+    const entries = Array.isArray(data) ? data : [];
+    const profiles = [];
+    for (const entry of entries) {
+      const obj = entry;
+      if (Array.isArray(obj.cts_profiles)) {
+        profiles.push(...obj.cts_profiles);
+      }
+    }
+    return profiles;
+  }
+  async getUserStatuses(userHuids, short = false) {
+    const keys = loadApigwKeys();
+    const keyId = (keys?.ctsKey ?? keys?.encryptionKey)?.keyId ?? "";
+    return this.client.post("/api/v1/user_statuses/get", {
+      user_huids: userHuids,
+      short,
+      key_id: keyId
+    });
+  }
+  async getUserStatusHistory(since) {
+    return this.client.post("/api/v1/user_statuses/history", {
+      since: since ?? null
+    });
+  }
+};
+
+// src/cli/status.ts
+function createStatusCommand() {
+  const cmd = new Command4("status");
+  cmd.description("Get user statuses");
+  cmd.command("self").description("Get own status").option("-s, --short", "Short format", false).option("--host <host>", "eXpress host").option("-o, --output <format>", "Output format", "table").action(async (opts) => {
+    try {
+      const client = new ApiClient(opts.host ? { host: opts.host } : void 0);
+      const api = new UserApi(client);
+      const profile = await api.getSelfProfile();
+      const result = await api.getUserStatuses([profile.user_huid], opts.short);
+      if (opts.output === "json") {
+        console.log(formatOutput(result, "json"));
+      } else {
+        console.log(formatStatusTable(result.user_statuses));
+      }
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+  cmd.command("get <huids...>").description("Get statuses for users by HUID").option("-s, --short", "Short format", false).option("--host <host>", "eXpress host").option("-o, --output <format>", "Output format", "table").action(async (huids, opts) => {
+    try {
+      const client = new ApiClient(opts.host ? { host: opts.host } : void 0);
+      const api = new UserApi(client);
+      const result = await api.getUserStatuses(huids, opts.short);
+      if (opts.output === "json") {
+        console.log(formatOutput(result, "json"));
+      } else {
+        console.log(formatStatusTable(result.user_statuses));
+      }
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+  cmd.command("history").description("Get status history").option("--since <iso-date>", "Since date (ISO 8601)").option("--host <host>", "eXpress host").option("-o, --output <format>", "Output format", "json").action(async (opts) => {
+    try {
+      const client = new ApiClient(opts.host ? { host: opts.host } : void 0);
+      const api = new UserApi(client);
+      const history = await api.getUserStatusHistory(opts.since);
+      console.log(formatOutput(history, opts.output));
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+  return cmd;
+}
+
+// src/cli/contacts.ts
+import { Command as Command5 } from "commander";
+import chalk2 from "chalk";
+
+// src/api/websocket.ts
+import { randomUUID as randomUUID3 } from "crypto";
+async function fetchChatListViaWebSocket(params) {
+  const { host, ctsToken, encryptionKeyId, timeoutMs = 15e3 } = params;
+  const instanceId = randomUUID3();
+  const wsUrl = `wss://${host}/socket/user/websocket?vsn=1.0.0&auto_join=true&key_id=${encryptionKeyId}&version=6&background=false&voex_unencrypted=true&voex_multistream=true&voex_audio_bridge=true&instance_id=${instanceId}`;
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const done = (fn) => {
+      if (!settled) {
+        settled = true;
+        fn();
+      }
+    };
+    const timer = setTimeout(() => {
+      try {
+        ws.close();
+      } catch {
+      }
+      done(() => reject(new Error("WebSocket timeout: no chat_list response")));
+    }, timeoutMs);
+    const hostParts = host.split(".");
+    const webOrigin = `https://${hostParts.length > 2 ? hostParts.slice(1).join(".") : host}`;
+    const ws = new WebSocket(wsUrl, {
+      headers: {
+        Origin: webOrigin,
+        "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36"
+      }
+    });
+    const authRef = 0;
+    const chatListRef = 1;
+    const send = (msg) => {
+      ws.send(JSON.stringify(msg));
+    };
+    ws.addEventListener("open", () => {
+      send({ topic: "phoenix", event: "authenticate", payload: { token: ctsToken }, ref: authRef });
+    });
+    ws.addEventListener("message", (event) => {
+      let msg;
+      try {
+        msg = JSON.parse(event.data);
+      } catch {
+        return;
+      }
+      if (msg.ref === authRef && msg.topic === "phoenix" && msg.event === "phx_reply") {
+        if (msg.payload.status !== "ok") {
+          clearTimeout(timer);
+          ws.close();
+          done(() => reject(new Error(`WebSocket auth failed: ${JSON.stringify(msg.payload.response)}`)));
+          return;
+        }
+        send({ topic: "system", event: "chat_list", payload: { since: null, request_version: 6 }, ref: chatListRef });
+        return;
+      }
+      if (msg.ref === chatListRef && msg.topic === "system" && msg.event === "phx_reply") {
+        if (msg.payload.status !== "ok") {
+          clearTimeout(timer);
+          ws.close();
+          done(() => reject(new Error(`WebSocket chat_list failed: ${JSON.stringify(msg.payload.response)}`)));
+          return;
+        }
+        const response = msg.payload.response;
+        if (Array.isArray(response.chat_list)) {
+          clearTimeout(timer);
+          ws.close();
+          done(() => resolve(response.chat_list));
+        }
+      }
+    });
+    ws.addEventListener("error", (err) => {
+      clearTimeout(timer);
+      done(() => reject(new Error(`WebSocket connection error: ${String(err)}`)));
+    });
+    ws.addEventListener("close", (event) => {
+      clearTimeout(timer);
+      done(() => reject(new Error(`WebSocket closed before completion (code=${event.code})`)));
+    });
+  });
+}
+
+// src/api/chats.ts
+var ChatsApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  async listChats() {
+    const config = loadConfig();
+    const host = new URL(getBaseUrl(config)).hostname;
+    const ctsToken = getAuthToken();
+    const keys = loadApigwKeys();
+    const ctsKeyId = (keys?.ctsKey ?? keys?.encryptionKey)?.keyId;
+    if (ctsToken && ctsKeyId) {
+      try {
+        return await fetchChatListViaWebSocket({
+          host,
+          ctsToken,
+          encryptionKeyId: ctsKeyId
+        });
+      } catch (err) {
+        if (process.env.EXPRESS_DEBUG) {
+          console.error(`  [DEBUG] WebSocket failed, falling back to directory: ${err.message}`);
+        }
+      }
+    }
+    return this.listChatsViaDirectory();
+  }
+  async listChatsViaDirectory() {
+    const data = await this.client.get("/api/v1/corporate_directory/entries");
+    const entries = data?.entries ?? [];
+    const chatIds = entries.filter((e) => e.entry_type === "chat" && !e.deleted).map((e) => e.entry_id);
+    if (chatIds.length === 0) return [];
+    const result = await this.client.post("/api/v1/messaging/chats/open_chats_list", {
+      chat_ids: chatIds
+    });
+    return result?.open_chats ?? [];
+  }
+  async getChatInfo(chatId) {
+    const data = await this.client.post("/api/v1/messaging/chats/open_chats_list", {
+      chat_ids: [chatId]
+    });
+    return data?.open_chats?.[0] ?? null;
+  }
+};
+
+// src/api/phonebook.ts
+var PhonebookApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  async getContacts() {
+    const data = await this.client.get("/api/v1/apigw/api/v1/phonebook/contacts");
+    if (!data) return [];
+    if (Array.isArray(data)) return data;
+    if (typeof data === "object" && data !== null) {
+      const obj = data;
+      if (Array.isArray(obj.contacts)) return obj.contacts;
+      if (Array.isArray(obj.users)) return obj.users;
+      if (Array.isArray(obj.result)) return obj.result;
+    }
+    return [];
+  }
+  async getContactChanges(since, udid = "latest_mobile") {
+    return this.client.get(
+      `/api/v1/apigw/api/v4/phonebook/user_contacts_changes?since=${encodeURIComponent(since)}&udid=${udid}`
+    );
+  }
+  async getEncryptedEntries(since, udid = "latest_mobile") {
+    return this.client.get(
+      `/api/v1/apigw/api/v4/phonebook/encrypted_entries?since=${encodeURIComponent(since)}&udid=${udid}`
+    );
+  }
+  async getCorporateDirectory(since) {
+    const params = since ? `?since=${encodeURIComponent(since)}` : "";
+    const data = await this.client.get(`/api/v1/corporate_directory/entries${params}`);
+    if (!data) return { entries: [] };
+    if (typeof data === "object" && data !== null && "entries" in data) return data;
+    return data;
+  }
+  async searchUsers(query, limit = 20) {
+    return this.searchUsersPhonebook(query, limit);
+  }
+  async searchUsersPhonebook(query, limit) {
+    const data = await this.client.get(
+      `/api/v3/phonebook/search?query=${encodeURIComponent(query)}&active=true&disable_fuzzy_search=false`
+    );
+    if (!data || typeof data !== "object") return [];
+    const obj = data;
+    const result = obj.result;
+    const phonebook = result?.phonebook ?? [];
+    const huids = [
+      ...new Set(
+        phonebook.flatMap((entry) => entry.contacts ?? []).map((c) => c.user_huid).filter(Boolean)
+      )
+    ].slice(0, limit);
+    if (huids.length === 0) return [];
+    const raw = await this.client.rawRequest("/api/v1/phonebook/cts_profiles/query", {
+      method: "POST",
+      body: JSON.stringify({ huids })
+    });
+    const profileData = await raw.json();
+    const entries = profileData.result ?? [];
+    const profiles = [];
+    for (const entry of entries) {
+      profiles.push(...entry.cts_profiles ?? []);
+    }
+    return profiles.slice(0, limit);
+  }
+  async searchUsersApigw(query, limit, contacts) {
+    const lowerQuery = query.toLowerCase();
+    const matched = contacts.filter((c) => {
+      const searchable = [c.name, c.email, c.ad_login, c.department, c.company_position, c.phone, c.ip_phone].filter(Boolean).join(" ").toLowerCase();
+      return searchable.includes(lowerQuery);
+    }).slice(0, limit);
+    if (matched.length > 0) {
+      const huids = matched.map((c) => c.huid).filter(Boolean);
+      if (huids.length > 0) {
+        const raw = await this.client.rawRequest("/api/v1/phonebook/cts_profiles/query", {
+          method: "POST",
+          body: JSON.stringify({ huids })
+        });
+        const data = await raw.json();
+        const entries = data.result ?? (Array.isArray(data) ? data : []);
+        const profiles = [];
+        for (const entry of entries) {
+          profiles.push(...entry.cts_profiles ?? []);
+        }
+        return profiles.slice(0, limit);
+      }
+    }
+    return [];
+  }
+  async searchUsersDirectory(query, limit) {
+    const dirData = await this.getCorporateDirectory();
+    const entries = dirData?.entries ?? [];
+    const userIds = entries.filter((e) => e.entry_type === "user" && !e.deleted).map((e) => e.entry_id);
+    if (userIds.length === 0) {
+      return [];
+    }
+    const batchSize = 100;
+    const allProfiles = [];
+    const lowerQuery = query.toLowerCase();
