@aixnn/aixautots 0.0.0-stage → 0.5.2

package/dist/chunk-PCYERBNZ.js

@@ -0,0 +1,1564 @@
+// src/core/i18n.ts
+var DICT = {
+  en: {
+    auth: "Authentication error",
+    timeout: "Operation timed out",
+    offline: "Device offline",
+    locked: "Device locked",
+    protocol: "Protocol error",
+    unknown: "Error"
+  },
+  zh: {
+    auth: "\u8BA4\u8BC1\u9519\u8BEF",
+    timeout: "\u64CD\u4F5C\u8D85\u65F6",
+    offline: "\u8BBE\u5907\u79BB\u7EBF",
+    locked: "\u8BBE\u5907\u5DF2\u9501\u5B9A",
+    protocol: "\u534F\u8BAE\u9519\u8BEF",
+    unknown: "\u9519\u8BEF"
+  }
+};
+var current = "en";
+function setLocale(l) {
+  if (l === "en" || l === "zh") current = l;
+}
+function getLocale() {
+  return current;
+}
+function t(code) {
+  return DICT[current][code] ?? DICT.en[code];
+}
+
+// src/core/errors.ts
+var AixError = class extends Error {
+  constructor(message, code = "unknown", opts) {
+    super(code === "unknown" ? message : `${t(code)}: ${message}`);
+    this.name = new.target.name;
+    this.code = code;
+    this.status = opts?.status;
+    this.detail = opts?.detail;
+  }
+};
+var AixAuthError = class extends AixError {
+  constructor(m) {
+    super(m, "auth");
+  }
+};
+var AixTimeout = class extends AixError {
+  constructor(m) {
+    super(m, "timeout");
+  }
+};
+var AixDeviceOffline = class extends AixError {
+  constructor(m) {
+    super(m, "offline");
+  }
+};
+var AixLocked = class extends AixError {
+  constructor(m) {
+    super(m, "locked");
+  }
+};
+var AixProtocolError = class extends AixError {
+  constructor(m) {
+    super(m, "protocol");
+  }
+};
+function errorFromRet(error) {
+  if (error === "no node" || error.includes("offline") || error.includes("no-node")) return new AixDeviceOffline(error);
+  if (error.includes("timed out") || error.includes("timeout")) return new AixTimeout(error);
+  return new AixError(error);
+}
+
+// src/core/protocol.ts
+function parseIncoming(text) {
+  let v;
+  try {
+    v = JSON.parse(text);
+  } catch (e) {
+    throw new AixProtocolError(`bad json frame: ${String(e)}`);
+  }
+  if (typeof v !== "object" || v === null) throw new AixProtocolError("frame must be an object");
+  const o = v;
+  const hasT = typeof o.t === "string";
+  const hasExec = typeof o.run_id === "string" && o.event !== void 0;
+  if (!hasT && !hasExec) throw new AixProtocolError("frame missing string `t`");
+  return v;
+}
+function isRetFrame(f) {
+  return f.t === "ret";
+}
+function isFridaEventFrame(f) {
+  return f.t === "frida_event";
+}
+function isScriptletEventFrame(f) {
+  return f.t === "scriptlet_event";
+}
+function isStatusFrame(f) {
+  return f.t === "status";
+}
+function isExecutionFrame(f) {
+  const e = f.event;
+  return typeof f.run_id === "string" && typeof f.device_id === "string" && typeof e === "object" && e !== null && typeof e.kind === "string";
+}
+function isEnvEventFrame(f) {
+  if (typeof f !== "object" || f === null) return false;
+  const k = f.kind;
+  return k === "started" || k === "step" || k === "log" || k === "finished";
+}
+
+// src/core/resources/auth-provider.ts
+var PROJECT_KEY_HEADER = "X-Project-Key";
+var PROJECT_SECRET_HEADER = "X-Project-Secret";
+function find(creds, kind) {
+  return creds.find((c) => c.kind === kind);
+}
+function buildAuthProvider(input) {
+  const creds = Array.isArray(input) ? input : [input];
+  return {
+    async headers(scope) {
+      if (scope === "public") return {};
+      if (scope === "caller") {
+        const project = find(creds, "project");
+        if (project) {
+          return { [PROJECT_KEY_HEADER]: project.key, [PROJECT_SECRET_HEADER]: project.secret };
+        }
+        const user = find(creds, "user");
+        if (user) return { Authorization: `Bearer ${await user.getToken()}` };
+        throw new AixAuthError("caller scope requires a project or user credential");
+      }
+      const dev = find(creds, "developer");
+      if (dev) return { Authorization: `Bearer ${await dev.getToken()}` };
+      throw new AixAuthError(`${scope} scope requires a developer credential`);
+    },
+    async callerBearer() {
+      const user = find(creds, "user");
+      if (user) return user.getToken();
+      return null;
+    }
+  };
+}
+function jwtExpMs(token) {
+  const seg = token.split(".")[1];
+  if (!seg) return null;
+  try {
+    const b64 = seg.replace(/-/g, "+").replace(/_/g, "/");
+    const json = typeof atob === "function" ? atob(b64) : globalThis.Buffer?.from(b64, "base64")?.toString("binary");
+    if (!json) return null;
+    const exp = JSON.parse(json).exp;
+    return typeof exp === "number" ? exp * 1e3 : null;
+  } catch {
+    return null;
+  }
+}
+function createCachedUserCredential(opts) {
+  const skew = opts.refreshSkewMs ?? 6e4;
+  const fallbackTtl = opts.fallbackTtlMs ?? 6e5;
+  const now = opts.now ?? (() => Date.now());
+  let token = null;
+  let expiresAt = 0;
+  let inflight = null;
+  const refresh = async () => {
+    const r = await opts.mint();
+    const t2 = typeof r === "string" ? r : r.token;
+    const expiresIn = typeof r === "string" ? void 0 : r.expiresIn;
+    expiresAt = expiresIn != null ? now() + expiresIn * 1e3 : jwtExpMs(t2) ?? now() + fallbackTtl;
+    token = t2;
+    return t2;
+  };
+  return {
+    kind: "user",
+    getToken: () => {
+      if (token && now() < expiresAt - skew) return token;
+      if (!inflight) inflight = refresh().finally(() => {
+        inflight = null;
+      });
+      return inflight;
+    }
+  };
+}
+
+// src/core/config.ts
+function joinUrl(base, path) {
+  return `${base.replace(/\/+$/, "")}/${path.replace(/^\/+/, "")}`;
+}
+function executionWsUrl(baseUrl, id) {
+  return joinUrl(baseUrl, `/ws/execution/${encodeURIComponent(id)}`).replace(/^http/, "ws");
+}
+async function executionStreamEventsAfter(cfg, id, after, limit = 100) {
+  const path = `/api/executions/${encodeURIComponent(id)}/events?after=${encodeURIComponent(String(after))}&limit=${encodeURIComponent(String(limit))}`;
+  const headers = await cfg.auth.headers("caller");
+  const resp = await cfg.fetchFn(joinUrl(cfg.baseUrl, path), { headers });
+  if (!resp.ok) {
+    const text = await resp.text().catch(() => "");
+    if (resp.status === 401 || resp.status === 403) throw new AixAuthError(`execution events ${resp.status}: ${text}`);
+    throw new AixError(`execution events ${resp.status}: ${text}`);
+  }
+  const result = await resp.json();
+  if (!Array.isArray(result.events)) throw new AixError("execution events response is missing events");
+  return result;
+}
+async function executionWsTicketUrl(cfg, id, after) {
+  const path = `/api/executions/${encodeURIComponent(id)}/ticket`;
+  const headers = { ...await cfg.auth.headers("caller"), "content-type": "application/json" };
+  let resp;
+  try {
+    resp = await cfg.fetchFn(joinUrl(cfg.baseUrl, path), { method: "POST", headers, body: "{}" });
+  } catch (error) {
+    if (error instanceof AixError) throw error;
+    throw new AixError(`execution ticket request failed: ${String(error)}`, "offline");
+  }
+  if (!resp.ok) {
+    const text = await resp.text().catch(() => "");
+    if (resp.status === 401 || resp.status === 403) throw new AixAuthError(`execution ticket ${resp.status}: ${text}`);
+    throw new AixError(`execution ticket ${resp.status}: ${text}`);
+  }
+  const ticket = await resp.json();
+  if (!ticket.ticket || !ticket.expires_at) throw new AixError("execution ticket response is missing ticket or expires_at");
