@omg-dev/cloud 0.6.41

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Benny Kok
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/auth.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Sign-in and the short-lived app JWT, against better-auth's REST surface.
+ *
+ * Raw `fetch` on purpose. better-auth's browser client manages a cookie jar,
+ * and each consumer here has its own: the native app's platform jar, the
+ * dashboard's document cookies, or nothing at all for a self-hosted UI that
+ * lets its `omg serve` hold the credential. Keeping to three endpoints of
+ * surface area is what lets one module serve all of them.
+ *
+ * /token authenticates with the session cookie the platform replays, so the
+ * server needs no `bearer` plugin for this path.
+ */
+import { type CloudEndpoints, type FetchLike } from "./config";
+export declare class OmgAuthError extends Error {
+    readonly status: number;
+    constructor(message: string, status: number);
+}
+/**
+ * The server did not confirm the session was revoked. Distinct from
+ * OmgAuthError so a caller can tell "sign-out failed, the account may still
+ * be signed in server-side" apart from an ordinary sign-in failure. A caller
+ * must NOT treat this the same as a successful sign-out.
+ */
+export declare class SignOutFailedError extends Error {
+    constructor(message: string);
+}
+export type SignedInUser = {
+    id: string;
+    email: string;
+    name?: string;
+};
+export type SocialProvider = "apple" | "google";
+export interface CloudAuthOptions {
+    endpoints?: Partial<CloudEndpoints>;
+    fetch?: FetchLike;
+    /**
+     * Value for the `Origin` header on every auth request.
+     *
+     * better-auth's origin check rejects state-changing requests that arrive
+     * with no Origin header. A browser always sends one; React Native's fetch
+     * never does. A consumer with no origin of its own sets one of the server's
+     * trusted origins here. A browser consumer leaves it unset, because the
+     * browser forbids overriding it anyway.
+     */
+    requestOrigin?: string;
+    /** How long a minted JWT is reused before a fresh mint. Default 30 s. */
+    tokenTtlMs?: number;
+    now?: () => number;
+}
+export interface CloudAuth {
+    sendSignInCode(email: string): Promise<void>;
+    verifySignInCode(email: string, otp: string): Promise<SignedInUser>;
+    signInWithIdToken(provider: SocialProvider, idToken: string, options?: {
+        nonce?: string;
+        name?: {
+            firstName?: string;
+            lastName?: string;
+        };
+        email?: string;
+    }): Promise<SignedInUser>;
+    getSession(): Promise<SignedInUser | null>;
+    /** Throws SignOutFailedError unless the server confirmed revocation. */
+    signOut(): Promise<void>;
+    /** The account JWT, or null when nobody is signed in. Cached and deduplicated. */
+    getAuthToken(): Promise<string | null>;
+    /** Drop the cached JWT so the next call re-mints. */
+    clearAuthToken(): void;
+}
+/**
+ * One auth client per process.
+ *
+ * The token cache and the in-flight mint live on the instance, not in a hook
+ * or a React context: a hook shares code, never state, and the dashboard once
+ * paid five concurrent /token round trips on every cold Computer for exactly
+ * that reason. Create this once and hand the same object to every consumer.
+ */
+export declare function createCloudAuth(options?: CloudAuthOptions): CloudAuth;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAsC,KAAK,cAAc,EAAE,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAEnG,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAI1C;CACF;AAED;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEhD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACpC,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACpE,iBAAiB,CACf,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE;YAAE,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7F,OAAO,CAAC,YAAY,CAAC,CAAC;IACzB,UAAU,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC3C,wEAAwE;IACxE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,kFAAkF;IAClF,YAAY,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvC,qDAAqD;IACrD,cAAc,IAAI,IAAI,CAAC;CACxB;AAkBD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,GAAE,gBAAqB,GAAG,SAAS,CA4JzE"}

package/dist/auth.js

@@ -0,0 +1,206 @@
+/**
+ * Sign-in and the short-lived app JWT, against better-auth's REST surface.
