itd-api 0.9.1 → 0.9.3

package/dist/index.js

@@ -1,12 +1,12 @@
-import { $ as orderPluginDefinitions, A as ITD_CATALOG, C as ReportReason, D as ViewReason, E as SpanType, F as operationMethod, G as pickString, I as operationRetrySafety, K as RetrySafety, L as BUCKET_LIMITS, M as defineBuiltInOperation, N as isBuiltInOperationId, O as ViewSource, P as operationBucket, Q as assertPluginRemovable, R as DEFAULT_RATE_LIMIT_BUCKET, S as NotificationType, T as ServiceState, V as pickArray, Z as RequestQueuePool, _ as FeedTab, at as isRecord, b as ItdErrorCode, c as normalizeNotification, d as canonicalNotificationType, et as DEFAULT_BASE_URL, f as isKnownNotificationType, g as EventChannelStatus, h as CommentSort, it as LIBRARY_VERSION, j as OPERATIONS, k as WallAccess, lt as systemClock, m as AttachmentType, n as formatNotificationText, nt as STATUS_SERVICE, o as passthroughOperation, ot as requireOptionalBoolean, p as AccessType, rt as resolveRateLimit, s as voidOperation, st as RateLimitPacing, t as resolveNotificationUrl, ut as installAsyncDisposeFallback, v as IncidentKind, w as ReportTargetType, x as LikesVisibility, y as InteractionType, z as createClientRuntime } from "./shared/url-Dsr4c5r5.js";
+import { $ as orderPluginDefinitions, A as ITD_CATALOG, C as ReportReason, D as ViewReason, E as SpanType, F as operationMethod, G as pickString, I as operationRetrySafety, K as RetrySafety, L as BUCKET_LIMITS, M as defineBuiltInOperation, N as isBuiltInOperationId, O as ViewSource, P as operationBucket, Q as assertPluginRemovable, R as DEFAULT_RATE_LIMIT_BUCKET, S as NotificationType, T as ServiceState, V as pickArray, Z as RequestQueuePool, _ as FeedTab, at as isRecord, b as ItdErrorCode, c as normalizeNotification, d as canonicalNotificationType, et as DEFAULT_BASE_URL, f as isKnownNotificationType, g as EventChannelStatus, h as CommentSort, it as LIBRARY_VERSION, j as OPERATIONS, k as WallAccess, lt as systemClock, m as AttachmentType, n as formatNotificationText, nt as STATUS_SERVICE, o as passthroughOperation, ot as requireOptionalBoolean, p as AccessType, rt as resolveRateLimit, s as voidOperation, st as RateLimitPacing, t as resolveNotificationUrl, ut as installAsyncDisposeFallback, v as IncidentKind, w as ReportTargetType, x as LikesVisibility, y as InteractionType, z as createClientRuntime } from "./shared/url-3Ts6EEHQ.js";
 import { A as isItdStateError, C as isItdError, D as isItdPhoneVerificationError, E as isItdNotFoundError, O as isItdRateLimitError, S as isItdConflictError, T as isItdForbiddenError, _ as ItdStateError, a as ItdConfigError, b as isItdApiError, c as ItdErrorKind, d as ItdForbiddenError, f as ItdNetworkError, g as ItdServerError, h as ItdRateLimitError, i as ItdAuthError, j as isItdValidationError, k as isItdServerError, l as ItdFileError, m as ItdPhoneVerificationError, n as ItdApiError, o as ItdConflictError, p as ItdNotFoundError, r as ItdApiErrorKind, s as ItdError, t as ItdAbortError, u as ItdFileErrorReason, v as ItdTimeoutError, w as isItdFileError, x as isItdAuthError, y as ItdValidationError } from "./shared/errors-GI10kZxk.js";
-import { _ as RuntimeMode, c as REFRESH_COOKIE, l as REFRESH_COOKIE_PATH, v as createDeviceId } from "./shared/redact-Ba5iSVYZ.js";
-import { A as toDate, C as ALLOWED_MIME_TYPES, D as comment, E as VIDEO_MIME_TYPES, F as Paginator, I as mapPage, L as createFeatureHost, M as NotificationsResource, N as BaseResource, O as isBuilder, P as PaginationMode, R as ExtensibleOperationCatalog, S as parseMarkdown, T as IMAGE_MIME_TYPES, _ as post, a as createMemoryShopOrderAccessStorage, b as markup, c as ShopConsentKind, d as ShopProductStatus, f as isMyProfile, g as report, h as createResources, i as MemoryShopOrderAccessStorage, j as utcStampToIso, k as createStatusFeature, l as ShopOrderStatus, m as fromUrl, n as renderSpans, o as createShopOrderAccessStorage, p as fromStream, r as createShopFeature, s as statusDays, t as SpanRenderFormat, u as ShopProductCategory, v as poll, w as AUDIO_MIME_TYPES, x as parseHtml, y as autoSpans } from "./shared/render-sb1VJhUA.js";
-import { c as FileTransferMode } from "./shared/options-DhgGg7Ms.js";
-import { _ as Emitter, a as WebSocketTransport, c as NotificationEventsTransport, d as NotificationUpdateOrigin, f as NotificationUpdateType, g as runEventMiddleware, h as UnauthorizedStreamError, i as createNotificationEventsClient, l as resolveNotificationEventsOptions, n as EventRouter, o as EVENT_OPERATIONS, p as EventChannel, r as NotificationEventsClient, s as NotificationEvents, t as EventComposer, u as setNotificationEventsConnectGuard, v as reportListenerError } from "./shared/events-D6y0Hxyz.js";
+import { c as REFRESH_COOKIE, l as REFRESH_COOKIE_PATH, s as CookieJar, u as isSerializedCookieEntry, v as RuntimeMode, y as createDeviceId } from "./shared/redact-DJV0XM3n.js";
