tca-js 0.3.1 → 0.4.1

package/dist/index.js

@@ -1,54 +1,1321 @@
 "use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.loginQR = exports.MANUAL_CLOSE = exports.Listener = exports.TikTokError = exports.MessageType = exports.API = exports.TikTok = void 0;
-/**
- * tca-js — unofficial TikTok Chat API (speaks the TikTok Web protocol).
- *
- * ```ts
- * const api = await new TikTok().login({ cookies, deviceId });
- * api.listener.on('message', async (msg) => {
- *   if (msg.isSelf) return;
- *   await api.sendMessage(msg, 'Got it, thanks!');
- * });
- * api.listener.start();
- * ```
- *
- * Getting cookies the first time: `loginQR({ chromePath, onEvent })` — opens headless Chrome on TikTok's QR page
- * (the login API requires a JS signature so it can't be done in pure Node), returns cookies after scanning. See README.
- */
-const api_1 = require("./api");
-const context_1 = require("./context");
-const errors_1 = require("./errors");
-class TikTok {
-    options;
-    constructor(options = {}) {
-        this.options = options;
-    }
-    /** Log in with existing cookies. Expired cookies → `TikTokError('SESSION_EXPIRED')`. */
-    async login(credentials) {
-        const ctx = new context_1.Context(credentials, this.options);
-        if (!ctx.cookies.get('sessionid') && !ctx.cookies.get('sid_tt')) {
-            throw new errors_1.TikTokError('SESSION_EXPIRED', 'Cookie has no sessionid');
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key2 of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key2) && key2 !== except)
+        __defProp(to, key2, { get: () => from[key2], enumerable: !(desc = __getOwnPropDesc(from, key2)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  API: () => API,
+  Listener: () => Listener,
+  MANUAL_CLOSE: () => MANUAL_CLOSE,
+  MessageType: () => MessageType,
+  TikTok: () => TikTok,
+  TikTokError: () => TikTokError,
+  findChrome: () => findChrome,
+  loginQR: () => loginQR
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/api/api.ts
+var import_node_crypto3 = require("crypto");
+
+// src/protocol/constants.ts
+var IM_API = "https://im-api-sg.tiktok.com";
+var IM_WS = "wss://im-ws-sg.tiktok.com/ws/v2";
+var WEB = "https://www.tiktok.com";
+var DEFAULT_USER_AGENT = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.0.0 Safari/537.36";
+var AID_WEB = "1988";
+var AID_FRONTIER = "1459";
+var SDK_VERSION = "1.8.5";
+var BUILD_NUMBER = "feffaa1:master";
+var FRONTIER_FPID = "9";
+var FRONTIER_APP_KEY = "e1bd35ec9db7b8d846de66ed140b1ad9";
+var FRONTIER_SALT = "f8a69f1719916z";
+var Cmd = {
+  SendMessage: 100,
+  GetMessagesByUserInit: 203,
+  GetMessagesByConversation: 301,
+  /** Websocket push of new messages. */
+  NewMessage: 500,
+  /** Add / remove a reaction (message `property`) — `/v1/message/set_property`. */
+  SetMessageProperty: 705,
+  GetConversationInfo: 610,
+  MarkRead: 2002,
+  UploadConfig: 2059
+};
+var MARK_READ_BODY_FIELD = 604;
+var MessageType = {
+  System: 1,
+  Text: 7,
+  ShareVideo: 8,
+  PrivateImage: 1802,
+  /** Sticker — public image on the sticker CDN, not encrypted. */
+  Sticker: 1805,
+  /** Hidden command (read receipt…) — not shown in the conversation, but still pushed over websocket. */
+  Command: 50001
+};
+var ConversationType = { OneToOne: 1 };
+var Resp = { cmd: 1, seq: 2, status: 3, error: 4, body: 6, logId: 7 };
+var MsgF = {
+  conversationId: 1,
+  conversationType: 2,
+  serverMessageId: 3,
+  indexInConversation: 4,
+  conversationShortId: 5,
+  type: 6,
+  sender: 7,
+  content: 8,
+  ext: 9,
+  createTime: 10,
+  /** `property_list` — reaction: `{1 key "e:<emoji>", 2 {1 PropertyItem[]}}`. */
+  propertyList: 15,
+  attachments: 20,
+  tag: 21
+};
+var PropertyOp = { Add: 0, Remove: 1 };
+var REACTION_PREFIX = "e:";
+var REACTION_LOVE_KEY = "e:love";
+var REACTION_HEART = "\u2764\uFE0F";
+var IMAGEX_REGION = "cn-north-1";
+var IMAGEX_SERVICE = "imagex";
+var IMAGEX_VERSION = "2018-08-01";
+
+// src/protocol/proto.ts
+function readVarint(b, i) {
+  let x = 0n;
+  let shift = 0n;
+  let c;
+  do {
+    if (i >= b.length) throw new Error("varint runs past end of buffer");
+    c = b[i++];
+    x |= BigInt(c & 127) << shift;
+    shift += 7n;
+  } while (c & 128);
+  return [x, i];
+}
+function decodeFields(b) {
+  const out = [];
+  let i = 0;
+  try {
+    while (i < b.length) {
+      const [key2, j] = readVarint(b, i);
+      i = j;
+      const wire = Number(key2 & 7n);
+      const n = Number(key2 >> 3n);
+      if (n === 0) return null;
+      if (wire === 0) {
+        const [v, k] = readVarint(b, i);
+        out.push({ n, wire, int: v, bytes: Buffer.alloc(0) });
+        i = k;
+      } else if (wire === 2) {
+        const [len, k] = readVarint(b, i);
+        const end = k + Number(len);
+        if (end > b.length) return null;
+        out.push({ n, wire, int: 0n, bytes: b.subarray(k, end) });
+        i = end;
+      } else if (wire === 1 || wire === 5) {
+        const size = wire === 1 ? 8 : 4;
+        if (i + size > b.length) return null;
+        out.push({ n, wire, int: 0n, bytes: b.subarray(i, i + size) });
+        i += size;
+      } else {
+        return null;
+      }
+    }
+  } catch {
+    return null;
+  }
+  return out;
+}
+var Msg = class _Msg {
+  constructor(fields) {
+    this.fields = fields;
+  }
+  fields;
+  static parse(b) {
+    const f = decodeFields(b);
+    if (!f) throw new Error("Failed to decode protobuf");
+    return new _Msg(f);
+  }
+  static tryParse(b) {
+    if (!b) return null;
+    const f = decodeFields(b);
+    return f ? new _Msg(f) : null;
+  }
+  has(n) {
+    return this.fields.some((f) => f.n === n);
+  }
+  int(n) {
+    return this.fields.find((f) => f.n === n)?.int ?? 0n;
+  }
+  num(n) {
+    return Number(this.int(n));
+  }
+  /** 64-bit integer as a string — uids / message IDs exceed `Number.MAX_SAFE_INTEGER`. */
+  id(n) {
+    return this.int(n).toString();
+  }
+  bytes(n) {
+    return this.fields.find((f) => f.n === n)?.bytes ?? Buffer.alloc(0);
+  }
+  str(n) {
+    return this.bytes(n).toString("utf8");
+  }
+  strs(n) {
+    return this.fields.filter((f) => f.n === n).map((f) => f.bytes.toString("utf8"));
+  }
+  msg(n) {
