diggylab 0.1.30

package/cli.js

@@ -0,0 +1,2781 @@
+#!/usr/bin/env node
+
+// src/cli/cli.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
+import { hostname, homedir } from "node:os";
+import { dirname as dirname3, join as join4 } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+// ../../packages/facebook-scanner/dist/parser.js
+var paths = {
+  text: [["message", "text"], ["comet_sections", "content", "story", "message", "text"], ["text"]],
+  url: [["url"], ["permalink_url"], ["wwwURL"], ["comet_sections", "content", "story", "url"]],
+  author: [["actors", 0, "name"], ["actor", "name"], ["author", "name"]],
+  avatar: [
+    ["actors", 0, "profile_picture", "uri"],
+    ["actor", "profile_picture", "uri"],
+    ["author", "profile_picture", "uri"],
+    ["comet_sections", "content", "story", "actors", 0, "profile_picture", "uri"]
+  ],
+  time: [["creation_time"], ["created_time"], ["publish_time"]],
+  group: [["to", "name"], ["group", "name"], ["target", "name"]],
+  groupId: [["to", "id"], ["group", "id"], ["target", "id"]]
+};
+var textFormatPaths = [
+  ["text_format_metadata"],
+  ["comet_sections", "message", "story", "text_format_metadata"],
+  [
+    "comet_sections",
+    "content",
+    "story",
+    "comet_sections",
+    "message",
+    "story",
+    "text_format_metadata"
+  ]
+];
+var facebookHosts = /* @__PURE__ */ new Set([
+  "facebook.com",
+  "fb.com",
+  "m.facebook.com",
+  "mbasic.facebook.com",
+  "mobile.facebook.com",
+  "web.facebook.com",
+  "www.facebook.com",
+  "www.fb.com"
+]);
+var stableIdPattern = /^\d+$/;
+function isData(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function get(root, path) {
+  return path.reduce((value, key) => {
+    if (Array.isArray(value) && typeof key === "number")
+      return value[key];
+    return isData(value) && typeof key === "string" ? value[key] : void 0;
+  }, root);
+}
+function firstString(root, candidates, trim = true) {
+  for (const path of candidates) {
+    const value = get(root, path);
+    if ((typeof value === "string" || typeof value === "number") && String(value).trim()) {
+      return trim ? String(value).trim() : String(value);
+    }
+  }
+  return void 0;
+}
+function firstData(root, candidates) {
+  for (const path of candidates) {
+    const value = get(root, path);
+    if (isData(value))
+      return value;
+  }
+  return void 0;
+}
+function requestedGroupIdentifier(value) {
+  if (!value || /\s/.test(value))
+    return void 0;
+  try {
+    const url = new URL(value);
+    const match = /^\/groups\/([a-z0-9._-]+)\/?$/i.exec(url.pathname);
+    if (!["http:", "https:"].includes(url.protocol) || !facebookHosts.has(url.hostname.toLowerCase()) || url.username || url.password || url.port || !match) {
+      return void 0;
+    }
+    return match[1].toLowerCase();
+  } catch {
+    return void 0;
+  }
+}
+function normalizePostUrl(value, requestedGroups, verifiedGroupId) {
+  if (!value || /\s/.test(value))
+    return void 0;
+  try {
+    const url = new URL(value, "https://www.facebook.com");
+    if (!["http:", "https:"].includes(url.protocol) || !facebookHosts.has(url.hostname.toLowerCase()) || url.username || url.password || url.port) {
+      return void 0;
+    }
+    const post = /^\/groups\/([a-z0-9._-]+)\/posts\/(\d+)\/?$/i.exec(url.pathname);
+    if (post) {
+      const group = post[1].toLowerCase();
+      if (requestedGroups && !requestedGroups.has(group) && (!verifiedGroupId || !requestedGroups.has(verifiedGroupId.toLowerCase())) || url.searchParams.has("comment_id") || url.searchParams.has("reply_comment_id")) {
+        return void 0;
+      }
+      return `https://www.facebook.com/groups/${group}/posts/${post[2]}/`;
+    }
+    if (url.pathname.toLowerCase() !== "/permalink.php")
+      return void 0;
+    const storyIds = url.searchParams.getAll("story_fbid");
+    const groupIds = url.searchParams.getAll("id");
+    if (storyIds.length !== 1 || groupIds.length !== 1 || !stableIdPattern.test(storyIds[0]) || !stableIdPattern.test(groupIds[0]) || requestedGroups && !requestedGroups.has(groupIds[0]) || url.searchParams.has("comment_id") || url.searchParams.has("reply_comment_id")) {
+      return void 0;
+    }
+    return `https://www.facebook.com/permalink.php?story_fbid=${storyIds[0]}&id=${groupIds[0]}`;
+  } catch {
+    return void 0;
+  }
+}
+function toIso(value) {
+  if (!value)
+    return void 0;
+  const numeric = Number(value);
+  const date = Number.isFinite(numeric) ? new Date(numeric * 1e3) : new Date(value);
+  return Number.isNaN(date.valueOf()) ? void 0 : date.toISOString();
+}
+function getAttachmentImages(node) {
+  const urls = /* @__PURE__ */ new Set();
+  collectAttachmentImageUrls(node, urls, 0);
+  return dedupeImageUrls([...urls]);
+}
+function dedupeImageUrls(urls) {
+  const best = /* @__PURE__ */ new Map();
+  const order = [];
+  for (const url of urls) {
+    let pathname = url;
+    try {
+      pathname = new URL(url).pathname;
+    } catch {
+    }
+    const quality = imageQuality(url);
+    const current = best.get(pathname);
+    if (!current) {
+      order.push(pathname);
+      best.set(pathname, { url, quality });
+    } else if (quality > current.quality) {
+      best.set(pathname, { url, quality });
+    }
+  }
+  return order.map((pathname) => best.get(pathname).url).slice(0, 6);
+}
+function imageQuality(url) {
+  const match = /[?&]stp=[^&]*?_p(\d+)x(\d+)/.exec(url);
+  return match ? Math.max(Number(match[1]), Number(match[2])) : Number.MAX_SAFE_INTEGER;
+}
+function collectFallbackImageUrls(value, urls, depth) {
+  if (!value || depth > 12 || urls.size >= 12)
+    return;
+  if (Array.isArray(value)) {
+    for (const item of value)
+      collectFallbackImageUrls(item, urls, depth + 1);
+    return;
+  }
+  if (!isData(value))
+    return;
+  if ("comment_id" in value || "parent_comment" in value)
+    return;
+  for (const [key, child] of Object.entries(value)) {
+    if (key === "profile_picture" || key === "text_format_metadata" || key === "actors" || key === "actor" || key === "actor_photo") {
+      continue;
+    }
+    if (typeof child === "string") {
+      if (/^https?:\/\//i.test(child) && /(scontent\.|fbcdn\.net)/i.test(child) && /\.(jpe?g|png|webp|avif)(\?|#|$)/i.test(child) && !isProfilePictureUrl(child)) {
+        urls.add(child);
+      }
+      continue;
+    }
+    collectFallbackImageUrls(child, urls, depth + 1);
+    if (urls.size >= 12)
+      return;
+  }
+}
+function getTextFormat(node) {
+  const metadata = firstData(node, textFormatPaths);
+  if (!metadata)
+    return void 0;
+  const textFormat = {
+    backgroundColor: firstString(metadata, [["background_color"], ["background", "color"]]),
+    backgroundImageUrl: firstString(metadata, [
+      ["background_image", "uri"],
+      ["background", "image", "uri"],
+      ["portrait_background_image", "uri"],
+      ["background", "portrait_image", "uri"]
+    ], false),
+    color: firstString(metadata, [["color"]]),
+    fontStyle: firstString(metadata, [["font_style"]]),
+    fontWeight: firstString(metadata, [["font_weight"]])
+  };
+  return Object.values(textFormat).some(Boolean) ? textFormat : void 0;
+}
+function collectImageUrls(value, urls, depth) {
+  if (!value || depth > 12 || urls.size >= 12)
+    return;
+  if (typeof value === "string") {
+    if (/^https?:\/\//i.test(value) && /(scontent\.|fbcdn\.net|\.(avif|gif|jpe?g|png|webp)(\?|#|$))/i.test(value) && !isProfilePictureUrl(value)) {
+      urls.add(value);
+    }
+    return;
+  }
+  if (typeof value !== "object")
+    return;
+  for (const child of Array.isArray(value) ? value : Object.values(value)) {
+    collectImageUrls(child, urls, depth + 1);
+    if (urls.size >= 12)
+      return;
+  }
+}
+function isProfilePictureUrl(url) {
+  return /\/v\/t1\.30497-1\//i.test(url) || /[?&]stp=cp0_/i.test(url);
+}
+function collectAttachmentImageUrls(value, urls, depth) {
+  if (!value || depth > 10 || urls.size >= 12)
+    return;
+  if (Array.isArray(value)) {
+    for (const item of value)
+      collectAttachmentImageUrls(item, urls, depth + 1);
+    return;
+  }
+  if (!isData(value))
+    return;
+  if (Array.isArray(value.attachments) || isData(value.attachments)) {
+    collectImageUrls(value.attachments, urls, 0);
+  }
+  if (Array.isArray(value.all_attachments) || isData(value.all_attachments)) {
+    collectImageUrls(value.all_attachments, urls, 0);
+  }
+  for (const child of Object.values(value)) {
+    collectAttachmentImageUrls(child, urls, depth + 1);
+    if (urls.size >= 12)
+      return;
+  }
+}
+function toItem(node, requestedGroup) {
+  const text = firstString(node, paths.text);
+  const typename = typeof node.__typename === "string" ? node.__typename : void 0;
+  if (!text || typename && !/(post|story)$/i.test(typename) || "comment_id" in node || "parent_comment" in node) {
+    return void 0;
+  }
+  const candidateUrl = firstString(node, paths.url, false);
+  const url = candidateUrl ? normalizePostUrl(candidateUrl, /* @__PURE__ */ new Set([requestedGroup]), firstString(node, paths.groupId)) : void 0;
+  if (!url)
+    return void 0;
+  const authorAvatarUrl = firstString(node, paths.avatar, false);
+  let attachmentImages = getAttachmentImages(node);
+  if (!attachmentImages.length) {
+    const fallbackUrls = /* @__PURE__ */ new Set();
+    collectFallbackImageUrls(node, fallbackUrls, 0);
+    if (fallbackUrls.size)
+      attachmentImages = dedupeImageUrls([...fallbackUrls]);
+  }
+  const textFormat = getTextFormat(node);
+  return {
+    text,
+    url,
+    authorName: firstString(node, paths.author),
+    ...authorAvatarUrl ? { authorAvatarUrl } : {},
+    ...attachmentImages.length ? { attachmentImages } : {},
+    ...textFormat ? { textFormat } : {},
+    publishedAt: toIso(firstString(node, paths.time)),
+    groupName: firstString(node, paths.group)
+  };
+}
+function visit(value, requestedGroup, items) {
+  if (Array.isArray(value)) {
+    for (const item2 of value)
+      visit(item2, requestedGroup, items);
+    return;
+  }
+  if (!isData(value))
+    return;
+  for (const child of Object.values(value))
+    visit(child, requestedGroup, items);
+  const item = toItem(value, requestedGroup);
+  if (item)
+    items.push(item);
+}
+function mergeFacebookScanItems(items, limit) {
+  const unique = /* @__PURE__ */ new Map();
+  for (const item of items) {
+    const url = normalizePostUrl(item.url);
+    if (!url || !item.text.trim())
+      continue;
+    const existing = unique.get(url);
+    if (!existing && unique.size >= limit)
+      continue;
+    if (!existing) {
+      unique.set(url, { ...item, text: item.text.trim(), url });
+    } else {
+      if (!existing.authorAvatarUrl && item.authorAvatarUrl) {
+        existing.authorAvatarUrl = item.authorAvatarUrl;
+      }
+      const attachmentImages = dedupeImageUrls([
+        ...existing.attachmentImages ?? [],
+        ...item.attachmentImages ?? []
+      ]);
+      if (attachmentImages.length)
+        existing.attachmentImages = attachmentImages;
+      if (item.textFormat) {
+        existing.textFormat = { ...item.textFormat, ...existing.textFormat };
+      }
+    }
+  }
+  return [...unique.values()];
+}
+function parseFacebookGraphqlBody(body, groupUrl) {
+  const items = [];
+  const requestedGroup = requestedGroupIdentifier(groupUrl);
+  if (!requestedGroup)
+    return items;
+  for (const line of body.split(/\r?\n/)) {
+    const json = line.trim().replace(/^for\s*\(;;\);/, "");
+    if (!json.startsWith("{") && !json.startsWith("["))
+      continue;
+    try {
+      visit(JSON.parse(json), requestedGroup, items);
+    } catch {
+    }
+  }
+  return mergeFacebookScanItems(items, Number.POSITIVE_INFINITY);
+}
+async function extractFacebookDomItems(page, groupUrl) {
+  const requestedGroup = requestedGroupIdentifier(groupUrl);
+  if (!requestedGroup)
+    return [];
+  const requestedGroups = /* @__PURE__ */ new Set([requestedGroup]);
+  const groupNavigationUrls = await page.locator('[role="tab"] a[href*="/groups/"], a[role="tab"][href*="/groups/"]').evaluateAll((anchors) => anchors.map((anchor) => anchor.href));
+  for (const navigationUrl of groupNavigationUrls) {
+    const alias = requestedGroupIdentifier(navigationUrl);
+    if (alias)
+      requestedGroups.add(alias);
+  }
+  const raw = await page.locator('[role="article"]').evaluateAll((articles) => articles.map((article) => {
+    if (!article.checkVisibility() || article.parentElement?.closest('[role="article"]')) {
+      return void 0;
+    }
+    const belongsToArticle = (element) => element.closest('[role="article"]') === article;
+    const anchors = Array.from(article.querySelectorAll("a[href]")).filter((anchor) => belongsToArticle(anchor) && anchor.checkVisibility());
