camox 0.58.1 → 0.60.2

package/dist/lib/auth.js

@@ -1,6 +1,7 @@
 import { actionsStore } from "../features/provider/actionsStore.js";
 import { validatePreviewTarget } from "./preview-handoff.js";
-import { SERVER_AUTH_COOKIE_NAME, buildClearServerAuthCookieHeader, getServerAuthCookieHeader } from "./server-auth-cookie.js";
+import { buildClearServerAuthCookieHeader, buildServerAuthCookieHeader, getServerAuthCookieHeader, readServerAuthCookie } from "./server-auth-cookie.js";
+import { getCookie, getSetCookie, parseSetCookieHeader, withCookieHeader } from "./stored-auth-cookies.js";
 import { c } from "react/compiler-runtime";
 import * as React from "react";
 import { oneTimeTokenClient, organizationClient } from "better-auth/client/plugins";
@@ -9,60 +10,26 @@ import { createAuthClient } from "better-auth/react";
 //#region src/lib/auth.ts
 function writeServerAuthCookie(cookie) {
 	if (typeof document === "undefined") return;
-	const secure = window.location.protocol === "https:" ? "; Secure" : "";
+	const secure = window.location.protocol === "https:";
 	if (!cookie) {
-		document.cookie = `${buildClearServerAuthCookieHeader()}${secure}`;
+		document.cookie = `${buildClearServerAuthCookieHeader()}${secure ? "; Secure" : ""}`;
 		return;
 	}
-	document.cookie = `${SERVER_AUTH_COOKIE_NAME}=${encodeURIComponent(cookie)}; Path=/; SameSite=Lax; Max-Age=2592000${secure}`;
+	document.cookie = buildServerAuthCookieHeader(cookie, { secure });
 }
-function parseSetCookieHeader(header) {
-	const cookieMap = /* @__PURE__ */ new Map();
-	header.split(", ").forEach((cookie) => {
-		const [nameValue, ...attributes] = cookie.split("; ");
-		const [name, value] = nameValue.split("=");
-		const cookieObj = { value };
-		attributes.forEach((attr) => {
-			const [attrName, attrValue] = attr.split("=");
-			cookieObj[attrName.toLowerCase()] = attrValue;
-		});
-		cookieMap.set(name, cookieObj);
-	});
-	return cookieMap;
-}
-function getSetCookie(header, prevCookie) {
-	const parsed = parseSetCookieHeader(header);
-	let toSetCookie = {};
-	parsed.forEach((cookie, key) => {
-		const expiresAt = cookie["expires"];
-		const maxAge = cookie["max-age"];
-		let expires = null;
-		if (expiresAt) expires = new Date(String(expiresAt));
-		else if (maxAge) expires = new Date(Date.now() + Number(maxAge) * 1e3);
-		toSetCookie[key] = {
-			value: cookie["value"],
-			expires: expires ? expires.toISOString() : null
-		};
-	});
-	if (prevCookie) try {
-		toSetCookie = {
-			...JSON.parse(prevCookie),
-			...toSetCookie
-		};
-	} catch {}
-	return JSON.stringify(toSetCookie);
-}
-function getCookie(cookie) {
-	let parsed = {};
-	try {
-		parsed = JSON.parse(cookie);
-	} catch {}
-	const parts = [];
-	for (const [key, value] of Object.entries(parsed)) {
-		if (value.expires && new Date(value.expires) < /* @__PURE__ */ new Date()) continue;
-		parts.push(`${key}=${value.value}`);
-	}
-	return parts.join("; ");
+const STORED_COOKIES_KEY = "better-auth_cookie";
+/**
+* The stored cookies, with the session the website's Worker signed in with added: it exchanges a
