@lifesi/genesis-cli 0.0.0-stage → 0.1.0

package/bin/genesis.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import { main } from '../dist/index.js';
+main(process.argv).then((code) => { process.exitCode = code; });

package/dist/auth.d.ts

@@ -0,0 +1,30 @@
+import type { CredentialStore, SavedLogin } from './store.js';
+/**
+ * Browser/device login via LifeID (WorkOS AuthKit CLI Auth, RFC 8628).
+ * Docs: https://workos.com/docs/authkit/cli-auth
+ *   POST {authApi}/user_management/authorize/device        {client_id}
+ *   POST {authApi}/user_management/authenticate            {grant_type: device_code | refresh_token, ...}
+ * client_id is a public identifier (not a secret). Set GENESIS_CLIENT_ID to the LifeID (staging) AuthKit client.
+ * GENESIS_AUTH_API lets this point at an auth.life.one proxy once one exists; default is WorkOS directly.
+ */
+export interface AuthConfig {
+    clientId?: string;
+    authApi: string;
+    fetch: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+}
+export declare function authConfig(env?: NodeJS.ProcessEnv, f?: typeof fetch): AuthConfig;
+export interface DeviceCode {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete: string;
+    expires_in: number;
+    interval: number;
+}
+export declare function startDevice(c: AuthConfig): Promise<DeviceCode>;
+export declare function jwtExp(token: string): number | undefined;
+export declare function pollDevice(c: AuthConfig, d: DeviceCode): Promise<SavedLogin>;
+export declare function refresh(c: AuthConfig, s: SavedLogin, organizationId?: string): Promise<SavedLogin>;
+/** Credential provider for the SDK: saved login, refreshed if within 60s of expiry. */
+export declare function savedLoginProvider(c: AuthConfig, store: CredentialStore, now?: () => number): () => Promise<string | undefined>;

package/dist/auth.js

@@ -0,0 +1,79 @@
+export function authConfig(env = process.env, f = fetch) {
+    return { clientId: env.GENESIS_CLIENT_ID, authApi: (env.GENESIS_AUTH_API ?? 'https://api.workos.com').replace(/\/+$/, ''), fetch: f };
+}
+function needClient(c) {
+    if (!c.clientId)
+        throw new Error('Login is not configured: set GENESIS_CLIENT_ID to the LifeID AuthKit client id (staging), or use GENESIS_API_KEY.');
+    return c.clientId;
+}
+async function post(c, path, body) {
+    const res = await c.fetch(`${c.authApi}${path}`, { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' }, body: new URLSearchParams(body).toString() });
+    const json = await res.json().catch(() => ({}));
+    return { ok: res.ok, status: res.status, json };
+}
+export async function startDevice(c) {
+    const r = await post(c, '/user_management/authorize/device', { client_id: needClient(c) });
+    if (!r.ok)
+        throw new Error(`Could not start login (${r.status}): ${r.json.error_description ?? r.json.message ?? r.json.error ?? 'unknown error'}`);
+    return r.json;
+}
+export function jwtExp(token) {
+    try {
+        return JSON.parse(Buffer.from(token.split('.')[1], 'base64url').toString()).exp;
+    }
+    catch {
+        return undefined;
+    }
+}
+function toSaved(c, j) {
+    return { access_token: j.access_token, refresh_token: j.refresh_token, user: j.user, organization_id: j.organization_id, expires_at: jwtExp(j.access_token), client_id: needClient(c) };
+}
+export async function pollDevice(c, d) {
+    const sleep = c.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    let interval = (d.interval || 5) * 1000;
+    const deadline = Date.now() + (d.expires_in || 300) * 1000;
+    while (Date.now() < deadline) {
+        await sleep(interval);
+        const r = await post(c, '/user_management/authenticate', { grant_type: 'urn:ietf:params:oauth:grant-type:device_code', device_code: d.device_code, client_id: needClient(c) });
+        if (r.ok)
+            return toSaved(c, r.json);
+        const err = r.json.error;
+        if (err === 'authorization_pending')
+            continue;
+        if (err === 'slow_down') {
+            interval += 5000;
+            continue;
+        }
+        if (err === 'access_denied')
+            throw new Error('Login was denied in the browser.');
+        if (err === 'expired_token')
+            break;
+        throw new Error(`Login failed (${r.status}): ${r.json.error_description ?? err ?? 'unknown error'}`);
+    }
+    throw new Error('Login code expired. Run `genesis login` again.');
+}
+export async function refresh(c, s, organizationId) {
+    if (!s.refresh_token)
+        throw new Error('Session expired. Run `genesis login`.');
+    const body = { grant_type: 'refresh_token', refresh_token: s.refresh_token, client_id: s.client_id };
+    if (organizationId)
+        body.organization_id = organizationId;
+    const r = await post(c, '/user_management/authenticate', body);
+    if (!r.ok)
+        throw new Error(r.json.error === 'invalid_grant' ? 'Session expired. Run `genesis login`.' : `Could not refresh session (${r.status}): ${r.json.error_description ?? r.json.error}`);
+    return { ...toSaved({ ...c, clientId: s.client_id }, r.json), user: r.json.user ?? s.user };
+}
+/** Credential provider for the SDK: saved login, refreshed if within 60s of expiry. */
+export function savedLoginProvider(c, store, now = () => Date.now() / 1000) {
+    return async () => {
+        let s = await store.get();
+        if (!s)
+            return undefined;
+        const exp = s.expires_at ?? jwtExp(s.access_token);
+        if (exp && exp - 60 < now()) {
+            s = await refresh(c, s, s.organization_id);
+            await store.set(s);
+        }
+        return s.access_token;
+    };
+}

