@rikaidev/yomi 0.2.6

package/dist/line/core/service.js

@@ -0,0 +1,134 @@
+/**
+ * LINE Protocol Service - Yomi's read-only session/query core.
+ *
+ * Orchestrates session resume (with auto token refresh) and E2EE
+ * decryption. Login and continuous polling live in the vendored auth
+ * modules but are never invoked by Yomi's MCP server — see README.md.
+ */
+import { EventEmitter } from 'node:events';
+import { CredentialStore } from '../../auth/credential-store.js';
+import { yomiDataPath } from '../../util/data-dir.js';
+import { createCliLogger } from '../../util/log.js';
+import { createAuthSessionService } from './auth-session-service.js';
+import { createChatRuntimeService } from './chat-runtime-service.js';
+import { createDirectoryRuntimeService } from './directory-runtime-service.js';
+import { E2EEKeyManager } from './e2ee/index.js';
+import { LineSessionState } from './session-state/index.js';
+export const STATE = {
+    DISCONNECTED: 'disconnected',
+    LOGGING_IN: 'logging_in',
+    CONNECTED: 'connected',
+    POLLING: 'polling',
+    ERROR: 'error',
+};
+/**
+ * High-level LINE service coordinating all aspects of the protocol.
+ * Used by Adapter and Agent layers.
+ */
+export class LineProtocolService extends EventEmitter {
+    options;
+    state;
+    client;
+    profile;
+    startupFlowLogger;
+    logger;
+    credentialStore;
+    sessionState;
+    nameCache;
+    chatCache;
+    e2eeManager;
+    e2eeWarning;
+    loginRequired;
+    // Why loginRequired was set. 'revoked' = LINE invalidated the token (a
+    // competing login elsewhere); 'expired' = the token aged out and the silent
+    // refresh failed. Both recover via `login`, but they are different stories to
+    // tell the user, so the cause has to survive the trip to the MCP gate.
+    // Always cleared back to null wherever loginRequired goes false.
+    loginReason;
+    recentFetchState;
+    // The following are mixed in at construction time via Object.assign from
+    // createAuthSessionService / createDirectoryRuntimeService /
+    // createChatRuntimeService (see constructor below) — TS cannot see that
+    // assignment, so these use definite-assignment assertions. Yomi's MCP
+    // server calls resumeSession/sendMessage/getRecentMessages/
+    // getPreviousMessages/download* only; it never calls startPwlessLogin
+    // (still present for compile completeness).
+    startPwlessLogin;
+    logout;
+    invalidateSession;
+    tryRefreshToken;
+    resumeSession;
+    resolveName;
+    getContact;
+    getGroup;
+    listStickerPackages;
+    searchStickerPackages;
+    sendMessage;
+    sendImage;
+    sendFile;
+    sendAudio;
+    sendVideo;
+    sendContact;
+    sendSticker;
+    sendLocation;
+    getRecentMessages;
+    getPreviousMessages;
+    downloadMessageContent;
+    downloadMessageContentPreview;
+    markChatRead;
+    renameGroup;
+    inviteToGroup;
+    kickFromGroup;
+    leaveGroup;
+    createGroup;
+    reactToMessage;
+    cancelReaction;
+    unsendMessage;
+    addFriend;
+    blockContact;
+    unblockContact;
+    acceptInvitation;
+    constructor(options = {}) {
+        super();
+        this.options = { autoStart: true, pollInterval: 10000, ...options };
+        this.state = STATE.DISCONNECTED;
+        this.client = null;
+        this.profile = null;
+        this.logger = options.logger || createCliLogger('LINE');
+        this.startupFlowLogger = null;
+        this.credentialStore =
+            options.credentialStore ||
+                new CredentialStore('line', 
+                // Absolute, per-user (see ../../util/data-dir.ts). This was the
+                // relative string 'data/line-credentials.json', which CredentialStore
+                // also derives the E2EE cache path from — so under Claude Desktop, whose
+                // cwd is `/`, the cache aimed at /data/ and silently never persisted.