+  const query = new URLSearchParams({ ticket: ticket.ticket });
+  if (after !== void 0) query.set("after", String(after));
+  return `${executionWsUrl(cfg.baseUrl, id)}?${query}`;
+}
+async function authHeader(getAuthToken) {
+  const tok = await getAuthToken();
+  return { Authorization: `Bearer ${tok}` };
+}
+function resolveConfig(cfg) {
+  const fetchFn = cfg.fetchFn ?? globalThis.fetch.bind(globalThis);
+  const wsFactory = cfg.wsFactory ?? ((url) => new globalThis.WebSocket(url));
+  const rtcFactory = cfg.rtcFactory ?? ((config) => {
+    const Ctor = globalThis.RTCPeerConnection;
+    if (!Ctor) throw new AixError("WebRTC unavailable: no RTCPeerConnection (inject cfg.rtcFactory)");
+    return new Ctor(config);
+  });
+  const creds = [];
+  if (cfg.auth) creds.push(...Array.isArray(cfg.auth) ? cfg.auth : [cfg.auth]);
+  if (cfg.getAuthToken && !creds.some((c) => c.kind === "user")) {
+    creds.push({ kind: "user", getToken: cfg.getAuthToken });
+  }
+  if (creds.length === 0) throw new AixError("AixConfig requires `auth` or `getAuthToken`");
+  const auth = buildAuthProvider(creds);
+  const getAuthToken = cfg.getAuthToken ?? (async () => {
+    const t2 = await auth.callerBearer();
+    if (t2 == null) throw new AixAuthError("no user bearer token configured (set auth.user or getAuthToken)");
+    return t2;
+  });
+  return { baseUrl: cfg.baseUrl, getAuthToken, auth, fetchFn, wsFactory, rtcFactory, localNode: cfg.localNode };
+}
+
+// src/core/transport.ts
+var ReconnectingSocket = class {
+  constructor(o) {
+    this.o = o;
+    this.ws = null;
+    this.closed = false;
+    this.attempt = 0;
+    this.reconnectTimer = null;
+    this.base = o.baseDelayMs ?? 500;
+    this.max = o.maxDelayMs ?? 1e4;
+  }
+  async start() {
+    await this.connect();
+  }
+  async connect() {
+    if (this.closed) return;
+    const url = await this.o.urlProvider();
+    const ws = this.o.wsFactory(url);
+    this.ws = ws;
+    ws.onopen = () => {
+      this.attempt = 0;
+      this.o.onOpen?.();
+    };
+    ws.onmessage = (ev) => {
+      if (typeof ev.data !== "string") return;
+      this.o.onMessage(ev.data);
+    };
+    ws.onerror = () => {
+    };
+    ws.onclose = () => {
+      this.ws = null;
+      this.o.onClose?.();
+      if (!this.closed) this.scheduleReconnect();
+    };
+  }
+  scheduleReconnect() {
+    const exp = Math.min(this.max, this.base * 2 ** this.attempt);
+    const jitter = exp * 0.25 * Math.random();
+    this.attempt++;
+    this.reconnectTimer = setTimeout(() => {
+      this.reconnectTimer = null;
+      void this.connect().catch(() => {
+        if (!this.closed) this.scheduleReconnect();
+      });
+    }, exp + jitter);
+  }
+  send(text) {
+    if (!this.ws) throw new Error("socket not connected");
+    this.ws.send(text);
+  }
+  isConnected() {
+    return this.ws !== null;
+  }
+  close() {
+    if (this.reconnectTimer !== null) {
+      clearTimeout(this.reconnectTimer);
+      this.reconnectTimer = null;
+    }
+    this.closed = true;
+    this.ws?.close();
+    this.ws = null;
+  }
+};
+
+// src/core/env-run.ts
+function envBody(action, input) {
+  const os = input.os ?? "mac";
+  const body = { os };
+  if (action === "setup" && input.route) body.route = input.route;
+  if (action === "teardown" && input.purge) body.purge = true;
+  return body;
+}
+var EnvRun = class _EnvRun {
+  constructor(reqId, stream, socket) {
+    this.reqId = reqId;
+    this.stream = stream;
+    this.socket = socket;
+    this.eventListeners = /* @__PURE__ */ new Set();
+    this.doneListeners = /* @__PURE__ */ new Set();
+    this.doneFired = false;
+    this.last = null;
+    this.cursor = 0;
+    this.pollTimer = null;
+    this.closed = false;
+    // `start()` opens the socket before callers can register listeners. Keep
+    // frames received in that small window so the first Started/Step events do
+    // not disappear and leave progress UIs stuck at 0%.
+    this.pendingEvents = [];
+  }
+  /** Trigger an env action on an owned node and start streaming its progress. */
+  static async start(cfg, nodeId, action, input = {}) {
+    const resolved = "fetchFn" in cfg ? cfg : resolveConfig(cfg);
+    const url = joinUrl(resolved.baseUrl, `/api/nodes/${encodeURIComponent(nodeId)}/env/${action}`);
+    const headers = { ...await resolved.auth.headers("caller"), "content-type": "application/json" };
+    const resp = await resolved.fetchFn(url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(envBody(action, input))
+    });
+    if (!resp.ok) {
+      const t2 = await resp.text().catch(() => "");
+      if (resp.status === 401 || resp.status === 403) throw new AixAuthError(`env ${action} ${resp.status}: ${t2}`);
+      throw new AixError(`env ${action} ${resp.status}: ${t2}`);
+    }
+    const data = await resp.json();
+    let run = null;
+    let cursor = 0;
+    let processing = Promise.resolve();
+    const applyFrame = (frame) => {
+      if (frame.run_id !== data.req_id) return;
+      if (typeof frame.cursor !== "number") {
+        run?.onMessage(JSON.stringify(frame.event));
+        return;
+      }
+      if (frame.cursor <= cursor) return;
+      cursor = frame.cursor;
+      run?.onMessage(JSON.stringify({ cursor: frame.cursor, ...frame.event }));
+    };
+    const fetchCatchup = async (after) => {
+      let nextAfter = after;
+      do {
+        const page = await executionStreamEventsAfter(resolved, data.req_id, nextAfter);
+        for (const event of page.events) applyFrame(event);
+        nextAfter = page.next_cursor ?? cursor;
+        if (!page.has_more) break;
+      } while (true);
+    };
+    const processFrame = async (frame) => {
+      if (frame.run_id !== data.req_id) return;
+      if (typeof frame.cursor !== "number") {
+        run?.onMessage(JSON.stringify(frame.event));
+        return;
+      }
+      if (frame.cursor <= cursor) return;
+      if (frame.cursor > cursor + 1) {
+        await fetchCatchup(cursor);
+      }
+      applyFrame(frame);
+    };
+    const socket = new ReconnectingSocket({
+      // Fetch a new one-time ticket after every stream reconnect and resume
+      // after the latest durable event cursor.
+      urlProvider: async () => executionWsTicketUrl(resolved, data.req_id, cursor),
+      wsFactory: resolved.wsFactory,
+      onMessage: (text) => {
+        let frame;
+        try {
+          frame = JSON.parse(text);
+        } catch {
+          return;
+        }
+        if (!frame.run_id || !frame.event) {
+          run?.onMessage(text);
+          return;
+        }
+        processing = processing.then(() => processFrame(frame)).catch(() => void 0);
+      }
+    });
+    run = new _EnvRun(data.req_id, data.stream ?? `/ws/execution/${data.req_id}`, socket);
+    const currentRun = run;
+    let failures = 0;
+    const poll = async () => {
+      if (currentRun.closed) return;
+      try {
+        await (processing = processing.catch(() => void 0).then(() => fetchCatchup(cursor)));
+        failures = 0;
+      } catch (error) {
+        if (++failures >= 3 && !currentRun.closed) {
+          currentRun.onMessage(JSON.stringify({
+            kind: "finished",
+            ok: false,
+            error: `Environment progress connection failed: ${String(error)}`,
+            hint: "The node may still be installing. Check its status before starting setup again."
