avios-cli 0.4.1__tar.gz → 0.4.3__tar.gz

{avios_cli-0.4.1 → avios_cli-0.4.3}/CHANGELOG.md

@@ -6,6 +6,29 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.4.3] - 2026-07-27
+
+### Changed
+- **`uvx avios-cli login` now works with no extra flags.** Browser-assisted login
+  (Playwright + browser-cookie3) moved from the optional `[login]` extra into the
+  base package, so `uvx avios-cli login iberia` just works — no more
+  `uvx --from 'avios-cli[login]' …`. The `login` extra is kept as a no-op alias
+  for backward compatibility.
+- If you have no system Chrome, `avios login` now **downloads Playwright's Chromium
+  automatically** on first use (~150 MB, one-time) instead of failing with an
+  install hint.
+
+## [0.4.2] - 2026-07-27
+
+### Fixed
+- **BA reward-flight searches failed with 403 after a successful login.** The
+  flight finder has a separate Auth0 session and rejects plain HTTP or automated
+  headless requests at Akamai. BA login now waits for the second reward-flight
+  prompt, and searches drive the site's own form in a background Chrome window
+  before parsing the returned RSC availability.
+- Stored Akamai cookies are no longer replayed over Chrome's fresher browser jar,
+  and a transient Next.js shell response is retried once.
+
 ## [0.4.1] - 2026-07-27
 
 ### Fixed
@@ -187,7 +210,9 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - Reward-flight **availability** search is not yet implemented (needs a British
   Airways capture).
 
-[Unreleased]: https://github.com/alexechoi/avios-cli/compare/v0.4.1...HEAD
+[Unreleased]: https://github.com/alexechoi/avios-cli/compare/v0.4.3...HEAD
+[0.4.3]: https://github.com/alexechoi/avios-cli/compare/v0.4.2...v0.4.3
+[0.4.2]: https://github.com/alexechoi/avios-cli/compare/v0.4.1...v0.4.2
 [0.4.1]: https://github.com/alexechoi/avios-cli/compare/v0.4.0...v0.4.1
 [0.4.0]: https://github.com/alexechoi/avios-cli/compare/v0.3.0...v0.4.0
 [0.3.0]: https://github.com/alexechoi/avios-cli/compare/v0.2.1...v0.3.0

{avios_cli-0.4.1 → avios_cli-0.4.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: avios-cli
-Version: 0.4.1
+Version: 0.4.3
 Summary: A CLI and TUI for Avios balances, transactions, and BA reward-flight availability.
 Project-URL: Homepage, https://github.com/alexechoi/avios-cli
 Project-URL: Repository, https://github.com/alexechoi/avios-cli
@@ -21,7 +21,9 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Utilities
 Requires-Python: >=3.10
+Requires-Dist: browser-cookie3>=0.19
 Requires-Dist: httpx>=0.27
+Requires-Dist: playwright>=1.44
 Requires-Dist: pydantic-settings>=2.3
 Requires-Dist: pydantic>=2.7
 Requires-Dist: pyyaml>=6.0
@@ -29,8 +31,6 @@ Requires-Dist: rich>=13.7
 Requires-Dist: textual>=0.80
 Requires-Dist: typer>=0.12
 Provides-Extra: login
-Requires-Dist: browser-cookie3>=0.19; extra == 'login'
-Requires-Dist: playwright>=1.44; extra == 'login'
 Description-Content-Type: text/markdown
 
 # avios-cli
@@ -86,22 +86,26 @@ uv run avios --help
 avios.com has no credential API — login is Auth0 Universal Login behind hCaptcha and
 SMS/passkey MFA — so `avios login` opens a real browser, **waits while you finish
 logging in** (password, captcha, SMS code), and captures the session once you land
-on the dashboard. It needs the **`login` extra**:
+on the dashboard:
 
 ```bash
-uvx --from 'avios-cli[login]' avios login
-uvx --from 'avios-cli[login]' avios login finnair
+uvx avios-cli login
+uvx avios-cli login iberia
+uvx avios-cli login finnair
 ```
 
-It launches your installed **Google Chrome** (no extra download). If you don't have
-Chrome, install Playwright's browser once with
-`uvx --from playwright playwright install chromium`.
+It launches your installed **Google Chrome** (no download). If you don't have
+Chrome, it fetches Playwright's Chromium automatically on first login (~150 MB,
+one-time). No extra flags — browser support ships in the package.
+
+> Tip: if you'll use it often, `uv tool install avios-cli` once, then just run
+> `avios login`, `avios balance`, etc. directly.
 
