@leemour/max-cli 0.1.0

package/dist/session/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/session/store.ts"],"names":[],"mappings":"AAGA,OAAO,EAAe,KAAK,YAAY,EAAmD,MAAM,mBAAmB,CAAA;AAEnH;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAA;IAChB,6FAA6F;IAC7F,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,oGAAoG;IACpG,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IACvB,OAAO,CAAC,EAAE,YAAY,CAAA;IACtB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAID,qBAAa,YAAY;;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;gBAIZ,EAAE,OAAmB,EAAE,GAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAE,mBAAwB;IAe9G,8DAA8D;IAC9D,SAAS,IAAI,MAAM,GAAG,SAAS;IAI/B,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI/B;;;;;;;OAOG;IACH,SAAS,IAAI,YAAY;IAezB,UAAU,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI;IAIrC,0FAA0F;IAC1F,MAAM,IAAI,OAAO;CAclB"}

package/dist/session/store.js

@@ -0,0 +1,80 @@
+import { randomUUID } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { Credentials, pathsAreOverridden, resolvePaths, writeSecurely } from "@leemour/cli-core";
+const APP = "max-cli";
+export class SessionStore {
+    profile;
+    #stateDir;
+    #credentials;
+    constructor({ profile = "default", env = process.env, keyring, configDir, stateDir } = {}) {
+        const paths = resolvePaths({ appName: APP, prefix: "MAX", env });
+        this.profile = profile;
+        this.#stateDir = stateDir ?? paths.state;
+        this.#credentials = new Credentials({
+            configDir: configDir ?? paths.config,
+            service: APP,
+            envVar: "MAX_TOKEN",
+            isolated: pathsAreOverridden({ appName: APP, prefix: "MAX", env }),
+            ...(keyring ? { keyring } : {}),
+            env,
+            warn: (message) => process.stderr.write(`${message}\n`),
+        });
+    }
+    /** `undefined` means nobody has logged in on this profile. */
+    readToken() {
+        return this.#credentials.read(this.profile)?.secret;
+    }
+    writeToken(token) {
+        this.#credentials.write(this.profile, token);
+    }
+    /**
+     * Reads the state, inventing a device identity the first time and keeping it thereafter.
+     *
+     * **A new identity is written out immediately, before it is used for anything.** Returning one
+     * without saving it looks harmless and is not: a login that fails, or simply a second call,
+     * would then present MAX with a different device every time — which is the "new device on every
+     * command" that §34 exists to prevent. Found by a test, not by a user.
+     */
+    readState() {
+        try {
+            const parsed = JSON.parse(readFileSync(this.#statePath(), "utf8"));
+            if (typeof parsed.deviceId === "string" && parsed.deviceId !== "") {
+                return { deviceId: parsed.deviceId, logins: parsed.logins ?? 0, ...pick(parsed) };
+            }
+        }
+        catch {
+            // No state yet, or a file we cannot read: either way the answer is a fresh identity.
+        }
+        const fresh = { deviceId: randomUUID(), logins: 0 };
+        this.writeState(fresh);
+        return fresh;
+    }
+    writeState(state) {
+        writeSecurely(this.#statePath(), `${JSON.stringify(state, null, 2)}\n`, 0o600);
+    }
+    /** Forgets everything about this profile. Returns whether there was a token to forget. */
+    forget() {
+        const had = this.readToken() !== undefined;
+        this.#credentials.remove(this.profile);
+        try {
+            writeSecurely(this.#statePath(), `${JSON.stringify({ deviceId: randomUUID(), logins: 0 }, null, 2)}\n`, 0o600);
+        }
+        catch {
+            // Nothing to reset.
+        }
+        return had;
+    }
+    #statePath() {
+        return join(this.#stateDir, "profiles", `${this.profile}.json`);
+    }
+}
+const pick = (state) => {
+    const extra = {};
+    if (typeof state.viewerId === "string")
+        extra.viewerId = state.viewerId;
+    if (typeof state.lastLoginAt === "string")
+        extra.lastLoginAt = state.lastLoginAt;
+    return extra;
+};
+//# sourceMappingURL=store.js.map

