@rikaidev/yomi 0.2.6

package/dist/cli/login.js

@@ -0,0 +1,142 @@
+/**
+ * Shared LINE passwordless-login core, plus the TTY front-end for it.
+ *
+ * `runPwlessLogin` is the ONE login sequence: subscribe to `pinCreated`/
+ * `waitingForBiometric`, drive `service.startPwlessLogin`, unsubscribe in a
+ * `finally`, and persist the phone/region that succeeded. Every front-end
+ * calls it — the MCP `login`/`login_complete` tools (see
+ * ../mcp/handlers-login.ts; surfaces the PIN via elicitation on clients
+ * that support it, or as a tool-result string with a follow-up
+ * `login_complete` call on clients that don't) and `cliLogin` below
+ * (surfaces the PIN on stdout, for the guaranteed-to-work `npx @rikaidev/yomi
+ * login` path that needs no MCP client at all). No front-end duplicates
+ * the sequence itself.
+ */
+import readline from 'node:readline/promises';
+import { LineProtocolService } from '../line/core/service.js';
+/**
+ * Drive the passwordless (secondary-device) LINE login flow to completion.
+ *
+ * This is the single login sequence shared by every front-end — do not
+ * re-subscribe to `pinCreated`/`waitingForBiometric` or call
+ * `service.startPwlessLogin` anywhere else.
+ *
+ * @param service - LineProtocolService (not yet authenticated).
+ * @param phone - Phone number in E.164 form.
+ * @param region - Region code (e.g. TW, JP).
+ * @param hooks - Front-end callbacks for surfacing the PIN/biometric wait.
+ * @returns The resulting profile identity.
+ */
+export async function runPwlessLogin(service, phone, region, hooks) {
+    const onBiometric = () => hooks.onWaitingBiometric?.();
+    service.on('pinCreated', hooks.onPin);
+    service.on('waitingForBiometric', onBiometric);
+    try {
+        await service.startPwlessLogin(phone, region);
+        const profile = service.profile ?? null;
+        // Persist phone/region once, here in the shared core, so every
+        // front-end's next login is argument-free (and the phone number stops
+        // appearing in the tool-call transcript).
+        await service.credentialStore?.set?.('line_phone', phone);
+        await service.credentialStore?.set?.('line_region', region);
+        return {
+            mid: profile?.mid ?? null,
+            displayName: profile?.displayName ?? null,
+        };
+    }
+    finally {
+        service.off('pinCreated', hooks.onPin);
+        service.off('waitingForBiometric', onBiometric);
+    }
+}
+/**
+ * Prompt on stdin for a value when it was not supplied on the command line.
+ *
+ * @param rl - Open readline interface.
+ * @param label - Prompt label.
+ * @returns Trimmed user input.
+ */
+async function promptFor(rl, label) {
+    const answer = await rl.question(`${label}: `);
+    return answer.trim();
+}
+/**
+ * Parse `--phone`/`--region` flags out of CLI args.
+ *
+ * @param argv - Arguments following `login`.
+ * @returns Parsed phone/region (undefined when not supplied).
+ */
+function parseLoginArgs(argv) {
+    let phone;
+    let region;
+    for (let i = 0; i < argv.length; i++) {
+        if (argv[i] === '--phone') {
+            phone = argv[i + 1];
+            i++;
+        }
+        else if (argv[i] === '--region') {
+            region = argv[i + 1];
+            i++;
+        }
+    }
+    return { phone, region };
+}
+/**
+ * TTY front-end: `npx @rikaidev/yomi login [--phone +886...] [--region TW]`.
+ *
+ * Prints the PIN prominently to stdout (not stderr — there is no MCP
+ * client here to hide it from). Falls back to a previously persisted
+ * `line_phone`/`line_region` when the corresponding flag is absent, and
+ * only prompts on stdin for whatever is still missing after that. Blocks
+ * until the flow completes.
