omnara 0.1.0

package/README.md

@@ -0,0 +1,20 @@
+# Omnara CLI
+
+The Omnara CLI launches a coding agent that streams its activity to your Omnara dashboard at [omnara.com](https://omnara.com). Sign in once, start the orchestrator from your terminal, and follow along (or respond) from the web or mobile apps. You can also attach a real-time voice worker to any active session.
+
+## Quick Start
+
+```bash
+npm install -g omnara
+
+# Start the synced coding agent experience
+omnara
+```
+
+Running `omnara` bootstraps the agent orchestrator. The first launch prompts you to authenticate in the browser; after that the CLI reconnects automatically.
+
+## Helpful Commands
+
+- `omnara auth login|status|logout` — manage the cached Omnara credentials used by the CLI.
+- `omnara agent voice --session-id <id>` — invite the Omnara voice worker into an existing agent session so you can talk to your coder in real time.
+- `omnara agent orchestrator` — launch the orchestrator explicitly when scripting or running in headless environments.

package/bin/omnara.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+
+const fs = require('fs');
+const path = require('path');
+
+const distEntry = path.join(__dirname, '..', 'dist', 'cli.js');
+
+if (!fs.existsSync(distEntry)) {
+  console.error(
+    'Could not find the compiled CLI at dist/cli.js. ' +
+      'Run `npm install` followed by `npm run build` inside the omnara package.',
+  );
+  process.exit(1);
+}
+
+require(distEntry);

package/dist/auth/auth-provider.d.ts

@@ -0,0 +1,18 @@
+import { CredentialsStore } from './credentials-store';
+import { type AuthContext } from './credential-manager';
+export interface AuthProviderOptions {
+    store: CredentialsStore;
+    backendUrl: string;
+    frontendUrl?: string;
+    logger?: Console;
+}
+export declare class AuthProvider {
+    private readonly options;
+    private cached;
+    private readonly backendUrl;
+    constructor(options: AuthProviderOptions);
+    getAuthContext(): Promise<AuthContext>;
+    getAccessToken(): Promise<string>;
+    private loadAuthContext;
+}
+export declare function createAuthProvider(options: AuthProviderOptions): Promise<AuthProvider>;

package/dist/auth/auth-provider.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthProvider = void 0;
+exports.createAuthProvider = createAuthProvider;
+const credential_manager_1 = require("./credential-manager");
+const login_flow_1 = require("./login-flow");
+const api_client_1 = require("../http/api-client");
+class AuthProvider {
+    constructor(options) {
+        this.options = options;
+        this.cached = null;
+        this.backendUrl = (0, api_client_1.normalizeBaseUrl)(options.backendUrl);
+    }
+    async getAuthContext() {
+        const auth = await this.loadAuthContext();
+        this.cached = auth;
+        return auth;
+    }
+    async getAccessToken() {
+        const auth = await this.getAuthContext();
+        return auth.accessToken;
+    }
+    async loadAuthContext() {
+        try {
+            return await (0, credential_manager_1.ensureAuthContext)(this.options.store, this.backendUrl);
+        }
+        catch (error) {
+            if (!shouldAttemptLogin(error)) {
+                throw error;
+            }
+            this.options.logger?.log('CLI login required. Opening browser flow…');
+            await (0, login_flow_1.performVerificationLogin)({
+                backendUrlOption: this.backendUrl,
+                frontendUrlOption: this.options.frontendUrl,
+                store: this.options.store,
+            });
+            return await (0, credential_manager_1.ensureAuthContext)(this.options.store, this.backendUrl);
+        }
+    }
+}
+exports.AuthProvider = AuthProvider;
+function shouldAttemptLogin(error) {
+    if (!(error instanceof Error)) {
+        return false;
+    }
+    const message = error.message.toLowerCase();
+    return (message.includes('no credentials found') ||
+        message.includes('run `omnara auth login` first') ||
+        message.includes('refresh token expired') ||
+        message.includes('refresh token unavailable') ||
+        message.includes('access token expired'));
+}
+async function createAuthProvider(options) {
+    const provider = new AuthProvider(options);
+    await provider.getAuthContext();
+    return provider;
+}
+//# sourceMappingURL=auth-provider.js.map

