@parall/daemon 1.28.0 → 1.28.1

package/bundle/parall-daemon.js

@@ -0,0 +1,2786 @@
+#!/usr/bin/env node
+
+// ts/sdk/dist/constants.js
+var API_BASE = "/api/v1";
+var WIKI_BASE = "/wiki/v1";
+var ENDPOINTS = {
+  // Auth
+  AUTH_REGISTER: `${API_BASE}/auth/register`,
+  AUTH_LOGIN: `${API_BASE}/auth/login`,
+  AUTH_REFRESH: `${API_BASE}/auth/refresh`,
+  AUTH_LOGOUT: `${API_BASE}/auth/logout`,
+  AUTH_CHANGE_PASSWORD: `${API_BASE}/auth/change-password`,
+  AUTH_CHECK_EMAIL: `${API_BASE}/auth/check-email`,
+  AUTH_VERIFY_EMAIL: `${API_BASE}/auth/verify-email`,
+  AUTH_RESEND_CODE: `${API_BASE}/auth/resend-code`,
+  // Users
+  USERS_ME: `${API_BASE}/users/me`,
+  USER_AVATAR: `${API_BASE}/users/me/avatar`,
+  USER: (id) => `${API_BASE}/users/${id}`,
+  // WebSocket ticket
+  WS_TICKET: `${API_BASE}/ws/ticket`,
+  // Organizations (global)
+  ORGS: `${API_BASE}/orgs`,
+  // Org-scoped
+  ORG: (orgId) => `${API_BASE}/orgs/${orgId}`,
+  ORG_MEMBERS: (orgId) => `${API_BASE}/orgs/${orgId}/members`,
+  ORG_MEMBERS_ONLINE: (orgId) => `${API_BASE}/orgs/${orgId}/members/online`,
+  ORG_MEMBER: (orgId, userId) => `${API_BASE}/orgs/${orgId}/members/${userId}`,
+  ORG_MEMBER_CHATS: (orgId, memberId) => `${API_BASE}/orgs/${orgId}/members/${memberId}/chats`,
+  ORG_MEMBER_TASKS: (orgId, memberId) => `${API_BASE}/orgs/${orgId}/members/${memberId}/tasks`,
+  // Direct messages (org-scoped, atomic find-or-create + send)
+  DM: (orgId) => `${API_BASE}/orgs/${orgId}/dm`,
+  // Onboarding
+  SEED_ONBOARDING_DM: (orgId) => `${API_BASE}/orgs/${orgId}/seed-onboarding-dm`,
+  DISMISS_ONBOARDING: (orgId) => `${API_BASE}/orgs/${orgId}/dismiss-onboarding`,
+  // Chats (org-scoped)
+  CHATS: (orgId) => `${API_BASE}/orgs/${orgId}/chats`,
+  CHATS_DISCOVERABLE: (orgId) => `${API_BASE}/orgs/${orgId}/chats/discoverable`,
+  CHAT: (orgId, chatId) => `${API_BASE}/orgs/${orgId}/chats/${chatId}`,
+  CHAT_JOIN: (orgId, chatId) => `${API_BASE}/orgs/${orgId}/chats/${chatId}/join`,
+  CHAT_ARCHIVE: (orgId, chatId) => `${API_BASE}/orgs/${orgId}/chats/${chatId}/archive`,
+  CHAT_RESTORE: (orgId, chatId) => `${API_BASE}/orgs/${orgId}/chats/${chatId}/restore`,
+  CHAT_MEMBERS: (orgId, chatId) => `${API_BASE}/orgs/${orgId}/chats/${chatId}/members`,
+  CHAT_MEMBER: (orgId, chatId, userId) => `${API_BASE}/orgs/${orgId}/chats/${chatId}/members/${userId}`,
+  CHAT_TRANSFER_OWNERSHIP: (orgId, chatId) => `${API_BASE}/orgs/${orgId}/chats/${chatId}/transfer-ownership`,
+  CHAT_MESSAGES: (orgId, chatId) => `${API_BASE}/orgs/${orgId}/chats/${chatId}/messages`,
+  // Messages (global, by message ID)
+  MESSAGE: (id) => `${API_BASE}/messages/${id}`,
+  MESSAGE_PATCHES: (id) => `${API_BASE}/messages/${id}/patches`,
+  MESSAGE_REPLIES: (id) => `${API_BASE}/messages/${id}/replies`,
+  // Upload (org-scoped)
+  UPLOAD_PRESIGN: (orgId) => `${API_BASE}/orgs/${orgId}/upload/presign`,
+  UPLOAD_COMPLETE: (orgId) => `${API_BASE}/orgs/${orgId}/upload/complete`,
+  FILE: (id) => `${API_BASE}/files/${id}`,
+  // Approval requests (org-scoped)
+  APPROVAL_REQUESTS: (orgId) => `${API_BASE}/orgs/${orgId}/approval-requests`,
+  // Approvals (global)
+  APPROVAL: (id) => `${API_BASE}/approvals/${id}`,
+  APPROVAL_DECIDE: (id) => `${API_BASE}/approvals/${id}/decide`,
+  APPROVAL_CANCEL: (id) => `${API_BASE}/approvals/${id}/cancel`,
+  APPROVALS_PENDING: `${API_BASE}/approvals/pending`,
+  APPROVALS_ACTIONS: `${API_BASE}/approvals/actions`,
+  // Agents (org-scoped)
+  AGENTS: (orgId) => `${API_BASE}/orgs/${orgId}/agents`,
+  AGENT: (orgId, agentId) => `${API_BASE}/orgs/${orgId}/agents/${agentId}`,
+  AGENT_API_KEYS: (orgId, agentId) => `${API_BASE}/orgs/${orgId}/agents/${agentId}/api-keys`,
+  AGENT_API_KEY: (orgId, agentId, key) => `${API_BASE}/orgs/${orgId}/agents/${agentId}/api-keys/${key}`,
+  AGENT_AVATAR: (orgId, agentId) => `${API_BASE}/orgs/${orgId}/agents/${agentId}/avatar`,
+  AGENT_ACTIVITY: (orgId, agentId) => `${API_BASE}/orgs/${orgId}/agents/${agentId}/activity`,
+  AGENT_MONITOR: (orgId, agentId) => `${API_BASE}/orgs/${orgId}/agents/${agentId}/monitor`,
+  AGENT_ME: (orgId) => `${API_BASE}/orgs/${orgId}/agents/me`,
+  AGENT_SESSIONS: (orgId, agentId) => `${API_BASE}/orgs/${orgId}/agents/${agentId}/sessions`,
+  AGENT_SESSION: (orgId, agentId, sessionId) => `${API_BASE}/orgs/${orgId}/agents/${agentId}/sessions/${sessionId}`,
+  AGENT_SESSION_STEPS: (orgId, agentId, sessionId) => `${API_BASE}/orgs/${orgId}/agents/${agentId}/sessions/${sessionId}/steps`,
+  AGENT_SESSION_STEP: (orgId, agentId, sessionId, stepId) => `${API_BASE}/orgs/${orgId}/agents/${agentId}/sessions/${sessionId}/steps/${stepId}`,
+  AGENT_TASKS: (orgId, agentId) => `${API_BASE}/orgs/${orgId}/agents/${agentId}/tasks`,
+  AGENT_RUNTIME_AUTH: (orgId, agentId) => `${API_BASE}/orgs/${orgId}/agents/${agentId}/runtime-auth`,
+  AGENT_RUNTIME_AUTH_SESSIONS: (orgId, agentId) => `${API_BASE}/orgs/${orgId}/agents/${agentId}/runtime-auth-sessions`,
+  AGENT_RUNTIME_AUTH_SESSION_COMPLETE: (orgId, agentId, sessionId) => `${API_BASE}/orgs/${orgId}/agents/${agentId}/runtime-auth-sessions/${sessionId}/complete`,
+  AGENT_RUNTIME: (orgId, agentId) => `${API_BASE}/orgs/${orgId}/agents/${agentId}/runtime`,
+  AGENT_RUNTIME_UPGRADE: (orgId, agentId) => `${API_BASE}/orgs/${orgId}/agents/${agentId}/runtime/upgrade`,
+  AGENT_RUNTIME_AVAILABLE_TAGS: (orgId, agentId) => `${API_BASE}/orgs/${orgId}/agents/${agentId}/runtime/available-tags`,
+  AGENT_RUNTIME_RELEASE: (orgId, agentId, tag) => `${API_BASE}/orgs/${orgId}/agents/${agentId}/runtime/releases/${encodeURIComponent(tag)}`,
+  AGENT_PROVIDER_CONFIG: (orgId, agentId) => `${API_BASE}/orgs/${orgId}/agents/${agentId}/provider-config`,
+  // Machines (org-scoped)
+  MACHINES: (orgId) => `${API_BASE}/orgs/${orgId}/machines`,
+  MACHINE: (orgId, machineId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}`,
+  MACHINE_START: (orgId, machineId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}/start`,
+  MACHINE_STOP: (orgId, machineId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}/stop`,
+  MACHINE_STATUS: (orgId, machineId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}/status`,
+  MACHINE_LOGS: (orgId, machineId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}/logs`,
+  MACHINE_SPEC: (orgId, machineId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}/spec`,
+  MACHINE_RESTART: (orgId, machineId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}/restart`,
+  MACHINE_RESTART_ALL: (orgId) => `${API_BASE}/orgs/${orgId}/machines/restart-all`,
+  // Daemon-mode Machine management (org-scoped, user auth).
+  // POST creates a new daemon-mode Machine (daemon_mode=true always).
+  // Attach/Detach bind an agent to/from a daemon Machine.
+  MACHINE_ATTACH_AGENT: (orgId, machineId, agentId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}/agents/${agentId}`,
+  MACHINE_DETACH_AGENT: (orgId, machineId, agentId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}/agents/${agentId}`,
+  MACHINE_RUNTIME_AUTH: (orgId, machineId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}/runtime-auth`,
+  MACHINE_KEYS: (orgId, machineId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}/keys`,
+  MACHINE_KEY: (orgId, machineId, keyId) => `${API_BASE}/orgs/${orgId}/machines/${machineId}/keys/${keyId}`,
+  // Machine self-control-plane (mck_-scoped). The bearer token implicitly
+  // identifies the Machine, so there is no `:mid` URL parameter — these are
+  // "self" routes called by the daemon for its own host.
+  MACHINES_ME: `${API_BASE}/machines/me`,
+  MACHINES_ME_AGENTS: `${API_BASE}/machines/me/agents`,
+  MACHINES_ME_HEALTH: `${API_BASE}/machines/me/health`,
+  MACHINES_ME_AGENT_LAUNCH_CREDENTIAL: (agentId) => `${API_BASE}/machines/me/agents/${agentId}/launch-credential`,
+  MACHINES_ME_WS_TICKET: `${API_BASE}/machines/me/ws/ticket`,
+  // Tasks (org-scoped)
+  TASKS: (orgId) => `${API_BASE}/orgs/${orgId}/tasks`,
+  TASK: (orgId, taskId) => `${API_BASE}/orgs/${orgId}/tasks/${taskId}`,
+  TASK_ARCHIVE: (orgId, taskId) => `${API_BASE}/orgs/${orgId}/tasks/${taskId}/archive`,
+  TASK_RESTORE: (orgId, taskId) => `${API_BASE}/orgs/${orgId}/tasks/${taskId}/restore`,
+  TASK_WATCH: (orgId, taskId) => `${API_BASE}/orgs/${orgId}/tasks/${taskId}/watch`,
+  TASK_WATCHERS: (orgId, taskId) => `${API_BASE}/orgs/${orgId}/tasks/${taskId}/watchers`,
+  TASK_SUBTASKS: (orgId, taskId) => `${API_BASE}/orgs/${orgId}/tasks/${taskId}/subtasks`,
+  TASK_RELATIONS: (orgId, taskId) => `${API_BASE}/orgs/${orgId}/tasks/${taskId}/relations`,
+  TASK_RELATION: (orgId, taskId, relId) => `${API_BASE}/orgs/${orgId}/tasks/${taskId}/relations/${relId}`,
+  TASK_RELATIONS_BY_TARGET: (orgId) => `${API_BASE}/orgs/${orgId}/task-relations`,
+  TASK_COMMENTS: (orgId, taskId) => `${API_BASE}/orgs/${orgId}/tasks/${taskId}/comments`,
+  TASK_COMMENT: (orgId, taskId, commentId) => `${API_BASE}/orgs/${orgId}/tasks/${taskId}/comments/${commentId}`,
+  TASK_ACTIVITIES: (orgId, taskId) => `${API_BASE}/orgs/${orgId}/tasks/${taskId}/activities`,
+  // Projects (org-scoped)
+  PROJECTS: (orgId) => `${API_BASE}/orgs/${orgId}/projects`,
+  PROJECT: (orgId, projectId) => `${API_BASE}/orgs/${orgId}/projects/${projectId}`,
+  // Schedules (org-scoped, platform time trigger primitive)
+  SCHEDULES: (orgId) => `${API_BASE}/orgs/${orgId}/schedules`,
+  SCHEDULE: (orgId, id) => `${API_BASE}/orgs/${orgId}/schedules/${id}`,
+  SCHEDULE_PAUSE: (orgId, id) => `${API_BASE}/orgs/${orgId}/schedules/${id}/pause`,
+  SCHEDULE_RESUME: (orgId, id) => `${API_BASE}/orgs/${orgId}/schedules/${id}/resume`,
+  SCHEDULE_CANCEL: (orgId, id) => `${API_BASE}/orgs/${orgId}/schedules/${id}/cancel`,
+  SCHEDULE_RUNS: (orgId, id) => `${API_BASE}/orgs/${orgId}/schedules/${id}/runs`,
+  SCHEDULE_RUN: (orgId, runId) => `${API_BASE}/orgs/${orgId}/schedule_runs/${runId}`,
+  // Invitations (org-scoped, admin)
+  ORG_INVITATIONS: (orgId) => `${API_BASE}/orgs/${orgId}/invitations`,
+  ORG_INVITATION: (orgId, invId) => `${API_BASE}/orgs/${orgId}/invitations/${invId}`,
+  ORG_INVITATION_RESEND: (orgId, invId) => `${API_BASE}/orgs/${orgId}/invitations/${invId}/resend`,
+  // Invitations (invitee)
+  MY_INVITATIONS: `${API_BASE}/invitations/pending`,
+  INVITATION_ACCEPT: (id) => `${API_BASE}/invitations/${id}/accept`,
+  INVITATION_DECLINE: (id) => `${API_BASE}/invitations/${id}/decline`,
+  INVITATION_BY_TOKEN: (token) => `${API_BASE}/invitations/by-token/${token}`,
+  // Wikis (org-scoped, served by wiki-service)
+  WIKIS: (orgId) => `${WIKI_BASE}/orgs/${orgId}/wikis`,
+  WIKI: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}`,
+  WIKI_TREE: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/tree`,
+  WIKI_BLOB: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/blob`,
+  WIKI_NODE_SECTIONS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/node-sections`,
+  WIKI_SEARCH: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/search`,
+  WIKI_PAGE_INDEX: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/page-index`,
+  WIKI_REFS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/refs`,
+  WIKI_REFS_CHECK: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/refs/check`,
+  WIKI_ANCHOR_STATUS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/anchor-status`,
+  WIKI_CHANGESETS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/changesets`,
+  WIKI_CHANGESET: (orgId, wikiId, changesetId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/changesets/${changesetId}`,
+  WIKI_CHANGESET_DIFF: (orgId, wikiId, changesetId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/changesets/${changesetId}/diff`,
+  WIKI_CHANGESET_MERGE: (orgId, wikiId, changesetId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/changesets/${changesetId}/merge`,
+  WIKI_CHANGESET_CLOSE: (orgId, wikiId, changesetId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/changesets/${changesetId}/close`,
+  WIKI_CHANGESET_FILES: (orgId, wikiId, changesetId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/changesets/${changesetId}/files`,
+  // Wiki Binary Upload / Delete (Phase 2 of wiki-file-storage-design)
+  WIKI_UPLOADS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/uploads`,
+  WIKI_FILES: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/files`,
+  WIKI_FILE_PREVIEW_URL: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/files/preview-url`,
+  // Wiki Path Scopes (AFCS ACL)
+  WIKI_PATH_SCOPES: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/path-scopes`,
+  WIKI_PATH_SCOPE: (orgId, wikiId, scopeId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/path-scopes/${scopeId}`,
