@leemour/max-cli 0.5.0 → 0.6.0

package/dist/sends/journal.js

@@ -0,0 +1,40 @@
+import { appendFileSync, mkdirSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { resolvePaths } from "@leemour/cli-core";
+/**
+ * `<state dir>/sends/<profile>.jsonl` — beside `runs`, never in the cache directory, so that
+ * `max cache clear` cannot erase what was sent in the owner's name (the reason of `NEED-51`).
+ */
+export const sendsPathFor = (profile, env = process.env) => join(resolvePaths({ appName: "max-cli", prefix: "MAX", env }).state, "sends", `${profile}.jsonl`);
+export class SendJournal {
+    path;
+    constructor(path) {
+        this.path = path;
+    }
+    append(entry) {
+        mkdirSync(dirname(this.path), { recursive: true, mode: 0o700 });
+        appendFileSync(this.path, `${JSON.stringify(entry)}\n`, { mode: 0o600 });
+    }
+    /** Oldest first. A line that does not parse is skipped: a torn last write must not block sending. */
+    entries() {
+        let text;
+        try {
+            text = readFileSync(this.path, "utf8");
+        }
+        catch {
+            return [];
+        }
+        return text
+            .split("\n")
+            .filter((line) => line.trim() !== "")
+            .flatMap((line) => {
+            try {
+                return [JSON.parse(line)];
+            }
+            catch {
+                return [];
+            }
+        });
+    }
+}
+//# sourceMappingURL=journal.js.map

package/dist/sends/journal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"journal.js","sourceRoot":"","sources":["../../src/sends/journal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAqBhD;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAe,EAAE,MAAyB,OAAO,CAAC,GAAG,EAAU,EAAE,CAC5F,IAAI,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,QAAQ,CAAC,CAAA;AAEnG,MAAM,OAAO,WAAW;IACD;IAArB,YAAqB,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAErC,MAAM,CAAC,KAAgB;QACrB,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC/D,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED,qGAAqG;IACrG,OAAO;QACL,IAAI,IAAY,CAAA;QAChB,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;QACD,OAAO,IAAI;aACR,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;aACpC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YAChB,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAc,CAAC,CAAA;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,CAAA;YACX,CAAC;QACH,CAAC,CAAC,CAAA;IACN,CAAC;CACF"}

package/dist/sends/recipients.d.ts

@@ -0,0 +1,29 @@
+import type { Id } from "../domain/models.js";
+export interface Recipient {
+    id: Id;
+    title: string | null;
+    addedAt: string;
+}
+/**
+ * A state file, not a setting: the configuration schema has deliberately no place for a chat id
+ * (`src/config.ts`), and this list is data about a profile rather than a preference.
+ */
+export declare const recipientsPathFor: (profile: string, env?: NodeJS.ProcessEnv) => string;
+/**
+ * The chats a profile may send to. **No file means the check is off**; a file with no chats in it
+ * means nowhere. Optional by the owner's ruling (`NEED-159`).
+ */
+export declare class RecipientList {
+    #private;
+    readonly path: string;
+    constructor(path: string);
+    /** `undefined` when the list is off. A file that cannot be read refuses rather than opening up. */
+    read(): Recipient[] | undefined;
+    /** Whether it was new. */
+    add(recipient: Recipient): boolean;
+    /** The id or the title as it was stored; `undefined` when neither matched. */
+    remove(reference: string): Recipient | undefined;
+    /** Whether there was a list to turn off. */
+    off(): boolean;
+}
+//# sourceMappingURL=recipients.d.ts.map

package/dist/sends/recipients.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipients.d.ts","sourceRoot":"","sources":["../../src/sends/recipients.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAA;AAE7C,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,EAAE,CAAA;IACN,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAAI,SAAS,MAAM,EAAE,MAAK,MAAM,CAAC,UAAwB,KAAG,MACsB,CAAA;AAEhH;;;GAGG;AACH,qBAAa,aAAa;;IACZ,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM;IAEjC,mGAAmG;IACnG,IAAI,IAAI,SAAS,EAAE,GAAG,SAAS;IAe/B,0BAA0B;IAC1B,GAAG,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO;IAOlC,8EAA8E;IAC9E,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;IAUhD,4CAA4C;IAC5C,GAAG,IAAI,OAAO;CASf"}

