abb-rws-client 0.7.2 → 1.0.0

package/dist/RwsClient2.js

@@ -1,7 +1,9 @@
 import * as https from 'https';
 import * as http from 'http';
 import { XhtmlParser } from './XhtmlParser.js';
+import { HalJsonParser } from './HalJsonParser.js';
 import { Logger } from './Logger.js';
+import { RwsError } from './types.js';
 /**
  * RWS 2.0 protocol client for ABB OmniCore controllers (RobotWare 7.x).
  *
@@ -12,10 +14,15 @@ import { Logger } from './Logger.js';
  * Key differences vs RWS 1.0 (all confirmed by live virtual-controller probing):
  * - HTTP Basic auth instead of Digest
  * - Path-based actions: /rw/rapid/execution/stop (not ?action=stop)
- * - XHTML responses only (Accept: application/xhtml+xml;v=2.0)
+ * - GETs are negotiated as HAL JSON (Accept: application/hal+json;v=2.0 —
+ *   live-verified 2026-07-09 on RW7.21 for every GET family) with an automatic
+ *   per-instance fallback to application/xhtml+xml;v=2.0 for older RW7
+ *   releases; form-POST responses and subscription events are XHTML-only
  * - Mastership domains: 'edit' replaces both 'cfg' and 'rapid'
  * - FileService home: 'HOME' not '$HOME'
- * - Self-signed TLS on virtual controllers → rejectUnauthorized: false
+ * - Self-signed TLS on all shipping controllers → verification is OFF by default;
+ *   pass `{ rejectUnauthorized: true }` to keep it on (e.g. controllers with a
+ *   properly installed certificate).
  */
 export class RwsClient2 {
     baseUrl;
@@ -25,25 +32,60 @@ export class RwsClient2 {
     httpsAgent;
     httpAgent;
     isHttps;
+    /** Per-request timeout in ms (constructor `opts.timeout`, default 10000). */
+    timeoutMs;
+    /** When true, TLS certificate verification stays ON everywhere (requests, subscription POST, WebSocket). */
+    rejectUnauthorized;
     /** Session cookie set by the controller on first auth — REQUIRED to avoid creating
      *  a new session per request (controller's session pool fills in seconds otherwise). */
     sessionCookie = null;
     /** Signal name → {network, device} — populated by listAllSignals for writeSignal lookups */
     sigCoords = new Map();
-    constructor(baseUrl, username, password) {
+    constructor(baseUrl, username, password, opts = {}) {
         this.baseUrl = baseUrl;
         this.authHeader = 'Basic ' + Buffer.from(`${username}:${password}`).toString('base64');
         this.isHttps = baseUrl.startsWith('https');
+        this.timeoutMs = opts.timeout ?? 10000;
+        this.rejectUnauthorized = opts.rejectUnauthorized ?? false;
         // keepAlive reuses the TCP connection so we don't churn sessions on every poll.
-        this.httpsAgent = new https.Agent({ rejectUnauthorized: false, keepAlive: true });
+        this.httpsAgent = new https.Agent({
+            keepAlive: true,
+            ...(this.rejectUnauthorized ? {} : { rejectUnauthorized: false }),
+        });
         this.httpAgent = new http.Agent({ keepAlive: true });
     }
     // ─── HTTP transport ────────────────────────────────────────────────────────
+    /** Primary GET representation. Officially supported on RWS 2.0; live-verified
+     *  2026-07-09 on OmniCore VC RW7.21 for every GET endpoint family in this client. */
+    static ACCEPT_HAL = 'application/hal+json;v=2.0';
+    /** Representation for writes, fileservice, subscriptions, and the fallback GET path. */
+    static ACCEPT_XHTML = 'application/xhtml+xml;v=2.0';
+    /** Set once a controller rejects hal+json (HTTP 406 or a non-JSON reply to a
+     *  hal+json GET) — older RW7 releases predate HAL JSON. All subsequent GETs on
+     *  this instance then go straight to XHTML instead of re-negotiating each time. */
+    preferXhtml = false;
+    /** GET paths that must keep the XHTML Accept: fileservice serves raw file bytes
+     *  (a content-type-based negotiation retry would double every file read, and the
+     *  service rejects some Accept values), and /logout's body is ignored anyway. */
+    static isXhtmlOnlyPath(path) {
+        return path.startsWith('/fileservice') || path === '/logout';
+    }
+    /** Picks the parser for a response body: HAL JSON (primary GET representation)
+     *  or XHTML (fallback GETs, form-POST responses). Both expose the same reads. */
+    static parse(body) {
+        return HalJsonParser.looksLikeJson(body) ? new HalJsonParser(body) : new XhtmlParser(body);
+    }
+    /** Error block from either representation (JSON status.code/msg or XHTML spans). */
+    static extractError(body) {
+        return RwsClient2.parse(body).getError();
+    }
     /**
      * Core HTTP request. acceptExtra lists additional success status codes beyond 200/204.
      * Used by subscribe() to accept HTTP 201 (Created) from POST /subscription.
+     * acceptOverride pins the Accept header for callers that must not negotiate
+     * (e.g. getDeviceTree, which promises a raw XHTML document).
      */
-    async req(method, path, body, rawBody, rawContentType, acceptExtra = []) {
+    async req(method, path, body, rawBody, rawContentType, acceptExtra = [], acceptOverride) {
         const wait = RwsClient2.MIN_MS - (Date.now() - this.lastReqTime);
         if (wait > 0) {
             await new Promise(r => setTimeout(r, wait));
@@ -54,6 +96,11 @@ export class RwsClient2 {
         // RWS 2.0 requires Content-Type on all POST/PUT/DELETE requests, even with no body
         // (mastership and a few other endpoints return HTTP 406 without it).
         const writingMethod = method === 'POST' || method === 'PUT' || method === 'DELETE';
+        // GETs negotiate HAL JSON; writes stay XHTML (form-POST responses are XHTML-only).
+        const wantsHal = method === 'GET' && !this.preferXhtml
+            && !acceptOverride && !RwsClient2.isXhtmlOnlyPath(path);
+        const accept = acceptOverride
+            ?? (wantsHal ? RwsClient2.ACCEPT_HAL : RwsClient2.ACCEPT_XHTML);
         const options = {
             method,
             hostname: url.hostname,
@@ -61,7 +108,7 @@ export class RwsClient2 {
             path: url.pathname + url.search,
             headers: {
                 Authorization: this.authHeader,
-                Accept: 'application/xhtml+xml;v=2.0',
+                Accept: accept,
                 ...(this.sessionCookie ? { Cookie: this.sessionCookie } : {}),
                 ...(writingMethod ? {
                     'Content-Type': rawContentType ?? 'application/x-www-form-urlencoded;v=2.0',
@@ -69,6 +116,13 @@ export class RwsClient2 {
                 } : {}),
             },
             agent: this.isHttps ? this.httpsAgent : this.httpAgent,
+            // Must ALSO be set per-request, not only on the agent: hosts that replace the
+            // agent (VS Code's extension host patches http/https and swaps custom agents for
+            // non-localhost targets) would otherwise re-enable TLS verification and fail on
+            // the self-signed certs ABB controllers ship. Live-reported on a real OmniCore RC
+            // (abb-rws-vscode issue #2, 2026-05-18); localhost VCs never hit this because the
+            // extension host doesn't intercept localhost traffic.
+            ...(this.isHttps && !this.rejectUnauthorized ? { rejectUnauthorized: false } : {}),
         };
         const startedAt = Date.now();
         Logger.trace?.('http.req', `RWS2 ${method} ${path}`, {
@@ -95,16 +149,34 @@ export class RwsClient2 {
                         resolve('');
                         return;
                     }
+                    // HAL JSON negotiation fallback: a controller predating hal+json either
+                    // rejects the Accept outright (406) or ignores it and answers XHTML.
+                    // Retry this one request as XHTML and remember the preference so every
+                    // later GET on this instance skips the failed negotiation.