+ *
+ * Raw `fetch` on purpose. better-auth's browser client manages a cookie jar,
+ * and each consumer here has its own: the native app's platform jar, the
+ * dashboard's document cookies, or nothing at all for a self-hosted UI that
+ * lets its `omg serve` hold the credential. Keeping to three endpoints of
+ * surface area is what lets one module serve all of them.
+ *
+ * /token authenticates with the session cookie the platform replays, so the
+ * server needs no `bearer` plugin for this path.
+ */
+import { AUTH_APP_ID, resolveCloudEndpoints } from "./config";
+export class OmgAuthError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.name = "OmgAuthError";
+        this.status = status;
+    }
+}
+/**
+ * The server did not confirm the session was revoked. Distinct from
+ * OmgAuthError so a caller can tell "sign-out failed, the account may still
+ * be signed in server-side" apart from an ordinary sign-in failure. A caller
+ * must NOT treat this the same as a successful sign-out.
+ */
+export class SignOutFailedError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "SignOutFailedError";
+    }
+}
+/**
+ * better-auth's own routes are mounted under /api/auth, while the JWT exchange
+ * at /token is a first-party route at the root. Mixing the two up is a silent
+ * 404, so the prefix lives here once.
+ */
+const BETTER_AUTH_BASE = "/api/auth";
+function parseJson(text) {
+    if (!text)
+        return {};
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * One auth client per process.
+ *
+ * The token cache and the in-flight mint live on the instance, not in a hook
+ * or a React context: a hook shares code, never state, and the dashboard once
+ * paid five concurrent /token round trips on every cold Computer for exactly
+ * that reason. Create this once and hand the same object to every consumer.
+ */
+export function createCloudAuth(options = {}) {
+    const endpoints = resolveCloudEndpoints(options.endpoints);
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    const now = options.now ?? Date.now;
+    const tokenTtlMs = options.tokenTtlMs ?? 30_000;
+    const baseHeaders = { "Content-Type": "application/json" };
+    if (options.requestOrigin)
+        baseHeaders.Origin = options.requestOrigin;
+    let cachedToken = null;
+    let inFlight = null;
+    async function authFetch(path, body) {
+        let response;
+        try {
+            response = await fetchImpl(`${endpoints.authOrigin}${BETTER_AUTH_BASE}${path}`, {
+                method: "POST",
+                headers: baseHeaders,
+                credentials: "include",
+                body: JSON.stringify(body),
+            });
+        }
+        catch {
+            throw new OmgAuthError("Couldn't reach omg. Check your connection.", 0);
+        }
+        const data = parseJson(await response.text().catch(() => ""));
+        if (!response.ok) {
+            const record = data;
+            throw new OmgAuthError(record?.message ?? record?.error ?? `Sign-in failed (${response.status})`, response.status);
+        }
+        return data;
+    }
+    async function mintToken() {
+        let response;
+        try {
+            response = await fetchImpl(`${endpoints.authOrigin}/token`, {
+                method: "POST",
+                headers: baseHeaders,
+                credentials: "include",
+                body: JSON.stringify({ appId: AUTH_APP_ID }),
+            });
+        }
+        catch {
+            throw new OmgAuthError("Couldn't reach omg. Check your connection.", 0);
+        }
+        // Not signed in is an ordinary answer, not a failure: the caller turns
+        // null into the sign-in screen.
+        if (response.status === 401)
+            return null;
+        if (!response.ok) {
+            throw new OmgAuthError(`Couldn't authenticate (${response.status})`, response.status);
+        }
+        const data = (await response.json().catch(() => null));
+        return data?.token ?? null;
+    }
+    const clearAuthToken = () => {
+        cachedToken = null;
+        inFlight = null;
+    };
+    return {
+        async sendSignInCode(email) {
+            // Rate limited per IP and reports success either way. Never auto-retry.