package/dist/sends/recipients.js

@@ -0,0 +1,62 @@
+import { existsSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { CliError, resolvePaths, writeSecurely } from "@leemour/cli-core";
+/**
+ * A state file, not a setting: the configuration schema has deliberately no place for a chat id
+ * (`src/config.ts`), and this list is data about a profile rather than a preference.
+ */
+export const recipientsPathFor = (profile, env = process.env) => join(resolvePaths({ appName: "max-cli", prefix: "MAX", env }).state, "profiles", `${profile}.recipients.json`);
+/**
+ * The chats a profile may send to. **No file means the check is off**; a file with no chats in it
+ * means nowhere. Optional by the owner's ruling (`NEED-159`).
+ */
+export class RecipientList {
+    path;
+    constructor(path) {
+        this.path = path;
+    }
+    /** `undefined` when the list is off. A file that cannot be read refuses rather than opening up. */
+    read() {
+        if (!existsSync(this.path))
+            return undefined;
+        try {
+            const parsed = JSON.parse(readFileSync(this.path, "utf8"));
+            if (!Array.isArray(parsed.chats))
+                throw new Error("no `chats` array");
+            return parsed.chats;
+        }
+        catch (error) {
+            throw new CliError("configuration_error", `the recipient list ${this.path} cannot be read (${error instanceof Error ? error.message : String(error)}) — ` +
+                "fix the file or turn the list off with `max recipients off`");
+        }
+    }
+    /** Whether it was new. */
+    add(recipient) {
+        const chats = this.read() ?? [];
+        if (chats.some((chat) => chat.id === recipient.id))
+            return false;
+        this.#write([...chats, recipient]);
+        return true;
+    }
+    /** The id or the title as it was stored; `undefined` when neither matched. */
+    remove(reference) {
+        const chats = this.read() ?? [];
+        const wanted = reference.trim();
+        const gone = chats.find((chat) => chat.id === wanted) ??
+            chats.find((chat) => chat.title?.toLocaleLowerCase() === wanted.toLocaleLowerCase());
+        if (gone)
+            this.#write(chats.filter((chat) => chat !== gone));
+        return gone;
+    }
+    /** Whether there was a list to turn off. */
+    off() {
+        if (!existsSync(this.path))
+            return false;
+        rmSync(this.path);
+        return true;
+    }
+    #write(chats) {
+        writeSecurely(this.path, `${JSON.stringify({ chats }, null, 2)}\n`, 0o600);
+    }
+}
+//# sourceMappingURL=recipients.js.map

package/dist/sends/recipients.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipients.js","sourceRoot":"","sources":["../../src/sends/recipients.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AASzE;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAAE,MAAyB,OAAO,CAAC,GAAG,EAAU,EAAE,CACjG,IAAI,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,OAAO,kBAAkB,CAAC,CAAA;AAEhH;;;GAGG;AACH,MAAM,OAAO,aAAa;IACH;IAArB,YAAqB,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAErC,mGAAmG;IACnG,IAAI;QACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAA;QAC5C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAwB,CAAA;YACjF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACrE,OAAO,MAAM,CAAC,KAAoB,CAAA;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,QAAQ,CAChB,qBAAqB,EACrB,sBAAsB,IAAI,CAAC,IAAI,oBAAoB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM;gBAC7G,6DAA6D,CAChE,CAAA;QACH,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,GAAG,CAAC,SAAoB;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAA;QAC/B,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAA;QAChE,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,EAAE,SAAS,CAAC,CAAC,CAAA;QAClC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,8EAA8E;IAC9E,MAAM,CAAC,SAAiB;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAA;QAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAA;QAC/B,MAAM,IAAI,GACR,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC;YACxC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,KAAK,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAA;QACtF,IAAI,IAAI;YAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAA;QAC5D,OAAO,IAAI,CAAA;IACb,CAAC;IAED,4CAA4C;IAC5C,GAAG;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QACxC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,CAAC,KAAkB;QACvB,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC5E,CAAC;CACF"}

package/dist/session/adopt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adopt.d.ts","sourceRoot":"","sources":["../../src/session/adopt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,UAAU,GAAU,QAAQ,SAAS,EAAE,OAAO,YAAY,EAAE,OAAO,MAAM,KAAG,OAAO,CAAC,IAAI,CASpG,CAAA"}
+{"version":3,"file":"adopt.d.ts","sourceRoot":"","sources":["../../src/session/adopt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,UAAU,GAAU,QAAQ,SAAS,EAAE,OAAO,YAAY,EAAE,OAAO,MAAM,KAAG,OAAO,CAAC,IAAI,CAUpG,CAAA"}

package/dist/session/adopt.js

@@ -17,13 +17,14 @@
  * cannot be driven by a test — and this ordering is too expensive to hold on trust.
  */
 export const adoptToken = async (client, store, token) => {
+    const before = store.readToken();
     await client.connect({ token });
-    // ⚠ **Only if the login did not already leave a better one.** MAX answers every login with a
-    // fresh token and `connect` now keeps it (`MAX-11`); writing the pasted one here unconditionally
-    // would replace that with the credential the person copied out of a browser, which is the older
-    // of the two. The check also covers the case where the keyring write failed inside `connect`:
-    // then there is nothing stored, and what was pasted is better than nothing.
-    if (store.readToken() === undefined)
+    // ⚠ **Only if the login did not already leave a better one.** MAX answers a login with a fresh
+    // token when the one presented has aged, and `connect` keeps it (`MAX-11`); overwriting that here
+    // would put back the older credential. Comparing with what was stored before, rather than asking
+    // whether anything is stored, is what lets a new login replace an old session at all — until
+    // 2026-09-24 a profile that already held a token kept it, and the command still said "stored".
+    if (store.readToken() === before)
         store.writeToken(token);
 };
 //# sourceMappingURL=adopt.js.map