+    const urls = anchors.map((anchor) => anchor.getAttribute("href") ?? "").filter((href) => /\/posts\/|permalink\.php/.test(href));
+    const message = Array.from(article.querySelectorAll('[data-ad-preview="message"]')).find((element) => belongsToArticle(element) && element.checkVisibility());
+    const author = Array.from(article.querySelectorAll("h2 a, h3 a, strong a")).find((element) => belongsToArticle(element) && element.checkVisibility());
+    const time = Array.from(article.querySelectorAll("time[datetime], abbr[data-utime]")).find((element) => belongsToArticle(element) && element.checkVisibility());
+    const attachmentImages = Array.from(article.querySelectorAll("img")).filter((image) => belongsToArticle(image) && image.naturalWidth >= 200).map((image) => image.currentSrc || image.src).filter((src) => /^https?:\/\//i.test(src) && /(scontent\.|fbcdn\.net)/i.test(src));
+    return {
+      text: message?.innerText ?? "",
+      urls,
+      authorName: author?.innerText,
+      publishedAt: time?.getAttribute("datetime") ?? time?.getAttribute("data-utime") ?? void 0,
+      ...attachmentImages.length ? { attachmentImages } : {}
+    };
+  }));
+  return mergeFacebookScanItems(raw.flatMap((item) => {
+    const url = item?.urls.map((candidate) => normalizePostUrl(candidate, requestedGroups)).find((candidate) => candidate !== void 0);
+    return item && item.text.trim() && url ? [{
+      text: item.text,
+      url,
+      authorName: item.authorName,
+      publishedAt: item.publishedAt,
+      ...item.attachmentImages?.length ? { attachmentImages: dedupeImageUrls(item.attachmentImages) } : {}
+    }] : [];
+  }), Number.POSITIVE_INFINITY);
+}
+
+// ../../packages/facebook-scanner/dist/session.js
+async function detectFacebookSession(page, context) {
+  let url;
+  try {
+    url = new URL(page.url());
+  } catch {
+    return "LOGIN_REQUIRED";
+  }
+  const host = url.hostname.toLowerCase();
+  if (host !== "facebook.com" && !host.endsWith(".facebook.com"))
+    return "LOGIN_REQUIRED";
+  if (/^\/checkpoint(?:\/|$)/i.test(url.pathname))
+    return "CHECKPOINT_REQUIRED";
+  if (/^\/login(?:\/|$)/i.test(url.pathname))
+    return "LOGIN_REQUIRED";
+  if (await page.locator('input[name="email"]').count())
+    return "LOGIN_REQUIRED";
+  const cookies = await context.cookies();
+  const hasUser = cookies.some((cookie) => cookie.name === "c_user" && cookie.value.trim().length > 0 && (cookie.domain === "facebook.com" || cookie.domain.endsWith(".facebook.com")));
+  return hasUser ? "READY" : "LOGIN_REQUIRED";
+}
+
+// ../../packages/facebook-scanner/dist/scanner.js
+var FacebookScannerError = class extends Error {
+  code;
+  constructor(code) {
+    super(code);
+    this.code = code;
+    this.name = "FacebookScannerError";
+  }
+};
+var FacebookScanner = class {
+  browserType;
+  extractDomItems;
+  parseGraphqlBody;
+  graphqlResponseTimeoutMs;
+  running = false;
+  constructor(options) {
+    this.browserType = options.browserType;
+    this.extractDomItems = options.extractDomItems ?? extractFacebookDomItems;
+    this.parseGraphqlBody = options.parseGraphqlBody ?? parseFacebookGraphqlBody;
+    this.graphqlResponseTimeoutMs = options.graphqlResponseTimeoutMs ?? 1e4;
+  }
+  async scanMany(options) {
+    if (this.running)
+      throw new FacebookScannerError("SCANNER_BUSY");
+    this.running = true;
+    let browser = null;
+    try {
+      browser = await this.browserType.launch({ headless: true });
+      const results = [];
+      for (const [index, groupUrl] of options.groupUrls.entries()) {
+        assertNotAborted(options.signal);
+        const items = await this.scanGroup(browser, options, groupUrl, index);
+        results.push(items);
+      }
+      return results;
+    } finally {
+      await browser?.close();
+      this.running = false;
+    }
+  }
+  async scanGroup(browser, options, groupUrl, groupIndex) {
+    const context = await browser.newContext({ storageState: options.storageState });
+    let page = null;
+    const graphqlItems = [];
+    const responseTasks = [];
+    const responseHandler = (response) => {
+      if (!response.url().includes("/api/graphql/"))
+        return;
+      responseTasks.push(withTimeout(response.text(), this.graphqlResponseTimeoutMs).then((body) => graphqlItems.push(...this.parseGraphqlBody(body, groupUrl))).then(() => void 0).catch(() => void 0));
+    };
+    try {
+      page = await context.newPage();
+      page.on("response", responseHandler);
+      await page.route("**/*", (route) => ["font", "image", "media"].includes(route.request().resourceType()) ? route.abort() : route.continue());
+      const target = new URL(groupUrl);
+      target.searchParams.set("sorting_setting", "CHRONOLOGICAL");
+      try {
+        await page.goto(target.toString(), { waitUntil: "domcontentloaded", timeout: 45e3 });
+      } catch {
+        throw new FacebookScannerError("NAVIGATION_FAILED");
+      }
+      const condition = await detectFacebookSession(page, context);
+      if (condition !== "READY")
+        throw new FacebookScannerError(condition);
+      await options.onProgress?.({ groupIndex, groupCount: options.groupUrls.length, phase: "SCANNING", itemCount: 0 });
+      let domItems = [];
+      let items = [];
+      let idleRounds = 0;
+      while (items.length < options.limit && idleRounds < 3) {
+        assertNotAborted(options.signal);
+        const previousCount = items.length;
+        await page.waitForTimeout(1500);
+        await drain(responseTasks, this.graphqlResponseTimeoutMs);
+        domItems = await this.extractDomItems(page, groupUrl);
+        items = mergeFacebookScanItems([...graphqlItems, ...domItems], options.limit);
+        if (items.length !== previousCount) {
+          await options.onProgress?.({
+            groupIndex,
+            groupCount: options.groupUrls.length,
+            phase: "SCANNING",
+            itemCount: items.length
+          });
+        }
+        idleRounds = items.length === previousCount ? idleRounds + 1 : 0;
+        if (items.length < options.limit)
+          await page.mouse.wheel(0, 2e3);
+      }
+      assertNotAborted(options.signal);
+      await drain(responseTasks, this.graphqlResponseTimeoutMs);
+      items = mergeFacebookScanItems([...graphqlItems, ...domItems], options.limit);
+      if (!items.length)
+        throw new FacebookScannerError("NO_POSTS");
+      await options.onProgress?.({ groupIndex, groupCount: options.groupUrls.length, phase: "COMPLETE", itemCount: items.length });
+      return items;
+    } finally {
+      page?.off("response", responseHandler);
+      await page?.unroute("**/*").catch(() => void 0);
+      await Promise.allSettled(responseTasks);
+      await page?.close();
+      await context.close();
+    }
+  }
+};
+function assertNotAborted(signal) {
+  if (signal?.aborted)
+    throw new FacebookScannerError("SCAN_CANCELED");
+}
+async function drain(tasks, timeoutMs) {
+  const pending = tasks.splice(0);
+  if (pending.length)
+    await withTimeout(Promise.allSettled(pending), timeoutMs).catch(() => void 0);
+}
+function withTimeout(promise, timeoutMs) {
+  let timer;
+  const timeout = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => reject(new Error("Facebook response timeout.")), timeoutMs);
+  });
+  return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
+}
+
+// src/cli/cli.ts
+import { chromium } from "playwright";
+import WebSocket from "ws";
+
+// src/main/activity-log.ts
+import { gzip } from "node:zlib";
+import { promisify } from "node:util";
+import { mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
+import { basename, join } from "node:path";
+var gzipAsync = promisify(gzip);
+var ActivityLog = class {
+  options;
+  listeners = /* @__PURE__ */ new Set();
+  pending = Promise.resolve();
+  constructor(options) {
+    this.options = {
+      now: Date.now,
+      randomUuid: () => crypto.randomUUID(),
+      maxFileBytes: 2 * 1024 * 1024,
+      maxDirectoryBytes: 10 * 1024 * 1024,
+      ...options
+    };
+  }
+  append(input) {
+    const entry2 = {
+      ...input,
+      id: this.options.randomUuid(),
+      timestamp: new Date(this.options.now()).toISOString(),
+      code: sanitize(input.code).toUpperCase().replace(/[^A-Z0-9_]/g, "_").slice(0, 80) || "EVENT",
+      message: sanitize(input.message).slice(0, 500)
+    };
+    this.pending = this.pending.catch(() => void 0).then(async () => {
+      await this.persist(entry2);
+      for (const listener of this.listeners) listener(entry2);
+    });
+    return this.pending;
+  }
+  async list(limit = 500) {
+    await this.pending;
+    const names = (await this.names()).sort().slice(-7);
+    const entries = [];
+    for (const name of names) {
+      const lines = await readFile(join(this.options.directory, name), "utf8").catch(() => "");
+      for (const line of lines.split("\n")) {
+        if (!line) continue;
+        try {
+          const entry2 = JSON.parse(line);
+          if (isEntry(entry2)) entries.push(entry2);
+        } catch {
+        }
+      }
+    }
+    return entries.slice(-Math.max(1, Math.min(limit, 1e3)));
+  }
+  subscribe(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  clear() {
+    this.pending = this.pending.catch(() => void 0).then(async () => {
+      await Promise.all((await this.names()).map((name) => rm(join(this.options.directory, name), { force: true })));
+    });
+    return this.pending;
+  }
+  async exportDay(day, destination) {
+    if (!/^\d{4}-\d{2}-\d{2}$/.test(day) || basename(destination) === "") {
+      throw new TypeError("Invalid activity export.");
+    }
+    await this.pending;
+    const source = await readFile(join(this.options.directory, `${day}.jsonl`));
+    await writeFile(destination, await gzipAsync(source), { mode: 384 });
+  }
+  async persist(entry2) {
+    await mkdir(this.options.directory, { recursive: true });
+    const day = entry2.timestamp.slice(0, 10);
+    const path = join(this.options.directory, `${day}.jsonl`);
+    const existing = await readFile(path, "utf8").catch(() => "");
+    const line = `${JSON.stringify(entry2)}
+`;
+    let value = `${existing}${line}`;
+    while (Buffer.byteLength(value) > this.options.maxFileBytes && value.includes("\n")) {
+      value = value.slice(value.indexOf("\n") + 1);
+    }
+    await writeFile(`${path}.tmp`, value, { encoding: "utf8", mode: 384 });
+    await rename(`${path}.tmp`, path);
+    await this.prune(day);
+  }
+  async prune(currentDay) {
+    const minimumDay = /* @__PURE__ */ new Date(`${currentDay}T00:00:00.000Z`);
+    minimumDay.setUTCDate(minimumDay.getUTCDate() - 6);
+    const minimum = minimumDay.toISOString().slice(0, 10);
+    let names = (await this.names()).sort();
+    await Promise.all(names.filter((name) => name.slice(0, 10) < minimum).map((name) => rm(join(this.options.directory, name), { force: true })));
+    names = (await this.names()).sort();
+    const sizes = await Promise.all(names.map(async (name) => ({
+      name,
+      size: await stat(join(this.options.directory, name)).then((value) => value.size).catch(() => 0)
+    })));
+    let total = sizes.reduce((sum, item) => sum + item.size, 0);
+    while (total > this.options.maxDirectoryBytes && sizes.length > 1) {
+      const oldest = sizes.shift();
+      if (!oldest) break;
+      await rm(join(this.options.directory, oldest.name), { force: true });
+      total -= oldest.size;
+    }
+  }
+  names() {
+    return readdir(this.options.directory).then((names) => names.filter((name) => /^\d{4}-\d{2}-\d{2}\.jsonl$/.test(name))).catch(() => []);
+  }
+};
+function sanitize(value) {
+  return value.replace(/Bearer\s+\S+/gi, "Bearer [REDACTED]").replace(/\b(authorization|cookie|set-cookie|token|access[ _-]?token|refresh[ _-]?token|api[ _-]?key|private[ _-]?key|signature|pairing[ _-]?code|storage[ _-]?state)\b\s*[:=]\s*[^\s;]+/gi, "$1=[REDACTED]").replace(/https?:\/\/[^\s/@:]+:[^\s/@]+@/gi, "https://[REDACTED]@").replace(/\b[A-F0-9]{32}\b/gi, "[REDACTED]").replace(/[\r\n\t]+/g, " ").trim();
+}
+function isEntry(value) {
+  return typeof value?.id === "string" && typeof value.timestamp === "string" && ["INFO", "WARN", "ERROR"].includes(value.level) && ["CONNECTION", "PAIRING", "FACEBOOK", "SCAN", "UPLOAD", "SYSTEM"].includes(value.category) && typeof value.code === "string" && typeof value.message === "string";
+}
+
+// src/main/browser-runtime.ts
+function createBrowserLauncher(browserType, executablePath) {
+  if (!executablePath) return browserType;
+  return {
+    launch: (options) => browserType.launch({ ...options, executablePath })
+  };
+}
+
+// src/main/json-store.ts