+                    if (wantsHal) {
+                        const contentType = String(res.headers['content-type'] ?? '');
+                        if (status === 406 || (status < 400 && !/json/i.test(contentType))) {
+                            this.preferXhtml = true;
+                            Logger.trace?.('http.res', `RWS2 ${method} ${path} → ${status} (hal+json not served — falling back to XHTML for this client)`, {
+                                protocol: 'rws2', method, path, status, durationMs, contentType,
+                            });
+                            resolve(this.req(method, path, body, rawBody, rawContentType, acceptExtra));
+                            return;
+                        }
+                    }
                     if (acceptExtra.includes(status)) {
                         Logger.trace?.('http.res', `RWS2 ${method} ${path} → ${status}`, { protocol: 'rws2', method, path, status, durationMs, bodyPreview: raw.slice(0, 200) });
                         resolve(raw);
                         return;
                     }
                     if (status >= 400) {
-                        const err = new XhtmlParser(raw).getError();
+                        const err = RwsClient2.extractError(raw);
                         Logger.trace?.('http.err', `RWS2 ${method} ${path} → ${status}`, { protocol: 'rws2', method, path, status, durationMs, errCode: err?.code, errMsg: err?.msg, bodyPreview: raw.slice(0, 300) });
-                        reject(new Error(`RWS2 ${method} ${path}: HTTP ${status}` +
-                            (err ? ` — ${err.msg}` : '')));
+                        const code = status === 401 ? 'AUTH_FAILED' :
+                            status === 503 ? 'CONTROLLER_BUSY' :
+                                status === 429 ? 'RATE_LIMITED' : 'UNKNOWN';
+                        reject(new RwsError(`RWS2 ${method} ${path}: HTTP ${status}` +
+                            (err ? ` — ${err.msg}` : ''), code, status, err?.msg));
                         return;
                     }
                     Logger.trace?.('http.res', `RWS2 ${method} ${path} → ${status} (${raw.length}b)`, { protocol: 'rws2', method, path, status, durationMs, bodyLen: raw.length });
@@ -113,12 +185,12 @@ export class RwsClient2 {
             });
             req.on('error', (e) => {
                 Logger.trace?.('http.err', `RWS2 ${method} ${path} → network error`, { protocol: 'rws2', method, path, error: String(e), durationMs: Date.now() - startedAt });
-                reject(e);
+                reject(new RwsError(e instanceof Error ? e.message : String(e), 'NETWORK_ERROR'));
             });
-            req.setTimeout(10000, () => {
+            req.setTimeout(this.timeoutMs, () => {
                 req.destroy();
                 Logger.trace?.('http.err', `RWS2 ${method} ${path} → timeout`, { protocol: 'rws2', method, path, durationMs: Date.now() - startedAt });
-                reject(new Error(`RWS2 timeout: ${path}`));
+                reject(new RwsError(`RWS2 timeout: ${path}`, 'NETWORK_ERROR'));
             });
             if (bodyStr) {
                 req.write(bodyStr);
@@ -139,18 +211,18 @@ export class RwsClient2 {
     getSessionCookie() { return this.sessionCookie; }
     // ─── Panel ─────────────────────────────────────────────────────────────────
     async getControllerState() {
-        const p = new XhtmlParser(await this.req('GET', '/rw/panel/ctrl-state'));
+        const p = RwsClient2.parse(await this.req('GET', '/rw/panel/ctrl-state'));
         return (p.getState('pnl-ctrlstate')['ctrlstate'] ?? 'init');
     }
     setControllerState(state) {
         return this.req('POST', '/rw/panel/ctrl-state', { 'ctrl-state': state }).then(() => { });
     }
     async getOperationMode() {
-        const p = new XhtmlParser(await this.req('GET', '/rw/panel/opmode'));
+        const p = RwsClient2.parse(await this.req('GET', '/rw/panel/opmode'));
         return (p.getState('pnl-opmode')['opmode'] ?? 'MANR');
     }
     async getSpeedRatio() {
-        const p = new XhtmlParser(await this.req('GET', '/rw/panel/speedratio'));
+        const p = RwsClient2.parse(await this.req('GET', '/rw/panel/speedratio'));
         return Number(p.getState('pnl-speedratio')['speedratio'] ?? 100);
     }
     /**
@@ -176,7 +248,7 @@ export class RwsClient2 {
         }
     }
     async getCollisionDetectionState() {
-        const p = new XhtmlParser(await this.req('GET', '/rw/panel/coldetstate'));
+        const p = RwsClient2.parse(await this.req('GET', '/rw/panel/coldetstate'));
         return (p.getState('pnl-coldetstate')['coldetstate'] ?? 'INIT');
     }
     lockOperationMode(pin, permanent = false) {
@@ -219,11 +291,11 @@ export class RwsClient2 {
     }
     // ─── RAPID execution ────────────────────────────────────────────────────────
     async getRapidExecutionState() {
-        const p = new XhtmlParser(await this.req('GET', '/rw/rapid/execution'));
+        const p = RwsClient2.parse(await this.req('GET', '/rw/rapid/execution'));
         return (p.getState('rap-execution')['ctrlexecstate'] ?? 'stopped');
     }
     async getRapidExecutionInfo() {
-        const p = new XhtmlParser(await this.req('GET', '/rw/rapid/execution'));
+        const p = RwsClient2.parse(await this.req('GET', '/rw/rapid/execution'));
         // Live: <li class="rap-execution"><span class="ctrlexecstate">stopped</span><span class="cycle">forever</span>
         const d = p.getState('rap-execution');
         return {
@@ -247,7 +319,7 @@ export class RwsClient2 {
         return this.req('POST', '/rw/rapid/execution/cycle', { cycle }).then(() => { });
     }
     async getRapidTasks() {
-        const p = new XhtmlParser(await this.req('GET', '/rw/rapid/tasks'));
+        const p = RwsClient2.parse(await this.req('GET', '/rw/rapid/tasks'));
         return p.getAllStates('rap-task-li').map(t => ({
             name: t['name'] ?? '',
             type: t['type'] ?? 'normal',
@@ -302,7 +374,7 @@ export class RwsClient2 {
     }
     // ─── RAPID modules & variables ──────────────────────────────────────────────
     async listModules(task) {
-        const p = new XhtmlParser(await this.req('GET', `/rw/rapid/tasks/${task}/modules`));
+        const p = RwsClient2.parse(await this.req('GET', `/rw/rapid/tasks/${task}/modules`));
         return p.getAllStates('rap-module-info-li').map(m => m['name']).filter(Boolean);
     }
     /**
@@ -310,7 +382,7 @@ export class RwsClient2 {
      * Single round-trip — same endpoint as `listModules` but exposes more fields.
      */
     async listModulesDetailed(task) {
-        const p = new XhtmlParser(await this.req('GET', `/rw/rapid/tasks/${task}/modules`));
+        const p = RwsClient2.parse(await this.req('GET', `/rw/rapid/tasks/${task}/modules`));
         return p.getAllStates('rap-module-info-li')
             .map(m => ({ name: m['name'] ?? '', type: m['type'] ?? '' }))
             .filter(m => m.name);
@@ -337,7 +409,7 @@ export class RwsClient2 {
     async getRapidVariable(task, module, symbol) {
         // RWS 2.0 symbol API: suffix-style — /rw/rapid/symbol/{symburl}/data
         // (RWS 1.0 puts /data at the front: /rw/rapid/symbol/data/{symburl})
-        const p = new XhtmlParser(await this.req('GET', `/rw/rapid/symbol/RAPID/${task}/${module}/${symbol}/data`));
+        const p = RwsClient2.parse(await this.req('GET', `/rw/rapid/symbol/RAPID/${task}/${module}/${symbol}/data`));
         return p.get('value') ?? '';
     }
     setRapidVariable(task, module, symbol, value) {
@@ -356,7 +428,7 @@ export class RwsClient2 {
         }
     }
     async getRapidSymbolProperties(task, module, symbol) {
-        const p = new XhtmlParser(await this.req('GET', `/rw/rapid/symbol/RAPID/${task}/${module}/${symbol}/properties`));
+        const p = RwsClient2.parse(await this.req('GET', `/rw/rapid/symbol/RAPID/${task}/${module}/${symbol}/properties`));
         const d = p.getState('rap-sympropvar') || p.getState('rap-sympropvar-li') || p.getState('rap-symbol-properties');
         return {
             symburl: d['symburl'] ?? `RAPID/${task}/${module}/${symbol}`,
@@ -429,7 +501,7 @@ export class RwsClient2 {
         ];
         const out = [];
         for (const cls of liClasses) {
-            const p = new XhtmlParser(xhtml);
+            const p = RwsClient2.parse(xhtml);
             for (const s of p.getAllStates(cls)) {
                 out.push({
                     symburl: s['symburl'] ?? '',
@@ -447,7 +519,7 @@ export class RwsClient2 {
     }
     async getActiveUiInstruction() {
         try {
-            const p = new XhtmlParser(await this.req('GET', '/rw/rapid/uiinstr/active'));
+            const p = RwsClient2.parse(await this.req('GET', '/rw/rapid/uiinstr/active'));
             const d = p.getState('rap-uiinstr-li') || p.getState('rap-uiinstr');
             if (!d['instr']) {
                 return null;
@@ -464,7 +536,7 @@ export class RwsClient2 {
     }
     // ─── Motion ─────────────────────────────────────────────────────────────────
     async getJointPositions(mechunit = 'ROB_1') {
-        const p = new XhtmlParser(await this.req('GET', `/rw/motionsystem/mechunits/${mechunit}/jointtarget`));
+        const p = RwsClient2.parse(await this.req('GET', `/rw/motionsystem/mechunits/${mechunit}/jointtarget`));
         const d = p.getState('ms-jointtarget');
         return {
             rax_1: +d['rax_1'], rax_2: +d['rax_2'], rax_3: +d['rax_3'],
@@ -472,7 +544,7 @@ export class RwsClient2 {
         };
     }
     async getCartesianFull(mechunit = 'ROB_1') {
-        const p = new XhtmlParser(await this.req('GET', `/rw/motionsystem/mechunits/${mechunit}/cartesian`));
+        const p = RwsClient2.parse(await this.req('GET', `/rw/motionsystem/mechunits/${mechunit}/cartesian`));
         // Live: cf1/cf4/cf6/cfx in RWS 2.0 map to j1/j4/j6/jx in CartesianFull type
         const d = p.getState('ms-mechunit-cartesian');
         return {
@@ -482,7 +554,7 @@ export class RwsClient2 {
         };
     }
     async listMechunits() {
-        const p = new XhtmlParser(await this.req('GET', '/rw/motionsystem/mechunits'));
+        const p = RwsClient2.parse(await this.req('GET', '/rw/motionsystem/mechunits'));
         // Live: <li class="ms-mechunit-li" title="ROB_1">
         return p.getAllStates('ms-mechunit-li')
             .map(m => m['_title'])
@@ -490,18 +562,22 @@ export class RwsClient2 {
     }
     // ─── System info ─────────────────────────────────────────────────────────────
     async getSystemInfo() {
-        const p = new XhtmlParser(await this.req('GET', '/rw/system'));
+        const p = RwsClient2.parse(await this.req('GET', '/rw/system'));
         const d = p.getState('sys-system');
-        const opts = p.getAllStates('sys-option').map(o => o['option']).filter(Boolean);
+        // Type-name drift between representations (live-verified 2026-07-09, RW7.21):
+        // XHTML lists options as class="sys-option"; HAL JSON nests them under the
+        // sys-options-li resource as _type="sys-options". Collect both.
+        const opts = [...p.getAllStates('sys-option'), ...p.getAllStates('sys-options')]
+            .map(o => o['option']).filter(Boolean);
         return { name: d['name'] ?? '', rwVersion: d['rwversion'] ?? '', sysid: d['sysid'] ?? '', startTime: d['starttm'] ?? '', options: opts };
     }
     async getControllerIdentity() {
-        const p = new XhtmlParser(await this.req('GET', '/ctrl/identity'));
+        const p = RwsClient2.parse(await this.req('GET', '/ctrl/identity'));
         const d = p.getState('ctrl-identity-info');
         return { name: d['ctrl-name'] ?? '', id: '', type: d['ctrl-type'] ?? '', mac: '' };
     }
     async getControllerClock() {
-        const p = new XhtmlParser(await this.req('GET', '/ctrl/clock'));
+        const p = RwsClient2.parse(await this.req('GET', '/ctrl/clock'));
         return { datetime: p.getState('ctrl-clock-info')['datetime'] ?? '' };
     }
     setControllerClock(year, month, day, hour, min, sec) {
@@ -521,7 +597,7 @@ export class RwsClient2 {
     // ─── Event log ───────────────────────────────────────────────────────────────
     async getEventLog(domain = 0) {
         // lang=en required to get title/desc/causes/actions (confirmed by live probe)
-        const p = new XhtmlParser(await this.req('GET', `/rw/elog/${domain}?lang=en`));
+        const p = RwsClient2.parse(await this.req('GET', `/rw/elog/${domain}?lang=en`));
         return p.getAllStates('elog-message-li').map(m => {
             const parts = (m['_title'] ?? '').split('/');
             return {
@@ -547,7 +623,7 @@ export class RwsClient2 {
     }
     // ─── I/O signals ─────────────────────────────────────────────────────────────
     async listAllSignals(start = 0, limit = 200) {
-        const p = new XhtmlParser(await this.req('GET', `/rw/iosystem/signals?start=${start}&limit=${limit}`));
+        const p = RwsClient2.parse(await this.req('GET', `/rw/iosystem/signals?start=${start}&limit=${limit}`));
         return p.getAllStates('ios-signal-li').map(s => {
             const name = s['name'] ?? s['_title']?.split('/').pop() ?? '';
             const parts = (s['_title'] ?? '').split('/');
@@ -558,7 +634,7 @@ export class RwsClient2 {
         });
     }
     async readSignal(network, device, name) {
-        const p = new XhtmlParser(await this.req('GET', `/rw/iosystem/signals/${network}/${device}/${name}`));
+        const p = RwsClient2.parse(await this.req('GET', `/rw/iosystem/signals/${network}/${device}/${name}`));
         const d = p.getState('ios-signal-li');
         return { name: d['name'] ?? name, value: d['lvalue'] ?? '0', type: (d['type'] ?? 'DI'), lvalue: d['lvalue'] ?? '0' };
     }
@@ -566,13 +642,17 @@ export class RwsClient2 {
         let n = network, d = device;
         if (!n || !d) {
             const c = this.sigCoords.get(name);
-            n = c?.n ?? '';
-            d = c?.d ?? '';
+            if (!c) {
+                // Without coordinates the URL would degenerate to /signals///{name}/set-value.
