@lifesi/genesis-cli 0.1.0 → 0.1.2

package/dist/beacons.js

@@ -1,5 +1,49 @@
+import { readFile } from 'node:fs/promises';
+import { createPrivateKey, sign } from 'node:crypto';
 export function registerBeacons(program, client, emit) {
-    const devices = program.command('beacons').description('Beacons: Agent-native mesh').command('devices').description('Manage Bridge devices in your signed-in organization');
+    const beacons = program.command('beacons').description('Beacons: Agent-native mesh');
+    beacons.command('fleets').description('Provision Bridge metadata in your verified selection')
+        .command('provision').requiredOption('--request-id <uuid>', 'Stable UUID; reuse with the same name on retry')
+        .option('--name <name>', 'Optional fleet name')
+        .action(async (opts) => {
+        const result = await (await client()).beacons.fleets.provision(opts.requestId, opts.name === undefined ? {} : { name: opts.name });
+        emit(result, () => JSON.stringify(result, null, 2));
+    });
+    const devices = beacons.command('devices').description('Manage Bridge devices in your signed-in organization');
+    devices.command('challenge <fleet-id>').requiredOption('--proof-key <key>', 'Base64url Ed25519 public key').requiredOption('--tunnel-key <key>', 'Base64url WireGuard public key').option('--transport <transport>', 't1_full or t2_sandboxed', 't1_full')
+        .action(async (fleetId, opts) => {
+        if (opts.transport !== 't1_full' && opts.transport !== 't2_sandboxed')
+            throw new Error('Unsupported device transport.');
+        const result = await (await client()).beacons.devices.challenge({ fleet_id: fleetId, proof_key: opts.proofKey, tunnel_key: opts.tunnelKey, transport: opts.transport });
+        emit(result, () => JSON.stringify(result, null, 2));
+    });
+    devices.command('enroll <challenge-file>').requiredOption('--key-file <path>', 'Local Ed25519 PEM private key; never uploaded')
+        .action(async (challengeFile, opts) => {
+        const challenge = JSON.parse(await readFile(challengeFile, 'utf8'));
+        const fields = ['version', 'id', 'nonce', 'issuer', 'organization', 'principal', 'workspace', 'project', 'environment', 'binding_revision', 'transport', 'fleet_id', 'proof_key', 'tunnel_key', 'issued_at', 'expires_at'];
+        if (Object.keys(challenge).length !== fields.length || fields.some(field => challenge[field] === undefined))
+            throw new Error('Invalid challenge file.');
+        const canonical = Object.fromEntries(fields.map(field => [field, challenge[field]]));
+        const key = createPrivateKey(await readFile(opts.keyFile));
+        if (key.asymmetricKeyType !== 'ed25519')
+            throw new Error('An Ed25519 device key is required.');
+        const signature = sign(null, Buffer.from('Genesis Beacons device enrollment v1\n' + JSON.stringify(canonical)), key).toString('base64url');
+        const result = await (await client()).beacons.devices.enroll({ challenge, signature });
+        emit(result, () => JSON.stringify(result, null, 2));
+    });
+    devices.command('revocations <id>').description('Poll durable transport teardown commands').action(async (id) => {
+        const result = await (await client()).beacons.devices.revocations(id);
+        emit(result, () => JSON.stringify(result, null, 2));
+    });
+    devices.command('ack <id> <version>').requiredOption('--action <action>', 'Applied interface_torn_down or peer_key_removed; apply transport action first').action(async (id, version, opts) => {
+        const numeric = Number(version);
+        if (!Number.isSafeInteger(numeric) || numeric < 1)
+            throw new Error('Invalid revocation version.');
+        if (opts.action !== 'interface_torn_down' && opts.action !== 'peer_key_removed')
+            throw new Error('Invalid transport action.');
+        const result = await (await client()).beacons.devices.acknowledge(id, numeric, { action: opts.action });
+        emit(result, () => JSON.stringify(result, null, 2));
+    });
     devices.command('list', { isDefault: true }).action(async () => {
         const result = await (await client()).beacons.devices.list();
         emit(result, () => JSON.stringify(result, null, 2));

package/dist/dials.js

@@ -13,13 +13,75 @@ export function registerDials(program, dependencies) {
     const emit = (data) => dependencies.emit(data, () => JSON.stringify(data, null, 2));
     const numbers = dials.command('numbers').description('Carrier number inventory');
     numbers.command('list', { isDefault: true }).action(async () => { const { client, scope } = await context(); emit(await client.dials.numbers.list(scope)); });
-    numbers.command('search').option('--area-code <code>', 'three digit area code').action(async (options) => { const { client, scope } = await context(); emit(await client.dials.numbers.search(scope, { areaCode: options.areaCode, limit: 10 })); });
+    numbers.command('search').option('--area-code <code>', 'three digit area code').option('--filters <json-or-@file>', 'carrier search filters, including capabilities and rate center').action(async (options) => {
+        const { client, scope } = await context();
+        const text = options.filters?.startsWith('@') ? await readFile(options.filters.slice(1), 'utf8') : options.filters;
+        const filters = text ? JSON.parse(text) : {};
+        if (!filters || typeof filters !== 'object' || Array.isArray(filters))
+            throw new Error('Search filters must be a JSON object.');
+        const allowed = new Set(['areaCode', 'exchangeCode', 'localCallingArea', 'contains', 'startsWith', 'endsWith', 'repeatingDigit', 'repeatingDigitCount', 'region', 'locality', 'postalCode', 'rateCenter', 'lata', 'nearNumber', 'nearLatLong', 'distance', 'excludeAddressRequired', 'excludeLocalAddressRequired', 'excludeForeignAddressRequired', 'beta', 'voice', 'sms', 'mms', 'fax', 'numberType', 'limit']);
+        if (Object.keys(filters).some(key => !allowed.has(key)))
+            throw new Error('Unsupported Dials search filter. Scope is selected by the command context.');
+        emit(await client.dials.numbers.search(scope, { ...filters, ...(options.areaCode ? { areaCode: options.areaCode } : {}) }));
+    });
+    numbers.command('reconciliations').action(async () => { const { client, scope } = await context(); emit(await client.dials.numbers.reconciliations(scope)); });
+    numbers.command('drift').action(async () => { const { client, scope } = await context(); emit(await client.dials.numbers.drift(scope)); });
+    dials.command('overview').action(async () => { const { client, scope } = await context(); emit(await client.dials.overview.summary(scope)); });
+    dials.command('operating-surface').action(async () => { const { client, scope } = await context(); emit(await client.dials.overview.operatingSurface(scope)); });
+    for (const [name, list, create] of [['people', 'dials_listHumanProfiles', 'dials_createHumanProfile'], ['agents', 'dials_listAgents', 'dials_createAgent'], ['voice', 'dials_listVoiceProfiles', 'dials_createVoiceProfile']]) {
+        const profiles = dials.command(name).description('Saved profile configuration in the selected scope');
+        profiles.command('list', { isDefault: true }).action(async () => { const { client, scope } = await context(); emit(await client.call(list, scope)); });
+        profiles.command('create').requiredOption('--body <json-or-@file>', 'Unassigned profile fields and actorId; same-name POST updates the stored profile').action(async (options) => {
+            const { client, scope } = await context();
+            const text = options.body.startsWith('@') ? await readFile(options.body.slice(1), 'utf8') : options.body;
+            const body = JSON.parse(text);
+            if (!body || typeof body !== 'object' || Array.isArray(body) || 'phoneNumberId' in body)
+                throw new Error('Supply unassigned profile fields; use numbers assign after saving.');
+            emit(await client.call(create, { body: { ...body, scope } }));
+        });
+    }
+    const readBody = async (value) => {
+        const body = JSON.parse(value.startsWith('@') ? await readFile(value.slice(1), 'utf8') : value);
+        if (!body || typeof body !== 'object' || Array.isArray(body))
+            throw new Error('Dials body must be a JSON object.');
+        return body;
+    };
+    const messages = dials.command('messages').description('Saved messages, templates and pending registration configuration');
+    messages.command('list', { isDefault: true }).action(async () => { const { client, scope } = await context(); emit(await client.dials.messages.list(scope)); });
+    messages.command('send').requiredOption('--body <json-or-@file>', 'Explicit approvals, actor, sender, destination, body and idempotency key')
+        .action(async (options) => { const { client, scope } = await context(); const body = await readBody(options.body); emit(await client.call('dials_createOutboundMessage', { body: { ...body, scope } })); });
+    for (const [name, list, create] of [
+        ['templates', 'dials_listMessageTemplates', 'dials_createMessageTemplate'],
+        ['brands', 'dials_listMessagingBrands', 'dials_createMessagingBrand'],
+        ['campaigns', 'dials_listMessagingCampaigns', 'dials_createMessagingCampaign'],
+    ]) {
+        const group = messages.command(name).description('Scoped saved configuration; creation is not provider approval');
+        group.command('list', { isDefault: true }).action(async () => { const { client, scope } = await context(); emit(await client.call(list, scope)); });
+        group.command('create').requiredOption('--body <json-or-@file>', 'Configuration fields and actorId')
+            .action(async (options) => { const { client, scope } = await context(); const body = await readBody(options.body); emit(await client.call(create, { body: { ...body, scope } })); });
+        if (name === 'campaigns')
+            group.command('assign').requiredOption('--campaign <id>', 'Owned campaign ID').requiredOption('--body <json-or-@file>', 'Owned phoneNumberId and actorId')
+                .action(async (options) => { const { client, scope } = await context(); const body = await readBody(options.body); emit(await client.call('dials_assignCampaignNumber', { campaign_id: options.campaign, body: { ...body, scope } })); });
+    }
+    const routing = dials.command('routing').description('Managed owned-number inbound policies; workflow documents are separate');
+    routing.command('list', { isDefault: true }).action(async () => { const { client, scope } = await context(); emit(await client.dials.routing.list(scope)); });
+    routing.command('create').requiredOption('--body <json-or-@file>', 'Owned source, supported action, priority and persisted original UUID; creates an enabled policy')
+        .action(async (options) => { const { client, scope } = await context(); const body = await readBody(options.body); emit(await client.call('dials_createRoutingRule', { body: { ...body, scope } })); });
+    routing.command('disable').requiredOption('--rule <id>', 'Owned managed policy ID; record is retained')
+        .action(async (options) => { const { client, scope } = await context(); emit(await client.dials.routing.disable(options.rule, { scope })); });
+    const workflows = dials.command('workflows').description('Persisted routing descriptors; execution is verified separately');
+    workflows.command('list', { isDefault: true }).action(async () => { const { client, scope } = await context(); emit(await client.dials.workflows.list(scope)); });
+    workflows.command('deploy').requiredOption('--body <json-or-@file>', 'Workflow graph and actorId')
+        .action(async (options) => { const { client, scope } = await context(); const body = await readBody(options.body); emit(await client.call('dials_deployWorkflow', { body: { ...body, scope } })); });
+    numbers.command('delete').requiredOption('--number <id>', 'Owned number ID to release at the carrier').requiredOption('--actor <id>', 'Actual actorId').option('--reason <text>', 'Release reason').option('--platform <id>', 'Selected data platform; omitted defaults to dials')
+        .action(async (options) => { const { client, scope } = await context(); emit(await client.dials.numbers.delete({ ...scope, ...(options.platform !== undefined ? { platformId: options.platform } : {}), number_id: options.number, actorId: options.actor, ...(options.reason !== undefined ? { reason: options.reason } : {}) })); });
     const calls = dials.command('calls').description('Call activity and approved outbound calls');
     calls.command('list', { isDefault: true }).action(async () => { const { client, scope } = await context(); emit(await client.dials.calls.list(scope)); });
     // @file keeps structured approval and idempotency fields out of shell history.
     for (const [parent, name, operation] of [
+        [numbers, 'caller-name', 'dials_updateNumberCallerName'], [numbers, 'reconcile', 'dials_reconcileNumberInventory'],
         [numbers, 'provision', 'dials_provisionNumber'], [numbers, 'assign', 'dials_assignNumber'], [numbers, 'release', 'dials_releaseNumber'], [numbers, 'e911', 'dials_registerEmergencyAddress'],
-        [calls, 'validate', 'dials_validateOutboundCall'], [calls, 'create', 'dials_createOutboundCall'],
+        [calls, 'validate', 'dials_validateOutboundCall'], [calls, 'create', 'dials_createOutboundCall'], [calls, 'recover', 'dials_recoverOutboundCall'],
     ]) {
         parent.command(name).requiredOption('--body <json-or-@file>', 'JSON input including actorId and required operation fields')
             .action(async (options) => {