+  WIKI_ACCESS_STATUS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/access-status`,
+  WIKI_ACCESS_REQUESTS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/access-requests`,
+  // Wiki History (commits, file commits, blame)
+  WIKI_COMMITS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/commits`,
+  WIKI_FILE_COMMITS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/file-commits`,
+  WIKI_BLAME: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/blame`,
+  // Wiki Operations (audit log)
+  WIKI_OPERATIONS: (orgId, wikiId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/operations`,
+  WIKI_OPERATION_REVERT: (orgId, wikiId, opId) => `${WIKI_BASE}/orgs/${orgId}/wikis/${wikiId}/operations/${opId}/revert`,
+  // Unified Comments (org-scoped, api-server)
+  COMMENTS: (orgId) => `${API_BASE}/orgs/${orgId}/comments`,
+  COMMENT: (orgId, commentId) => `${API_BASE}/orgs/${orgId}/comments/${commentId}`,
+  // Inbox (org-scoped)
+  INBOX: (orgId) => `${API_BASE}/orgs/${orgId}/inbox`,
+  INBOX_UNREAD_COUNT: (orgId) => `${API_BASE}/orgs/${orgId}/inbox/unread-count`,
+  INBOX_ITEM_READ: (orgId, id) => `${API_BASE}/orgs/${orgId}/inbox/${id}/read`,
+  INBOX_ITEM_UNREAD: (orgId, id) => `${API_BASE}/orgs/${orgId}/inbox/${id}/unread`,
+  INBOX_ITEM_ARCHIVE: (orgId, id) => `${API_BASE}/orgs/${orgId}/inbox/${id}/archive`,
+  // Snooze/Unsnooze deferred until un-snooze cron worker is implemented
+  INBOX_MARK_ALL_READ: (orgId) => `${API_BASE}/orgs/${orgId}/inbox/mark-all-read`,
+  INBOX_ARCHIVE_ALL: (orgId) => `${API_BASE}/orgs/${orgId}/inbox/archive-all`,
+  INBOX_ITEM: (orgId, id) => `${API_BASE}/orgs/${orgId}/inbox/${id}`,
+  INBOX_ACK: (orgId) => `${API_BASE}/orgs/${orgId}/inbox/ack`,
+  // Dispatch (agent event delivery)
+  DISPATCH: (orgId) => `${API_BASE}/orgs/${orgId}/dispatch`,
+  DISPATCH_PENDING_COUNT: (orgId) => `${API_BASE}/orgs/${orgId}/dispatch/pending-count`,
+  DISPATCH_ACK: (orgId) => `${API_BASE}/orgs/${orgId}/dispatch/ack`,
+  DISPATCH_ACK_BY_ID: (orgId, id) => `${API_BASE}/orgs/${orgId}/dispatch/${id}/ack`,
+  // Unread
+  UNREAD: `${API_BASE}/me/unread`,
+  ORG_UNREAD: (orgId) => `${API_BASE}/orgs/${orgId}/unread`,
+  CHAT_READ: (orgId, chatId) => `${API_BASE}/orgs/${orgId}/chats/${chatId}/read`,
+  // References (org-scoped)
+  REFS_RESOLVE: (orgId) => `${API_BASE}/orgs/${orgId}/refs/resolve`,
+  REFS_BACKLINKS: (orgId) => `${API_BASE}/orgs/${orgId}/refs/backlinks`,
+  REFS_CHECK: (orgId) => `${API_BASE}/orgs/${orgId}/refs/check`,
+  // Platform config (agent-scoped, not org-scoped)
+  PLATFORM_CONFIG: `${API_BASE}/agents/platform-config`,
+  // Push notifications
+  PUSH_SUBSCRIBE: `${API_BASE}/push/subscribe`,
+  PUSH_UNSUBSCRIBE: `${API_BASE}/push/unsubscribe`,
+  PUSH_VAPID_KEY: `${API_BASE}/push/vapid-key`,
+  // Notification preferences
+  NOTIFICATION_PREFERENCES: `${API_BASE}/notification-preferences`,
+  // Feature flags (org-scoped, server-evaluated)
+  FEATURE_FLAGS: (orgId) => `${API_BASE}/orgs/${orgId}/feature-flags`,
+  // Billing & Credits (org-scoped)
+  BILLING: (orgId) => `${API_BASE}/orgs/${orgId}/billing`,
+  BILLING_TRANSACTIONS: (orgId) => `${API_BASE}/orgs/${orgId}/billing/transactions`,
+  BILLING_CHECKOUT: (orgId) => `${API_BASE}/orgs/${orgId}/billing/checkout`,
+  BILLING_AUTO_RELOAD: (orgId) => `${API_BASE}/orgs/${orgId}/billing/auto-reload`,
+  BILLING_SETUP_INTENT: (orgId) => `${API_BASE}/orgs/${orgId}/billing/setup-intent`,
+  COMPUTE_PRICING: () => `${API_BASE}/billing/compute-pricing`
+  // ADMIN_GRANTS intentionally NOT exported here — it sits under the
+  // unauthenticated `/internal/admin/*` surface and must not bleed into the
+  // public SDK. Admin dashboard hits the URL directly from its own client.
+};
+var WS_EVENTS = {
+  // Client -> Server
+  PING: "ping",
+  TYPING: "typing",
+  WATCH: "watch",
+  AGENT_HEARTBEAT: "agent.heartbeat",
+  // Server -> Client
+  HELLO: "hello",
+  PONG: "pong",
+  WATCHING: "watching",
+  MESSAGE_NEW: "message.new",
+  MESSAGE_PATCH: "message.patch",
+  MESSAGE_EDIT: "message.edit",
+  MESSAGE_DELETE: "message.delete",
+  TYPING_UPDATE: "typing.update",
+  CHAT_UPDATE: "chat.update",
+  CHAT_DELETED: "chat.deleted",
+  APPROVAL_UPDATE: "approval.update",
+  // deprecated
+  CARD_UPDATE: "card.update",
+  RECOVERY_OVERFLOW: "recovery.overflow",
+  MEMBERSHIP_CHANGED: "membership.changed",
+  TASK_CREATED: "task.created",
+  TASK_UPDATED: "task.updated",
+  TASK_DELETED: "task.deleted",
+  TASK_COMMENT_CREATED: "task.comment.created",
+  TASK_COMMENT_UPDATED: "task.comment.updated",
+  TASK_COMMENT_DELETED: "task.comment.deleted",
+  PROJECT_CREATED: "project.created",
+  PROJECT_UPDATED: "project.updated",
+  PROJECT_DELETED: "project.deleted",
+  AGENT_SESSION_NEW: "agent_session.new",
+  AGENT_SESSION_UPDATE: "agent_session.update",
+  AGENT_STEP_NEW: "agent_step.new",
+  INVITATION_NEW: "invitation.new",
+  INVITATION_ACCEPTED: "invitation.accepted",
+  INVITATION_DECLINED: "invitation.declined",
+  INVITATION_REVOKED: "invitation.revoked",
+  AGENT_CONFIG_UPDATE: "agent_config.update",
+  PRESENCE_UPDATE: "presence.update",
+  WIKI_CHANGESET_CREATED: "wiki.changeset.created",
+  WIKI_CHANGESET_UPDATED: "wiki.changeset.updated",
+  COMMENT_CREATED: "comment.created",
+  COMMENT_UPDATED: "comment.updated",
+  COMMENT_DELETED: "comment.deleted",
+  NOTIFICATION_ALERT: "notification.alert",
+  INBOX_NEW: "inbox.new",
+  INBOX_UPDATE: "inbox.update",
+  INBOX_BULK_UPDATE: "inbox.bulk_update",
+  READ_POSITION_UPDATED: "read_position.updated",
+  DISPATCH_NEW: "dispatch.new",
+  SCHEDULE_CREATED: "schedule.created",
+  SCHEDULE_UPDATED: "schedule.updated",
+  SCHEDULE_DELETED: "schedule.deleted",
+  SCHEDULE_FIRED: "schedule.fired",
+  BILLING_BALANCE_UPDATED: "billing.balance_updated",
+  BILLING_LOW_BALANCE: "billing.low_balance",
+  BILLING_MACHINE_STOPPED: "billing.machine_stopped",
+  BILLING_INSUFFICIENT: "billing.insufficient",
+  USER_UPDATED: "user.updated",
+  MACHINE_HELLO: "machine.hello",
+  MACHINE_AGENT_ATTACHED: "machine.agent.attached",
+  MACHINE_AGENT_DETACHED: "machine.agent.detached",
+  MACHINE_STOP: "machine.stop"
+};
+
+// ts/sdk/dist/client.js
+var ParallClient = class _ParallClient {
+  baseUrl;
+  token;
+  onTokenExpired;
+  getRefreshToken;
+  setTokens;
+  refreshPromise = null;
+  swimlaneName;
+  /** Auth endpoints excluded from automatic 401 refresh to prevent recursion. */
+  static AUTH_PATHS = /* @__PURE__ */ new Set([
+    "/auth/login",
+    "/auth/register",
+    "/auth/refresh",
+    "/auth/logout",
+    "/auth/verify-email",
+    "/auth/resend-code",
+    "/auth/check-email"
+  ]);
+  /** Proactive refresh when token expires within this window (seconds). */
+  static REFRESH_THRESHOLD_S = 5 * 60;
+  static normalizeFetchError(err) {
+    if (typeof DOMException !== "undefined" && err instanceof DOMException && (err.name === "TimeoutError" || err.name === "AbortError")) {
+      return new ApiError(0, "Request timed out", "REQUEST_TIMEOUT");
+    }
+    const apiError = new ApiError(0, "Network request failed", "NETWORK_ERROR");
+    if (err instanceof Error && err.message && err.message !== "Failed to fetch") {
+      apiError.extras = { cause: err.message };
+    }
+    return apiError;
+  }
+  /** Build headers common to all requests (auth, swimlane). */
+  buildHeaders(extra) {
+    const headers = {
+      "Content-Type": "application/json",
+      ...extra
+    };
+    if (this.token) {
+      headers["Authorization"] = `Bearer ${this.token}`;
+    }
+    if (this.swimlaneName) {
+      headers["X-Prll-Swimlane"] = this.swimlaneName;
+    }
+    return headers;
+  }
+  constructor(options = {}) {
+    this.baseUrl = options.baseUrl ?? "";
+    this.token = options.token ?? null;
+    this.onTokenExpired = options.onTokenExpired;
+    this.getRefreshToken = options.getRefreshToken;
+    this.setTokens = options.setTokens;
+    this.swimlaneName = options.swimlaneName;
+  }
+  setToken(token) {
+    this.token = token;
+  }
+  getToken() {
+    return this.token;
+  }
+  /** Decode the `exp` claim from a JWT without verifying the signature. */
+  static decodeJwtExp(token) {
+    try {
+      const parts = token.split(".");
+      if (parts.length !== 3)
+        return null;
+      const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+      const padded = b64.padEnd(b64.length + (4 - b64.length % 4) % 4, "=");
+      const payload = JSON.parse(atob(padded));
+      return typeof payload.exp === "number" ? payload.exp : null;
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Proactive refresh: if the current access token expires within
+   * REFRESH_THRESHOLD_S, refresh it **before** sending the request.
+   * No-op when the token is still fresh, missing, or un-parseable.
+   */
+  async ensureFreshToken(path4) {
+    if (!this.token || !this.getRefreshToken)
+      return;
+    const pathSuffix = path4.replace(/^\/api\/v1/, "");
+    if (_ParallClient.AUTH_PATHS.has(pathSuffix))
+      return;
+    const exp = _ParallClient.decodeJwtExp(this.token);
+    if (exp === null)
+      return;
+    if (exp - Date.now() / 1e3 > _ParallClient.REFRESH_THRESHOLD_S)
+      return;
+    await this.tryRefresh();
+  }
+  /**
+   * Single-flight token refresh. Multiple concurrent 401s share one promise
+   * so only one refresh request is made.
+   */
+  async tryRefresh() {
+    const rt = this.getRefreshToken?.();
+    if (!rt)
+      return false;
+    if (!this.refreshPromise) {
+      this.refreshPromise = this.refreshToken(rt);
+    }
+    try {
+      const tokens = await this.refreshPromise;
+      this.setToken(tokens.access_token);
+      this.setTokens?.(tokens);
+      return true;
+    } catch {
+      return false;
+    } finally {
+      this.refreshPromise = null;
+    }
+  }
+  async request(method, path4, body, query, retried = false, opts) {
+    if (!retried) {
+      await this.ensureFreshToken(path4);
+    }
+    let url = `${this.baseUrl}${path4}`;
+    if (query) {
+      const params = new URLSearchParams();
+      for (const [key, value] of Object.entries(query)) {
+        if (value !== void 0) {
+          params.set(key, String(value));
+        }
+      }
+      const qs = params.toString();
+      if (qs)
+        url += `?${qs}`;
+    }
+    const headers = this.buildHeaders();
+    let res;
+    try {
+      res = await fetch(url, {
+        method,
+        headers,
+        body: body ? JSON.stringify(body) : void 0,
+        signal: AbortSignal.timeout(opts?.timeoutMs ?? 15e3)
+      });
+    } catch (err) {
+      throw _ParallClient.normalizeFetchError(err);
+    }
+    if (res.status === 401) {
+      const pathSuffix = path4.replace(/^\/api\/v1/, "");
+      const isAuthPath = _ParallClient.AUTH_PATHS.has(pathSuffix);
+      if (!retried && !isAuthPath && this.getRefreshToken) {
+        const refreshed = await this.tryRefresh();
+        if (refreshed) {
+          return this.request(method, path4, body, query, true, opts);
+        }
+      }
+      if (this.onTokenExpired && !isAuthPath) {
+        this.onTokenExpired();
+      }
+    }
+    if (!res.ok) {
+      const rawErrorBody = await res.json().catch(() => ({}));
+      const errorBody = rawErrorBody !== null && typeof rawErrorBody === "object" ? rawErrorBody : {};
+      const errorObj = errorBody?.error && typeof errorBody.error === "object" ? errorBody.error : void 0;
+      const errMsg = errorObj?.message ?? (typeof errorBody?.error === "string" ? errorBody.error : void 0);
+      const errCode = errorObj?.code ?? (typeof errorBody?.code === "string" ? errorBody.code : void 0);
+      const apiError = new ApiError(res.status, errMsg ?? res.statusText, errCode);
+      const { error: _e, code: _c, message: _m, ...extras } = errorBody;
+      if (Object.keys(extras).length > 0)
+        apiError.extras = extras;
+      throw apiError;
+    }
+    if (res.status === 204)
+      return void 0;
+    if (res.status === 202) {
+      const text = await res.text();
+      if (!text)
+        return void 0;
+      return JSON.parse(text);
+    }
+    return res.json();
+  }
+  /**
+   * Multipart upload variant of `request`. Same auth / refresh / error
+   * handling, but lets the caller hand us a prepared `FormData` (file +
+   * text fields) and skips the JSON content-type. Used by
+   * uploadWikiFile / uploadWikiFileToChangeset — wiki binary uploads can
+   * hit the 100 MiB cap, so a longer 5-minute timeout is used so a
+   * 50 MiB blob on a slow connection doesn't get chopped at 15 s.
