itd-api 0.9.3 → 0.10.0

package/dist/index.js

@@ -1,9 +1,9 @@
-import { $ as orderPluginDefinitions, A as ITD_CATALOG, C as ReportReason, D as ViewReason, E as SpanType, F as operationMethod, G as pickString, I as operationRetrySafety, K as RetrySafety, L as BUCKET_LIMITS, M as defineBuiltInOperation, N as isBuiltInOperationId, O as ViewSource, P as operationBucket, Q as assertPluginRemovable, R as DEFAULT_RATE_LIMIT_BUCKET, S as NotificationType, T as ServiceState, V as pickArray, Z as RequestQueuePool, _ as FeedTab, at as isRecord, b as ItdErrorCode, c as normalizeNotification, d as canonicalNotificationType, et as DEFAULT_BASE_URL, f as isKnownNotificationType, g as EventChannelStatus, h as CommentSort, it as LIBRARY_VERSION, j as OPERATIONS, k as WallAccess, lt as systemClock, m as AttachmentType, n as formatNotificationText, nt as STATUS_SERVICE, o as passthroughOperation, ot as requireOptionalBoolean, p as AccessType, rt as resolveRateLimit, s as voidOperation, st as RateLimitPacing, t as resolveNotificationUrl, ut as installAsyncDisposeFallback, v as IncidentKind, w as ReportTargetType, x as LikesVisibility, y as InteractionType, z as createClientRuntime } from "./shared/url-3Ts6EEHQ.js";
+import { A as ViewReason, B as BUCKET_LIMITS, C as ItdErrorCode, D as ReportTargetType, E as ReportReason, F as defineBuiltInOperation, G as pickArray, H as createClientRuntime, I as isBuiltInOperationId, L as operationBucket, M as WallAccess, N as ITD_CATALOG, O as ServiceState, P as OPERATIONS, R as operationMethod, S as InteractionType, T as NotificationType, U as createApiError, V as DEFAULT_RATE_LIMIT_BUCKET, X as RetrySafety, Y as pickString, _ as CaptchaType, at as orderPluginDefinitions, b as FeedTab, c as normalizeNotification, ct as STATUS_SERVICE, d as canonicalNotificationType, dt as isRecord, et as createRequestAbortScope, f as isKnownNotificationType, ft as requireOptionalBoolean, g as CaptchaField, gt as installAsyncDisposeFallback, h as CaptchaChoice, ht as systemClock, it as assertPluginRemovable, j as ViewSource, k as SpanType, lt as resolveRateLimit, m as AttachmentType, n as formatNotificationText, o as passthroughOperation, ot as DEFAULT_BASE_URL, p as AccessType, pt as RateLimitPacing, rt as RequestQueuePool, s as voidOperation, t as resolveNotificationUrl, tt as requestAbortError, ut as LIBRARY_VERSION, v as CommentSort, w as LikesVisibility, x as IncidentKind, y as EventChannelStatus, z as operationRetrySafety } from "./shared/url-BA5hEwj2.js";
 import { A as isItdStateError, C as isItdError, D as isItdPhoneVerificationError, E as isItdNotFoundError, O as isItdRateLimitError, S as isItdConflictError, T as isItdForbiddenError, _ as ItdStateError, a as ItdConfigError, b as isItdApiError, c as ItdErrorKind, d as ItdForbiddenError, f as ItdNetworkError, g as ItdServerError, h as ItdRateLimitError, i as ItdAuthError, j as isItdValidationError, k as isItdServerError, l as ItdFileError, m as ItdPhoneVerificationError, n as ItdApiError, o as ItdConflictError, p as ItdNotFoundError, r as ItdApiErrorKind, s as ItdError, t as ItdAbortError, u as ItdFileErrorReason, v as ItdTimeoutError, w as isItdFileError, x as isItdAuthError, y as ItdValidationError } from "./shared/errors-GI10kZxk.js";
-import { c as REFRESH_COOKIE, l as REFRESH_COOKIE_PATH, s as CookieJar, u as isSerializedCookieEntry, v as RuntimeMode, y as createDeviceId } from "./shared/redact-DJV0XM3n.js";
-import { A as utcStampToIso, C as AUDIO_MIME_TYPES, D as isBuilder, E as comment, F as mapPage, I as createFeatureHost, L as ExtensibleOperationCatalog, M as BaseResource, N as PaginationMode, O as createStatusFeature, P as Paginator, S as ALLOWED_MIME_TYPES, T as VIDEO_MIME_TYPES, _ as poll, a as createShopOrderAccessStorage, b as parseHtml, c as ShopOrderStatus, d as isMyProfile, f as fromStream, g as post, h as report, i as MemoryShopOrderAccessStorage, j as NotificationsResource, k as toDate, l as ShopProductCategory, m as createResources, n as renderSpans, o as statusDays, p as fromUrl, r as createShopFeature, s as ShopConsentKind, t as SpanRenderFormat, u as ShopProductStatus, v as autoSpans, w as IMAGE_MIME_TYPES, x as parseMarkdown, y as markup } from "./shared/render-CtOpp9Pm.js";
+import { c as REFRESH_COOKIE, h as joinUrl, l as REFRESH_COOKIE_PATH, s as CookieJar, u as isSerializedCookieEntry, v as RuntimeMode, y as createDeviceId } from "./shared/redact-DJV0XM3n.js";