package/dist/auth/auth-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-provider.js","sourceRoot":"","sources":["../../src/auth/auth-provider.ts"],"names":[],"mappings":";;;AAiEA,gDAIC;AAlED,6DAA2E;AAC3E,6CAAwD;AACxD,mDAAsD;AAStD,MAAa,YAAY;IAIvB,YAA6B,OAA4B;QAA5B,YAAO,GAAP,OAAO,CAAqB;QAHjD,WAAM,GAAuB,IAAI,CAAC;QAIxC,IAAI,CAAC,UAAU,GAAG,IAAA,6BAAgB,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,eAAe;QAC3B,IAAI,CAAC;YACH,OAAO,MAAM,IAAA,sCAAiB,EAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,2CAA2C,CAAC,CAAC;YACtE,MAAM,IAAA,qCAAwB,EAAC;gBAC7B,gBAAgB,EAAE,IAAI,CAAC,UAAU;gBACjC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;gBAC3C,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;aAC1B,CAAC,CAAC;YACH,OAAO,MAAM,IAAA,sCAAiB,EAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;CACF;AAnCD,oCAmCC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IAC5C,OAAO,CACL,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QACxC,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAAC;QACjD,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QACzC,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC;QAC7C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CACzC,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,kBAAkB,CAAC,OAA4B;IACnE,MAAM,QAAQ,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAC;IAChC,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/auth/cli-auth-service.d.ts

@@ -0,0 +1,18 @@
+import { ApiClient } from '../http/api-client';
+export interface CliAuthSession {
+    sessionId: string;
+    verificationUri: string;
+    verificationUriComplete: string;
+    expiresIn: number;
+    pollInterval: number;
+}
+export interface ExchangeCliCodeResult {
+    accessToken: string;
+    accessTokenExpiresIn: number;
+    refreshToken: string;
+    refreshTokenExpiresIn: number;
+    relayWsPath: string;
+    relayHeartbeatIntervalSec: number;
+}
+export declare function createCliAuthSession(client: ApiClient, frontendUrl?: string): Promise<CliAuthSession>;
+export declare function exchangeCliCode(client: ApiClient, sessionId: string, code: string): Promise<ExchangeCliCodeResult>;

package/dist/auth/cli-auth-service.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCliAuthSession = createCliAuthSession;
+exports.exchangeCliCode = exchangeCliCode;
+async function createCliAuthSession(client, frontendUrl) {
+    const body = frontendUrl ? { frontend_url: frontendUrl } : {};
+    const wire = await client.postJson('/api/v1/cli-auth/session', body);
+    return {
+        sessionId: wire.session_id,
+        verificationUri: wire.verification_uri,
+        verificationUriComplete: wire.verification_uri_complete,
+        expiresIn: wire.expires_in,
+        pollInterval: wire.poll_interval,
+    };
+}
+async function exchangeCliCode(client, sessionId, code) {
+    const wire = await client.postJson('/api/v1/cli-auth/exchange', {
+        session_id: sessionId,
+        code,
+    });
+    return {
+        accessToken: wire.access_token,
+        accessTokenExpiresIn: wire.access_token_expires_in,
+        refreshToken: wire.refresh_token,
+        refreshTokenExpiresIn: wire.refresh_token_expires_in,
+        relayWsPath: wire.relay_ws_path,
+        relayHeartbeatIntervalSec: wire.relay_heartbeat_interval_sec,
+    };
+}
+//# sourceMappingURL=cli-auth-service.js.map

package/dist/auth/cli-auth-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-auth-service.js","sourceRoot":"","sources":["../../src/auth/cli-auth-service.ts"],"names":[],"mappings":";;AA6CA,oDAgBC;AAED,0CAoBC;AAtCM,KAAK,UAAU,oBAAoB,CACxC,MAAiB,EACjB,WAAoB;IAEpB,MAAM,IAAI,GAA6B,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAChC,0BAA0B,EAC1B,IAAI,CACL,CAAC;IACF,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,UAAU;QAC1B,eAAe,EAAE,IAAI,CAAC,gBAAgB;QACtC,uBAAuB,EAAE,IAAI,CAAC,yBAAyB;QACvD,SAAS,EAAE,IAAI,CAAC,UAAU;QAC1B,YAAY,EAAE,IAAI,CAAC,aAAa;KACjC,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,eAAe,CACnC,MAAiB,EACjB,SAAiB,EACjB,IAAY;IAEZ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAChC,2BAA2B,EAC3B;QACE,UAAU,EAAE,SAAS;QACrB,IAAI;KACL,CACF,CAAC;IACF,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,oBAAoB,EAAE,IAAI,CAAC,uBAAuB;QAClD,YAAY,EAAE,IAAI,CAAC,aAAa;QAChC,qBAAqB,EAAE,IAAI,CAAC,wBAAwB;QACpD,WAAW,EAAE,IAAI,CAAC,aAAa;QAC/B,yBAAyB,EAAE,IAAI,CAAC,4BAA4B;KAC7D,CAAC;AACJ,CAAC"}

