@leemour/max-cli 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Viacheslav Ptsarev
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,176 @@
+# max-cli
+
+Читать и писать в свой личный аккаунт [MAX Messenger](https://max.ru) из терминала или из
+скрипта — чаты, сообщения, контакты, — не открывая браузер.
+
+Сделано **в первую очередь для агентов и скриптов**: любой результат доступен как одно
+детерминированное значение JSON, у любого отказа есть код, на который можно ветвиться, а stdout
+никогда не несёт ничего, кроме данных. Та же дисциплина делает его приятным для человека: в
+терминале таблицы и цвет, и ничего не происходит само.
+
+```sh
+max session start          # один раз: токен уходит в ключницу
+max chats list --limit 5
+max messages list "Иван Петров"
+```
+
+> ⚠ **Версия `0.1.0` ещё не опубликована.** Под именем `@leemour/max-cli` на npm пока нет ничего.
+> Пока — [установка из исходников](docs/installation.md).
+
+## Что это даёт
+
+- **Один запуск — одна операция.** Соединиться, сделать, напечатать, отключиться. Ничего не висит
+  фоном, не держит сокет и не слушает события: команда, которая напечатала ответ и не вышла, — это
+  дефект, а не особенность.
+- **Чтение ничего не помечает прочитанным.** В протоколе «получить историю» и «отметить
+  прочитанным» — разные операции; вторая не отправляется никогда, и это проверяется тестом, а не
+  обещается в README.
+- **Токен не касается ни файла, ни истории оболочки.** Он спрашивается без эха или читается из
+  трубы и уходит в ключницу операционной системы. В схеме настроек нет поля, куда его можно было
+  бы положить.
+- **Отправка, которая не врёт об исходе.** Если ответ не пришёл, это `outcome_unknown`, а не
+  «ошибка» и не «отправлено»: сообщение могло уйти. Повтор возможен только с тем же `--cid`, и
+  MAX схлопывает дубль — это измерено на реальном аккаунте, а не предположено.
+- **Имя чата не угадывается.** Часть названия, подходящая к двум чатам, — это отказ со списком
+  кандидатов. Отправить не в тот разговор нельзя отменить.
+- **Диагностика, в которой нет содержимого.** `--verbose` показывает по строке на запрос,
+  `--record` кладёт их в каталог запуска на 30 дней. Операция, опкод, идентификаторы, байты,
+  длительности — да. Название чата, имя, текст, телефон, токен — никогда, ни обрезанными, ни
+  хэшем.
+- **По умолчанию не записывается ничего.** Мессенджер, который сам собирает каталог с историей
+  того, кого вы читали, — это чужая жизнь в чужом логе; запись включается флагом.
+- **Два рантайма, и это проверяется.** Node 22+ и Bun; под обоими в CI выполняется собранная
+  команда, а не только проверка типов.
+- **Мы выглядим как официальный клиент.** На проводе нет ни нашего имени, ни своего user-agent:
+  поля, которыми клиент представляется, копируют веб-клиент MAX.
+
+## Содержание
+
+- [Установка](#установка)
+- [Вход](#вход)
+- [Использование](#использование)
+- [Для скриптов и агентов](#для-скриптов-и-агентов)
+- [Документация](#документация)
+- [Разработка](#разработка)
+- [Лицензия](#лицензия)
+
+## Установка
+
+Пакет — **`@leemour/max-cli`**, команда, которую он ставит, — **`max`**. Имя без области занято
+чужим пакетом с 2018 года.
+
+Пока `0.1.0` не опубликован, ставится из исходников:
+
+```sh
+git clone git@github.com:leemour/max-cli.git
+cd max-cli && pnpm install && pnpm build && pnpm link --global
+max --version      # 0.1.0
+```
+
+Нужен **Node 22 или новее**, либо **Bun 1.3+**. Подробности, переменные окружения и то, куда
+ложатся файлы, — [docs/installation.md](docs/installation.md).
+
+## Вход
+
+Своего входа по номеру телефона пока нет: `max session start` импортирует токен, полученный в
+официальном клиенте, и кладёт его в ключницу.
+
+```sh
+max session start                      # спросит токен, не отображая ввод