+            await authFetch("/email-otp/send-verification-otp", {
+                email: email.trim().toLowerCase(),
+                type: "sign-in",
+            });
+        },
+        async verifySignInCode(email, otp) {
+            const data = (await authFetch("/sign-in/email-otp", {
+                email: email.trim().toLowerCase(),
+                otp: otp.trim(),
+            }));
+            if (!data?.user?.id)
+                throw new OmgAuthError("That code didn't work. Try again.", 401);
+            return data.user;
+        },
+        async signInWithIdToken(provider, idToken, extra = {}) {
+            const user = extra.name || extra.email
+                ? { ...(extra.name ? { name: extra.name } : {}), ...(extra.email ? { email: extra.email } : {}) }
+                : undefined;
+            const data = (await authFetch("/sign-in/social", {
+                provider,
+                idToken: {
+                    token: idToken,
+                    ...(extra.nonce ? { nonce: extra.nonce } : {}),
+                    ...(user ? { user } : {}),
+                },
+            }));
+            if (!data?.user?.id)
+                throw new OmgAuthError("That sign-in didn't work. Try again.", 401);
+            return data.user;
+        },
+        async getSession() {
+            try {
+                const response = await fetchImpl(`${endpoints.authOrigin}${BETTER_AUTH_BASE}/get-session`, {
+                    headers: baseHeaders,
+                    credentials: "include",
+                });
+                if (!response.ok)
+                    return null;
+                const data = (await response.json().catch(() => null));
+                return data?.user?.id ? data.user : null;
+            }
+            catch {
+                return null;
+            }
+        },
+        /**
+         * Fails closed: a network failure throws the same as a server rejection
+         * rather than clearing local state. Showing "signed in" while offline is
+         * a recoverable annoyance; showing "signed out" while a token is still
+         * live is a false claim about account state.
+         */
+        async signOut() {
+            let response;
+            try {
+                response = await fetchImpl(`${endpoints.authOrigin}${BETTER_AUTH_BASE}/sign-out`, {
+                    method: "POST",
+                    headers: baseHeaders,
+                    credentials: "include",
+                });
+            }
+            catch {
+                throw new SignOutFailedError("Couldn't reach omg to sign out. Check your connection and try again.");
+            }
+            // 401 means the session is already gone. The goal state already holds.
+            if (!response.ok && response.status !== 401) {
+                throw new SignOutFailedError(`Sign-out was rejected (${response.status}). Your session may still be active — try again.`);
+            }
+            clearAuthToken();
+        },
+        getAuthToken() {
+            if (cachedToken && now() - cachedToken.fetchedAt < tokenTtlMs) {
+                return Promise.resolve(cachedToken.token);
+            }
+            if (inFlight)
+                return inFlight;
+            inFlight = mintToken()
+                .then((token) => {
+                cachedToken = token ? { token, fetchedAt: now() } : null;
+                return token;
+            })
+                .finally(() => {
+                inFlight = null;
+            });
+            return inFlight;
+        },
+        clearAuthToken,
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAuC,MAAM,UAAU,CAAC;AAEnG,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,MAAM,CAAS;IACxB,YAAY,OAAe,EAAE,MAAc;QACzC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAyCD;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAErC,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,OAAO,GAAqB,EAAE;IAC5D,MAAM,SAAS,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACpD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC;IAChD,MAAM,WAAW,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;IACnF,IAAI,OAAO,CAAC,aAAa;QAAE,WAAW,CAAC,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAEtE,IAAI,WAAW,GAAgD,IAAI,CAAC;IACpE,IAAI,QAAQ,GAAkC,IAAI,CAAC;IAEnD,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,IAAa;QAClD,