package/dist/session/adopt.js.map

@@ -1 +1 @@
-{"version":3,"file":"adopt.js","sourceRoot":"","sources":["../../src/session/adopt.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,MAAiB,EAAE,KAAmB,EAAE,KAAa,EAAiB,EAAE;IACvG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IAE/B,6FAA6F;IAC7F,iGAAiG;IACjG,gGAAgG;IAChG,8FAA8F;IAC9F,4EAA4E;IAC5E,IAAI,KAAK,CAAC,SAAS,EAAE,KAAK,SAAS;QAAE,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;AAC9D,CAAC,CAAA"}
+{"version":3,"file":"adopt.js","sourceRoot":"","sources":["../../src/session/adopt.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,MAAiB,EAAE,KAAmB,EAAE,KAAa,EAAiB,EAAE;IACvG,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,EAAE,CAAA;IAChC,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IAE/B,+FAA+F;IAC/F,kGAAkG;IAClG,iGAAiG;IACjG,6FAA6F;IAC7F,+FAA+F;IAC/F,IAAI,KAAK,CAAC,SAAS,EAAE,KAAK,MAAM;QAAE,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;AAC3D,CAAC,CAAA"}

package/dist/session/browser.d.ts

@@ -0,0 +1,55 @@
+import { type ChildProcess } from "node:child_process";
+import type { Closeable } from "../deadline.js";
+/**
+ * What `session start` needs from a browser. Injected in tests, which must never open a window on
+ * the owner's desktop — the real ones refuse inside the test sandbox.
+ */
+export interface BrowserDoors {
+    /** Shows a page in whatever browser the system opens links with. */
+    open: (url: string) => Promise<void>;
+    /** Opens web.max.ru in a Chromium-family browser and waits for the page to be logged in. */
+    chromiumToken: (options: {
+        track: (closeable: Closeable) => void;
+        waitMs: number;
+    }) => Promise<string>;
+}
+export declare const realBrowser: BrowserDoors;
+/**
+ * The QR page, served from `127.0.0.1` rather than written to a file: a browser installed as a
+ * snap cannot read our temporary directory, and a file would leave the link on disk. The path is
+ * random, so another local user guessing the port finds nothing.
+ */
+export declare const serveQrPage: (link: string) => Promise<{
+    url: string;
+} & Closeable>;
+export declare const openUrl: (url: string) => Promise<void>;
+/**
+ * Chrome, Chromium, Edge or Brave — any browser that speaks the DevTools protocol. `MAX_BROWSER`
+ * names another. A snap build is skipped: it keeps its own `/tmp`, so the profile we hand it would
+ * land where we cannot delete it.
+ */
+export declare const findChromium: () => string | undefined;
+/**
+ * web.max.ru logs itself in — it asks MAX for the QR code, or sends the SMS — in a real browser with
+ * a profile of its own, and we read the token it stores once it has one. MAX sees its own web
+ * client do the login, not our socket.
+ *
+ * ⚠ The profile holds a live session, so it is deleted on every way out: success, a closed window,
+ * `--timeout`, Ctrl-C.
+ */
+export declare const tokenFromChromium: ({ track, waitMs, }: {
+    track: (closeable: Closeable) => void;
+    waitMs: number;
+}) => Promise<string>;
+export declare class ChromiumSession implements Closeable {
+    #private;
+    constructor(child: ChildProcess, profile: string, port: number, graceMs?: number);
+    waitForToken(waitMs: number): Promise<string>;
+    close(): Promise<void>;
+}
+/**
+ * The stored value is JSON holding the token, or the token itself — which one is not measured yet.
+ * Either way nothing here prints it.
+ */
+export declare const tokenIn: (stored: string) => string | undefined;
+//# sourceMappingURL=browser.d.ts.map

package/dist/session/browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/session/browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAS,MAAM,oBAAoB,CAAA;AAW7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,oEAAoE;IACpE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACpC,4FAA4F;IAC5F,aAAa,EAAE,CAAC,OAAO,EAAE;QAAE,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,KAAK,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CACvG;AAED,eAAO,MAAM,WAAW,EAAE,YAGzB,CAAA;AAKD;;;;GAIG;AACH,eAAO,MAAM,WAAW,GAAU,MAAM,MAAM,KAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAkCnF,CAAA;AASD,eAAO,MAAM,OAAO,GAAU,KAAK,MAAM,KAAG,OAAO,CAAC,IAAI,CAmBvD,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,YAAY,QAAO,MAAM,GAAG,SA0CxC,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAAU,oBAGrC;IACD,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,KAAK,IAAI,CAAA;IACrC,MAAM,EAAE,MAAM,CAAA;CACf,KAAG,OAAO,CAAC,MAAM,CAiCjB,CAAA;AAED,qBAAa,eAAgB,YAAW,SAAS;;gBAQnC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,SAAQ;IAWzE,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgBnD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAuCvB;AAED;;;GAGG;AACH,eAAO,MAAM,OAAO,GAAI,QAAQ,MAAM,KAAG,MAAM,GAAG,SAWjD,CAAA"}