package/dist/fleets.js

@@ -20,7 +20,14 @@ export async function readFoundryKey(input = process.stdin) {
     return key;
 }
 export function registerFleets(program, client, emit, keyInput = readFoundryKey) {
-    const fleets = program.command('fleets').description('Fleets: managed agent tasks');
+    const fleets = program.command('fleets').description('Fleets: managed Henry instances and tasks');
+    const instances = fleets.command('instances').description('Actual admitted Henry Host status');
+    instances.command('list').option('--limit <number>').option('--after <instance_id>').action(async (options) => {
+        emit(await (await client()).fleets.instances.list({ ...(options.limit ? { limit: Number(options.limit) } : {}), ...(options.after ? { after: options.after } : {}) }));
+    });
+    instances.command('get <instance_id>').action(async (id) => emit(await (await client()).fleets.instances.get(id)));
+    instances.command('stop <instance_id>').description('Stop admitted Henry compute and retain its data').option('--idempotency-key <uuid>', 'canonical UUID4 to retain after an uncertain reply').action(async (id, options) => emit(await (await client()).fleets.instances.stop(id, { idempotencyKey: options.idempotencyKey })));
+    instances.command('start <instance_id>').description('Connect already admitted Henry compute').option('--idempotency-key <uuid>', 'canonical UUID4 to retain after an uncertain reply').action(async (id, options) => emit(await (await client()).fleets.instances.start(id, { idempotencyKey: options.idempotencyKey })));
     const connection = fleets.command('connection').description('Organization-owned Foundry connection');
     connection.command('get').action(async () => emit(await (await client()).fleets.connection.get()));
     connection.command('set').description('Read a Foundry key from stdin and encrypt it with Genesis KMS').action(async () => {

package/dist/flocks.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+import type { Genesis } from '@lifesi/genesis';
+export declare function registerFlocks(program: Command, client: () => Promise<Genesis>, emit: (data: unknown, pretty: () => string) => void, env?: Record<string, string | undefined>): void;

package/dist/flocks.js

@@ -0,0 +1,46 @@
+export function registerFlocks(program, client, emit, env = process.env) {
+    const flocks = program.command('flocks').description('Flocks: Agents on your hardware');
+    const secret = (name) => {
+        const value = env[name];
+        if (!value)
+            throw new Error(`Set ${name} in the environment; do not pass Flocks credentials as command-line arguments.`);
+        return value;
+    };
+    const show = async (run) => {
+        const data = await run(await client());
+        emit(data, () => JSON.stringify(data, null, 2));
+    };
+    flocks.command('readiness').description('Check whether node enrollment is currently available').action(() => show(g => g.flocks.readiness.get()));
+    flocks.command('nodes').description('List your org nodes').action(() => show(g => g.flocks.nodes.list()));
+    flocks.command('join-token').option('--ttl <seconds>', 'lifetime (60–600 seconds)', '600').action((opts) => {
+        const ttl = Number(opts.ttl);
+        if (!Number.isInteger(ttl) || ttl < 60 || ttl > 600)
+            throw new Error('TTL must be 60–600 seconds');
+        return show(g => g.flocks.joinTokens.create(ttl));
+    });
+    flocks.command('rename <id> <nickname>').action((id, nickname) => show(g => g.flocks.nodes.rename(id, nickname)));
+    flocks.command('revoke <id>').action((id) => show(g => g.flocks.nodes.revoke(id)));
+    flocks.command('enroll <name> <platform> <cpus>').description('Enroll this node with FLOCKS_JOIN_TOKEN from the environment').action((name, platform, cpus) => {
+        const cpu_count = Number(cpus);
+        if (!Number.isInteger(cpu_count) || cpu_count < 1 || cpu_count > 65536)
+            throw new Error('CPUs must be 1–65536');
+        const token = secret('FLOCKS_JOIN_TOKEN');
+        return show(g => g.flocks.nodes.enroll({ token, name, platform, cpu_count }));
+    });
+    flocks.command('heartbeat <id>').description('Send presence using FLOCKS_NODE_BINDING from the environment').action((id) => {
+        const binding = secret('FLOCKS_NODE_BINDING');
+        return show(g => g.flocks.nodes.heartbeat(id, binding));
+    });
+    flocks.command('exchange-join').description('Exchange FLOCKS_JOIN_TOKEN and FLOCKS_NODE_NONCE; save the returned key privately before activation').action(() => show(g => g.flocks.joinTokens.exchange({ token: secret('FLOCKS_JOIN_TOKEN'), node_nonce: secret('FLOCKS_NODE_NONCE') })));
+    flocks.command('activate <id> <name> <platform> <cpus>').description('Activate the saved node key with FLOCKS_NODE_NONCE').action((id, name, platform, cpus) => {
+        const cpu_count = Number(cpus);
+        if (!Number.isInteger(cpu_count) || cpu_count < 1 || cpu_count > 65536)
+            throw new Error('CPUs must be 1–65536');
+        return show(g => g.flocks.nodes.activate(id, { name, platform, cpu_count, node_nonce: secret('FLOCKS_NODE_NONCE') }));
+    });
+    flocks.command('rotate <id> <action>').description('prepare→persist→commit, or cancel; use saved FLOCKS_NODE_NONCE/FLOCKS_ROTATION_NONCE').action((id, action) => {
+        if (!['prepare', 'commit', 'cancel'].includes(action))
+            throw new Error('Action must be prepare, commit or cancel');
+        return show(g => g.flocks.nodes.rotateCredential(id, { action: action, node_nonce: secret('FLOCKS_NODE_NONCE'), operation_nonce: secret('FLOCKS_ROTATION_NONCE') }));
+    });
+}