+                this.options.credentialPath ?? yomiDataPath('line-credentials.json'));
+        this.sessionState = new LineSessionState(this.credentialStore);
+        this.nameCache = new Map();
+        this.chatCache = new Map();
+        this.e2eeManager = options.e2eeManager || new E2EEKeyManager();
+        this.e2eeWarning = false;
+        this.loginRequired = false;
+        this.loginReason = null;
+        this.recentFetchState = new Map();
+        this.e2eeManager.setRuntime({
+            getClient: () => this.client,
+            getStore: () => this.credentialStore,
+            getProfileMid: () => this.profile?.mid,
+            emitWarning: (payload) => {
+                this.e2eeWarning = payload.active;
+                this.emit('e2eeWarning', payload);
+            },
+        });
+        Object.assign(this, createAuthSessionService(this, STATE), createDirectoryRuntimeService(this), createChatRuntimeService(this));
+    }
+    /**
+     * Set the current service state and emit an event.
+     * @param newState - The new state to set.
+     */
+    setState(newState) {
+        this.state = newState;
+        this.emit('state', newState);
+    }
+}

package/dist/line/core/session-state/index.js

@@ -0,0 +1,243 @@
+/**
+ * LINE session state manager.
+ *
+ * Acts as the single state owner for LINE auth/session persistence. All
+ * token/revision writes should flow through this class instead of writing
+ * directly to the credential store from scattered call sites.
+ */
+import { loadStoredSessionFields, parseStoredNumber, persistLoginBootstrap, persistLoginCredentials, persistLoginCryptoMaterial, } from './persist.js';
+/**
+ * Own persisted and in-memory LINE session state.
+ */
+export class LineSessionState {
+    credentialStore;
+    client;
+    authToken;
+    refreshToken;
+    tokenIssueTimeEpochSec;
+    durationUntilRefreshInSec;
+    revision;
+    globalRevision;
+    individualRevision;
+    mid;
+    /**
+     * Create the LINE session state manager.
+     * @param credentialStore - Persistent credential store for LINE session data
+     */
+    constructor(credentialStore) {
+        this.credentialStore = credentialStore;
+        this.client = null;
+        this.authToken = null;
+        this.refreshToken = null;
+        this.tokenIssueTimeEpochSec = null;
+        this.durationUntilRefreshInSec = null;
+        this.revision = -1;
+        this.globalRevision = 0;
+        this.individualRevision = 0;
+        this.mid = null;
+    }
+    /**
+     * Bind the active runtime client to the current session snapshot.
+     * @param client - Active LINE client instance
+     */
+    bindClient(client) {
+        this.client = client;
+        if (this.authToken) {
+            client.authToken = this.authToken;
+        }
+        client.revision = this.revision;
+        client.globalRevision = this.globalRevision;
+        client.individualRevision = this.individualRevision;
+    }
+    /**
+     * Load persisted LINE session state from the credential store.
+     * @returns Promise that resolves when state has been hydrated
+     */
+    async loadFromStore() {
+        const stored = await loadStoredSessionFields(this.credentialStore);
+        this.authToken = stored.authToken;
+        this.refreshToken = stored.refreshToken;
+        this.mid = stored.mid;
+        this.tokenIssueTimeEpochSec = parseStoredNumber(stored.tokenIssueTimeEpochSec, null);
+        this.durationUntilRefreshInSec = parseStoredNumber(stored.durationUntilRefreshInSec, null);
+        this.revision = parseStoredNumber(stored.revision, -1) ?? -1;
+        this.globalRevision = parseStoredNumber(stored.globalRevision, 0) ?? 0;
+        this.individualRevision =
+            parseStoredNumber(stored.individualRevision, 0) ?? 0;
+        if (this.client) {
+            this.bindClient(this.client);
+        }
+    }
+    /**
+     * Initialize session state from a fresh login result.
