@crievo/omni 0.1.2 → 0.1.3

package/tools/omnichat.mjs

@@ -72,7 +72,7 @@
      node tools/omnichat.mjs webhook setup | subscribe | status | serve [--port 5434]
          the messaging webhook that the button and the follow gate need: `setup` creates the verify token and says
          what to paste in the Meta panel, `subscribe` signs the account up to messages and postbacks, `serve` listens
-         (behind a tunnel: cloudflared tunnel --url http://127.0.0.1:5434)
+         here for a test (the Callback URL is the cloud Worker's /webhook)
      node tools/omnichat.mjs cloud status | push [videos/<slug>] [--records] [--force] | pull videos/<slug>
          the Worker in cloud/omnichat (cloud.url in the config, OMNICHAT_CLOUD_SECRET in the .env):
          `push` sends the config, the Instagram account and the rules (with --records, the local records too,
@@ -1284,9 +1284,8 @@ async function cloudCmd(sub) {
 /* --- the messaging webhook: the button's tap and the follow gate ------------------------------
    The comment's DM opens with a button (rule.button / rule.require_follow). The tap reaches here as a
    `messaging_postbacks` event; handleTap (tools/lib/omnichat/gate.mjs) checks the criterion and sends the
-   link, or asks to follow. Meta needs a public HTTPS callback URL: `serve` listens on this machine and a
-   tunnel (cloudflared) exposes it while the Mac is awake. A webhook handled elsewhere (a cloud function)
-   uses the same handleWebhook. The record is written under the pass lock, so the agent and the tap
+   link, or asks to follow. Meta needs a public HTTPS callback URL: the cloud Worker's /webhook
+   (cloud/omnichat), which runs the same handleWebhook; `serve` listens on this machine for a test. The record is written under the pass lock, so the agent and the tap
    don't overwrite each other. */
 const WEBHOOK_PORT = 5434;
 const gatedRules = () => videosWithRule().filter(d => gateOn(ruleOf(d) ?? {}));
@@ -1337,10 +1336,9 @@ async function webhook(sub) {
     console.log("✓ INSTAGRAM_WEBHOOK_VERIFY_TOKEN no .env");
     console.log(`
 Faltam estes passos, uma vez só:
-  1. Expor a porta ${port}: node tools/omnichat.mjs webhook serve   e, em outro terminal,
-     cloudflared tunnel --url http://127.0.0.1:${port}   (anote a URL https://….trycloudflare.com)
+  1. A cloud no ar (cloud/omnichat, reference/omnichat.md): é ela que recebe o webhook.
   2. developers.facebook.com/apps → seu app → Instagram → API setup with Instagram login → Configure webhooks:
-       Callback URL:  <a URL do túnel>/webhook
+       Callback URL:  ${cloudSettings().url || "https://omnichat.<você>.workers.dev"}/webhook
        Verify token:  ${token}
      e ligue os campos messages e messaging_postbacks.
   3. node tools/omnichat.mjs webhook subscribe   (inscreve a conta nesses campos)

package/tools/package.mjs

@@ -7,8 +7,9 @@
    not Bun; ffmpeg, the Chrome without a window and Python are fetched by `omni up` (tools/lib/deps.mjs).
 
      node tools/package.mjs [--version <x.y.z>]     builds and packs; prints the .tgz path
-     node tools/package.mjs publish [--version …]   builds, packs and publishes to npm with the account in
-                                                    NPM_CONFIG_USERCONFIG (e.g. ~/.npmrc-pedroflp)
+     node tools/package.mjs publish [--version …]   builds, packs and publishes to npm: in CI through npm's
+                                                    trusted publishing (.github/workflows/deploy.yml), by
+                                                    hand with the account in NPM_CONFIG_USERCONFIG
 