+import { mkdir as mkdir2, readFile as readFile2, rename as rename2, writeFile as writeFile2 } from "node:fs/promises";
+import { dirname } from "node:path";
+var defaultIo = { mkdir: mkdir2, readFile: readFile2, rename: rename2, writeFile: writeFile2 };
+var JsonFileStore = class {
+  constructor(path, defaultValue, io = defaultIo) {
+    this.path = path;
+    this.defaultValue = defaultValue;
+    this.io = io;
+  }
+  path;
+  defaultValue;
+  io;
+  async read() {
+    try {
+      return JSON.parse(await this.io.readFile(this.path, "utf8"));
+    } catch {
+      return this.defaultValue();
+    }
+  }
+  async write(value) {
+    const temporaryPath = `${this.path}.tmp`;
+    await this.io.mkdir(dirname(this.path), { recursive: true });
+    await this.io.writeFile(temporaryPath, JSON.stringify(value), { encoding: "utf8", mode: 384 });
+    await this.io.rename(temporaryPath, this.path);
+  }
+};
+
+// src/main/credential-store.ts
+var CredentialStore = class {
+  constructor(path, crypto2, io) {
+    this.crypto = crypto2;
+    this.store = new JsonFileStore(path, () => ({}), io);
+  }
+  crypto;
+  store;
+  ensureEncryptionAvailable() {
+    if (!this.crypto.isEncryptionAvailable()) {
+      throw new Error("OS credential encryption is unavailable.");
+    }
+  }
+  async set(key, value) {
+    this.ensureEncryptionAvailable();
+    const credentials = await this.store.read();
+    credentials[key] = this.crypto.encryptString(value).toString("base64");
+    await this.store.write(credentials);
+  }
+  async get(key) {
+    const encrypted = (await this.store.read())[key];
+    return encrypted ? this.crypto.decryptString(Buffer.from(encrypted, "base64")) : null;
+  }
+  async delete(key) {
+    const credentials = await this.store.read();
+    delete credentials[key];
+    await this.store.write(credentials);
+  }
+  clear() {
+    return this.store.write({});
+  }
+};
+
+// src/main/device-credential-manager.ts
+var DeviceCredentialManager = class {
+  store;
+  http;
+  createIdentity;
+  stored = null;
+  access = null;
+  refreshPromise = null;
+  constructor(store, http, createIdentity) {
+    this.store = store;
+    this.http = http;
+    this.createIdentity = createIdentity;
+  }
+  async load() {
+    this.stored = await this.store.load();
+    return this.stored;
+  }
+  async pair(input) {
+    this.store.ensureEncryptionAvailable();
+    const identity = this.createIdentity();
+    const result = await this.http.pair({ ...input, publicKey: identity.publicKey });
+    return this.persistResult(result, identity.privateKey, identity.publicKey);
+  }
+  refresh() {
+    if (this.refreshPromise) return this.refreshPromise;
+    this.refreshPromise = this.refreshOnce().finally(() => {
+      this.refreshPromise = null;
+    });
+    return this.refreshPromise;
+  }
+  getStoredSession() {
+    return this.stored;
+  }
+  getAccessCredential() {
+    return this.access;
+  }
+  async clear() {
+    this.stored = null;
+    this.access = null;
+    await this.store.clear();
+  }
+  async refreshOnce() {
+    if (!this.stored) throw new Error("Desktop Agent is not paired.");
+    let result;
+    try {
+      result = await this.http.refresh(this.stored.refreshToken);
+    } catch (error) {
+      if (hasErrorCode(error, "CREDENTIAL_REVOKED")) await this.clear();
+      throw error;
+    }
+    return this.persistResult(result, this.stored.privateKey, this.stored.publicKey);
+  }
+  async persistResult(result, privateKey, publicKey) {
+    const session = {
+      privateKey,
+      publicKey,
+      refreshToken: result.refreshToken,
+      refreshTokenExpiresAt: result.refreshTokenExpiresAt,
+      device: result.device
+    };
+    await this.store.save(session);
+    const access = {
+      accessToken: result.accessToken,
+      accessTokenExpiresAt: result.accessTokenExpiresAt,
+      session
+    };
+    this.stored = session;
+    this.access = access;
+    return access;
+  }
+};
+function hasErrorCode(error, code) {
+  return Boolean(error && typeof error === "object" && "code" in error && error.code === code);
+}
+
+// src/main/device-name.ts
+function sanitizeDeviceName(value) {
+  return [...value].filter((character) => {
+    const code = character.codePointAt(0) ?? 0;
+    return code >= 32 && code !== 127;
+  }).join("").replace(/\s+/g, " ").trim().slice(0, 80) || "Desktop Agent";
+}
+
+// src/main/desktop-agent-http.ts
+var RESPONSE_LIMIT = 64 * 1024;
+var REQUEST_TIMEOUT_MS = 1e4;
+var DesktopAgentClientError = class extends Error {
+  code;
+  constructor(code) {
+    super(code);
+    this.code = code;
+    this.name = "DesktopAgentClientError";
+  }
+};
+var DesktopAgentHttpClient = class {
+  origin;
+  fetcher;
+  constructor(origin, fetcher = fetch) {
+    this.origin = origin;
+    this.fetcher = fetcher;
+  }
+  pair(input) {
+    return this.requestCredential("/desktop-agent-auth/pair", {
+      ...input,
+      code: input.code.trim().toUpperCase(),
+      name: input.name.trim()
+    });
+  }
+  refresh(refreshToken) {
+    return this.requestCredential("/desktop-agent-auth/refresh", { refreshToken });
+  }
+  async me(accessToken) {
+    const value = await this.request("/desktop-agent-auth/me", {
+      headers: { authorization: `Bearer ${accessToken}` },
+      method: "GET"
+    });
+    if (!isDeviceSummary(value)) throw new DesktopAgentClientError("DESKTOP_RESPONSE_INVALID");
+    return value;
+  }
+  async requestCredential(path, body) {
+    const value = await this.request(path, {
+      body: JSON.stringify(body),
+      headers: { "content-type": "application/json" },
+      method: "POST"
+    });
+    if (!isCredentialResult(value)) {
+      throw new DesktopAgentClientError("DESKTOP_RESPONSE_INVALID");
+    }
+    return value;
+  }
+  async request(path, init) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+    timeout.unref?.();
+    let response;
+    try {
+      response = await this.fetcher(`${this.origin}${path}`, {
+        ...init,
+        cache: "no-store",
+        signal: controller.signal
+      });
+    } catch {
+      throw new DesktopAgentClientError("NETWORK_ERROR");
+    } finally {
+      clearTimeout(timeout);
+    }
+    const contentType = response.headers.get("content-type")?.split(";", 1)[0].trim();
+    if (contentType !== "application/json") {
+      throw new DesktopAgentClientError("DESKTOP_RESPONSE_INVALID");
+    }
+    const value = await readBoundedJson(response);
+    if (!response.ok) throw mapServerError(response.status, value);
+    return value;
+  }
+};
+async function readBoundedJson(response) {
+  const length = Number(response.headers.get("content-length"));
+  if (Number.isFinite(length) && length > RESPONSE_LIMIT) {
+    throw new DesktopAgentClientError("DESKTOP_RESPONSE_TOO_LARGE");
+  }
+  if (!response.body) throw new DesktopAgentClientError("DESKTOP_RESPONSE_INVALID");
+  const reader = response.body.getReader();
+  const chunks = [];
+  let size = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    size += value.byteLength;
+    if (size > RESPONSE_LIMIT) {
+      await reader.cancel();
+      throw new DesktopAgentClientError("DESKTOP_RESPONSE_TOO_LARGE");
+    }
+    chunks.push(value);
+  }
+  const body = Buffer.concat(chunks, size).toString("utf8");
+  try {
+    return JSON.parse(body);
+  } catch {
+    throw new DesktopAgentClientError("DESKTOP_RESPONSE_INVALID");
+  }
+}
+function mapServerError(status, value) {
+  const code = value && typeof value === "object" && "code" in value ? value.code : void 0;
+  if (code === "DESKTOP_AGENT_PAIRING_CODE_INVALID") {
+    return new DesktopAgentClientError("PAIRING_CODE_INVALID");
+  }
+  if (code === "DESKTOP_AGENT_PLAN_RESTRICTED") {
+    return new DesktopAgentClientError("PLAN_RESTRICTED");
+  }
+  if (code === "DESKTOP_AGENT_TOKEN_INVALID" || code === "DESKTOP_AGENT_DEVICE_REVOKED") {
+    return new DesktopAgentClientError("CREDENTIAL_REVOKED");
+  }
+  return new DesktopAgentClientError(status >= 500 ? "SERVER_UNAVAILABLE" : "DESKTOP_RESPONSE_INVALID");
+}
+function isCredentialResult(value) {
+  if (!value || typeof value !== "object") return false;
+  const result = value;
+  return typeof result.accessToken === "string" && typeof result.accessTokenExpiresAt === "string" && typeof result.refreshToken === "string" && typeof result.refreshTokenExpiresAt === "string" && isDeviceSummary(result.device);
+}
+function isDeviceSummary(value) {
+  if (!value || typeof value !== "object") return false;
+  const device = value;
+  return typeof device.id === "string" && typeof device.name === "string" && (device.platform === "WINDOWS" || device.platform === "MACOS" || device.platform === "LINUX") && typeof device.agentVersion === "string" && typeof device.facebookReady === "boolean" && (device.accessMode === "FULL" || device.accessMode === "PLAN_RESTRICTED");
+}
+
+// src/main/desktop-agent-session.ts
+import { randomUUID } from "node:crypto";
+
+// ../../packages/shared/src/index.ts
+var DESKTOP_AGENT_PROTOCOL_VERSION = 1;
+
+// src/main/desktop-agent-session.ts
+var MESSAGE_FRESHNESS_MS = 5 * 60 * 1e3;
+var MAX_REPLAY_IDS = 512;
+var DesktopAgentSession = class {
+  options;
+  snapshot = emptySnapshot("UNPAIRED");
+  listeners = /* @__PURE__ */ new Set();
+  jobListeners = /* @__PURE__ */ new Set();
+  replayIds = /* @__PURE__ */ new Set();
+  socket = null;
+  heartbeatTimer = null;
+  accessRefreshTimer = null;
+  reconnectTimer = null;
+  generation = 0;
+  reconnectAttempt = 0;
+  handshake = "CHALLENGE";
+  reportedState = "IDLE";
+  reportedJobId = null;
+  constructor(options) {
+    this.options = options;
+  }
+  getSnapshot() {
+    return this.snapshot;
+  }
+  subscribe(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  subscribeJobs(listener) {
+    this.jobListeners.add(listener);
+    return () => this.jobListeners.delete(listener);
+  }
+  setReportedState(state) {
+    this.reportedState = state;
+  }
+  restoreJob(jobId) {
+    this.reportedJobId = jobId;
+    this.update({ ...this.snapshot, currentJobId: jobId });
+  }
+  claimJob(jobId) {
+    return this.sendAuthenticated("SCAN_JOB_CLAIM", { jobId });
+  }
+  heartbeatJob(jobId, attemptToken) {
+    return this.sendAuthenticated("SCAN_JOB_HEARTBEAT", { jobId, attemptToken });
+  }
+  progressJob(jobId, attemptToken, message) {
+    return this.sendAuthenticated("SCAN_JOB_PROGRESS", { jobId, attemptToken, message });
+  }
+  finishJob(jobId) {
+    if (this.reportedJobId !== jobId && this.snapshot.currentJobId !== jobId) return false;
+    this.reportedJobId = null;
+    this.update({ ...this.snapshot, currentJobId: null, pendingJobId: null });
+    return true;
+  }
+  clearJob() {
+    this.reportedJobId = null;
+    this.reportedState = "IDLE";
+    this.update({ ...this.snapshot, currentJobId: null, pendingJobId: null });
+  }
+  async start(publishConnecting = true) {
+    const generation = ++this.generation;
+    const stored = await this.options.credentials.load();
+    if (generation !== this.generation) return;
+    if (!stored) {
+      this.update(emptySnapshot("UNPAIRED"));
+      return;
+    }
+    if (publishConnecting) this.update(snapshotForSession("CONNECTING", stored));
+    try {
+      const access = await this.options.credentials.refresh();
+      if (generation === this.generation) {
+        this.connect(access, generation);
+        this.scheduleAccessRefresh(access, generation);
+      }
+    } catch (error) {
+      if (generation !== this.generation) return;
+      if (hasErrorCode2(error, "CREDENTIAL_REVOKED")) {
+        this.update(snapshotForSession("REVOKED", null, "CREDENTIAL_REVOKED"));
+      } else {
+        this.scheduleReconnect(stored, generation, "NETWORK_ERROR");
+      }
+    }
+  }
+  async pair(input) {
+    const generation = ++this.generation;
+    this.closeActive();
+    this.update(emptySnapshot("PAIRING"));
+    try {
+      const access = await this.options.credentials.pair(input);
+      if (generation !== this.generation) return;
+      this.update(snapshotForSession("CONNECTING", access.session));
+      this.connect(access, generation);
+      this.scheduleAccessRefresh(access, generation);
+    } catch (error) {
+      if (generation !== this.generation) return;
+      this.update(snapshotForSession("UNPAIRED", null, readErrorCode(error)));
+      throw error;
+    }
+  }
+  retry() {
+    this.cancelTimers();
+    return this.start();
+  }
+  async unlink() {
+    ++this.generation;
+    this.closeActive();
+    await this.options.credentials.clear();
+    this.reportedJobId = null;
+    this.reportedState = "IDLE";
+    this.update(emptySnapshot("UNPAIRED"));
+  }
+  stop() {
+    ++this.generation;
+    this.closeActive();