+import { A as utcStampToIso, C as AUDIO_MIME_TYPES, D as isBuilder, E as comment, F as mapPage, I as createFeatureHost, L as ExtensibleOperationCatalog, M as BaseResource, N as PaginationMode, O as createStatusFeature, P as Paginator, S as ALLOWED_MIME_TYPES, T as VIDEO_MIME_TYPES, _ as poll, a as createShopOrderAccessStorage, b as parseHtml, c as ShopOrderStatus, d as isMyProfile, f as fromStream, g as post, h as report, i as MemoryShopOrderAccessStorage, j as NotificationsResource, k as toDate, l as ShopProductCategory, m as createResources, n as renderSpans, o as statusDays, p as fromUrl, r as createShopFeature, s as ShopConsentKind, t as SpanRenderFormat, u as ShopProductStatus, v as autoSpans, w as IMAGE_MIME_TYPES, x as parseMarkdown, y as markup } from "./shared/render-CtOpp9Pm.js";
+import { c as FileTransferMode } from "./shared/options-i4LrKfqx.js";
+import { _ as reportListenerError, a as WebSocketTransport, c as NotificationEventsTransport, d as NotificationUpdateOrigin, f as NotificationUpdateType, g as Emitter, h as runEventMiddleware, i as createNotificationEventsClient, l as resolveNotificationEventsOptions, m as UnauthorizedStreamError, n as EventRouter, o as EVENT_OPERATIONS, p as EventChannel, r as NotificationEventsClient, s as NotificationEvents, t as EventComposer, u as setNotificationEventsConnectGuard } from "./shared/events-BzjI6pn5.js";
 import { a as isEnumerableKeyValueStore, i as createRecordKeyValueStore, o as withCodec, r as createKeyValueStore, s as withNamespace, t as MemoryKeyValueStore } from "./shared/key-value-store-Bt2PSMxY.js";
-import { n as copySession, r as createTokenStorage, t as MemoryTokenStorage } from "./shared/storage-CfHKzVHf.js";
-import { a as scopedTokenStorage, i as isRestorableSession, n as controlledTokenStorage, r as createMultiTokenStorage, t as MemoryMultiTokenStorage } from "./shared/multi-storage-SoW05uzO.js";
+import { n as copySession, r as createTokenStorage, t as MemoryTokenStorage } from "./shared/storage-DiDe0PZM.js";
+import { a as scopedTokenStorage, i as isRestorableSession, n as controlledTokenStorage, r as createMultiTokenStorage, t as MemoryMultiTokenStorage } from "./shared/multi-storage-C3Ngtop1.js";
 //#region src/notifications-api.ts
 var ClientNotifications = class extends NotificationsResource {
 	#createEvents;
@@ -49,7 +49,7 @@ const AUTH_SIGN_IN = defineBuiltInOperation("auth.signIn", (body) => {
 	};
 });
 const AUTH_VERIFY_OTP = defineBuiltInOperation("auth.verifyOtp", (body) => requireString(body, "accessToken", "Сервер не вернул accessToken после подтверждения кода"));
-const AUTH_REFRESH = defineBuiltInOperation("auth.refresh", (body) => pickString(body, "accessToken"));
+const AUTH_REFRESH = defineBuiltInOperation("auth.refresh", (body) => requireString(body, "accessToken", "Сервер не вернул accessToken при обновлении сессии"));
 const AUTH_RESEND_OTP = voidOperation("auth.resendOtp");
 const AUTH_LOGOUT = voidOperation("auth.logout");
 const AUTH_FORGOT_PASSWORD = defineBuiltInOperation("auth.forgotPassword", (body) => requireString(body, "flowToken", "Сервер не вернул flowToken при запросе сброса пароля"));
@@ -74,38 +74,34 @@ function decodeBase64Url(segment) {
 	const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
 	return new TextDecoder().decode(bytes);
 }
-/**
-* Читает `sub` и `sid` из полезной нагрузки JWT.
-*
-* Подпись не проверяется — ключа для проверки у клиента нет. Прочитанные значения служат
-* лишь метками для разделения локального состояния и не дают доступа: его определяет сервер.
-*/
-function readTokenIdentity(token) {
+/** Читает полезную нагрузку JWT без проверки подписи. */
+function readTokenPayload(token) {
 	try {
 		const payload = token.split(".")[1];
-		if (!payload) return {};
+		if (!payload) return void 0;
 		const parsed = JSON.parse(decodeBase64Url(payload));
-		if (typeof parsed !== "object" || parsed === null) return {};
-		const { sub, sid } = parsed;
-		return {
-			...typeof sub === "string" && sub.length > 0 ? { subject: sub } : {},
-			...typeof sid === "string" && sid.length > 0 ? { sessionId: sid } : {}
-		};
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
+		return parsed;
 	} catch {
-		return {};
+		return;
 	}
 }
-/**
-* Читает `sub` из полезной нагрузки JWT.
-*
-* @returns идентификатор владельца токена; `undefined`, если токен не JWT, повреждён
-* или поля `sub` в нём нет
-*/
-function readTokenSubject(token) {
-	return readTokenIdentity(token).subject;
+/** Читает используемые клиентом поля JWT за один раз. */
+function readTokenMetadata(token) {
+	const payload = readTokenPayload(token);
+	if (!payload) return {};
+	const { sub, sid, exp } = payload;
+	const expiresAt = typeof exp === "number" && Number.isFinite(exp) ? exp * 1e3 : void 0;
+	return {
+		...typeof sub === "string" && sub.length > 0 ? { subject: sub } : {},
+		...typeof sid === "string" && sid.length > 0 ? { sessionId: sid } : {},
+		...expiresAt !== void 0 && Number.isFinite(expiresAt) ? { expiresAt } : {}
+	};
 }
 //#endregion
 //#region src/session/auth.ts
+/** Запас до истечения токена на очередь и выполнение запроса. */
+const ACCESS_TOKEN_REFRESH_LEEWAY_MS = 3e4;
 /**
 * Проверяет форму `auth` и сообщает о типичных ошибках понятным текстом.
