@lifesi/genesis-cli 0.0.0-stage → 0.1.1

package/dist/index.js

@@ -0,0 +1,430 @@
+import { registerBeacons } from './beacons.js';
+import { registerDials } from './dials.js';
+import { Command, CommanderError } from 'commander';
+import { Genesis, GenesisError, hivesResponseBytes, MAX_FUNCTION_BODY_BYTES, MAX_FUNCTION_JSON_BYTES, services } from '@lifesi/genesis';
+import { authConfig, pollDevice, refresh, savedLoginProvider, startDevice } from './auth.js';
+import { keychainStore } from './store.js';
+import { c, listOf, stdio, table } from './output.js';
+import { spawn } from 'node:child_process';
+import { addHenryCommands } from './henry.js';
+import { registerFleets } from './fleets.js';
+import { registerRunner } from './runner.js';
+import { createHivesNodeTransport } from './hives-node-transport.js';
+import { readFunctionFile, readFunctionJson, writeFunctionOutput } from './function-input.js';
+import { basename } from 'node:path';
+import { readWasmFile } from './wasm-input.js';
+import { readSecretInput, validateSecret, validateSecretValue, parseSecretBatch } from './secret-input.js';
+function defaultOpen(url) {
+    const cmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'cmd' : 'xdg-open';
+    const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
+    try {
+        spawn(cmd, args, { stdio: 'ignore', detached: true }).on('error', () => { }).unref();
+    }
+    catch { /* print-only fallback */ }
+}
+export function buildProgram(deps = {}) {
+    const out = deps.out ?? stdio;
+    const env = deps.env ?? process.env;
+    const f = deps.fetch ?? fetch;
+    const getStore = deps.store ?? keychainStore;
+    const auth = { ...authConfig(env, f), sleep: deps.sleep };
+    const program = new Command('genesis')
+        .description('One CLI for every Genesis service.')
+        .version('0.1.1')
+        .option('--json', 'machine-readable JSON output')
+        .option('--api-key <key>', 'use this API key (default: GENESIS_API_KEY, then your `genesis login`)')
+        .option('--base-url <url>', 'gateway URL (default: GENESIS_BASE_URL or https://console.life.one/api)')
+        .option('--direct', 'skip the gateway and call each service host directly (for local dev)')
+        .option('--org <org_id>', 'organization to act on')
+        .showHelpAfterError()
+        .exitOverride()
+        .configureOutput({ writeOut: (s) => out.log(s.trimEnd()), writeErr: (s) => out.err(s.trimEnd()) });
+    const g = () => program.opts();
+    const client = async (hivesTransport = false) => {
+        const o = g();
+        const store = await getStore().catch(() => undefined);
+        const opts = {
+            apiKey: o.apiKey ?? env.GENESIS_API_KEY, token: env.GENESIS_TOKEN,
+            baseUrl: o.baseUrl ?? env.GENESIS_BASE_URL, routing: o.direct || env.GENESIS_ROUTING === 'direct' ? 'direct' : 'gateway',
+            fetch: f, userAgent: 'genesis-cli/0.1.1',
+            credentials: store ? savedLoginProvider(auth, store) : undefined,
+        };
+        return new Genesis(hivesTransport ? { ...opts, fetch: createHivesNodeTransport(opts, deps.signal) } : opts);
+    };
+    const emit = (data, pretty) => out.log(g().json ? JSON.stringify(data, null, 2) : pretty());
+    const positiveInteger = (value, option, maximum) => {
+        if (value === undefined)
+            return undefined;
+        if (!/^\d+$/.test(value) || !Number.isSafeInteger(Number(value)) || Number(value) < 1 || Number(value) > maximum) {
+            throw new Error(`${option} must be an integer from 1 to ${maximum}.`);
+        }
+        return Number(value);
+    };
+    const projectName = (name) => {
+        if (name.length < 3 || name.length > 64 || !/^[a-z][a-z0-9-]*[a-z0-9]$/.test(name)) {
+            throw new Error('Project name must be 3–64 lowercase letters, numbers or hyphens, start with a letter and end with a letter or number.');
+        }
+        return name;
+    };
+    registerRunner(program, client, emit);
+    const orgId = async (gen) => {
+        if (g().org)
+            return g().org;
+        const s = await (await getStore().catch(() => undefined))?.get();
+        if (s?.organization_id && !g().apiKey && !env.GENESIS_API_KEY)
+            return s.organization_id;
+        return (await gen.whoami()).org;
+    };
+    registerDials(program, { client, orgId, emit });
+    // ---- auth ------------------------------------------------------------
+    program.command('login').description('Sign in with LifeID in your browser').option('--no-browser', 'just print the link')
+        .action(async (o) => {
+        const store = await getStore();
+        const d = await startDevice(auth);
+        out.err(`\n  Your code: ${c.bold(d.user_code)}\n  Opening ${d.verification_uri_complete}\n  ${c.dim('Waiting for you to approve in the browser…')}\n`);
+        if (o.browser)
+            (deps.openBrowser ?? defaultOpen)(d.verification_uri_complete);
+        const s = await pollDevice(auth, d);
+        await store.set(s);