package/dist/session/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/session/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,WAAW,EAAqB,kBAAkB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AA4BnH,MAAM,GAAG,GAAG,SAAS,CAAA;AAErB,MAAM,OAAO,YAAY;IACd,OAAO,CAAQ;IACf,SAAS,CAAQ;IACjB,YAAY,CAAa;IAElC,YAAY,EAAE,OAAO,GAAG,SAAS,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAA0B,EAAE;QAC5G,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;QAChE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,SAAS,GAAG,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAA;QACxC,IAAI,CAAC,YAAY,GAAG,IAAI,WAAW,CAAC;YAClC,SAAS,EAAE,SAAS,IAAI,KAAK,CAAC,MAAM;YACpC,OAAO,EAAE,GAAG;YACZ,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,kBAAkB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;YAClE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,GAAG;YACH,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC;SACxD,CAAC,CAAA;IACJ,CAAC;IAED,8DAA8D;IAC9D,SAAS;QACP,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACrD,CAAC;IAED,UAAU,CAAC,KAAa;QACtB,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAC9C,CAAC;IAED;;;;;;;OAOG;IACH,SAAS;QACP,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC,CAA0B,CAAA;YAC3F,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;gBAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAA;YACnF,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qFAAqF;QACvF,CAAC;QAED,MAAM,KAAK,GAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAA;QACjE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,UAAU,CAAC,KAAmB;QAC5B,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAChF,CAAC;IAED,0FAA0F;IAC1F,MAAM;QACJ,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,SAAS,CAAA;QAC1C,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACtC,IAAI,CAAC;YACH,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAChH,CAAC;QAAC,MAAM,CAAC;YACP,oBAAoB;QACtB,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,OAAO,OAAO,CAAC,CAAA;IACjE,CAAC;CACF;AAED,MAAM,IAAI,GAAG,CAAC,KAA4B,EAAE,EAAE;IAC5C,MAAM,KAAK,GAA0B,EAAE,CAAA;IACvC,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAAE,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;IACvE,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QAAE,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAA;IAChF,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}

package/dist/spec/check.d.ts

@@ -0,0 +1,16 @@
+import type { Payload } from "../protocol/frame.js";
+import { type Operation } from "./define.js";
+/**
+ * Compares MAX's answer with what we declared, and **reports without deciding**.
+ *
+ * Checking is not enforcing. An unofficial protocol changes without telling anyone, so a response
+ * never fails a command, never changes an exit code and never alters what the caller gets back
+ * (`NEED-35`). Unknown fields are not mismatches at all — response shapes are loose, and a field
+ * MAX adds passes straight through.
+ *
+ * What is left is the case worth hearing about: a field we said we rely on stopped being what it
+ * was. The failure this prevents is the quiet one — `max chats` printing a column of blanks
+ * because something was renamed, and nobody learning why for a week.
+ */
+export declare const checkResponse: (operation: Operation, payload: Payload) => string | undefined;
+//# sourceMappingURL=check.d.ts.map

package/dist/spec/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/spec/check.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,aAAa,CAAA;AAEvD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,aAAa,GAAI,WAAW,SAAS,EAAE,SAAS,OAAO,KAAG,MAAM,GAAG,SAgB/E,CAAA"}

package/dist/spec/check.js

@@ -0,0 +1,44 @@
+import * as v from "valibot";
+import { fieldPath } from "./define.js";
+/**
+ * Compares MAX's answer with what we declared, and **reports without deciding**.
+ *
+ * Checking is not enforcing. An unofficial protocol changes without telling anyone, so a response
+ * never fails a command, never changes an exit code and never alters what the caller gets back
+ * (`NEED-35`). Unknown fields are not mismatches at all — response shapes are loose, and a field
+ * MAX adds passes straight through.
+ *
+ * What is left is the case worth hearing about: a field we said we rely on stopped being what it
+ * was. The failure this prevents is the quiet one — `max chats` printing a column of blanks
+ * because something was renamed, and nobody learning why for a week.
+ */
+export const checkResponse = (operation, payload) => {
+    try {
+        const result = v.safeParse(operation.response, payload);
+        if (result.success)
+            return undefined;
+        const shown = result.issues.slice(0, MOST);
+        const rest = result.issues.length - shown.length;
+        const detail = shown.map(describe).join("; ");
+        return `${operation.name}: MAX answered with something we did not expect — ${detail}${rest > 0 ? ` (and ${rest} more)` : ""}`;
+    }
+    catch {
+        // A diagnostic that breaks the command it was describing is worse than no diagnostic.
+        return undefined;
+    }
+};
+const MOST = 3;
+/**
+ * ⚠ **Built by hand, never from `issue.message`.** Valibot's own text quotes the value it saw —
+ * `Invalid type: Expected number but received "…"` — and the value may be somebody's message. Only
+ * the field path, the expected type and the *kind* of what arrived leave this function.
+ */
+const describe = (issue) => `${fieldPath(issue)} — expected ${issue.expected ?? "something else"}, got ${kindOf(issue.input)}`;
+const kindOf = (value) => {
+    if (value === null)
+        return "null";
+    if (Array.isArray(value))
+        return "a list";
+    return typeof value;
+};
+//# sourceMappingURL=check.js.map

package/dist/spec/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/spec/check.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAE5B,OAAO,EAAE,SAAS,EAAkB,MAAM,aAAa,CAAA;AAEvD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,SAAoB,EAAE,OAAgB,EAAsB,EAAE;IAC1F,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QACvD,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,SAAS,CAAA;QAEpC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;QAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;QAChD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAE7C,OAAO,GAAG,SAAS,CAAC,IAAI,qDAAqD,MAAM,GACjF,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,EACrC,EAAE,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,sFAAsF;QACtF,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AAED,MAAM,IAAI,GAAG,CAAC,CAAA;AAEd;;;;GAIG;AACH,MAAM,QAAQ,GAAG,CAAC,KAAoE,EAAU,EAAE,CAChG,GAAG,SAAS,CAAC,KAAK,CAAC,eAAe,KAAK,CAAC,QAAQ,IAAI,gBAAgB,SAAS,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAA;AAEpG,MAAM,MAAM,GAAG,CAAC,KAAc,EAAU,EAAE;IACxC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAA;IACjC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IACzC,OAAO,OAAO,KAAK,CAAA;AACrB,CAAC,CAAA"}