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,SAAS,CAAC,UAAU,GAAG,gBAAgB,GAAG,IAAI,EAAE,EAAE;gBAC9E,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,WAAW;gBACpB,WAAW,EAAE,SAAS;gBACtB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,YAAY,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,IAA4C,CAAC;YAC5D,MAAM,IAAI,YAAY,CACpB,MAAM,EAAE,OAAO,IAAI,MAAM,EAAE,KAAK,IAAI,mBAAmB,QAAQ,CAAC,MAAM,GAAG,EACzE,QAAQ,CAAC,MAAM,CAChB,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,UAAU,SAAS;QACtB,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,SAAS,CAAC,UAAU,QAAQ,EAAE;gBAC1D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,WAAW;gBACpB,WAAW,EAAE,SAAS;gBACtB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;aAC7C,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,YAAY,CAAC,4CAA4C,EAAE,CAAC,CAAC,CAAC;QAC1E,CAAC;QACD,uEAAuE;QACvE,gCAAgC;QAChC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,YAAY,CAAC,0BAA0B,QAAQ,CAAC,MAAM,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA8B,CAAC;QACpF,OAAO,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC;IAC7B,CAAC;IAED,MAAM,cAAc,GAAG,GAAG,EAAE;QAC1B,WAAW,GAAG,IAAI,CAAC;QACnB,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,cAAc,CAAC,KAAK;YACxB,wEAAwE;YACxE,MAAM,SAAS,CAAC,kCAAkC,EAAE;gBAClD,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;gBACjC,IAAI,EAAE,SAAS;aAChB,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG;YAC/B,MAAM,IAAI,GAAG,CAAC,MAAM,SAAS,CAAC,oBAAoB,EAAE;gBAClD,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;gBACjC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE;aAChB,CAAC,CAA4B,CAAC;YAC/B,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;gBAAE,MAAM,IAAI,YAAY,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;YACtF,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,GAAG,EAAE;YACnD,MAAM,IAAI,GACR,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK;gBACvB,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;gBACjG,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,IAAI,GAAG,CAAC,MAAM,SAAS,CAAC,iBAAiB,EAAE;gBAC/C,QAAQ;gBACR,OAAO,EAAE;oBACP,KAAK,EAAE,OAAO;oBACd,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9C,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1B;aACF,CAAC,CAA4B,CAAC;YAC/B,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;gBAAE,MAAM,IAAI,YAAY,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;YACzF,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,UAAU;YACd,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,SAAS,CAAC,UAAU,GAAG,gBAAgB,cAAc,EAAE;oBACzF,OAAO,EAAE,WAAW;oBACpB,WAAW,EAAE,SAAS;iBACvB,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,EAAE;oBAAE,OAAO,IAAI,CAAC;gBAC9B,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;gBACzF,OAAO,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED;;;;;WAKG;QACH,KAAK,CAAC,OAAO;YACX,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,SAAS,CAAC,UAAU,GAAG,gBAAgB,WAAW,EAAE;oBAChF,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,WAAW;oBACpB,WAAW,EAAE,SAAS;iBACvB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,kBAAkB,CAC1B,sEAAsE,CACvE,CAAC;YACJ,CAAC;YACD,uEAAuE;YACvE,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5C,MAAM,IAAI,kBAAkB,CAC1B,0BAA0B,QAAQ,CAAC,MAAM,kDAAkD,CAC5F,CAAC;YACJ,CAAC;YACD,cAAc,EAAE,CAAC;QACnB,CAAC;QAED,YAAY;YACV,IAAI,WAAW,IAAI,GAAG,EAAE,GAAG,WAAW,CAAC,SAAS,GAAG,UAAU,EAAE,CAAC;gBAC9D,OAAO,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC5C,CAAC;YACD,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAC9B,QAAQ,GAAG,SAAS,EAAE;iBACnB,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;gBACd,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBACzD,OAAO,KAAK,CAAC;YACf,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACZ,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC,CAAC,CAAC;YACL,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,cAAc;KACf,CAAC;AACJ,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Where an omg Cloud client points.
+ *
+ * Every consumer of this package reaches the same three origins, but from a
+ * different place: the hosted dashboard from its own domain, the native app
+ * from a phone, and a self-hosted `omg serve` UI from a loopback or tailnet
+ * address. None of them share a cookie jar or an env prefix, so the endpoints
+ * are a plain object the consumer builds once and passes in, never a module
+ * global read from `process.env`.