package/dist/auth/credential-manager.d.ts

@@ -0,0 +1,6 @@
+import { CredentialsStore, type StoredCredentials } from './credentials-store';
+export interface AuthContext {
+    credentials: StoredCredentials;
+    accessToken: string;
+}
+export declare function ensureAuthContext(store: CredentialsStore, backendUrl: string): Promise<AuthContext>;

package/dist/auth/credential-manager.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureAuthContext = ensureAuthContext;
+const supabase_client_1 = require("./supabase-client");
+const supabase_config_1 = require("./supabase-config");
+const EXPIRY_BUFFER_MS = 60000; // refresh tokens one minute before expiry
+async function ensureAuthContext(store, backendUrl) {
+    const credentials = await store.load();
+    if (!credentials) {
+        throw new Error('No credentials found. Run `omnara auth login` first.');
+    }
+    if (!credentials.refreshToken) {
+        throw new Error('Refresh token unavailable. Please run `omnara auth login`.');
+    }
+    if (!credentials.accessToken) {
+        return await refreshWithStoredToken(store, credentials, backendUrl, 'No access token stored.');
+    }
+    if (!isExpiring(credentials.accessTokenExpiresAt, EXPIRY_BUFFER_MS)) {
+        return { credentials, accessToken: credentials.accessToken };
+    }
+    return await refreshWithStoredToken(store, credentials, backendUrl, 'Access token expired.');
+}
+async function refreshWithStoredToken(store, credentials, backendUrl, reason) {
+    const refreshToken = credentials.refreshToken;
+    if (!refreshToken) {
+        throw new Error(`${reason} Refresh token unavailable. Please run \`omnara auth login\`.`);
+    }
+    if (credentials.refreshTokenExpiresAt && isExpiring(credentials.refreshTokenExpiresAt, 0)) {
+        throw new Error('Refresh token expired. Please run `omnara auth login`.');
+    }
+    const supabaseConfig = await (0, supabase_config_1.getSupabaseAuthConfig)(backendUrl);
+    const supabase = (0, supabase_client_1.buildSupabaseClient)(supabaseConfig);
+    const { data, error } = await supabase.auth.refreshSession({ refresh_token: refreshToken });
+    if (error || !data?.session) {
+        throw new Error(`${reason} Failed to refresh Supabase session: ${error?.message ?? 'unknown error'}.`);
+    }
+    const updated = applySession(credentials, data.session);
+    await store.save(updated);
+    if (!updated.accessToken) {
+        throw new Error('Supabase refresh completed without an access token.');
+    }
+    return { credentials: updated, accessToken: updated.accessToken };
+}
+function isExpiring(expiresAtIso, bufferMs) {
+    if (!expiresAtIso) {
+        return true;
+    }
+    const timestamp = Date.parse(expiresAtIso);
+    if (Number.isNaN(timestamp)) {
+        return true;
+    }
+    return timestamp - bufferMs <= Date.now();
+}
+function applySession(credentials, session) {
+    const expiresAt = deriveAccessExpiry(session);
+    return {
+        ...credentials,
+        accessToken: session.access_token,
+        accessTokenExpiresAt: expiresAt,
+        refreshToken: session.refresh_token ?? credentials.refreshToken,
+        refreshTokenExpiresAt: credentials.refreshTokenExpiresAt,
+    };
+}
+function deriveAccessExpiry(session) {
+    if (session.expires_at) {
+        return new Date(session.expires_at * 1000).toISOString();
+    }
+    if (session.expires_in) {
+        return new Date(Date.now() + session.expires_in * 1000).toISOString();
+    }
+    return undefined;
+}
+//# sourceMappingURL=credential-manager.js.map