+        emit({ user: s.user, organization_id: s.organization_id, store: store.kind }, () => `${c.green('✓')} Signed in as ${c.bold(s.user?.email ?? s.user?.id ?? 'you')}${s.organization_id ? ` (${s.organization_id})` : ''}. Token saved to your ${store.kind === 'os-keychain' ? 'OS keychain' : store.kind}.`);
+    });
+    program.command('logout').description('Forget your saved login').action(async () => {
+        const had = await (await getStore()).clear();
+        emit({ logged_out: had }, () => had ? `${c.green('✓')} Signed out.` : 'You were not signed in.');
+    });
+    program.command('whoami').description('Show who you are signed in as').action(async () => {
+        const gen = await client();
+        const saved = await (await getStore().catch(() => undefined))?.get();
+        try {
+            const p = await gen.whoami();
+            emit({ ...p, user: saved?.user }, () => [
+                `${c.bold('Org')}        ${p.org}`, `${c.bold('Principal')}  ${p.principal ?? '-'}`,
+                `${c.bold('Via')}        ${p.kind}`, `${c.bold('Scopes')}     ${p.scopes.join(', ') || '-'}`,
+                ...(saved?.user?.email ? [`${c.bold('User')}       ${saved.user.email}`] : [])
+            ].join('\n'));
+        }
+        catch (e) {
+            if (!saved || g().apiKey || env.GENESIS_API_KEY)
+                throw e;
+            // Saved login exists but LifeID verify isn't reachable yet (auth-v4-backend PR #30 not deployed).
+            emit({ user: saved.user, organization_id: saved.organization_id, verified: false, reason: e.message }, () => `${c.bold('User')}  ${saved.user?.email ?? saved.user?.id}\n${c.bold('Org')}   ${saved.organization_id ?? '-'}\n${c.yellow('!')} ${c.dim('From your saved login; LifeID verify unavailable: ' + e.message)}`);
+        }
+    });
+    const orgs = program.command('orgs').description('Your organizations');
+    orgs.command('list', { isDefault: true }).description('Show your current organization').action(async () => {
+        const s = await (await getStore()).get();
+        if (!s)
+            throw new Error('Not signed in. Run `genesis login`.');
+        const rows = s.organization_id ? [{ id: s.organization_id, current: '*' }] : [];
+        emit({ current: s.organization_id ?? null, organizations: rows }, () => `${table(rows, ['id', 'current'])}\n${c.dim('Listing every org you belong to needs a LifeID memberships endpoint (not built yet). Switch with `genesis orgs switch <org_id>`.')}`);
+    });
+    orgs.command('switch <org_id>').description('Switch your login to another organization').action(async (id) => {
+        const store = await getStore();
+        const s = await store.get();
+        if (!s)
+            throw new Error('Not signed in. Run `genesis login`.');
+        const n = await refresh(auth, s, id);
+        await store.set(n);
+        emit({ organization_id: n.organization_id }, () => `${c.green('✓')} Now using ${c.bold(n.organization_id ?? id)}.`);
+    });
+    // ---- keys ------------------------------------------------------------
+    const keys = program.command('keys').description('Org API keys (LifeID / WorkOS)');
+    keys.command('list').action(async () => {
+        const gen = await client();
+        const org = await orgId(gen);
+        const r = await gen.keys.list(org);
+        emit(r, () => table(r.data, ['id', 'name', 'obfuscated_value', 'scopes', 'last_used_at', 'expires_at']));
+    });
+    keys.command('create <name>').description('Create a key (shown once), or with --blinds hand it straight to Blinds so nobody ever sees it')
+        .option('--scopes <list>', 'comma-separated scopes, e.g. hives:read,relays:write')
+        .option('--blinds', 'store the key in Blinds; the raw key is never shown to anyone')
+        .option('--expires <iso>', 'expiry, e.g. 2027-01-01T00:00:00Z')
+        .action(async (name, o) => {
+        const gen = await client();
+        const org = await orgId(gen);
+        const k = await gen.keys.create(org, { name, custody: o.blinds ? 'blinds' : 'reveal', ...(o.scopes ? { scopes: o.scopes.split(',').map((x) => x.trim()).filter(Boolean) } : {}), ...(o.expires ? { expires_at: o.expires } : {}) });
+        emit(k, () => o.blinds
+            ? `${c.green('✓')} Key ${c.bold(k.id)} created and stored in Blinds as ${c.bold(String(k.blinds_credential_ref))}.\n  ${c.dim('No one, human or agent, will ever see the raw key.')}`
+            : `${c.green('✓')} Key ${c.bold(k.id)} created. Copy it now; it won't be shown again:\n\n  ${c.bold(String(k.value))}\n`);
+    });
+    keys.command('revoke <key_id>').action(async (id) => {
+        const gen = await client();
+        await gen.keys.revoke(id);
+        emit({ revoked: id }, () => `${c.green('✓')} Revoked ${id} ${c.dim('(takes effect within 60s)')}`);
+    });
+    // ---- foundry ---------------------------------------------------------
+    const foundry = program.command('foundry').description('Foundry: models and inference');
+    foundry.command('models').action(async () => {
+        const r = await (await client()).foundry.models.list();