+   */
+  async multipartRequest(method, path4, body, retried = false) {
+    if (!retried) {
+      await this.ensureFreshToken(path4);
+    }
+    const { "Content-Type": _drop, ...headers } = this.buildHeaders();
+    void _drop;
+    let res;
+    try {
+      res = await fetch(`${this.baseUrl}${path4}`, {
+        method,
+        headers,
+        body,
+        signal: AbortSignal.timeout(5 * 60 * 1e3)
+      });
+    } catch (err) {
+      throw _ParallClient.normalizeFetchError(err);
+    }
+    if (res.status === 401) {
+      const pathSuffix = path4.replace(/^\/api\/v1/, "");
+      const isAuthPath = _ParallClient.AUTH_PATHS.has(pathSuffix);
+      if (!retried && !isAuthPath && this.getRefreshToken) {
+        const refreshed = await this.tryRefresh();
+        if (refreshed) {
+          return this.multipartRequest(method, path4, body, true);
+        }
+      }
+      if (this.onTokenExpired && !isAuthPath) {
+        this.onTokenExpired();
+      }
+    }
+    if (!res.ok) {
+      const rawErrorBody = await res.json().catch(() => ({}));
+      const errorBody = rawErrorBody !== null && typeof rawErrorBody === "object" ? rawErrorBody : {};
+      const errorObj = errorBody?.error && typeof errorBody.error === "object" ? errorBody.error : void 0;
+      const errMsg = errorObj?.message ?? (typeof errorBody?.error === "string" ? errorBody.error : void 0);
+      const errCode = errorObj?.code ?? (typeof errorBody?.code === "string" ? errorBody.code : void 0);
+      const apiError = new ApiError(res.status, errMsg ?? res.statusText, errCode);
+      const { error: _e, code: _c, message: _m, ...extras } = errorBody;
+      if (Object.keys(extras).length > 0)
+        apiError.extras = extras;
+      throw apiError;
+    }
+    if (res.status === 204)
+      return void 0;
+    return res.json();
+  }
+  // ---- Auth ----
+  async register(req) {
+    return this.request("POST", ENDPOINTS.AUTH_REGISTER, req);
+  }
+  async login(req) {
+    return this.request("POST", ENDPOINTS.AUTH_LOGIN, req);
+  }
+  async refreshToken(refreshToken) {
+    return this.request("POST", ENDPOINTS.AUTH_REFRESH, { refresh_token: refreshToken });
+  }
+  async logout() {
+    return this.request("POST", ENDPOINTS.AUTH_LOGOUT);
+  }
+  async changePassword(req) {
+    return this.request("POST", ENDPOINTS.AUTH_CHANGE_PASSWORD, req);
+  }
+  async checkEmail(email) {
+    return this.request("POST", ENDPOINTS.AUTH_CHECK_EMAIL, { email });
+  }
+  async verifyEmail(email, code) {
+    return this.request("POST", ENDPOINTS.AUTH_VERIFY_EMAIL, { email, code });
+  }
+  async resendCode(email) {
+    return this.request("POST", ENDPOINTS.AUTH_RESEND_CODE, { email });
+  }
+  // ---- WebSocket ----
+  async getWsTicket() {
+    return this.request("POST", ENDPOINTS.WS_TICKET);
+  }
+  // ---- Users ----
+  async getMe() {
+    return this.request("GET", ENDPOINTS.USERS_ME);
+  }
+  async updateMe(data) {
+    return this.request("PATCH", ENDPOINTS.USERS_ME, data);
+  }
+  async deleteAccount() {
+    return this.request("DELETE", ENDPOINTS.USERS_ME);
+  }
+  async uploadAvatar(file) {
+    const fd = new FormData();
+    fd.append("file", file);
+    return this.multipartRequest("POST", ENDPOINTS.USER_AVATAR, fd);
+  }
+  async deleteAvatar() {
+    return this.request("DELETE", ENDPOINTS.USER_AVATAR);
+  }
+  async uploadAgentAvatar(orgId, agentId, file) {
+    const fd = new FormData();
+    fd.append("file", file);
+    return this.multipartRequest("POST", ENDPOINTS.AGENT_AVATAR(orgId, agentId), fd);
+  }
+  async deleteAgentAvatar(orgId, agentId) {
+    return this.request("DELETE", ENDPOINTS.AGENT_AVATAR(orgId, agentId));
+  }
+  async getUser(id) {
+    return this.request("GET", ENDPOINTS.USER(id));
+  }
+  // ---- Organizations ----
+  async createOrg(data) {
+    return this.request("POST", ENDPOINTS.ORGS, data);
+  }
+  async getOrgs() {
+    const res = await this.request("GET", ENDPOINTS.ORGS);
+    return res.data;
+  }
+  async getOrg(orgId) {
+    return this.request("GET", ENDPOINTS.ORG(orgId));
+  }
+  /**
+   * Update org settings. Owner/admin-only on the server; non-admin callers
+   * get 403. Smart routing: pass strategy ('llm' | 'agent' | '') and
+   * agent_id to configure; omit to leave unchanged.
+   */
+  async updateOrg(orgId, data) {
+    return this.request("PATCH", ENDPOINTS.ORG(orgId), data);
+  }
+  async deleteOrg(orgId) {
+    return this.request("DELETE", ENDPOINTS.ORG(orgId));
+  }
+  async getOrgMembers(orgId) {
+    const res = await this.request("GET", ENDPOINTS.ORG_MEMBERS(orgId));
+    return res.data;
+  }
+  async getOnlineMembers(orgId) {
+    const res = await this.request("GET", ENDPOINTS.ORG_MEMBERS_ONLINE(orgId));
+    return res.user_ids ?? [];
+  }
+  async removeOrgMember(orgId, userId) {
+    return this.request("DELETE", ENDPOINTS.ORG_MEMBER(orgId, userId));
+  }
+  async updateOrgMember(orgId, userId, role) {
+    return this.request("PATCH", ENDPOINTS.ORG_MEMBER(orgId, userId), { role });
+  }
+  // Member activity surfaces — chats the member participates in within this org,
+  // ordered by most recent activity. Powers the member profile Activity tab.
+  async getMemberChats(orgId, memberId, params) {
+    const q = {};
+    if (params?.cursor)
+      q.cursor = params.cursor;
+    if (params?.limit)
+      q.limit = String(params.limit);
+    return this.request("GET", ENDPOINTS.ORG_MEMBER_CHATS(orgId, memberId), void 0, q);
+  }
+  // Pending tasks (todo + in_progress) assigned to a member. Powers both
+  // member profile Activity and the agent startup catch-up flow.
+  async getMemberTasks(orgId, memberId, params) {
+    const q = {};
+    if (params?.cursor)
+      q.cursor = params.cursor;
+    if (params?.limit)
+      q.limit = String(params.limit);
+    return this.request("GET", ENDPOINTS.ORG_MEMBER_TASKS(orgId, memberId), void 0, q);
+  }
+  // ---- Invitations ----
+  async createInvitation(orgId, email, role) {
+    return this.request("POST", ENDPOINTS.ORG_INVITATIONS(orgId), { email, role });
+  }
+  async getOrgInvitations(orgId) {
+    const res = await this.request("GET", ENDPOINTS.ORG_INVITATIONS(orgId));
+    return res.data;
+  }
+  async revokeInvitation(orgId, invId) {
+    return this.request("DELETE", ENDPOINTS.ORG_INVITATION(orgId, invId));
+  }
+  async resendInvitation(orgId, invId) {
+    return this.request("POST", ENDPOINTS.ORG_INVITATION_RESEND(orgId, invId));
+  }
+  async getMyInvitations() {
+    const res = await this.request("GET", ENDPOINTS.MY_INVITATIONS);
+    return res.data;
+  }
+  async acceptInvitation(id) {
+    return this.request("POST", ENDPOINTS.INVITATION_ACCEPT(id));
+  }
+  async declineInvitation(id) {
+    return this.request("POST", ENDPOINTS.INVITATION_DECLINE(id));
+  }
+  async getInvitationByToken(token) {
+    return this.request("GET", ENDPOINTS.INVITATION_BY_TOKEN(token));
+  }
+  // ---- Direct Messages (org-scoped) ----
+  async sendDirectMessage(orgId, req) {
+    return this.request("POST", ENDPOINTS.DM(orgId), req);
+  }
+  /** Create the onboarding agent's DM and seed the intro message.
+   *  Call after confirming the agent is online so the chat only appears
+   *  once the agent can actually respond. */
+  async seedOnboardingDM(orgId) {
+    return this.request("POST", ENDPOINTS.SEED_ONBOARDING_DM(orgId));
+  }
+  /** Record that the user has dismissed the onboarding popup for this org.
+   *  Once dismissed, the popup never auto-shows again. */
+  async dismissOnboarding(orgId) {
+    await this.request("POST", ENDPOINTS.DISMISS_ONBOARDING(orgId));
+  }
+  // ---- Chats (org-scoped) ----
+  async createChat(orgId, req) {
+    return this.request("POST", ENDPOINTS.CHATS(orgId), req);
+  }
+  async getChats(orgId, params) {
+    return this.request("GET", ENDPOINTS.CHATS(orgId), void 0, params);
+  }
+  async getChat(orgId, chatId) {
+    return this.request("GET", ENDPOINTS.CHAT(orgId, chatId));
+  }
+  async updateChat(orgId, chatId, data) {
+    return this.request("PATCH", ENDPOINTS.CHAT(orgId, chatId), data);
+  }
+  async getDiscoverableChats(orgId, params) {
+    const res = await this.request("GET", ENDPOINTS.CHATS_DISCOVERABLE(orgId), void 0, params);
+    return res.data;
+  }
+  async joinChat(orgId, chatId) {
+    return this.request("POST", ENDPOINTS.CHAT_JOIN(orgId, chatId));
+  }
+  async deleteChat(orgId, chatId, opts) {
+    return this.request("DELETE", ENDPOINTS.CHAT(orgId, chatId), void 0, opts?.force ? { force: "true" } : void 0);
+  }
+  async archiveChat(orgId, chatId) {
+    return this.request("POST", ENDPOINTS.CHAT_ARCHIVE(orgId, chatId));
+  }
+  async restoreChat(orgId, chatId) {
+    return this.request("POST", ENDPOINTS.CHAT_RESTORE(orgId, chatId));
+  }
+  // ---- Chat Members ----
+  async getChatMembers(orgId, chatId) {
+    const res = await this.request("GET", ENDPOINTS.CHAT_MEMBERS(orgId, chatId));
+    return res.data;
+  }
+  async addChatMember(orgId, chatId, userId, role) {
+    return this.request("POST", ENDPOINTS.CHAT_MEMBERS(orgId, chatId), { user_id: userId, role });
+  }
+  async removeChatMember(orgId, chatId, userId) {
+    return this.request("DELETE", ENDPOINTS.CHAT_MEMBER(orgId, chatId, userId));
+  }
+  async updateChatMemberRole(orgId, chatId, userId, role) {
+    return this.request("PATCH", ENDPOINTS.CHAT_MEMBER(orgId, chatId, userId), { role });
+  }
+  async updateChatMember(orgId, chatId, userId, req) {
+    return this.request("PATCH", ENDPOINTS.CHAT_MEMBER(orgId, chatId, userId), req);
+  }
+  async transferChatOwnership(orgId, chatId, req) {
+    return this.request("POST", ENDPOINTS.CHAT_TRANSFER_OWNERSHIP(orgId, chatId), req);
+  }
+  // ---- Messages ----
+  async sendMessage(orgId, chatId, req) {
+    return this.request("POST", ENDPOINTS.CHAT_MESSAGES(orgId, chatId), req);
+  }
+  async getMessages(orgId, chatId, params) {
+    return this.request("GET", ENDPOINTS.CHAT_MESSAGES(orgId, chatId), void 0, params);
+  }
+  async getMessage(id) {
+    return this.request("GET", ENDPOINTS.MESSAGE(id));
+  }
+  async editMessage(id, content) {
+    return this.request("PATCH", ENDPOINTS.MESSAGE(id), { content });
+  }
+  async deleteMessage(id) {
+    return this.request("DELETE", ENDPOINTS.MESSAGE(id));
+  }
+  async patchMessage(id, req) {
+    return this.request("POST", ENDPOINTS.MESSAGE_PATCHES(id), req);
+  }
+  async getMessageReplies(id, params) {
+    return this.request("GET", ENDPOINTS.MESSAGE_REPLIES(id), void 0, params);
+  }
+  // ---- File Upload ----
+  async getUploadPresignUrl(orgId, req) {
+    return this.request("POST", ENDPOINTS.UPLOAD_PRESIGN(orgId), req);
+  }
+  async completeUpload(orgId, attachmentId) {
+    return this.request("POST", ENDPOINTS.UPLOAD_COMPLETE(orgId), { attachment_id: attachmentId });
+  }
+  async getFileUrl(id) {
+    return this.request("GET", ENDPOINTS.FILE(id));
+  }
+  // ---- Approvals ----
+  async getApproval(id) {
+    return this.request("GET", ENDPOINTS.APPROVAL(id));
+  }
+  async requestApproval(orgId, req) {
+    return this.request("POST", ENDPOINTS.APPROVAL_REQUESTS(orgId), req);
+  }
+  async decideApproval(id, decision) {
+    return this.request("POST", ENDPOINTS.APPROVAL_DECIDE(id), { decision });
+  }
+  async cancelApproval(id) {
+    return this.request("POST", ENDPOINTS.APPROVAL_CANCEL(id));
+  }
+  async getPendingApprovals() {
+    const res = await this.request("GET", ENDPOINTS.APPROVALS_PENDING);
+    return res.data;
+  }
+  async getApprovableActions() {
+    const res = await this.request("GET", ENDPOINTS.APPROVALS_ACTIONS);
+    return res.data;
+  }
+  // ---- Agents (org-scoped) ----
+  async createAgent(orgId, req, opts) {
+    return this.request("POST", ENDPOINTS.AGENTS(orgId), req, void 0, false, opts);
+  }
+  async getAgents(orgId) {
+    const res = await this.request("GET", ENDPOINTS.AGENTS(orgId));
+    return res.data;
+  }
+  async updateAgent(orgId, agentId, data) {
+    return this.request("PATCH", ENDPOINTS.AGENT(orgId, agentId), data);
+  }
+  /**
+   * Read the redacted per-agent provider config. Admin-only — the
+   * agents list deliberately omits `provider_config` to avoid leaking
+   * topology metadata (base URL → provider / tenant) to non-admins,
+   * so this dedicated endpoint is the only read path.
+   */
+  async getAgentProviderConfig(orgId, agentId) {
+    return this.request("GET", ENDPOINTS.AGENT_PROVIDER_CONFIG(orgId, agentId));
+  }
+  /**
+   * Update per-agent credential / endpoint overrides. Admin-only on the
+   * server side. Env changes only take effect after the operator
+   * recreates the agent Pod — this call just persists to the DB.
+   */
+  async updateAgentProviderConfig(orgId, agentId, req) {
+    return this.request("PATCH", ENDPOINTS.AGENT_PROVIDER_CONFIG(orgId, agentId), req);
+  }
+  async deleteAgent(orgId, agentId) {
+    return this.request("DELETE", ENDPOINTS.AGENT(orgId, agentId));
+  }
+  async createAgentApiKey(orgId, agentId) {
+    return this.request("POST", ENDPOINTS.AGENT_API_KEYS(orgId, agentId));
+  }
+  async revokeAgentApiKey(orgId, agentId, key) {
+    return this.request("DELETE", ENDPOINTS.AGENT_API_KEY(orgId, agentId, key));
+  }
+  async getAgentActivity(orgId, agentId, params) {
+    const res = await this.request("GET", ENDPOINTS.AGENT_ACTIVITY(orgId, agentId), void 0, params);
+    return res.data;
+  }
+  async getAgentMonitor(orgId, agentId) {
+    const res = await this.request("GET", ENDPOINTS.AGENT_MONITOR(orgId, agentId));
+    return res.data;
+  }
+  // ---- Agent Bootstrap (self) ----
+  async getAgentMe(orgId) {
+    return this.request("GET", ENDPOINTS.AGENT_ME(orgId));
+  }
+  // ---- Agent Sessions (org-scoped) ----
+  async createAgentSession(orgId, agentId, req) {
+    return this.request("POST", ENDPOINTS.AGENT_SESSIONS(orgId, agentId), req);
+  }
+  /**
+   * List agent sessions.
+   * @param params.status - Comma-separated status filter (e.g., `'open'`).
