@ih8e/express-cli 0.1.4 → 0.1.6

package/dist/index.js

@@ -49,6 +49,219 @@ var init_esm_shims = __esm({
   }
 });
 
+// src/types/express.ts
+var init_express = __esm({
+  "src/types/express.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
+// src/types/api.ts
+var init_api = __esm({
+  "src/types/api.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
+// src/types/config.ts
+import { z } from "zod";
+var configSchema, envSchema;
+var init_config = __esm({
+  "src/types/config.ts"() {
+    "use strict";
+    init_esm_shims();
+    configSchema = z.object({
+      host: z.string().min(1, "host is required \u2014 set EXPRESS_HOST or configure via `express config set host <host>`"),
+      protocol: z.enum(["https", "http"]).default("https"),
+      token: z.string().optional(),
+      locale: z.string().default("ru"),
+      platform: z.string().default("web"),
+      platform_package_id: z.string().default("ru.alfabank"),
+      app_version: z.string().default("3.66.47"),
+      output: z.enum(["table", "json"]).default("table")
+    });
+    envSchema = z.object({
+      EXPRESS_HOST: z.string().optional(),
+      EXPRESS_TOKEN: z.string().optional(),
+      EXPRESS_LOCALE: z.string().optional(),
+      EXPRESS_OUTPUT: z.enum(["table", "json"]).optional()
+    });
+  }
+});
+
+// src/types/index.ts
+var init_types = __esm({
+  "src/types/index.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_express();
+    init_api();
+    init_config();
+  }
+});
+
+// src/config/store.ts
+import Conf from "conf";
+function getStoredConfig() {
+  return store.get("config") ?? {};
+}
+function setStoredConfig(partial) {
+  const current = getStoredConfig();
+  store.set("config", { ...current, ...partial });
+}
+function getAuthToken() {
+  return store.get("authToken") ?? null;
+}
+function setAuthToken(token) {
+  if (token === null) {
+    store.delete("authToken");
+  } else {
+    store.set("authToken", token);
+  }
+}
+function getRtsAuthToken() {
+  return store.get("rtsAuthToken") ?? null;
+}
+function setRtsAuthToken(token) {
+  if (token === null) {
+    store.delete("rtsAuthToken");
+  } else {
+    store.set("rtsAuthToken", token);
+  }
+}
+function getRefreshToken() {
+  return store.get("refreshToken") ?? null;
+}
+function setRefreshToken(token) {
+  if (token === null) {
+    store.delete("refreshToken");
+  } else {
+    store.set("refreshToken", token);
+  }
+}
+function getTokenExpiresAt() {
+  return store.get("tokenExpiresAt") ?? null;
+}
+function setTokenExpiresAt(expiresAt) {
+  if (expiresAt === null) {
+    store.delete("tokenExpiresAt");
+  } else {
+    store.set("tokenExpiresAt", expiresAt);
+  }
+}
+function calcTokenExpiresAt(expiresIn) {
+  return Date.now() + Math.floor(expiresIn / 2) * 1e3;
+}
+function isTokenExpiringSoon() {
+  const expiresAt = getTokenExpiresAt();
+  if (!expiresAt) return true;
+  return Date.now() >= expiresAt;
+}
+function getEtsAuthToken() {
+  return store.get("etsAuthToken") ?? null;
+}
+function setEtsAuthToken(token) {
+  if (token === null) {
+    store.delete("etsAuthToken");
+  } else {
+    store.set("etsAuthToken", token);
+  }
+}
+function getApigwKeysRaw() {
+  return store.get("apigwKeys") ?? null;
+}
+function setApigwKeysRaw(data) {
+  if (data === null) {
+    store.delete("apigwKeys");
+  } else {
+    store.set("apigwKeys", data);
+  }
+}
+function clearAll() {
+  store.clear();
+}
+var store;
+var init_store = __esm({
+  "src/config/store.ts"() {
+    "use strict";
+    init_esm_shims();
+    store = new Conf({
+      projectName: "express-cli",
+      defaults: {
+        config: {},
+        authToken: null,
+        refreshToken: null,
+        rtsAuthToken: null,
+        apigwKeys: null,
+        tokenExpiresAt: null,
+        etsAuthToken: null
+      }
+    });
+  }
+});
+
+// src/config/loader.ts
+var loader_exports = {};
+__export(loader_exports, {
+  getBaseUrl: () => getBaseUrl,
+  getEtsBaseUrl: () => getEtsBaseUrl,
+  getWebOrigin: () => getWebOrigin,
+  loadConfig: () => loadConfig
+});
+import { ZodError } from "zod";
+function loadConfig(cliOverrides = {}) {
+  const stored = getStoredConfig();
+  const env2 = {};
+  if (process.env.EXPRESS_HOST) env2.host = process.env.EXPRESS_HOST;
+  if (process.env.EXPRESS_TOKEN) env2.token = process.env.EXPRESS_TOKEN;
+  if (process.env.EXPRESS_LOCALE) env2.locale = process.env.EXPRESS_LOCALE;
+  if (process.env.EXPRESS_OUTPUT) env2.output = process.env.EXPRESS_OUTPUT;
+  const merged = {
+    ...stored,
+    ...env2,
+    ...cliOverrides
+  };
+  if (!merged.token) {
+    const storedToken = getAuthToken();
+    if (storedToken) merged.token = storedToken;
+  }
+  try {
+    return configSchema.parse(merged);
+  } catch (err) {
+    if (err instanceof ZodError) {
+      const details = err.issues.map((i) => `  ${i.path.join(".")}: ${i.message}`).join("\n");
+      throw new Error(`Configuration error:
+${details}
+
+Run: express-cli config set host <hostname>`);
+    }
+    throw err;
+  }
+}
+function getBaseUrl(config) {
+  return `${config.protocol}://${config.host}`;
+}
+function getDomain(ctsHost) {
+  const parts = ctsHost.split(".");
+  return parts.length > 2 ? parts.slice(1).join(".") : ctsHost;
+}
+function getEtsBaseUrl(config) {
+  return `https://ets.${getDomain(config.host)}`;
+}
+function getWebOrigin(config) {
+  return `https://${getDomain(config.host)}`;
+}
+var init_loader = __esm({
+  "src/config/loader.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_types();
+    init_store();
+  }
+});
+
 // node_modules/react/cjs/react.production.js
 var require_react_production = __commonJS({
   "node_modules/react/cjs/react.production.js"(exports) {
@@ -25062,179 +25275,11 @@ init_esm_shims();
 
 // src/config/index.ts
 init_esm_shims();
-
-// src/config/loader.ts
-init_esm_shims();
-import { ZodError } from "zod";
-
-// src/types/index.ts
-init_esm_shims();
-
-// src/types/express.ts
-init_esm_shims();
-
-// src/types/api.ts
-init_esm_shims();
-
-// src/types/config.ts
-init_esm_shims();
-import { z } from "zod";
-var configSchema = z.object({
-  host: z.string().min(1, "host is required \u2014 set EXPRESS_HOST or configure via `express config set host <host>`"),
-  protocol: z.enum(["https", "http"]).default("https"),
-  token: z.string().optional(),
-  locale: z.string().default("ru"),
-  platform: z.string().default("web"),
-  platform_package_id: z.string().default("ru.alfabank"),
-  app_version: z.string().default("3.66.47"),
-  output: z.enum(["table", "json"]).default("table")
-});
-var envSchema = z.object({
-  EXPRESS_HOST: z.string().optional(),
-  EXPRESS_TOKEN: z.string().optional(),
-  EXPRESS_LOCALE: z.string().optional(),
-  EXPRESS_OUTPUT: z.enum(["table", "json"]).optional()
-});
-
-// src/config/store.ts
-init_esm_shims();
-import Conf from "conf";
-var store = new Conf({
-  projectName: "express-cli",
-  defaults: {
-    config: {},
-    authToken: null,
-    refreshToken: null,
-    rtsAuthToken: null,
-    apigwKeys: null,
-    tokenExpiresAt: null,
-    etsAuthToken: null
-  }
-});
-function getStoredConfig() {
-  return store.get("config") ?? {};
-}
-function setStoredConfig(partial) {
-  const current = getStoredConfig();
-  store.set("config", { ...current, ...partial });
-}
-function getAuthToken() {
-  return store.get("authToken") ?? null;
-}
-function setAuthToken(token) {
-  if (token === null) {
-    store.delete("authToken");
-  } else {
-    store.set("authToken", token);
-  }
-}
-function getRtsAuthToken() {
-  return store.get("rtsAuthToken") ?? null;
-}
-function setRtsAuthToken(token) {
-  if (token === null) {
-    store.delete("rtsAuthToken");
-  } else {
-    store.set("rtsAuthToken", token);
-  }
-}
-function getRefreshToken() {
-  return store.get("refreshToken") ?? null;
-}
-function setRefreshToken(token) {
-  if (token === null) {
-    store.delete("refreshToken");
-  } else {
-    store.set("refreshToken", token);
-  }
-}
-function getTokenExpiresAt() {
-  return store.get("tokenExpiresAt") ?? null;
-}
-function setTokenExpiresAt(expiresAt) {
-  if (expiresAt === null) {
-    store.delete("tokenExpiresAt");
-  } else {
-    store.set("tokenExpiresAt", expiresAt);
-  }
-}
-function calcTokenExpiresAt(expiresIn) {
-  return Date.now() + Math.floor(expiresIn / 2) * 1e3;
-}
-function isTokenExpiringSoon() {
-  const expiresAt = getTokenExpiresAt();
-  if (!expiresAt) return true;
-  return Date.now() >= expiresAt;
-}
-function getEtsAuthToken() {
-  return store.get("etsAuthToken") ?? null;
-}
-function setEtsAuthToken(token) {
-  if (token === null) {
-    store.delete("etsAuthToken");
-  } else {
-    store.set("etsAuthToken", token);
-  }
-}
-function getApigwKeysRaw() {
-  return store.get("apigwKeys") ?? null;
-}
-function setApigwKeysRaw(data) {
-  if (data === null) {
-    store.delete("apigwKeys");
-  } else {
-    store.set("apigwKeys", data);
-  }
-}
-function clearAll() {
-  store.clear();
-}
-
-// src/config/loader.ts
-function loadConfig(cliOverrides = {}) {
-  const stored = getStoredConfig();
-  const env2 = {};
-  if (process.env.EXPRESS_HOST) env2.host = process.env.EXPRESS_HOST;
-  if (process.env.EXPRESS_TOKEN) env2.token = process.env.EXPRESS_TOKEN;
-  if (process.env.EXPRESS_LOCALE) env2.locale = process.env.EXPRESS_LOCALE;
-  if (process.env.EXPRESS_OUTPUT) env2.output = process.env.EXPRESS_OUTPUT;
-  const merged = {
-    ...stored,
-    ...env2,
-    ...cliOverrides
-  };
-  if (!merged.token) {
-    const storedToken = getAuthToken();
-    if (storedToken) merged.token = storedToken;
-  }
-  try {
-    return configSchema.parse(merged);
-  } catch (err) {
-    if (err instanceof ZodError) {
-      const details = err.issues.map((i) => `  ${i.path.join(".")}: ${i.message}`).join("\n");
-      throw new Error(`Configuration error:
-${details}
-
-Run: express-cli config set host <hostname>`);
-    }
-    throw err;
-  }
-}
-function getBaseUrl(config) {
-  return `${config.protocol}://${config.host}`;
-}
-function getDomain(ctsHost) {
-  const parts = ctsHost.split(".");
-  return parts.length > 2 ? parts.slice(1).join(".") : ctsHost;
-}
-function getEtsBaseUrl(config) {
-  return `https://ets.${getDomain(config.host)}`;
-}
-function getWebOrigin(config) {
-  return `https://${getDomain(config.host)}`;
-}
+init_loader();
+init_store();
 