+* sign-in's one-time token itself and sets only the mirror. Read storage through this alone,
+* since reading it writes the mirror back from storage.
+*/
+function readStoredCookies(storage, key = STORED_COOKIES_KEY) {
+	const stored = storage.getItem(key) || "{}";
+	if (typeof document === "undefined") return stored;
+	const adopted = withCookieHeader(stored, readServerAuthCookie(document.cookie));
+	if (!adopted) return stored;
+	storage.setItem(key, adopted);
+	return adopted;
 }
 /**
 * Read the cross-domain auth cookie from localStorage and return it as a
@@ -70,7 +37,7 @@ function getCookie(cookie) {
 */
 function getAuthCookieHeader() {
 	if (typeof window === "undefined") return "";
-	const cookie = getCookie(localStorage.getItem("better-auth_cookie") || "{}");
+	const cookie = getCookie(readStoredCookies(localStorage));
 	writeServerAuthCookie(cookie);
 	return cookie;
 }
@@ -87,10 +54,7 @@ function crossDomainClient(opts = {}) {
 		getActions(_, $store) {
 			store = $store;
 			return {
-				getCookie: () => {
-					const cookie = storage?.getItem(cookieName);
-					return getCookie(cookie || "{}");
-				},
+				getCookie: () => storage ? getCookie(readStoredCookies(storage, cookieName)) : "",
 				updateSession: () => {
 					$store.notify("$sessionSignal");
 				},
@@ -143,7 +107,7 @@ function crossDomainClient(opts = {}) {
 					options
 				};
 				options = options || {};
-				const cookie = getCookie(storage.getItem(cookieName) || "{}");
+				const cookie = getCookie(readStoredCookies(storage, cookieName));
 				writeServerAuthCookie(cookie);
 				options.credentials = getAuthRequestCredentials(cookie);
 				options.headers = {
@@ -181,6 +145,8 @@ function createCamoxAuthClient(apiUrl) {
 /**
 * Process a `?ott=` one-time token from the URL before the provider mounts.
 * Verifies the token against the API backend and notifies the session store.
+* The Worker exchanges a studio sign-in's token before rendering, so this handles a preview
+* link's, and any token the Worker couldn't exchange.
 *
 * Reports completion and explicit handoff failures instead of silently showing live content.
 * Keeps the handoff marker until SSR confirms authentication on the subsequent load.
@@ -230,7 +196,7 @@ function useProcessOtt(authClient, target, initialAuthenticated = false) {
 				window.location.reload();
 				return;
 			} catch {
-				setError("Preview sign-in failed. The link may have expired or already been used. Run camox preview again for a fresh link.");
+				setError("Preview sign-in failed. The link may have expired or already been used. Restart the dev server for a fresh link.");
 			}
 			setReady(true);
 		})();
@@ -258,7 +224,7 @@ function useProjectUuid() {
 }
 const subscribeToHydration = () => () => {};
 function hasStoredAuthCookie() {
-	return getCookie(localStorage.getItem("better-auth_cookie") || "{}") !== "";
+	return getCookie(readStoredCookies(localStorage)) !== "";
 }
 const noSubscription = () => () => {};
 /**