 *
@@ -119,12 +115,18 @@ function validateAuth(auth) {
 		return auth;
 	}
 	if (typeof auth !== "object" || auth === null) throw new ItdConfigError(`auth должен быть строкой с токеном или объектом, получено: ${typeof auth}`);
+	if ([
+		"getToken" in auth,
+		"accessToken" in auth || "refreshToken" in auth,
+		"email" in auth || "password" in auth
+	].filter(Boolean).length > 1) throw new ItdConfigError("auth должен описывать ровно один способ авторизации: getToken, accessToken или email/password");
 	if ("getToken" in auth) {
 		if (typeof auth.getToken !== "function") throw new ItdConfigError("auth.getToken должен быть функцией");
 		return { ...auth };
 	}
 	if ("accessToken" in auth) {
 		if (typeof auth.accessToken !== "string" || auth.accessToken.trim() === "") throw new ItdConfigError("auth.accessToken должен быть непустой строкой");
+		if (auth.refreshToken !== void 0 && (typeof auth.refreshToken !== "string" || auth.refreshToken.trim() === "")) throw new ItdConfigError("auth.refreshToken должен быть непустой строкой");
 		return { ...auth };
 	}
 	if ("email" in auth || "password" in auth) {
@@ -212,10 +214,67 @@ const AUTH_PATHS = {
 const TURNSTILE_SITE_KEY = "0x4AAAAAACHhxczw6fJGwPBg";
 /** Убирает поле, которое сохраняли промежуточные версии с поддержкой `getUserId()`. */
 function withoutLegacyUserId(session) {
-	const clean = { ...session };
+	const clean = copySession(session);
 	delete clean.userId;
 	return clean;
 }
+function normalizeSessionValue(value, source, mode = "strict", logger) {
+	const tolerant = mode === "stored";
+	if (!isRecord(value)) {
+		if (tolerant) {
+			logger?.warn(`${source} вернула не объект сессии; сохранённая запись пропущена`);
+			return null;
+		}
+		throw new ItdConfigError(`${source} должна быть объектом сессии`);
+	}
+	const record = value;
+	const normalized = { ...record };
+	delete normalized.userId;
+	const normalizeString = (field) => {
+		const item = record[field];
+		if (item === void 0) {
+			delete normalized[field];
+			return;
+		}
+		if (item !== void 0 && (typeof item !== "string" || item.trim() === "")) {
+			if (tolerant) {
+				logger?.warn(`${source}.${field} повреждена; поле сохранённой сессии пропущено`);
+				delete normalized[field];
+				return;
+			}
+			throw new ItdConfigError(`${source}.${field} должна быть непустой строкой`);
+		}
+		normalized[field] = item;
+	};
+	normalizeString("accessToken");
+	normalizeString("refreshToken");
+	normalizeString("deviceId");
+	if (record.obtainedAt === void 0) delete normalized.obtainedAt;
+	else if (typeof record.obtainedAt !== "number" || !Number.isFinite(record.obtainedAt)) {
+		if (!tolerant) throw new ItdConfigError(`${source}.obtainedAt должна быть конечным числом`);
+		else {
+			logger?.warn(`${source}.obtainedAt повреждена; поле сохранённой сессии пропущено`);
+			delete normalized.obtainedAt;
+		}
+	}
+	if (record.cookies === void 0) delete normalized.cookies;
+	else if (!Array.isArray(record.cookies)) {
+		if (tolerant) {
+			logger?.warn(`${source}.cookies повреждена; поле сохранённой сессии пропущено`);
+			delete normalized.cookies;
+		} else throw new ItdConfigError(`${source}.cookies должна быть массивом`);
+	} else {
+		const valid = record.cookies.filter((cookie) => typeof cookie === "string" && isSerializedCookieEntry(cookie));
+		if (valid.length > 0) normalized.cookies = valid;
+		else delete normalized.cookies;
+	}
+	return normalized;
+}
+function normalizeSession(value, source) {
+	const normalized = normalizeSessionValue(value, source);
+	if (!normalized) throw new ItdConfigError(`${source} должна быть объектом сессии`);
+	return normalized;
+}
 let authScopeSequence = 0;
 function nextAuthScope() {
 	authScopeSequence += 1;
@@ -242,7 +301,7 @@ var AuthManager = class {
 	* старте читают хранилище один раз и не заводят каждый свой `deviceId`.
 	*/
 	#loading = null;
-	/** Общий промис обновления: к нему присоединяются все, кто получил 401. */
+	/** Текущее обновление: к нему присоединяются запросы той же ревизии. */
 	#refreshing = null;
 	/** Общий промис входа по логину и паролю. */
 	#signingIn = null;
@@ -252,6 +311,7 @@ var AuthManager = class {
 	#externalToken;
 	/** Идентификаторы последнего токена внешнего источника для синхронных потребителей. */
 	#externalIdentity;
+	#tokenMetadata;
 	/**
 	* Идентификатор устройства.
 	*
@@ -265,11 +325,12 @@ var AuthManager = class {
 	* Счётчик смен владельца авторизации.
 	*
 	* Растёт при каждой операции, которая заменяет или очищает сессию извне: `clear`,
-	* `setSession`, `setAccessToken`, вход. `#performRefresh` снимает его значение перед
-	* сетевым запросом и сверяет перед записью — иначе запоздавший ответ обновления мог бы
-	* воскресить уже очищенную сессию поверх `signOut`.