+   */
+  async getAgentSessions(orgId, agentId, params) {
+    const res = await this.request("GET", ENDPOINTS.AGENT_SESSIONS(orgId, agentId), void 0, params);
+    return res.data;
+  }
+  async getAgentSession(orgId, agentId, sessionId) {
+    return this.request("GET", ENDPOINTS.AGENT_SESSION(orgId, agentId, sessionId));
+  }
+  async updateAgentSession(orgId, agentId, sessionId, req) {
+    return this.request("PATCH", ENDPOINTS.AGENT_SESSION(orgId, agentId, sessionId), req);
+  }
+  async createAgentStep(orgId, agentId, sessionId, req) {
+    return this.request("POST", ENDPOINTS.AGENT_SESSION_STEPS(orgId, agentId, sessionId), req);
+  }
+  async getAgentSessionSteps(orgId, agentId, sessionId, params) {
+    const res = await this.request("GET", ENDPOINTS.AGENT_SESSION_STEPS(orgId, agentId, sessionId), void 0, params);
+    return res.data;
+  }
+  async getAgentSessionStep(orgId, agentId, sessionId, stepId) {
+    return this.request("GET", ENDPOINTS.AGENT_SESSION_STEP(orgId, agentId, sessionId, stepId));
+  }
+  // ---- Agent runtime auth (hosted Claude OAuth) ----
+  async getAgentRuntimeAuth(orgId, agentId) {
+    return this.request("GET", ENDPOINTS.AGENT_RUNTIME_AUTH(orgId, agentId));
+  }
+  async startAgentRuntimeAuthSession(orgId, agentId, req = {}) {
+    return this.request("POST", ENDPOINTS.AGENT_RUNTIME_AUTH_SESSIONS(orgId, agentId), req);
+  }
+  async completeAgentRuntimeAuthSession(orgId, agentId, sessionId, req) {
+    return this.request("POST", ENDPOINTS.AGENT_RUNTIME_AUTH_SESSION_COMPLETE(orgId, agentId, sessionId), req);
+  }
+  async disconnectAgentRuntimeAuth(orgId, agentId) {
+    return this.request("DELETE", ENDPOINTS.AGENT_RUNTIME_AUTH(orgId, agentId));
+  }
+  // ---- Agent runtime update mode (hot-update) ----
+  async getAgentRuntime(orgId, agentId) {
+    return this.request("GET", ENDPOINTS.AGENT_RUNTIME(orgId, agentId));
+  }
+  async setAgentRuntimeMode(orgId, agentId, req) {
+    return this.request("PATCH", ENDPOINTS.AGENT_RUNTIME(orgId, agentId), req);
+  }
+  async upgradeAgentRuntime(orgId, agentId) {
+    return this.request("POST", ENDPOINTS.AGENT_RUNTIME_UPGRADE(orgId, agentId));
+  }
+  async listAgentRuntimeTags(orgId, agentId) {
+    return this.request("GET", ENDPOINTS.AGENT_RUNTIME_AVAILABLE_TAGS(orgId, agentId));
+  }
+  async getAgentRuntimeRelease(orgId, agentId, tag) {
+    return this.request("GET", ENDPOINTS.AGENT_RUNTIME_RELEASE(orgId, agentId, tag));
+  }
+  /** Fetch all pending tasks (todo/in_progress) assigned to an agent. Pages automatically. */
+  async getAgentTasks(orgId, agentId) {
+    const all = [];
+    let cursor;
+    do {
+      const params = { limit: "100" };
+      if (cursor)
+        params.cursor = cursor;
+      const res = await this.request("GET", ENDPOINTS.AGENT_TASKS(orgId, agentId), void 0, params);
+      all.push(...res.data);
+      cursor = res.has_more ? res.next_cursor : void 0;
+    } while (cursor);
+    return all;
+  }
+  // ---- Machines (org-scoped) ----
+  async getMachines(orgId) {
+    const res = await this.request("GET", ENDPOINTS.MACHINES(orgId));
+    return res.data;
+  }
+  async getMachine(orgId, machineId) {
+    return this.request("GET", ENDPOINTS.MACHINE(orgId, machineId));
+  }
+  async deleteMachine(orgId, machineId) {
+    return this.request("DELETE", ENDPOINTS.MACHINE(orgId, machineId));
+  }
+  async startMachine(orgId, machineId) {
+    return this.request("POST", ENDPOINTS.MACHINE_START(orgId, machineId));
+  }
+  async stopMachine(orgId, machineId) {
+    return this.request("POST", ENDPOINTS.MACHINE_STOP(orgId, machineId));
+  }
+  async getMachineStatus(orgId, machineId) {
+    return this.request("GET", ENDPOINTS.MACHINE_STATUS(orgId, machineId));
+  }
+  async getMachineLogs(orgId, machineId, lines = 100) {
+    return this.request("GET", ENDPOINTS.MACHINE_LOGS(orgId, machineId), void 0, { lines });
+  }
+  async restartMachine(orgId, machineId) {
+    return this.request("POST", ENDPOINTS.MACHINE_RESTART(orgId, machineId));
+  }
+  async restartAllMachines(orgId) {
+    return this.request("POST", ENDPOINTS.MACHINE_RESTART_ALL(orgId));
+  }
+  // ---- Daemon-mode Machine management (org-scoped, user auth) ----
+  /**
+   * Create a new daemon-mode Machine. Returns the Machine row + one-shot
+   * mck_ token. The UI uses this when the user clicks "Create Workspace".
+   */
+  async createMachine(orgId, opts) {
+    return this.request("POST", ENDPOINTS.MACHINES(orgId), opts);
+  }
+  /**
+   * Returns only daemon_mode=true machines (non-terminated). Backs the
+   * "Workspaces" UI list. Legacy 1:1 machines are excluded.
+   */
+  async getDaemonMachines(orgId) {
+    const all = await this.getMachines(orgId);
+    return all.filter((m) => m.daemon_mode && m.status !== "terminated");
+  }
+  /** Attach an agent to a daemon-mode Machine. */
+  async attachAgent(orgId, machineId, agentId, opts) {
+    return this.request("POST", ENDPOINTS.MACHINE_ATTACH_AGENT(orgId, machineId, agentId), opts);
+  }
+  /** Detach an agent from a daemon-mode Machine. */
+  async detachAgent(orgId, machineId, agentId) {
+    return this.request("DELETE", ENDPOINTS.MACHINE_DETACH_AGENT(orgId, machineId, agentId));
+  }
+  /** Get machine-level runtime auth state. */
+  async getMachineRuntimeAuth(orgId, machineId) {
+    return this.request("GET", ENDPOINTS.MACHINE_RUNTIME_AUTH(orgId, machineId));
+  }
+  // ---- Machine self-control-plane (mck_-scoped) ----
+  //
+  // The four methods below are intended to be called from a daemon-mode
+  // Machine using its `mck_*` bearer as the API key. They identify the
+  // Machine implicitly via the bearer; there is no `machineId` parameter.
+  // Calling them with a JWT or `agk_` will get a 401 from the server's
+  // RequireMachineAuth middleware.
+  /** `GET /machines/me` — returns the calling Machine's own row. */
+  async getMachineSelf() {
+    return this.request("GET", ENDPOINTS.MACHINES_ME);
+  }
+  /**
+   * `GET /machines/me/agents` — enumerate the AgentProfiles attached to
+   * the calling Machine. The supervisor uses this list to decide which
+   * per-agent runtime subprocesses to keep alive.
+   */
+  async listAttachedAgents() {
+    const res = await this.request("GET", ENDPOINTS.MACHINES_ME_AGENTS);
+    return res.data;
+  }
+  /**
+   * `POST /machines/me/health` — bump the Machine's `updated_at` to now.
+   * Body is intentionally empty; the server ignores any payload. The
+   * daemon should call this on a fixed cadence (e.g. every 30s) so an
+   * external observer can detect a wedged supervisor.
+   */
+  async postMachineHeartbeat() {
+    return this.request("POST", ENDPOINTS.MACHINES_ME_HEALTH);
+  }
+  /**
+   * `POST /machines/me/agents/{agentId}/launch-credential` — mint a
+   * short-lived `agk_*` for one of this Machine's attached agents. The
+   * daemon uses the returned `api_key` as `PRLL_API_KEY` for that
+   * agent's subprocess. Server returns 404 if the agent isn't
+   * attached to the calling Machine, or 410-equivalent if the agent
+   * was suspended.
+   */
+  async mintLaunchCredential(agentId) {
+    return this.request("POST", ENDPOINTS.MACHINES_ME_AGENT_LAUNCH_CREDENTIAL(agentId));
+  }
+  async getMachineWsTicket() {
+    return this.request("POST", ENDPOINTS.MACHINES_ME_WS_TICKET);
+  }
+  async resizeMachine(orgId, machineId, spec) {
+    return this.request("PATCH", ENDPOINTS.MACHINE_SPEC(orgId, machineId), spec);
+  }
+  /** Create a new machine key. Returns the raw key string (shown once) + metadata. */
+  async createMachineKey(orgId, machineId, name) {
+    return this.request("POST", ENDPOINTS.MACHINE_KEYS(orgId, machineId), name ? { name } : void 0);
+  }
+  /** Revoke (soft-delete) a machine key by ID. */
+  async revokeMachineKey(orgId, machineId, keyId) {
+    return this.request("DELETE", ENDPOINTS.MACHINE_KEY(orgId, machineId, keyId));
+  }
+  // Wiki mount/token methods removed — wiki-service handles all wiki endpoints.
+  // ---- Unread ----
+  async getUnreadCounts(orgId) {
+    const endpoint = orgId ? ENDPOINTS.ORG_UNREAD(orgId) : ENDPOINTS.UNREAD;
+    const res = await this.request("GET", endpoint);
+    return res.data;
+  }
+  async markRead(orgId, chatId, messageId) {
+    return this.request("POST", ENDPOINTS.CHAT_READ(orgId, chatId), { message_id: messageId });
+  }
+  // ---- Inbox ----
+  async getInbox(orgId, params) {
+    return this.request("GET", ENDPOINTS.INBOX(orgId), void 0, params);
+  }
+  async getInboxUnreadCount(orgId) {
+    return this.request("GET", ENDPOINTS.INBOX_UNREAD_COUNT(orgId));
+  }
+  async markInboxRead(orgId, id) {
+    return this.request("PATCH", ENDPOINTS.INBOX_ITEM_READ(orgId, id));
+  }
+  async markInboxUnread(orgId, id) {
+    return this.request("PATCH", ENDPOINTS.INBOX_ITEM_UNREAD(orgId, id));
+  }
+  async archiveInboxItem(orgId, id) {
+    return this.request("PATCH", ENDPOINTS.INBOX_ITEM_ARCHIVE(orgId, id));
+  }
+  // snoozeInboxItem / unsnoozeInboxItem deferred until un-snooze cron worker is implemented
+  async markAllInboxRead(orgId) {
+    return this.request("POST", ENDPOINTS.INBOX_MARK_ALL_READ(orgId));
+  }
+  async archiveAllInbox(orgId) {
+    return this.request("POST", ENDPOINTS.INBOX_ARCHIVE_ALL(orgId));
+  }
+  /** Mark an inbox item as read by its source (source_type + source_id) rather than inbox item ID. */
+  async ackInbox(orgId, source) {
+    return this.request("POST", ENDPOINTS.INBOX_ACK(orgId), source);
+  }
+  async deleteInboxItem(orgId, id) {
+    return this.request("DELETE", ENDPOINTS.INBOX_ITEM(orgId, id));
+  }
+  // ---- Dispatch (agent event delivery) ----
+  async getDispatch(orgId, params) {
+    return this.request("GET", ENDPOINTS.DISPATCH(orgId), void 0, params);
+  }
+  async getDispatchPendingCount(orgId) {
+    return this.request("GET", ENDPOINTS.DISPATCH_PENDING_COUNT(orgId));
+  }
+  async ackDispatch(orgId, source) {
+    return this.request("POST", ENDPOINTS.DISPATCH_ACK(orgId), source);
+  }
+  async ackDispatchByID(orgId, id) {
+    return this.request("POST", ENDPOINTS.DISPATCH_ACK_BY_ID(orgId, id));
+  }
+  // ---- Platform Config ----
+  /**
+   * Fetch platform config for the authenticated agent.
+   * Pass currentVersion to enable conditional fetch (If-None-Match / 304).
+   * Returns null when the server responds with 304 (config unchanged).
