@calimero-network/mero-js 18.2.0 → 19.0.0

package/dist/cloud/cloud-client.js

@@ -1,6 +1,243 @@
+/**
+ * Calimero Cloud (MDMA) client.
+ *
+ * # Why the SDK knows about the cloud at all
+ *
+ * Delegated execution lets an account that holds one signing key write into a
+ * context without running a node — but only through a *relay*, and a relay is
+ * something the client has to be told about. A warrant names an executor
+ * account, so a client that cannot discover which relay serves its namespace,
+ * and which account that relay writes as, cannot mint a usable warrant at all.
+ *
+ * For a self-hosted namespace the operator hands those two facts over out of
+ * band. For the hosted tier the cloud is the directory: the user signs in, the
+ * cloud knows which namespaces they own and which attested TEE nodes are
+ * assigned to each, and it answers with the relay's URL and executor account.
+ * That is what this client is for — it is the discovery half of
+ * {@link RelayClient}, not a second way to talk to a node.
+ *
+ * # What it deliberately is not
+ *
+ * It never sees a warrant, a device secret, or an intent. Discovery goes
+ * through the cloud; the write goes straight from the client to the relay. A
+ * cloud that proxied intents would read every method and argument its users
+ * ever sent, and would be a throughput bottleneck on a path that has no reason
+ * to involve it.
+ */
+import { HTTPError } from '../http-client/web-client.js';
+/** Where the hosted cloud lives when a caller names no other. */
+const DEFAULT_CLOUD_BASE_URL = 'https://cloud.calimero.network';
+/** Response headers MDMA uses to hand back a rolling-refreshed session. */
+const REFRESH_HEADER = 'x-mdma-session-refresh';
+const REFRESH_EXPIRES_HEADER = 'x-mdma-session-expires';
 export class CloudClient {
     constructor(config = {}) {
-        this.baseUrl = (config.cloudBaseUrl || 'https://cloud.calimero.network').replace(/\/+$/, '');
+        this.session = null;
+        this.baseUrl = (config.cloudBaseUrl || DEFAULT_CLOUD_BASE_URL).replace(/\/+$/, '');
+        this.onSession = config.onSession;
+        // Bound through an arrow function: an unbound `globalThis.fetch` throws
+        // "Illegal invocation" in a browser, the same reason the node HTTP clients
+        // wrap it.
+        const injected = config.fetch;
+        this.fetchImpl = injected
+            ? (input, init) => injected(input, init)
+            : (input, init) => globalThis.fetch(input, init);
+        this.timeoutMs = config.timeoutMs ?? 10000;
+        if (config.sessionToken) {
+            // Expiry unknown until the server tells us; 0 means "do not reason about
+            // it locally", never "expired" — the server is the only judge and it
+            // answers 401 when it disagrees.
+            this.session = {
+                sessionToken: config.sessionToken,
+                expiresAt: 0,
+                user: { email: '' },
+            };
+        }
+    }
+    /** The current session, or `null` when nobody is signed in. */
+    getSession() {
+        return this.session;
+    }
+    /** Whether a session token is held. Says nothing about the server agreeing. */
+    isSignedIn() {
+        return this.session !== null;
+    }
+    /**
+     * Exchange a Google OAuth2 ID token for an MDMA session.
+     *
+     * The app owns the Google flow (One Tap, an auth-code popup, a native
+     * browser) and hands the resulting ID token here once. Everything after this
+     * uses the returned session token, so the Google credential does not have to
+     * be kept or re-minted per call.
+     */
+    async signInWithGoogle(idToken) {
+        const body = await this.request('POST', '/api/auth/google', { body: { id_token: idToken }, anonymous: true });
+        return this.adoptSession(body);
+    }
+    /**
+     * Refresh the session token explicitly.
+     *
+     * Rarely needed: MDMA rolling-refreshes on ordinary authenticated calls and
+     * this client adopts the replacement automatically. Use it when an app wants
+     * a fresh token before going idle rather than on the next request.
+     */
+    async refreshSession() {
+        const body = await this.request('POST', '/api/auth/refresh');
+        return this.adoptSession(body);
+    }
+    /**
+     * Revoke this session server-side and forget it locally.
+     *
+     * Local state is cleared even if the server call fails: the caller asked to
+     * be signed out, and keeping a token they believe is gone is the worse of the
+     * two failures.