+  }
+  connect(access, generation) {
+    if (generation !== this.generation) return;
+    this.replayIds.clear();
+    this.handshake = "CHALLENGE";
+    const socket = this.options.createSocket(this.options.websocketUrl, access.accessToken);
+    this.socket = socket;
+    socket.on("message", (data) => this.handleMessage(socket, data, access, generation));
+    socket.on("error", () => this.handleDisconnect(socket, access.session, generation));
+    socket.on("close", () => this.handleDisconnect(socket, access.session, generation));
+  }
+  handleMessage(socket, data, access, generation) {
+    if (generation !== this.generation || socket !== this.socket) return;
+    const envelope = parseServerEnvelope(data);
+    if (!envelope || envelope.deviceId !== access.session.device.id || envelope.protocolVersion !== DESKTOP_AGENT_PROTOCOL_VERSION || Math.abs(Date.now() - Date.parse(envelope.sentAt)) > MESSAGE_FRESHNESS_MS || this.replayIds.has(envelope.messageId)) {
+      this.protocolFailure(socket, access.session, generation);
+      return;
+    }
+    this.rememberMessage(envelope.messageId);
+    if (envelope.type === "CREDENTIAL_REVOKED") {
+      void this.revoke(socket, generation);
+      return;
+    }
+    if (envelope.type === "UPDATE_REQUIRED") {
+      ++this.generation;
+      this.socket = null;
+      this.cancelTimers();
+      socket.close();
+      this.update({
+        ...snapshotForSession("UPDATE_REQUIRED", access.session),
+        minimumAgentVersion: envelope.payload.minimumAgentVersion
+      });
+      return;
+    }
+    if (this.handshake === "CHALLENGE") {
+      if (envelope.type !== "CHALLENGE") {
+        this.protocolFailure(socket, access.session, generation);
+        return;
+      }
+      this.send(socket, access.session.device.id, "HELLO", {
+        challenge: envelope.payload.challenge,
+        signature: this.options.signChallenge(
+          access.session.privateKey,
+          access.session.device.id,
+          envelope.payload.challenge
+        ),
+        agentVersion: this.options.agentVersion,
+        platform: this.options.platform,
+        state: this.reportedState,
+        facebookReady: this.options.getFacebookReady(),
+        currentJobId: this.reportedJobId
+      });
+      this.handshake = "WELCOME";
+      return;
+    }
+    if (this.handshake === "WELCOME") {
+      if (envelope.type !== "WELCOME") {
+        this.protocolFailure(socket, access.session, generation);
+        return;
+      }
+      this.handshake = "AUTHENTICATED";
+    }
+    this.handleAuthenticatedEnvelope(socket, envelope, access.session, generation);
+  }
+  handleAuthenticatedEnvelope(socket, envelope, stored, generation) {
+    if (envelope.type === "WELCOME") {
+      const state = envelope.payload.accessMode === "FULL" ? "ONLINE" : "RESTRICTED";
+      this.reconnectAttempt = 0;
+      this.update({
+        ...snapshotForSession(state, stored),
+        accessMode: envelope.payload.accessMode
+      });
+      this.scheduleHeartbeat(socket, stored.device.id, envelope.payload.heartbeatIntervalMs, generation);
+      return;
+    }
+    if (envelope.type === "ACCESS_MODE") {
+      this.update({
+        ...this.snapshot,
+        accessMode: envelope.payload.accessMode,
+        state: envelope.payload.accessMode === "FULL" ? "ONLINE" : "RESTRICTED"
+      });
+      return;
+    }
+    if (envelope.type === "SCAN_JOB_AVAILABLE") {
+      this.update({ ...this.snapshot, pendingJobId: envelope.payload.jobId });
+      this.emitJob({ type: "AVAILABLE", jobId: envelope.payload.jobId });
+      return;
+    }
+    if (envelope.type === "SCAN_JOB_STOP") {
+      if (this.reportedJobId === envelope.payload.jobId) this.reportedJobId = null;
+      this.update({ ...this.snapshot, currentJobId: null, pendingJobId: null });
+      this.emitJob({ type: "STOP", ...envelope.payload });
+      return;
+    }
+    if (envelope.type !== "SCAN_JOB_START") {
+      this.protocolFailure(socket, stored, generation);
+      return;
+    }
+    this.update({ ...this.snapshot, currentJobId: envelope.payload.jobId, pendingJobId: null });
+    this.reportedJobId = envelope.payload.jobId;
+    this.emitJob({ type: "START", ...envelope.payload });
+  }
+  scheduleHeartbeat(socket, deviceId, interval, generation) {
+    this.clearHeartbeat();
+    this.heartbeatTimer = this.options.setTimer(() => {
+      if (generation !== this.generation || socket !== this.socket) return;
+      this.send(socket, deviceId, "HEARTBEAT", {
+        state: this.reportedState,
+        facebookReady: this.options.getFacebookReady(),
+        currentJobId: this.reportedJobId
+      });
+      this.scheduleHeartbeat(socket, deviceId, interval, generation);
+    }, interval);
+  }
+  scheduleAccessRefresh(access, generation) {
+    this.clearAccessRefresh();
+    const expiresAt = Date.parse(access.accessTokenExpiresAt);
+    const delay = Math.max(1e3, expiresAt - Date.now() - 6e4);
+    this.accessRefreshTimer = this.options.setTimer(() => {
+      if (generation !== this.generation) return;
+      ++this.generation;
+      this.closeActive();
+      void this.start(false);
+    }, delay);
+  }
+  handleDisconnect(socket, stored, generation) {
+    if (generation !== this.generation || socket !== this.socket) return;
+    this.socket = null;
+    this.clearHeartbeat();
+    this.clearAccessRefresh();
+    this.scheduleReconnect(stored, generation, "NETWORK_ERROR");
+  }
+  protocolFailure(socket, stored, generation) {
+    if (socket === this.socket) this.socket = null;
+    socket.close();
+    this.clearHeartbeat();
+    this.clearAccessRefresh();
+    this.scheduleReconnect(stored, generation, "PROTOCOL_VIOLATION");
+  }
+  scheduleReconnect(stored, generation, errorCode) {
+    if (generation !== this.generation || this.reconnectTimer) return;
+    const delay = this.options.reconnectDelay(this.reconnectAttempt++, this.options.random);
+    this.update({
+      ...snapshotForSession("RECONNECTING", stored, errorCode),
+      nextRetryAt: new Date(Date.now() + delay).toISOString()
+    });
+    this.reconnectTimer = this.options.setTimer(() => {
+      this.reconnectTimer = null;
+      if (generation === this.generation) void this.start();
+    }, delay);
+  }
+  async revoke(socket, generation) {
+    if (generation !== this.generation) return;
+    ++this.generation;
+    this.socket = null;
+    socket.close();
+    this.cancelTimers();
+    await this.options.credentials.clear();
+    this.reportedJobId = null;
+    this.reportedState = "IDLE";
+    this.update(snapshotForSession("REVOKED", null, "CREDENTIAL_REVOKED"));
+  }
+  send(socket, deviceId, type, payload) {
+    socket.send(JSON.stringify({
+      protocolVersion: DESKTOP_AGENT_PROTOCOL_VERSION,
+      deviceId,
+      messageId: randomUUID(),
+      sentAt: (/* @__PURE__ */ new Date()).toISOString(),
+      type,
+      payload
+    }));
+  }
+  sendAuthenticated(type, payload) {
+    const stored = this.options.credentials.getStoredSession();
+    if (!stored || !this.socket || this.handshake !== "AUTHENTICATED" || this.socket.readyState !== 1) {
+      return false;
+    }
+    this.send(this.socket, stored.device.id, type, payload);
+    return true;
+  }
+  emitJob(event) {
+    for (const listener of this.jobListeners) {
+      Promise.resolve(listener(event)).catch(() => void 0);
+    }
+  }
+  rememberMessage(messageId) {
+    this.replayIds.add(messageId);
+    if (this.replayIds.size > MAX_REPLAY_IDS) {
+      this.replayIds.delete(this.replayIds.values().next().value);
+    }
+  }
+  closeActive() {
+    this.cancelTimers();
+    const socket = this.socket;
+    this.socket = null;
+    socket?.close();
+  }
+  cancelTimers() {
+    this.clearHeartbeat();
+    this.clearAccessRefresh();
+    if (this.reconnectTimer) this.options.clearTimer(this.reconnectTimer);
+    this.reconnectTimer = null;
+  }
+  clearHeartbeat() {
+    if (this.heartbeatTimer) this.options.clearTimer(this.heartbeatTimer);
+    this.heartbeatTimer = null;
+  }
+  clearAccessRefresh() {
+    if (this.accessRefreshTimer) this.options.clearTimer(this.accessRefreshTimer);
+    this.accessRefreshTimer = null;
+  }
+  update(snapshot) {
+    this.snapshot = snapshot;
+    for (const listener of this.listeners) listener(snapshot);
+  }
+};
+function parseServerEnvelope(data) {
+  try {
+    const value = JSON.parse(data.toString("utf8"));
+    if (!value || typeof value !== "object") return null;
+    const envelope = value;
+    return typeof envelope.deviceId === "string" && typeof envelope.messageId === "string" && typeof envelope.sentAt === "string" && typeof envelope.type === "string" && Boolean(envelope.payload && typeof envelope.payload === "object") ? value : null;
+  } catch {
+    return null;
+  }
+}
+function emptySnapshot(state) {
+  return {
+    state,
+    deviceName: null,
+    accessMode: null,
+    facebookReady: false,
+    currentJobId: null,
+    pendingJobId: null,
+    nextRetryAt: null,
+    minimumAgentVersion: null,
+    errorCode: null
+  };
+}
+function snapshotForSession(state, stored, errorCode = null) {
+  return {
+    ...emptySnapshot(state),
+    deviceName: stored?.device.name ?? null,
+    accessMode: stored?.device.accessMode ?? null,
+    facebookReady: stored?.device.facebookReady ?? false,
+    errorCode
+  };
+}
+function hasErrorCode2(error, code) {
+  return Boolean(error && typeof error === "object" && "code" in error && error.code === code);
+}
+function readErrorCode(error) {
+  return error && typeof error === "object" && "code" in error && typeof error.code === "string" ? error.code : "UNKNOWN_ERROR";
+}
+
+// src/main/desktop-scan-http.ts
+import { createHash, createPrivateKey, randomUUID as randomUUID2, sign } from "node:crypto";
+var RESPONSE_LIMIT2 = 64 * 1024;
+var REQUEST_TIMEOUT_MS2 = 9e4;
+var DesktopScanHttpError = class extends Error {
+  code;
+  recoverable;
+  constructor(code, recoverable = false) {
+    super(code);
+    this.code = code;
+    this.recoverable = recoverable;
+  }
+};
+var DesktopScanHttp = class {
+  origin;
+  getCredential;
+  fetcher;
+  constructor(options) {
+    this.origin = options.origin;
+    this.getCredential = options.getCredential;
+    this.fetcher = options.fetcher ?? fetch;
+  }
+  uploadBatch(jobId, payload, signal) {
+    payload = normalizeBatch(payload);
+    return this.signedPost(`/leads/desktop-agent/jobs/${jobId}/batches`, payload, signal);
+  }
+  complete(jobId, payload, signal) {
+    if (payload.outcome === "FAILED") {
+      payload = { ...payload, errorMessage: (payload.errorMessage ?? "Desktop scan failed.").slice(0, 500) };
+    }
+    return this.signedPost(`/leads/desktop-agent/jobs/${jobId}/complete`, payload, signal);
+  }
+  cancel(jobId, attemptToken) {
+    return this.signedPost(`/leads/desktop-agent/jobs/${jobId}/cancel`, { attemptToken });
+  }
+  async signedPost(path, businessPayload, signal) {
+    const credential = this.getCredential();
+    if (!credential) throw new DesktopScanHttpError("CREDENTIAL_UNAVAILABLE");
+    const signedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const requestNonce = randomUUID2();
+    const unsigned = { ...businessPayload, signedAt, requestNonce, signature: void 0 };
+    const digest = createHash("sha256").update(JSON.stringify(unsigned)).digest("hex");
+    const message = Buffer.from(
+      `desktop-agent-http:1:POST:${path}:${signedAt}:${requestNonce}:${digest}`,
+      "utf8"
+    );
+    const key = createPrivateKey({
+      key: Buffer.from(credential.privateKey, "base64"),
+      format: "der",
+      type: "pkcs8"
+    });
+    const body = {
+      ...businessPayload,
+      signedAt,
+      requestNonce,
+      signature: sign(null, message, key).toString("base64")
+    };
+    const timeoutSignal = AbortSignal.timeout(REQUEST_TIMEOUT_MS2);
+    const requestSignal = signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
+    let response;
+    try {
+      response = await this.fetcher(`${this.origin}${path}`, {
+        body: JSON.stringify(body),
+        cache: "no-store",
+        headers: {
+          authorization: `Bearer ${credential.accessToken}`,
+          "content-type": "application/json"
+        },
+        method: "POST",
+        signal: requestSignal
+      });
+    } catch {
+      throw new DesktopScanHttpError("NETWORK_ERROR", true);
+    }
+    const contentType = response.headers.get("content-type")?.split(";", 1)[0];
+    if (contentType !== "application/json") throw new DesktopScanHttpError("RESPONSE_INVALID");
+    const value = await readBoundedJson2(response);
+    if (!response.ok) {
+      throw new DesktopScanHttpError(
