meta-sovereign 0.49.9 → 0.49.11

package/js/src/server/github-service.js

@@ -100,6 +100,16 @@ const errorEntry = (error) => ({
   ...(error.retryAfter ? { retryAfter: error.retryAfter } : {}),
 });
 
+// A write that may have been delivered: reported as unknown, never repeated.
+const unknownIfAmbiguous = (error) =>
+  error?.ambiguous === true && error.code !== 'send-unknown'
+    ? Object.assign(error, {
+        code: 'send-unknown',
+        outcome: 'unknown',
+        fallback: false,
+      })
+    : error;
+
 const putAll = async (store, links) => {
   for (const link of links) {
     await store.put(stampSourceLink(link, 'github'));
@@ -307,16 +317,26 @@ export const createGithubService = ({
   const notifications = () => storedNotifications(store);
 
   // Marking read changes GitHub: only on an explicit call (never by fetching).
+  // A failure that may have reached GitHub is `send-unknown` and is not
+  // repeated; the stored copy stays unread until the next fetch shows what
+  // GitHub says (R-Z4, R-Z20).
   const markRead = async ({ threadId = null, all = false } = {}) => {
     const { token, live } = await withLive();
+    try {
+      if (all) {
+        await live.markAllRead({ token });
+      } else {
+        await live.markThreadRead(threadId, { token });
+      }
+    } catch (error) {
+      throw unknownIfAmbiguous(error);
+    }
     if (all) {
-      await live.markAllRead({ token });
       for (const link of await notifications()) {
         await store.put({ ...link, unread: false });
       }
       return { ok: true, all: true };
     }
-    await live.markThreadRead(threadId, { token });
     const link = await store.get(`notification:github:${threadId}`);
     if (link) {
       await store.put({ ...link, unread: false });

package/js/src/server/index.js

@@ -39,6 +39,7 @@
  *   POST /api/email/pull           -> local-server email API/protocol proxy
  *   POST /api/email/send           -> local-server email send proxy
  *   GET  /api/email/attachment     -> a mail attachment from the media folder (routes-email.js)
+ *   GET  /api/media/<network>/<sha256>[.ext] -> imported archive media (routes-media.js, R-Z15)
  *   GET  /api/backups              -> list archives (gated on archiveDir)
  *   POST /api/backups              -> { passphrase?, keep? } -> { file }
  *   POST /api/backups/restore      -> { file, passphrase? } -> { restored }
@@ -95,8 +96,14 @@ import { profileDirIn } from '../sources/whatsapp-web-signin.js';
 import { handleTelegramRoutes } from './routes-telegram.js';
 import { handleMessageRoutes } from './routes-messages.js';
 import { handleEmailGets } from './routes-email.js';
+import { handleMediaGets } from './routes-media.js';
 import { createAttachmentStore } from './email-attachments.js';
-import { createEmailPoller } from './email-poller.js';
+import {
+  VK_CAPTCHA_HOSTS,
+  VK_IMAGE_HOSTS,
+  VK_MEDIA_HOSTS,
+  cspSources,
+} from '../sources/vk-hosts.js';
 import { setAttachmentSink } from '../sources/email.js';
 import { handleEventRoutes } from './routes-events.js';
 import { createPasscodeLock } from './passcode.js';
@@ -154,7 +161,9 @@ export const CSP =
   "style-src 'self'; " +
   "img-src 'self' data: blob: https://vk.com " +
   // VK's picture CDNs, for photos and stickers in VK chats (R-Z8).
-  'https://*.userapi.com https://*.vk-cdn.net https://*.vkuserphoto.ru; ' +
+  `${cspSources(VK_IMAGE_HOSTS)} ${cspSources(VK_CAPTCHA_HOSTS)}; ` +
+  // Direct VK audio and video files (R-Z20); a VK video page is a link.
+  `media-src 'self' ${cspSources(VK_MEDIA_HOSTS)}; ` +
   'frame-src https:; ' +
   "connect-src 'self' https: ws: wss: http://127.0.0.1:* http://localhost:*; " +
   "worker-src 'self'; " +
@@ -389,17 +398,12 @@ const mediaDirOf = (storeDir) =>
 