+        const rows = listOf(r).map((m) => ({ id: m.id, owned_by: m.owned_by ?? m.provider ?? '' }));
+        emit(r, () => table(rows, ['id', 'owned_by']));
+    });
+    foundry.command('chat <prompt...>').description('Chat with a model').option('-m, --model <model>', 'model id', env.GENESIS_MODEL)
+        .option('--no-stream', 'wait for the full answer').option('-s, --system <text>', 'system prompt')
+        .action(async (prompt, o) => {
+        if (!o.model)
+            throw new Error('Pick a model with --model (see `genesis foundry models`) or set GENESIS_MODEL.');
+        const gen = await client();
+        const messages = [...(o.system ? [{ role: 'system', content: o.system }] : []), { role: 'user', content: prompt.join(' ') }];
+        if (o.stream && !g().json) {
+            for await (const d of gen.foundry.chatStream({ model: o.model, messages }))
+                process.stdout.write(d);
+            process.stdout.write('\n');
+            return;
+        }
+        const r = await gen.foundry.chat({ model: o.model, messages });
+        emit(r, () => r.choices?.[0]?.message?.content ?? JSON.stringify(r));
+    });
+    const hivesClient = () => client(true);
+    // ---- hives -----------------------------------------------------------
+    const hives = program.command('hives').description('Hives: projects, secrets, deployments, functions');
+    const deployments = hives.command('deployments').description('Real WASM artifacts and deployment lifecycle');
+    const emitDeployment = (data) => emit(data, () => table(data && typeof data === 'object' && !Array.isArray(data) && !('data' in data) ? [data] : listOf(data), ['id', 'version', 'status', 'module_hash', 'created_at']));
+    deployments.command('list <project_id>')
+        .option('--page <number>', 'page (1–10000)').option('--per-page <number>', 'items (1–100)')
+        .option('--status <status>', 'persisted deployment status').option('--author <id>', 'creator ID')
+        .action(async (project, o) => {
+        emitDeployment(await (await hivesClient()).hives.deployments.list(project, {
+            page: positiveInteger(o.page, '--page', 10000), per_page: positiveInteger(o.perPage, '--per-page', 100), status: o.status, author: o.author,
+        }));
+    });
+    deployments.command('get <project_id> <deployment_id>')
+        .action(async (project, deployment) => emitDeployment(await (await hivesClient()).hives.deployments.get(project, deployment)));
+    deployments.command('upload <project_id> <wasm_file>').description('Upload actual WASM bytes; Git options are labels only')
+        .option('--git-sha <sha>', 'commit label (7–40 characters)').option('--git-branch <branch>', 'branch label').option('--git-message <message>', 'commit label')
+        .action(async (project, path, o) => {
+        const file = await (deps.readWasmFile ?? readWasmFile)(path);
+        emitDeployment(await (await hivesClient()).hives.deployments.upload(project, file, {
+            filename: basename(path), git_sha: o.gitSha, git_branch: o.gitBranch, git_message: o.gitMessage,
+        }));
+    });
+    deployments.command('reuse <project_id> <module_hash>').description('Deploy a real artifact already owned by this org and project')
+        .option('--no-auto-promote', 'keep the completed deployment ready for explicit promotion')
+        .action(async (project, module_hash, o) => {
+        if (!/^[a-f0-9]{64}$/.test(module_hash))
+            throw new Error('module_hash must be the lowercase SHA-256 returned by a real Hives upload.');
+        emitDeployment(await (await hivesClient()).hives.deployments.create(project, { module_hash, auto_promote: o.autoPromote }));
+    });
+    deployments.command('promote <project_id> <deployment_id>')
+        .action(async (project, deployment) => emitDeployment(await (await hivesClient()).hives.deployments.promote(project, deployment)));
+    deployments.command('rollback <project_id> <deployment_id>').description('Activate this owned previous deployment')
+        .option('--reason <text>', 'audit reason')
+        .action(async (project, deployment, o) => emitDeployment(await (await hivesClient()).hives.deployments.rollback(project, deployment, { reason: o.reason })));
+    deployments.command('cancel <project_id> <deployment_id>')
+        .action(async (project, deployment) => emitDeployment(await (await hivesClient()).hives.deployments.cancel(project, deployment)));
+    deployments.command('delete <project_id> <deployment_id>').description('Delete a deployment that is not currently active')
+        .action(async (project, deployment) => { const result = await (await hivesClient()).hives.deployments.delete(project, deployment); emit(result, () => `Deleted deployment ${deployment}.`); });
+    deployments.command('logs <project_id> <deployment_id>').description('Read real persisted deployment logs')
+        .option('--page <number>', 'page (1–10000)').option('--per-page <number>', 'items (1–100)')
+        .option('--level <level>', 'minimum level').option('--search <text>', 'search log messages')
