devicerent 0.1.0

package/README.md

@@ -0,0 +1,85 @@
+# devicerent
+
+DeviceRent from your terminal. Rent a **real** Android phone by the minute,
+install your APK, run Espresso or a Quick test, get a hosted Appium URL, or hand
+the phone to DeviceyAI — everything the website does except show you the live
+screen.
+
+```bash
+npm install -g devicerent      # Node 22 or newer
+devicerent login               # approve in your browser, like `gh auth login`
+devicerent devices             # what is in the rack right now
+devicerent rent "Pixel 7a"     # billing starts now
+devicerent install app-debug.apk --launch
+devicerent test quick com.example.app --report quick-test.md
+devicerent stop
+```
+
+## Signing in
+
+`devicerent login` opens `devicerent.net` in your browser and asks you to
+approve the sign-in. Nothing is typed into the terminal: the page hands the
+terminal a one-time sign-in token, encrypted so that only the waiting
+`devicerent` process can open it. If your account has two-factor turned on, the
+terminal asks for your authenticator code too.
+
+Signing in on a machine without a browser (an SSH session, a VM):
+
+```bash
+devicerent login --no-browser   # open the printed link anywhere, paste the code back
+```
+
+The session is stored in `~/.config/devicerent/` (`%APPDATA%\devicerent` on
+Windows), readable only by you, and is only ever sent to the DeviceRent that
+issued it. `devicerent logout` signs this terminal out and leaves your browser
+sessions alone.
+
+## Commands
+
+| Group | Commands |
+| --- | --- |
+| Account | `whoami`, `wallet [--history]`, `history`, `credits [buy s\|m\|l]`, `topup <eur>`, `subscribe <plus\|pro\|slot> [--yearly]`, `billing`, `keys list\|create\|revoke` |
+| Rentals | `devices [--available]`, `rent <device…>` (up to three), `status`, `stop [rental] \| --all` |
+| Phone | `install <apk…> [--launch]`, `apps`, `launch <pkg>`, `uninstall <pkg>`, `shell [cmd]`, `logcat [-f] [--package] [--level]`, `screenshot [file]`, `push`, `pull`, `ui [--xml]` |
+| Testing | `test espresso [--runner] [--class] [--junit out.xml]`, `test quick <apk\|pkg> [--report] [--fix-prompt]`, `appium [--check]`, `connect [--port]` |
+| DeviceyAI | `ai "<task>" [--allow-actions] [--allow-shell] [--model]`, `ai --models` |
+
+Every command takes `--json` for machine-readable output, and `-h` for help.
+With more than one rental running, pick the phone with `--rental <id or name>`.
+
+Payments always happen in the browser: `topup`, `subscribe`, `credits buy` and
+`billing` print a Stripe link and open it.
+
+## How you are billed
+
+Exactly as on the website. A rental bills per minute from `rent` until `stop`,
+at your plan's rate. A rental with no activity for 30 minutes is stopped for
+you; installing, testing, shell input and DeviceyAI steps count as activity,
+merely holding `logcat -f` or an idle `connect` tunnel open does not.
+DeviceyAI spends AI credits, the same as in the panel.
+
+## Exit codes
+
+`0` success · `1` failure (a test failed, the app crashed, a request was
+refused) · `2` usage error or not signed in · `3` the test run itself broke.
+
+`test espresso` writes JUnit XML with `--junit`, so it drops into a CI report.
+
+## Pointing at another DeviceRent
+
+`--api-base <url>` (or `DEVICERENT_API_BASE`) targets another deployment, for
+example a local `next start` on `http://localhost:3000`. Each deployment keeps
+its own session.
+
+## Security
+
+- The terminal holds an ordinary DeviceRent session for your account — the same
+  identity and the same row-level security as your browser tab. It can do what
+  you can do on the site; admin pages stay browser-only.
+- Phones are reached over the same serial-pinned, ten-minute bridge tokens the
+  session page uses. The Pi never sees your session.
+- Approve a sign-in only if you just ran `devicerent login` yourself, and never
+  send the code from `--no-browser` to anyone.
+
+Source: [`clients/devicerent-cli`](https://github.com/DeviceRent-net/devicerent.net/tree/main/clients/devicerent-cli).
+Design notes: `docs/CLI.md` in the same repository.

package/bin/devicerent.mjs

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+// The published entry point. Everything lives in the bundle `npm run build`
+// writes to dist/ — the CLI imports the web app's own device and DeviceyAI
+// modules from src/lib, so it cannot run from source without the bundler.
+import "../dist/devicerent.mjs";