+pass show max/token | max session start # или из трубы
+max account show                       # кто вы
+```
+
+Несколько аккаунтов — несколько профилей, и профиль называется **первым словом**, а не флагом:
+
+```sh
+max chats list              # профиль default
+max personal chats list     # профиль personal
+export MAX_PROFILE=personal # или на всю сессию оболочки
+```
+
+## Использование
+
+```sh
+max chats list --limit 5
+max contacts list
+max messages list 0 --limit 50        # по id чата
+max messages list "Иван Петров"       # или по части названия
+max messages send 0 "текст"
+```
+
+Что делала команда:
+
+```sh
+max chats list --verbose     # показать по строке на запрос, ничего не сохраняя
+max chats list --record      # сохранить, ничего не показывая
+max runs list                # что делалось, новое сверху
+max runs show <id>
+```
+
+Локальная копия — чтобы было чем ответить без сети:
+
+```sh
+max chats list --offline
+max cache clear
+```
+
+Полностью: [docs/usage.md](docs/usage.md). Каждая команда и каждая опция:
+[docs/commands.md](docs/commands.md) — эта страница собирается из самой программы, поэтому описать
+версию, которой не существует, она не может.
+
+## Для скриптов и агентов
+
+```sh
+max chats list --json
+```
+
+`--json` — это **ровно одно значение JSON на stdout и больше ничего**: ни спиннера, ни галочки, ни
+предупреждения. То же самое включается само, когда stdout не терминал. Ошибка уходит на stderr, а
+stdout остаётся пустым, поэтому отказ невозможно принять за результат:
+
+```json
+{"error":{"code":"authentication_error","message":"no session for profile \"default\" — run `max session start`"}}
+```
+
+Ветвиться надо по коду возврата: `4` — нет сессии, `6` — не найдено, `9` — таймаут, `14` — исход
+неизвестен, `130` — прервано. Вся таблица — в [docs/commands.md](docs/commands.md).
+
+## Документация
+
+| | |
+|---|---|
+| [docs/installation.md](docs/installation.md) | установка, обновление, куда что ложится |
+| [docs/usage.md](docs/usage.md) | вход, чтение, отправка, машинный режим |
+| [docs/sessions.md](docs/sessions.md) | токен, ключница, профили |
+| [docs/configuration.md](docs/configuration.md) | настройки, переменные, порядок разрешения |
+| [docs/diagnostics.md](docs/diagnostics.md) | `--verbose`, `--record`, `max runs` |
+| [docs/security.md](docs/security.md) | что пишется на диск, а что никогда |
+| [docs/troubleshooting.md](docs/troubleshooting.md) | по симптому: что делать, когда не работает |
+| [docs/commands.md](docs/commands.md) | каждая команда и опция — **генерируется** из программы |
+| [docs/protocol.md](docs/protocol.md) | каждый опкод и откуда известна его форма — **генерируется** |
+| [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) | как это устроено и какие швы нельзя пересекать |
+| [docs/DECISIONS.md](docs/DECISIONS.md) | что и почему решено — читать прежде, чем «чинить» странное |
+| [docs/BACKLOG.md](docs/BACKLOG.md) | что осталось |
+
+Оглавление целиком — [docs/README.md](docs/README.md).
+
+## Разработка
+
+```sh
+pnpm install
+pnpm lint && pnpm typecheck && pnpm test
+pnpm build && pnpm smoke:bun          # собранная команда под вторым рантаймом
+pnpm generate                         # переписать сгенерированные файлы
+```
+
+Протокол MAX неофициальный и разобран обратной инженерией: это не Bot API. Каждый опкод и форма
+каждого сообщения объявлены один раз в `src/spec/`, а реестр, типизированный клиент и
+[docs/protocol.md](docs/protocol.md) из них генерируются — и CI падает, если дерево устарело.
+
+Половина, не имеющая отношения к MAX — потоки вывода, рендерер, коды ошибок, ключница, часы, —
+вынесена в [`@leemour/cli-core`](https://github.com/leemour/cli-core) и общая с `braze-cli`.
+
+## Лицензия
+
+MIT — см. [LICENSE](LICENSE).