+                return Promise.reject(new RwsError(`writeSignal: network/device unknown for signal "${name}" — pass them explicitly or call listAllSignals() first`, 'UNKNOWN'));
+            }
+            n = c.n;
+            d = c.d;
         }
         return this.req('POST', `/rw/iosystem/signals/${n}/${d}/${name}/set-value`, { lvalue: value }).then(() => { });
     }
     async listNetworks() {
-        const p = new XhtmlParser(await this.req('GET', '/rw/iosystem/networks'));
+        const p = RwsClient2.parse(await this.req('GET', '/rw/iosystem/networks'));
         // Live: <li class="ios-network-li" title="IntegratedIONetwork">
         //   <span class="name">IntegratedIONetwork</span><span class="pstate">running</span><span class="lstate">started</span>
         return p.getAllStates('ios-network-li').map(n => ({
@@ -582,7 +662,7 @@ export class RwsClient2 {
         }));
     }
     async listDevices(network) {
-        const p = new XhtmlParser(await this.req('GET', `/rw/iosystem/devices?network=${encodeURIComponent(network)}`));
+        const p = RwsClient2.parse(await this.req('GET', `/rw/iosystem/devices?network=${encodeURIComponent(network)}`));
         // Live: <li class="ios-device-li" title="IntBus/EPanel">
         //   <span class="name">EPanel</span><span class="lstate">enabled</span><span class="pstate">running</span><span class="address"></span>
         return p.getAllStates('ios-device-li').map(d => ({
@@ -594,9 +674,14 @@ export class RwsClient2 {
         }));
     }
     // ─── File system ──────────────────────────────────────────────────────────────
-    rws2Path(path) { return path.replace(/\$HOME/g, 'HOME'); }
+    rws2Path(path) {
+        // Percent-encode per segment so names with spaces, '#', '%', etc. survive
+        // URL parsing ('#' would otherwise be treated as a fragment and truncate the path).
+        return path.replace(/\$HOME/g, 'HOME')
+            .split('/').map(encodeURIComponent).join('/');
+    }
     async listDirectory(path) {
-        const p = new XhtmlParser(await this.req('GET', `/fileservice/${this.rws2Path(path)}`));
+        const p = RwsClient2.parse(await this.req('GET', `/fileservice/${this.rws2Path(path)}`));
         const dirs = p.getAllStates('fs-dir').map(d => ({ name: d['_title'] ?? '', type: 'dir', modified: d['fs-mdate'] }));
         const files = p.getAllStates('fs-file').map(f => ({ name: f['_title'] ?? '', type: 'file', size: f['fs-size'] ? +f['fs-size'] : undefined, created: f['fs-cdate'], modified: f['fs-mdate'], readonly: f['fs-readonly'] === 'true' }));
         return [...dirs, ...files];
@@ -627,9 +712,26 @@ export class RwsClient2 {
     }
     // ─── Configuration database `/rw/cfg` ───────────────────────────────────────
     async listCfgDomains() {
-        const p = new XhtmlParser(await this.req('GET', '/rw/cfg'));
+        const p = RwsClient2.parse(await this.req('GET', '/rw/cfg'));
         return p.getAllStates('cfg-domain-li').map(d => d['_title'] ?? d['name']).filter(Boolean);
     }
+    /**
+     * Next-page path from a paginated list response, resolved relative to the
+     * parent of the current request path (matches the controller's relative
+     * hrefs; live-verified on the XHTML `rel="next"` links and, 2026-07-09 on
+     * RW7.21, on the HAL `_links.next.href` form). Both representations XML-escape
+     * ampersands in the href — even inside JSON strings — hence the unescape.
+     * Returns '' when there is no further page.
+     */
+    static nextPagePath(responseBody, currentPath) {
+        const rel = HalJsonParser.looksLikeJson(responseBody)
+            ? new HalJsonParser(responseBody).nextHref()
+            : responseBody.match(/<a\s+href="([^"]+)"\s+rel="next"/)?.[1];
+        if (!rel) {
+            return '';
+        }
+        return currentPath.replace(/[^/]*$/, '') + rel.replace(/&amp;/g, '&');
+    }
     async listCfgTypes(domain) {
         // Live-verified class: cfg-dt-li (datatype-li). Paginated — controller returns 70/page.
         // Pagination quirk: the `rel="next"` href is relative to the response's <base href>
@@ -639,18 +741,9 @@ export class RwsClient2 {
         let pages = 0;
         while (path && pages < 50) {
             const html = await this.req('GET', path);
-            const p = new XhtmlParser(html);
+            const p = RwsClient2.parse(html);
             types.push(...p.getAllStates('cfg-dt-li').map(t => t['_title'] ?? t['name']).filter(Boolean));
-            const nextMatch = html.match(/<a\s+href="([^"]+)"\s+rel="next"/);
-            if (nextMatch) {
-                const rel = nextMatch[1].replace(/&amp;/g, '&');
-                // Resolve relative to the parent of the current path (controller's <base href> is /rw/cfg/).
-                const parent = path.replace(/[^/]*$/, '');
-                path = parent + rel;
-            }
-            else {
-                path = '';
-            }
+            path = RwsClient2.nextPagePath(html, path);
             pages++;
         }
         return types;
@@ -672,17 +765,9 @@ export class RwsClient2 {
             catch {
                 return instances;
             } // invalid type or no permission — silent empty
-            const p = new XhtmlParser(html);
+            const p = RwsClient2.parse(html);
             instances.push(...p.getAllStates('cfg-dt-instance-li').map(i => i['_title'] ?? '').filter(Boolean));
-            const nextMatch = html.match(/<a\s+href="([^"]+)"\s+rel="next"/);
-            if (nextMatch) {
-                const rel = nextMatch[1].replace(/&amp;/g, '&');
-                const parent = path.replace(/[^/]*$/, '');
-                path = parent + rel;
-            }
-            else {
-                path = '';
-            }
+            path = RwsClient2.nextPagePath(html, path);
             pages++;
         }
         return instances;
@@ -692,7 +777,7 @@ export class RwsClient2 {
         // Returns an outer cfg-dt-instance li with NESTED cfg-ia-t li elements.
         // Each attribute: <li class="cfg-ia-t" title="ATTR_NAME"><span class="value">VALUE</span></li>
         const html = await this.req('GET', `/rw/cfg/${domain}/${type}/instances/${encodeURIComponent(instance)}`);
-        const p = new XhtmlParser(html);
+        const p = RwsClient2.parse(html);
         const attribs = p.getAllStates('cfg-ia-t');
         const result = {};
         for (const attr of attribs) {
@@ -704,15 +789,42 @@ export class RwsClient2 {
         }
         return result;
     }
+    /**
+     * Update attributes on an existing configuration instance. Requires 'edit'
+     * mastership (callers hold it; RobotManager wraps these with mastership).
+     *
+     * Live-verified 2026-07-09 on OmniCore VC RW7.21 via probe-cfg-rws2.mjs:
+     *   ✓ POST /rw/cfg/{domain}/{type}/instances/{instance}
+     *     body: each attribute in BRACKET representation `Attr=[value,1]` joined
+     *     by '&', values literal (not percent-encoded), Content-Type
+     *     application/x-www-form-urlencoded;v=2.0 → 204. Partial attribute sets
+     *     are accepted; unknown attribute names → 400 "Error set attribute".
+     *   ✗ POST /rw/cfg/{domain}/{type}/{instance} (no /instances/) → 404
+     */
     async setCfgInstance(domain, type, instance, attrs) {
-        await this.req('POST', `/rw/cfg/${domain}/${type}/${encodeURIComponent(instance)}`, attrs);
+        const body = Object.entries(attrs).map(([k, v]) => `${k}=[${v},1]`).join('&');
+        await this.req('POST', `/rw/cfg/${domain}/${type}/instances/${encodeURIComponent(instance)}`, undefined, body, 'application/x-www-form-urlencoded;v=2.0');
     }
+    /**
+     * Create a new configuration instance, then apply `attrs`. Requires 'edit'
+     * mastership. Live-verified 2026-07-09 on OmniCore VC RW7.21:
+     *   ✓ POST /rw/cfg/{domain}/{type}/instances/create-default  body name={instance} → 201,
+     *     followed by the setCfgInstance shape above for the attribute values.
+     *   ✗ POST /rw/cfg/{domain}/{type}/{instance}/create → 404 (endpoint doesn't exist)
+     */
     async createCfgInstance(domain, type, instance, attrs) {
-        // POST on the type root with name=... creates a new instance
-        await this.req('POST', `/rw/cfg/${domain}/${type}/${encodeURIComponent(instance)}/create`, attrs);
+        await this.req('POST', `/rw/cfg/${domain}/${type}/instances/create-default`, undefined, `name=${instance}`, 'application/x-www-form-urlencoded;v=2.0');
+        if (Object.keys(attrs).length > 0) {
+            await this.setCfgInstance(domain, type, instance, attrs);
+        }
     }
+    /**
+     * Delete a configuration instance. Requires 'edit' mastership.
