itd-api 0.9.3 → 0.10.1

package/dist/index.js

@@ -1,9 +1,9 @@
-import { $ as orderPluginDefinitions, A as ITD_CATALOG, C as ReportReason, D as ViewReason, E as SpanType, F as operationMethod, G as pickString, I as operationRetrySafety, K as RetrySafety, L as BUCKET_LIMITS, M as defineBuiltInOperation, N as isBuiltInOperationId, O as ViewSource, P as operationBucket, Q as assertPluginRemovable, R as DEFAULT_RATE_LIMIT_BUCKET, S as NotificationType, T as ServiceState, V as pickArray, Z as RequestQueuePool, _ as FeedTab, at as isRecord, b as ItdErrorCode, c as normalizeNotification, d as canonicalNotificationType, et as DEFAULT_BASE_URL, f as isKnownNotificationType, g as EventChannelStatus, h as CommentSort, it as LIBRARY_VERSION, j as OPERATIONS, k as WallAccess, lt as systemClock, m as AttachmentType, n as formatNotificationText, nt as STATUS_SERVICE, o as passthroughOperation, ot as requireOptionalBoolean, p as AccessType, rt as resolveRateLimit, s as voidOperation, st as RateLimitPacing, t as resolveNotificationUrl, ut as installAsyncDisposeFallback, v as IncidentKind, w as ReportTargetType, x as LikesVisibility, y as InteractionType, z as createClientRuntime } from "./shared/url-3Ts6EEHQ.js";
+import { A as ViewReason, B as BUCKET_LIMITS, C as ItdErrorCode, D as ReportTargetType, E as ReportReason, F as defineBuiltInOperation, G as pickArray, H as createClientRuntime, I as isBuiltInOperationId, L as operationBucket, M as WallAccess, N as ITD_CATALOG, O as ServiceState, P as OPERATIONS, R as operationMethod, S as InteractionType, T as NotificationType, U as createApiError, V as DEFAULT_RATE_LIMIT_BUCKET, X as RetrySafety, Y as pickString, _ as CaptchaType, at as orderPluginDefinitions, b as FeedTab, c as normalizeNotification, ct as STATUS_SERVICE, d as canonicalNotificationType, dt as isRecord, et as createRequestAbortScope, f as isKnownNotificationType, ft as requireOptionalBoolean, g as CaptchaField, gt as installAsyncDisposeFallback, h as CaptchaChoice, ht as systemClock, it as assertPluginRemovable, j as ViewSource, k as SpanType, lt as resolveRateLimit, m as AttachmentType, n as formatNotificationText, o as passthroughOperation, ot as DEFAULT_BASE_URL, p as AccessType, pt as RateLimitPacing, rt as RequestQueuePool, s as voidOperation, t as resolveNotificationUrl, tt as requestAbortError, ut as LIBRARY_VERSION, v as CommentSort, w as LikesVisibility, x as IncidentKind, y as EventChannelStatus, z as operationRetrySafety } from "./shared/url-CntTEAxu.js";
 import { A as isItdStateError, C as isItdError, D as isItdPhoneVerificationError, E as isItdNotFoundError, O as isItdRateLimitError, S as isItdConflictError, T as isItdForbiddenError, _ as ItdStateError, a as ItdConfigError, b as isItdApiError, c as ItdErrorKind, d as ItdForbiddenError, f as ItdNetworkError, g as ItdServerError, h as ItdRateLimitError, i as ItdAuthError, j as isItdValidationError, k as isItdServerError, l as ItdFileError, m as ItdPhoneVerificationError, n as ItdApiError, o as ItdConflictError, p as ItdNotFoundError, r as ItdApiErrorKind, s as ItdError, t as ItdAbortError, u as ItdFileErrorReason, v as ItdTimeoutError, w as isItdFileError, x as isItdAuthError, y as ItdValidationError } from "./shared/errors-GI10kZxk.js";
-import { c as REFRESH_COOKIE, l as REFRESH_COOKIE_PATH, s as CookieJar, u as isSerializedCookieEntry, v as RuntimeMode, y as createDeviceId } from "./shared/redact-DJV0XM3n.js";
-import { A as utcStampToIso, C as AUDIO_MIME_TYPES, D as isBuilder, E as comment, F as mapPage, I as createFeatureHost, L as ExtensibleOperationCatalog, M as BaseResource, N as PaginationMode, O as createStatusFeature, P as Paginator, S as ALLOWED_MIME_TYPES, T as VIDEO_MIME_TYPES, _ as poll, a as createShopOrderAccessStorage, b as parseHtml, c as ShopOrderStatus, d as isMyProfile, f as fromStream, g as post, h as report, i as MemoryShopOrderAccessStorage, j as NotificationsResource, k as toDate, l as ShopProductCategory, m as createResources, n as renderSpans, o as statusDays, p as fromUrl, r as createShopFeature, s as ShopConsentKind, t as SpanRenderFormat, u as ShopProductStatus, v as autoSpans, w as IMAGE_MIME_TYPES, x as parseMarkdown, y as markup } from "./shared/render-CtOpp9Pm.js";
+import { c as REFRESH_COOKIE, h as joinUrl, l as REFRESH_COOKIE_PATH, s as CookieJar, u as isSerializedCookieEntry, v as RuntimeMode, y as createDeviceId } from "./shared/redact-DJV0XM3n.js";
+import { A as utcStampToIso, C as AUDIO_MIME_TYPES, D as isBuilder, E as comment, F as mapPage, I as createFeatureHost, L as ExtensibleOperationCatalog, M as BaseResource, N as PaginationMode, O as createStatusFeature, P as Paginator, S as ALLOWED_MIME_TYPES, T as VIDEO_MIME_TYPES, _ as poll, a as createShopOrderAccessStorage, b as parseHtml, c as ShopOrderStatus, d as isMyProfile, f as fromStream, g as post, h as report, i as MemoryShopOrderAccessStorage, j as NotificationsResource, k as toDate, l as ShopProductCategory, m as createResources, n as renderSpans, o as statusDays, p as fromUrl, r as createShopFeature, s as ShopConsentKind, t as SpanRenderFormat, u as ShopProductStatus, v as autoSpans, w as IMAGE_MIME_TYPES, x as parseMarkdown, y as markup } from "./shared/render-CubTTof_.js";