+        response.status >= 500 ? "SERVER_UNAVAILABLE" : response.status === 413 ? "BATCH_TOO_LARGE" : "BATCH_REJECTED",
+        response.status >= 500
+      );
+    }
+    return value;
+  }
+};
+async function readBoundedJson2(response) {
+  const length = Number(response.headers.get("content-length"));
+  if (Number.isFinite(length) && length > RESPONSE_LIMIT2) {
+    throw new DesktopScanHttpError("RESPONSE_TOO_LARGE");
+  }
+  if (!response.body) throw new DesktopScanHttpError("RESPONSE_INVALID");
+  const reader = response.body.getReader();
+  const chunks = [];
+  let size = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    size += value.byteLength;
+    if (size > RESPONSE_LIMIT2) {
+      await reader.cancel();
+      throw new DesktopScanHttpError("RESPONSE_TOO_LARGE");
+    }
+    chunks.push(value);
+  }
+  try {
+    return JSON.parse(Buffer.concat(chunks, size).toString("utf8"));
+  } catch {
+    throw new DesktopScanHttpError("RESPONSE_INVALID");
+  }
+}
+function normalizeBatch(payload) {
+  const items = payload.items.map((item) => {
+    const authorAvatarUrl = normalizeMediaUrl(item.authorAvatarUrl);
+    const attachmentImages = item.attachmentImages?.map(normalizeMediaUrl).filter((url) => Boolean(url)).slice(0, 6);
+    const groupName = typeof item.groupName === "string" && item.groupName.trim() ? item.groupName.trim().slice(0, 200) : void 0;
+    const textFormat = normalizeTextFormat(item.textFormat);
+    return {
+      ...item,
+      ...groupName ? { groupName } : {},
+      sourceUrl: normalizeFacebookPostUrl(item.sourceUrl),
+      authorAvatarUrl,
+      attachmentImages: attachmentImages?.length ? attachmentImages : void 0,
+      textFormat
+    };
+  });
+  if (!Number.isInteger(payload.sequence) || payload.sequence < 0 || payload.groupItemCount !== void 0 && (!Number.isInteger(payload.groupItemCount) || payload.groupItemCount < items.length) || items.length > 100 || !isFacebookGroupUrl(payload.groupUrl) || items.some((item) => !isFacebookPost(item))) {
+    throw new DesktopScanHttpError("BATCH_INVALID");
+  }
+  return { ...payload, items };
+}
+function isFacebookGroupUrl(value) {
+  try {
+    const url = new URL(value);
+    return ["facebook.com", "www.facebook.com"].includes(url.hostname.toLowerCase()) && /^\/groups\/[a-z0-9._-]+\/?$/i.test(url.pathname);
+  } catch {
+    return false;
+  }
+}
+function isFacebookPost(item) {
+  if (!item.text.trim() || item.text.length > 5e4 || (item.authorName?.length ?? 0) > 200) return false;
+  if (item.authorAvatarUrl && !isHttpUrl(item.authorAvatarUrl)) return false;
+  if (item.attachmentImages && (item.attachmentImages.length > 6 || item.attachmentImages.some((url) => !isHttpUrl(url)))) return false;
+  if (item.publishedAt && Number.isNaN(Date.parse(item.publishedAt))) return false;
+  try {
+    const url = new URL(item.sourceUrl);
+    return ["facebook.com", "www.facebook.com"].includes(url.hostname.toLowerCase()) && /^\/groups\/[a-z0-9._-]+\/posts\/\d+\/?$/i.test(url.pathname);
+  } catch {
+    return false;
+  }
+}
+function isHttpUrl(value) {
+  try {
+    return ["http:", "https:"].includes(new URL(value).protocol);
+  } catch {
+    return false;
+  }
+}
+function normalizeMediaUrl(value) {
+  return value && value.length <= 2e3 && isHttpUrl(value) ? value : void 0;
+}
+function normalizeTextFormat(value) {
+  if (!value) return void 0;
+  const textFormat = {
+    backgroundColor: normalizeFormatToken(value.backgroundColor),
+    backgroundImageUrl: normalizeMediaUrl(value.backgroundImageUrl),
+    color: normalizeFormatToken(value.color),
+    fontStyle: normalizeFormatToken(value.fontStyle),
+    fontWeight: normalizeFormatToken(value.fontWeight)
+  };
+  return Object.values(textFormat).some(Boolean) ? textFormat : void 0;
+}
+function normalizeFormatToken(value) {
+  const normalized = value?.trim();
+  return normalized && normalized.length <= 50 ? normalized : void 0;
+}
+function normalizeFacebookPostUrl(value) {
+  try {
+    const url = new URL(value);
+    if (url.pathname.toLowerCase() !== "/permalink.php") return value;
+    const groupId = url.searchParams.get("id");
+    const postId = url.searchParams.get("story_fbid");
+    return groupId && postId && /^\d+$/.test(groupId) && /^\d+$/.test(postId) ? `https://www.facebook.com/groups/${groupId}/posts/${postId}/` : value;
+  } catch {
+    return value;
+  }
+}
+
+// src/main/desktop-scan-runner.ts
+var DesktopScanRunner = class {
+  options;
+  listeners = /* @__PURE__ */ new Set();
+  snapshot = idleSnapshot();
+  active = null;
+  abortController = null;
+  heartbeatTimer = null;
+  leaseTimer = null;
+  canceled = false;
+  unsubscribe = null;
+  paused = null;
+  recovered = null;
+  activeAttempt = null;
+  recoveryBlocked = false;
+  constructor(options) {
+    this.options = options;
+  }
+  start() {
+    if (this.unsubscribe) return;
+    this.unsubscribe = this.options.session.subscribeJobs((event) => this.handleEvent(event));
+  }
+  async recover() {
+    let records;
+    try {
+      records = await this.options.spool.loadAll();
+    } catch (error) {
+      this.recoveryBlocked = true;
+      this.update({ ...idleSnapshot(), state: "SPOOL_FULL", errorCode: readErrorCode2(error) });
+      return;
+    }
+    const current = records.find((record) => Date.parse(record.job.leaseExpiresAt) > this.options.now()) ?? null;
+    await Promise.all(records.filter((record) => record !== current).map((record) => this.options.spool.delete(record.job.jobId)));
+    if (!current) return;
+    this.recovered = current;
+    this.options.session.restoreJob(current.job.jobId);
+    this.options.session.setReportedState("SCANNING");
+    this.update({
+      state: "OFFLINE_PENDING",
+      jobId: current.job.jobId,
+      groupIndex: Math.min(current.nextGroupIndex, Math.max(0, current.job.groupUrls.length - 1)),
+      groupCount: current.job.groupUrls.length,
+      acceptedItems: current.acceptedItems,
+      errorCode: "RECONCILIATION_REQUIRED"
+    });
+  }
+  stop() {
+    this.canceled = true;
+    this.abortController?.abort();
+    this.clearHeartbeat();
+    this.unsubscribe?.();
+    this.unsubscribe = null;
+  }
+  getSnapshot() {
+    return this.snapshot;
+  }
+  isRunning() {
+    return this.active !== null;
+  }
+  subscribe(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  async whenIdle() {
+    await this.active;
+  }
+  async reset() {
+    this.stop();
+    await this.whenIdle();
+    this.canceled = false;
+    this.paused = null;
+    this.recovered = null;
+    this.activeAttempt = null;
+    this.recoveryBlocked = false;
+    this.abortController = null;
+    this.options.session.clearJob();
+    this.options.session.setReportedState("IDLE");
+    this.update(idleSnapshot());
+  }
+  async resumeAfterLogin() {
+    if (this.active || !this.paused || !await this.options.facebookState.isReady()) return false;
+    const paused = this.paused;
+    this.paused = null;
+    this.canceled = false;
+    this.active = this.run(paused.job, paused).finally(() => {
+      this.active = null;
+    });
+    return true;
+  }
+  async handleEvent(event) {
+    if (event.type === "AVAILABLE") {
+      await this.claimIfReady(event.jobId);
+      return;
+    }
+    if (event.type === "STOP") {
+      if (this.snapshot.jobId === event.jobId) {
+        this.canceled = true;
+        this.paused = null;
+        this.recovered = null;
+        if (this.active) {
+          this.update({ ...this.snapshot, state: "CANCELING" });
+          this.abortController?.abort();
+          await this.active;
+        } else {
+          this.options.session.setReportedState("IDLE");
+          this.update(idleSnapshot());
+        }
+        await this.options.spool.delete(event.jobId);
+      }
+      return;
+    }
+    if (this.recoveryBlocked) return;
+    if (this.paused?.job.jobId === event.jobId && this.paused.job.attemptToken === event.attemptToken) {
+      this.paused.job = event;
+      return;
+    }
+    if (this.active) {
+      if (this.activeAttempt?.jobId === event.jobId && this.activeAttempt.attemptToken === event.attemptToken) {
+        if (Date.parse(event.leaseExpiresAt) > Date.parse(this.activeAttempt.leaseExpiresAt)) {
+          this.activeAttempt.leaseExpiresAt = event.leaseExpiresAt;
+          this.scheduleLeaseTimer(this.abortController, event.leaseExpiresAt);
+        }
+        return;
+      }
+      this.canceled = true;
+      this.abortController?.abort();
+      await this.active;
+      if (this.recoveryBlocked) return;
+    }
+    if (event.cancelRequestedAt) {
+      if (this.recovered?.job.jobId === event.jobId) {
+        await this.options.spool.delete(event.jobId);
+        this.recovered = null;
+      }
+      this.options.session.finishJob(event.jobId);
+      return;
+    }
+    const recovered = this.recovered?.job.jobId === event.jobId ? this.recovered : null;
+    if (this.recovered && (!recovered || this.recovered.job.attemptToken !== event.attemptToken)) {
+      await this.options.spool.delete(this.recovered.job.jobId);
+      this.recovered = null;
+    }
+    this.canceled = false;
+    this.active = this.run(event, recovered ? {
+      groupIndex: recovered.nextGroupIndex,
+      sequence: recovered.nextSequence,
+      acceptedItems: recovered.acceptedItems,
+      record: recovered
+    } : void 0).finally(() => {
+      this.active = null;
+    });
+    await this.active;
+  }
+  async claimIfReady(jobId) {
+    const session = this.options.session.getSnapshot();
+    if (this.recoveryBlocked || this.active || this.snapshot.jobId || session.currentJobId || session.state !== "ONLINE" || session.accessMode !== "FULL" || this.options.isLoginActive() || !await this.options.facebookState.isReady()) return;
+    this.options.session.claimJob(jobId);
+  }
+  async run(job, resume) {
+    const controller = new AbortController();
+    this.abortController = controller;
+    this.activeAttempt = {
+      jobId: job.jobId,
+      attemptToken: job.attemptToken,
+      leaseExpiresAt: job.leaseExpiresAt
+    };
+    this.options.session.setReportedState("SCANNING");
+    this.update({
+      state: "SCANNING",
+      jobId: job.jobId,
+      groupIndex: Math.min(resume?.groupIndex ?? 0, Math.max(0, job.groupUrls.length - 1)),
+      groupCount: job.groupUrls.length,
+      acceptedItems: resume?.acceptedItems ?? 0,
+      errorCode: null
+    });
+    this.scheduleHeartbeat(job, controller.signal);
+    this.scheduleLeaseTimer(controller, job.leaseExpiresAt);
+    let sequence = resume?.sequence ?? 0;
+    let currentGroupIndex = resume?.groupIndex ?? 0;
+    let successCompletionStarted = false;
+    let record = resume?.record ?? createSpoolRecord(job, this.options.now());
+    let transportOffline = false;
+    try {
+      if (!resume?.record) await this.options.spool.put(record);
+      for (const batch of record.pendingBatches) {
+        if (!await this.uploadWithRetry(job, batch, controller.signal)) {
+          transportOffline = true;
+          break;
+        }
+        assertActive(controller.signal, this.leaseExpiresAt(job), this.options.now());
+        record = { ...record, pendingBatches: record.pendingBatches.filter((item) => item.sequence !== batch.sequence), acceptedItems: record.acceptedItems + batch.items.length, updatedAt: nowIso(this.options.now()) };
+        await this.options.spool.put(record);
+        this.update({ ...this.snapshot, acceptedItems: record.acceptedItems });
+      }
+      if (record.completion) {
+        successCompletionStarted = record.completion.outcome === "SUCCEEDED";
+        if (transportOffline || !await this.completeWithRetry(job, record.completion, controller.signal)) {
+          throw codedError("OFFLINE_PENDING");
+        }
+        await this.options.spool.delete(job.jobId);
+        this.recovered = null;
+        this.options.session.finishJob(job.jobId);
+        return;
+      }
+      for (const [groupIndex, groupUrl] of job.groupUrls.entries()) {
+        if (groupIndex < currentGroupIndex) continue;
+        currentGroupIndex = groupIndex;
+        assertActive(controller.signal, this.leaseExpiresAt(job), this.options.now());
+        const storageState = await this.options.facebookState.load();
+        if (!storageState) throw codedError("FACEBOOK_SESSION_MISSING");
+        this.update({ ...this.snapshot, groupIndex });
+        this.options.session.progressJob(
+          job.jobId,
+          job.attemptToken,
+          `Nh\xF3m ${groupIndex + 1}/${job.groupUrls.length}: ${groupUrl}`
+        );
+        this.options.session.progressJob(
+          job.jobId,
+          job.attemptToken,
+          "\u0110ang g\u1ECDi t\xE1c v\u1EE5 thu th\u1EADp b\u1EB1ng Desktop Agent."