+     * Live-verified 2026-07-09 on OmniCore VC RW7.21:
+     *   ✓ DELETE /rw/cfg/{domain}/{type}/instances/{instance} → 204 (readback → 404)
+     */
     async removeCfgInstance(domain, type, instance) {
-        await this.req('DELETE', `/rw/cfg/${domain}/${type}/${encodeURIComponent(instance)}`);
+        await this.req('DELETE', `/rw/cfg/${domain}/${type}/instances/${encodeURIComponent(instance)}`);
     }
     async loadCfgFile(filepath, action = 'replace') {
         await this.req('POST', '/rw/cfg', { 'action-type': action, filepath });
@@ -724,7 +836,7 @@ export class RwsClient2 {
     async listBackups() {
         // Backups live under /fileservice/BACKUP — list that volume
         try {
-            const p = new XhtmlParser(await this.req('GET', '/fileservice/BACKUP'));
+            const p = RwsClient2.parse(await this.req('GET', '/fileservice/BACKUP'));
             return p.getAllStates('fs-dir').map(d => ({
                 name: d['_title'] ?? '',
                 created: d['fs-cdate'],
@@ -741,7 +853,7 @@ export class RwsClient2 {
         await this.req('POST', '/ctrl/backup/restore', { 'backup': `BACKUP/${name}` });
     }
     async getBackupStatus() {
-        const p = new XhtmlParser(await this.req('GET', '/ctrl/backup'));
+        const p = RwsClient2.parse(await this.req('GET', '/ctrl/backup'));
         const d = p.getState('ctrl-backup-info-li') || p.getState('ctrl-backup-info');
         const phase = d['progress-state'] ?? d['phase'] ?? '';
         return {
@@ -754,17 +866,17 @@ export class RwsClient2 {
     // RWS exposes these via the mechunit's tool-name / wobj-name attributes;
     // setting requires updating the active task's tooldata/wobjdata RAPID symbols.
     async getActiveTool(mechunit = 'ROB_1') {
-        const p = new XhtmlParser(await this.req('GET', `/rw/motionsystem/mechunits/${mechunit}`));
+        const p = RwsClient2.parse(await this.req('GET', `/rw/motionsystem/mechunits/${mechunit}`));
         const d = p.getState('ms-mechunit');
         return { name: d['tool-name'] ?? 'tool0' };
     }
     async getActiveWobj(mechunit = 'ROB_1') {
-        const p = new XhtmlParser(await this.req('GET', `/rw/motionsystem/mechunits/${mechunit}`));
+        const p = RwsClient2.parse(await this.req('GET', `/rw/motionsystem/mechunits/${mechunit}`));
         const d = p.getState('ms-mechunit');
         return { name: d['wobj-name'] ?? 'wobj0' };
     }
     async getActivePayload(mechunit = 'ROB_1') {
-        const p = new XhtmlParser(await this.req('GET', `/rw/motionsystem/mechunits/${mechunit}`));
+        const p = RwsClient2.parse(await this.req('GET', `/rw/motionsystem/mechunits/${mechunit}`));
         const d = p.getState('ms-mechunit');
         return { name: d['total-payload-name'] ?? d['payload-name'] ?? 'load0' };
     }
@@ -780,7 +892,7 @@ export class RwsClient2 {
     }
     // ─── DIPC `/rw/dipc` ───────────────────────────────────────────────────────
     async listDipcQueues() {
-        const p = new XhtmlParser(await this.req('GET', '/rw/dipc'));
+        const p = RwsClient2.parse(await this.req('GET', '/rw/dipc'));
         return p.getAllStates('dipc-queue-li').map(q => ({
             name: q['queue-name'] ?? q['_title'] ?? '',
             size: q['queue-size'] ? +q['queue-size'] : undefined,
@@ -806,7 +918,7 @@ export class RwsClient2 {
     }
     async readDipcMessage(queue, timeoutMs = 0) {
         try {
-            const p = new XhtmlParser(await this.req('POST', `/rw/dipc/${encodeURIComponent(queue)}/read`, {
+            const p = RwsClient2.parse(await this.req('POST', `/rw/dipc/${encodeURIComponent(queue)}/read`, {
                 'dipc-timeout': String(timeoutMs),
             }));
             const d = p.getState('dipc-message');
@@ -850,7 +962,7 @@ export class RwsClient2 {
      */
     async requestMastershipWithId(domain) {
         const xhtml = await this.req('POST', `/rw/mastership/${this.rws2Domain(domain)}/request-with-id`);
-        const id = new XhtmlParser(xhtml).get('mastership-id');
+        const id = RwsClient2.parse(xhtml).get('mastership-id');
         if (!id) {
             throw new Error('RWS2 request-with-id: no mastership-id in response');
         }
@@ -877,13 +989,13 @@ export class RwsClient2 {
     }
     /** Read mastership status for one domain — returns 'nomaster' | 'remote' | 'local' | similar. */
     async getMastershipStatus(domain) {
-        const p = new XhtmlParser(await this.req('GET', `/rw/mastership/${this.rws2Domain(domain)}`));
+        const p = RwsClient2.parse(await this.req('GET', `/rw/mastership/${this.rws2Domain(domain)}`));
         const d = p.getState('msh-resource');
         return { mastership: d['mastership'] ?? 'unknown', uid: d['uid'], application: d['application'] };
     }
     /** List all mastership domains the controller exposes (typically `['edit', 'motion']`). */
     async listMastershipDomains() {
-        const p = new XhtmlParser(await this.req('GET', '/rw/mastership'));
+        const p = RwsClient2.parse(await this.req('GET', '/rw/mastership'));
         return p.getAllStates('msh-resource-li').map(d => d['_title']).filter(Boolean);
     }
     // ─── Devices `/rw/devices` ──────────────────────────────────────────────────
@@ -893,15 +1005,17 @@ export class RwsClient2 {
      * Drill into each group with `getDeviceTree(group)`.
      */
     async listSystemDevices() {
-        const p = new XhtmlParser(await this.req('GET', '/rw/devices'));
+        const p = RwsClient2.parse(await this.req('GET', '/rw/devices'));
         return p.getAllStates('dev-id-li').map(d => ({
             id: d['_title'] ?? '',
             name: d['name'] ?? '',
         }));
     }
-    /** Drill into a device group (e.g. 'HW_DEVICES'). Returns sub-tree as raw XHTML map. */
+    /** Drill into a device group (e.g. 'HW_DEVICES'). Returns sub-tree as raw XHTML map.
+     *  Accept is pinned to XHTML so the promised raw format never changes under
+     *  the HAL JSON negotiation. */
     async getDeviceTree(group) {
-        return this.req('GET', `/rw/devices/${encodeURIComponent(group)}`);
+        return this.req('GET', `/rw/devices/${encodeURIComponent(group)}`, undefined, undefined, undefined, [], RwsClient2.ACCEPT_XHTML);
     }
     /**
      * List ALL configured I/O devices across every network in one call.
@@ -909,7 +1023,7 @@ export class RwsClient2 {
      * one's handy when you want a flat overview without enumerating networks first.)
      */
     async listAllIoDevices() {
-        const p = new XhtmlParser(await this.req('GET', '/rw/iosystem/devices'));
+        const p = RwsClient2.parse(await this.req('GET', '/rw/iosystem/devices'));
         return p.getAllStates('ios-device-li').map(d => {
             const title = d['_title'] ?? '';
             const network = title.split('/')[0] ?? '';
@@ -939,7 +1053,7 @@ export class RwsClient2 {
             tool, wobj,
         }).toString();
         const xhtml = await this.req('POST', `/rw/motionsystem/mechunits/${mechunit}?action=CalcRobTFromJoints`, undefined, body);
-        const p = new XhtmlParser(xhtml);
+        const p = RwsClient2.parse(xhtml);
         if (p.getError()) {
             throw new Error(`FK rejected: ${p.getError()?.msg ?? 'unknown'} (likely missing PC Interface 616-1 license)`);
         }
@@ -964,7 +1078,7 @@ export class RwsClient2 {
     // ─── Vision `/rw/vision` ────────────────────────────────────────────────────
     async listVisionSystems() {
         try {
-            const p = new XhtmlParser(await this.req('GET', '/rw/vision'));
+            const p = RwsClient2.parse(await this.req('GET', '/rw/vision'));
             return p.getAllStates('vision-system-li').map(s => ({
                 name: s['_title'] ?? s['name'] ?? '',
                 status: s['status'],
@@ -975,11 +1089,11 @@ export class RwsClient2 {
         }
     }
     async getVisionSystemInfo(name) {
-        const p = new XhtmlParser(await this.req('GET', `/rw/vision/${encodeURIComponent(name)}`));
+        const p = RwsClient2.parse(await this.req('GET', `/rw/vision/${encodeURIComponent(name)}`));
         return p.getState('vision-system');
     }
     async listVisionJobs(system) {
-        const p = new XhtmlParser(await this.req('GET', `/rw/vision/${encodeURIComponent(system)}/jobs`));
+        const p = RwsClient2.parse(await this.req('GET', `/rw/vision/${encodeURIComponent(system)}/jobs`));
         return p.getAllStates('vision-job-li').map(j => ({
             name: j['name'] ?? j['_title'] ?? '',
             active: j['active'] === 'true',
@@ -991,7 +1105,7 @@ export class RwsClient2 {
     // ─── Safety controller `/ctrl/safety` ──────────────────────────────────────
     async getSafetyStatus() {
         try {
-            const p = new XhtmlParser(await this.req('GET', '/ctrl/safety'));
+            const p = RwsClient2.parse(await this.req('GET', '/ctrl/safety'));
             const d = p.getState('ctrl-safety') || p.getState('ctrl-safety-info');
             return { state: d['state'] ?? 'unknown', details: d };
         }
@@ -1001,7 +1115,7 @@ export class RwsClient2 {
     }
     async listSafetyZones() {
         try {
-            const p = new XhtmlParser(await this.req('GET', '/ctrl/safety/zones'));
+            const p = RwsClient2.parse(await this.req('GET', '/ctrl/safety/zones'));
             return p.getAllStates('ctrl-safety-zone-li');
         }
         catch {
@@ -1021,7 +1135,7 @@ export class RwsClient2 {
         //   /vtspeed → class="ctrl-vtspeed" → span "vtcurrspeed" (1.0=real, 10=10x)
         const fetch = async (sub) => {
             try {
-                const p = new XhtmlParser(await this.req('GET', `/ctrl/virtualtime/${sub}`));
+                const p = RwsClient2.parse(await this.req('GET', `/ctrl/virtualtime/${sub}`));
                 return p.getState(`ctrl-${sub}`) || {};
             }
             catch {
@@ -1048,7 +1162,7 @@ export class RwsClient2 {
     // ─── Certificate store `/ctrl/certstore` ──────────────────────────────────
     async listCertificates() {
         try {
-            const p = new XhtmlParser(await this.req('GET', '/ctrl/certstore'));
+            const p = RwsClient2.parse(await this.req('GET', '/ctrl/certstore'));
             return p.getAllStates('ctrl-cert-li').map(c => ({
                 name: c['name'] ?? c['_title'] ?? '',
                 subject: c['subject'],
@@ -1068,7 +1182,7 @@ export class RwsClient2 {
     // ─── Registry `/ctrl/registry` ────────────────────────────────────────────
     async getRegistry() {
         try {
-            const p = new XhtmlParser(await this.req('GET', '/ctrl/registry'));
+            const p = RwsClient2.parse(await this.req('GET', '/ctrl/registry'));
             return p.getState('ctrl-registry');
         }
         catch {
@@ -1082,7 +1196,7 @@ export class RwsClient2 {
     // ─── File service — list volumes ──────────────────────────────────────────
     async listFileVolumes() {
         try {
-            const p = new XhtmlParser(await this.req('GET', '/fileservice'));
+            const p = RwsClient2.parse(await this.req('GET', '/fileservice'));
             return p.getAllStates('fs-volume').map(v => v['_title'] ?? v['name']).filter(Boolean);
         }
         catch {
@@ -1121,7 +1235,7 @@ export class RwsClient2 {
     async listBreakpoints(task) {
         try {
             // Live-verified: /rw/rapid/tasks/{task}/program/breakpoints (not /breakpoint at task root)
-            const p = new XhtmlParser(await this.req('GET', `/rw/rapid/tasks/${task}/program/breakpoints`));
+            const p = RwsClient2.parse(await this.req('GET', `/rw/rapid/tasks/${task}/program/breakpoints`));
             return p.getAllStates('rap-breakpoint-li').map(b => ({
                 module: b['modulename'] ?? b['modulemame'] ?? b['module'] ?? '',
                 row: +(b['begin-position-row'] ?? '0'),
@@ -1149,7 +1263,7 @@ export class RwsClient2 {
     // ─── Mechunit detailed endpoints ────────────────────────────────────────────
     async getMechunitBaseFrame(mechunit = 'ROB_1') {
         // Live-verified class: ms-mechunit-baseframe (not ms-baseframe)
-        const p = new XhtmlParser(await this.req('GET', `/rw/motionsystem/mechunits/${mechunit}/baseframe`));
+        const p = RwsClient2.parse(await this.req('GET', `/rw/motionsystem/mechunits/${mechunit}/baseframe`));
         const d = p.getState('ms-mechunit-baseframe') || p.getState('ms-baseframe');
         return {
             x: +d['x'], y: +d['y'], z: +d['z'],
@@ -1165,7 +1279,7 @@ export class RwsClient2 {
     async getMechunitAxes(mechunit = 'ROB_1') {
         // Live-verified: /axes returns a count + sub-resource links (axes/1..N).