package/dist/bin/max.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=max.d.ts.map

package/dist/bin/max.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"max.d.ts","sourceRoot":"","sources":["../../src/bin/max.ts"],"names":[],"mappings":""}

package/dist/bin/max.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+import { run } from "../program.js";
+// `max chats --json | head` closes the pipe while we are still writing, and an unhandled EPIPE
+// makes Node print a stack trace over the output of the command that just worked. A reader that
+// stopped reading is not an error: leave quietly, as every other Unix tool does.
+for (const stream of [process.stdout, process.stderr]) {
+    stream.on("error", (error) => {
+        if (error.code === "EPIPE")
+            process.exit(0);
+        throw error;
+    });
+}
+process.exitCode = await run(process.argv.slice(2));
+//# sourceMappingURL=max.js.map

package/dist/bin/max.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"max.js","sourceRoot":"","sources":["../../src/bin/max.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAA;AAEnC,+FAA+F;AAC/F,gGAAgG;AAChG,iFAAiF;AACjF,KAAK,MAAM,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;IACtD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;QAClD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC3C,MAAM,KAAK,CAAA;IACb,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,OAAO,CAAC,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA"}

package/dist/cache/driver.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The seam the two runtimes meet at.
+ *
+ * `node:sqlite` and `bun:sqlite` are different modules with different names, so a static import of
+ * either one breaks the other runtime **at load time** — before any code runs and before anything
+ * can catch it. The database is therefore handed in, the way the keyring and the clock already are
+ * (`CONVENTIONS.md`: core takes its environment as arguments).
+ *
+ * The surface is deliberately tiny. Everything above it is ordinary SQL, so replacing the driver —
+ * or adding a third — is writing thirty lines, not learning an abstraction.
+ */
+/** What SQLite itself can hold. Not `any`: a value it cannot store must fail to compile. */
+export type SqlValue = string | number | bigint | null | Uint8Array;
+export interface CacheStatement {
+    /** For writes. `changes` is how the fetch lease decides who won. */
+    run(...parameters: SqlValue[]): {
+        changes: number;
+    };
+    get(...parameters: SqlValue[]): Record<string, unknown> | undefined;
+    all(...parameters: SqlValue[]): Record<string, unknown>[];
+}
+export interface CacheDatabase {
+    exec(sql: string): void;
+    prepare(sql: string): CacheStatement;
+    close(): void;
+}
+export type OpenDatabase = (path: string) => CacheDatabase;
+/**
+ * **Write-ahead mode, and a timeout rather than an instant failure.**
+ *
+ * Without the first, one writer freezes out every reader for the length of its write, and several
+ * `max` invocations at once is the normal case here rather than the exception. Without the second,
+ * a writer that finds the database busy fails immediately instead of waiting the moment out.
+ *
+ * `foreign_keys` is off by default in SQLite, which surprises everyone once.
+ */
+export declare const PRAGMAS = "\n  PRAGMA journal_mode = WAL;\n  PRAGMA busy_timeout = 5000;\n  PRAGMA foreign_keys = ON;\n";
+//# sourceMappingURL=driver.d.ts.map

package/dist/cache/driver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"driver.d.ts","sourceRoot":"","sources":["../../src/cache/driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,4FAA4F;AAC5F,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,UAAU,CAAA;AAEnE,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,GAAG,CAAC,GAAG,UAAU,EAAE,QAAQ,EAAE,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IACnD,GAAG,CAAC,GAAG,UAAU,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAA;IACnE,GAAG,CAAC,GAAG,UAAU,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;CAC1D;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAAA;IACpC,KAAK,IAAI,IAAI,CAAA;CACd;AAED,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,aAAa,CAAA;AAE1D;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,iGAInB,CAAA"}