package/dist/beacons.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+import type { Genesis } from '@lifesi/genesis';
+export declare function registerBeacons(program: Command, client: () => Promise<Genesis>, emit: (data: unknown, pretty: () => string) => void): void;

package/dist/beacons.js

@@ -0,0 +1,20 @@
+export function registerBeacons(program, client, emit) {
+    const devices = program.command('beacons').description('Beacons: Agent-native mesh').command('devices').description('Manage Bridge devices in your signed-in organization');
+    devices.command('list', { isDefault: true }).action(async () => {
+        const result = await (await client()).beacons.devices.list();
+        emit(result, () => JSON.stringify(result, null, 2));
+    });
+    devices.command('update <id>').option('--name <name>', 'Device name').option('--nickname <nickname...>', 'Replace nicknames').option('--clear-nicknames', 'Remove all nicknames')
+        .action(async (id, opts) => {
+        if (opts.clearNicknames && opts.nickname)
+            throw new Error('Choose --nickname or --clear-nicknames.');
+        if (opts.name === undefined && opts.nickname === undefined && !opts.clearNicknames)
+            throw new Error('Supply --name, --nickname or --clear-nicknames.');
+        const result = await (await client()).beacons.devices.update(id, { ...(opts.name === undefined ? {} : { name: opts.name }), ...(opts.clearNicknames ? { nicknames: [] } : opts.nickname ? { nicknames: opts.nickname } : {}) });
+        emit(result, () => JSON.stringify(result, null, 2));
+    });
+    devices.command('revoke <id>').description('Request durable mesh teardown').action(async (id) => {
+        const result = await (await client()).beacons.devices.revoke(id);
+        emit(result ?? { status: 'revoked' }, () => JSON.stringify(result ?? { status: 'revoked' }, null, 2));
+    });
+}

package/dist/dials.d.ts

@@ -0,0 +1,7 @@
+import { Command } from 'commander';
+import type { Genesis } from '@lifesi/genesis';
+export declare function registerDials(program: Command, dependencies: {
+    client: () => Promise<Genesis>;
+    orgId: (client: Genesis) => Promise<string>;
+    emit: (data: unknown, pretty: () => string) => void;
+}): void;

package/dist/dials.js

@@ -0,0 +1,34 @@
+import { readFile } from 'node:fs/promises';
+export function registerDials(program, dependencies) {
+    const dials = program.command('dials').description('Dials: phone numbers and calls for agents')
+        .requiredOption('--workspace <id>', 'selected workspace')
+        .requiredOption('--project <id>', 'selected project')
+        .requiredOption('--environment <id>', 'selected environment');
+    const context = async () => {
+        const client = await dependencies.client();
+        const options = dials.opts();
+        const scope = { organizationId: await dependencies.orgId(client), workspaceId: options.workspace, projectId: options.project, environmentId: options.environment };
+        return { client, scope };
+    };
+    const emit = (data) => dependencies.emit(data, () => JSON.stringify(data, null, 2));
+    const numbers = dials.command('numbers').description('Carrier number inventory');
+    numbers.command('list', { isDefault: true }).action(async () => { const { client, scope } = await context(); emit(await client.dials.numbers.list(scope)); });
+    numbers.command('search').option('--area-code <code>', 'three digit area code').action(async (options) => { const { client, scope } = await context(); emit(await client.dials.numbers.search(scope, { areaCode: options.areaCode, limit: 10 })); });
+    const calls = dials.command('calls').description('Call activity and approved outbound calls');
+    calls.command('list', { isDefault: true }).action(async () => { const { client, scope } = await context(); emit(await client.dials.calls.list(scope)); });
+    // @file keeps structured approval and idempotency fields out of shell history.
+    for (const [parent, name, operation] of [
+        [numbers, 'provision', 'dials_provisionNumber'], [numbers, 'assign', 'dials_assignNumber'], [numbers, 'release', 'dials_releaseNumber'], [numbers, 'e911', 'dials_registerEmergencyAddress'],
+        [calls, 'validate', 'dials_validateOutboundCall'], [calls, 'create', 'dials_createOutboundCall'],
+    ]) {
+        parent.command(name).requiredOption('--body <json-or-@file>', 'JSON input including actorId and required operation fields')
+            .action(async (options) => {
+            const { client, scope } = await context();
+            const text = options.body.startsWith('@') ? await readFile(options.body.slice(1), 'utf8') : options.body;
+            const body = JSON.parse(text);
+            if (!body || typeof body !== 'object' || Array.isArray(body))
+                throw new Error('Dials body must be a JSON object.');
+            emit(await client.call(operation, { body: { ...body, scope } }));
+        });
+    }
+}

