@lifesi/genesis-cli 0.1.1 → 0.1.3

package/dist/auth.d.ts

@@ -1,30 +1,24 @@
 import type { CredentialStore, SavedLogin } from './store.js';
-/**
- * Browser/device login via LifeID (WorkOS AuthKit CLI Auth, RFC 8628).
- * Docs: https://workos.com/docs/authkit/cli-auth
- *   POST {authApi}/user_management/authorize/device        {client_id}
- *   POST {authApi}/user_management/authenticate            {grant_type: device_code | refresh_token, ...}
- * client_id is a public identifier (not a secret). Set GENESIS_CLIENT_ID to the LifeID (staging) AuthKit client.
- * GENESIS_AUTH_API lets this point at an auth.life.one proxy once one exists; default is WorkOS directly.
- */
+import { type NativeAttempt } from './lifeid-native.js';
+/** LifeID's admitted native product bridge, never a direct AuthKit bearer. */
 export interface AuthConfig {
-    clientId?: string;
+    productId?: string;
+    redirectUri?: string;
+    audience?: string;
     authApi: string;
     fetch: typeof fetch;
     sleep?: (ms: number) => Promise<void>;
 }
 export declare function authConfig(env?: NodeJS.ProcessEnv, f?: typeof fetch): AuthConfig;
-export interface DeviceCode {
-    device_code: string;
-    user_code: string;
-    verification_uri: string;
-    verification_uri_complete: string;
-    expires_in: number;
-    interval: number;
-}
-export declare function startDevice(c: AuthConfig): Promise<DeviceCode>;
+export declare function startLogin(c: AuthConfig, options?: {
+    signal?: AbortSignal;
+    timeoutMs?: number;
+    organizationHint?: string;
+}): Promise<NativeAttempt>;
+/** Scheduling/consistency only. The LifeID server and Genesis verifier own authority. */
 export declare function jwtExp(token: string): number | undefined;
-export declare function pollDevice(c: AuthConfig, d: DeviceCode): Promise<SavedLogin>;
+export declare function parseLifeSession(c: AuthConfig, value: unknown, now?: number): SavedLogin;
+export declare function completeLogin(c: AuthConfig, attempt: NativeAttempt): Promise<SavedLogin>;
 export declare function refresh(c: AuthConfig, s: SavedLogin, organizationId?: string): Promise<SavedLogin>;
-/** Credential provider for the SDK: saved login, refreshed if within 60s of expiry. */
+/** OS-keychain bridge session; one committed rotation per store, never raw AuthKit. */
 export declare function savedLoginProvider(c: AuthConfig, store: CredentialStore, now?: () => number): () => Promise<string | undefined>;