 Prefer not to open a browser? Import the cookie from a Chrome you're already logged
 into avios.com with:
 
 ```bash
-uvx --from 'avios-cli[login]' avios login --from-browser
+uvx avios-cli login --from-browser
 ```
 
 This scans **all your Chrome profiles** and uses whichever one is actually logged
@@ -109,16 +113,12 @@ into avios.com (it tells you which). If you have several profiles, you can targe
 one directly:
 
 ```bash
-uvx --from 'avios-cli[login]' avios login --from-browser --profile "Profile 1"
+uvx avios-cli login --from-browser --profile "Profile 1"
 ```
 
-Plain `uvx avios-cli login` won't work — the isolated environment doesn't include
-the `login` extra.
-
 **Stuck in an endless captcha loop?** That's bot detection on the automated
 browser. Use `--from-browser` instead: log into avios.com in your normal Chrome
-(you'll get one normal captcha), then run
-`uvx --from 'avios-cli[login]' avios login --from-browser`.
+(you'll get one normal captcha), then run `uvx avios-cli login --from-browser`.
 
 Finnair uses a different CAS/OAuth flow. `avios login finnair` opens the Finnair Plus
 balance page, lets you complete password and MFA in the real browser, and captures the
@@ -128,8 +128,12 @@ for Finnair because browser-cookie import cannot read that token.
 Each programme session is stored at `~/.config/avios/accounts/<programme>.json`
 (mode `600`). Sessions expire; just log in to that programme again. Use
 `avios logout <programme>` for one account or `avios logout` for all accounts.
-For BA, browser-assisted login also opens the reward-flight finder briefly so its
-separate `spend-avios` session is captured.
+For BA, browser-assisted login also opens the separate reward-flight application.
+British Airways may show a second login prompt; keep the browser open until the
+CLI confirms success. Reward searches drive the site's own form in a background
+Chrome window because the flight-search route rejects plain HTTP and automated
+headless requests, so the `login` extra remains required when running
+`avios flights` or the Reward Flights TUI tab.
 
 ## Usage
 

{avios_cli-0.4.1 → avios_cli-0.4.3}/README.md

@@ -51,22 +51,26 @@ uv run avios --help
 avios.com has no credential API — login is Auth0 Universal Login behind hCaptcha and
 SMS/passkey MFA — so `avios login` opens a real browser, **waits while you finish
 logging in** (password, captcha, SMS code), and captures the session once you land
-on the dashboard. It needs the **`login` extra**:
+on the dashboard:
 
 ```bash
-uvx --from 'avios-cli[login]' avios login
-uvx --from 'avios-cli[login]' avios login finnair
+uvx avios-cli login
+uvx avios-cli login iberia
+uvx avios-cli login finnair
 ```
 
-It launches your installed **Google Chrome** (no extra download). If you don't have
-Chrome, install Playwright's browser once with
-`uvx --from playwright playwright install chromium`.
+It launches your installed **Google Chrome** (no download). If you don't have
+Chrome, it fetches Playwright's Chromium automatically on first login (~150 MB,
+one-time). No extra flags — browser support ships in the package.
+
+> Tip: if you'll use it often, `uv tool install avios-cli` once, then just run
+> `avios login`, `avios balance`, etc. directly.
 