    Try it before publishing: npm install --prefix /tmp/omni-test <the .tgz>, then
    /tmp/omni-test/node_modules/.bin/omni status
@@ -120,7 +121,8 @@ const tgz = join(OUT, packed.stdout.trim().split("\n").at(-1) ?? "");
 console.log(`${PACKAGE}@${v}: ${(size(PKG) / 1e6).toFixed(1)} MB de arquivos, pacote em ${tgz}`);
 
 if (args[0] === "publish") {
-  if (!process.env.NPM_CONFIG_USERCONFIG)
+  /* CI publishes through npm's trusted publishing (OIDC); by hand, with the account's own login file */
+  if (!process.env.NPM_CONFIG_USERCONFIG && !process.env.GITHUB_ACTIONS)
     fail("defina NPM_CONFIG_USERCONFIG com o login da conta que publica (ex.: ~/.npmrc-pedroflp)");
   const r = spawnSync("npm", ["publish", tgz, "--access", "public", ...(v.includes("-") ? ["--tag", "next"] : [])], {
     stdio: "inherit",

package/tools/publish.mjs

@@ -66,7 +66,7 @@
 
 /* The platform clients (tools/lib/platforms/), the texts and per-platform checks (tools/lib/publish/)
    and the schedule decisions (tools/lib/schedule/) are the core; this file is the CLI: files, flags,
-   the desktop login, the local tunnel for Instagram, ffmpeg/ffprobe, `claude` and the launchd agent. */
+   the desktop login, the Instagram files through the cloud's R2, ffmpeg/ffprobe, `claude` and the launchd agent. */
 
 import {
   readFileSync,
@@ -74,7 +74,6 @@ import {
   renameSync,
   existsSync,
   statSync,
-  createReadStream,
   readdirSync,
   mkdirSync,
   openSync,
@@ -83,9 +82,8 @@ import {
   unlinkSync,
 } from "node:fs";
 import { createServer } from "node:http";
-import https from "node:https";
 import { randomBytes, createHash } from "node:crypto";
-import { spawn, spawnSync } from "node:child_process";
+import { spawnSync } from "node:child_process";
 import { homedir, tmpdir } from "node:os";
 import { join, resolve, dirname, basename, sep } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -98,7 +96,6 @@ import {
   pullTiktokEnv,
   cloudSettings,
   cloudApi,
-  sleep,
   instagramToken,
   instagramAccount,
   igClient,
@@ -303,138 +300,44 @@ async function authInstagram(token) {
   console.log(`Instagram conectado: @${c.username}`);
 }
 
