@lifesi/genesis-cli 0.0.0-stage → 0.1.1

package/bin/genesis.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import { main } from '../dist/index.js';
+main(process.argv).then((code) => { process.exitCode = code; });

package/dist/auth.d.ts

@@ -0,0 +1,30 @@
+import type { CredentialStore, SavedLogin } from './store.js';
+/**
+ * Browser/device login via LifeID (WorkOS AuthKit CLI Auth, RFC 8628).
+ * Docs: https://workos.com/docs/authkit/cli-auth
+ *   POST {authApi}/user_management/authorize/device        {client_id}
+ *   POST {authApi}/user_management/authenticate            {grant_type: device_code | refresh_token, ...}
+ * client_id is a public identifier (not a secret). Set GENESIS_CLIENT_ID to the LifeID (staging) AuthKit client.
+ * GENESIS_AUTH_API lets this point at an auth.life.one proxy once one exists; default is WorkOS directly.
+ */
+export interface AuthConfig {
+    clientId?: string;
+    authApi: string;
+    fetch: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+}
+export declare function authConfig(env?: NodeJS.ProcessEnv, f?: typeof fetch): AuthConfig;
+export interface DeviceCode {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete: string;
+    expires_in: number;
+    interval: number;
+}
+export declare function startDevice(c: AuthConfig): Promise<DeviceCode>;
+export declare function jwtExp(token: string): number | undefined;
+export declare function pollDevice(c: AuthConfig, d: DeviceCode): Promise<SavedLogin>;
+export declare function refresh(c: AuthConfig, s: SavedLogin, organizationId?: string): Promise<SavedLogin>;
+/** Credential provider for the SDK: saved login, refreshed if within 60s of expiry. */
+export declare function savedLoginProvider(c: AuthConfig, store: CredentialStore, now?: () => number): () => Promise<string | undefined>;

package/dist/auth.js

@@ -0,0 +1,79 @@
+export function authConfig(env = process.env, f = fetch) {
+    return { clientId: env.GENESIS_CLIENT_ID, authApi: (env.GENESIS_AUTH_API ?? 'https://api.workos.com').replace(/\/+$/, ''), fetch: f };
+}
+function needClient(c) {
+    if (!c.clientId)
+        throw new Error('Login is not configured: set GENESIS_CLIENT_ID to the LifeID AuthKit client id (staging), or use GENESIS_API_KEY.');
+    return c.clientId;
+}
+async function post(c, path, body) {
+    const res = await c.fetch(`${c.authApi}${path}`, { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' }, body: new URLSearchParams(body).toString() });
+    const json = await res.json().catch(() => ({}));
+    return { ok: res.ok, status: res.status, json };
+}
+export async function startDevice(c) {
+    const r = await post(c, '/user_management/authorize/device', { client_id: needClient(c) });
+    if (!r.ok)
+        throw new Error(`Could not start login (${r.status}): ${r.json.error_description ?? r.json.message ?? r.json.error ?? 'unknown error'}`);
+    return r.json;
+}
+export function jwtExp(token) {
+    try {
+        return JSON.parse(Buffer.from(token.split('.')[1], 'base64url').toString()).exp;
+    }
+    catch {
+        return undefined;
+    }
+}
+function toSaved(c, j) {
+    return { access_token: j.access_token, refresh_token: j.refresh_token, user: j.user, organization_id: j.organization_id, expires_at: jwtExp(j.access_token), client_id: needClient(c) };
+}
+export async function pollDevice(c, d) {
+    const sleep = c.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    let interval = (d.interval || 5) * 1000;
+    const deadline = Date.now() + (d.expires_in || 300) * 1000;
+    while (Date.now() < deadline) {
+        await sleep(interval);
+        const r = await post(c, '/user_management/authenticate', { grant_type: 'urn:ietf:params:oauth:grant-type:device_code', device_code: d.device_code, client_id: needClient(c) });
+        if (r.ok)
+            return toSaved(c, r.json);
+        const err = r.json.error;
+        if (err === 'authorization_pending')
+            continue;
+        if (err === 'slow_down') {
+            interval += 5000;
+            continue;
+        }
+        if (err === 'access_denied')
+            throw new Error('Login was denied in the browser.');
+        if (err === 'expired_token')
+            break;
+        throw new Error(`Login failed (${r.status}): ${r.json.error_description ?? err ?? 'unknown error'}`);
+    }
+    throw new Error('Login code expired. Run `genesis login` again.');
+}
+export async function refresh(c, s, organizationId) {
+    if (!s.refresh_token)
+        throw new Error('Session expired. Run `genesis login`.');
+    const body = { grant_type: 'refresh_token', refresh_token: s.refresh_token, client_id: s.client_id };
+    if (organizationId)
+        body.organization_id = organizationId;
+    const r = await post(c, '/user_management/authenticate', body);
+    if (!r.ok)
+        throw new Error(r.json.error === 'invalid_grant' ? 'Session expired. Run `genesis login`.' : `Could not refresh session (${r.status}): ${r.json.error_description ?? r.json.error}`);
+    return { ...toSaved({ ...c, clientId: s.client_id }, r.json), user: r.json.user ?? s.user };
+}
+/** Credential provider for the SDK: saved login, refreshed if within 60s of expiry. */
+export function savedLoginProvider(c, store, now = () => Date.now() / 1000) {
+    return async () => {
+        let s = await store.get();
+        if (!s)
+            return undefined;
+        const exp = s.expires_at ?? jwtExp(s.access_token);
+        if (exp && exp - 60 < now()) {
+            s = await refresh(c, s, s.organization_id);
+            await store.set(s);
+        }
+        return s.access_token;
+    };
+}