 Prefer not to open a browser? Import the cookie from a Chrome you're already logged
 into avios.com with:
 
 ```bash
-uvx --from 'avios-cli[login]' avios login --from-browser
+uvx avios-cli login --from-browser
 ```
 
 This scans **all your Chrome profiles** and uses whichever one is actually logged
@@ -74,16 +78,12 @@ into avios.com (it tells you which). If you have several profiles, you can targe
 one directly:
 
 ```bash
-uvx --from 'avios-cli[login]' avios login --from-browser --profile "Profile 1"
+uvx avios-cli login --from-browser --profile "Profile 1"
 ```
 
-Plain `uvx avios-cli login` won't work — the isolated environment doesn't include
-the `login` extra.
-
 **Stuck in an endless captcha loop?** That's bot detection on the automated
 browser. Use `--from-browser` instead: log into avios.com in your normal Chrome
-(you'll get one normal captcha), then run
-`uvx --from 'avios-cli[login]' avios login --from-browser`.
+(you'll get one normal captcha), then run `uvx avios-cli login --from-browser`.
 
 Finnair uses a different CAS/OAuth flow. `avios login finnair` opens the Finnair Plus
 balance page, lets you complete password and MFA in the real browser, and captures the
@@ -93,8 +93,12 @@ for Finnair because browser-cookie import cannot read that token.
 Each programme session is stored at `~/.config/avios/accounts/<programme>.json`
 (mode `600`). Sessions expire; just log in to that programme again. Use
 `avios logout <programme>` for one account or `avios logout` for all accounts.
-For BA, browser-assisted login also opens the reward-flight finder briefly so its
-separate `spend-avios` session is captured.
+For BA, browser-assisted login also opens the separate reward-flight application.
+British Airways may show a second login prompt; keep the browser open until the
+CLI confirms success. Reward searches drive the site's own form in a background
+Chrome window because the flight-search route rejects plain HTTP and automated
+headless requests, so the `login` extra remains required when running
+`avios flights` or the Reward Flights TUI tab.
 
 ## Usage
 

{avios_cli-0.4.1 → avios_cli-0.4.3}/SECURITY.md

@@ -11,8 +11,10 @@
 - `avios logout` deletes stored sessions. They also expire on the server side.
 - `AVIOS_COOKIE` may be set to supply a cookie via the environment instead of the
   stored file — avoid committing it or storing it in shell history.
-- Reward-flight search sends the same saved BA cookie only to `www.avios.com`.
-  The RSC response's short-lived action tokens are neither exposed nor persisted.
+- Reward-flight search launches the isolated BA Chrome profile in the background;
+  Chrome sends the saved application cookie only to `www.avios.com` and refreshes
+  its own anti-bot cookies. The RSC response's short-lived action tokens are
+  neither exposed nor persisted.
 
 ## Unofficial software
 

{avios_cli-0.4.1 → avios_cli-0.4.3}/pyproject.toml

@@ -33,16 +33,18 @@ dependencies = [
     "pydantic>=2.7",
     "pydantic-settings>=2.3",
     "pyyaml>=6.0",
-]
-
-[project.optional-dependencies]
-# Browser-assisted login. Kept optional so the core stays lightweight and the
-# heavy Playwright browser download is only pulled when a user needs to log in.
-login = [
+    # Browser-assisted login ships in the base package so `uvx avios-cli login`
+    # works with no extra flags. The Chromium *binary* is still fetched on demand
+    # (only if you have no system Chrome) — see avios.auth._install_chromium.
     "playwright>=1.44",
     "browser-cookie3>=0.19",
 ]
 
+[project.optional-dependencies]
+# Retained for backward compatibility: the login dependencies now ship in the
+# base package, so `avios-cli[login]` resolves to the same thing as `avios-cli`.
+login = []
+
 # Dev tooling lives in a PEP 735 dependency-group (not an extra) so that `uv sync`
 # and `uv run` install it by default — an extra would be pruned by `uv run`.
 [dependency-groups]

{avios_cli-0.4.1 → avios_cli-0.4.3}/src/avios/__init__.py

@@ -3,4 +3,4 @@
 View your Avios balance, transactions and reward-flight availability from the terminal.
 """
 
-__version__ = "0.4.1"
+__version__ = "0.4.3"

{avios_cli-0.4.1 → avios_cli-0.4.3}/src/avios/auth.py

@@ -5,12 +5,12 @@ hCaptcha, Akamai Bot Manager and SMS/passkey MFA, so there is no way to POST a
 username/password over HTTP and obtain a session. Instead we let a real browser
 handle the login once and capture the resulting session cookie.
 