package/dist/fleets.d.ts

@@ -0,0 +1,4 @@
+import type { Command } from 'commander';
+import type { Genesis } from '@lifesi/genesis';
+export declare function readFoundryKey(input?: AsyncIterable<Uint8Array>): Promise<string>;
+export declare function registerFleets(program: Command, client: () => Promise<Genesis>, emit: (data: unknown) => void, keyInput?: () => Promise<string>): void;

package/dist/fleets.js

@@ -0,0 +1,44 @@
+export async function readFoundryKey(input = process.stdin) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of input) {
+        const bytes = Buffer.from(chunk);
+        size += bytes.length;
+        if (size > 4098)
+            throw new Error('Foundry key must contain at most 4096 bytes.');
+        chunks.push(bytes);
+    }
+    let key;
+    try {
+        key = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(Buffer.concat(chunks)).replace(/\r?\n$/, '');
+    }
+    catch {
+        throw new Error('Invalid UTF-8 Foundry key on stdin.');
+    }
+    if (!key || Buffer.byteLength(key) > 4096 || /[\r\n\0]/.test(key))
+        throw new Error('Invalid Foundry key on stdin.');
+    return key;
+}
+export function registerFleets(program, client, emit, keyInput = readFoundryKey) {
+    const fleets = program.command('fleets').description('Fleets: managed agent tasks');
+    const connection = fleets.command('connection').description('Organization-owned Foundry connection');
+    connection.command('get').action(async () => emit(await (await client()).fleets.connection.get()));
+    connection.command('set').description('Read a Foundry key from stdin and encrypt it with Genesis KMS').action(async () => {
+        const apiKey = await keyInput();
+        emit(await (await client()).fleets.connection.set(apiKey));
+    });
+    connection.command('delete').action(async () => emit(await (await client()).fleets.connection.delete()));
+    const tasks = fleets.command('tasks');
+    tasks.command('list').option('--limit <number>').option('--before <task_id>').action(async (options) => {
+        emit(await (await client()).fleets.tasks.list({ ...(options.limit ? { limit: Number(options.limit) } : {}), ...(options.before ? { before: options.before } : {}) }));
+    });
+    tasks.command('submit <input>').option('--timeout <seconds>', 'task deadline in seconds', '300').requiredOption('--idempotency-key <key>', 'stable key to reuse on retry').action(async (input, options) => {
+        const timeout = Number(options.timeout);
+        if (!Number.isInteger(timeout) || timeout < 1 || timeout > 3600)
+            throw new Error('Timeout must be 1–3600 seconds.');
+        emit(await (await client()).fleets.tasks.submit({ input, timeout_seconds: timeout, idempotency_key: options.idempotencyKey }));
+    });
+    tasks.command('get <task_id>').action(async (id) => emit(await (await client()).fleets.tasks.get(id)));
+    tasks.command('cancel <task_id>').action(async (id) => emit(await (await client()).fleets.tasks.cancel(id)));
+    tasks.command('receipt <task_id>').action(async (id) => emit(await (await client()).fleets.tasks.receipt(id)));
+}

package/dist/henry.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+import type { Genesis } from '@lifesi/genesis';
+export declare function addHenryCommands(program: Command, client: () => Promise<Genesis>, output: (value: unknown) => void): void;