 import { c as FileTransferMode } from "./shared/options-i4LrKfqx.js";
-import { _ as reportListenerError, a as WebSocketTransport, c as NotificationEventsTransport, d as NotificationUpdateOrigin, f as NotificationUpdateType, g as Emitter, h as runEventMiddleware, i as createNotificationEventsClient, l as resolveNotificationEventsOptions, m as UnauthorizedStreamError, n as EventRouter, o as EVENT_OPERATIONS, p as EventChannel, r as NotificationEventsClient, s as NotificationEvents, t as EventComposer, u as setNotificationEventsConnectGuard } from "./shared/events-BzjI6pn5.js";
+import { _ as Emitter, a as WebSocketTransport, c as NotificationEventsTransport, d as NotificationUpdateOrigin, f as NotificationUpdateType, g as runEventMiddleware, h as UnauthorizedStreamError, i as createNotificationEventsClient, l as resolveNotificationEventsOptions, m as EventChannel, n as EventRouter, o as EVENT_OPERATIONS, p as createParser, r as NotificationEventsClient, s as NotificationEvents, t as EventComposer, u as setNotificationEventsConnectGuard, v as reportListenerError } from "./shared/events-Cipe-Fm9.js";
 import { a as isEnumerableKeyValueStore, i as createRecordKeyValueStore, o as withCodec, r as createKeyValueStore, s as withNamespace, t as MemoryKeyValueStore } from "./shared/key-value-store-Bt2PSMxY.js";
 import { n as copySession, r as createTokenStorage, t as MemoryTokenStorage } from "./shared/storage-DiDe0PZM.js";
 import { a as scopedTokenStorage, i as isRestorableSession, n as controlledTokenStorage, r as createMultiTokenStorage, t as MemoryMultiTokenStorage } from "./shared/multi-storage-C3Ngtop1.js";
@@ -31,12 +31,37 @@ const SignInStatus = Object.freeze({
 	Authenticated: "authenticated",
 	OtpRequired: "otp_required"
 });
+/**
+* Поле тела запроса по умолчанию для известных провайдеров.
+*
+* Используется, когда провайдера не спрашивали. Ответ `captchaProvider()` важнее этой таблицы.
+*/
+const CAPTCHA_FIELDS = Object.freeze({
+	[CaptchaType.Itd]: CaptchaField.Itd,
+	[CaptchaType.Cloudflare]: CaptchaField.Cloudflare
+});
+/** Состояния, которые может вернуть проверка QR-входа. */
+const QrLoginStatus = Object.freeze({
+	Pending: "pending",
+	Scanned: "scanned",
+	CaptchaRequired: "captcha_required",
+	Authorized: "authorized",
+	Rejected: "rejected"
+});
+/** Состояния, приходящие из потокового наблюдения за QR-входом. */
+const QrLoginStreamStatus = Object.freeze({
+	Pending: "pending",
+	Scanned: "scanned",
+	Approved: "approved",
+	Rejected: "rejected"
+});
 function requireString(body, key, message) {
 	const value = pickString(body, key);
 	if (!value) throw new ItdConfigError(message);
 	return value;
 }
 const AUTH_CHECK = passthroughOperation("auth.check");
+const AUTH_CAPTCHA_PROVIDER = passthroughOperation("auth.captchaProvider");
 const AUTH_SIGN_UP = defineBuiltInOperation("auth.signUp", (body) => requireString(body, "flowToken", "Сервер не вернул flowToken при регистрации"));
 const AUTH_SIGN_IN = defineBuiltInOperation("auth.signIn", (body) => {
 	const accessToken = pickString(body, "accessToken");
@@ -58,6 +83,96 @@ const AUTH_CHANGE_PASSWORD = voidOperation("auth.changePassword");
 const AUTH_SESSIONS = defineBuiltInOperation("auth.sessions", (body) => pickArray(body, "sessions"));
 const AUTH_REVOKE_SESSION = voidOperation("auth.revokeSession");
 const AUTH_REVOKE_OTHER_SESSIONS = voidOperation("auth.revokeOtherSessions");
+const AUTH_QR_START = passthroughOperation("auth.qrStart");
+const AUTH_QR_CLAIM = passthroughOperation("auth.qrClaim");
+//#endregion
+//#region src/session/captcha.ts
+function requireCaptchaText(value, field) {
+	if (value !== void 0 && (typeof value !== "string" || value.trim() === "")) throw new ItdConfigError(`${field} должен быть непустой строкой`);
+}
+/**
+* Проверяет форму источника токена и приводит его к объекту.
+*
+* Сам объект сохраняется как есть: `getToken` вызывается на нём, чтобы источнику остался
+* доступен собственный `this`.
+*
+* @throws {ItdConfigError} при некорректных значениях
+*/
+function resolveCaptchaSolver(captcha) {
+	if (captcha === void 0) return void 0;
+	if (typeof captcha === "function") return { getToken: captcha };
+	if (!isRecord(captcha)) throw new ItdConfigError("captcha должен быть функцией либо объектом с getToken");
+	const { getToken, type, field } = captcha;
+	if (typeof getToken !== "function") throw new ItdConfigError("captcha.getToken должен быть функцией");
+	requireCaptchaText(type, "captcha.type");
+	requireCaptchaText(field, "captcha.field");
+	return captcha;
+}
+/**
+* Проверяет форму готового токена капчи.