+import { A as utcStampToIso, C as AUDIO_MIME_TYPES, D as isBuilder, E as comment, F as mapPage, I as createFeatureHost, L as ExtensibleOperationCatalog, M as BaseResource, N as PaginationMode, O as createStatusFeature, P as Paginator, S as ALLOWED_MIME_TYPES, T as VIDEO_MIME_TYPES, _ as poll, a as createShopOrderAccessStorage, b as parseHtml, c as ShopOrderStatus, d as isMyProfile, f as fromStream, g as post, h as report, i as MemoryShopOrderAccessStorage, j as NotificationsResource, k as toDate, l as ShopProductCategory, m as createResources, n as renderSpans, o as statusDays, p as fromUrl, r as createShopFeature, s as ShopConsentKind, t as SpanRenderFormat, u as ShopProductStatus, v as autoSpans, w as IMAGE_MIME_TYPES, x as parseMarkdown, y as markup } from "./shared/render-CkhvH_yh.js";
 import { c as FileTransferMode } from "./shared/options-i4LrKfqx.js";
-import { _ as reportListenerError, a as WebSocketTransport, c as NotificationEventsTransport, d as NotificationUpdateOrigin, f as NotificationUpdateType, g as Emitter, h as runEventMiddleware, i as createNotificationEventsClient, l as resolveNotificationEventsOptions, m as UnauthorizedStreamError, n as EventRouter, o as EVENT_OPERATIONS, p as EventChannel, r as NotificationEventsClient, s as NotificationEvents, t as EventComposer, u as setNotificationEventsConnectGuard } from "./shared/events-BzjI6pn5.js";
+import { _ as Emitter, a as WebSocketTransport, c as NotificationEventsTransport, d as NotificationUpdateOrigin, f as NotificationUpdateType, g as runEventMiddleware, h as UnauthorizedStreamError, i as createNotificationEventsClient, l as resolveNotificationEventsOptions, m as EventChannel, n as EventRouter, o as EVENT_OPERATIONS, p as createParser, r as NotificationEventsClient, s as NotificationEvents, t as EventComposer, u as setNotificationEventsConnectGuard, v as reportListenerError } from "./shared/events-B0Wtn4cF.js";
 import { a as isEnumerableKeyValueStore, i as createRecordKeyValueStore, o as withCodec, r as createKeyValueStore, s as withNamespace, t as MemoryKeyValueStore } from "./shared/key-value-store-Bt2PSMxY.js";
 import { n as copySession, r as createTokenStorage, t as MemoryTokenStorage } from "./shared/storage-DiDe0PZM.js";
 import { a as scopedTokenStorage, i as isRestorableSession, n as controlledTokenStorage, r as createMultiTokenStorage, t as MemoryMultiTokenStorage } from "./shared/multi-storage-C3Ngtop1.js";
@@ -31,12 +31,37 @@ const SignInStatus = Object.freeze({
 	Authenticated: "authenticated",
 	OtpRequired: "otp_required"
 });
+/**
+* Поле тела запроса по умолчанию для известных провайдеров.
+*
+* Используется, когда провайдера не спрашивали. Ответ `captchaProvider()` важнее этой таблицы.
+*/
+const CAPTCHA_FIELDS = Object.freeze({
+	[CaptchaType.Itd]: CaptchaField.Itd,
+	[CaptchaType.Cloudflare]: CaptchaField.Cloudflare
+});
+/** Состояния, которые может вернуть проверка QR-входа. */
+const QrLoginStatus = Object.freeze({
+	Pending: "pending",
+	Scanned: "scanned",
+	CaptchaRequired: "captcha_required",
+	Authorized: "authorized",
+	Rejected: "rejected"
+});
+/** Состояния, приходящие из потокового наблюдения за QR-входом. */
+const QrLoginStreamStatus = Object.freeze({
+	Pending: "pending",
+	Scanned: "scanned",
+	Approved: "approved",
+	Rejected: "rejected"
+});
 function requireString(body, key, message) {
 	const value = pickString(body, key);
 	if (!value) throw new ItdConfigError(message);
 	return value;
 }
 const AUTH_CHECK = passthroughOperation("auth.check");
+const AUTH_CAPTCHA_PROVIDER = passthroughOperation("auth.captchaProvider");
 const AUTH_SIGN_UP = defineBuiltInOperation("auth.signUp", (body) => requireString(body, "flowToken", "Сервер не вернул flowToken при регистрации"));
 const AUTH_SIGN_IN = defineBuiltInOperation("auth.signIn", (body) => {
 	const accessToken = pickString(body, "accessToken");
@@ -58,6 +83,84 @@ const AUTH_CHANGE_PASSWORD = voidOperation("auth.changePassword");
 const AUTH_SESSIONS = defineBuiltInOperation("auth.sessions", (body) => pickArray(body, "sessions"));
 const AUTH_REVOKE_SESSION = voidOperation("auth.revokeSession");
 const AUTH_REVOKE_OTHER_SESSIONS = voidOperation("auth.revokeOtherSessions");
+const AUTH_QR_START = passthroughOperation("auth.qrStart");
+const AUTH_QR_CLAIM = passthroughOperation("auth.qrClaim");
+//#endregion
+//#region src/session/captcha.ts
+function requireCaptchaText(value, field) {
+	if (value !== void 0 && (typeof value !== "string" || value.trim() === "")) throw new ItdConfigError(`${field} должен быть непустой строкой`);
+}
+/**
+* Проверяет форму блока `auth.captcha`.