-/* does the URL answer (206) when resolved through Cloudflare's DNS (1.1.1.1)? */
-async function reachableFromOutside(url, host) {
-  let ip;
-  try {
-    const r = await fetch(`https://1.1.1.1/dns-query?name=${host}&type=A`, {
-      headers: { accept: "application/dns-json" },
-      signal: AbortSignal.timeout(5000),
-    });
-    ip = (await r.json()).Answer?.find(a => a.type === 1)?.data;
-  } catch {
-    return false;
-  }
-  if (!ip) return false;
-  return new Promise(ok => {
-    const req = https.get(
-      url,
-      {
-        headers: { range: "bytes=0-0" },
-        lookup: (_h, opts, cb) => (opts?.all ? cb(null, [{ address: ip, family: 4 }]) : cb(null, ip, 4)),
-        timeout: 8000,
-      },
-      res => {
-        res.resume();
-        ok(res.statusCode === 206 || res.statusCode === 200);
-      },
+/* Files at a public URL until Instagram has them: each one goes up to the cloud's R2 (cloud/omnichat,
+   PUT /api/media/<slug>/<name>) and Instagram downloads it from <cloud>/media/<key>. `urls` in file
+   order; `close()` deletes them (the bucket's 7-day rule is the backstop). The schedule uses the same
+   bucket (ADR 0004). */
+async function servePublic(slug, files) {
+  const c = cloudSettings();
+  if (!c.ready)
+    throw new Error(
+      "o Instagram baixa o vídeo de um link público, que vem da cloud: falta cloud.url no config e OMNICHAT_CLOUD_SECRET no .env",
     );
-    req.on("timeout", () => {
-      req.destroy();
-      ok(false);
-    });
-    req.on("error", () => ok(false));
-  });
-}
-
-/* Files at a public URL for a few minutes: a server on 127.0.0.1 that only answers
-   /<token>.<ext> for each one (with Range) and a cloudflared quick tunnel in front
-   (https://<random>.trycloudflare.com). `urls` in file order; `close()` tears both down.
-   Local only: in the cloud the files are already at a public URL (object storage). */
-const TYPES = { ".mp4": "video/mp4", ".jpg": "image/jpeg" };
-async function servePublic(files) {
-  const served = new Map(
-    files.map(file => {
-      const ext = file.slice(file.lastIndexOf("."));
-      return [
-        `/${randomBytes(16).toString("hex")}${ext}`,
-        { file, size: statSync(file).size, type: TYPES[ext] ?? "application/octet-stream" },
-      ];
-    }),
-  );
-  const srv = createServer((req, res) => {
-    const s = served.get(req.url);
-    if (!s || !["GET", "HEAD"].includes(req.method)) {
-      res.writeHead(404).end();
-      return;
-    }
-    const { file, size } = s;
-    let start = 0,
-      end = size - 1,
-      code = 200;
-    const m = /^bytes=(\d*)-(\d*)$/.exec(req.headers.range ?? "");
-    if (m && (m[1] || m[2])) {
-      code = 206;
-      if (m[1]) {
-        start = +m[1];
-        if (m[2]) end = Math.min(+m[2], size - 1);
-      } else start = Math.max(0, size - +m[2]);
-      if (start > end) {
-        res.writeHead(416, { "content-range": `bytes */${size}` }).end();
-        return;
-      }
-    }
-    res.writeHead(code, {
-      "content-type": s.type,
-      "content-length": String(end - start + 1),
-      "accept-ranges": "bytes",
-      ...(code === 206 ? { "content-range": `bytes ${start}-${end}/${size}` } : {}),
-    });
-    if (req.method === "HEAD") res.end();
-    else createReadStream(file, { start, end }).pipe(res);
-  });
-  await new Promise(ok => srv.listen(0, "127.0.0.1", ok));
-  const tunnel = spawn(
-    P.instagram.cloudflared ?? "cloudflared",
-    ["tunnel", "--no-autoupdate", "--url", `http://127.0.0.1:${srv.address().port}`],
-    { stdio: ["ignore", "pipe", "pipe"] },
-  );
-  const close = () => {
-    try {
-      tunnel.kill();
-    } catch {
-      /* already exited */
-    }
-    srv.close();
+  /* the Worker takes [\w-]+ for the slug and [\w-]+.(mp4|jpg) for the name */
+  const safe = (/** @type {string} */ s) => s.replace(/[^\w-]+/g, "-");
+  const nameOf = (/** @type {string} */ file) => {
+    const b = basename(file);
+    const dot = b.lastIndexOf(".");
+    return `${safe(b.slice(0, dot))}${b.slice(dot).toLowerCase()}`;