+ */
+export interface CloudEndpoints {
+    /** Auth server that holds the account session and mints the app JWT. */
+    authOrigin: string;
+    /** Control plane: account, machine bindings, cloud Computer lifecycle. */
+    controlPlaneOrigin: string;
+    /** Session origin: the Computer itself, reached through the omg proxy. */
+    sessionOrigin: string;
+}
+export declare const DEFAULT_CLOUD_ENDPOINTS: CloudEndpoints;
+/** Fill in the defaults and drop trailing slashes so path joins are exact. */
+export declare function resolveCloudEndpoints(overrides?: Partial<CloudEndpoints>): CloudEndpoints;
+/** Grant mint route on the session origin. */
+export declare const SESSION_AUTH_PATH = "/__omg/session-auth";
+/**
+ * The JWT audience. Every omg client is the same account on the same
+ * platform, so they all ask for the same one; a different appId would mint a
+ * token the session origin does not accept.
+ */
+export declare const AUTH_APP_ID = "vibes";
+/**
+ * The account's managed cloud sandbox is addressed by this virtual binding id
+ * rather than its real sandbox id, so instance ids and node URLs stay server
+ * side.
+ */
+export declare const CLOUD_BINDING_ID = "cloud";
+/** A fetch a consumer may inject, for tests or a runtime with no global. */
+export type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+/**
+ * Produces the account JWT, or null when nobody is signed in.
+ *
+ * Injected, not owned here: the hosted dashboard mints it from a browser
+ * session, the native app from a platform cookie jar, and a self-hosted UI
+ * from its own `omg serve`, which holds the credential on the box.
+ */
+export type GetAuthToken = () => Promise<string | null>;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,kBAAkB,EAAE,MAAM,CAAC;IAC3B,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,uBAAuB,EAAE,cAIrC,CAAC;AAIF,8EAA8E;AAC9E,wBAAgB,qBAAqB,CACnC,SAAS,GAAE,OAAO,CAAC,cAAc,CAAM,GACtC,cAAc,CAQhB;AAED,8CAA8C;AAC9C,eAAO,MAAM,iBAAiB,wBAAwB,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,WAAW,UAAU,CAAC;AAEnC;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,UAAU,CAAC;AAExC,4EAA4E;AAC5E,MAAM,MAAM,SAAS,GAAG,CACtB,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,EAC7B,IAAI,CAAC,EAAE,WAAW,KACf,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC"}

package/dist/config.js

@@ -0,0 +1,39 @@
+/**
+ * Where an omg Cloud client points.
+ *
+ * Every consumer of this package reaches the same three origins, but from a
+ * different place: the hosted dashboard from its own domain, the native app
+ * from a phone, and a self-hosted `omg serve` UI from a loopback or tailnet
+ * address. None of them share a cookie jar or an env prefix, so the endpoints
+ * are a plain object the consumer builds once and passes in, never a module
+ * global read from `process.env`.
+ */
+export const DEFAULT_CLOUD_ENDPOINTS = {
+    authOrigin: "https://auth.omg.dev",
+    controlPlaneOrigin: "https://backend.omg.dev",
+    sessionOrigin: "https://sessions.omgs.app",
+};
+const trimSlash = (value) => value.trim().replace(/\/+$/, "");
+/** Fill in the defaults and drop trailing slashes so path joins are exact. */
+export function resolveCloudEndpoints(overrides = {}) {
+    return {
+        authOrigin: trimSlash(overrides.authOrigin ?? DEFAULT_CLOUD_ENDPOINTS.authOrigin),
+        controlPlaneOrigin: trimSlash(overrides.controlPlaneOrigin ?? DEFAULT_CLOUD_ENDPOINTS.controlPlaneOrigin),
+        sessionOrigin: trimSlash(overrides.sessionOrigin ?? DEFAULT_CLOUD_ENDPOINTS.sessionOrigin),
+    };
+}
+/** Grant mint route on the session origin. */
+export const SESSION_AUTH_PATH = "/__omg/session-auth";
+/**
+ * The JWT audience. Every omg client is the same account on the same
+ * platform, so they all ask for the same one; a different appId would mint a
+ * token the session origin does not accept.
+ */
+export const AUTH_APP_ID = "vibes";
+/**
+ * The account's managed cloud sandbox is addressed by this virtual binding id
+ * rather than its real sandbox id, so instance ids and node URLs stay server
+ * side.