package/dist/function-input.d.ts

@@ -0,0 +1,3 @@
+export declare function readFunctionFile(path: string, limit: number): Promise<Uint8Array>;
+export declare function readFunctionJson(path: string, limit: number): Promise<Record<string, unknown>>;
+export declare function writeFunctionOutput(path: string, bytes: Uint8Array): Promise<void>;

package/dist/function-input.js

@@ -0,0 +1,49 @@
+import { open, writeFile } from 'node:fs/promises';
+export async function readFunctionFile(path, limit) {
+    let file;
+    try {
+        file = await open(path, 'r');
+    }
+    catch {
+        throw new Error('Could not open the function input file. Check its path and permissions.');
+    }
+    try {
+        const stat = await file.stat();
+        if (!stat.isFile() || stat.size > limit)
+            throw new Error('Choose a regular function input file within the documented size limit.');
+        const bytes = new Uint8Array(limit + 1);
+        let size = 0;
+        for (;;) {
+            const { bytesRead } = await file.read(bytes, size, bytes.length - size, null);
+            if (!bytesRead)
+                break;
+            size += bytesRead;
+            if (size > limit)
+                throw new Error('Function input file exceeds the documented size limit.');
+        }
+        return bytes.slice(0, size);
+    }
+    finally {
+        await file.close();
+    }
+}
+export async function readFunctionJson(path, limit) {
+    const bytes = await readFunctionFile(path, limit);
+    try {
+        const value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            throw new Error();
+        return value;
+    }
+    catch {
+        throw new Error('Function request file must contain a JSON object. No input value is echoed.');
+    }
+}
+export async function writeFunctionOutput(path, bytes) {
+    try {
+        await writeFile(path, bytes, { flag: 'wx', mode: 0o600 });
+    }
+    catch {
+        throw new Error('Could not create the output file. Choose a new path with write permission. Existing files are preserved.');
+    }
+}

package/dist/hives-node-transport.d.ts

@@ -0,0 +1,6 @@
+import { type GenesisOptions } from '@lifesi/genesis';
+export declare function closeHivesNodeTransport(): Promise<void>;
+export declare function hivesOperationBudget(id: string): number;
+/** Hives leaf transport. Caller fetch overrides stay authoritative; only native
+ * global fetch gets our Agent. Every operation retains an overall body deadline. */
+export declare function createHivesNodeTransport(opts: GenesisOptions, callerSignal?: AbortSignal): typeof fetch;

package/dist/hives-node-transport.js

@@ -0,0 +1,147 @@
+import { Agent } from 'undici';
+import { Genesis, operationTable } from '@lifesi/genesis';
+// Node's native fetch accepts a compatible per-request dispatcher. Never change
+// the global dispatcher or the portable SDK: other products retain their transport.
+const agentOptions = { headersTimeout: 340_000, bodyTimeout: 340_000, connect: { timeout: 5_000 }, connections: 4, pipelining: 1 };
+let agent;
+const nativeAgent = () => agent ??= new Agent(agentOptions);
+export async function closeHivesNodeTransport() {
+    const current = agent;
+    agent = undefined;
+    await current?.destroy();
+}
+export function hivesOperationBudget(id) {
+    if (['hives_list_buckets', 'hives_create_bucket', 'hives_get_bucket', 'hives_delete_bucket', 'hives_list_objects', 'hives_upload_object', 'hives_upload_object_by_key', 'hives_delete_object', 'hives_delete_object_by_key', 'hives_download_object_by_key', 'hives_get_cors_config', 'hives_set_cors_config', 'hives_generate_presigned_url', 'hives_reconcile'].includes(id))
+        return 100_000;
+    if (id === 'hives_cancel_deployment' || id === 'hives_delete_deployment')
+        return 330_000;
+    if (['hives_create_deployment', 'hives_upload_deployment', 'hives_invoke_deployment', 'hives_invoke_function', 'hives_invoke_function_async'].includes(id))
+        return 40_000;
+    if (['hives_create_function', 'hives_update_function', 'hives_delete_function'].includes(id))
+        return 100_000;
+    return 20_000;
+}
+const escape = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+const templatePattern = (value) => new RegExp('^' + value.split(/(\{[^}]+\})/).map((part) => part.startsWith('{') ? '[^/]+' : escape(part)).join('') + '$');
+/** Hives leaf transport. Caller fetch overrides stay authoritative; only native
+ * global fetch gets our Agent. Every operation retains an overall body deadline. */
+export function createHivesNodeTransport(opts, callerSignal) {
+    const supplied = opts.fetch ?? globalThis.fetch;
+    const underlying = supplied.bind(globalThis);
+    const useNative = supplied === globalThis.fetch;
+    const resolver = new Genesis(opts);
+    const routes = Object.entries(operationTable)
+        .filter(([, op]) => op.service === 'hives' && !op.internal)
+        .flatMap(([id, op]) => {
+        const direct = resolver.routing === 'direct';
+        let base;
+        try {
+            base = new URL(direct ? (opts.upstreams?.hives ?? op.upstream.base) : resolver.baseUrl);
+        }
+        catch {
+            throw new Error('Invalid Hives service address.');
+        }
+        const path = direct ? op.upstream.path : op.path;
+        const prefix = base.pathname.replace(/\/+$/, '');
+        const paths = [path];
+        if (!direct && path.startsWith('/v1/hives/'))
+            paths.push(path.replace('/v1/hives/', '/hives/v1/'));
+        return paths.map((p) => ({ id, origin: base.origin, method: direct ? op.upstream.method : op.method, pattern: templatePattern(prefix + p) }));
+    });
+    return (async (input, init = {}) => {
+        let url;
+        try {
+            url = new URL(input instanceof Request ? input.url : String(input));
+        }
+        catch {
+            throw new Error('Invalid Hives request address.');
+        }
+        const method = (init.method ?? (input instanceof Request ? input.method : 'GET')).toUpperCase();
+        const route = routes.find((entry) => entry.origin === url.origin && entry.method === method && entry.pattern.test(url.pathname));
+        if (!route)
+            return underlying(input, init);
+        const controller = new AbortController();
+        let message = 'Hives transport failed. Refresh the resource and retry.';
+        const safeError = () => new Error(message);
+        const signals = [...new Set([callerSignal, init.signal, input instanceof Request ? input.signal : undefined].filter((signal) => !!signal))];
+        const canceled = () => {
+            message = 'Hives request canceled before completion. Refresh the resource before retrying.';
+            controller.abort();
+        };
+        for (const signal of signals)
+            signal.addEventListener('abort', canceled, { once: true });
+        const timer = setTimeout(() => {
+            message = 'Hives request deadline exceeded. Refresh the resource before retrying.';
+            controller.abort();
+        }, hivesOperationBudget(route.id));
+        timer.unref();
+        let abortReject = () => { };
+        let reader;
+        let bodyController;
+        const aborted = () => {
+            abortReject(safeError());
+            bodyController?.error(safeError());
+            void reader?.cancel().catch(() => { });
+            cleanup();
+        };
+        controller.signal.addEventListener('abort', aborted, { once: true });
+        const abortPromise = new Promise((_, reject) => { abortReject = reject; });
+        void abortPromise.catch(() => { });
+        const cleanup = () => {
+            clearTimeout(timer);
+            for (const signal of signals)
+                signal.removeEventListener('abort', canceled);
+            controller.signal.removeEventListener('abort', aborted);
+        };
+        if (signals.some((signal) => signal.aborted))
+            canceled();
+        try {
+            if (controller.signal.aborted)
+                throw safeError();
+            const requestInit = {
+                ...init, signal: controller.signal, cache: 'no-store',
+                redirect: init.redirect === 'manual' ? 'manual' : 'error',
+                ...(useNative ? { dispatcher: nativeAgent() } : {}),
+            };
+            const pending = underlying(input, requestInit);
+            // A caller transport may ignore AbortSignal. Reject on our budget anyway,
+            // and discard any late response rather than presenting an acknowledgement.
+            void pending.then((response) => { if (controller.signal.aborted)
+                void response.body?.cancel().catch(() => { }); }, () => { });
+            const response = await Promise.race([pending, abortPromise]);
+            if (controller.signal.aborted)
+                throw safeError();
+            if (!response.body) {
+                cleanup();
+                return response;
+            }
+            reader = response.body.getReader();
+            const body = new ReadableStream({
+                start(value) { bodyController = value; },
+                async pull(value) {
+                    try {
+                        const next = await reader.read();
+                        if (controller.signal.aborted)
+                            return;
+                        if (next.done) {
+                            cleanup();
+                            value.close();
+                        }
+                        else
+                            value.enqueue(next.value);
+                    }
+                    catch {
+                        cleanup();
+                        value.error(safeError());
+                    }
+                },
+                async cancel() { cleanup(); await reader.cancel().catch(() => { }); },
+            });
+            return new Response(body, { status: response.status, statusText: response.statusText, headers: response.headers });
+        }
+        catch {
+            cleanup();
+            throw safeError();
+        }
+    });
+}

package/dist/hives-operations.d.ts

@@ -0,0 +1,9 @@
+import { Command } from 'commander';
+import type { Genesis } from '@lifesi/genesis';
+type Deps = {
+    client: () => Promise<Genesis>;
+    emit: (data: unknown, pretty: () => string) => void;
+    readRequest?: (path: string, limit: number) => Promise<Record<string, unknown>>;
+};
+export declare function registerHivesOperations(hives: Command, deps: Deps): void;
+export {};