package/dist/auth/credential-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-manager.js","sourceRoot":"","sources":["../../src/auth/credential-manager.ts"],"names":[],"mappings":";;AAaA,8CAsBC;AAhCD,uDAAwD;AACxD,uDAA0D;AAE1D,MAAM,gBAAgB,GAAG,KAAM,CAAC,CAAC,0CAA0C;AAOpE,KAAK,UAAU,iBAAiB,CACrC,KAAuB,EACvB,UAAkB;IAElB,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;QAC7B,OAAO,MAAM,sBAAsB,CAAC,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,yBAAyB,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE,CAAC;IAC/D,CAAC;IAED,OAAO,MAAM,sBAAsB,CAAC,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,uBAAuB,CAAC,CAAC;AAC/F,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,KAAuB,EACvB,WAA8B,EAC9B,UAAkB,EAClB,MAAc;IAEd,MAAM,YAAY,GAAG,WAAW,CAAC,YAAY,CAAC;IAC9C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,+DAA+D,CAAC,CAAC;IAC5F,CAAC;IAED,IAAI,WAAW,CAAC,qBAAqB,IAAI,UAAU,CAAC,WAAW,CAAC,qBAAqB,EAAE,CAAC,CAAC,EAAE,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,IAAA,uCAAqB,EAAC,UAAU,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,IAAA,qCAAmB,EAAC,cAAc,CAAC,CAAC;IACrD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC;IAC5F,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,wCAAwC,KAAK,EAAE,OAAO,IAAI,eAAe,GAAG,CACtF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAExD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1B,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,UAAU,CAAC,YAAgC,EAAE,QAAgB;IACpE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,SAAS,GAAG,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,YAAY,CAAC,WAA8B,EAAE,OAAgB;IACpE,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAE9C,OAAO;QACL,GAAG,WAAW;QACd,WAAW,EAAE,OAAO,CAAC,YAAY;QACjC,oBAAoB,EAAE,SAAS;QAC/B,YAAY,EAAE,OAAO,CAAC,aAAa,IAAI,WAAW,CAAC,YAAY;QAC/D,qBAAqB,EAAE,WAAW,CAAC,qBAAqB;KACzD,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/auth/credentials-store.d.ts

@@ -0,0 +1,14 @@
+export interface StoredCredentials {
+    accessToken?: string;
+    accessTokenExpiresAt?: string;
+    refreshToken?: string;
+    refreshTokenExpiresAt?: string;
+}
+export declare const DEFAULT_CREDENTIALS_PATH: string;
+export declare class CredentialsStore {
+    private readonly filePath;
+    constructor(filePath?: string);
+    load(): Promise<StoredCredentials | null>;
+    save(credentials: StoredCredentials): Promise<void>;
+    clear(): Promise<void>;
+}

package/dist/auth/credentials-store.js

@@ -0,0 +1,75 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialsStore = exports.DEFAULT_CREDENTIALS_PATH = void 0;
+const promises_1 = __importDefault(require("fs/promises"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const DEFAULT_DIR = path_1.default.join(os_1.default.homedir(), '.omnara');
+exports.DEFAULT_CREDENTIALS_PATH = path_1.default.join(DEFAULT_DIR, 'credentials.json');
+const DEFAULT_FILE_MODE = 0o600;
+const DEFAULT_DIR_MODE = 0o700;
+function isStoredCredentials(value) {
+    return Boolean(value) && typeof value === 'object';
+}
+class CredentialsStore {
+    constructor(filePath = exports.DEFAULT_CREDENTIALS_PATH) {
+        this.filePath = filePath;
+    }
+    async load() {
+        try {
+            const raw = await promises_1.default.readFile(this.filePath, 'utf8');
+            const parsed = JSON.parse(raw);
+            if (!isStoredCredentials(parsed)) {
+                throw new Error('File does not contain valid credentials data');
+            }
+            return parsed;
+        }
+        catch (error) {
+            if (isFileNotFound(error)) {
+                return null;
+            }
+            throw new Error(`Failed to read credentials from ${this.filePath}: ${extractErrorMessage(error)}`);
+        }
+    }
+    async save(credentials) {
+        const payload = {
+            accessToken: credentials.accessToken,
+            accessTokenExpiresAt: credentials.accessTokenExpiresAt,
+            refreshToken: credentials.refreshToken,
+            refreshTokenExpiresAt: credentials.refreshTokenExpiresAt,
+        };
+        await promises_1.default.mkdir(path_1.default.dirname(this.filePath), { recursive: true, mode: DEFAULT_DIR_MODE });
+        const tempPath = `${this.filePath}.tmp`;
+        const serialized = JSON.stringify(payload, null, 2);
+        await promises_1.default.writeFile(tempPath, serialized, { mode: DEFAULT_FILE_MODE });
+        await promises_1.default.chmod(tempPath, DEFAULT_FILE_MODE);
+        await promises_1.default.rename(tempPath, this.filePath);
+    }
+    async clear() {
+        try {
+            await promises_1.default.unlink(this.filePath);
+        }
+        catch (error) {
+            if (!isFileNotFound(error)) {
+                throw new Error(`Failed to remove credentials file ${this.filePath}: ${extractErrorMessage(error)}`);
+            }
+        }
+    }
+}
+exports.CredentialsStore = CredentialsStore;
+function isFileNotFound(error) {
+    return Boolean(error &&
+        typeof error === 'object' &&
+        'code' in error &&
+        error.code === 'ENOENT');
+}
+function extractErrorMessage(error) {
+    if (error instanceof Error && error.message) {
+        return error.message;
+    }
+    return String(error);
+}
+//# sourceMappingURL=credentials-store.js.map