-Two strategies, both requiring the optional ``login`` extra
-(``pip install "avios-cli[login]"``):
+Playwright and browser_cookie3 ship in the base package, so these work with a
+plain ``avios`` install (no extra flags). Two strategies:
 
 - :func:`login_via_browser` — open a Playwright browser, the user logs in
-  (password + captcha + MFA), and we grab the cookies. Also needs
-  ``playwright install chromium``.
+  (password + captcha + MFA), and we grab the cookies. The Chromium binary is
+  fetched on demand only if you have no system Chrome (see :func:`_install_chromium`).
 - :func:`import_from_browser` — read the avios.com cookie straight out of a
   running browser via ``browser_cookie3`` (no popup) if already logged in there.
 """
@@ -33,6 +33,7 @@ from avios.session import cookie_header_from
 LOGIN_TIMEOUT_MS = 300_000  # 5 minutes to complete password + captcha + MFA
 LOGIN_POLL_MS = 2_000  # how often to check whether the session is authenticated
 SUPPORTED_BROWSERS = ("chrome", "firefox", "edge", "brave", "safari", "chromium")
+BA_REWARD_SEARCH_PATH = "/en-GB/spend-avios/search-reward-flights"
 
 # Chromium-family user-data roots per browser (relative to home), used to discover
 # per-profile cookie databases (Default, "Profile 1", ...).
@@ -108,36 +109,67 @@ def login_via_browser(
     profile_dir = str(settings.config_dir / "chrome-profile" / programme.slug)
 
     with factory() as pw:
-        ctx = _open_login_context(pw, headless=headless, user_data_dir=profile_dir)
+        ctx = _open_login_context(
+            pw,
+            headless=headless,
+            user_data_dir=profile_dir,
+            user_agent=settings.user_agent,
+        )
         page = ctx.new_page()
         page.goto(programme.login_url)
         authed = _wait_for_auth(ctx, page, programme.base_url, timeout_ms)
+        reward_authed = True
         if authed and programme.slug == "ba":
-            _warm_ba_reward_search(page, programme.base_url)
+            reward_authed = _wait_for_ba_reward_auth(
+                ctx,
+                page,
+                programme.base_url,
+                timeout_ms,
+            )
         cookies = list(ctx.cookies())
         ctx.close()
 
     if not authed:
         raise LoginError("Timed out waiting for login. Run `avios login` again.")
+    if not reward_authed:
+        raise LoginError(
+            "British Airways account login succeeded, but reward-flight login did not. "
+            "Run `avios login ba` again, complete the second BA prompt, and keep the "
+            "browser open until this command confirms success."
+        )
     return _only_avios(cookies)
 
 
-def _warm_ba_reward_search(page: Any, base_url: str) -> None:
-    """Open BA's separate flight-search app so its session cookies are captured.
+def _has_ba_reward_session(ctx: Any) -> bool:
+    """Whether BA's separate reward-search application session is present."""
+    names = {
+        str(cookie.get("name", ""))
+        for cookie in ctx.cookies()
+        if "avios.com" in str(cookie.get("domain", ""))
+    }
+    return "__session" in names or any(name.startswith("appSession") for name in names)
 
-    Balance/profile authentication alone does not necessarily initialise the
-    ``spend-avios`` Next.js app. This best-effort navigation runs while the real
-    login browser is already open; failure does not invalidate account login.
-    """
+
+def _wait_for_ba_reward_auth(ctx: Any, page: Any, base_url: str, timeout_ms: int) -> bool:
+    """Open BA's reward app and wait for its separate Auth0 flow to complete."""
     try:
         page.goto(
-            f"{base_url}/en-GB/spend-avios/search-reward-flights",
+            f"{base_url}{BA_REWARD_SEARCH_PATH}",
             wait_until="domcontentloaded",
             timeout=60_000,
         )
-        page.wait_for_timeout(3_000)
     except Exception:
-        pass
+        return False
+
+    for _ in range(max(1, timeout_ms // LOGIN_POLL_MS)):
+        if _has_ba_reward_session(ctx) and page.url.startswith(
+            f"{base_url}{BA_REWARD_SEARCH_PATH}"
+        ):
+            with contextlib.suppress(Exception):
+                if "search reward flights" in page.title().lower():
+                    return True
+        page.wait_for_timeout(LOGIN_POLL_MS)
+    return False
 