package/dist/hives-operations.js

@@ -0,0 +1,61 @@
+import { registerHivesResources } from './hives-resources.js';
+import { Option } from 'commander';
+import { readFunctionJson } from './function-input.js';
+function metricsOptions(command) {
+    return command.option('--start <time>', 'inclusive UTC timestamp').option('--end <time>', 'exclusive UTC timestamp')
+        .addOption(new Option('--resolution <value>', 'time bucket').choices(['minute', 'fiveminutes', 'fifteenminutes', 'hour', 'day']))
+        .addOption(new Option('--aggregation <value>', 'supported aggregation').choices(['sum', 'avg', 'min', 'max', 'count', 'p50', 'p90', 'p95', 'p99']));
+}
+const integer = (value, name, max) => {
+    if (value === undefined)
+        return undefined;
+    if (!/^\d+$/.test(value) || !Number.isSafeInteger(Number(value)) || Number(value) < 1 || Number(value) > max) {
+        throw new Error(`${name} must be an integer from 1 to ${max}.`);
+    }
+    return Number(value);
+};
+const paging = (command) => command.option('--page <number>').option('--per-page <number>');
+const pagination = (o) => ({ page: integer(o.page, '--page', 10000), per_page: integer(o.perPage, '--per-page', 100) });
+export function registerHivesOperations(hives, deps) {
+    registerHivesResources(hives, deps);
+    const output = (data) => deps.emit(data, () => JSON.stringify(data, null, 2));
+    const read = deps.readRequest ?? readFunctionJson;
+    const settings = hives.command('settings').description('Stored project preferences and actual engine capabilities');
+    settings.command('get <project_id>').action(async (project) => output(await (await deps.client()).hives.settings.get(project)));
+    settings.command('update <project_id>').requiredOption('--request-file <path>', 'JSON settings patch')
+        .action(async (project, o) => output(await (await deps.client()).hives.settings.update(project, await read(o.requestFile, 64 * 1024))));
+    const crons = hives.command('crons').description('Waggle schedules and persisted run outcomes');
+    paging(crons.command('list <project_id>')).action(async (project, o) => output(await (await deps.client()).hives.crons.list(project, pagination(o))));
+    crons.command('get <project_id> <cron_id>').action(async (project, cron) => output(await (await deps.client()).hives.crons.get(project, cron)));
+    crons.command('create <project_id>').requiredOption('--request-file <path>', 'JSON name, schedule, handler, timezone and enabled preference')
+        .action(async (project, o) => {
+        const body = await read(o.requestFile, 64 * 1024);
+        if (typeof body.name !== 'string' || typeof body.schedule !== 'string' || typeof body.handler !== 'string')
+            throw new Error('Cron JSON requires name, schedule and handler strings.');
+        output(await (await deps.client()).hives.crons.create(project, { ...body, name: body.name, schedule: body.schedule, handler: body.handler }));
+    });
+    crons.command('update <project_id> <cron_id>').requiredOption('--request-file <path>', 'JSON schedule patch')
+        .action(async (project, cron, o) => output(await (await deps.client()).hives.crons.update(project, cron, await read(o.requestFile, 64 * 1024))));
+    for (const action of ['delete', 'pause', 'resume', 'trigger']) {
+        crons.command(`${action} <project_id> <cron_id>`)
+            .description(action === 'trigger' ? 'Admit one run; inspect runs for completion. Does not retry.' : `${action} an owned schedule`)
+            .action(async (project, cron) => output(await (await deps.client()).hives.crons[action](project, cron)));
+    }
+    paging(crons.command('runs <project_id> <cron_id>')).addOption(new Option('--status <state>', 'persisted run status').choices(['pending', 'running', 'success', 'failed', 'timeout', 'cancelled']))
+        .option('--since <time>').option('--until <time>')
+        .action(async (project, cron, o) => output(await (await deps.client()).hives.crons.runs(project, cron, { ...pagination(o), status: o.status, since: o.since, until: o.until })));
+    const metrics = hives.command('metrics').description('Retained completed API observations; unavailable measurements remain null');
+    for (const kind of ['project', 'requests', 'latency', 'errors', 'resources']) {
+        metricsOptions(metrics.command(`${kind} <project_id>`))
+            .action(async (project, q) => output(await (await deps.client()).hives.metrics[kind](project, q)));
+    }
+    metrics.command('dashboard <project_id>').addOption(new Option('--period <value>').choices(['1h', '24h', '7d', '30d']))
+        .action(async (project, q) => output(await (await deps.client()).hives.metrics.dashboard(project, q)));
+    for (const kind of ['function', 'invocations']) {
+        metricsOptions(metrics.command(`${kind} <project_id> <function_id>`))
+            .action(async (project, id, q) => output(await (await deps.client()).hives.metrics[kind](project, id, q)));
+    }
+    metricsOptions(metrics.command('deployment <project_id> <deployment_id>'))
+        .action(async (project, id, q) => output(await (await deps.client()).hives.metrics.deployment(project, id, q)));
+    metrics.command('realtime <project_id>').action(async (project) => output(await (await deps.client()).hives.metrics.realtime(project)));
+}

package/dist/hives-resources.d.ts

@@ -0,0 +1,9 @@
+import { Command } from 'commander';
+import type { Genesis } from '@lifesi/genesis';
+type Deps = {
+    client: () => Promise<Genesis>;
+    emit: (data: unknown, pretty: () => string) => void;
+    readRequest?: (path: string, limit: number) => Promise<Record<string, unknown>>;
+};
+export declare function registerHivesResources(hives: Command, deps: Deps): void;
+export {};