+*
+* @param path имя опции или аргумента для текста ошибки
+* @throws {ItdConfigError} если токен или его тип не указаны
+*/
+function validateCaptchaToken(captcha, path) {
+	if (captcha === void 0) return;
+	if (!isRecord(captcha)) throw new ItdConfigError(`${path} должен быть объектом { type, token }`);
+	const { type, token, field } = captcha;
+	if (typeof token !== "string" || token.trim() === "") throw new ItdConfigError(`${path}.token должен быть непустой строкой`);
+	if (typeof type !== "string" || type.trim() === "") throw new ItdConfigError(`${path}.type должен быть непустой строкой`);
+	requireCaptchaText(field, `${path}.field`);
+}
+/** Разбирает ответ `GET /api/v1/auth/captcha/provider` для автоматического входа. */
+function readCaptchaProvider(body) {
+	const config = isRecord(body) ? body : void 0;
+	const provider = config?.provider;
+	const field = config?.field;
+	if (typeof provider !== "string" || provider.trim() === "" || typeof field !== "string" || field.trim() === "") throw new ItdConfigError("Сервер вернул неподдерживаемую конфигурацию капчи");
+	return {
+		provider,
+		field
+	};
+}
+/** Куда класть токен: настройка, иначе умолчание провайдера. */
+function resolveField(type, configured) {
+	const field = configured ?? CAPTCHA_FIELDS[type];
+	if (field) return field;
+	throw new ItdConfigError(`Неизвестно, в каком поле сервер ждёт токен капчи «${type}». Передайте captcha.field либо оставьте captcha.type = ${CaptchaChoice.Auto}, чтобы поле назвал сервер.`);
+}
+/** Спрашивает токен у источника и убеждается, что он непустой. */
+async function requireSolvedToken(solver, type) {
+	const token = await solver.getToken(type);
+	if (typeof token === "string" && token.trim() !== "") return token;
+	throw new ItdConfigError(`Источник капчи не вернул токен для провайдера «${type}». Проверьте captcha.getToken.`);
+}
+/**
+* Готовит фрагмент тела запроса, взяв токен у источника.
+*
+* При `CaptchaChoice.Auto` провайдер спрашивается у сервера — тогда и тип виджета,
+* и имя поля приходят оттуда. Явно названный тип обходится без этого запроса.
+*
+* @param askProvider как спросить активного провайдера; вызывается, только если это нужно
+* @throws {ItdConfigError} если токен получить не удалось
+*/
+async function solveCaptchaBody(solver, askProvider) {
+	const choice = solver.type ?? CaptchaChoice.Auto;
+	if (choice === CaptchaChoice.Auto) {
+		const { provider, field } = await askProvider();
+		return { [field]: await requireSolvedToken(solver, provider) };
+	}
+	return { [resolveField(choice, solver.field)]: await requireSolvedToken(solver, choice) };
+}
+/**
+* Готовит фрагмент тела из готового токена.
+*
+* Поле берётся из самого токена либо из умолчания провайдера; запроса к серверу нет.
+*
+* @throws {ItdConfigError} если токен или его тип не указаны
+*/
+function captchaBody(captcha) {
+	validateCaptchaToken(captcha, "captcha");
+	return { [resolveField(captcha.type, captcha.field)]: captcha.token };
+}
 //#endregion
 //#region src/session/jwt.ts
 /**
@@ -130,11 +245,10 @@ function validateAuth(auth) {
 		return { ...auth };
 	}
 	if ("email" in auth || "password" in auth) {
-		const { email, password, turnstileToken, getTurnstileToken } = auth;
+		const { email, password, captcha } = auth;
 		if (typeof email !== "string" || email.trim() === "") throw new ItdConfigError("auth.email должен быть непустой строкой");
 		if (typeof password !== "string" || password === "") throw new ItdConfigError("auth.password должен быть непустой строкой");
-		if (getTurnstileToken !== void 0 && typeof getTurnstileToken !== "function") throw new ItdConfigError("auth.getTurnstileToken должен быть функцией");
-		if (turnstileToken !== void 0 && (typeof turnstileToken !== "string" || turnstileToken.trim() === "")) throw new ItdConfigError("auth.turnstileToken должен быть непустой строкой");
+		validateCaptchaToken(captcha, "auth.captcha");
 		return { ...auth };
 	}
 	throw new ItdConfigError("auth не распознан. Ожидается строка с accessToken либо объект { accessToken }, { email, password } или { getToken }");
@@ -163,6 +277,7 @@ function resolveSessionConfig(options, runtime) {
 	return {
 		...runtime,
 		auth: validateAuth(options.auth),
+		captcha: resolveCaptchaSolver(options.captcha),
 		storage: resolveStorage(options.storage),
 		deviceId: options.deviceId,
 		autoRefresh: options.autoRefresh ?? true,
@@ -181,6 +296,7 @@ function createItdAuth(options, deps) {
 }
 /** Пути эндпоинтов авторизации. */
 const AUTH_PATHS = {
+	captchaProvider: "/api/v1/auth/captcha/provider",
 	signUp: "/api/v1/auth/sign-up",
 	signIn: "/api/v1/auth/sign-in",
 	verifyOtp: "/api/v1/auth/verify-otp",
@@ -190,7 +306,10 @@ const AUTH_PATHS = {
 	forgotPassword: "/api/v1/auth/forgot-password",
 	resetPassword: "/api/v1/auth/reset-password",
 	changePassword: "/api/v1/auth/change-password",
-	sessions: "/api/v1/auth/sessions"
+	sessions: "/api/v1/auth/sessions",
+	qrStart: "/api/v1/auth/qr/start",
+	qrClaim: "/api/v1/auth/qr/claim",
+	qrStream: "/api/v1/auth/qr/stream"
 };
 /**
 * Публичный ключ Cloudflare Turnstile платформы итд.com.