+	* `setSession`, `setAccessToken`, вход. Refresh сверяет снимок до и после сетевого запроса.
 	*/
 	#authEpoch = 0;
+	#externalReadGeneration = 0;
+	#disposed = false;
+	#persistence = Promise.resolve();
 	constructor(config, http, jar, hooks = {}) {
 		this.#config = config;
 		this.#http = http;
@@ -279,15 +340,25 @@ var AuthManager = class {
 	}
 	/** Подписка на события авторизации. */
 	get on() {
-		return this.#emitter.on.bind(this.#emitter);
+		return ((...args) => {
+			this.#assertActive();
+			return this.#emitter.on(...args);
+		});
 	}
 	/** Подписка на одно срабатывание. */
 	get once() {
-		return this.#emitter.once.bind(this.#emitter);
+		return ((...args) => {
+			this.#assertActive();
+			return this.#emitter.once(...args);
+		});
 	}
 	/** Снимает служебные подписки при окончательном освобождении владельца. @internal */
 	dispose() {
+		if (this.#disposed) return;
+		this.#disposed = true;
+		this.#externalReadGeneration += 1;
 		this.#invalidateInFlight();
+		this.#tokenMetadata = void 0;
 		this.#emitter.removeAllListeners();
 	}
 	/**
@@ -301,6 +372,7 @@ var AuthManager = class {
 	}
 	/** Загружает сессию и возвращает идентификаторы аккаунта и сессии для плагинов. */
 	async getAuthIdentity() {
+		this.#assertActive();
 		const session = await this.#loadSession();
 		if (session?.accessToken) return this.#identityForToken(session.accessToken);
 		const auth = this.#config.auth;
@@ -321,16 +393,57 @@ var AuthManager = class {
 	/** Отмечает смену владельца авторизации — обесценивает результат идущего обновления. */
 	#invalidateInFlight() {
 		this.#authEpoch += 1;
+		this.#externalReadGeneration += 1;
+	}
+	/** Ревизия владельца сессии для условного commit внешнего auth-flow. @internal */
+	revision() {
+		this.#assertActive();
+		return this.#authEpoch;
+	}
+	/** Создаёт изолированный jar для сетевого auth-flow. @internal */
+	createCookieFlow(inherit = true) {
+		this.#assertActive();
+		return inherit ? this.#jar.clone() : new CookieJar();
+	}
+	/** Применяет cookies только если владелец сессии не сменился. @internal */
+	commitCookieFlow(cookies, expectedRevision) {
+		this.#assertActive();
+		if (this.#authEpoch !== expectedRevision) return false;
+		this.#jar.replaceWith(cookies);
+		return true;
+	}
+	#assertActive() {
+		if (this.#disposed) throw new ItdStateError("Менеджер авторизации уже освобождён");
+	}
+	#currentAccessToken() {
+		return this.#session?.accessToken ?? null;
 	}
 	#identityForToken(accessToken) {
-		const token = accessToken ? readTokenIdentity(accessToken) : {};
+		const token = this.#metadataForToken(accessToken);
 		return {
 			...token.subject ? { userId: token.subject } : {},
 			...token.sessionId ? { sessionId: token.sessionId } : {}
 		};
 	}
+	#metadataForToken(accessToken) {
+		if (!accessToken) {
+			this.#tokenMetadata = void 0;
+			return {};
+		}
+		if (this.#tokenMetadata?.accessToken === accessToken) return this.#tokenMetadata.value;
+		const value = readTokenMetadata(accessToken);
+		this.#tokenMetadata = {
+			accessToken,
+			value
+		};
+		return value;
+	}
 	async #readExternalToken(getToken) {
+		this.#assertActive();
+		const generation = ++this.#externalReadGeneration;
 		const token = await getToken() ?? null;
+		this.#assertActive();
+		if (generation !== this.#externalReadGeneration) return token;
 		const current = this.#identityForToken(token ?? void 0);
 		if (this.#externalToken !== void 0 && this.#externalToken !== token) {
 			this.#rotateAuthScope();
@@ -361,6 +474,7 @@ var AuthManager = class {
 	* ответ был бы `false` даже при полностью рабочей сохранённой сессии.
 	*/
 	async hasRefreshSession() {
+		this.#assertActive();
 		await this.#loadSession();
 		return this.#hasRefreshSession();
 	}
@@ -370,14 +484,33 @@ var AuthManager = class {
 		if (this.#jar.has("is_auth", this.#config.baseUrl)) return true;
 		return Boolean(this.#session?.refreshToken);
 	}
-	/**
-	* Готовит состояние авторизации до входа запроса в очередь. Стадия `auth_preparation`.
-	*
-	* Загрузка хранилища, внешний источник токена и отложенный вход асинхронны, поэтому
-	* обязаны завершиться до захвата слота очереди.
-	*/
+	/** Готовит внутреннюю сессию до retry исходного запроса. */
+	async preflight(allowRefresh) {
+		this.#assertActive();
+		let accessToken = (await this.#loadSession())?.accessToken;
+		if (!accessToken) {
+			const auth = this.#config.auth;
+			if (typeof auth === "object" && auth !== null && "email" in auth) accessToken = await this.#signInWithCredentials(auth) ?? void 0;
+		}
+		if (!accessToken || !allowRefresh || !this.#config.autoRefresh) return;
+		const expiresAt = this.#metadataForToken(accessToken).expiresAt;
+		if (expiresAt === void 0 || expiresAt > this.#config.clock.now() + ACCESS_TOKEN_REFRESH_LEEWAY_MS || !this.#hasRefreshSession()) return;
+		try {
+			await this.#refreshDeduplicated({
+				epoch: this.#authEpoch,
+				accessToken
+			});
+		} catch (error) {
+			this.#emitter.emit("authError", { error });
+			throw error;
+		}
+	}
+	/** Перед каждой попыткой перечитывает внешний источник токена. */
 	async prepare() {
-		await this.token();
+		this.#assertActive();
+		if ((await this.#loadSession())?.accessToken) return;
+		const auth = this.#config.auth;
+		if (typeof auth === "object" && auth !== null && "getToken" in auth) await this.#readExternalToken(() => auth.getToken());
 	}
 	/**
 	* Заголовки уже подготовленной авторизации без чтения storage или вызова внешнего источника.