package/dist/hives-resources.js

@@ -0,0 +1,71 @@
+import { createReadStream } from 'node:fs';
+import { stat, writeFile } from 'node:fs/promises';
+import { readFunctionJson } from './function-input.js';
+async function bytes(path) {
+    const metadata = await stat(path);
+    if (!metadata.isFile() || metadata.size > 10 * 1024 * 1024)
+        throw new Error('Choose a regular file of at most 10 MiB.');
+    const stream = createReadStream(path);
+    const chunks = [];
+    let total = 0;
+    try {
+        for await (const chunk of stream) {
+            const value = Buffer.from(chunk);
+            total += value.byteLength;
+            if (total > 10 * 1024 * 1024)
+                throw new Error('Object file exceeds 10 MiB.');
+            chunks.push(value);
+        }
+    }
+    finally {
+        stream.destroy();
+    }
+    return Uint8Array.from(Buffer.concat(chunks, total));
+}
+function number(value, min, max) { if (value === undefined)
+    return undefined; if (!/^\d+$/.test(value) || !Number.isSafeInteger(Number(value)) || Number(value) < min || Number(value) > max)
+    throw new Error('Invalid bounded numeric option.'); return Number(value); }
+export function registerHivesResources(hives, deps) {
+    const output = (data) => deps.emit(data, () => JSON.stringify(data, null, 2));
+    const read = deps.readRequest ?? readFunctionJson;
+    const cells = hives.command('cells').description('Owned GCS buckets and objects; uncertain mutations require readback/reconciliation');
+    cells.command('list <project_id>').option('--page <number>').option('--per-page <number>').action(async (project, o) => output(await (await deps.client()).hives.cells.list(project, { page: number(o.page, 1, 10000), per_page: number(o.perPage, 1, 100) })));
+    cells.command('get <project_id> <bucket_id>').action(async (project, id) => output(await (await deps.client()).hives.cells.get(project, id)));
+    cells.command('create <project_id>').requiredOption('--request-file <path>', 'JSON name, region, visibility and CORS').action(async (project, o) => output(await (await deps.client()).hives.cells.create(project, await read(o.requestFile, 512 * 1024))));
+    for (const action of ['remove', 'reconcile'])
+        cells.command(`${action} <project_id> <bucket_id>`).action(async (project, id) => output(await (await deps.client()).hives.cells[action](project, id)));
+    const cors = cells.command('cors');
+    cors.command('get <project_id> <bucket_id>').action(async (project, id) => output(await (await deps.client()).hives.cells.cors.get(project, id)));
+    cors.command('set <project_id> <bucket_id>').requiredOption('--request-file <path>', 'JSON object with rules array').action(async (project, id, o) => { const body = await read(o.requestFile, 512 * 1024); if (!Array.isArray(body.rules))
+        throw new Error('CORS JSON requires rules.'); output(await (await deps.client()).hives.cells.cors.set(project, id, body.rules)); });
+    const objects = cells.command('objects');
+    objects.command('list <project_id> <bucket_id>').option('--prefix <value>').option('--delimiter <value>').option('--continuation-token <value>').option('--max-keys <number>').action(async (project, id, o) => output(await (await deps.client()).hives.cells.objects.list(project, id, { prefix: o.prefix, delimiter: o.delimiter, continuation_token: o.continuationToken, max_keys: number(o.maxKeys, 1, 1000) })));
+    for (const action of ['put', 'put-flat'])
+        objects.command(`${action} <project_id> <bucket_id> <key>`).requiredOption('--file <path>', 'Exact binary bytes up to 10 MiB').option('--content-type <value>').action(async (project, id, key, o) => { const client = await deps.client(); output(await client.hives.cells.objects[action === 'put' ? 'put' : 'putFlat'](project, id, key, await bytes(o.file), { content_type: o.contentType })); });
+    for (const action of ['remove', 'remove-flat'])
+        objects.command(`${action} <project_id> <bucket_id> <key>`).action(async (project, id, key) => { await (await deps.client()).hives.cells.objects[action === 'remove' ? 'remove' : 'removeFlat'](project, id, key); output({ acknowledged: true }); });
+    objects.command('download <project_id> <bucket_id> <key>').requiredOption('--output-file <path>', 'Create a new file; existing files are never overwritten').action(async (project, id, key, o) => { const response = await (await deps.client()).hives.cells.objects.download(project, id, key); const data = new Uint8Array(await response.arrayBuffer()); await writeFile(o.outputFile, data, { flag: 'wx', mode: 0o600 }); output({ saved: true, bytes: data.byteLength }); });
+    cells.command('presign <project_id> <bucket_id>').requiredOption('--request-file <path>', 'Explicit GET/PUT capability request; PUT requires exact content_length').action(async (project, id, o) => output(await (await deps.client()).hives.cells.presign(project, id, await read(o.requestFile, 64 * 1024))));
+    const queues = hives.command('queues').description('Buzz durable messages and possessed temporary delivery receipts');
+    for (const action of ['list'])
+        queues.command(`${action} <project_id>`).action(async (project) => output(await (await deps.client()).hives.queues[action](project)));
+    for (const action of ['get', 'stats', 'consumers', 'pause', 'resume', 'purge', 'remove', 'dead-letter-stats', 'purge-dead-letters']) {
+        const names = { 'dead-letter-stats': 'deadLetterStats', 'purge-dead-letters': 'purgeDeadLetters' };
+        queues.command(`${action} <project_id> <queue_id>`).action(async (project, id) => { const client = await deps.client(); const method = action in names ? names[action] : action; output(await client.hives.queues[method](project, id)); });
+    }
+    queues.command('create <project_id>').requiredOption('--request-file <path>').action(async (project, o) => output(await (await deps.client()).hives.queues.create(project, await read(o.requestFile, 512 * 1024))));
+    queues.command('configure <project_id> <queue_id>').requiredOption('--request-file <path>').action(async (project, id, o) => output(await (await deps.client()).hives.queues.configure(project, id, await read(o.requestFile, 512 * 1024))));
+    queues.command('send <project_id> <queue_id>').requiredOption('--request-file <path>', 'Exactly body or body_base64; decoded body 256 KiB').action(async (project, id, o) => output(await (await deps.client()).hives.queues.send(project, id, await read(o.requestFile, 512 * 1024))));
+    queues.command('receive <project_id> <queue_id>').option('--max-messages <number>').option('--wait-seconds <number>').action(async (project, id, o) => output(await (await deps.client()).hives.queues.receive(project, id, { maxMessages: number(o.maxMessages, 1, 10), waitSeconds: number(o.waitSeconds, 0, 10) })));
+    for (const action of ['ack', 'nack'])
+        queues.command(`${action} <project_id> <queue_id> <message_id>`).requiredOption('--receipt-file <path>', 'JSON receiptHandle; not a credential/header/query').action(async (project, id, message, o) => { const body = await read(o.receiptFile, 4096); if (typeof body.receiptHandle !== 'string')
+            throw new Error('Receipt JSON requires receiptHandle.'); output(await (await deps.client()).hives.queues[action](project, id, message, body.receiptHandle)); });
+    queues.command('dead-letters <project_id> <queue_id>').option('--limit <number>').option('--offset <number>').action(async (project, id, o) => output(await (await deps.client()).hives.queues.deadLetters(project, id, { limit: number(o.limit, 1, 10), offset: number(o.offset, 0, 8192) })));
+    for (const action of ['replay', 'delete-dead-letter'])
+        queues.command(`${action} <project_id> <queue_id> <message_id>`).action(async (project, id, message) => output(await (await deps.client()).hives.queues[action === 'replay' ? 'replay' : 'deleteDeadLetter'](project, id, message)));
+    const runtime = hives.command('runtimes').description('Compiled serving implementation metadata; not available capacity');
+    runtime.command('list').action(async () => output(await (await deps.client()).hives.runtimes.list()));
+    runtime.command('project <project_id>').action(async (project) => output(await (await deps.client()).hives.runtimes.project(project)));
+    runtime.command('get <name>').action(async (name) => output(await (await deps.client()).hives.runtimes.get(name)));
+    runtime.command('select').requiredOption('--wasi <value>').requiredOption('--runner <value>').requiredOption('--artifact <value>').action(async (input) => output(await (await deps.client()).hives.runtimes.select(input)));
+}

package/dist/index.d.ts

@@ -1,13 +1,21 @@
 import { Command } from 'commander';
 import { type CredentialStore } from './store.js';
 import { type Out } from './output.js';
+import { type SecretInputOptions } from './secret-input.js';
 export interface Deps {
     out?: Out;
     store?: () => Promise<CredentialStore>;
     fetch?: typeof fetch;
+    /** Cancel Hives calls through response-body completion; other products retain their transport. */
+    signal?: AbortSignal;
     env?: Record<string, string | undefined>;
     openBrowser?: (url: string) => void;
     sleep?: (ms: number) => Promise<void>;
+    readSecretInput?: (options: SecretInputOptions, limit: number) => Promise<string>;
+    readWasmFile?: (path: string) => Promise<Blob>;
+    writeBytes?: (bytes: Uint8Array) => void;
+    writeOutputFile?: (path: string, bytes: Uint8Array) => Promise<void>;
+    readHivesRequest?: (path: string, limit: number) => Promise<Record<string, unknown>>;
 }
 export declare function buildProgram(deps?: Deps): Command;
 export declare function main(argv: string[], deps?: Deps): Promise<number>;