+          }));
+        }
+      }
+      if (!currentRun.closed) currentRun.pollTimer = setTimeout(() => {
+        void poll();
+      }, 3e3);
+    };
+    currentRun.pollTimer = setTimeout(() => {
+      void poll();
+    }, 3e3);
+    try {
+      await socket.start();
+    } catch {
+    }
+    return run;
+  }
+  on(event, cb) {
+    if (event === "event") {
+      const fn2 = cb;
+      this.eventListeners.add(fn2);
+      if (this.pendingEvents.length > 0) {
+        const pending = this.pendingEvents;
+        this.pendingEvents = [];
+        for (const ev of pending) fn2(ev);
+      }
+      return () => this.eventListeners.delete(fn2);
+    }
+    const fn = cb;
+    this.doneListeners.add(fn);
+    if (this.doneFired && this.last) {
+      const f = this.last;
+      queueMicrotask(() => fn(f));
+    }
+    return () => this.doneListeners.delete(fn);
+  }
+  onMessage(text) {
+    let frame;
+    try {
+      frame = JSON.parse(text);
+    } catch {
+      return;
+    }
+    if (!isEnvEventFrame(frame)) return;
+    const cursor = frame.cursor;
+    if (typeof cursor === "number") {
+      if (cursor <= this.cursor) return;
+      this.cursor = cursor;
+    }
+    const ev = frame;
+    if (this.eventListeners.size === 0) this.pendingEvents.push(ev);
+    else for (const cb of this.eventListeners) cb(ev);
+    if (ev.kind === "finished" && !this.doneFired) {
+      this.doneFired = true;
+      this.last = ev;
+      for (const cb of this.doneListeners) cb(this.last);
+      this.close();
+    }
+  }
+  close() {
+    this.closed = true;
+    if (this.pollTimer !== null) {
+      clearTimeout(this.pollTimer);
+      this.pollTimer = null;
+    }
+    this.socket.close();
+  }
+};
+var ENV_OK_STATES = /* @__PURE__ */ new Set(["ok", "skipped", "present", "done"]);
+var ENV_BAD_STATES = /* @__PURE__ */ new Set(["failed", "error"]);
+function summarizeEnv(events) {
+  const meta = /* @__PURE__ */ new Map();
+  const steps = /* @__PURE__ */ new Map();
+  const logs = [];
+  let total = 0;
+  let finished = null;
+  for (const e of events) {
+    if (e.kind === "started") {
+      total = e.total;
+      e.steps.forEach((s, i) => {
+        meta.set(i, s);
+        const existing = steps.get(i);
+        steps.set(i, existing ? { ...existing, label: s.label } : {
+          index: i,
+          id: s.id,
+          label: s.label,
+          state: "pending",
+          pct: 0
+        });
+      });
+    } else if (e.kind === "step") {
+      const m = meta.get(e.index);
+      steps.set(e.index, {
+        index: e.index,
+        id: e.id,
+        label: m?.label ?? e.id,
+        state: e.state,
+        pct: e.pct,
+        detail: e.detail
+      });
+    } else if (e.kind === "log") {
+      logs.push(`${e.id}: ${e.line}`);
+    } else if (e.kind === "finished") {
+      finished = e;
+    }
+  }
+  const list = [...steps.values()].sort((a, b) => a.index - b.index);
+  const anyBad = list.some((s) => ENV_BAD_STATES.has(s.state));
+  const allGood = list.length > 0 && list.every((s) => ENV_OK_STATES.has(s.state));
+  const ready = finished ? finished.ok && !anyBad && (allGood || !!finished.result?.docker_socket) : false;
+  return { total: total || list.length, steps: list, logs, finished, ready, running: !finished && events.length > 0 };
+}
+function envBlocker(finished) {
+  if (finished && !finished.ok && finished.code === "WSL_UNAVAILABLE") return "wsl-missing";
+  return null;
+}
+function detectEnvOs() {
+  const ua = typeof navigator !== "undefined" && (navigator.userAgent || navigator.platform) || "";
+  if (/win/i.test(ua)) return "win";
+  if (/mac|darwin|iphone|ipad/i.test(ua)) return "mac";
+  return null;
+}
+async function runEnvToFinish(cfg, nodeId, action, input = {}) {
+  const run = await EnvRun.start(cfg, nodeId, action, input);
+  const events = [];
+  return new Promise((resolve) => {
+    run.on("event", (e) => events.push(e));
+    run.on("done", () => resolve(summarizeEnv(events)));
+  });
+}
+
+// src/core/resources/http.ts
+function buildQuery(query) {
+  if (!query) return "";
+  const parts = [];
+  for (const [k, v] of Object.entries(query)) {
+    if (v === void 0 || v === null) continue;
+    parts.push(`${encodeURIComponent(k)}=${encodeURIComponent(String(v))}`);
+  }
+  return parts.length ? `?${parts.join("&")}` : "";
+}
+var RestClient = class {
+  constructor(cfg) {
+    this.cfg = cfg;
+  }
+  async request(method, path, opts = {}) {
+    const scope = opts.scope ?? "caller";
+    const url = joinUrl(this.cfg.baseUrl, path) + buildQuery(opts.query);
+    const headers = {
+      Accept: "application/json",
+      ...await this.cfg.auth.headers(scope),
+      ...opts.headers ?? {}
+    };
+    let body;
+    if (opts.body !== void 0) {
+      body = typeof opts.body === "string" ? opts.body : JSON.stringify(opts.body);
+      if (!("Content-Type" in headers) && !("content-type" in headers)) {
+        headers["Content-Type"] = "application/json";
+      }
+    }
+    let resp;
+    try {
+      resp = await this.cfg.fetchFn(url, { method, headers, body });
+    } catch (e) {
+      if (e instanceof AixError) throw e;
+      throw new AixError(`${method} ${path} request failed: ${String(e)}`, "offline");
+    }
+    if (!resp.ok) {
+      const text = await resp.text().catch(() => "");
+      let detail;
+      try {
+        const j = JSON.parse(text);
+        const m = typeof j.message === "string" ? j.message : typeof j.error === "string" ? j.error : void 0;
+        detail = m || void 0;
+      } catch {
+      }
+      if (resp.status === 401 || resp.status === 403) throw new AixAuthError(`${method} ${path} ${resp.status}: ${text}`);
+      if (resp.status === 423) throw new AixLocked(`${method} ${path} 423: ${text}`);
+      throw new AixError(detail ?? `${method} ${path} ${resp.status}: ${text}`, "unknown", { status: resp.status, detail });
+    }
+    if (resp.status === 204) return void 0;
+    const ct = resp.headers.get?.("content-type") ?? "";
+    if (!ct.includes("application/json")) return await resp.text();
+    return await resp.json();
+  }
+  get(path, opts) {
+    return this.request("GET", path, opts);
+  }
+  post(path, body, opts) {
+    return this.request("POST", path, { ...opts, body });
+  }
+  put(path, body, opts) {
+    return this.request("PUT", path, { ...opts, body });
+  }
+  patch(path, body, opts) {
+    return this.request("PATCH", path, { ...opts, body });
+  }
+  del(path, opts) {
+    return this.request("DELETE", path, opts);
+  }
+};
+function restClient(cfg) {
+  return new RestClient(cfg);
+}
+
+// src/core/resources/auth.ts
+var AuthApi = class {
+  constructor(c) {
+    this.c = c;
+  }
+  login(email, password) {
+    return this.c.post("/api/auth/login", { email, password }, { scope: "public" });
+  }
+  register(email, password) {
+    return this.c.post("/api/auth/register", { email, password }, { scope: "public" });
+  }
+  sendCode(email) {
+    return this.c.post("/api/auth/send-code", { email }, { scope: "public" });
+  }
+  verifyCode(email, code) {
+    return this.c.post("/api/auth/verify-code", { email, code }, { scope: "public" });
+  }
+  setPassword(password) {
+    return this.c.post("/api/auth/set-password", { password }, { scope: "developer" });
+  }
+  /** Exchange the developer bearer for a project-scoped user token. */
+  projectUser(projectId) {
+    return this.c.post("/api/auth/project-user", { project_id: projectId }, { scope: "developer" });
+  }
+};
+
+// src/core/resources/projects.ts
+var ProjectsApi = class {
+  constructor(c) {
+    this.c = c;
+  }
+  list() {
+    return this.c.get("/api/projects", { scope: "developer" });
+  }
+  create(input) {
+    return this.c.post("/api/projects", input, { scope: "developer" });
+  }
+  remove(id) {