package/dist/henry.js

@@ -0,0 +1,31 @@
+export function addHenryCommands(program, client, output) {
+    const henry = program.command('henry').description('Henry: agent runtime, live activity and approvals');
+    henry.command('config').action(async () => output(await (await client()).henry.config()));
+    henry.command('credential').description('Read a Foundry API key from stdin and encrypt it in Genesis KMS')
+        .action(async () => {
+        const chunks = [];
+        let size = 0;
+        for await (const chunk of process.stdin) {
+            size += Buffer.byteLength(chunk);
+            if (size > 4096)
+                throw new Error('Foundry API key exceeds limit');
+            chunks.push(Buffer.from(chunk));
+        }
+        output(await (await client()).henry.credential(Buffer.concat(chunks).toString('utf8').trim()));
+    });
+    henry.command('runs').option('--page-token <token>').action(async (options) => output(await (await client()).henry.runs.list(options.pageToken)));
+    henry.command('run').requiredOption('--model <model>').requiredOption('--task <text>').option('--run-id <uuid>', 'UUIDv4 for concurrent activity polling')
+        .action(async (options) => output(await (await client()).henry.runs.create({ model: options.model, task: options.task, ...(options.runId ? { run_id: options.runId } : {}) })));
+    henry.command('get <run_id>').action(async (runId) => output(await (await client()).henry.runs.get(runId)));
+    henry.command('command <run_id> <action>').option('--text <text>')
+        .action(async (runId, action, options) => {
+        if (!['pause', 'resume', 'cancel', 'input'].includes(action))
+            throw new Error('Action must be pause, resume, cancel or input');
+        output(await (await client()).henry.runs.command(runId, action, options.text));
+    });
+    henry.command('approval <run_id> <approval_id> <decision>').action(async (runId, approvalId, decision) => {
+        if (!['approve', 'reject'].includes(decision))
+            throw new Error('Decision must be approve or reject');
+        output(await (await client()).henry.runs.approval(runId, approvalId, decision));
+    });
+}

package/dist/index.d.ts

@@ -0,0 +1,13 @@
+import { Command } from 'commander';
+import { type CredentialStore } from './store.js';
+import { type Out } from './output.js';
+export interface Deps {
+    out?: Out;
+    store?: () => Promise<CredentialStore>;
+    fetch?: typeof fetch;
+    env?: Record<string, string | undefined>;
+    openBrowser?: (url: string) => void;
+    sleep?: (ms: number) => Promise<void>;
+}
+export declare function buildProgram(deps?: Deps): Command;
+export declare function main(argv: string[], deps?: Deps): Promise<number>;