 // Mail (R-Z5): where attachments are kept next to the store, and the
 // periodic pull of a connected mailbox (`emailPoll: false` turns it off).
-const emailContext = (store, storeDir, poll, log, later) => {
+const emailContext = (storeDir) => {
   const emailFiles = storeDir
     ? createAttachmentStore(path.join(storeDir, 'media', 'email'))
     : null;
   setAttachmentSink(emailFiles ? (bytes) => emailFiles.save(bytes) : null);
-  const emailPoller =
-    poll === false
-      ? { start() {}, stop() {} }
-      : createEmailPoller({ store, log, ...poll });
-  later.push(() => emailPoller.start());
-  return { emailFiles, emailPoller };
+  return { emailFiles };
 };
 
 // Listen (with HTTPS beside HTTP when asked, ./local-tls.js) and track
@@ -586,6 +590,7 @@ const routeOn = async (store, req, res, ctx, url, p) => {
     () => handleTelegramRoutes(req, res, p, ctx),
     () => handleMessageRoutes(store, req, res, p, url, ctx),
     () => handleEmailGets(store, req, res, p, url, ctx),
+    () => handleMediaGets(req, res, p, ctx),
     () => handleDeletedRoutes(store, req, res, p, url, ctx),
     () => handleAudienceSyncRoute(store, req, res, p, ctx),
     () => handleChatRoutes(req, res, p, url, ctx),
@@ -836,7 +841,7 @@ export const startServer = async ({
     signaling: null,
     secretPassphrase,
     emailLiveFactory,
-    ...emailContext(store, storeDir, emailPoll, log, later),
+    ...emailContext(storeDir),
     ...uiContext(allowOrigins, uiUrl, localUi),
     ...cvContext(cv),
     replies: replyService(store, storeDir, replies),
@@ -863,7 +868,7 @@ export const startServer = async ({
       later
     ),
     chatIndex,
-    ...pullContext(store, log, pulls, later),
+    ...pullContext(store, log, pulls, later, emailPoll),
   };
   Object.assign(ctx, backgroundJobs({ ctx, store, log, later, backups }));
   const server = createHttpServer(store, ctx, log);
@@ -909,7 +914,6 @@ export const startServer = async ({
     close: () =>
       new Promise((resolve) => {
         bus?.close();
-        ctx.emailPoller.stop();
         ctx.replies.close().catch(() => {});
         ctx.closeAutomations().catch(() => {});
         ctx.stopJobs();