package/dist/beacons.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+import type { Genesis } from '@lifesi/genesis';
+export declare function registerBeacons(program: Command, client: () => Promise<Genesis>, emit: (data: unknown, pretty: () => string) => void): void;

package/dist/beacons.js

@@ -0,0 +1,20 @@
+export function registerBeacons(program, client, emit) {
+    const devices = program.command('beacons').description('Beacons: Agent-native mesh').command('devices').description('Manage Bridge devices in your signed-in organization');
+    devices.command('list', { isDefault: true }).action(async () => {
+        const result = await (await client()).beacons.devices.list();
+        emit(result, () => JSON.stringify(result, null, 2));
+    });
+    devices.command('update <id>').option('--name <name>', 'Device name').option('--nickname <nickname...>', 'Replace nicknames').option('--clear-nicknames', 'Remove all nicknames')
+        .action(async (id, opts) => {
+        if (opts.clearNicknames && opts.nickname)
+            throw new Error('Choose --nickname or --clear-nicknames.');
+        if (opts.name === undefined && opts.nickname === undefined && !opts.clearNicknames)
+            throw new Error('Supply --name, --nickname or --clear-nicknames.');
+        const result = await (await client()).beacons.devices.update(id, { ...(opts.name === undefined ? {} : { name: opts.name }), ...(opts.clearNicknames ? { nicknames: [] } : opts.nickname ? { nicknames: opts.nickname } : {}) });
+        emit(result, () => JSON.stringify(result, null, 2));
+    });
+    devices.command('revoke <id>').description('Request durable mesh teardown').action(async (id) => {
+        const result = await (await client()).beacons.devices.revoke(id);
+        emit(result ?? { status: 'revoked' }, () => JSON.stringify(result ?? { status: 'revoked' }, null, 2));
+    });
+}

package/dist/dials.d.ts

@@ -0,0 +1,7 @@
+import { Command } from 'commander';
+import type { Genesis } from '@lifesi/genesis';
+export declare function registerDials(program: Command, dependencies: {
+    client: () => Promise<Genesis>;
+    orgId: (client: Genesis) => Promise<string>;
+    emit: (data: unknown, pretty: () => string) => void;
+}): void;