package/dist/auth.js

@@ -1,78 +1,206 @@
+import { LIFEID_ISSUER, startNativeAttempt, validateRegistration } from './lifeid-native.js';
 export function authConfig(env = process.env, f = fetch) {
-    return { clientId: env.GENESIS_CLIENT_ID, authApi: (env.GENESIS_AUTH_API ?? 'https://api.workos.com').replace(/\/+$/, ''), fetch: f };
+    return { productId: env.GENESIS_AUTH_PRODUCT, redirectUri: env.GENESIS_AUTH_REDIRECT_URI,
+        audience: env.GENESIS_AUTH_AUDIENCE, authApi: LIFEID_ISSUER, fetch: f };
 }
-function needClient(c) {
-    if (!c.clientId)
-        throw new Error('Login is not configured: set GENESIS_CLIENT_ID to the LifeID AuthKit client id (staging), or use GENESIS_API_KEY.');
-    return c.clientId;
+function registration(c) {
+    if (c.authApi !== LIFEID_ISSUER || !c.productId || !c.redirectUri || !c.audience) {
+        throw new Error('LifeID native login is not admitted here. Configure GENESIS_AUTH_PRODUCT, GENESIS_AUTH_REDIRECT_URI and GENESIS_AUTH_AUDIENCE from the registered LifeID profile, or use GENESIS_API_KEY.');
+    }
+    const r = { productId: c.productId, redirectUri: c.redirectUri, audience: c.audience };
+    validateRegistration(r);
+    return r;
 }
-async function post(c, path, body) {
-    const res = await c.fetch(`${c.authApi}${path}`, { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' }, body: new URLSearchParams(body).toString() });
-    const json = await res.json().catch(() => ({}));
-    return { ok: res.ok, status: res.status, json };
+export async function startLogin(c, options = {}) {
+    return startNativeAttempt(registration(c), options);
 }
-export async function startDevice(c) {
-    const r = await post(c, '/user_management/authorize/device', { client_id: needClient(c) });
-    if (!r.ok)
-        throw new Error(`Could not start login (${r.status}): ${r.json.error_description ?? r.json.message ?? r.json.error ?? 'unknown error'}`);
-    return r.json;
+function object(v) {
+    return v !== null && typeof v === 'object' && !Array.isArray(v) ? v : undefined;
 }
-export function jwtExp(token) {
+function tokenClaims(token) {
     try {
-        return JSON.parse(Buffer.from(token.split('.')[1], 'base64url').toString()).exp;
+        const parts = token.split('.');
+        if (parts.length !== 3 || !parts.every(p => /^[A-Za-z0-9_-]+$/.test(p)) || token.length > 16_384)
+            return undefined;
+        return object(JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8')));
     }
     catch {
         return undefined;
     }
 }
-function toSaved(c, j) {
-    return { access_token: j.access_token, refresh_token: j.refresh_token, user: j.user, organization_id: j.organization_id, expires_at: jwtExp(j.access_token), client_id: needClient(c) };
+/** Scheduling/consistency only. The LifeID server and Genesis verifier own authority. */
+export function jwtExp(token) {
+    const exp = tokenClaims(token)?.exp;
+    return typeof exp === 'number' && Number.isSafeInteger(exp) ? exp : undefined;
 }
-export async function pollDevice(c, d) {
-    const sleep = c.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-    let interval = (d.interval || 5) * 1000;
-    const deadline = Date.now() + (d.expires_in || 300) * 1000;
-    while (Date.now() < deadline) {
-        await sleep(interval);
-        const r = await post(c, '/user_management/authenticate', { grant_type: 'urn:ietf:params:oauth:grant-type:device_code', device_code: d.device_code, client_id: needClient(c) });
-        if (r.ok)
-            return toSaved(c, r.json);
-        const err = r.json.error;
-        if (err === 'authorization_pending')
-            continue;
-        if (err === 'slow_down') {
-            interval += 5000;
-            continue;
-        }
-        if (err === 'access_denied')
-            throw new Error('Login was denied in the browser.');
-        if (err === 'expired_token')
-            break;
-        throw new Error(`Login failed (${r.status}): ${r.json.error_description ?? err ?? 'unknown error'}`);
+function id(v, prefix) {
+    return typeof v === 'string' && new RegExp(`^${prefix}_[0-9A-HJKMNP-TV-Z]{26}$`).test(v);
+}
+function secret(v) {
+    return typeof v === 'string' && v.length > 0 && v.length <= 16_384 && !/[\s\x00-\x1f\x7f]/.test(v);
+}
+class LifeIdRequestError extends Error {
+}
+function invalidEnvelope() { throw new LifeIdRequestError('LifeID returned an invalid or mismatched session. Run `genesis login` again.'); }
+export function parseLifeSession(c, value, now = Date.now() / 1000) {
+    const r = registration(c);
+    const body = object(value), s = object(body?.session), p = object(body?.principal);
+    if (!s || !p || p.kind !== 'human' || !id(p.id, 'h') || s.principalKind !== 'human'
+        || !id(s.id, 'sess') || !id(s.organizationId, 'o') || s.issuer !== LIFEID_ISSUER
+        || s.audience !== r.audience || !secret(s.accessToken) || !secret(body?.refresh_token)
+        || typeof s.issuedAt !== 'string' || typeof s.expiresAt !== 'string')
+        invalidEnvelope();
+    const issued = Date.parse(s.issuedAt) / 1000, expires = Date.parse(s.expiresAt) / 1000;
+    const claims = tokenClaims(s.accessToken);
+    const exp = jwtExp(s.accessToken);
+    const audiences = typeof claims?.aud === 'string' ? [claims.aud] : claims?.aud;
+    if (!Number.isFinite(issued) || !Number.isFinite(expires) || issued > now + 60 || expires <= now || expires <= issued
+        || !claims || !exp || exp <= now || claims.iss !== LIFEID_ISSUER || !Array.isArray(audiences)
+        || !audiences.every(a => typeof a === 'string') || !audiences.includes(r.audience)
+        || claims.kind !== 'human' || claims.sid !== s.id || claims.sub !== p.id || claims.tid !== p.id || claims.org !== s.organizationId
+        || (s.tenantId !== undefined && s.tenantId !== null && s.tenantId !== p.id)
+        || claims.cnf !== undefined || claims.cap !== undefined || claims.obo !== undefined)
+        invalidEnvelope();
+    // LifeID's account scope is the principal; the selected organization stays separate.
+    // Optional response projections are not required to retain committed rotation.
+    return { access_token: s.accessToken, refresh_token: body.refresh_token,
+        user: { id: p.id, ...(typeof p.email === 'string' ? { email: p.email } : {}) },
+        organization_id: s.organizationId, expires_at: Math.min(expires, exp), client_id: r.productId,
+        auth: { kind: 'lifeid-bridge', issuer: LIFEID_ISSUER, audience: r.audience, product_id: r.productId,
+            redirect_uri: r.redirectUri, principal_id: p.id, session_id: s.id } };
+}
+/** Bound headers AND body, forbid redirects, and never echo a provider payload. */
+async function post(c, path, body, signal) {
+    registration(c);
+    if (signal?.aborted)
+        throw new LifeIdRequestError('LifeID request cancelled. No automatic retry was made.');
+    const controller = new AbortController();
+    let reader;
+    let response;
+    let rejectDeadline;
+    const deadline = new Promise((_, reject) => { rejectDeadline = reject; });