+*
+* Отсутствие источника токена ошибкой не считается: до входа по паролю дело может и не
+* дойти. О нехватке сообщит {@link resolveCaptchaBody} в момент входа.
+*
+* @throws {ItdConfigError} при некорректных значениях
+*/
+function validateCaptchaOptions(captcha) {
+	if (captcha === void 0) return;
+	if (!isRecord(captcha)) throw new ItdConfigError("auth.captcha должен быть объектом");
+	const { type, token, getToken, field } = captcha;
+	requireCaptchaText(type, "auth.captcha.type");
+	requireCaptchaText(token, "auth.captcha.token");
+	requireCaptchaText(field, "auth.captcha.field");
+	if (getToken !== void 0 && typeof getToken !== "function") throw new ItdConfigError("auth.captcha.getToken должен быть функцией");
+}
+/** Разбирает ответ `GET /api/v1/auth/captcha/provider` для автоматического входа. */
+function readCaptchaProvider(body) {
+	const config = isRecord(body) ? body : void 0;
+	const provider = config?.provider;
+	const field = config?.field;
+	if (typeof provider !== "string" || provider.trim() === "" || typeof field !== "string" || field.trim() === "") throw new ItdConfigError("Сервер вернул неподдерживаемую конфигурацию капчи");
+	return {
+		provider,
+		field
+	};
+}
+/** Куда класть токен: настройка, иначе умолчание провайдера. */
+function resolveField(type, configured) {
+	const field = configured ?? CAPTCHA_FIELDS[type];
+	if (field) return field;
+	throw new ItdConfigError(`Неизвестно, в каком поле сервер ждёт токен капчи «${type}». Передайте auth.captcha.field либо оставьте auth.captcha.type = ${CaptchaChoice.Auto}, чтобы поле назвал сервер.`);
+}
+/** Спрашивает свежий токен, затем берёт разовый. */
+async function resolveToken(captcha, type) {
+	const token = await captcha.getToken?.(type) || captcha.token;
+	if (token) return token;
+	throw new ItdConfigError(`Источник капчи не вернул токен для провайдера «${type}». Проверьте auth.captcha.getToken.`);
+}
+/**
+* Готовит фрагмент тела запроса с токеном капчи.
+*
+* При `CaptchaChoice.Auto` провайдер спрашивается у сервера — тогда и тип виджета,
+* и имя поля приходят оттуда. Явно названный тип решается без этого запроса.
+*
+* @param askProvider как спросить активного провайдера; вызывается, только если это нужно
+* @throws {ItdConfigError} если капча не настроена или токен не получен
+*/
+async function resolveCaptchaBody(captcha, askProvider) {
+	if (!captcha?.token && !captcha?.getToken) throw new ItdConfigError("Вход по email и паролю требует токен капчи. Передайте auth.captcha.getToken — источник свежего токена — либо разовый auth.captcha.token. В Node токен получает пакет @itd-api/captcha.");
+	const choice = captcha.type ?? CaptchaChoice.Auto;
+	if (choice === CaptchaChoice.Auto) {
+		const { provider, field } = await askProvider();
+		return { [field]: await resolveToken(captcha, provider) };
+	}
+	return { [resolveField(choice, captcha.field)]: await resolveToken(captcha, choice) };
+}
+/**
+* Готовит фрагмент тела для разового вызова с готовым доказательством.
+*
+* Поле берётся из самого доказательства либо из умолчания провайдера; запроса к серверу нет.
+*
+* @throws {ItdConfigError} если доказательство неполное
+*/
+function captchaBody(captcha) {
+	if (!isRecord(captcha)) throw new ItdConfigError("captcha должен быть объектом { type, token }");
+	if (typeof captcha.token !== "string" || captcha.token.trim() === "") throw new ItdConfigError("captcha.token должен быть непустой строкой");
+	if (typeof captcha.type !== "string" || captcha.type.trim() === "") throw new ItdConfigError("captcha.type должен быть непустой строкой");
+	return { [resolveField(captcha.type, captcha.field)]: captcha.token };
+}
 //#endregion
 //#region src/session/jwt.ts
 /**
@@ -130,11 +233,10 @@ function validateAuth(auth) {
 		return { ...auth };
 	}
 	if ("email" in auth || "password" in auth) {
-		const { email, password, turnstileToken, getTurnstileToken } = auth;
+		const { email, password, captcha } = auth;
 		if (typeof email !== "string" || email.trim() === "") throw new ItdConfigError("auth.email должен быть непустой строкой");
 		if (typeof password !== "string" || password === "") throw new ItdConfigError("auth.password должен быть непустой строкой");
-		if (getTurnstileToken !== void 0 && typeof getTurnstileToken !== "function") throw new ItdConfigError("auth.getTurnstileToken должен быть функцией");
-		if (turnstileToken !== void 0 && (typeof turnstileToken !== "string" || turnstileToken.trim() === "")) throw new ItdConfigError("auth.turnstileToken должен быть непустой строкой");
+		validateCaptchaOptions(captcha);
 		return { ...auth };
 	}
 	throw new ItdConfigError("auth не распознан. Ожидается строка с accessToken либо объект { accessToken }, { email, password } или { getToken }");
@@ -181,6 +283,7 @@ function createItdAuth(options, deps) {
 }
 /** Пути эндпоинтов авторизации. */
 const AUTH_PATHS = {
+	captchaProvider: "/api/v1/auth/captcha/provider",
 	signUp: "/api/v1/auth/sign-up",
 	signIn: "/api/v1/auth/sign-in",
 	verifyOtp: "/api/v1/auth/verify-otp",
@@ -190,7 +293,10 @@ const AUTH_PATHS = {
 	forgotPassword: "/api/v1/auth/forgot-password",
 	resetPassword: "/api/v1/auth/reset-password",
 	changePassword: "/api/v1/auth/change-password",
-	sessions: "/api/v1/auth/sessions"
+	sessions: "/api/v1/auth/sessions",
+	qrStart: "/api/v1/auth/qr/start",
+	qrClaim: "/api/v1/auth/qr/claim",
+	qrStream: "/api/v1/auth/qr/stream"
 };
 /**
 * Публичный ключ Cloudflare Turnstile платформы итд.com.