+ *
+ * @param argv - Arguments following `login` on the command line.
+ * @returns Process exit code (0 on success).
+ */
+export async function cliLogin(argv) {
+    const parsed = parseLoginArgs(argv);
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout,
+    });
+    const service = new LineProtocolService();
+    // A Node EventEmitter with zero 'error' listeners turns any emit('error')
+    // into an uncaught exception that kills this process (see pwless-login-flow.ts,
+    // auth-session-service.ts). This listener must exist for the lifetime of the
+    // service so a login/session error surfaces as a log line, not a crash — the
+    // real failure still reaches this function through the normal throw/rejection path.
+    service.on('error', (error) => console.error(`[Yomi] service error: ${error?.message ?? String(error)}`));
+    try {
+        const phone = parsed.phone ||
+            (await service.credentialStore?.get?.('line_phone')) ||
+            (await promptFor(rl, 'LINE phone number (E.164, e.g. +8869XXXXXXXX)'));
+        const region = parsed.region ||
+            (await service.credentialStore?.get?.('line_region')) ||
+            (await promptFor(rl, 'Region code (e.g. TW, JP, TH, ID, US)'));
+        if (!phone || !region) {
+            console.error('[Yomi] phone and region are required.');
+            return 1;
+        }
+        console.log('[Yomi] Starting passwordless login. Enter the PIN on your primary phone within ' +
+            "about 3 minutes of it appearing — that is LINE's own deadline; this CLI itself will keep " +
+            'waiting well beyond that.');
+        const result = await runPwlessLogin(service, phone, region, {
+            onPin: (pin) => {
+                console.log(`[Yomi] PIN: ${pin}`);
+                console.log('[Yomi] Enter this PIN in the LINE app on your primary phone, then approve the new device.');
+            },
+            onWaitingBiometric: () => {
+                console.log('[Yomi] Waiting for you to approve the new device on your phone...');
+            },
+        });
+        console.log(`[Yomi] Login successful. mid=${result.mid ?? 'unknown'} displayName=${result.displayName ?? 'unknown'}`);
+        return 0;
+    }
+    catch (error) {
+        console.error(`[Yomi] Login failed: ${error?.message ?? String(error)}`);
+        return 1;
+    }
+    finally {
+        rl.close();
+    }
+}

package/dist/line/auth/protocol/e2ee-bootstrap.js

@@ -0,0 +1,87 @@
+import { decryptKeyChain } from '../../core/e2ee/index.js';
+/**
+ * Resolve the active LINE logger.
+ *
+ * @param service - LINE protocol service instance.
+ * @returns Logger-like object.
+ */
+function getLineLog(service) {
+    return service?.startupFlowLogger || service?.logger || console;
+}
+/**
+ * Build a missing-bootstrap result and emit the matching warning.
+ *
+ * @param service - LINE protocol service instance.
+ * @param loginResult - Login result.
+ * @param e2eeInfo - Normalized E2EE info.
+ * @returns Failed bootstrap result.
+ */
+function buildMissingBootstrapResult(service, loginResult, e2eeInfo) {
+    const reason = 'missing_login_e2ee_bootstrap';
+    getLineLog(service).warn?.('e2ee.init.skipped', {
+        has_keychain: Boolean(e2eeInfo?.encryptedKeyChain),
+        has_secret_key: Boolean(loginResult.secretKey),
+        has_server_public_key: Boolean(e2eeInfo?.serverPublicKey),
+        reason,
+    });
+    service.e2eeWarning = true;
+    service.emit?.('e2eeWarning', { active: true, reason });
+    return { keyCount: 0, reason, success: false };
+}
+/**
+ * Import decoded self keys into the active service.
+ *
+ * @param service - LINE protocol service instance.
+ * @param loginResult - Login result.
+ * @param keys - Decoded self keys.