 // src/auth/import.ts
+init_loader();
 async function importToken(token, cliOverrides = {}) {
   const config = loadConfig(cliOverrides);
   const baseUrl = getBaseUrl(config);
@@ -25275,6 +25320,7 @@ init_esm_shims();
 
 // src/auth/keys.ts
 init_esm_shims();
+init_store();
 import { ed25519 } from "@noble/curves/ed25519.js";
 import { randomBytes } from "crypto";
 import nacl from "tweetnacl";
@@ -25561,6 +25607,8 @@ ${signingString}`);
 }
 
 // src/auth/device-login.ts
+init_store();
+init_loader();
 import nacl2 from "tweetnacl";
 import { randomUUID } from "crypto";
 async function fetchCurrentAccountCtsKey(baseUrl, token, userHuid, webOrigin) {
@@ -25958,6 +26006,30 @@ Minting a new one would break your other devices. Import the shared key instead:
 
 // src/auth/qr-login.ts
 init_esm_shims();
+
+// src/auth/qr-browser.ts
+init_esm_shims();
+import { execFile } from "child_process";
+import QRCode from "qrcode";
+async function openQrInBrowser(payload, registrationId) {
+  let pngDataUrl;
+  try {
+    pngDataUrl = await QRCode.toDataURL(payload, { scale: 8, margin: 2 });
+  } catch {
+    return;
+  }
+  const html = `<!DOCTYPE html><html><head><meta charset="utf-8"><title>eXpress QR</title><style>body{font-family:sans-serif;background:#fff;display:flex;flex-direction:column;align-items:center;justify-content:center;min-height:100vh;margin:0}h2{color:#1a1a1a;margin-bottom:16px}img{width:280px;height:280px;image-rendering:pixelated;border:1px solid #eee;border-radius:8px}p{color:#999;font-size:11px;margin-top:12px;font-family:monospace}</style></head><body><h2>Scan with eXpress</h2><img src="${pngDataUrl}" alt="QR"><p>${registrationId}</p></body></html>`;
+  const htmlDataUrl = `data:text/html;charset=utf-8,${encodeURIComponent(html)}`;
+  try {
+    const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+    execFile(opener, [htmlDataUrl]);
+  } catch {
+  }
+}
+
+// src/auth/qr-login.ts
+init_store();
+init_loader();
 import { randomUUID as randomUUID2, randomBytes as randomBytes2 } from "crypto";
 import qrcode from "qrcode-terminal";
 import nacl3 from "tweetnacl";
@@ -25992,16 +26064,20 @@ function commonHeaders(webOrigin) {
     "sec-ch-ua-platform": '"macOS"'
   };
 }
-async function qrLogin(cliOverrides = {}) {
+function buildQrMaterial(cliOverrides = {}) {
   const config = loadConfig(cliOverrides);
-  const etsBaseUrl = getEtsBaseUrl(config);
-  const webOrigin = getWebOrigin(config);
   const qrSigningKey = generateSigningKeyPair();
   const registrationId = qrSigningKey.keyId;
   const registrationToken = Buffer.from(randomBytes2(64)).toString("base64");
   const signPubKey = publicKeyToBase64(qrSigningKey.publicKey);
   const udid = randomUUID2();
   const encryptionKey = randomBytes2(32);
+  const qrPayload = JSON.stringify({
+    registration_id: registrationId,
+    registration_token: registrationToken,
+    registration_key: Buffer.from(encryptionKey).toString("base64"),
+    version: 1
+  });
   const qrBody = JSON.stringify({
     registration_id: registrationId,
     registration_token: registrationToken,
@@ -26021,63 +26097,53 @@ async function qrLogin(cliOverrides = {}) {
     platform: "web",
     platform_package_id: "com.pyligrim.alphach"
   });
-  const qrPayload = JSON.stringify({
-    registration_id: registrationId,
-    registration_token: registrationToken,
-    registration_key: Buffer.from(encryptionKey).toString("base64"),
-    version: 1
-  });
-  console.log("Step 1/7: Scan this QR code with your eXpress app:\n");
-  qrcode.generate(qrPayload, { small: true }, (qr) => {
-    console.log(qr);
-  });
-  console.log(`
-  registration_id: ${registrationId}`);
-  console.log("  Waiting for scan (server long-polling)...\n");
+  return { registrationId, encryptionKey, qrSigningKey, udid, qrPayload, qrBody, config };
+}
+async function pollForQrScan(mat) {
+  const etsBaseUrl = getEtsBaseUrl(mat.config);
+  const webOrigin = getWebOrigin(mat.config);
   const etsUrl = `${etsBaseUrl}/api/v1/authentication/qr/mobile_to_web/request`;
   const qrHeaders = signQrRequest({
     method: "POST",
     url: etsUrl,
-    body: qrBody,
-    registrationId,
-    privateKey: qrSigningKey.privateKey
+    body: mat.qrBody,
+    registrationId: mat.registrationId,
+    privateKey: mat.qrSigningKey.privateKey
   });
-  let qrRes;
+  let res;
   try {
-    qrRes = await fetch(etsUrl, {
+    res = await fetch(etsUrl, {
       method: "POST",
       headers: { ...commonHeaders(webOrigin), ...qrHeaders },
-      body: qrBody
+      body: mat.qrBody
     });
   } catch (err) {
     throw new Error(`QR request network error: ${err.message}`);
   }
-  const qrText = await qrRes.text();
-  if (!qrRes.ok) {
-    console.log(`  Response (${qrRes.status}): ${qrText.slice(0, 500)}`);
-    throw new Error(`QR request failed (${qrRes.status}): ${qrText.slice(0, 500)}`);
-  }
-  let qrData;
-  try {
-    qrData = JSON.parse(qrText);
-  } catch {
-    throw new Error(`Invalid QR response: ${qrText.slice(0, 500)}`);
-  }
-  if (process.env.EXPRESS_DEBUG) {
-    console.log(`  [DEBUG] QR full response: ${qrText.slice(0, 1e3)}`);
+  const text = await res.text();
+  if (!res.ok) throw new Error(`QR request failed (${res.status}): ${text.slice(0, 500)}`);
+  const data = JSON.parse(text);
+  if (process.env.EXPRESS_DEBUG) process.stderr.write(`[qr] full response: ${text.slice(0, 1e3)}
+`);
+  const result = extractResult2(data);
+  const ctsRegistrationToken = result.cts_registration_token ?? "";
+  const rtsRegistrationToken = result.rts_registration_token ?? "";
+  const registrationData = result.registration_data ?? "";
+  if (!ctsRegistrationToken && !rtsRegistrationToken) {
+    throw new Error(`No tokens in QR response: ${text.slice(0, 500)}`);
   }
-  const qrResult = extractResult2(qrData);
-  const ctsRegistrationToken = qrResult.cts_registration_token ?? "";
-  const rtsRegistrationToken = qrResult.rts_registration_token ?? "";
-  const registrationData = qrResult.registration_data ?? "";
-  console.log("  QR scanned! Got tokens from server.");
+  return { ctsRegistrationToken, rtsRegistrationToken, registrationData };
+}
+async function completeQrRegistration(mat, poll, log = console.log) {
+  const { config, registrationId, encryptionKey, qrSigningKey } = mat;
+  const { ctsRegistrationToken, rtsRegistrationToken, registrationData } = poll;
+  const etsBaseUrl = getEtsBaseUrl(config);
+  const webOrigin = getWebOrigin(config);
+  log("  QR scanned! Got tokens from server.");
   if (process.env.EXPRESS_DEBUG) {
-    console.log(`  [DEBUG] registration_data length: ${registrationData.length}`);
-    console.log(`  [DEBUG] registration_data raw: ${registrationData.slice(0, 100)}...`);
-    console.log(`  [DEBUG] encryptionKey (registration_key) hex: ${Buffer.from(encryptionKey).toString("hex")}`);
-  }
-  if (!ctsRegistrationToken && !rtsRegistrationToken) {
-    throw new Error(`No tokens in QR response: ${qrText.slice(0, 500)}`);
+    log(`  [DEBUG] registration_data length: ${registrationData.length}`);
+    log(`  [DEBUG] registration_data raw: ${registrationData.slice(0, 100)}...`);
+    log(`  [DEBUG] encryptionKey (registration_key) hex: ${Buffer.from(encryptionKey).toString("hex")}`);
   }
   let rtsPrivateKey = null;
   let rtsPublicKeyId = "";
@@ -26087,14 +26153,14 @@ async function qrLogin(cliOverrides = {}) {
     try {
       const raw = Uint8Array.from(Buffer.from(registrationData, "base64"));
       if (process.env.EXPRESS_DEBUG) {
-        console.log(`  [DEBUG] registration_data decoded length: ${raw.length}`);
-        console.log(`  [DEBUG] first 40 bytes hex: ${Buffer.from(raw.slice(0, 40)).toString("hex")}`);
-        console.log(`  [DEBUG] encryptionKey hex: ${Buffer.from(encryptionKey).toString("hex")}`);
-        console.log(`  [DEBUG] encryptionKey length: ${encryptionKey.length}`);
+        log(`  [DEBUG] registration_data decoded length: ${raw.length}`);
+        log(`  [DEBUG] first 40 bytes hex: ${Buffer.from(raw.slice(0, 40)).toString("hex")}`);
+        log(`  [DEBUG] encryptionKey hex: ${Buffer.from(encryptionKey).toString("hex")}`);
+        log(`  [DEBUG] encryptionKey length: ${encryptionKey.length}`);
       }
       const decrypted = decryptRegistrationData(registrationData, encryptionKey);
       if (process.env.EXPRESS_DEBUG) {
-        console.log("  Decrypted registration_data:", JSON.stringify(decrypted).slice(0, 500));
+        log("  Decrypted registration_data: " + JSON.stringify(decrypted).slice(0, 500));
       }
       if (decrypted && typeof decrypted === "object") {
         const data = decrypted;
@@ -26110,10 +26176,10 @@ async function qrLogin(cliOverrides = {}) {
         }
       }
     } catch (err) {
-      console.log(`  Warning: could not decrypt registration_data: ${err.message}`);
+      log(`  Warning: could not decrypt registration_data: ${err.message}`);
     }
   }
-  console.log("\nStep 2/7: Confirming with ETS...");
+  log("\nStep 2: Confirming with ETS...");
   const confirmUrl = `${etsBaseUrl}/api/v1/authentication/register_confirm/qr`;
   const confirmBody = JSON.stringify({
     registration_id: registrationId,
@@ -26132,23 +26198,17 @@ async function qrLogin(cliOverrides = {}) {
     body: confirmBody
   });
   const confirmText = await confirmRes.text();
-  if (!confirmRes.ok) {
-    throw new Error(`ETS register_confirm failed (${confirmRes.status}): ${confirmText.slice(0, 500)}`);
-  }
+  if (!confirmRes.ok) throw new Error(`ETS register_confirm failed (${confirmRes.status}): ${confirmText.slice(0, 500)}`);