         // Fetch each axis individually and assemble the result.
-        const p = new XhtmlParser(await this.req('GET', `/rw/motionsystem/mechunits/${mechunit}/axes`));
+        const p = RwsClient2.parse(await this.req('GET', `/rw/motionsystem/mechunits/${mechunit}/axes`));
         const total = p.getState('ms-mechunit-axes');
         const axisCount = +(total['axes'] ?? 0);
         if (axisCount === 0) {
@@ -1174,7 +1288,7 @@ export class RwsClient2 {
         const axes = [];
         for (let i = 1; i <= axisCount; i++) {
             try {
-                const ap = new XhtmlParser(await this.req('GET', `/rw/motionsystem/mechunits/${mechunit}/axes/${i}`));
+                const ap = RwsClient2.parse(await this.req('GET', `/rw/motionsystem/mechunits/${mechunit}/axes/${i}`));
                 const ad = ap.getState('ms-mechunit-axis') || ap.getState('ms-axis');
                 axes.push({ axis: String(i), ...ad });
             }
@@ -1185,7 +1299,7 @@ export class RwsClient2 {
         return axes;
     }
     async getMechunitPjoints(mechunit = 'ROB_1') {
-        const p = new XhtmlParser(await this.req('GET', `/rw/motionsystem/mechunits/${mechunit}/pjoints`));
+        const p = RwsClient2.parse(await this.req('GET', `/rw/motionsystem/mechunits/${mechunit}/pjoints`));
         const d = p.getState('ms-pjoints');
         const out = {};
         for (const [k, v] of Object.entries(d)) {
@@ -1196,18 +1310,58 @@ export class RwsClient2 {
         return out;
     }
     async getMechunitInfo(mechunit = 'ROB_1') {
-        const p = new XhtmlParser(await this.req('GET', `/rw/motionsystem/mechunits/${mechunit}`));
+        const p = RwsClient2.parse(await this.req('GET', `/rw/motionsystem/mechunits/${mechunit}`));
         return p.getState('ms-mechunit');
     }
     // ─── Module detailed endpoints ──────────────────────────────────────────────
     async getModuleSource(task, moduleName) {
-        // Modules can live in $HOME, DATA, etc. — first fetch metadata to find path
-        const info = await this.getModuleInfo(task, moduleName);
-        const filepath = info['path'] ?? info['file-path'] ?? `$HOME/${moduleName}.mod`;
-        return this.readFile(filepath);
+        // Program memory is the source of truth — the save round-trip reads it
+        // directly, so it is the PRIMARY path. A direct file read can return a
+        // stale on-disk copy (module edited in memory, or a leftover HOME file
+        // shadowing a module that was actually loaded from .pgf / RobotStudio),
+        // and module metadata exposes no reliable backing path to trust: the
+        // per-module GET only carries a bare `filename` span (live-verified
+        // 2026-07-09 on OmniCore VC RW7.21 — no path/file-path field exists).
+        try {
+            return await this.readModuleViaSave(task, moduleName);
+        }
+        catch {
+            // Save endpoint failed (permissions, disk, transient) — fall back to the
+            // backing file named by metadata, or the conventional HOME location.
+            const info = await this.getModuleInfo(task, moduleName).catch(() => ({}));
+            const filepath = info['path'] ?? info['file-path']
+                ?? (info['filename'] ? `HOME/${info['filename']}` : `$HOME/${moduleName}.mod`);
+            return this.readFile(filepath);
+        }
+    }
+    /**
+     * Read a module's source by round-tripping it through the TEMP volume.
+     * Live-verified 2026-07-08 on OmniCore VC RW7.21:
+     *   POST /rw/rapid/tasks/{task}/modules/{module}/save  body name=<tmp>&path=TEMP:
+     *   → 204, no mastership required. The controller ALWAYS appends '.modx' to
+     *   the given name (even for SysMod modules — never '.sysx'), so the name is
+     *   passed without extension. TEMP: avoids any risk of clobbering HOME files.
+     */
+    async readModuleViaSave(task, moduleName) {
+        const tmp = `${moduleName}_${Date.now().toString(36)}${Math.floor(Math.random() * 0xffff).toString(36)}`;
+        await this.req('POST', `/rw/rapid/tasks/${task}/modules/${encodeURIComponent(moduleName)}/save`, undefined, `name=${tmp}&path=TEMP:`);
+        try {
+            return await this.readFile(`TEMP/${tmp}.modx`);
+        }
+        finally {
+            await this.deleteFile(`TEMP/${tmp}.modx`).catch(() => { });
+        }
     }
     async getModuleInfo(task, moduleName) {
-        const p = new XhtmlParser(await this.req('GET', `/rw/rapid/tasks/${task}/modules/${encodeURIComponent(moduleName)}`));
+        // Live-verified 2026-07-09 on OmniCore VC RW7.21: the per-module GET returns
+        // <li class="rap-module" title="{task}/{module}"> with spans modname,
+        // filename (bare name like 'BASE.sysx' — NO path) and attribute.
+        // (rap-module-info-li is the class used by the module LIST endpoint.)
+        const p = RwsClient2.parse(await this.req('GET', `/rw/rapid/tasks/${task}/modules/${encodeURIComponent(moduleName)}`));
+        const d = p.getState('rap-module');
+        if (Object.keys(d).length > 0) {
+            return d;
+        }
         return p.getState('rap-module-info-li') || p.getState('rap-module-info');
     }
     async listModuleSymbols(task, moduleName) {
@@ -1216,15 +1370,15 @@ export class RwsClient2 {
     }
     // ─── Per-task additional endpoints ──────────────────────────────────────────
     async getTaskStructuralChangeCount(task) {
-        const p = new XhtmlParser(await this.req('GET', `/rw/rapid/tasks/${task}/structural-changecount`));
+        const p = RwsClient2.parse(await this.req('GET', `/rw/rapid/tasks/${task}/structural-changecount`));
         return Number(p.get('change-count') ?? p.get('structural-changecount') ?? 0);
     }
     async getTaskMotion(task) {
-        const p = new XhtmlParser(await this.req('GET', `/rw/rapid/tasks/${task}/motion`));
+        const p = RwsClient2.parse(await this.req('GET', `/rw/rapid/tasks/${task}/motion`));
         return p.getState('rap-task-motion') || {};
     }
     async getTaskActivationRecord(task) {
-        const p = new XhtmlParser(await this.req('GET', `/rw/rapid/tasks/${task}/activation-record`));
+        const p = RwsClient2.parse(await this.req('GET', `/rw/rapid/tasks/${task}/activation-record`));
         return p.getState('rap-activation-record') || {};
     }
     async getTaskProgramInfo(task) {
@@ -1233,7 +1387,7 @@ export class RwsClient2 {
         if (!xml) {
             return {};
         }
-        return new XhtmlParser(xml).getState('rap-program-info') || {};
+        return RwsClient2.parse(xml).getState('rap-program-info') || {};
     }
     // ─── WebSocket subscriptions ──────────────────────────────────────────────────
     /**
@@ -1286,22 +1440,26 @@ export class RwsClient2 {
         }
         return path; // fallback: keep full path
     }
-    async subscribe(resources, handler) {
-        // 1. Build subscription body
-        const paths = resources.map(r => RwsClient2.rws2ResourcePath(r)).filter(Boolean);
-        if (paths.length === 0) {
-            return async () => { };
-        }
-        const parts = [`resources=${paths.length}`];
-        paths.forEach((p, i) => {
-            // Format: <idx>=<path;stateParam>&<idx>-p=<priority>
-            // Semicolons must be LITERAL — do NOT encodeURIComponent
-            parts.push(`${i + 1}=${p}&${i + 1}-p=1`);
-        });
-        const bodyStr = parts.join('&');
-        // 2. POST /subscription — accept HTTP 201 (Created)
-        //    Capture the Location header (authoritative WS URL) and Set-Cookie (required for WS auth)
-        const { wsUrl, deleteUrl, cookieStr } = await new Promise((resolve, reject) => {
+    /** First reconnect delay after a dropped subscription WebSocket (doubles per attempt). */
+    static WS_RECONNECT_BASE_MS = 500;
+    /** Give up re-subscribing after this many consecutive failed attempts. */
+    static WS_RECONNECT_MAX_ATTEMPTS = 6;
+    /** How long to wait for the WebSocket upgrade to complete before treating the attempt as failed. */
+    static WS_OPEN_TIMEOUT_MS = 8000;
+    /**
+     * POST /subscription — accept HTTP 201 (Created).