package/dist/dials.js

@@ -0,0 +1,49 @@
+import { readFile } from 'node:fs/promises';
+export function registerDials(program, dependencies) {
+    const dials = program.command('dials').description('Dials: phone numbers and calls for agents')
+        .requiredOption('--workspace <id>', 'selected workspace')
+        .requiredOption('--project <id>', 'selected project')
+        .requiredOption('--environment <id>', 'selected environment');
+    const context = async () => {
+        const client = await dependencies.client();
+        const options = dials.opts();
+        const scope = { organizationId: await dependencies.orgId(client), workspaceId: options.workspace, projectId: options.project, environmentId: options.environment };
+        return { client, scope };
+    };
+    const emit = (data) => dependencies.emit(data, () => JSON.stringify(data, null, 2));
+    const numbers = dials.command('numbers').description('Carrier number inventory');
+    numbers.command('list', { isDefault: true }).action(async () => { const { client, scope } = await context(); emit(await client.dials.numbers.list(scope)); });
+    numbers.command('search').option('--area-code <code>', 'three digit area code').option('--filters <json-or-@file>', 'carrier search filters, including capabilities and rate center').action(async (options) => {
+        const { client, scope } = await context();
+        const text = options.filters?.startsWith('@') ? await readFile(options.filters.slice(1), 'utf8') : options.filters;
+        const filters = text ? JSON.parse(text) : {};
+        if (!filters || typeof filters !== 'object' || Array.isArray(filters))
+            throw new Error('Search filters must be a JSON object.');
+        const allowed = new Set(['areaCode', 'exchangeCode', 'localCallingArea', 'contains', 'startsWith', 'endsWith', 'repeatingDigit', 'repeatingDigitCount', 'region', 'locality', 'postalCode', 'rateCenter', 'lata', 'nearNumber', 'nearLatLong', 'distance', 'excludeAddressRequired', 'excludeLocalAddressRequired', 'excludeForeignAddressRequired', 'beta', 'voice', 'sms', 'mms', 'fax', 'numberType', 'limit']);
+        if (Object.keys(filters).some(key => !allowed.has(key)))
+            throw new Error('Unsupported Dials search filter. Scope is selected by the command context.');
+        emit(await client.dials.numbers.search(scope, { ...filters, ...(options.areaCode ? { areaCode: options.areaCode } : {}) }));
+    });
+    numbers.command('reconciliations').action(async () => { const { client, scope } = await context(); emit(await client.dials.numbers.reconciliations(scope)); });
+    numbers.command('drift').action(async () => { const { client, scope } = await context(); emit(await client.dials.numbers.drift(scope)); });
+    dials.command('overview').action(async () => { const { client, scope } = await context(); emit(await client.dials.overview.summary(scope)); });
+    dials.command('operating-surface').action(async () => { const { client, scope } = await context(); emit(await client.dials.overview.operatingSurface(scope)); });
+    const calls = dials.command('calls').description('Call activity and approved outbound calls');
+    calls.command('list', { isDefault: true }).action(async () => { const { client, scope } = await context(); emit(await client.dials.calls.list(scope)); });
+    // @file keeps structured approval and idempotency fields out of shell history.
+    for (const [parent, name, operation] of [
+        [numbers, 'caller-name', 'dials_updateNumberCallerName'], [numbers, 'reconcile', 'dials_reconcileNumberInventory'],
+        [numbers, 'provision', 'dials_provisionNumber'], [numbers, 'assign', 'dials_assignNumber'], [numbers, 'release', 'dials_releaseNumber'], [numbers, 'e911', 'dials_registerEmergencyAddress'],
+        [calls, 'validate', 'dials_validateOutboundCall'], [calls, 'create', 'dials_createOutboundCall'],
+    ]) {
+        parent.command(name).requiredOption('--body <json-or-@file>', 'JSON input including actorId and required operation fields')
+            .action(async (options) => {
+            const { client, scope } = await context();
+            const text = options.body.startsWith('@') ? await readFile(options.body.slice(1), 'utf8') : options.body;
+            const body = JSON.parse(text);
+            if (!body || typeof body !== 'object' || Array.isArray(body))
+                throw new Error('Dials body must be a JSON object.');
+            emit(await client.call(operation, { body: { ...body, scope } }));
+        });
+    }
+}