+    for (let i = 0; i < userIds.length && allProfiles.length < limit; i += batchSize) {
+      const batch = userIds.slice(i, i + batchSize);
+      const raw = await this.client.rawRequest("/api/v1/phonebook/cts_profiles/query", {
+        method: "POST",
+        body: JSON.stringify({ huids: batch })
+      });
+      const data = await raw.json();
+      const entries2 = data.result ?? (Array.isArray(data) ? data : []);
+      for (const entry of entries2) {
+        for (const p of entry.cts_profiles ?? []) {
+          const searchable = [
+            p.name,
+            p.email,
+            p.ad_login,
+            p.department,
+            p.company_position,
+            p.phone,
+            p.ip_phone
+          ].filter(Boolean).join(" ").toLowerCase();
+          if (searchable.includes(lowerQuery)) {
+            allProfiles.push(p);
+            if (allProfiles.length >= limit) return allProfiles;
+          }
+        }
+      }
+    }
+    return allProfiles;
+  }
+};
+
+// src/cli/contacts.ts
+function createContactsCommand() {
+  const cmd = new Command5("contacts");
+  cmd.description("Contacts and phonebook");
+  cmd.command("self").description("Get own profile").option("--host <host>", "eXpress host").option("-o, --output <format>", "Output format", "table").action(async (opts) => {
+    try {
+      const client = new ApiClient(opts.host ? { host: opts.host } : void 0);
+      const api = new UserApi(client);
+      const profile = await api.getSelfProfile();
+      if (opts.output === "json") {
+        console.log(formatOutput(profile, "json"));
+      } else {
+        console.log(formatProfileTable([profile]));
+      }
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+  cmd.command("query <huids...>").description("Query profiles by HUIDs").option("--host <host>", "eXpress host").option("-o, --output <format>", "Output format", "table").action(async (huids, opts) => {
+    try {
+      const client = new ApiClient(opts.host ? { host: opts.host } : void 0);
+      const api = new UserApi(client);
+      const profiles = await api.getProfilesByHuid(huids);
+      if (opts.output === "json") {
+        console.log(formatOutput(profiles, "json"));
+      } else {
+        console.log(formatProfileTable(profiles));
+      }
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+  cmd.command("search <query>").description("Search users by name/email/department (apigw or directory)").option("-l, --limit <n>", "Max results", "20").option("--host <host>", "eXpress host").option("-o, --output <format>", "Output format", "table").action(async (query, opts) => {
+    try {
+      const client = new ApiClient(opts.host ? { host: opts.host } : void 0);
+      const limit = parseInt(opts.limit, 10);
+      const phonebook = new PhonebookApi(client);
+      let profiles = await phonebook.searchUsers(query, limit);
+      if (profiles.length === 0) {
+        try {
+          const userApi = new UserApi(client);
+          const chatsApi = new ChatsApi(client);
+          const [allChats, self] = await Promise.all([chatsApi.listChats(), userApi.getSelfProfile()]);
+          const myHuid = self.user_huid;
+          const allMemberHuids = [...new Set(
+            allChats.flatMap((c) => c.member_huids ?? []).filter((h) => h !== myHuid)
+          )];
+          if (allMemberHuids.length > 0) {
+            const allProfiles = await userApi.getProfilesByHuid(allMemberHuids);
+            const lowerQuery = query.toLowerCase();
+            profiles = allProfiles.filter(
+              (p) => [p.name, p.email, p.ad_login, p.department, p.company_position].filter(Boolean).join(" ").toLowerCase().includes(lowerQuery)
+            ).slice(0, limit);
+          }
+        } catch (err) {
+          if (process.env.EXPRESS_DEBUG) {
+            console.error(`  [DEBUG] Chat member search failed: ${err.message}`);
+          }
+        }
+      }
+      if (profiles.length === 0) {
+        console.log(chalk2.yellow("No users found."));
+        return;
+      }
+      if (opts.output === "json") {
+        console.log(formatOutput(profiles, "json"));
+      } else {
+        console.log(formatProfileTable(profiles));
+      }
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+  cmd.command("list").description("List all contacts (requires 'express auth login')").option("--host <host>", "eXpress host").option("-o, --output <format>", "Output format", "json").action(async (opts) => {
+    try {
+      const client = new ApiClient(opts.host ? { host: opts.host } : void 0);
+      if (!client.isApigwReady()) {
+        console.error(chalk2.yellow("Error: This command requires apigw auth. Run 'express auth login' first."));
+        process.exit(1);
+      }
+      const api = new PhonebookApi(client);
+      const contacts = await api.getContacts();
+      if (!contacts || contacts.length === 0) {
+        console.log(chalk2.yellow("No contacts found. The apigw phonebook endpoint may not have synced contacts yet."));
+        console.log(chalk2.yellow("Use 'express contacts search <query>' to search via corporate directory."));
+        return;
+      }
+      console.log(formatOutput(contacts, opts.output));
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+  cmd.command("directory").description("Corporate directory entries").option("--since <iso-date>", "Since date (ISO 8601)").option("--host <host>", "eXpress host").option("-o, --output <format>", "Output format", "json").action(async (opts) => {
+    try {
+      const client = new ApiClient(opts.host ? { host: opts.host } : void 0);
+      const api = new PhonebookApi(client);
+      const entries = await api.getCorporateDirectory(opts.since);
+      console.log(formatOutput(entries, opts.output));
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+  return cmd;
+}
+
+// src/cli/settings.ts
+import { Command as Command6 } from "commander";
+
+// src/api/settings.ts
+var SettingsApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  async getServerMeta() {
+    return this.client.get("/api/v1/settings/server/meta/");
+  }
+  async getSettings(since) {
+    const params = since ? `?since=${encodeURIComponent(since)}` : "";
+    return this.client.get(`/api/v2/settings/${params}`);
+  }
+  async getRoles(deviceHash) {
+    return this.client.get(`/api/v1/roles/rules?device_hash=${encodeURIComponent(deviceHash)}`);
+  }
+};
+
+// src/cli/settings.ts
+function createSettingsCommand() {
+  const cmd = new Command6("settings");
+  cmd.description("Server settings and meta");
+  cmd.command("meta").description("Get server metadata").option("--host <host>", "eXpress host").option("-o, --output <format>", "Output format", "json").action(async (opts) => {
+    try {
+      const client = new ApiClient(opts.host ? { host: opts.host } : void 0);
+      const api = new SettingsApi(client);
+      const meta = await api.getServerMeta();
+      console.log(formatOutput(meta, opts.output));
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+  cmd.command("get").description("Get settings").option("--since <iso-date>", "Since date (ISO 8601)").option("--host <host>", "eXpress host").option("-o, --output <format>", "Output format", "json").action(async (opts) => {
+    try {
+      const client = new ApiClient(opts.host ? { host: opts.host } : void 0);
+      const api = new SettingsApi(client);
+      const settings = await api.getSettings(opts.since);
+      console.log(formatOutput(settings, opts.output));
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+  return cmd;
+}
+
+// src/cli/chats.ts
+import { Command as Command7 } from "commander";
+import Table2 from "cli-table3";
+import chalk3 from "chalk";
+async function resolveDmNames(chats, client) {
+  const dmChats = chats.filter((c) => c.chat_type === "chat" && c.member_huids?.length);
+  if (dmChats.length === 0) return;
+  try {
+    const userApi = new UserApi(client);
+    const self = await userApi.getSelfProfile();
+    const myHuid = self.user_huid;
+    const otherHuids = [...new Set(
+      dmChats.flatMap((c) => (c.member_huids ?? []).filter((h) => h !== myHuid))
+    )];
+    if (otherHuids.length === 0) return;
+    const profiles = await userApi.getProfilesByHuid(otherHuids);
+    const nameMap = new Map(profiles.map((p) => [p.user_huid, p.name]));
+    for (const chat of chats) {
+      if (chat.chat_type === "chat" && chat.member_huids) {
+        const otherHuid = chat.member_huids.find((h) => h !== myHuid);
+        if (otherHuid) chat.name = nameMap.get(otherHuid) ?? chat.name;
+      }
+    }
+  } catch (err) {
+    if (process.env.EXPRESS_DEBUG) {
+      console.error(`  [DEBUG] Failed to resolve DM names: ${err.message}`);
+    }
+  }
+}
+function typeLabel(chatType) {
+  if (chatType === "channel" || chatType === "global") return chalk3.magenta(chatType);
+  if (chatType === "group_chat") return chalk3.blue("group");
+  if (chatType === "chat") return chalk3.green("dm");
+  return chalk3.gray(chatType);
+}
+function memberCount(c) {
+  return c.members_count != null ? String(c.members_count) : c.member_huids?.length != null ? String(c.member_huids.length) : "-";
+}
+function createChatsCommand() {
+  const cmd = new Command7("chats");
+  cmd.description("Chat management");
+  cmd.command("list").description("List all chats (uses WebSocket for full list)").option("--host <host>", "eXpress host").option("--type <type>", "Filter by type: dm, group, channel, all", "all").option("-o, --output <format>", "Output format", "table").action(async (opts) => {
+    try {
+      const client = new ApiClient(opts.host ? { host: opts.host } : void 0);
+      const api = new ChatsApi(client);
+      let chats = await api.listChats();
+      await resolveDmNames(chats, client);
+      if (opts.type !== "all") {
+        const typeMap = {
+          dm: ["chat"],
+          group: ["group_chat"],
+          channel: ["channel", "global"]
+        };
+        const allowed = typeMap[opts.type] ?? [];
+        chats = chats.filter((c) => allowed.includes(c.chat_type));
+      }
+      if (opts.output === "json") {
+        console.log(formatOutput(chats, "json"));
+        return;
+      }
+      const table = new Table2({
+        head: ["Name", "Type", "Members", "Chat ID"],
+        style: { head: ["cyan"] }
+      });
+      for (const c of chats) {
+        table.push([c.name ?? "-", typeLabel(c.chat_type), memberCount(c), c.group_chat_id.slice(0, 8) + "..."]);
+      }
+      console.log(table.toString());
+      console.log(chalk3.gray(`  ${chats.length} chats`));
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+  cmd.command("find <query>").description("Find chats by name (case-insensitive), shows full IDs").option("--host <host>", "eXpress host").option("--type <type>", "Filter by type: dm, group, channel, all", "all").option("-o, --output <format>", "Output format", "table").action(async (query, opts) => {
+    try {
+      const client = new ApiClient(opts.host ? { host: opts.host } : void 0);
+      const api = new ChatsApi(client);
+      let chats = await api.listChats();
+      await resolveDmNames(chats, client);