package/js/src/server/routes-media.js

@@ -0,0 +1,179 @@
+/**
+ * Imported archive media (R-Z15):
+ *   GET /api/media/<network>/<sha256>[.<ext>]
+ * serves a file that an archive import (R-Z10 Facebook/Messenger,
+ * Instagram, X, LinkedIn; R-Z15 WhatsApp) copied to
+ * `<store>/media/<network>/<sha256><ext>`. The path is built only from
+ * validated parts (a fixed network list, 64 hex digits, a fixed extension
+ * list), so nothing outside that folder can be named. Pictures, audio and
+ * video are shown inline; everything else, svg and html included, is
+ * offered as a download with a sandboxing CSP. Audio and video answer
+ * `Range`. The file is streamed, never read whole.
+ */
+
+import { createReadStream, promises as fs } from 'node:fs';
+import path from 'node:path';
+import { fail } from './util.js';
+import { fromApp } from './routes-telegram-files.js';
+
+export const MEDIA_NETWORKS = Object.freeze([
+  'facebook',
+  'messenger',
+  'instagram',
+  'x',
+  'linkedin',
+  'whatsapp',
+]);
+
+const INLINE = {
+  jpg: 'image/jpeg',
+  jpeg: 'image/jpeg',
+  png: 'image/png',
+  gif: 'image/gif',
+  webp: 'image/webp',
+  mp4: 'video/mp4',
+  m4v: 'video/mp4',
+  mov: 'video/quicktime',
+  webm: 'video/webm',
+  mp3: 'audio/mpeg',
+  m4a: 'audio/mp4',
+  aac: 'audio/aac',
+  ogg: 'audio/ogg',
+  opus: 'audio/ogg',
+  oga: 'audio/ogg',
+  wav: 'audio/wav',
+};
+// Downloaded, never shown: documents, archives, and the types a browser
+// would run (svg, html), which are sent as opaque bytes.
+const OPAQUE = 'application/octet-stream';
+const DOWNLOAD = {
+  pdf: 'application/pdf',
+  txt: 'text/plain; charset=utf-8',
+  vcf: 'text/vcard; charset=utf-8',
+  csv: 'text/csv; charset=utf-8',
+  json: 'application/json',
+  zip: 'application/zip',
+  ...Object.fromEntries(
+    [
+      'doc',
+      'docx',
+      'xls',
+      'xlsx',
+      'ppt',
+      'pptx',
+      'heic',
+      'heif',
+      '3gp',
+      'amr',
+      'mkv',
+      'svg',
+      'html',
+      'htm',
+      'xml',
+      'js',
+    ].map((ext) => [ext, OPAQUE])
+  ),
+};
+
+export const MEDIA_EXTENSIONS = Object.freeze([
+  ...Object.keys(INLINE),
+  ...Object.keys(DOWNLOAD),
+]);
+
+const URL_SHAPE =
+  /^\/api\/media\/([a-z]{1,16})\/([0-9a-f]{64})(?:\.([a-z0-9]{1,8}))?$/;
+const IN_MEDIA = /^\/api\/media(\/|$)/;
+
+const refuse = (res, status, code, error) =>
+  fail(res, status, code, error) ?? true;
+const notFound = (res) => refuse(res, 404, 'not-found', 'no such media file');
+
+/** `{network, sha256, ext}` of a valid media path, else null. */
+export const parseMediaPath = (p) => {
+  const m = URL_SHAPE.exec(p);
+  if (!m || !MEDIA_NETWORKS.includes(m[1])) {
+    return null;
+  }
+  const ext = m[3] ?? '';
+  return ext && !MEDIA_EXTENSIONS.includes(ext)
+    ? null
+    : { network: m[1], sha256: m[2], ext };
+};
+
+const rangeOf = (header, size) => {
+  const m = /^bytes=(\d*)-(\d*)$/.exec(String(header ?? ''));
+  if (!m || (m[1] === '' && m[2] === '')) {
+    return null;
+  }
+  const start = Math.max(0, m[1] === '' ? size - Number(m[2]) : Number(m[1]));
+  const end =
+    m[1] === '' || m[2] === '' ? size - 1 : Math.min(Number(m[2]), size - 1);
+  return start <= end && start < size
+    ? { start, end }
+    : { unsatisfiable: true };
+};
+
+const send = ({ req, res, file, ext, size }) => {
+  const inline = ext in INLINE;
+  const headers = {
+    'content-type': INLINE[ext] ?? DOWNLOAD[ext] ?? OPAQUE,
+    'x-content-type-options': 'nosniff',
+    'content-disposition': inline
+      ? 'inline'
+      : `attachment; filename="media${ext ? `.${ext}` : ''}"`,
+    'cache-control': 'private, max-age=3600',
+    'content-security-policy': "sandbox; default-src 'none'",
+    'accept-ranges': inline ? 'bytes' : 'none',
+  };
+  const range = inline ? rangeOf(req.headers.range, size) : null;
+  if (range?.unsatisfiable) {
+    res.writeHead(416, { ...headers, 'content-range': `bytes */${size}` });
+    res.end();
+    return true;
+  }
+  const part = range ?? { start: 0, end: size - 1 };
+  res.writeHead(range ? 206 : 200, {
+    ...headers,
+    'content-length': size === 0 ? 0 : part.end - part.start + 1,
+    ...(range
+      ? { 'content-range': `bytes ${part.start}-${part.end}/${size}` }
+      : {}),
+  });
+  if (req.method === 'HEAD' || size === 0) {
+    res.end();
+    return true;
+  }
+  const stream = createReadStream(file, part);
+  stream.on('error', () => res.destroy());
+  stream.pipe(res);
+  return true;
+};
+
+/** GET /api/media/... (see the header). */
+export const handleMediaGets = async (req, res, p, ctx) => {
+  if (!IN_MEDIA.test(p) || (req.method !== 'GET' && req.method !== 'HEAD')) {
+    return false;
+  }
+  if (!fromApp(req, ctx?.allowOrigins)) {
+    return refuse(res, 403, 'forbidden', 'media loads only in the app');
+  }
+  const wanted = parseMediaPath(p);
+  if (!wanted || !ctx?.storeDir) {
+    return notFound(res);
+  }
+  const { network, sha256, ext } = wanted;
+  const file = path.join(
+    ctx.storeDir,
+    'media',
+    network,
+    `${sha256}${ext ? `.${ext}` : ''}`
+  );
+  try {
+    const info = await fs.lstat(file);
+    return info.isFile()
+      ? send({ req, res, file, ext, size: info.size })
+      : notFound(res);
+  } catch {
+    return notFound(res);
+  }
+};