package/dist/lib/draft-scope.js

@@ -1,9 +1,8 @@
 import { UNNAMED_DEFAULT_LOCALE, localeHeaders } from "./locale-path.js";
-import { getApiClient } from "./api-client.js";
 import { c } from "react/compiler-runtime";
 import * as React from "react";
 import { generateUuidv7 } from "@camox/api-contract/ids";
-import { DEVELOPMENT_DRAFT, DRAFT_CREATE_HEADER, DRAFT_HEADER, DRAFT_SEARCH_PARAM } from "@camox/api-contract/drafts";
+import { DRAFT_CREATE_HEADER, DRAFT_HEADER, DRAFT_SEARCH_PARAM } from "@camox/api-contract/drafts";
 import { LIVE_KEY_SCOPE, scopeOfKey } from "@camox/api-contract/query-keys";
 
 //#region src/lib/draft-scope.ts
@@ -17,22 +16,14 @@ function withoutDraft(href) {
 	url.searchParams.delete(DRAFT_SEARCH_PARAM);
 	return url.href;
 }
-function buildIsDevelopmentMode() {
-	return typeof __CAMOX_DEVELOPMENT_DRAFT__ !== "undefined" && __CAMOX_DEVELOPMENT_DRAFT__;
-}
-function createDraftScope({ queryClient, browser, developmentMode = buildIsDevelopmentMode(), loadDevelopmentDraftId = async (projectId) => (await getApiClient().drafts.get({ projectId }))?.id }) {
-	let current = developmentMode ? DEVELOPMENT_DRAFT : null;
+function createDraftScope({ queryClient, browser }) {
+	let current = null;
 	let locale = UNNAMED_DEFAULT_LOCALE;
 	let pending = null;
-	let developmentDraftId;
 	let adoptedRender = false;
 	const listeners = /* @__PURE__ */ new Set();
 	const noticeListeners = /* @__PURE__ */ new Set();
 	const pendingNotices = [];
-	const draftOfRender = (rendered) => {
-		if (!developmentMode) return rendered.draftId ?? null;
-		return rendered.refusedDraft ? null : DEVELOPMENT_DRAFT;
-	};
 	const notify = (move) => {
 		for (const listener of listeners) listener({
 			draftId: current,
@@ -75,7 +66,7 @@ function createDraftScope({ queryClient, browser, developmentMode = buildIsDevel
 			},
 			settle: noop
 		};
-		if (!contentWrite || developmentMode) return {
+		if (!contentWrite) return {
 			headers: inLocale,
 			settle: noop
 		};
@@ -102,7 +93,6 @@ function createDraftScope({ queryClient, browser, developmentMode = buildIsDevel
 	return {
 		current: () => current,
 		locale: () => locale,
-		developmentMode,
 		subscribe(listener) {
 			listeners.add(listener);
 			return () => listeners.delete(listener);
@@ -114,7 +104,6 @@ function createDraftScope({ queryClient, browser, developmentMode = buildIsDevel
 			return true;
 		},
 		hrefFor(to, { from, draft } = {}) {
-			if (developmentMode) return to;
 			const base = new URL(from ?? browser?.location.href ?? "http://camox.local");
 			const target = new URL(to, base);
 			if (target.origin !== base.origin) return to;
@@ -131,7 +120,7 @@ function createDraftScope({ queryClient, browser, developmentMode = buildIsDevel
 				replaceUrl(null);
 				if (rendered.refusedDraft.notice) report(rendered.refusedDraft.notice);
 			}
-			const next = draftOfRender(rendered);
+			const next = rendered.draftId ?? null;
 			if (next !== null) pending = null;
 			const firstRender = !adoptedRender;
 			adoptedRender = true;
@@ -149,7 +138,6 @@ function createDraftScope({ queryClient, browser, developmentMode = buildIsDevel
 		},
 		leave(ended, { notice = false } = {}) {
 			queryClient.invalidateQueries({ queryKey: ["camox"] });
-			if (developmentMode) return false;
 			pending = null;
 			current = null;
 			replaceUrl(null);
@@ -158,19 +146,11 @@ function createDraftScope({ queryClient, browser, developmentMode = buildIsDevel
 				...ended
 			});
 			notify("left");
-			return true;
 		},
 		onNotice(listener) {
 			noticeListeners.add(listener);
 			for (const notice of pendingNotices.splice(0)) listener(notice);
 			return () => noticeListeners.delete(listener);
-		},
-		async keyScopeOfDraft(draftId, projectId) {
-			if (current !== DEVELOPMENT_DRAFT) return draftId;
-			developmentDraftId ??= loadDevelopmentDraftId(projectId).catch(() => {
-				developmentDraftId = void 0;
-			});
-			return draftId === await developmentDraftId ? DEVELOPMENT_DRAFT : draftId;
 		}
 	};
 }

package/dist/lib/preview-handoff.js

@@ -6,7 +6,7 @@ function validatePreviewTarget(raw, target) {
 		const expected = JSON.parse(raw);
 		if (expected.projectUuid === target.projectUuid && typeof expected.apiUrl === "string" && expected.apiUrl.replace(/\/+$/, "") === target.apiUrl.replace(/\/+$/, "")) return null;
 	} catch {}
-	return "Preview destination does not match the CLI project or backend. Check --cwd and --url, then run camox preview again.";
+	return "This sign-in link is for another project or backend. Open the one your dev server printed.";
 }
 