package/dist/fleets.d.ts

@@ -0,0 +1,4 @@
+import type { Command } from 'commander';
+import type { Genesis } from '@lifesi/genesis';
+export declare function readFoundryKey(input?: AsyncIterable<Uint8Array>): Promise<string>;
+export declare function registerFleets(program: Command, client: () => Promise<Genesis>, emit: (data: unknown) => void, keyInput?: () => Promise<string>): void;

package/dist/fleets.js

@@ -0,0 +1,44 @@
+export async function readFoundryKey(input = process.stdin) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of input) {
+        const bytes = Buffer.from(chunk);
+        size += bytes.length;
+        if (size > 4098)
+            throw new Error('Foundry key must contain at most 4096 bytes.');
+        chunks.push(bytes);
+    }
+    let key;
+    try {
+        key = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(Buffer.concat(chunks)).replace(/\r?\n$/, '');
+    }
+    catch {
+        throw new Error('Invalid UTF-8 Foundry key on stdin.');
+    }
+    if (!key || Buffer.byteLength(key) > 4096 || /[\r\n\0]/.test(key))
+        throw new Error('Invalid Foundry key on stdin.');
+    return key;
+}
+export function registerFleets(program, client, emit, keyInput = readFoundryKey) {
+    const fleets = program.command('fleets').description('Fleets: managed agent tasks');
+    const connection = fleets.command('connection').description('Organization-owned Foundry connection');
+    connection.command('get').action(async () => emit(await (await client()).fleets.connection.get()));
+    connection.command('set').description('Read a Foundry key from stdin and encrypt it with Genesis KMS').action(async () => {
+        const apiKey = await keyInput();
+        emit(await (await client()).fleets.connection.set(apiKey));
+    });
+    connection.command('delete').action(async () => emit(await (await client()).fleets.connection.delete()));
+    const tasks = fleets.command('tasks');
+    tasks.command('list').option('--limit <number>').option('--before <task_id>').action(async (options) => {
+        emit(await (await client()).fleets.tasks.list({ ...(options.limit ? { limit: Number(options.limit) } : {}), ...(options.before ? { before: options.before } : {}) }));
+    });
+    tasks.command('submit <input>').option('--timeout <seconds>', 'task deadline in seconds', '300').requiredOption('--idempotency-key <key>', 'stable key to reuse on retry').action(async (input, options) => {
+        const timeout = Number(options.timeout);
+        if (!Number.isInteger(timeout) || timeout < 1 || timeout > 3600)
+            throw new Error('Timeout must be 1–3600 seconds.');
+        emit(await (await client()).fleets.tasks.submit({ input, timeout_seconds: timeout, idempotency_key: options.idempotencyKey }));
+    });
+    tasks.command('get <task_id>').action(async (id) => emit(await (await client()).fleets.tasks.get(id)));
+    tasks.command('cancel <task_id>').action(async (id) => emit(await (await client()).fleets.tasks.cancel(id)));
+    tasks.command('receipt <task_id>').action(async (id) => emit(await (await client()).fleets.tasks.receipt(id)));
+}

package/dist/function-input.d.ts

@@ -0,0 +1,3 @@
+export declare function readFunctionFile(path: string, limit: number): Promise<Uint8Array>;
+export declare function readFunctionJson(path: string, limit: number): Promise<Record<string, unknown>>;
+export declare function writeFunctionOutput(path: string, bytes: Uint8Array): Promise<void>;