package/dist/cache/driver.js

@@ -0,0 +1,26 @@
+/**
+ * The seam the two runtimes meet at.
+ *
+ * `node:sqlite` and `bun:sqlite` are different modules with different names, so a static import of
+ * either one breaks the other runtime **at load time** — before any code runs and before anything
+ * can catch it. The database is therefore handed in, the way the keyring and the clock already are
+ * (`CONVENTIONS.md`: core takes its environment as arguments).
+ *
+ * The surface is deliberately tiny. Everything above it is ordinary SQL, so replacing the driver —
+ * or adding a third — is writing thirty lines, not learning an abstraction.
+ */
+/**
+ * **Write-ahead mode, and a timeout rather than an instant failure.**
+ *
+ * Without the first, one writer freezes out every reader for the length of its write, and several
+ * `max` invocations at once is the normal case here rather than the exception. Without the second,
+ * a writer that finds the database busy fails immediately instead of waiting the moment out.
+ *
+ * `foreign_keys` is off by default in SQLite, which surprises everyone once.
+ */
+export const PRAGMAS = `
+  PRAGMA journal_mode = WAL;
+  PRAGMA busy_timeout = 5000;
+  PRAGMA foreign_keys = ON;
+`;
+//# sourceMappingURL=driver.js.map

package/dist/cache/driver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"driver.js","sourceRoot":"","sources":["../../src/cache/driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAoBH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG;;;;CAItB,CAAA"}

package/dist/cache/drivers/bun-sqlite.d.ts

@@ -0,0 +1,8 @@
+import type { CacheDatabase } from "../driver.js";
+/**
+ * The specifier is a variable on purpose: written inline, TypeScript tries to resolve `bun:sqlite`
+ * and fails, because Bun's types are not installed and would only be right for one of the two
+ * runtimes anyway. The import is reached only under Bun, so Node never evaluates it.
+ */
+export declare const openWithBunSqlite: (path: string) => Promise<CacheDatabase>;
+//# sourceMappingURL=bun-sqlite.d.ts.map

package/dist/cache/drivers/bun-sqlite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bun-sqlite.d.ts","sourceRoot":"","sources":["../../../src/cache/drivers/bun-sqlite.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,cAAc,CAAA;AAc3D;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAU,MAAM,MAAM,KAAG,OAAO,CAAC,aAAa,CAiB3E,CAAA"}

package/dist/cache/drivers/bun-sqlite.js

@@ -0,0 +1,23 @@
+/**
+ * The specifier is a variable on purpose: written inline, TypeScript tries to resolve `bun:sqlite`
+ * and fails, because Bun's types are not installed and would only be right for one of the two
+ * runtimes anyway. The import is reached only under Bun, so Node never evaluates it.
+ */
+export const openWithBunSqlite = async (path) => {
+    const specifier = "bun:sqlite";
+    const { Database } = (await import(specifier));
+    const database = new Database(path);
+    return {
+        exec: (sql) => database.exec(sql),
+        prepare: (sql) => {
+            const statement = database.query(sql);
+            return {
+                run: (...parameters) => ({ changes: Number(statement.run(...parameters).changes) }),
+                get: (...parameters) => statement.get(...parameters),
+                all: (...parameters) => statement.all(...parameters),
+            };
+        },
+        close: () => database.close(),
+    };
+};
+//# sourceMappingURL=bun-sqlite.js.map

package/dist/cache/drivers/bun-sqlite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bun-sqlite.js","sourceRoot":"","sources":["../../../src/cache/drivers/bun-sqlite.ts"],"names":[],"mappings":"AAcA;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,IAAY,EAA0B,EAAE;IAC9E,MAAM,SAAS,GAAG,YAAY,CAAA;IAC9B,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAoD,CAAA;IACjG,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAA;IAEnC,OAAO;QACL,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QACjC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACf,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACrC,OAAO;gBACL,GAAG,EAAE,CAAC,GAAG,UAAsB,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/F,GAAG,EAAE,CAAC,GAAG,UAAsB,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,UAAU,CAAwC;gBACvG,GAAG,EAAE,CAAC,GAAG,UAAsB,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,UAAU,CAA8B;aAC9F,CAAA;QACH,CAAC;QACD,KAAK,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE;KAC9B,CAAA;AACH,CAAC,CAAA"}