   const confirmData = extractResult2(JSON.parse(confirmText));
   const userHuid = confirmData.user_huid ?? "";
   const etsAuthToken = confirmData.auth_token ?? "";
-  console.log(`  ETS confirmed. User: ${userHuid || "unknown"}`);
+  log(`  ETS confirmed. User: ${userHuid || "unknown"}`);
   if (etsAuthToken) {
     setEtsAuthToken(etsAuthToken);
-    if (process.env.EXPRESS_DEBUG) {
-      console.log(`  [DEBUG] ETS auth_token saved (${etsAuthToken.length} chars)`);
-    }
-  }
-  if (!ctsRegistrationToken) {
-    throw new Error("No cts_registration_token \u2014 cannot confirm with CTS");
+    if (process.env.EXPRESS_DEBUG) log(`  [DEBUG] ETS auth_token saved (${etsAuthToken.length} chars)`);
   }
-  console.log("\nStep 3/7: Confirming with CTS (AD integration)...");
+  if (!ctsRegistrationToken) throw new Error("No cts_registration_token \u2014 cannot confirm with CTS");
+  log("\nStep 3: Confirming with CTS (AD integration)...");
   const ctsUrl = `${getBaseUrl(config)}/api/v1/ad_integration/register_confirm/qr`;
   const adConfirmBody = JSON.stringify({
     rts_registration_id: registrationId,
@@ -26168,9 +26228,7 @@ async function qrLogin(cliOverrides = {}) {
     body: adConfirmBody
   });
   const adText = await adRes.text();
-  if (!adRes.ok) {
-    throw new Error(`AD integration confirm failed (${adRes.status}): ${adText.slice(0, 500)}`);
-  }
+  if (!adRes.ok) throw new Error(`AD integration confirm failed (${adRes.status}): ${adText.slice(0, 500)}`);
   const adData = extractResult2(JSON.parse(adText));
   const accessToken = adData.access_token;
   const refreshToken2 = adData.refresh_token;
@@ -26179,26 +26237,19 @@ async function qrLogin(cliOverrides = {}) {
   const encryptedRtsToken = adData.encrypted_rts_token;
   if (process.env.EXPRESS_DEBUG) {
     const adDataRaw = JSON.parse(adText);
-    console.log(`  [DEBUG] AD confirm full result keys: ${JSON.stringify(Object.keys(adDataRaw.result || adDataRaw))}`);
-    if (encryptedRtsToken) {
-      console.log(`  [DEBUG] encrypted_rts_token found: ${encryptedRtsToken.slice(0, 60)}...`);
-    } else {
-      console.log(`  [DEBUG] encrypted_rts_token NOT found in response`);
-    }
-  }
-  if (!accessToken) {
-    throw new Error(`No access_token in AD confirm response: ${adText.slice(0, 500)}`);
+    log(`  [DEBUG] AD confirm full result keys: ${JSON.stringify(Object.keys(adDataRaw.result || adDataRaw))}`);
+    if (encryptedRtsToken) log(`  [DEBUG] encrypted_rts_token found: ${encryptedRtsToken.slice(0, 60)}...`);
+    else log(`  [DEBUG] encrypted_rts_token NOT found in response`);
   }
+  if (!accessToken) throw new Error(`No access_token in AD confirm response: ${adText.slice(0, 500)}`);
   setAuthToken(accessToken);
-  if (refreshToken2) {
-    setRefreshToken(refreshToken2);
-  }
+  if (refreshToken2) setRefreshToken(refreshToken2);
   if (typeof expiresIn === "number") {
     setTokenExpiresAt(calcTokenExpiresAt(expiresIn));
-    console.log(`  Token expires in ${expiresIn}s (refresh after ${(expiresIn / 2 / 60).toFixed(0)} min)`);
+    log(`  Token expires in ${expiresIn}s (refresh after ${(expiresIn / 2 / 60).toFixed(0)} min)`);
   }
-  console.log(`  CTS confirmed. Access token: ${accessToken.slice(0, 40)}...`);
-  console.log("\nStep 4/7: Registering device token...");
+  log(`  CTS confirmed. Access token: ${accessToken.slice(0, 40)}...`);
+  log("\nStep 4: Registering device token...");
   const tokenUrl = `${getBaseUrl(config)}/api/v1/ad_integration/token`;
   const tokenBody = JSON.stringify({
     app_version: config.app_version,
@@ -26217,23 +26268,19 @@ async function qrLogin(cliOverrides = {}) {
   });
   const tokenRes = await fetch(tokenUrl, {
     method: "PUT",
-    headers: {
-      ...commonHeaders(webOrigin),
-      Authorization: `Bearer ${accessToken}`,
-      "Content-Type": "application/json"
-    },
+    headers: { ...commonHeaders(webOrigin), Authorization: `Bearer ${accessToken}`, "Content-Type": "application/json" },
     body: tokenBody
   });
   if (!tokenRes.ok) {
     const tokenErrText = await tokenRes.text().catch(() => "");
-    console.log(`  Warning: device token registration failed (${tokenRes.status}): ${tokenErrText.slice(0, 200)}`);
+    log(`  Warning: device token registration failed (${tokenRes.status}): ${tokenErrText.slice(0, 200)}`);
   } else {
-    console.log("  Device token registered.");
+    log("  Device token registered.");
   }
-  console.log("\nStep 5/7: Registering signing key + fetching server key...");
+  log("\nStep 5: Registering signing key + fetching server key...");
   if (process.env.EXPRESS_DEBUG) {
-    console.log(`  [DEBUG] serverId: ${serverId}`);
-    console.log(`  [DEBUG] userHuid: ${userHuid}`);
+    log(`  [DEBUG] serverId: ${serverId}`);
+    log(`  [DEBUG] userHuid: ${userHuid}`);
   }
   const apigwSigningKey = generateSigningKeyPair();
   const apigwKeyPublicBase64 = publicKeyToBase64(apigwSigningKey.publicKey);
@@ -26247,56 +26294,42 @@ async function qrLogin(cliOverrides = {}) {
   const [kdcSignRes, etsKdcSignRes, etsKdcStartRes] = await Promise.all([
     fetch(kdcSignUrl, {
       method: "POST",
-      headers: {
-        ...commonHeaders(webOrigin),
-        Authorization: `Bearer ${accessToken}`,
-        "Content-Type": "application/json"
-      },
+      headers: { ...commonHeaders(webOrigin), Authorization: `Bearer ${accessToken}`, "Content-Type": "application/json" },
       body: kdcSignBody
     }),
     fetch(`${etsBaseUrl}/api/v2/kdc/keys/${userHuid}`, {
       method: "POST",
-      headers: {
-        ...commonHeaders(webOrigin),
-        Authorization: `Bearer ${etsAuthToken}`,
-        "Content-Type": "application/json"
-      },
+      headers: { ...commonHeaders(webOrigin), Authorization: `Bearer ${etsAuthToken}`, "Content-Type": "application/json" },
       body: kdcSignBody
     }),
-    fetch(`${etsBaseUrl}/api/v1/kdc/start`, {
-      headers: {
-        ...commonHeaders(webOrigin)
-      }
-    })
+    fetch(`${etsBaseUrl}/api/v1/kdc/start`, { headers: { ...commonHeaders(webOrigin) } })
   ]);
   if (!kdcSignRes.ok) {
     const kdcErrText = await kdcSignRes.text().catch(() => "");
-    console.log(`  Warning: CTS KDC signing key registration failed (${kdcSignRes.status}): ${kdcErrText.slice(0, 200)}`);
+    log(`  Warning: CTS KDC signing key registration failed (${kdcSignRes.status}): ${kdcErrText.slice(0, 200)}`);
   } else {
     const kdcSignData = await kdcSignRes.json().catch(() => null);
-    console.log(`  Signing key registered in CTS: ${apigwSigningKey.keyId}`, kdcSignData ? JSON.stringify(kdcSignData).slice(0, 200) : "");
+    log(`  Signing key registered in CTS: ${apigwSigningKey.keyId}` + (kdcSignData ? " " + JSON.stringify(kdcSignData).slice(0, 200) : ""));
   }
   if (!etsKdcSignRes.ok) {
     const etsErrText = await etsKdcSignRes.text().catch(() => "");
-    console.log(`  Warning: ETS KDC signing key registration failed (${etsKdcSignRes.status}): ${etsErrText.slice(0, 200)}`);
+    log(`  Warning: ETS KDC signing key registration failed (${etsKdcSignRes.status}): ${etsErrText.slice(0, 200)}`);
   } else {
     const etsSignData = await etsKdcSignRes.json().catch(() => null);
-    console.log(`  Signing key registered in ETS: ${apigwSigningKey.keyId}`, etsSignData ? JSON.stringify(etsSignData).slice(0, 200) : "");
+    log(`  Signing key registered in ETS: ${apigwSigningKey.keyId}` + (etsSignData ? " " + JSON.stringify(etsSignData).slice(0, 200) : ""));
   }
   let serverPublicKey = new Uint8Array(0);
   let serverPublicKeyId = "";
   if (etsKdcStartRes.ok) {
     const kdcStartText = await etsKdcStartRes.text();
-    if (process.env.EXPRESS_DEBUG) {
-      console.log(`  [DEBUG] ETS KDC start response: ${kdcStartText.slice(0, 500)}`);
-    }
+    if (process.env.EXPRESS_DEBUG) log(`  [DEBUG] ETS KDC start response: ${kdcStartText.slice(0, 500)}`);
     try {
       const kdcStartData = JSON.parse(kdcStartText);
       const keyBody = kdcStartData.result ?? kdcStartText;
       serverPublicKey = new Uint8Array(Buffer.from(keyBody, "base64"));
       serverPublicKeyId = "kdc-start-ets";
       const rawB64 = Buffer.from(serverPublicKey).toString("base64");
-      console.log(`  ETS server public key from /kdc/start: ${rawB64} (curve25519, used directly)`);
+      log(`  ETS server public key from /kdc/start: ${rawB64} (curve25519, used directly)`);
     } catch {
       try {
         serverPublicKey = new Uint8Array(Buffer.from(kdcStartText, "base64"));
@@ -26306,11 +26339,7 @@ async function qrLogin(cliOverrides = {}) {
   }
   if (!serverPublicKey.length) {
     if (process.env.EXPRESS_DEBUG && !etsKdcStartRes.ok) {
-      console.log(`  [DEBUG] ETS KDC start status: ${etsKdcStartRes.status}`);
-      try {
-        console.log(`  [DEBUG] ETS KDC start body: ${(await etsKdcStartRes.text()).slice(0, 500)}`);
-      } catch {
-      }
+      log(`  [DEBUG] ETS KDC start status: ${etsKdcStartRes.status}`);
     }
     throw new Error("Could not fetch server public key from ETS /kdc/start");
   }
@@ -26320,34 +26349,26 @@ async function qrLogin(cliOverrides = {}) {
     const [ctsRtsRes, etsRtsRes] = await Promise.all([
       fetch(kdcSignUrl, {
         method: "POST",
-        headers: {
-          ...commonHeaders(webOrigin),
-          Authorization: `Bearer ${accessToken}`,
-          "Content-Type": "application/json"
-        },
+        headers: { ...commonHeaders(webOrigin), Authorization: `Bearer ${accessToken}`, "Content-Type": "application/json" },
         body: rtsKeyBody
