emusks 2.3.6 → 2.3.8

package/README.md

@@ -5,4 +5,12 @@ Log in and interact with the unofficial X API using any client identity - web, A
 
 officially dmca'd by twitter™ 🏆  •  includes a few leaked ads bearers
 
-[Learn more →](https://emusks.tiago.zip) [Radicle](https://app.radicle.xyz/nodes/rosa.radicle.xyz/rad:z4F48Wmhm5Mian1rgZjmnKxEQ5ays)
+[Learn more →](https://emusks.tiago.zip) [Source](https://code.lgbt/tiago/emusks)
+
+## browser-free password login
+
+password login can use a private Castle signal profile to generate fresh request tokens locally. emusks loads `.emusks/castle-profile.json` from the working directory, or the file selected by `EMUSKS_CASTLE_PROFILE`. an explicit `castleProfile` login option accepts a path or profile object; `false` disables profile loading.
+
+the profile contains saved browser measurements, not a pre-generated request token. six request-specific fields are generated by the SDK for each local instance. the profile's user agent and client hints are retained through login and the authenticated session. profiles are bound to the bundled SDK's SHA-256 hash; a changed SDK produces an error before credential submission.
+
+keep the profile private and exclude `.emusks/` from version control. profiles are not included in the published package. token generation and login do not launch or contact a browser.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "emusks",
-  "version": "2.3.6",
+  "version": "2.3.8",
   "description": "Reverse-engineered Twitter API client. Log in and interact with the unofficial X API using any client identity - web, Android, iOS, or TweetDeck",
   "keywords": [
     "client",
@@ -12,12 +12,12 @@
   ],
   "homepage": "https://emusks.tiago.zip",
   "bugs": {
-    "url": "https://app.radicle.xyz/nodes/rosa.radicle.xyz/rad:z4F48Wmhm5Mian1rgZjmnKxEQ5ays"
+    "url": "https://code.lgbt/tiago/emusks/issues"
   },
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",
-    "url": "https://app.radicle.xyz/nodes/rosa.radicle.xyz/rad:z4F48Wmhm5Mian1rgZjmnKxEQ5ays"
+    "url": "https://code.lgbt/tiago/emusks"
   },
   "type": "module",
   "main": "src/index.js",
@@ -26,6 +26,7 @@
   },
   "files": [
     "src",
+    "!src/scripts",
     "README.md"
   ],
   "dependencies": {

package/src/castle-profile.js

@@ -0,0 +1,18 @@
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+export function loadCastleProfile(value) {
+  if (value === false) return null;
+  const path = value ?? process.env.EMUSKS_CASTLE_PROFILE ?? resolve(".emusks/castle-profile.json");
+  if (value == null && !process.env.EMUSKS_CASTLE_PROFILE && !existsSync(path)) return null;
+  const profile = typeof path === "string" ? JSON.parse(readFileSync(path, "utf8")) : path;
+  if (profile?.format !== 1 || !/^[a-f0-9]{64}$/.test(profile.sdkSha256 ?? "") || typeof profile.userAgent !== "string" || !Array.isArray(profile.signals) || profile.signals.length !== 749) {
+    throw new Error("invalid Castle profile");
+  }
+  const clientHints = {};
+  for (const name of ["sec-ch-ua", "sec-ch-ua-mobile", "sec-ch-ua-platform"]) {
+    if (typeof profile.clientHints?.[name] !== "string") throw new Error(`Castle profile is missing ${name}`);
+    clientHints[name] = profile.clientHints[name];
+  }
+  return { ...profile, clientHints };
+}

package/src/castle.js

@@ -1,3 +1,5 @@
+import { createHash } from "node:crypto";
+import { loadCastleProfile } from "./castle-profile.js";
 import { readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -7,7 +9,7 @@ import { parseHTML } from "linkedom";
 const HERE = dirname(fileURLToPath(import.meta.url));
 
 export const DEFAULT_CASTLE_PK = "pk_AvRa79bHyJSYSQHnRpcVtzyxetSvFerx";
-export const CASTLE_MODULE_ID = "84197";
+export const CASTLE_MODULE_ID = "855881";
 
 const DEFAULT_UA =
   "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36";
@@ -42,36 +44,53 @@ function mimeTypeArray() {
   return arr;
 }
 