package/dist/auth/credentials-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-store.js","sourceRoot":"","sources":["../../src/auth/credentials-store.ts"],"names":[],"mappings":";;;;;;AAAA,2DAA6B;AAC7B,4CAAoB;AACpB,gDAAwB;AASxB,MAAM,WAAW,GAAG,cAAI,CAAC,IAAI,CAAC,YAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC1C,QAAA,wBAAwB,GAAG,cAAI,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;AACnF,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAChC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,SAAS,mBAAmB,CAAC,KAAc;IACzC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;AACrD,CAAC;AAED,MAAa,gBAAgB;IAC3B,YAA6B,WAAmB,gCAAwB;QAA3C,aAAQ,GAAR,QAAQ,CAAmC;IAAG,CAAC;IAE5E,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;YAC1C,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,CAAC,QAAQ,KAAK,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAClF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,WAA8B;QACvC,MAAM,OAAO,GAAsB;YACjC,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,oBAAoB,EAAE,WAAW,CAAC,oBAAoB;YACtD,YAAY,EAAE,WAAW,CAAC,YAAY;YACtC,qBAAqB,EAAE,WAAW,CAAC,qBAAqB;SACzD,CAAC;QAEF,MAAM,kBAAE,CAAC,KAAK,CAAC,cAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAEzF,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,QAAQ,MAAM,CAAC;QACxC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACpD,MAAM,kBAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACtE,MAAM,kBAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QAC5C,MAAM,kBAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC;YACH,MAAM,kBAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,CAAC,QAAQ,KAAK,mBAAmB,CAAC,KAAK,CAAC,EAAE,CACpF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAjDD,4CAiDC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,CACZ,KAAK;QACH,OAAO,KAAK,KAAK,QAAQ;QACzB,MAAM,IAAI,KAAK;QACd,KAA2B,CAAC,IAAI,KAAK,QAAQ,CACjD,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC"}

package/dist/auth/login-flow.d.ts

@@ -0,0 +1,15 @@
+import { CredentialsStore, type StoredCredentials } from './credentials-store';
+import { type ExchangeCliCodeResult } from './cli-auth-service';
+interface LoginOptions {
+    backendUrlOption?: string;
+    frontendUrlOption?: string;
+    store: CredentialsStore;
+}
+export declare function performVerificationLogin({ backendUrlOption, frontendUrlOption, store, }: LoginOptions): Promise<StoredCredentials>;
+export declare function resolveBackendUrl(option?: string): string;
+export declare function resolveFrontendUrl(option?: string): string;
+export declare function mergeCredentialsAfterExchange(args: {
+    exchange: ExchangeCliCodeResult;
+}): StoredCredentials;
+export declare function formatDuration(ms: number): string;
+export {};