       }),
       fetch(`${etsBaseUrl}/api/v2/kdc/keys/${userHuid}`, {
         method: "POST",
-        headers: {
-          ...commonHeaders(webOrigin),
-          Authorization: `Bearer ${etsAuthToken}`,
-          "Content-Type": "application/json"
-        },
+        headers: { ...commonHeaders(webOrigin), Authorization: `Bearer ${etsAuthToken}`, "Content-Type": "application/json" },
         body: rtsKeyBody
       })
     ]);
     if (!ctsRtsRes.ok) {
       const errText = await ctsRtsRes.text().catch(() => "");
-      console.log(`  Warning: CTS RTS key registration failed (${ctsRtsRes.status}): ${errText.slice(0, 200)}`);
+      log(`  Warning: CTS RTS key registration failed (${ctsRtsRes.status}): ${errText.slice(0, 200)}`);
     } else {
-      console.log(`  RTS key registered in CTS: ${rtsPublicKeyId}`);
+      log(`  RTS key registered in CTS: ${rtsPublicKeyId}`);
     }
     if (!etsRtsRes.ok) {
       const errText = await etsRtsRes.text().catch(() => "");
-      console.log(`  Warning: ETS RTS key registration failed (${etsRtsRes.status}): ${errText.slice(0, 200)}`);
+      log(`  Warning: ETS RTS key registration failed (${etsRtsRes.status}): ${errText.slice(0, 200)}`);
     } else {
-      console.log(`  RTS key registered in ETS: ${rtsPublicKeyId}`);
+      log(`  RTS key registered in ETS: ${rtsPublicKeyId}`);
     }
   }
   if (!rtsPrivateKey) {
@@ -26359,34 +26380,26 @@ async function qrLogin(cliOverrides = {}) {
     const [ctsEncRes, etsEncRes] = await Promise.all([
       fetch(kdcSignUrl, {
         method: "POST",
-        headers: {
-          ...commonHeaders(webOrigin),
-          Authorization: `Bearer ${accessToken}`,
-          "Content-Type": "application/json"
-        },
+        headers: { ...commonHeaders(webOrigin), Authorization: `Bearer ${accessToken}`, "Content-Type": "application/json" },
         body: rtsFallbackBody
       }),
       fetch(`${etsBaseUrl}/api/v2/kdc/keys/${userHuid}`, {
         method: "POST",
-        headers: {
-          ...commonHeaders(webOrigin),
-          Authorization: `Bearer ${etsAuthToken}`,
-          "Content-Type": "application/json"
-        },
+        headers: { ...commonHeaders(webOrigin), Authorization: `Bearer ${etsAuthToken}`, "Content-Type": "application/json" },
         body: rtsFallbackBody
       })
     ]);
     if (!ctsEncRes.ok) {
       const errText = await ctsEncRes.text().catch(() => "");
-      console.log(`  Warning: CTS fallback RTS key registration failed (${ctsEncRes.status}): ${errText.slice(0, 200)}`);
+      log(`  Warning: CTS fallback RTS key registration failed (${ctsEncRes.status}): ${errText.slice(0, 200)}`);
     } else {
-      console.log(`  Fallback encryption key registered in CTS: ${rtsPublicKeyId}`);
+      log(`  Fallback encryption key registered in CTS: ${rtsPublicKeyId}`);
     }
     if (!etsEncRes.ok) {
       const errText = await etsEncRes.text().catch(() => "");
-      console.log(`  Warning: ETS fallback RTS key registration failed (${etsEncRes.status}): ${errText.slice(0, 200)}`);
+      log(`  Warning: ETS fallback RTS key registration failed (${etsEncRes.status}): ${errText.slice(0, 200)}`);
     } else {
-      console.log(`  Fallback encryption key registered in ETS: ${rtsPublicKeyId}`);
+      log(`  Fallback encryption key registered in ETS: ${rtsPublicKeyId}`);
     }
   }
   const rtsPublicKey = nacl3.box.keyPair.fromSecretKey(rtsPrivateKey).publicKey;
@@ -26395,18 +26408,14 @@ async function qrLogin(cliOverrides = {}) {
     try {
       rtsAuthToken = decryptRtsToken(encryptedRtsToken, serverPublicKey, rtsPrivateKey);
       setRtsAuthToken(rtsAuthToken);
-      if (process.env.EXPRESS_DEBUG) {
-        console.log(`  [DEBUG] Decrypted RTS auth token: ${rtsAuthToken.slice(0, 60)}...`);
-      }
-      console.log(`  RTS auth token decrypted from encrypted_rts_token`);
+      if (process.env.EXPRESS_DEBUG) log(`  [DEBUG] Decrypted RTS auth token: ${rtsAuthToken.slice(0, 60)}...`);
+      log(`  RTS auth token decrypted from encrypted_rts_token`);
     } catch (err) {
-      console.log(`  Warning: could not decrypt encrypted_rts_token: ${err.message}`);
+      log(`  Warning: could not decrypt encrypted_rts_token: ${err.message}`);
     }
   }
   const rtsIdFromToken = extractRtsKeyIdFromToken(accessToken);
-  if (rtsIdFromToken && process.env.EXPRESS_DEBUG) {
-    console.log(`  [DEBUG] rts_id from CTS token: ${rtsIdFromToken}`);
-  }
+  if (rtsIdFromToken && process.env.EXPRESS_DEBUG) log(`  [DEBUG] rts_id from CTS token: ${rtsIdFromToken}`);
   const existingCts = loadApigwKeys()?.ctsKey;
   let ctsKey;
   if (qrCtsPrivateKey && qrCtsKeyId) {
@@ -26415,10 +26424,10 @@ async function qrLogin(cliOverrides = {}) {
       privateKey: qrCtsPrivateKey,
       publicKey: nacl3.box.keyPair.fromSecretKey(qrCtsPrivateKey).publicKey
     };
-    console.log(`  Using CTS key from QR handshake: ${qrCtsKeyId.slice(0, 8)}... (shared account key)`);
+    log(`  Using CTS key from QR handshake: ${qrCtsKeyId.slice(0, 8)}... (shared account key)`);
   } else if (existingCts) {
     ctsKey = existingCts;
-    console.log(`  Reusing existing CTS key: ${existingCts.keyId.slice(0, 8)}... (not re-registering)`);
+    log(`  Reusing existing CTS key: ${existingCts.keyId.slice(0, 8)}... (not re-registering)`);
   } else {
     const currentCts = await fetchCurrentAccountCtsKey2(getBaseUrl(config), accessToken, userHuid, webOrigin);
     if (currentCts) {
@@ -26426,29 +26435,25 @@ async function qrLogin(cliOverrides = {}) {
         `Account already has a shared CTS key (${currentCts}) that this CLI doesn't hold.
 Minting a new one would break your other devices (they can't fetch its private key).
 Instead, extract the key from a logged-in web client (IndexedDB authState \u2192 encryptionKeys \u2192 user.privateKeys.cts) and run:
-  express auth import-cts <private_key_b64> ${currentCts}
+  express-cli auth import-cts <private_key_b64> ${currentCts}
 Then re-run login, or just use 'auth refresh' for tokens.`
       );
     }
-    console.log("  No existing account CTS key found \u2014 minting a new one (first device).");
+    log("  No existing account CTS key found \u2014 minting a new one (first device).");
     const ctsKeyPair = nacl3.box.keyPair();
     const ctsKeyId = crypto.randomUUID();
     const ctsKeyPubB64 = Buffer.from(ctsKeyPair.publicKey).toString("base64");
     const ctsKeyBody = JSON.stringify({ key: ctsKeyPubB64, kind: "cts", algo: "xsalsa20", id: ctsKeyId });
     const ctsCtsKeyRes = await fetch(kdcSignUrl, {
       method: "POST",
-      headers: {
-        ...commonHeaders(webOrigin),
-        Authorization: `Bearer ${accessToken}`,
-        "Content-Type": "application/json"
-      },
+      headers: { ...commonHeaders(webOrigin), Authorization: `Bearer ${accessToken}`, "Content-Type": "application/json" },
       body: ctsKeyBody
     });
     if (!ctsCtsKeyRes.ok) {
       const errText = await ctsCtsKeyRes.text().catch(() => "");
-      console.log(`  Warning: CTS encryption key registration failed (${ctsCtsKeyRes.status}): ${errText.slice(0, 200)}`);
+      log(`  Warning: CTS encryption key registration failed (${ctsCtsKeyRes.status}): ${errText.slice(0, 200)}`);
     } else {
-      console.log(`  CTS encryption key registered: ${ctsKeyId.slice(0, 8)}...`);
+      log(`  CTS encryption key registered: ${ctsKeyId.slice(0, 8)}...`);
     }
     ctsKey = {
       keyId: ctsKeyId,
@@ -26468,7 +26473,7 @@ Then re-run login, or just use 'auth refresh' for tokens.`
     serverPublicKeyId
   };
   saveApigwKeys(apigwKeys);
-  console.log("\nStep 6/7: Activating apigw via ETS...");
+  log("\nStep 6: Activating apigw via ETS...");
   const activationUrl = `${etsBaseUrl}/api/v1/apigw/api/v1/authentication/activation`;
   const activationBody = JSON.stringify({
     app_version: config.app_version,
@@ -26496,20 +26501,39 @@ Then re-run login, or just use 'auth refresh' for tokens.`
   });
   if (!activationRes.ok) {
     const actErrText = await activationRes.text().catch(() => "");
-    console.log(`  Warning: apigw activation failed (${activationRes.status}): ${actErrText.slice(0, 200)}`);
+    log(`  Warning: apigw activation failed (${activationRes.status}): ${actErrText.slice(0, 200)}`);
   } else {
-    console.log("  Apigw activated.");
+    log("  Apigw activated.");
   }
-  console.log(`
+  log(`
   User HUID: ${userHuid || "unknown"}`);
-  console.log(`  Signing key: ${apigwSigningKey.keyId.slice(0, 8)}...`);
-  console.log(`  Encryption key: ${rtsPublicKeyId.slice(0, 8)}...`);
-  console.log(`  Server key: ${serverPublicKeyId.slice(0, 8)}...`);
-  console.log("\nQR login complete! You are now authenticated.");
+  log(`  Signing key: ${apigwSigningKey.keyId.slice(0, 8)}...`);
+  log(`  Encryption key: ${rtsPublicKeyId.slice(0, 8)}...`);
+  log(`  Server key: ${serverPublicKeyId.slice(0, 8)}...`);
+  log("\nQR login complete! You are now authenticated.");
 }
+async function qrLogin(cliOverrides = {}) {
+  const mat = buildQrMaterial(cliOverrides);
+  console.log("Step 1/6: Scan this QR code with your eXpress app:\n");
+  qrcode.generate(mat.qrPayload, { small: true }, (qr) => {
+    console.log(qr);
+  });
+  console.log(`
+  registration_id: ${mat.registrationId}`);
+  console.log("  Waiting for scan (server long-polling)...\n");
+  openQrInBrowser(mat.qrPayload, mat.registrationId).catch(() => {
+  });
+  const pollResult = await pollForQrScan(mat);
+  await completeQrRegistration(mat, pollResult);
+}
+
+// src/cli/auth.ts
+init_store();
 