+    const abort = () => { controller.abort(); rejectDeadline(new LifeIdRequestError('LifeID request cancelled. No automatic retry was made.')); };
+    const timer = setTimeout(() => {
+        controller.abort();
+        rejectDeadline(new LifeIdRequestError('LifeID request timed out. No automatic retry was made.'));
+    }, 15_000);
+    signal?.addEventListener('abort', abort, { once: true });
+    if (signal?.aborted)
+        abort();
+    try {
+        return await Promise.race([deadline, (async () => {
+                if (controller.signal.aborted)
+                    throw new LifeIdRequestError('LifeID request cancelled.');
+                response = await c.fetch(`${LIFEID_ISSUER}${path}`, { method: 'POST', headers: { 'content-type': 'application/json', accept: 'application/json' },
+                    body: JSON.stringify(body), redirect: 'error', cache: 'no-store', signal: controller.signal });
+                if (controller.signal.aborted) {
+                    void response.body?.cancel().catch(() => { });
+                    throw new LifeIdRequestError('LifeID request cancelled.');
+                }
+                if (!response.ok || !/^application\/json(?:;|$)/i.test(response.headers.get('content-type') ?? '')) {
+                    void response.body?.cancel().catch(() => { });
+                    throw new LifeIdRequestError(`LifeID request failed (${response.status}). Run \`genesis login\` again.`);
+                }
+                reader = response.body?.getReader();
+                if (!reader)
+                    invalidEnvelope();
+                const chunks = [];
+                let size = 0;
+                while (true) {
+                    const part = await reader.read();
+                    if (part.done)
+                        break;
+                    size += part.value.byteLength;
+                    if (size > 32_768) {
+                        void reader.cancel().catch(() => { });
+                        invalidEnvelope();
+                    }
+                    chunks.push(part.value);
+                }
+                try {
+                    return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+                }
+                catch {
+                    invalidEnvelope();
+                }
+            })()]);
+    }
+    catch (error) {
+        if (error instanceof LifeIdRequestError)
+            throw error;
+        throw new Error('LifeID transport failed. No automatic retry was made.');
+    }
+    finally {
+        clearTimeout(timer);
+        signal?.removeEventListener('abort', abort);
+        if (controller.signal.aborted)
+            void reader?.cancel().catch(() => { });
+    }
+}
+export async function completeLogin(c, attempt) {
+    try {
+        const r = registration(c);
+        if (r.productId !== attempt.registration.productId || r.redirectUri !== attempt.registration.redirectUri
+            || r.audience !== attempt.registration.audience)
+            throw new Error('LifeID login registration changed.');
+        const code = await attempt.code;
+        const body = await post(c, '/v4/lifeid/exchange', { life_code: code, product_id: r.productId,
+            redirect_uri: r.redirectUri, code_verifier: attempt.codeVerifier }, attempt.signal);
+        return parseLifeSession(c, body);
+    }
+    finally {
+        attempt.close();
+    }
+}
+function requireSaved(c, s) {
+    const r = registration(c), a = s.auth;
+    if (!a || a.kind !== 'lifeid-bridge' || a.issuer !== LIFEID_ISSUER || a.audience !== r.audience
+        || a.product_id !== r.productId || a.redirect_uri !== r.redirectUri || s.client_id !== r.productId
+        || !id(s.organization_id, 'o') || !id(a.principal_id, 'h') || !id(a.session_id, 'sess')) {
+        throw new Error('Saved login is not an admitted LifeID bridge session. Run `genesis login` again.');
+    }
+    const claims = tokenClaims(s.access_token), aud = claims?.aud;
+    if (!claims || claims.iss !== a.issuer || !(aud === a.audience || (Array.isArray(aud) && aud.includes(a.audience)))
+        || claims.kind !== 'human' || claims.sid !== a.session_id || claims.sub !== a.principal_id || claims.tid !== a.principal_id
+        || claims.org !== s.organization_id || claims.cnf !== undefined || claims.cap !== undefined || claims.obo !== undefined) {
+        throw new Error('Saved LifeID session is inconsistent. Run `genesis login` again.');
     }
-    throw new Error('Login code expired. Run `genesis login` again.');
 }
 export async function refresh(c, s, organizationId) {
-    if (!s.refresh_token)
+    requireSaved(c, s);
+    if (organizationId && organizationId !== s.organization_id) {
+        throw new Error('Changing organization requires a new verified LifeID login; refresh cannot select an organization.');
+    }
+    if (!secret(s.refresh_token))
         throw new Error('Session expired. Run `genesis login`.');
-    const body = { grant_type: 'refresh_token', refresh_token: s.refresh_token, client_id: s.client_id };
-    if (organizationId)
-        body.organization_id = organizationId;
-    const r = await post(c, '/user_management/authenticate', body);
-    if (!r.ok)
-        throw new Error(r.json.error === 'invalid_grant' ? 'Session expired. Run `genesis login`.' : `Could not refresh session (${r.status}): ${r.json.error_description ?? r.json.error}`);
-    return { ...toSaved({ ...c, clientId: s.client_id }, r.json), user: r.json.user ?? s.user };
+    const n = parseLifeSession(c, await post(c, '/v4/auth/refresh', { refresh_token: s.refresh_token }));
+    if (n.organization_id !== s.organization_id || n.auth?.principal_id !== s.auth?.principal_id)
+        invalidEnvelope();
+    return n;
 }
-/** Credential provider for the SDK: saved login, refreshed if within 60s of expiry. */
+const rotations = new WeakMap();
+/** OS-keychain bridge session; one committed rotation per store, never raw AuthKit. */
 export function savedLoginProvider(c, store, now = () => Date.now() / 1000) {
     return async () => {
         let s = await store.get();
         if (!s)
             return undefined;
-        const exp = s.expires_at ?? jwtExp(s.access_token);
-        if (exp && exp - 60 < now()) {
-            s = await refresh(c, s, s.organization_id);
-            await store.set(s);
+        requireSaved(c, s);
+        const exp = jwtExp(s.access_token);
+        const deadline = Math.min(s.expires_at ?? 0, exp ?? 0);
+        if (!Number.isFinite(deadline) || deadline - 60 <= now()) {
+            let pending = rotations.get(store);
+            if (!pending) {
+                pending = (async () => { const next = await refresh(c, s); await store.set(next); return next; })();
+                rotations.set(store, pending);
+            }
+            try {
+                s = await pending;
+            }
+            finally {
+                if (rotations.get(store) === pending)
+                    rotations.delete(store);
+            }
         }
         return s.access_token;
     };