+    return _Msg.tryParse(this.fields.find((f) => f.n === n)?.bytes);
+  }
+  msgs(n) {
+    return this.fields.filter((f) => f.n === n).map((f) => _Msg.tryParse(f.bytes)).filter((m) => m !== null);
+  }
+  /** `map<string,string>` — each entry is a message `{1: key, 2: value}`. */
+  map(n) {
+    const out = {};
+    for (const m of this.msgs(n)) out[m.str(1)] = m.str(2);
+    return out;
+  }
+};
+function varint(x) {
+  let v = BigInt(x);
+  if (v < 0n) v = BigInt.asUintN(64, v);
+  const out = [];
+  do {
+    const c = Number(v & 127n);
+    v >>= 7n;
+    out.push(v ? c | 128 : c);
+  } while (v);
+  return Buffer.from(out);
+}
+var key = (n, wire) => varint(BigInt(n) << 3n | BigInt(wire));
+var Writer = class _Writer {
+  parts = [];
+  int(n, v) {
+    this.parts.push(key(n, 0), varint(typeof v === "string" ? BigInt(v) : v));
+    return this;
+  }
+  bytes(n, v) {
+    const b = typeof v === "string" ? Buffer.from(v, "utf8") : v;
+    this.parts.push(key(n, 2), varint(b.length), b);
+    return this;
+  }
+  msg(n, w) {
+    return this.bytes(n, w.finish());
+  }
+  /** `map<string,string>` in the object's key order. */
+  map(n, obj) {
+    for (const [k, v] of Object.entries(obj)) this.msg(n, new _Writer().bytes(1, k).bytes(2, v));
+    return this;
+  }
+  finish() {
+    return Buffer.concat(this.parts);
+  }
+};
+
+// src/errors.ts
+var TikTokError = class extends Error {
+  constructor(code, message, upstream) {
+    super(message);
+    this.code = code;
+    this.upstream = upstream;
+    this.name = "TikTokError";
+  }
+  code;
+  upstream;
+};
+
+// src/listener/listener.ts
+var import_node_events = require("events");
+var import_ws = __toESM(require("ws"));
+
+// src/models/message.ts
+function parseJson(s) {
+  try {
+    return JSON.parse(s);
+  } catch {
+    return s;
+  }
+}
+function parseImage(m) {
+  const media = m.msg(MsgF.attachments)?.msg(4);
+  const origin = media?.msg(1);
+  if (!media || !origin) return null;
+  const size = origin.msg(5);
+  return {
+    uri: origin.str(1),
+    url: origin.strs(2)[0] ?? "",
+    thumbUrl: media.msg(2)?.strs(2)[0] ?? "",
+    width: size?.num(1) ?? 0,
+    height: size?.num(2) ?? 0,
+    decryptKey: origin.str(6)
+  };
+}
+function parseSticker(m) {
+  const st = m.msg(MsgF.attachments)?.msg(7);
+  const img = st?.msg(1);
+  if (!st || !img) return null;
+  const size = img.msg(5);
+  const ext = st.msg(200)?.msg(1)?.map(2) ?? {};
+  return {
+    stickerId: ext["a:sticker_id"] ?? "",
+    stickerType: Number(ext["a:sticker_type"] ?? 0),
+    url: img.str(2),
+    width: size?.num(1) ?? 0,
+    height: size?.num(2) ?? 0
+  };
+}
+function parseReactions(m) {
+  const byEmoji = /* @__PURE__ */ new Map();
+  for (const p of m.msgs(MsgF.propertyList)) {
+    const key2 = p.str(1);
+    if (!key2.startsWith(REACTION_PREFIX)) continue;
+    const emoji = key2 === REACTION_LOVE_KEY ? REACTION_HEART : key2.slice(REACTION_PREFIX.length);
+    const uids = byEmoji.get(emoji) ?? /* @__PURE__ */ new Set();
+    for (const item of p.msg(2)?.msgs(1) ?? []) uids.add(item.id(1));
+    if (uids.size) byEmoji.set(emoji, uids);
+  }
+  return [...byEmoji].map(([emoji, uids]) => ({ emoji, userIds: [...uids] }));
+}
+var KIND = {
+  [MessageType.Text]: "text",
+  [MessageType.PrivateImage]: "image",
+  [MessageType.Sticker]: "sticker",
+  [MessageType.ShareVideo]: "video",
+  [MessageType.System]: "system",
+  [MessageType.Command]: "command"
+};
+function parseMessage(m, ownId) {
+  const type = m.num(MsgF.type);
+  const content = parseJson(m.str(MsgF.content));
+  const ext = m.map(MsgF.ext);
+  const senderId = m.id(MsgF.sender);
+  const text = type === MessageType.Text && content && typeof content === "object" && "text" in content ? String(content.text ?? "") : "";
+  return {
+    conversationId: m.str(MsgF.conversationId),
+    conversationShortId: m.id(MsgF.conversationShortId),
+    serverMessageId: m.id(MsgF.serverMessageId),
+    index: m.id(MsgF.indexInConversation),
+    type,
+    kind: KIND[type] ?? "other",
+    senderId,
+    isSelf: senderId === ownId,
+    text,
+    image: type === MessageType.PrivateImage ? parseImage(m) : null,
+    sticker: type === MessageType.Sticker ? parseSticker(m) : null,
+    reactions: parseReactions(m),
+    content,
+    createdAt: m.num(MsgF.createTime),
+    clientMessageId: ext["s:client_message_id"] ?? "",
+    ext
+  };
+}
+function parseConversation(m, ownId) {
+  const participants = (m.msg(6)?.msgs(1) ?? []).map((p) => p.id(1));
+  return {
+    conversationId: m.str(1),
+    conversationShortId: m.id(2),
+    participants,
+    peerId: participants.find((p) => p !== ownId) ?? ""
+  };
+}
+
+// src/listener/frame.ts
+var import_node_crypto = require("crypto");
+
+// src/protocol/lz4.ts
+function lz4Decompress(src) {
+  let out = Buffer.alloc(Math.max(src.length * 4, 1024));
+  let o = 0;
+  const ensure = (need) => {
+    if (o + need <= out.length) return;
+    let size = out.length * 2;
+    while (o + need > size) size *= 2;
+    const bigger = Buffer.alloc(size);
+    out.copy(bigger, 0, 0, o);
+    out = bigger;
+  };
+  let i = 0;
+  while (i < src.length) {
+    const token = src[i++];
+    let lit = token >> 4;
+    if (lit === 15) {
+      let b;
+      do {
+        b = src[i++];
+        lit += b;
+      } while (b === 255);
+    }
+    ensure(lit);
+    src.copy(out, o, i, i + lit);
+    i += lit;
+    o += lit;
+    if (i >= src.length) break;
+    const offset = src[i] | src[i + 1] << 8;
+    i += 2;
+    if (offset === 0 || offset > o) throw new Error("lz4: invalid offset");
+    let len = token & 15;
+    if (len === 15) {
+      let b;
+      do {
+        b = src[i++];
+        len += b;
+      } while (b === 255);
+    }
+    len += 4;
+    ensure(len);
+    for (let k = 0; k < len; k++, o++) out[o] = out[o - offset];
+  }
+  return out.subarray(0, o);
+}
+
+// src/listener/frame.ts
+function accessKey(deviceId) {
+  return (0, import_node_crypto.createHash)("md5").update(FRONTIER_FPID + FRONTIER_APP_KEY + deviceId + FRONTIER_SALT).digest("hex");
+}
+function parseFrame(data) {
+  const m = Msg.parse(data);
+  return {
+    seq: m.int(1),
+    logId: m.int(2),
+    headers: m.map(5),