package/dist/spec/define.d.ts

@@ -0,0 +1,95 @@
+import * as v from "valibot";
+import type { Payload } from "../protocol/frame.js";
+/**
+ * How much we actually know about a shape.
+ *
+ * `REQUIREMENTS.md` §10 asks for four levels. There are five, because most of what this CLI sends
+ * is stronger than all four of them: we watched MAX answer it. A claim in a README, a line in
+ * somebody's source and a frame we captured are three different things, and flattening the third
+ * into "confirmed" loses the one distinction the field exists for.
+ *
+ * The case this has to express: opcode 36 is `CONTACT_LIST` in two clients and `GET_BLOCKED` in
+ * the documentation. "Two sources agree" and "one client does this" must not be the same value.
+ */
+export type Confidence = 
+/** We sent it and read the answer. The source says when. */
+"measured"
+/** Two or more independent implementations agree, and we have not run it. */
+ | "confirmed"
+/** One implementation does this. */
+ | "observed"
+/** Nobody states it; it follows from something next to it. */
+ | "inferred"
+/** Named here so that a gap is recorded rather than implied. */
+ | "unknown";
+export interface Provenance {
+    confidence: Confidence;
+    /** Where it came from: a file in another project, a document, or a dated measurement. */
+    sources: [string, ...string[]];
+    /** Anything a reader needs that the sources do not say. */
+    notes?: string;
+}
+export interface Operation<TRequest extends v.GenericSchema = v.GenericSchema, TResponse extends v.GenericSchema = v.GenericSchema> {
+    readonly kind: "operation";
+    /** Dotted and grouped by subject: `chats.list`, `messages.send`. The generator splits on the dot. */
+    readonly name: string;
+    /**
+     * MAX's own name for the number, as captured traffic and other clients spell it — `MSG_SEND`,
+     * not `MESSAGES_SEND`. Written out rather than derived from `name`, because the two vocabularies
+     * are not the same one: ours groups by subject, MAX's has to match what a frame is called
+     * everywhere else (`CONVENTIONS.md`, wire names below the adapter).
+     */
+    readonly constant: string;
+    readonly opcode: number;
+    /** Whether it may only be sent after LOGIN. */
+    readonly auth: boolean;
+    /** Strict: a request must not carry a field nobody has seen. */
+    readonly request: TRequest;
+    /** Loose: a response that gained a field must not break a command (§29). */
+    readonly response: TResponse;
+    readonly provenance: Provenance;
+}
+/**
+ * A number we know and will not send.
+ *
+ * Not a `callable: false` flag on an operation, because a reserved opcode has no request shape and
+ * half an empty operation invites somebody to fill it in. The generator gives these a registry
+ * entry and no method, which is what turns "never call an opcode because it is in the enum" from a
+ * rule somebody has to remember into a property of the generated code.
+ */
+export interface Reservation {
+    readonly kind: "reservation";
+    readonly name: string;
+    readonly constant: string;
+    readonly opcode: number;
+    /** Why it is known and still never sent. This is the whole value of the entry. */
+    readonly reason: string;
+    readonly provenance: Provenance;
+}
+export type Entry = Operation | Reservation;
+export declare const defineOperation: <TRequest extends v.GenericSchema, TResponse extends v.GenericSchema>(operation: Omit<Operation<TRequest, TResponse>, "kind">) => Operation<TRequest, TResponse>;
+export declare const reserveOpcode: (reservation: Omit<Reservation, "kind">) => Reservation;
+/** What a caller passes: a domain string for an id, not a `bigint`. */
+export type RequestOf<TOperation extends Operation> = v.InferInput<TOperation["request"]>;
+/** What goes on the wire once the schema has encoded it. */
+export type WireRequestOf<TOperation extends Operation> = v.InferOutput<TOperation["request"]>;
+export type ResponseOf<TOperation extends Operation> = v.InferOutput<TOperation["response"]>;
+/**
+ * Checks and encodes in one step, so a conversion cannot be forgotten in a second place.
+ *
+ * A refusal here is ours, before anything reaches the socket. **The message names the field and
+ * never the value** — a request carries message text, and a validation error is not a place for
+ * it to appear.
+ */
+export declare const buildRequest: <TOperation extends Operation>(operation: TOperation, input: RequestOf<TOperation>) => Payload;
+/**
+ * The dotted path of the field an issue is about, and nothing else.
+ *
+ * ⚠ **Never `issue.message` and never `issue.received`.** Valibot's own text quotes the value it
+ * saw — `Invalid type: Expected number but received "…"` — so printing it puts a message body on
+ * the screen and into any log that collects the stream (`REQUIREMENTS.md` §14, §24).
+ */
+export declare const fieldPath: (issue: {
+    path?: unknown;
+}) => string;
+//# sourceMappingURL=define.d.ts.map