package/dist/beacons.js

@@ -1,5 +1,49 @@
+import { readFile } from 'node:fs/promises';
+import { createPrivateKey, sign } from 'node:crypto';
 export function registerBeacons(program, client, emit) {
-    const devices = program.command('beacons').description('Beacons: Agent-native mesh').command('devices').description('Manage Bridge devices in your signed-in organization');
+    const beacons = program.command('beacons').description('Beacons: Agent-native mesh');
+    beacons.command('fleets').description('Provision Bridge metadata in your verified selection')
+        .command('provision').requiredOption('--request-id <uuid>', 'Stable UUID; reuse with the same name on retry')
+        .option('--name <name>', 'Optional fleet name')
+        .action(async (opts) => {
+        const result = await (await client()).beacons.fleets.provision(opts.requestId, opts.name === undefined ? {} : { name: opts.name });
+        emit(result, () => JSON.stringify(result, null, 2));
+    });
+    const devices = beacons.command('devices').description('Manage Bridge devices in your signed-in organization');
+    devices.command('challenge <fleet-id>').requiredOption('--proof-key <key>', 'Base64url Ed25519 public key').requiredOption('--tunnel-key <key>', 'Base64url WireGuard public key').option('--transport <transport>', 't1_full or t2_sandboxed', 't1_full')
+        .action(async (fleetId, opts) => {
+        if (opts.transport !== 't1_full' && opts.transport !== 't2_sandboxed')
+            throw new Error('Unsupported device transport.');
+        const result = await (await client()).beacons.devices.challenge({ fleet_id: fleetId, proof_key: opts.proofKey, tunnel_key: opts.tunnelKey, transport: opts.transport });
+        emit(result, () => JSON.stringify(result, null, 2));
+    });
+    devices.command('enroll <challenge-file>').requiredOption('--key-file <path>', 'Local Ed25519 PEM private key; never uploaded')
+        .action(async (challengeFile, opts) => {
+        const challenge = JSON.parse(await readFile(challengeFile, 'utf8'));
+        const fields = ['version', 'id', 'nonce', 'issuer', 'organization', 'principal', 'workspace', 'project', 'environment', 'binding_revision', 'transport', 'fleet_id', 'proof_key', 'tunnel_key', 'issued_at', 'expires_at'];
+        if (Object.keys(challenge).length !== fields.length || fields.some(field => challenge[field] === undefined))
+            throw new Error('Invalid challenge file.');
+        const canonical = Object.fromEntries(fields.map(field => [field, challenge[field]]));
+        const key = createPrivateKey(await readFile(opts.keyFile));
+        if (key.asymmetricKeyType !== 'ed25519')
+            throw new Error('An Ed25519 device key is required.');
+        const signature = sign(null, Buffer.from('Genesis Beacons device enrollment v1\n' + JSON.stringify(canonical)), key).toString('base64url');
+        const result = await (await client()).beacons.devices.enroll({ challenge, signature });
+        emit(result, () => JSON.stringify(result, null, 2));
+    });
+    devices.command('revocations <id>').description('Poll durable transport teardown commands').action(async (id) => {
+        const result = await (await client()).beacons.devices.revocations(id);
+        emit(result, () => JSON.stringify(result, null, 2));
+    });
+    devices.command('ack <id> <version>').requiredOption('--action <action>', 'Applied interface_torn_down or peer_key_removed; apply transport action first').action(async (id, version, opts) => {
+        const numeric = Number(version);
+        if (!Number.isSafeInteger(numeric) || numeric < 1)
+            throw new Error('Invalid revocation version.');
+        if (opts.action !== 'interface_torn_down' && opts.action !== 'peer_key_removed')
+            throw new Error('Invalid transport action.');
+        const result = await (await client()).beacons.devices.acknowledge(id, numeric, { action: opts.action });
+        emit(result, () => JSON.stringify(result, null, 2));
+    });
     devices.command('list', { isDefault: true }).action(async () => {
         const result = await (await client()).beacons.devices.list();
         emit(result, () => JSON.stringify(result, null, 2));

