tca-js 0.4.0 → 0.5.0

package/dist/index.mjs

@@ -750,8 +750,9 @@ var API = class {
   getCookies() {
     return [...this.ctx.cookies].map(([name, value]) => ({ name, value }));
   }
+  /** Non-cookie session state to save alongside the cookies (pass back into `login`). */
   getContext() {
-    return { deviceId: this.ctx.deviceId, userAgent: this.ctx.userAgent };
+    return { deviceId: this.ctx.deviceId, userAgent: this.ctx.userAgent, ticketGuard: this.ctx.ticketGuard };
   }
   /** Whether the session is still alive — call periodically to detect expiry early. */
   async isAlive() {
@@ -881,6 +882,56 @@ var API = class {
   }
 };
 
+// src/protocol/ticket-guard.ts
+import { createPrivateKey, createPublicKey, sign } from "crypto";
+var SIGNED_PATHS = /* @__PURE__ */ new Set(["/v1/message/send"]);
+function ticketGuardHeaders(guard, path, now = Date.now()) {
+  const timestamp = Math.floor(now / 1e3);
+  const message = `ticket=${guard.ticket}&path=${path}&timestamp=${timestamp}`;
+  const reqSign = sign("sha256", Buffer.from(message), createPrivateKey(guard.privateKey)).toString("base64");
+  const clientData = { ts_sign: guard.tsSign, req_content: "ticket,path,timestamp", req_sign: reqSign, timestamp };
+  return {
+    "tt-ticket-guard-client-data": Buffer.from(JSON.stringify(clientData)).toString("base64"),
+    "tt-ticket-guard-public-key": publicPoint(guard.publicKey),
+    "tt-ticket-guard-version": "2",
+    "tt-ticket-guard-web-version": "1",
+    "tt-ticket-guard-iteration-version": "0"
+  };
+}
+function publicPoint(pem) {
+  const jwk = createPublicKey(pem).export({ format: "jwk" });
+  return Buffer.concat([
+    Buffer.from([4]),
+    Buffer.from(jwk.x ?? "", "base64url"),
+    Buffer.from(jwk.y ?? "", "base64url")
+  ]).toString("base64");
+}
+var READ_TICKET_GUARD_JS = `(async () => {
+  try {
+    const db = await new Promise((ok, ko) => { const r = indexedDB.open('secure-store'); r.onsuccess = () => ok(r.result); r.onerror = ko; });
+    if (!db.objectStoreNames.contains('cryptvalues')) return null;
+    const get = (k) => new Promise((ok) => { const q = db.transaction('cryptvalues').objectStore('cryptvalues').get(k); q.onsuccess = () => ok(q.result); q.onerror = () => ok(null); });
+    const keysRaw = await get('security-sdk/s_sdk_crypt_sdk');
+    const signRaw = await get('security-sdk/s_sdk_sign_data_key/tt_fetch');
+    if (!keysRaw || !signRaw) return null;
+    const keys = JSON.parse(JSON.parse(keysRaw).data);
+    const signData = JSON.parse(JSON.parse(signRaw).data);
+    if (!keys.ec_privateKey || !keys.ec_publicKey || !signData.ts_sign || !signData.encrypt_ticket) return null;
+    const te = new TextEncoder();
+    const base = await crypto.subtle.importKey('raw', te.encode('tt-ticket-guard-iv'), 'PBKDF2', false, ['deriveKey']);
+    const aes = await crypto.subtle.deriveKey({ name: 'PBKDF2', salt: te.encode('secure-salt'), iterations: 1000, hash: 'SHA-256' }, base, { name: 'AES-GCM', length: 128 }, false, ['decrypt']);
+    const enc = Uint8Array.from(atob(signData.encrypt_ticket), (c) => c.charCodeAt(0));
+    const ticket = new TextDecoder().decode(await crypto.subtle.decrypt({ name: 'AES-GCM', iv: enc.slice(0, 12) }, aes, enc.slice(12)));
+    return { privateKey: keys.ec_privateKey, publicKey: keys.ec_publicKey, tsSign: signData.ts_sign, ticket };
+  } catch (e) {
+    return null;
+  }
+})()`;
+function isTicketGuard(v) {
+  const g = v;
+  return !!g && typeof g.privateKey === "string" && typeof g.publicKey === "string" && typeof g.tsSign === "string" && typeof g.ticket === "string" && g.ticket.length > 0;
+}
+
 // src/protocol/context.ts
 function normalizeCookies(input) {
   const jar = /* @__PURE__ */ new Map();
@@ -902,6 +953,7 @@ var Context = class {
     this.cookies = normalizeCookies(creds.cookies);
     this.deviceId = creds.deviceId ?? "";
     this.userAgent = creds.userAgent || DEFAULT_USER_AGENT;
+    if (isTicketGuard(creds.ticketGuard)) this.ticketGuard = creds.ticketGuard;
   }
   options;
   cookies;
@@ -911,6 +963,8 @@ var Context = class {
    */
   deviceId;
   userAgent;
+  /** Signing material for `SIGNED_PATHS` — absent for sessions saved before 0.5.0 (sends then go unsigned). */
+  ticketGuard;
   ownId = "";
   seq = 1e4;
   cookieHeader() {
@@ -956,17 +1010,24 @@ var Context = class {
   }
   /**
    * Call an IM command over HTTP. Returns the unwrapped body (`ResponseBody[cmd]`).
-   * NO X-Gnarly/X-Bogus/msToken signature needed — the IM server only checks cookies (tested 09/11/2026).
+   * NO X-Gnarly/X-Bogus/msToken signature needed. `message/send` additionally needs the ticket-guard headers
+   * (enforced 12/11/2026) — added from `ticketGuard` when present.
    */
   async im(path, cmd, body, bodyField = cmd) {
     const url = `${IM_API}${path}?aid=${AID_WEB}&version_code=1.0.0&app_name=tiktok_web&device_platform=web_pc`;
     const res = await this.fetch(url, {
       method: "POST",
-      headers: { "Content-Type": "application/x-protobuf", Accept: "application/x-protobuf" },
+      headers: {
+        "Content-Type": "application/x-protobuf",
+        Accept: "application/x-protobuf",
+        ...this.ticketGuard && SIGNED_PATHS.has(path) ? ticketGuardHeaders(this.ticketGuard, path) : {}
+      },
       body: new Uint8Array(this.buildRequest(cmd, bodyField, body))
     });
     if (!res.ok) throw new TikTokError("HTTP_ERROR", `${path}: HTTP ${res.status}`, res.status);
-    const resp = Msg.tryParse(Buffer.from(await res.arrayBuffer()));
+    const raw = Buffer.from(await res.arrayBuffer());
+    if (/json/i.test(res.headers.get("content-type") ?? "")) throw gatewayError(path, raw);
+    const resp = Msg.tryParse(raw);
     if (!resp) throw new TikTokError("BAD_RESPONSE", `${path}: response is not protobuf`);
     const status = resp.num(Resp.status);
     if (status !== 0) {
@@ -977,6 +1038,19 @@ var Context = class {
     return resp.msg(Resp.body)?.msg(cmd) ?? resp.msg(Resp.body)?.msg(bodyField) ?? Msg.parse(Buffer.alloc(0));
   }
 };
+function gatewayError(path, raw) {
+  let status;
+  try {
+    status = JSON.parse(raw.toString("utf8")).status_code;
+  } catch {
+  }
+  if (status === 7) return new TikTokError("SESSION_BLOCKED", `${path}: gateway status_code 7 \u2014 session blocked`, 7);
+  return new TikTokError(
+    "BAD_RESPONSE",
+    `${path}: gateway JSON status_code ${String(status)}`,
+    typeof status === "number" ? status : void 0
+  );
+}
 