package/dist/spec/define.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"define.d.ts","sourceRoot":"","sources":["../../src/spec/define.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAC5B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAEnD;;;;;;;;;;GAUG;AACH,MAAM,MAAM,UAAU;AACpB,4DAA4D;AAC1D,UAAU;AACZ,6EAA6E;GAC3E,WAAW;AACb,oCAAoC;GAClC,UAAU;AACZ,8DAA8D;GAC5D,UAAU;AACZ,gEAAgE;GAC9D,SAAS,CAAA;AAEb,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,UAAU,CAAA;IACtB,yFAAyF;IACzF,OAAO,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAA;IAC9B,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,SAAS,CACxB,QAAQ,SAAS,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,aAAa,EAClD,SAAS,SAAS,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,aAAa;IAEnD,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,qGAAqG;IACrG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,gEAAgE;IAChE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAA;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAA;IAC5B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;CAChC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;CAChC;AAED,MAAM,MAAM,KAAK,GAAG,SAAS,GAAG,WAAW,CAAA;AAE3C,eAAO,MAAM,eAAe,GAAI,QAAQ,SAAS,CAAC,CAAC,aAAa,EAAE,SAAS,SAAS,CAAC,CAAC,aAAa,EACjG,WAAW,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,KACtD,SAAS,CAAC,QAAQ,EAAE,SAAS,CAA0C,CAAA;AAE1E,eAAO,MAAM,aAAa,GAAI,aAAa,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,KAAG,WAGrE,CAAA;AAEF,uEAAuE;AACvE,MAAM,MAAM,SAAS,CAAC,UAAU,SAAS,SAAS,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;AAEzF,4DAA4D;AAC5D,MAAM,MAAM,aAAa,CAAC,UAAU,SAAS,SAAS,IAAI,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;AAE9F,MAAM,MAAM,UAAU,CAAC,UAAU,SAAS,SAAS,IAAI,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAA;AAE5F;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,GAAI,UAAU,SAAS,SAAS,EACvD,WAAW,UAAU,EACrB,OAAO,SAAS,CAAC,UAAU,CAAC,KAC3B,OAMF,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,GAAI,OAAO;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,KAAG,MAIrD,CAAA"}

package/dist/spec/define.js

@@ -0,0 +1,34 @@
+import { CliError } from "@leemour/cli-core";
+import * as v from "valibot";
+export const defineOperation = (operation) => ({ kind: "operation", ...operation });
+export const reserveOpcode = (reservation) => ({
+    kind: "reservation",
+    ...reservation,
+});
+/**
+ * Checks and encodes in one step, so a conversion cannot be forgotten in a second place.
+ *
+ * A refusal here is ours, before anything reaches the socket. **The message names the field and
+ * never the value** — a request carries message text, and a validation error is not a place for
+ * it to appear.
+ */
+export const buildRequest = (operation, input) => {
+    const result = v.safeParse(operation.request, input);
+    if (result.success)
+        return result.output;
+    const fields = result.issues.map((issue) => fieldPath(issue)).join(", ");
+    throw new CliError("validation_error", `${operation.name}: cannot send this request — ${fields}`);
+};
+/**
+ * The dotted path of the field an issue is about, and nothing else.
+ *
+ * ⚠ **Never `issue.message` and never `issue.received`.** Valibot's own text quotes the value it
+ * saw — `Invalid type: Expected number but received "…"` — so printing it puts a message body on
+ * the screen and into any log that collects the stream (`REQUIREMENTS.md` §14, §24).
+ */
+export const fieldPath = (issue) => {
+    const path = Array.isArray(issue.path) ? issue.path : [];
+    const segments = path.map((step) => String(step?.key ?? "?"));
+    return segments.length > 0 ? segments.join(".") : "(the payload itself)";
+};
+//# sourceMappingURL=define.js.map

package/dist/spec/define.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"define.js","sourceRoot":"","sources":["../../src/spec/define.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC5C,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AA8E5B,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,SAAuD,EACvB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,SAAS,EAAE,CAAC,CAAA;AAE1E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,WAAsC,EAAe,EAAE,CAAC,CAAC;IACrF,IAAI,EAAE,aAAa;IACnB,GAAG,WAAW;CACf,CAAC,CAAA;AAUF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,SAAqB,EACrB,KAA4B,EACnB,EAAE;IACX,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACpD,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,MAAiB,CAAA;IAEnD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACxE,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,GAAG,SAAS,CAAC,IAAI,gCAAgC,MAAM,EAAE,CAAC,CAAA;AACnG,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAyB,EAAU,EAAE;IAC7D,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAuB,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,CAAA;IAChF,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAA;AAC1E,CAAC,CAAA"}