package/dist/dials.js

@@ -28,13 +28,60 @@ export function registerDials(program, dependencies) {
     numbers.command('drift').action(async () => { const { client, scope } = await context(); emit(await client.dials.numbers.drift(scope)); });
     dials.command('overview').action(async () => { const { client, scope } = await context(); emit(await client.dials.overview.summary(scope)); });
     dials.command('operating-surface').action(async () => { const { client, scope } = await context(); emit(await client.dials.overview.operatingSurface(scope)); });
+    for (const [name, list, create] of [['people', 'dials_listHumanProfiles', 'dials_createHumanProfile'], ['agents', 'dials_listAgents', 'dials_createAgent'], ['voice', 'dials_listVoiceProfiles', 'dials_createVoiceProfile']]) {
+        const profiles = dials.command(name).description('Saved profile configuration in the selected scope');
+        profiles.command('list', { isDefault: true }).action(async () => { const { client, scope } = await context(); emit(await client.call(list, scope)); });
+        profiles.command('create').requiredOption('--body <json-or-@file>', 'Unassigned profile fields and actorId; same-name POST updates the stored profile').action(async (options) => {
+            const { client, scope } = await context();
+            const text = options.body.startsWith('@') ? await readFile(options.body.slice(1), 'utf8') : options.body;
+            const body = JSON.parse(text);
+            if (!body || typeof body !== 'object' || Array.isArray(body) || 'phoneNumberId' in body)
+                throw new Error('Supply unassigned profile fields; use numbers assign after saving.');
+            emit(await client.call(create, { body: { ...body, scope } }));
+        });
+    }
+    const readBody = async (value) => {
+        const body = JSON.parse(value.startsWith('@') ? await readFile(value.slice(1), 'utf8') : value);
+        if (!body || typeof body !== 'object' || Array.isArray(body))
+            throw new Error('Dials body must be a JSON object.');
+        return body;
+    };
+    const messages = dials.command('messages').description('Saved messages, templates and pending registration configuration');
+    messages.command('list', { isDefault: true }).action(async () => { const { client, scope } = await context(); emit(await client.dials.messages.list(scope)); });
+    messages.command('send').requiredOption('--body <json-or-@file>', 'Explicit approvals, actor, sender, destination, body and idempotency key')
+        .action(async (options) => { const { client, scope } = await context(); const body = await readBody(options.body); emit(await client.call('dials_createOutboundMessage', { body: { ...body, scope } })); });
+    for (const [name, list, create] of [
+        ['templates', 'dials_listMessageTemplates', 'dials_createMessageTemplate'],
+        ['brands', 'dials_listMessagingBrands', 'dials_createMessagingBrand'],
+        ['campaigns', 'dials_listMessagingCampaigns', 'dials_createMessagingCampaign'],
+    ]) {
+        const group = messages.command(name).description('Scoped saved configuration; creation is not provider approval');
+        group.command('list', { isDefault: true }).action(async () => { const { client, scope } = await context(); emit(await client.call(list, scope)); });
+        group.command('create').requiredOption('--body <json-or-@file>', 'Configuration fields and actorId')
+            .action(async (options) => { const { client, scope } = await context(); const body = await readBody(options.body); emit(await client.call(create, { body: { ...body, scope } })); });
+        if (name === 'campaigns')
+            group.command('assign').requiredOption('--campaign <id>', 'Owned campaign ID').requiredOption('--body <json-or-@file>', 'Owned phoneNumberId and actorId')
+                .action(async (options) => { const { client, scope } = await context(); const body = await readBody(options.body); emit(await client.call('dials_assignCampaignNumber', { campaign_id: options.campaign, body: { ...body, scope } })); });
+    }
+    const routing = dials.command('routing').description('Managed owned-number inbound policies; workflow documents are separate');
+    routing.command('list', { isDefault: true }).action(async () => { const { client, scope } = await context(); emit(await client.dials.routing.list(scope)); });
+    routing.command('create').requiredOption('--body <json-or-@file>', 'Owned source, supported action, priority and persisted original UUID; creates an enabled policy')
+        .action(async (options) => { const { client, scope } = await context(); const body = await readBody(options.body); emit(await client.call('dials_createRoutingRule', { body: { ...body, scope } })); });
+    routing.command('disable').requiredOption('--rule <id>', 'Owned managed policy ID; record is retained')
+        .action(async (options) => { const { client, scope } = await context(); emit(await client.dials.routing.disable(options.rule, { scope })); });
+    const workflows = dials.command('workflows').description('Persisted routing descriptors; execution is verified separately');
+    workflows.command('list', { isDefault: true }).action(async () => { const { client, scope } = await context(); emit(await client.dials.workflows.list(scope)); });
+    workflows.command('deploy').requiredOption('--body <json-or-@file>', 'Workflow graph and actorId')
+        .action(async (options) => { const { client, scope } = await context(); const body = await readBody(options.body); emit(await client.call('dials_deployWorkflow', { body: { ...body, scope } })); });
+    numbers.command('delete').requiredOption('--number <id>', 'Owned number ID to release at the carrier').requiredOption('--actor <id>', 'Actual actorId').option('--reason <text>', 'Release reason').option('--platform <id>', 'Selected data platform; omitted defaults to dials')
+        .action(async (options) => { const { client, scope } = await context(); emit(await client.dials.numbers.delete({ ...scope, ...(options.platform !== undefined ? { platformId: options.platform } : {}), number_id: options.number, actorId: options.actor, ...(options.reason !== undefined ? { reason: options.reason } : {}) })); });
     const calls = dials.command('calls').description('Call activity and approved outbound calls');
     calls.command('list', { isDefault: true }).action(async () => { const { client, scope } = await context(); emit(await client.dials.calls.list(scope)); });
     // @file keeps structured approval and idempotency fields out of shell history.
     for (const [parent, name, operation] of [
         [numbers, 'caller-name', 'dials_updateNumberCallerName'], [numbers, 'reconcile', 'dials_reconcileNumberInventory'],
         [numbers, 'provision', 'dials_provisionNumber'], [numbers, 'assign', 'dials_assignNumber'], [numbers, 'release', 'dials_releaseNumber'], [numbers, 'e911', 'dials_registerEmergencyAddress'],
-        [calls, 'validate', 'dials_validateOutboundCall'], [calls, 'create', 'dials_createOutboundCall'],
+        [calls, 'validate', 'dials_validateOutboundCall'], [calls, 'create', 'dials_createOutboundCall'], [calls, 'recover', 'dials_recoverOutboundCall'],
     ]) {
         parent.command(name).requiredOption('--body <json-or-@file>', 'JSON input including actorId and required operation fields')
             .action(async (options) => {