+     * Captures the Location header (authoritative WS URL) and the group resource
+     * path (`/subscription/{id}` — the URL a DELETE must target to free the group).
+     *
+     * Rides the client's main HTTP session: live-verified 2026-07-09 on OmniCore
+     * VC RW7.21 (probe-sub-session.mjs) — POST /subscription with the existing
+     * session Cookie returns 201 with NO Set-Cookie (no new session minted) and
+     * the WebSocket authenticates with that same cookie. Without the Cookie the
+     * controller mints one session per subscribe, and reconnect loops would burn
+     * through the 5-sessions-per-IP budget.
+     */
+    createSubscription(bodyStr) {
+        return new Promise((resolve, reject) => {
             const url = new URL('/subscription', this.baseUrl);
             const encoded = Buffer.from(bodyStr);
             const options = {
@@ -1314,8 +1472,12 @@ export class RwsClient2 {
                     Accept: 'application/xhtml+xml;v=2.0',
                     'Content-Type': 'application/x-www-form-urlencoded;v=2.0',
                     'Content-Length': String(encoded.length),
+                    ...(this.sessionCookie ? { Cookie: this.sessionCookie } : {}),
                 },
-                ...(this.isHttps ? { agent: this.httpsAgent } : {}),
+                // Per-request as well as on the agent — see req() for why (issue #2).
+                ...(this.isHttps
+                    ? { agent: this.httpsAgent, ...(this.rejectUnauthorized ? {} : { rejectUnauthorized: false }) }
+                    : {}),
             };
             const transport = this.isHttps ? https : http;
             const req = transport.request(options, res => {
@@ -1326,24 +1488,34 @@ export class RwsClient2 {
                         reject(new Error(`RWS2 subscribe POST returned ${res.statusCode}`));
                         return;
                     }
+                    const body = Buffer.concat(chunks).toString('utf8');
                     // Location header contains the WebSocket URL (wss://host/poll/{id})
                     const location = (res.headers['location'] ?? '');
                     let wsUrl;
-                    let deleteUrl;
                     if (location.startsWith('wss://') || location.startsWith('ws://')) {
                         wsUrl = location;
-                        deleteUrl = location.replace(/^wss:/, 'https:').replace(/^ws:/, 'http:');
                     }
                     else {
                         // Fallback: parse from XHTML body
-                        const body = Buffer.concat(chunks).toString('utf8');
-                        const wsMatch = body.match(/href="(wss?:\/\/[^"]+)"/);
-                        wsUrl = wsMatch?.[1] ?? '';
-                        deleteUrl = wsUrl.replace(/^wss:/, 'https:').replace(/^ws:/, 'http:');
+                        wsUrl = body.match(/href="(wss?:\/\/[^"]+)"/)?.[1] ?? '';
                     }
-                    // Capture session cookies — WebSocket needs Cookie header, NOT Authorization
+                    // Group resource for cleanup. Live-verified 2026-07-09 on OmniCore VC
+                    // RW7.21: DELETE /subscription/{id} → 200 and the group disappears;
+                    // DELETE on the /poll/{id} URL → 404 (it is NOT a deletable resource).
+                    // The 201 body carries <a href="subscription/{id}" rel="group"/>.
+                    const groupId = body.match(/href="[^"]*subscription\/([^"/]+)"[^>]*rel="group"/)?.[1]
+                        ?? body.match(/rel="group"[^>]*href="[^"]*subscription\/([^"/]+)"/)?.[1]
+                        ?? wsUrl.match(/\/poll\/([^/?#]+)/)?.[1]
+                        ?? '';
+                    const deleteUrl = groupId ? `/subscription/${groupId}` : '';
+                    // Capture the session cookie if this POST minted one (first-ever request
+                    // on this client) — same capture rule as req(). The WebSocket authenticates
+                    // with Cookie, NOT Authorization.
                     const setCookies = (res.headers['set-cookie'] ?? []);
-                    const cookieStr = setCookies.map((c) => c.split(';')[0]).join('; ');
+                    if (setCookies.length > 0 && !this.sessionCookie) {
+                        this.sessionCookie = setCookies.map((c) => c.split(';')[0]).join('; ');
+                    }
+                    const cookieStr = this.sessionCookie ?? '';
                     if (!wsUrl) {
                         reject(new Error('RWS2 subscribe: no WebSocket URL'));
                         return;
@@ -1355,85 +1527,215 @@ export class RwsClient2 {
             req.write(encoded);
             req.end();
         });
-        // 3. Open WebSocket and wait for confirmation it actually connected.
-        //    Auth: Cookie from subscription response (NOT Authorization header).
-        //    Subprotocol: "robapi2_subscription" (ABB standard; may not be supported on all VCs).
-        //    We dynamically import 'ws' so callers who never subscribe don't pay for it.
-        //    (ESM-safe; the package is `"type": "module"`, so `require` is undefined.)
+    }
+    async subscribe(resources, handler, onLost) {
+        // 1. Build subscription body
+        const paths = resources.map(r => RwsClient2.rws2ResourcePath(r)).filter(Boolean);
+        if (paths.length === 0) {
+            return async () => { };
+        }
+        const parts = [`resources=${paths.length}`];
+        paths.forEach((p, i) => {
+            // Format: <idx>=<path;stateParam>&<idx>-p=<priority>
+            // Semicolons must be LITERAL — do NOT encodeURIComponent
+            parts.push(`${i + 1}=${p}&${i + 1}-p=1`);
+        });
+        const bodyStr = parts.join('&');
+        // We dynamically import 'ws' so callers who never subscribe don't pay for it.
+        // (ESM-safe; the package is `"type": "module"`, so `require` is undefined.)
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         const wsMod = await import('ws');
         const WsImpl = wsMod.default;
-        const ws = new WsImpl(wsUrl, ['robapi2_subscription'], {
-            rejectUnauthorized: false,
-            headers: { Cookie: cookieStr },
-        });
-        // Wait up to 8 s for the WebSocket to open.  If the controller rejects the upgrade
-        // (e.g. RWS 2.0 virtual controller), we clean up and throw so the caller falls back to polling.
-        await new Promise((resolve, reject) => {
-            const timer = setTimeout(() => {
-                ws.terminate();
-                reject(new Error('WebSocket connection timed out after 8 s'));
-            }, 8000);
-            ws.on('open', () => {
-                clearTimeout(timer);
-                resolve();
-            });
-            // unexpected-response fires when the HTTP upgrade is rejected (e.g. 400)
+        // Connection state shared between the reconnect logic and unsubscribe.
+        const conn = {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            ws.on('unexpected-response', (_req, res) => {
-                clearTimeout(timer);
-                const chunks = [];
-                res.on('data', (c) => chunks.push(c));
-                res.on('end', () => {
-                    const body = (Buffer.concat(chunks).toString().trim() || '').slice(0, 120);
+            ws: null,
+            deleteUrl: '',
+            pingTimer: null,
+            reconnectTimer: null,
+            closed: false,
+            attempts: 0,
+            lostNotified: false,
+        };
+        // Best-effort removal of a subscription group (DELETE /subscription/{id}).
+        // Groups live as long as the session that owns them, and the session is the
+        // client's main one — orphaned groups would pile up on every reconnect.
+        const dropGroup = (path) => path ? this.req('DELETE', path).then(() => { }, () => { }) : Promise.resolve();
+        // The subscription rides the main HTTP session (see createSubscription), so a
+        // dropped WebSocket does NOT invalidate the group — but its poll URL is spent.
+        // Every (re)connect drops the previous group, then POSTs a fresh /subscription
+        // on the same session; no extra sessions are ever minted.
+        const open = async () => {
+            if (conn.deleteUrl) {
+                await dropGroup(conn.deleteUrl);
+                conn.deleteUrl = '';
+            }
+            const { wsUrl, deleteUrl, cookieStr } = await this.createSubscription(bodyStr);
+            conn.deleteUrl = deleteUrl;
+            // 2. Open WebSocket and wait for confirmation it actually connected.
+            //    Auth: Cookie from subscription response (NOT Authorization header).
+            //    Subprotocol: "rws_subscription" — the RWS 2.0 name. Live-verified 2026-07-08
+            //    on OmniCore VC RW7.21: "robapi2_subscription" (the RWS 1.0 name) is rejected
+            //    with HTTP 400; "rws_subscription" upgrades with 101.
+            const ws = new WsImpl(wsUrl, ['rws_subscription'], {
+                ...(this.rejectUnauthorized ? {} : { rejectUnauthorized: false }),
+                headers: { Cookie: cookieStr },
+            });
+            // Wait for the WebSocket to open.  If the controller rejects the upgrade,
+            // we clean up and throw so the caller falls back to polling.
+            await new Promise((resolve, reject) => {
+                let settled = false;
+                const timer = setTimeout(() => {
+                    if (settled) {
+                        return;
+                    }
+                    settled = true;
                     ws.terminate();
-                    this.reqDelete(deleteUrl).catch(() => { });
-                    reject(new Error(`RWS2 WebSocket upgrade rejected (HTTP ${res.statusCode}): ${body}`));
+                    dropGroup(deleteUrl);
+                    reject(new Error(`WebSocket connection timed out after ${RwsClient2.WS_OPEN_TIMEOUT_MS} ms`));
+                }, RwsClient2.WS_OPEN_TIMEOUT_MS);
+                ws.on('open', () => {
+                    if (settled) {
+                        return;
+                    }
+                    settled = true;
+                    clearTimeout(timer);
+                    resolve();
+                });
+                // unexpected-response fires when the HTTP upgrade is rejected (e.g. 400)
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                ws.on('unexpected-response', (_req, res) => {
+                    clearTimeout(timer);
+                    const chunks = [];
+                    res.on('data', (c) => chunks.push(c));
+                    res.on('end', () => {
+                        if (settled) {
+                            return;
+                        }
+                        settled = true;
+                        const body = (Buffer.concat(chunks).toString().trim() || '').slice(0, 120);
+                        ws.terminate();
+                        dropGroup(deleteUrl);
+                        reject(new Error(`RWS2 WebSocket upgrade rejected (HTTP ${res.statusCode}): ${body}`));
+                    });
+                });
+                ws.on('error', (err) => {
+                    if (settled) {
+                        return;
+                    }
+                    settled = true;
+                    clearTimeout(timer);
+                    dropGroup(deleteUrl);
+                    reject(err);
                 });
             });
+            // Unsubscribed while the handshake was in flight — discard the connection.