package/js/src/server/routes-pull.js

@@ -23,6 +23,8 @@ import { liveOptionsFrom, pullLiveInto } from '../sources/index.js';
 import { createUpworkLive } from '../sources/upwork.js';
 import { createPeoplePerHourLive } from '../sources/peopleperhour.js';
 import { createGithubService } from './github-service.js';
+import { handleVkRoutes } from './routes-vk.js';
+import { emailConfigured } from '../sources/email-store.js';
 import { fail, json, readBody } from './util.js';
 
 const MINUTE = 60_000;
@@ -34,9 +36,24 @@ const connected = (store, source) => async () =>
 // still comes from the store.
 const liveOf = (make, given) => (given ? make(given) : undefined);
 
+// Mail (R-Z5, on the shared runner since R-Z20): every ten minutes, the first
+// pull 30 s after the server listens, never faster than a minute, backed off
+// after a failure like every job. `emailPoll: false` keeps only the button.
+// `email.pull` (tests) replaces the real pull.
+const MIN_EMAIL_MS = MINUTE;
+const emailJob = (store, poll = {}) => ({
+  ready: async () => emailConfigured(await liveOptionsFrom(store, 'email')),
+  run: () =>
+    (poll.pull ?? ((s) => pullLiveInto(s, 'email', { limit: 20 })))(store),
+  intervalMs:
+    poll === false ? 0 : Math.max(MIN_EMAIL_MS, poll.intervalMs ?? 10 * MINUTE),
+  firstDelayMs: poll === false ? 0 : (poll.firstMs ?? 30_000),
+});
+
 /** The jobs: network -> { ready, run, intervalMs }. */
 export const pullJobs = (store, { vkInbox, github, options = {} }) => ({
   ...(github ? { github: github.pullJob() } : {}),
+  email: emailJob(store, options.email),
   vk: {
     ready: vkInbox.ready,
     run: vkInbox.fetch,
@@ -103,6 +120,8 @@ const statusOf = async (store, ctx) => {
       connected: await ctx.pullRunner.connected(source),
       lastOkAt: state.lastOkAt ?? null,
       lastError: state.lastError ?? null,
+      // A captcha, or anything else only the user can clear (R-Z20).
+      needsAttention: state.lastError?.needsAttention === true,
     };
   }
   return { ok: true, sources };
@@ -117,6 +136,9 @@ export const handlePullRoutes = async (store, req, res, p, ctx) => {
   if (!ctx.pullRunner) {
     return false;
   }
+  if (p.startsWith('/api/vk/')) {
+    return handleVkRoutes(req, res, p, ctx);
+  }
   if (p === '/api/pull/status' && req.method === 'GET') {
     return json(res, 200, await statusOf(store, ctx)) ?? true;
   }
@@ -139,7 +161,7 @@ export const handlePullRoutes = async (store, req, res, p, ctx) => {
 };
 