package/dist/index.js

@@ -1,14 +1,21 @@
 import { registerBeacons } from './beacons.js';
 import { registerDials } from './dials.js';
 import { Command, CommanderError } from 'commander';
-import { Genesis, GenesisError, services } from '@lifesi/genesis';
+import { Genesis, GenesisError, hivesResponseBytes, MAX_FUNCTION_BODY_BYTES, MAX_FUNCTION_JSON_BYTES, services } from '@lifesi/genesis';
 import { authConfig, pollDevice, refresh, savedLoginProvider, startDevice } from './auth.js';
 import { keychainStore } from './store.js';
 import { c, listOf, stdio, table } from './output.js';
 import { spawn } from 'node:child_process';
 import { addHenryCommands } from './henry.js';
 import { registerFleets } from './fleets.js';
+import { registerFlocks } from './flocks.js';
 import { registerRunner } from './runner.js';
+import { createHivesNodeTransport } from './hives-node-transport.js';
+import { registerHivesOperations } from './hives-operations.js';
+import { readFunctionFile, readFunctionJson, writeFunctionOutput } from './function-input.js';
+import { basename } from 'node:path';
+import { readWasmFile } from './wasm-input.js';
+import { readSecretInput, validateSecret, validateSecretValue, parseSecretBatch } from './secret-input.js';
 function defaultOpen(url) {
     const cmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'cmd' : 'xdg-open';
     const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
@@ -25,7 +32,7 @@ export function buildProgram(deps = {}) {
     const auth = { ...authConfig(env, f), sleep: deps.sleep };
     const program = new Command('genesis')
         .description('One CLI for every Genesis service.')
-        .version('0.1.0')
+        .version('0.1.2')
         .option('--json', 'machine-readable JSON output')
         .option('--api-key <key>', 'use this API key (default: GENESIS_API_KEY, then your `genesis login`)')
         .option('--base-url <url>', 'gateway URL (default: GENESIS_BASE_URL or https://console.life.one/api)')
@@ -35,18 +42,32 @@ export function buildProgram(deps = {}) {
         .exitOverride()
         .configureOutput({ writeOut: (s) => out.log(s.trimEnd()), writeErr: (s) => out.err(s.trimEnd()) });
     const g = () => program.opts();
-    const client = async () => {
+    const client = async (hivesTransport = false) => {
         const o = g();
         const store = await getStore().catch(() => undefined);
         const opts = {
             apiKey: o.apiKey ?? env.GENESIS_API_KEY, token: env.GENESIS_TOKEN,
             baseUrl: o.baseUrl ?? env.GENESIS_BASE_URL, routing: o.direct || env.GENESIS_ROUTING === 'direct' ? 'direct' : 'gateway',
-            fetch: f, userAgent: 'genesis-cli/0.1.0',
+            fetch: f, userAgent: 'genesis-cli/0.1.2',
             credentials: store ? savedLoginProvider(auth, store) : undefined,
         };
-        return new Genesis(opts);
+        return new Genesis(hivesTransport ? { ...opts, fetch: createHivesNodeTransport(opts, deps.signal) } : opts);
     };
     const emit = (data, pretty) => out.log(g().json ? JSON.stringify(data, null, 2) : pretty());
+    const positiveInteger = (value, option, maximum) => {
+        if (value === undefined)
+            return undefined;
+        if (!/^\d+$/.test(value) || !Number.isSafeInteger(Number(value)) || Number(value) < 1 || Number(value) > maximum) {
+            throw new Error(`${option} must be an integer from 1 to ${maximum}.`);
+        }
+        return Number(value);
+    };
+    const projectName = (name) => {
+        if (name.length < 3 || name.length > 64 || !/^[a-z][a-z0-9-]*[a-z0-9]$/.test(name)) {
+            throw new Error('Project name must be 3–64 lowercase letters, numbers or hyphens, start with a letter and end with a letter or number.');
+        }
+        return name;
+    };
     registerRunner(program, client, emit);
     const orgId = async (gen) => {
         if (g().org)
@@ -156,17 +177,253 @@ export function buildProgram(deps = {}) {
         const r = await gen.foundry.chat({ model: o.model, messages });
         emit(r, () => r.choices?.[0]?.message?.content ?? JSON.stringify(r));
     });
+    const hivesClient = () => client(true);
     // ---- hives -----------------------------------------------------------
-    const hives = program.command('hives').description('Hives: projects, deployments, functions');
+    const hives = program.command('hives').description('Hives: projects, secrets, deployments, functions, schedules and activity');
+    registerHivesOperations(hives, { client: hivesClient, emit, readRequest: deps.readHivesRequest });
+    const deployments = hives.command('deployments').description('Real WASM artifacts and deployment lifecycle');
+    const emitDeployment = (data) => emit(data, () => table(data && typeof data === 'object' && !Array.isArray(data) && !('data' in data) ? [data] : listOf(data), ['id', 'version', 'status', 'module_hash', 'created_at']));
+    deployments.command('list <project_id>')
+        .option('--page <number>', 'page (1–10000)').option('--per-page <number>', 'items (1–100)')
+        .option('--status <status>', 'persisted deployment status').option('--author <id>', 'creator ID')
+        .action(async (project, o) => {
+        emitDeployment(await (await hivesClient()).hives.deployments.list(project, {
+            page: positiveInteger(o.page, '--page', 10000), per_page: positiveInteger(o.perPage, '--per-page', 100), status: o.status, author: o.author,
+        }));
+    });
+    deployments.command('get <project_id> <deployment_id>')
+        .action(async (project, deployment) => emitDeployment(await (await hivesClient()).hives.deployments.get(project, deployment)));
+    deployments.command('upload <project_id> <wasm_file>').description('Upload actual WASM bytes; Git options are labels only')
+        .option('--git-sha <sha>', 'commit label (7–40 characters)').option('--git-branch <branch>', 'branch label').option('--git-message <message>', 'commit label')
+        .action(async (project, path, o) => {
+        const file = await (deps.readWasmFile ?? readWasmFile)(path);
+        emitDeployment(await (await hivesClient()).hives.deployments.upload(project, file, {
+            filename: basename(path), git_sha: o.gitSha, git_branch: o.gitBranch, git_message: o.gitMessage,
+        }));
+    });
+    deployments.command('reuse <project_id> <module_hash>').description('Deploy a real artifact already owned by this org and project')
+        .option('--no-auto-promote', 'keep the completed deployment ready for explicit promotion')
+        .action(async (project, module_hash, o) => {
+        if (!/^[a-f0-9]{64}$/.test(module_hash))
+            throw new Error('module_hash must be the lowercase SHA-256 returned by a real Hives upload.');
+        emitDeployment(await (await hivesClient()).hives.deployments.create(project, { module_hash, auto_promote: o.autoPromote }));
+    });
+    deployments.command('promote <project_id> <deployment_id>')
+        .action(async (project, deployment) => emitDeployment(await (await hivesClient()).hives.deployments.promote(project, deployment)));
+    deployments.command('rollback <project_id> <deployment_id>').description('Activate this owned previous deployment')
+        .option('--reason <text>', 'audit reason')
+        .action(async (project, deployment, o) => emitDeployment(await (await hivesClient()).hives.deployments.rollback(project, deployment, { reason: o.reason })));
+    deployments.command('cancel <project_id> <deployment_id>')
+        .action(async (project, deployment) => emitDeployment(await (await hivesClient()).hives.deployments.cancel(project, deployment)));
+    deployments.command('delete <project_id> <deployment_id>').description('Delete a deployment that is not currently active')
+        .action(async (project, deployment) => { const result = await (await hivesClient()).hives.deployments.delete(project, deployment); emit(result, () => `Deleted deployment ${deployment}.`); });
+    deployments.command('logs <project_id> <deployment_id>').description('Read real persisted deployment logs')
+        .option('--page <number>', 'page (1–10000)').option('--per-page <number>', 'items (1–100)')
+        .option('--level <level>', 'minimum level').option('--search <text>', 'search log messages')
+        .option('--start <iso>', 'RFC 3339 start time').option('--end <iso>', 'RFC 3339 end time')
+        .action(async (project, deployment, o) => {
+        for (const timestamp of [o.start, o.end])
+            if (timestamp !== undefined && !Number.isFinite(Date.parse(timestamp)))
+                throw new Error('Log timestamps must use RFC 3339.');
+        const result = await (await hivesClient()).hives.deployments.logs(project, deployment, {
+            page: positiveInteger(o.page, '--page', 10000), per_page: positiveInteger(o.perPage, '--per-page', 100),
+            level: o.level, search: o.search, start: o.start, end: o.end,
+        });
+        emit(result, () => table(result.logs, ['timestamp', 'level', 'message', 'source']));
+    });
+    const emitFunction = (value) => emit(value, () => table(listOf(value).length ? listOf(value) : [value], ['id', 'name', 'status', 'handler', 'memory_mb', 'timeout_ms']));
+    const functions = hives.command('functions').description('Owned WASM functions; invocation returns the completed raw guest response');
+    functions.command('list <project_id>').option('--page <n>').option('--per-page <n>').option('--status <status>').option('--search <text>')
+        .action(async (project, o) => emitFunction(await (await hivesClient()).hives.functions.list(project, {
+        page: positiveInteger(o.page, '--page', 1000000), per_page: positiveInteger(o.perPage, '--per-page', 100), status: o.status, search: o.search,
+    })));
+    functions.command('get <project_id> <function_id>').action(async (project, id) => emitFunction(await (await hivesClient()).hives.functions.get(project, id)));
+    functions.command('create <project_id> <name> <module_hash>').option('--request-file <file>', 'JSON metadata and encrypted env overrides; input values are never printed')
+        .action(async (project, name, hash, o) => {
+        if (!/^[a-f0-9]{64}$/.test(hash))
+            throw new Error('Use a full lowercase artifact hash from an owned Hives upload.');
+        const extra = o.requestFile ? await readFunctionJson(o.requestFile, 256 * 1024) : {};
+        emitFunction(await (await hivesClient()).hives.functions.create(project, { ...extra, name, handler: `wasm://sha256/${hash}` }));
+    });
+    functions.command('update <project_id> <function_id>').requiredOption('--request-file <file>', 'JSON supported metadata/env/remove_env fields; values are never printed')
+        .action(async (project, id, o) => emitFunction(await (await hivesClient()).hives.functions.update(project, id, await readFunctionJson(o.requestFile, 256 * 1024))));
+    functions.command('delete <project_id> <function_id>').action(async (project, id) => {
+        const result = await (await hivesClient()).hives.functions.delete(project, id);
+        emit(result, () => `Deleted function ${id}.`);
+    });
+    function invocationCommand(command, kind) {
+        command.description('Complete real guest execution; write exact bytes, including executed HTTP error bodies')
+            .option('--request-file <file>', 'JSON method/path/headers/body or body_base64')
+            .option('--body-file <file>', 'Exact binary body (up to 10 MiB; serialized guest envelope may reach its cap earlier)')
+            .option('--method <method>', 'guest HTTP method', 'POST').option('--path <path>', 'guest path including query', '/')
+            .option('--output <file>', 'create a new private file containing exact response bytes')
+            .action(async (project, id, o) => {
+            if (o.requestFile && o.bodyFile)
+                throw new Error('Choose --request-file or --body-file.');
+            if (g().json && o.output)
+                throw new Error('Choose --json or --output.');
+            let request = o.requestFile ? await readFunctionJson(o.requestFile, MAX_FUNCTION_JSON_BYTES) : { method: o.method, path: o.path };
+            if (o.bodyFile)
+                request.body_base64 = Buffer.from(await readFunctionFile(o.bodyFile, MAX_FUNCTION_BODY_BYTES)).toString('base64');
+            const response = await (await hivesClient()).hives[kind].invoke(project, id, request);
+            const bytes = await hivesResponseBytes(response);
+            if (g().json)