+     */
+    async signOut() {
+        try {
+            if (this.session)
+                await this.request('POST', '/api/auth/logout', { parse: 'none' });
+        }
+        finally {
+            this.session = null;
+            void this.notifySession(null);
+        }
+    }
+    /** Namespaces the signed-in user owns. */
+    async getMyNamespaces() {
+        const rows = await this.request('GET', '/api/cloud/me/namespaces');
+        return rows.map((row) => ({
+            namespaceId: String(row.namespace_id ?? row.group_id ?? ''),
+            groupId: String(row.group_id ?? row.namespace_id ?? ''),
+            haStatus: String(row.ha_status ?? 'none'),
+            haEnabledAt: row.ha_enabled_at ?? null,
+            contexts: Array.isArray(row.contexts) ? row.contexts : [],
+            fleetReplicas: row.fleet_replicas,
+        }));
+    }
+    /**
+     * The relays serving one namespace: where to present an intent, and as whom.
+     *
+     * Everything a client needs in order to mint a warrant it can actually
+     * spend. Filter on `authorshipReady` before signing — a warrant presented to
+     * a relay with no grant is refused *after* the author has burned a nonce from
+     * its monotonic sequence on it.
+     */
+    async getNamespaceRelays(namespaceId) {
+        const body = await this.request('GET', `/api/cloud/me/namespaces/${encodeURIComponent(namespaceId)}/relays`);
+        return (body.relays ?? []).map((row) => ({
+            peerId: String(row.peer_id ?? ''),
+            relayUrl: row.relay_url ?? null,
+            executorAccount: row.executor_account ?? null,
+            status: String(row.status ?? ''),
+            authorshipReady: row.authorship_ready === true,
+            lastSeenAt: row.last_seen_at ?? null,
+            confirmedAt: row.confirmed_at ?? null,
+        }));
+    }
+    /**
+     * The first relay for `namespaceId` that can actually run an intent, or
+     * `null`.
+     *
+     * "Can actually run one" is three conditions, and a client that checks fewer
+     * gets a refusal it cannot explain: the cloud must know a URL, the relay must
+     * have reported the executor account a warrant has to name, and the grant
+     * must be in place.
+     */
+    async findExecutingRelay(namespaceId) {
+        const relays = await this.getNamespaceRelays(namespaceId);
+        return (relays.find((r) => r.authorshipReady && r.relayUrl !== null && r.executorAccount !== null) ??
+            null);
+    }
+    /**
+     * Every attested machine currently serving something this account owns.
+     *
+     * The account-wide view of the same rows {@link getNamespaceRelays} returns
+     * per namespace, keyed by machine — so a UI can answer "what is running for
+     * me?" in one call. `canExecute` folds the three-way precondition, so a
+     * caller does not re-derive it.
+     *
+     * Only the caller's own namespaces appear on each machine. A plan's
+     * `usersPerMachine` is greater than one, so a fleet node routinely serves
+     * several accounts at once.
+     */
+    async getMyMachines() {
+        const body = await this.request('GET', '/api/cloud/me/machines');
+        return (body.machines ?? []).map((row) => ({
+            peerId: String(row.peer_id ?? ''),
+            relayUrl: row.relay_url ?? null,
+            executorAccount: row.executor_account ?? null,
+            canExecute: row.can_execute === true,
+            namespaces: (Array.isArray(row.namespaces) ? row.namespaces : []).map((n) => {
+                const ns = n;
+                return {
+                    namespaceId: String(ns.namespace_id ?? ''),
+                    status: String(ns.status ?? ''),
+                    authorshipReady: ns.authorship_ready === true,
+                    fresh: ns.fresh === true,
+                    confirmedAt: ns.confirmed_at ?? null,
+                    lastSeenAt: ns.last_seen_at ?? null,
+                };
+            }),
+        }));
+    }
+    /**
+     * Claim a namespace under this account, proving ownership.
+     *
+     * The cloud has no other way to learn a namespace exists — namespaces are
+     * created on a node, and there is deliberately no "create namespace" in the
+     * cloud. `ownershipProof` comes from
+     * `admin.issueNamespaceOwnershipProof(namespaceId, …)` on a node that is a
+     * **direct admin** of that namespace; merod refuses to issue one otherwise.
+     *
+     * Pass merod's response object straight through. The cloud accepts core's
+     * `signerPublicKey`/`signedPayload` casing as well as snake_case, so there is
+     * no re-keying step — and getting that wrong used to surface as a `422`
+     * naming three missing fields.