+        .option('--start <iso>', 'RFC 3339 start time').option('--end <iso>', 'RFC 3339 end time')
+        .action(async (project, deployment, o) => {
+        for (const timestamp of [o.start, o.end])
+            if (timestamp !== undefined && !Number.isFinite(Date.parse(timestamp)))
+                throw new Error('Log timestamps must use RFC 3339.');
+        const result = await (await hivesClient()).hives.deployments.logs(project, deployment, {
+            page: positiveInteger(o.page, '--page', 10000), per_page: positiveInteger(o.perPage, '--per-page', 100),
+            level: o.level, search: o.search, start: o.start, end: o.end,
+        });
+        emit(result, () => table(result.logs, ['timestamp', 'level', 'message', 'source']));
+    });
+    const emitFunction = (value) => emit(value, () => table(listOf(value).length ? listOf(value) : [value], ['id', 'name', 'status', 'handler', 'memory_mb', 'timeout_ms']));
+    const functions = hives.command('functions').description('Owned WASM functions; invocation returns the completed raw guest response');
+    functions.command('list <project_id>').option('--page <n>').option('--per-page <n>').option('--status <status>').option('--search <text>')
+        .action(async (project, o) => emitFunction(await (await hivesClient()).hives.functions.list(project, {
+        page: positiveInteger(o.page, '--page', 1000000), per_page: positiveInteger(o.perPage, '--per-page', 100), status: o.status, search: o.search,
+    })));
+    functions.command('get <project_id> <function_id>').action(async (project, id) => emitFunction(await (await hivesClient()).hives.functions.get(project, id)));
+    functions.command('create <project_id> <name> <module_hash>').option('--request-file <file>', 'JSON metadata and encrypted env overrides; input values are never printed')
+        .action(async (project, name, hash, o) => {
+        if (!/^[a-f0-9]{64}$/.test(hash))
+            throw new Error('Use a full lowercase artifact hash from an owned Hives upload.');
+        const extra = o.requestFile ? await readFunctionJson(o.requestFile, 256 * 1024) : {};
+        emitFunction(await (await hivesClient()).hives.functions.create(project, { ...extra, name, handler: `wasm://sha256/${hash}` }));
+    });
+    functions.command('update <project_id> <function_id>').requiredOption('--request-file <file>', 'JSON supported metadata/env/remove_env fields; values are never printed')
+        .action(async (project, id, o) => emitFunction(await (await hivesClient()).hives.functions.update(project, id, await readFunctionJson(o.requestFile, 256 * 1024))));
+    functions.command('delete <project_id> <function_id>').action(async (project, id) => {
+        const result = await (await hivesClient()).hives.functions.delete(project, id);
+        emit(result, () => `Deleted function ${id}.`);
+    });
+    function invocationCommand(command, kind) {
+        command.description('Complete real guest execution; write exact bytes, including executed HTTP error bodies')
+            .option('--request-file <file>', 'JSON method/path/headers/body or body_base64')
+            .option('--body-file <file>', 'Exact binary body (up to 10 MiB; serialized guest envelope may reach its cap earlier)')
+            .option('--method <method>', 'guest HTTP method', 'POST').option('--path <path>', 'guest path including query', '/')
+            .option('--output <file>', 'create a new private file containing exact response bytes')
+            .action(async (project, id, o) => {
+            if (o.requestFile && o.bodyFile)
+                throw new Error('Choose --request-file or --body-file.');
+            if (g().json && o.output)
+                throw new Error('Choose --json or --output.');
+            let request = o.requestFile ? await readFunctionJson(o.requestFile, MAX_FUNCTION_JSON_BYTES) : { method: o.method, path: o.path };
+            if (o.bodyFile)
+                request.body_base64 = Buffer.from(await readFunctionFile(o.bodyFile, MAX_FUNCTION_BODY_BYTES)).toString('base64');
+            const response = await (await hivesClient()).hives[kind].invoke(project, id, request);
+            const bytes = await hivesResponseBytes(response);
+            if (g().json)
+                out.log(JSON.stringify({ status: response.status, headers: Object.fromEntries(response.headers), body_base64: Buffer.from(bytes).toString('base64') }));
+            else {
+                out.err(JSON.stringify({ status: response.status, headers: Object.fromEntries(response.headers), bytes: bytes.length }));
+                if (o.output)
+                    await (deps.writeOutputFile ?? writeFunctionOutput)(o.output, bytes);
+                else
+                    (deps.writeBytes ?? ((value) => { process.stdout.write(value); }))(bytes);
+            }
+        });
+    }
+    invocationCommand(functions.command('invoke <project_id> <function_id>'), 'functions');
+    invocationCommand(deployments.command('invoke <project_id> <deployment_id>'), 'deployments');
+    const secrets = hives.command('secrets').description('Project secrets encrypted with Genesis KMS');