+   */
+  async getPlatformConfig(currentVersion) {
+    const url = `${this.baseUrl}${ENDPOINTS.PLATFORM_CONFIG}`;
+    const extra = {};
+    if (currentVersion !== void 0) {
+      extra["If-None-Match"] = currentVersion;
+    }
+    const headers = this.buildHeaders(extra);
+    let res;
+    try {
+      res = await fetch(url, {
+        method: "GET",
+        headers,
+        signal: AbortSignal.timeout(15e3)
+      });
+    } catch (err) {
+      throw _ParallClient.normalizeFetchError(err);
+    }
+    if (res.status === 304)
+      return null;
+    if (!res.ok) {
+      const rawErrorBody = await res.json().catch(() => ({}));
+      const errorBody = rawErrorBody !== null && typeof rawErrorBody === "object" ? rawErrorBody : {};
+      const errorObj = errorBody?.error && typeof errorBody.error === "object" ? errorBody.error : void 0;
+      const errMsg = errorObj?.message ?? (typeof errorBody?.error === "string" ? errorBody.error : void 0);
+      const errCode = errorObj?.code ?? (typeof errorBody?.code === "string" ? errorBody.code : void 0);
+      const apiError = new ApiError(res.status, errMsg ?? res.statusText, errCode);
+      const { error: _e, code: _c, message: _m, ...extras } = errorBody;
+      if (Object.keys(extras).length > 0)
+        apiError.extras = extras;
+      throw apiError;
+    }
+    return res.json();
+  }
+  // ---- Tasks (org-scoped) ----
+  async createTask(orgId, data) {
+    return this.request("POST", ENDPOINTS.TASKS(orgId), data);
+  }
+  async getTasks(orgId, params) {
+    return this.request("GET", ENDPOINTS.TASKS(orgId), void 0, params);
+  }
+  async getTask(orgId, taskId) {
+    return this.request("GET", ENDPOINTS.TASK(orgId, taskId));
+  }
+  async updateTask(orgId, taskId, data) {
+    return this.request("PATCH", ENDPOINTS.TASK(orgId, taskId), data);
+  }
+  async deleteTask(orgId, taskId, opts) {
+    return this.request("DELETE", ENDPOINTS.TASK(orgId, taskId), void 0, opts?.force ? { force: "true" } : void 0);
+  }
+  async archiveTask(orgId, taskId) {
+    return this.request("POST", ENDPOINTS.TASK_ARCHIVE(orgId, taskId));
+  }
+  async restoreTask(orgId, taskId) {
+    return this.request("POST", ENDPOINTS.TASK_RESTORE(orgId, taskId));
+  }
+  async watchTask(orgId, taskId) {
+    return this.request("POST", ENDPOINTS.TASK_WATCH(orgId, taskId));
+  }
+  async unwatchTask(orgId, taskId) {
+    return this.request("DELETE", ENDPOINTS.TASK_WATCH(orgId, taskId));
+  }
+  async getTaskWatchers(orgId, taskId) {
+    const res = await this.request("GET", ENDPOINTS.TASK_WATCHERS(orgId, taskId));
+    return res.data;
+  }
+  async getSubtasks(orgId, taskId) {
+    const res = await this.request("GET", ENDPOINTS.TASK_SUBTASKS(orgId, taskId));
+    return res.data;
+  }
+  async createTaskRelation(orgId, taskId, data) {
+    return this.request("POST", ENDPOINTS.TASK_RELATIONS(orgId, taskId), data);
+  }
+  async getTaskRelations(orgId, taskId) {
+    const res = await this.request("GET", ENDPOINTS.TASK_RELATIONS(orgId, taskId));
+    return res.data;
+  }
+  async listTaskRelationsByTarget(orgId, params) {
+    const query = new URLSearchParams({
+      target_type: params.target_type,
+      target_id: params.target_id
+    });
+    const res = await this.request("GET", `${ENDPOINTS.TASK_RELATIONS_BY_TARGET(orgId)}?${query.toString()}`);
+    return res.data;
+  }
+  async deleteTaskRelation(orgId, taskId, relationId) {
+    return this.request("DELETE", ENDPOINTS.TASK_RELATION(orgId, taskId, relationId));
+  }
+  // ---- Task Comments ----
+  async getTaskComments(orgId, taskId, params) {
+    return this.request("GET", ENDPOINTS.TASK_COMMENTS(orgId, taskId), void 0, params);
+  }
+  async getTaskComment(orgId, taskId, commentId) {
+    return this.request("GET", ENDPOINTS.TASK_COMMENT(orgId, taskId, commentId));
+  }
+  async createTaskComment(orgId, taskId, data) {
+    return this.request("POST", ENDPOINTS.TASK_COMMENTS(orgId, taskId), data);
+  }
+  async updateTaskComment(orgId, taskId, commentId, data) {
+    return this.request("PATCH", ENDPOINTS.TASK_COMMENT(orgId, taskId, commentId), data);
+  }
+  async deleteTaskComment(orgId, taskId, commentId) {
+    return this.request("DELETE", ENDPOINTS.TASK_COMMENT(orgId, taskId, commentId));
+  }
+  // ---- Task Activities ----
+  async getTaskActivities(orgId, taskId, params) {
+    return this.request("GET", ENDPOINTS.TASK_ACTIVITIES(orgId, taskId), void 0, params);
+  }
+  // ---- Projects (org-scoped) ----
+  async createProject(orgId, data) {
+    return this.request("POST", ENDPOINTS.PROJECTS(orgId), data);
+  }
+  async getProjects(orgId) {
+    const res = await this.request("GET", ENDPOINTS.PROJECTS(orgId));
+    return res.data;
+  }
+  async getProject(orgId, projectId) {
+    return this.request("GET", ENDPOINTS.PROJECT(orgId, projectId));
+  }
+  async updateProject(orgId, projectId, data) {
+    return this.request("PATCH", ENDPOINTS.PROJECT(orgId, projectId), data);
+  }
+  async deleteProject(orgId, projectId) {
+    return this.request("DELETE", ENDPOINTS.PROJECT(orgId, projectId));
+  }
+  // ---- Schedules (org-scoped) ----
+  async createSchedule(orgId, input) {
+    return this.request("POST", ENDPOINTS.SCHEDULES(orgId), input);
+  }
+  async listSchedules(orgId, filters) {
+    return this.request("GET", ENDPOINTS.SCHEDULES(orgId), void 0, filters);
+  }
+  async getSchedule(orgId, scheduleId) {
+    return this.request("GET", ENDPOINTS.SCHEDULE(orgId, scheduleId));
+  }
+  async updateSchedule(orgId, scheduleId, patch) {
+    return this.request("PATCH", ENDPOINTS.SCHEDULE(orgId, scheduleId), patch);
+  }
+  async pauseSchedule(orgId, scheduleId) {
+    return this.request("POST", ENDPOINTS.SCHEDULE_PAUSE(orgId, scheduleId));
+  }
+  async resumeSchedule(orgId, scheduleId) {
+    return this.request("POST", ENDPOINTS.SCHEDULE_RESUME(orgId, scheduleId));
+  }
+  async cancelSchedule(orgId, scheduleId) {
+    return this.request("POST", ENDPOINTS.SCHEDULE_CANCEL(orgId, scheduleId));
+  }
+  async deleteSchedule(orgId, scheduleId) {
+    return this.request("DELETE", ENDPOINTS.SCHEDULE(orgId, scheduleId));
+  }
+  async listScheduleRuns(orgId, scheduleId, filters) {
+    return this.request("GET", ENDPOINTS.SCHEDULE_RUNS(orgId, scheduleId), void 0, filters);
+  }
+  async getScheduleRun(orgId, runId) {
+    return this.request("GET", ENDPOINTS.SCHEDULE_RUN(orgId, runId));
+  }
+  // ---- Wikis (org-scoped) ----
+  async createWiki(orgId, data) {
+    return this.request("POST", ENDPOINTS.WIKIS(orgId), data);
+  }
+  async getWikis(orgId) {
+    const res = await this.request("GET", ENDPOINTS.WIKIS(orgId));
+    return res.data;
+  }
+  async getWiki(orgId, wikiId) {
+    return this.request("GET", ENDPOINTS.WIKI(orgId, wikiId));
+  }
+  async getWikiTree(orgId, wikiId, params) {
+    return this.request("GET", ENDPOINTS.WIKI_TREE(orgId, wikiId), void 0, params);
+  }
+  async getWikiBlob(orgId, wikiId, params) {
+    return this.request("GET", ENDPOINTS.WIKI_BLOB(orgId, wikiId), void 0, params);
+  }
+  async getWikiNodeSections(orgId, wikiId, params) {
+    return this.request("GET", ENDPOINTS.WIKI_NODE_SECTIONS(orgId, wikiId), void 0, params);
+  }
+  async searchWiki(orgId, wikiId, params) {
+    return this.request("GET", ENDPOINTS.WIKI_SEARCH(orgId, wikiId), void 0, params);
+  }
+  async getWikiPageIndex(orgId, wikiId, params) {
+    return this.request("GET", ENDPOINTS.WIKI_PAGE_INDEX(orgId, wikiId), void 0, params);
+  }
+  async getWikiRefs(orgId, wikiId, params) {
+    return this.request("GET", ENDPOINTS.WIKI_REFS(orgId, wikiId), void 0, params);
+  }
+  async checkWikiRefs(orgId, wikiId, params) {
+    return this.request("GET", ENDPOINTS.WIKI_REFS_CHECK(orgId, wikiId), void 0, params);
+  }
+  // Anchor-status: batch blob-SHA compare for inline-comment outdated judging.
+  // Refs the caller cannot read are silently dropped from the response.
+  async getWikiAnchorStatus(orgId, wikiId, body) {
+    return this.request("POST", ENDPOINTS.WIKI_ANCHOR_STATUS(orgId, wikiId), body);
+  }
+  async createWikiChangeset(orgId, wikiId, data) {
+    return normalizeWikiChangeset(await this.request("POST", ENDPOINTS.WIKI_CHANGESETS(orgId, wikiId), data));
+  }
+  async getWikiChangesets(orgId, wikiId) {
+    const res = await this.request("GET", ENDPOINTS.WIKI_CHANGESETS(orgId, wikiId));
+    return res.data.map(normalizeWikiChangeset);
+  }
+  async getWikiChangeset(orgId, wikiId, changesetId) {
+    return normalizeWikiChangeset(await this.request("GET", ENDPOINTS.WIKI_CHANGESET(orgId, wikiId, changesetId)));
+  }
+  async updateWikiChangeset(orgId, wikiId, changesetId, data) {
+    return normalizeWikiChangeset(await this.request("PATCH", ENDPOINTS.WIKI_CHANGESET(orgId, wikiId, changesetId), data));
+  }
+  async getWikiChangesetDiff(orgId, wikiId, changesetId) {
+    return this.request("GET", ENDPOINTS.WIKI_CHANGESET_DIFF(orgId, wikiId, changesetId));
+  }
+  async mergeWikiChangeset(orgId, wikiId, changesetId) {
+    return normalizeWikiChangeset(await this.request("POST", ENDPOINTS.WIKI_CHANGESET_MERGE(orgId, wikiId, changesetId)));
+  }
+  async closeWikiChangeset(orgId, wikiId, changesetId) {
+    return normalizeWikiChangeset(await this.request("POST", ENDPOINTS.WIKI_CHANGESET_CLOSE(orgId, wikiId, changesetId)));
+  }
+  // ---- Wiki Binary Upload / Delete (Phase 2 of wiki-file-storage-design) ----
+  /**
+   * Upload a binary file directly to the wiki's default branch (maintain
+   * scope). Size ≤ 1 MiB lands as an inline Git blob; > 1 MiB lands as a
+   * Git-LFS pointer backed by S3. Text files return 422 — they must go
+   * through createWikiChangeset / updateWikiChangeset.
+   */
+  async uploadWikiFile(orgId, wikiId, params) {
+    const fd = new FormData();
+    fd.append("path", params.path);
+    fd.append("file", params.file);
+    if (params.message)
+      fd.append("message", params.message);
+    return this.multipartRequest("POST", ENDPOINTS.WIKI_UPLOADS(orgId, wikiId), fd);
+  }
+  /**
+   * Upload a binary file into a changeset's feature branch (read scope +
+   * author-only). Used by reader flow: propose a changeset, attach
+   * binary, PATCH markdown that references it. On merge the binary
+   * squashes into the default branch.
+   */
+  async uploadWikiFileToChangeset(orgId, wikiId, changesetId, params) {
+    const fd = new FormData();
+    fd.append("path", params.path);
+    fd.append("file", params.file);
+    if (params.message)
+      fd.append("message", params.message);
+    return this.multipartRequest("POST", ENDPOINTS.WIKI_CHANGESET_FILES(orgId, wikiId, changesetId), fd);
+  }
+  /** Remove a binary file from the default branch. Text files must use a
+   * changeset delete action. The blob stays reachable via git history. */
+  async deleteWikiFile(orgId, wikiId, params) {
+    await this.request("DELETE", ENDPOINTS.WIKI_FILES(orgId, wikiId), void 0, { path: params.path, message: params.message });
+  }
+  /**
+   * Sign a short-lived (~5-min) URL the browser can paste into a media
+   * element src. ACL is evaluated here; the returned URL is a capability
+   * token — don't leak it.
+   */
+  async getWikiFilePreviewUrl(orgId, wikiId, params) {
+    return this.request("POST", ENDPOINTS.WIKI_FILE_PREVIEW_URL(orgId, wikiId), params);
+  }
+  // ---- Wiki Path Scopes (AFCS ACL) ----
+  async getWikiPathScopes(orgId, wikiId) {
+    const res = await this.request("GET", ENDPOINTS.WIKI_PATH_SCOPES(orgId, wikiId));
+    return res.data;
+  }
+  async createWikiPathScope(orgId, wikiId, data) {
+    return this.request("POST", ENDPOINTS.WIKI_PATH_SCOPES(orgId, wikiId), data);
+  }
+  async deleteWikiPathScope(orgId, wikiId, scopeId) {
+    await this.request("DELETE", ENDPOINTS.WIKI_PATH_SCOPE(orgId, wikiId, scopeId));
+  }
+  async getWikiAccessStatus(orgId, wikiId, path4) {
+    return this.request("GET", ENDPOINTS.WIKI_ACCESS_STATUS(orgId, wikiId), void 0, path4 ? { path: path4 } : void 0);
+  }
+  async createWikiAccessRequest(orgId, wikiId, data) {
+    await this.request("POST", ENDPOINTS.WIKI_ACCESS_REQUESTS(orgId, wikiId), data);
+  }
+  // ---- Wiki History (commits, file commits, blame) ----
+  async getWikiCommits(orgId, wikiId, params) {
+    return this.request("GET", ENDPOINTS.WIKI_COMMITS(orgId, wikiId), void 0, params);
+  }
+  async getWikiFileCommits(orgId, wikiId, path4, params) {
+    return this.request("GET", ENDPOINTS.WIKI_FILE_COMMITS(orgId, wikiId), void 0, { path: path4, ...params });
+  }
+  async getWikiBlame(orgId, wikiId, path4, ref) {
+    return this.request("GET", ENDPOINTS.WIKI_BLAME(orgId, wikiId), void 0, { path: path4, ref });
+  }
+  // ---- Wiki Operations (audit log) ----
+  async getWikiOperations(orgId, wikiId, params) {
+    return this.request("GET", ENDPOINTS.WIKI_OPERATIONS(orgId, wikiId), void 0, params);
+  }
+  async revertWikiOperation(orgId, wikiId, opId) {
+    return this.request("POST", ENDPOINTS.WIKI_OPERATION_REVERT(orgId, wikiId, opId));
+  }
+  // ---- Unified Comments ----
+  async getComments(orgId, params) {
+    return this.request("GET", ENDPOINTS.COMMENTS(orgId), void 0, params);
+  }
+  async getComment(orgId, commentId) {
+    return this.request("GET", ENDPOINTS.COMMENT(orgId, commentId));
+  }
+  async createComment(orgId, data) {
+    return this.request("POST", ENDPOINTS.COMMENTS(orgId), data);
+  }
+  async updateComment(orgId, commentId, data) {
+    return this.request("PATCH", ENDPOINTS.COMMENT(orgId, commentId), data);
+  }
+  async deleteComment(orgId, commentId) {
+    return this.request("DELETE", ENDPOINTS.COMMENT(orgId, commentId));
+  }
+  // ---- References ----
+  async resolveRefs(orgId, refs, options) {
+    const body = { refs };
+    if (options?.sourceMessageId) {
+      body.source_message_id = options.sourceMessageId;
+    }
+    return this.request("POST", ENDPOINTS.REFS_RESOLVE(orgId), body);
+  }
+  async getBacklinks(orgId, params) {
+    return this.request("GET", ENDPOINTS.REFS_BACKLINKS(orgId), void 0, params);
+  }
+  async checkBrokenRefs(orgId) {
+    return this.request("GET", ENDPOINTS.REFS_CHECK(orgId));
+  }
+  // ---- Push Notifications ----
+  async subscribePush(body) {
+    return this.request("POST", ENDPOINTS.PUSH_SUBSCRIBE, body);
+  }
+  async unsubscribePush(token) {
+    return this.request("DELETE", ENDPOINTS.PUSH_UNSUBSCRIBE, { token });
+  }
+  async getVapidKey() {
+    return this.request("GET", ENDPOINTS.PUSH_VAPID_KEY);
+  }
+  // ---- Notification Preferences ----
+  async getNotificationPreferences() {
+    return this.request("GET", ENDPOINTS.NOTIFICATION_PREFERENCES);
+  }
+  async updateNotificationPreferences(prefs) {
+    return this.request("PATCH", ENDPOINTS.NOTIFICATION_PREFERENCES, { prefs });
+  }
+  // ---- Feature Flags (org-scoped, server-evaluated) ----
+  async getFeatureFlags(orgId) {
+    return this.request("GET", ENDPOINTS.FEATURE_FLAGS(orgId));
+  }
+  // ---- Billing & Credits (org-scoped) ----
+  async getBilling(orgId) {
+    return this.request("GET", ENDPOINTS.BILLING(orgId));
+  }
+  async listBillingTransactions(orgId, opts) {
+    const params = new URLSearchParams();
+    if (opts?.cursor)
+      params.set("cursor", opts.cursor);
+    if (opts?.limit)
+      params.set("limit", String(opts.limit));
+    if (opts?.types?.length)
+      params.set("types", opts.types.join(","));
+    if (opts?.user_id)
+      params.set("user_id", opts.user_id);
+    if (opts?.unresolved_actor)
+      params.set("unresolved_actor", "true");
+    if (opts?.machine_id)
+      params.set("machine_id", opts.machine_id);
+    if (opts?.unresolved_machine)
+      params.set("unresolved_machine", "true");
+    const qs = params.toString();
+    return this.request("GET", `${ENDPOINTS.BILLING_TRANSACTIONS(orgId)}${qs ? `?${qs}` : ""}`);
+  }
+  async listBillingTransactionAgentGroups(orgId) {
+    return this.request("GET", `${ENDPOINTS.BILLING_TRANSACTIONS(orgId)}?group_by=agent`);
+  }
+  async listBillingTransactionMachineGroups(orgId) {
+    return this.request("GET", `${ENDPOINTS.BILLING_TRANSACTIONS(orgId)}?group_by=machine`);
+  }
+  async createCheckout(orgId, req) {
+    return this.request("POST", ENDPOINTS.BILLING_CHECKOUT(orgId), req);
+  }
+  /**
+   * Creates a Stripe-hosted card-collection session (Checkout in mode=setup)
+   * and returns the redirect URL. The frontend navigates to `setup_url` and
+   * Stripe handles the card form; the resulting payment_method is recorded
+   * server-side via the `setup_intent.succeeded` webhook. Mirrors
+   * `POST /billing/setup-intent`.
+   */
+  async createSetupIntent(orgId) {
+    return this.request("POST", ENDPOINTS.BILLING_SETUP_INTENT(orgId));
+  }
+  async getAutoReloadSettings(orgId) {
+    return this.request("GET", ENDPOINTS.BILLING_AUTO_RELOAD(orgId));
+  }
+  async updateAutoReloadSettings(orgId, req) {
+    return this.request("PUT", ENDPOINTS.BILLING_AUTO_RELOAD(orgId), req);
+  }
+  // The admin grant endpoints (POST/GET /internal/admin/orgs/
+  // {id}/grants) intentionally do NOT live on this public client — they
+  // are mounted on the unauthenticated `/internal/*` surface and reachable
+  // only via internal network paths. The admin dashboard maintains its
+  // own thin client (`ts/admin/lib/api.ts`) that hits these directly.