+    encoding: m.str(6),
+    payload: m.bytes(8)
+  };
+}
+function newMessageBody(frame) {
+  if (frame.payload.length === 0) return null;
+  const payload = frame.encoding === "__lz4" ? lz4Decompress(frame.payload) : frame.payload;
+  const resp = Msg.tryParse(payload);
+  if (!resp || resp.num(Resp.cmd) !== Cmd.NewMessage) return null;
+  return resp.msg(Resp.body)?.msg(Cmd.NewMessage)?.msg(5) ?? null;
+}
+function buildAck(f, now = Date.now()) {
+  const ackId = `${now.toString(36)}:${f.headers.x_frontier_traceid ?? ""}`;
+  return new Writer().int(1, f.seq).int(2, f.logId).int(3, 5).int(4, 1).map(5, { is_ack: "1", ack_id: ackId, ack_code: "0" }).bytes(9, ackId).finish();
+}
+
+// src/listener/listener.ts
+var HEARTBEAT_MS = 15e3;
+var IDLE_TIMEOUT_MS = 75e3;
+var RECONNECT_MIN_MS = 2e3;
+var RECONNECT_MAX_MS = 6e4;
+var DEDUPE_KEEP = 500;
+var MANUAL_CLOSE = 4e3;
+var Listener = class extends import_node_events.EventEmitter {
+  constructor(ctx) {
+    super();
+    this.ctx = ctx;
+  }
+  ctx;
+  ws = null;
+  heartbeat = null;
+  idle = null;
+  reconnectTimer = null;
+  backoff = RECONNECT_MIN_MS;
+  retry = true;
+  seen = /* @__PURE__ */ new Set();
+  get connected() {
+    return this.ws?.readyState === import_ws.default.OPEN;
+  }
+  url() {
+    const q = new URLSearchParams({
+      aid: AID_FRONTIER,
+      fpid: FRONTIER_FPID,
+      device_platform: "web",
+      version_code: "fws_1.0.0",
+      access_key: accessKey(this.ctx.deviceId),
+      device_id: this.ctx.deviceId,
+      // Cookie value is already URL-encoded (`1%7C…`) — decode it so URLSearchParams doesn't double-encode.
+      ttwid: decodeURIComponent(this.ctx.cookies.get("ttwid") ?? ""),
+      xsack: "1",
+      xaack: "1",
+      xsqos: "0"
+    });
+    return `${IM_WS}?${q}`;
+  }
+  /** Open the connection. `retryOnClose` (on by default): reconnect on drop, backing off up to 1 minute. */
+  start(opts = {}) {
+    this.retry = opts.retryOnClose ?? true;
+    this.connect();
+  }
+  stop() {
+    this.retry = false;
+    this.clearTimers();
+    if (this.reconnectTimer) clearTimeout(this.reconnectTimer);
+    this.reconnectTimer = null;
+    const ws = this.ws;
+    this.ws = null;
+    if (ws && ws.readyState <= import_ws.default.OPEN) ws.close(MANUAL_CLOSE, "manual");
+  }
+  connect() {
+    const ws = new import_ws.default(this.url(), {
+      headers: { Cookie: this.ctx.cookieHeader(), "User-Agent": this.ctx.userAgent, Origin: WEB }
+    });
+    this.ws = ws;
+    ws.binaryType = "nodebuffer";
+    ws.on("open", () => {
+      this.backoff = RECONNECT_MIN_MS;
+      this.heartbeat = setInterval(() => ws.readyState === import_ws.default.OPEN && ws.send("hi"), HEARTBEAT_MS);
+      this.touch();
+      this.ctx.log("debug", "tca: websocket connected");
+      this.emit("connected");
+    });
+    ws.on("message", (data, isBinary) => {
+      this.touch();
+      if (!isBinary) return;
+      try {
+        this.onFrame(ws, data);
+      } catch (err) {
+        this.emit("error", err instanceof Error ? err : new Error(String(err)));
+      }
+    });
+    ws.on("error", (err) => this.emit("error", err));
+    ws.on("close", (code, reason) => {
+      if (this.ws !== ws) return;
+      this.ws = null;
+      this.clearTimers();
+      this.emit("closed", code, reason.toString());
+      if (!this.retry || code === MANUAL_CLOSE) return;
+      const wait = this.backoff;
+      this.backoff = Math.min(this.backoff * 2, RECONNECT_MAX_MS);
+      this.ctx.log("warn", `tca: websocket closed (${code}) \u2014 reconnecting in ${wait / 1e3}s`);
+      this.reconnectTimer = setTimeout(() => this.connect(), wait);
+    });
+  }
+  touch() {
+    if (this.idle) clearTimeout(this.idle);
+    this.idle = setTimeout(() => {
+      this.ctx.log("warn", "tca: websocket silent too long \u2014 reconnecting");
+      this.ws?.terminate();
+    }, IDLE_TIMEOUT_MS);
+  }
+  clearTimers() {
+    if (this.heartbeat) clearInterval(this.heartbeat);
+    if (this.idle) clearTimeout(this.idle);
+    this.heartbeat = null;
+    this.idle = null;
+  }
+  onFrame(ws, data) {
+    const frame = parseFrame(data);
+    if (frame.headers.need_ack === "1" && ws.readyState === import_ws.default.OPEN) ws.send(buildAck(frame));
+    const body = newMessageBody(frame);
+    if (!body) return;
+    const msg = parseMessage(body, this.ctx.ownId);
+    if (!msg.serverMessageId || this.seen.has(msg.serverMessageId)) return;
+    this.seen.add(msg.serverMessageId);
+    if (this.seen.size > DEDUPE_KEEP) this.seen.delete(this.seen.values().next().value);
+    if (msg.kind === "command") this.emit("command", msg);
+    else this.emit("message", msg);
+  }
+};
+
+// src/api/account.ts
+async function fetchAccount(ctx) {
+  const res = await ctx.getJson(`${WEB}/passport/web/account/info/?aid=${AID_FRONTIER}`);
+  if (res.message !== "success" || !res.data?.user_id_str) return null;
+  return {
+    uid: res.data.user_id_str,
+    username: res.data.username ?? "",
+    screenName: res.data.screen_name ?? "",
+    avatar: res.data.avatar_url ?? ""
+  };
+}
+async function fetchWebId(ctx) {
+  const res = await ctx.fetch(`${WEB}/api/v1/web-cookie-privacy/config?locale=vi-VN&appId=1988&theme=default&tea=1`);
+  if (!res.ok) return "";
+  return /"wid":"(\d+)"/.exec(await res.text())?.[1] ?? "";
+}
+function avatarLinks(avatars) {
+  const urls = [];
+  const walk = (v) => {
+    if (typeof v === "string") {
+      if (/^https?:\/\//.test(v) && !urls.includes(v)) urls.push(v);
+    } else if (Array.isArray(v)) v.forEach(walk);
+    else if (v && typeof v === "object") Object.values(v).forEach(walk);
+  };
+  walk(avatars);
+  const heic = (u) => /\.heic(\?|$)/i.test(u.split("?")[0] + "?");
+  const ranked = [...urls.filter((u) => !heic(u)), ...urls.filter(heic)];
+  return { avatar: ranked[0] ?? "", avatars: ranked };
+}
+
+// src/api/media.ts
+var import_node_crypto2 = require("crypto");
+var import_node_zlib = require("zlib");
+var sha256 = (s) => (0, import_node_crypto2.createHash)("sha256").update(s).digest("hex");
+var hmac = (k, s) => (0, import_node_crypto2.createHmac)("sha256", k).update(s).digest();