@@ -200,14 +306,15 @@ const AUTH_PATHS = {
 *
 * Ключ привязан к домену: на чужом origin Cloudflare отказывает виджету с кодом `110200`.
 * Поэтому отрисовать его может только код, выполняемый на самом итд.com. Остальным
-* подходит `@itd-api/turnstile`, готовый токен из другого источника или вовсе вход
+* подходит `@itd-api/captcha`, готовый токен из другого источника или вовсе вход
 * без капчи — по сохранённой сессии либо по токенам, взятым в браузере.
 *
 * @example
 * ```ts
 * turnstile.render('#captcha', {
 *   sitekey: TURNSTILE_SITE_KEY,
-*   callback: (turnstileToken) => itd.auth.signIn({ email, password, turnstileToken }),
+*   callback: (token) =>
+*     itd.auth.signIn({ email, password, captcha: { type: CaptchaType.Cloudflare, token } }),
 * });
 * ```
 */
@@ -625,6 +732,13 @@ var AuthManager = class {
 	}
 	/** Сохраняет токен, полученный извне, — например после подтверждения OTP. */
 	async setAccessToken(accessToken, expectedRevision = this.#authEpoch, cookies) {
+		return this.#storeAccessToken(accessToken, expectedRevision, cookies, false);
+	}
+	/** Атомарно принимает токен и cookie завершённого входа как новую сессию. @internal */
+	async commitAuthFlow(accessToken, cookies, expectedRevision = this.#authEpoch) {
+		return this.#storeAccessToken(accessToken, expectedRevision, cookies, true);
+	}
+	async #storeAccessToken(accessToken, expectedRevision, cookies, replaceSession) {
 		this.#assertActive();
 		if (typeof accessToken !== "string" || accessToken.trim() === "") throw new ItdConfigError("accessToken должен быть непустой строкой");
 		await this.#loadSession();
@@ -634,7 +748,7 @@ var AuthManager = class {
 		this.#invalidateInFlight();
 		this.#transitionAuth(accessToken);
 		const saved = this.#saveSession({
-			...this.#session ?? {},
+			...replaceSession ? {} : this.#session ?? {},
 			accessToken,
 			obtainedAt: this.#config.clock.now()
 		});
@@ -849,29 +963,23 @@ var AuthManager = class {
 		this.#signingIn = promise;
 		return promise;
 	}
-	/**
-	* Берёт токен капчи для входа.
-	*
-	* `getTurnstileToken` приоритетнее готовой строки: токен Turnstile одноразовый и живёт
-	* несколько минут, поэтому при повторном входе через сутки годится только свежий.