+ */
+export const CLOUD_BINDING_ID = "cloud";
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAWH,MAAM,CAAC,MAAM,uBAAuB,GAAmB;IACrD,UAAU,EAAE,sBAAsB;IAClC,kBAAkB,EAAE,yBAAyB;IAC7C,aAAa,EAAE,2BAA2B;CAC3C,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEtE,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB,CACnC,SAAS,GAA4B,EAAE;IAEvC,OAAO;QACL,UAAU,EAAE,SAAS,CAAC,SAAS,CAAC,UAAU,IAAI,uBAAuB,CAAC,UAAU,CAAC;QACjF,kBAAkB,EAAE,SAAS,CAC3B,SAAS,CAAC,kBAAkB,IAAI,uBAAuB,CAAC,kBAAkB,CAC3E;QACD,aAAa,EAAE,SAAS,CAAC,SAAS,CAAC,aAAa,IAAI,uBAAuB,CAAC,aAAa,CAAC;KAC3F,CAAC;AACJ,CAAC;AAED,8CAA8C;AAC9C,MAAM,CAAC,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AAEvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC;AAEnC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC"}

package/dist/control-plane.d.ts

@@ -0,0 +1,116 @@
+/**
+ * The account's machines, as the control plane reports them.
+ *
+ * Every dashboard read goes through `POST <controlPlane>/api/computer/<name>`
+ * with the account JWT as a bearer. The names are the control plane's own
+ * function names, so a new one needs no client change beyond a call.
+ */
+import { type CloudEndpoints, type FetchLike, type GetAuthToken } from "./config";
+import { type SharedComputerView } from "./shared-binding";
+/** A machine the account owns, paired through `omg connect`. */
+export type ComputerBinding = {
+    id: string;
+    boxId?: string;
+    online?: boolean;
+    lastSeenAt?: number | null;
+    createdAt?: number;
+    defaultFolder?: string | null;
+    computerUrl?: string | null;
+};
+/**
+ * A machine somebody else shared with this account, presented as an ordinary
+ * binding so it flows through the same transport cache, grant mint and picker
+ * rows. `id` is the opaque `shared:<ownerUserId>:<bindingId>` spelling.
+ *
+ * Never synthesized with a `computerUrl`: a guest never gets the owner's
+ * direct box URL. Only the session proxy knows how to reach it.
+ */
+export type SharedComputerBinding = ComputerBinding & {
+    shared: true;
+    ownerUserId: string;
+    ownerBindingId: string;
+    /** The owner's name, or their email if they have none set. */
+    ownerLabel: string;
+    /** Display name when they have one. Never an email. */
+    ownerName?: string;
+    email: string;
+    machineLabel?: string;
+};
+export declare function toSharedBinding(computer: SharedComputerView): SharedComputerBinding;
+/** Lifecycle of the account's cloud Computer. Server owned, never inferred. */
+export type CloudComputerStatus = "none" | "provisioning" | "waking" | "live" | "paused" | "recycled" | "upgrade_required";
+/** Shape returned by control-plane getCloudComputer. Render what the server sent. */
+export type CloudComputer = {
+    status?: CloudComputerStatus | string;
+    blockedReason?: "compute_exhausted" | "plan_downgraded" | string | null;
+    instanceId?: string | null;
+    plan?: string | null;
+    machine?: {
+        vcpus?: number;
+        memoryMib?: number;
+        diskGib?: number;
+        alwaysOn?: boolean;
+    } | null;
+    recyclesAt?: number | null;
+};
+/** A cloud Computer that the session proxy would answer with a permanent 425. */
+export declare function isCloudComputerBlocked(cloud: CloudComputer | null | undefined): boolean;
+export interface ControlPlaneOptions {
+    endpoints?: Partial<CloudEndpoints>;
+    getAuthToken: GetAuthToken;
+    fetch?: FetchLike;
+}
+export type MachineList = {
+    bindings: ComputerBinding[];
+    sharedComputers: SharedComputerBinding[];
+    cloud: CloudComputer | null;
+    /**
+     * Set only when BOTH calls every account depends on failed. The shared list
+     * is best effort: almost every account has nothing shared with it, and a
+     * failure there costs the "Shared with you" section, never the screen.