   };
+  const keys = [];
+  const close = () =>
+    Promise.all(
+      keys.map(k => cloudApi("DELETE", `/api/media/${k}`).catch(e => warn(`não apaguei ${k} da cloud: ${e.message}`))),
+    );
   try {
-    /* the address shows up in the output right away; the registered connection a few seconds later */
-    let output = "";
-    const waitFor = (re, label) =>
-      new Promise((ok, reject) => {
-        const check = () => {
-          const m = re.exec(output);
-          if (m) ok(m[0]);
-        };
-        tunnel.stdout.on("data", check);
-        tunnel.stderr.on("data", check);
-        check();
-        tunnel.on("error", e => reject(new Error(`cloudflared: ${e.message} (instale com brew install cloudflared)`)));
-        tunnel.on("exit", c => reject(new Error(`o cloudflared saiu com ${c}: ${output.trim().slice(-300)}`)));
-        setTimeout(() => reject(new Error(`o cloudflared não ${label} em 30 s`)), 30_000).unref();
+    const urls = [];
+    for (const file of files) {
+      const r = await fetch(`${c.url}/api/media/${safe(slug)}/${nameOf(file)}`, {
+        method: "PUT",
+        headers: { authorization: `Bearer ${env("OMNICHAT_CLOUD_SECRET")}` },
+        body: readFileSync(file),
       });
-    tunnel.stdout.on("data", b => {
-      output += b;
-    });
-    tunnel.stderr.on("data", b => {
-      output += b;
-    });
-    const base = await waitFor(/https:\/\/[a-z0-9-]+\.trycloudflare\.com/, "abriu o túnel");
-    await waitFor(/Registered tunnel connection/, "conectou o túnel");
-    /* The new name takes one to two minutes to answer. The proof is downloading 1 byte from
-       the public URL, with the IP taken from a public DNS: macOS's DNS caches the "does not
-       exist" of the first attempt and would delay everything. */
-    const urls = [...served.keys()].map(path => `${base}${path}`);
-    const host = new URL(base).hostname;
-    const deadline = Date.now() + 150_000;
-    for (;;) {
-      if (await reachableFromOutside(urls[0], host)) break;
-      if (Date.now() > deadline) throw new Error(`o túnel abriu, mas ${host} não respondeu em 2,5 min`);
-      await sleep(3000);
+      const j = await r.json().catch(() => ({}));
+      if (!r.ok || !j.key) throw new Error(`subir ${basename(file)} para a cloud: ${r.status} ${j.error ?? ""}`.trim());
+      keys.push(j.key);
+      urls.push(j.url ?? `${c.url}/media/${j.key}`);
     }
     return { urls, close };
   } catch (e) {
-    close();
+    await close();
     throw e;
   }
 }
@@ -443,12 +346,12 @@ async function servePublic(files) {
    video_url (resumable upload is only for apps with Facebook login). The link comes from
    servePublic and stays up until Instagram finishes processing. The cover goes the same
    way, as cover_url, instead of the cover_at_s frame. */
-async function uploadInstagram(mp4, caption, cover) {
+async function uploadInstagram(slug, mp4, caption, cover) {
   const { token, id } = await instagramToken();
   console.log(
-    `Instagram: abrindo um link temporário para o Instagram baixar o vídeo (${(statSync(mp4).size / 1e6).toFixed(1)} MB)…`,
+    `Instagram: subindo o vídeo para a cloud, de onde o Instagram baixa (${(statSync(mp4).size / 1e6).toFixed(1)} MB)…`,
   );
-  const link = await servePublic(cover ? [mp4, cover.jpg] : [mp4]);
+  const link = await servePublic(slug, cover ? [mp4, cover.jpg] : [mp4]);
   const [videoUrl, coverUrl] = link.urls;
   return publishReel({
     client: igClient(token),
@@ -809,7 +712,7 @@ async function publish(dir) {
         plat === "youtube"
           ? await uploadYoutube(exp.mp4, meta, privacy, video, cover)
           : plat === "instagram"
-            ? await uploadInstagram(exp.mp4, meta.caption, cover)
+            ? await uploadInstagram(basename(dir), exp.mp4, meta.caption, cover)
             : await uploadTiktok(exp.mp4, meta.tiktokCaption, video, tiktokPrivacy);
       pub[plat] = publishedEntry({
         result: r,
@@ -899,8 +802,8 @@ async function publishCarousel(videoDir) {
 