+    return this.c.del(`/api/projects/${encodeURIComponent(id)}`, { scope: "developer" });
+  }
+  rotateSecret(id) {
+    return this.c.post(`/api/projects/${encodeURIComponent(id)}/rotate-secret`, void 0, { scope: "developer" });
+  }
+};
+
+// src/core/resources/users.ts
+var UsersApi = class {
+  constructor(c) {
+    this.c = c;
+  }
+  /** POST /api/users — provision (or reuse) a user and mint their token. */
+  provision(input) {
+    return this.c.post("/api/users", input, { scope: "caller" });
+  }
+};
+
+// src/core/resources/devices.ts
+var DevicesApi = class {
+  constructor(c) {
+    this.c = c;
+  }
+  list() {
+    return this.c.get("/api/devices");
+  }
+  /** Register/upsert a device (`POST /api/devices`). */
+  register(body) {
+    return this.c.post("/api/devices", body);
+  }
+  /** Provision a virtual device (`POST /api/devices/provision`). The spec is
+   *  opaque; `node_id` (optional) routes to a specific usable node. */
+  provision(spec) {
+    return this.c.post("/api/devices/provision", spec);
+  }
+  /** Brand→model identity catalog for the create-wizard's 品牌 → 机型 picker
+   *  (`GET /api/devices/profile-catalog`). Static read-only data; the chosen
+   *  `model` is passed back via `ProvisionSpec.model` to lock the fingerprint base. */
+  profileCatalog() {
+    return this.c.get("/api/devices/profile-catalog");
+  }
+  /** The single generic live-op entry point, proxied to the owning node. Any
+   *  node-supported op works here without a dedicated method; the typed helpers
+   *  below are thin wrappers over it. */
+  op(deviceId, op) {
+    return this.c.post(`/api/devices/${encodeURIComponent(deviceId)}/op`, op);
+  }
+  screenshot(deviceId) {
+    return this.op(deviceId, { op: "screenshot" });
+  }
+  captureUiTree(deviceId) {
+    return this.op(deviceId, { op: "capture_ui_tree" });
+  }
+  /** Power / lifecycle op (`POST /api/devices/:id/power`). Resolves with the
+   *  node's power JSON receipt (e.g. `{ rebooted: true }`, `{ stopped: true }`,
+   *  `{ device_id, reset: true }`) — the backend awaits the node response, so a
+   *  resolved promise means the op actually ran. Rejects (RestClient throws on
+   *  non-2xx) carry the node/backend error. */
+  power(deviceId, action, extra) {
+    return this.c.post(`/api/devices/${encodeURIComponent(deviceId)}/power`, { action, ...extra });
+  }
+  /** Typed device-control op via the power lane (install / inject / screen-record). */
+  control(deviceId, op) {
+    return this.power(deviceId, "control", { op });
+  }
+  installApkUrl(deviceId, url) {
+    return this.control(deviceId, { op: "install", payload: { source: { kind: "url", value: url } } });
+  }
+  /** Install an iOS App Store app by bundle id via the node's ipatool local
+   *  library (downloads on miss). `control` lane, fire-and-forget. */
+  installIosBundle(deviceId, bundleId) {
+    return this.control(deviceId, { op: "install", payload: { source: { kind: "ios_bundle", value: bundleId } } });
+  }
+  /** Search APKPure for installable apps (`GET /api/apps/search?q=`). */
+  searchApps(q) {
+    return this.c.get(`/api/apps/search?q=${encodeURIComponent(q)}`);
+  }
+  /** Install by APKPure package name; the backend resolves the download url and
+   *  the node downloads + installs (apk or xapk). `POST /api/devices/:id/install-app`. */
+  installByPackage(deviceId, pkg, version) {
+    return this.c.post(`/api/devices/${encodeURIComponent(deviceId)}/install-app`, { package: pkg, version });
+  }
+  /** Install an apk/xapk already uploaded to R2 (key from `filesUploadUrl`). */
+  installByKey(deviceId, key) {
+    return this.c.post(`/api/devices/${encodeURIComponent(deviceId)}/install-app`, { r2_key: key });
+  }
+  lease(deviceId) {
+    return this.c.post(`/api/devices/${encodeURIComponent(deviceId)}/lease`);
+  }
+  release(deviceId) {
+    return this.c.post(`/api/devices/${encodeURIComponent(deviceId)}/release`);
+  }
+  claim(deviceId) {
+    return this.c.post(`/api/devices/${encodeURIComponent(deviceId)}/claim`);
+  }
+  // ── 回收站 / 软删除（058） ──
+  /** 软删除（移入回收站）—`DELETE /api/devices/:id`。在线节点即时销毁容器，
+   *  离线节点标记 pending_destroy，待节点重连对账。3 天后自动彻底清除。 */
+  delete(deviceId) {
+    return this.c.del(`/api/devices/${encodeURIComponent(deviceId)}`);
+  }
+  /** 列回收站内的设备（`GET /api/devices/recycle`）。 */
+  recycle() {
+    return this.c.get("/api/devices/recycle");
+  }
+  /** 从回收站恢复（`POST /api/devices/:id/restore`）。容器已销毁的虚拟设备会按存储 spec 重建。 */
+  restore(deviceId) {
+    return this.c.post(`/api/devices/${encodeURIComponent(deviceId)}/restore`);
+  }
+  /** 彻底删除（`DELETE /api/devices/:id/purge`）。不可恢复。 */
+  purge(deviceId) {
+    return this.c.del(`/api/devices/${encodeURIComponent(deviceId)}/purge`);
+  }
+  /** 清空回收站（`DELETE /api/devices/recycle`）。彻底删除当前用户所有回收站设备。 */
+  purgeAll() {
+    return this.c.del("/api/devices/recycle");
+  }
+  /** Update mutable device fields — `PATCH /api/devices/:id`.
+   *  `ios_transport` switches an iOS device's live-mirror VIDEO source
+   *  (`replaykit` device-app WebRTC, default | `iosusbadapter` host screenshot
+   *  over usbmux, driven by go-ios); control is always host-mediated and
+   *  unaffected. (Legacy value `pymobiledevice3` was renamed to `iosusbadapter`.)
+   *  `sleep_timeout_min` sets the inactivity sleep timeout (0 = disabled). */
+  update(deviceId, patch) {
+    return this.c.patch(`/api/devices/${encodeURIComponent(deviceId)}`, patch);
+  }
+  /** Update only the device proxy and retain a typed patch receipt. */
+  updateProxy(deviceId, proxy) {
+    return this.c.patch(`/api/devices/${encodeURIComponent(deviceId)}`, { proxy });
+  }
+  /** Probe the device's configured proxy and report its egress IP/connectivity. */
+  probeProxy(deviceId) {
+    return this.c.post(`/api/devices/${encodeURIComponent(deviceId)}/proxy/probe`, {});
+  }
+  /** 休眠设备 (`POST /api/devices/:id/sleep`)。
+   *  虚拟机：截图 + 快照 + 停机（关计费）。真机：锁屏（best-effort）。 */
+  sleep(deviceId) {
+    return this.c.post(`/api/devices/${encodeURIComponent(deviceId)}/sleep`);
+  }
+  /** 唤醒设备 (`POST /api/devices/:id/wakeup`)。
+   *  虚拟机：恢复快照 + 重建计费。真机：发唤醒键（best-effort）。 */
+  wakeup(deviceId) {
+    return this.c.post(`/api/devices/${encodeURIComponent(deviceId)}/wakeup`);
+  }
+  // ── 设备指纹 (device fingerprint / device_profile) ──
+  /** Current fingerprint + curated editable subset + dropdown choices + apply
+   *  semantics (`GET /api/devices/:id/profile`). */
+  getProfile(deviceId) {
+    return this.c.get(`/api/devices/${encodeURIComponent(deviceId)}/profile`);
+  }
+  /** One-click regenerate the fingerprint (fresh identifiers). Optional
+   *  `model`/`android_version` constrain the catalog base. */
+  regenerateProfile(deviceId, opts = {}) {
+    return this.c.post(`/api/devices/${encodeURIComponent(deviceId)}/profile`, { regenerate: true, ...opts });
+  }
+  /** Apply curated edits onto the current fingerprint, keeping unique
+   *  identifiers (`POST /api/devices/:id/profile`). */
+  setProfileOverrides(deviceId, overrides) {
+    return this.c.post(`/api/devices/${encodeURIComponent(deviceId)}/profile`, { overrides });
+  }
+  /** Real-device only: set which apps the LSPosed spoof module disguises (and
+   *  force-stops on re-push for immediate effect). Persisted to `meta.spec.scope_pkgs`
+   *  and pushed live with the current fingerprint (`POST /api/devices/:id/profile`). */
+  setProfileScope(deviceId, scopePkgs) {
+    return this.c.post(`/api/devices/${encodeURIComponent(deviceId)}/profile`, { scope_pkgs: scopePkgs });
+  }
+  /** Real-device only: **start** the first-time install of the LSPosed identity
+   *  layer (+ spoof module) on a rooted device (`POST /api/devices/:id/anti-detect`,
+   *  `202`). The multi-reboot install (~minutes) runs in the background — poll
+   *  `getProfile().disguise_install_status` (`installing`→`installed`/`failed`).