+     */
+    error: string | null;
+};
+export interface ControlPlaneClient {
+    /** Call any control plane computer function by name. */
+    call<T>(name: string, body?: unknown): Promise<T>;
+    listBindings(): Promise<ComputerBinding[]>;
+    listSharedComputers(): Promise<SharedComputerBinding[]>;
+    getCloudComputer(): Promise<CloudComputer | null>;
+    /**
+     * The one client-callable path that wakes or provisions the cloud Computer.
+     * Minting a grant, reading state, and polling bootstrap never do.
+     */
+    getOrProvisionCloudComputer(): Promise<CloudComputer | null>;
+    setComputerPreference(value: string): Promise<void>;
+    /** All three reads at once, each allowed to fail on its own. */
+    listMachines(): Promise<MachineList>;
+}
+export declare function createControlPlaneClient(options: ControlPlaneOptions): ControlPlaneClient;
+/**
+ * Auto-select when there is no real choice to make. An account with exactly
+ * one online machine should not be asked which one; an account whose cloud
+ * Computer is plan-blocked should not have it silently chosen either.
+ * Returns null when a person has to choose.
+ */
+export declare function autoSelectBinding(list: Pick<MachineList, "bindings" | "cloud">): string | null;
+/**
+ * A machine's own name: what to call the COMPUTER, not the work it is pointed
+ * at. The hostname is the machine's real identity, so it goes first. The
+ * folder stays as a fallback; a folder name beats a truncated uuid.
+ */
+export declare function bindingLabel(binding: {
+    id: string;
+    boxId?: string;
+    defaultFolder?: string | null;
+    computerUrl?: string | null;
+}): string;
+/** Turn a cloud status code into something a person can act on. */
+export declare function cloudStatusLabel(status?: string, blockedReason?: string | null): string;
+/** Machine spec line, e.g. "4 vCPU · 8 GB RAM · 64 GB disk". */
+export declare function machineSpec(machine?: {
+    vcpus?: number;
+    memoryMib?: number;
+    diskGib?: number;
+} | null): string | null;
+//# sourceMappingURL=control-plane.d.ts.map

package/dist/control-plane.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../src/control-plane.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAA2C,KAAK,cAAc,EAAE,KAAK,SAAS,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAC3H,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,kBAAkB,CAAC;AAE1B,gEAAgE;AAChE,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG,eAAe,GAAG;IACpD,MAAM,EAAE,IAAI,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,UAAU,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,kBAAkB,GAAG,qBAAqB,CAgBnF;AAED,+EAA+E;AAC/E,MAAM,MAAM,mBAAmB,GAC3B,MAAM,GACN,cAAc,GACd,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,UAAU,GACV,kBAAkB,CAAC;AAEvB,qFAAqF;AACrF,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,CAAC,EAAE,mBAAmB,GAAG,MAAM,CAAC;IACtC,aAAa,CAAC,EAAE,mBAAmB,GAAG,iBAAiB,GAAG,MAAM,GAAG,IAAI,CAAC;IACxE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9F,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAIF,iFAAiF;AACjF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEvF;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACpC,YAAY,EAAE,YAAY,CAAC;IAC3B,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,eAAe,EAAE,qBAAqB,EAAE,CAAC;IACzC,KAAK,EAAE,aAAa,GAAG,IAAI,CAAC;IAC5B;;;;OAIG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,CAAC;AAEF,MAAM,WAAW,kBAAkB;IACjC,wDAAwD;IACxD,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAClD,YAAY,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC3C,mBAAmB,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACxD,gBAAgB,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAClD;;;OAGG;IACH,2BAA2B,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC7D,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,gEAAgE;IAChE,YAAY,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;CACtC;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,mBAAmB,GAAG,kBAAkB,CA+DzF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAO9F;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,GAAG,MAAM,CAcT;AAKD,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAmBvF;AAED,gEAAgE;AAChE,wBAAgB,WAAW,CAAC,OAAO,CAAC,EAAE;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAOvB"}