package/dist/spec/identity.d.ts

@@ -0,0 +1,23 @@
+/**
+ * What we claim to be on the wire.
+ *
+ * **We imitate MAX's own web client rather than announcing ourselves** (`REQUIREMENTS.md` §34), so
+ * none of these values names this tool. Shape and field names from `max-api-docs/protocol/auth.md`,
+ * cross-checked against tsmax's `createWebAgent`.
+ *
+ * The device identity is deliberately not here: it is generated once per profile and stored,
+ * because a client presenting a new device on every command is not imitating anything.
+ */
+export declare const WEB_USER_AGENT: {
+    readonly deviceType: "WEB";
+    readonly pushDeviceType: "WEBPUSH";
+    readonly locale: "ru";
+    readonly deviceLocale: "ru";
+    readonly osVersion: "Linux";
+    readonly deviceName: "Chrome";
+    readonly headerUserAgent: "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36";
+    readonly appVersion: "26.5.5";
+    readonly screen: "1080x1920 1.0x";
+    readonly timezone: "Europe/Madrid";
+};
+//# sourceMappingURL=identity.d.ts.map

package/dist/spec/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/spec/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;CAYjB,CAAA"}

package/dist/spec/identity.js

@@ -0,0 +1,23 @@
+/**
+ * What we claim to be on the wire.
+ *
+ * **We imitate MAX's own web client rather than announcing ourselves** (`REQUIREMENTS.md` §34), so
+ * none of these values names this tool. Shape and field names from `max-api-docs/protocol/auth.md`,
+ * cross-checked against tsmax's `createWebAgent`.
+ *
+ * The device identity is deliberately not here: it is generated once per profile and stored,
+ * because a client presenting a new device on every command is not imitating anything.
+ */
+export const WEB_USER_AGENT = {
+    deviceType: "WEB",
+    pushDeviceType: "WEBPUSH",
+    locale: "ru",
+    deviceLocale: "ru",
+    osVersion: "Linux",
+    deviceName: "Chrome",
+    headerUserAgent: "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36",
+    appVersion: "26.5.5",
+    screen: "1080x1920 1.0x",
+    timezone: "Europe/Madrid",
+};
+//# sourceMappingURL=identity.js.map

package/dist/spec/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/spec/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,UAAU,EAAE,KAAK;IACjB,cAAc,EAAE,SAAS;IACzB,MAAM,EAAE,IAAI;IACZ,YAAY,EAAE,IAAI;IAClB,SAAS,EAAE,OAAO;IAClB,UAAU,EAAE,QAAQ;IACpB,eAAe,EACb,uGAAuG;IACzG,UAAU,EAAE,QAAQ;IACpB,MAAM,EAAE,gBAAgB;IACxB,QAAQ,EAAE,eAAe;CACjB,CAAA"}

package/dist/spec/index.d.ts

@@ -0,0 +1,15 @@
+import type { Entry, Operation, Reservation } from "./define.js";
+export { checkResponse } from "./check.js";
+export * from "./define.js";
+export * from "./scalars.js";
+/**
+ * Every opcode this project knows, whether or not it is ever sent.
+ *
+ * **The order is the order it is read in**, and the generator preserves it: the registry, the
+ * reference table and the coverage list all come out grouped the same way, which is what makes a
+ * regenerated file a small diff instead of a reshuffle.
+ */
+export declare const spec: readonly Entry[];
+export declare const operations: readonly Operation[];
+export declare const reservations: readonly Reservation[];
+//# sourceMappingURL=index.d.ts.map

package/dist/spec/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/spec/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAMhE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAE5B;;;;;;GAMG;AACH,eAAO,MAAM,IAAI,EAAE,SAAS,KAAK,EAYhC,CAAA;AAED,eAAO,MAAM,UAAU,EAAE,SAAS,SAAS,EAA2E,CAAA;AAEtH,eAAO,MAAM,YAAY,EAAE,SAAS,WAAW,EAE9C,CAAA"}

package/dist/spec/index.js

@@ -0,0 +1,30 @@
+import { chatMark, chatsHistory, chatsList } from "./operations/chats.js";
+import { contactsInfo, profile, unidentified36 } from "./operations/contacts.js";
+import { messageDelete, messagesSend } from "./operations/messages.js";
+import { logout, sessionInit, sessionLogin } from "./operations/session.js";
+export { checkResponse } from "./check.js";
+export * from "./define.js";
+export * from "./scalars.js";
+/**
+ * Every opcode this project knows, whether or not it is ever sent.
+ *
+ * **The order is the order it is read in**, and the generator preserves it: the registry, the
+ * reference table and the coverage list all come out grouped the same way, which is what makes a
+ * regenerated file a small diff instead of a reshuffle.
+ */
+export const spec = [
+    sessionInit,
+    sessionLogin,
+    logout,
+    contactsInfo,
+    profile,
+    unidentified36,
+    chatsHistory,
+    chatMark,
+    chatsList,
+    messagesSend,
+    messageDelete,
+];
+export const operations = spec.filter((entry) => entry.kind === "operation");
+export const reservations = spec.filter((entry) => entry.kind === "reservation");
+//# sourceMappingURL=index.js.map