+var rfc3986 = (s) => encodeURIComponent(s).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+var MediaClient = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  cred = null;
+  /** `UploadConfig` returns two credential sets: type 1 = ImageX (images), type 2 = VOD (video). Use type 1. */
+  async credential() {
+    if (this.cred && this.cred.expiresAt - Date.now() > 6e4) return this.cred;
+    const body = await this.ctx.im("/v1/media/upload_config", Cmd.UploadConfig, Buffer.alloc(0));
+    const c = body.msgs(1).find((m) => m.num(1) === 1);
+    if (!c) throw new TikTokError("UPLOAD_FAILED", "upload_config has no ImageX credentials");
+    this.cred = {
+      serviceId: c.str(2),
+      host: c.str(3),
+      expiresAt: c.num(4),
+      accessKeyId: c.str(6),
+      sessionToken: c.str(7),
+      secretAccessKey: c.str(8)
+    };
+    return this.cred;
+  }
+  /** Call ImageX signed with AWS SigV4 (region cn-north-1, service imagex). */
+  async imagex(method, params, body) {
+    const c = await this.credential();
+    const amzDate = (/* @__PURE__ */ new Date()).toISOString().replace(/[-:]/g, "").replace(/\.\d+/, "");
+    const date = amzDate.slice(0, 8);
+    const query = Object.keys(params).sort().map((k2) => `${rfc3986(k2)}=${rfc3986(params[k2])}`).join("&");
+    const headers = { "x-amz-date": amzDate, "x-amz-security-token": c.sessionToken };
+    if (body !== void 0) headers["x-amz-content-sha256"] = sha256(body);
+    const signed = Object.keys(headers).sort();
+    const canonical = [
+      method,
+      "/",
+      query,
+      signed.map((k2) => `${k2}:${headers[k2]}
+`).join(""),
+      signed.join(";"),
+      body !== void 0 ? headers["x-amz-content-sha256"] : sha256("")
+    ].join("\n");
+    const scope = `${date}/${IMAGEX_REGION}/${IMAGEX_SERVICE}/aws4_request`;
+    const toSign = ["AWS4-HMAC-SHA256", amzDate, scope, sha256(canonical)].join("\n");
+    let k = hmac(`AWS4${c.secretAccessKey}`, date);
+    k = hmac(k, IMAGEX_REGION);
+    k = hmac(k, IMAGEX_SERVICE);
+    k = hmac(k, "aws4_request");
+    const signature = (0, import_node_crypto2.createHmac)("sha256", k).update(toSign).digest("hex");
+    const res = await fetch(`https://${c.host}/?${query}`, {
+      method,
+      headers: {
+        ...headers,
+        Authorization: `AWS4-HMAC-SHA256 Credential=${c.accessKeyId}/${scope}, SignedHeaders=${signed.join(";")}, Signature=${signature}`,
+        ...body !== void 0 ? { "Content-Type": "application/json" } : {}
+      },
+      body,
+      signal: AbortSignal.timeout(this.ctx.options.timeoutMs ?? 2e4)
+    });
+    const json = await res.json().catch(() => null);
+    const err = json?.ResponseMetadata?.Error;
+    if (!res.ok || !json || err) {
+      throw new TikTokError(
+        "UPLOAD_FAILED",
+        `imagex ${params.Action}: ${err?.Message ?? `HTTP ${res.status}`}`,
+        err?.CodeN ?? res.status
+      );
+    }
+    return json;
+  }
+  /**
+   * Upload an image to the private message store: Apply → POST file → Commit (the store encrypts with AES-GCM
+   * and returns the key). Image dimensions come from the Commit result — no need to decode the image.
+   */
+  async upload(image) {
+    const c = await this.credential();
+    const ext = (/\.([a-z0-9]{2,5})$/i.exec(image.filename)?.[1] ?? "jpg").toLowerCase();
+    const apply = await this.imagex("GET", {
+      Action: "ApplyImageUpload",
+      Version: IMAGEX_VERSION,
+      ServiceId: c.serviceId,
+      FileSize: String(image.data.length),
+      FileExtension: `.${ext}`,
+      s: (0, import_node_crypto2.randomBytes)(6).toString("hex").slice(0, 10)
+    });
+    const addr = apply.Result.UploadAddress;
+    const store = addr.StoreInfos[0];
+    const host = addr.UploadHosts[0];
+    if (!store || !host) throw new TikTokError("UPLOAD_FAILED", "ApplyImageUpload returned no upload target");
+    const up = await fetch(`https://${host}/upload/v1/${store.StoreUri}`, {
+      method: "POST",
+      headers: {
+        Authorization: store.Auth,
+        "Content-CRC32": ((0, import_node_zlib.crc32)(image.data) >>> 0).toString(16).padStart(8, "0"),
+        // Without this header the store returns 4004 Not Found.
+        "X-Storage-U": this.ctx.ownId,
+        "Content-Type": "application/octet-stream",
+        "Content-Disposition": 'attachment; filename="undefined"'
+      },
+      body: new Uint8Array(image.data),
+      signal: AbortSignal.timeout(this.ctx.options.timeoutMs ?? 6e4)
+    });
+    const upJson = await up.json().catch(() => null);
+    if (!up.ok || upJson?.code !== 2e3) {
+      throw new TikTokError(
+        "UPLOAD_FAILED",
+        `upload: ${upJson?.message ?? `HTTP ${up.status}`}`,
+        upJson?.code ?? up.status
+      );
+    }
+    const commit = await this.imagex(
+      "POST",
+      { Action: "CommitImageUpload", Version: IMAGEX_VERSION, ServiceId: c.serviceId },
+      JSON.stringify({
+        SessionKey: addr.SessionKey,
+        Functions: [{ name: "Encryption", input: { Config: { copies: "cipher_v2" } } }]
+      })
+    );
+    const enc = commit.Result.Results?.[0]?.Encryption;
+    const plugin = commit.Result.PluginResult?.[0];
+    if (!enc?.Uri || !enc.SecretKey)
+      throw new TikTokError("UPLOAD_FAILED", "CommitImageUpload returned no encrypted result");
+    return {
+      uri: enc.Uri,
+      secretKey: enc.SecretKey,
+      width: plugin?.ImageWidth ?? Number(enc.Extra?.img_width ?? 0),
+      height: plugin?.ImageHeight ?? Number(enc.Extra?.img_height ?? 0),
+      size: plugin?.ImageSize ?? image.data.length,
+      filename: image.filename
+    };
+  }
+  /** Download and decrypt a message image. Layout: 12-byte IV ‖ ciphertext ‖ 16-byte tag. */
+  async download(image, which = "origin") {
+    const url = which === "thumb" && image.thumbUrl ? image.thumbUrl : image.url;
+    if (!url) throw new TikTokError("DOWNLOAD_FAILED", "Image has no URL");
+    const res = await this.ctx.fetch(url);
+    if (!res.ok) throw new TikTokError("DOWNLOAD_FAILED", `Image download: HTTP ${res.status}`, res.status);
+    const enc = Buffer.from(await res.arrayBuffer());
+    if (!image.decryptKey) return enc;
+    try {
+      const d = (0, import_node_crypto2.createDecipheriv)("aes-256-gcm", Buffer.from(image.decryptKey, "hex"), enc.subarray(0, 12));