+                out.log(JSON.stringify({ status: response.status, headers: Object.fromEntries(response.headers), body_base64: Buffer.from(bytes).toString('base64') }));
+            else {
+                out.err(JSON.stringify({ status: response.status, headers: Object.fromEntries(response.headers), bytes: bytes.length }));
+                if (o.output)
+                    await (deps.writeOutputFile ?? writeFunctionOutput)(o.output, bytes);
+                else
+                    (deps.writeBytes ?? ((value) => { process.stdout.write(value); }))(bytes);
+            }
+        });
+    }
+    invocationCommand(functions.command('invoke <project_id> <function_id>'), 'functions');
+    invocationCommand(deployments.command('invoke <project_id> <deployment_id>'), 'deployments');
+    const secrets = hives.command('secrets').description('Project secrets encrypted with Genesis KMS');
+    const readInput = async (options, limit) => {
+        if (Boolean(options.file) === Boolean(options.stdin))
+            throw new Error('Choose exactly one input source: a file or --stdin. Secret values are not accepted as command arguments.');
+        return (deps.readSecretInput ?? readSecretInput)(options, limit);
+    };
+    const emitSecret = (data) => emit(data, () => table(listOf(data), ['id', 'name', 'version', 'description', 'updated_at']));
+    const context = hives.command('context').description('Explicit Hives binding for the current verified interactive Genesis selection');
+    context.command('get').action(async () => {
+        const r = await (await hivesClient()).hives.context.get();
+        emit(r, () => table([r.project], ['id', 'name', 'slug', 'kind', 'status']));
+    });
+    context.command('create <name>').option('--kind <kind>', 'worker|function|site|api', 'worker').option('--description <text>', 'project description')
+        .action(async (name, o) => {
+        if (!['worker', 'function', 'site', 'api'].includes(o.kind))
+            throw new Error('Choose worker, function, site or api.');
+        if (o.description && o.description.length > 500)
+            throw new Error('Project descriptions must contain at most 500 characters.');
+        const r = await (await hivesClient()).hives.context.set({ create: { name: projectName(name), kind: o.kind, description: o.description } });
+        emit(r, () => table([r.project], ['id', 'name', 'slug', 'kind', 'status']));
+    });
+    context.command('link <project_id>').description('Link a Hives project owned by the verified org')
+        .action(async (id) => { const r = await (await hivesClient()).hives.context.set({ link: { project_id: id } }); emit(r, () => table([r.project], ['id', 'name', 'slug', 'kind', 'status'])); });
+    context.command('detach').description('Remove this selection binding; retain the Hives project and its resources')
+        .action(async () => { const r = await (await hivesClient()).hives.context.detach(); emit(r, () => 'Detached selection; retained Hives project ' + r.hivesProjectId + '.'); });
+    const environment = hives.command('environment').description('Encrypted project environment; names-only metadata and explicit KMS reveal');
+    environment.command('list <project_id>').option('--page <number>', 'page number (1–10000)').option('--per-page <number>', 'items per page (1–100)')
+        .action(async (id, o) => {
+        const r = await (await hivesClient()).hives.environment.list(id, { page: positiveInteger(o.page, '--page', 10000), per_page: positiveInteger(o.perPage, '--per-page', 100) });
+        emit(r, () => table(r.data, ['name']));
+    });
+    environment.command('upsert <project_id>').description('Encrypt a flat JSON map; empty string values are allowed')
+        .option('--file <path>', 'UTF-8 JSON input file').option('--stdin', 'read JSON from stdin')
+        .action(async (id, o) => {
+        const text = await readInput(o, 2 * 1024 * 1024);
+        let body;
+        try {
+            body = JSON.parse(text);
+        }
+        catch {
+            throw new Error('Environment input must be a flat JSON map of names to string values.');
+        }
+        const r = await (await hivesClient()).hives.environment.upsert(id, body);
+        emit(r, () => table(r.updated, ['name']));
+    });
+    environment.command('reveal <project_id> <key>').description('Explicit audit-logged environment reveal; requires --stdout')
+        .option('--stdout', 'write sensitive plaintext to stdout (avoid retained output)')
+        .action(async (id, key, o) => {
+        if (!o.stdout)
+            throw new Error('Environment reveal requires --stdout. Avoid logging or retaining the plaintext.');
+        const r = await (await hivesClient()).hives.environment.reveal(id, key);
+        emit(r, () => r.value);
+    });
+    secrets.command('list <project_id>').description('List secret metadata without values')
+        .option('--page <number>', 'page number (1–10000)').option('--per-page <number>', 'items per page (1–100)')
+        .action(async (id, o) => {
+        const q = { page: positiveInteger(o.page, '--page', 10000), per_page: positiveInteger(o.perPage, '--per-page', 100) };
+        emitSecret(await (await hivesClient()).hives.secrets.list(id, q));
+    });
+    secrets.command('get <project_id> <secret_id>').description('Inspect secret metadata without its value')
+        .action(async (project, secret) => {
+        const r = await (await hivesClient()).hives.secrets.get(project, secret);
+        emit(r, () => table([r], ['id', 'name', 'version', 'description', 'updated_at']));
+    });
+    secrets.command('create <project_id> <name>').description('Create a secret; plaintext is read from a file or stdin')
+        .option('--value-file <path>', 'UTF-8 file containing the value').option('--stdin', 'read value from stdin')
+        .option('--description <text>', 'description (up to 500 characters)')
+        .action(async (project, name, o) => {
+        const body = validateSecret({ name, value: await readInput({ file: o.valueFile, stdin: o.stdin }, 65536), description: o.description });
+        const r = await (await hivesClient()).hives.secrets.create(project, body);
+        emit(r, () => table([r], ['id', 'name', 'version']));
+    });
+    secrets.command('update <project_id> <secret_id>').description('Replace a secret value, creating a new version')
+        .option('--value-file <path>', 'UTF-8 file containing the new value').option('--stdin', 'read value from stdin')
+        .action(async (project, secret, o) => {
+        const value = validateSecretValue(await readInput({ file: o.valueFile, stdin: o.stdin }, 65536));
+        const r = await (await hivesClient()).hives.secrets.update(project, secret, { value });
+        emit(r, () => table([r], ['id', 'name', 'version']));
+    });
+    secrets.command('delete <project_id> <secret_id>').description('Delete a secret in your authenticated org')
+        .action(async (project, secret) => { const r = await (await hivesClient()).hives.secrets.delete(project, secret); emit(r, () => `Deleted secret ${secret}.`); });
+    secrets.command('reveal <project_id> <secret_id>').description('Explicit, audit-logged plaintext reveal; requires --stdout')
+        .option('--stdout', 'write sensitive plaintext to stdout (avoid logs and retained output)')
+        .action(async (project, secret, o) => {
+        if (!o.stdout)
+            throw new Error('Reveal requires --stdout. This writes sensitive plaintext to your terminal or pipe; avoid logging or retaining it.');
+        const r = await (await hivesClient()).hives.secrets.reveal(project, secret);
+        emit(r, () => r.value);
+    });
+    secrets.command('bulk <project_id>').description('PUT a JSON array of secret names and values; existing names receive new versions')
+        .option('--file <path>', 'UTF-8 JSON input file').option('--stdin', 'read JSON from stdin')
+        .action(async (project, o) => {
+        const batch = parseSecretBatch(await readInput(o, 256 * 1024));
+        const r = await (await hivesClient()).hives.secrets.bulkUpsert(project, batch);
+        emit(r, () => table(r.secrets, ['id', 'name', 'version']));
+    });
     const projects = hives.command('projects').description('Hives projects');
-    projects.command('list', { isDefault: true }).action(async () => {
-        const r = await (await client()).hives.projects.list();
+    projects.command('list', { isDefault: true }).option('--search <text>', 'filter by project name')
+        .option('--page <number>', 'page number (1–10000)').option('--per-page <number>', 'items per page (1–100)')
+        .action(async (o) => {
+        const r = await (await hivesClient()).hives.projects.list({ search: o.search,
+            page: positiveInteger(o.page, '--page', 10000), per_page: positiveInteger(o.perPage, '--per-page', 100) });
         emit(r, () => table(listOf(r), ['id', 'name', 'slug', 'region', 'total_deployments', 'active_instances']));
     });
     projects.command('get <project_id>').action(async (id) => {
-        const r = await (await client()).hives.projects.get(id);
+        const r = await (await hivesClient()).hives.projects.get(id);
         emit(r, () => JSON.stringify(r, null, 2));
     });
+    projects.command('create <name>').description('Create a project in your authenticated org')
+        .option('--kind <kind>', 'worker, function, site or api', 'worker')
+        .option('--description <text>', 'project description (up to 500 characters)')
+        .action(async (name, o) => {
+        if (!['worker', 'function', 'site', 'api'].includes(o.kind))
+            throw new Error('--kind must be worker, function, site or api.');
+        if (o.description && o.description.length > 500)
+            throw new Error('--description must be at most 500 characters.');
+        const r = await (await hivesClient()).hives.projects.create({ name: projectName(name), kind: o.kind,
+            ...(o.description === undefined ? {} : { description: o.description }) });
+        emit(r, () => table([r], ['id', 'name', 'slug', 'status']));
+    });
+    projects.command('rename <project_id> <name>').description('Rename a project in your authenticated org')
+        .action(async (id, name) => {
+        const r = await (await hivesClient()).hives.projects.update(id, { name: projectName(name) });
+        emit(r, () => table([r], ['id', 'name', 'slug', 'status']));
+    });
+    projects.command('activity <project_id>').description('Read persisted project activity')
+        .option('--action <action>', 'filter by action')
+        .option('--actor-type <type>', 'filter by actor type')
+        .option('--resource-type <type>', 'filter by resource type')
+        .option('--since <timestamp>', 'inclusive start timestamp in ISO 8601')
+        .option('--until <timestamp>', 'inclusive end timestamp in ISO 8601')
+        .option('--page <number>', 'page number (1–10000)')
+        .option('--per-page <number>', 'items per page (1–100)')
+        .action(async (id, o) => {
+        for (const [option, value] of [['--since', o.since], ['--until', o.until]]) {
+            if (value !== undefined && (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/.test(value) || !Number.isFinite(Date.parse(value)))) {
+                throw new Error(`${option} must be an ISO 8601 timestamp.`);
+            }
+        }
+        const r = await (await hivesClient()).hives.projects.activity(id, { action: o.action,
+            actor_type: o.actorType, resource_type: o.resourceType, since: o.since, until: o.until,
+            page: positiveInteger(o.page, '--page', 10000), per_page: positiveInteger(o.perPage, '--per-page', 100) });
+        emit(r, () => table(listOf(r), ['created_at', 'action', 'actor_id', 'resource_type', 'resource_name']));
+    });
     // ---- relays ----------------------------------------------------------
     const relays = program.command('relays').description('Relays: DNS zones and records');
     relays.command('zones').description('List DNS zones').option('--search <q>').action(async (o) => {
@@ -188,6 +445,7 @@ export function buildProgram(deps = {}) {
     });
     addHenryCommands(program, client, value => out.log(JSON.stringify(value, null, 2)));
     registerFleets(program, client, (data) => emit(data, () => JSON.stringify(data, null, 2)));
+    registerFlocks(program, client, (data) => emit(data, () => JSON.stringify(data, null, 2)), env);
     registerBeacons(program, client, emit);
     // ---- status ----------------------------------------------------------
     program.command('status').description('Which Genesis services are wired up').action(async () => {

