@hyphae/cloud (JavaScript)

sdks/js/ in the repository. Zero runtime dependencies, ESM, Node 22+ and browsers. It is a client: it holds the caller’s token, has no route of its own, computes or verifies nothing, and surfaces the server’s errors and Native’s fields unchanged. It decodes exactly one Native envelope kind (HYPRSP01 capabilities), like the Studio and hcloud.

import { createCloudClient, CloudError, PROTOCOL_MINOR } from "@hyphae/cloud";
const cloud = createCloudClient({ url: "https://infra-hyphae.run" });   // absolute origin required

Owner plane (cloud.*, session token)

Group	Methods
auth	signup({email,password,invite_code?}) (the code is required on invite-gated deployments), login({email,password}), logout(), me()
projects	create({name}), list(), get(id), wakeup(id), sleep(id), head(id)
keys	create(projectId, {label?}), list(projectId), revoke(projectId, keyId)
snapshots	create(projectId, {label?}), list(projectId), get(projectId, snapshotId); cloud.restore(projectId, snapshotId)
storage	buckets.list(projectId), buckets.create(projectId, name), upload(projectId, {bucket,key,body,contentType?}), download(projectId, ref), downloadUrl(projectId, ref), list(projectId, bucket), remove(projectId, ref)
realtime	publish(projectId, {channel,event,payload?}), `subscribe(projectId, channel
functions	deploy(projectId, name, source), list(projectId), get(projectId, name), remove(projectId, name), invoke(projectId, name, body?); functions.secrets.list/set/remove

cloud.token holds the current session token after signup/login; set it yourself to reuse a stored one.

Key plane (cloud.data(projectId, { key }))

capabilities() (decoded HYPRSP01 kind 1 plus the raw bytes), storage (objects and bucket list), publish/subscribe, invoke(name, body?), and raw(path, init?) for any /v2 request with the key and protocol headers set. There is deliberately no secrets on this plane.

Errors

CloudError carries status, code (one of the 16 codes) and message, plus isTenantRunning / isTenantNotRunning getters. Identifier grammars are checked client-side before a request leaves (prj_<16 hex>, function names [a-z0-9_]{1,40}, secret names [A-Z][A-Z0-9_]{0,63}, bucket names), with the same rules the server applies.

The package is not published to a registry yet; use it from the repository as a workspace or file: dependency.