package/dist/spec/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/spec/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACzE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAChF,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACtE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAE3E,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAE5B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,IAAI,GAAqB;IACpC,WAAW;IACX,YAAY;IACZ,MAAM;IACN,YAAY;IACZ,OAAO;IACP,cAAc;IACd,YAAY;IACZ,QAAQ;IACR,SAAS;IACT,YAAY;IACZ,aAAa;CACd,CAAA;AAED,MAAM,CAAC,MAAM,UAAU,GAAyB,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAsB,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,CAAA;AAEtH,MAAM,CAAC,MAAM,YAAY,GAA2B,IAAI,CAAC,MAAM,CAC7D,CAAC,KAAK,EAAwB,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,CAC9D,CAAA"}

package/dist/spec/operations/chats.d.ts

@@ -0,0 +1,25 @@
+import * as v from "valibot";
+export declare const chatsList: import("../define.js").Operation<v.StrictObjectSchema<{
+    /** A cursor, not a count: MAX pages from a point in time. */
+    readonly marker: v.NumberSchema<undefined>;
+    readonly count: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
+}, undefined>, v.LooseObjectSchema<{
+    readonly chats: v.OptionalSchema<v.ArraySchema<v.LooseObjectSchema<{}, undefined>, undefined>, undefined>;
+}, undefined>>;
+export declare const chatsHistory: import("../define.js").Operation<v.StrictObjectSchema<{
+    readonly chatId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, "an id is a whole number written as a string">, v.TransformAction<string, bigint>]>;
+    readonly from: v.NumberSchema<undefined>;
+    readonly forward: v.NumberSchema<undefined>;
+    readonly backward: v.NumberSchema<undefined>;
+    readonly forwardTime: v.NumberSchema<undefined>;
+    readonly backwardTime: v.NumberSchema<undefined>;
+    readonly itemType: v.LiteralSchema<"REGULAR", undefined>;
+    readonly getChat: v.BooleanSchema<undefined>;
+    readonly getMessages: v.BooleanSchema<undefined>;
+    /** False for the same reason as on login: a script reading is not a person looking. */
+    readonly interactive: v.LiteralSchema<false, undefined>;
+}, undefined>, v.LooseObjectSchema<{
+    readonly messages: v.OptionalSchema<v.ArraySchema<v.LooseObjectSchema<{}, undefined>, undefined>, undefined>;
+}, undefined>>;
+export declare const chatMark: import("../define.js").Reservation;
+//# sourceMappingURL=chats.d.ts.map

package/dist/spec/operations/chats.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chats.d.ts","sourceRoot":"","sources":["../../../src/spec/operations/chats.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAI5B,eAAO,MAAM,SAAS;IAMlB,6DAA6D;;;;;cAU/D,CAAA;AAEF,eAAO,MAAM,YAAY;;;;;;;;;;IAerB,uFAAuF;;;;cAKzF,CAAA;AAEF,eAAO,MAAM,QAAQ,oCAOnB,CAAA"}

package/dist/spec/operations/chats.js

@@ -0,0 +1,49 @@
+import * as v from "valibot";
+import { defineOperation, reserveOpcode } from "../define.js";
+import { id } from "../scalars.js";
+export const chatsList = defineOperation({
+    name: "chats.list",
+    constant: "CHATS_LIST",
+    opcode: 53,
+    auth: true,
+    request: v.strictObject({
+        /** A cursor, not a count: MAX pages from a point in time. */
+        marker: v.number(),
+        count: v.optional(v.pipe(v.number(), v.integer(), v.minValue(1))),
+    }),
+    response: v.looseObject({ chats: v.optional(v.array(v.looseObject({}))) }),
+    provenance: {
+        confidence: "measured",
+        sources: ["measured against MAX 2026-09-19", "max-api-docs/protocol/chats.md"],
+        notes: "The documentation describes `count`; tsmax sends only `marker`. Optional here for that reason.",
+    },
+});
+export const chatsHistory = defineOperation({
+    name: "chats.history",
+    constant: "CHAT_HISTORY",
+    opcode: 49,
+    auth: true,
+    request: v.strictObject({
+        chatId: id(),
+        from: v.number(),
+        forward: v.number(),
+        backward: v.number(),
+        forwardTime: v.number(),
+        backwardTime: v.number(),
+        itemType: v.literal("REGULAR"),
+        getChat: v.boolean(),
+        getMessages: v.boolean(),
+        /** False for the same reason as on login: a script reading is not a person looking. */
+        interactive: v.literal(false),
+    }),
+    response: v.looseObject({ messages: v.optional(v.array(v.looseObject({}))) }),
+    provenance: { confidence: "measured", sources: ["measured against MAX 2026-09-19"] },
+});
+export const chatMark = reserveOpcode({
+    name: "chats.mark",
+    constant: "CHAT_MARK",
+    opcode: 50,
+    reason: "Reading is observational by construction. Marking a conversation read is a change to somebody's account that no read command asked for, so 50 is declared here and never sent — and `src/client.test.ts` asserts its absence from everything the client sent.",
+    provenance: { confidence: "confirmed", sources: ["tsmax", "max-api-docs/protocol/chats.md"] },
+});
+//# sourceMappingURL=chats.js.map