package/dist/cache/drivers/node-sqlite.d.ts

@@ -0,0 +1,8 @@
+import type { CacheDatabase } from "../driver.js";
+/**
+ * ⚠ On Node 22 the import itself prints `ExperimentalWarning: SQLite is an experimental feature`
+ * to stderr. Node 24 is silent. Left alone deliberately (`NEED-59`): suppressing warnings
+ * process-wide to hide one line costs more than it saves.
+ */
+export declare const openWithNodeSqlite: (path: string) => CacheDatabase;
+//# sourceMappingURL=node-sqlite.d.ts.map

package/dist/cache/drivers/node-sqlite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-sqlite.d.ts","sourceRoot":"","sources":["../../../src/cache/drivers/node-sqlite.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,cAAc,CAAA;AAE3D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,KAAG,aAejD,CAAA"}

package/dist/cache/drivers/node-sqlite.js

@@ -0,0 +1,22 @@
+import { DatabaseSync } from "node:sqlite";
+/**
+ * ⚠ On Node 22 the import itself prints `ExperimentalWarning: SQLite is an experimental feature`
+ * to stderr. Node 24 is silent. Left alone deliberately (`NEED-59`): suppressing warnings
+ * process-wide to hide one line costs more than it saves.
+ */
+export const openWithNodeSqlite = (path) => {
+    const database = new DatabaseSync(path);
+    return {
+        exec: (sql) => database.exec(sql),
+        prepare: (sql) => {
+            const statement = database.prepare(sql);
+            return {
+                run: (...parameters) => ({ changes: Number(statement.run(...parameters).changes) }),
+                get: (...parameters) => statement.get(...parameters),
+                all: (...parameters) => statement.all(...parameters),
+            };
+        },
+        close: () => database.close(),
+    };
+};
+//# sourceMappingURL=node-sqlite.js.map

package/dist/cache/drivers/node-sqlite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-sqlite.js","sourceRoot":"","sources":["../../../src/cache/drivers/node-sqlite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAG1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAAiB,EAAE;IAChE,MAAM,QAAQ,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAA;IAEvC,OAAO;QACL,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QACjC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACf,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACvC,OAAO;gBACL,GAAG,EAAE,CAAC,GAAG,UAAsB,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/F,GAAG,EAAE,CAAC,GAAG,UAAsB,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,UAAU,CAAwC;gBACvG,GAAG,EAAE,CAAC,GAAG,UAAsB,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,UAAU,CAA8B;aAC9F,CAAA;QACH,CAAC;QACD,KAAK,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE;KAC9B,CAAA;AACH,CAAC,CAAA"}

package/dist/cache/index.d.ts

@@ -0,0 +1,22 @@
+import { type CacheStore } from "./store.js";
+export type { CacheStore } from "./store.js";
+export interface ProfileCacheOptions {
+    env?: NodeJS.ProcessEnv;
+    /**
+     * Where a cache that could not be opened is reported.
+     *
+     * ⚠ **Silence here hid the feature being entirely off for a day.** The `catch` was deliberate —
+     * a cache must never fail the command it was meant to help — but swallowing the reason meant the
+     * directory never being created looked identical to everything working. Failing quietly is
+     * right; failing *invisibly* is not.
+     */
+    onProblem?: (message: string) => void;
+}
+/**
+ * Opens this profile's record, **or gives up without failing the command**.
+ *
+ * The file holds message text, so the directory is `0700` and the database `0600`. It lives under
+ * the cache directory rather than the state one: deleting it must lose nothing that was typed.
+ */
+export declare const openProfileCache: (profile: string, { env, onProblem }?: ProfileCacheOptions) => Promise<CacheStore | undefined>;
+//# sourceMappingURL=index.d.ts.map

package/dist/cache/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cache/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,UAAU,EAAa,MAAM,YAAY,CAAA;AAEvD,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,MAAM,WAAW,mBAAmB;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IACvB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CACtC;AAED;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAC3B,SAAS,MAAM,EACf,qBAAkC,mBAAwB,KACzD,OAAO,CAAC,UAAU,GAAG,SAAS,CAehC,CAAA"}