@@ -200,14 +319,15 @@ const AUTH_PATHS = {
 *
 * Ключ привязан к домену: на чужом origin Cloudflare отказывает виджету с кодом `110200`.
 * Поэтому отрисовать его может только код, выполняемый на самом итд.com. Остальным
-* подходит `@itd-api/turnstile`, готовый токен из другого источника или вовсе вход
+* подходит `@itd-api/captcha`, готовый токен из другого источника или вовсе вход
 * без капчи — по сохранённой сессии либо по токенам, взятым в браузере.
 *
 * @example
 * ```ts
 * turnstile.render('#captcha', {
 *   sitekey: TURNSTILE_SITE_KEY,
-*   callback: (turnstileToken) => itd.auth.signIn({ email, password, turnstileToken }),
+*   callback: (token) =>
+*     itd.auth.signIn({ email, password, captcha: { type: CaptchaType.Cloudflare, token } }),
 * });
 * ```
 */
@@ -329,6 +449,8 @@ var AuthManager = class {
 	*/
 	#authEpoch = 0;
 	#externalReadGeneration = 0;
+	/** Разовый токен из `auth.captcha` тратится ровно на один запрос. */
+	#configCaptchaSpent = false;
 	#disposed = false;
 	#persistence = Promise.resolve();
 	constructor(config, http, jar, hooks = {}) {
@@ -625,6 +747,13 @@ var AuthManager = class {
 	}
 	/** Сохраняет токен, полученный извне, — например после подтверждения OTP. */
 	async setAccessToken(accessToken, expectedRevision = this.#authEpoch, cookies) {
+		return this.#storeAccessToken(accessToken, expectedRevision, cookies, false);
+	}
+	/** Атомарно принимает токен и cookie завершённого входа как новую сессию. @internal */
+	async commitAuthFlow(accessToken, cookies, expectedRevision = this.#authEpoch) {
+		return this.#storeAccessToken(accessToken, expectedRevision, cookies, true);
+	}
+	async #storeAccessToken(accessToken, expectedRevision, cookies, replaceSession) {
 		this.#assertActive();
 		if (typeof accessToken !== "string" || accessToken.trim() === "") throw new ItdConfigError("accessToken должен быть непустой строкой");
 		await this.#loadSession();
@@ -634,7 +763,7 @@ var AuthManager = class {
 		this.#invalidateInFlight();
 		this.#transitionAuth(accessToken);
 		const saved = this.#saveSession({
-			...this.#session ?? {},
+			...replaceSession ? {} : this.#session ?? {},
 			accessToken,
 			obtainedAt: this.#config.clock.now()
 		});
@@ -850,28 +979,50 @@ var AuthManager = class {
 		return promise;
 	}
 	/**
-	* Берёт токен капчи для входа.
+	* Готовит фрагмент тела с токеном капчи для запроса, который её требует.
 	*
-	* `getTurnstileToken` приоритетнее готовой строки: токен Turnstile одноразовый и живёт
-	* несколько минут, поэтому при повторном входе через сутки годится только свежий.
+	* Источники в порядке убывания приоритета: токен, переданный в сам вызов; разовый токен
+	* из `auth.captcha`; опция `captcha`. Когда ни одного нет, фрагмент пустой: нужна ли
+	* капча этому запросу, решает сервер.
+	*
+	* @param explicit готовый токен, переданный в вызов
+	* @throws {ItdConfigError} если токен неполный или источник его не вернул
 	*/
-	async #resolveTurnstileToken(credentials) {
-		if (credentials.getTurnstileToken) {
-			const token = await credentials.getTurnstileToken();
-			if (token) return token;
-		}
-		if (credentials.turnstileToken) return credentials.turnstileToken;
-		throw new ItdConfigError("Вход по email и паролю требует токен капчи Cloudflare Turnstile: без него сервер отвечает 422. Передайте auth.getTurnstileToken (источник свежего токена) либо разовый auth.turnstileToken. Ключ виджета — TURNSTILE_SITE_KEY. В Node токен умеет добывать отдельный пакет: npm i @itd-api/turnstile, затем getTurnstileToken: createTurnstileSolver().");
+	async captchaBody(explicit) {
+		if (explicit) return captchaBody(explicit);
+		const configured = this.#takeConfiguredCaptcha();
+		if (configured) return captchaBody(configured);
+		const solver = this.#config.captcha;
+		if (solver) return solveCaptchaBody(solver, () => this.#resolveCaptchaProvider());
+		this.#config.logger?.debug("Запрос уходит без токена капчи: не передан аргумент captcha и не задана опция captcha");
+		return {};
+	}
+	/** Отдаёт разовый токен из `auth.captcha`, помечая его потраченным. */
+	#takeConfiguredCaptcha() {
+		if (this.#configCaptchaSpent) return void 0;
+		const auth = this.#config.auth;
+		const captcha = isRecord(auth) ? auth.captcha : void 0;
+		if (!captcha) return void 0;
+		this.#configCaptchaSpent = true;
+		return captcha;
+	}
+	/** Спрашивает у сервера активного провайдера и поле, в котором он ждёт токен. */
+	async #resolveCaptchaProvider() {
+		return readCaptchaProvider(await this.#http.execute(AUTH_CAPTCHA_PROVIDER, {
+			path: AUTH_PATHS.captchaProvider,
+			skipAuth: true,
+			skipAuthRefresh: true
+		}));
 	}
 	async #performSignIn(credentials, revision) {
-		const turnstileToken = await this.#resolveTurnstileToken(credentials);
+		const captcha = await this.captchaBody();
 		const flowCookies = new CookieJar();
 		const result = await this.#http.execute(AUTH_SIGN_IN, {
 			path: AUTH_PATHS.signIn,
 			body: {
 				email: credentials.email,
 				password: credentials.password,
-				turnstileToken