package/dist/spec/operations/chats.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chats.js","sourceRoot":"","sources":["../../../src/spec/operations/chats.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAC5B,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,EAAE,EAAE,MAAM,eAAe,CAAA;AAElC,MAAM,CAAC,MAAM,SAAS,GAAG,eAAe,CAAC;IACvC,IAAI,EAAE,YAAY;IAClB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,EAAE;IACV,IAAI,EAAE,IAAI;IACV,OAAO,EAAE,CAAC,CAAC,YAAY,CAAC;QACtB,6DAA6D;QAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;KAClE,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,UAAU,EAAE;QACV,UAAU,EAAE,UAAU;QACtB,OAAO,EAAE,CAAC,iCAAiC,EAAE,gCAAgC,CAAC;QAC9E,KAAK,EAAE,gGAAgG;KACxG;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,eAAe,CAAC;IAC1C,IAAI,EAAE,eAAe;IACrB,QAAQ,EAAE,cAAc;IACxB,MAAM,EAAE,EAAE;IACV,IAAI,EAAE,IAAI;IACV,OAAO,EAAE,CAAC,CAAC,YAAY,CAAC;QACtB,MAAM,EAAE,EAAE,EAAE;QACZ,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACxB,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC9B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;QACxB,uFAAuF;QACvF,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;KAC9B,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,UAAU,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,iCAAiC,CAAC,EAAE;CACrF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG,aAAa,CAAC;IACpC,IAAI,EAAE,YAAY;IAClB,QAAQ,EAAE,WAAW;IACrB,MAAM,EAAE,EAAE;IACV,MAAM,EACJ,+PAA+P;IACjQ,UAAU,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,gCAAgC,CAAC,EAAE;CAC9F,CAAC,CAAA"}

package/dist/spec/operations/contacts.d.ts

@@ -0,0 +1,9 @@
+import * as v from "valibot";
+export declare const contactsInfo: import("../define.js").Operation<v.StrictObjectSchema<{
+    readonly contactIds: v.ArraySchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, "an id is a whole number written as a string">, v.TransformAction<string, bigint>]>, undefined>;
+}, undefined>, v.LooseObjectSchema<{
+    readonly contacts: v.OptionalSchema<v.ArraySchema<v.LooseObjectSchema<{}, undefined>, undefined>, undefined>;
+}, undefined>>;
+export declare const profile: import("../define.js").Reservation;
+export declare const unidentified36: import("../define.js").Reservation;
+//# sourceMappingURL=contacts.d.ts.map

package/dist/spec/operations/contacts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contacts.d.ts","sourceRoot":"","sources":["../../../src/spec/operations/contacts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAI5B,eAAO,MAAM,YAAY;;;;cAYvB,CAAA;AAEF,eAAO,MAAM,OAAO,oCAOlB,CAAA;AAEF,eAAO,MAAM,cAAc,oCAgBzB,CAAA"}

package/dist/spec/operations/contacts.js

@@ -0,0 +1,39 @@
+import * as v from "valibot";
+import { defineOperation, reserveOpcode } from "../define.js";
+import { id } from "../scalars.js";
+export const contactsInfo = defineOperation({
+    name: "contacts.info",
+    constant: "CONTACT_INFO",
+    opcode: 32,
+    auth: true,
+    request: v.strictObject({ contactIds: v.array(id()) }),
+    response: v.looseObject({ contacts: v.optional(v.array(v.looseObject({}))) }),
+    provenance: {
+        confidence: "measured",
+        sources: ["measured against MAX 2026-09-19: asked for ten, got ten"],
+        notes: "One request for every unknown id at once. A person with forty dialogs should not cost forty round trips.",
+    },
+});
+export const profile = reserveOpcode({
+    name: "account.update",
+    constant: "PROFILE",
+    opcode: 16,
+    reason: "It does not read a profile, it updates one, and it refuses an empty payload. Your own profile arrives with the login response, so nothing needs to send this. It is declared here so that fact keeps a home.",
+    provenance: { confidence: "measured", sources: ["measured against MAX 2026-09-19: refused an empty payload"] },
+});
+export const unidentified36 = reserveOpcode({
+    name: "protocol.unidentified36",
+    constant: "UNIDENTIFIED_36",
+    opcode: 36,
+    reason: "Nobody agrees what it is: tsmax and PyMax call it `CONTACT_LIST`; the protocol documentation calls it `GET_BLOCKED`. Sent once with the owner's permission on 2026-09-20 and it exists — but it refuses every payload we can guess, and one guess closed the connection. It stays unsent until somebody watches a real client send it (`PROTO-1`).",
+    provenance: {
+        confidence: "unknown",
+        sources: [
+            "tsmax and PyMax call it CONTACT_LIST",
+            "max-api-docs calls it GET_BLOCKED",
+            "measured against MAX 2026-09-20: `{}` and `{marker}` are refused with `proto.payload`, `{marker, count}` closes the connection",
+        ],
+        notes: "The refusal names the payload rather than the opcode, so 36 is real and validates its arguments — we simply do not know its shape. Guessing cost a dropped connection, which is why the ladder stopped at three.",
+    },
+});
+//# sourceMappingURL=contacts.js.map