+      d.setAuthTag(enc.subarray(enc.length - 16));
+      return Buffer.concat([d.update(enc.subarray(12, enc.length - 16)), d.final()]);
+    } catch (err) {
+      throw new TikTokError("DOWNLOAD_FAILED", `Image decryption: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+};
+
+// src/api/requests.ts
+var NEWEST = 9999999999999999n;
+function getMessagesBody(conv, limit, before) {
+  return new Writer().bytes(1, conv.conversationId).int(2, ConversationType.OneToOne).int(3, BigInt(conv.conversationShortId)).int(4, 1).int(5, before ? BigInt(before) : NEWEST).int(6, limit).finish();
+}
+function markReadBody(msg) {
+  return new Writer().bytes(1, msg.conversationId).int(2, BigInt(msg.conversationShortId)).int(3, ConversationType.OneToOne).int(4, BigInt(msg.index)).int(11, 4).finish();
+}
+function sendMessageBody(conv, cid, type, content, extra) {
+  const w = new Writer().bytes(1, conv.conversationId).int(2, ConversationType.OneToOne).int(3, BigInt(conv.conversationShortId)).bytes(4, content).map(5, { "s:mentioned_users": "", "s:client_message_id": cid }).int(6, type).bytes(7, "deprecated").bytes(8, cid);
+  return extra ? Buffer.concat([w.finish(), extra.finish()]) : w.finish();
+}
+function imageMessageExtra(up) {
+  const w = String(up.width);
+  const h = String(up.height);
+  const media = new Writer().msg(
+    1,
+    new Writer().bytes(1, up.uri).msg(5, new Writer().int(1, up.width).int(2, up.height)).bytes(6, up.secretKey).int(7, 0)
+  ).msg(
+    3,
+    new Writer().msg(1, new Writer().bytes(1, "You sent a \u{1F4F7}")).msg(2, new Writer().bytes(1, "sent a \u{1F4F7}")).msg(3, new Writer().bytes(1, "[Photo]"))
+  ).msg(
+    200,
+    new Writer().msg(
+      1,
+      new Writer().bytes(1, up.uri).map(2, {
+        image_width: w,
+        image_height: h,
+        decrypt_key: up.secretKey,
+        quote_preview: "dm_cam_preview_photo",
+        sender_preview: "sender_preview"
+      })
+    )
+  );
+  return new Writer().msg(13, new Writer().msg(4, media)).bytes(14, "private_image").msg(
+    17,
+    new Writer().int(1, 1).bytes(2, up.uri).bytes(3, up.secretKey).msg(10, new Writer().int(1, up.width).int(2, up.height).int(4, up.size).bytes(5, up.filename))
+  );
+}
+function reactionOps(msg, own, emoji) {
+  const mine = msg.reactions.filter((r) => r.userIds.includes(own)).map((r) => r.emoji);
+  const ops = [];
+  if (emoji && !mine.includes(emoji)) ops.push({ op: PropertyOp.Add, key: REACTION_PREFIX + emoji });
+  for (const e of mine) {
+    if (e === emoji) continue;
+    ops.push({ op: PropertyOp.Remove, key: REACTION_PREFIX + e });
+    if (e === REACTION_HEART) ops.push({ op: PropertyOp.Remove, key: REACTION_LOVE_KEY });
+  }
+  return ops;
+}
+function setPropertyBody(msg, ops, own) {
+  const target = new Writer().bytes(1, msg.conversationId).int(2, ConversationType.OneToOne).int(3, BigInt(msg.conversationShortId)).int(4, BigInt(msg.serverMessageId)).bytes(5, msg.clientMessageId);
+  for (const o of ops) target.msg(6, new Writer().int(1, o.op).bytes(2, o.key).bytes(4, own));
+  return new Writer().msg(1, target).bytes(2, "deprecated").finish();
+}
+
+// src/api/api.ts
+var API = class {
+  constructor(ctx, account) {
+    this.ctx = ctx;
+    this.account = account;
+    this.listener = new Listener(ctx);
+    this.media = new MediaClient(ctx);
+  }
+  ctx;
+  account;
+  listener;
+  media;
+  getOwnId() {
+    return this.ctx.ownId;
+  }
+  /** Current cookies — save them so the next `login` needs no QR scan. */
+  getCookies() {
+    return [...this.ctx.cookies].map(([name, value]) => ({ name, value }));
+  }
+  getContext() {
+    return { deviceId: this.ctx.deviceId, userAgent: this.ctx.userAgent };
+  }
+  /** Whether the session is still alive — call periodically to detect expiry early. */
+  async isAlive() {
+    return await fetchAccount(this.ctx).catch(() => null) !== null;
+  }
+  // ─── Inbox ─────────────────────────────────────────────────────────────────
+  /** Recent conversations + their latest messages, paginated with `cursor`. */
+  async getConversations(cursor = "0") {
+    const body = await this.ctx.im(
+      "/v2/message/get_by_user_init",
+      Cmd.GetMessagesByUserInit,
+      new Writer().int(1, BigInt(cursor)).finish()
+    );
+    return {
+      messages: body.msgs(1).map((m) => parseMessage(m, this.ctx.ownId)),
+      conversations: body.msgs(2).map((m) => parseConversation(m, this.ctx.ownId)),
+      // Cursor = number of conversations fetched so far (0, 10, 20…) — field 4; field 3 is a timestamp, not used for paging.
+      cursor: body.id(4),
+      hasMore: body.num(5) === 1
+    };
+  }
+  /** Messages of a conversation, newest first. For older messages: `before = <index of oldest message>`. */
+  async getMessages(conv, opts = {}) {
+    const limit = Math.min(Math.max(opts.limit ?? 20, 1), 50);
+    const body = await this.ctx.im(
+      "/v1/message/get_by_conversation",
+      Cmd.GetMessagesByConversation,
+      getMessagesBody(conv, limit, opts.before)
+    );
+    const messages = body.msgs(1).map((m) => parseMessage(m, this.ctx.ownId));
+    return { messages, hasMore: messages.length >= limit };
+  }
+  /** User profiles by uid (display name, @username, avatar). */
+  async getUsers(uids) {
+    if (uids.length === 0) return [];
+    const q = new URLSearchParams({
+      aid: "1988",
+      app_name: "tiktok_web",
+      device_platform: "web_pc",
+      source: "im_chat",
+      from_page: "message",
+      user_ids: JSON.stringify(uids)
+    });
+    const res = await this.ctx.getJson(`${WEB}/tiktok/v1/im/user/profile/?${q}`);
+    if (res.status_code) throw new TikTokError("IM_ERROR", `user/profile: ${res.status_code}`, res.status_code);
+    return (res.users ?? []).map(({ im_user_profile: p = {} }) => ({
+      uid: p.user_id_str ?? "",
+      uniqueId: p.unique_id ?? "",
+      nickname: p.nick_name ?? "",
+      ...avatarLinks(p.avatars)
+    }));
+  }
+  /**
+   * Download an avatar (tries each URL in turn, skips heic). No cookie / Referer sent: the image CDN is cross-origin and
+   * URLs are already signed. `null` if no URL could be downloaded.