+    const readInput = async (options, limit) => {
+        if (Boolean(options.file) === Boolean(options.stdin))
+            throw new Error('Choose exactly one input source: a file or --stdin. Secret values are not accepted as command arguments.');
+        return (deps.readSecretInput ?? readSecretInput)(options, limit);
+    };
+    const emitSecret = (data) => emit(data, () => table(listOf(data), ['id', 'name', 'version', 'description', 'updated_at']));
+    secrets.command('list <project_id>').description('List secret metadata without values')
+        .option('--page <number>', 'page number (1–10000)').option('--per-page <number>', 'items per page (1–100)')
+        .action(async (id, o) => {
+        const q = { page: positiveInteger(o.page, '--page', 10000), per_page: positiveInteger(o.perPage, '--per-page', 100) };
+        emitSecret(await (await hivesClient()).hives.secrets.list(id, q));
+    });
+    secrets.command('get <project_id> <secret_id>').description('Inspect secret metadata without its value')
+        .action(async (project, secret) => {
+        const r = await (await hivesClient()).hives.secrets.get(project, secret);
+        emit(r, () => table([r], ['id', 'name', 'version', 'description', 'updated_at']));
+    });
+    secrets.command('create <project_id> <name>').description('Create a secret; plaintext is read from a file or stdin')
+        .option('--value-file <path>', 'UTF-8 file containing the value').option('--stdin', 'read value from stdin')
+        .option('--description <text>', 'description (up to 500 characters)')
+        .action(async (project, name, o) => {
+        const body = validateSecret({ name, value: await readInput({ file: o.valueFile, stdin: o.stdin }, 65536), description: o.description });
+        const r = await (await hivesClient()).hives.secrets.create(project, body);
+        emit(r, () => table([r], ['id', 'name', 'version']));
+    });
+    secrets.command('update <project_id> <secret_id>').description('Replace a secret value, creating a new version')
+        .option('--value-file <path>', 'UTF-8 file containing the new value').option('--stdin', 'read value from stdin')
+        .action(async (project, secret, o) => {
+        const value = validateSecretValue(await readInput({ file: o.valueFile, stdin: o.stdin }, 65536));
+        const r = await (await hivesClient()).hives.secrets.update(project, secret, { value });
+        emit(r, () => table([r], ['id', 'name', 'version']));
+    });
+    secrets.command('delete <project_id> <secret_id>').description('Delete a secret in your authenticated org')
+        .action(async (project, secret) => { const r = await (await hivesClient()).hives.secrets.delete(project, secret); emit(r, () => `Deleted secret ${secret}.`); });
+    secrets.command('reveal <project_id> <secret_id>').description('Explicit, audit-logged plaintext reveal; requires --stdout')
+        .option('--stdout', 'write sensitive plaintext to stdout (avoid logs and retained output)')
+        .action(async (project, secret, o) => {
+        if (!o.stdout)
+            throw new Error('Reveal requires --stdout. This writes sensitive plaintext to your terminal or pipe; avoid logging or retaining it.');
+        const r = await (await hivesClient()).hives.secrets.reveal(project, secret);
+        emit(r, () => r.value);
+    });
+    secrets.command('bulk <project_id>').description('PUT a JSON array of secret names and values; existing names receive new versions')
+        .option('--file <path>', 'UTF-8 JSON input file').option('--stdin', 'read JSON from stdin')
+        .action(async (project, o) => {
+        const batch = parseSecretBatch(await readInput(o, 256 * 1024));
+        const r = await (await hivesClient()).hives.secrets.bulkUpsert(project, batch);
+        emit(r, () => table(r.secrets, ['id', 'name', 'version']));
+    });
+    const projects = hives.command('projects').description('Hives projects');
+    projects.command('list', { isDefault: true }).option('--search <text>', 'filter by project name')
+        .option('--page <number>', 'page number (1–10000)').option('--per-page <number>', 'items per page (1–100)')
+        .action(async (o) => {
+        const r = await (await hivesClient()).hives.projects.list({ search: o.search,
+            page: positiveInteger(o.page, '--page', 10000), per_page: positiveInteger(o.perPage, '--per-page', 100) });
+        emit(r, () => table(listOf(r), ['id', 'name', 'slug', 'region', 'total_deployments', 'active_instances']));
+    });
+    projects.command('get <project_id>').action(async (id) => {
+        const r = await (await hivesClient()).hives.projects.get(id);
+        emit(r, () => JSON.stringify(r, null, 2));
+    });
+    projects.command('create <name>').description('Create a project in your authenticated org')
+        .option('--kind <kind>', 'worker, function, site or api', 'worker')
+        .option('--description <text>', 'project description (up to 500 characters)')
+        .action(async (name, o) => {
+        if (!['worker', 'function', 'site', 'api'].includes(o.kind))