+      const lowerQuery = query.toLowerCase();
+      chats = chats.filter((c) => (c.name ?? "").toLowerCase().includes(lowerQuery));
+      if (opts.type !== "all") {
+        const typeMap = {
+          dm: ["chat"],
+          group: ["group_chat"],
+          channel: ["channel", "global"]
+        };
+        const allowed = typeMap[opts.type] ?? [];
+        chats = chats.filter((c) => allowed.includes(c.chat_type));
+      }
+      if (chats.length === 0) {
+        console.log(chalk3.yellow(`No chats matching "${query}".`));
+        return;
+      }
+      if (opts.output === "json") {
+        console.log(formatOutput(chats, "json"));
+        return;
+      }
+      const table = new Table2({
+        head: ["Name", "Type", "Members", "Chat ID (full)"],
+        style: { head: ["cyan"] }
+      });
+      for (const c of chats) {
+        table.push([c.name ?? "-", typeLabel(c.chat_type), memberCount(c), c.group_chat_id]);
+      }
+      console.log(table.toString());
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+  cmd.command("info <chat-id>").description("Get chat details").option("--host <host>", "eXpress host").option("-o, --output <format>", "Output format", "json").action(async (chatId, opts) => {
+    try {
+      const client = new ApiClient(opts.host ? { host: opts.host } : void 0);
+      const api = new ChatsApi(client);
+      const chat = await api.getChatInfo(chatId);
+      if (!chat) {
+        console.error(`Chat not found: ${chatId}`);
+        process.exit(1);
+      }
+      console.log(formatOutput(chat, opts.output));
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+  return cmd;
+}
+
+// src/cli/send.ts
+import { Command as Command8 } from "commander";
+
+// src/api/messaging.ts
+var MessagingApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  async sendMessage(params) {
+    const payload = {
+      group_chat_id: params.groupChatId,
+      notification: {
+        status: "ok",
+        body: params.body,
+        ...params.metadata && { metadata: params.metadata },
+        ...params.mentions && { mentions: params.mentions },
+        ...params.stealthMode && {
+          opts: { stealth_mode: true }
+        }
+      }
+    };
+    return this.client.post("/api/v4/botx/notifications/direct", payload);
+  }
+  async sendFile(params) {
+    const payload = {
+      group_chat_id: params.groupChatId,
+      notification: {
+        status: "ok",
+        body: params.caption ?? ""
+      },
+      file: {
+        file_name: params.fileName,
+        data: params.fileData
+      }
+    };
+    return this.client.post("/api/v4/botx/notifications/direct", payload);
+  }
+};
+
+// src/api/messaging-ws.ts
+import { randomBytes as randomBytes3, randomUUID as randomUUID4 } from "crypto";
+import nacl4 from "tweetnacl";
+import sodium from "libsodium-wrappers-sumo";
+function buildTextPayload(text, fromHuid, chatId) {
+  return JSON.stringify({
+    type: "text",
+    msg_id: randomUUID4(),
+    from: fromHuid,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    group_chat_id: chatId,
+    lat: 0,
+    lng: 0,
+    link_meta_disabled: false,
+    stealth_forwarding: false,
+    body: text
+  });
+}
+function payloadAad(chatId, syncId) {
+  return new Uint8Array(Buffer.from(`${chatId}:${syncId}`));
+}
+async function sendMessageViaWebSocket(params) {
+  const { client, chatId, body, timeoutMs = 2e4 } = params;
+  await sodium.ready;
+  const apigwKeys = loadApigwKeys();
+  if (!apigwKeys) throw new Error("No apigw keys. Run 'express auth login' first.");
+  const config = loadConfig();
+  const host = new URL(getBaseUrl(config)).hostname;
+  const webOrigin = getWebOrigin(config);
+  const ctsToken = getAuthToken();
+  const ctsKey = apigwKeys.ctsKey ?? apigwKeys.encryptionKey;
+  const encKeyId = ctsKey.keyId;
+  const participantKeyIds = await getChatKeyIds(host, webOrigin, ctsToken, encKeyId, chatId);
+  const kdcKeys = await client.get(
+    `/api/v1/kdc/keys/?ids=${participantKeyIds.join(",")}`
+  ) ?? [];
+  const publicKeys = kdcKeys.filter((k) => k.kind === "cts");
+  const symmetricKey = randomBytes3(32);
+  const syncId = randomUUID4();
+  const encryptedKeys = publicKeys.map((kdcKey) => {
+    const recipientPubKey = new Uint8Array(Buffer.from(kdcKey.body, "base64"));
+    const nonce = randomBytes3(nacl4.box.nonceLength);
+    const ciphertext2 = nacl4.box(
+      symmetricKey,
+      nonce,
+      recipientPubKey,
+      ctsKey.privateKey
+    );
+    if (!ciphertext2) throw new Error(`Failed to encrypt key for ${kdcKey.id}`);
+    const combined = Buffer.concat([nonce, Buffer.from(ciphertext2)]);
+    return {
+      key_id: kdcKey.id,
+      key: combined.toString("base64"),
+      algo: "xsalsa20:xchacha20_aead_ietf"
+    };
+  });
+  const selfHuid = (await new UserApi(client).getSelfProfile()).user_huid;
+  const plaintext = new Uint8Array(Buffer.from(buildTextPayload(body, selfHuid, chatId)));
+  const msgNonce = randomBytes3(sodium.crypto_aead_xchacha20poly1305_ietf_NPUBBYTES);
+  const ciphertext = sodium.crypto_aead_xchacha20poly1305_ietf_encrypt(
+    plaintext,
+    payloadAad(chatId, syncId),
+    null,
+    new Uint8Array(msgNonce),
+    new Uint8Array(symmetricKey)
+  );
+  const encryptedPayload = Buffer.concat([msgNonce, Buffer.from(ciphertext)]).toString("base64");
+  const signingKey = apigwKeys.signingKey;
+  const signBytes = signEd25519(
+    signingKey.privateKey,
+    new Uint8Array(Buffer.from(encryptedPayload, "utf8"))
+  );
+  const signature = {
+    sign: Buffer.from(signBytes).toString("base64"),
+    sign_key_id: signingKey.keyId,
+    sign_algo: "ed25519"
+  };
+  return sendMessageNew({
+    host,
+    webOrigin,
+    ctsToken,
+    encKeyId,
+    chatId,
+    syncId,
+    encryptedKeys,
+    encryptedPayload,
+    signature,
+    timeoutMs
+  });
+}
+async function getChatKeyIds(host, webOrigin, ctsToken, encKeyId, chatId) {
+  const wsUrl = `wss://${host}/socket/user/websocket?vsn=1.0.0&auto_join=true&key_id=${encKeyId}&version=6&background=false&voex_unencrypted=true&instance_id=${randomUUID4()}`;
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const done = (fn) => {
+      if (!settled) {
+        settled = true;
+        fn();
+      }
+    };
+    const timer = setTimeout(() => {
+      try {
+        ws.close();
+      } catch {
+      }
+      done(() => reject(new Error("Timeout getting chat key_ids")));
+    }, 1e4);
+    const ws = new WebSocket(wsUrl, {
+      headers: { Origin: webOrigin, "User-Agent": "Mozilla/5.0" }
+    });
+    let ref = 0;
+    const authRef = ref++;
+    let chatInfoRef;
+    const send = (msg) => ws.send(JSON.stringify(msg));
+    ws.addEventListener("open", () => {
+      send({ topic: "phoenix", event: "authenticate", payload: { token: ctsToken }, ref: authRef });
+    });
+    ws.addEventListener("message", (e) => {
+      const msg = JSON.parse(e.data);
+      if (msg.ref === authRef && msg.event === "phx_reply" && msg.payload?.status === "ok") {
+        chatInfoRef = ref++;
+        send({ topic: "system", event: "chat_info", payload: { group_chat_id: chatId, request_version: 6 }, ref: chatInfoRef });
+        return;
+      }
+      if (msg.ref === chatInfoRef && msg.event === "phx_reply") {
+        clearTimeout(timer);
+        ws.close();
+        const chatInfo = msg.payload?.response?.chat_info ?? msg.payload?.response;
+        const keys = chatInfo?.keys ?? [];
+        done(() => resolve(keys));
+      }
+    });
+    ws.addEventListener("error", (err) => {
+      clearTimeout(timer);
+      done(() => reject(new Error(`WS error: ${String(err)}`)));
+    });
+    ws.addEventListener("close", () => {
+      clearTimeout(timer);
+      done(() => reject(new Error("WS closed before chat_info")));
+    });
+  });
+}
+async function sendMessageNew(params) {
+  const { host, webOrigin, ctsToken, encKeyId, chatId, syncId, encryptedKeys, encryptedPayload, signature, timeoutMs } = params;
+  const wsUrl = `wss://${host}/socket/user/websocket?vsn=1.0.0&auto_join=true&key_id=${encKeyId}&version=6&background=false&voex_unencrypted=true&instance_id=${randomUUID4()}`;
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const done = (fn) => {
+      if (!settled) {
+        settled = true;
+        fn();
+      }
+    };
+    const timer = setTimeout(() => {
+      try {
+        ws.close();
+      } catch {
+      }
+      done(() => reject(new Error("Timeout sending message")));
+    }, timeoutMs);
+    const ws = new WebSocket(wsUrl, {
+      headers: { Origin: webOrigin, "User-Agent": "Mozilla/5.0" }
+    });
+    let ref = 0;
+    const authRef = ref++;
+    let msgRef;
+    const send = (msg) => ws.send(JSON.stringify(msg));
+    ws.addEventListener("open", () => {
+      send({ topic: "phoenix", event: "authenticate", payload: { token: ctsToken }, ref: authRef });
+    });
+    ws.addEventListener("message", (e) => {
+      const msg = JSON.parse(e.data);
+      if (msg.ref === authRef && msg.event === "phx_reply" && msg.payload?.status === "ok") {
+        msgRef = ref++;
+        send({
+          topic: `groupchat:${chatId}`,
+          event: "message_new",
+          payload: {
+            keys: encryptedKeys,
+            group_chat_id: chatId,
+            sync_id: syncId,
+            payload: encryptedPayload,
+            signature
+          },
+          ref: msgRef
+        });
+        return;
+      }
+      if (msg.ref === msgRef && msg.event === "phx_reply") {
+        clearTimeout(timer);
+        ws.close();
+        if (msg.payload?.status === "ok") {
+          done(() => resolve({ sync_id: syncId }));
+        } else {
+          done(() => reject(new Error(`message_new failed: ${JSON.stringify(msg.payload?.response)}`)));
+        }
+      }
+    });
+    ws.addEventListener("error", (err) => {
+      clearTimeout(timer);
+      done(() => reject(new Error(`WS error: ${String(err)}`)));
+    });
+    ws.addEventListener("close", () => {
+      clearTimeout(timer);
+      done(() => reject(new Error("WS closed before message_new reply")));
+    });
+  });
+}
+
+// src/api/resolve.ts
+async function listChatsWithNames(client) {
+  const chats = await new ChatsApi(client).listChats();
+  const dmChats = chats.filter((c) => c.chat_type === "chat" && c.member_huids?.length);
+  if (dmChats.length === 0) return chats;
+  const userApi = new UserApi(client);
+  const myHuid = (await userApi.getSelfProfile()).user_huid;
+  const otherHuids = [...new Set(dmChats.flatMap((c) => (c.member_huids ?? []).filter((h) => h !== myHuid)))];
+  if (otherHuids.length === 0) return chats;
+  const nameMap = new Map((await userApi.getProfilesByHuid(otherHuids)).map((p) => [p.user_huid, p.name]));
+  for (const chat of chats) {
+    if (chat.chat_type === "chat" && chat.member_huids) {
+      const other = chat.member_huids.find((h) => h !== myHuid);
+      if (other) chat.name = nameMap.get(other) ?? chat.name;
+    }
+  }
+  return chats;
+}
+async function resolveChatId(client, chatIdOrName) {
+  if (/^[0-9a-f-]{36}$/i.test(chatIdOrName)) return chatIdOrName;
+  const chats = await listChatsWithNames(client);