-	*/
-	async #resolveTurnstileToken(credentials) {
-		if (credentials.getTurnstileToken) {
-			const token = await credentials.getTurnstileToken();
-			if (token) return token;
-		}
-		if (credentials.turnstileToken) return credentials.turnstileToken;
-		throw new ItdConfigError("Вход по email и паролю требует токен капчи Cloudflare Turnstile: без него сервер отвечает 422. Передайте auth.getTurnstileToken (источник свежего токена) либо разовый auth.turnstileToken. Ключ виджета — TURNSTILE_SITE_KEY. В Node токен умеет добывать отдельный пакет: npm i @itd-api/turnstile, затем getTurnstileToken: createTurnstileSolver().");
+	/** Спрашивает у сервера активного провайдера и поле, в котором он ждёт токен. */
+	async #resolveCaptchaProvider() {
+		return readCaptchaProvider(await this.#http.execute(AUTH_CAPTCHA_PROVIDER, {
+			path: AUTH_PATHS.captchaProvider,
+			skipAuth: true,
+			skipAuthRefresh: true
+		}));
 	}
 	async #performSignIn(credentials, revision) {
-		const turnstileToken = await this.#resolveTurnstileToken(credentials);
+		const captcha = await resolveCaptchaBody(credentials.captcha, () => this.#resolveCaptchaProvider());
 		const flowCookies = new CookieJar();
 		const result = await this.#http.execute(AUTH_SIGN_IN, {
 			path: AUTH_PATHS.signIn,
 			body: {
 				email: credentials.email,
 				password: credentials.password,
-				turnstileToken
+				...captcha
 			},
 			skipAuth: true,
 			skipAuthRefresh: true,
@@ -895,6 +1003,125 @@ var AuthManager = class {
 	}
 };
 //#endregion
+//#region src/session/qr-stream.ts
+const QR_STREAM_STATUSES = new Set(Object.values(QrLoginStreamStatus));
+function readQrLoginStreamEvent(data) {
+	let value;
+	try {
+		value = JSON.parse(data);
+	} catch {
+		return;
+	}
+	if (!isRecord(value)) return void 0;
+	const event = value;
+	if (typeof event.status !== "string" || !QR_STREAM_STATUSES.has(event.status)) return;
+	return {
+		status: event.status,
+		...typeof event.expiresIn === "number" && Number.isFinite(event.expiresIn) ? { expiresIn: event.expiresIn } : {}
+	};
+}
+/** Читает короткоживущий SSE-поток QR-входа и последовательно доставляет его события. */
+async function consumeQrLoginStream(body, onEvent, signal) {
+	const reader = body.getReader();
+	const decoder = new TextDecoder();
+	let delivery = Promise.resolve();
+	let completed = false;
+	const cancel = () => {
+		reader.cancel(signal?.reason).catch(() => {});
+	};
+	signal?.addEventListener("abort", cancel, { once: true });
+	const parser = createParser({ onEvent(message) {
+		const event = readQrLoginStreamEvent(message.data);
+		if (!event) return;
+		delivery = delivery.then(() => onEvent(event));
+	} });
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			parser.feed(decoder.decode(value, { stream: true }));
+			await delivery;
+		}
+		parser.feed(decoder.decode());
+		await delivery;
+		if (signal?.aborted) throw signal.reason;
+		completed = true;
+	} finally {
+		signal?.removeEventListener("abort", cancel);
+		if (!completed) await reader.cancel().catch(() => {});
+		reader.releaseLock?.();
+	}
+}
+/** Открывает изолированный HTTP/SSE-канал QR-входа. @internal */
+async function openQrLoginStream(connection, cookies, input, onEvent, signal) {
+	connection.assertActive?.("открыть QR-поток");
+	const path = AUTH_PATHS.qrStream;
+	const method = "POST";
+	const url = joinUrl(connection.baseUrl, path);
+	const abort = createRequestAbortScope(signal, connection.signal, 0, connection.clock);
+	try {
+		const headers = await connection.baseHeaders(url);
+		headers.delete("Authorization");
+		headers.delete("Cookie");
+		headers.set("Accept", "text/event-stream");
+		headers.set("Content-Type", "application/json");
+		const cookie = cookies.getHeader(url);
+		if (cookie) headers.set("Cookie", cookie);
+		let response;
+		try {
+			response = await connection.fetch(url, {
+				method,
+				headers,
+				body: JSON.stringify(input),
+				credentials: "include",
+				signal: abort.signal
+			});
+		} catch (error) {
+			const failure = new ItdNetworkError(`Не удалось открыть QR-поток: ${String(error)}`, {
+				method,
+				path,
+				cause: error
+			});
+			throw requestAbortError(abort, {
+				timeout: 0,
+				method,
+				path
+			}, failure);
+		}
+		cookies.setFromResponse(response.url || url, response);
+		if (!response.ok) {
+			const text = await response.text();
+			let body = text;
+			try {
+				body = JSON.parse(text);
+			} catch {}
+			throw createApiError({
+				method,
+				path,
+				status: response.status,
+				statusText: response.statusText,
+				headers: response.headers,
+				response,
+				body,
+				now: connection.clock.now()
+			});
+		}
+		if (!response.body) throw new ItdNetworkError("Сервер не вернул тело QR-потока", {
+			method,
+			path
+		});
+		await consumeQrLoginStream(response.body, onEvent, abort.signal);
+	} catch (error) {
+		throw requestAbortError(abort, {
+			timeout: 0,
+			method,
+			path
+		}, error);
+	} finally {
+		abort.cleanup();
+	}
+}
+//#endregion
 //#region src/resources/auth.ts
 /**
 * Результат входа.
@@ -909,9 +1136,35 @@ var AuthManager = class {
 */
 var AuthResource = class extends BaseResource {
 	#auth;
+	#connection;
+	#qrFlows = /* @__PURE__ */ new Map();
 	constructor(http, deps) {
 		super(http);
 		this.#auth = deps.auth;
+		this.#connection = deps.connection;
+	}
+	#pruneQrFlows() {
+		const now = this.#connection.clock.now();
+		for (const [qrId, flow] of this.#qrFlows) if (flow.expiresAt !== void 0 && flow.expiresAt <= now) this.#qrFlows.delete(qrId);
+	}
+	#qrFlow(qrId) {
+		this.#pruneQrFlows();
+		const existing = this.#qrFlows.get(qrId);
+		if (existing) return existing;
+		const flow = {
+			cookies: this.#auth.createCookieFlow(false),
+			expiresAt: void 0
+		};
+		this.#qrFlows.set(qrId, flow);
+		return flow;
+	}
+	#touchQrFlow(flow, expiresIn) {
+		if (typeof expiresIn !== "number" || !Number.isFinite(expiresIn)) return;
+		const expiresAt = this.#connection.clock.now() + Math.max(0, expiresIn) * 1e3;
+		flow.expiresAt = flow.expiresAt === void 0 ? expiresAt : Math.min(flow.expiresAt, expiresAt);
+	}
+	#forgetTerminalQrError(qrId, error) {
+		if (isItdApiError(error) && error.hasCode("QR_EXPIRED", "QR_ALREADY_USED", "QR_TOKEN_MISMATCH")) this.#qrFlows.delete(qrId);
 	}
 	/**
 	* Проверяет состояние авторизации и возвращает текущего пользователя.