+     * @param loginResult - Login payload returned by the LINE auth flow
+     * @returns Promise that resolves when state has been persisted
+     */
+    async initializeFromLogin(loginResult) {
+        this.authToken = loginResult.authToken ?? this.authToken;
+        this.refreshToken = loginResult.refreshToken ?? this.refreshToken;
+        this.mid = loginResult.mid ?? this.mid;
+        this.tokenIssueTimeEpochSec =
+            loginResult.tokenIssueTimeEpochSec ?? this.tokenIssueTimeEpochSec;
+        this.durationUntilRefreshInSec =
+            loginResult.durationUntilRefreshInSec ?? this.durationUntilRefreshInSec;
+        await persistLoginCredentials(this.credentialStore, loginResult);
+        await persistLoginCryptoMaterial(this.credentialStore, loginResult);
+        await persistLoginBootstrap(this.credentialStore, loginResult);
+        // Read-back verification: a write that is never read back is an
+        // unverified claim, not a fact. `persistLoginCredentials` above can
+        // report success while the underlying store still drops the key (a
+        // keychain write failure swallowed by `CredentialStore.persistBlob`'s
+        // catch, a race with another writer, etc.) — the only way to know the
+        // session actually survives a restart is to read it back through the
+        // same store the next process boot will use.
+        const persistedAuthToken = await this.credentialStore.get('line_auth_token');
+        const persistedMid = await this.credentialStore.get('line_mid');
+        if (!persistedAuthToken || !persistedMid) {
+            throw new Error(`LineSessionState.initializeFromLogin: login succeeded but session did not persist ` +
+                `(line_auth_token=${persistedAuthToken ? 'present' : 'MISSING'}, ` +
+                `line_mid=${persistedMid ? 'present' : 'MISSING'}). ` +
+                'The next restart would require a fresh phone-PIN login.');
+        }
+        if (this.client) {
+            this.bindClient(this.client);
+        }
+    }
+    /**
+     * Apply a refreshed auth token result to the session.
+     * @param refreshResult - Refresh payload containing a new auth token
+     * @returns Promise that resolves when the new token is persisted
+     */
+    async applyRefreshResult(refreshResult) {
+        this.authToken = refreshResult.authToken;
+        this.tokenIssueTimeEpochSec =
+            refreshResult.tokenIssueTimeEpochSec ?? this.tokenIssueTimeEpochSec;
+        this.durationUntilRefreshInSec =
+            refreshResult.durationUntilRefreshInSec ?? this.durationUntilRefreshInSec;
+        await this.credentialStore.set('line_auth_token', refreshResult.authToken);
+        if (refreshResult.tokenIssueTimeEpochSec != null) {
+            await this.credentialStore.set('line_token_issue_time_epoch_sec', String(refreshResult.tokenIssueTimeEpochSec));
+        }
+        if (refreshResult.durationUntilRefreshInSec != null) {
+            await this.credentialStore.set('line_token_duration_until_refresh_sec', String(refreshResult.durationUntilRefreshInSec));
+        }
+        if (this.client) {
+            this.client.authToken = refreshResult.authToken;
+        }
+    }
+    /**
+     * Apply an auth token observed at runtime, such as token rotation.
+     * @param authToken - Latest auth token
+     * @returns Promise that resolves when the token is persisted
+     */
+    async applyRuntimeToken(authToken) {
+        this.authToken = authToken;
+        await this.credentialStore.set('line_auth_token', authToken);
+        if (this.client) {
+            this.client.authToken = authToken;
+        }
+    }
+    /**
+     * Persist the latest LINE sync revisions.