 /** What a server keeps for the pulls; they start with the other `later` services. */
-export const pullContext = (store, log, options, later) => {
+export const pullContext = (store, log, options, later, emailPoll) => {
   // GitHub's picker routes work even when the pulls are off; its schedule is
   // one more job of the shared runner (R-Z11).
   // Tests give `pulls.githubLiveFactory`, a fake createGithubLive.
@@ -153,11 +175,17 @@ export const pullContext = (store, log, options, later) => {
   if (options === false) {
     return { ...given, pullRunner: null };
   }
-  const services = createPullServices(store, log, options ?? {}, github);
+  const services = createPullServices(
+    store,
+    log,
+    { ...options, email: emailPoll },
+    github
+  );
   later.push(services.start);
   return {
     ...given,
     pullRunner: services.pullRunner,
+    vkInbox: services.vkInbox,
     stopPulls: services.stop,
   };
 };

package/js/src/server/routes-vk.js

@@ -0,0 +1,93 @@
+/**
+ * VK scroll-back (R-Z20), a user action from the page:
+ *
+ *   POST /api/vk/history {chat, before?, captchaSid?, captchaKey?}
+ *     -> { ok, imported, complete }
+ *        or { ok: false, error, code } with `code` one of bad-request |
+ *        not-connected | rate-limited (HTTP 429) | captcha (HTTP 409, plus
+ *        `captcha: { sid, img }` -- `img` only when it is on VK's own API
+ *        host) | the network's own code.
+ *
+ * `chat` is the VK peer id, `before` the VK id of the oldest message the
+ * page holds. A captcha is shown to the user by the page, which repeats
+ * this request once with `captchaSid` and `captchaKey`; the program never
+ * solves one, and pulls in the background never ask (they back off and mark
+ * the connection as needing attention: ../sources/pull-runner.js).
+ */
+
+import { fail, json, readBody } from './util.js';
+import { isTrustedMutation } from './routes-auto-import.js';
+import { safeMessage } from './redact.js';
+import { vkCaptchaImage } from '../sources/vk-hosts.js';
+
+const PEER = /^-?\d{1,15}$/;
+const MESSAGE = /^\d{1,12}$/;
+const SID = /^[\w.-]{1,64}$/;
+const KEY = /^\S{1,32}$/;
+const STATUS = { 'rate-limited': 429, captcha: 409, 'not-connected': 409 };
+
+const text = (value) => (value === undefined ? undefined : String(value));
+
+/** The checked request, or a message saying what is wrong. */
+export const historyRequest = (body) => {
+  const peerId = text(body.chat);
+  if (!PEER.test(peerId ?? '') || Number(peerId) === 0) {
+    return { error: 'a VK chat id is needed' };
+  }
+  const before = text(body.before);
+  if (before !== undefined && !MESSAGE.test(before)) {
+    return { error: '"before" must be a VK message id' };
+  }
+  const sid = text(body.captchaSid);
+  const key = text(body.captchaKey);
+  if ((sid === undefined) !== (key === undefined)) {
+    return { error: 'captchaSid and captchaKey go together' };
+  }
+  if (sid !== undefined && !(SID.test(sid) && KEY.test(key))) {
+    return { error: 'the captcha answer is not valid' };
+  }
+  return { peerId, before, captchaSid: sid, captchaKey: key };
+};
+
+const failure = (res, error) => {
+  const code = error.code ?? 'failed';
+  const captcha =
+    code === 'captcha'
+      ? {
+          captcha: {
+            sid: error.captchaSid ?? null,
+            img: error.captchaImg ? vkCaptchaImage(error.captchaImg) : null,
+          },
+        }
+      : {};
+  return (
+    json(res, STATUS[code] ?? 502, {
+      ok: false,
+      error: safeMessage(error),
+      code,
+      ...captcha,
+    }) ?? true
+  );
+};
+
+export const handleVkRoutes = async (req, res, p, ctx) => {
+  if (p !== '/api/vk/history' || req.method !== 'POST') {
+    return false;
+  }
+  if (!isTrustedMutation(req, ctx.allowOrigins)) {
+    return fail(res, 403, 'forbidden', 'use the meta-sovereign app') ?? true;
+  }
+  const request = historyRequest(await readBody(req));
+  if (request.error) {
+    return fail(res, 400, 'bad-request', request.error) ?? true;
+  }
+  if (!ctx.vkInbox) {
+    return fail(res, 404, 'unsupported', 'VK is not enabled') ?? true;
+  }
+  try {
+    const done = await ctx.vkInbox.older(request);
+    return json(res, 200, { ok: true, ...done }) ?? true;
+  } catch (error) {
+    return failure(res, error);
+  }
+};