+  async getComputePricing() {
+    const resp = await this.request("GET", ENDPOINTS.COMPUTE_PRICING());
+    return resp.data;
+  }
+};
+function normalizeWikiChangeset(changeset) {
+  return {
+    ...changeset,
+    changed_paths: changeset.changed_paths ?? [],
+    file_changes: changeset.file_changes ?? []
+  };
+}
+var ApiError = class extends Error {
+  status;
+  code;
+  extras;
+  constructor(status, message, code) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.name = "ApiError";
+  }
+};
+
+// ts/sdk/dist/ws.js
+var ParallWs = class {
+  ws = null;
+  options;
+  listeners = /* @__PURE__ */ new Map();
+  stateListeners = /* @__PURE__ */ new Set();
+  heartbeatTimer = null;
+  reconnectTimer = null;
+  reconnectAttempts = 0;
+  lastSeq = 0;
+  _state = "disconnected";
+  intentionalClose = false;
+  lastReceivedAt = 0;
+  heartbeatIntervalMs = 0;
+  probeTimer = null;
+  browserListenersActive = false;
+  constructor(options) {
+    this.options = {
+      reconnect: true,
+      reconnectInterval: 1e3,
+      maxReconnectInterval: 3e4,
+      ...options
+    };
+    this.lastSeq = options.lastSeq ?? 0;
+  }
+  get state() {
+    return this._state;
+  }
+  async connect() {
+    this.intentionalClose = false;
+    this.setupBrowserListeners();
+    this.setState("connecting");
+    let ticket;
+    try {
+      ticket = await this.options.getTicket();
+    } catch (err) {
+      console.error("Failed to get WS ticket:", err);
+      if (this.options.reconnect) {
+        this.scheduleReconnect();
+      } else {
+        this.setState("disconnected");
+      }
+      return;
+    }
+    const wsUrl = ticket.ws_url || this.options.wsUrl;
+    if (!wsUrl) {
+      console.error("No WS URL available");
+      this.setState("disconnected");
+      return;
+    }
+    const url = new URL(wsUrl);
+    url.searchParams.set("ticket", ticket.ticket);
+    if (this.lastSeq > 0) {
+      url.searchParams.set("last_seq", String(this.lastSeq));
+    }
+    this.ws = new WebSocket(url.toString());
+    const ws = this.ws;
+    const connectTimeout = setTimeout(() => {
+      if (this._state === "connected" || this.intentionalClose)
+        return;
+      ws.onclose = null;
+      ws.onopen = null;
+      ws.onerror = null;
+      try {
+        ws.close();
+      } catch {
+      }
+      if (ws !== this.ws)
+        return;
+      if (this.options.reconnect) {
+        this.scheduleReconnect();
+      } else {
+        this.setState("disconnected");
+      }
+    }, 15e3);
+    this.ws.onopen = () => {
+      clearTimeout(connectTimeout);
+      this.reconnectAttempts = 0;
+      this.lastReceivedAt = Date.now();
+      this.setState("connected");
+    };
+    this.ws.onmessage = (event) => {
+      try {
+        const frame = JSON.parse(event.data);
+        this.handleFrame(frame);
+      } catch {
+      }
+    };
+    this.ws.onclose = () => {
+      clearTimeout(connectTimeout);
+      this.stopHeartbeat();
+      this.clearProbe();
+      if (this.intentionalClose) {
+        this.setState("disconnected");
+        return;
+      }
+      if (this.options.reconnect) {
+        this.scheduleReconnect();
+      } else {
+        this.setState("disconnected");
+      }
+    };
+    this.ws.onerror = () => {
+    };
+  }
+  disconnect() {
+    this.intentionalClose = true;
+    this.stopHeartbeat();
+    this.clearReconnect();
+    this.clearProbe();
+    this.teardownBrowserListeners();
+    if (this.ws) {
+      this.ws.close();
+      this.ws = null;
+    }
+    this.setState("disconnected");
+  }
+  // ---- Client -> Server messages ----
+  /** Tell the server which chats the user is currently viewing (no auth implications). */
+  watch(chatIds) {
+    this.send({ type: WS_EVENTS.WATCH, data: { chat_ids: chatIds } });
+  }
+  sendTyping(chatId, action, threadRootId) {
+    this.send({
+      type: WS_EVENTS.TYPING,
+      data: { chat_id: chatId, thread_root_id: threadRootId ?? null, action }
+    });
+  }
+  /** Send an agent heartbeat with telemetry data. */
+  sendAgentHeartbeat(sessionId, telemetry) {
+    this.send({
+      type: WS_EVENTS.AGENT_HEARTBEAT,
+      data: { session_id: sessionId, telemetry }
+    });
+  }
+  sendEvent(type, data) {
+    this.send({ type, data });
+  }
+  // ---- Event listeners ----
+  on(event, handler) {
+    let set = this.listeners.get(event);
+    if (!set) {
+      set = /* @__PURE__ */ new Set();
+      this.listeners.set(event, set);
+    }
+    set.add(handler);
+    return () => {
+      set.delete(handler);
+    };
+  }
+  off(event, handler) {
+    this.listeners.get(event)?.delete(handler);
+  }
+  onStateChange(handler) {
+    this.stateListeners.add(handler);
+    return () => {
+      this.stateListeners.delete(handler);
+    };
+  }
+  // ---- Internal ----
+  send(frame) {
+    if (this.ws?.readyState === WebSocket.OPEN) {
+      this.ws.send(JSON.stringify(frame));
+    }
+  }
+  handleFrame(frame) {
+    this.lastReceivedAt = Date.now();
+    this.clearProbe();
+    if (frame.seq !== void 0) {
+      this.lastSeq = frame.seq;
+    }
+    if (frame.type === WS_EVENTS.HELLO) {
+      const interval = frame.data.heartbeat_interval;
+      this.startHeartbeat(interval);
+    }
+    const handlers = this.listeners.get(frame.type);
+    if (handlers) {
+      for (const handler of handlers) {
+        handler(frame.data, frame.seq);
+      }
+    }
+  }
+  startHeartbeat(intervalSec) {
+    this.stopHeartbeat();
+    if (!Number.isFinite(intervalSec) || intervalSec <= 0) {
+      console.error("Invalid heartbeat interval from server:", intervalSec);
+      return;
+    }
+    this.heartbeatIntervalMs = intervalSec * 1e3;
+    this.heartbeatTimer = setInterval(() => {
+      if (this.lastReceivedAt > 0 && Date.now() - this.lastReceivedAt > this.heartbeatIntervalMs * 1.5) {
+        this.probeConnection();
+        return;
+      }
+      this.send({ type: WS_EVENTS.PING, data: { ts: Date.now() } });
+    }, intervalSec * 1e3);
+  }
+  stopHeartbeat() {
+    if (this.heartbeatTimer) {
+      clearInterval(this.heartbeatTimer);
+      this.heartbeatTimer = null;
+    }
+  }
+  scheduleReconnect() {
+    this.setState("reconnecting");
+    this.clearReconnect();
+    const base = Math.min(this.options.reconnectInterval * Math.pow(2, this.reconnectAttempts), this.options.maxReconnectInterval);
+    const delay = base * (0.5 + Math.random() * 0.5);
+    this.reconnectAttempts++;
+    this.reconnectTimer = setTimeout(() => {
+      this.connect();
+    }, delay);
+  }
+  clearReconnect() {
+    if (this.reconnectTimer) {
+      clearTimeout(this.reconnectTimer);
+      this.reconnectTimer = null;
+    }
+  }
+  /** Force-close a dead/stale connection and trigger reconnect. */
+  forceReconnect() {
+    this.stopHeartbeat();
+    this.clearReconnect();
+    this.clearProbe();
+    if (this.ws) {
+      this.ws.onclose = null;
+      this.ws.onopen = null;
+      this.ws.onerror = null;
+      this.ws.onmessage = null;
+      try {
+        this.ws.close();
+      } catch {
+      }
+      this.ws = null;
+    }
+    if (this.options.reconnect && !this.intentionalClose) {
+      this.scheduleReconnect();
+    } else {
+      this.setState("disconnected");
+    }
+  }
+  // ---- Browser event listeners for proactive reconnection ----
+  setupBrowserListeners() {
+    if (this.browserListenersActive)
+      return;
+    this.browserListenersActive = true;
+    if (typeof document !== "undefined") {
+      document.addEventListener("visibilitychange", this.handleVisibilityChange);
+    }
+    if (typeof window !== "undefined") {
+      window.addEventListener("online", this.handleOnline);
+    }
+  }
+  teardownBrowserListeners() {
+    if (!this.browserListenersActive)
+      return;
+    this.browserListenersActive = false;
+    if (typeof document !== "undefined") {
+      document.removeEventListener("visibilitychange", this.handleVisibilityChange);
+    }
+    if (typeof window !== "undefined") {
+      window.removeEventListener("online", this.handleOnline);
+    }
+  }
+  /**
+   * Send a ping and arm a short timeout. If no frame arrives within 5s the
+   * connection is assumed dead and force-reconnected. Any received frame
+   * (including the pong) cancels the timer via clearProbe() in handleFrame.
+   */
+  probeConnection() {
+    if (this.probeTimer)
+      return;
+    this.send({ type: WS_EVENTS.PING, data: { ts: Date.now() } });
+    this.probeTimer = setTimeout(() => {
+      this.forceReconnect();
+    }, 5e3);
+  }
+  clearProbe() {
+    if (this.probeTimer) {
+      clearTimeout(this.probeTimer);
+      this.probeTimer = null;
+    }
+  }
+  /** Tab returned to foreground — verify connection or accelerate reconnect. */
+  handleVisibilityChange = () => {
+    if (typeof document !== "undefined" && document.hidden)
+      return;
+    if (this._state === "connected") {
+      if (!this.ws || this.ws.readyState !== WebSocket.OPEN) {
+        this.forceReconnect();
+      } else {
+        this.probeConnection();
+      }
+    } else if (this._state === "reconnecting") {
+      this.clearReconnect();
+      this.reconnectAttempts = 0;
+      this.connect();
+    }
+  };
+  /** Network restored — accelerate reconnection. */
+  handleOnline = () => {
+    if (this.intentionalClose)
+      return;
+    if (this._state === "connected") {
+      if (!this.ws || this.ws.readyState !== WebSocket.OPEN) {
+        this.forceReconnect();
+      } else {
+        this.probeConnection();
+      }
+    } else if (this._state === "reconnecting") {
+      this.clearReconnect();
+      this.reconnectAttempts = 0;
+      this.connect();
+    }
+  };
+  setState(state) {
+    this._state = state;
+    for (const listener of this.stateListeners) {
+      listener(state);
+    }
+  }
+};
+
+// ts/daemon/dist/config.js
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+function resolvePath(value) {
+  return path.isAbsolute(value) ? value : path.resolve(process.cwd(), value);
+}
+function parseMs(value, fallback) {
+  if (!value)
+    return fallback;
+  const n = Number(value);
+  return Number.isFinite(n) && n > 0 ? n : fallback;
+}
+function parseMsAllowZero(value, fallback) {
+  if (value === void 0)
+    return fallback;
+  const n = Number(value);
+  return Number.isFinite(n) && n >= 0 ? n : fallback;
+}
+function daemonConfigDir(env = process.env) {
+  return path.join(env.HOME || os.homedir(), ".parall-daemon");
+}
+function daemonConfigPath(env = process.env) {
+  return path.join(daemonConfigDir(env), "config.json");
+}
+function tryLoadConfigFile(env) {
+  const cfgPath = daemonConfigPath(env);
+  let content;
+  try {
+    content = fs.readFileSync(cfgPath, "utf-8");
+  } catch (err) {
+    if (err.code === "ENOENT")
+      return null;
+    console.error(`Failed to read daemon config at ${cfgPath}: ${String(err)}`);
+    return null;
+  }
+  try {
+    return JSON.parse(content);
+  } catch (err) {
+    console.error(`Failed to parse daemon config at ${cfgPath}: ${String(err)}`);
+    return null;
+  }
+}
+function resolveClaudeDaemonConfig(env = process.env) {
+  let apiUrl = env.PRLL_API_URL?.trim() || "";
+  let apiKey = env.PRLL_API_KEY?.trim() || "";
+  if (!apiUrl || !apiKey) {
+    const file = tryLoadConfigFile(env);
+    if (file) {
+      if (!apiUrl && file.api_url)
+        apiUrl = file.api_url.trim();
+      if (!apiKey && file.api_key)
+        apiKey = file.api_key.trim();
+    }
+  }
+  if (!apiUrl)
+    throw new Error("Missing required env var: PRLL_API_URL");
+  if (!apiKey)
+    throw new Error("Missing required env var: PRLL_API_KEY");
+  if (!apiKey.startsWith("mck_")) {
+    throw new Error(`PRLL_API_KEY does not look like a Machine bearer (expected prefix "mck_"). Daemon mode requires a machine-scoped key issued via POST /machines/{id}/keys.`);
+  }
+  const rootClaudeHome = resolvePath(env.PRLL_CLAUDE_HOME?.trim() || env.HOME || os.homedir());
+  const rootStateDir = resolvePath(env.PRLL_CLAUDE_STATE_DIR?.trim() || path.join(rootClaudeHome, ".parall-agent"));
+  return {
+    apiUrl,
+    apiKey,
+    agentBin: env.PRLL_CLAUDE_AGENT_BIN?.trim() || "parall-claude-agent",
+    rootStateDir,
+    rootClaudeHome,
+    wsUrl: env.PRLL_WS_URL?.trim() || void 0,
+    pollIntervalMs: parseMs(env.PRLL_DAEMON_POLL_INTERVAL_MS, 3e4),
+    heartbeatIntervalMs: parseMs(env.PRLL_DAEMON_HEARTBEAT_INTERVAL_MS, 3e4),
+    restartBackoffMs: parseMs(env.PRLL_DAEMON_RESTART_BACKOFF_MS, 5e3),
+    restartBackoffMaxMs: parseMs(env.PRLL_DAEMON_RESTART_BACKOFF_MAX_MS, 5 * 6e4),
+    bootstrapBackoffMs: parseMsAllowZero(env.PRLL_DAEMON_BOOTSTRAP_BACKOFF_MS, 2e3),
+    bootstrapBackoffMaxMs: parseMs(env.PRLL_DAEMON_BOOTSTRAP_BACKOFF_MAX_MS, 6e4),
+    supervisorRestartBackoffMs: parseMsAllowZero(env.PRLL_DAEMON_SUPERVISOR_RESTART_BACKOFF_MS, 5e3),
+    supervisorRestartBackoffMaxMs: parseMs(env.PRLL_DAEMON_SUPERVISOR_RESTART_BACKOFF_MAX_MS, 5 * 6e4)
+  };
+}
+function assertSafeAgentId(agentId) {
+  if (!/^[A-Za-z0-9_-]+$/.test(agentId)) {
+    throw new Error(`Invalid agentId for filesystem path: ${agentId}`);
+  }
+  return agentId;
+}
+function agentStateDirFor(rootStateDir, agentId) {
+  return path.join(rootStateDir, "agents", assertSafeAgentId(agentId));
+}
+function agentClaudeHomeFor(rootClaudeHome, agentId) {
+  return path.join(rootClaudeHome, "agents", assertSafeAgentId(agentId));
+}
+function sharedClaudeCredentialsFileFor(rootClaudeHome) {
+  return path.join(rootClaudeHome, ".claude", ".credentials.json");
+}
+function agentClaudeCredentialsFileFor(agentClaudeHome) {
+  return path.join(agentClaudeHome, ".claude", ".credentials.json");
+}
+function agentWorkspaceDirFor(rootStateDir, agentId) {
+  return path.join(rootStateDir, "agents", assertSafeAgentId(agentId), "workspace");
+}
+function resolveWsUrl(apiUrl, explicitWsUrl) {
+  return explicitWsUrl || `${apiUrl.replace(/\/$/, "").replace(/^http/, "ws")}/ws`;
+}
+
+// ts/daemon/dist/supervisor.js
+import { spawn } from "node:child_process";
+import * as fs2 from "node:fs";
+import * as path2 from "node:path";
+
+// ts/daemon/dist/runtimes.js
+var claudeCodeAdapter = {
+  bin: "parall-claude-agent",
+  buildEnv(baseEnv, agentId, orgId, apiKey, dirs) {
+    const env = { ...baseEnv };
+    env.PRLL_API_KEY = apiKey;
+    env.PRLL_ORG_ID = orgId;
+    env.AGENT_ID = agentId;
+    env.PRLL_AGENT_ID = agentId;
+    env.PRLL_CLAUDE_HOME = dirs.claudeHome;
+    env.PRLL_CLAUDE_STATE_DIR = dirs.stateDir;
+    env.PRLL_CLAUDE_WORKSPACE_DIR = dirs.workspaceDir;
+    if ("ANTHROPIC_AUTH_TOKEN" in env) {
+      env.ANTHROPIC_AUTH_TOKEN = apiKey;