+ */
+async function applyDecodedKeys(service, loginResult, keys) {
+    service.e2eeManager.importKeys(keys);
+    if (loginResult.mid) {
+        service.e2eeManager.bindSelfKeysToMid(loginResult.mid);
+    }
+    await service.sessionState.saveE2EEKeys(keys);
+    service.e2eeWarning = false;
+    service.emit?.('e2eeWarning', { active: false, reason: null });
+}
+/**
+ * Initializes end-to-end encryption with login credentials.
+ *
+ * @param service - The LINE protocol service instance
+ * @param loginResult - The login result containing encryption keys
+ * @returns E2EE bootstrap result
+ */
+export async function initE2EE(service, loginResult) {
+    const lineLog = getLineLog(service);
+    const e2eeInfo = loginResult.e2eeInfo || null;
+    if (!e2eeInfo?.encryptedKeyChain ||
+        !e2eeInfo?.serverPublicKey ||
+        !loginResult.secretKey) {
+        return buildMissingBootstrapResult(service, loginResult, e2eeInfo);
+    }
+    try {
+        // This step only imports self keys delivered during login. It is allowed to fail
+        // without invalidating the just-issued auth token. Message decryption during scan
+        // and polling uses additional peer/group material and can still fail later even
+        // when this bootstrap succeeds, so callers must treat E2EE bootstrap and login
+        // validation as separate failure domains.
+        const keys = decryptKeyChain(e2eeInfo.encryptedKeyChain, e2eeInfo.serverPublicKey, loginResult.secretKey).map((key) => ({
+            ...key,
+            mid: loginResult.mid || null,
+        }));
+        await applyDecodedKeys(service, loginResult, keys);
+        lineLog.info?.('e2ee.init.complete', {
+            key_count: keys.length,
+            key_id: e2eeInfo.keyId ?? null,
+            version: e2eeInfo.e2eeVersion ?? null,
+        });
+        return { keyCount: keys.length, reason: null, success: keys.length > 0 };
+    }
+    catch (e) {
+        const reason = 'keychain_decrypt_failed';
+        lineLog.warn?.('e2ee.init.failed', { error: e?.message, reason });
+        service.e2eeWarning = true;
+        service.emit?.('e2eeWarning', { active: true, reason });
+        return { keyCount: 0, reason, success: false };
+    }
+}

package/dist/line/auth/protocol/index.js

@@ -0,0 +1,3 @@
+export { initE2EE } from './e2ee-bootstrap.js';
+export { extractE2EEInfo } from './login-metadata.js';
+export { performPwlessLogin } from './pwless-login-flow.js';

package/dist/line/auth/protocol/login-metadata.js

@@ -0,0 +1,159 @@
+import { Buffer } from 'node:buffer';
+/**
+ * Decode a base64-encoded value into a Buffer when present.
+ *
+ * @param value - Buffer or base64 string from a login response.
+ * @returns Decoded Buffer or null.
+ */
+function decodeMaybeBase64(value) {
+    if (!value) {
+        return null;
+    }
+    if (Buffer.isBuffer(value)) {
+        return value;
+    }
+    if (typeof value === 'string') {
+        return Buffer.from(value, 'base64');
+    }
+    return null;
+}
+/**
+ * Convert a mixed login metadata value into a number when possible.
+ *
+ * @param value - Raw numeric value or numeric string.
+ * @returns Parsed number or null.
+ */
+function toMaybeNumber(value) {
+    if (typeof value === 'number' && Number.isFinite(value)) {
+        return value;
+    }
+    if (typeof value === 'string' && value.trim() !== '') {
+        const parsed = Number(value);
+        return Number.isFinite(parsed) ? parsed : null;
+    }
+    return null;
+}
+/**
+ * Resolve the metadata payload from a raw login response.
+ *
+ * @param raw - Raw login response or nested E2EE payload.
+ * @returns Metadata object or null.