+     * @param revision - Main operation revision
+     * @param globalRevision - Global sync revision
+     * @param individualRevision - Individual sync revision
+     * @returns Promise that resolves when revisions are persisted
+     */
+    async setRevisions(revision, globalRevision, individualRevision) {
+        this.revision = revision;
+        await this.credentialStore.set('line_revision', String(revision));
+        if (globalRevision != null) {
+            this.globalRevision = globalRevision;
+            await this.credentialStore.set('line_global_revision', String(globalRevision));
+        }
+        if (individualRevision != null) {
+            this.individualRevision = individualRevision;
+            await this.credentialStore.set('line_individual_revision', String(individualRevision));
+        }
+        if (this.client) {
+            this.client.revision = revision;
+            this.client.globalRevision = this.globalRevision;
+            this.client.individualRevision = this.individualRevision;
+        }
+    }
+    /**
+     * Persist decrypted E2EE self keys for future session restore.
+     * @param keys - Decrypted E2EE self keys
+     * @returns Promise that resolves when keys are persisted
+     */
+    async saveE2EEKeys(keys) {
+        // Only the `line_e2ee_keys` blob is ever read back (auth-session-runtime
+        // restore). The former per-keyId and per-mid entries had no reader, so they
+        // only churned the OS keychain and emitted one store-complete debug log per
+        // key on every login/token refresh — dropped.
+        await this.credentialStore.set('line_e2ee_keys', JSON.stringify(keys));
+    }
+    /**
+     * Load persisted recent-fetch checkpoints for warm history planning.
+     *
+     * @returns Recent fetch checkpoint map.
+     */
+    async loadRecentFetchState() {
+        const raw = await this.credentialStore.get('line_recent_fetch_state');
+        if (!raw) {
+            return new Map();
+        }
+        try {
+            const parsed = JSON.parse(raw);
+            const entries = Object.entries(parsed || {}).map(([chatId, state]) => [
+                chatId,
+                {
+                    lastCheckedAt: Number(state?.lastCheckedAt || 0),
+                    lastDeliveredMessageId: state?.lastDeliveredMessageId
+                        ? String(state.lastDeliveredMessageId)
+                        : null,
+                    lastDeliveredTime: Number(state?.lastDeliveredTime || 0),
+                },
+            ]);
+            return new Map(entries);
+        }
+        catch {
+            return new Map();
+        }
+    }
+    /**
+     * Persist recent-fetch checkpoints for warm history planning.
+     *
+     * @param recentFetchState - Current recent fetch checkpoint map.
+     * @returns Promise that resolves when checkpoints are persisted.
+     */
+    async saveRecentFetchState(recentFetchState) {
+        const payload = Object.fromEntries(Array.from(recentFetchState.entries())
+            .sort((left, right) => right[1].lastCheckedAt - left[1].lastCheckedAt)
+            .slice(0, 500));
+        await this.credentialStore.set('line_recent_fetch_state', JSON.stringify(payload));
+    }
+    /**
+     * Clear auth credentials for the current LINE session.
+     *
+     * This intentionally preserves non-auth LINE state such as saved phone,
+     * E2EE key material, peer/group key caches, and recent-fetch checkpoints.
+     * Those fields may belong to a freshly logged-in sibling process or be useful
+     * for in-session E2EE recovery after a token failure.
+     *
+     * @returns Promise that resolves when credentials are removed
+     */
+    async clearAuth() {
+        this.authToken = null;
+        this.refreshToken = null;
+        this.tokenIssueTimeEpochSec = null;
+        this.durationUntilRefreshInSec = null;
+        this.mid = null;
+        this.revision = -1;
+        this.globalRevision = 0;
+        this.individualRevision = 0;
+        await this.credentialStore.delete('line_auth_token');
+        await this.credentialStore.delete('line_refresh_token');
+        await this.credentialStore.delete('line_token_issue_time_epoch_sec');
+        await this.credentialStore.delete('line_token_duration_until_refresh_sec');
+        await this.credentialStore.delete('line_revision');
+        await this.credentialStore.delete('line_global_revision');
+        await this.credentialStore.delete('line_individual_revision');
+    }
+}

package/dist/line/core/session-state/persist.js

@@ -0,0 +1,192 @@
+/**
+ * Persistence helpers for LINE session state.
+ * Read/write individual credential fields from the credential store.