+        );
+        const [items] = await this.options.scanner.scanMany({
+          groupUrls: [groupUrl],
+          limit: job.itemsPerGroup,
+          onProgress: ({ itemCount, phase }) => {
+            if (phase !== "SCANNING") return;
+            const processed = Math.min(itemCount, Math.max(0, job.itemsPerGroup - 1));
+            this.options.session.progressJob(
+              job.jobId,
+              job.attemptToken,
+              `[PROGRESS]: Found ${itemCount} new group posts, ${processed}/${job.itemsPerGroup} for URL ${groupUrl}`
+            );
+          },
+          storageState,
+          signal: controller.signal
+        });
+        assertActive(controller.signal, this.leaseExpiresAt(job), this.options.now());
+        const groupBatches = [];
+        for (let offset = 0; offset < items.length; offset += 100) {
+          const batchItems = items.slice(offset, offset + 100).map(toDesktopPost);
+          const batch = {
+            attemptToken: job.attemptToken,
+            sequence,
+            idempotencyKey: this.options.randomUuid(),
+            groupUrl,
+            groupItemCount: items.length,
+            items: batchItems
+          };
+          sequence += 1;
+          groupBatches.push(batch);
+        }
+        record = {
+          ...record,
+          nextGroupIndex: groupIndex + 1,
+          nextSequence: sequence,
+          pendingBatches: [...record.pendingBatches, ...groupBatches],
+          updatedAt: nowIso(this.options.now())
+        };
+        await this.options.spool.put(record);
+        for (const batch of groupBatches) {
+          if (transportOffline || !await this.uploadWithRetry(job, batch, controller.signal)) {
+            transportOffline = true;
+            continue;
+          }
+          assertActive(controller.signal, this.leaseExpiresAt(job), this.options.now());
+          record = { ...record, pendingBatches: record.pendingBatches.filter((item) => item.sequence !== batch.sequence), acceptedItems: record.acceptedItems + batch.items.length, updatedAt: nowIso(this.options.now()) };
+          await this.options.spool.put(record);
+          this.update({ ...this.snapshot, acceptedItems: record.acceptedItems });
+        }
+      }
+      assertActive(controller.signal, this.leaseExpiresAt(job), this.options.now());
+      successCompletionStarted = true;
+      const completion = {
+        attemptToken: job.attemptToken,
+        outcome: "SUCCEEDED",
+        idempotencyKey: this.options.randomUuid()
+      };
+      record = { ...record, completion, updatedAt: nowIso(this.options.now()) };
+      await this.options.spool.put(record);
+      if (transportOffline || record.pendingBatches.length > 0 || !await this.completeWithRetry(job, completion, controller.signal)) {
+        throw codedError("OFFLINE_PENDING");
+      }
+      await this.options.spool.delete(job.jobId);
+      this.recovered = null;
+      this.options.session.finishJob(job.jobId);
+    } catch (error) {
+      const code = readErrorCode2(error);
+      const checkpoint = code === "LOGIN_REQUIRED" || code === "CHECKPOINT_REQUIRED";
+      if (code === "OFFLINE_PENDING") {
+        this.recovered = record;
+        this.update({ ...this.snapshot, state: "OFFLINE_PENDING", errorCode: "RECONCILIATION_REQUIRED" });
+      } else if (code === "SPOOL_FULL") {
+        this.recovered = record;
+        this.update({ ...this.snapshot, state: "SPOOL_FULL", errorCode: "SPOOL_FULL" });
+      } else if (successCompletionStarted) {
+        this.recovered = record;
+        this.update({ ...this.snapshot, state: "OFFLINE_PENDING", errorCode: "RECONCILIATION_REQUIRED" });
+      } else if (checkpoint && !this.canceled && this.options.now() < Date.parse(this.leaseExpiresAt(job))) {
+        this.paused = {
+          job,
+          groupIndex: currentGroupIndex,
+          sequence,
+          acceptedItems: this.snapshot.acceptedItems
+        };
+        this.options.session.setReportedState(code === "LOGIN_REQUIRED" ? "FACEBOOK_LOGIN_REQUIRED" : "CHECKPOINT_REQUIRED");
+        this.update({ ...this.snapshot, state: code, errorCode: code });
+        if (!this.options.isLoginActive()) {
+          await this.options.requestFacebookLogin().catch(() => void 0);
+        }
+      } else if (!this.canceled && code !== "SCAN_CANCELED" && code !== "LEASE_EXPIRED") {
+        const completion = {
+          attemptToken: job.attemptToken,
+          outcome: "FAILED",
+          errorMessage: code,
+          idempotencyKey: this.options.randomUuid()
+        };
+        record = { ...record, completion, updatedAt: nowIso(this.options.now()) };
+        let confirmed = false;
+        let terminalPersistenceFailed = false;
+        try {
+          await this.options.spool.put(record);
+          confirmed = await this.completeWithRetry(job, completion, controller.signal);
+        } catch (completionError) {
+          const completionCode = readErrorCode2(completionError);
+          terminalPersistenceFailed = true;
+          this.recovered = record;
+          this.update({
+            ...this.snapshot,
+            state: completionCode === "SPOOL_FULL" ? "SPOOL_FULL" : "OFFLINE_PENDING",
+            errorCode: completionCode === "SPOOL_FULL" ? "SPOOL_FULL" : "RECONCILIATION_REQUIRED"
+          });
+        }
+        if (confirmed) {
+          await this.options.spool.delete(job.jobId);
+          this.options.session.finishJob(job.jobId);
+        } else if (!terminalPersistenceFailed) {
+          this.recovered = record;
+          this.update({ ...this.snapshot, state: "OFFLINE_PENDING", errorCode: "RECONCILIATION_REQUIRED" });
+        }
+      }
+    } finally {
+      this.clearHeartbeat();
+      this.clearLeaseTimer();
+      this.abortController = null;
+      this.activeAttempt = null;
+      if (!this.snapshot.errorCode && this.snapshot.state !== "LOGIN_REQUIRED" && this.snapshot.state !== "CHECKPOINT_REQUIRED" && this.snapshot.state !== "OFFLINE_PENDING" && this.snapshot.state !== "SPOOL_FULL") {
+        this.options.session.setReportedState("IDLE");
+        this.update(idleSnapshot());
+      }
+    }
+  }
+  async uploadWithRetry(job, batch, signal) {
+    let attempt = 0;
+    for (; ; ) {
+      assertActive(signal, this.leaseExpiresAt(job), this.options.now());
+      try {
+        await this.options.http.uploadBatch(job.jobId, batch, signal);
+        return true;
+      } catch (error) {
+        if (!isRecoverable(error)) throw error;
+        if (attempt >= 4) return false;
+        attempt += 1;
+        await this.options.wait(Math.min(8e3, 500 * 2 ** attempt), signal);
+      }
+    }
+  }
+  async completeWithRetry(job, payload, signal) {
+    let attempt = 0;
+    for (; ; ) {
+      assertActive(signal, this.leaseExpiresAt(job), this.options.now());
+      try {
+        await this.options.http.complete(job.jobId, payload, signal);
+        return true;
+      } catch (error) {
+        if (!isRecoverable(error)) throw error;
+        if (attempt >= 4) return false;
+        attempt += 1;
+        await this.options.wait(Math.min(8e3, 500 * 2 ** attempt), signal);
+      }
+    }
+  }
+  scheduleHeartbeat(job, signal) {
+    this.clearHeartbeat();
+    this.heartbeatTimer = this.options.setTimer(() => {
+      if (signal.aborted || this.options.now() >= Date.parse(this.leaseExpiresAt(job))) return;
+      this.options.session.heartbeatJob(job.jobId, job.attemptToken);
+      this.scheduleHeartbeat(job, signal);
+    }, 15e3);
+  }
+  clearHeartbeat() {
+    if (this.heartbeatTimer) this.options.clearTimer(this.heartbeatTimer);
+    this.heartbeatTimer = null;
+  }
+  clearLeaseTimer() {
+    if (this.leaseTimer) this.options.clearTimer(this.leaseTimer);
+    this.leaseTimer = null;
+  }
+  scheduleLeaseTimer(controller, leaseExpiresAt) {
+    this.clearLeaseTimer();
+    this.leaseTimer = this.options.setTimer(
+      () => controller.abort(),
+      Math.max(0, Date.parse(leaseExpiresAt) - this.options.now())
+    );
+  }
+  leaseExpiresAt(job) {
+    return this.activeAttempt?.jobId === job.jobId && this.activeAttempt.attemptToken === job.attemptToken ? this.activeAttempt.leaseExpiresAt : job.leaseExpiresAt;
+  }
+  update(snapshot) {
+    this.snapshot = snapshot;
+    for (const listener of this.listeners) listener(snapshot);
+  }
+};
+function toDesktopPost(item) {
+  return {
+    sourceUrl: item.url,
+    text: item.text,
+    ...item.authorName ? { authorName: item.authorName } : {},
+    ...item.authorAvatarUrl ? { authorAvatarUrl: item.authorAvatarUrl } : {},
+    ...item.attachmentImages?.length ? { attachmentImages: item.attachmentImages } : {},
+    ...item.textFormat ? { textFormat: item.textFormat } : {},
+    ...item.publishedAt ? { publishedAt: item.publishedAt } : {},
+    ...item.groupName ? { groupName: item.groupName } : {}
+  };
+}
+function idleSnapshot() {
+  return {
+    state: "IDLE",
+    jobId: null,
+    groupIndex: 0,
+    groupCount: 0,
+    acceptedItems: 0,
+    errorCode: null
+  };
+}
+function assertActive(signal, leaseExpiresAt, now) {
+  if (signal.aborted) throw codedError("SCAN_CANCELED");
+  if (now >= Date.parse(leaseExpiresAt)) throw codedError("LEASE_EXPIRED");
+}
+function codedError(code) {
+  return Object.assign(new Error(code), { code });
+}
+function createSpoolRecord(job, now) {
+  return {
+    version: 1,
+    job: {
+      jobId: job.jobId,
+      attemptToken: job.attemptToken,
+      groupUrls: job.groupUrls,
+      itemsPerGroup: job.itemsPerGroup,
+      leaseExpiresAt: job.leaseExpiresAt,
+      cancelRequestedAt: job.cancelRequestedAt
+    },
+    nextGroupIndex: 0,
+    nextSequence: 0,
+    acceptedItems: 0,
+    pendingBatches: [],
+    completion: null,
+    updatedAt: nowIso(now)
+  };
+}
+function nowIso(now) {
+  return new Date(now).toISOString();
+}
+function readErrorCode2(error) {
+  return error && typeof error === "object" && "code" in error && typeof error.code === "string" ? error.code.slice(0, 500) : "SCAN_FAILED";
+}
+function isRecoverable(error) {
+  return Boolean(error && typeof error === "object" && "recoverable" in error && error.recoverable === true);
+}
+function abortableDelay(milliseconds, signal) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(resolve, milliseconds);
+    const abort = () => {
+      clearTimeout(timer);
+      reject(codedError("SCAN_CANCELED"));
+    };
+    timer.unref();
+    signal.addEventListener("abort", abort, { once: true });
+  });
+}
+
+// src/main/device-session-store.ts
+var SESSION_KEY = "device-session";
+var DeviceSessionStore = class {
+  constructor(credentials) {
+    this.credentials = credentials;
+  }
+  credentials;
+  ensureEncryptionAvailable() {
+    this.credentials.ensureEncryptionAvailable();
+  }
+  async load() {
+    const value = await this.credentials.get(SESSION_KEY);
+    if (!value) return null;
+    try {
+      const session = JSON.parse(value);
+      return isStoredSession(session) ? session : null;
+    } catch {
+      return null;
+    }
+  }
+  save(session) {
+    return this.credentials.set(SESSION_KEY, JSON.stringify(session));
+  }
+  clear() {
+    return this.credentials.delete(SESSION_KEY);
+  }
+};
+function isStoredSession(value) {
+  if (!value || typeof value !== "object") return false;
+  const session = value;
+  return typeof session.privateKey === "string" && typeof session.publicKey === "string" && typeof session.refreshToken === "string" && typeof session.refreshTokenExpiresAt === "string" && Boolean(session.device && typeof session.device.id === "string");
+}
+
+// src/main/encrypted-scan-spool.ts
+import { createHash as createHash2 } from "node:crypto";
+import { mkdir as mkdir3, readFile as readFile3, readdir as readdir2, rename as rename3, rm as rm2, stat as stat2, writeFile as writeFile3 } from "node:fs/promises";
+import { join as join2 } from "node:path";
+var ScanSpoolError = class extends Error {
+  code;
+  constructor(code) {
+    super(code);
+    this.code = code;
+  }
+};
+var EncryptedScanSpool = class {
+  directory;
+  crypto;
+  maxBytes;
+  constructor(directory, crypto2, maxBytes = 25 * 1024 * 1024) {
+    this.directory = directory;
+    this.crypto = crypto2;
+    this.maxBytes = maxBytes;
+  }
+  async put(record) {
+    if (!this.crypto.isEncryptionAvailable()) {
+      throw new ScanSpoolError("SPOOL_ENCRYPTION_UNAVAILABLE");
+    }
+    const path = this.pathFor(record.job.jobId);
+    const payload = JSON.stringify(record);
+    const encrypted = this.crypto.encryptString(JSON.stringify({
+      checksum: createHash2("sha256").update(payload).digest("hex"),
+      payload
+    }));
+    const currentSize = await stat2(path).then((value) => value.size).catch(() => 0);
+    const totalSize = await this.size();
+    if (totalSize - currentSize + encrypted.byteLength > this.maxBytes) {
+      throw new ScanSpoolError("SPOOL_FULL");
+    }
+    await mkdir3(this.directory, { recursive: true });
+    await writeFile3(`${path}.tmp`, encrypted, { mode: 384 });
+    await rename3(`${path}.tmp`, path);
+  }
+  async loadAll() {
+    if (!this.crypto.isEncryptionAvailable()) {
+      throw new ScanSpoolError("SPOOL_ENCRYPTION_UNAVAILABLE");
+    }
+    await this.removeTemporaryFiles();
+    const names = await this.names();
+    const records = [];
+    for (const name of names) {
+      const path = join2(this.directory, name);
+      let decrypted;
+      try {
+        decrypted = this.crypto.decryptString(await readFile3(path));
+      } catch {
+        continue;
+      }
+      try {
+        const envelope = JSON.parse(decrypted);
+        if (typeof envelope.payload !== "string" || typeof envelope.checksum !== "string" || createHash2("sha256").update(envelope.payload).digest("hex") !== envelope.checksum) {
+          throw new Error("Invalid spool checksum.");
+        }
+        const record = JSON.parse(envelope.payload);