 // src/auth/token-refresh.ts
 init_esm_shims();
+init_store();
+init_loader();
 var refreshPromise = null;
 async function refreshToken(cliOverrides = {}) {
   if (refreshPromise) return refreshPromise;
@@ -26657,6 +26681,7 @@ import { Command as Command2 } from "commander";
 
 // src/api/client.ts
 init_esm_shims();
+init_store();
 var ApiClient = class {
   config;
   baseUrl;
@@ -26723,8 +26748,9 @@ var ApiClient = class {
           const retryRes = await fetch(url, { ...options, headers: newHeaders });
           return this.handleResponse(retryRes);
         }
+        throw new Error("Token expired and refresh failed. Please re-authenticate with `express auth qr`.");
       }
-      throw new Error("Token expired and refresh failed. Please re-authenticate with `express auth qr`.");
+      throw new Error(`API error 401: ${res.statusText}${text ? ` \u2014 ${text.slice(0, 200)}` : ""}`);
     }
     return this.handleResponse(res);
   }
@@ -27126,8 +27152,97 @@ async function fetchChatListViaWebSocket(params) {
     });
   });
 }
+async function createPersonalChatViaWebSocket(params) {
+  const { host, ctsToken, encryptionKeyId, myHuid, targetHuid, timeoutMs = 15e3 } = params;
+  const instanceId = randomUUID3();
+  const wsUrl = `wss://${host}/socket/user/websocket?vsn=1.0.0&auto_join=true&key_id=${encryptionKeyId}&version=6&background=false&instance_id=${instanceId}`;
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const done = (fn) => {
+      if (!settled) {
+        settled = true;
+        fn();
+      }
+    };
+    const timer = setTimeout(() => {
+      try {
+        ws2.close();
+      } catch {
+      }
+      done(() => reject(new Error("WebSocket timeout: no chat_new response")));
+    }, timeoutMs);
+    const hostParts = host.split(".");
+    const webOrigin = `https://${hostParts.length > 2 ? hostParts.slice(1).join(".") : host}`;
+    const ws2 = new WebSocket(wsUrl, {
+      headers: {
+        Origin: webOrigin,
+        "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36"
+      }
+    });
+    const authRef = 0;
+    const createRef = 1;
+    const send = (msg) => {
+      ws2.send(JSON.stringify(msg));
+    };
+    ws2.addEventListener("open", () => {
+      send({ topic: "phoenix", event: "authenticate", payload: { token: ctsToken }, ref: authRef });
+    });
+    ws2.addEventListener("message", (event) => {
+      let msg;
+      try {
+        msg = JSON.parse(event.data);
+      } catch {
+        return;
+      }
+      if (msg.ref === authRef && msg.event === "phx_reply") {
+        if (msg.payload.status !== "ok") {
+          clearTimeout(timer);
+          ws2.close();
+          done(() => reject(new Error(`WS auth failed: ${JSON.stringify(msg.payload.response)}`)));
+          return;
+        }
+        send({
+          topic: "system",
+          event: "chat_new",
+          payload: {
+            chat_type: "chat",
+            members: [targetHuid, myHuid],
+            name: "personal chat",
+            description: "",
+            threads_enabled: false
+          },
+          ref: createRef
+        });
+        return;
+      }
+      if (msg.ref === createRef && msg.event === "phx_reply") {
+        clearTimeout(timer);
+        ws2.close();
+        if (msg.payload.status !== "ok") {
+          done(() => reject(new Error(`chat_new failed: ${JSON.stringify(msg.payload.response)}`)));
+          return;
+        }
+        const chatId = msg.payload.response?.chat_new?.payload?.group_chat_id;
+        if (!chatId) {
+          done(() => reject(new Error(`chat_new: no group_chat_id in response`)));
+          return;
+        }
+        done(() => resolve(chatId));
+      }
+    });
+    ws2.addEventListener("error", (err) => {
+      clearTimeout(timer);
+      done(() => reject(new Error(`WS error: ${String(err)}`)));
+    });
+    ws2.addEventListener("close", (event) => {
+      clearTimeout(timer);
+      done(() => reject(new Error(`WS closed before chat_new reply (code=${event.code})`)));
+    });
+  });
+}
 
 // src/api/chats.ts
+init_store();
 var ChatsApi = class {
   constructor(client) {
     this.client = client;
@@ -27174,6 +27289,16 @@ var ChatsApi = class {
     });
     return data?.open_chats?.[0] ?? null;
   }
+  async createDm(targetHuid) {
+    const config = loadConfig();
+    const host = new URL(getBaseUrl(config)).hostname;
+    const ctsToken = getAuthToken();
+    const keys = loadApigwKeys();
+    const encryptionKeyId = (keys?.ctsKey ?? keys?.encryptionKey)?.keyId;
+    if (!ctsToken || !encryptionKeyId) throw new Error("Not authenticated");
+    const myHuid = (await new UserApi(this.client).getSelfProfile()).user_huid;
+    return createPersonalChatViaWebSocket({ host, ctsToken, encryptionKeyId, myHuid, targetHuid });
+  }
 };
 
 // src/api/phonebook.ts
@@ -27221,8 +27346,7 @@ var PhonebookApi = class {
     );
     if (!data || typeof data !== "object") return [];
     const obj = data;
-    const result = obj.result;
-    const phonebook = result?.phonebook ?? [];
+    const phonebook = obj.phonebook ?? [];
     const huids = [
       ...new Set(
         phonebook.flatMap((entry) => entry.contacts ?? []).map((c) => c.user_huid).filter(Boolean)
@@ -27602,50 +27726,100 @@ function createChatsCommand() {
 init_esm_shims();
 import { Command as Command8 } from "commander";
 