+   *  After install, fingerprint edits push live via `setProfileOverrides`/`regenerateProfile`. */
+  installAntiDetect(deviceId) {
+    return this.c.post(`/api/devices/${encodeURIComponent(deviceId)}/anti-detect`, {});
+  }
+  /** Real-device only: toggle the disguise on/off WITHOUT uninstalling LSPosed (停用伪装).
+   *  `enabled:false` empties the on-device spoof config + relaunches scoped apps so they read
+   *  the genuine identity; `enabled:true` re-pushes the stored fingerprint. App-layer effect is
+   *  immediate; `resetprop` props (model/hardware) fully revert only on the next device reboot.
+   *  Requires the anti-detect layer installed (`POST /api/devices/:id/disguise`). */
+  setDisguiseEnabled(deviceId, enabled) {
+    return this.c.post(`/api/devices/${encodeURIComponent(deviceId)}/disguise`, { enabled });
+  }
+  // 文件传输（R2 临时中转）：字节直传 R2，控制面只过 presigned URL。
+  /** 申请直传 R2 的 presigned PUT；返回 `key` 供后续 `filesPush` 引用。 */
+  filesUploadUrl(deviceId, filename) {
+    return this.c.post(`/api/devices/${encodeURIComponent(deviceId)}/files/upload-url`, { filename });
+  }
+  /** 让节点从 R2 拉 `key`、adb push 到设备 `dest`；成功后后端删除 R2 对象。 */
+  filesPush(deviceId, key, dest) {
+    return this.c.post(`/api/devices/${encodeURIComponent(deviceId)}/files/push`, { key, dest });
+  }
+  /** 让节点 adb pull 设备 `src`、PUT 到 R2；返回 presigned GET 供客户端下载。 */
+  filesPull(deviceId, src, filename) {
+    return this.c.post(`/api/devices/${encodeURIComponent(deviceId)}/files/pull`, { src, filename });
+  }
+  // 设备会话（DataChannel 多路复用）：开一条通用点对点会话，字节/命令走 WebRTC
+  // 不经服务端。会话本身是通用的(文件管理 + 终端 + 传输都在一条 DC 上多路复用)，
+  // 故不再带 direction/dest/src —— 具体操作在 DataChannel 上以 `{id,t,...}` 驱动。
+  /** 开一条设备会话：让后端编排目标节点 join `/ws/signal`(节点 = offerer，建
+   *  "ctrl" DataChannel)，返回 `session_id`(SDK 据此 mint viewer token、作
+   *  answerer 建链、经 `ondatachannel` 拿到 "ctrl" 通道)。这是 DataChannel 多路
+   *  复用会话(通道 A)的握手入口;push/pull 失败时由上层回退到 R2 中转
+   *  (`filesUploadUrl` / `filesPush` / `filesPull`)。 */
+  dcSession(deviceId) {
+    return this.c.post(`/api/devices/${encodeURIComponent(deviceId)}/dc-session`, {});
+  }
+};
+
+// src/core/resources/nodes.ts
+var NodesApi = class {
+  constructor(c, cfg) {
+    this.c = c;
+    this.cfg = cfg;
+  }
+  list() {
+    return this.c.get("/api/nodes");
+  }
+  /** Register a node. Accepts a name or a full input ({ name, scope?, region? }). */
+  register(input) {
+    const body = typeof input === "string" ? { name: input } : input;
+    return this.c.post("/api/nodes", body);
+  }
+  /** Update name/scope/region of an owned node (`PATCH /api/nodes/:id`). */
+  update(nodeId, patch) {
+    return this.c.patch(`/api/nodes/${nodeId}`, patch);
+  }
+  /** Rotate the node token, returning a fresh one (`POST /api/nodes/:id/token`). */
+  rotateToken(nodeId) {
+    return this.c.post(`/api/nodes/${nodeId}/token`, {});
+  }
+  /** Delete (revoke) an owned node (`DELETE /api/nodes/:id`). */
+  remove(nodeId) {
+    return this.c.del(`/api/nodes/${nodeId}`);
+  }
+  /** Liveness/latency probe (`POST /api/nodes/:id/probe`). Round-trips a ping to
+   *  the node; `online:false` when unreachable. */
+  probe(nodeId) {
+    return this.c.post(`/api/nodes/${nodeId}/probe`, {});
+  }
+  /** Ask an owned node to restart itself (`POST /api/nodes/:id/restart`). */
+  restart(nodeId) {
+    return this.c.post(`/api/nodes/${nodeId}/restart`, {});
+  }
+  /** Persist the only remotely configurable runtime value. The node validates
+   * the native absolute path and returns a restart-required receipt. */
+  setDataRoot(nodeId, dataRoot) {
+    return this.c.post(`/api/nodes/${nodeId}/runtime/data-root`, { data_root: dataRoot });
+  }
+  /** Submit a durable node-owned agent task (`POST /api/agent-tasks`). */
+  submitAgentTask(input) {
+    return this.c.post("/api/agent-tasks", input);
+  }
+  /** Reload a durable AgentTask, including each target's current attempt. */
+  getAgentTask(taskId) {
+    return this.c.get(`/api/agent-tasks/${taskId}`);
+  }
+  /** Explicit read alias for callers that use CRUD-style naming. */
+  readAgentTask(taskId) {
+    return this.getAgentTask(taskId);
+  }
+  /** Stop one stable target without cancelling the other devices in its task. */
+  cancelAgentTaskTarget(taskId, targetId) {
+    return this.c.post(`/api/agent-tasks/${taskId}/targets/${targetId}/cancel`, {});
+  }
+  /** Create a new immutable attempt for a failed/cancelled target. */
+  retryAgentTaskTarget(taskId, targetId) {
+    return this.c.post(`/api/agent-tasks/${taskId}/targets/${targetId}/retry`, {});
+  }
+  /** Resolve the target's current approval gate. */
+  approveAgentTaskTarget(taskId, targetId) {
+    return this.c.post(`/api/agent-tasks/${taskId}/targets/${targetId}/approve`, {});
+  }
+  /** Fetch cursor-ordered events missed while the task stream was disconnected. */
+  agentTaskEvents(taskId, after) {
+    return this.c.get(`/api/agent-tasks/${taskId}/events`, { query: { after } });
+  }
+  /** Devices the node currently reports, with claim status (`POST /:id/devices/discover`). */
+  discoverDevices(nodeId) {
+    return this.c.post(`/api/nodes/${nodeId}/devices/discover`, {});
+  }
+  /** Enumerate adb mDNS services on a node (`POST /api/nodes/:id/adb/scan`). */
+  adbScan(nodeId) {
+    return this.c.post(`/api/nodes/${nodeId}/adb/scan`, {});
+  }
+  /** Pair a wireless device (`POST /api/nodes/:id/adb/pair`). */
+  adbPair(nodeId, addr, code) {
+    return this.c.post(`/api/nodes/${nodeId}/adb/pair`, { addr, code });
+  }
+  /** Connect an already-paired wireless device (`POST /api/nodes/:id/adb/connect`). */
+  adbConnect(nodeId, addr) {
+    return this.c.post(`/api/nodes/${nodeId}/adb/connect`, { addr });
+  }
+  // ── iOS wireless (real-device lane) — node-scoped control verbs ──
+  // iOS pairing is the on-device "Trust" dialog (no IP+code like Android adb):
+  // scan → pair (USB trust) → wifi (enable wireless lane) → reachable wirelessly.