@@ -396,6 +529,7 @@ var AuthManager = class {
 	* через `itd.auth.refresh()`, а библиотека просто пробрасывает {@link ItdAuthError}.
 	*/
 	recover() {
+		this.#assertActive();
 		return this.#config.autoRefresh ? this.onUnauthorized() : Promise.resolve(false);
 	}
 	/**
@@ -406,6 +540,7 @@ var AuthManager = class {
 	* по новой сессии на каждый старт.
 	*/
 	deviceId() {
+		this.#assertActive();
 		if (this.#deviceId) return Promise.resolve(this.#deviceId);
 		this.#deviceIdLoading ??= this.#resolveDeviceId().finally(() => {
 			this.#deviceIdLoading = null;
@@ -413,9 +548,12 @@ var AuthManager = class {
 		return this.#deviceIdLoading;
 	}
 	async #resolveDeviceId() {
+		const revision = this.#authEpoch;
 		const session = await this.#loadSession();
+		this.#assertActive();
 		const deviceId = this.#config.deviceId ?? session?.deviceId ?? createDeviceId();
 		this.#deviceId = deviceId;
+		if (this.#authEpoch !== revision) return deviceId;
 		if (session?.deviceId !== deviceId) await this.#saveSession({
 			...session ?? {},
 			deviceId
@@ -429,6 +567,7 @@ var AuthManager = class {
 	* и пароль, первый же запрос сам заведёт сессию.
 	*/
 	async token() {
+		this.#assertActive();
 		const session = await this.#loadSession();
 		if (session?.accessToken) return session.accessToken;
 		const auth = this.#config.auth;
@@ -443,6 +582,7 @@ var AuthManager = class {
 	* @returns `true`, если токен обновлён и запрос имеет смысл повторить
 	*/
 	async onUnauthorized() {
+		this.#assertActive();
 		try {
 			if (await this.#refreshDeduplicated() !== null) return true;
 			this.#emitter.emit("authError", { error: this.#noRefreshSessionError() });
@@ -478,24 +618,33 @@ var AuthManager = class {
 	* @throws {ItdAuthError} если обновить сессию не удалось
 	*/
 	async refresh() {
+		this.#assertActive();
 		const token = await this.#refreshDeduplicated();
 		if (token === null) throw this.#noRefreshSessionError();
 		return token;
 	}
 	/** Сохраняет токен, полученный извне, — например после подтверждения OTP. */
-	async setAccessToken(accessToken) {
+	async setAccessToken(accessToken, expectedRevision = this.#authEpoch, cookies) {
+		this.#assertActive();
+		if (typeof accessToken !== "string" || accessToken.trim() === "") throw new ItdConfigError("accessToken должен быть непустой строкой");
 		await this.#loadSession();
+		this.#assertActive();
+		if (this.#authEpoch !== expectedRevision) return false;
+		if (cookies) this.#jar.replaceWith(cookies);
 		this.#invalidateInFlight();
 		this.#transitionAuth(accessToken);
-		await this.#saveSession({
+		const saved = this.#saveSession({
 			...this.#session ?? {},
 			accessToken,
 			obtainedAt: this.#config.clock.now()
 		});
 		this.#emitter.emit("tokens", { accessToken });
+		await saved;
+		return true;
 	}
 	/** Текущая сессия целиком. Полезно, чтобы сохранить её самому. */
 	async getSession() {
+		this.#assertActive();
 		const session = await this.#loadSession();
 		return session ? copySession(session) : null;
 	}
@@ -506,20 +655,24 @@ var AuthManager = class {
 	* токена идентификатор прежнего владельца остаться не может.
 	*/
 	async getUserId() {
+		this.#assertActive();
 		const session = await this.#loadSession();
-		return session?.accessToken ? readTokenSubject(session.accessToken) : void 0;
+		return session?.accessToken ? this.#identityForToken(session.accessToken).userId : void 0;
 	}
 	/** Заменяет сессию и связанные с ней cookie целиком. */
 	async setSession(session) {
+		this.#assertActive();
+		const normalized = normalizeSession(session, "session");
 		await this.#loadSession();
+		this.#assertActive();
 		this.#invalidateInFlight();
-		this.#transitionAuth(session.accessToken);
+		this.#transitionAuth(normalized.accessToken);
 		this.#jar.clear();
-		this.#jar.deserialize(session.cookies);
-		if (session.deviceId) this.#deviceId = session.deviceId;
-		this.#session = session;
+		this.#jar.deserialize(normalized.cookies);
+		if (normalized.deviceId) this.#deviceId = normalized.deviceId;
+		this.#session = normalized;
 		this.#seedRefreshCookie();
-		await this.#saveSession(session);
+		await this.#saveSession(normalized);
 	}
 	/**
 	* Забывает сессию и cookie. Сетевой запрос не выполняется.
@@ -528,14 +681,19 @@ var AuthManager = class {
 	* новую запись в списке сессий.