+ */
+import { Buffer } from 'node:buffer';
+import { createCliLogger } from '../../../util/log.js';
+import { extractE2EEInfo } from '../../auth/protocol/login-metadata.js';
+const persistLog = createCliLogger('SESSION-PERSIST');
+/**
+ * Normalize binary credential values before persistence.
+ * @param value - Raw credential value.
+ * @returns Persistable string value.
+ */
+export function toPersistedKeyValue(value) {
+    if (!value) {
+        return null;
+    }
+    return Buffer.isBuffer(value) ? value.toString('base64') : String(value);
+}
+/**
+ * Parse an optional numeric credential value.
+ * @param value - Raw persisted value.
+ * @param fallback - Fallback when the value is missing.
+ * @returns Parsed number or fallback.
+ */
+export function parseStoredNumber(value, fallback) {
+    return value ? Number(value) : fallback;
+}
+/**
+ * Extract persisted token/revision fields from the credential store.
+ * @param credentialStore - Persistent LINE credential store.
+ * @returns Hydrated session fields.
+ */
+export async function loadStoredSessionFields(credentialStore) {
+    const authToken = await credentialStore.get('line_auth_token');
+    const refreshToken = await credentialStore.get('line_refresh_token');
+    const mid = await credentialStore.get('line_mid');
+    const tokenIssueTimeEpochSec = await credentialStore.get('line_token_issue_time_epoch_sec');
+    const durationUntilRefreshInSec = await credentialStore.get('line_token_duration_until_refresh_sec');
+    const revision = await credentialStore.get('line_revision');
+    const globalRevision = await credentialStore.get('line_global_revision');
+    const individualRevision = await credentialStore.get('line_individual_revision');
+    return {
+        authToken,
+        refreshToken,
+        mid,
+        tokenIssueTimeEpochSec,
+        durationUntilRefreshInSec,
+        revision,
+        globalRevision,
+        individualRevision,
+    };
+}
+/**
+ * Persist LINE auth/session fields provided by a fresh login result.
+ *
+ * `authToken` is never optional: a login result without it is not a
+ * usable session, so it throws instead of writing a half-persisted
+ * credential set. The other fields are genuinely optional (a field the
+ * LINE login response legitimately omits must not throw), but every
+ * call logs exactly which keys were written and which were skipped so
+ * an unexpected omission is visible immediately instead of surfacing as
+ * "session lost" three hours later.
+ *
+ * @param credentialStore - Persistent LINE credential store.
+ * @param loginResult - Login payload returned by the auth flow.
+ */
+export async function persistLoginCredentials(credentialStore, loginResult) {
+    if (!loginResult.authToken) {
+        throw new Error('persistLoginCredentials: loginResult.authToken is missing — cannot persist a session without an auth token');
+    }
+    const written = [];
+    const skipped = [];
+    await credentialStore.set('line_auth_token', loginResult.authToken);
+    written.push('line_auth_token');
+    if (loginResult.refreshToken) {
+        await credentialStore.set('line_refresh_token', loginResult.refreshToken);
+        written.push('line_refresh_token');
+    }
+    else {
+        skipped.push('line_refresh_token');
+    }
+    if (loginResult.certificate) {
+        await credentialStore.set('line_certificate', loginResult.certificate);
+        written.push('line_certificate');
+    }
+    else {
+        skipped.push('line_certificate');
+    }
+    if (loginResult.mid) {
+        await credentialStore.set('line_mid', loginResult.mid);
+        written.push('line_mid');
+    }
+    else {
+        skipped.push('line_mid');
+    }
+    if (loginResult.tokenIssueTimeEpochSec != null) {
+        await credentialStore.set('line_token_issue_time_epoch_sec', String(loginResult.tokenIssueTimeEpochSec));
+        written.push('line_token_issue_time_epoch_sec');
+    }
+    else {
+        skipped.push('line_token_issue_time_epoch_sec');
+    }
+    if (loginResult.durationUntilRefreshInSec != null) {
+        await credentialStore.set('line_token_duration_until_refresh_sec', String(loginResult.durationUntilRefreshInSec));
+        written.push('line_token_duration_until_refresh_sec');
+    }
+    else {
+        skipped.push('line_token_duration_until_refresh_sec');
+    }
+    persistLog.info('login-credentials-persisted', {
+        written: written.join(','),
+        skipped: skipped.join(',') || 'none',
+    });
+}
+/**
+ * Persist LINE NaCl/E2EE bootstrap credentials when present.