package/dist/function-input.js

@@ -0,0 +1,49 @@
+import { open, writeFile } from 'node:fs/promises';
+export async function readFunctionFile(path, limit) {
+    let file;
+    try {
+        file = await open(path, 'r');
+    }
+    catch {
+        throw new Error('Could not open the function input file. Check its path and permissions.');
+    }
+    try {
+        const stat = await file.stat();
+        if (!stat.isFile() || stat.size > limit)
+            throw new Error('Choose a regular function input file within the documented size limit.');
+        const bytes = new Uint8Array(limit + 1);
+        let size = 0;
+        for (;;) {
+            const { bytesRead } = await file.read(bytes, size, bytes.length - size, null);
+            if (!bytesRead)
+                break;
+            size += bytesRead;
+            if (size > limit)
+                throw new Error('Function input file exceeds the documented size limit.');
+        }
+        return bytes.slice(0, size);
+    }
+    finally {
+        await file.close();
+    }
+}
+export async function readFunctionJson(path, limit) {
+    const bytes = await readFunctionFile(path, limit);
+    try {
+        const value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            throw new Error();
+        return value;
+    }
+    catch {
+        throw new Error('Function request file must contain a JSON object. No input value is echoed.');
+    }
+}
+export async function writeFunctionOutput(path, bytes) {
+    try {
+        await writeFile(path, bytes, { flag: 'wx', mode: 0o600 });
+    }
+    catch {
+        throw new Error('Could not create the output file. Choose a new path with write permission. Existing files are preserved.');
+    }
+}

package/dist/henry.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+import type { Genesis } from '@lifesi/genesis';
+export declare function addHenryCommands(program: Command, client: () => Promise<Genesis>, output: (value: unknown) => void): void;

package/dist/henry.js

@@ -0,0 +1,31 @@
+export function addHenryCommands(program, client, output) {
+    const henry = program.command('henry').description('Henry: agent runtime, live activity and approvals');
+    henry.command('config').action(async () => output(await (await client()).henry.config()));
+    henry.command('credential').description('Read a Foundry API key from stdin and encrypt it in Genesis KMS')
+        .action(async () => {
+        const chunks = [];
+        let size = 0;
+        for await (const chunk of process.stdin) {
+            size += Buffer.byteLength(chunk);
+            if (size > 4096)
+                throw new Error('Foundry API key exceeds limit');
+            chunks.push(Buffer.from(chunk));
+        }
+        output(await (await client()).henry.credential(Buffer.concat(chunks).toString('utf8').trim()));
+    });
+    henry.command('runs').option('--page-token <token>').action(async (options) => output(await (await client()).henry.runs.list(options.pageToken)));
+    henry.command('run').requiredOption('--model <model>').requiredOption('--task <text>').option('--run-id <uuid>', 'UUIDv4 for concurrent activity polling')
+        .action(async (options) => output(await (await client()).henry.runs.create({ model: options.model, task: options.task, ...(options.runId ? { run_id: options.runId } : {}) })));
+    henry.command('get <run_id>').action(async (runId) => output(await (await client()).henry.runs.get(runId)));
+    henry.command('command <run_id> <action>').option('--text <text>')
+        .action(async (runId, action, options) => {
+        if (!['pause', 'resume', 'cancel', 'input'].includes(action))
+            throw new Error('Action must be pause, resume, cancel or input');
+        output(await (await client()).henry.runs.command(runId, action, options.text));
+    });
+    henry.command('approval <run_id> <approval_id> <decision>').action(async (runId, approvalId, decision) => {
+        if (!['approve', 'reject'].includes(decision))
+            throw new Error('Decision must be approve or reject');
+        output(await (await client()).henry.runs.approval(runId, approvalId, decision));
+    });
+}