 //#endregion

package/dist/lib/server-auth-cookie.js

@@ -1,21 +1,33 @@
 //#region src/lib/server-auth-cookie.ts
 const SERVER_AUTH_COOKIE_NAME = "camox_auth_cookie";
+/** How long the mirror lasts. The API still refuses a session that expired before it. */
+const SERVER_AUTH_COOKIE_MAX_AGE = 2592e3;
 function buildClearServerAuthCookieHeader() {
 	return `${SERVER_AUTH_COOKIE_NAME}=; Path=/; SameSite=Lax; Max-Age=0`;
 }
-/** Forward credentials to the API for validation; cookie presence is not authentication.
-* Cross-domain sessions use the mirror. Same-host sessions (including localhost
-* on different ports) may only have Better Auth's native, HttpOnly cookie.
+/** Sets the mirror to a session, as a `Cookie` header's value. */
+function buildServerAuthCookieHeader(cookie, { secure }) {
+	return `${SERVER_AUTH_COOKIE_NAME}=${encodeURIComponent(cookie)}; Path=/; SameSite=Lax; Max-Age=${SERVER_AUTH_COOKIE_MAX_AGE}${secure ? "; Secure" : ""}`;
+}
+/**
+* The session to forward to the API for validation; cookie presence is not authentication. Only
+* the studio's session counts, which the SDK mirrors into `camox_auth_cookie`. Better Auth's own
+* cookies don't: on a Custom Domain like camox.ai they're the dashboard's session, set for every
+* host (ADR 0028). Mirrored in apps/dispatch/src/previews.ts: keep the two in sync.
 */
 function getServerAuthCookieHeader(headers) {
-	const cookies = (headers.get("Cookie") ?? "").split(";").map((part) => part.trim());
-	const mirror = cookies.find((part) => part.startsWith(`${SERVER_AUTH_COOKIE_NAME}=`));
-	if (mirror) try {
-		const value = decodeURIComponent(mirror.slice(18));
-		if (value) return value;
-	} catch {}
-	return cookies.filter((part) => part.startsWith("better-auth.session_token=") || part.startsWith("__Secure-better-auth.session_token=")).join("; ");
+	return readServerAuthCookie(headers.get("Cookie") ?? "");
+}
+/** The mirror's session in a `Cookie` header's value, or `document.cookie`. */
+function readServerAuthCookie(cookieHeader) {
+	const mirror = cookieHeader.split(";").map((part) => part.trim()).find((part) => part.startsWith(`${SERVER_AUTH_COOKIE_NAME}=`));
+	if (!mirror) return "";
+	try {
+		return decodeURIComponent(mirror.slice(18));
+	} catch {
+		return "";
+	}
 }
 
 //#endregion
-export { SERVER_AUTH_COOKIE_NAME, buildClearServerAuthCookieHeader, getServerAuthCookieHeader };
+export { SERVER_AUTH_COOKIE_NAME, buildClearServerAuthCookieHeader, buildServerAuthCookieHeader, getServerAuthCookieHeader, readServerAuthCookie };

package/dist/lib/stored-auth-cookies.js

@@ -0,0 +1,76 @@
+//#region src/lib/stored-auth-cookies.ts
+function parseSetCookieHeader(header) {
+	const cookieMap = /* @__PURE__ */ new Map();
+	header.split(", ").forEach((cookie) => {
+		const [nameValue, ...attributes] = cookie.split("; ");
+		const [name, value] = nameValue.split("=");
+		const cookieObj = { value };
+		attributes.forEach((attr) => {
+			const [attrName, attrValue] = attr.split("=");
+			cookieObj[attrName.toLowerCase()] = attrValue;
+		});
+		cookieMap.set(name, cookieObj);
+	});
+	return cookieMap;
+}
+function getSetCookie(header, prevCookie) {
+	const parsed = parseSetCookieHeader(header);
+	let toSetCookie = {};
+	parsed.forEach((cookie, key) => {
+		const expiresAt = cookie["expires"];
+		const maxAge = cookie["max-age"];
+		let expires = null;
+		if (expiresAt) expires = new Date(String(expiresAt));
+		else if (maxAge) expires = new Date(Date.now() + Number(maxAge) * 1e3);
+		toSetCookie[key] = {
+			value: cookie["value"],
+			expires: expires ? expires.toISOString() : null
+		};
+	});
+	if (prevCookie) try {
+		toSetCookie = {
+			...JSON.parse(prevCookie),
+			...toSetCookie
+		};
+	} catch {}
+	return JSON.stringify(toSetCookie);
+}
+function getCookie(cookie) {
+	let parsed = {};
+	try {
+		parsed = JSON.parse(cookie);
+	} catch {}
+	const parts = [];
+	for (const [key, value] of Object.entries(parsed)) {
+		if (value.expires && new Date(value.expires) < /* @__PURE__ */ new Date()) continue;
+		parts.push(`${key}=${value.value}`);
+	}
+	return parts.join("; ");
+}
+/**
+* The stored cookies with those of a `Cookie` header's value added, when it holds one they don't:
+* a session the website's Worker signed in with. Null when they hold it already, even expired.
+*/
+function withCookieHeader(stored, header) {
+	let parsed = {};
+	try {
+		parsed = JSON.parse(stored);
+	} catch {}
+	let added = false;
+	for (const pair of header.split("; ")) {
+		const separator = pair.indexOf("=");
+		if (separator <= 0) continue;
+		const name = pair.slice(0, separator);
+		const value = pair.slice(separator + 1);
+		if (parsed[name]?.value === value) continue;
+		parsed[name] = {
+			value,
+			expires: null
+		};
+		added = true;
+	}
+	return added ? JSON.stringify(parsed) : null;
+}
+
+//#endregion
+export { getCookie, getSetCookie, parseSetCookieHeader, withCookieHeader };