+ *
+ * All three fields are optional here (a fresh login may or may not carry
+ * new crypto bootstrap material), so a missing field never throws — but
+ * every call logs exactly which keys were written and which were skipped.
+ *
+ * @param credentialStore - Persistent LINE credential store.
+ * @param loginResult - Login payload returned by the auth flow.
+ */
+export async function persistLoginCryptoMaterial(credentialStore, loginResult) {
+    const secretKey = toPersistedKeyValue(loginResult.secretKey);
+    const publicKey = toPersistedKeyValue(loginResult.publicKey);
+    const written = [];
+    const skipped = [];
+    if (secretKey) {
+        await credentialStore.set('line_nacl_secret_key', secretKey);
+        written.push('line_nacl_secret_key');
+    }
+    else {
+        skipped.push('line_nacl_secret_key');
+    }
+    if (publicKey) {
+        await credentialStore.set('line_nacl_public_key', publicKey);
+        written.push('line_nacl_public_key');
+    }
+    else {
+        skipped.push('line_nacl_public_key');
+    }
+    if (loginResult.nonce) {
+        await credentialStore.set('line_nonce', loginResult.nonce);
+        written.push('line_nonce');
+    }
+    else {
+        skipped.push('line_nonce');
+    }
+    persistLog.info('login-crypto-material-persisted', {
+        written: written.join(',') || 'none',
+        skipped: skipped.join(',') || 'none',
+    });
+}
+/**
+ * Persist the E2EE bootstrap payload extracted from login metadata.
+ *
+ * This field is optional (a login result may carry no E2EE bootstrap
+ * metadata at all — e.g. a device that already has keys), so a missing
+ * field never throws — but every call logs whether the key was written
+ * or skipped, and why, so an unexpected omission is visible immediately.
+ *
+ * @param credentialStore - Persistent LINE credential store.
+ * @param loginResult - Login payload returned by the auth flow.
+ */
+export async function persistLoginBootstrap(credentialStore, loginResult) {
+    const e2eeInfo = extractE2EEInfo(loginResult.e2eeInfo || loginResult.metaData || null);
+    const secretKey = toPersistedKeyValue(loginResult.secretKey);
+    if (!e2eeInfo?.encryptedKeyChain ||
+        !e2eeInfo?.serverPublicKey ||
+        !secretKey) {
+        persistLog.info('login-bootstrap-persisted', {
+            written: 'none',
+            skipped: 'line_e2ee_bootstrap',
+            reason: 'no encryptedKeyChain/serverPublicKey/secretKey in login result',
+        });
+        return;
+    }
+    await credentialStore.set('line_e2ee_bootstrap', JSON.stringify({
+        encryptedKeyChain: e2eeInfo.encryptedKeyChain.toString('base64'),
+        secretKey,
+        serverPublicKey: e2eeInfo.serverPublicKey.toString('base64'),
+        keyId: e2eeInfo.keyId,
+        e2eeVersion: e2eeInfo.e2eeVersion,
+    }));
+    persistLog.info('login-bootstrap-persisted', {
+        written: 'line_e2ee_bootstrap',
+        skipped: 'none',
+    });
+}

package/dist/line/core/store.js

@@ -0,0 +1,8 @@
+/**
+ * LINE Credential Stores — re-exports
+ *
+ * Both stores live in Yomi's vendored auth/credential-store module.
+ * This module re-exports them under their original names for
+ * compatibility with the LINE protocol core.
+ */
+export { CredentialStore as FileCredentialStore, InMemoryStore, } from '../../auth/credential-store.js';