-// src/api/messaging.ts
+// src/api/messaging-ws.ts
+init_esm_shims();
+import WebSocket2 from "ws";
+import { randomBytes as randomBytes3, randomUUID as randomUUID4, createHash } from "crypto";
+import { readFile } from "fs/promises";
+import { basename } from "path";
+import nacl4 from "tweetnacl";
+import sodium2 from "libsodium-wrappers-sumo";
+import sharp from "sharp";
+
+// src/api/file-service.ts
 init_esm_shims();
-var MessagingApi = class {
+var UPLOAD_PART_SIZE = 6291507;
+var IMAGE_MIME_TYPES = {
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp"
+};
+function detectImageMimeType(fileName) {
+  const ext = fileName.includes(".") ? "." + fileName.split(".").pop().toLowerCase() : "";
+  return IMAGE_MIME_TYPES[ext] ?? null;
+}
+var FileServiceApi = class {
   constructor(client) {
     this.client = client;
   }
   client;
-  async sendMessage(params) {
-    const payload = {
-      group_chat_id: params.groupChatId,
-      notification: {
-        status: "ok",
-        body: params.body,
-        ...params.metadata && { metadata: params.metadata },
-        ...params.mentions && { mentions: params.mentions },
-        ...params.stealthMode && {
-          opts: { stealth_mode: true }
-        }
-      }
-    };
-    return this.client.post("/api/v4/botx/notifications/direct", payload);
-  }
-  async sendFile(params) {
-    const payload = {
-      group_chat_id: params.groupChatId,
-      notification: {
-        status: "ok",
-        body: params.caption ?? ""
+  /** Uploads an already-encrypted content blob plus an already-encrypted JPEG preview via the resumable protocol. */
+  async uploadWithPreview(init, content, preview) {
+    const resumableId = await this.initUpload(
+      init,
+      `content=${content.length};preview=${preview.data.length},${preview.mimeType}`
+    );
+    await this.uploadPart(resumableId, "content", content);
+    const finalRes = await this.uploadPart(resumableId, "preview", preview.data);
+    const body = await finalRes.json();
+    return body.result;
+  }
+  async initUpload(init, shapes) {
+    const res = await this.client.rawRequest("/api/v2/file_service/resumable", {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "upload-part-size": String(UPLOAD_PART_SIZE),
+        "upload-shapes": shapes
       },
-      file: {
-        file_name: params.fileName,
-        data: params.fileData
-      }
-    };
-    return this.client.post("/api/v4/botx/notifications/direct", payload);
+      body: JSON.stringify(init)
+    });
+    if (!res.ok) {
+      throw new Error(`file upload init failed: ${res.status} ${await res.text()}`);
+    }
+    const resumableId = res.headers.get("upload-resumable-id");
+    if (!resumableId) throw new Error("file upload init: missing upload-resumable-id header");
+    return resumableId;
+  }
+  async uploadPart(resumableId, shape, data) {
+    const res = await this.client.rawRequest(`/api/v2/file_service/resumable/${resumableId}`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/octet-stream",
+        "upload-shape": shape,
+        "upload-part-size": String(UPLOAD_PART_SIZE),
+        "upload-range": `bytes=0-${data.length - 1}`
+      },
+      body: data
+    });
+    if (!res.ok) {
+      throw new Error(`file upload part (${shape}) failed: ${res.status} ${await res.text()}`);
+    }
+    return res;
   }
 };
 
-// src/api/messaging-ws.ts
+// src/api/file-crypto.ts
 init_esm_shims();
-import WebSocket2 from "ws";
-import { randomBytes as randomBytes3, randomUUID as randomUUID4 } from "crypto";
-import nacl4 from "tweetnacl";
 import sodium from "libsodium-wrappers-sumo";
+var FILE_CHUNK_SIZE = 2097152;
+async function encryptFileStream(data, key) {
+  await sodium.ready;
+  const { state, header } = sodium.crypto_secretstream_xchacha20poly1305_init_push(key);
+  const parts = [header];
+  for (let offset = 0; offset < data.length; offset += FILE_CHUNK_SIZE) {
+    const chunk = data.subarray(offset, offset + FILE_CHUNK_SIZE);
+    const isLast = offset + FILE_CHUNK_SIZE >= data.length;
+    const tag = isLast ? sodium.crypto_secretstream_xchacha20poly1305_TAG_FINAL : sodium.crypto_secretstream_xchacha20poly1305_TAG_MESSAGE;
+    parts.push(sodium.crypto_secretstream_xchacha20poly1305_push(state, chunk, null, tag));
+  }
+  return Buffer.concat(parts);
+}
+
+// src/api/messaging-ws.ts
+init_store();
 function buildTextPayload(text, fromHuid, chatId) {
   return JSON.stringify({
     type: "text",
@@ -27660,12 +27834,49 @@ function buildTextPayload(text, fromHuid, chatId) {
     body: text
   });
 }
+function buildImagePayload(params) {
+  return JSON.stringify({
+    type: "image",
+    msg_id: randomUUID4(),
+    from: params.fromHuid,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    group_chat_id: params.chatId,
+    lat: 0,
+    lng: 0,
+    stealth_forwarding: false,
+    payload: {
+      file: params.contentPath,
+      file_name: params.fileName,
+      file_size: params.fileSize,
+      file_hash: params.fileHash,
+      file_mime_type: params.mimeType,
+      chunk_size: FILE_CHUNK_SIZE,
+      file_encryption_algo: "stream",
+      file_preview: params.previewPath,
+      file_preview_width: params.previewWidth,
+      file_preview_height: params.previewHeight,
+      blur_preview_file: params.blurPreviewDataUri,
+      file_id: params.fileId
+    },
+    body: params.caption
+  });
+}
 function payloadAad(chatId, syncId) {
   return new Uint8Array(Buffer.from(`${chatId}:${syncId}`));
 }
+function wrapKeyForRecipients(symmetricKey, publicKeys, ctsKey) {
+  return publicKeys.map((kdcKey) => {
+    const recipientPubKey = new Uint8Array(Buffer.from(kdcKey.body, "base64"));
+    const nonce = randomBytes3(nacl4.box.nonceLength);
+    const ciphertext = nacl4.box(symmetricKey, nonce, recipientPubKey, ctsKey.privateKey);
+    if (!ciphertext) throw new Error(`Failed to encrypt key for ${kdcKey.id}`);
+    const combined = Buffer.concat([nonce, Buffer.from(ciphertext)]);
+    return { key_id: kdcKey.id, key: combined.toString("base64"), algo: "xsalsa20:xchacha20_aead_ietf" };
+  });
+}
 async function sendMessageViaWebSocket(params) {
   const { client, chatId, body, timeoutMs = 2e4 } = params;
-  await sodium.ready;
+  await sodium2.ready;
   const apigwKeys = loadApigwKeys();
   if (!apigwKeys) throw new Error("No apigw keys. Run 'express auth login' first.");
   const config = loadConfig();
@@ -27681,27 +27892,11 @@ async function sendMessageViaWebSocket(params) {
   const publicKeys = kdcKeys.filter((k) => k.kind === "cts");
   const symmetricKey = randomBytes3(32);
   const syncId = randomUUID4();
-  const encryptedKeys = publicKeys.map((kdcKey) => {
-    const recipientPubKey = new Uint8Array(Buffer.from(kdcKey.body, "base64"));
-    const nonce = randomBytes3(nacl4.box.nonceLength);
-    const ciphertext2 = nacl4.box(
-      symmetricKey,
-      nonce,
-      recipientPubKey,
-      ctsKey.privateKey
-    );
-    if (!ciphertext2) throw new Error(`Failed to encrypt key for ${kdcKey.id}`);
-    const combined = Buffer.concat([nonce, Buffer.from(ciphertext2)]);
-    return {
-      key_id: kdcKey.id,
-      key: combined.toString("base64"),
-      algo: "xsalsa20:xchacha20_aead_ietf"
-    };
-  });
+  const encryptedKeys = wrapKeyForRecipients(symmetricKey, publicKeys, ctsKey);
   const selfHuid = (await new UserApi(client).getSelfProfile()).user_huid;
   const plaintext = new Uint8Array(Buffer.from(buildTextPayload(body, selfHuid, chatId)));
-  const msgNonce = randomBytes3(sodium.crypto_aead_xchacha20poly1305_ietf_NPUBBYTES);
-  const ciphertext = sodium.crypto_aead_xchacha20poly1305_ietf_encrypt(
+  const msgNonce = randomBytes3(sodium2.crypto_aead_xchacha20poly1305_ietf_NPUBBYTES);
+  const ciphertext = sodium2.crypto_aead_xchacha20poly1305_ietf_encrypt(
     plaintext,
     payloadAad(chatId, syncId),
     null,
@@ -27732,6 +27927,114 @@ async function sendMessageViaWebSocket(params) {
     timeoutMs
   });
 }
+async function buildPreview(imageBytes) {
+  const data = await sharp(imageBytes).resize({ width: 300, height: 300, fit: "inside", withoutEnlargement: true }).jpeg({ quality: 90 }).toBuffer();
+  const blurData = data;
+  const { width, height } = await sharp(data).metadata();
+  return { data, width: width ?? 0, height: height ?? 0, blurData };
+}
+async function sendImageViaWebSocket(params) {
+  const { client, chatId, filePath, caption = "", timeoutMs = 3e4 } = params;
+  const fileName = basename(filePath);
+  const mimeType = detectImageMimeType(fileName);
+  if (!mimeType) {
+    throw new Error(
+      `Unsupported file type for '${fileName}'. Only images are currently supported: .png, .jpg, .jpeg, .gif, .webp`
+    );
+  }
+  await sodium2.ready;
+  const apigwKeys = loadApigwKeys();
+  if (!apigwKeys) throw new Error("No apigw keys. Run 'express auth login' first.");
+  const config = loadConfig();
+  const host = new URL(getBaseUrl(config)).hostname;
+  const webOrigin = getWebOrigin(config);
+  const ctsToken = getAuthToken();
+  const ctsKey = apigwKeys.ctsKey ?? apigwKeys.encryptionKey;
+  const encKeyId = ctsKey.keyId;
+  const participantKeyIds = await getChatKeyIds(host, webOrigin, ctsToken, encKeyId, chatId);
+  const kdcKeys = await client.get(
+    `/api/v1/kdc/keys/?ids=${participantKeyIds.join(",")}`
+  ) ?? [];
+  const publicKeys = kdcKeys.filter((k) => k.kind === "cts");
+  const originalBytes = await readFile(filePath);
+  const fileHash = createHash("sha256").update(originalBytes).digest("base64");
+  const preview = await buildPreview(originalBytes);
+  const blurPreviewDataUri = `data:image/jpeg;base64,${preview.blurData.toString("base64")}`;
+  const fileKey = randomBytes3(32);
+  const fileKeys = wrapKeyForRecipients(fileKey, publicKeys, ctsKey);
+  const syncId = randomUUID4();
+  const encryptedContent = await encryptFileStream(originalBytes, fileKey);
+  const encryptedPreview = await encryptFileStream(preview.data, fileKey);
+  const uploaded = await new FileServiceApi(client).uploadWithPreview(
+    {
+      subject: "groupchat_file",
+      subject_id: chatId,
+      visible: true,
+      file_name: fileName,
+      mime_type: mimeType,
+      meta: {
+        sync_id: syncId,
+        kind: "media",
+        chunk_size: FILE_CHUNK_SIZE,
+        file_encryption_algo: "stream",
+        sender_key_id: encKeyId,
+        keys: fileKeys,
+        file_hash: fileHash
+      }
+    },
+    encryptedContent,
+    { data: encryptedPreview, mimeType: "image/jpeg" }
+  );
+  const selfHuid = (await new UserApi(client).getSelfProfile()).user_huid;
+  const plaintext = new Uint8Array(Buffer.from(buildImagePayload({
+    fromHuid: selfHuid,
+    chatId,
+    caption,
+    fileName,
+    fileSize: originalBytes.length,
+    fileHash,
+    mimeType,
+    contentPath: uploaded.content,
+    previewPath: uploaded.content_shapes.preview ?? "",
+    previewWidth: preview.width,
+    previewHeight: preview.height,
+    blurPreviewDataUri,
+    fileId: uploaded.id
+  })));
+  const msgKey = randomBytes3(32);
+  const encryptedKeys = wrapKeyForRecipients(msgKey, publicKeys, ctsKey);
+  const msgNonce = randomBytes3(sodium2.crypto_aead_xchacha20poly1305_ietf_NPUBBYTES);
+  const ciphertext = sodium2.crypto_aead_xchacha20poly1305_ietf_encrypt(
+    plaintext,
+    payloadAad(chatId, syncId),
+    null,
+    new Uint8Array(msgNonce),
+    new Uint8Array(msgKey)
+  );
+  const encryptedPayload = Buffer.concat([msgNonce, Buffer.from(ciphertext)]).toString("base64");
+  const signingKey = apigwKeys.signingKey;
+  const signBytes = signEd25519(
+    signingKey.privateKey,
+    new Uint8Array(Buffer.from(encryptedPayload, "utf8"))
+  );
+  const signature = {
+    sign: Buffer.from(signBytes).toString("base64"),
+    sign_key_id: signingKey.keyId,
+    sign_algo: "ed25519"
+  };
+  return sendMessageNew({
+    host,
+    webOrigin,
+    ctsToken,
+    encKeyId,
+    chatId,
+    syncId,
+    encryptedKeys,
+    encryptedPayload,
+    signature,
+    timeoutMs
+  });
+}
 async function getChatKeyIds(host, webOrigin, ctsToken, encKeyId, chatId) {
   const wsUrl = `wss://${host}/socket/user/websocket?vsn=1.0.0&auto_join=true&key_id=${encKeyId}&version=6&background=false&voex_unencrypted=true&instance_id=${randomUUID4()}`;
   return new Promise((resolve, reject) => {
@@ -27875,18 +28178,31 @@ async function resolveChatId(client, chatIdOrName) {
   const chats = await listChatsWithNames(client);
   const lower = chatIdOrName.toLowerCase();
   const matches = chats.filter((c) => (c.name ?? "").toLowerCase().includes(lower));
-  if (matches.length === 0) throw new Error(`No chat found matching "${chatIdOrName}"`);
+  if (matches.length === 1) return matches[0].group_chat_id;
   if (matches.length > 1) {
     const names = matches.map((c) => `  ${c.name} (${c.group_chat_id})`).join("\n");
     throw new Error(`Multiple chats match "${chatIdOrName}":
 ${names}
 Use the full chat ID.`);
   }
-  return matches[0].group_chat_id;
+  const results = await new PhonebookApi(client).searchUsers(chatIdOrName, 5);
+  if (results.length === 0) throw new Error(`No chat or contact found matching "${chatIdOrName}"`);
+  if (results.length > 1) {
+    const names = results.map((p) => `  ${p.name} (${p.user_huid})`).join("\n");
+    throw new Error(`No existing DM with "${chatIdOrName}", found multiple contacts:
+${names}
+Be more specific.`);
+  }
+  const person = results[0];
+  process.stderr.write(`No DM with "${person.name}" \u2014 creating one...
+`);
+  const chatId = await new ChatsApi(client).createDm(person.user_huid);
+  process.stderr.write(`DM created: ${chatId}
+`);
+  return chatId;
 }
 