+        if (!isRecord(record)) throw new Error("Invalid spool record.");
+        records.push(record);
+      } catch {
+        await rm2(path, { force: true });
+      }
+    }
+    return records.sort((left, right) => left.updatedAt.localeCompare(right.updatedAt));
+  }
+  delete(jobId) {
+    return rm2(this.pathFor(jobId), { force: true });
+  }
+  async bytes() {
+    return this.size();
+  }
+  async clear() {
+    await Promise.all((await this.ownedNames()).map((name) => rm2(join2(this.directory, name), { force: true })));
+  }
+  async size() {
+    const sizes = await Promise.all((await this.ownedNames()).map((name) => stat2(join2(this.directory, name)).then((value) => value.size).catch(() => 0)));
+    return sizes.reduce((total, value) => total + value, 0);
+  }
+  async names() {
+    return readdir2(this.directory).then((names) => names.filter((name) => name.endsWith(".spool"))).catch(() => []);
+  }
+  ownedNames() {
+    return readdir2(this.directory).then((names) => names.filter((name) => name.endsWith(".spool") || name.endsWith(".spool.tmp"))).catch(() => []);
+  }
+  async removeTemporaryFiles() {
+    await Promise.all((await this.ownedNames()).filter((name) => name.endsWith(".tmp")).map((name) => rm2(join2(this.directory, name), { force: true })));
+  }
+  pathFor(jobId) {
+    return join2(this.directory, `${createHash2("sha256").update(jobId).digest("hex")}.spool`);
+  }
+};
+function isRecord(value) {
+  return value?.version === 1 && typeof value.job?.jobId === "string" && typeof value.job.attemptToken === "string" && Array.isArray(value.job.groupUrls) && Number.isInteger(value.nextGroupIndex) && Number.isInteger(value.nextSequence) && Number.isInteger(value.acceptedItems) && Array.isArray(value.pendingBatches) && typeof value.updatedAt === "string";
+}
+
+// src/main/endpoint-policy.ts
+var DEVELOPMENT_ORIGIN = "http://127.0.0.1:4000";
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "::1", "localhost"]);
+function resolveAgentEndpoint(configured, packaged) {
+  const value = configured?.trim();
+  if (packaged && !value) {
+    throw new Error("DIGGYLAB_API_URL is required in a packaged Desktop Agent.");
+  }
+  let url;
+  try {
+    url = new URL(value || DEVELOPMENT_ORIGIN);
+  } catch {
+    throw new Error("Invalid Desktop Agent API origin.");
+  }
+  const rootOnly = url.pathname === "/" && !url.search && !url.hash;
+  const noAuthoritySecrets = !url.username && !url.password;
+  const validProduction = packaged && url.protocol === "https:" && !url.port;
+  const validDevelopment = !packaged && url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname.toLowerCase());
+  if (!rootOnly || !noAuthoritySecrets || !validProduction && !validDevelopment) {
+    throw new Error("Invalid Desktop Agent API origin.");
+  }
+  const httpOrigin = url.origin;
+  const websocket = new URL("/desktop-agent/ws", httpOrigin);
+  websocket.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+  return { httpOrigin, websocketUrl: websocket.toString() };
+}
+
+// src/main/facebook-login-service.ts
+var FacebookLoginService = class {
+  options;
+  snapshot = { state: "NOT_READY", errorCode: null, accountId: null };
+  listeners = /* @__PURE__ */ new Set();
+  browser = null;
+  context = null;
+  page = null;
+  timer = null;
+  readyBeforeLogin = false;
+  accountIdBeforeLogin = null;
+  pending = Promise.resolve();
+  opening = false;
+  navigationHandler = () => {
+    void this.checkAgain().catch(() => void 0);
+  };
+  constructor(options) {
+    this.options = options;
+  }
+  getSnapshot() {
+    return this.snapshot;
+  }
+  subscribe(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  async initialize() {
+    const accountId = await this.options.store.getAccountId();
+    this.update({ state: accountId ? "READY" : "NOT_READY", errorCode: null, accountId });
+  }
+  open() {
+    if (this.opening || this.snapshot.state === "LOGIN_OPEN" || this.snapshot.state === "LOGIN_REQUIRED" || this.snapshot.state === "CHECKPOINT_REQUIRED") {
+      return Promise.reject(new Error("LOGIN_ALREADY_OPEN"));
+    }
+    this.opening = true;
+    return this.serialize(() => this.openNow()).finally(() => {
+      this.opening = false;
+    });
+  }
+  isActive() {
+    return this.opening || this.snapshot.state === "LOGIN_OPEN" || this.snapshot.state === "LOGIN_REQUIRED" || this.snapshot.state === "CHECKPOINT_REQUIRED";
+  }
+  checkAgain() {
+    return this.serialize(() => this.checkAgainNow());
+  }
+  close(errorCode = null) {
+    return this.serialize(() => this.finish({ state: this.readyBeforeLogin ? "READY" : "NOT_READY", errorCode, accountId: this.accountIdBeforeLogin }));
+  }
+  clear() {
+    return this.serialize(async () => {
+      await this.finish({ state: "NOT_READY", errorCode: null, accountId: null });
+      await this.options.store.clear();
+      this.readyBeforeLogin = false;
+      this.accountIdBeforeLogin = null;
+    });
+  }
+  async openNow() {
+    if (this.browser) throw new Error("LOGIN_ALREADY_OPEN");
+    const previous = await this.options.store.load();
+    this.accountIdBeforeLogin = await this.options.store.getAccountId();
+    this.readyBeforeLogin = Boolean(this.accountIdBeforeLogin);
+    const browser = await this.options.browserType.launch({ headless: false });
+    try {
+      const context = await browser.newContext({ ...previous ? { storageState: previous } : {} });
+      const page = await context.newPage();
+      this.browser = browser;
+      this.context = context;
+      this.page = page;
+      page.on("framenavigated", this.navigationHandler);
+      this.timer = this.options.setTimer(() => {
+        void this.close("LOGIN_TIMEOUT");
+      }, this.options.timeoutMs);
+      this.update({ state: "LOGIN_OPEN", errorCode: null, accountId: this.accountIdBeforeLogin });
+      await page.goto("https://www.facebook.com/", { waitUntil: "domcontentloaded" });
+    } catch (error) {
+      await this.finish({
+        state: this.readyBeforeLogin ? "READY" : "NOT_READY",
+        errorCode: null,
+        accountId: this.accountIdBeforeLogin
+      });
+      throw error;
+    }
+  }
+  async checkAgainNow() {
+    if (!this.page || !this.context) throw new Error("LOGIN_NOT_OPEN");
+    const condition = await this.options.detectSession(this.page, this.context);
+    if (condition !== "READY") {
+      this.update({ state: condition, errorCode: null, accountId: this.accountIdBeforeLogin });
+      return false;
+    }
+    const state = await this.context.storageState();
+    const accountId = await this.options.store.save(state);
+    await this.finish({ state: "READY", errorCode: null, accountId });
+    return true;
+  }
+  async finish(snapshot) {
+    if (this.timer) this.options.clearTimer(this.timer);
+    this.timer = null;
+    const page = this.page;
+    const context = this.context;
+    const browser = this.browser;
+    this.page = null;
+    this.context = null;
+    this.browser = null;
+    page?.off("framenavigated", this.navigationHandler);
+    await context?.close();
+    await browser?.close();
+    this.update(snapshot);
+  }
+  update(snapshot) {
+    if (snapshot.state === this.snapshot.state && snapshot.errorCode === this.snapshot.errorCode && snapshot.accountId === this.snapshot.accountId) return;
+    this.snapshot = snapshot;
+    for (const listener of this.listeners) listener(snapshot);
+  }
+  serialize(operation) {
+    const result = this.pending.catch(() => void 0).then(operation);
+    this.pending = result.then(() => void 0, () => void 0);
+    return result;
+  }
+};
+
+// src/main/facebook-session-store.ts
+var FACEBOOK_SESSION_KEY = "facebook-session";
+var FacebookSessionStore = class {
+  credentials;
+  constructor(credentials) {
+    this.credentials = credentials;
+  }
+  async load() {
+    const value = await this.credentials.get(FACEBOOK_SESSION_KEY);
+    if (!value) return null;
+    try {
+      const parsed = JSON.parse(value);
+      return isFacebookStorageState(parsed) ? parsed : null;
+    } catch {
+      return null;
+    }
+  }
+  async save(state) {
+    if (!isFacebookStorageState(state)) {
+      throw new TypeError("FACEBOOK_SESSION_INVALID");
+    }
+    const accountId = getFacebookAccountId(state);
+    if (!accountId) throw new TypeError("FACEBOOK_SESSION_INVALID");
+    await this.credentials.set(FACEBOOK_SESSION_KEY, JSON.stringify(state));
+    return accountId;
+  }
+  clear() {
+    return this.credentials.delete(FACEBOOK_SESSION_KEY);
+  }
+  async isReady() {
+    return Boolean(await this.getAccountId());
+  }
+  async getAccountId() {
+    const state = await this.load();
+    return state ? getFacebookAccountId(state) : null;
+  }
+};
+function isFacebookStorageState(value) {
+  if (!value || typeof value !== "object") return false;
+  const state = value;
+  return Array.isArray(state.cookies) && state.cookies.every((cookie) => Boolean(cookie && typeof cookie === "object" && typeof cookie.name === "string" && typeof cookie.value === "string" && typeof cookie.domain === "string")) && (state.origins === void 0 || Array.isArray(state.origins));
+}
+function getFacebookAccountId(state) {
+  const value = state.cookies.find((cookie) => cookie.name === "c_user" && (cookie.domain === "facebook.com" || cookie.domain.endsWith(".facebook.com")))?.value.trim();
+  return value && /^\d{1,32}$/.test(value) ? value : null;
+}
+
+// src/main/reconnect-backoff.ts
+var BASE_DELAY_MS = 1e3;
+var MAX_DELAY_MS = 3e4;
+function reconnectDelay(attempt, random = Math.random) {
+  const ceiling = Math.min(MAX_DELAY_MS, BASE_DELAY_MS * 2 ** Math.max(0, attempt));
+  return Math.floor(Math.min(0.999999, Math.max(0, random())) * ceiling);
+}
+
+// src/main/device-identity.ts
+import {
+  createPrivateKey as createPrivateKey2,
+  createPublicKey,
+  generateKeyPairSync,
+  sign as sign2
+} from "node:crypto";
+function createDeviceIdentity() {
+  const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+  return {
+    privateKey: privateKey.export({ format: "der", type: "pkcs8" }).toString("base64"),
+    publicKey: publicKey.export({ format: "der", type: "spki" }).toString("base64")
+  };
+}
+function signChallenge(privateKey, deviceId, challenge) {
+  const message = Buffer.from(
+    `desktop-agent-ws:${DESKTOP_AGENT_PROTOCOL_VERSION}:${deviceId}:${challenge}`,
+    "utf8"
+  );
+  return sign2(null, message, readPrivateKey(privateKey)).toString("base64");
+}
+function readPrivateKey(privateKey) {
+  return createPrivateKey2({
+    key: Buffer.from(privateKey, "base64"),
+    format: "der",
+    type: "pkcs8"
+  });
+}
+
+// src/cli/args.ts
+var FLAGS = {
+  "--api": { key: "api", type: "string" },
+  "--bind": { key: "bind", type: "string" },
+  "--code": { key: "code", type: "string" },
+  "--config": { key: "config", type: "string" },
+  "--display": { key: "display", type: "number" },
+  "--name": { key: "name", type: "string" },
+  "--novnc-web": { key: "novncWeb", type: "string" },
+  "--port": { key: "port", type: "number" },
+  "--public-host": { key: "publicHost", type: "string" }
+};
+function parseCliArgs(argv) {
+  const options = {};
+  let command;
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index];
+    if (token.startsWith("--")) {
+      const [flag, inline] = token.includes("=") ? token.split("=", 2) : [token, void 0];
+      const spec = FLAGS[flag];
+      if (!spec) return { error: `Unknown option "${flag}".`, options };
+      const raw = inline ?? argv[index + 1];
+      if (raw === void 0 || raw.startsWith("--")) return { error: `Option "${flag}" needs a value.`, options };
+      if (inline === void 0) index += 1;
+      if (spec.type === "number") {
+        const value = Number(raw);
+        if (!Number.isInteger(value) || value <= 0) return { error: `Option "${flag}" must be a positive whole number.`, options };
+        options[spec.key] = value;
+      } else {
+        options[spec.key] = raw;
+      }
+      continue;
+    }
+    if (command === void 0) {
+      command = token;
+      continue;
+    }
+    return { error: `Unknown argument "${token}".`, options };
+  }
+  return { command, options };
+}
+
+// src/cli/file-crypto.ts
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname as dirname2 } from "node:path";
+var KEY_BYTES = 32;
+var IV_BYTES = 12;
+var TAG_BYTES = 16;
+function createFileCrypto(keyPath) {
+  const loadKey = () => {
+    if (!existsSync(keyPath)) {
+      mkdirSync(dirname2(keyPath), { mode: 448, recursive: true });
+      writeFileSync(keyPath, randomBytes(KEY_BYTES), { mode: 384 });
+      chmodSync(keyPath, 384);
+    }
+    const key = readFileSync(keyPath);
+    if (key.length !== KEY_BYTES) {
+      throw new Error(`Desktop Agent key file must contain ${KEY_BYTES} bytes: ${keyPath}`);
+    }
+    return key;
+  };
+  return {
+    decryptString(value) {
+      if (value.length <= IV_BYTES + TAG_BYTES) throw new Error("Encrypted credential is truncated.");
+      const decipher = createDecipheriv("aes-256-gcm", loadKey(), value.subarray(0, IV_BYTES));
+      decipher.setAuthTag(value.subarray(IV_BYTES, IV_BYTES + TAG_BYTES));
+      return Buffer.concat([
+        decipher.update(value.subarray(IV_BYTES + TAG_BYTES)),
+        decipher.final()
+      ]).toString("utf8");
+    },
+    encryptString(value) {
+      const iv = randomBytes(IV_BYTES);
+      const cipher = createCipheriv("aes-256-gcm", loadKey(), iv);
+      const sealed = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
+      return Buffer.concat([iv, cipher.getAuthTag(), sealed]);
+    },
+    isEncryptionAvailable() {
+      try {
+        loadKey();
+        return true;
+      } catch {
+        return false;
+      }
+    }
+  };
+}
+
+// src/cli/qr.ts
+import qrcode from "qrcode-terminal";
+function terminalQr(value) {
+  let output = "";
+  qrcode.generate(value, { small: true }, (rendered) => {
+    output = rendered;
+  });
+  return output;
+}
+