+  const lower = chatIdOrName.toLowerCase();
+  const matches = chats.filter((c) => (c.name ?? "").toLowerCase().includes(lower));
+  if (matches.length === 0) throw new Error(`No chat found matching "${chatIdOrName}"`);
+  if (matches.length > 1) {
+    const names = matches.map((c) => `  ${c.name} (${c.group_chat_id})`).join("\n");
+    throw new Error(`Multiple chats match "${chatIdOrName}":
+${names}
+Use the full chat ID.`);
+  }
+  return matches[0].group_chat_id;
+}
+
+// src/cli/send.ts
+import { readFileSync } from "fs";
+function createSendCommand() {
+  const cmd = new Command8("send");
+  cmd.description("Send messages and files");
+  cmd.command("message <chat-id-or-name> <text>").description("Send a text message to a chat (chat ID or partial name)").option("--stealth", "Send in stealth mode", false).option("--host <host>", "eXpress host").option("-o, --output <format>", "Output format", "json").action(async (chatIdOrName, text, opts) => {
+    try {
+      const client = new ApiClient(opts.host ? { host: opts.host } : void 0);
+      const chatId = await resolveChatId(client, chatIdOrName);
+      const result = await sendMessageViaWebSocket({ client, chatId, body: text });
+      console.log(formatOutput(result, opts.output));
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+  cmd.command("file <chat-id> <file-path>").description("Send a file to a chat").option("--caption <caption>", "File caption").option("--host <host>", "eXpress host").option("-o, --output <format>", "Output format", "json").action(async (chatId, filePath, opts) => {
+    try {
+      const data = readFileSync(filePath);
+      const fileName = filePath.split("/").pop() ?? "file";
+      const mimeMap = {
+        ".png": "image/png",
+        ".jpg": "image/jpeg",
+        ".jpeg": "image/jpeg",
+        ".gif": "image/gif",
+        ".pdf": "application/pdf",
+        ".txt": "text/plain",
+        ".json": "application/json",
+        ".csv": "text/csv",
+        ".zip": "application/zip"
+      };
+      const ext = fileName.includes(".") ? "." + fileName.split(".").pop().toLowerCase() : "";
+      const mime = mimeMap[ext] ?? "application/octet-stream";
+      const base64 = data.toString("base64");
+      const dataUri = `data:${mime};base64,${base64}`;
+      const client = new ApiClient(opts.host ? { host: opts.host } : void 0);
+      const api = new MessagingApi(client);
+      const result = await api.sendFile({
+        groupChatId: chatId,
+        fileName,
+        fileData: dataUri,
+        caption: opts.caption
+      });
+      console.log(formatOutput(result, opts.output));
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+  return cmd;
+}
+
+// src/cli/avatar.ts
+import { Command as Command9 } from "commander";
+
+// src/api/uploads.ts
+var UploadsApi = class {
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  async downloadAvatar(huid) {
+    const profile = await this.client.get(
+      `/api/v1/phonebook/cts_profiles/query`
+    );
+    return null;
+  }
+  async download(url) {
+    const res = await this.client.downloadFile(url);
+    if (!res.ok) {
+      throw new Error(`Download failed: ${res.status} ${res.statusText}`);
+    }
+    const data = await res.arrayBuffer();
+    const contentType = res.headers.get("content-type");
+    return { data, contentType };
+  }
+};
+
+// src/cli/avatar.ts
+import { writeFileSync } from "fs";
+function createAvatarCommand() {
+  const cmd = new Command9("avatar");
+  cmd.description("Download user avatars");
+  cmd.command("get <huid>").description("Download avatar for a user by HUID").option("-o, --output <path>", "Output file path (default: <huid>.png)").option("--host <host>", "eXpress host").action(async (huid, opts) => {
+    try {
+      const client = new ApiClient(opts.host ? { host: opts.host } : void 0);
+      const userApi = new UserApi(client);
+      const uploadsApi = new UploadsApi(client);
+      const profiles = await userApi.getProfilesByHuid([huid]);
+      const profile = profiles?.[0];
+      const avatarUrl = profile?.custom_avatar ?? profile?.avatar;
+      if (!avatarUrl) {
+        console.log("No avatar found for this user.");
+        return;
+      }
+      const { data, contentType } = await uploadsApi.download(avatarUrl);
+      const ext = contentType?.includes("jpeg") ? ".jpg" : contentType?.includes("png") ? ".png" : ".png";
+      const outputPath = opts.output ?? `${huid}${ext}`;
+      writeFileSync(outputPath, Buffer.from(data));
+      console.log(`Avatar saved to ${outputPath}`);
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+  cmd.command("self").description("Download your own avatar").option("-o, --output <path>", "Output file path (default: self_avatar.png)").option("--host <host>", "eXpress host").action(async (opts) => {
+    try {
+      const client = new ApiClient(opts.host ? { host: opts.host } : void 0);
+      const userApi = new UserApi(client);
+      const uploadsApi = new UploadsApi(client);
+      const profile = await userApi.getSelfProfile();
+      const avatarUrl = profile.custom_avatar ?? profile.avatar;
+      if (!avatarUrl) {
+        console.log("No avatar found for your profile.");
+        return;
+      }
+      const { data, contentType } = await uploadsApi.download(avatarUrl);
+      const ext = contentType?.includes("jpeg") ? ".jpg" : contentType?.includes("png") ? ".png" : ".png";
+      const outputPath = opts.output ?? `self_avatar${ext}`;
+      writeFileSync(outputPath, Buffer.from(data));
+      console.log(`Avatar saved to ${outputPath}`);
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+  return cmd;
+}
+
+// src/cli/download.ts
+import { Command as Command10 } from "commander";
+import { writeFileSync as writeFileSync2 } from "fs";
+function createDownloadCommand() {
+  const cmd = new Command10("download");
+  cmd.description("Download a file from eXpress uploads").argument("<url>", "Full URL or path (e.g. /uploads/files/...)").option("-o, --output <path>", "Output file path (default: auto from URL)").option("--host <host>", "eXpress host").action(async (url, opts) => {
+    try {
+      const client = new ApiClient(opts.host ? { host: opts.host } : void 0);
+      const uploadsApi = new UploadsApi(client);
+      const { data, contentType } = await uploadsApi.download(url);
+      const urlPath = new URL(url.startsWith("http") ? url : `https://x${url}`).pathname;
+      const baseName = urlPath.split("/").pop() ?? "download";
+      const outputPath = opts.output ?? baseName;
+      writeFileSync2(outputPath, Buffer.from(data));
+      console.log(`Downloaded to ${outputPath} (${contentType ?? "unknown"}, ${data.byteLength} bytes)`);
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+  return cmd;
+}
+
+// src/cli/messages.ts
+import { Command as Command11 } from "commander";
+
+// src/api/messages-read.ts
+import { randomUUID as randomUUID5 } from "crypto";
+
+// src/api/decrypt.ts
+import nacl5 from "tweetnacl";
+import sodium2 from "libsodium-wrappers-sumo";
+function decryptMessage(msg, ctsPrivateKey, myKeyId, keyMap, apigwKeys) {
+  const encKey = msg.key;
+  if (encKey.key_id !== myKeyId) {
+    throw new Error(`key not for us (key_id=${encKey.key_id}, myKeyId=${myKeyId})`);
+  }
+  const keyRaw = Uint8Array.from(Buffer.from(encKey.key, "base64"));
+  const nonce = keyRaw.slice(0, nacl5.box.nonceLength);
+  const ciphertext = keyRaw.slice(nacl5.box.nonceLength);
+  const senderPubKey = getSenderPublicKey(msg, keyMap, apigwKeys);
+  if (!senderPubKey) throw new Error("cannot determine sender public key");
+  const symmetricKey = nacl5.box.open(ciphertext, nonce, senderPubKey, ctsPrivateKey);
+  if (!symmetricKey) throw new Error("nacl.box.open failed \u2014 wrong key pair");
+  const payloadRaw = Uint8Array.from(Buffer.from(msg.payload, "base64"));
+  const msgNonce = payloadRaw.slice(0, sodium2.crypto_aead_xchacha20poly1305_ietf_NPUBBYTES);
+  const msgCiphertext = payloadRaw.slice(sodium2.crypto_aead_xchacha20poly1305_ietf_NPUBBYTES);
+  const aad = new Uint8Array(Buffer.from(`${msg.group_chat_id}:${msg.sync_id}`));
+  const plaintext = sodium2.crypto_aead_xchacha20poly1305_ietf_decrypt(null, msgCiphertext, aad, msgNonce, symmetricKey);
+  return JSON.parse(new TextDecoder().decode(plaintext));
+}
+function toDecrypted(msg, payload) {
+  const base = { sync_id: msg.sync_id, sender: msg.sender ?? "", inserted_at: msg.inserted_at, decrypted: true, type: payload.type };
+  if (payload.type === "image" && payload.payload) {
+    const p = payload.payload;
+    return {
+      ...base,
+      body: payload.body ?? "",
+      image: {
+        fileName: p.file_name ?? "image",
+        mimeType: p.file_mime_type,
+        previewDataUri: p.blur_preview_file,
+        width: p.file_preview_width,
+        height: p.file_preview_height
+      }
+    };
+  }
+  return { ...base, body: payload.body ?? "" };
+}
+function getSenderPublicKey(msg, keyMap, apigwKeys) {
+  const senderKeyId = msg.sender_key_id;
+  if (!senderKeyId) return null;
+  if (senderKeyId === apigwKeys.ctsKey?.keyId) return apigwKeys.ctsKey.publicKey;
+  if (senderKeyId === apigwKeys.encryptionKey?.keyId) return apigwKeys.encryptionKey.publicKey;
+  const kdcKey = keyMap.get(senderKeyId);
+  if (kdcKey) return new Uint8Array(Buffer.from(kdcKey.body, "base64"));
+  return null;
+}
+async function decryptMessages(events, apigwKeys, client = new ApiClient()) {
+  await sodium2.ready;
+  const ctsKey = apigwKeys.ctsKey ?? apigwKeys.encryptionKey;
+  const messages = events.filter((e) => e.event_type === "message_new" && e.payload && e.key);
+  if (messages.length === 0) return [];
+  const keyIds = [.../* @__PURE__ */ new Set([
+    ...messages.map((m) => m.sender_key_id).filter(Boolean),
+    ...messages.map((m) => m.key.key_id)
+  ])];
+  const kdcKeys = await client.get(
+    `/api/v1/kdc/keys/?ids=${keyIds.join(",")}`
+  ) ?? [];
+  const keyMap = new Map(kdcKeys.map((k) => [k.id, k]));
+  return messages.map((msg) => {
+    try {
+      return toDecrypted(msg, decryptMessage(msg, ctsKey.privateKey, ctsKey.keyId, keyMap, apigwKeys));
+    } catch (err) {
+      return { sync_id: msg.sync_id, body: "", sender: msg.sender ?? "", inserted_at: msg.inserted_at, decrypted: false, error: err.message };
+    }
+  });
+}
+
+// src/api/messages-read.ts
+async function readMessages(params) {
+  const { chatId, limit = 20, timeoutMs = 2e4, direction = "backward" } = params;
+  const apigwKeys = loadApigwKeys();
+  if (!apigwKeys) throw new Error("No apigw keys. Run 'express auth login' first.");
+  const config = loadConfig();
+  const host = new URL(getBaseUrl(config)).hostname;
+  const webOrigin = getWebOrigin(config);
+  const ctsToken = getAuthToken();
+  const ctsKey = apigwKeys.ctsKey ?? apigwKeys.encryptionKey;
+  const history = await fetchEventsHistory(host, webOrigin, ctsToken, ctsKey.keyId, chatId, limit, timeoutMs, direction);
+  return decryptMessages(history, apigwKeys);
+}
+async function fetchEventsHistory(host, webOrigin, ctsToken, encKeyId, chatId, limit, timeoutMs, direction = "backward") {