-function buildSandbox(userAgent) {
-  const { document } = parseHTML(
-    "<!DOCTYPE html><html><head><title>X</title></head><body></body></html>",
+function buildSandbox(userAgent, cookies, html) {
+  const { document, window: domWindow } = parseHTML(
+    html ?? "<!DOCTYPE html><html><head><title>X</title></head><body></body></html>",
   );
   const define = (prop, value) => {
     try {
       Object.defineProperty(document, prop, { get: () => value, configurable: true });
     } catch {}
   };
-  define("cookie", "");
+  Object.defineProperty(document, "cookie", {
+    configurable: true,
+    get: () => Object.entries(cookies).map(([name, value]) => `${name}=${value}`).join("; "),
+    set: (cookie) => {
+      const [pair, ...attributes] = String(cookie).split(";");
+      const separator = pair.indexOf("=");
+      if (separator < 1) return;
+      const name = pair.slice(0, separator).trim();
+      const attrs = Object.fromEntries(attributes.map((attribute) => {
+        const [key, ...parts] = attribute.trim().split("=");
+        return [key.toLowerCase(), parts.join("=")];
+      }));
+      const maxAge = /^-?\d+$/.test(attrs["max-age"] ?? "") ? Number(attrs["max-age"]) : null;
+      const expired = maxAge !== null ? maxAge <= 0 : Date.parse(attrs.expires) <= Date.now();
+      if (expired) delete cookies[name];
+      else cookies[name] = pair.slice(separator + 1).trim();
+    },
+  });
   define("readyState", "complete");
   define("referrer", "https://x.com/");
   define("visibilityState", "visible");
   define("hidden", false);
+  Object.defineProperty(document, "scripts", { get: () => document.getElementsByTagName("script"), configurable: true });
   document.hasFocus = () => true;
 
   const s = {};
-  s.globalThis = s;
-  s.self = s;
-  s.window = s;
-  s.global = s;
-  s.top = s;
-  s.parent = s;
-  s.frames = s;
+  for (const name of ["Element", "HTMLElement", "Node", "Document", "DocumentFragment", "Event", "CustomEvent", "EventTarget", "MutationObserver", "HTMLCanvasElement", "HTMLIFrameElement", "HTMLImageElement"]) {
+    if (domWindow[name]) s[name] = domWindow[name];
+  }
+  Object.assign(s, { Request, Response, Headers, AbortController, AbortSignal, URL, URLSearchParams, Blob, CompressionStream, DecompressionStream, ReadableStream, WritableStream, TransformStream });
   s.name = "";
   s.closed = false;
   s.origin = "https://x.com";
   s.isSecureContext = true;
 
   s.document = document;
+  const context2d = document.createElement("canvas").getContext("2d");
+  if (context2d) s.CanvasRenderingContext2D = context2d.constructor;
   s.navigator = {
     userAgent,
     appVersion: userAgent.replace("Mozilla/", ""),
@@ -129,12 +148,12 @@ function buildSandbox(userAgent) {
     orientation: { type: "landscape-primary", angle: 0 },
   };
   s.location = {
-    href: "https://x.com/i/flow/login",
+    href: "https://x.com/",
     protocol: "https:",
     host: "x.com",
     hostname: "x.com",
     origin: "https://x.com",
-    pathname: "/i/flow/login",
+    pathname: "/",
     search: "",
     hash: "",
   };
@@ -208,6 +227,22 @@ function buildSandbox(userAgent) {
     addEventListener() {}
   };
   s.getComputedStyle = () => ({ getPropertyValue: () => "" });
+  const createElement = document.createElement.bind(document);
+  document.createElement = (name, ...args) => {
+    const element = createElement(name, ...args);
+    if (String(name).toLowerCase() !== "iframe") return element;
+    const frameDocument = parseHTML("<!doctype html><html><head></head><body></body></html>").document;
+    const frame = vm.createContext({ document: frameDocument, navigator: s.navigator, performance: s.performance });
+    const frameWindow = vm.runInContext("self = window = globalThis", frame);
+    frameWindow.parent = document.defaultView;
+    frameWindow.top = document.defaultView;
+    Object.defineProperty(frameDocument, "defaultView", { get: () => frameWindow, configurable: true });
+    Object.defineProperties(element, {
+      contentWindow: { get: () => frameWindow },
+      contentDocument: { get: () => frameDocument },
+    });
+    return element;
+  };
   return s;
 }
 
@@ -217,20 +252,40 @@ export function createCastleMinter(opts = {}) {
     userAgent = DEFAULT_UA,
     sdkPath = join(HERE, "vendor", "castle-sdk.min.js"),
     sdkSource,
+    cookies = {},
+    html,
+    profile: profileOption,
   } = opts;
 