 // src/cli/send.ts
-import { readFileSync } from "fs";
 function createSendCommand() {
   const cmd = new Command8("send");
   cmd.description("Send messages and files");
@@ -27901,33 +28217,11 @@ function createSendCommand() {
       process.exit(1);
     }
   });
-  cmd.command("file <chat-id> <file-path>").description("Send a file to a chat").option("--caption <caption>", "File caption").option("--host <host>", "eXpress host").option("-o, --output <format>", "Output format", "json").action(async (chatId, filePath, opts) => {
+  cmd.command("file <chat-id-or-name> <file-path>").description("Send a file to a chat (chat ID or partial name). Currently images only: .png, .jpg, .jpeg, .gif, .webp").option("--caption <caption>", "File caption").option("--host <host>", "eXpress host").option("-o, --output <format>", "Output format", "json").action(async (chatIdOrName, filePath, opts) => {
     try {
-      const data = readFileSync(filePath);
-      const fileName = filePath.split("/").pop() ?? "file";
-      const mimeMap = {
-        ".png": "image/png",
-        ".jpg": "image/jpeg",
-        ".jpeg": "image/jpeg",
-        ".gif": "image/gif",
-        ".pdf": "application/pdf",
-        ".txt": "text/plain",
-        ".json": "application/json",
-        ".csv": "text/csv",
-        ".zip": "application/zip"
-      };
-      const ext = fileName.includes(".") ? "." + fileName.split(".").pop().toLowerCase() : "";
-      const mime = mimeMap[ext] ?? "application/octet-stream";
-      const base64 = data.toString("base64");
-      const dataUri = `data:${mime};base64,${base64}`;
       const client = new ApiClient(opts.host ? { host: opts.host } : void 0);
-      const api = new MessagingApi(client);
-      const result = await api.sendFile({
-        groupChatId: chatId,
-        fileName,
-        fileData: dataUri,
-        caption: opts.caption
-      });
+      const chatId = await resolveChatId(client, chatIdOrName);
+      const result = await sendImageViaWebSocket({ client, chatId, filePath, caption: opts.caption });
       console.log(formatOutput(result, opts.output));
     } catch (err) {
       console.error(`Error: ${err.message}`);
@@ -28048,11 +28342,12 @@ import { Command as Command11 } from "commander";
 init_esm_shims();
 import WebSocket3 from "ws";
 import { randomUUID as randomUUID5 } from "crypto";
+init_store();
 