@@ -925,14 +1178,106 @@ var AuthResource = class extends BaseResource {
 		});
 	}
 	/**
+	* Узнаёт активного провайдера капчи и поле токена.
+	*
+	* Сервер может переключить провайдера или переименовать поле без выпуска новой версии SDK.
+	* Автоматическому входу этот вызов не нужен — клиент делает его сам.
+	*/
+	captchaProvider(options = {}) {
+		return this.http.execute(AUTH_CAPTCHA_PROVIDER, {
+			path: AUTH_PATHS.captchaProvider,
+			skipAuth: true,
+			skipAuthRefresh: true,
+			...options
+		});
+	}
+	/** Создаёт короткоживущую сессию QR-входа. */
+	async startQrLogin(options = {}) {
+		const cookies = this.#auth.createCookieFlow(false);
+		const result = await this.http.execute(AUTH_QR_START, {
+			path: AUTH_PATHS.qrStart,
+			skipAuth: true,
+			skipAuthRefresh: true,
+			cookieJar: cookies,
+			...options
+		});
+		if (typeof result.qrId === "string" && result.qrId !== "") {
+			const flow = {
+				cookies,
+				expiresAt: void 0
+			};
+			this.#touchQrFlow(flow, result.expiresIn);
+			this.#qrFlows.set(result.qrId, flow);
+		}
+		return result;
+	}
+	/**
+	* Проверяет QR-сессию и завершает вход после подтверждения на другом устройстве.
+	*
+	* До подтверждения возвращает промежуточный статус. Если сервер потребовал капчу,
+	* повторите вызов с `captcha` — тип берётся из {@link captchaProvider}.
+	* Полученный `accessToken` автоматически сохраняется в клиенте.
+	*/
+	async claimQrLogin(input, options = {}) {
+		const revision = this.#auth.revision();
+		const flow = this.#qrFlow(input.qrId);
+		try {
+			const { captcha, ...rest } = input;
+			const result = await this.http.execute(AUTH_QR_CLAIM, {
+				path: AUTH_PATHS.qrClaim,
+				body: {
+					...rest,
+					...captcha ? captchaBody(captcha) : {}
+				},
+				skipAuth: true,
+				skipAuthRefresh: true,
+				cookieJar: flow.cookies,
+				...options
+			});
+			this.#touchQrFlow(flow, result.expiresIn);
+			if (result.status === QrLoginStatus.Authorized) {
+				await this.#auth.commitAuthFlow(result.accessToken, flow.cookies, revision);
+				this.#qrFlows.delete(input.qrId);
+			} else if (result.status === QrLoginStatus.Rejected) this.#qrFlows.delete(input.qrId);
+			return result;
+		} catch (error) {
+			this.#forgetTerminalQrError(input.qrId, error);
+			throw error;
+		}
+	}
+	/**
+	* Слушает состояния QR-входа до закрытия ответа или отмены `signal`.
+	*
+	* Событие `approved` означает, что подтверждение завершено: после него вызовите
+	* {@link claimQrLogin}, чтобы получить и сохранить access token.
+	*/
+	async streamQrLogin(input, onEvent, options = {}) {
+		if (typeof onEvent !== "function") throw new ItdConfigError("onEvent QR-потока должен быть функцией");
+		const flow = this.#qrFlow(input.qrId);
+		try {
+			await openQrLoginStream(this.#connection, flow.cookies, input, async (event) => {
+				this.#touchQrFlow(flow, event.expiresIn);
+				if (event.status === QrLoginStreamStatus.Rejected) this.#qrFlows.delete(input.qrId);
+				await onEvent(event);
+			}, options.signal);
+		} catch (error) {
+			this.#forgetTerminalQrError(input.qrId, error);
+			throw error;
+		}
+	}
+	/**
 	* Регистрирует аккаунт и запускает подтверждение по коду.