 // src/client.ts
 var TikTok = class {
@@ -1184,6 +1258,28 @@ async function loginQR(opts) {
           return null;
         }
       };
+      const readTicketGuard = async () => {
+        const read = async () => {
+          const r = await tab.send("Runtime.evaluate", {
+            expression: READ_TICKET_GUARD_JS,
+            awaitPromise: true,
+            returnByValue: true
+          }).catch(() => null);
+          return isTicketGuard(r?.result?.value) ? r.result.value : void 0;
+        };
+        for (let i = 0; i < 8 && !done; i++) {
+          const g = await read();
+          if (g) return g;
+          await new Promise((r) => setTimeout(r, 1e3));
+        }
+        await tab.send("Page.navigate", { url: `${WEB}/messages` }).catch(() => void 0);
+        for (let i = 0; i < 20 && !done; i++) {
+          await new Promise((r) => setTimeout(r, 1e3));
+          const g = await read();
+          if (g) return g;
+        }
+        return void 0;
+      };
       const collectCookies = async () => {
         for (let i = 0; i < 30 && !done; i++) {
           const { cookies } = await tab.send(
@@ -1197,7 +1293,8 @@ async function loginQR(opts) {
             )) {
               byName.set(c.name, { name: c.name, value: c.value });
             }
-            return finish(null, { cookies: [...byName.values()], userAgent });
+            const ticketGuard = await readTicketGuard();
+            return finish(null, { cookies: [...byName.values()], userAgent, ...ticketGuard ? { ticketGuard } : {} });
           }
           await new Promise((r) => setTimeout(r, 1e3));
         }