package/dist/fleets.js

@@ -20,7 +20,32 @@ export async function readFoundryKey(input = process.stdin) {
     return key;
 }
 export function registerFleets(program, client, emit, keyInput = readFoundryKey) {
-    const fleets = program.command('fleets').description('Fleets: managed agent tasks');
+    const fleets = program.command('fleets').description('Fleets: managed Henry instances and tasks');
+    const agents = fleets.command('agents').description('Persistent Henry agents on Fleets-managed compute');
+    agents.command('list').action(async () => emit(await (await client()).fleets.agents.list()));
+    agents.command('launch <name>').option('--memory <provider>', 'memory provider (minds, files or custom)', 'minds').option('--namespace <namespace>').option('--endpoint <url>').option('--model <model>').option('--instructions <text>').requiredOption('--idempotency-key <key>', 'stable key to reuse on retry').action(async (name, options) => {
+        const provider = options.memory;
+        if (!['minds', 'files', 'custom'].includes(provider))
+            throw new Error('Memory provider must be minds, files, or custom.');
+        if (provider === 'custom' && !options.endpoint)
+            throw new Error('Custom memory requires --endpoint.');
+        emit(await (await client()).fleets.agents.launch({ name, memory: { provider, ...(options.namespace ? { namespace: options.namespace } : {}), ...(options.endpoint ? { endpoint: options.endpoint } : {}) }, ...(options.model ? { model: options.model } : {}), ...(options.instructions ? { instructions: options.instructions } : {}), idempotency_key: options.idempotencyKey }));
+    });
+    agents.command('get <agent_id>').action(async (id) => emit(await (await client()).fleets.agents.get(id)));
+    agents.command('command <agent_id> <input>').option('--delivery <mode>', 'queue, steer or interrupt', 'queue').action(async (id, input, options) => {
+        if (!['queue', 'steer', 'interrupt'].includes(options.delivery))
+            throw new Error('Delivery must be queue, steer, or interrupt.');
+        emit(await (await client()).fleets.agents.command(id, { input, delivery: options.delivery }));
+    });
+    agents.command('stop <agent_id>').action(async (id) => emit(await (await client()).fleets.agents.stop(id)));
+    agents.command('recover <agent_id>').action(async (id) => emit(await (await client()).fleets.agents.recover(id)));
+    const instances = fleets.command('instances').description('Actual admitted Henry Host status');
+    instances.command('list').option('--limit <number>').option('--after <instance_id>').action(async (options) => {
+        emit(await (await client()).fleets.instances.list({ ...(options.limit ? { limit: Number(options.limit) } : {}), ...(options.after ? { after: options.after } : {}) }));
+    });
+    instances.command('get <instance_id>').action(async (id) => emit(await (await client()).fleets.instances.get(id)));
+    instances.command('stop <instance_id>').description('Stop admitted Henry compute and retain its data').option('--idempotency-key <uuid>', 'canonical UUID4 to retain after an uncertain reply').action(async (id, options) => emit(await (await client()).fleets.instances.stop(id, { idempotencyKey: options.idempotencyKey })));
+    instances.command('start <instance_id>').description('Connect already admitted Henry compute').option('--idempotency-key <uuid>', 'canonical UUID4 to retain after an uncertain reply').action(async (id, options) => emit(await (await client()).fleets.instances.start(id, { idempotencyKey: options.idempotencyKey })));
     const connection = fleets.command('connection').description('Organization-owned Foundry connection');
     connection.command('get').action(async () => emit(await (await client()).fleets.connection.get()));
     connection.command('set').description('Read a Foundry key from stdin and encrypt it with Genesis KMS').action(async () => {

package/dist/flocks.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+import type { Genesis } from '@lifesi/genesis';
+export declare function registerFlocks(program: Command, client: () => Promise<Genesis>, emit: (data: unknown, pretty: () => string) => void, env?: Record<string, string | undefined>): void;

package/dist/flocks.js

@@ -0,0 +1,46 @@
+export function registerFlocks(program, client, emit, env = process.env) {
+    const flocks = program.command('flocks').description('Flocks: Agents on your hardware');
+    const secret = (name) => {
+        const value = env[name];
+        if (!value)
+            throw new Error(`Set ${name} in the environment; do not pass Flocks credentials as command-line arguments.`);
+        return value;
+    };
+    const show = async (run) => {
+        const data = await run(await client());
+        emit(data, () => JSON.stringify(data, null, 2));
+    };
+    flocks.command('readiness').description('Check whether node enrollment is currently available').action(() => show(g => g.flocks.readiness.get()));
+    flocks.command('nodes').description('List your org nodes').action(() => show(g => g.flocks.nodes.list()));
+    flocks.command('join-token').option('--ttl <seconds>', 'lifetime (60–600 seconds)', '600').action((opts) => {
+        const ttl = Number(opts.ttl);
+        if (!Number.isInteger(ttl) || ttl < 60 || ttl > 600)
+            throw new Error('TTL must be 60–600 seconds');
+        return show(g => g.flocks.joinTokens.create(ttl));
+    });
+    flocks.command('rename <id> <nickname>').action((id, nickname) => show(g => g.flocks.nodes.rename(id, nickname)));
+    flocks.command('revoke <id>').action((id) => show(g => g.flocks.nodes.revoke(id)));
+    flocks.command('enroll <name> <platform> <cpus>').description('Enroll this node with FLOCKS_JOIN_TOKEN from the environment').action((name, platform, cpus) => {
+        const cpu_count = Number(cpus);
+        if (!Number.isInteger(cpu_count) || cpu_count < 1 || cpu_count > 65536)
+            throw new Error('CPUs must be 1–65536');
+        const token = secret('FLOCKS_JOIN_TOKEN');
+        return show(g => g.flocks.nodes.enroll({ token, name, platform, cpu_count }));
+    });
+    flocks.command('heartbeat <id>').description('Send presence using FLOCKS_NODE_BINDING from the environment').action((id) => {
+        const binding = secret('FLOCKS_NODE_BINDING');
+        return show(g => g.flocks.nodes.heartbeat(id, binding));
+    });
+    flocks.command('exchange-join').description('Exchange FLOCKS_JOIN_TOKEN and FLOCKS_NODE_NONCE; save the returned key privately before activation').action(() => show(g => g.flocks.joinTokens.exchange({ token: secret('FLOCKS_JOIN_TOKEN'), node_nonce: secret('FLOCKS_NODE_NONCE') })));
+    flocks.command('activate <id> <name> <platform> <cpus>').description('Activate the saved node key with FLOCKS_NODE_NONCE').action((id, name, platform, cpus) => {
+        const cpu_count = Number(cpus);
+        if (!Number.isInteger(cpu_count) || cpu_count < 1 || cpu_count > 65536)
+            throw new Error('CPUs must be 1–65536');
+        return show(g => g.flocks.nodes.activate(id, { name, platform, cpu_count, node_nonce: secret('FLOCKS_NODE_NONCE') }));
+    });
+    flocks.command('rotate <id> <action>').description('prepare→persist→commit, or cancel; use saved FLOCKS_NODE_NONCE/FLOCKS_ROTATION_NONCE').action((id, action) => {
+        if (!['prepare', 'commit', 'cancel'].includes(action))
+            throw new Error('Action must be prepare, commit or cancel');
+        return show(g => g.flocks.nodes.rotateCredential(id, { action: action, node_nonce: secret('FLOCKS_NODE_NONCE'), operation_nonce: secret('FLOCKS_ROTATION_NONCE') }));
+    });
+}