-  const src = sdkSource ?? readFileSync(sdkPath, "utf8");
-  const sandbox = buildSandbox(userAgent);
+  let src = sdkSource ?? readFileSync(sdkPath, "utf8");
+  const profile = loadCastleProfile(profileOption);
+  if (profile) {
+    if (createHash("sha256").update(src).digest("hex") !== profile.sdkSha256 || !src.includes(",$=[],")) {
+      throw new Error("Castle profile does not match the bundled SDK");
+    }
+    const signals = Object.fromEntries(profile.signals.flatMap((value, index) => [4, 116, 342, 356, 465, 550].includes(index) ? [] : [[index, value]]));
+    src = src.replace(",$=[],", `,$=new Proxy(Object.assign([],${JSON.stringify(signals)}),{set(target,key,value){const profile=${JSON.stringify(signals)};target[key]=Object.hasOwn(profile,key)?profile[key]:value;return true;}}),`);
+  }
+  const sandbox = buildSandbox(profile?.userAgent ?? userAgent, cookies, html);
 
   let factory = null;
   sandbox.webpackChunk_twitter_responsive_web = {
     push: (entry) => {
       const modules = entry?.[1];
-      if (modules && modules[CASTLE_MODULE_ID]) factory = modules[CASTLE_MODULE_ID];
+      if (modules?.[CASTLE_MODULE_ID]) factory = modules[CASTLE_MODULE_ID];
     },
   };
 
   const ctx = vm.createContext(sandbox);
+  vm.runInContext("self = window = global = top = parent = frames = globalThis", ctx);
+  vm.runInContext(`
+    Object.defineProperties(document, {
+      defaultView: { get: () => window, configurable: true },
+      location: { get: () => location, configurable: true },
+      URL: { get: () => location.href, configurable: true },
+      documentURI: { get: () => location.href, configurable: true },
+    });
+  `, ctx);
   vm.runInContext(src, ctx, { filename: "castle-sdk.min.js" });
   if (!factory) throw new Error(`castle sdk module ${CASTLE_MODULE_ID} not found (X may have rotated the chunk)`);
 

package/src/flow-jetfuel.js

@@ -1,11 +1,11 @@
-import { ClientTransaction, handleXMigration } from "x-client-transaction-id";
-import { mintCastleToken } from "./castle.js";
+import { loadCastleProfile } from "./castle-profile.js";
+import { createCastleMinter } from "./castle.js";
 import clients from "./clients.js";
 import getCycleTLS from "./cycletls.js";
-import { decodeJetfuel } from "./parsers/jetfuel.js";
+import { decodeJetfuelMessages } from "./parsers/jetfuel-messages.js";
 
 const GUEST_ACTIVATE_URL = "https://api.x.com/1.1/guest/activate.json";
-const JFAPI_BASE = "https://x.com/i/jfapi";
+const JFAPI_BASE = "https://jf.x.com";
 const SURFACE = "onboarding/web";
 const UA =
   "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36";
@@ -13,11 +13,12 @@ const UA =
 const MAX_STEPS = 15;
 
 class CookieSession {
-  constructor(cycleTLS, proxy, timeout) {
+  constructor(cycleTLS, proxy, timeout, profile) {
     this.cycleTLS = cycleTLS;
     this.cookies = {};
     this.proxy = proxy;
     this.timeout = timeout;
+    this.profile = profile;
   }
 
   cookieString() {
@@ -30,13 +31,24 @@ class CookieSession {
     const setCookie = res.headers?.["set-cookie"] || res.headers?.["Set-Cookie"];
     if (!setCookie) return;
     for (const cookie of Array.isArray(setCookie) ? setCookie : [setCookie]) {
-      const [key, ...rest] = cookie.split(";")[0].split("=");
-      if (rest.length) this.cookies[key.trim()] = rest.join("=").trim();
+      const [pair, ...attributes] = cookie.split(";");
+      const separator = pair.indexOf("=");
+      if (separator < 1) continue;
+      const key = pair.slice(0, separator).trim();
+      const attrs = Object.fromEntries(attributes.map((attribute) => {
+        const [name, ...value] = attribute.trim().split("=");
+        return [name.toLowerCase(), value.join("=")];
+      }));
+      const maxAge = /^-?\d+$/.test(attrs["max-age"] ?? "") ? Number(attrs["max-age"]) : null;
+      const expired = maxAge !== null ? maxAge <= 0 : Date.parse(attrs.expires) <= Date.now();
+      if (expired) delete this.cookies[key];
+      else this.cookies[key] = pair.slice(separator + 1).trim();
     }
   }
 
   async request(url, method, { headers = {}, body, responseType } = {}) {
-    const h = { ...headers };
+    const h = { ...this.profile?.clientHints, ...headers };
+    if (this.cookies.ct0) h["x-csrf-token"] = this.cookies.ct0;
     const cookieStr = this.cookieString();
     if (cookieStr) h.Cookie = cookieStr;
 