+    }
+    delete env.PRLL_DAEMON_MODE;
+    return env;
+  }
+};
+var codexAdapter = {
+  bin: "parall-codex-agent",
+  buildEnv(baseEnv, agentId, orgId, apiKey, dirs) {
+    const env = { ...baseEnv };
+    env.PRLL_API_KEY = apiKey;
+    env.PRLL_ORG_ID = orgId;
+    env.AGENT_ID = agentId;
+    env.PRLL_AGENT_ID = agentId;
+    env.PRLL_CODEX_STATE_DIR = dirs.stateDir;
+    env.PRLL_CODEX_WORKSPACE_DIR = dirs.workspaceDir;
+    delete env.PRLL_DAEMON_MODE;
+    return env;
+  }
+};
+var defaultAdapter = {
+  bin: "parall-agent",
+  buildEnv(baseEnv, agentId, orgId, apiKey, dirs) {
+    const env = { ...baseEnv };
+    env.PRLL_API_KEY = apiKey;
+    env.PRLL_ORG_ID = orgId;
+    env.AGENT_ID = agentId;
+    env.PRLL_AGENT_ID = agentId;
+    env.PRLL_STATE_DIR = dirs.stateDir;
+    env.PRLL_WORKSPACE_DIR = dirs.workspaceDir;
+    delete env.PRLL_DAEMON_MODE;
+    return env;
+  }
+};
+var openclawAdapter = {
+  bin: "parall-openclaw-agent",
+  buildEnv(baseEnv, agentId, orgId, apiKey, dirs) {
+    const env = { ...baseEnv };
+    env.PRLL_API_KEY = apiKey;
+    env.PRLL_ORG_ID = orgId;
+    env.AGENT_ID = agentId;
+    env.PRLL_AGENT_ID = agentId;
+    env.PRLL_OPENCLAW_STATE_DIR = dirs.stateDir;
+    env.PRLL_OPENCLAW_WORKSPACE_DIR = dirs.workspaceDir;
+    env.OPENCLAW_GATEWAY_PORT = env.OPENCLAW_GATEWAY_PORT || "0";
+    delete env.PRLL_DAEMON_MODE;
+    return env;
+  }
+};
+var RUNTIME_ADAPTERS = {
+  "claude-code": claudeCodeAdapter,
+  "codex": codexAdapter,
+  "openclaw": openclawAdapter
+};
+function getRuntimeAdapter(runtimeType) {
+  return RUNTIME_ADAPTERS[runtimeType] ?? defaultAdapter;
+}
+function assertAgentKey(apiKey) {
+  if (apiKey.startsWith("mck_")) {
+    throw new Error("BUG: machine key leaked to child process \u2014 expected agk_, got mck_");
+  }
+}
+
+// ts/daemon/dist/supervisor.js
+var RUNTIME_PACKAGES = {
+  "claude-code": "@parall/claude-agent",
+  "codex": "@parall/codex-agent",
+  "openclaw": "@parall/openclaw-agent"
+};
+function sleepCancellable(ms, signal) {
+  if (signal.aborted)
+    return Promise.resolve(false);
+  return new Promise((resolve3) => {
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve3(true);
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      resolve3(false);
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+var DaemonSupervisor = class {
+  config;
+  client;
+  log;
+  children = /* @__PURE__ */ new Map();
+  ws = null;
+  running = false;
+  machineOrgId = null;
+  stopResolve = null;
+  constructor(config, client, log) {
+    this.config = config;
+    this.client = client;
+    this.log = log;
+  }
+  /** Start the supervisor. Returns a promise that resolves on `stop()`. */
+  async run(signal) {
+    if (this.running)
+      throw new Error("supervisor already running");
+    this.running = true;
+    const onAbort = () => {
+      this.stop().catch((err) => this.log.error(`stop() failed: ${String(err)}`));
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    try {
+      if (!await this.bootstrapWithRetry(signal)) {
+        signal.removeEventListener("abort", onAbort);
+        this.running = false;
+        return;
+      }
+    } catch (err) {
+      signal.removeEventListener("abort", onAbort);
+      this.running = false;
+      throw err;
+    }
+    this.migrateFlatLayout();
+    await this.fullReconcile();
+    this.ws = new ParallWs({
+      getTicket: () => this.client.getMachineWsTicket(),
+      wsUrl: this.config.wsUrl,
+      reconnect: true
+    });
+    this.ws.on("machine.hello", (_data) => {
+      this.log.info("machine WS connected (machine.hello)");
+      void this.fullReconcile();
+    });
+    this.ws.on("machine.agent.attached", (data) => {
+      this.log.info(`WS: agent ${data.agent_id} attached`);
+      void this.handleAgentAttached(data.agent_id);
+    });
+    this.ws.on("machine.agent.detached", (data) => {
+      this.log.info(`WS: agent ${data.agent_id} detached`);
+      void this.handleAgentDetached(data.agent_id);
+    });
+    this.ws.on("machine.stop", (data) => {
+      this.log.info(`WS: machine.stop received (reason=${data.reason ?? "none"})`);
+      void this.stop();
+    });
+    this.ws.onStateChange((state) => {
+      if (state === "disconnected" || state === "reconnecting") {
+        this.log.warn(`machine WS state: ${state}`);
+      }
+    });
+    await this.ws.connect();
+    await new Promise((resolve3) => {
+      this.stopResolve = resolve3;
+    });
+    signal.removeEventListener("abort", onAbort);
+  }
+  /** Disconnect WS, cancel timers, SIGTERM all children, await exit. */
+  async stop() {
+    if (!this.running)
+      return;
+    this.running = false;
+    if (this.ws) {
+      this.ws.disconnect();
+      this.ws = null;
+    }
+    const exits = [];
+    for (const state of this.children.values()) {
+      state.shuttingDown = true;
+      if (state.restartTimer) {
+        clearTimeout(state.restartTimer);
+        state.restartTimer = null;
+      }
+      exits.push(this.terminateChild(state));
+    }
+    await Promise.allSettled(exits);
+    this.children.clear();
+    this.log.info("daemon supervisor stopped");
+    if (this.stopResolve) {
+      this.stopResolve();
+      this.stopResolve = null;
+    }
+  }
+  // ---- Bootstrap (resilient identity probe) ----
+  async bootstrapWithRetry(signal) {
+    let attempt = 0;
+    while (this.running && !signal.aborted) {
+      try {
+        const machine = await this.client.getMachineSelf();
+        this.machineOrgId = machine.org_id;
+        this.log.info(`daemon online \u2014 machine_id=${machine.id} org=${machine.org_id} label=${machine.label}`);
+        return true;
+      } catch (err) {
+        if (this.config.bootstrapBackoffMs === 0) {
+          this.log.error(`getMachineSelf failed: ${String(err)} (fail-fast mode)`);
+          throw err;
+        }
+        const delay = Math.min(this.config.bootstrapBackoffMs * Math.pow(2, attempt), this.config.bootstrapBackoffMaxMs);
+        attempt += 1;
+        this.log.warn(`getMachineSelf failed (attempt ${attempt}): ${String(err)} \u2014 retrying in ${delay}ms`);
+        const slept = await sleepCancellable(delay, signal);
+        if (!slept)
+          return false;
+      }
+    }
+    return false;
+  }
+  // ---- Full reconcile (HTTP-based, used on boot + WS reconnect) ----
+  // Safe to run concurrently with WS event handlers: JS single-threaded
+  // event loop guarantees no mid-statement interleaving, and both
+  // handleAgentAttached/Detached guard on children.has()/get() so a WS
+  // event between the HTTP fetch and the spawn/kill loop is a no-op.
+  async fullReconcile() {
+    if (!this.running)
+      return;
+    let attached;
+    try {
+      attached = await this.client.listAttachedAgents();
+    } catch (err) {
+      this.log.warn(`fullReconcile: listAttachedAgents failed: ${String(err)}`);
+      return;
+    }
+    const seen = /* @__PURE__ */ new Set();
+    for (const a of attached) {
+      const userId = a.user?.id ?? a.profile.user_id;
+      if (!userId) {
+        this.log.warn(`skipping attached entry with no user_id (profile=${JSON.stringify(a.profile)})`);
+        continue;
+      }
+      if (a.user && a.user.status !== "active") {
+        this.log.info(`agent ${userId} not active (status=${a.user.status}) \u2014 skipping`);
+        continue;
+      }
+      seen.add(userId);
+      const existing = this.children.get(userId);
+      if (!existing) {
+        const orgId = this.machineOrgId;
+        if (!orgId) {
+          this.log.warn(`agent ${userId}: no org_id available yet; skipping`);
+          continue;
+        }
+        await this.spawnAgent(userId, orgId, a);
+      } else if (!existing.child && !existing.restartTimer && !existing.shuttingDown) {
+        await this.restartChildNow(existing, "reconcile found no live child");
+      }
+    }
+    for (const [userId, state] of this.children) {
+      if (!seen.has(userId)) {
+        this.log.info(`agent ${userId} detached (reconcile) \u2014 terminating subprocess`);
+        state.shuttingDown = true;
+        if (state.restartTimer) {
+          clearTimeout(state.restartTimer);
+          state.restartTimer = null;
+        }
+        await this.terminateChild(state);
+        this.children.delete(userId);
+      }
+    }
+  }
+  // ---- Flat layout migration (self-hosted → daemon) ----
+  /**
+   * Detects a legacy flat state layout (no agents/ subdir) and migrates it
+   * into the per-agent directory for the owning agent. Ownership is determined
+   * by parsing session state files which embed the agent ID in the runtimeKey.
+   */
+  migrateFlatLayout() {
+    const root = this.config.rootStateDir;
+    const agentsDir = path2.join(root, "agents");
+    const flatWorkspace = path2.join(root, "workspace");
+    if (!fs2.existsSync(flatWorkspace) || fs2.existsSync(agentsDir))
+      return;
+    let ownerAgentId;
+    const sessionsDir = path2.join(root, "sessions");
+    if (fs2.existsSync(sessionsDir)) {
+      try {
+        for (const file of fs2.readdirSync(sessionsDir)) {
+          if (!file.endsWith(".json"))
+            continue;
+          const decoded = Buffer.from(file.replace(".json", ""), "base64url").toString();
+          const parts = decoded.split(":");
+          if (parts.length >= 4 && parts[3].startsWith("usr_")) {
+            ownerAgentId = parts[3];
+            break;
+          }
+        }
+      } catch {
+      }
+    }
+    const targetId = ownerAgentId ?? "_orphan";
+    const targetDir = path2.join(agentsDir, targetId);
+    try {
+      fs2.mkdirSync(targetDir, { recursive: true });
+      for (const sub of ["workspace", "sessions", "dispatch-context"]) {
+        const src = path2.join(root, sub);
+        if (fs2.existsSync(src)) {
+          fs2.renameSync(src, path2.join(targetDir, sub));
+        }
+      }
+      this.log.info(`migrated legacy flat state \u2192 agents/${targetId}/`);
+    } catch (err) {
+      this.log.warn(`flat layout migration failed: ${String(err)}`);
+    }
+  }
+  // ---- WS event handlers (incremental) ----
+  async handleAgentAttached(agentId) {
+    if (this.children.has(agentId))
+      return;
+    let attached;
+    try {
+      attached = await this.client.listAttachedAgents();
+    } catch (err) {
+      this.log.warn(`handleAgentAttached: listAttachedAgents failed: ${String(err)}`);
+      return;
+    }
+    const entry = attached.find((a) => (a.user?.id ?? a.profile.user_id) === agentId);
+    if (!entry) {
+      this.log.warn(`handleAgentAttached: agent ${agentId} not found in attached list`);
+      return;
+    }
+    if (entry.user && entry.user.status !== "active") {
+      this.log.info(`agent ${agentId} not active (status=${entry.user.status}) \u2014 skipping`);
+      return;
+    }
+    const orgId = this.machineOrgId;
+    if (!orgId) {
+      this.log.warn(`agent ${agentId}: no org_id available yet; skipping`);
+      return;
+    }
+    await this.spawnAgent(agentId, orgId, entry);
+  }
+  async handleAgentDetached(agentId) {
+    const state = this.children.get(agentId);
+    if (!state)
+      return;
+    this.log.info(`agent ${agentId} detached \u2014 terminating subprocess`);
+    state.shuttingDown = true;
+    if (state.restartTimer) {
+      clearTimeout(state.restartTimer);
+      state.restartTimer = null;
+    }
+    await this.terminateChild(state);
+    this.children.delete(agentId);
+  }
+  // ---- Spawn / restart ----
+  async restartChildNow(state, reason) {
+    if (!this.running || state.shuttingDown || state.child || state.restartTimer) {
+      return;
+    }
+    try {
+      state.credential = await this.client.mintLaunchCredential(state.agentId);
+      state.restartAttempts = 0;
+      this.log.info(`agent ${state.agentId}: restarting child (${reason})`);
+      this.startChild(state);
+    } catch (err) {
+      this.log.warn(`agent ${state.agentId}: restart mint failed (${reason}): ${String(err)}`);
+    }
+  }
+  async spawnAgent(agentId, orgId, attached) {
+    let credential;
+    try {
+      credential = await this.client.mintLaunchCredential(agentId);
+    } catch (err) {
+      this.log.error(`mintLaunchCredential ${agentId} failed: ${String(err)}`);
+      return;
+    }
+    const stateDir = agentStateDirFor(this.config.rootStateDir, agentId);
+    const workspaceDir = attached.daemon_config?.workspace_path || agentWorkspaceDirFor(this.config.rootStateDir, agentId);
+    const isK8s = !!process.env.KUBERNETES_SERVICE_HOST;
+    const claudeHome = isK8s ? agentClaudeHomeFor(this.config.rootClaudeHome, agentId) : this.config.rootClaudeHome;
+    try {
+      fs2.mkdirSync(stateDir, { recursive: true });
+      if (!attached.daemon_config?.workspace_path) {
+        fs2.mkdirSync(workspaceDir, { recursive: true });
+      }
+      if (isK8s) {
+        fs2.mkdirSync(claudeHome, { recursive: true });
+        this.ensureSharedCredentialLink(claudeHome, agentId);
+      }
+    } catch (err) {
+      this.log.warn(`mkdir agent dirs (${agentId}) failed: ${String(err)}`);
+    }
+    const runtimeType = attached.profile.runtime_type ?? "claude-code";
+    const state = {
+      agentId,
+      orgId,
+      runtimeType,
+      workspacePath: workspaceDir,
+      claudeHome,
+      child: null,
+      credential,
+      restartAttempts: 0,
+      restartTimer: null,
+      shuttingDown: false
+    };
+    this.children.set(agentId, state);
+    this.startChild(state);
+  }
+  startChild(state) {
+    if (state.shuttingDown || !this.running)
+      return;
+    if (!state.credential) {
+      this.log.error(`startChild ${state.agentId}: no credential \u2014 bug`);
+      return;
+    }
+    assertAgentKey(state.credential.api_key);
+    const adapter = getRuntimeAdapter(state.runtimeType);
+    const dirs = {
+      stateDir: agentStateDirFor(this.config.rootStateDir, state.agentId),
+      workspaceDir: state.workspacePath,
+      claudeHome: state.claudeHome
+    };
+    const env = adapter.buildEnv({ ...process.env, PRLL_API_URL: this.config.apiUrl }, state.agentId, state.orgId, state.credential.api_key, dirs);
+    this.log.info(`spawning agent ${state.agentId} runtime=${state.runtimeType} bin=${adapter.bin} (attempt ${state.restartAttempts + 1})`);
+    const child = spawn(adapter.bin, [], {
+      env,
+      stdio: ["ignore", "inherit", "inherit"],
+      detached: false
+    });
+    state.child = child;
+    let childSettled = false;
+    const settleChild = (event, code, signal, err) => {
+      if (childSettled)
+        return;
+      childSettled = true;