package/dist/index.js

@@ -0,0 +1,222 @@
+import { registerBeacons } from './beacons.js';
+import { registerDials } from './dials.js';
+import { Command, CommanderError } from 'commander';
+import { Genesis, GenesisError, services } from '@lifesi/genesis';
+import { authConfig, pollDevice, refresh, savedLoginProvider, startDevice } from './auth.js';
+import { keychainStore } from './store.js';
+import { c, listOf, stdio, table } from './output.js';
+import { spawn } from 'node:child_process';
+import { addHenryCommands } from './henry.js';
+import { registerFleets } from './fleets.js';
+import { registerRunner } from './runner.js';
+function defaultOpen(url) {
+    const cmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'cmd' : 'xdg-open';
+    const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
+    try {
+        spawn(cmd, args, { stdio: 'ignore', detached: true }).on('error', () => { }).unref();
+    }
+    catch { /* print-only fallback */ }
+}
+export function buildProgram(deps = {}) {
+    const out = deps.out ?? stdio;
+    const env = deps.env ?? process.env;
+    const f = deps.fetch ?? fetch;
+    const getStore = deps.store ?? keychainStore;
+    const auth = { ...authConfig(env, f), sleep: deps.sleep };
+    const program = new Command('genesis')
+        .description('One CLI for every Genesis service.')
+        .version('0.1.0')
+        .option('--json', 'machine-readable JSON output')
+        .option('--api-key <key>', 'use this API key (default: GENESIS_API_KEY, then your `genesis login`)')
+        .option('--base-url <url>', 'gateway URL (default: GENESIS_BASE_URL or https://console.life.one/api)')
+        .option('--direct', 'skip the gateway and call each service host directly (for local dev)')
+        .option('--org <org_id>', 'organization to act on')
+        .showHelpAfterError()
+        .exitOverride()
+        .configureOutput({ writeOut: (s) => out.log(s.trimEnd()), writeErr: (s) => out.err(s.trimEnd()) });
+    const g = () => program.opts();
+    const client = async () => {
+        const o = g();
+        const store = await getStore().catch(() => undefined);
+        const opts = {
+            apiKey: o.apiKey ?? env.GENESIS_API_KEY, token: env.GENESIS_TOKEN,
+            baseUrl: o.baseUrl ?? env.GENESIS_BASE_URL, routing: o.direct || env.GENESIS_ROUTING === 'direct' ? 'direct' : 'gateway',
+            fetch: f, userAgent: 'genesis-cli/0.1.0',
+            credentials: store ? savedLoginProvider(auth, store) : undefined,
+        };
+        return new Genesis(opts);
+    };
+    const emit = (data, pretty) => out.log(g().json ? JSON.stringify(data, null, 2) : pretty());
+    registerRunner(program, client, emit);
+    const orgId = async (gen) => {
+        if (g().org)
+            return g().org;
+        const s = await (await getStore().catch(() => undefined))?.get();
+        if (s?.organization_id && !g().apiKey && !env.GENESIS_API_KEY)
+            return s.organization_id;
+        return (await gen.whoami()).org;
+    };
+    registerDials(program, { client, orgId, emit });
+    // ---- auth ------------------------------------------------------------
+    program.command('login').description('Sign in with LifeID in your browser').option('--no-browser', 'just print the link')
+        .action(async (o) => {
+        const store = await getStore();
+        const d = await startDevice(auth);
+        out.err(`\n  Your code: ${c.bold(d.user_code)}\n  Opening ${d.verification_uri_complete}\n  ${c.dim('Waiting for you to approve in the browser…')}\n`);
+        if (o.browser)
+            (deps.openBrowser ?? defaultOpen)(d.verification_uri_complete);
+        const s = await pollDevice(auth, d);
+        await store.set(s);
+        emit({ user: s.user, organization_id: s.organization_id, store: store.kind }, () => `${c.green('✓')} Signed in as ${c.bold(s.user?.email ?? s.user?.id ?? 'you')}${s.organization_id ? ` (${s.organization_id})` : ''}. Token saved to your ${store.kind === 'os-keychain' ? 'OS keychain' : store.kind}.`);
+    });
+    program.command('logout').description('Forget your saved login').action(async () => {
+        const had = await (await getStore()).clear();
+        emit({ logged_out: had }, () => had ? `${c.green('✓')} Signed out.` : 'You were not signed in.');
+    });
+    program.command('whoami').description('Show who you are signed in as').action(async () => {
+        const gen = await client();
+        const saved = await (await getStore().catch(() => undefined))?.get();
+        try {
+            const p = await gen.whoami();
+            emit({ ...p, user: saved?.user }, () => [
+                `${c.bold('Org')}        ${p.org}`, `${c.bold('Principal')}  ${p.principal ?? '-'}`,
+                `${c.bold('Via')}        ${p.kind}`, `${c.bold('Scopes')}     ${p.scopes.join(', ') || '-'}`,
+                ...(saved?.user?.email ? [`${c.bold('User')}       ${saved.user.email}`] : [])
+            ].join('\n'));
+        }
+        catch (e) {
+            if (!saved || g().apiKey || env.GENESIS_API_KEY)
+                throw e;
+            // Saved login exists but LifeID verify isn't reachable yet (auth-v4-backend PR #30 not deployed).
+            emit({ user: saved.user, organization_id: saved.organization_id, verified: false, reason: e.message }, () => `${c.bold('User')}  ${saved.user?.email ?? saved.user?.id}\n${c.bold('Org')}   ${saved.organization_id ?? '-'}\n${c.yellow('!')} ${c.dim('From your saved login; LifeID verify unavailable: ' + e.message)}`);
+        }
+    });
+    const orgs = program.command('orgs').description('Your organizations');
+    orgs.command('list', { isDefault: true }).description('Show your current organization').action(async () => {
+        const s = await (await getStore()).get();
+        if (!s)
+            throw new Error('Not signed in. Run `genesis login`.');
+        const rows = s.organization_id ? [{ id: s.organization_id, current: '*' }] : [];
+        emit({ current: s.organization_id ?? null, organizations: rows }, () => `${table(rows, ['id', 'current'])}\n${c.dim('Listing every org you belong to needs a LifeID memberships endpoint (not built yet). Switch with `genesis orgs switch <org_id>`.')}`);
+    });
+    orgs.command('switch <org_id>').description('Switch your login to another organization').action(async (id) => {
+        const store = await getStore();
+        const s = await store.get();
+        if (!s)
+            throw new Error('Not signed in. Run `genesis login`.');
+        const n = await refresh(auth, s, id);
+        await store.set(n);
+        emit({ organization_id: n.organization_id }, () => `${c.green('✓')} Now using ${c.bold(n.organization_id ?? id)}.`);
+    });
+    // ---- keys ------------------------------------------------------------
+    const keys = program.command('keys').description('Org API keys (LifeID / WorkOS)');
+    keys.command('list').action(async () => {
+        const gen = await client();
+        const org = await orgId(gen);
+        const r = await gen.keys.list(org);