+ */
+function resolveE2EEMetadata(raw) {
+    if (!raw || typeof raw !== 'object') {
+        return null;
+    }
+    const nested = raw.metadata || raw.metaData || raw[10]?.metadata || raw[10]?.metaData;
+    if (nested && typeof nested === 'object') {
+        return nested;
+    }
+    return raw;
+}
+/**
+ * Check whether a metadata object has the minimum E2EE bootstrap fields.
+ *
+ * @param metadata - Metadata candidate.
+ * @returns Whether the candidate carries keychain and public key.
+ */
+function hasE2EEBootstrapFields(metadata) {
+    return Boolean(metadata &&
+        typeof metadata === 'object' &&
+        (metadata.encryptedKeyChain || metadata[6] || metadata[3]) &&
+        (metadata.serverPublicKey || metadata.publicKey || metadata[4]));
+}
+/**
+ * Search child object values for a nested E2EE payload.
+ *
+ * @param metadata - Metadata object.
+ * @param depth - Remaining search depth.
+ * @returns Payload-like object or null.
+ */
+function findNestedE2EEMetadata(metadata, depth) {
+    for (const child of Object.values(metadata)) {
+        if (child && typeof child === 'object') {
+            const found = findE2EEMetadata(child, depth - 1);
+            if (found && hasE2EEBootstrapFields(found)) {
+                return found;
+            }
+        }
+    }
+    return null;
+}
+/**
+ * Recursively find a nested E2EE payload.
+ *
+ * @param value - Candidate payload.
+ * @param depth - Remaining search depth.
+ * @returns Payload-like object or null.
+ */
+function findE2EEMetadata(value, depth = 3) {
+    const metadata = resolveE2EEMetadata(value);
+    if (!metadata || typeof metadata !== 'object' || depth < 0) {
+        return null;
+    }
+    if (hasE2EEBootstrapFields(metadata)) {
+        return metadata;
+    }
+    return findNestedE2EEMetadata(metadata, depth) || metadata;
+}
+/**
+ * Resolve the encrypted keychain field from known LINE metadata shapes.
+ *
+ * @param metadata - E2EE metadata payload.
+ * @returns Encrypted keychain value.
+ */
+function getEncryptedKeyChainField(metadata) {
+    return metadata.encryptedKeyChain || metadata[6] || metadata[3] || null;
+}
+/**
+ * Resolve the server public key field from known LINE metadata shapes.
+ *
+ * @param metadata - E2EE metadata payload.
+ * @returns Server public key value.
+ */
+function getServerPublicKeyField(metadata) {
+    return metadata.serverPublicKey || metadata.publicKey || metadata[4] || null;
+}
+/**
+ * Resolve the E2EE key id field from known LINE metadata shapes.
+ *
+ * @param metadata - E2EE metadata payload.
+ * @returns Key id value.
+ */
+function getKeyIdField(metadata) {
+    return metadata.keyId || metadata.e2EEPublicKeyId || metadata[2] || null;
+}
+/**
+ * Resolve the E2EE version field from known LINE metadata shapes.
+ *
+ * @param metadata - E2EE metadata payload.
+ * @returns Version value.
+ */
+function getE2EEVersionField(metadata) {
+    return metadata.e2eeVersion || metadata.version || metadata[1] || null;
+}
+/**
+ * Normalize LINE login E2EE metadata into a common structure.
+ *
+ * @param raw - Raw E2EE metadata struct from LINE login APIs.
+ * @returns Normalized encrypted keychain payload or null when incomplete.