package/dist/lib/studio-reads.js

@@ -484,7 +484,7 @@ function createStudioCache({ queryClient, scope, api, runtimeJson = (endpoint, b
 				message,
 				projectId
 			});
-			const keyScope = message.draftId === null ? null : await scope.keyScopeOfDraft(message.draftId, projectId);
+			const keyScope = message.draftId;
 			await Promise.all(message.targets.map((queryKey) => queryClient.invalidateQueries({
 				queryKey,
 				predicate: keyScope === null ? void 0 : (query) => scopeOfKey(query.queryKey) === keyScope

package/dist/lib/use-thread.js

@@ -1,7 +1,6 @@
 import { apiSocketOptions } from "./api-socket.js";
 import { c } from "react/compiler-runtime";
 import * as React from "react";
-import { DEVELOPMENT_DRAFT } from "@camox/api-contract/drafts";
 import { usePartySocket } from "partysocket/react";
 import { EMPTY_THREAD_STATE, THREAD_ENDED_CLOSE_CODE, reduceThreadFrame, threadViewOf } from "@camox/api-contract/threads";
 
@@ -11,10 +10,10 @@ const OPEN = 1;
 /**
 * Follows a thread in a project over its socket, folding Pi's events into the thread's view: the
 * signed-in editor's Live thread when `draftId` is null, or the draft's thread, which `draftId`
-* names as the draft header does (`development` in dev mode). A message is resent with its
+* names. A message is resent with its
 * operation id each time the thread shows itself after the socket opens, until it accepts it,
 * which records it once, or turns it down. A draft's thread that ended with its draft isn't
-* reconnected to, but for a development draft's, which moves on to a new thread. Mount it once
+* reconnected to. Mount it once
 * per project and draft.
 *
 * When the agent on Live hands a request off to a draft it started, the studio that sent a
@@ -25,7 +24,7 @@ const OPEN = 1;
 * of only, so that the studio follows the agent; teammates' runs leave it where it is.
 */
 function useThread(apiUrl, projectId, draftId, t0) {
-	const $ = c(47);
+	const $ = c(46);
 	let t1;
 	if ($[0] !== t0) {
 		t1 = t0 === void 0 ? {} : t0;
@@ -71,17 +70,14 @@ function useThread(apiUrl, projectId, draftId, t0) {
 		basePath: draftId ? `threads/draft/${projectId}/${draftId}` : `threads/live/${projectId}`,
 		maxEnqueuedMessages: 0,
 		shouldReconnectOnClose: _temp,
-		onClose(event_0) {
-			if (event_0.code === THREAD_ENDED_CLOSE_CODE && draftId === DEVELOPMENT_DRAFT) socket.reconnect();
-		},
 		onOpen() {
 			shown.current = false;
 		},
-		onMessage(event_1) {
-			if (typeof event_1.data !== "string") return;
+		onMessage(event_0) {
+			if (typeof event_0.data !== "string") return;
 			let frame;
 			try {
-				frame = JSON.parse(event_1.data);
+				frame = JSON.parse(event_0.data);
 			} catch {
 				return;
 			}
@@ -156,10 +152,10 @@ function useThread(apiUrl, projectId, draftId, t0) {
 	let t9;
 	if ($[23] !== socket || $[24] !== unaccepted) {
 		t9 = () => {