+  const wsUrl = `wss://${host}/socket/user/websocket?vsn=1.0.0&auto_join=true&key_id=${encKeyId}&version=6&background=false&voex_unencrypted=true&instance_id=${randomUUID5()}`;
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const done = (fn) => {
+      if (!settled) {
+        settled = true;
+        fn();
+      }
+    };
+    const timer = setTimeout(() => {
+      try {
+        ws.close();
+      } catch {
+      }
+      done(() => reject(new Error("Timeout fetching messages")));
+    }, timeoutMs);
+    const ws = new WebSocket(wsUrl, {
+      headers: { Origin: webOrigin, "User-Agent": "Mozilla/5.0" }
+    });
+    let ref = 0;
+    const authRef = ref++;
+    let subRef = 0;
+    let histRef = 0;
+    const send = (msg) => ws.send(JSON.stringify(msg));
+    ws.addEventListener("open", () => {
+      send({ topic: "phoenix", event: "authenticate", payload: { token: ctsToken }, ref: authRef });
+    });
+    ws.addEventListener("message", (e) => {
+      const msg = JSON.parse(e.data);
+      const msgRef = typeof msg.ref === "string" ? parseInt(msg.ref, 10) : msg.ref;
+      if (msgRef === authRef && msg.event === "phx_reply" && msg.payload?.status === "ok") {
+        subRef = ref++;
+        send({ topic: `groupchat:${chatId}`, event: "subscribe_to_chat_activities", payload: { group_chat_id: chatId }, ref: subRef });
+        return;
+      }
+      if (msgRef === subRef && msg.event === "phx_reply") {
+        histRef = ref++;
+        send({
+          topic: `groupchat:${chatId}`,
+          event: "events_history",
+          payload: {
+            direction,
+            group_chat_id: chatId,
+            limit,
+            skip_non_affecting_rc: true,
+            skip_to_sync_id_event: true,
+            last_ignore_messages_at: null
+          },
+          ref: histRef
+        });
+        return;
+      }
+      if (msgRef === histRef && msg.event === "phx_reply") {
+        clearTimeout(timer);
+        ws.close();
+        const response = msg.payload?.response ?? msg.payload;
+        const history = response?.history ?? [];
+        done(() => resolve(Array.isArray(history) ? history : []));
+        return;
+      }
+    });
+    ws.addEventListener("error", (err) => {
+      clearTimeout(timer);
+      done(() => reject(new Error(`WS error: ${String(err)}`)));
+    });
+    ws.addEventListener("close", () => {
+      clearTimeout(timer);
+      done(() => reject(new Error("WS closed before messages received")));
+    });
+  });
+}
+
+// src/cli/messages.ts
+function createMessagesCommand() {
+  const cmd = new Command11("messages");
+  cmd.description("Read and decrypt chat messages");
+  cmd.command("list <chat-id>").description("List recent messages from a chat").option("-n, --limit <number>", "Number of messages", "20").option("--host <host>", "eXpress host").option("-o, --output <format>", "Output format", "table").action(async (chatId, opts) => {
+    try {
+      const messages = await readMessages({
+        chatId,
+        limit: parseInt(opts.limit, 10) || 20
+      });
+      if (opts.output === "json") {
+        console.log(formatOutput(messages, opts.output));
+        return;
+      }
+      for (const msg of messages) {
+        const time = msg.inserted_at ? new Date(msg.inserted_at).toLocaleString("ru-RU") : "?";
+        const sender = msg.sender ? msg.sender.slice(0, 8) + "..." : "unknown";
+        if (msg.decrypted) {
+          console.log(`[${time}] ${sender}: ${msg.body}`);
+        } else {
+          console.log(`[${time}] ${sender}: [DECRYPT FAILED: ${msg.error}]`);
+        }
+      }
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+  return cmd;
+}
+
+// src/cli/listen.ts
+import { Command as Command12 } from "commander";
+import chalk4 from "chalk";
+
+// src/session/session.ts
+import { EventEmitter } from "events";
+import { randomUUID as randomUUID6 } from "crypto";
+var HEARTBEAT_MS = 25e3;
+var REQUEST_TIMEOUT_MS = 15e3;
+var MAX_RECONNECT_DELAY_MS = 3e4;
+var ExpressSession = class _ExpressSession extends EventEmitter {
+  ws = null;
+  ref = 0;
+  pending = /* @__PURE__ */ new Map();
+  heartbeatTimer = null;
+  reconnectTimer = null;
+  chats = [];
+  threads = [];
+  subscribed = /* @__PURE__ */ new Set();
+  closing = false;
+  connecting = false;
+  reconnectAttempt = 0;
+  host;
+  webOrigin;
+  keyId;
+  apigwKeys;
+  constructor() {
+    super();
+    const config = loadConfig();
+    this.host = new URL(getBaseUrl(config)).hostname;
+    this.webOrigin = getWebOrigin(config);
+    const keys = loadApigwKeys();
+    if (!keys) throw new Error("No apigw keys. Run 'express auth qr' first.");
+    this.apigwKeys = keys;
+    this.keyId = (keys.ctsKey ?? keys.encryptionKey).keyId;
+  }
+  getChats() {
+    return this.chats;
+  }
+  getThreads() {
+    return this.threads;
+  }
+  /** Initial connect (awaited by the caller). Reconnection afterwards is driven
+   * solely by `handleClose` → `scheduleReconnect`. */
+  async connect() {
+    this.closing = false;
+    await this.openSocket();
+  }
+  async openSocket() {
+    if (this.closing) return;
+    if (this.connecting || this.ws && this.ws.readyState === this.ws.OPEN) return;
+    this.connecting = true;
+    const token = getAuthToken();
+    if (!token) {
+      this.connecting = false;
+      throw new Error("Not authenticated. Run 'express auth qr'.");
+    }
+    const url = `wss://${this.host}/socket/user/websocket?vsn=1.0.0&auto_join=true&key_id=${this.keyId}&version=6&background=false&voex_unencrypted=true&voex_multistream=true&voex_audio_bridge=true&instance_id=${randomUUID6()}`;
+    const ws = new WebSocket(url, {
+      headers: { Origin: this.webOrigin, "User-Agent": "Mozilla/5.0" }
+    });
+    this.ws = ws;
+    ws.addEventListener("message", (e) => {
+      if (this.ws === ws) this.onMessage(e.data);
+    });
+    ws.addEventListener("close", () => this.handleClose(ws));
+    ws.addEventListener("error", () => {
+    });
+    try {
+      await new Promise((resolve, reject) => {
+        const openTimer = setTimeout(() => {
+          try {
+            ws.close();
+          } catch {
+          }
+          reject(new Error("WebSocket open timeout"));
+        }, REQUEST_TIMEOUT_MS);
+        ws.addEventListener("open", () => {
+          clearTimeout(openTimer);
+          this.request("phoenix", "authenticate", { token }).then(() => resolve()).catch(reject);
+        });
+        ws.addEventListener("close", () => {
+          clearTimeout(openTimer);
+          reject(new Error("closed during connect"));
+        });
+      });
+    } catch (err) {
+      if (this.ws === ws) {
+        this.connecting = false;
+        try {
+          ws.close();
+        } catch {
+        }
+      }
+      throw err;
+    }
+    if (this.ws !== ws) return;
+    this.connecting = false;
+    this.reconnectAttempt = 0;
+    this.startHeartbeat();
+    this.emit("connected");
+    await this.loadChats(ws);
+  }
+  close() {
+    this.closing = true;
+    this.connecting = false;
+    if (this.reconnectTimer) {
+      clearTimeout(this.reconnectTimer);
+      this.reconnectTimer = null;
+    }
+    this.stopHeartbeat();
+    const ws = this.ws;
+    this.ws = null;
+    try {
+      ws?.close();
+    } catch {
+    }
+  }
+  /** chat_type values that accept `subscribe_to_chat_activities` (others like
+   * "global"/"voex_call" reply "unmatched topic"). */
+  static SUBSCRIBABLE = /* @__PURE__ */ new Set(["chat", "group_chat", "channel", "notes"]);
+  /** Load the chat list and subscribe to each real chat's live activities.
+   * Bails if the socket changes/closes mid-way (avoids error spam on teardown). */
+  async loadChats(ws) {
+    const response = await this.request("system", "chat_list", { since: null, request_version: 6 });
+    const chats = response.chat_list ?? [];
+    this.chats = Array.isArray(chats) ? chats : [];
+    this.emit("chats", this.chats);
+    const ids = this.chats.filter((c) => !c.chat_type || _ExpressSession.SUBSCRIBABLE.has(c.chat_type)).map((c) => c.group_chat_id).filter((id) => Boolean(id));
+    await Promise.allSettled(ids.map((id) => this.subscribe(id, ws)));
+    try {
+      const tl = await this.request("system", "thread_list", { group_chat_id: null, limit: 200, request_version: 2 });
+      this.threads = tl.thread_list ?? [];
+      this.emit("threads", this.threads);
+      const threadIds = this.threads.map((t) => t.thread_id).filter(Boolean);
+      await Promise.allSettled(threadIds.map((id) => this.subscribe(id, ws)));
+    } catch {
+    }
+  }
+  async subscribe(chatId, ws) {
+    if (this.subscribed.has(chatId) || this.ws !== ws) return;
+    try {
+      await this.request(`groupchat:${chatId}`, "subscribe_to_chat_activities", { group_chat_id: chatId });
+      this.subscribed.add(chatId);
+    } catch {
+    }
+  }
+  onMessage(data) {
+    let frame;
+    try {
+      frame = JSON.parse(data);
+    } catch {
+      return;
+    }
+    const ref = frame.ref == null ? null : typeof frame.ref === "string" ? parseInt(frame.ref, 10) : frame.ref;
+    if (ref != null && this.pending.has(ref) && frame.event === "phx_reply") {
+      const p = this.pending.get(ref);
+      this.pending.delete(ref);
+      clearTimeout(p.timer);
+      if (frame.payload?.status === "ok") p.resolve(frame.payload.response ?? {});
+      else p.reject(new Error(`${frame.event} failed: ${JSON.stringify(frame.payload?.response)}`));
+      return;
+    }
+    if (ref == null && frame.event === "message_new") {
+      const p = frame.payload;
+      const chatId = p.group_chat_id ?? frame.topic.replace("groupchat:", "");
+      const activity = {
+        chatId,
+        syncId: p.sync_id ?? "",
+        sender: p.sender ?? "",
+        senderKeyId: p.sender_key_id ?? ""
+      };
+      this.emit("activity", activity);
+      void this.resolveMessage(activity);
+    }
+  }
+  /** Pushes have `key: null`; pull recent history (which includes our key) and decrypt. */
+  async resolveMessage(activity) {
+    try {
+      const response = await this.request(`groupchat:${activity.chatId}`, "events_history", {
+        direction: "backward",
+        group_chat_id: activity.chatId,
+        limit: 5,
+        skip_non_affecting_rc: true,
+        skip_to_sync_id_event: true,
+        last_ignore_messages_at: null
+      });
+      const history = response.history ?? [];
+      const decrypted = await decryptMessages(history, this.apigwKeys);
+      const match = decrypted.find((m) => m.sync_id === activity.syncId) ?? decrypted[0];
+      if (!match) return;
+      const msg = {
+        chatId: activity.chatId,
+        syncId: match.sync_id,
+        sender: match.sender,
+        body: match.body,
+        decrypted: match.decrypted,
+        error: match.error,
+        insertedAt: match.inserted_at,
+        type: match.type,
+        image: match.image
+      };
+      this.emit("message", msg);
+    } catch (err) {
+      this.emit("error", new Error(`decrypt push failed: ${err.message}`));
+    }
+  }
+  request(topic, event, payload) {
+    const ws = this.ws;