+        emit(r, () => table(r.data, ['id', 'name', 'obfuscated_value', 'scopes', 'last_used_at', 'expires_at']));
+    });
+    keys.command('create <name>').description('Create a key (shown once), or with --blinds hand it straight to Blinds so nobody ever sees it')
+        .option('--scopes <list>', 'comma-separated scopes, e.g. hives:read,relays:write')
+        .option('--blinds', 'store the key in Blinds; the raw key is never shown to anyone')
+        .option('--expires <iso>', 'expiry, e.g. 2027-01-01T00:00:00Z')
+        .action(async (name, o) => {
+        const gen = await client();
+        const org = await orgId(gen);
+        const k = await gen.keys.create(org, { name, custody: o.blinds ? 'blinds' : 'reveal', ...(o.scopes ? { scopes: o.scopes.split(',').map((x) => x.trim()).filter(Boolean) } : {}), ...(o.expires ? { expires_at: o.expires } : {}) });
+        emit(k, () => o.blinds
+            ? `${c.green('✓')} Key ${c.bold(k.id)} created and stored in Blinds as ${c.bold(String(k.blinds_credential_ref))}.\n  ${c.dim('No one, human or agent, will ever see the raw key.')}`
+            : `${c.green('✓')} Key ${c.bold(k.id)} created. Copy it now; it won't be shown again:\n\n  ${c.bold(String(k.value))}\n`);
+    });
+    keys.command('revoke <key_id>').action(async (id) => {
+        const gen = await client();
+        await gen.keys.revoke(id);
+        emit({ revoked: id }, () => `${c.green('✓')} Revoked ${id} ${c.dim('(takes effect within 60s)')}`);
+    });
+    // ---- foundry ---------------------------------------------------------
+    const foundry = program.command('foundry').description('Foundry: models and inference');
+    foundry.command('models').action(async () => {
+        const r = await (await client()).foundry.models.list();
+        const rows = listOf(r).map((m) => ({ id: m.id, owned_by: m.owned_by ?? m.provider ?? '' }));
+        emit(r, () => table(rows, ['id', 'owned_by']));
+    });
+    foundry.command('chat <prompt...>').description('Chat with a model').option('-m, --model <model>', 'model id', env.GENESIS_MODEL)
+        .option('--no-stream', 'wait for the full answer').option('-s, --system <text>', 'system prompt')
+        .action(async (prompt, o) => {
+        if (!o.model)
+            throw new Error('Pick a model with --model (see `genesis foundry models`) or set GENESIS_MODEL.');
+        const gen = await client();
+        const messages = [...(o.system ? [{ role: 'system', content: o.system }] : []), { role: 'user', content: prompt.join(' ') }];
+        if (o.stream && !g().json) {
+            for await (const d of gen.foundry.chatStream({ model: o.model, messages }))
+                process.stdout.write(d);
+            process.stdout.write('\n');
+            return;
+        }
+        const r = await gen.foundry.chat({ model: o.model, messages });
+        emit(r, () => r.choices?.[0]?.message?.content ?? JSON.stringify(r));
+    });
+    // ---- hives -----------------------------------------------------------
+    const hives = program.command('hives').description('Hives: projects, deployments, functions');
+    const projects = hives.command('projects').description('Hives projects');
+    projects.command('list', { isDefault: true }).action(async () => {
+        const r = await (await client()).hives.projects.list();
+        emit(r, () => table(listOf(r), ['id', 'name', 'slug', 'region', 'total_deployments', 'active_instances']));
+    });
+    projects.command('get <project_id>').action(async (id) => {
+        const r = await (await client()).hives.projects.get(id);
+        emit(r, () => JSON.stringify(r, null, 2));
+    });
+    // ---- relays ----------------------------------------------------------
+    const relays = program.command('relays').description('Relays: DNS zones and records');
+    relays.command('zones').description('List DNS zones').option('--search <q>').action(async (o) => {
+        const r = await (await client()).relays.zones.list(o.search ? { search: o.search } : {});
+        emit(r, () => table((r.zones ?? []), ['name', 'type', 'record_count', 'dnssec_enabled', 'status']));
+    });
+    const records = relays.command('records').description('DNS records in a zone');
+    records.command('list <zone>', { isDefault: true }).option('--type <type>').action(async (zone, o) => {
+        const r = await (await client()).relays.records.list(zone, o.type ? { type: o.type } : {});
+        emit(r, () => table((r.records ?? []), ['id', 'name', 'type', 'content', 'ttl']));
+    });
+    records.command('add <zone> <name> <type> <content>').option('--ttl <seconds>', 'TTL', '3600').action(async (zone, name, type, content, o) => {
+        const r = await (await client()).relays.records.create(zone, { name, type: type.toUpperCase(), content, ttl: Number(o.ttl) });
+        emit(r, () => `${c.green('✓')} Added ${type.toUpperCase()} ${name} → ${content} in ${zone}${r.id ? ` (id ${r.id})` : ''}`);
+    });
+    records.command('rm <zone> <record_id>').action(async (zone, id) => {
+        await (await client()).relays.records.delete(zone, Number(id));
+        emit({ deleted: Number(id) }, () => `${c.green('✓')} Deleted record ${id} from ${zone}`);
+    });
+    addHenryCommands(program, client, value => out.log(JSON.stringify(value, null, 2)));
+    registerFleets(program, client, (data) => emit(data, () => JSON.stringify(data, null, 2)));
+    registerBeacons(program, client, emit);
+    // ---- status ----------------------------------------------------------
+    program.command('status').description('Which Genesis services are wired up').action(async () => {
+        emit(services, () => table(services.map((s) => ({ service: s.name, status: s.status, ops: s.operations, upstream: s.upstream, note: s.statusNote })), ['service', 'status', 'ops', 'upstream', 'note']));
+    });
+    return program;
+}
+export async function main(argv, deps = {}) {
+    const out = deps.out ?? stdio;
+    const program = buildProgram(deps);
+    try {
+        await program.parseAsync(argv);
+        return 0;
+    }
+    catch (e) {
+        if (e instanceof CommanderError)
+            return e.exitCode;
+        const json = program.opts().json;
+        if (e instanceof GenesisError) {
+            if (json)
+                out.err(JSON.stringify({ error: { type: e.type, status: e.status, message: e.message, request_id: e.requestId } }));
+            else
+                out.err(`${c.red('✗')} ${e.message}${e.status ? c.dim(` (${e.status} ${e.type}${e.requestId ? `, request ${e.requestId}` : ''})`) : ''}`);
+            return 1;
+        }
+        const msg = e.message ?? String(e);
+        const net = /fetch failed|ENOTFOUND|ECONNREFUSED/.test(msg + (e.cause?.code ?? ''));
+        out.err(json ? JSON.stringify({ error: { type: net ? 'network' : 'error', message: msg } })
+            : `${c.red('✗')} ${net ? `Could not reach the Genesis API gateway (${msg}). Try --direct to call service hosts directly.` : msg}`);
+        return 1;
+    }
+}