+      if (state.child !== child)
+        return;
+      const wasShutting = state.shuttingDown;
+      state.child = null;
+      if (err) {
+        this.log.error(`agent ${state.agentId} child ${event}: ${String(err)}${wasShutting ? " (shutting down)" : ""}`);
+      } else {
+        this.log.info(`agent ${state.agentId} exited code=${code ?? "null"} signal=${signal ?? "null"}${wasShutting ? " (shutting down)" : ""}`);
+      }
+      if (wasShutting || !this.running)
+        return;
+      const delay = Math.min(this.config.restartBackoffMs * Math.pow(2, state.restartAttempts), this.config.restartBackoffMaxMs);
+      state.restartAttempts += 1;
+      this.log.warn(`agent ${state.agentId} will restart in ${delay}ms`);
+      state.restartTimer = setTimeout(() => {
+        state.restartTimer = null;
+        this.startChild(state);
+      }, delay);
+    };
+    child.once("error", (err) => {
+      if (err.code === "ENOENT") {
+        const pkg = RUNTIME_PACKAGES[state.runtimeType] ?? `@parall/${state.runtimeType}-agent`;
+        this.log.error(`Runtime binary "${adapter.bin}" not found in PATH. Install: npm install -g ${pkg}`);
+      }
+      settleChild("error", null, null, err);
+    });
+    child.once("close", (code, signal) => settleChild("close", code, signal));
+    setTimeout(() => {
+      if (state.child === child) {
+        state.restartAttempts = 0;
+      }
+    }, Math.max(this.config.restartBackoffMs, 3e4));
+  }
+  async terminateChild(state) {
+    const child = state.child;
+    if (!child)
+      return;
+    return new Promise((resolve3) => {
+      const onExit = () => resolve3();
+      child.once("exit", onExit);
+      try {
+        child.kill("SIGTERM");
+      } catch (err) {
+        this.log.warn(`SIGTERM ${state.agentId} threw: ${String(err)}`);
+        child.off("exit", onExit);
+        resolve3();
+        return;
+      }
+      const hardKill = setTimeout(() => {
+        try {
+          child.kill("SIGKILL");
+        } catch {
+        }
+      }, 1e4);
+      child.once("exit", () => clearTimeout(hardKill));
+    });
+  }
+  ensureSharedCredentialLink(agentClaudeHome, agentId) {
+    const sharedCredentials = path2.resolve(sharedClaudeCredentialsFileFor(this.config.rootClaudeHome));
+    const agentCredentials = agentClaudeCredentialsFileFor(agentClaudeHome);
+    const agentCredentialsDir = path2.dirname(agentCredentials);
+    fs2.mkdirSync(path2.dirname(sharedCredentials), { recursive: true });
+    fs2.mkdirSync(agentCredentialsDir, { recursive: true });
+    try {
+      const existing = fs2.lstatSync(agentCredentials);
+      if (existing.isSymbolicLink()) {
+        const currentTarget = fs2.readlinkSync(agentCredentials);
+        if (path2.resolve(agentCredentialsDir, currentTarget) === sharedCredentials) {
+          return;
+        }
+        fs2.unlinkSync(agentCredentials);
+      } else if (existing.isDirectory()) {
+        this.log.warn(`agent ${agentId}: credential path is a directory, cannot link ${agentCredentials}`);
+        return;
+      } else {
+        fs2.unlinkSync(agentCredentials);
+      }
+    } catch (err) {
+      if (err.code !== "ENOENT") {
+        throw err;
+      }
+    }
+    fs2.symlinkSync(sharedCredentials, agentCredentials);
+  }
+};
+
+// ts/daemon/dist/cli.js
+import * as fs3 from "node:fs";
+import * as path3 from "node:path";
+import * as os2 from "node:os";
+import * as readline from "node:readline";
+import { spawn as spawn2, execSync } from "node:child_process";
+var CONFIG_DIR = daemonConfigDir();
+var CONFIG_PATH = daemonConfigPath();
+function readConfig() {
+  try {
+    return JSON.parse(fs3.readFileSync(CONFIG_PATH, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function writeConfig(config) {
+  fs3.mkdirSync(CONFIG_DIR, { recursive: true, mode: 448 });
+  fs3.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2), { mode: 384 });
+  fs3.chmodSync(CONFIG_PATH, 384);
+}
+function prompt(question) {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve3) => {
+    rl.question(question, (answer) => {
+      rl.close();
+      resolve3(answer.trim());
+    });
+  });
+}
+function isMacOS() {
+  return process.platform === "darwin";
+}
+function isLinux() {
+  return process.platform === "linux";
+}
+var PLIST_LABEL = "com.parall.daemon";
+function plistPath() {
+  return path3.join(os2.homedir(), "Library", "LaunchAgents", `${PLIST_LABEL}.plist`);
+}
+function systemdUnitPath() {
+  return path3.join(os2.homedir(), ".config", "systemd", "user", "parall-daemon.service");
+}
+function getDaemonBin() {
+  try {
+    return execSync("which parall-daemon", { encoding: "utf-8", stdio: "pipe" }).trim();
+  } catch {
+    return process.argv[1] ?? "parall-daemon";
+  }
+}
+function generatePlist(daemonBin) {
+  const logPath = path3.join(os2.homedir(), "Library", "Logs", "parall-daemon.log");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>${PLIST_LABEL}</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>${daemonBin}</string>
+    </array>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>KeepAlive</key>
+    <true/>
+    <key>ThrottleInterval</key>
+    <integer>5</integer>
+    <key>StandardOutPath</key>
+    <string>${logPath}</string>
+    <key>StandardErrorPath</key>
+    <string>${logPath}</string>
+</dict>
+</plist>`;
+}
+function generateSystemdUnit(daemonBin) {
+  return `[Unit]
+Description=Parall Daemon
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=${daemonBin}
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target`;
+}
+function installService() {
+  const config = readConfig();
+  if (!config) {
+    console.error("No config found. Run `parall-daemon init` first.");
+    process.exit(1);
+  }
+  const bin = getDaemonBin();
+  if (isMacOS()) {
+    const dir = path3.dirname(plistPath());
+    fs3.mkdirSync(dir, { recursive: true });
+    fs3.writeFileSync(plistPath(), generatePlist(bin));
+    execSync(`launchctl bootout gui/$(id -u) ${plistPath()} 2>/dev/null || true`);
+    execSync(`launchctl bootstrap gui/$(id -u) ${plistPath()}`);
+    console.log(`launchd agent installed: ${plistPath()}`);
+  } else if (isLinux()) {
+    const dir = path3.dirname(systemdUnitPath());
+    fs3.mkdirSync(dir, { recursive: true });
+    fs3.writeFileSync(systemdUnitPath(), generateSystemdUnit(bin));
+    execSync("systemctl --user daemon-reload");
+    execSync("systemctl --user enable --now parall-daemon");
+    console.log(`systemd service installed: ${systemdUnitPath()}`);
+  } else {
+    console.log("Unsupported platform. Run `parall-daemon` manually.");
+  }
+}
+async function cmdInit() {
+  const existing = readConfig();
+  const defaultUrl = existing?.api_url || "https://api.parall.com";
+  const apiUrl = await prompt(`API URL [${defaultUrl}]: `) || defaultUrl;
+  const apiKey = await prompt("Machine key (mck_...): ");
+  if (!apiKey.startsWith("mck_")) {
+    console.error('Error: Machine key must start with "mck_"');
+    process.exit(1);
+  }
+  writeConfig({ api_url: apiUrl, api_key: apiKey });
+  console.log(`Config written to ${CONFIG_PATH}`);
+  const install = await prompt("Install as background service? (Y/n): ");
+  if (install.toLowerCase() !== "n") {
+    installService();
+  }
+}
+function cmdStatus() {
+  const config = readConfig();
+  console.log(`Config: ${config ? CONFIG_PATH : "not configured"}`);
+  if (isMacOS()) {
+    try {
+      const output = execSync(`launchctl print gui/$(id -u)/${PLIST_LABEL} 2>&1`, {
+        encoding: "utf-8"
+      });
+      const running = output.includes("state = running");
+      console.log(`Service: ${running ? "running" : "stopped"}`);
+      const pidMatch = output.match(/pid\s*=\s*(\d+)/);
+      if (pidMatch)
+        console.log(`PID: ${pidMatch[1]}`);
+    } catch {
+      console.log("Service: not installed");
+    }
+  } else if (isLinux()) {
+    try {
+      execSync("systemctl --user is-active parall-daemon", { encoding: "utf-8", stdio: "pipe" });
+      console.log("Service: running");
+    } catch {
+      console.log("Service: stopped or not installed");
+    }
+  }
+}
+function cmdStop() {
+  if (isMacOS()) {
+    execSync(`launchctl bootout gui/$(id -u) ${plistPath()} 2>/dev/null || true`, {
+      stdio: "inherit"
+    });
+  } else if (isLinux()) {
+    execSync("systemctl --user stop parall-daemon", { stdio: "inherit" });
+  }
+  console.log("Daemon stopped.");
+}
+function cmdLogs(lines) {
+  if (isLinux()) {
+    const child2 = spawn2("journalctl", ["--user-unit", "parall-daemon", "-n", lines, "-f"], {
+      stdio: "inherit"
+    });
+    child2.on("exit", (code) => process.exit(code ?? 0));
+    return;
+  }
+  const logPath = path3.join(os2.homedir(), "Library", "Logs", "parall-daemon.log");
+  if (!fs3.existsSync(logPath)) {
+    console.log("No log file found at", logPath);
+    return;
+  }
+  const child = spawn2("tail", ["-n", lines, "-f", logPath], { stdio: "inherit" });
+  child.on("exit", (code) => process.exit(code ?? 0));
+}
+function cmdServiceUninstall() {
+  if (isMacOS()) {
+    execSync(`launchctl bootout gui/$(id -u) ${plistPath()} 2>/dev/null || true`);
+    if (fs3.existsSync(plistPath()))
+      fs3.unlinkSync(plistPath());
+    console.log("launchd agent uninstalled.");
+  } else if (isLinux()) {
+    execSync("systemctl --user stop parall-daemon 2>/dev/null || true");
+    execSync("systemctl --user disable parall-daemon 2>/dev/null || true");
+    if (fs3.existsSync(systemdUnitPath()))
+      fs3.unlinkSync(systemdUnitPath());
+    execSync("systemctl --user daemon-reload");
+    console.log("systemd service uninstalled.");
+  } else {
+    console.log("Unsupported platform.");
+  }
+}
+function printUsage() {
+  console.log(`
+parall-daemon \u2014 Parall local agent runtime
+
+Usage:
+  parall-daemon                    Run the daemon (default, foreground)
+  parall-daemon init               Configure the daemon (interactive)
+  parall-daemon status             Show daemon service status
+  parall-daemon stop               Stop the background service
+  parall-daemon logs [-n LINES]    Tail daemon logs
+  parall-daemon service install    Install as background service (launchd/systemd)
+  parall-daemon service uninstall  Uninstall background service
+  parall-daemon help               Show this help
+`.trim());
+}
+async function runCLI(args) {
+  const cmd = args[0];
+  switch (cmd) {
+    case "init":
+      await cmdInit();
+      return "handled";
+    case "status":
+      cmdStatus();
+      return "handled";
+    case "stop":
+      cmdStop();
+      return "handled";
+    case "logs": {
+      let lines = "50";
+      if (args[1] === "-n") {
+        const n = Number(args[2]);
+        if (!Number.isInteger(n) || n <= 0) {
+          console.error("Error: -n requires a positive integer");
+          process.exit(1);
+        }
+        lines = String(n);
+      }
+      cmdLogs(lines);
+      return "handled";
+    }
+    case "service": {
+      const sub = args[1];
+      if (sub === "install") {
+        installService();
+      } else if (sub === "uninstall") {
+        cmdServiceUninstall();
+      } else {
+        console.error(`Unknown service command: ${sub ?? "(none)"}`);
+        console.log("Usage: parall-daemon service [install|uninstall]");
+        process.exit(1);
+      }
+      return "handled";
+    }
+    case "help":
+    case "--help":
+    case "-h":
+      printUsage();
+      return "handled";
+    default:
+      if (cmd) {
+        console.error(`Unknown command: ${cmd}`);
+        printUsage();
+        process.exit(1);
+      }
+      return "run-daemon";
+  }
+}
+
+// ts/daemon/dist/index.js
+function createLogger(prefix) {
+  return {
+    info: (msg) => console.log(`[${prefix}] ${msg}`),
+    warn: (msg) => console.warn(`[${prefix}] ${msg}`),
+    error: (msg) => console.error(`[${prefix}] ${msg}`)
+  };
+}
+function formatError(reason) {
+  if (reason instanceof Error) {
+    return reason.stack ?? reason.message;
+  }
+  return String(reason);
+}
+async function runForever(config, client, log, signal) {
+  let attempt = 0;
+  while (!signal.aborted) {
+    const supervisor = new DaemonSupervisor(config, client, log);
+    try {
+      await supervisor.run(signal);
+      await supervisor.stop();
+      return;
+    } catch (err) {
+      log.error(`supervisor crashed: ${String(err)}`);
+      try {
+        await supervisor.stop();
+      } catch (stopErr) {
+        log.warn(`supervisor.stop() after crash threw: ${String(stopErr)}`);
+      }
+      if (config.supervisorRestartBackoffMs === 0) {
+        log.error("supervisor keepalive disabled (PRLL_DAEMON_SUPERVISOR_RESTART_BACKOFF_MS=0) \u2014 exiting");
+        throw err;
+      }
+      const delay = Math.min(config.supervisorRestartBackoffMs * Math.pow(2, attempt), config.supervisorRestartBackoffMaxMs);
+      attempt += 1;
+      log.warn(`restarting supervisor in ${delay}ms (attempt ${attempt})`);
+      const slept = await sleepCancellable(delay, signal);
+      if (!slept)
+        return;
+    }
+  }
+}
+async function main() {
+  const config = resolveClaudeDaemonConfig(process.env);
+  const log = createLogger("daemon");
+  log.info(`boot: api=${config.apiUrl} pollMs=${config.pollIntervalMs} heartbeatMs=${config.heartbeatIntervalMs} agentBin=${config.agentBin}`);
+  log.info(`keepalive: bootstrapBackoffMs=${config.bootstrapBackoffMs} supervisorRestartBackoffMs=${config.supervisorRestartBackoffMs}`);
+  const client = new ParallClient({
+    baseUrl: config.apiUrl,
+    token: config.apiKey
+  });
+  const abortController = new AbortController();
+  const onSignal = (sig) => {
+    log.info(`received ${sig} \u2014 initiating shutdown`);
+    abortController.abort();
+  };
+  process.on("SIGINT", () => onSignal("SIGINT"));
+  process.on("SIGTERM", () => onSignal("SIGTERM"));
+  process.on("unhandledRejection", (reason) => {
+    log.error(`unhandledRejection: ${formatError(reason)}`);
+  });
+  process.on("uncaughtException", (err) => {
+    log.error(`uncaughtException: ${formatError(err)}`);
+    process.exitCode = 1;
+    process.exit(1);
+  });
+  config.wsUrl = resolveWsUrl(config.apiUrl, config.wsUrl);
+  await runForever(config, client, log, abortController.signal);
+}
+var cliArgs = process.argv.slice(2);
+runCLI(cliArgs).then((result) => {
+  if (result === "handled")
+    return;
+  main().catch((err) => {
+    console.error(`[daemon] fatal: ${formatError(err)}`);
+    process.exitCode = 1;
+  });
+}).catch((err) => {
+  console.error(`[daemon] fatal: ${formatError(err)}`);
+  process.exitCode = 1;
+});