- OTM SSO: /api/auth/otm-sso verifies the control-plane ticket (vendored
verifier), in-memory jti claim, mints an HMAC cookie (src/lib/session.ts);
/api/auth/session + /api/auth/signout. No accounts, no DB.
- /api/ai-names: server-side call to the platform's metered gateway
(ANTHROPIC_BASE_URL + per-app gateway token), 401 without a session,
~20 req/h per OTM account. Prompt/parser shared with the BYO-key path
via src/lib/ai-prompt.ts.
- Finder: 'Sign in with OTM for AI names' link → 'AI names' toggle when
signed in; own key still overrides.
Pairs with platform 0.116.0 (needsAnthropic + needsAuthSecret on names).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XStQKxPfEjrTvWo83KFCxG
- ☆ on every card saves it to a browser-only shortlist (localStorage
names.wishlist, cap 60) shown as a Saved panel with snapshotted
statuses, Re-check and Copy list.
- SuggestionLightbulb from @otm/account-panel is Tailwind-styled and
names had no Tailwind, so it rendered as a bare button. Added Tailwind
(preflight off, dark class pinned), scoped element CSS to .wrap and
mounted the widget outside it.
- v0.2.0
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XStQKxPfEjrTvWo83KFCxG
Captures what isn't derivable from the code: build_app times out at the MCP
layer while continuing to build (poll for the image, don't retry), the app
doesn't exist to build_app until platform CI goes green, and the three
generator guards (prefix-only hint matching, -er-only syncopation, truncation
rejection) each exist because of specific bad output.
Also records why lookups must not route through rdap.org: its redirector
returns a bare 404 both for "unregistered" and "I don't serve this TLD", which
would report every .io as available.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JChWdFJPCRxMBxErb8kUVK
Free, no-account tool for naming a business and finding a domain you can
actually register.
Availability uses no paid API and no key. IANA's RDAP bootstrap maps ~1,200
TLDs to their authoritative registry servers (404 = free, 200 = taken); the
handful with no RDAP at all (.io, .co, .me, .sh, .gg, .us) fall back to a DNS
NS lookup and are reported as "probably free" rather than confirmed, because a
registered-but-undelegated domain is indistinguishable that way.
Name generation is pure, deterministic, and client-side — eight strategies over
a curated word bank, ranked by a scorer that does the real quality work. Three
of its guards (prefix-only hint matching, -er-only syncopation, truncation
rejection) exist because of specific bad output and should not be relaxed.
Optional AI suggestions use the visitor's OWN Anthropic/Gemini key from
localStorage, called browser-direct, so this stays free to run.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JChWdFJPCRxMBxErb8kUVK