+    if (!ws || ws.readyState !== ws.OPEN) return Promise.reject(new Error("WebSocket not open"));
+    const ref = this.ref++;
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        this.pending.delete(ref);
+        reject(new Error(`request timeout: ${event}`));
+      }, REQUEST_TIMEOUT_MS);
+      this.pending.set(ref, { resolve, reject, timer });
+      ws.send(JSON.stringify({ topic, event, payload, ref }));
+    });
+  }
+  startHeartbeat() {
+    this.stopHeartbeat();
+    this.heartbeatTimer = setInterval(() => {
+      const ws = this.ws;
+      if (ws && ws.readyState === ws.OPEN) {
+        ws.send(JSON.stringify({ topic: "phoenix", event: "heartbeat", payload: {}, ref: this.ref++ }));
+      }
+    }, HEARTBEAT_MS);
+  }
+  stopHeartbeat() {
+    if (this.heartbeatTimer) {
+      clearInterval(this.heartbeatTimer);
+      this.heartbeatTimer = null;
+    }
+  }
+  /** Sole reconnect trigger. Ignores events from stale sockets. */
+  handleClose(ws) {
+    if (this.ws !== ws) return;
+    this.ws = null;
+    this.connecting = false;
+    this.stopHeartbeat();
+    for (const [, p] of this.pending) {
+      clearTimeout(p.timer);
+      p.reject(new Error("WebSocket closed"));
+    }
+    this.pending.clear();
+    this.subscribed.clear();
+    this.emit("disconnected", { code: 1006 });
+    if (!this.closing) this.scheduleReconnect();
+  }
+  scheduleReconnect() {
+    if (this.closing || this.reconnectTimer) return;
+    this.reconnectAttempt += 1;
+    const delayMs = Math.min(1e3 * 2 ** (this.reconnectAttempt - 1), MAX_RECONNECT_DELAY_MS);
+    this.emit("reconnecting", { attempt: this.reconnectAttempt, delayMs });
+    this.reconnectTimer = setTimeout(async () => {
+      this.reconnectTimer = null;
+      if (this.closing) return;
+      await refreshToken().catch(() => false);
+      this.openSocket().catch(() => {
+      });
+    }, delayMs);
+  }
+};
+
+// src/cli/listen.ts
+function createListenCommand() {
+  const cmd = new Command12("listen");
+  cmd.description("Open a persistent session and stream incoming messages/notifications").option("--host <host>", "eXpress host").option("--activity", "Also print raw activity events (before decryption)", false).action(async (opts) => {
+    let session;
+    try {
+      session = new ExpressSession();
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+    const names = /* @__PURE__ */ new Map();
+    const label = (chatId) => names.get(chatId) ?? chatId.slice(0, 8);
+    const ts = (iso) => iso ? new Date(iso).toLocaleTimeString("ru-RU") : (/* @__PURE__ */ new Date()).toLocaleTimeString("ru-RU");
+    session.on("connected", () => console.log(chalk4.green("\u25CF connected")));
+    session.on("chats", (chats) => {
+      for (const c of chats) {
+        const id = c.group_chat_id ?? c.id;
+        const name = c.name;
+        if (id) names.set(id, name || id.slice(0, 8));
+      }
+      console.log(chalk4.dim(`  ${chats.length} chats loaded, subscribing to activity\u2026`));
+    });
+    if (opts.activity) {
+      session.on("activity", (a) => {
+        console.log(chalk4.dim(`  \xB7 activity in ${label(a.chatId)} (${a.syncId.slice(0, 8)})`));
+      });
+    }
+    session.on("message", (m) => {
+      const who = m.sender.slice(0, 8);
+      if (m.decrypted) {
+        console.log(`${chalk4.dim(`[${ts(m.insertedAt)}]`)} ${chalk4.cyan(label(m.chatId))} ${chalk4.yellow(who)}: ${m.body}`);
+      } else {
+        console.log(`${chalk4.dim(`[${ts(m.insertedAt)}]`)} ${chalk4.cyan(label(m.chatId))} ${chalk4.yellow(who)}: ${chalk4.red(`[decrypt failed: ${m.error}]`)}`);
+      }
+    });
+    session.on("reconnecting", ({ attempt, delayMs }) => {
+      console.log(chalk4.yellow(`\u25CB reconnecting (attempt ${attempt}) in ${Math.round(delayMs / 1e3)}s\u2026`));
+    });
+    session.on("disconnected", ({ code }) => console.log(chalk4.yellow(`\u25CB disconnected (code=${code})`)));
+    session.on("error", (err) => console.error(chalk4.red(`! ${err.message}`)));
+    const shutdown = () => {
+      console.log(chalk4.dim("\nclosing\u2026"));
+      session.close();
+      process.exit(0);
+    };
+    process.on("SIGINT", shutdown);
+    process.on("SIGTERM", shutdown);
+    try {
+      await session.connect();
+      console.log(chalk4.dim("Listening. Press Ctrl+C to stop."));
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      session.close();
+      process.exit(1);
+    }
+  });
+  return cmd;
+}
+
+// src/cli/tui.ts
+import { Command as Command13 } from "commander";
+
+// src/tui/index.tsx
+import { render } from "ink";
+
+// src/tui/app.tsx
+import { useEffect, useMemo, useRef, useState } from "react";
+import { Box, Text, useApp, useInput, useStdin, useStdout } from "ink";
+import TextInput from "ink-text-input";
+
+// src/tui/image.ts
+import terminalImage from "terminal-image";
+async function renderImage(data, cols, rows) {
+  const b64 = data.includes(",") ? data.slice(data.indexOf(",") + 1) : data;
+  const buf = Buffer.from(b64, "base64");
+  const out = await terminalImage.buffer(buf, {
+    width: Math.max(4, cols),
+    ...rows ? { height: rows } : {},
+    preserveAspectRatio: true,
+    preferNativeRender: false
+  });
+  return out.replace(/\n$/, "");
+}
+
+// src/tui/app.tsx
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+var LIST_TYPES = /* @__PURE__ */ new Set(["chat", "group_chat", "channel", "notes"]);
+var shortHuid = (h) => h ? h.slice(0, 8) : "unknown";
+var clock = (iso) => {
+  const d = iso ? new Date(iso) : /* @__PURE__ */ new Date();
+  return Number.isNaN(d.getTime()) ? "--:--" : d.toLocaleTimeString("ru-RU", { hour: "2-digit", minute: "2-digit" });
+};
+var MENTION_RE = /@\{mention:([0-9a-fA-F-]{36})\}/g;
+function parseBody(body) {
+  const out = [];
+  let last = 0;
+  let m;
+  MENTION_RE.lastIndex = 0;
+  while (m = MENTION_RE.exec(body)) {
+    if (m.index > last) out.push({ text: body.slice(last, m.index) });
+    out.push({ mention: m[1] });
+    last = m.index + m[0].length;
+  }
+  if (last < body.length) out.push({ text: body.slice(last) });
+  return out.length ? out : [{ text: body }];
+}
+var toDisplay = (m) => ({ syncId: m.sync_id, sender: m.sender, body: m.body, decrypted: m.decrypted, error: m.error, insertedAt: m.inserted_at, type: m.type, image: m.image });
+function App() {
+  const { exit } = useApp();
+  const { stdout } = useStdout();
+  const { isRawModeSupported } = useStdin();
+  const rows = stdout?.rows ?? 24;
+  const cols = stdout?.columns ?? 80;
+  const sessionRef = useRef(null);
+  const [chats, setChats] = useState([]);
+  const [threads, setThreads] = useState([]);
+  const [selected, setSelected] = useState(0);
+  const [messages, setMessages] = useState({});
+  const [status2, setStatus] = useState({ text: "connecting\u2026", color: "yellow" });
+  const [focus, setFocus] = useState("chats");
+  const [draft, setDraft] = useState("");
+  const [selfHuid, setSelfHuid] = useState("");
+  const [names, setNames] = useState({});
+  const [unread, setUnread] = useState({});
+  const [msgCursor, setMsgCursor] = useState(0);
+  const [discussionsOpen, setDiscussionsOpen] = useState(false);
+  const [threadCursor, setThreadCursor] = useState(0);
+  const [openThreadId, setOpenThreadId] = useState(null);
+  const [threadTitles, setThreadTitles] = useState({});
+  const [renderedImages, setRenderedImages] = useState({});
+  const requested = useRef(/* @__PURE__ */ new Set());
+  const titleRequested = useRef(/* @__PURE__ */ new Set());
+  const imgRequested = useRef(/* @__PURE__ */ new Set());
+  const currentIdRef = useRef(void 0);
+  const visibleChats = useMemo(
+    () => chats.filter((c) => LIST_TYPES.has(c.chat_type) && !c.left).sort((a, b) => (b.last_event_inserted_at ?? "").localeCompare(a.last_event_inserted_at ?? "")),
+    [chats]
+  );
+  const current = visibleChats[selected];
+  const currentId = current?.group_chat_id;
+  currentIdRef.current = currentId;
+  const threadsForChat = useMemo(
+    () => threads.filter((t) => t.group_chat_id === currentId).sort((a, b) => (b.last_event_inserted_at ?? "").localeCompare(a.last_event_inserted_at ?? "")),
+    [threads, currentId]
+  );
+  const activeMessages = openThreadId ? messages[openThreadId] : currentId ? messages[currentId] : void 0;
+  const resolveHuids = (huids) => {
+    const need = [...new Set(huids)].filter((h) => h && h.length >= 30 && !requested.current.has(h));
+    if (need.length === 0) return;
+    need.forEach((h) => requested.current.add(h));
+    new UserApi(new ApiClient()).getProfilesByHuid(need).then((profiles) => setNames((prev) => {
+      const next = { ...prev };
+      for (const p of profiles) if (p.name) next[p.user_huid] = p.name;
+      return next;
+    })).catch(() => need.forEach((h) => requested.current.delete(h)));
+  };
+  const displayChatName = (c) => {
+    if (c.chat_type === "chat" && c.member_huids && selfHuid) {
+      const other = c.member_huids.find((h) => h !== selfHuid);
+      if (other && names[other]) return names[other];
+    }
+    return c.name?.trim() || c.group_chat_id.slice(0, 8);
+  };
+  const senderLabel = (huid) => huid === selfHuid || huid === "me" ? "you" : names[huid] || shortHuid(huid);
+  const fetchThreadTitle = (threadId) => {
+    if (threadTitles[threadId] || titleRequested.current.has(threadId)) return;
+    titleRequested.current.add(threadId);
+    readMessages({ chatId: threadId, limit: 1, direction: "forward" }).then((h) => {
+      const root = h.find((m) => m.decrypted && m.body);
+      if (root) setThreadTitles((p) => ({ ...p, [threadId]: root.body.replace(/\s+/g, " ").trim() }));
+    }).catch(() => titleRequested.current.delete(threadId));
+  };
+  const threadTitle = (threadId) => threadTitles[threadId];
+  useEffect(() => {
+    let session;
+    try {
+      session = new ExpressSession();
+    } catch (err) {
+      setStatus({ text: err.message, color: "red" });
+      return;
+    }
+    sessionRef.current = session;
+    session.on("connected", () => setStatus({ text: "connected", color: "green" }));
+    session.on("chats", (list) => setChats(list));
+    session.on("threads", (list) => setThreads(list));
+    session.on("message", (m) => {
+      setMessages((prev) => {
+        const list = prev[m.chatId] ?? [];
+        if (list.some((x) => x.syncId === m.syncId)) return prev;
+        const next = { syncId: m.syncId, sender: m.sender, body: m.body, decrypted: m.decrypted, error: m.error, insertedAt: m.insertedAt, type: m.type, image: m.image };
+        return { ...prev, [m.chatId]: [...list, next].slice(-200) };
+      });
+      if (m.chatId !== currentIdRef.current) setUnread((u) => ({ ...u, [m.chatId]: (u[m.chatId] ?? 0) + 1 }));
+    });
+    session.on("reconnecting", ({ attempt }) => setStatus({ text: `reconnecting (#${attempt})\u2026`, color: "yellow" }));
+    session.on("disconnected", () => setStatus({ text: "disconnected", color: "yellow" }));
+    session.on("error", () => {
+    });
+    session.connect().catch((err) => setStatus({ text: err.message, color: "red" }));
+    new UserApi(new ApiClient()).getSelfProfile().then((p) => setSelfHuid(p.user_huid)).catch(() => {