+            if (conn.closed) {
+                ws.close();
+                dropGroup(deleteUrl);
+                return;
+            }
+            conn.ws = ws;
+            // 3. Ping every 25 s (controller closes if no activity within 30 s)
+            conn.pingTimer = setInterval(() => {
+                if (ws.readyState === 1 /* OPEN */) {
+                    ws.send('PING');
+                }
+            }, 25000);
+            // 4. Parse incoming events (same approach as abb-rws-client WsSubscriber)
+            ws.on('message', (data) => {
+                const raw = data.toString();
+                if (raw === 'PONG') {
+                    return;
+                }
+                const liPat = /<li[^>]*>([\s\S]*?)<\/li>/gi;
+                let m;
+                while ((m = liPat.exec(raw)) !== null) {
+                    const block = m[1];
+                    const hrefM = block.match(/<a[^>]*href="([^"]+)"/i);
+                    const spanM = block.match(/<span[^>]*>([\s\S]*?)<\/span>/i);
+                    if (!hrefM || !spanM) {
+                        continue;
+                    }
+                    handler({
+                        resource: RwsClient2.resourcePathToName(hrefM[1]),
+                        value: spanM[1].trim(),
+                        timestamp: new Date(),
+                    });
+                }
+            });
+            // Non-fatal error after open — the matching 'close' event drives cleanup/reconnect.
             ws.on('error', (err) => {
-                clearTimeout(timer);
-                this.reqDelete(deleteUrl).catch(() => { });
-                reject(err);
+                console.warn('[RWS2] WebSocket error:', err.message);
             });
-        });
-        // 4. Ping every 25 s (controller closes if no activity within 30 s)
-        const pingTimer = setInterval(() => {
-            if (ws.readyState === 1 /* OPEN */) {
-                ws.send('PING');
-            }
-        }, 25000);
-        // 5. Parse incoming events (same approach as abb-rws-client WsSubscriber)
-        ws.on('message', (data) => {
-            const raw = data.toString();
-            if (raw === 'PONG') {
+            ws.on('close', () => {
+                if (conn.pingTimer) {
+                    clearInterval(conn.pingTimer);
+                    conn.pingTimer = null;
+                }
+                if (!conn.closed) {
+                    scheduleReconnect();
+                }
+            });
+        };
+        const scheduleReconnect = () => {
+            // unsubscribe() clears the pending timer, but an open() already in
+            // flight lands here through its .catch — without this guard it would
+            // keep retrying (and eventually fire onLost) after the consumer left.
+            if (conn.closed) {
                 return;
             }
-            const liPat = /<li[^>]*>([\s\S]*?)<\/li>/gi;
-            let m;
-            while ((m = liPat.exec(raw)) !== null) {
-                const block = m[1];
-                const hrefM = block.match(/<a[^>]*href="([^"]+)"/i);
-                const spanM = block.match(/<span[^>]*>([\s\S]*?)<\/span>/i);
-                if (!hrefM || !spanM) {
-                    continue;
+            if (conn.attempts >= RwsClient2.WS_RECONNECT_MAX_ATTEMPTS) {
+                const msg = `RWS2 subscription lost — giving up after ${conn.attempts} reconnect attempts`;
+                Logger.error(msg);
+                console.error(`[RWS2] ${msg}`);
+                void dropGroup(conn.deleteUrl);
+                conn.deleteUrl = '';
+                if (!conn.lostNotified) {
+                    conn.lostNotified = true;
+                    try {
+                        onLost?.();
+                    }
+                    catch { /* consumer callback — never let it break us */ }
                 }
-                handler({
-                    resource: RwsClient2.resourcePathToName(hrefM[1]),
-                    value: spanM[1].trim(),
-                    timestamp: new Date(),
-                });
+                return;
             }
-        });
-        // Non-fatal error after open (connection dropped mid-session)
-        ws.on('error', (err) => {
-            console.warn('[RWS2] WebSocket error:', err.message);
-        });
-        // 6. Return unsubscribe — close WS and DELETE the subscription
+            const delay = RwsClient2.WS_RECONNECT_BASE_MS * 2 ** conn.attempts;
+            conn.attempts++;
+            Logger.trace?.('subscription', `RWS2 WebSocket dropped — reconnect attempt ${conn.attempts} in ${delay} ms`);
+            conn.reconnectTimer = setTimeout(() => {
+                open()
+                    .then(() => {
+                    if (conn.closed) {
+                        // unsubscribe() won the race against this reconnect — tear the
+                        // fresh socket/group down instead of leaving a zombie stream.
+                        conn.ws?.close();
+                        const url = conn.deleteUrl;
+                        conn.deleteUrl = '';
+                        void dropGroup(url);
+                        return;
+                    }
+                    conn.attempts = 0;
+                })
+                    .catch(e => {
+                    Logger.warn(`RWS2 subscription reconnect failed: ${e instanceof Error ? e.message : String(e)}`);
+                    scheduleReconnect();
+                });
+            }, delay);
+        };
+        await open();
+        // 5. Return unsubscribe — close WS and DELETE the subscription group
         return async () => {
-            clearInterval(pingTimer);
-            ws.close();
-            await this.reqDelete(deleteUrl).catch(() => { });
+            conn.closed = true;
+            if (conn.reconnectTimer) {
+                clearTimeout(conn.reconnectTimer);
+            }
+            if (conn.pingTimer) {
+                clearInterval(conn.pingTimer);
+                conn.pingTimer = null;
+            }
+            conn.ws?.close();
+            await dropGroup(conn.deleteUrl);
         };
     }
     // ─── Remote Mastership Privilege (RMMP) ────────────────────────────────────────
@@ -1449,7 +1751,7 @@ export class RwsClient2 {
      */
     async getRmmpPrivilege() {
         const xml = await this.req('GET', '/users/rmmp');
-        const p = new XhtmlParser(xml);
+        const p = RwsClient2.parse(xml);
         const priv = p.get('privilege') ?? 'none';
         const heldByMe = (p.get('rmmpheldbyme') ?? 'false').toLowerCase() === 'true';
         if (priv === 'none') {
@@ -1480,13 +1782,95 @@ export class RwsClient2 {
         ].join('&');
         await this.req('POST', '/rw/motionsystem/jog', undefined, body, 'application/x-www-form-urlencoded;v=2.0');
     }
+    // ─── Simulation panel (virtual controllers only) ─────────────────────────────
+    // RobotWare 7 VCs expose the panel hardware (e-stop chain, enabling device) and
+    // a joint-teleport endpoint for simulation. Real controllers do not serve these
+    // paths (404) — the FlexPendant hardware is the source of truth there — so every
+    // method below translates a 404 into a clear "virtual controllers only" error.
+    // All wire shapes live-verified 2026-07-09 on an OmniCore VC RW7.21.
+    /** Shared POST for the VC-only simulation endpoints. */
+    async simPost(label, path, body, rawBody) {
+        try {
+            await this.req('POST', path, body, rawBody);
+        }
+        catch (e) {
+            if (e instanceof RwsError && e.httpStatus === 404) {
+                throw new RwsError(`${label}: ${path} returned 404 — simulation endpoints exist only on RobotWare 7 virtual controllers (not on real hardware or RW6)`, 'UNKNOWN', 404, e.rwsDetail);
+            }
+            throw e;
+        }
+    }
+    /**
+     * Engage the (internal) emergency stop — controller state goes to
+     * `emergencystop`. Live-verified 2026-07-09 on OmniCore VC RW7.21:
+     *   POST /rw/panel/emergency-stop  body `state=off` → 204.
+     * The polarity is INVERTED from the ABB Swagger example: state=off OPENS the
+     * safety chain (engages the stop), state=on closes it again. Fully reversible
+     * on a VC via {@link simResetEmergencyStop} — no physical reset step exists
+     * there (unlike real hardware, which latches until the button is released).
+     */
+    simEmergencyStop() {
+        return this.simPost('simEmergencyStop', '/rw/panel/emergency-stop', { state: 'off' });
+    }
+    /** Release the simulated emergency stop (`state=on`) — controller returns to
+     *  `motoroff`. See {@link simEmergencyStop} for the polarity note. */
+    simResetEmergencyStop() {
+        return this.simPost('simResetEmergencyStop', '/rw/panel/emergency-stop', { state: 'on' });
+    }
+    /**
+     * Engage the general stop (controller state → `guardstop`); pass `false` to
+     * release it again (→ `motoroff`). Live-verified 2026-07-09 on OmniCore VC
+     * RW7.21: POST /rw/panel/general-stop, `state=off` engages / `state=on`
+     * releases (same inverted polarity as the e-stop endpoints).
+     */
+    simGeneralStop(engage = true) {
+        return this.simPost('simGeneralStop', '/rw/panel/general-stop', { state: engage ? 'off' : 'on' });
+    }
+    /**
+     * Engage the automatic stop (controller state → `guardstop`); pass `false` to
+     * release it. Live-verified 2026-07-09 on OmniCore VC RW7.21:
+     * POST /rw/panel/auto-stop, `state=off` engages / `state=on` releases.
+     */
+    simAutoStop(engage = true) {
+        return this.simPost('simAutoStop', '/rw/panel/auto-stop', { state: engage ? 'off' : 'on' });
+    }
+    /**
+     * Press (`true`) or release (`false`) the simulated three-position enabling
+     * device. Live-verified 2026-07-09 on OmniCore VC RW7.21:
+     *   POST /rw/panel/enable-switch  body `state=on|off` → 204.
+     * This endpoint's polarity is direct (no inversion). In AUTO the controller
+     * accepts the call as a no-op; driving motors on requires manual mode.