package/dist/auth/login-flow.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.performVerificationLogin = performVerificationLogin;
+exports.resolveBackendUrl = resolveBackendUrl;
+exports.resolveFrontendUrl = resolveFrontendUrl;
+exports.mergeCredentialsAfterExchange = mergeCredentialsAfterExchange;
+exports.formatDuration = formatDuration;
+const child_process_1 = require("child_process");
+const api_client_1 = require("../http/api-client");
+const prompt_1 = require("../utils/prompt");
+const cli_auth_service_1 = require("./cli-auth-service");
+async function performVerificationLogin({ backendUrlOption, frontendUrlOption, store, }) {
+    const backendUrl = resolveBackendUrl(backendUrlOption);
+    const frontendUrl = resolveFrontendUrl(frontendUrlOption);
+    const client = new api_client_1.ApiClient({ baseUrl: backendUrl });
+    console.log('\nAuthentication required. Launching browser flow…');
+    const session = await (0, cli_auth_service_1.createCliAuthSession)(client, frontendUrl);
+    printSessionInstructions(session);
+    tryOpenBrowser(session.verificationUriComplete);
+    while (true) {
+        const input = await (0, prompt_1.prompt)('\nEnter the 6-digit verification code: ');
+        const cleaned = input.trim();
+        if (!/^[0-9]{6}$/.test(cleaned)) {
+            console.log('Codes must be exactly six digits.');
+            continue;
+        }
+        try {
+            const exchange = await (0, cli_auth_service_1.exchangeCliCode)(client, session.sessionId, cleaned);
+            const updated = mergeCredentialsAfterExchange({
+                exchange,
+            });
+            await store.save(updated);
+            console.log('\nLogin successful. Credentials saved.');
+            return updated;
+        }
+        catch (error) {
+            if (error instanceof api_client_1.ApiError && error.status === 401) {
+                console.log('That code was not recognized. Paste the code shown in the browser.');
+                continue;
+            }
+            throw error;
+        }
+    }
+}
+const DEFAULT_BACKEND_URL = 'https://omnara-voice.onrender.com/';
+const DEFAULT_FRONTEND_URL = 'https://voice.omnara.com/';
+function resolveBackendUrl(option) {
+    const candidate = option ?? process.env.OMNARA_BACKEND_URL ?? DEFAULT_BACKEND_URL;
+    return (0, api_client_1.normalizeBaseUrl)(candidate);
+}
+function resolveFrontendUrl(option) {
+    const candidate = option ?? process.env.OMNARA_FRONTEND_URL ?? DEFAULT_FRONTEND_URL;
+    return (0, api_client_1.normalizeBaseUrl)(candidate);
+}
+function mergeCredentialsAfterExchange(args) {
+    const now = Date.now();
+    const accessExpiresAt = new Date(now + args.exchange.accessTokenExpiresIn * 1000).toISOString();
+    const refreshExpiresAt = new Date(now + args.exchange.refreshTokenExpiresIn * 1000).toISOString();
+    return {
+        accessToken: args.exchange.accessToken,
+        accessTokenExpiresAt: accessExpiresAt,
+        refreshToken: args.exchange.refreshToken,
+        refreshTokenExpiresAt: refreshExpiresAt,
+    };
+}
+function formatDuration(ms) {
+    const totalSeconds = Math.round(ms / 1000);
+    if (totalSeconds < 60) {
+        return `${totalSeconds}s`;
+    }
+    const totalMinutes = Math.round(totalSeconds / 60);
+    if (totalMinutes < 60) {
+        const seconds = totalSeconds % 60;
+        return seconds > 0 ? `${totalMinutes}m ${seconds}s` : `${totalMinutes}m`;
+    }
+    const totalHours = Math.floor(totalMinutes / 60);
+    const minutes = totalMinutes % 60;
+    if (totalHours < 48) {
+        return minutes > 0 ? `${totalHours}h ${minutes}m` : `${totalHours}h`;
+    }
+    const totalDays = Math.floor(totalHours / 24);
+    const hours = totalDays % 24;
+    return hours > 0 ? `${totalDays}d ${hours}h` : `${totalDays}d`;
+}
+function printSessionInstructions(session) {
+    console.log('\n1. Open the following URL in your browser:');
+    console.log(`   ${session.verificationUriComplete}`);
+    console.log('\n2. Sign in (if prompted) and click “Authorize CLI access”.');
+    console.log(`   This link expires in about ${formatDuration(session.expiresIn * 1000)}.`);
+    console.log('\n3. Return here and paste the 6-digit code when prompted.');
+}
+function tryOpenBrowser(url) {
+    const command = process.platform === 'darwin'
+        ? 'open'
+        : process.platform === 'win32'
+            ? 'cmd'
+            : 'xdg-open';
+    const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
+    try {
+        const child = (0, child_process_1.spawn)(command, args, { stdio: 'ignore', detached: true });
+        child.unref();
+    }
+    catch {
+        // Ignore failures; user can open manually.
+    }
+}
+//# sourceMappingURL=login-flow.js.map