@@ -44,9 +56,8 @@ class CookieSession {
       url,
       {
         body,
-        ja3: clients.web.fingerprints.ja3,
-        ja4r: clients.web.fingerprints.ja4r,
-        userAgent: UA,
+        ja3: clients.web.fingerprints.ja3.replace(/^771,/, "772,").replace("4588-", ""),
+        userAgent: this.profile?.userAgent ?? UA,
         headers: h,
         proxy: this.proxy || undefined,
         responseType,
@@ -59,7 +70,7 @@ class CookieSession {
   }
 }
 
-function jfHeaders(guestToken, tid, theme) {
+function jfHeaders(guestToken, theme) {
   const headers = {
     authorization: `Bearer ${clients.web.bearer}`,
     "x-guest-token": guestToken,
@@ -71,9 +82,8 @@ function jfHeaders(guestToken, tid, theme) {
     accept: "*/*",
     timezone: Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC",
     Origin: "https://x.com",
-    Referer: "https://x.com/i/flow/login",
+    Referer: "https://x.com/",
   };
-  if (tid) headers["x-client-transaction-id"] = tid;
   return headers;
 }
 
@@ -95,12 +105,18 @@ async function toBuffer(res) {
   return Buffer.from(String(body ?? ""), "utf8");
 }
 
-function decodeStrings(buffer) {
-  try {
-    return decodeJetfuel(buffer).strings || [];
-  } catch {
-    return [];
+function decodeResponse(buffer) {
+  const { messages, strings } = decodeJetfuelMessages(buffer);
+  const forms = [];
+  for (const [tag, message] of messages) {
+    if (tag !== 0) continue;
+    for (const [type, value] of message.props) {
+      if (type === 30) {
+        forms.push({ url: value[0], fields: Object.fromEntries(value[1]), errors: Object.fromEntries(value[2]) });
+      }
+    }
   }
+  return { strings, forms };
 }
 
 function extractActionIds(strings) {
@@ -148,7 +164,8 @@ export default async function flowLoginJetfuel(opts) {
     email,
     phone,
     onRequest,
-    getCastleToken = () => mintCastleToken(),
+    getCastleToken,
+    castleProfile,
     proxy,
     timeout,
     theme = "light",
@@ -161,57 +178,63 @@ export default async function flowLoginJetfuel(opts) {
   if (!password) throw new Error("password is required for login");
 
   const cycleTLS = await getCycleTLS();
-  const session = new CookieSession(cycleTLS, proxy, timeout);
+  const profile = loadCastleProfile(castleProfile);
+  const session = new CookieSession(cycleTLS, proxy, timeout, profile);
 
-  const migrationDoc = await handleXMigration();
-  const transaction = new ClientTransaction(migrationDoc);
-  await transaction.initialize();
-  const tid = (method, path) => transaction.generateTransactionId(method, path);
+  const home = await session.request("https://x.com/", "get", {
+    headers: { accept: "text/html", "accept-language": "en-US,en;q=0.9" },
+  });
+  if (home.status !== 200) throw new Error(`login bootstrap failed: ${home.status}`);
+  const homeHtml = (await toBuffer(home)).toString("utf8");
+  const mint = getCastleToken ?? createCastleMinter({ userAgent: UA, cookies: session.cookies, html: homeHtml, profile: profile ?? false });
 
-  const guestToken = await getGuestToken(session);
-  log("guest token", guestToken);
+  const guestToken = homeHtml.match(/document\.cookie\s*=\s*["']gt=(\d+);/)?.[1]
+    ?? session.cookies.gt
+    ?? await getGuestToken(session);
+  session.cookies.gt = guestToken;
+  log("guest token obtained");
 