 	*/
 	async clear() {
+		this.#assertActive();
 		await this.#loadSession();
+		this.#assertActive();
 		this.#invalidateInFlight();
 		this.#transitionAuth(void 0);
-		this.#session = null;
 		this.#jar.clear();
-		await this.#config.storage.clear();
-		if (this.#deviceId) await this.#saveSession({ deviceId: this.#deviceId });
+		const retained = this.#deviceId ? { deviceId: this.#deviceId } : null;
+		this.#session = retained;
 		this.#emitter.emit("signOut", void 0);
+		await this.#enqueuePersistence(async () => {
+			await this.#config.storage.clear();
+			if (retained) await this.#config.storage.set(copySession(retained));
+		});
 	}
 	#loadSession() {
 		if (this.#session !== void 0) return Promise.resolve(this.#session);
@@ -546,7 +704,8 @@ var AuthManager = class {
 	}
 	async #performLoad() {
 		const loaded = await this.#config.storage.get() ?? null;
-		const stored = loaded ? withoutLegacyUserId(loaded) : null;
+		this.#assertActive();
+		const stored = loaded === null ? null : normalizeSessionValue(loaded, "storage.get()", "stored", this.#config.logger);
 		if (stored?.cookies) this.#jar.deserialize(stored.cookies);
 		const fromConfig = this.#sessionFromConfig(this.#config.auth);
 		this.#session = stored && fromConfig ? {
@@ -568,7 +727,7 @@ var AuthManager = class {
 		if (!this.#config.useCookieJar) return;
 		const refreshToken = this.#session?.refreshToken;
 		if (!refreshToken) return;
-		if (this.#jar.has("refresh_token")) return;
+		if (this.#jar.has("refresh_token", this.#config.baseUrl + "/api/v1/auth")) return;
 		this.#jar.set(this.#config.baseUrl, REFRESH_COOKIE, refreshToken, REFRESH_COOKIE_PATH);
 	}
 	#sessionFromConfig(auth) {
@@ -587,56 +746,76 @@ var AuthManager = class {
 	async #saveSession(session) {
 		const cookies = this.#config.useCookieJar ? this.#jar.serialize() : void 0;
 		const deviceId = session.deviceId ?? this.#deviceId;
+		const { cookies: _staleCookies, ...withoutCookies } = copySession(session);
 		const next = withoutLegacyUserId({
-			...session,
+			...withoutCookies,
 			...cookies?.length ? { cookies } : {},
 			...deviceId ? { deviceId } : {}
 		});
 		this.#session = next;
-		await this.#config.storage.set(next);
-	}
-	/**
-	* Обновление с дедупликацией.
-	*
-	* Все, кто пришёл, пока обновление уже идёт, получают его результат, а не запускают своё.
-	*/
-	#refreshDeduplicated() {
-		if (this.#refreshing) return this.#refreshing;
-		const promise = this.#performRefresh().finally(() => {
-			this.#refreshing = null;
+		await this.#enqueuePersistence(() => this.#config.storage.set(copySession(next)));
+	}
+	#enqueuePersistence(operation) {
+		const pending = this.#persistence.then(operation, operation);
+		this.#persistence = pending.catch(() => {});
+		return pending;
+	}
+	/** Дедуплицирует refresh одной ревизии; следующая ждёт завершения предыдущей. */
+	#refreshDeduplicated(expectation = { epoch: this.#authEpoch }) {
+		const current = this.#refreshing;
+		if (current) {
+			if (current.epoch === expectation.epoch) return current.promise;
+			return current.promise.then(() => this.#refreshDeduplicated(expectation), () => this.#refreshDeduplicated(expectation));
+		}
+		const promise = this.#performRefresh(expectation).finally(() => {
+			if (this.#refreshing?.promise === promise) this.#refreshing = null;
 		});
-		this.#refreshing = promise;
+		this.#refreshing = {
+			epoch: expectation.epoch,
+			promise
+		};
 		return promise;
 	}
-	async #performRefresh() {
+	#matchesRefreshExpectation(expectation) {
+		return this.#authEpoch === expectation.epoch && (expectation.accessToken === void 0 || this.#session?.accessToken === expectation.accessToken);
+	}
+	async #performRefresh(expectation) {
+		this.#assertActive();
 		await this.#loadSession();
+		if (!this.#matchesRefreshExpectation(expectation)) return this.#currentAccessToken();
 		if (!this.#hasRefreshSession()) return this.#reloginOrNull();
-		const epoch = this.#authEpoch;
+		const flowCookies = this.#jar.clone();
 		try {
 			const accessToken = await this.#http.execute(AUTH_REFRESH, {
 				path: AUTH_PATHS.refresh,
 				skipAuth: true,
-				skipAuthRefresh: true
+				skipAuthRefresh: true,
+				cookieJar: flowCookies
 			});
-			if (!accessToken) return this.#reloginOrNull();
-			if (this.#authEpoch !== epoch) return this.#session?.accessToken ?? null;
+			if (!this.#matchesRefreshExpectation(expectation)) return this.#session?.accessToken ?? null;
+			this.#jar.replaceWith(flowCookies);
 			const rotated = this.#jar.getValue(REFRESH_COOKIE, this.#config.baseUrl + REFRESH_COOKIE_PATH);
 			this.#transitionAuth(accessToken, false);