package/dist/auth/login-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-flow.js","sourceRoot":"","sources":["../../src/auth/login-flow.ts"],"names":[],"mappings":";;AAkBA,4DAwCC;AAKD,8CAGC;AAED,gDAGC;AAED,sEAaC;AAED,wCAqBC;AA7GD,iDAAsC;AAEtC,mDAA2E;AAE3E,4CAAyC;AACzC,yDAK4B;AAQrB,KAAK,UAAU,wBAAwB,CAAC,EAC7C,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,GACQ;IACb,MAAM,UAAU,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IACvD,MAAM,WAAW,GAAG,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,sBAAS,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IAEtD,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAElE,MAAM,OAAO,GAAG,MAAM,IAAA,uCAAoB,EAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAChE,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClC,cAAc,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAEhD,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,MAAM,IAAA,eAAM,EAAC,yCAAyC,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAE7B,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;YACjD,SAAS;QACX,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAA,kCAAe,EAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC3E,MAAM,OAAO,GAAG,6BAA6B,CAAC;gBAC5C,QAAQ;aACT,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;YACtD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACtD,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;gBAClF,SAAS;YACX,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,mBAAmB,GAAG,oCAAoC,CAAC;AACjE,MAAM,oBAAoB,GAAG,2BAA2B,CAAC;AAEzD,SAAgB,iBAAiB,CAAC,MAAe;IAC/C,MAAM,SAAS,GAAG,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,mBAAmB,CAAC;IAClF,OAAO,IAAA,6BAAgB,EAAC,SAAS,CAAC,CAAC;AACrC,CAAC;AAED,SAAgB,kBAAkB,CAAC,MAAe;IAChD,MAAM,SAAS,GAAG,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,oBAAoB,CAAC;IACpF,OAAO,IAAA,6BAAgB,EAAC,SAAS,CAAC,CAAC;AACrC,CAAC;AAED,SAAgB,6BAA6B,CAAC,IAE7C;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,eAAe,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAChG,MAAM,gBAAgB,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAElG,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW;QACtC,oBAAoB,EAAE,eAAe;QACrC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY;QACxC,qBAAqB,EAAE,gBAAgB;KACxC,CAAC;AACJ,CAAC;AAED,SAAgB,cAAc,CAAC,EAAU;IACvC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3C,IAAI,YAAY,GAAG,EAAE,EAAE,CAAC;QACtB,OAAO,GAAG,YAAY,GAAG,CAAC;IAC5B,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,EAAE,CAAC,CAAC;IACnD,IAAI,YAAY,GAAG,EAAE,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,YAAY,GAAG,EAAE,CAAC;QAClC,OAAO,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,KAAK,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,GAAG,CAAC;IAC3E,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,EAAE,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,YAAY,GAAG,EAAE,CAAC;IAClC,IAAI,UAAU,GAAG,EAAE,EAAE,CAAC;QACpB,OAAO,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,KAAK,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,UAAU,GAAG,CAAC;IACvE,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,SAAS,GAAG,EAAE,CAAC;IAC7B,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,GAAG,CAAC;AACjE,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAuB;IACvD,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CACT,iCAAiC,cAAc,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAC7E,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,OAAO,GACX,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAC3B,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC5B,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,UAAU,CAAC;IAEnB,MAAM,IAAI,GACR,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAElE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAA,qBAAK,EAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;IAC7C,CAAC;AACH,CAAC"}

package/dist/auth/supabase-client.d.ts

@@ -0,0 +1,3 @@
+import { type SupabaseClient } from '@supabase/supabase-js';
+import type { SupabaseAuthConfig } from './supabase-config';
+export declare function buildSupabaseClient(config: SupabaseAuthConfig): SupabaseClient;

package/dist/auth/supabase-client.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildSupabaseClient = buildSupabaseClient;
+const supabase_js_1 = require("@supabase/supabase-js");
+function buildSupabaseClient(config) {
+    return (0, supabase_js_1.createClient)(config.url, config.anonKey, {
+        auth: {
+            persistSession: false,
+            detectSessionInUrl: false,
+        },
+    });
+}
+//# sourceMappingURL=supabase-client.js.map

package/dist/auth/supabase-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase-client.js","sourceRoot":"","sources":["../../src/auth/supabase-client.ts"],"names":[],"mappings":";;AAIA,kDAOC;AAXD,uDAA0E;AAI1E,SAAgB,mBAAmB,CAAC,MAA0B;IAC5D,OAAO,IAAA,0BAAY,EAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE;QAC9C,IAAI,EAAE;YACJ,cAAc,EAAE,KAAK;YACrB,kBAAkB,EAAE,KAAK;SAC1B;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/supabase-config.d.ts

@@ -0,0 +1,5 @@
+export interface SupabaseAuthConfig {
+    url: string;
+    anonKey: string;
+}
+export declare function getSupabaseAuthConfig(baseUrl: string): Promise<SupabaseAuthConfig>;

package/dist/auth/supabase-config.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getSupabaseAuthConfig = getSupabaseAuthConfig;
+const api_client_1 = require("../http/api-client");
+const CACHE = new Map();
+async function getSupabaseAuthConfig(baseUrl) {
+    const normalized = normalizeBaseUrl(baseUrl);
+    const cached = CACHE.get(normalized);
+    if (cached) {
+        return cached;
+    }
+    const client = new api_client_1.ApiClient({ baseUrl: normalized });
+    const response = await client.getJson('/api/v1/auth/config');
+    const config = {
+        url: response.supabase_url,
+        anonKey: response.supabase_anon_key,
+    };
+    CACHE.set(normalized, config);
+    return config;
+}
+function normalizeBaseUrl(raw) {
+    return raw.endsWith('/') ? raw : `${raw}/`;
+}
+//# sourceMappingURL=supabase-config.js.map