package/dist/session/browser.js

@@ -0,0 +1,292 @@
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { existsSync, mkdtempSync, realpathSync, rmSync } from "node:fs";
+import { createServer } from "node:http";
+import { createServer as createTcpServer } from "node:net";
+import { tmpdir } from "node:os";
+import { delimiter, join } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import { CliError } from "@leemour/cli-core";
+import qrcode from "qrcode-generator";
+import { WebSocket } from "ws";
+export const realBrowser = {
+    open: (url) => openUrl(url),
+    chromiumToken: (options) => tokenFromChromium(options),
+};
+const WEB_MAX = "https://web.max.ru/";
+const AUTH_KEY = "__oneme_auth";
+/**
+ * The QR page, served from `127.0.0.1` rather than written to a file: a browser installed as a
+ * snap cannot read our temporary directory, and a file would leave the link on disk. The path is
+ * random, so another local user guessing the port finds nothing.
+ */
+export const serveQrPage = async (link) => {
+    const path = `/${randomBytes(16).toString("hex")}`;
+    const code = qrcode(0, "M");
+    code.addData(link);
+    code.make();
+    const page = qrHtml(code.createSvgTag({ cellSize: 8, margin: 4, scalable: true }));
+    const server = createServer((request, response) => {
+        if (request.url !== path) {
+            response.writeHead(404).end();
+            return;
+        }
+        response
+            .writeHead(200, {
+            "content-type": "text/html; charset=utf-8",
+            "cache-control": "no-store",
+            "referrer-policy": "no-referrer",
+        })
+            .end(page);
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", resolve);
+    });
+    const { port } = server.address();
+    return {
+        url: `http://127.0.0.1:${port}${path}`,
+        close: () => new Promise((resolve) => {
+            server.closeAllConnections();
+            server.close(() => resolve());
+        }),
+    };
+};
+const qrHtml = (svg) => `<!doctype html>
+<html lang="ru"><head><meta charset="utf-8"><title>MAX — вход</title>
+<style>body{font-family:system-ui,sans-serif;display:grid;place-items:center;min-height:100vh;margin:0;background:#fff;color:#111}
+main{text-align:center;max-width:22rem}svg{width:18rem;height:18rem}</style></head>
+<body><main>${svg}<p>Отсканируйте код приложением MAX на телефоне. Код действует около двух минут.</p>
+<p>После входа эту вкладку можно закрыть.</p></main></body></html>`;
+export const openUrl = async (url) => {
+    refuseInTests();
+    const [command, args] = process.platform === "darwin"
+        ? ["open", [url]]
+        : process.platform === "win32"
+            ? ["cmd", ["/c", "start", "", url]]
+            : ["xdg-open", [url]];
+    await new Promise((resolve, reject) => {
+        const child = spawn(command, args, { stdio: "ignore", detached: true, windowsHide: true });
+        child.once("error", () => reject(new CliError("configuration_error", "no browser could be opened here — use `session start token`")));
+        child.once("spawn", () => {
+            child.unref();
+            resolve();
+        });
+    });
+};
+/**
+ * Chrome, Chromium, Edge or Brave — any browser that speaks the DevTools protocol. `MAX_BROWSER`
+ * names another. A snap build is skipped: it keeps its own `/tmp`, so the profile we hand it would
+ * land where we cannot delete it.
+ */
+export const findChromium = () => {
+    const named = process.env.MAX_BROWSER;
+    if (named)
+        return named;
+    if (process.platform === "darwin") {
+        return [
+            "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
+            "/Applications/Chromium.app/Contents/MacOS/Chromium",
+            "/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge",
+            "/Applications/Brave Browser.app/Contents/MacOS/Brave Browser",
+        ].find((path) => existsSync(path));
+    }
+    if (process.platform === "win32") {
+        const roots = [process.env.PROGRAMFILES, process.env["PROGRAMFILES(X86)"], process.env.LOCALAPPDATA];
+        const apps = [
+            "Google\\Chrome\\Application\\chrome.exe",
+            "Microsoft\\Edge\\Application\\msedge.exe",
+            "BraveSoftware\\Brave-Browser\\Application\\brave.exe",
+        ];
+        return apps
+            .flatMap((app) => roots.filter((root) => root !== undefined).map((root) => join(root, app)))
+            .find(existsSync);
+    }
+    const names = [
+        "google-chrome",
+        "google-chrome-stable",
+        "chromium",
+        "chromium-browser",
+        "microsoft-edge",
+        "microsoft-edge-stable",
+        "brave-browser",
+    ];
+    const dirs = (process.env.PATH ?? "").split(delimiter).filter(Boolean);
+    for (const name of names) {
+        for (const dir of dirs) {
+            const path = join(dir, name);
+            if (existsSync(path) && !realpathSync(path).startsWith("/snap/"))
+                return path;
+        }
+    }
+    return undefined;
+};
+/**
+ * web.max.ru logs itself in — it asks MAX for the QR code, or sends the SMS — in a real browser with
+ * a profile of its own, and we read the token it stores once it has one. MAX sees its own web
+ * client do the login, not our socket.
+ *
+ * ⚠ The profile holds a live session, so it is deleted on every way out: success, a closed window,
+ * `--timeout`, Ctrl-C.
+ */
+export const tokenFromChromium = async ({ track, waitMs, }) => {
+    refuseInTests();
+    const binary = findChromium();
+    if (!binary) {
+        throw new CliError("configuration_error", "no Chrome, Chromium, Edge or Brave found — set MAX_BROWSER to one, or use `session start qr`");
+    }
+    const profile = mkdtempSync(join(tmpdir(), "max-login-"));
+    const port = await freePort();
+    const child = spawn(binary, [
+        `--user-data-dir=${profile}`,
+        `--remote-debugging-port=${port}`,