+				...captcha
 			},
 			skipAuth: true,
 			skipAuthRefresh: true,
@@ -895,6 +1046,125 @@ var AuthManager = class {
 	}
 };
 //#endregion
+//#region src/session/qr-stream.ts
+const QR_STREAM_STATUSES = new Set(Object.values(QrLoginStreamStatus));
+function readQrLoginStreamEvent(data) {
+	let value;
+	try {
+		value = JSON.parse(data);
+	} catch {
+		return;
+	}
+	if (!isRecord(value)) return void 0;
+	const event = value;
+	if (typeof event.status !== "string" || !QR_STREAM_STATUSES.has(event.status)) return;
+	return {
+		status: event.status,
+		...typeof event.expiresIn === "number" && Number.isFinite(event.expiresIn) ? { expiresIn: event.expiresIn } : {}
+	};
+}
+/** Читает короткоживущий SSE-поток QR-входа и последовательно доставляет его события. */
+async function consumeQrLoginStream(body, onEvent, signal) {
+	const reader = body.getReader();
+	const decoder = new TextDecoder();
+	let delivery = Promise.resolve();
+	let completed = false;
+	const cancel = () => {
+		reader.cancel(signal?.reason).catch(() => {});
+	};
+	signal?.addEventListener("abort", cancel, { once: true });
+	const parser = createParser({ onEvent(message) {
+		const event = readQrLoginStreamEvent(message.data);
+		if (!event) return;
+		delivery = delivery.then(() => onEvent(event));
+	} });
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			parser.feed(decoder.decode(value, { stream: true }));
+			await delivery;
+		}
+		parser.feed(decoder.decode());
+		await delivery;
+		if (signal?.aborted) throw signal.reason;
+		completed = true;
+	} finally {
+		signal?.removeEventListener("abort", cancel);
+		if (!completed) await reader.cancel().catch(() => {});
+		reader.releaseLock?.();
+	}
+}
+/** Открывает изолированный HTTP/SSE-канал QR-входа. @internal */
+async function openQrLoginStream(connection, cookies, input, onEvent, signal) {
+	connection.assertActive?.("открыть QR-поток");
+	const path = AUTH_PATHS.qrStream;
+	const method = "POST";
+	const url = joinUrl(connection.baseUrl, path);
+	const abort = createRequestAbortScope(signal, connection.signal, 0, connection.clock);
+	try {
+		const headers = await connection.baseHeaders(url);
+		headers.delete("Authorization");
+		headers.delete("Cookie");
+		headers.set("Accept", "text/event-stream");
+		headers.set("Content-Type", "application/json");
+		const cookie = cookies.getHeader(url);
+		if (cookie) headers.set("Cookie", cookie);
+		let response;
+		try {
+			response = await connection.fetch(url, {
+				method,
+				headers,
+				body: JSON.stringify(input),
+				credentials: "include",
+				signal: abort.signal
+			});
+		} catch (error) {
+			const failure = new ItdNetworkError(`Не удалось открыть QR-поток: ${String(error)}`, {
+				method,
+				path,
+				cause: error
+			});
+			throw requestAbortError(abort, {
+				timeout: 0,
+				method,
+				path
+			}, failure);
+		}
+		cookies.setFromResponse(response.url || url, response);
+		if (!response.ok) {
+			const text = await response.text();
+			let body = text;
+			try {
+				body = JSON.parse(text);
+			} catch {}
+			throw createApiError({
+				method,
+				path,
+				status: response.status,
+				statusText: response.statusText,
+				headers: response.headers,
+				response,
+				body,
+				now: connection.clock.now()
+			});
+		}
+		if (!response.body) throw new ItdNetworkError("Сервер не вернул тело QR-потока", {
+			method,
+			path
+		});
+		await consumeQrLoginStream(response.body, onEvent, abort.signal);
+	} catch (error) {
+		throw requestAbortError(abort, {
+			timeout: 0,
+			method,
+			path
+		}, error);
+	} finally {
+		abort.cleanup();
+	}
+}
+//#endregion
 //#region src/resources/auth.ts
 /**
 * Результат входа.
@@ -909,9 +1179,36 @@ var AuthManager = class {
 */
 var AuthResource = class extends BaseResource {
 	#auth;
+	#connection;
+	#qrFlows = /* @__PURE__ */ new Map();
 	constructor(http, deps) {
 		super(http);
 		this.#auth = deps.auth;
+		this.#connection = deps.connection;
+	}
+	#pruneQrFlows() {
+		const now = this.#connection.clock.now();
+		for (const [qrId, flow] of this.#qrFlows) if (flow.expiresAt !== void 0 && flow.expiresAt <= now) this.#qrFlows.delete(qrId);
+	}
+	#qrFlow(qrId) {
+		this.#pruneQrFlows();
+		const existing = this.#qrFlows.get(qrId);
+		if (existing) return existing;
+		const flow = {
+			cookies: this.#auth.createCookieFlow(false),
+			expiresAt: void 0,
+			captchaRequired: false
+		};
+		this.#qrFlows.set(qrId, flow);
+		return flow;
+	}
+	#touchQrFlow(flow, expiresIn) {
+		if (typeof expiresIn !== "number" || !Number.isFinite(expiresIn)) return;
+		const expiresAt = this.#connection.clock.now() + Math.max(0, expiresIn) * 1e3;
+		flow.expiresAt = flow.expiresAt === void 0 ? expiresAt : Math.min(flow.expiresAt, expiresAt);
+	}
+	#forgetTerminalQrError(qrId, error) {
+		if (isItdApiError(error) && error.hasCode("QR_EXPIRED", "QR_ALREADY_USED", "QR_TOKEN_MISMATCH")) this.#qrFlows.delete(qrId);
 	}
 	/**
 	* Проверяет состояние авторизации и возвращает текущего пользователя.