+    });
+    return () => session.close();
+  }, []);
+  const send = async (text) => {
+    const body = text.trim();
+    setDraft("");
+    const target = openThreadId ?? currentId;
+    if (!body || !target) return;
+    const localId = `local-${Date.now()}`;
+    const optimistic = { syncId: localId, sender: selfHuid || "me", body, decrypted: true, insertedAt: (/* @__PURE__ */ new Date()).toISOString() };
+    setMessages((prev) => ({ ...prev, [target]: [...prev[target] ?? [], optimistic].slice(-200) }));
+    try {
+      await sendMessageViaWebSocket({ client: new ApiClient(), chatId: target, body });
+    } catch (err) {
+      setMessages((prev) => ({
+        ...prev,
+        [target]: (prev[target] ?? []).map((m) => m.syncId === localId ? { ...m, decrypted: false, error: err.message } : m)
+      }));
+    }
+  };
+  const loadHistory = (id) => {
+    if (messages[id]) return;
+    readMessages({ chatId: id, limit: 40 }).then((h) => setMessages((prev) => prev[id] ? prev : { ...prev, [id]: h.map(toDisplay) })).catch(() => setMessages((prev) => prev[id] ? prev : { ...prev, [id]: [] }));
+  };
+  useEffect(() => {
+    if (currentId) loadHistory(currentId);
+  }, [currentId]);
+  useEffect(() => {
+    if (openThreadId) {
+      loadHistory(openThreadId);
+      fetchThreadTitle(openThreadId);
+      setMsgCursor((messages[openThreadId]?.length ?? 1) - 1);
+    }
+  }, [openThreadId]);
+  useEffect(() => {
+    if (!selfHuid) return;
+    resolveHuids(visibleChats.filter((c) => c.chat_type === "chat").flatMap((c) => (c.member_huids ?? []).filter((h) => h !== selfHuid)));
+  }, [chats, selfHuid]);
+  useEffect(() => {
+    if (!activeMessages) return;
+    resolveHuids(activeMessages.flatMap((m) => [m.sender, ...parseBody(m.body).filter((s) => s.mention).map((s) => s.mention)]));
+  }, [activeMessages]);
+  useEffect(() => {
+    setDiscussionsOpen(false);
+    setOpenThreadId(null);
+    if (currentId) setUnread((u) => u[currentId] ? { ...u, [currentId]: 0 } : u);
+  }, [currentId]);
+  useEffect(() => {
+    if (!discussionsOpen) return;
+    threadsForChat.forEach((t) => fetchThreadTitle(t.thread_id));
+  }, [discussionsOpen, threadsForChat]);
+  useEffect(() => {
+    const m = focus === "thread" ? activeMessages?.[msgCursor] : void 0;
+    const uri = m?.image?.previewDataUri;
+    if (!m || !uri || renderedImages[m.syncId] || imgRequested.current.has(m.syncId)) return;
+    imgRequested.current.add(m.syncId);
+    const w = Math.min(40, Math.max(10, cols - 36));
+    renderImage(uri, w).then((s) => setRenderedImages((p) => ({ ...p, [m.syncId]: s }))).catch(() => imgRequested.current.delete(m.syncId));
+  }, [focus, msgCursor, activeMessages]);
+  useInput((input, key) => {
+    if (focus === "input") {
+      if (key.escape) setFocus(openThreadId ? "thread" : "chats");
+      return;
+    }
+    if (input === "q" || key.ctrl && input === "c") {
+      sessionRef.current?.close();
+      exit();
+      return;
+    }
+    if (input === "t" && currentId && !openThreadId) {
+      if (discussionsOpen) {
+        setDiscussionsOpen(false);
+        setFocus("chats");
+      } else {
+        setDiscussionsOpen(true);
+        setThreadCursor(0);
+        setFocus("discussions");
+      }
+      return;
+    }
+    if (focus === "chats") {
+      if (key.upArrow || input === "k") setSelected((i) => Math.max(0, i - 1));
+      else if (key.downArrow || input === "j") setSelected((i) => Math.min(visibleChats.length - 1, i + 1));
+      else if ((key.rightArrow || key.tab) && currentId) {
+        setMsgCursor((activeMessages?.length ?? 1) - 1);
+        setFocus("thread");
+      } else if (key.return && currentId) setFocus("input");
+    } else if (focus === "discussions") {
+      if (key.upArrow || input === "k") setThreadCursor((c) => Math.max(0, c - 1));
+      else if (key.downArrow || input === "j") setThreadCursor((c) => Math.min(threadsForChat.length - 1, c + 1));
+      else if (key.return && threadsForChat[threadCursor]) {
+        setOpenThreadId(threadsForChat[threadCursor].thread_id);
+        setFocus("thread");
+      } else if (key.leftArrow || key.escape) {
+        setDiscussionsOpen(false);
+        setFocus("chats");
+      }
+    } else if (focus === "thread") {
+      const len = activeMessages?.length ?? 0;
+      if (key.upArrow || input === "k") setMsgCursor((c) => Math.max(0, c - 1));
+      else if (key.downArrow || input === "j") setMsgCursor((c) => Math.min(len - 1, c + 1));
+      else if (key.leftArrow || key.escape) {
+        if (openThreadId) {
+          setOpenThreadId(null);
+          setFocus("discussions");
+        } else setFocus("chats");
+      } else if (key.return) setFocus("input");
+    }
+  }, { isActive: isRawModeSupported });
+  const bodyHeight = Math.max(4, rows - 4);
+  const rightWidth = Math.max(20, cols - 34);
+  const listWindow = windowAround(selected, visibleChats.length, bodyHeight);
+  const showDiscussions = discussionsOpen && !openThreadId;
+  const estLines = (m) => {
+    let n = 9 + senderLabel(m.sender).length + 2;
+    for (const seg of parseBody(m.body)) n += seg.mention ? 1 + (names[seg.mention]?.length ?? 8) : seg.text?.length ?? 0;
+    return Math.max(1, Math.ceil(n / rightWidth));
+  };
+  let threadStart = activeMessages ? activeMessages.length : 0;
+  if (activeMessages) {
+    let used = 0;
+    while (threadStart > 0 && used < bodyHeight) {
+      used += estLines(activeMessages[threadStart - 1]);
+      threadStart--;
+    }
+    if (focus === "thread" && msgCursor < threadStart) threadStart = msgCursor;
+  }
+  const threadView = activeMessages ? activeMessages.slice(threadStart) : void 0;
+  const renderBody = (m) => parseBody(m.body).map(
+    (seg, i) => seg.mention ? /* @__PURE__ */ jsxs(Text, { color: "magenta", children: [
+      "@",
+      names[seg.mention] || shortHuid(seg.mention)
+    ] }, i) : /* @__PURE__ */ jsx(Text, { children: seg.text }, i)
+  );
+  const rightBorder = focus === "input" ? "green" : focus === "thread" || focus === "discussions" ? "cyan" : "gray";
+  const rightTitle = openThreadId ? `\u{1F4AC} ${threadTitle(openThreadId) ?? "\u041E\u0431\u0441\u0443\u0436\u0434\u0435\u043D\u0438\u0435"}` : (current ? displayChatName(current) : "\u2014") + (threadsForChat.length ? `  \u{1F4AC} ${threadsForChat.length}` : "");
+  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", height: rows, children: [
+    /* @__PURE__ */ jsxs(Box, { children: [
+      /* @__PURE__ */ jsx(Text, { children: " " }),
+      /* @__PURE__ */ jsx(Text, { color: status2.color, children: "\u25CF" }),
+      /* @__PURE__ */ jsx(Text, { children: " eXpress TUI \u2014 " }),
+      /* @__PURE__ */ jsx(Text, { color: status2.color, children: status2.text }),
+      /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+        "  (",
+        visibleChats.length,
+        " chats)"
+      ] })
+    ] }),
+    /* @__PURE__ */ jsxs(Box, { flexGrow: 1, children: [
+      /* @__PURE__ */ jsxs(Box, { flexDirection: "column", width: 32, borderStyle: "single", borderColor: focus === "chats" ? "cyan" : "gray", paddingX: 1, children: [
+        visibleChats.length === 0 && /* @__PURE__ */ jsx(Text, { dimColor: true, children: "loading\u2026" }),
+        visibleChats.slice(listWindow.start, listWindow.end).map((c, i) => {
+          const idx = listWindow.start + i;
+          const active = idx === selected;
+          const n = unread[c.group_chat_id] ?? 0;
+          return /* @__PURE__ */ jsxs(Text, { color: active ? "black" : n > 0 ? "cyan" : void 0, backgroundColor: active ? "cyan" : void 0, bold: n > 0 && !active, wrap: "truncate", children: [
+            active ? "\u203A " : "  ",
+            displayChatName(c),
+            n > 0 ? ` (${n})` : ""
+          ] }, c.group_chat_id);
+        })
+      ] }),
+      /* @__PURE__ */ jsxs(Box, { flexDirection: "column", flexGrow: 1, borderStyle: "single", borderColor: rightBorder, paddingX: 1, children: [
+        /* @__PURE__ */ jsx(Text, { bold: true, wrap: "truncate", children: rightTitle }),
+        /* @__PURE__ */ jsx(Box, { flexDirection: "column", flexGrow: 1, children: showDiscussions ? /* @__PURE__ */ jsxs(Fragment, { children: [
+          threadsForChat.length === 0 && /* @__PURE__ */ jsx(Text, { dimColor: true, children: "no discussions" }),
+          threadsForChat.map((t, i) => {
+            const on = focus === "discussions" && i === threadCursor;
+            const title = threadTitle(t.thread_id) ?? t.thread_id.slice(0, 8);
+            return /* @__PURE__ */ jsxs(Text, { color: on ? "black" : void 0, backgroundColor: on ? "cyan" : void 0, wrap: "truncate", children: [
+              on ? "\u203A " : "  ",
+              "\u{1F4AC} ",
+              title,
+              "  ",
+              /* @__PURE__ */ jsxs(Text, { dimColor: !on, children: [
+                "\xB7 ",
+                t.counter ?? 0,
+                " \xB7 ",
+                clock(t.last_event_inserted_at ?? "")
+              ] })
+            ] }, t.thread_id);
+          })
+        ] }) : /* @__PURE__ */ jsxs(Fragment, { children: [
+          !current && /* @__PURE__ */ jsx(Text, { dimColor: true, children: "select a chat" }),
+          current && !threadView && /* @__PURE__ */ jsx(Text, { dimColor: true, children: "loading messages\u2026" }),
+          threadView && threadView.length === 0 && /* @__PURE__ */ jsx(Text, { dimColor: true, children: "no messages" }),
+          threadView?.map((m, i) => {
+            const idx = threadStart + i;
+            const mine = m.sender === selfHuid || m.sender === "me";
+            const onCursor = focus === "thread" && idx === msgCursor;
+            const img = renderedImages[m.syncId];
+            return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+              /* @__PURE__ */ jsxs(Text, { wrap: "wrap", children: [
+                /* @__PURE__ */ jsx(Text, { color: onCursor ? "cyan" : void 0, children: onCursor ? "\u258D" : " " }),
+                /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+                  "[",
+                  clock(m.insertedAt),
+                  "] "
+                ] }),
+                /* @__PURE__ */ jsx(Text, { color: mine ? "green" : "yellow", children: senderLabel(m.sender) }),
+                /* @__PURE__ */ jsx(Text, { children: ": " }),
+                !m.decrypted ? /* @__PURE__ */ jsxs(Text, { color: "red", children: [
+                  "[",
+                  m.error ? "send failed" : "decrypt failed",
+                  "]"
+                ] }) : m.image ? /* @__PURE__ */ jsxs(Text, { color: "cyan", children: [
+                  "\u{1F5BC} ",
+                  m.image.fileName,
+                  m.body ? ` \u2014 ${m.body}` : ""
+                ] }) : renderBody(m)
+              ] }),
+              onCursor && m.image?.previewDataUri && (img ? /* @__PURE__ */ jsx(Text, { children: img }) : /* @__PURE__ */ jsx(Text, { dimColor: true, children: "  rendering preview\u2026" }))
+            ] }, m.syncId);
+          })
+        ] }) }),
+        current && !showDiscussions && /* @__PURE__ */ jsxs(Box, { children: [