+ */
+export function extractE2EEInfo(raw) {
+    const metadata = findE2EEMetadata(raw);
+    if (!metadata) {
+        return null;
+    }
+    const encryptedKeyChain = decodeMaybeBase64(getEncryptedKeyChainField(metadata));
+    const serverPublicKey = decodeMaybeBase64(getServerPublicKeyField(metadata));
+    const keyId = toMaybeNumber(getKeyIdField(metadata));
+    const e2eeVersion = toMaybeNumber(getE2EEVersionField(metadata));
+    if (!encryptedKeyChain || !serverPublicKey) {
+        return null;
+    }
+    return {
+        encryptedKeyChain,
+        serverPublicKey,
+        keyId,
+        e2eeVersion,
+    };
+}

package/dist/line/auth/protocol/pwless-login-flow.js

@@ -0,0 +1,83 @@
+import { LineClient } from '../../client/index.js';
+import { LinePwlessLogin } from '../pwless/index.js';
+import { initE2EE } from './e2ee-bootstrap.js';
+/**
+ * Perform passwordless login and initialize the service client.
+ *
+ * @param service - The LINE protocol service instance
+ * @param phone - E.164 phone number
+ * @param region - Region code (TW, JP)
+ * @param loggingInState - State to set during login
+ * @param connectedState - State to set on successful login
+ * @param errorState - State to set on login failure
+ * @returns Promise resolving to login result
+ */
+export async function performPwlessLogin(service, phone, region, loggingInState, connectedState, errorState) {
+    // Never write login progress to stdout: under the MCP stdio transport
+    // stdout IS the JSON-RPC channel, and this login path runs inside the MCP
+    // server. Route through the service logger, which writes to stderr.
+    const log = service.startupFlowLogger ?? service.logger;
+    service.setState(loggingInState);
+    service.pwlessLogin = new LinePwlessLogin(service.config);
+    for (const evt of [
+        'pinCreated',
+        'waitingForBiometric',
+        'biometricVerified',
+        'error',
+    ]) {
+        service.pwlessLogin.on(evt, (...args) => service.emit(evt, ...args));
+    }
+    try {
+        const savedCert = await service.credentialStore.get('line_certificate');
+        const result = await service.pwlessLogin.login(phone, region, savedCert || undefined);
+        log?.info?.('login.ok', {
+            refreshToken: result.refreshToken ? 'yes' : 'no',
+        });
+        service.client = new LineClient(result.authToken, {
+            ...service.config,
+            logger: service.logger,
+            startupFlowLogger: service.startupFlowLogger,
+        });
+        // `service.client` is its own EventEmitter (see sync-service/client.ts's
+        // `runtime.emit('error', ...)` in the poll loop) — a zero-listener 'error'
+        // emit there throws uncaught and kills the process just like on `service`
+        // itself. Attach here, at construction, for the client's lifetime.
+        service.client.on('error', (error) => {
+            const message = error?.message ?? String(error);
+            if (service.startupFlowLogger?.warn) {
+                service.startupFlowLogger.warn('client.error', { error: message });
+            }
+            else {
+                // stderr, not stdout — stdout is the MCP JSON-RPC channel.
+                console.error(`[LINE] client error: ${message}`);
+            }
+        });
+        service.sessionState.bindClient(service.client);
+        await service.sessionState.initializeFromLogin(result);
+        // Keep login on one auth boundary: one persisted login result,
+        // one E2EE bootstrap, one getProfile validation.
+        // Any later per-message E2EE failures are runtime content issues, not a reason
+        // to mutate auth state, refresh tokens aggressively, or mark the login invalid.
+        const e2eeBootstrap = await initE2EE(service, result);
+        if (!e2eeBootstrap.success) {
+            service.startupFlowLogger?.warn?.('session.login_e2ee_unavailable', {
+                reason: e2eeBootstrap.reason,
+            });
+        }
+        service.profile = await service.client.getProfile();
+        // Display name only — do not print the mid alongside it.