package/dist/runner.js

@@ -2,6 +2,21 @@
 export function registerRunner(program, client, emit) {
     const runner = program.command('runner').description('Runner: agent task execution');
     const output = (value) => emit(value, () => JSON.stringify(value, null, 2));
+    runner.command('permission-grant').description('Request only your current native human Sandbox execution permission; preserve operation/scope/expiry on retry')
+        .requiredOption('--organization <id>', 'current approved Life organization assertion')
+        .requiredOption('--project <id>', 'current approved project assertion')
+        .requiredOption('--workspace <id>', 'current approved workspace assertion')
+        .requiredOption('--operation-id <uuid>', 'stable canonical UUIDv4 for this immutable authorization operation')
+        .requiredOption('--request-id <uuid>', 'fresh canonical UUIDv4 correlation for this attempt')
+        .requiredOption('--expires-at-ms <ms>', 'exact retained future integer expiry, at most 30 minutes and current session/access expiry')
+        .action(async (o) => {
+        if (!/^[1-9]\d*$/.test(o.expiresAtMs) || !Number.isSafeInteger(Number(o.expiresAtMs)))
+            throw new TypeError('Runner permission expiry must be a positive safe integer literal');
+        const input = { schemaVersion: 1, organizationId: o.organization, projectId: o.project,
+            workspaceId: o.workspace, platformId: 'pf_console', fleetId: null, resourceEnvironment: 'sandbox',
+            operationId: o.operationId, requestId: o.requestId, expiresAtMs: Number(o.expiresAtMs) };
+        output(await (await client()).runner.permission.grant(input));
+    });
     runner.command('catalog').description('Authorized workspaces and execution routes')
         .action(async () => output(await (await client()).runner.catalog()));
     const jobs = runner.command('jobs').description('Jobs belonging to your verified identity');

package/dist/secret-input.d.ts

@@ -0,0 +1,14 @@
+export interface SecretInputOptions {
+    file?: string;
+    stdin?: boolean;
+}
+export interface SecretInput {
+    name: string;
+    value: string;
+    description?: string;
+}
+/** Read plaintext only from an explicitly selected file or stdin, never argv. */
+export declare function readSecretInput(options: SecretInputOptions, limit: number): Promise<string>;
+export declare function validateSecretValue(value: string): string;
+export declare function validateSecret(input: unknown): SecretInput;
+export declare function parseSecretBatch(text: string): SecretInput[];

package/dist/secret-input.js

@@ -0,0 +1,85 @@
+import { open } from 'node:fs/promises';
+/** Read plaintext only from an explicitly selected file or stdin, never argv. */
+export async function readSecretInput(options, limit) {
+    if (Boolean(options.file) === Boolean(options.stdin))
+        throw new Error('Choose exactly one input source: a file or --stdin. Secret values are not accepted as command arguments.');
+    const chunks = [];
+    let size = 0;
+    const append = (chunk) => {
+        size += chunk.byteLength;
+        if (size > limit)
+            throw new Error(`Secret input exceeds ${limit} UTF-8 bytes. Use a smaller value or batch.`);
+        chunks.push(chunk);
+    };
+    if (options.file) {
+        let file;
+        try {
+            file = await open(options.file, 'r');
+        }
+        catch {
+            throw new Error('Could not open the secret input file. Check its path and permissions.');
+        }
+        try {
+            for (;;) {
+                const buffer = new Uint8Array(Math.min(8192, limit + 1));
+                const { bytesRead } = await file.read(buffer, 0, buffer.length, null);
+                if (!bytesRead)
+                    break;
+                append(buffer.subarray(0, bytesRead));
+            }
+        }
+        finally {
+            await file.close();
+        }
+    }
+    else {
+        for await (const chunk of process.stdin)
+            append(typeof chunk === 'string' ? new TextEncoder().encode(chunk) : chunk);
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    try {
+        return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    }
+    catch {
+        throw new Error('Secret input must be valid UTF-8 text.');
+    }
+}
+export function validateSecretValue(value) {
+    if (!value.length || new TextEncoder().encode(value).length > 65536)
+        throw new Error('Secret values must contain 1–65,536 UTF-8 bytes.');
+    return value;
+}
+export function validateSecret(input) {
+    if (!input || typeof input !== 'object')
+        throw new Error('Each secret needs a name and value.');
+    const { name, value, description } = input;
+    if (typeof name !== 'string' || name.length > 255 || !/^[A-Za-z][A-Za-z0-9_]*$/.test(name))
+        throw new Error('Secret names must start with a letter and contain only letters, numbers and underscores (up to 255 characters).');
+    if (typeof value !== 'string')
+        throw new Error('Each secret value must be a string.');
+    if (description !== undefined && description !== null && (typeof description !== 'string' || description.length > 500))
+        throw new Error('Secret descriptions must contain at most 500 characters.');
+    return { name, value: validateSecretValue(value), ...(typeof description === 'string' ? { description } : {}) };
+}
+export function parseSecretBatch(text) {
+    let data;
+    try {
+        data = JSON.parse(text);
+    }
+    catch {
+        throw new Error('Bulk input must be a JSON array with secret name and value fields.');
+    }
+    if (!Array.isArray(data) || !data.length)
+        throw new Error('Bulk input must be a non-empty JSON array.');
+    const batch = data.map(validateSecret);
+    if (new Set(batch.map((secret) => secret.name)).size !== batch.length)
+        throw new Error('Each secret name must appear once in a bulk update.');
+    if (new TextEncoder().encode(JSON.stringify(batch)).length > 256 * 1024)
+        throw new Error('Bulk input must fit within 256 KiB. Split it into smaller batches.');
+    return batch;
+}

package/dist/wasm-input.d.ts

@@ -0,0 +1,2 @@
+/** Read only the explicitly requested regular file, with a bounded allocation. */
+export declare function readWasmFile(path: string): Promise<Blob>;

package/dist/wasm-input.js

@@ -0,0 +1,31 @@
+import { open } from 'node:fs/promises';
+import { MAX_WASM_BYTES } from '@lifesi/genesis';
+/** Read only the explicitly requested regular file, with a bounded allocation. */
+export async function readWasmFile(path) {
+    let file;
+    try {
+        file = await open(path, 'r');
+    }
+    catch {
+        throw new Error('Could not open the WASM file. Check its path and permissions.');
+    }
+    try {
+        const stat = await file.stat();
+        if (!stat.isFile() || stat.size < 4 || stat.size > MAX_WASM_BYTES)
+            throw new Error('Choose a regular WASM file of 4 bytes to 10 MiB.');
+        const bytes = new Uint8Array(MAX_WASM_BYTES + 1);
+        let size = 0;
+        for (;;) {
+            const { bytesRead } = await file.read(bytes, size, bytes.length - size, null);
+            if (!bytesRead)
+                break;
+            size += bytesRead;
+            if (size > MAX_WASM_BYTES)
+                throw new Error('WASM file exceeds 10 MiB.');
+        }
+        return new Blob([bytes.slice(0, size)], { type: 'application/wasm' });
+    }
+    finally {
+        await file.close();
+    }
+}

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "@lifesi/genesis-cli",
-  "version": "0.1.0",
+  "version": "0.1.2",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/l1felabs/genesis-api.git",
+    "directory": "packages/cli"
+  },
   "description": "genesis: one CLI for every Genesis service",
   "type": "module",
   "bin": {
@@ -12,7 +17,8 @@
   ],
   "dependencies": {
     "commander": "^14.0.0",
-    "@lifesi/genesis": "0.1.0"
+    "undici": "6.29.0",
+    "@lifesi/genesis": "0.1.2"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "^1.2.0"