+            throw new Error('--kind must be worker, function, site or api.');
+        if (o.description && o.description.length > 500)
+            throw new Error('--description must be at most 500 characters.');
+        const r = await (await hivesClient()).hives.projects.create({ name: projectName(name), kind: o.kind,
+            ...(o.description === undefined ? {} : { description: o.description }) });
+        emit(r, () => table([r], ['id', 'name', 'slug', 'status']));
+    });
+    projects.command('rename <project_id> <name>').description('Rename a project in your authenticated org')
+        .action(async (id, name) => {
+        const r = await (await hivesClient()).hives.projects.update(id, { name: projectName(name) });
+        emit(r, () => table([r], ['id', 'name', 'slug', 'status']));
+    });
+    projects.command('activity <project_id>').description('Read persisted project activity')
+        .option('--action <action>', 'filter by action')
+        .option('--actor-type <type>', 'filter by actor type')
+        .option('--resource-type <type>', 'filter by resource type')
+        .option('--since <timestamp>', 'inclusive start timestamp in ISO 8601')
+        .option('--until <timestamp>', 'inclusive end timestamp in ISO 8601')
+        .option('--page <number>', 'page number (1–10000)')
+        .option('--per-page <number>', 'items per page (1–100)')
+        .action(async (id, o) => {
+        for (const [option, value] of [['--since', o.since], ['--until', o.until]]) {
+            if (value !== undefined && (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/.test(value) || !Number.isFinite(Date.parse(value)))) {
+                throw new Error(`${option} must be an ISO 8601 timestamp.`);
+            }
+        }
+        const r = await (await hivesClient()).hives.projects.activity(id, { action: o.action,
+            actor_type: o.actorType, resource_type: o.resourceType, since: o.since, until: o.until,
+            page: positiveInteger(o.page, '--page', 10000), per_page: positiveInteger(o.perPage, '--per-page', 100) });
+        emit(r, () => table(listOf(r), ['created_at', 'action', 'actor_id', 'resource_type', 'resource_name']));
+    });
+    // ---- relays ----------------------------------------------------------
+    const relays = program.command('relays').description('Relays: DNS zones and records');
+    relays.command('zones').description('List DNS zones').option('--search <q>').action(async (o) => {
+        const r = await (await client()).relays.zones.list(o.search ? { search: o.search } : {});
+        emit(r, () => table((r.zones ?? []), ['name', 'type', 'record_count', 'dnssec_enabled', 'status']));
+    });
+    const records = relays.command('records').description('DNS records in a zone');
+    records.command('list <zone>', { isDefault: true }).option('--type <type>').action(async (zone, o) => {
+        const r = await (await client()).relays.records.list(zone, o.type ? { type: o.type } : {});
+        emit(r, () => table((r.records ?? []), ['id', 'name', 'type', 'content', 'ttl']));
+    });
+    records.command('add <zone> <name> <type> <content>').option('--ttl <seconds>', 'TTL', '3600').action(async (zone, name, type, content, o) => {
+        const r = await (await client()).relays.records.create(zone, { name, type: type.toUpperCase(), content, ttl: Number(o.ttl) });
+        emit(r, () => `${c.green('✓')} Added ${type.toUpperCase()} ${name} → ${content} in ${zone}${r.id ? ` (id ${r.id})` : ''}`);
+    });
+    records.command('rm <zone> <record_id>').action(async (zone, id) => {
+        await (await client()).relays.records.delete(zone, Number(id));
+        emit({ deleted: Number(id) }, () => `${c.green('✓')} Deleted record ${id} from ${zone}`);
+    });
+    addHenryCommands(program, client, value => out.log(JSON.stringify(value, null, 2)));
+    registerFleets(program, client, (data) => emit(data, () => JSON.stringify(data, null, 2)));
+    registerBeacons(program, client, emit);
+    // ---- status ----------------------------------------------------------
+    program.command('status').description('Which Genesis services are wired up').action(async () => {
+        emit(services, () => table(services.map((s) => ({ service: s.name, status: s.status, ops: s.operations, upstream: s.upstream, note: s.statusNote })), ['service', 'status', 'ops', 'upstream', 'note']));
+    });
+    return program;
+}
+export async function main(argv, deps = {}) {
+    const out = deps.out ?? stdio;
+    const program = buildProgram(deps);
+    try {
+        await program.parseAsync(argv);
+        return 0;
+    }
+    catch (e) {
+        if (e instanceof CommanderError)
+            return e.exitCode;
+        const json = program.opts().json;
+        if (e instanceof GenesisError) {
+            if (json)
+                out.err(JSON.stringify({ error: { type: e.type, status: e.status, message: e.message, request_id: e.requestId } }));
+            else
+                out.err(`${c.red('✗')} ${e.message}${e.status ? c.dim(` (${e.status} ${e.type}${e.requestId ? `, request ${e.requestId}` : ''})`) : ''}`);