+  /** List connected iOS devices + their usbmux lanes (`{op:'scan'}`). */
+  iosScan(nodeId) {
+    return this.c.post(`/api/nodes/${nodeId}/ios/control`, { op: "scan" });
+  }
+  /** Trigger the on-device Trust dialog for a udid (`{op:'pair'}`). */
+  iosPair(nodeId, udid) {
+    return this.c.post(`/api/nodes/${nodeId}/ios/control`, { op: "pair", udid });
+  }
+  /** Toggle wifi-connections for a trusted udid (`{op:'wifi'}`). */
+  iosWifi(nodeId, udid, enable) {
+    return this.c.post(`/api/nodes/${nodeId}/ios/control`, { op: "wifi", udid, enable });
+  }
+  // ── iOS App Store account + library ──
+  /** 节点 iOS App Store 账号状态(`{op:'account_info'}`)。 */
+  iosAccount(nodeId) {
+    return this.c.post(`/api/nodes/${nodeId}/ios/control`, { op: "account_info" });
+  }
+  /** 登录节点 iOS 账号;`needs_2fa` 时带 `auth_code` 重试(`{op:'account_login'}`)。 */
+  iosAccountLogin(nodeId, body) {
+    return this.c.post(`/api/nodes/${nodeId}/ios/control`, { op: "account_login", ...body });
+  }
+  iosAccountLogout(nodeId) {
+    return this.c.post(`/api/nodes/${nodeId}/ios/control`, { op: "account_logout" });
+  }
+  /** App Store 搜索(`{op:'store_search'}`)。 */
+  iosStoreSearch(nodeId, term, limit = 20) {
+    return this.c.post(`/api/nodes/${nodeId}/ios/control`, { op: "store_search", term, limit });
+  }
+  /** 下载入节点本地库(`{op:'download'}`)。 */
+  iosDownload(nodeId, bundleId, name) {
+    return this.c.post(`/api/nodes/${nodeId}/ios/control`, { op: "download", bundle_id: bundleId, name });
+  }
+  /** 节点本地 IPA 库(已下载,模版多选来源)(`{op:'apps'}`)。 */
+  iosApps(nodeId) {
+    return this.c.post(`/api/nodes/${nodeId}/ios/control`, { op: "apps" });
+  }
+  // ── env base (redroid host) — trigger + stream over the shared /ws/execution lane ──
+  /** Configure the redroid host base on an owned node, streaming progress.
+   *  `POST /api/nodes/:id/env/setup` → subscribe `/ws/execution/:req_id`. */
+  envSetup(nodeId, input = {}) {
+    return EnvRun.start(this.cfg, nodeId, "setup", input);
+  }
+  /** Probe the host base without changing it (`POST /api/nodes/:id/env/status`). */
+  envStatus(nodeId, input = {}) {
+    return EnvRun.start(this.cfg, nodeId, "status", input);
+  }
+  /** Stop (or `purge`) the host base (`POST /api/nodes/:id/env/teardown`). */
+  envTeardown(nodeId, input = {}) {
+    return EnvRun.start(this.cfg, nodeId, "teardown", input);
+  }
+};
+
+// src/core/resources/clusters.ts
+var ClustersApi = class {
+  constructor(c) {
+    this.c = c;
+  }
+  list() {
+    return this.c.get("/api/clusters");
+  }
+  create(input) {
+    return this.c.post("/api/clusters", {
+      name: input.name,
+      description: input.description ?? null,
+      device_ids: input.device_ids,
+      default_mode: input.default_mode ?? { type: "broadcast" }
+    });
+  }
+  remove(id) {
+    return this.c.del(`/api/clusters/${encodeURIComponent(id)}`);
+  }
+  setDevices(id, deviceIds) {
+    return this.c.patch(`/api/clusters/${encodeURIComponent(id)}/devices`, { device_ids: deviceIds });
+  }
+  run(id, flow) {
+    return this.c.post(`/api/clusters/${encodeURIComponent(id)}/run`, { flow });
+  }
+};
+
+// src/core/resources/scripts.ts
+var ScriptsApi = class {
+  constructor(c) {
+    this.c = c;
+  }
+  list() {
+    return this.c.get("/api/scripts");
+  }
+  get(id) {
+    return this.c.get(`/api/scripts/${encodeURIComponent(id)}`);
+  }
+  create(script) {
+    return this.c.post("/api/scripts", script);
+  }
+  update(id, script) {
+    return this.c.put(`/api/scripts/${encodeURIComponent(id)}`, script);
+  }
+  /** Create when `script.id` is unset, else update. Returns the saved entity so
+   *  callers can capture the server-assigned `id` on first create — otherwise a
+   *  new script's id is lost and every later autosave re-creates it. */
+  save(script) {
+    return script.id ? this.update(script.id, script) : this.create(script);
+  }
+  remove(id) {
+    return this.c.del(`/api/scripts/${encodeURIComponent(id)}`);
+  }
+  /** Change a script's visibility (`user` | `project` | `system`). */
+  setVisibility(id, visibility) {
+    return this.c.patch(`/api/scripts/${encodeURIComponent(id)}/visibility`, { visibility });
+  }
+  /** Manual: ask the text LLM for a title + description, written back to the script. */
+  generateMeta(id) {
+    return this.c.post(`/api/scripts/${encodeURIComponent(id)}/generate-meta`);
+  }
+  /** Manual: generate a cover/icon image, store it, and write back stable URLs. */
+  generateCover(id) {
+    return this.c.post(`/api/scripts/${encodeURIComponent(id)}/generate-cover`);
+  }
+  async duplicate(id) {
+    const src = await this.get(id);
+    return this.create({ ...src, id: void 0, name: `${src.name} copy` });
+  }
+};
+
+// src/core/resources/shortcuts.ts
+var ShortcutsApi = class {
+  constructor(c) {
+    this.c = c;
+  }
+  list(platform) {
+    const q = platform ? `?platform=${encodeURIComponent(platform)}` : "";
+    return this.c.get(`/api/shortcuts${q}`);
+  }
+  create(body) {
+    return this.c.post("/api/shortcuts", body);
+  }
+  update(id, body) {
+    return this.c.put(`/api/shortcuts/${encodeURIComponent(id)}`, body);
+  }
+  remove(id) {
+    return this.c.del(`/api/shortcuts/${encodeURIComponent(id)}`);
+  }
+};
+
+// src/core/resources/locators.ts
+var LocatorsApi = class {
+  constructor(c) {
+    this.c = c;
+  }
+  list() {
+    return this.c.get("/api/locators");
+  }
+  create(input) {
+    return this.c.post("/api/locators", input);
+  }
+  remove(id) {
+    return this.c.del(`/api/locators/${encodeURIComponent(id)}`);
+  }
+};
+
+// src/core/resources/fleet.ts
+var TERMINAL_RUN = /* @__PURE__ */ new Set(["done", "failed", "partial", "cancelled", "canceled"]);
+var TERMINAL_DEVICE = /* @__PURE__ */ new Set(["done", "failed", "cancelled", "canceled"]);
+function isFleetRunTerminal(detail) {
+  if (detail.status && TERMINAL_RUN.has(detail.status)) return true;
+  const devices = detail.devices ?? [];
+  return devices.length > 0 && devices.every((d) => TERMINAL_DEVICE.has(d.status));
+}
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+var FleetApi = class {
+  constructor(c) {
+    this.c = c;
+  }
+  start(body) {
+    return this.c.post("/api/fleet/runs", {
+      script: body.script,
+      mode: body.mode ?? "Broadcast",
+      device_ids: body.device_ids
+    });
+  }
+  get(runId) {
+    return this.c.get(`/api/fleet/runs/${encodeURIComponent(runId)}`);
+  }
+  /** Poll `get(runId)` until the run is terminal (see {@link isFleetRunTerminal})
+   *  or `timeoutMs` elapses. Always resolves with the latest `FleetRunDetail`
+   *  (never rejects on timeout); inspect `isFleetRunTerminal(detail)` to tell a
+   *  finished run from a polling-cap hit. Used to turn the fire-and-forget
+   *  `start()` into a real receipt for shortcut/copy runs. */
+  async waitForRun(runId, opts = {}) {
+    const timeoutMs = opts.timeoutMs ?? 3e4;
+    const intervalMs = opts.intervalMs ?? 800;
+    const deadline = Date.now() + timeoutMs;
+    let detail = await this.get(runId);
+    while (!isFleetRunTerminal(detail) && Date.now() < deadline) {
+      await sleep(intervalMs);
+      detail = await this.get(runId);
+    }
+    return detail;
+  }
+  cancel(runId) {
+    return this.c.post(`/api/fleet/runs/${encodeURIComponent(runId)}/cancel`);
+  }
+  pause(runId) {
+    return this.c.post(`/api/fleet/runs/${encodeURIComponent(runId)}/pause`);