-  const landingPath = `/i/jfapi/${SURFACE}?mode=login`;
-  const landing = await session.request(`${JFAPI_BASE}/${SURFACE}?mode=login`, "get", {
-    headers: jfHeaders(guestToken, await tid("GET", landingPath), theme),
+  const landing = await session.request(`${JFAPI_BASE}/${SURFACE}/landing`, "get", {
+    headers: jfHeaders(guestToken, theme),
     responseType: "arraybuffer",
   });
   if (landing.status !== 200) throw new Error(`landing failed: ${landing.status}`);
-  let strings = decodeStrings(await toBuffer(landing));
+  let response = decodeResponse(await toBuffer(landing));
+  let { strings } = response;
   log("landing actions", extractActionIds(strings));
 
   const post = async (action, fields) => {
-    const path = `/i/jfapi/${SURFACE}/actions/${action}`;
-    const castle = await getCastleToken(action);
+    const castle = await mint(action);
     const form = new URLSearchParams({ ...fields, $castle_token: castle }).toString();
-    const headers = jfHeaders(guestToken, await tid("POST", path), theme);
+    const headers = jfHeaders(guestToken, theme);
     headers["content-type"] = "application/x-www-form-urlencoded";
-    if (session.cookies.ct0) headers["x-csrf-token"] = session.cookies.ct0;
     const res = await session.request(`${JFAPI_BASE}/${SURFACE}/actions/${action}`, "post", {
       headers,
       body: form,
       responseType: "arraybuffer",
     });
     const buffer = await toBuffer(res);
-    const responseStrings = decodeStrings(buffer);
-    log(`POST ${action} -> ${res.status}`, extractActionIds(responseStrings));
     if (res.status !== 200) {
-      throw new Error(`action ${action} failed: ${res.status} - ${buffer.toString("utf8").slice(0, 200)}`);
+      throw new Error(`action ${action} failed: ${res.status}`);
     }
+    const result = decodeResponse(buffer);
+    const responseStrings = result.strings;
+    log(`POST ${action} -> ${res.status}`, extractActionIds(responseStrings));
     const genericError = responseStrings.find((s) => /something went wrong/i.test(s));
     if (genericError && responseStrings.length < 6) {
       throw new Error(
-        `action ${action} rejected ("${genericError}") - usually an invalid or missing $castle_token.`,
+        `action ${action} rejected ("${genericError}")`,
       );
     }
-    const serverError = extractServerError(responseStrings);
+    const serverError = result.forms.flatMap((form) => Object.values(form.errors)).find(Boolean)
+      ?? extractServerError(responseStrings);
     if (serverError) {
       if (/temporarily limited|rate.?limit|try again later/i.test(serverError)) {
-        throw new Error(`login rate-limited by X: "${serverError.trim()}" (back off this account/IP)`);
+        throw new Error(`login rate-limited by X: "${serverError.trim()}"`);
       }
       throw new Error(`action ${action} error: "${serverError.trim()}"`);
     }
-    return responseStrings;
+    return result;
   };
 
   const sessionTokenFrom = (arr) => {
@@ -223,7 +246,8 @@ export default async function flowLoginJetfuel(opts) {
   let sessionToken = null;
   const withSession = (fields) => (sessionToken ? { session_token: sessionToken, ...fields } : fields);
 
-  strings = await post("begin_login", { username_or_email: identifier });
+  response = await post("begin_login", { username_or_email: identifier });
+  strings = response.strings;
   sessionToken = sessionTokenFrom(strings) || sessionToken;
 
   let step = 0;
@@ -239,6 +263,51 @@ export default async function flowLoginJetfuel(opts) {
       throw new Error("login denied: account locked or suspended");
     }
 