+   */
+  async downloadAvatar(user) {
+    for (const url of user.avatars) {
+      const res = await fetch(url, {
+        headers: { "User-Agent": this.ctx.userAgent },
+        referrerPolicy: "no-referrer",
+        signal: AbortSignal.timeout(this.ctx.options.timeoutMs ?? 2e4)
+      }).catch(() => null);
+      const type = res?.headers.get("content-type") ?? "";
+      if (!res?.ok || !/^image\/(jpeg|png|webp|gif)/.test(type)) continue;
+      return { data: Buffer.from(await res.arrayBuffer()), type };
+    }
+    return null;
+  }
+  /** Mark as read up to message `msg`. */
+  async markRead(msg) {
+    await this.ctx.im("/v3/conversation/mark_read", Cmd.MarkRead, markReadBody(msg), MARK_READ_BODY_FIELD);
+  }
+  // ─── Send ─────────────────────────────────────────────────────────────────
+  /** Send a text message to a conversation (usually the just-received `msg` — it carries the conversation ids). */
+  async sendMessage(conv, text) {
+    const cid = (0, import_node_crypto3.randomUUID)();
+    await this.send(conv, cid, MessageType.Text, JSON.stringify({ aweType: 0, text }), null);
+    return { clientMessageId: cid };
+  }
+  /** Send an image: upload to the private (encrypted) store, then send an image message. */
+  async sendImage(conv, image) {
+    const up = await this.media.upload(image);
+    const cid = (0, import_node_crypto3.randomUUID)();
+    await this.send(conv, cid, MessageType.PrivateImage, "", imageMessageExtra(up));
+    return { clientMessageId: cid };
+  }
+  /**
+   * Set YOUR reaction on a message — like TikTok Web, one reaction per user: a new `emoji` replaces the old one,
+   * `null` = remove. Pass the whole `msg` just read (current `reactions` are needed to know which key to remove).
+   * Sends `ModifyMessagePropertyRequestBody` (command 705) — see README.
+   */
+  async setReaction(msg, emoji) {
+    const own = this.ctx.ownId;
+    const ops = reactionOps(msg, own, emoji);
+    if (ops.length === 0) return;
+    const body = await this.ctx.im("/v1/message/set_property", Cmd.SetMessageProperty, setPropertyBody(msg, ops, own));
+    const status = body.num(1);
+    if (status > 1) throw new TikTokError("IM_ERROR", `set_property: status ${status}`, status);
+  }
+  // ─── Media ─────────────────────────────────────────────────────────────────
+  /** Download a sticker image (public CDN, unencrypted, no cookie needed). */
+  async downloadSticker(sticker) {
+    const res = await fetch(sticker.url, {
+      headers: { "User-Agent": this.ctx.userAgent },
+      referrerPolicy: "no-referrer",
+      signal: AbortSignal.timeout(this.ctx.options.timeoutMs ?? 2e4)
+    }).catch(() => null);
+    if (!res?.ok) throw new TikTokError("DOWNLOAD_FAILED", `Sticker download failed: ${res?.status ?? "network"}`);
+    return { data: Buffer.from(await res.arrayBuffer()), type: res.headers.get("content-type") ?? "image/webp" };
+  }
+  /** Download + decrypt a message's image (pass the whole `msg` — listener messages lack the URL, this looks it up). */
+  async downloadImage(source, which = "origin") {
+    let image = "serverMessageId" in source ? source.image : source;
+    if ("serverMessageId" in source && image && !image.url) {
+      const { messages } = await this.getMessages(source, { limit: 5, before: (BigInt(source.index) + 1n).toString() });
+      image = messages.find((m) => m.serverMessageId === source.serverMessageId)?.image ?? image;
+    }
+    if (!image) throw new TikTokError("DOWNLOAD_FAILED", "Message has no image");
+    return this.media.download(image, which);
+  }
+  async send(conv, cid, type, content, extra) {
+    if (!conv.conversationId || !conv.conversationShortId) {
+      throw new TikTokError("IM_ERROR", "Missing conversationId / conversationShortId");
+    }
+    await this.ctx.im("/v1/message/send", Cmd.SendMessage, sendMessageBody(conv, cid, type, content, extra));
+  }
+};
+
+// src/protocol/context.ts
+function normalizeCookies(input) {
+  const jar = /* @__PURE__ */ new Map();
+  if (typeof input === "string") {
+    for (const part of input.split(";")) {
+      const i = part.indexOf("=");
+      if (i > 0) jar.set(part.slice(0, i).trim(), part.slice(i + 1).trim());
+    }
+  } else if (Array.isArray(input)) {
+    for (const c of input) if (c?.name) jar.set(c.name, String(c.value ?? ""));
+  } else {
+    for (const [k, v] of Object.entries(input ?? {})) jar.set(k, String(v));
+  }
+  return jar;
+}
+var Context = class {
+  constructor(creds, options = {}) {
+    this.options = options;
+    this.cookies = normalizeCookies(creds.cookies);
+    this.deviceId = creds.deviceId ?? "";
+    this.userAgent = creds.userAgent || DEFAULT_USER_AGENT;
+  }
+  options;
+  cookies;
+  /**
+   * IM device id = the `wid` TikTok issues for the `ttwid` cookie (`login` fetches it). The websocket only
+   * accepts this id — a made-up id gets 400 (HTTP IM isn't picky).
+   */
+  deviceId;
+  userAgent;
+  ownId = "";
+  seq = 1e4;
+  cookieHeader() {
+    return [...this.cookies].map(([k, v]) => `${k}=${v}`).join("; ");
+  }
+  log(level, msg) {
+    this.options.logger?.(level, msg);
+  }
+  /** `fetch` with cookies + UA + timeout. */
+  async fetch(url, init = {}) {
+    try {
+      return await fetch(url, {
+        ...init,
+        headers: {
+          "User-Agent": this.userAgent,
+          Referer: `${WEB}/`,
+          Origin: WEB,
+          Cookie: this.cookieHeader(),
+          ...init.headers
+        },
+        signal: AbortSignal.timeout(this.options.timeoutMs ?? 2e4)
+      });
+    } catch (err) {
+      throw new TikTokError("HTTP_ERROR", `${url.split("?")[0]}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  async getJson(url) {
+    const res = await this.fetch(url);
+    if (!res.ok) throw new TikTokError("HTTP_ERROR", `${url.split("?")[0]}: HTTP ${res.status}`, res.status);
+    return await res.json();
+  }
+  /** IM `Request` envelope: command + body + common headers. */
+  buildRequest(cmd, bodyField, body) {
+    return new Writer().int(1, cmd).int(2, this.seq++).bytes(3, SDK_VERSION).bytes(4, "").int(5, 3).int(6, 0).bytes(7, BUILD_NUMBER).msg(8, new Writer().bytes(bodyField, body)).bytes(9, this.deviceId).bytes(11, "web").map(15, {
+      aid: AID_WEB,
+      app_name: "tiktok_web",
+      channel: "web",
+      device_platform: "web_pc",
+      device_id: this.deviceId,
+      user_is_login: "true",
+      user_agent: this.userAgent
+    }).int(18, 1).finish();
+  }
+  /**
+   * Call an IM command over HTTP. Returns the unwrapped body (`ResponseBody[cmd]`).
+   * NO X-Gnarly/X-Bogus/msToken signature needed — the IM server only checks cookies (tested 09/11/2026).