+     */
+    simEnableSwitch(on) {
+        return this.simPost('simEnableSwitch', '/rw/panel/enable-switch', { state: on ? 'on' : 'off' });
+    }
+    /**
+     * Teleport a mechanical unit to absolute joint values (degrees) — the VC
+     * equivalent of dragging the robot in RobotStudio; no motors, mastership, or
+     * program stop needed. Live-verified 2026-07-09 on OmniCore VC RW7.21:
+     *   POST /rw/motionsystem/mechunits/{mechunit}/position
+     *   body `rob_joint=[j1,j2,j3,j4,j5,j6]&ext_joint=[e1,e2,e3,e4,e5,e6]` → 204
+     * BOTH keys are required by the controller (omitting either → 400
+     * "No rob_joint parameter"), which is why `extJoints` defaults to six zeros.
+     * The readback (`getJointPositions`) may show sub-µdeg float rounding.
+     * Caveat (live-verified 2026-07-09): while an operation-mode change is
+     * pending (opmode AUTO_CH — FlexPendant acknowledge outstanding) the endpoint
+     * answers 403 "Operation not allowed for user in current operation mode".
+     */
+    async teleportMechunit(mechunit, joints, extJoints) {
+        if (joints.length !== 6 || (extJoints !== undefined && extJoints.length !== 6)) {
+            throw new RwsError('teleportMechunit: exactly 6 robot joint values (and 6 external-axis values, if given) are required', 'UNKNOWN');
+        }
+        const ext = extJoints ?? [0, 0, 0, 0, 0, 0];
+        await this.simPost('teleportMechunit', `/rw/motionsystem/mechunits/${mechunit}/position`, undefined, `rob_joint=[${joints.join(',')}]&ext_joint=[${ext.join(',')}]`);
+    }
     // ─── System detail endpoints ────────────────────────────────────────────────
     async getLicenseInfo() {
-        const p = new XhtmlParser(await this.req('GET', '/rw/system/license'));
+        const p = RwsClient2.parse(await this.req('GET', '/rw/system/license'));
         return { entries: p.getAllStates('sys-license') };
     }
     async listProducts() {
-        const p = new XhtmlParser(await this.req('GET', '/rw/system/products'));
+        const p = RwsClient2.parse(await this.req('GET', '/rw/system/products'));
         // Live-verified class: sys-product-li (with -li suffix). Each product has a _title
         // (the product name e.g. "RobotControl") plus version and version-name spans.
         return p.getAllStates('sys-product-li').map(p => ({
@@ -1496,20 +1880,20 @@ export class RwsClient2 {
         }));
     }
     async getRobotType() {
-        const p = new XhtmlParser(await this.req('GET', '/rw/system/robottype'));
+        const p = RwsClient2.parse(await this.req('GET', '/rw/system/robottype'));
         const d = p.getState('sys-robottype');
         // Live-verified: span class is 'robot-type' (with hyphen), not 'robottype'
         return { type: d['robot-type'] ?? d['robottype'] ?? d['type'] ?? '', variant: d['variant'] };
     }
     async getEnergyStats() {
-        const p = new XhtmlParser(await this.req('GET', '/rw/system/energy'));
+        const p = RwsClient2.parse(await this.req('GET', '/rw/system/energy'));
         // Live-verified class: sys-energy-state (not sys-energy)
         return p.getState('sys-energy-state');
     }
     // ─── Return-code lookup ─────────────────────────────────────────────────────
     async getReturnCode(code, lang = 'en') {
         try {
-            const p = new XhtmlParser(await this.req('GET', `/rw/retcode?code=${code}&lang=${lang}`));
+            const p = RwsClient2.parse(await this.req('GET', `/rw/retcode?code=${code}&lang=${lang}`));
             const d = p.getState('rw-retcode') || p.getState('rw-retcode-li');
             if (!d['title'] && !d['desc']) {
                 return null;
@@ -1522,29 +1906,29 @@ export class RwsClient2 {
     }
     // ─── Controller detail endpoints ────────────────────────────────────────────
     async listControllerOptions() {
-        const p = new XhtmlParser(await this.req('GET', '/ctrl/options'));
+        const p = RwsClient2.parse(await this.req('GET', '/ctrl/options'));
         return p.getAllStates('ctrl-option').map(o => ({
             name: o['option'] ?? o['name'] ?? '',
             description: o['description'],
         }));
     }
     async listFeatures() {
-        const p = new XhtmlParser(await this.req('GET', '/ctrl/features'));
+        const p = RwsClient2.parse(await this.req('GET', '/ctrl/features'));
         return p.getAllStates('ctrl-feature');
     }
     // ─── Motion detail endpoints ────────────────────────────────────────────────
     async getMotionChangeCount() {
-        const p = new XhtmlParser(await this.req('GET', '/rw/motionsystem?resource=change-count'));
+        const p = RwsClient2.parse(await this.req('GET', '/rw/motionsystem?resource=change-count'));
         return Number(p.get('change-count') ?? 0);
     }
     async getMotionErrorState() {
-        const p = new XhtmlParser(await this.req('GET', '/rw/motionsystem/errorstate'));
+        const p = RwsClient2.parse(await this.req('GET', '/rw/motionsystem/errorstate'));
         const d = p.getState('ms-errorstate-li') || p.getState('ms-errorstate');
         return { state: d['err-state'] ?? d['state'] ?? 'unknown', details: d };
     }
     async getNonMotionExecution() {
         // Live-verified: class="ms-nonmotionexecution", span "mode" returns quoted "OFF" or "ON".
-        const p = new XhtmlParser(await this.req('GET', '/rw/motionsystem/nonmotionexecution'));
+        const p = RwsClient2.parse(await this.req('GET', '/rw/motionsystem/nonmotionexecution'));
         const v = (p.get('mode') ?? p.get('state') ?? 'OFF').replace(/"/g, '').toUpperCase();
         return v === 'ON';
     }
@@ -1554,7 +1938,7 @@ export class RwsClient2 {
     async getCollisionPredictionMode() {
         // Live-verified: class="ms-collision-prediction-mode" with span "collision-prediction-mode-enabled"
         // returning "true" / "false". Map back to ON/OFF for caller convenience.
-        const p = new XhtmlParser(await this.req('GET', '/rw/motionsystem/collisionprediction'));
+        const p = RwsClient2.parse(await this.req('GET', '/rw/motionsystem/collisionprediction'));
         const enabled = p.get('collision-prediction-mode-enabled') ?? p.get('mode') ?? 'false';
         return enabled.toLowerCase() === 'true' ? 'ON' : 'OFF';
     }
@@ -1563,20 +1947,20 @@ export class RwsClient2 {
     }
     // ─── Panel detail endpoints ─────────────────────────────────────────────────
     async getEnableRequest() {
-        const p = new XhtmlParser(await this.req('GET', '/rw/panel/enreq'));
+        const p = RwsClient2.parse(await this.req('GET', '/rw/panel/enreq'));
         const d = p.getState('pnl-enreq') || p.getState('pnl-enreq-li');
         return { state: d['state'] ?? d['enreq'] ?? 'unknown', raw: d };
     }
     // ─── RAPID detail endpoints ─────────────────────────────────────────────────
     async listAliasIO() {
-        const p = new XhtmlParser(await this.req('GET', '/rw/rapid/aliasio'));
+        const p = RwsClient2.parse(await this.req('GET', '/rw/rapid/aliasio'));
         return p.getAllStates('rap-aliasio-li').map(a => ({
             alias: a['name'] ?? a['alias'] ?? '',
             signal: a['signal'] ?? a['_title'] ?? '',
         }));
     }
     async getTaskSelection() {
-        const p = new XhtmlParser(await this.req('GET', '/rw/rapid/taskselection'));
+        const p = RwsClient2.parse(await this.req('GET', '/rw/rapid/taskselection'));
         const sel = p.getAllStates('rap-taskselection-li').map(t => t['name']).filter(Boolean);
         const all = p.getAllStates('rap-task-li').map(t => t['name']).filter(Boolean);
         return { selected: sel, available: all };
@@ -1592,7 +1976,7 @@ export class RwsClient2 {
         //   beginposition  → "row,col" combined string
         //   endposition    → "row,col"
         //   changecount, executiontype
-        const p = new XhtmlParser(await this.req('GET', `/rw/rapid/tasks/${task}/pcp`));
+        const p = RwsClient2.parse(await this.req('GET', `/rw/rapid/tasks/${task}/pcp`));
         const d = p.getState('pcp-info') || p.getState('program-pointer-state') || p.getState('rap-pcp-li');
         const begin = (d['beginposition'] ?? '').split(',');
         return {
@@ -1606,7 +1990,7 @@ export class RwsClient2 {
     async getMotionPointer(task) {
         // Live-verified: /syncstate/motion-pointer returns class="rap-task-sync-state"
         // with a single span class="motion-pointer-state" containing 'Off' or position info.
-        const p = new XhtmlParser(await this.req('GET', `/rw/rapid/tasks/${task}/syncstate/motion-pointer`));
+        const p = RwsClient2.parse(await this.req('GET', `/rw/rapid/tasks/${task}/syncstate/motion-pointer`));
         const d = p.getState('rap-task-sync-state');
         const stateVal = d['motion-pointer-state'] ?? '';
         return {
@@ -1637,7 +2021,7 @@ export class RwsClient2 {
             `elog_at_error=false`,
         ].join('&');
         const html = await this.req('POST', `/rw/motionsystem/mechunits/${mechunit}/joints-from-cartesian`, undefined, bodyStr, 'application/x-www-form-urlencoded;v=2.0');
-        const p = new XhtmlParser(html);
+        const p = RwsClient2.parse(html);
         const d = p.getState('ms-jointtarget');
         if (!d['rax_1']) {
             throw new Error('IK: no joint values in response');
@@ -1647,26 +2031,5 @@ export class RwsClient2 {
             rax_4: +d['rax_4'], rax_5: +d['rax_5'], rax_6: +d['rax_6'],
         };
     }
-    /**
-     * Send a DELETE request to an absolute URL (used to clean up subscriptions).
-     * The URL is absolute (https://host:port/poll/{id}) so we can't use req() directly.
-     */
-    reqDelete(absoluteUrl) {
-        return new Promise((resolve) => {
-            const url = new URL(absoluteUrl);
-            const isHttps = url.protocol === 'https:';
-            const options = {
-                method: 'DELETE',
-                hostname: url.hostname,
-                port: url.port ? +url.port : (isHttps ? 443 : 80),
-                path: url.pathname,
-                headers: { Authorization: this.authHeader },
-                ...(isHttps ? { agent: this.httpsAgent } : {}),
-            };
-            const req = (isHttps ? https : http).request(options, res => { res.resume(); resolve(); });
-            req.on('error', () => resolve()); // best-effort
-            req.end();
-        });
-    }
 }
 //# sourceMappingURL=RwsClient2.js.map