 	*
 	* @returns `flowToken`, который нужно передать в {@link verifyOtp}
 	*/
 	signUp(credentials, options = {}) {
+		const { captcha, ...rest } = credentials;
 		return this.http.execute(AUTH_SIGN_UP, {
 			path: AUTH_PATHS.signUp,
-			body: credentials,
+			body: {
+				...rest,
+				...captchaBody(captcha)
+			},
 			skipAuth: true,
 			skipAuthRefresh: true,
 			...options
@@ -949,17 +1294,21 @@ var AuthResource = class extends BaseResource {
 	* @param credentials email, пароль и обязательный токен капчи — см. {@link CaptchaCredentials}
 	*/
 	async signIn(credentials, options = {}) {
+		const { captcha, ...rest } = credentials;
 		const revision = this.#auth.revision();
 		const cookies = this.#auth.createCookieFlow(false);
 		const result = await this.http.execute(AUTH_SIGN_IN, {
 			path: AUTH_PATHS.signIn,
-			body: credentials,
+			body: {
+				...rest,
+				...captchaBody(captcha)
+			},
 			skipAuth: true,
 			skipAuthRefresh: true,
 			cookieJar: cookies,
 			...options
 		});
-		if (result.status === SignInStatus.Authenticated) await this.#auth.setAccessToken(result.accessToken, revision, cookies);
+		if (result.status === SignInStatus.Authenticated) await this.#auth.commitAuthFlow(result.accessToken, cookies, revision);
 		else this.#auth.commitCookieFlow(cookies, revision);
 		return result;
 	}
@@ -979,7 +1328,7 @@ var AuthResource = class extends BaseResource {
 			cookieJar: cookies,
 			...options
 		});
-		await this.#auth.setAccessToken(accessToken, revision, cookies);
+		await this.#auth.commitAuthFlow(accessToken, cookies, revision);
 		return accessToken;
 	}
 	/** Отправляет код подтверждения повторно. */
@@ -1084,7 +1433,10 @@ var AuthResource = class extends BaseResource {
 	forgotPassword(input, options = {}) {
 		return this.http.execute(AUTH_FORGOT_PASSWORD, {
 			path: AUTH_PATHS.forgotPassword,
-			body: input,
+			body: {
+				email: input.email,
+				...captchaBody(input.captcha)
+			},
 			skipAuth: true,
 			skipAuthRefresh: true,
 			...options
@@ -1115,23 +1467,21 @@ var AuthResource = class extends BaseResource {
 	* ```ts
 	* await itd.auth.resetPasswordWithOtp({
 	*   email,
-	*   turnstileToken,
+	*   captcha: { type: provider, token, field },
 	*   newPassword,
 	*   getOtp: () => rl.question('Код из письма: '),
 	* });
 	* ```
 	*/
 	async resetPasswordWithOtp(input, options = {}) {
-		const flowToken = await this.forgotPassword({
-			email: input.email,
-			turnstileToken: input.turnstileToken
-		}, options);
-		const otp = await input.getOtp();
+		const { getOtp, newPassword, ...request } = input;
+		const flowToken = await this.forgotPassword(request, options);
+		const otp = await getOtp();
 		await this.resetPassword({
 			email: input.email,
 			otp,
 			flowToken,
-			newPassword: input.newPassword
+			newPassword
 		}, options);
 	}
 	/**
@@ -1220,8 +1570,8 @@ function createManagedClient(options, internals) {
 * const itd = new ItdClient({
 *   // `auth` не обязателен: когда хранилище уже содержит сессию, токен берётся оттуда,
 *   // а истёкший продлевается сам. Здесь он нужен на первый запуск.
-*   // Вход по паролю требует токена капчи — см. AuthInput и TURNSTILE_SITE_KEY.
-*   auth: { email, password, getTurnstileToken },
+*   // Вход по паролю требует токена капчи — см. CaptchaOptions.
+*   auth: { email, password, captcha: createCaptchaSolver() },
 *   storage: new FileTokenStorage('./.itd-session.json'),
 *   rateLimit: { concurrency: 4, rps: 8 },
 * });
@@ -1242,7 +1592,10 @@ var ItdClient = class ItdClient {
 	#auth;
 	/** Авторизация, сессии и пароли. */
 	get auth() {
-		this.#auth ??= new AuthResource(this.#runtime.http, { auth: this.#runtime.auth });
+		this.#auth ??= new AuthResource(this.#runtime.http, {
+			auth: this.#runtime.auth,
+			connection: this.#runtime.connection()
+		});
 		return this.#auth;
 	}
 	/** Профили, подписки, блокировки, приватность. */
@@ -1739,7 +2092,9 @@ function assertAccountsActive(accounts, action) {
 * await accounts.restore();
 *
 * if (!accounts.has('kiow')) {
-*   accounts.addAccount('kiow', { auth: { email, password, getTurnstileToken } });
+*   accounts.addAccount('kiow', {
+*     auth: { email, password, captcha: createCaptchaSolver() },
+*   });
 * }
 *
 * await accounts.account('kiow').posts.create({ content: 'привет' });
@@ -1818,7 +2173,9 @@ var ItdAccounts = class ItdAccounts {
 	*
 	* @example
 	* ```ts
-	* accounts.addAccount('bot', { auth: { email, password, getTurnstileToken } });
+	* accounts.addAccount('bot', {
+	*   auth: { email, password, captcha: createCaptchaSolver() },
+	* });
 	* accounts.addAccount('reader', { auth: '<accessToken>' });
 	* accounts.addAccount('через-прокси', { fetch: proxyFetch('socks5://…') });