package/dist/hives-marketplace.d.ts

@@ -0,0 +1,10 @@
+import { Command } from 'commander';
+import type { Genesis } from '@lifesi/genesis';
+type Deps = {
+    client: () => Promise<Genesis>;
+    emit: (data: unknown, pretty: () => string) => void;
+    readRequest?: (path: string, limit: number) => Promise<Record<string, unknown>>;
+};
+/** Environment values belong in a bounded private JSON file, never command-line options. */
+export declare function registerHivesMarketplace(hives: Command, deps: Deps): void;
+export {};

package/dist/hives-marketplace.js

@@ -0,0 +1,29 @@
+import { Option } from 'commander';
+import { readFunctionJson } from './function-input.js';
+function number(value) { if (value === undefined)
+    return undefined; if (!/^\d+$/.test(value) || !Number.isSafeInteger(Number(value)))
+    throw new Error('Invalid page option.'); return Number(value); }
+/** Environment values belong in a bounded private JSON file, never command-line options. */
+export function registerHivesMarketplace(hives, deps) {
+    const m = hives.command('marketplace').description('Existing Hives packages, publication and persisted installations');
+    const output = (data) => deps.emit(data, () => JSON.stringify(data, null, 2));
+    const read = deps.readRequest ?? readFunctionJson;
+    const api = async () => (await deps.client()).hives.marketplace;
+    m.command('list <project_id>').option('--query <value>').option('--category <value>').option('--free-only').option('--verified-only')
+        .addOption(new Option('--sort <field>').choices(['name', 'installs', 'stars', 'created', 'updated']))
+        .addOption(new Option('--order <direction>').choices(['asc', 'desc'])).option('--page <number>').option('--page-size <number>')
+        .action(async (project, o) => output(await (await api()).list(project, { q: o.query, category: o.category, free_only: o.freeOnly, verified_only: o.verifiedOnly, sort: o.sort, order: o.order, page: number(o.page), page_size: number(o.pageSize) })));
+    m.command('get <project_id> <slug>').option('--version <semver>').action(async (project, slug, o) => output(await (await api()).get(project, slug, { version: o.version })));
+    m.command('versions <project_id> <slug>').option('--page <number>').option('--page-size <number>').action(async (project, slug, o) => output(await (await api()).versions(project, slug, { page: number(o.page), page_size: number(o.pageSize) })));
+    for (const action of ['categories', 'featured'])
+        m.command(`${action} <project_id>`).action(async (project) => output(await (await api())[action](project)));
+    m.command('publish <project_id>').requiredOption('--request-file <path>', 'JSON publication with an owned uploaded module_hash and immutable version')
+        .action(async (project, o) => output(await (await api()).publish(project, await read(o.requestFile, 512 * 1024))));
+    for (const action of ['install', 'update'])
+        m.command(`${action} <project_id> <slug>`).requiredOption('--request-file <path>', 'JSON version and env_overrides; use {} for defaults')
+            .action(async (project, slug, o) => output(await (await api())[action](project, slug, await read(o.requestFile, 512 * 1024))));
+    m.command('installed <project_id>').option('--page <number>').option('--page-size <number>').action(async (project, o) => output(await (await api()).installed(project, { page: number(o.page), page_size: number(o.pageSize) })));
+    m.command('installation <project_id> <installation_id>').action(async (project, id) => output(await (await api()).getInstallation(project, id)));
+    for (const action of ['reconcile', 'uninstall'])
+        m.command(`${action} <project_id> <installation_id>`).action(async (project, id) => output(await (await api())[action](project, id)));
+}