+        log?.info?.('profile.ok', {
+            displayName: service.profile?.displayName ?? null,
+        });
+        service.loginRequired = false;
+        service.loginReason = null;
+        service.setState(connectedState);
+        service.emit('loginComplete', { profile: service.profile });
+        return result;
+    }
+    catch (err) {
+        service.setState(errorState);
+        service.emit('error', err);
+        throw err;
+    }
+}

package/dist/line/auth/pwless/index.js

@@ -0,0 +1,163 @@
+/**
+ * LINE Passwordless Login — Orchestrator
+ *
+ * Flow:
+ *   1. createSession(phone, region) → sessionId
+ *   2. verifyLoginCertificate → skip PIN if cert valid
+ *   3. requestPinCodeVerif → PIN displayed to user
+ *   4. checkPinCodeVerified → long-poll wait
+ *   5. putExchangeKey → NaCl X25519 key exchange
+ *   6. requestPaakAuth + checkPaakAuthenticated → biometric
+ *   7. loginV2 → authToken + certificate + mid
+ */
+import { Buffer } from 'node:buffer';
+import { EventEmitter } from 'node:events';
+import nacl from 'tweetnacl';
+import { sendRequest } from '../../client/transport.js';
+import { LINE_APP_CONFIG } from '../../core/config.js';
+import { extractE2EEInfo } from '../protocol/login-metadata.js';
+import { checkPaakAuthenticated, checkPinCodeVerified, createSession, getE2eeKey, loginV2, PAAK_AUTH_POLL_ATTEMPTS, PIN_VERIFY_POLL_ATTEMPTS, putExchangeKey, requestPaakAuth, requestPinCodeVerif, verifyLoginCertificate, } from './steps.js';
+/**
+ * How long a single long-poll hop is bounded to before LINE's long-poll
+ * endpoint returns (or times out). This is NOT the human's window for
+ * anything — `checkPinCodeVerified`/`checkPaakAuthenticated` each retry this
+ * many times in a loop (see steps.ts), so the real client-side ceiling for
+ * each step is this value multiplied by that step's attempt count — see
+ * `PIN_VERIFY_CLIENT_CEILING_MS` / `PAAK_AUTH_CLIENT_CEILING_MS` below.
+ */
+export const PWLESS_POLL_TIMEOUT_MS = 65000;
+/**
+ * Real client-side ceiling for the PIN-verification long-poll loop: how long
+ * yomi keeps waiting for the human to enter the PIN before giving up.
+ * Derived, not hardcoded — `PWLESS_POLL_TIMEOUT_MS × PIN_VERIFY_POLL_ATTEMPTS`
+ * = 65000 × 15 ≈ 16 minutes.
+ */
+export const PIN_VERIFY_CLIENT_CEILING_MS = PWLESS_POLL_TIMEOUT_MS * PIN_VERIFY_POLL_ATTEMPTS;
+/**
+ * Real client-side ceiling for the PAAK (device-approval) long-poll loop: how
+ * long yomi keeps waiting for the human to approve the new device before
+ * giving up. Derived, not hardcoded —
+ * `PWLESS_POLL_TIMEOUT_MS × PAAK_AUTH_POLL_ATTEMPTS` = 65000 × 12 ≈ 13 minutes.
+ */
+export const PAAK_AUTH_CLIENT_CEILING_MS = PWLESS_POLL_TIMEOUT_MS * PAAK_AUTH_POLL_ATTEMPTS;
+/**
+ * LINE's own server-side lifetime for a passwordless login code: the human
+ * must enter the code and confirm the device on the primary phone within 3
+ * minutes of the code being displayed, or the code is dead — regardless of
+ * how long yomi itself is still willing to poll.
+ *
+ * This is an EXTERNAL FACT, not derived from any of our code or protocol
+ * traffic. Source: LINE Help Center (zh-Hant),
+ * https://help.line.me/line/IOSSecondary/?contentId=20018574&lang=zh-Hant
+ * — on the primary device, tick the device signing in and tap 「用戶確認」
+ * within 3 minutes of the code being displayed.
+ */
+export const LINE_PIN_CODE_LIFETIME_MS = 3 * 60 * 1000;
+const DEFAULT_CONFIG = {
+    ...LINE_APP_CONFIG,
+    pollTimeout: PWLESS_POLL_TIMEOUT_MS,
+};
+/**
+ * Handles the LINE passwordless login flow.