+  }
+  resume(runId) {
+    return this.c.post(`/api/fleet/runs/${encodeURIComponent(runId)}/resume`);
+  }
+};
+
+// src/core/resources/tasks.ts
+var TasksApi = class {
+  constructor(c) {
+    this.c = c;
+  }
+  /** Current status of one task (`GET /api/webhook/tasks/:id`). */
+  get(id) {
+    return this.c.get(`/api/webhook/tasks/${encodeURIComponent(id)}`);
+  }
+  /** List the caller-project's tasks, newest first (paginated, filterable). */
+  list(filter) {
+    return this.c.get("/api/webhook/tasks", {
+      query: {
+        device_id: filter?.deviceId,
+        status: filter?.status,
+        limit: filter?.limit,
+        offset: filter?.offset
+      }
+    });
+  }
+  /** Cancel a task (DB-side: not-yet-terminal targets → cancelled). */
+  cancel(id) {
+    return this.c.post(`/api/webhook/tasks/${encodeURIComponent(id)}/cancel`);
+  }
+  /** Pause a task: still-`pending` targets → `paused` so nodes skip them
+   *  (`pending_for_external` only pulls `pending`). In-flight targets keep
+   *  running — pause only holds back not-yet-started work. */
+  pause(id) {
+    return this.c.post(`/api/webhook/tasks/${encodeURIComponent(id)}/pause`);
+  }
+  /** Resume a paused task: `paused` targets → `pending` so nodes pick them up again. */
+  resume(id) {
+    return this.c.post(`/api/webhook/tasks/${encodeURIComponent(id)}/resume`);
+  }
+  /** Persisted event history for a task, newest first. */
+  events(id, opts) {
+    return this.c.get(`/api/webhook/tasks/${encodeURIComponent(id)}/events`, {
+      query: { limit: opts?.limit, offset: opts?.offset }
+    });
+  }
+};
+
+// src/core/resources/webhooks.ts
+var WebhooksApi = class {
+  constructor(c) {
+    this.c = c;
+  }
+  list() {
+    return this.c.get("/api/webhooks/configs", { scope: "developer" }).then((r) => r.webhooks ?? []);
+  }
+  create(input) {
+    return this.c.post("/api/webhooks/configs", input, { scope: "developer" });
+  }
+  setEnabled(id, enabled) {
+    return this.c.patch(`/api/webhooks/configs/${encodeURIComponent(id)}`, { enabled }, { scope: "developer" });
+  }
+  remove(id) {
+    return this.c.del(`/api/webhooks/configs/${encodeURIComponent(id)}`, { scope: "developer" });
+  }
+  trigger(eventType, payload) {
+    return this.c.post("/api/webhooks/trigger", { event_type: eventType, payload }, { scope: "developer" });
+  }
+};
+
+// src/core/resources/llm.ts
+var LlmApi = class {
+  constructor(c) {
+    this.c = c;
+  }
+  test(opts) {
+    return this.c.post(
+      "/api/llm/test",
+      { token: opts?.token, model: opts?.model, base_url: opts?.baseUrl },
+      { scope: "developer" }
+    );
+  }
+};
+
+// src/core/resources/admin.ts
+var AdminApi = class {
+  constructor(c) {
+    this.c = c;
+  }
+  // rates
+  listRates() {
+    return this.c.get("/api/admin/rates", { scope: "admin" });
+  }
+  upsertRate(body) {
+    return this.c.put("/api/admin/rates", body, { scope: "admin" });
+  }
+  // project rebate / node platform flag
+  setRebate(projectId, ratio) {
+    return this.c.put(`/api/admin/projects/${encodeURIComponent(projectId)}/rebate`, { ratio }, { scope: "admin" });
+  }
+  setNodePlatform(nodeId, isPlatform) {
+    return this.c.put(`/api/admin/nodes/${encodeURIComponent(nodeId)}/platform`, { is_platform: isPlatform }, { scope: "admin" });
+  }
+  // plans + reports
+  listPlans() {
+    return this.c.get("/api/admin/plans", { scope: "admin" });
+  }
+  createPlan(body) {
+    return this.c.put("/api/admin/plans", body, { scope: "admin" });
+  }
+  usage() {
+    return this.c.get("/api/admin/billing/usage", { scope: "admin" });
+  }
+  ledger() {
+    return this.c.get("/api/admin/billing/ledger", { scope: "admin" });
+  }
+  // platform OEM (white-label defaults every project inherits)
+  getOem() {
+    return this.c.get("/api/admin/oem", { scope: "admin" });
+  }
+  putOem(body) {
+    return this.c.put("/api/admin/oem", body, { scope: "admin" });
+  }
+  // image artifacts
+  listImages() {
+    return this.c.get("/api/images", { scope: "admin" });
+  }
+  upsertImage(body) {
+    return this.c.post("/api/images", body, { scope: "admin" });
+  }
+  setImageActive(id, active) {
+    return this.c.put(`/api/images/${encodeURIComponent(id)}/active`, { active }, { scope: "admin" });
+  }
+  deleteImage(id) {
+    return this.c.del(`/api/images/${encodeURIComponent(id)}`, { scope: "admin" });
+  }
+};
+
+// src/core/resources/images.ts
+var ImagesApi = class {
+  constructor(c) {
+    this.c = c;
+  }
+  /** Provisionable versions for a platform, drawn from the active catalog
+   *  (`GET /api/images/options`). Omit `platform` for all platforms. */
+  options(platform) {
+    const q = platform ? `?platform=${encodeURIComponent(platform)}` : "";
+    return this.c.get(`/api/images/options${q}`);
+  }
+};
+
+// src/core/resources/billing.ts
+var BillingApi = class {
+  constructor(c) {
+    this.c = c;
+  }
+  /** 当前钱包余额 + 最近流水(`GET /api/billing/balance`)。 */
+  balance() {
+    return this.c.get("/api/billing/balance");
+  }
+  /** 名下项目订阅列表(`GET /api/billing/subscriptions`)。 */
+  subscriptions() {
+    return this.c.get("/api/billing/subscriptions");
+  }
+  /** 订阅一个套餐(`POST /api/billing/subscriptions`)。`plan_id` 由调用方传入。 */
+  subscribe(input) {
+    return this.c.post("/api/billing/subscriptions", input);
+  }
+  /** 自有节点日费(`GET /api/billing/own-node-charges`)。 */
+  ownNodeCharges() {
+    return this.c.get("/api/billing/own-node-charges");
+  }
+  /** 充值到指定用户钱包(`POST /api/admin/billing/balance/topup`,admin scope)。 */
+  topup(input) {
+    return this.c.post("/api/admin/billing/balance/topup", input, { scope: "admin" });
+  }
+};
+
+// src/core/resources/tokens.ts
+var ApiTokensApi = class {
+  constructor(c) {
+    this.c = c;
+  }
+  /** 列出名下令牌(无明文/hash;`GET /api/tokens`)。 */
+  list() {
+    return this.c.get("/api/tokens");
+  }
+  /** 创建一个 PAT(`POST /api/tokens`);响应 `token` 明文仅此一次。 */
+  create(input) {
+    return this.c.post("/api/tokens", input);
+  }
+  /** 撤销一个 PAT(`DELETE /api/tokens/:id`,204)。 */
+  revoke(id) {
+    return this.c.del(`/api/tokens/${encodeURIComponent(id)}`);
+  }
+  /** 轮换一个 PAT(重签明文,旧 hash 失效;`POST /api/tokens/:id/rotate`)。 */
+  rotate(id) {
+    return this.c.post(`/api/tokens/${encodeURIComponent(id)}/rotate`);
+  }
+};
+
+// src/core/local-node.ts
+function toWs(httpBase) {
+  return httpBase.replace(/^http/, "ws");
+}
+var LocalNodeController = class {
+  constructor(client, opts) {
+    this.client = client;
+    this.opts = opts;
+    /** The node id this machine is bound to once `ensure()` has run. */
+    this.nodeId = null;
+    /** Last best-effort failure captured by `ensure()`, for host UIs that want to surface it. */
+    this.lastError = null;
+  }
+  async startHost(token, backendWs) {
+    const opts = { token, backendWs };
+    if (this.opts.requireSdkUpdate !== void 0) opts.requireSdkUpdate = this.opts.requireSdkUpdate;
+    await this.opts.host.start(opts);
+  }
+  get scope() {
+    return this.opts.scope ?? "personal";
+  }
+  get backendWs() {
+    return this.opts.backendWs ?? toWs(this.client.cfg.baseUrl);
+  }
+  /** Ensure THIS machine runs as its OWN node owned by the signed-in caller,
+   *  starting it via the host. The node is keyed by machine name (`nameHint`), so
+   *  each of the user's machines gets a distinct node (no shared-node churn).