+        "--no-first-run",
+        "--no-default-browser-check",
+        WEB_MAX,
+    ], { stdio: "ignore" });
+    const browser = new ChromiumSession(child, profile, port);
+    track(browser);
+    const stopSignals = closeOnSignal(browser);
+    try {
+        return await browser.waitForToken(waitMs);
+    }
+    finally {
+        stopSignals();
+        await browser.close();
+    }
+};
+export class ChromiumSession {
+    #child;
+    #profile;
+    #port;
+    #exited;
+    #graceMs;
+    #closing;
+    constructor(child, profile, port, graceMs = 5_000) {
+        this.#child = child;
+        this.#graceMs = graceMs;
+        this.#profile = profile;
+        this.#port = port;
+        this.#exited = new Promise((resolve) => {
+            child.once("exit", () => resolve());
+            child.once("error", () => resolve());
+        });
+    }
+    async waitForToken(waitMs) {
+        const deadline = Date.now() + waitMs;
+        let running = true;
+        void this.#exited.then(() => {
+            running = false;
+        });
+        while (Date.now() < deadline) {
+            if (!running)
+                throw new CliError("cancelled", "the browser was closed before the login finished");
+            const token = await this.#storedToken().catch(() => undefined);
+            if (token)
+                return token;
+            await delay(1_000);
+        }
+        throw new CliError("timeout", `nobody logged in within ${Math.round(waitMs / 60_000)} minutes`);
+    }
+    close() {
+        this.#closing ??= this.#shutdown();
+        return this.#closing;
+    }
+    async #shutdown() {
+        // Chrome writes to the profile while it shuts down; removing it first leaves half of it behind.
+        const version = await this.#json("/json/version").catch(() => undefined);
+        const endpoint = typeof version?.webSocketDebuggerUrl === "string" ? version.webSocketDebuggerUrl : undefined;
+        if (endpoint)
+            await evaluateOver(endpoint, "Browser.close", {}).catch(() => undefined);
+        const exited = await Promise.race([this.#exited.then(() => true), delay(this.#graceMs).then(() => false)]);
+        if (!exited && this.#child.pid !== undefined) {
+            this.#child.kill();
+            await Promise.race([this.#exited, delay(2_000)]);
+        }
+        rmSync(this.#profile, { recursive: true, force: true, maxRetries: 3 });
+    }
+    async #storedToken() {
+        const targets = await this.#json("/json/list");
+        const page = (Array.isArray(targets) ? targets : []).find((target) => target?.type === "page" && typeof target.url === "string" && target.url.startsWith(WEB_MAX));
+        if (typeof page?.webSocketDebuggerUrl !== "string")
+            return undefined;
+        const result = await evaluateOver(page.webSocketDebuggerUrl, "Runtime.evaluate", {
+            expression: `localStorage.getItem(${JSON.stringify(AUTH_KEY)})`,
+            returnByValue: true,
+        });
+        const stored = result?.result?.value;
+        return typeof stored === "string" ? tokenIn(stored) : undefined;
+    }
+    // biome-ignore lint/suspicious/noExplicitAny: the DevTools answers are read defensively, field by field.
+    async #json(path) {
+        const response = await fetch(`http://127.0.0.1:${this.#port}${path}`, { signal: AbortSignal.timeout(2_000) });
+        return await response.json();
+    }
+}
+/**
+ * The stored value is JSON holding the token, or the token itself — which one is not measured yet.
+ * Either way nothing here prints it.
+ */
+export const tokenIn = (stored) => {
+    try {
+        const parsed = JSON.parse(stored);
+        if (typeof parsed === "object" && parsed !== null && "token" in parsed) {
+            const token = parsed.token;
+            return typeof token === "string" && token !== "" ? token : undefined;
+        }
+        return typeof parsed === "string" && parsed !== "" ? parsed : undefined;
+    }
+    catch {
+        return stored === "" ? undefined : stored;
+    }
+};
+// biome-ignore lint/suspicious/noExplicitAny: see #json.
+const evaluateOver = (endpoint, method, params) => new Promise((resolve, reject) => {
+    const socket = new WebSocket(endpoint);
+    const timer = setTimeout(() => {
+        socket.terminate();
+        reject(new Error("the browser did not answer"));
+    }, 5_000);
+    socket.once("error", (error) => {
+        clearTimeout(timer);
+        reject(error);
+    });
+    socket.once("open", () => socket.send(JSON.stringify({ id: 1, method, params })));
+    socket.on("message", (data) => {
+        const message = JSON.parse(String(data));
+        if (message.id !== 1)
+            return;
+        clearTimeout(timer);
+        socket.close();
+        resolve(message.result);
+    });
+});
+/**
+ * Node's default Ctrl-C exits without running a `finally`, which would leave the browser open and
+ * its logged-in profile on disk. Returns the function that removes the handlers again.
+ */
+const closeOnSignal = (closeable) => {
+    const onSignal = () => {
+        void closeable.close().finally(() => process.exit(130));
+    };
+    // `on`, not `once`: a second Ctrl-C during the shutdown would otherwise exit before the profile goes.
+    process.on("SIGINT", onSignal);
+    process.on("SIGTERM", onSignal);
+    return () => {
+        process.off("SIGINT", onSignal);
+        process.off("SIGTERM", onSignal);
+    };
+};
+const freePort = () => new Promise((resolve, reject) => {
+    const probe = createTcpServer();
+    probe.once("error", reject);
+    probe.listen(0, "127.0.0.1", () => {
+        const { port } = probe.address();
+        probe.close(() => resolve(port));
+    });
+});
+const refuseInTests = () => {
+    if (process.env.MAX_TEST_SANDBOX)
+        throw new Error("a test reached the real browser — inject BrowserDoors");
+};
+//# sourceMappingURL=browser.js.map