package/dist/hives-node-transport.d.ts

@@ -0,0 +1,6 @@
+import { type GenesisOptions } from '@lifesi/genesis';
+export declare function closeHivesNodeTransport(): Promise<void>;
+export declare function hivesOperationBudget(id: string): number;
+/** Hives leaf transport. Caller fetch overrides stay authoritative; only native
+ * global fetch gets our Agent. Every operation retains an overall body deadline. */
+export declare function createHivesNodeTransport(opts: GenesisOptions, callerSignal?: AbortSignal): typeof fetch;

package/dist/hives-node-transport.js

@@ -0,0 +1,145 @@
+import { Agent } from 'undici';
+import { Genesis, operationTable } from '@lifesi/genesis';
+// Node's native fetch accepts a compatible per-request dispatcher. Never change
+// the global dispatcher or the portable SDK: other products retain their transport.
+const agentOptions = { headersTimeout: 340_000, bodyTimeout: 340_000, connect: { timeout: 5_000 }, connections: 4, pipelining: 1 };
+let agent;
+const nativeAgent = () => agent ??= new Agent(agentOptions);
+export async function closeHivesNodeTransport() {
+    const current = agent;
+    agent = undefined;
+    await current?.destroy();
+}
+export function hivesOperationBudget(id) {
+    if (id === 'hives_cancel_deployment' || id === 'hives_delete_deployment')
+        return 330_000;
+    if (['hives_create_deployment', 'hives_upload_deployment', 'hives_invoke_deployment', 'hives_invoke_function', 'hives_invoke_function_async'].includes(id))
+        return 40_000;
+    if (['hives_create_function', 'hives_update_function', 'hives_delete_function'].includes(id))
+        return 100_000;
+    return 20_000;
+}
+const escape = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+const templatePattern = (value) => new RegExp('^' + value.split(/(\{[^}]+\})/).map((part) => part.startsWith('{') ? '[^/]+' : escape(part)).join('') + '$');
+/** Hives leaf transport. Caller fetch overrides stay authoritative; only native
+ * global fetch gets our Agent. Every operation retains an overall body deadline. */
+export function createHivesNodeTransport(opts, callerSignal) {
+    const supplied = opts.fetch ?? globalThis.fetch;
+    const underlying = supplied.bind(globalThis);
+    const useNative = supplied === globalThis.fetch;
+    const resolver = new Genesis(opts);
+    const routes = Object.entries(operationTable)
+        .filter(([, op]) => op.service === 'hives' && !op.internal)
+        .flatMap(([id, op]) => {
+        const direct = resolver.routing === 'direct';
+        let base;
+        try {
+            base = new URL(direct ? (opts.upstreams?.hives ?? op.upstream.base) : resolver.baseUrl);
+        }
+        catch {
+            throw new Error('Invalid Hives service address.');
+        }
+        const path = direct ? op.upstream.path : op.path;
+        const prefix = base.pathname.replace(/\/+$/, '');
+        const paths = [path];
+        if (!direct && path.startsWith('/v1/hives/'))
+            paths.push(path.replace('/v1/hives/', '/hives/v1/'));
+        return paths.map((p) => ({ id, origin: base.origin, method: direct ? op.upstream.method : op.method, pattern: templatePattern(prefix + p) }));
+    });
+    return (async (input, init = {}) => {
+        let url;
+        try {
+            url = new URL(input instanceof Request ? input.url : String(input));
+        }
+        catch {
+            throw new Error('Invalid Hives request address.');
+        }
+        const method = (init.method ?? (input instanceof Request ? input.method : 'GET')).toUpperCase();
+        const route = routes.find((entry) => entry.origin === url.origin && entry.method === method && entry.pattern.test(url.pathname));
+        if (!route)
+            return underlying(input, init);
+        const controller = new AbortController();
+        let message = 'Hives transport failed. Refresh the resource and retry.';
+        const safeError = () => new Error(message);
+        const signals = [...new Set([callerSignal, init.signal, input instanceof Request ? input.signal : undefined].filter((signal) => !!signal))];
+        const canceled = () => {
+            message = 'Hives request canceled before completion. Refresh the resource before retrying.';
+            controller.abort();
+        };
+        for (const signal of signals)