package/dist/cache/index.js

@@ -0,0 +1,33 @@
+import { chmodSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { resolvePaths } from "@leemour/cli-core";
+import { openCache } from "./open.js";
+import { openStore } from "./store.js";
+/**
+ * Opens this profile's record, **or gives up without failing the command**.
+ *
+ * The file holds message text, so the directory is `0700` and the database `0600`. It lives under
+ * the cache directory rather than the state one: deleting it must lose nothing that was typed.
+ */
+export const openProfileCache = async (profile, { env = process.env, onProblem } = {}) => {
+    const paths = resolvePaths({ appName: "max-cli", prefix: "MAX", env });
+    const file = join(paths.cache, `${profile}.db`);
+    try {
+        // SQLite will not create a file in a directory that does not exist, and on a fresh machine
+        // this one never does.
+        mkdirSync(paths.cache, { recursive: true, mode: 0o700 });
+        const store = openStore({ database: await openCache(file) });
+        chmodSync(file, 0o600);
+        return store;
+    }
+    catch (error) {
+        onProblem?.(`the local record is unavailable, so this ran against MAX: ${asReason(error)}`);
+        return undefined;
+    }
+};
+/** The reason, never the path — a profile name and a home directory are nobody else's business. */
+const asReason = (error) => {
+    const code = error?.code;
+    return typeof code === "string" ? code : error instanceof Error ? error.name : "an unknown problem";
+};
+//# sourceMappingURL=index.js.map

package/dist/cache/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cache/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAmB,SAAS,EAAE,MAAM,YAAY,CAAA;AAiBvD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,OAAe,EACf,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,SAAS,KAA0B,EAAE,EACzB,EAAE;IACnC,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IACtE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,OAAO,KAAK,CAAC,CAAA;IAE/C,IAAI,CAAC;QACH,2FAA2F;QAC3F,uBAAuB;QACvB,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACxD,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC5D,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,SAAS,EAAE,CAAC,6DAA6D,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAC3F,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AAED,mGAAmG;AACnG,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAU,EAAE;IAC1C,MAAM,IAAI,GAAI,KAA4B,EAAE,IAAI,CAAA;IAChD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAA;AACrG,CAAC,CAAA"}

package/dist/cache/open.d.ts

@@ -0,0 +1,14 @@
+import { type CacheDatabase } from "./driver.js";
+/**
+ * Opens the cache with whichever SQLite the runtime actually has.
+ *
+ * **Both imports are dynamic, and that is the whole point.** A static `import` of
+ * `node:sqlite` fails under Bun at load time, and one of `bun:sqlite` fails under Node the same
+ * way — before any code runs, so nothing can catch it and no test can reach it. Reaching the
+ * import only inside the branch that can satisfy it is what makes one build serve both runtimes.
+ *
+ * Measured 2026-09-19: `node:sqlite` exists on Node 22.23.2 and 24 and not in Bun; `bun:sqlite`
+ * is the reverse (`NEED-11`).
+ */
+export declare const openCache: (path: string) => Promise<CacheDatabase>;
+//# sourceMappingURL=open.d.ts.map

package/dist/cache/open.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"open.d.ts","sourceRoot":"","sources":["../../src/cache/open.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAW,MAAM,aAAa,CAAA;AAEzD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,SAAS,GAAU,MAAM,MAAM,KAAG,OAAO,CAAC,aAAa,CAInE,CAAA"}