package/dist/auth/supabase-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase-config.js","sourceRoot":"","sources":["../../src/auth/supabase-config.ts"],"names":[],"mappings":";;AAcA,sDAeC;AA7BD,mDAA+C;AAY/C,MAAM,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;AAE7C,KAAK,UAAU,qBAAqB,CAAC,OAAe;IACzD,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,sBAAS,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAyB,qBAAqB,CAAC,CAAC;IACrF,MAAM,MAAM,GAAuB;QACjC,GAAG,EAAE,QAAQ,CAAC,YAAY;QAC1B,OAAO,EAAE,QAAQ,CAAC,iBAAiB;KACpC,CAAC;IACF,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC9B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;AAC7C,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare function createProgram(): Command;
+export declare function run(argv: readonly string[]): Promise<void>;

package/dist/cli.js

@@ -0,0 +1,53 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createProgram = createProgram;
+exports.run = run;
+const path_1 = __importDefault(require("path"));
+const commander_1 = require("commander");
+const package_json_1 = __importDefault(require("../package.json"));
+const commands_1 = require("./commands");
+function createProgram() {
+    const program = new commander_1.Command();
+    program
+        .name('omnara')
+        .description(package_json_1.default.description ?? 'Command-line interface for Omnara.')
+        .version(package_json_1.default.version)
+        .option('--backend-url <url>', 'Override backend API base URL used for login')
+        .option('--frontend-url <url>', 'Override frontend URL opened during login')
+        .action(async () => {
+        const options = program.opts();
+        await (0, commands_1.runAgentOrchestrator)(options);
+    });
+    // Register top-level commands here.
+    program.addCommand((0, commands_1.buildAgentCommand)());
+    program.addCommand((0, commands_1.buildAuthCommand)());
+    return program;
+}
+async function run(argv) {
+    const program = createProgram();
+    try {
+        await program.parseAsync(argv);
+    }
+    catch (error) {
+        // Commander will already have logged the error. Set non-zero exit for clarity.
+        program.error(error.message, { exitCode: 1 });
+    }
+}
+function invokedViaBin() {
+    if (!module || !module.parent) {
+        return false;
+    }
+    const parentPath = path_1.default.normalize(module.parent.filename ?? '');
+    const expectedSuffix = path_1.default.join('bin', 'omnara.js');
+    return parentPath.endsWith(expectedSuffix);
+}
+if (require.main === module || invokedViaBin()) {
+    run(process.argv).catch((error) => {
+        console.error(error);
+        process.exitCode = 1;
+    });
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";;;;;AAUA,sCAmBC;AAED,kBASC;AAxCD,gDAAwB;AACxB,yCAAoC;AACpC,mEAA0C;AAC1C,yCAKoB;AAEpB,SAAgB,aAAa;IAC3B,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;IAE9B,OAAO;SACJ,IAAI,CAAC,QAAQ,CAAC;SACd,WAAW,CAAC,sBAAW,CAAC,WAAW,IAAI,oCAAoC,CAAC;SAC5E,OAAO,CAAC,sBAAW,CAAC,OAAO,CAAC;SAC5B,MAAM,CAAC,qBAAqB,EAAE,8CAA8C,CAAC;SAC7E,MAAM,CAAC,sBAAsB,EAAE,2CAA2C,CAAC;SAC3E,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAuB,CAAC;QACpD,MAAM,IAAA,+BAAoB,EAAC,OAAO,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEL,oCAAoC;IACpC,OAAO,CAAC,UAAU,CAAC,IAAA,4BAAiB,GAAE,CAAC,CAAC;IACxC,OAAO,CAAC,UAAU,CAAC,IAAA,2BAAgB,GAAE,CAAC,CAAC;IAEvC,OAAO,OAAO,CAAC;AACjB,CAAC;AAEM,KAAK,UAAU,GAAG,CAAC,IAAuB;IAC/C,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;IAEhC,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,UAAU,CAAC,IAAgB,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+EAA+E;QAC/E,OAAO,CAAC,KAAK,CAAE,KAAe,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,aAAa;IACpB,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,UAAU,GAAG,cAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,cAAc,GAAG,cAAI,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACrD,OAAO,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;AAC7C,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,aAAa,EAAE,EAAE,CAAC;IAC/C,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACzC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/commands/agent.d.ts

@@ -0,0 +1,7 @@
+import { Command } from 'commander';
+export declare function buildAgentCommand(): Command;
+export interface OrchestratorOptions {
+    backendUrl?: string;
+    frontendUrl?: string;
+}
+export declare function runAgentOrchestrator(options?: OrchestratorOptions): Promise<void>;