+     *
+     * Idempotent for the same account. A namespace already claimed by someone
+     * else is a `409`; a replayed proof nonce is a `403`.
+     */
+    async claimNamespace(namespaceId, ownershipProof) {
+        await this.request('POST', '/api/cloud/namespaces/claim', {
+            body: { namespace_id: namespaceId, ownership_proof: ownershipProof },
+        });
+    }
+    /**
+     * Ask the fleet to host a claimed namespace — the step that gets a relay
+     * assigned.
+     *
+     * Takes no body: {@link claimNamespace} already established ownership, and
+     * this is the separate "now host it" half. Idempotent.
+     *
+     * Not to be confused with {@link enableHA}, which opens the cloud's web flow
+     * in a browser tab for a user to complete by hand. This is the API call.
+     */
+    async enableNamespaceHa(namespaceId) {
+        return this.request('POST', `/api/cloud/namespaces/${encodeURIComponent(namespaceId)}/enable-ha`, { body: {} });
+    }
+    /**
+     * Stop hosting a claimed namespace.
+     *
+     * The fleet's own reconcile loop does the rest: each assigned node notices
+     * the namespace is no longer assigned to it and **self-leaves**, which makes
+     * core evict it and purge its local data and keys. So this is not just a
+     * billing flip.
+     */
+    async disableNamespaceHa(namespaceId) {
+        return this.request('POST', `/api/cloud/namespaces/${encodeURIComponent(namespaceId)}/disable-ha`, { body: {} });
+    }
+    /**
+     * The node assigned to the signed-in user, or `null`.
+     *
+     * @deprecated Use {@link getMyMachines}. This reads the cloud's retired
+     * `NodeAssignment` ledger, which nothing has written since the v1
+     * retirement, so it answers `null` for every namespace-native account —
+     * which reads as "you have no machine" when the truth is "that is no longer
+     * how a machine is assigned".
+     */
+    async getMyNode() {
+        const body = await this.request('GET', '/api/cloud/me/node');
+        return body.node ?? null;
     }
     enableHA(options) {
         const params = new URLSearchParams({
@@ -22,4 +259,85 @@ export class CloudClient {
         }
         window.open(`${this.baseUrl}/disable-ha?${params.toString()}`);
     }
+    /** Record a freshly-issued session and tell the app to persist it. */
+    adoptSession(body) {
+        this.session = {
+            sessionToken: body.session_token,
+            expiresAt: body.expires_at,
+            user: body.user,
+        };
+        void this.notifySession(this.session);
+        return this.session;
+    }
+    async notifySession(session) {
+        try {
+            await this.onSession?.(session);
+        }
+        catch {
+            // A failing persistence callback must not mask the call's own result.
+        }
+    }
+    async request(method, path, options = {}) {
+        if (!options.anonymous && !this.session) {
+            throw new Error('Not signed in to Calimero Cloud: call signInWithGoogle() or construct the client with a sessionToken');
+        }
+        const headers = { Accept: 'application/json' };
+        if (options.body !== undefined)
+            headers['Content-Type'] = 'application/json';
+        if (!options.anonymous && this.session) {
+            headers.Authorization = `Bearer ${this.session.sessionToken}`;
+        }
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+        let response;
+        try {
+            response = await this.fetchImpl(`${this.baseUrl}${path}`, {
+                method,
+                headers,
+                body: options.body === undefined ? undefined : JSON.stringify(options.body),
+                signal: controller.signal,
+            });
+        }
+        catch (err) {
+            // Same shape the node clients use for a transport failure: an `HTTPError`
+            // with `status: 0`, so a caller has one error type to handle rather than
+            // one per layer.
+            throw new HTTPError(0, err instanceof Error ? err.name : 'NetworkError', `${this.baseUrl}${path}`, new Headers(), err instanceof Error ? err.message : String(err));
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        this.adoptRollingRefresh(response);
+        if (!response.ok) {
+            const bodyText = await response.text().catch(() => undefined);
+            throw new HTTPError(response.status, response.statusText, `${this.baseUrl}${path}`, response.headers, bodyText);
+        }
+        if (options.parse === 'none' || response.status === 204)
+            return undefined;
+        return (await response.json());
+    }
+    /**
+     * Adopt a session token the server refreshed mid-request.