package/dist/session/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../../src/session/browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AACxC,OAAO,EAAoB,YAAY,IAAI,eAAe,EAAE,MAAM,UAAU,CAAA;AAC5E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAC3C,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC5C,OAAO,MAAM,MAAM,kBAAkB,CAAA;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAA;AAc9B,MAAM,CAAC,MAAM,WAAW,GAAiB;IACvC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAC3B,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC;CACvD,CAAA;AAED,MAAM,OAAO,GAAG,qBAAqB,CAAA;AACrC,MAAM,QAAQ,GAAG,cAAc,CAAA;AAE/B;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,IAAY,EAAwC,EAAE;IACtF,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC3B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAClB,IAAI,CAAC,IAAI,EAAE,CAAA;IACX,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAElF,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAChD,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YACzB,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;YAC7B,OAAM;QACR,CAAC;QACD,QAAQ;aACL,SAAS,CAAC,GAAG,EAAE;YACd,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,UAAU;YAC3B,iBAAiB,EAAE,aAAa;SACjC,CAAC;aACD,GAAG,CAAC,IAAI,CAAC,CAAA;IACd,CAAC,CAAC,CAAA;IACF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC5B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IACF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAA;IAEhD,OAAO;QACL,GAAG,EAAE,oBAAoB,IAAI,GAAG,IAAI,EAAE;QACtC,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC5B,MAAM,CAAC,mBAAmB,EAAE,CAAA;YAC5B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;QAC/B,CAAC,CAAC;KACL,CAAA;AACH,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC;;;;cAI1B,GAAG;mEACkD,CAAA;AAEnE,MAAM,CAAC,MAAM,OAAO,GAAG,KAAK,EAAE,GAAW,EAAiB,EAAE;IAC1D,aAAa,EAAE,CAAA;IACf,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,GACnB,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAC3B,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC5B,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YACnC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;IAE3B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;QAC1F,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CACvB,MAAM,CAAC,IAAI,QAAQ,CAAC,qBAAqB,EAAE,6DAA6D,CAAC,CAAC,CAC3G,CAAA;QACD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,KAAK,CAAC,KAAK,EAAE,CAAA;YACb,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,GAAuB,EAAE;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAA;IACrC,IAAI,KAAK;QAAE,OAAO,KAAK,CAAA;IAEvB,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO;YACL,8DAA8D;YAC9D,oDAAoD;YACpD,gEAAgE;YAChE,8DAA8D;SAC/D,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;IACpC,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QACpG,MAAM,IAAI,GAAG;YACX,yCAAyC;YACzC,0CAA0C;YAC1C,sDAAsD;SACvD,CAAA;QACD,OAAO,IAAI;aACR,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;aAC3F,IAAI,CAAC,UAAU,CAAC,CAAA;IACrB,CAAC;IAED,MAAM,KAAK,GAAG;QACZ,eAAe;QACf,sBAAsB;QACtB,UAAU;QACV,kBAAkB;QAClB,gBAAgB;QAChB,uBAAuB;QACvB,eAAe;KAChB,CAAA;IACD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACtE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAC5B,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAA;QAC/E,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,EACtC,KAAK,EACL,MAAM,GAIP,EAAmB,EAAE;IACpB,aAAa,EAAE,CAAA;IACf,MAAM,MAAM,GAAG,YAAY,EAAE,CAAA;IAC7B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,QAAQ,CAChB,qBAAqB,EACrB,8FAA8F,CAC/F,CAAA;IACH,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,CAAA;IACzD,MAAM,IAAI,GAAG,MAAM,QAAQ,EAAE,CAAA;IAC7B,MAAM,KAAK,GAAG,KAAK,CACjB,MAAM,EACN;QACE,mBAAmB,OAAO,EAAE;QAC5B,2BAA2B,IAAI,EAAE;QACjC,gBAAgB;QAChB,4BAA4B;QAC5B,OAAO;KACR,EACD,EAAE,KAAK,EAAE,QAAQ,EAAE,CACpB,CAAA;IACD,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;IACzD,KAAK,CAAC,OAAO,CAAC,CAAA;IAEd,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IAC1C,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;IAC3C,CAAC;YAAS,CAAC;QACT,WAAW,EAAE,CAAA;QACb,MAAM,OAAO,CAAC,KAAK,EAAE,CAAA;IACvB,CAAC;AACH,CAAC,CAAA;AAED,MAAM,OAAO,eAAe;IACjB,MAAM,CAAc;IACpB,QAAQ,CAAQ;IAChB,KAAK,CAAQ;IACb,OAAO,CAAe;IACtB,QAAQ,CAAQ;IACzB,QAAQ,CAA2B;IAEnC,YAAY,KAAmB,EAAE,OAAe,EAAE,IAAY,EAAE,OAAO,GAAG,KAAK;QAC7E,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;QACnB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;QACvB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;QACvB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;QACjB,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YACrC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;YACnC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;QACtC,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAA;QACpC,IAAI,OAAO,GAAG,IAAI,CAAA;QAClB,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE;YAC1B,OAAO,GAAG,KAAK,CAAA;QACjB,CAAC,CAAC,CAAA;QAEF,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,kDAAkD,CAAC,CAAA;YACjG,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YAC9D,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAA;YACvB,MAAM,KAAK,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;QACD,MAAM,IAAI,QAAQ,CAAC,SAAS,EAAE,2BAA2B,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAA;IACjG,CAAC;IAED,KAAK;QACH,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS,EAAE,CAAA;QAClC,OAAO,IAAI,CAAC,QAAQ,CAAA;IACtB,CAAC;IAED,KAAK,CAAC,SAAS;QACb,gGAAgG;QAChG,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACxE,MAAM,QAAQ,GAAG,OAAO,OAAO,EAAE,oBAAoB,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAA;QAC7G,IAAI,QAAQ;YAAE,MAAM,YAAY,CAAC,QAAQ,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAEtF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC1G,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;YAClB,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAClD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;QAC9C,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CACvD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,KAAK,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CACxG,CAAA;QACD,IAAI,OAAO,IAAI,EAAE,oBAAoB,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QAEpE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,oBAAoB,EAAE,kBAAkB,EAAE;YAC/E,UAAU,EAAE,wBAAwB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG;YAC/D,aAAa,EAAE,IAAI;SACpB,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,EAAE,KAAK,CAAA;QACpC,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACjE,CAAC;IAED,yGAAyG;IACzG,KAAK,CAAC,KAAK,CAAC,IAAY;QACtB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAC7G,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC9B,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,MAAc,EAAsB,EAAE;IAC5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC1C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YACvE,MAAM,KAAK,GAAI,MAA6B,CAAC,KAAK,CAAA;YAClD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;QACtE,CAAC;QACD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAA;IAC3C,CAAC;AACH,CAAC,CAAA;AAED,yDAAyD;AACzD,MAAM,YAAY,GAAG,CAAC,QAAgB,EAAE,MAAc,EAAE,MAAc,EAAgB,EAAE,CACtF,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAA;IACtC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,MAAM,CAAC,SAAS,EAAE,CAAA;QAClB,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAA;IACjD,CAAC,EAAE,KAAK,CAAC,CAAA;IACT,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QAC7B,YAAY,CAAC,KAAK,CAAC,CAAA;QACnB,MAAM,CAAC,KAAK,CAAC,CAAA;IACf,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAA;IACjF,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;QACxC,IAAI,OAAO,CAAC,EAAE,KAAK,CAAC;YAAE,OAAM;QAC5B,YAAY,CAAC,KAAK,CAAC,CAAA;QACnB,MAAM,CAAC,KAAK,EAAE,CAAA;QACd,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEJ;;;GAGG;AACH,MAAM,aAAa,GAAG,CAAC,SAAoB,EAAgB,EAAE;IAC3D,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACzD,CAAC,CAAA;IACD,sGAAsG;IACtG,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;IAC9B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IAC/B,OAAO,GAAG,EAAE;QACV,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;QAC/B,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IAClC,CAAC,CAAA;AACH,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,GAAoB,EAAE,CACrC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,MAAM,KAAK,GAAG,eAAe,EAAE,CAAA;IAC/B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC3B,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;QAChC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,OAAO,EAAiB,CAAA;QAC/C,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEJ,MAAM,aAAa,GAAG,GAAS,EAAE;IAC/B,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;AAC5G,CAAC,CAAA"}