package/js/src/server/routes-whatsapp.js

@@ -6,16 +6,19 @@
  *   POST /api/whatsapp/web/close       -> closes it
  *   POST /api/whatsapp/archive {name, data(base64)}
  *                                      -> imports an "Export chat" .txt or .zip
+ *                                         (a zip's photos/videos/files are kept in media/whatsapp, R-Z15)
  *
  * The sign-in window is for the person to scan the QR code themselves
  * (see ../sources/whatsapp-web-signin.js); these routes never touch it.
  */
 
+import path from 'node:path';
 import { json, readBody } from './util.js';
 import { isTrustedMutation } from './routes-auto-import.js';
 import { safeMessage } from './redact.js';
 import { createWhatsAppWebSignIn } from '../sources/whatsapp-web-signin.js';
 import { importWhatsAppFile } from '../sources/whatsapp-file.js';
+import { isFatalWrite } from '../sources/archive/context.js';
 
 const PREFIX = '/api/whatsapp/';
 
@@ -43,7 +46,7 @@ const failure = (res, error) =>
     code: error.code ?? 'internal',
   });
 
-const archiveRoute = async (store, req, res) => {
+const archiveRoute = async (store, req, res, ctx) => {
   const body = await readBody(req, { limit: 64 * 1024 * 1024 });
   const bytes = Buffer.from(String(body.data ?? ''), 'base64');
   if (bytes.length === 0 || typeof body.name !== 'string') {
@@ -53,9 +56,21 @@ const archiveRoute = async (store, req, res) => {
     });
   }
   try {
-    return reply(res, 200, await importWhatsAppFile(store, body.name, bytes));
+    // Media files of a zip are kept next to the store (R-Z15).
+    const mediaDir = ctx?.storeDir ? path.join(ctx.storeDir, 'media') : null;
+    return reply(
+      res,
+      200,
+      await importWhatsAppFile(store, body.name, bytes, { mediaDir })
+    );
   } catch (error) {
-    return reply(res, 400, { error: safeMessage(error), code: 'bad-archive' });
+    // A full or unwritable disk is not a bad file (R-Z14).
+    return isFatalWrite(error)
+      ? reply(res, 507, {
+          error: safeMessage(error),
+          code: 'store-write-failed',
+        })
+      : reply(res, 400, { error: safeMessage(error), code: 'bad-archive' });
   }
 };
 
@@ -94,7 +109,7 @@ export const handleWhatsAppRoutes = async (store, req, res, p, ctx) => {
     });
   }
   if (isArchive) {
-    return req.method === 'POST' ? archiveRoute(store, req, res) : false;
+    return req.method === 'POST' ? archiveRoute(store, req, res, ctx) : false;
   }
   const expected = route === 'web' ? 'GET' : 'POST';
   return req.method === expected

package/js/src/sources/pull-runner.js

@@ -21,6 +21,10 @@
  * whose user turned the schedule off can still be fetched by hand) and its
  * `intervalMs` is then just how often `due()` is asked.
  *
+ * A pull that VK stops with a captcha (code `captcha`) is marked
+ * `needsAttention` in `lastError`: neither the schedule nor this runner
+ * shows or solves it (R-Z20; the page asks only for the user's own actions).
+ *
  * `pull-state:<source>` keeps `lastOkAt` and a job's own cursor.
  */
 