 
 def _import_sync_playwright() -> Any:
@@ -145,11 +177,9 @@ def _import_sync_playwright() -> Any:
         from playwright.sync_api import sync_playwright
     except ImportError as exc:
         raise LoginError(
-            "Playwright isn't installed. Log in using the 'login' extra:\n"
-            "  uvx --from 'avios-cli[login]' avios login\n"
-            "  (first time only: uvx --from playwright playwright install chromium)\n"
-            "Or import the cookie from Chrome instead (no browser download):\n"
-            "  uvx --from 'avios-cli[login]' avios login --from-browser"
+            "Playwright isn't available in this environment. Reinstall avios-cli "
+            "(e.g. `uv tool install avios-cli`), or import the cookie from your "
+            "browser instead:\n  avios login --from-browser"
         ) from exc
     return sync_playwright
 
@@ -177,7 +207,14 @@ def _is_authenticated(ctx: Any, base_url: str) -> bool:
         return False
 
 
-def _open_login_context(pw: Any, *, headless: bool, user_data_dir: str) -> Any:
+def _open_login_context(
+    pw: Any,
+    *,
+    headless: bool,
+    user_data_dir: str,
+    user_agent: str | None = None,
+    background: bool = False,
+) -> Any:
     """Open a browser context for login, tuned to avoid the hCaptcha bot loop.
 
     hCaptcha/Akamai serve endless challenges to obviously-automated browsers, so:
@@ -189,30 +226,67 @@ def _open_login_context(pw: Any, *, headless: bool, user_data_dir: str) -> Any:
     """
     args = ["--disable-blink-features=AutomationControlled"]
     ignore_default_args = ["--enable-automation"]
+    launch_options: dict[str, Any] = {}
+    if background:
+        args.append("--window-position=-32000,-32000")
+        launch_options["viewport"] = {"width": 1280, "height": 900}
+    if headless and user_agent:
+        # Chrome's native headless networking can reach BA's login page, but its
+        # default ``HeadlessChrome`` UA is rejected. Keep the normal Chrome UA.
+        launch_options["user_agent"] = user_agent
+
+    def launch(**extra: Any) -> Any:
+        return pw.chromium.launch_persistent_context(
+            user_data_dir,
+            headless=headless,
+            args=args,
+            ignore_default_args=ignore_default_args,
+            **launch_options,
+            **extra,
+        )
+
+    # Prefer the user's real Chrome, then bundled Chromium.
     for extra in ({"channel": "chrome"}, {}):
         try:
-            return pw.chromium.launch_persistent_context(
-                user_data_dir,
-                headless=headless,
-                args=args,
-                ignore_default_args=ignore_default_args,
-                **extra,
-            )
+            return launch(**extra)
         except Exception:
             continue
+    # Neither is available (no system Chrome and no downloaded Chromium). Fetch
+    # the Chromium binary once, then retry the bundled browser.
+    if _install_chromium():
+        try:
+            return launch()
+        except Exception:
+            pass
     raise LoginError(
         "Couldn't launch a browser. Install Chromium once with:\n"
         "  uvx --from playwright playwright install chromium"
     )
 