+            signal.addEventListener('abort', canceled, { once: true });
+        const timer = setTimeout(() => {
+            message = 'Hives request deadline exceeded. Refresh the resource before retrying.';
+            controller.abort();
+        }, hivesOperationBudget(route.id));
+        timer.unref();
+        let abortReject = () => { };
+        let reader;
+        let bodyController;
+        const aborted = () => {
+            abortReject(safeError());
+            bodyController?.error(safeError());
+            void reader?.cancel().catch(() => { });
+            cleanup();
+        };
+        controller.signal.addEventListener('abort', aborted, { once: true });
+        const abortPromise = new Promise((_, reject) => { abortReject = reject; });
+        void abortPromise.catch(() => { });
+        const cleanup = () => {
+            clearTimeout(timer);
+            for (const signal of signals)
+                signal.removeEventListener('abort', canceled);
+            controller.signal.removeEventListener('abort', aborted);
+        };
+        if (signals.some((signal) => signal.aborted))
+            canceled();
+        try {
+            if (controller.signal.aborted)
+                throw safeError();
+            const requestInit = {
+                ...init, signal: controller.signal, cache: 'no-store',
+                redirect: init.redirect === 'manual' ? 'manual' : 'error',
+                ...(useNative ? { dispatcher: nativeAgent() } : {}),
+            };
+            const pending = underlying(input, requestInit);
+            // A caller transport may ignore AbortSignal. Reject on our budget anyway,
+            // and discard any late response rather than presenting an acknowledgement.
+            void pending.then((response) => { if (controller.signal.aborted)
+                void response.body?.cancel().catch(() => { }); }, () => { });
+            const response = await Promise.race([pending, abortPromise]);
+            if (controller.signal.aborted)
+                throw safeError();
+            if (!response.body) {
+                cleanup();
+                return response;
+            }
+            reader = response.body.getReader();
+            const body = new ReadableStream({
+                start(value) { bodyController = value; },
+                async pull(value) {
+                    try {
+                        const next = await reader.read();
+                        if (controller.signal.aborted)
+                            return;
+                        if (next.done) {
+                            cleanup();
+                            value.close();
+                        }
+                        else
+                            value.enqueue(next.value);
+                    }
+                    catch {
+                        cleanup();
+                        value.error(safeError());
+                    }
+                },
+                async cancel() { cleanup(); await reader.cancel().catch(() => { }); },
+            });
+            return new Response(body, { status: response.status, statusText: response.statusText, headers: response.headers });
+        }
+        catch {
+            cleanup();
+            throw safeError();
+        }
+    });
+}

package/dist/index.d.ts

@@ -0,0 +1,20 @@
+import { Command } from 'commander';
+import { type CredentialStore } from './store.js';
+import { type Out } from './output.js';
+import { type SecretInputOptions } from './secret-input.js';
+export interface Deps {
+    out?: Out;
+    store?: () => Promise<CredentialStore>;
+    fetch?: typeof fetch;
+    /** Cancel Hives calls through response-body completion; other products retain their transport. */
+    signal?: AbortSignal;
+    env?: Record<string, string | undefined>;
+    openBrowser?: (url: string) => void;
+    sleep?: (ms: number) => Promise<void>;
+    readSecretInput?: (options: SecretInputOptions, limit: number) => Promise<string>;
+    readWasmFile?: (path: string) => Promise<Blob>;
+    writeBytes?: (bytes: Uint8Array) => void;
+    writeOutputFile?: (path: string, bytes: Uint8Array) => Promise<void>;
+}
+export declare function buildProgram(deps?: Deps): Command;
+export declare function main(argv: string[], deps?: Deps): Promise<number>;