 	* ```
@@ -2151,6 +2508,6 @@ function createAccounts(options = {}) {
 	return new ItdAccounts(options);
 }
 //#endregion
-export { ALLOWED_MIME_TYPES, AUDIO_MIME_TYPES, AccessType, AttachmentType, BUCKET_LIMITS, CommentSort, DEFAULT_BASE_URL, DEFAULT_RATE_LIMIT_BUCKET, EventChannel, EventChannelStatus, EventComposer, EventRouter, FeedTab, FileTransferMode, IMAGE_MIME_TYPES, IncidentKind, InteractionType, ItdAbortError, ItdAccounts, ItdApiError, ItdApiErrorKind, ItdAuthError, ItdClient, ItdConfigError, ItdConflictError, ItdError, ItdErrorCode, ItdErrorKind, ItdFileError, ItdFileErrorReason, ItdForbiddenError, ItdNetworkError, ItdNotFoundError, ItdPhoneVerificationError, ItdRateLimitError, ItdServerError, ItdStateError, ItdTimeoutError, ItdValidationError, LIBRARY_VERSION, LikesVisibility, MemoryKeyValueStore, MemoryMultiTokenStorage, MemoryShopOrderAccessStorage, MemoryTokenStorage, NotificationEvents, NotificationEventsClient, NotificationEventsTransport, NotificationType, NotificationUpdateOrigin, NotificationUpdateType, OPERATIONS, PaginationMode, Paginator, RateLimitPacing, ReportReason, ReportTargetType, RetrySafety, RuntimeMode, STATUS_SERVICE, ServiceState, ShopConsentKind, ShopOrderStatus, ShopProductCategory, ShopProductStatus, SignInStatus, SpanRenderFormat, SpanType, TURNSTILE_SITE_KEY, UnauthorizedStreamError, VIDEO_MIME_TYPES, ViewReason, ViewSource, WallAccess, WebSocketTransport, autoSpans, canonicalNotificationType, comment, createAccounts, createClient, createKeyValueStore, createMultiTokenStorage, createNotificationEventsClient, createRecordKeyValueStore, createShopFeature, createShopOrderAccessStorage, createTokenStorage, formatNotificationText, fromStream, fromUrl, isBuilder, isBuiltInOperationId, isEnumerableKeyValueStore, isItdApiError, isItdAuthError, isItdConflictError, isItdError, isItdFileError, isItdForbiddenError, isItdNotFoundError, isItdPhoneVerificationError, isItdRateLimitError, isItdServerError, isItdStateError, isItdValidationError, isKnownNotificationType, isMyProfile, mapPage, markup, normalizeNotification, operationBucket, operationMethod, operationRetrySafety, parseHtml, parseMarkdown, poll, post, renderSpans, report, resolveNotificationUrl, runEventMiddleware, scopedTokenStorage, statusDays, systemClock, toDate, utcStampToIso, withCodec, withNamespace };
+export { ALLOWED_MIME_TYPES, AUDIO_MIME_TYPES, AccessType, AttachmentType, BUCKET_LIMITS, CAPTCHA_FIELDS, CaptchaChoice, CaptchaField, CaptchaType, CommentSort, DEFAULT_BASE_URL, DEFAULT_RATE_LIMIT_BUCKET, EventChannel, EventChannelStatus, EventComposer, EventRouter, FeedTab, FileTransferMode, IMAGE_MIME_TYPES, IncidentKind, InteractionType, ItdAbortError, ItdAccounts, ItdApiError, ItdApiErrorKind, ItdAuthError, ItdClient, ItdConfigError, ItdConflictError, ItdError, ItdErrorCode, ItdErrorKind, ItdFileError, ItdFileErrorReason, ItdForbiddenError, ItdNetworkError, ItdNotFoundError, ItdPhoneVerificationError, ItdRateLimitError, ItdServerError, ItdStateError, ItdTimeoutError, ItdValidationError, LIBRARY_VERSION, LikesVisibility, MemoryKeyValueStore, MemoryMultiTokenStorage, MemoryShopOrderAccessStorage, MemoryTokenStorage, NotificationEvents, NotificationEventsClient, NotificationEventsTransport, NotificationType, NotificationUpdateOrigin, NotificationUpdateType, OPERATIONS, PaginationMode, Paginator, QrLoginStatus, QrLoginStreamStatus, RateLimitPacing, ReportReason, ReportTargetType, RetrySafety, RuntimeMode, STATUS_SERVICE, ServiceState, ShopConsentKind, ShopOrderStatus, ShopProductCategory, ShopProductStatus, SignInStatus, SpanRenderFormat, SpanType, TURNSTILE_SITE_KEY, UnauthorizedStreamError, VIDEO_MIME_TYPES, ViewReason, ViewSource, WallAccess, WebSocketTransport, autoSpans, canonicalNotificationType, comment, createAccounts, createClient, createKeyValueStore, createMultiTokenStorage, createNotificationEventsClient, createRecordKeyValueStore, createShopFeature, createShopOrderAccessStorage, createTokenStorage, formatNotificationText, fromStream, fromUrl, isBuilder, isBuiltInOperationId, isEnumerableKeyValueStore, isItdApiError, isItdAuthError, isItdConflictError, isItdError, isItdFileError, isItdForbiddenError, isItdNotFoundError, isItdPhoneVerificationError, isItdRateLimitError, isItdServerError, isItdStateError, isItdValidationError, isKnownNotificationType, isMyProfile, mapPage, markup, normalizeNotification, operationBucket, operationMethod, operationRetrySafety, parseHtml, parseMarkdown, poll, post, renderSpans, report, resolveNotificationUrl, runEventMiddleware, scopedTokenStorage, statusDays, systemClock, toDate, utcStampToIso, withCodec, withNamespace };
 
 //# sourceMappingURL=index.js.map