 
+def _install_chromium() -> bool:
+    """Download Playwright's Chromium binary on demand. Returns True if it ran."""
+    import subprocess
+    import sys
+
+    print("No browser found — downloading Chromium (~150 MB, one-time)…", file=sys.stderr)
+    try:
+        subprocess.run(
+            [sys.executable, "-m", "playwright", "install", "chromium"],
+            check=True,
+        )
+        return True
+    except Exception:
+        return False
+
+
 def _bc3() -> Any:
     try:
         import browser_cookie3 as bc3
     except ImportError as exc:
         raise LoginError(
-            "browser-cookie3 isn't installed. Run with the 'login' extra:\n"
-            "  uvx --from 'avios-cli[login]' avios login --from-browser"
+            "browser-cookie3 isn't available in this environment. "
+            "Reinstall avios-cli (e.g. `uv tool install avios-cli`)."
         ) from exc
     return bc3
 

{avios_cli-0.4.1 → avios_cli-0.4.3}/src/avios/cli.py

@@ -179,9 +179,14 @@ def login(
             account = Account.from_programme(prog, cookies=result.cookies)
             saved_label = f"{result.count} cookie(s){where}"
         else:
+            ba_note = (
+                " British Airways may show a second login prompt for reward flights."
+                if prog.slug == "ba"
+                else ""
+            )
             console.print(
                 f"Opening a browser — log in to [bold]{prog.name}[/] (password, captcha, "
-                "SMS code). Keep the window open; it captures your session automatically."
+                f"SMS code).{ba_note} Keep the window open until this command confirms success."
             )
             cookies = login_via_browser(prog, headless=headless)
             account = Account.from_programme(prog, cookies=cookies)

{avios_cli-0.4.1 → avios_cli-0.4.3}/src/avios/rewards.py

@@ -89,6 +89,8 @@ class PassengerCounts(RewardModel):
     def infants_need_adults(self) -> PassengerCounts:
         if self.infants > self.adults:
             raise ValueError("infants cannot exceed adults")
+        if self.adults + self.young_adults + self.children + self.infants > 9:
+            raise ValueError("British Airways allows at most 9 travellers")
         return self
 