@@ -97,7 +101,13 @@ export const createPullRunner = ({
       const out = failure(error, { source });
       log?.({ level: 'warn', event: 'pull_failed', source, code: out.code });
       await savePullState(store, source, {
-        lastError: { code: out.code, at: new Date(now()).toISOString() },
+        lastError: {
+          code: out.code,
+          at: new Date(now()).toISOString(),
+          // A captcha only the user can solve, in the app: the schedule
+          // backs off and never asks (R-Z20).
+          ...(out.code === 'captcha' ? { needsAttention: true } : {}),
+        },
       }).catch(() => {});
       return out;
     } finally {
@@ -160,6 +170,10 @@ export const createPullRunner = ({
     fetchNow,
     /** Start the schedules (call after the server listens). */
     start() {
+      // A second start must not run a second schedule (R-Z20).
+      if (!stopped) {
+        return;
+      }
       stopped = false;
       for (const [source, job] of Object.entries(jobs)) {
         if (job.intervalMs > 0) {

package/js/src/sources/vk-hosts.js

@@ -0,0 +1,51 @@
+/**
+ * The exact VK hosts the page may load from (R-Z20): one list for the CSP
+ * (`img-src`, `media-src`, ../server/index.js) and for the adapter, so a URL
+ * is only offered to a player when the CSP would let the browser fetch it.
+ * Pictures, audio and video come from VK's CDNs; the captcha picture comes
+ * from the API host. Nothing is framed: a VK video page is a link, never an
+ * iframe.
+ */
+
+/** Hosts VK serves audio and video files from (`media-src`). */
+export const VK_MEDIA_HOSTS = [
+  '*.userapi.com',
+  '*.vk-cdn.net',
+  '*.vkuseraudio.net',
+  '*.vkuservideo.net',
+];
+
+/** Hosts of pictures (`img-src`): the media hosts and VK's photo CDN. */
+export const VK_IMAGE_HOSTS = [...VK_MEDIA_HOSTS, '*.vkuserphoto.ru'];
+
+/** Where VK's captcha picture is served from (`img-src`). */
+export const VK_CAPTCHA_HOSTS = ['api.vk.com', 'api.vk.ru'];
+
+/** A CSP source list for `hosts`: `https://a https://b`. */
+export const cspSources = (hosts) =>
+  hosts.map((host) => `https://${host}`).join(' ');
+
+const matches = (host, pattern) =>
+  pattern.startsWith('*.')
+    ? host.endsWith(pattern.slice(1)) && host.length > pattern.length - 1
+    : host === pattern;
+
+/** `url` when it is an https address on one of `hosts`, else null. */
+export const onHosts = (url, hosts) => {
+  try {
+    const parsed = new URL(String(url));
+    return parsed.protocol === 'https:' &&
+      !parsed.username &&
+      hosts.some((pattern) => matches(parsed.hostname, pattern))
+      ? parsed.href
+      : null;
+  } catch {
+    return null;
+  }
+};
+
+/** A direct audio/video file address, only on VK's CDNs. */
+export const vkMediaUrl = (url) => onHosts(url, VK_MEDIA_HOSTS);
+
+/** VK's captcha picture address, only on VK's API hosts. */
+export const vkCaptchaImage = (url) => onHosts(url, VK_CAPTCHA_HOSTS);

package/js/src/sources/vk-longpoll.js

@@ -181,7 +181,7 @@ const linksOfBatch = async (live, batch) => {
 };
 
 const failureDelay = (error, fails) =>
-  AUTH_CODES.has(Number(error?.vkCode))
+  AUTH_CODES.has(Number(error?.vkCode)) || error?.code === 'captcha'
     ? 5 * 60_000
     : Math.min(5 * 60_000, 5000 * 2 ** Math.min(fails - 1, 6));
 
@@ -307,6 +307,17 @@ export const createVkLongPoll = ({
           event: 'vk_longpoll_failed',
           code: error.code ?? error.vkCode ?? null,
         });
+        if (error.code === 'captcha') {
+          // Only the user can solve it, in the app; this loop just waits
+          // and says so (R-Z20).
+          await savePullState(store, SOURCE, {
+            lastError: {
+              code: 'captcha',
+              at: new Date(now()).toISOString(),
+              needsAttention: true,
+            },
+          }).catch(() => {});
+        }
         await sleep(failureDelay(error, fails));
       }
     }