+          /* @__PURE__ */ jsx(Text, { color: focus === "input" ? "green" : "gray", children: focus === "input" ? "\u203A " : "  " }),
+          /* @__PURE__ */ jsx(TextInput, { value: draft, onChange: setDraft, onSubmit: send, focus: focus === "input", placeholder: focus === "input" ? "type a message\u2026" : "Enter to write" })
+        ] })
+      ] })
+    ] }),
+    /* @__PURE__ */ jsx(Box, { children: /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+      " ",
+      footerHint(focus, openThreadId != null)
+    ] }) })
+  ] });
+}
+function footerHint(focus, inThread) {
+  if (focus === "input") return "Enter send \xB7 Esc cancel";
+  if (focus === "discussions") return "\u2191/\u2193 discussions \xB7 Enter open \xB7 Esc back";
+  if (focus === "thread") return `\u2191/\u2193 messages \xB7 \u2190 ${inThread ? "discussions" : "chats"} \xB7 Enter write \xB7 q quit`;
+  return "\u2191/\u2193 chats \xB7 \u2192 open thread \xB7 t discussions \xB7 Enter write \xB7 q quit";
+}
+function windowAround(selected, total, size) {
+  if (total <= size) return { start: 0, end: total };
+  let start = selected - Math.floor(size / 2);
+  start = Math.max(0, Math.min(start, total - size));
+  return { start, end: start + size };
+}
+
+// src/tui/index.tsx
+import { jsx as jsx2 } from "react/jsx-runtime";
+async function runTui() {
+  const { waitUntilExit } = render(/* @__PURE__ */ jsx2(App, {}));
+  await waitUntilExit();
+}
+
+// src/cli/tui.ts
+function createTuiCommand() {
+  const cmd = new Command13("tui");
+  cmd.description("Interactive terminal UI: chat list + live message thread").option("--host <host>", "eXpress host").action(async () => {
+    try {
+      await runTui();
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+  return cmd;
+}
+
+// src/cli/mcp.ts
+import { Command as Command14 } from "commander";
+
+// src/mcp/server.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z as z2 } from "zod";
+var ok = (data) => ({
+  content: [{ type: "text", text: typeof data === "string" ? data : JSON.stringify(data, null, 2) }]
+});
+var Inbox = class {
+  buf = [];
+  seq = 0;
+  cursor = 0;
+  waiters = [];
+  add(m) {
+    this.buf.push({ seq: ++this.seq, chatId: m.chatId, sender: m.sender, body: m.body, time: m.insertedAt, decrypted: m.decrypted, image: m.image?.fileName });
+    if (this.buf.length > 500) this.buf.splice(0, this.buf.length - 500);
+    const woken = this.waiters;
+    this.waiters = [];
+    woken.forEach((fn) => fn());
+  }
+  pending() {
+    return this.buf.filter((x) => x.seq > this.cursor);
+  }
+  /** Return (and consume) messages arrived since the last take, waiting up to timeoutMs. */
+  async take(timeoutMs) {
+    if (this.pending().length === 0) {
+      await new Promise((resolve) => {
+        const fn = () => {
+          clearTimeout(t);
+          resolve();
+        };
+        const t = setTimeout(() => {
+          this.waiters = this.waiters.filter((w) => w !== fn);
+          resolve();
+        }, timeoutMs);
+        this.waiters.push(fn);
+      });
+    }
+    const items = this.pending();
+    if (this.buf.length) this.cursor = this.buf[this.buf.length - 1].seq;
+    return items;
+  }
+};
+async function runMcpServer() {
+  const server = new McpServer({ name: "express-cli", version: "0.1.0" });
+  const inbox = new Inbox();
+  const chatNames = /* @__PURE__ */ new Map();
+  const senderNames = /* @__PURE__ */ new Map();
+  let sessionReady = false;
+  let session = null;
+  try {
+    session = new ExpressSession();
+    session.on("connected", () => {
+      sessionReady = true;
+    });
+    session.on("chats", (list) => {
+      for (const c of list) chatNames.set(c.group_chat_id, c.name?.trim() || c.group_chat_id.slice(0, 8));
+    });
+    session.on("message", (m) => inbox.add(m));
+    session.connect().catch((err) => {
+      process.stderr.write(`[mcp] session connect failed: ${err.message}
+`);
+    });
+    listChatsWithNames(new ApiClient()).then((chats) => {
+      for (const c of chats) chatNames.set(c.group_chat_id, c.name ?? c.group_chat_id.slice(0, 8));
+    }).catch(() => {
+    });
+  } catch (err) {
+    process.stderr.write(`[mcp] session unavailable: ${err.message}
+`);
+  }
+  const enrich = async (items) => {
+    const unknown = [...new Set(items.map((i) => i.sender))].filter((h) => h && h.length >= 30 && !senderNames.has(h));
+    if (unknown.length) {
+      try {
+        const profiles = await new UserApi(new ApiClient()).getProfilesByHuid(unknown);
+        for (const p of profiles) if (p.name) senderNames.set(p.user_huid, p.name);
+      } catch {
+      }
+    }
+    return items.map((i) => ({
+      time: i.time,
+      chat: chatNames.get(i.chatId) ?? i.chatId.slice(0, 8),
+      chat_id: i.chatId,
+      sender: senderNames.get(i.sender) ?? i.sender.slice(0, 8),
+      message: i.decrypted ? i.image ? `\u{1F5BC} ${i.image}` : i.body : "[decrypt failed]"
+    }));
+  };
+  server.registerTool("chats_list", {
+    title: "List chats",
+    description: "List chats (DMs, groups, channels) with names and full chat IDs. DM names are resolved to the person's full name.",
+    inputSchema: { type: z2.enum(["all", "dm", "group", "channel"]).optional().describe("Filter by chat type (default all)") }
+  }, async ({ type }) => {
+    const chats = await listChatsWithNames(new ApiClient());
+    const kind = { dm: "chat", group: "group_chat", channel: "channel" };
+    const filtered = !type || type === "all" ? chats : chats.filter((c) => c.chat_type === kind[type]);
+    return ok(filtered.map((c) => ({ name: c.name, chat_id: c.group_chat_id, type: c.chat_type, members: c.members_count })));
+  });
+  server.registerTool("chats_find", {
+    title: "Find a chat by name",
+    description: "Find chats whose name (person or group) contains the query. Returns name + full chat_id to use with other tools.",
+    inputSchema: { query: z2.string().describe("Part of the chat or person name") }
+  }, async ({ query }) => {
+    const chats = await listChatsWithNames(new ApiClient());
+    const q = query.toLowerCase();
+    return ok(chats.filter((c) => (c.name ?? "").toLowerCase().includes(q)).map((c) => ({ name: c.name, chat_id: c.group_chat_id, type: c.chat_type })));
+  });
+  server.registerTool("messages_list", {
+    title: "Read messages",
+    description: "Read and decrypt recent messages from a chat, identified by name or chat_id.",
+    inputSchema: {
+      chat: z2.string().describe("Chat name (partial ok) or full chat_id"),
+      limit: z2.number().int().min(1).max(200).optional().describe("How many recent messages (default 20)")
+    }
+  }, async ({ chat, limit }) => {
+    const client = new ApiClient();
+    const chatId = await resolveChatId(client, chat);
+    const msgs = await readMessages({ chatId, limit: limit ?? 20 });
+    return ok(msgs.map((m) => ({
+      time: m.inserted_at,
+      sender: m.sender,
+      body: m.decrypted ? m.image ? `\u{1F5BC} ${m.image.fileName}${m.body ? ` \u2014 ${m.body}` : ""}` : m.body : `[decrypt failed: ${m.error}]`
+    })));
+  });
+  server.registerTool("send_message", {
+    title: "Send a message",
+    description: "Send a text message to a chat, identified by name (partial ok) or chat_id. Returns the sync_id.",
+    inputSchema: { chat: z2.string().describe("Chat name or full chat_id"), text: z2.string().describe("Message text") }
+  }, async ({ chat, text }) => {
+    const client = new ApiClient();
+    const chatId = await resolveChatId(client, chat);
+    const res = await sendMessageViaWebSocket({ client, chatId, body: text });
+    return ok({ sent: true, chat_id: chatId, sync_id: res.sync_id });
+  });
+  server.registerTool("contacts_search", {
+    title: "Search employees",
+    description: "Global company phonebook search across all employees by name.",
+    inputSchema: { query: z2.string().describe("Name to search"), limit: z2.number().int().min(1).max(50).optional() }
+  }, async ({ query, limit }) => {
+    const profiles = await new PhonebookApi(new ApiClient()).searchUsers(query, limit ?? 20);
+    return ok(profiles.map((p) => ({ name: p.name, huid: p.user_huid, email: p.email, position: p.company_position, department: p.department })));
+  });
+  server.registerTool("contacts_self", {
+    title: "My profile",
+    description: "Get the authenticated user's own profile.",
+    inputSchema: {}
+  }, async () => ok(await new UserApi(new ApiClient()).getSelfProfile()));
+  server.registerTool("wait_for_messages", {
+    title: "Wait for incoming messages",
+    description: "Block until new incoming messages arrive (from any chat/discussion), then return them. Returns messages received since the previous call to this tool; if none are pending, waits up to timeout_seconds. Your own sent messages are not included. Use this to react to new messages instead of polling.",
+    inputSchema: { timeout_seconds: z2.number().int().min(1).max(120).optional().describe("Max seconds to wait when nothing is pending (default 30)") }
+  }, async ({ timeout_seconds }) => {
+    if (!session) return ok({ error: "Session unavailable \u2014 run 'express auth qr' to authenticate." });
+    const items = await inbox.take((timeout_seconds ?? 30) * 1e3);
+    return ok({ connected: sessionReady, count: items.length, messages: await enrich(items) });
+  });
+  server.registerTool("status", {
+    title: "Auth status",
+    description: "Check authentication and access-token status.",
+    inputSchema: {}
+  }, async () => {
+    const exp = getTokenExpiresAt();
+    return ok({
+      authenticated: !!getAuthToken(),
+      token_expires_in_seconds: exp ? Math.max(0, Math.floor((exp - Date.now()) / 1e3)) : null
+    });
+  });
+  await server.connect(new StdioServerTransport());
+}
+
+// src/cli/mcp.ts
+function createMcpCommand() {
+  const cmd = new Command14("mcp");
+  cmd.description("Run as an MCP server (stdio): exposes chats/messages/contacts tools to MCP hosts").action(async () => {
+    try {
+      await runMcpServer();
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+  return cmd;
+}
+
+// src/cli/root.ts
+function createRootCommand() {
+  const program2 = new Command15();
+  program2.name("express-cli").description("CLI client for eXpress Chat").version("0.1.0").option("--host <host>", "eXpress server host");
+  program2.addCommand(createAuthCommand());
+  program2.addCommand(createApiCommand());
+  program2.addCommand(createConfigCommand());
+  program2.addCommand(createStatusCommand());
+  program2.addCommand(createContactsCommand());
+  program2.addCommand(createSettingsCommand());
+  program2.addCommand(createChatsCommand());
+  program2.addCommand(createSendCommand());
+  program2.addCommand(createAvatarCommand());
+  program2.addCommand(createDownloadCommand());
+  program2.addCommand(createMessagesCommand());
+  program2.addCommand(createListenCommand());
+  program2.addCommand(createTuiCommand());
+  program2.addCommand(createMcpCommand());
+  return program2;
+}
+
+// src/index.ts
+var program = createRootCommand();
+program.parse();
+//# sourceMappingURL=index.js.map