+   *  Idempotent: keeps a running match, else restarts the persisted/rotated node,
+   *  else registers one named after the machine. Returns the bound node id, or
+   *  null on failure (best-effort). */
+  async ensure() {
+    const { host } = this.opts;
+    this.lastError = null;
+    try {
+      const status = await host.status();
+      const ws = this.backendWs;
+      const nodes = await this.client.nodes.list();
+      const mine = nodes.filter((n) => n.is_owner && n.scope === this.scope);
+      const machine = this.opts.nameHint ?? "desktop-node";
+      const ours = mine.find((n) => n.name === machine);
+      if (status.running) {
+        if (status.nodeId && ours && status.nodeId === ours.id) {
+          return await this.bind(status.nodeId);
+        }
+        await host.stop();
+      }
+      if (status.hasToken && status.nodeId && ours && status.nodeId === ours.id) {
+        await this.startHost(null, ws);
+        return await this.bind(status.nodeId);
+      }
+      if (ours) {
+        const r2 = await this.client.nodes.rotateToken(ours.id);
+        await this.startHost(r2.token, ws);
+        return await this.bind(ours.id);
+      }
+      const r = await this.client.nodes.register({ name: machine, scope: this.scope });
+      await this.startHost(r.token, ws);
+      return await this.bind(r.id);
+    } catch (e) {
+      this.lastError = e;
+      console.warn("[localNode] ensure failed:", e);
+      return null;
+    }
+  }
+  /** Record the bound node id and, in headless `'auto'` mode, ensure its redroid
+   *  host base is configured before returning. Always returns the id. */
+  async bind(id) {
+    this.nodeId = id;
+    await this.maybeAutoEnv();
+    return id;
+  }
+  /** Resolve the env OS: explicit option wins, else auto-detect; `null` (Linux/
+   *  unknown) means "no base needed" and the gate is skipped. */
+  get envOs() {
+    return this.opts.envOs !== void 0 ? this.opts.envOs : detectEnvOs();
+  }
+  /** HEADLESS auto env-init: probe `env/status` on the bound node and, if the
+   *  redroid base is missing, run `env/setup` to completion — no confirmation.
+   *  No-op unless `envInit: 'auto'` and the OS needs a base. Best-effort. */
+  async maybeAutoEnv() {
+    if (this.opts.envInit !== "auto" || !this.nodeId) return;
+    const os = this.envOs;
+    if (os !== "win" && os !== "mac") return;
+    try {
+      const status = await this.runEnv("status", os);
+      if (status) return;
+      await this.runEnv("setup", os);
+    } catch (e) {
+      console.warn("[localNode] env auto-init failed:", e);
+    }
+  }
+  /** Run an env action on the bound node to completion. For `'status'` returns
+   *  whether the base is already ready; for `'setup'` returns whether it ok'd. */
+  async runEnv(action, os) {
+    const nodeId = this.nodeId;
+    const run = action === "status" ? await this.client.nodes.envStatus(nodeId, { os }) : await this.client.nodes.envSetup(nodeId, { os, route: this.opts.envRoute });
+    const events = [];
+    return new Promise((resolve) => {
+      run.on("event", (e) => events.push(e));
+      run.on("done", () => resolve(summarizeEnv(events).ready));
+    });
+  }
+  /** Stop the local node (e.g. on logout). Best-effort. */
+  async stop() {
+    try {
+      await this.opts.host.stop();
+    } catch (e) {
+      console.warn("[localNode] stop failed:", e);
+    }
+  }
+  /** Devices connected to THIS local node — `devices.list()` filtered by node id.
+   *  Empty until `ensure()` has bound `nodeId`. */
+  async listDevices() {
+    if (!this.nodeId) return [];
+    const all = await this.client.devices.list();
+    return all.filter((d) => d.node_id === this.nodeId);
+  }
+  /** Subscribe to this node's device list (polled). Fires immediately, then every
+   *  `pollMs`. Returns an unsubscribe fn. */
+  onDevices(cb) {
+    let alive = true;
+    const tick = () => {
+      this.listDevices().then((d) => {
+        if (alive) cb(d);
+      }).catch(() => {
+      });
+    };
+    tick();
+    const id = setInterval(tick, this.opts.pollMs ?? 4e3);
+    return () => {
+      alive = false;
+      clearInterval(id);
+    };
+  }
+};
+
+// src/core/resources/app-templates.ts
+var AppTemplatesApi = class {
+  constructor(c) {
+    this.c = c;
+  }
+  list(platform) {
+    const q = platform ? `?platform=${platform}` : "";
+    return this.c.get(`/api/app-templates${q}`);
+  }
+  create(body) {
+    return this.c.post("/api/app-templates", body);
+  }
+  update(id, body) {
+    return this.c.put(`/api/app-templates/${encodeURIComponent(id)}`, body);
+  }
+  remove(id) {
+    return this.c.del(`/api/app-templates/${encodeURIComponent(id)}`);
+  }
+};
+
+// src/core/resources/client.ts
+var AixClient = class {
+  constructor(cfg) {
+    this.cfg = "fetchFn" in cfg && "auth" in cfg && typeof cfg.auth?.headers === "function" ? cfg : resolveConfig(cfg);
+    this.http = new RestClient(this.cfg);
+    this.auth = new AuthApi(this.http);
+    this.projects = new ProjectsApi(this.http);
+    this.users = new UsersApi(this.http);
+    this.devices = new DevicesApi(this.http);
+    this.nodes = new NodesApi(this.http, this.cfg);
+    this.clusters = new ClustersApi(this.http);
+    this.scripts = new ScriptsApi(this.http);
+    this.shortcuts = new ShortcutsApi(this.http);
+    this.locators = new LocatorsApi(this.http);
+    this.fleet = new FleetApi(this.http);
+    this.tasks = new TasksApi(this.http);
+    this.webhooks = new WebhooksApi(this.http);
+    this.llm = new LlmApi(this.http);
+    this.admin = new AdminApi(this.http);
+    this.images = new ImagesApi(this.http);
+    this.billing = new BillingApi(this.http);
+    this.tokens = new ApiTokensApi(this.http);
+    this.appTemplates = new AppTemplatesApi(this.http);
+    if (this.cfg.localNode) {
+      this.localNode = new LocalNodeController(this, this.cfg.localNode);
+      if (this.cfg.localNode.auto) void this.localNode.ensure();
+    }
+  }
+  /**
+   * 打开一条设备会话(DataChannel 多路复用):文件管理 + 终端 + 传输 + 通用流/
+   * 端口转发。返回的 `DeviceSession` 用完请 `close()`。
+   *
+   * 解耦说明:`device-session.ts` 静态依赖本文件(`AixClient`),为避免模块求值期
+   * 循环依赖,这里用**动态 import** 拿 `DeviceSession`;并把 `this.cfg`
+   * (ResolvedConfig)而非 `this` 传给 `open`(`open` 内部用 cfg + 自建 DevicesApi
+   * 即可,不必回依赖 client 实例)。
+   */
+  async deviceSession(deviceId, opts = {}) {
+    const { DeviceSession } = await import('./device-session-KZVGLPOI.js');
+    return DeviceSession.open(this.cfg, deviceId, opts);
+  }
+};
+function createClient(cfg) {
+  return new AixClient(cfg);
+}
+
+export { AdminApi, AixAuthError, AixClient, AixDeviceOffline, AixError, AixLocked, AixProtocolError, AixTimeout, ApiTokensApi, AuthApi, BillingApi, ClustersApi, DevicesApi, EnvRun, FleetApi, ImagesApi, LlmApi, LocalNodeController, LocatorsApi, NodesApi, ProjectsApi, ReconnectingSocket, RestClient, ScriptsApi, ShortcutsApi, TasksApi, UsersApi, WebhooksApi, authHeader, buildAuthProvider, createCachedUserCredential, createClient, detectEnvOs, envBlocker, errorFromRet, executionStreamEventsAfter, executionWsTicketUrl, executionWsUrl, getLocale, isEnvEventFrame, isExecutionFrame, isFleetRunTerminal, isFridaEventFrame, isRetFrame, isScriptletEventFrame, isStatusFrame, joinUrl, parseIncoming, resolveConfig, restClient, runEnvToFinish, setLocale, summarizeEnv, t };