   try {
     const { token, id } = await instagramToken();
-    console.log(`Instagram: abrindo um link temporário para o Instagram baixar os ${jpgs.length} slides…`);
-    const link = await servePublic(jpgs);
+    console.log(`Instagram: subindo os ${jpgs.length} slides para a cloud, de onde o Instagram baixa…`);
+    const link = await servePublic(basename(videoDir), jpgs);
     const done = await publishCarouselPost({
       client: igClient(token),
       userId: id,
@@ -1361,7 +1264,7 @@ function runOne(dir) {
 
 /* --- the launchd agent ---------------------------------------------------------------
    Runs `scheduler run` every 60 s with the node that installed it. PATH goes along because
-   launchd starts with a minimal PATH, without ffprobe, cloudflared or claude. */
+   launchd starts with a minimal PATH, without ffprobe or claude. */
 const domain = () => `gui/${process.getuid()}`;
 const launchctl = (...a) => spawnSync("launchctl", a, { encoding: "utf8" });
 

package/tools/reference.mjs

@@ -34,7 +34,7 @@
    guia reproduz a peça, e não só a descreve.
 
    Ritmo não se sente em quadro parado, mas se mede: é o que este script dá.
-   Requer ffmpeg/ffprobe; yt-dlp para baixar de link.
+   Requer ffmpeg/ffprobe; yt-dlp para baixar de link (o omni traz os três em ~/.omni/bin).
    ============================================================================ */
 
 import {

package/tools/setup.mjs

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
-/* Prepares a fresh OmniVideo clone and checks whether the machine is ready for
-   the first video. The full walkthrough (with the provider accounts) is in
-   docs/onboarding.md and in the studio's Getting started page
-   (/getting-started), which uses this same check.
+/* Prepares a fresh OmniVideo clone (the development repository) and checks
+   whether the machine is ready for the first video. A plugin install doesn't use
+   it: `omni up` prepares the computer, and the studio's Getting started page
+   (/getting-started, docs/onboarding.md) measures its own steps
+   (studio/api/services/onboarding.ts).
 
      node tools/setup.mjs                  prepares what's missing and checks everything
      node tools/setup.mjs check [--json]   only checks (the UI reads --json)
@@ -89,7 +90,8 @@ const version = (cmd, a = ["--version"]) => {
 };
 
 /* --- check ------------------------------------------------------------------
-   One step per guide section (the id is the `<!-- step: id -->` in docs/onboarding.md).
+   The development repository's steps (machine, project, Claude, voice, style, sound…), printed in the
+   terminal; the Getting started page has its own.
    state: ok · missing (blocks the first video) · warning (works, but take a look) */
 function check() {
   const c = cfg();
@@ -207,7 +209,7 @@ function check() {
           ready.length ? "ok" : "missing",
           ready.length
             ? `${ready.length} de ${accounts.length} conta(s) com login`
-            : `rode ${accounts[0] ? loginCommand(accounts[0], cfg) : "CLAUDE_CONFIG_DIR=~/.claude-personal claude auth login"}`,
+            : `rode ${accounts[0] ? loginCommand(accounts[0], cfg) : "claude auth login"}`,
         ),
         ...accounts
           .filter(a => !loginOf(a) && a !== accounts[0])
@@ -328,17 +330,12 @@ function check() {
   /* 8. publish (optional) */
   {
     const has = (...ks) => ks.every(k => env.has(k));
-    const cloudflared = version("cloudflared");
+    /* Instagram downloads the video from the cloud's R2 (publish.mjs servePublic) */
+    const cloud = !!(c.cloud?.url || c.omnichat?.cloud?.url) && env.has("OMNICHAT_CLOUD_SECRET");
     steps.push({
       id: "publish",
       optional: true,
       items: [
-        item(
-          "cloudflared",
-          "cloudflared (o Instagram busca o vídeo por ele)",
-          cloudflared ? "ok" : "warning",
-          cloudflared ? cloudflared.split(" (")[0] : "opcional: só para publicar no Instagram",
-        ),
         item(
           "youtube",
           "YouTube",
@@ -348,8 +345,12 @@ function check() {
         item(
           "instagram",
           "Instagram",
-          has("INSTAGRAM_TOKEN", "INSTAGRAM_USER_ID") ? "ok" : "warning",
-          has("INSTAGRAM_TOKEN") ? "conectado" : "opcional: não conectado",
+          has("INSTAGRAM_TOKEN", "INSTAGRAM_USER_ID") && cloud ? "ok" : "warning",
+          !has("INSTAGRAM_TOKEN")
+            ? "opcional: não conectado"
+            : cloud
+              ? "conectado"
+              : "conectado, mas o Instagram baixa o vídeo da cloud: falta cloud.url no config ou OMNICHAT_CLOUD_SECRET no .env",
         ),
         item(
           "tiktok",