-			for (const [operationId_2, text] of unaccepted) transmit(socket, {
+			for (const [operationId_2, message] of unaccepted) transmit(socket, {
 				type: "send",
 				operationId: operationId_2,
-				text
+				...message
 			});
 		};
 		$[23] = socket;
@@ -184,6 +180,7 @@ function useThread(apiUrl, projectId, draftId, t0) {
 	} else t11 = $[30];
 	React.useEffect(t10, t11);
 	let t12;
+	let t13;
 	if ($[31] !== socket) {
 		t12 = () => {
 			const resync = () => {
@@ -192,44 +189,47 @@ function useThread(apiUrl, projectId, draftId, t0) {
 			document.addEventListener("visibilitychange", resync);
 			return () => document.removeEventListener("visibilitychange", resync);
 		};
+		t13 = [socket];
 		$[31] = socket;
 		$[32] = t12;
-	} else t12 = $[32];
-	let t13;
-	if ($[33] !== socket) {
-		t13 = [socket];
-		$[33] = socket;
-		$[34] = t13;
-	} else t13 = $[34];
+		$[33] = t13;
+	} else {
+		t12 = $[32];
+		t13 = $[33];
+	}
 	React.useEffect(t12, t13);
 	let t14;
-	if ($[35] !== sent || $[36] !== socket) {
-		t14 = (text_0) => {
+	if ($[34] !== sent || $[35] !== socket) {
+		t14 = (text, where) => {
 			const operationId_3 = crypto.randomUUID();
+			const message_0 = where ? {
+				text,
+				where
+			} : { text };
 			sent.add(operationId_3);
 			setError(void 0);
-			setUnaccepted((current_3) => new Map(current_3).set(operationId_3, text_0));
+			setUnaccepted((current_3) => new Map(current_3).set(operationId_3, message_0));
 			transmit(socket, {
 				type: "send",
 				operationId: operationId_3,
-				text: text_0
+				...message_0
 			});
 		};
-		$[35] = sent;
-		$[36] = socket;
-		$[37] = t14;
-	} else t14 = $[37];
+		$[34] = sent;
+		$[35] = socket;
+		$[36] = t14;
+	} else t14 = $[36];
 	const send = t14;
 	let t15;
-	if ($[38] !== socket) {
+	if ($[37] !== socket) {
 		t15 = () => transmit(socket, { type: "stop" });
-		$[38] = socket;
-		$[39] = t15;
-	} else t15 = $[39];
+		$[37] = socket;
+		$[38] = t15;
+	} else t15 = $[38];
 	const stop = t15;
 	const t16 = unaccepted.size > 0;
 	let t17;
-	if ($[40] !== error || $[41] !== send || $[42] !== stop || $[43] !== t16 || $[44] !== touched || $[45] !== view) {
+	if ($[39] !== error || $[40] !== send || $[41] !== stop || $[42] !== t16 || $[43] !== touched || $[44] !== view) {
 		t17 = {
 			view,
 			sending: t16,
@@ -238,14 +238,14 @@ function useThread(apiUrl, projectId, draftId, t0) {
 			error,
 			touched
 		};
-		$[40] = error;
-		$[41] = send;
-		$[42] = stop;
-		$[43] = t16;
-		$[44] = touched;
-		$[45] = view;
-		$[46] = t17;
-	} else t17 = $[46];
+		$[39] = error;
+		$[40] = send;
+		$[41] = stop;
+		$[42] = t16;
+		$[43] = touched;
+		$[44] = view;
+		$[45] = t17;
+	} else t17 = $[45];
 	return t17;
 }
 function _temp2(count) {

package/dist/package.js

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "0.58.1";
+var version = "0.60.2";
 
 //#endregion
 export { version };