+            return 1;
+        }
+        const msg = e.message ?? String(e);
+        const net = /fetch failed|ENOTFOUND|ECONNREFUSED/.test(msg + (e.cause?.code ?? ''));
+        out.err(json ? JSON.stringify({ error: { type: net ? 'network' : 'error', message: msg } })
+            : `${c.red('✗')} ${net ? `Could not reach the Genesis API gateway (${msg}). Try --direct to call service hosts directly.` : msg}`);
+        return 1;
+    }
+}

package/dist/output.d.ts

@@ -0,0 +1,16 @@
+export interface Out {
+    log(s: string): void;
+    err(s: string): void;
+}
+export declare const stdio: Out;
+export declare const c: {
+    bold: (s: string) => string;
+    dim: (s: string) => string;
+    green: (s: string) => string;
+    yellow: (s: string) => string;
+    red: (s: string) => string;
+};
+/** Render rows as an aligned table. */
+export declare function table(rows: Record<string, unknown>[], cols: string[]): string;
+/** Pull the array out of the various list envelopes ({data}, {zones}, {records}, bare array). */
+export declare function listOf(x: any, ...keys: string[]): any[];

package/dist/output.js

@@ -0,0 +1,27 @@
+export const stdio = { log: (s) => process.stdout.write(s + '\n'), err: (s) => process.stderr.write(s + '\n') };
+const tty = () => !!process.stdout.isTTY && !process.env.NO_COLOR;
+export const c = {
+    bold: (s) => (tty() ? `\x1b[1m${s}\x1b[0m` : s),
+    dim: (s) => (tty() ? `\x1b[2m${s}\x1b[0m` : s),
+    green: (s) => (tty() ? `\x1b[32m${s}\x1b[0m` : s),
+    yellow: (s) => (tty() ? `\x1b[33m${s}\x1b[0m` : s),
+    red: (s) => (tty() ? `\x1b[31m${s}\x1b[0m` : s),
+};
+/** Render rows as an aligned table. */
+export function table(rows, cols) {
+    if (!rows.length)
+        return c.dim('(none)');
+    const cell = (v) => (v === undefined || v === null ? '' : Array.isArray(v) ? v.join(',') : String(v));
+    const w = cols.map((k) => Math.max(k.length, ...rows.map((r) => cell(r[k]).length)));
+    const line = (vals) => vals.map((v, i) => v.padEnd(w[i])).join('  ').trimEnd();
+    return [c.bold(line(cols.map((k) => k.toUpperCase()))), ...rows.map((r) => line(cols.map((k) => cell(r[k]))))].join('\n');
+}
+/** Pull the array out of the various list envelopes ({data}, {zones}, {records}, bare array). */
+export function listOf(x, ...keys) {
+    if (Array.isArray(x))
+        return x;
+    for (const k of [...keys, 'data', 'items', 'results'])
+        if (Array.isArray(x?.[k]))
+            return x[k];
+    return [];
+}

package/dist/runner.d.ts

@@ -0,0 +1,4 @@
+import type { Command } from 'commander';
+import type { Genesis } from '@lifesi/genesis';
+/** Register only Runner commands. The authenticated credential determines org and subject. */
+export declare function registerRunner(program: Command, client: () => Promise<Genesis>, emit: (data: unknown, pretty: () => string) => void): void;

package/dist/runner.js

@@ -0,0 +1,40 @@
+/** Register only Runner commands. The authenticated credential determines org and subject. */
+export function registerRunner(program, client, emit) {
+    const runner = program.command('runner').description('Runner: agent task execution');
+    const output = (value) => emit(value, () => JSON.stringify(value, null, 2));
+    runner.command('catalog').description('Authorized workspaces and execution routes')
+        .action(async () => output(await (await client()).runner.catalog()));
+    const jobs = runner.command('jobs').description('Jobs belonging to your verified identity');
+    jobs.command('list', { isDefault: true }).description('Newest 100 jobs')
+        .action(async () => output(await (await client()).runner.jobs.list()));
+    jobs.command('start').description('Start a bounded task; refs must come from catalog')
+        .requiredOption('--task-id <id>', 'opaque task ID')
+        .requiredOption('--text <text>', 'task instructions (at most 32768 characters)')
+        .requiredOption('--workspace <ref>', 'authorized workspace key')
+        .requiredOption('--kind <kind>', 'external-harness or internal-model')
+        .requiredOption('--route <id>', 'authorized execution route')
+        .requiredOption('--idempotency-key <key>', 'stable key for retries of the same task')
+        .option('--duration-ms <ms>', 'maximum execution duration', '600000')
+        .option('--output-bytes <bytes>', 'maximum output size', '1048576')
+        .option('--max-events <count>', 'retained event limit', '200')
+        .action(async (o) => {
+        if (!['external-harness', 'internal-model'].includes(o.kind))
+            throw new TypeError('Runner kind must be external-harness or internal-model');
+        const body = {
+            task: { id: o.taskId, text: o.text }, workspaceRef: o.workspace,
+            executionRef: { kind: o.kind, routeId: o.route },
+            limits: { maxDurationMs: Number(o.durationMs), maxOutputBytes: Number(o.outputBytes), maxEvents: Number(o.maxEvents) },
+            idempotencyKey: o.idempotencyKey,
+        };