+     *
+     * MDMA rotates the token on activity and returns the replacement in a
+     * response header rather than making the client ask. Ignoring it costs
+     * nothing immediately and then logs the user out a week later, which is the
+     * kind of bug that is impossible to reproduce in a short session.
+     *
+     * The user identity is carried over: the header holds only a token, and the
+     * refresh is the same logical session as the sign-in that named the user.
+     */
+    adoptRollingRefresh(response) {
+        const token = response.headers.get(REFRESH_HEADER);
+        if (!token || !this.session)
+            return;
+        const expiresRaw = response.headers.get(REFRESH_EXPIRES_HEADER);
+        const expiresAt = Number(expiresRaw);
+        this.session = {
+            sessionToken: token,
+            expiresAt: Number.isFinite(expiresAt) && expiresAt > 0 ? expiresAt : this.session.expiresAt,
+            user: this.session.user,
+        };
+        void this.notifySession(this.session);
+    }
 }

package/dist/cloud/connect.d.ts

@@ -0,0 +1,94 @@
+/**
+ * The second way to log in: sign in to Calimero Cloud instead of connecting to
+ * a node.
+ *
+ * # Two connection shapes, one SDK
+ *
+ * `createMeroJs({ baseUrl })` is the node connection: point at a node, hold a
+ * credential on it, and drive its admin API and JSON-RPC. It assumes the caller
+ * has a node — their own, or one they have an account on.
+ *
+ * `connectCloud(...)` is for the caller who has neither. They sign in with the
+ * identity they already use (Google, through the cloud), and the cloud answers
+ * with an attested TEE relay serving their namespace. Writes then go through
+ * delegated execution: signed here, run there, attributed here.
+ *
+ * The two are not alternatives to be picked at random — they answer different
+ * questions. "Which node do I talk to?" has an answer for a desktop app and no
+ * answer at all for a web app whose user has never installed anything. This
+ * function is that missing answer, which is why the login step it replaces is
+ * the *node URL prompt* rather than the authentication.
+ *
+ * # What it does not do
+ *
+ * It does not read state. A relay writes on the author's behalf; reads still
+ * come from a node the client can query, or from the app's own projection of
+ * the events it receives. `connectCloud` is deliberately narrow about this
+ * rather than presenting a half-working `MeroJs` whose `admin` and `rpc` would
+ * need a credential nobody holds.
+ */
+import { CloudClient } from './cloud-client.js';
+import type { CloudClientConfig, CloudNamespace, CloudRelay } from './cloud-client.js';
+import { RelayClient } from '../relay/relay-client.js';
+import type { IntentResult, NonceSource } from '../relay/index.js';
+export interface ConnectCloudOptions {
+    /** Defaults to the hosted cloud. */
+    cloudBaseUrl?: string;
+    /** A stored MDMA session token. Provide this or `googleIdToken`. */
+    sessionToken?: string;
+    /** A Google ID token to exchange for a session. Provide this or `sessionToken`. */
+    googleIdToken?: string;
+    /** Persist a new or rolling-refreshed session. See {@link CloudClientConfig.onSession}. */
+    onSession?: CloudClientConfig['onSession'];
+    /** The author's account, hex — whose writes these will be. */
+    authorAccount: string;
+    /** The author's `AccountProof<DeviceCert>`, hex-encoded borsh. */
+    authorProof: string;
+    /** The author device's ed25519 signing secret, hex. Never transmitted. */
+    deviceSecret: string;
+    /**
+     * Which namespace to write in.
+     *
+     * Optional only when the user owns exactly one: guessing among several would
+     * pick a tenant for them, and the failure would be a write landing in the
+     * wrong place rather than an error.
+     */
+    namespaceId?: string;
+    /**
+     * Where nonces come from.
+     *
+     * Defaults to `localStorage`, keyed by the author's device public key, so a
+     * reload continues the sequence instead of replaying it. Pass
+     * {@link createMemoryNonceSource} explicitly for a process that owns its
+     * whole sequence, or your own source to coordinate across tabs.
+     */
+    nonces?: NonceSource;
+    /** Seconds a minted warrant stays presentable. Defaults to 300. */
+    ttlSeconds?: number;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+}
+/** A signed-in cloud session with a relay ready to write through. */
+export interface CloudConnection {
+    /** The cloud API, for namespaces, billing, HA and sign-out. */
+    cloud: CloudClient;
+    /** The relay chosen for this namespace. */
+    relay: RelayClient;
+    /** The namespace writes will land in. */
+    namespaceId: string;
+    namespace: CloudNamespace;
+    /** What the cloud reported about the chosen relay. */
+    relayInfo: CloudRelay;
+    /** Run one method in one context, on the author's behalf. */
+    execute<T = unknown>(contextId: string, method: string, argsJson?: unknown): Promise<IntentResult<T>>;
+}
+/**
+ * Sign in to the cloud and return a connection that can write.
+ *
+ * Throws rather than returning a half-usable connection, and the message says
+ * which step is missing — no namespace, several to choose between, HA not
+ * enabled, or no relay holding the authorship grant. Every one of those is
+ * something the user has to go and do, and a client that reports them alike
+ * cannot tell them what.
+ */
+export declare function connectCloud(options: ConnectCloudOptions): Promise<CloudConnection>;

package/dist/cloud/connect.js

@@ -0,0 +1,150 @@
+/**
+ * The second way to log in: sign in to Calimero Cloud instead of connecting to
+ * a node.
+ *
+ * # Two connection shapes, one SDK
+ *
+ * `createMeroJs({ baseUrl })` is the node connection: point at a node, hold a
+ * credential on it, and drive its admin API and JSON-RPC. It assumes the caller
+ * has a node — their own, or one they have an account on.
+ *
+ * `connectCloud(...)` is for the caller who has neither. They sign in with the
+ * identity they already use (Google, through the cloud), and the cloud answers
+ * with an attested TEE relay serving their namespace. Writes then go through
+ * delegated execution: signed here, run there, attributed here.
+ *
+ * The two are not alternatives to be picked at random — they answer different
+ * questions. "Which node do I talk to?" has an answer for a desktop app and no
+ * answer at all for a web app whose user has never installed anything. This
+ * function is that missing answer, which is why the login step it replaces is
+ * the *node URL prompt* rather than the authentication.
+ *
+ * # What it does not do
+ *
+ * It does not read state. A relay writes on the author's behalf; reads still
+ * come from a node the client can query, or from the app's own projection of
+ * the events it receives. `connectCloud` is deliberately narrow about this
+ * rather than presenting a half-working `MeroJs` whose `admin` and `rpc` would
+ * need a credential nobody holds.
+ */
+import { CloudClient } from './cloud-client.js';
+import { RelayClient } from '../relay/relay-client.js';
+import { createLocalStorageNonceSource, createMemoryNonceSource } from '../relay/nonce-source.js';
+import { derivePublicKey, hex } from '../crypto/internal.js';
+/**
+ * Sign in to the cloud and return a connection that can write.
+ *
+ * Throws rather than returning a half-usable connection, and the message says
+ * which step is missing — no namespace, several to choose between, HA not
+ * enabled, or no relay holding the authorship grant. Every one of those is
+ * something the user has to go and do, and a client that reports them alike
+ * cannot tell them what.
+ */
+export async function connectCloud(options) {
+    if (!options.sessionToken && !options.googleIdToken) {
+        throw new Error('connectCloud needs either a sessionToken or a googleIdToken');
+    }
+    const cloud = new CloudClient({
+        cloudBaseUrl: options.cloudBaseUrl,
+        sessionToken: options.sessionToken,
+        onSession: options.onSession,
+        fetch: options.fetch,
+        timeoutMs: options.timeoutMs,
+    });
+    if (!options.sessionToken && options.googleIdToken) {
+        await cloud.signInWithGoogle(options.googleIdToken);
+    }
+    const namespaces = await cloud.getMyNamespaces();
+    const namespace = pickNamespace(namespaces, options.namespaceId);
+    // One read, used for both the choice and the diagnostic. `findExecutingRelay`
+    // would fetch again to explain itself, and a second call can disagree with the
+    // first — reporting "waiting for the grant" about a relay that was already
+    // usable a moment ago.
+    const relays = await cloud.getNamespaceRelays(namespace.namespaceId);
+    const relayInfo = relays.find((r) => r.authorshipReady && r.relayUrl !== null && r.executorAccount !== null) ??
+        null;
+    if (!relayInfo) {
+        throw new Error(explainNoRelay(namespace, relays));
+    }
+    const relay = new RelayClient({
+        // Checked by `findExecutingRelay`, which is the only thing that returns a
+        // relay — narrowed here rather than re-validated, so the invariant lives in
+        // one place.