-			await this.#saveSession({
+			const saved = this.#saveSession({
 				...this.#session ?? {},
 				accessToken,
 				...rotated ? { refreshToken: rotated } : {},
 				obtainedAt: this.#config.clock.now()
 			});
 			this.#emitter.emit("tokens", { accessToken });
+			await saved;
+			if (this.#authEpoch !== expectation.epoch) return this.#currentAccessToken();
 			return accessToken;
 		} catch (error) {
-			if (error instanceof ItdApiError) {
-				if (this.#authEpoch !== epoch) return this.#session?.accessToken ?? null;
+			if (this.#authEpoch !== expectation.epoch) return this.#currentAccessToken();
+			if (error instanceof ItdAuthError) {
+				this.#invalidateInFlight();
+				const clearedRevision = this.#authEpoch;
 				this.#transitionAuth(void 0);
 				this.#session = null;
 				this.#jar.clear();
-				await this.#config.storage.clear();
+				await this.#enqueuePersistence(() => this.#config.storage.clear());
+				if (this.#authEpoch !== clearedRevision) return this.#currentAccessToken();
 				const relogged = await this.#reloginOrNull();
 				if (relogged !== null) return relogged;
 				throw error;
@@ -650,7 +829,8 @@ var AuthManager = class {
 		if (!this.#config.reloginOnRefreshFailure || !auth || typeof auth !== "object" || !("email" in auth)) return null;
 		try {
 			return await this.#signInWithCredentials(auth);
-		} catch {
+		} catch (error) {
+			this.#config.logger?.warn("Автоматический повторный вход не удался", error);
 			return null;
 		}
 	}
@@ -662,7 +842,8 @@ var AuthManager = class {
 	*/
 	#signInWithCredentials(credentials) {
 		if (this.#signingIn) return this.#signingIn;
-		const promise = this.#performSignIn(credentials).finally(() => {
+		const revision = this.#authEpoch;
+		const promise = this.#performSignIn(credentials, revision).finally(() => {
 			this.#signingIn = null;
 		});
 		this.#signingIn = promise;
@@ -682,8 +863,9 @@ var AuthManager = class {
 		if (credentials.turnstileToken) return credentials.turnstileToken;
 		throw new ItdConfigError("Вход по email и паролю требует токен капчи Cloudflare Turnstile: без него сервер отвечает 422. Передайте auth.getTurnstileToken (источник свежего токена) либо разовый auth.turnstileToken. Ключ виджета — TURNSTILE_SITE_KEY. В Node токен умеет добывать отдельный пакет: npm i @itd-api/turnstile, затем getTurnstileToken: createTurnstileSolver().");
 	}
-	async #performSignIn(credentials) {
+	async #performSignIn(credentials, revision) {
 		const turnstileToken = await this.#resolveTurnstileToken(credentials);
+		const flowCookies = new CookieJar();
 		const result = await this.#http.execute(AUTH_SIGN_IN, {
 			path: AUTH_PATHS.signIn,
 			body: {
@@ -692,18 +874,23 @@ var AuthManager = class {
 				turnstileToken
 			},
 			skipAuth: true,
-			skipAuthRefresh: true
+			skipAuthRefresh: true,
+			cookieJar: flowCookies
 		});
 		if (result.status !== SignInStatus.Authenticated) throw new ItdConfigError("Вход по email и паролю требует подтверждения кодом из письма. Автоматический вход невозможен: воспользуйтесь itd.auth.signInWithOtp() и передайте полученный accessToken в конфигурацию клиента.");
 		const accessToken = result.accessToken;
+		this.#assertActive();
+		if (this.#authEpoch !== revision) return this.#session?.accessToken ?? null;
+		this.#jar.replaceWith(flowCookies);
 		this.#invalidateInFlight();
 		this.#transitionAuth(accessToken);
-		await this.#saveSession({
+		const saved = this.#saveSession({
 			accessToken,
 			obtainedAt: this.#config.clock.now()
 		});
 		this.#emitter.emit("tokens", { accessToken });
 		this.#emitter.emit("signIn", { accessToken });
+		await saved;
 		return accessToken;
 	}
 };
@@ -762,14 +949,18 @@ var AuthResource = class extends BaseResource {
 	* @param credentials email, пароль и обязательный токен капчи — см. {@link CaptchaCredentials}
 	*/
 	async signIn(credentials, options = {}) {
+		const revision = this.#auth.revision();
+		const cookies = this.#auth.createCookieFlow(false);
 		const result = await this.http.execute(AUTH_SIGN_IN, {
 			path: AUTH_PATHS.signIn,
 			body: credentials,
 			skipAuth: true,
 			skipAuthRefresh: true,
+			cookieJar: cookies,
 			...options
 		});
-		if (result.status === SignInStatus.Authenticated) await this.#auth.setAccessToken(result.accessToken);
+		if (result.status === SignInStatus.Authenticated) await this.#auth.setAccessToken(result.accessToken, revision, cookies);
+		else this.#auth.commitCookieFlow(cookies, revision);
 		return result;
 	}
 	/**
@@ -778,14 +969,17 @@ var AuthResource = class extends BaseResource {
 	* Полученный токен сохраняется в клиенте автоматически.