package/dist/output.d.ts

@@ -0,0 +1,16 @@
+export interface Out {
+    log(s: string): void;
+    err(s: string): void;
+}
+export declare const stdio: Out;
+export declare const c: {
+    bold: (s: string) => string;
+    dim: (s: string) => string;
+    green: (s: string) => string;
+    yellow: (s: string) => string;
+    red: (s: string) => string;
+};
+/** Render rows as an aligned table. */
+export declare function table(rows: Record<string, unknown>[], cols: string[]): string;
+/** Pull the array out of the various list envelopes ({data}, {zones}, {records}, bare array). */
+export declare function listOf(x: any, ...keys: string[]): any[];

package/dist/output.js

@@ -0,0 +1,27 @@
+export const stdio = { log: (s) => process.stdout.write(s + '\n'), err: (s) => process.stderr.write(s + '\n') };
+const tty = () => !!process.stdout.isTTY && !process.env.NO_COLOR;
+export const c = {
+    bold: (s) => (tty() ? `\x1b[1m${s}\x1b[0m` : s),
+    dim: (s) => (tty() ? `\x1b[2m${s}\x1b[0m` : s),
+    green: (s) => (tty() ? `\x1b[32m${s}\x1b[0m` : s),
+    yellow: (s) => (tty() ? `\x1b[33m${s}\x1b[0m` : s),
+    red: (s) => (tty() ? `\x1b[31m${s}\x1b[0m` : s),
+};
+/** Render rows as an aligned table. */
+export function table(rows, cols) {
+    if (!rows.length)
+        return c.dim('(none)');
+    const cell = (v) => (v === undefined || v === null ? '' : Array.isArray(v) ? v.join(',') : String(v));
+    const w = cols.map((k) => Math.max(k.length, ...rows.map((r) => cell(r[k]).length)));
+    const line = (vals) => vals.map((v, i) => v.padEnd(w[i])).join('  ').trimEnd();
+    return [c.bold(line(cols.map((k) => k.toUpperCase()))), ...rows.map((r) => line(cols.map((k) => cell(r[k]))))].join('\n');
+}
+/** Pull the array out of the various list envelopes ({data}, {zones}, {records}, bare array). */
+export function listOf(x, ...keys) {
+    if (Array.isArray(x))
+        return x;
+    for (const k of [...keys, 'data', 'items', 'results'])
+        if (Array.isArray(x?.[k]))
+            return x[k];
+    return [];
+}

package/dist/runner.d.ts

@@ -0,0 +1,4 @@
+import type { Command } from 'commander';
+import type { Genesis } from '@lifesi/genesis';
+/** Register only Runner commands. The authenticated credential determines org and subject. */
+export declare function registerRunner(program: Command, client: () => Promise<Genesis>, emit: (data: unknown, pretty: () => string) => void): void;