+        relayUrl: relayInfo.relayUrl,
+        executorAccount: relayInfo.executorAccount,
+        authorAccount: options.authorAccount,
+        authorProof: options.authorProof,
+        deviceSecret: options.deviceSecret,
+        nonces: options.nonces ?? (await defaultNonceSource(options.deviceSecret)),
+        ttlSeconds: options.ttlSeconds,
+        fetch: options.fetch,
+        timeoutMs: options.timeoutMs,
+    });
+    return {
+        cloud,
+        relay,
+        namespaceId: namespace.namespaceId,
+        namespace,
+        relayInfo,
+        execute: (contextId, method, argsJson) => relay.execute(contextId, method, argsJson),
+    };
+}
+/** The one namespace to write in, or an error naming the actual ambiguity. */
+function pickNamespace(namespaces, requested) {
+    if (requested) {
+        const found = namespaces.find((n) => n.namespaceId === requested);
+        if (!found) {
+            throw new Error(`this account owns no namespace ${requested}; it owns: ${namespaces.map((n) => n.namespaceId).join(', ') || '(none)'}`);
+        }
+        return found;
+    }
+    if (namespaces.length === 0) {
+        throw new Error('this account owns no namespaces in the cloud: claim one first, then enable HA on it so a relay is assigned');
+    }
+    if (namespaces.length > 1) {
+        throw new Error(`this account owns ${namespaces.length} namespaces — pass namespaceId to say which: ${namespaces
+            .map((n) => n.namespaceId)
+            .join(', ')}`);
+    }
+    return namespaces[0];
+}
+/**
+ * Why no relay can write here — the three states, kept apart.
+ *
+ * They are three different asks of the user (turn HA on, wait, or get an admin
+ * to grant a capability) and one message for all of them would send them to
+ * the wrong one.
+ */
+function explainNoRelay(namespace, relays) {
+    if (relays.length === 0) {
+        return namespace.haStatus === 'enabled'
+            ? `namespace ${namespace.namespaceId} has HA enabled but no relay has been assigned to it yet — retry shortly`
+            : `namespace ${namespace.namespaceId} has no relays: enable HA on it in the cloud to have an attested node assigned`;
+    }
+    const waitingOnGrant = relays.filter((r) => !r.authorshipReady);
+    if (waitingOnGrant.length === relays.length) {
+        return (`every relay on namespace ${namespace.namespaceId} is waiting for the authorship grant: ` +
+            `an admin of the namespace must grant CAN_AUTHOR_ON_BEHALF to ${waitingOnGrant.map((r) => r.executorAccount ?? r.peerId).join(', ') || 'the relay account'}`);
+    }
+    return `namespace ${namespace.namespaceId} has ${relays.length} relay(s), but none reported both a URL and an executor account yet — retry shortly`;
+}
+/**
+ * A persisted nonce source keyed by the author's device public key.
+ *
+ * The key is the *public* key, derived locally: a per-device key is required
+ * (two devices of one account are independent replicas) and the secret must
+ * never end up in a storage key an extension or another script can enumerate.
+ *
+ * Falls back to memory where there is no `localStorage` — Node, a worker, an
+ * edge runtime. Those are processes that own their whole sequence, which is
+ * exactly the case a memory counter is correct for.
+ */
+async function defaultNonceSource(deviceSecret) {
+    const key = `mero-js:warrant-nonce:${hex(await derivePublicKey(deviceSecret))}`;
+    try {
+        return createLocalStorageNonceSource(key);
+    }
+    catch {
+        return createMemoryNonceSource(1);
+    }
+}

package/dist/cloud/index.d.ts

@@ -1,2 +1,4 @@
 export { CloudClient } from './cloud-client.js';
-export type { CloudClientConfig, EnableHAOptions, DisableHAOptions } from './cloud-client.js';
+export type { CloudClientConfig, CloudSession, CloudNamespace, CloudRelay, CloudMachine, CloudMachineNamespace, EnableHAOptions, DisableHAOptions, } from './cloud-client.js';
+export { connectCloud } from './connect.js';
+export type { ConnectCloudOptions, CloudConnection } from './connect.js';

package/dist/cloud/index.js

@@ -1 +1,2 @@
 export { CloudClient } from './cloud-client.js';
+export { connectCloud } from './connect.js';