+    const passwordSwitch = response.forms.find((form) => form.fields.force_password);
+    if (passwordSwitch) {
+      const knowledgeCheck = response.forms.find((form) => form.url === "/onboarding/web/actions/finish_knowledge_check");
+      if (knowledgeCheck && onRequest) {
+        const alternate = await onRequest("alternate_identifier");
+        if (alternate != null && alternate !== "") {
+          response = await post("finish_knowledge_check", { ...knowledgeCheck.fields, challenge_response: alternate });
+          strings = response.strings;
+          sessionToken = sessionTokenFrom(strings) || sessionToken;
+          continue;
+        }
+      }
+      response = await post("begin_login", passwordSwitch.fields);
+      strings = response.strings;
+      sessionToken = sessionTokenFrom(strings) || sessionToken;
+      continue;
+    }
+
+    const form = response.forms.find((entry) => /\/onboarding\/web\/actions\/login_enter_password$/.test(entry.url))
+      ?? response.forms.find((entry) => /\/onboarding\/web\/actions\/(?:finish_login|finish_knowledge_check|login_)/.test(entry.url));
+    if (form) {
+      const action = form.url.match(/^\/onboarding\/web\/actions\/([a-z0-9_]+)$/)?.[1];
+      if (!action) throw new Error("invalid login action URL");
+      const fields = { ...form.fields };
+      if (Object.hasOwn(fields, "password")) fields.password = password;
+      else {
+        const field = ["challenge_response", "code", "text"].find((key) => Object.hasOwn(fields, key));
+        if (!field) throw new Error(`unsupported login form: ${action}`);
+        const type = action === "finish_knowledge_check" || /username|phone/i.test(fields.challenge_type ?? "") ? "alternate_identifier"
+          : has("two_factor") || has("authenticator") || has("authentication code") ? "two_factor_code" : "email_code";
+        let alternate = null;
+        if (type === "alternate_identifier") {
+          const challenge = fields.challenge_type?.toLowerCase();
+          if (challenge === "username" && !identifier.includes("@") && !/^\+?[\d\s-]+$/.test(identifier)) alternate = identifier;
+          if (challenge === "email") alternate = email || (identifier.includes("@") ? identifier : null);
+          if (challenge === "phone") alternate = phone;
+        }
+        fields[field] = await resolve(alternate, onRequest, type);
+      }
+      response = await post(action, fields);
+      strings = response.strings;
+      sessionToken = sessionTokenFrom(strings) || sessionToken;
+      continue;
+    }
+
     const wantsPasswordEntry = has("enter your password") || has("login_enter_password");
     const wantsTwoFactor = has("two_factor") || has("2fa") || has("authentication code");
     const wantsEmailCode = has("acid") || has("verifycode") || has("verification code") ||
@@ -247,31 +316,35 @@ export default async function flowLoginJetfuel(opts) {
 
     if (wantsTwoFactor) {
       const code = await resolve(null, onRequest, "two_factor_code");
-      strings = await post("login_enter_two_factor", withSession({ text: code }));
+      response = await post("login_enter_two_factor", withSession({ text: code }));
+      strings = response.strings;
       sessionToken = sessionTokenFrom(strings) || sessionToken;
       continue;
     }
     if (wantsEmailCode) {
       const code = await resolve(null, onRequest, "email_code");
-      strings = await post("login_acid", withSession({ text: code }));
+      response = await post("login_acid", withSession({ text: code }));
+      strings = response.strings;
       sessionToken = sessionTokenFrom(strings) || sessionToken;
       continue;
     }
     if (wantsAlternate) {
       const value = await resolve(email || phone, onRequest, "alternate_identifier");
-      strings = await post("login_enter_alternate_identifier", withSession({ text: value }));
+      response = await post("login_enter_alternate_identifier", withSession({ text: value }));
+      strings = response.strings;
       sessionToken = sessionTokenFrom(strings) || sessionToken;
       continue;
     }
     if (wantsPasswordEntry || has("password")) {
-      strings = await post("login_enter_password", withSession({ password }));
+      response = await post("login_enter_password", withSession({ password }));
+      strings = response.strings;
       sessionToken = sessionTokenFrom(strings) || sessionToken;
       continue;
     }
 
     throw new Error(
       `unhandled jetfuel login step. decoded actions: [${extractActionIds(strings).join(", ")}]. ` +
-        `strings sample: ${JSON.stringify(strings.slice(0, 20))}`,
+        `no supported password or verification form was returned`,
     );
   }
 
@@ -284,5 +357,6 @@ export default async function flowLoginJetfuel(opts) {
     csrfToken: session.cookies.ct0 || null,
     userId: extractUserId(session.cookies),
     cookies: { ...session.cookies },
+    clientProfile: profile ? { userAgent: profile.userAgent, clientHints: profile.clientHints } : null,
   };
 }

package/src/helpers/media.js

@@ -219,7 +219,7 @@ export async function create(source, opts = {}) {
     });
   }
 
-  return { media_id: mediaId, ...finalizeData };
+  return { ...finalizeData, media_id: mediaId };
 }
 
 export async function createFromUrl(url, opts = {}) {
@@ -274,7 +274,7 @@ export async function createFromUrl(url, opts = {}) {
     });
   }
 
-  return { media_id: mediaId, ...initData };
+  return { ...initData, media_id: mediaId };
 }
 
 export async function createMetadata(mediaId, altText, opts = {}) {