@@ -925,14 +1222,109 @@ var AuthResource = class extends BaseResource {
 		});
 	}
 	/**
+	* Узнаёт активного провайдера капчи и поле токена.
+	*
+	* Сервер может переключить провайдера или переименовать поле без выпуска новой версии SDK.
+	* Автоматическому входу этот вызов не нужен — клиент делает его сам.
+	*/
+	captchaProvider(options = {}) {
+		return this.http.execute(AUTH_CAPTCHA_PROVIDER, {
+			path: AUTH_PATHS.captchaProvider,
+			skipAuth: true,
+			skipAuthRefresh: true,
+			...options
+		});
+	}
+	/** Создаёт короткоживущую сессию QR-входа. */
+	async startQrLogin(options = {}) {
+		const cookies = this.#auth.createCookieFlow(false);
+		const result = await this.http.execute(AUTH_QR_START, {
+			path: AUTH_PATHS.qrStart,
+			skipAuth: true,
+			skipAuthRefresh: true,
+			cookieJar: cookies,
+			...options
+		});
+		if (typeof result.qrId === "string" && result.qrId !== "") {
+			const flow = {
+				cookies,
+				expiresAt: void 0,
+				captchaRequired: false
+			};
+			this.#touchQrFlow(flow, result.expiresIn);
+			this.#qrFlows.set(result.qrId, flow);
+		}
+		return result;
+	}
+	/**
+	* Проверяет QR-сессию и завершает вход после подтверждения на другом устройстве.
+	*
+	* До подтверждения возвращает промежуточный статус. Токен капчи добывается, только когда
+	* сервер о ней попросил — статусом `captcha_required` на прошлой проверке, — либо когда
+	* передан в сам вызов. Полученный `accessToken` автоматически сохраняется в клиенте.
+	*/
+	async claimQrLogin(input, options = {}) {
+		const revision = this.#auth.revision();
+		const flow = this.#qrFlow(input.qrId);
+		try {
+			const { captcha, ...rest } = input;
+			const needsCaptcha = captcha !== void 0 || flow.captchaRequired;
+			const result = await this.http.execute(AUTH_QR_CLAIM, {
+				path: AUTH_PATHS.qrClaim,
+				body: {
+					...rest,
+					...needsCaptcha ? await this.#auth.captchaBody(captcha) : {}
+				},
+				skipAuth: true,
+				skipAuthRefresh: true,
+				cookieJar: flow.cookies,
+				...options
+			});
+			this.#touchQrFlow(flow, result.expiresIn);
+			if (result.status === QrLoginStatus.CaptchaRequired) flow.captchaRequired = true;
+			if (result.status === QrLoginStatus.Authorized) {
+				await this.#auth.commitAuthFlow(result.accessToken, flow.cookies, revision);
+				this.#qrFlows.delete(input.qrId);
+			} else if (result.status === QrLoginStatus.Rejected) this.#qrFlows.delete(input.qrId);
+			return result;
+		} catch (error) {
+			this.#forgetTerminalQrError(input.qrId, error);
+			throw error;
+		}
+	}
+	/**
+	* Слушает состояния QR-входа до закрытия ответа или отмены `signal`.
+	*
+	* Событие `approved` означает, что подтверждение завершено: после него вызовите
+	* {@link claimQrLogin}, чтобы получить и сохранить access token.
+	*/
+	async streamQrLogin(input, onEvent, options = {}) {
+		if (typeof onEvent !== "function") throw new ItdConfigError("onEvent QR-потока должен быть функцией");
+		const flow = this.#qrFlow(input.qrId);
+		try {
+			await openQrLoginStream(this.#connection, flow.cookies, input, async (event) => {
+				this.#touchQrFlow(flow, event.expiresIn);
+				if (event.status === QrLoginStreamStatus.Rejected) this.#qrFlows.delete(input.qrId);
+				await onEvent(event);
+			}, options.signal);
+		} catch (error) {
+			this.#forgetTerminalQrError(input.qrId, error);
+			throw error;
+		}
+	}
+	/**
 	* Регистрирует аккаунт и запускает подтверждение по коду.
 	*
 	* @returns `flowToken`, который нужно передать в {@link verifyOtp}
 	*/
-	signUp(credentials, options = {}) {
+	async signUp(credentials, options = {}) {
+		const { captcha, ...rest } = credentials;
 		return this.http.execute(AUTH_SIGN_UP, {
 			path: AUTH_PATHS.signUp,
-			body: credentials,
+			body: {
+				...rest,
+				...await this.#auth.captchaBody(captcha)
+			},
 			skipAuth: true,
 			skipAuthRefresh: true,
 			...options
@@ -946,20 +1338,25 @@ var AuthResource = class extends BaseResource {
 	*
 	* При успешном входе токен сохраняется в клиенте автоматически.