package/dist/cache/open.js

@@ -0,0 +1,26 @@
+import { PRAGMAS } from "./driver.js";
+/**
+ * Opens the cache with whichever SQLite the runtime actually has.
+ *
+ * **Both imports are dynamic, and that is the whole point.** A static `import` of
+ * `node:sqlite` fails under Bun at load time, and one of `bun:sqlite` fails under Node the same
+ * way — before any code runs, so nothing can catch it and no test can reach it. Reaching the
+ * import only inside the branch that can satisfy it is what makes one build serve both runtimes.
+ *
+ * Measured 2026-09-19: `node:sqlite` exists on Node 22.23.2 and 24 and not in Bun; `bun:sqlite`
+ * is the reverse (`NEED-11`).
+ */
+export const openCache = async (path) => {
+    const database = "Bun" in globalThis ? await openUnderBun(path) : await openUnderNode(path);
+    database.exec(PRAGMAS);
+    return database;
+};
+const openUnderBun = async (path) => {
+    const { openWithBunSqlite } = await import("./drivers/bun-sqlite.js");
+    return await openWithBunSqlite(path);
+};
+const openUnderNode = async (path) => {
+    const { openWithNodeSqlite } = await import("./drivers/node-sqlite.js");
+    return openWithNodeSqlite(path);
+};
+//# sourceMappingURL=open.js.map

package/dist/cache/open.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open.js","sourceRoot":"","sources":["../../src/cache/open.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,OAAO,EAAE,MAAM,aAAa,CAAA;AAEzD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,IAAY,EAA0B,EAAE;IACtE,MAAM,QAAQ,GAAG,KAAK,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,CAAA;IAC3F,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACtB,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,KAAK,EAAE,IAAY,EAA0B,EAAE;IAClE,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAA;IACrE,OAAO,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAA;AACtC,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,KAAK,EAAE,IAAY,EAA0B,EAAE;IACnE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAA;IACvE,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAA;AACjC,CAAC,CAAA"}

package/dist/cache/schema.d.ts

@@ -0,0 +1,14 @@
+import type { CacheDatabase } from "./driver.js";
+/**
+ * **Raise this on every change to the statements below.** The second schema change is the one that
+ * corrupts somebody's file, because the first is always made while the only copy is your own.
+ */
+export declare const SCHEMA_VERSION = 1;
+/**
+ * Brings a file up to date, and **refuses a file from the future** rather than writing to it.
+ *
+ * A newer `max` may have added a column this one does not know about. Reading it is survivable;
+ * writing to it is how one version quietly destroys what another stored.
+ */
+export declare const migrate: (database: CacheDatabase) => void;
+//# sourceMappingURL=schema.d.ts.map

package/dist/cache/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/cache/schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEhD;;;GAGG;AACH,eAAO,MAAM,cAAc,IAAI,CAAA;AAiF/B;;;;;GAKG;AACH,eAAO,MAAM,OAAO,GAAI,UAAU,aAAa,KAAG,IAcjD,CAAA"}