package/dist/session/handshake.d.ts

@@ -35,5 +35,7 @@ export interface SessionOptions {
  * diagnostic hook in `MaxClient` saw nothing of the two requests every single invocation makes,
  * and `max chats list` answers from the LOGIN response without sending anything else.
  */
+/** How many chats LOGIN is asked for. MAX answers the newest that many, newest first (`FIND-80`). */
+export declare const LOGIN_CHATS = 40;
 export declare const startSession: (invoke: Invoke, { token, deviceId, chatsCount, sync }: SessionOptions) => Promise<Payload>;
 //# sourceMappingURL=handshake.d.ts.map

package/dist/session/handshake.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handshake.d.ts","sourceRoot":"","sources":["../../src/session/handshake.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAA;AAC9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAInD,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,6FAA6F;IAC7F,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;;;;;;;OAWG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,YAAY,GACvB,QAAQ,MAAM,EACd,uCAAgD,cAAc,KAC7D,OAAO,CAAC,OAAO,CAajB,CAAA"}
+{"version":3,"file":"handshake.d.ts","sourceRoot":"","sources":["../../src/session/handshake.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAA;AAC9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAInD,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,6FAA6F;IAC7F,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;;;;;;;OAWG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED;;;;;;;;;;;;;;;GAeG;AACH,qGAAqG;AACrG,eAAO,MAAM,WAAW,KAAK,CAAA;AAE7B,eAAO,MAAM,YAAY,GACvB,QAAQ,MAAM,EACd,uCAAyD,cAAc,KACtE,OAAO,CAAC,OAAO,CAajB,CAAA"}

package/dist/session/handshake.js

@@ -16,7 +16,9 @@ import { sessionInit, sessionLogin } from "../spec/operations/session.js";
  * diagnostic hook in `MaxClient` saw nothing of the two requests every single invocation makes,
  * and `max chats list` answers from the LOGIN response without sending anything else.
  */
-export const startSession = async (invoke, { token, deviceId, chatsCount = 40, sync = 0 }) => {
+/** How many chats LOGIN is asked for. MAX answers the newest that many, newest first (`FIND-80`). */
+export const LOGIN_CHATS = 40;
+export const startSession = async (invoke, { token, deviceId, chatsCount = LOGIN_CHATS, sync = 0 }) => {
     await invoke(sessionInit, { userAgent: WEB_USER_AGENT, deviceId });
     return await invoke(sessionLogin, {
         token,

package/dist/session/handshake.js.map

@@ -1 +1 @@
-{"version":3,"file":"handshake.js","sourceRoot":"","sources":["../../src/session/handshake.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AAsBzE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,MAAc,EACd,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,GAAG,EAAE,EAAE,IAAI,GAAG,CAAC,EAAkB,EAC5C,EAAE;IACpB,MAAM,MAAM,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAA;IAElE,OAAO,MAAM,MAAM,CAAC,YAAY,EAAE;QAChC,KAAK;QACL,8FAA8F;QAC9F,WAAW,EAAE,KAAK;QAClB,UAAU;QACV,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,IAAI;QAClB,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,IAAI;KACjB,CAAC,CAAA;AACJ,CAAC,CAAA"}
+{"version":3,"file":"handshake.js","sourceRoot":"","sources":["../../src/session/handshake.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AAsBzE;;;;;;;;;;;;;;;GAeG;AACH,qGAAqG;AACrG,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAA;AAE7B,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,MAAc,EACd,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,GAAG,WAAW,EAAE,IAAI,GAAG,CAAC,EAAkB,EACrD,EAAE;IACpB,MAAM,MAAM,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAA;IAElE,OAAO,MAAM,MAAM,CAAC,YAAY,EAAE;QAChC,KAAK;QACL,8FAA8F;QAC9F,WAAW,EAAE,KAAK;QAClB,UAAU;QACV,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,IAAI;QAClB,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,IAAI;KACjB,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/session/login.d.ts

@@ -0,0 +1,20 @@
+import type { WireClient } from "../generated/client.generated.js";
+export interface SecondFactor {
+    /** Asked only when the account has a cloud password; `again` after a wrong one. */
+    askPassword: (hint: string | undefined, again: boolean) => Promise<string>;
+}
+export interface QrLogin extends SecondFactor {
+    /** Put the code where a phone can scan it. Resolves once it is shown, not once it is scanned. */
+    show: (link: string) => Promise<void>;
+    now?: () => number;
+    sleep?: (ms: number) => Promise<void>;
+}
+/**
+ * The login MAX's web client does itself when it shows a QR code: ask for a code, wait until a phone
+ * approves it, then exchange it for a token. Shapes from PyMax 2.4.1 (`auth/qr.py`), not measured.
+ *
+ * One code per run: an expired one is an error rather than a fresh code, so a person who walked
+ * away does not come back to a loop that has been asking MAX for codes all along.
+ */
+export declare const tokenByQr: (wire: WireClient, { show, askPassword, now, sleep }: QrLogin) => Promise<string>;
+//# sourceMappingURL=login.d.ts.map

package/dist/session/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/session/login.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAA;AAGlE,MAAM,WAAW,YAAY;IAC3B,mFAAmF;IACnF,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAC3E;AAED,MAAM,WAAW,OAAQ,SAAQ,YAAY;IAC3C,iGAAiG;IACjG,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,GACpB,MAAM,UAAU,EAChB,mCAAsD,OAAO,KAC5D,OAAO,CAAC,MAAM,CAiBhB,CAAA"}