 	*
-	* @param credentials email, пароль и обязательный токен капчи — см. {@link CaptchaCredentials}
+	* @param credentials email, пароль и токен капчи — см. {@link CredentialsWithCaptcha}
 	*/
 	async signIn(credentials, options = {}) {
+		const { captcha, ...rest } = credentials;
 		const revision = this.#auth.revision();
 		const cookies = this.#auth.createCookieFlow(false);
+		const body = {
+			...rest,
+			...await this.#auth.captchaBody(captcha)
+		};
 		const result = await this.http.execute(AUTH_SIGN_IN, {
 			path: AUTH_PATHS.signIn,
-			body: credentials,
+			body,
 			skipAuth: true,
 			skipAuthRefresh: true,
 			cookieJar: cookies,
 			...options
 		});
-		if (result.status === SignInStatus.Authenticated) await this.#auth.setAccessToken(result.accessToken, revision, cookies);
+		if (result.status === SignInStatus.Authenticated) await this.#auth.commitAuthFlow(result.accessToken, cookies, revision);
 		else this.#auth.commitCookieFlow(cookies, revision);
 		return result;
 	}
@@ -979,7 +1376,7 @@ var AuthResource = class extends BaseResource {
 			cookieJar: cookies,
 			...options
 		});
-		await this.#auth.setAccessToken(accessToken, revision, cookies);
+		await this.#auth.commitAuthFlow(accessToken, cookies, revision);
 		return accessToken;
 	}
 	/** Отправляет код подтверждения повторно. */
@@ -1081,10 +1478,13 @@ var AuthResource = class extends BaseResource {
 	*
 	* @returns `flowToken`, который нужно передать в {@link resetPassword}
 	*/
-	forgotPassword(input, options = {}) {
+	async forgotPassword(input, options = {}) {
 		return this.http.execute(AUTH_FORGOT_PASSWORD, {
 			path: AUTH_PATHS.forgotPassword,
-			body: input,
+			body: {
+				email: input.email,
+				...await this.#auth.captchaBody(input.captcha)
+			},
 			skipAuth: true,
 			skipAuthRefresh: true,
 			...options
@@ -1115,23 +1515,21 @@ var AuthResource = class extends BaseResource {
 	* ```ts
 	* await itd.auth.resetPasswordWithOtp({
 	*   email,
-	*   turnstileToken,
+	*   captcha: { type: provider, token, field },
 	*   newPassword,
 	*   getOtp: () => rl.question('Код из письма: '),
 	* });
 	* ```
 	*/
 	async resetPasswordWithOtp(input, options = {}) {
-		const flowToken = await this.forgotPassword({
-			email: input.email,
-			turnstileToken: input.turnstileToken
-		}, options);
-		const otp = await input.getOtp();
+		const { getOtp, newPassword, ...request } = input;
+		const flowToken = await this.forgotPassword(request, options);
+		const otp = await getOtp();
 		await this.resetPassword({
 			email: input.email,
 			otp,
 			flowToken,
-			newPassword: input.newPassword
+			newPassword
 		}, options);
 	}
 	/**
@@ -1220,8 +1618,9 @@ function createManagedClient(options, internals) {
 * const itd = new ItdClient({
 *   // `auth` не обязателен: когда хранилище уже содержит сессию, токен берётся оттуда,
 *   // а истёкший продлевается сам. Здесь он нужен на первый запуск.
-*   // Вход по паролю требует токена капчи — см. AuthInput и TURNSTILE_SITE_KEY.
-*   auth: { email, password, getTurnstileToken },
+*   auth: { email, password },
+*   // Капчу входа решает пакет @itd-api/captcha — см. CaptchaSolver.
+*   captcha: createCaptchaSolver(),
 *   storage: new FileTokenStorage('./.itd-session.json'),
 *   rateLimit: { concurrency: 4, rps: 8 },
 * });
@@ -1242,7 +1641,10 @@ var ItdClient = class ItdClient {
 	#auth;
 	/** Авторизация, сессии и пароли. */
 	get auth() {
-		this.#auth ??= new AuthResource(this.#runtime.http, { auth: this.#runtime.auth });
+		this.#auth ??= new AuthResource(this.#runtime.http, {
+			auth: this.#runtime.auth,
+			connection: this.#runtime.connection()
+		});
 		return this.#auth;
 	}
 	/** Профили, подписки, блокировки, приватность. */
@@ -1732,6 +2134,8 @@ function assertAccountsActive(accounts, action) {
 *
 * await using accounts = new ItdAccounts({
 *   storage: new FileMultiTokenStorage('./.itd-sessions.json'),
+*   // Общие опции достаются каждому аккаунту: один источник токена капчи на всех.