 // src/api/decrypt.ts
 init_esm_shims();
 import nacl5 from "tweetnacl";
-import sodium2 from "libsodium-wrappers-sumo";
+import sodium3 from "libsodium-wrappers-sumo";
 function decryptMessage(msg, ctsPrivateKey, myKeyId, keyMap, apigwKeys) {
   const encKey = msg.key;
   if (encKey.key_id !== myKeyId) {
@@ -28066,10 +28361,10 @@ function decryptMessage(msg, ctsPrivateKey, myKeyId, keyMap, apigwKeys) {
   const symmetricKey = nacl5.box.open(ciphertext, nonce, senderPubKey, ctsPrivateKey);
   if (!symmetricKey) throw new Error("nacl.box.open failed \u2014 wrong key pair");
   const payloadRaw = Uint8Array.from(Buffer.from(msg.payload, "base64"));
-  const msgNonce = payloadRaw.slice(0, sodium2.crypto_aead_xchacha20poly1305_ietf_NPUBBYTES);
-  const msgCiphertext = payloadRaw.slice(sodium2.crypto_aead_xchacha20poly1305_ietf_NPUBBYTES);
+  const msgNonce = payloadRaw.slice(0, sodium3.crypto_aead_xchacha20poly1305_ietf_NPUBBYTES);
+  const msgCiphertext = payloadRaw.slice(sodium3.crypto_aead_xchacha20poly1305_ietf_NPUBBYTES);
   const aad = new Uint8Array(Buffer.from(`${msg.group_chat_id}:${msg.sync_id}`));
-  const plaintext = sodium2.crypto_aead_xchacha20poly1305_ietf_decrypt(null, msgCiphertext, aad, msgNonce, symmetricKey);
+  const plaintext = sodium3.crypto_aead_xchacha20poly1305_ietf_decrypt(null, msgCiphertext, aad, msgNonce, symmetricKey);
   return JSON.parse(new TextDecoder().decode(plaintext));
 }
 function toDecrypted(msg, payload) {
@@ -28100,7 +28395,7 @@ function getSenderPublicKey(msg, keyMap, apigwKeys) {
   return null;
 }
 async function decryptMessages(events, apigwKeys, client = new ApiClient()) {
-  await sodium2.ready;
+  await sodium3.ready;
   const ctsKey = apigwKeys.ctsKey ?? apigwKeys.encryptionKey;
   const messages = events.filter((e) => e.event_type === "message_new" && e.payload && e.key);
   if (messages.length === 0) return [];
@@ -28249,6 +28544,7 @@ init_esm_shims();
 import WebSocket4 from "ws";
 import { EventEmitter } from "events";
 import { randomUUID as randomUUID6 } from "crypto";
+init_store();
 var HEARTBEAT_MS = 25e3;
 var REQUEST_TIMEOUT_MS = 15e3;
 var MAX_RECONNECT_DELAY_MS = 3e4;
@@ -38447,9 +38743,23 @@ init_esm_shims();
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z as z2 } from "zod";
+import { writeFileSync as writeFileSync3, readFileSync as readFileSync2, unlinkSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+init_store();
+import qrcode2 from "qrcode-terminal";
+var AUTH_INSTRUCTION = "Run 'express-cli auth qr' (or 'npx @ih8e/express-cli auth qr') in a terminal to log in.";
 var ok = (data) => ({
   content: [{ type: "text", text: typeof data === "string" ? data : JSON.stringify(data, null, 2) }]
 });
+var notAuthenticated = () => ok({ error: "not_authenticated", instruction: AUTH_INSTRUCTION });
+async function ensureAuth() {
+  const exp = getTokenExpiresAt();
+  if (exp && Date.now() > exp - 5 * 60 * 1e3) {
+    await refreshToken();
+  }
+  return !!getAuthToken();
+}
 var Inbox = class {
   buf = [];
   seq = 0;
@@ -38535,6 +38845,7 @@ async function runMcpServer() {
     description: "List chats (DMs, groups, channels) with names and full chat IDs. DM names are resolved to the person's full name.",
     inputSchema: { type: z2.enum(["all", "dm", "group", "channel"]).optional().describe("Filter by chat type (default all)") }
   }, async ({ type }) => {
+    if (!await ensureAuth()) return notAuthenticated();
     const chats = await listChatsWithNames(new ApiClient());
     const kind = { dm: "chat", group: "group_chat", channel: "channel" };
     const filtered = !type || type === "all" ? chats : chats.filter((c) => c.chat_type === kind[type]);
@@ -38545,6 +38856,7 @@ async function runMcpServer() {
     description: "Find chats whose name (person or group) contains the query. Returns name + full chat_id to use with other tools.",
     inputSchema: { query: z2.string().describe("Part of the chat or person name") }
   }, async ({ query }) => {
+    if (!await ensureAuth()) return notAuthenticated();
     const chats = await listChatsWithNames(new ApiClient());
     const q = query.toLowerCase();
     return ok(chats.filter((c) => (c.name ?? "").toLowerCase().includes(q)).map((c) => ({ name: c.name, chat_id: c.group_chat_id, type: c.chat_type })));
@@ -38557,6 +38869,7 @@ async function runMcpServer() {
       limit: z2.number().int().min(1).max(200).optional().describe("How many recent messages (default 20)")
     }
   }, async ({ chat, limit }) => {
+    if (!await ensureAuth()) return notAuthenticated();
     const client = new ApiClient();
     const chatId = await resolveChatId(client, chat);
     const msgs = await readMessages({ chatId, limit: limit ?? 20 });
@@ -38568,9 +38881,10 @@ async function runMcpServer() {
   });
   server.registerTool("send_message", {
     title: "Send a message",
-    description: "Send a text message to a chat, identified by name (partial ok) or chat_id. Returns the sync_id.",
+    description: "Send a text message to a chat, identified by name (partial ok) or chat_id. If no DM exists with that person, one is created automatically. Returns the sync_id.",
     inputSchema: { chat: z2.string().describe("Chat name or full chat_id"), text: z2.string().describe("Message text") }
   }, async ({ chat, text }) => {
+    if (!await ensureAuth()) return notAuthenticated();
     const client = new ApiClient();
     const chatId = await resolveChatId(client, chat);
     const res = await sendMessageViaWebSocket({ client, chatId, body: text });
@@ -38581,6 +38895,7 @@ async function runMcpServer() {
     description: "Global company phonebook search across all employees by name.",
     inputSchema: { query: z2.string().describe("Name to search"), limit: z2.number().int().min(1).max(50).optional() }
   }, async ({ query, limit }) => {
+    if (!await ensureAuth()) return notAuthenticated();
     const profiles = await new PhonebookApi(new ApiClient()).searchUsers(query, limit ?? 20);
     return ok(profiles.map((p) => ({ name: p.name, huid: p.user_huid, email: p.email, position: p.company_position, department: p.department })));
   });
@@ -38588,26 +38903,123 @@ async function runMcpServer() {
     title: "My profile",
     description: "Get the authenticated user's own profile.",
     inputSchema: {}
-  }, async () => ok(await new UserApi(new ApiClient()).getSelfProfile()));
+  }, async () => {
+    if (!await ensureAuth()) return notAuthenticated();
+    return ok(await new UserApi(new ApiClient()).getSelfProfile());
+  });
   server.registerTool("wait_for_messages", {
     title: "Wait for incoming messages",
     description: "Block until new incoming messages arrive (from any chat/discussion), then return them. Returns messages received since the previous call to this tool; if none are pending, waits up to timeout_seconds. Your own sent messages are not included. Use this to react to new messages instead of polling.",
     inputSchema: { timeout_seconds: z2.number().int().min(1).max(120).optional().describe("Max seconds to wait when nothing is pending (default 30)") }
   }, async ({ timeout_seconds }) => {
-    if (!session) return ok({ error: "Session unavailable \u2014 run 'express auth qr' to authenticate." });
+    if (!session) return ok({ error: "Session unavailable.", instruction: AUTH_INSTRUCTION });
     const items = await inbox.take((timeout_seconds ?? 30) * 1e3);
     return ok({ connected: sessionReady, count: items.length, messages: await enrich(items) });
   });
   server.registerTool("status", {
     title: "Auth status",
-    description: "Check authentication and access-token status.",
+    description: "Check authentication and access-token status. Call this first if other tools return not_authenticated.",
     inputSchema: {}
   }, async () => {
     const exp = getTokenExpiresAt();
     return ok({
       authenticated: !!getAuthToken(),
-      token_expires_in_seconds: exp ? Math.max(0, Math.floor((exp - Date.now()) / 1e3)) : null
+      token_expires_in_seconds: exp ? Math.max(0, Math.floor((exp - Date.now()) / 1e3)) : null,
+      login_instruction: AUTH_INSTRUCTION
+    });
+  });
+  const QR_MATERIAL_FILE = join(tmpdir(), "express-qr-material.json");
+  let pendingQrMaterial = null;
+  let pendingQrPoll = null;
+  server.registerTool("auth_qr_start", {
+    title: "Start QR login \u2014 step 1 of 2",
+    description: "Step 1: generate a QR code for eXpress login. The QR code is included in the response \u2014 display it to the user as-is. After displaying the QR you MUST immediately call the MCP tool `auth_qr_poll` (step 2) \u2014 do NOT wait for the user to confirm scanning first; auth_qr_poll waits automatically. Do NOT run auth_qr_poll as a shell command \u2014 it is an MCP tool. Use when status reports not_authenticated.",
+    inputSchema: {}
+  }, async () => {
+    const material = buildQrMaterial();
+    let qrAscii = "";
+    qrcode2.generate(material.qrPayload, { small: true }, (qr) => {
+      qrAscii = qr;
+    });
+    writeFileSync3(join(tmpdir(), "express-qr.txt"), qrAscii, "utf8");
+    process.stderr.write("\n" + qrAscii + "\n");
+    openQrInBrowser(material.qrPayload, material.registrationId).catch(() => {
     });
+    const persistent = {
+      registrationId: material.registrationId,
+      encryptionKey: Buffer.from(material.encryptionKey).toString("base64"),
+      qrSigningKey: {
+        keyId: material.qrSigningKey.keyId,
+        privateKey: Buffer.from(material.qrSigningKey.privateKey).toString("base64"),
+        publicKey: Buffer.from(material.qrSigningKey.publicKey).toString("base64")
+      },
+      udid: material.udid,
+      qrPayload: material.qrPayload,
+      qrBody: material.qrBody
+    };
+    writeFileSync3(QR_MATERIAL_FILE, JSON.stringify(persistent), "utf8");
+    pendingQrMaterial = material;
+    pendingQrPoll = pollForQrScan(material).catch((err) => {
+      process.stderr.write(`[mcp] QR poll error: ${err.message}
+`);
+      pendingQrMaterial = null;
+      pendingQrPoll = null;
+      throw err;
+    });
+    return ok(
+      `${qrAscii.trim()}
+
+Scan with the eXpress mobile app.
+
+[AGENT: call auth_qr_poll immediately \u2014 do not wait for user input]`
+    );
+  });
+  server.registerTool("auth_qr_poll", {
+    title: "Complete QR login \u2014 step 2 of 2",
+    description: "Step 2: wait for the phone scan and complete QR login. Call this immediately after auth_qr_start \u2014 do NOT wait for user confirmation. Waits up to 90 s for the server handshake, then saves tokens and keys. IMPORTANT: call this as an MCP tool, not as a shell command.",
+    inputSchema: {}
+  }, async () => {
+    let material = pendingQrMaterial;
+    let poll = pendingQrPoll;
+    if (!material || !poll) {
+      let saved = null;
+      try {
+        saved = JSON.parse(readFileSync2(QR_MATERIAL_FILE, "utf8"));
+      } catch {
+      }
+      if (!saved) return ok("No pending QR session. Call auth_qr_start first.");
+      const sk = saved.qrSigningKey;
+      const hydrated = {
+        registrationId: saved.registrationId,
+        encryptionKey: Buffer.from(saved.encryptionKey, "base64"),
+        qrSigningKey: {
+          keyId: sk.keyId,
+          privateKey: Buffer.from(sk.privateKey, "base64"),
+          publicKey: Buffer.from(sk.publicKey, "base64")
+        },
+        udid: saved.udid,
+        qrPayload: saved.qrPayload,
+        qrBody: saved.qrBody,
+        config: (await Promise.resolve().then(() => (init_loader(), loader_exports))).loadConfig()
+      };
+      material = hydrated;
+      poll = pollForQrScan(material);
+    }
+    pendingQrMaterial = null;
+    pendingQrPoll = null;
+    try {
+      unlinkSync(QR_MATERIAL_FILE);
+    } catch {
+    }
+    try {
+      const pollResult = await poll;
+      await completeQrRegistration(material, pollResult, (msg) => {
+        process.stderr.write(msg + "\n");
+      });
+      return ok("Login successful. You are now authenticated.");
+    } catch (err) {
+      return ok(`Login failed: ${err.message}`);
+    }
   });
   await server.connect(new StdioServerTransport());
 }
@@ -38629,7 +39041,7 @@ function createMcpCommand() {
 // src/cli/root.ts
 function createRootCommand() {
   const program2 = new Command15();
-  program2.name("express-cli").description("CLI client for eXpress Chat").version("0.1.4");
+  program2.name("express-cli").description("CLI client for eXpress Chat").version("0.1.6");
   program2.addCommand(createAuthCommand());
   program2.addCommand(createApiCommand());
   program2.addCommand(createConfigCommand());