package/dist/spec/operations/contacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contacts.js","sourceRoot":"","sources":["../../../src/spec/operations/contacts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAC5B,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,EAAE,EAAE,MAAM,eAAe,CAAA;AAElC,MAAM,CAAC,MAAM,YAAY,GAAG,eAAe,CAAC;IAC1C,IAAI,EAAE,eAAe;IACrB,QAAQ,EAAE,cAAc;IACxB,MAAM,EAAE,EAAE;IACV,IAAI,EAAE,IAAI;IACV,OAAO,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACtD,QAAQ,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,UAAU,EAAE;QACV,UAAU,EAAE,UAAU;QACtB,OAAO,EAAE,CAAC,yDAAyD,CAAC;QACpE,KAAK,EAAE,0GAA0G;KAClH;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,aAAa,CAAC;IACnC,IAAI,EAAE,gBAAgB;IACtB,QAAQ,EAAE,SAAS;IACnB,MAAM,EAAE,EAAE;IACV,MAAM,EACJ,8MAA8M;IAChN,UAAU,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,2DAA2D,CAAC,EAAE;CAC/G,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,aAAa,CAAC;IAC1C,IAAI,EAAE,yBAAyB;IAC/B,QAAQ,EAAE,iBAAiB;IAC3B,MAAM,EAAE,EAAE;IACV,MAAM,EACJ,oVAAoV;IACtV,UAAU,EAAE;QACV,UAAU,EAAE,SAAS;QACrB,OAAO,EAAE;YACP,sCAAsC;YACtC,mCAAmC;YACnC,gIAAgI;SACjI;QACD,KAAK,EACH,kNAAkN;KACrN;CACF,CAAC,CAAA"}

package/dist/spec/operations/messages.d.ts

@@ -0,0 +1,19 @@
+import * as v from "valibot";
+export declare const messagesSend: import("../define.js").Operation<v.StrictObjectSchema<{
+    readonly chatId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, "an id is a whole number written as a string">, v.TransformAction<string, bigint>]>;
+    readonly message: v.StrictObjectSchema<{
+        readonly text: v.StringSchema<undefined>;
+        /**
+         * The client id MAX deduplicates by — measured, and it is what makes one retry safe. It must
+         * never be regenerated on a retry: a fresh one means a second message in somebody's chat.
+         */
+        readonly cid: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>]>;
+        readonly elements: v.ArraySchema<v.UnknownSchema, undefined>;
+        readonly attaches: v.ArraySchema<v.UnknownSchema, undefined>;
+    }, undefined>;
+    readonly notify: v.BooleanSchema<undefined>;
+}, undefined>, v.LooseObjectSchema<{
+    readonly message: v.OptionalSchema<v.LooseObjectSchema<{}, undefined>, undefined>;
+}, undefined>>;
+export declare const messageDelete: import("../define.js").Reservation;
+//# sourceMappingURL=messages.d.ts.map

package/dist/spec/operations/messages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"messages.d.ts","sourceRoot":"","sources":["../../../src/spec/operations/messages.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAI5B,eAAO,MAAM,YAAY;;;;QASnB;;;WAGG;;;;;;;;cAaP,CAAA;AAEF,eAAO,MAAM,aAAa,oCAOxB,CAAA"}

package/dist/spec/operations/messages.js

@@ -0,0 +1,37 @@
+import * as v from "valibot";
+import { defineOperation, reserveOpcode } from "../define.js";
+import { id } from "../scalars.js";
+export const messagesSend = defineOperation({
+    name: "messages.send",
+    constant: "MSG_SEND",
+    opcode: 64,
+    auth: true,
+    request: v.strictObject({
+        chatId: id(),
+        message: v.strictObject({
+            text: v.string(),
+            /**
+             * The client id MAX deduplicates by — measured, and it is what makes one retry safe. It must
+             * never be regenerated on a retry: a fresh one means a second message in somebody's chat.
+             */
+            cid: v.pipe(v.number(), v.integer()),
+            elements: v.array(v.unknown()),
+            attaches: v.array(v.unknown()),
+        }),
+        notify: v.boolean(),
+    }),
+    response: v.looseObject({ message: v.optional(v.looseObject({})) }),
+    provenance: {
+        confidence: "measured",
+        sources: ["measured against MAX 2026-09-19, including deduplication by `cid` across two connections"],
+        notes: "How long MAX remembers a `cid` is still unmeasured (`PROTO-2`); the two probes were seconds apart.",
+    },
+});
+export const messageDelete = reserveOpcode({
+    name: "messages.delete",
+    constant: "MSG_DELETE",
+    opcode: 66,
+    reason: "Deliberately never called. Giving this tool the ability to destroy somebody's messages, in order to tidy up after a test, is a poor trade (`NEED-32`).",
+    provenance: { confidence: "observed", sources: ["tsmax"] },
+});
+//# sourceMappingURL=messages.js.map