+*   captcha: createCaptchaSolver(),
 *   rateLimit: { concurrency: 4 },
 * });
 *
@@ -1739,7 +2143,7 @@ function assertAccountsActive(accounts, action) {
 * await accounts.restore();
 *
 * if (!accounts.has('kiow')) {
-*   accounts.addAccount('kiow', { auth: { email, password, getTurnstileToken } });
+*   accounts.addAccount('kiow', { auth: { email, password } });
 * }
 *
 * await accounts.account('kiow').posts.create({ content: 'привет' });
@@ -1818,7 +2222,7 @@ var ItdAccounts = class ItdAccounts {
 	*
 	* @example
 	* ```ts
-	* accounts.addAccount('bot', { auth: { email, password, getTurnstileToken } });
+	* accounts.addAccount('bot', { auth: { email, password } });
 	* accounts.addAccount('reader', { auth: '<accessToken>' });
 	* accounts.addAccount('через-прокси', { fetch: proxyFetch('socks5://…') });
 	* ```
@@ -2151,6 +2555,6 @@ function createAccounts(options = {}) {
 	return new ItdAccounts(options);
 }
 //#endregion
-export { ALLOWED_MIME_TYPES, AUDIO_MIME_TYPES, AccessType, AttachmentType, BUCKET_LIMITS, CommentSort, DEFAULT_BASE_URL, DEFAULT_RATE_LIMIT_BUCKET, EventChannel, EventChannelStatus, EventComposer, EventRouter, FeedTab, FileTransferMode, IMAGE_MIME_TYPES, IncidentKind, InteractionType, ItdAbortError, ItdAccounts, ItdApiError, ItdApiErrorKind, ItdAuthError, ItdClient, ItdConfigError, ItdConflictError, ItdError, ItdErrorCode, ItdErrorKind, ItdFileError, ItdFileErrorReason, ItdForbiddenError, ItdNetworkError, ItdNotFoundError, ItdPhoneVerificationError, ItdRateLimitError, ItdServerError, ItdStateError, ItdTimeoutError, ItdValidationError, LIBRARY_VERSION, LikesVisibility, MemoryKeyValueStore, MemoryMultiTokenStorage, MemoryShopOrderAccessStorage, MemoryTokenStorage, NotificationEvents, NotificationEventsClient, NotificationEventsTransport, NotificationType, NotificationUpdateOrigin, NotificationUpdateType, OPERATIONS, PaginationMode, Paginator, RateLimitPacing, ReportReason, ReportTargetType, RetrySafety, RuntimeMode, STATUS_SERVICE, ServiceState, ShopConsentKind, ShopOrderStatus, ShopProductCategory, ShopProductStatus, SignInStatus, SpanRenderFormat, SpanType, TURNSTILE_SITE_KEY, UnauthorizedStreamError, VIDEO_MIME_TYPES, ViewReason, ViewSource, WallAccess, WebSocketTransport, autoSpans, canonicalNotificationType, comment, createAccounts, createClient, createKeyValueStore, createMultiTokenStorage, createNotificationEventsClient, createRecordKeyValueStore, createShopFeature, createShopOrderAccessStorage, createTokenStorage, formatNotificationText, fromStream, fromUrl, isBuilder, isBuiltInOperationId, isEnumerableKeyValueStore, isItdApiError, isItdAuthError, isItdConflictError, isItdError, isItdFileError, isItdForbiddenError, isItdNotFoundError, isItdPhoneVerificationError, isItdRateLimitError, isItdServerError, isItdStateError, isItdValidationError, isKnownNotificationType, isMyProfile, mapPage, markup, normalizeNotification, operationBucket, operationMethod, operationRetrySafety, parseHtml, parseMarkdown, poll, post, renderSpans, report, resolveNotificationUrl, runEventMiddleware, scopedTokenStorage, statusDays, systemClock, toDate, utcStampToIso, withCodec, withNamespace };
+export { ALLOWED_MIME_TYPES, AUDIO_MIME_TYPES, AccessType, AttachmentType, BUCKET_LIMITS, CAPTCHA_FIELDS, CaptchaChoice, CaptchaField, CaptchaType, CommentSort, DEFAULT_BASE_URL, DEFAULT_RATE_LIMIT_BUCKET, EventChannel, EventChannelStatus, EventComposer, EventRouter, FeedTab, FileTransferMode, IMAGE_MIME_TYPES, IncidentKind, InteractionType, ItdAbortError, ItdAccounts, ItdApiError, ItdApiErrorKind, ItdAuthError, ItdClient, ItdConfigError, ItdConflictError, ItdError, ItdErrorCode, ItdErrorKind, ItdFileError, ItdFileErrorReason, ItdForbiddenError, ItdNetworkError, ItdNotFoundError, ItdPhoneVerificationError, ItdRateLimitError, ItdServerError, ItdStateError, ItdTimeoutError, ItdValidationError, LIBRARY_VERSION, LikesVisibility, MemoryKeyValueStore, MemoryMultiTokenStorage, MemoryShopOrderAccessStorage, MemoryTokenStorage, NotificationEvents, NotificationEventsClient, NotificationEventsTransport, NotificationType, NotificationUpdateOrigin, NotificationUpdateType, OPERATIONS, PaginationMode, Paginator, QrLoginStatus, QrLoginStreamStatus, RateLimitPacing, ReportReason, ReportTargetType, RetrySafety, RuntimeMode, STATUS_SERVICE, ServiceState, ShopConsentKind, ShopOrderStatus, ShopProductCategory, ShopProductStatus, SignInStatus, SpanRenderFormat, SpanType, TURNSTILE_SITE_KEY, UnauthorizedStreamError, VIDEO_MIME_TYPES, ViewReason, ViewSource, WallAccess, WebSocketTransport, autoSpans, canonicalNotificationType, comment, createAccounts, createClient, createKeyValueStore, createMultiTokenStorage, createNotificationEventsClient, createRecordKeyValueStore, createShopFeature, createShopOrderAccessStorage, createTokenStorage, formatNotificationText, fromStream, fromUrl, isBuilder, isBuiltInOperationId, isEnumerableKeyValueStore, isItdApiError, isItdAuthError, isItdConflictError, isItdError, isItdFileError, isItdForbiddenError, isItdNotFoundError, isItdPhoneVerificationError, isItdRateLimitError, isItdServerError, isItdStateError, isItdValidationError, isKnownNotificationType, isMyProfile, mapPage, markup, normalizeNotification, operationBucket, operationMethod, operationRetrySafety, parseHtml, parseMarkdown, poll, post, renderSpans, report, resolveNotificationUrl, runEventMiddleware, scopedTokenStorage, statusDays, systemClock, toDate, utcStampToIso, withCodec, withNamespace };
 
 //# sourceMappingURL=index.js.map