+        output(await (await client()).runner.jobs.start(body));
+    });
+    jobs.command('get <job_id>').description('Read the authoritative snapshot')
+        .action(async (id) => output(await (await client()).runner.jobs.get(id)));
+    jobs.command('events <job_id>').description('Read one event page; continue with nextAfterSeq while hasMore')
+        .option('--after-seq <seq>', 'exclusive event cursor', '0')
+        .action(async (id, o) => output(await (await client()).runner.jobs.events(id, Number(o.afterSeq))));
+    jobs.command('result <job_id>').description('Read the verified completed provider deliverable')
+        .action(async (id) => output(await (await client()).runner.jobs.result(id)));
+    jobs.command('cancel <job_id>').description('Request cancellation; then watch status and cleanupPending')
+        .action(async (id) => output(await (await client()).runner.jobs.cancel(id)));
+}

package/dist/secret-input.d.ts

@@ -0,0 +1,14 @@
+export interface SecretInputOptions {
+    file?: string;
+    stdin?: boolean;
+}
+export interface SecretInput {
+    name: string;
+    value: string;
+    description?: string;
+}
+/** Read plaintext only from an explicitly selected file or stdin, never argv. */
+export declare function readSecretInput(options: SecretInputOptions, limit: number): Promise<string>;
+export declare function validateSecretValue(value: string): string;
+export declare function validateSecret(input: unknown): SecretInput;
+export declare function parseSecretBatch(text: string): SecretInput[];

package/dist/secret-input.js

@@ -0,0 +1,85 @@
+import { open } from 'node:fs/promises';
+/** Read plaintext only from an explicitly selected file or stdin, never argv. */
+export async function readSecretInput(options, limit) {
+    if (Boolean(options.file) === Boolean(options.stdin))
+        throw new Error('Choose exactly one input source: a file or --stdin. Secret values are not accepted as command arguments.');
+    const chunks = [];
+    let size = 0;
+    const append = (chunk) => {
+        size += chunk.byteLength;
+        if (size > limit)
+            throw new Error(`Secret input exceeds ${limit} UTF-8 bytes. Use a smaller value or batch.`);
+        chunks.push(chunk);
+    };
+    if (options.file) {
+        let file;
+        try {
+            file = await open(options.file, 'r');
+        }
+        catch {
+            throw new Error('Could not open the secret input file. Check its path and permissions.');
+        }
+        try {
+            for (;;) {
+                const buffer = new Uint8Array(Math.min(8192, limit + 1));
+                const { bytesRead } = await file.read(buffer, 0, buffer.length, null);
+                if (!bytesRead)
+                    break;
+                append(buffer.subarray(0, bytesRead));
+            }
+        }
+        finally {
+            await file.close();
+        }
+    }
+    else {
+        for await (const chunk of process.stdin)
+            append(typeof chunk === 'string' ? new TextEncoder().encode(chunk) : chunk);
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    try {
+        return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    }
+    catch {
+        throw new Error('Secret input must be valid UTF-8 text.');
+    }
+}
+export function validateSecretValue(value) {
+    if (!value.length || new TextEncoder().encode(value).length > 65536)
+        throw new Error('Secret values must contain 1–65,536 UTF-8 bytes.');
+    return value;
+}
+export function validateSecret(input) {
+    if (!input || typeof input !== 'object')
+        throw new Error('Each secret needs a name and value.');
+    const { name, value, description } = input;
+    if (typeof name !== 'string' || name.length > 255 || !/^[A-Za-z][A-Za-z0-9_]*$/.test(name))
+        throw new Error('Secret names must start with a letter and contain only letters, numbers and underscores (up to 255 characters).');
+    if (typeof value !== 'string')
+        throw new Error('Each secret value must be a string.');
+    if (description !== undefined && description !== null && (typeof description !== 'string' || description.length > 500))
+        throw new Error('Secret descriptions must contain at most 500 characters.');
+    return { name, value: validateSecretValue(value), ...(typeof description === 'string' ? { description } : {}) };
+}
+export function parseSecretBatch(text) {
+    let data;
+    try {
+        data = JSON.parse(text);
+    }
+    catch {
+        throw new Error('Bulk input must be a JSON array with secret name and value fields.');
+    }
+    if (!Array.isArray(data) || !data.length)
+        throw new Error('Bulk input must be a non-empty JSON array.');
+    const batch = data.map(validateSecret);
+    if (new Set(batch.map((secret) => secret.name)).size !== batch.length)
+        throw new Error('Each secret name must appear once in a bulk update.');
+    if (new TextEncoder().encode(JSON.stringify(batch)).length > 256 * 1024)
+        throw new Error('Bulk input must fit within 256 KiB. Split it into smaller batches.');
+    return batch;
+}