+   */
+  async im(path, cmd, body, bodyField = cmd) {
+    const url = `${IM_API}${path}?aid=${AID_WEB}&version_code=1.0.0&app_name=tiktok_web&device_platform=web_pc`;
+    const res = await this.fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-protobuf", Accept: "application/x-protobuf" },
+      body: new Uint8Array(this.buildRequest(cmd, bodyField, body))
+    });
+    if (!res.ok) throw new TikTokError("HTTP_ERROR", `${path}: HTTP ${res.status}`, res.status);
+    const raw = Buffer.from(await res.arrayBuffer());
+    if (/json/i.test(res.headers.get("content-type") ?? "")) throw gatewayError(path, raw);
+    const resp = Msg.tryParse(raw);
+    if (!resp) throw new TikTokError("BAD_RESPONSE", `${path}: response is not protobuf`);
+    const status = resp.num(Resp.status);
+    if (status !== 0) {
+      const desc = resp.str(Resp.error);
+      const code = status === 200005 ? "SESSION_EXPIRED" : "IM_ERROR";
+      throw new TikTokError(code, `${path}: ${status} ${desc}`.trim(), status);
+    }
+    return resp.msg(Resp.body)?.msg(cmd) ?? resp.msg(Resp.body)?.msg(bodyField) ?? Msg.parse(Buffer.alloc(0));
+  }
+};
+function gatewayError(path, raw) {
+  let status;
+  try {
+    status = JSON.parse(raw.toString("utf8")).status_code;
+  } catch {
+  }
+  if (status === 7) return new TikTokError("SESSION_BLOCKED", `${path}: gateway status_code 7 \u2014 session blocked`, 7);
+  return new TikTokError(
+    "BAD_RESPONSE",
+    `${path}: gateway JSON status_code ${String(status)}`,
+    typeof status === "number" ? status : void 0
+  );
+}
+
+// src/client.ts
+var TikTok = class {
+  constructor(options = {}) {
+    this.options = options;
+  }
+  options;
+  /** Log in with existing cookies. Expired cookies → `TikTokError('SESSION_EXPIRED')`. */
+  async login(credentials) {
+    const ctx = new Context(credentials, this.options);
+    if (!ctx.cookies.get("sessionid") && !ctx.cookies.get("sid_tt")) {
+      throw new TikTokError("SESSION_EXPIRED", "Cookie has no sessionid");
+    }
+    const account = await fetchAccount(ctx);
+    if (!account) throw new TikTokError("SESSION_EXPIRED", "TikTok cookie is no longer logged in");
+    ctx.ownId = account.uid;
+    ctx.deviceId = await fetchWebId(ctx).catch(() => "") || ctx.deviceId;
+    if (!ctx.deviceId) throw new TikTokError("BAD_RESPONSE", "Could not get wid (device_id) \u2014 cookie missing ttwid?");
+    return new API(ctx, account);
+  }
+};
+
+// src/auth/qr-login.ts
+var import_promises2 = require("fs/promises");
+
+// src/auth/cdp.ts
+var import_ws2 = __toESM(require("ws"));
+async function openTab(browserWs) {
+  const ws = new import_ws2.default(browserWs, { perMessageDeflate: false });
+  await new Promise((resolve, reject) => {
+    ws.once("open", () => resolve());
+    ws.once("error", reject);
+  });
+  let id = 0;
+  let sessionId;
+  const pending = /* @__PURE__ */ new Map();
+  const handlers = [];
+  ws.on("message", (raw2) => {
+    const m = JSON.parse(raw2.toString());
+    if (m.id !== void 0 && pending.has(m.id)) {
+      const p = pending.get(m.id);
+      pending.delete(m.id);
+      if (m.error) p.reject(new Error(m.error.message));
+      else p.resolve(m.result ?? {});
+      return;
+    }
+    if (m.method && (!m.sessionId || m.sessionId === sessionId)) for (const h of handlers) h(m.method, m.params ?? {});
+  });
+  const raw = (method, params = {}, sid) => new Promise((resolve, reject) => {
+    const i = ++id;
+    pending.set(i, { resolve, reject });
+    ws.send(JSON.stringify({ id: i, method, params, ...sid ? { sessionId: sid } : {} }));
+  });
+  const target = await raw("Target.createTarget", { url: "about:blank" });
+  sessionId = (await raw("Target.attachToTarget", { targetId: target.targetId, flatten: true })).sessionId;
+  return {
+    send: (method, params) => raw(method, params, sessionId),
+    on: (h) => handlers.push(h),
+    close: () => ws.close()
+  };
+}
+
+// src/auth/chrome.ts
+var import_node_child_process = require("child_process");
+var import_node_fs = require("fs");
+var import_promises = require("fs/promises");
+var import_node_os = require("os");
+var import_node_path = require("path");
+var PATH_NAMES = ["google-chrome", "google-chrome-stable", "chromium", "chromium-browser", "chrome"];
+function knownPaths(platform, env) {
+  if (platform === "darwin") {
+    const apps = [
+      "Google Chrome.app/Contents/MacOS/Google Chrome",
+      "Chromium.app/Contents/MacOS/Chromium",
+      "Google Chrome Canary.app/Contents/MacOS/Google Chrome Canary"
+    ];
+    const roots = ["/Applications", ...env.HOME ? [(0, import_node_path.join)(env.HOME, "Applications")] : []];
+    return roots.flatMap((r) => apps.map((a) => (0, import_node_path.join)(r, a)));
+  }
+  if (platform === "win32") {
+    const roots = [env.PROGRAMFILES, env["PROGRAMFILES(X86)"], env.LOCALAPPDATA].filter((r) => !!r);
+    return roots.flatMap((r) => [
+      (0, import_node_path.join)(r, "Google", "Chrome", "Application", "chrome.exe"),
+      (0, import_node_path.join)(r, "Chromium", "Application", "chrome.exe")
+    ]);
+  }
+  return [
+    "/usr/bin/google-chrome",
+    "/usr/bin/google-chrome-stable",
+    "/usr/bin/chromium",
+    "/usr/bin/chromium-browser",
+    "/snap/bin/chromium",
+    "/opt/google/chrome/chrome"
+  ];
+}
+function findChrome(env = process.env, platform = process.platform, exists = import_node_fs.existsSync) {
+  if (env.CHROME_PATH && exists(env.CHROME_PATH)) return env.CHROME_PATH;
+  for (const p of knownPaths(platform, env)) if (exists(p)) return p;
+  if (platform !== "win32") {
+    for (const dir of (env.PATH ?? "").split(import_node_path.delimiter).filter(Boolean)) {
+      for (const name of PATH_NAMES) if (exists((0, import_node_path.join)(dir, name))) return (0, import_node_path.join)(dir, name);
+    }
+  }
+  return null;
+}
+function resolveChromePath(chromePath) {
+  if (chromePath) return chromePath;
+  const found = findChrome();
+  if (!found) {
+    throw new TikTokError(
+      "LOGIN_FAILED",
+      "Chrome / Chromium not found \u2014 install it, set the CHROME_PATH environment variable, or pass `chromePath`"
+    );
+  }
+  return found;
+}
+async function launchChrome(chromePath, userAgent) {
+  const dir = await (0, import_promises.mkdtemp)((0, import_node_path.join)((0, import_node_os.tmpdir)(), "tca-chrome-"));
+  const proc = (0, import_node_child_process.spawn)(
+    chromePath,
+    [
+      "--headless=new",
+      "--remote-debugging-port=0",
+      `--user-data-dir=${dir}`,
+      "--no-first-run",
+      "--no-default-browser-check",
+      "--disable-gpu",
+      "--disable-dev-shm-usage",
+      // Containers run as root — Chromium requires disabling the sandbox.