+ * Emits events: session, pinCreated, waitingForBiometric, loginComplete, error
+ */
+export class LinePwlessLogin extends EventEmitter {
+    config;
+    sessionId;
+    secretKey;
+    publicKey;
+    certificate;
+    aborted;
+    seq;
+    constructor(config = {}) {
+        super();
+        this.config = { ...DEFAULT_CONFIG, ...config };
+        this.sessionId = null;
+        this.secretKey = null;
+        this.publicKey = null;
+        this.certificate = null;
+        this.aborted = false;
+        this.seq = 1;
+    }
+    /**
+     * Abort the login process.
+     */
+    abort() {
+        this.aborted = true;
+        this.emit('abort');
+    }
+    /**
+     * Run the full pwless login flow.
+     *
+     * @param phone - E.164 phone number
+     * @param region - Region code (TW, JP, etc.)
+     * @param savedCertificate - Previously saved certificate for skip-PIN
+     * @returns Login result with authToken and credentials
+     */
+    async login(phone, region, savedCertificate) {
+        this.aborted = false;
+        this.certificate = savedCertificate || null;
+        // Step 1: Create session
+        this.sessionId = await createSession(this, phone, region);
+        this.emit('session', this.sessionId);
+        // Step 2: Check certificate
+        const certOk = await verifyLoginCertificate(this, this.certificate || '');
+        // Step 3: PIN verification (if cert invalid)
+        if (!certOk) {
+            const pin = await requestPinCodeVerif(this);
+            this.emit('pinCreated', pin);
+            if (!(await checkPinCodeVerified(this))) {
+                throw new Error('PIN verification failed or timed out');
+            }
+            this.emit('pinVerified');
+        }
+        else {
+            this.emit('certificateVerified');
+        }
+        // Step 4: E2EE key exchange
+        const kp = nacl.box.keyPair();
+        this.secretKey = Buffer.from(kp.secretKey);
+        this.publicKey = Buffer.from(kp.publicKey);
+        await putExchangeKey(this, this.publicKey.toString('base64'));
+        // Step 5-6: PAAK (biometric) authentication
+        await requestPaakAuth(this);
+        this.emit('waitingForBiometric');
+        if (!(await checkPaakAuthenticated(this))) {
+            console.warn('[LINE] PAAK not confirmed, attempting login anyway');
+        }
+        else {
+            this.emit('biometricVerified');
+        }
+        // Step 7: Retrieve E2EE key (required to complete session)
+        const e2eeKeyResult = await getE2eeKey(this);
+        // Step 8: Final login
+        const loginResult = await loginV2(this, this.config.systemName);
+        const result = {
+            ...loginResult,
+            secretKey: this.secretKey,
+            publicKey: this.publicKey,
+            e2eeKeyChain: e2eeKeyResult?.encryptedKeyChain ?? null,
+            e2eeInfo: extractE2EEInfo(e2eeKeyResult),
+            nonce: null,
+        };
+        this.emit('loginComplete', result);
+        return result;
+    }
+    // ─── Transport (used by steps via PwlessContext interface) ─────
+    /**
+     * Send a pwless request.
+     * @param data - TCompact-encoded body
+     * @returns Promise resolving to decoded response
+     */
+    sendPwless(data) {
+        return sendRequest(this.config.host, this.config.pwlessPath, data, {}, 30000, { logger: this.config?.startupFlowLogger || this.config?.logger });
+    }
+    /**
+     * Send a long-poll pwless request.
+     * @param data - TCompact-encoded body
+     * @returns Promise resolving to decoded response
+     */
+    sendPwlessLongPoll(data) {
+        return sendRequest(this.config.host, this.config.pwlessLongPollPath, data, { 'X-Line-Access': this.sessionId, 'x-lst': '60000' }, this.config.pollTimeout, { logger: this.config?.startupFlowLogger || this.config?.logger });
+    }
+}