 	*/
 	async verifyOtp(input, options = {}) {
+		const revision = this.#auth.revision();
+		const cookies = this.#auth.createCookieFlow();
 		const accessToken = await this.http.execute(AUTH_VERIFY_OTP, {
 			path: AUTH_PATHS.verifyOtp,
 			body: input,
 			skipAuth: true,
 			skipAuthRefresh: true,
+			cookieJar: cookies,
 			...options
 		});
-		await this.#auth.setAccessToken(accessToken);
+		await this.#auth.setAccessToken(accessToken, revision, cookies);
 		return accessToken;
 	}
 	/** Отправляет код подтверждения повторно. */
@@ -1704,7 +1898,7 @@ var ItdAccounts = class ItdAccounts {
 		})));
 		const added = [];
 		for (const { name, session } of sessions) {
-			if (!isRestorableSession(session)) continue;
+			if (!isRestorableSession(session, this.#base.baseUrl ?? "https://xn--d1ah4a.com")) continue;
 			if (this.#clients.has(name) || this.#removing.has(name)) continue;
 			this.addAccount(name);
 			added.push(name);
@@ -1957,6 +2151,6 @@ function createAccounts(options = {}) {
 	return new ItdAccounts(options);
 }
 //#endregion
-export { ALLOWED_MIME_TYPES, AUDIO_MIME_TYPES, AccessType, AttachmentType, BUCKET_LIMITS, CommentSort, DEFAULT_BASE_URL, DEFAULT_RATE_LIMIT_BUCKET, EventChannel, EventChannelStatus, EventComposer, EventRouter, FeedTab, FileTransferMode, IMAGE_MIME_TYPES, IncidentKind, InteractionType, ItdAbortError, ItdAccounts, ItdApiError, ItdApiErrorKind, ItdAuthError, ItdClient, ItdConfigError, ItdConflictError, ItdError, ItdErrorCode, ItdErrorKind, ItdFileError, ItdFileErrorReason, ItdForbiddenError, ItdNetworkError, ItdNotFoundError, ItdPhoneVerificationError, ItdRateLimitError, ItdServerError, ItdStateError, ItdTimeoutError, ItdValidationError, LIBRARY_VERSION, LikesVisibility, MemoryKeyValueStore, MemoryMultiTokenStorage, MemoryShopOrderAccessStorage, MemoryTokenStorage, NotificationEvents, NotificationEventsClient, NotificationEventsTransport, NotificationType, NotificationUpdateOrigin, NotificationUpdateType, OPERATIONS, PaginationMode, Paginator, RateLimitPacing, ReportReason, ReportTargetType, RetrySafety, RuntimeMode, STATUS_SERVICE, ServiceState, ShopConsentKind, ShopOrderStatus, ShopProductCategory, ShopProductStatus, SignInStatus, SpanRenderFormat, SpanType, TURNSTILE_SITE_KEY, UnauthorizedStreamError, VIDEO_MIME_TYPES, ViewReason, ViewSource, WallAccess, WebSocketTransport, autoSpans, canonicalNotificationType, comment, createAccounts, createClient, createKeyValueStore, createMemoryShopOrderAccessStorage, createMultiTokenStorage, createNotificationEventsClient, createRecordKeyValueStore, createShopFeature, createShopOrderAccessStorage, createTokenStorage, formatNotificationText, fromStream, fromUrl, isBuilder, isBuiltInOperationId, isEnumerableKeyValueStore, isItdApiError, isItdAuthError, isItdConflictError, isItdError, isItdFileError, isItdForbiddenError, isItdNotFoundError, isItdPhoneVerificationError, isItdRateLimitError, isItdServerError, isItdStateError, isItdValidationError, isKnownNotificationType, isMyProfile, mapPage, markup, normalizeNotification, operationBucket, operationMethod, operationRetrySafety, parseHtml, parseMarkdown, poll, post, renderSpans, report, resolveNotificationUrl, runEventMiddleware, scopedTokenStorage, statusDays, systemClock, toDate, utcStampToIso, withCodec, withNamespace };
+export { ALLOWED_MIME_TYPES, AUDIO_MIME_TYPES, AccessType, AttachmentType, BUCKET_LIMITS, CommentSort, DEFAULT_BASE_URL, DEFAULT_RATE_LIMIT_BUCKET, EventChannel, EventChannelStatus, EventComposer, EventRouter, FeedTab, FileTransferMode, IMAGE_MIME_TYPES, IncidentKind, InteractionType, ItdAbortError, ItdAccounts, ItdApiError, ItdApiErrorKind, ItdAuthError, ItdClient, ItdConfigError, ItdConflictError, ItdError, ItdErrorCode, ItdErrorKind, ItdFileError, ItdFileErrorReason, ItdForbiddenError, ItdNetworkError, ItdNotFoundError, ItdPhoneVerificationError, ItdRateLimitError, ItdServerError, ItdStateError, ItdTimeoutError, ItdValidationError, LIBRARY_VERSION, LikesVisibility, MemoryKeyValueStore, MemoryMultiTokenStorage, MemoryShopOrderAccessStorage, MemoryTokenStorage, NotificationEvents, NotificationEventsClient, NotificationEventsTransport, NotificationType, NotificationUpdateOrigin, NotificationUpdateType, OPERATIONS, PaginationMode, Paginator, RateLimitPacing, ReportReason, ReportTargetType, RetrySafety, RuntimeMode, STATUS_SERVICE, ServiceState, ShopConsentKind, ShopOrderStatus, ShopProductCategory, ShopProductStatus, SignInStatus, SpanRenderFormat, SpanType, TURNSTILE_SITE_KEY, UnauthorizedStreamError, VIDEO_MIME_TYPES, ViewReason, ViewSource, WallAccess, WebSocketTransport, autoSpans, canonicalNotificationType, comment, createAccounts, createClient, createKeyValueStore, createMultiTokenStorage, createNotificationEventsClient, createRecordKeyValueStore, createShopFeature, createShopOrderAccessStorage, createTokenStorage, formatNotificationText, fromStream, fromUrl, isBuilder, isBuiltInOperationId, isEnumerableKeyValueStore, isItdApiError, isItdAuthError, isItdConflictError, isItdError, isItdFileError, isItdForbiddenError, isItdNotFoundError, isItdPhoneVerificationError, isItdRateLimitError, isItdServerError, isItdStateError, isItdValidationError, isKnownNotificationType, isMyProfile, mapPage, markup, normalizeNotification, operationBucket, operationMethod, operationRetrySafety, parseHtml, parseMarkdown, poll, post, renderSpans, report, resolveNotificationUrl, runEventMiddleware, scopedTokenStorage, statusDays, systemClock, toDate, utcStampToIso, withCodec, withNamespace };
 
 //# sourceMappingURL=index.js.map