+      "--no-sandbox",
+      "--window-size=1280,900",
+      "--lang=vi-VN",
+      // The default headless UA contains "HeadlessChrome" — replace it with a normal UA.
+      `--user-agent=${userAgent}`,
+      "about:blank"
+    ],
+    { stdio: ["ignore", "ignore", "pipe"] }
+  );
+  const ws = await new Promise((resolve, reject) => {
+    let buf = "";
+    const timer = setTimeout(() => reject(new Error("Chrome did not start within 20s")), 2e4);
+    proc.stderr.on("data", (d) => {
+      buf += d.toString();
+      const m = /DevTools listening on (ws:\/\/\S+)/.exec(buf);
+      if (m) {
+        clearTimeout(timer);
+        resolve(m[1]);
+      }
+    });
+    proc.once("error", (e) => {
+      clearTimeout(timer);
+      reject(e);
+    });
+    proc.once("exit", (code) => {
+      clearTimeout(timer);
+      reject(new Error(`Chrome exited (${code}) before it was ready`));
+    });
+  }).catch(async (err) => {
+    proc.kill("SIGKILL");
+    await (0, import_promises.rm)(dir, { recursive: true, force: true });
+    throw new TikTokError(
+      "LOGIN_FAILED",
+      `Failed to launch Chrome: ${err instanceof Error ? err.message : String(err)}`
+    );
+  });
+  return { proc, ws, dir };
+}
+
+// src/auth/qr-login.ts
+async function loginQR(opts) {
+  const userAgent = opts.userAgent || DEFAULT_USER_AGENT;
+  const maxRefresh = opts.maxRefresh ?? 3;
+  const { proc, ws, dir } = await launchChrome(resolveChromePath(opts.chromePath), userAgent);
+  let cdp = null;
+  try {
+    cdp = await openTab(ws);
+    const tab = cdp;
+    await tab.send("Network.enable");
+    await tab.send("Page.enable");
+    const result = new Promise((resolve, reject) => {
+      const urlById = /* @__PURE__ */ new Map();
+      let refreshes = 0;
+      let scanned = false;
+      let done = false;
+      const finish = (err, creds) => {
+        if (done) return;
+        done = true;
+        clearTimeout(timer);
+        opts.signal?.removeEventListener("abort", onAbort);
+        if (err) reject(err);
+        else resolve(creds);
+      };
+      const timer = setTimeout(
+        () => finish(new TikTokError("LOGIN_FAILED", "Timed out waiting for QR scan")),
+        opts.timeoutMs ?? 5 * 6e4
+      );
+      const onAbort = () => finish(new TikTokError("LOGIN_ABORTED", "QR login aborted"));
+      opts.signal?.addEventListener("abort", onAbort);
+      const body = async (requestId) => {
+        const r = await tab.send("Network.getResponseBody", { requestId }).catch(() => null);
+        if (!r) return null;
+        try {
+          return JSON.parse(r.base64Encoded ? Buffer.from(r.body, "base64").toString() : r.body);
+        } catch {
+          return null;
+        }
+      };
+      const collectCookies = async () => {
+        for (let i = 0; i < 30 && !done; i++) {
+          const { cookies } = await tab.send(
+            "Network.getAllCookies"
+          );
+          const mine = cookies.filter((c) => c.domain.endsWith("tiktok.com"));
+          if (mine.some((c) => c.name === "sessionid" && c.value) && mine.some((c) => c.name === "ttwid")) {
+            const byName = /* @__PURE__ */ new Map();
+            for (const c of mine.sort(
+              (a, b) => (a.domain === ".tiktok.com" ? 1 : 0) - (b.domain === ".tiktok.com" ? 1 : 0)
+            )) {
+              byName.set(c.name, { name: c.name, value: c.value });
+            }
+            return finish(null, { cookies: [...byName.values()], userAgent });
+          }
+          await new Promise((r) => setTimeout(r, 1e3));
         }
-        const account = await (0, api_1.fetchAccount)(ctx);
-        if (!account)
-            throw new errors_1.TikTokError('SESSION_EXPIRED', 'TikTok cookie is no longer logged in');
-        ctx.ownId = account.uid;
-        ctx.deviceId = (await (0, api_1.fetchWebId)(ctx).catch(() => '')) || ctx.deviceId;
-        if (!ctx.deviceId)
-            throw new errors_1.TikTokError('BAD_RESPONSE', 'Could not get wid (device_id) — cookie missing ttwid?');
-        return new api_1.API(ctx, account);
-    }
-}
-exports.TikTok = TikTok;
-var api_2 = require("./api");
-Object.defineProperty(exports, "API", { enumerable: true, get: function () { return api_2.API; } });
-var constants_1 = require("./constants");
-Object.defineProperty(exports, "MessageType", { enumerable: true, get: function () { return constants_1.MessageType; } });
-var errors_2 = require("./errors");
-Object.defineProperty(exports, "TikTokError", { enumerable: true, get: function () { return errors_2.TikTokError; } });
-var listener_1 = require("./listener");
-Object.defineProperty(exports, "Listener", { enumerable: true, get: function () { return listener_1.Listener; } });
-Object.defineProperty(exports, "MANUAL_CLOSE", { enumerable: true, get: function () { return listener_1.MANUAL_CLOSE; } });
-var qr_login_1 = require("./qr-login");
-Object.defineProperty(exports, "loginQR", { enumerable: true, get: function () { return qr_login_1.loginQR; } });
+        finish(new TikTokError("LOGIN_FAILED", "Confirmed but no sessionid cookie found"));
+      };
+      tab.on((method, p) => {
+        if (done) return;
+        if (method === "Network.responseReceived") {
+          const res = p.response;
+          urlById.set(p.requestId, res.url);
+          return;
+        }
+        if (method !== "Network.loadingFinished") return;
+        const url = urlById.get(p.requestId) ?? "";
+        if (url.includes("/passport/web/get_qrcode/")) {
+          void body(p.requestId).then((j) => {
+            const qr = j?.data?.qrcode;
+            if (typeof qr === "string" && qr) {
+              opts.onEvent?.({
+                type: "qr",
+                image: `data:image/png;base64,${qr}`,
+                expiresAt: Number(j?.data?.expire_time ?? 0) * 1e3 || Date.now() + 6e4
+              });
+            }
+          });
+        } else if (url.includes("/passport/web/check_qrconnect/")) {
+          void body(p.requestId).then((j) => {
+            const status = String(j?.data?.status ?? "");
+            if (status === "scanned" && !scanned) {
+              scanned = true;
+              opts.onEvent?.({ type: "scanned" });
+            } else if (status === "confirmed") {
+              opts.onEvent?.({ type: "confirmed" });
+              void collectCookies();
+            } else if (status === "expired" && !scanned) {
+              if (refreshes++ >= maxRefresh)
+                finish(new TikTokError("LOGIN_FAILED", "QR expired without being scanned"));
+              else void tab.send("Page.reload");
+            }
+          });
+        }
+      });
+    });
+    await tab.send("Page.navigate", { url: `${WEB}/login/qrcode` });
+    return await result;
+  } finally {
+    cdp?.close();
+    proc.kill("SIGKILL");
+    await (0, import_promises2.rm)(dir, { recursive: true, force: true }).catch(() => void 0);
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  API,
+  Listener,
+  MANUAL_CLOSE,
+  MessageType,
+  TikTok,
+  TikTokError,
+  findChrome,
+  loginQR
+});
+//# sourceMappingURL=index.js.map