     def query_items(self) -> list[tuple[str, str]]:
@@ -354,6 +356,17 @@ def search_reward_calendar(session: Session, query: RewardSearchQuery) -> Reward
         "next-url": NEXT_URL,
         "referer": referer,
     }
+
+    if not session.has_custom_transport:
+        payload = _fetch_reward_rsc_via_browser(session, query)
+        try:
+            return parse_reward_rsc(payload, query)
+        except RewardSearchProtocolError:
+            # The Next.js router occasionally returns only its small shell during
+            # rapid consecutive searches. One fresh browser navigation recovers.
+            payload = _fetch_reward_rsc_via_browser(session, query)
+            return parse_reward_rsc(payload, query)
+
     try:
         payload = session.get_text(
             endpoints.REWARD_FLIGHT_RESULTS,
@@ -368,3 +381,150 @@ def search_reward_calendar(session: Session, query: RewardSearchQuery) -> Reward
             ) from exc
         raise
     return parse_reward_rsc(payload, query)
+
+
+def _playwright_cookies(session: Session) -> list[dict[str, Any]]:
+    """Return only app-session cookies safe to seed into the Chrome profile.
+
+    Akamai cookies are bound to browser state and are refreshed by Chrome. Replaying
+    stored ``_abck``/``bm_*`` values over the profile's current jar triggers a 403.
+    """
+    allowed = {
+        "name",
+        "value",
+        "domain",
+        "path",
+        "expires",
+        "httpOnly",
+        "secure",
+        "sameSite",
+        "partitionKey",
+    }
+    normalised: list[dict[str, Any]] = []
+    for stored in session.browser_cookies():
+        name = str(stored.get("name", ""))
+        if name != "__session" and not name.startswith("appSession"):
+            continue
+        cookie = {key: value for key, value in stored.items() if key in allowed}
+        if not cookie.get("name") or not cookie.get("value") or not cookie.get("domain"):
+            continue
+        cookie.setdefault("path", "/")
+        normalised.append(cookie)
+    return normalised
+
+
+def _fetch_reward_rsc_via_browser(
+    session: Session,
+    query: RewardSearchQuery,
+    *,
+    playwright_factory: Any = None,
+    search_driver: Any = None,
+) -> str:
+    """Drive BA's real search form and capture its RSC response through Chrome."""
+    from avios.auth import LoginError, _import_sync_playwright, _open_login_context
+
+    factory = playwright_factory or _import_sync_playwright()
+    driver = search_driver or _drive_reward_search
+    profile_dir = str(session.settings.config_dir / "chrome-profile" / "ba")
+
+    try:
+        with factory() as pw:
+            ctx = _open_login_context(
+                pw,
+                headless=False,
+                user_data_dir=profile_dir,
+                user_agent=session.settings.user_agent,
+                background=True,
+            )
+            try:
+                cookies = _playwright_cookies(session)
+                profile_cookie_names = {str(cookie.get("name", "")) for cookie in ctx.cookies()}
+                profile_has_reward_session = "__session" in profile_cookie_names or any(
+                    name.startswith("appSession") for name in profile_cookie_names
+                )
+                if cookies and not profile_has_reward_session:
+                    ctx.add_cookies(cookies)
+                page = ctx.new_page()
+                body = driver(page, session.base_url, query)
+            finally:
+                ctx.close()
+    except LoginError as exc:
+        raise RewardSearchAccessError(str(exc)) from exc
+    except RewardSearchAccessError:
+        raise
+    except Exception as exc:
+        raise RewardSearchAccessError(
+            "Chrome could not fetch British Airways reward flights. "
+            "Run `avios login ba` again, then retry."
+        ) from exc
+
+    if not isinstance(body, str):
+        raise RewardSearchProtocolError("Chrome returned a non-text reward-flight response")
+    return body
+
+
+def _select_airport(page: Any, field: str, code: str) -> None:
+    airport = page.locator(f'input[name="{field}"]')
+    if airport.input_value().rstrip().endswith(f"({code})"):
+        return
+    airport.fill(code)
+    page.get_by_test_id(f"{field}-{code}-airport-option").click(timeout=20_000)
+
+
+def _set_passengers(page: Any, passengers: PassengerCounts) -> None:
+    increments = {
+        "Adults": passengers.adults - 1,
+        "Young Adults": passengers.young_adults,
+        "Children": passengers.children,
+        "Infants": passengers.infants,
+    }
+    if not any(increments.values()):
+        return
+    selector = page.get_by_test_id("passenger number select")
+    selector.click()
+    for label, count in increments.items():
+        for _ in range(count):
+            page.get_by_test_id(f"{label}-plus").click()
+    selector.click()
+
+
+def _drive_reward_search(page: Any, base_url: str, query: RewardSearchQuery) -> str:
+    """Use the site's form so Next.js and Akamai generate valid request state."""
+    from avios.auth import BA_REWARD_SEARCH_PATH
+
+    landing = page.goto(
+        f"{base_url}{BA_REWARD_SEARCH_PATH}",
+        wait_until="domcontentloaded",
+        timeout=60_000,
+    )
+    if landing is not None and landing.status == 403:
+        raise RewardSearchAccessError(
+            "British Airways rejected the Chrome reward-search session. Run `avios login ba` again."
+        )
+    if "accounts.britishairways.com" in page.url:
+        raise RewardSearchAccessError(
+            "British Airways reward-flight login is incomplete. Run `avios login ba` "
+            "again and complete the second BA prompt."
+        )
+    page.wait_for_timeout(1_500)
+    page.get_by_role("tab", name="One Way").click()
+    _select_airport(page, "origin", query.origin)
+    _select_airport(page, "destination", query.destination)
+    _set_passengers(page, query.passengers)
+
+    with page.expect_response(
+        lambda response: (
+            endpoints.REWARD_FLIGHT_RESULTS in response.url and response.request.method == "GET"
+        ),
+        timeout=60_000,
+    ) as response_info:
+        page.get_by_role("button", name="Search", exact=True).click()
+    response = response_info.value
+    body = str(response.text())
+    if response.status in (401, 403):
+        raise RewardSearchAccessError(
+            "British Airways rejected the Chrome reward-search session. Run `avios login ba` again."
+        )
+    if response.status >= 400:
+        raise RewardSearchError(f"British Airways reward search returned HTTP {response.status}")
+    return body