package/dist/runner.js

@@ -0,0 +1,40 @@
+/** Register only Runner commands. The authenticated credential determines org and subject. */
+export function registerRunner(program, client, emit) {
+    const runner = program.command('runner').description('Runner: agent task execution');
+    const output = (value) => emit(value, () => JSON.stringify(value, null, 2));
+    runner.command('catalog').description('Authorized workspaces and execution routes')
+        .action(async () => output(await (await client()).runner.catalog()));
+    const jobs = runner.command('jobs').description('Jobs belonging to your verified identity');
+    jobs.command('list', { isDefault: true }).description('Newest 100 jobs')
+        .action(async () => output(await (await client()).runner.jobs.list()));
+    jobs.command('start').description('Start a bounded task; refs must come from catalog')
+        .requiredOption('--task-id <id>', 'opaque task ID')
+        .requiredOption('--text <text>', 'task instructions (at most 32768 characters)')
+        .requiredOption('--workspace <ref>', 'authorized workspace key')
+        .requiredOption('--kind <kind>', 'external-harness or internal-model')
+        .requiredOption('--route <id>', 'authorized execution route')
+        .requiredOption('--idempotency-key <key>', 'stable key for retries of the same task')
+        .option('--duration-ms <ms>', 'maximum execution duration', '600000')
+        .option('--output-bytes <bytes>', 'maximum output size', '1048576')
+        .option('--max-events <count>', 'retained event limit', '200')
+        .action(async (o) => {
+        if (!['external-harness', 'internal-model'].includes(o.kind))
+            throw new TypeError('Runner kind must be external-harness or internal-model');
+        const body = {
+            task: { id: o.taskId, text: o.text }, workspaceRef: o.workspace,
+            executionRef: { kind: o.kind, routeId: o.route },
+            limits: { maxDurationMs: Number(o.durationMs), maxOutputBytes: Number(o.outputBytes), maxEvents: Number(o.maxEvents) },
+            idempotencyKey: o.idempotencyKey,
+        };
+        output(await (await client()).runner.jobs.start(body));
+    });
+    jobs.command('get <job_id>').description('Read the authoritative snapshot')
+        .action(async (id) => output(await (await client()).runner.jobs.get(id)));
+    jobs.command('events <job_id>').description('Read one event page; continue with nextAfterSeq while hasMore')
+        .option('--after-seq <seq>', 'exclusive event cursor', '0')
+        .action(async (id, o) => output(await (await client()).runner.jobs.events(id, Number(o.afterSeq))));
+    jobs.command('result <job_id>').description('Read the verified completed provider deliverable')
+        .action(async (id) => output(await (await client()).runner.jobs.result(id)));
+    jobs.command('cancel <job_id>').description('Request cancellation; then watch status and cleanupPending')
+        .action(async (id) => output(await (await client()).runner.jobs.cancel(id)));
+}

package/dist/store.d.ts

@@ -0,0 +1,23 @@
+/** Saved `genesis login`: kept in the OS keychain (macOS Keychain, Windows Credential Manager, libsecret). */
+export interface SavedLogin {
+    access_token: string;
+    refresh_token?: string;
+    user?: {
+        id: string;
+        email?: string;
+        first_name?: string | null;
+        last_name?: string | null;
+    };
+    organization_id?: string;
+    /** epoch seconds, from the access token's exp claim */
+    expires_at?: number;
+    client_id: string;
+}
+export interface CredentialStore {
+    get(): Promise<SavedLogin | undefined>;
+    set(v: SavedLogin): Promise<void>;
+    clear(): Promise<boolean>;
+    readonly kind: string;
+}
+export declare function keychainStore(): Promise<CredentialStore>;
+export declare function memoryStore(initial?: SavedLogin): CredentialStore;

package/dist/store.js

@@ -0,0 +1,33 @@
+const SERVICE = 'one.life.genesis';
+const ACCOUNT = 'default';
+export async function keychainStore() {
+    let Entry;
+    try {
+        ({ Entry } = await import('@napi-rs/keyring'));
+    }
+    catch {
+        throw new Error('OS keychain is unavailable (@napi-rs/keyring not installed). Use GENESIS_API_KEY instead.');
+    }
+    const entry = new Entry(SERVICE, ACCOUNT);
+    return {
+        kind: 'os-keychain',
+        async get() { try {
+            const s = entry.getPassword();
+            return s ? JSON.parse(s) : undefined;
+        }
+        catch {
+            return undefined;
+        } },
+        async set(v) { entry.setPassword(JSON.stringify(v)); },
+        async clear() { try {
+            return entry.deletePassword();
+        }
+        catch {
+            return false;
+        } },
+    };
+}
+export function memoryStore(initial) {
+    let v = initial;
+    return { kind: 'memory', async get() { return v; }, async set(x) { v = x; }, async clear() { const had = !!v; v = undefined; return had; } };
+}

package/package.json

@@ -1,6 +1,23 @@
 {
   "name": "@lifesi/genesis-cli",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "genesis: one CLI for every Genesis service",
+  "type": "module",
+  "bin": {
+    "genesis": "bin/genesis.js"
+  },
+  "files": [
+    "bin",
+    "dist"
+  ],
+  "dependencies": {
+    "commander": "^14.0.0",
+    "@lifesi/genesis": "0.1.0"
+  },
+  "optionalDependencies": {
+    "@napi-rs/keyring": "^1.2.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json"
+  }
 }

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.