+// src/cli/virtual-display.ts
+import { spawn } from "node:child_process";
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { mkdirSync as mkdirSync2, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { createConnection } from "node:net";
+import { networkInterfaces } from "node:os";
+import { join as join3 } from "node:path";
+var START_TIMEOUT_MS = 15e3;
+function waitForPort(host, port, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  return new Promise((resolve, reject) => {
+    const attempt = () => {
+      const socket = createConnection({ host, port });
+      socket.once("connect", () => {
+        socket.destroy();
+        resolve();
+      });
+      socket.once("error", () => {
+        socket.destroy();
+        if (Date.now() >= deadline) {
+          reject(new Error(`Timed out waiting for ${host}:${port}.`));
+          return;
+        }
+        setTimeout(attempt, 250).unref();
+      });
+    };
+    attempt();
+  });
+}
+function localAddress() {
+  for (const addresses of Object.values(networkInterfaces())) {
+    for (const address of addresses ?? []) {
+      if (address.family === "IPv4" && !address.internal) return address.address;
+    }
+  }
+  return "127.0.0.1";
+}
+function start(command, args, env, deps) {
+  const child = deps.spawnProcess(command, args, env);
+  const failure = new Promise((_resolve, reject) => {
+    child.on("error", (error) => reject(error instanceof Error ? error : new Error(String(error))));
+    child.on("exit", (code) => reject(new Error(`${command} exited with code ${String(code)}.`)));
+  });
+  return { child, failure };
+}
+async function startVirtualDisplay(options, overrides = {}) {
+  const deps = { spawnProcess: spawn, waitForPort, ...overrides };
+  const bind = options.bind ?? "0.0.0.0";
+  const displayNumber = options.displayNumber ?? 99;
+  const height = options.height ?? 900;
+  const novncWeb = options.novncWeb ?? "/usr/share/novnc";
+  const port = options.port ?? 6080;
+  const rfbPort = 5900 + displayNumber;
+  const token = randomBytes2(18).toString("base64url");
+  const tokenFile = join3(options.tokenDirectory, "websockify-token");
+  mkdirSync2(options.tokenDirectory, { mode: 448, recursive: true });
+  writeFileSync2(tokenFile, `${token}: 127.0.0.1:${rfbPort}
+`, { mode: 384 });
+  const xvfb = start("Xvfb", [`:${displayNumber}`, "-screen", `0`, `${options.width ?? 1280}x${height}x24`, "-nolisten", "tcp"], process.env, deps);
+  const vnc = start("x11vnc", ["-display", `:${displayNumber}`, "-localhost", "-rfbport", String(rfbPort), "-forever", "-shared", "-nopw", "-quiet"], process.env, deps);
+  const proxy = start("websockify", ["--web", novncWeb, "--token-plugin", "TokenFile", "--token-source", tokenFile, `${bind}:${port}`], process.env, deps);
+  const stop = async () => {
+    for (const { child } of [proxy, vnc, xvfb]) {
+      child.kill("SIGTERM");
+      await new Promise((resolve) => setTimeout(resolve, 200));
+      child.kill("SIGKILL");
+    }
+    rmSync(tokenFile, { force: true });
+  };
+  try {
+    await Promise.race([
+      deps.waitForPort(bind === "0.0.0.0" ? "127.0.0.1" : bind, port, options.timeoutMs ?? START_TIMEOUT_MS),
+      proxy.failure,
+      vnc.failure,
+      xvfb.failure
+    ]);
+  } catch (error) {
+    await stop();
+    throw error;
+  }
+  const publicHost = options.publicHost ?? localAddress();
+  return {
+    stop,
+    url: `http://${publicHost}:${port}/vnc.html?autoconnect=1&token=${encodeURIComponent(token)}`
+  };
+}
+
+// src/cli/cli.ts
+var LOGIN_TIMEOUT_MS = 10 * 60 * 1e3;
+var CONFIG_DIRECTORY = ".diggylab";
+var USAGE = `DiggyLab Desktop Agent CLI
+
+Usage:
+  diggylab pair --code <code> [--name <device name>] [--api <https://api.diggylab.com>]
+  diggylab login [--port 6080] [--bind 0.0.0.0] [--public-host <ip or host>]
+  diggylab run
+  diggylab status
+  diggylab unpair
+
+Global options:
+  --config <directory>   Agent state directory (default ~/.diggylab)
+  --api <origin>         API origin (default $DIGGYLAB_API_URL or https://api.diggylab.com)`;
+function agentVersion() {
+  let directory = fileURLToPath(new URL(".", import.meta.url));
+  for (let depth = 0; depth < 4; depth += 1) {
+    const manifest = join4(directory, "package.json");
+    if (existsSync2(manifest)) {
+      try {
+        const version = JSON.parse(readFileSync2(manifest, "utf8")).version;
+        if (typeof version === "string" && version) return version;
+      } catch {
+      }
+    }
+    directory = dirname3(directory);
+  }
+  return "0.0.0";
+}
+function resolvePlatform() {
+  if (process.platform === "darwin") return "MACOS";
+  return process.platform === "linux" ? "LINUX" : "WINDOWS";
+}
+function resolveConfigDirectory(options) {
+  return options.config?.trim() || process.env.DIGGYLAB_AGENT_DIR?.trim() || join4(homedir(), CONFIG_DIRECTORY);
+}
+function resolveEndpoint(options) {
+  const configured = (options.api ?? process.env.DIGGYLAB_API_URL)?.trim() || "https://api.diggylab.com";
+  const loopback = /^https?:\/\/(?:127\.0\.0\.1|\[::1\]|localhost)(?::\d+)?(?:\/|$)/i.test(configured);
+  return resolveAgentEndpoint(configured, !loopback);
+}
+function createRuntime(options) {
+  const directory = resolveConfigDirectory(options);
+  const endpoint = resolveEndpoint(options);
+  const crypto2 = createFileCrypto(join4(directory, "key"));
+  const credentials = new CredentialStore(join4(directory, "credentials.json"), crypto2);
+  const sessions = new DeviceSessionStore(credentials);
+  const facebook = new FacebookSessionStore(credentials);
+  const spool = new EncryptedScanSpool(join4(directory, "scan-spool"), crypto2);
+  const activity = new ActivityLog({ directory: join4(directory, "activity") });
+  const http = new DesktopAgentHttpClient(endpoint.httpOrigin);
+  const manager = new DeviceCredentialManager(sessions, http, createDeviceIdentity);
+  return { activity, browserType: createBrowserLauncher(chromium), directory, endpoint, facebook, manager, sessions, spool };
+}
+function waitForFacebookLogin(login, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      unsubscribe();
+      reject(new Error("Timed out waiting for the Facebook login."));
+    }, timeoutMs);
+    timer.unref();
+    const unsubscribe = login.subscribe((snapshot) => {
+      if (snapshot.state === "READY") {
+        clearTimeout(timer);
+        unsubscribe();
+        resolve();
+        return;
+      }
+      if (snapshot.state === "NOT_READY" && snapshot.errorCode) {
+        clearTimeout(timer);
+        unsubscribe();
+        reject(new Error(`Facebook login failed (${snapshot.errorCode}).`));
+      }
+    });
+    void login.open().catch((error) => {
+      clearTimeout(timer);
+      unsubscribe();
+      reject(error instanceof Error ? error : new Error(String(error)));
+    });
+  });
+}
+async function commandPair(runtime, options, io) {
+  const code = options.code?.trim();
+  if (!code) {
+    io.error("Missing --code <pairing code>. Create one on the Desktop Agent page of the web app.");
+    return 2;
+  }
+  const access = await runtime.manager.pair({
+    agentVersion: agentVersion(),
+    code,
+    name: sanitizeDeviceName(options.name?.trim() || hostname()),
+    platform: resolvePlatform()
+  });
+  io.log(`Paired as "${access.session.device.name}".`);
+  io.log("Next: run `diggylab login` to connect a Facebook account.");
+  return 0;
+}
+async function commandLogin(runtime, options, io) {
+  const login = new FacebookLoginService({
+    browserType: runtime.browserType,
+    clearTimer: (timer) => clearTimeout(timer),
+    detectSession: detectFacebookSession,
+    setTimer: (callback, delay) => {
+      const timer = setTimeout(callback, delay);
+      timer.unref();
+      return timer;
+    },
+    store: runtime.facebook,
+    timeoutMs: LOGIN_TIMEOUT_MS
+  });
+  await login.initialize();
+  if (login.getSnapshot().state === "READY") {
+    io.log("Facebook is already connected.");
+    return 0;
+  }
+  let display = null;
+  try {
+    if (process.env.DISPLAY) {
+      io.log(`Opening the Facebook login page on display ${process.env.DISPLAY}.`);
+    } else {
+      display = await startVirtualDisplay({
+        bind: options.bind,
+        displayNumber: options.display,
+        novncWeb: options.novncWeb,
+        port: options.port,
+        publicHost: options.publicHost,
+        tokenDirectory: join4(runtime.directory, "novnc")
+      });
+      process.env.DISPLAY = `:${options.display ?? 99}`;
+      io.log(terminalQr(display.url));
+      io.log(`Open this link on your phone, or scan the QR above:
+${display.url}`);
+      io.log("Log into Facebook on that screen; the agent saves the session automatically.");
+    }
+    await waitForFacebookLogin(login, LOGIN_TIMEOUT_MS + 6e4);
+    io.log("Facebook session saved.");
+    return 0;
+  } finally {
+    await login.close();
+    await display?.stop();
+  }
+}
+async function commandRun(runtime, io) {
+  const stored = await runtime.manager.load();
+  if (!stored) {
+    io.error("This agent is not paired yet. Run `diggylab pair --code <code>` first.");
+    return 2;
+  }
+  const recordActivity = (message, code) => {
+    void runtime.activity.append({ category: "CONNECTION", code, level: "INFO", message }).catch(() => void 0);
+  };
+  const facebookReady = await runtime.facebook.isReady();
+  const session = new DesktopAgentSession({
+    agentVersion: agentVersion(),
+    clearTimer: (timer) => clearTimeout(timer),
+    createSocket: (url, accessToken) => new WebSocket(url, {
+      headers: { authorization: `Bearer ${accessToken}` },
+      maxPayload: 16 * 1024
+    }),
+    credentials: runtime.manager,
+    getFacebookReady: () => facebookReady,
+    platform: resolvePlatform(),
+    random: Math.random,
+    reconnectDelay,
+    setTimer: (callback, delay) => {
+      const timer = setTimeout(callback, delay);
+      timer.unref();
+      return timer;
+    },
+    signChallenge,
+    websocketUrl: runtime.endpoint.websocketUrl
+  });
+  const scanHttp = new DesktopScanHttp({
+    getCredential: () => {
+      const access = runtime.manager.getAccessCredential();
+      return access ? { accessToken: access.accessToken, privateKey: access.session.privateKey } : null;
+    },
+    origin: runtime.endpoint.httpOrigin
+  });
+  const scanRunner = new DesktopScanRunner({
+    clearTimer: (timer) => clearTimeout(timer),
+    facebookState: runtime.facebook,
+    http: scanHttp,
+    isLoginActive: () => false,
+    now: Date.now,
+    randomUuid: () => randomUUID3(),
+    requestFacebookLogin: async () => {
+      io.error("The Facebook session expired. Stop this worker, run `diggylab login`, then start it again.");
+    },
+    scanner: new FacebookScanner({ browserType: runtime.browserType }),
+    session,
+    setTimer: (callback, delay) => {
+      const timer = setTimeout(callback, delay);
+      timer.unref();
+      return timer;
+    },
+    spool: runtime.spool,
+    wait: abortableDelay
+  });
+  session.subscribe((snapshot) => {
+    io.log(`session: ${snapshot.state}`);
+    recordActivity(`Session state changed to ${snapshot.state}.`, snapshot.state);
+  });
+  scanRunner.subscribe((snapshot) => {
+    io.log(`scanner: ${snapshot.state}${snapshot.jobId ? ` (job ${snapshot.jobId})` : ""}`);
+    recordActivity(`Scanner state changed to ${snapshot.state}.`, snapshot.state);
+  });
+  scanRunner.start();
+  await scanRunner.recover();
+  await session.start();
+  io.log(`Worker running as "${stored.device.name}". Press Ctrl+C to stop.`);
+  await new Promise((resolve) => {
+    process.once("SIGINT", resolve);
+    process.once("SIGTERM", resolve);
+  });
+  session.stop();
+  scanRunner.stop();
+  return 0;
+}
+async function commandStatus(runtime, io) {
+  const stored = await runtime.sessions.load();
+  const facebook = await runtime.facebook.load();
+  const hasUser = Boolean(facebook?.cookies?.some((cookie) => cookie.name === "c_user" && cookie.value));
+  io.log(`Config:   ${runtime.directory}`);
+  io.log(`API:      ${runtime.endpoint.httpOrigin}`);
+  io.log(`Version:  ${agentVersion()}`);
+  io.log(`Paired:   ${stored ? `"${stored.device.name}" (${stored.device.id})` : "no \u2014 run `diggylab pair --code <code>`"}`);
+  io.log(`Facebook: ${hasUser ? "connected" : "missing \u2014 run `diggylab login`"}`);
+  return 0;
+}
+async function commandUnpair(runtime, io) {
+  await runtime.manager.clear();
+  await runtime.facebook.clear();
+  await runtime.spool.clear();
+  io.log("Device unpaired; local credentials, Facebook session, and pending scans were removed.");
+  return 0;
+}
+async function main(argv, io = console) {
+  if (argv.includes("--help") || argv.includes("-h")) {
+    io.log(USAGE);
+    return 0;
+  }
+  const parsed = parseCliArgs(argv);
+  if (parsed.error) {
+    io.error(parsed.error);
+    io.error(USAGE);
+    return 2;
+  }
+  const command = parsed.command ?? "help";
+  if (command === "help" || command === "--help") {
+    io.log(USAGE);
+    return 0;
+  }
+  if (!["login", "pair", "run", "status", "unpair"].includes(command)) {
+    io.error(`Unknown command "${command}".`);
+    io.error(USAGE);
+    return 2;
+  }
+  const runtime = createRuntime(parsed.options);
+  switch (command) {
+    case "pair":
+      return commandPair(runtime, parsed.options, io);
+    case "login":
+      return commandLogin(runtime, parsed.options, io);
+    case "run":
+      return commandRun(runtime, io);
+    case "status":
+      return commandStatus(runtime, io);
+    default:
+      return commandUnpair(runtime, io);
+  }
+}
+var entry = process.argv[1] ? pathToFileURL(process.argv[1]).href : "";
+if (import.meta.url === entry) {
+  void main(process.argv.slice(2)).then((code) => {
+    process.exitCode = code;
+  }).catch((error) => {
+    console.error(error instanceof Error ? error.message : error);
+    process.exitCode = 1;
+  });
+}
+export {
+  main
+};