package/dist/cache/schema.js

@@ -0,0 +1,95 @@
+/**
+ * **Raise this on every change to the statements below.** The second schema change is the one that
+ * corrupts somebody's file, because the first is always made while the only copy is your own.
+ */
+export const SCHEMA_VERSION = 1;
+/**
+ * Everything the cache holds, and the indexes are part of it rather than an afterthought — each
+ * one exists for a query that is actually made.
+ *
+ * **Times are epoch milliseconds**, the way MAX sends them: an integer sorts, compares and ranges
+ * correctly without a format to agree on. The domain model's ISO strings are built on the way out.
+ *
+ * Ids are text even though MAX sends numbers. They are 64-bit, they are identifiers rather than
+ * arithmetic, and `INTEGER` here would put the rounding this project already fixed back again.
+ */
+const STATEMENTS = [
+    `CREATE TABLE IF NOT EXISTS chats (
+     id                 TEXT PRIMARY KEY,
+     title              TEXT,
+     kind               TEXT NOT NULL,
+     unread_count       INTEGER,
+     last_message_at    INTEGER,
+     participants_count INTEGER,
+     generation         INTEGER NOT NULL DEFAULT 0,
+     fetched_at         INTEGER NOT NULL
+   )`,
+    `CREATE INDEX IF NOT EXISTS chats_by_recency ON chats (last_message_at DESC)`,
+    `CREATE TABLE IF NOT EXISTS contacts (
+     id          TEXT PRIMARY KEY,
+     name        TEXT,
+     username    TEXT,
+     description TEXT,
+     fetched_at  INTEGER NOT NULL
+   )`,
+    `CREATE TABLE IF NOT EXISTS messages (
+     chat_id     TEXT NOT NULL,
+     id          TEXT NOT NULL,
+     sender_id   TEXT,
+     sender_name TEXT,
+     time        INTEGER NOT NULL,
+     update_time INTEGER,
+     text        TEXT NOT NULL,
+     outgoing    INTEGER,
+     attachments TEXT NOT NULL,
+     fetched_at  INTEGER NOT NULL,
+     PRIMARY KEY (chat_id, id)
+   )`,
+    `CREATE INDEX IF NOT EXISTS messages_by_time ON messages (chat_id, time DESC)`,
+    `CREATE INDEX IF NOT EXISTS messages_by_update ON messages (chat_id, update_time)`,
+    /**
+     * The windows we claim to hold **completely**, which is what makes "absent means deleted" safe
+     * to believe. A message outside every range is a message we have never looked for; a message
+     * missing from inside one has been deleted.
+     */
+    `CREATE TABLE IF NOT EXISTS ranges (
+     chat_id   TEXT NOT NULL,
+     from_time INTEGER NOT NULL,
+     to_time   INTEGER NOT NULL,
+     PRIMARY KEY (chat_id, from_time)
+   )`,
+    `CREATE INDEX IF NOT EXISTS ranges_by_chat ON ranges (chat_id, from_time)`,
+    /**
+     * When a whole collection was last known to be complete. A `fetched_at` on each row cannot say
+     * this: it tells you when a chat was seen, never that the list of chats has no newcomer missing
+     * from it.
+     */
+    `CREATE TABLE IF NOT EXISTS fetched (
+     kind TEXT PRIMARY KEY,
+     at   INTEGER NOT NULL
+   )`,
+    `CREATE TABLE IF NOT EXISTS fetch_lease (
+     chat_id    TEXT NOT NULL,
+     anchor     TEXT NOT NULL,
+     holder     TEXT NOT NULL,
+     expires_at INTEGER NOT NULL,
+     PRIMARY KEY (chat_id, anchor)
+   )`,
+];
+/**
+ * Brings a file up to date, and **refuses a file from the future** rather than writing to it.
+ *
+ * A newer `max` may have added a column this one does not know about. Reading it is survivable;
+ * writing to it is how one version quietly destroys what another stored.
+ */
+export const migrate = (database) => {
+    const current = Number(database.prepare("PRAGMA user_version").get()?.user_version ?? 0);
+    if (current > SCHEMA_VERSION) {
+        throw new Error(`this cache was written by a newer max (schema ${current}, this one speaks ${SCHEMA_VERSION}) — ` +
+            "run `max cache clear`, or use the newer version");
+    }
+    for (const statement of STATEMENTS)
+        database.exec(statement);
+    database.exec(`PRAGMA user_version = ${SCHEMA_VERSION}`);
+};
+//# sourceMappingURL=schema.js.map

package/dist/cache/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/cache/schema.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAA;AAE/B;;;;;;;;;GASG;AACH,MAAM,UAAU,GAAG;IACjB;;;;;;;;;KASG;IACH,6EAA6E;IAE7E;;;;;;KAMG;IAEH;;;;;;;;;;;;KAYG;IACH,8EAA8E;IAC9E,kFAAkF;IAElF;;;;OAIG;IACH;;;;;KAKG;IACH,0EAA0E;IAE1E;;;;OAIG;IACH;;;KAGG;IAEH;;;;;;KAMG;CACJ,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,QAAuB,EAAQ,EAAE;IACvD,MAAM,OAAO,GAAG,MAAM,CACnB,QAAQ,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,GAAG,EAAgC,EAAE,YAAY,IAAI,CAAC,CAChG,CAAA;IAED,IAAI,OAAO,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,iDAAiD,OAAO,qBAAqB,cAAc,MAAM;YAC/F,iDAAiD,CACpD,CAAA;IACH,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,UAAU;QAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAC5D,QAAQ,CAAC,IAAI,CAAC,yBAAyB,cAAc,EAAE,CAAC,CAAA;AAC1D,CAAC,CAAA"}