package/dist/hives-node-transport.js

@@ -11,6 +11,8 @@ export async function closeHivesNodeTransport() {
     await current?.destroy();
 }
 export function hivesOperationBudget(id) {
+    if (['hives_list_buckets', 'hives_create_bucket', 'hives_get_bucket', 'hives_delete_bucket', 'hives_list_objects', 'hives_upload_object', 'hives_upload_object_by_key', 'hives_delete_object', 'hives_delete_object_by_key', 'hives_download_object_by_key', 'hives_get_cors_config', 'hives_set_cors_config', 'hives_generate_presigned_url', 'hives_reconcile'].includes(id))
+        return 100_000;
     if (id === 'hives_cancel_deployment' || id === 'hives_delete_deployment')
         return 330_000;
     if (['hives_create_deployment', 'hives_upload_deployment', 'hives_invoke_deployment', 'hives_invoke_function', 'hives_invoke_function_async'].includes(id))

package/dist/hives-operations.d.ts

@@ -0,0 +1,9 @@
+import { Command } from 'commander';
+import type { Genesis } from '@lifesi/genesis';
+type Deps = {
+    client: () => Promise<Genesis>;
+    emit: (data: unknown, pretty: () => string) => void;
+    readRequest?: (path: string, limit: number) => Promise<Record<string, unknown>>;
+};
+export declare function registerHivesOperations(hives: Command, deps: Deps): void;
+export {};

package/dist/hives-operations.js

@@ -0,0 +1,61 @@
+import { registerHivesResources } from './hives-resources.js';
+import { Option } from 'commander';
+import { readFunctionJson } from './function-input.js';
+function metricsOptions(command) {
+    return command.option('--start <time>', 'inclusive UTC timestamp').option('--end <time>', 'exclusive UTC timestamp')
+        .addOption(new Option('--resolution <value>', 'time bucket').choices(['minute', 'fiveminutes', 'fifteenminutes', 'hour', 'day']))
+        .addOption(new Option('--aggregation <value>', 'supported aggregation').choices(['sum', 'avg', 'min', 'max', 'count', 'p50', 'p90', 'p95', 'p99']));
+}
+const integer = (value, name, max) => {
+    if (value === undefined)
+        return undefined;
+    if (!/^\d+$/.test(value) || !Number.isSafeInteger(Number(value)) || Number(value) < 1 || Number(value) > max) {
+        throw new Error(`${name} must be an integer from 1 to ${max}.`);
+    }
+    return Number(value);
+};
+const paging = (command) => command.option('--page <number>').option('--per-page <number>');
+const pagination = (o) => ({ page: integer(o.page, '--page', 10000), per_page: integer(o.perPage, '--per-page', 100) });
+export function registerHivesOperations(hives, deps) {
+    registerHivesResources(hives, deps);
+    const output = (data) => deps.emit(data, () => JSON.stringify(data, null, 2));
+    const read = deps.readRequest ?? readFunctionJson;
+    const settings = hives.command('settings').description('Stored project preferences and actual engine capabilities');
+    settings.command('get <project_id>').action(async (project) => output(await (await deps.client()).hives.settings.get(project)));
+    settings.command('update <project_id>').requiredOption('--request-file <path>', 'JSON settings patch')
+        .action(async (project, o) => output(await (await deps.client()).hives.settings.update(project, await read(o.requestFile, 64 * 1024))));
+    const crons = hives.command('crons').description('Waggle schedules and persisted run outcomes');
+    paging(crons.command('list <project_id>')).action(async (project, o) => output(await (await deps.client()).hives.crons.list(project, pagination(o))));
+    crons.command('get <project_id> <cron_id>').action(async (project, cron) => output(await (await deps.client()).hives.crons.get(project, cron)));
+    crons.command('create <project_id>').requiredOption('--request-file <path>', 'JSON name, schedule, handler, timezone and enabled preference')
+        .action(async (project, o) => {
+        const body = await read(o.requestFile, 64 * 1024);
+        if (typeof body.name !== 'string' || typeof body.schedule !== 'string' || typeof body.handler !== 'string')
+            throw new Error('Cron JSON requires name, schedule and handler strings.');
+        output(await (await deps.client()).hives.crons.create(project, { ...body, name: body.name, schedule: body.schedule, handler: body.handler }));
+    });
+    crons.command('update <project_id> <cron_id>').requiredOption('--request-file <path>', 'JSON schedule patch')
+        .action(async (project, cron, o) => output(await (await deps.client()).hives.crons.update(project, cron, await read(o.requestFile, 64 * 1024))));
+    for (const action of ['delete', 'pause', 'resume', 'trigger']) {
+        crons.command(`${action} <project_id> <cron_id>`)
+            .description(action === 'trigger' ? 'Admit one run; inspect runs for completion. Does not retry.' : `${action} an owned schedule`)
+            .action(async (project, cron) => output(await (await deps.client()).hives.crons[action](project, cron)));
+    }
+    paging(crons.command('runs <project_id> <cron_id>')).addOption(new Option('--status <state>', 'persisted run status').choices(['pending', 'running', 'success', 'failed', 'timeout', 'cancelled']))
+        .option('--since <time>').option('--until <time>')
+        .action(async (project, cron, o) => output(await (await deps.client()).hives.crons.runs(project, cron, { ...pagination(o), status: o.status, since: o.since, until: o.until })));
+    const metrics = hives.command('metrics').description('Retained completed API observations; unavailable measurements remain null');
+    for (const kind of ['project', 'requests', 'latency', 'errors', 'resources']) {
+        metricsOptions(metrics.command(`${kind} <project_id>`))
+            .action(async (project, q) => output(await (await deps.client()).hives.metrics[kind](project, q)));
+    }
+    metrics.command('dashboard <project_id>').addOption(new Option('--period <value>').choices(['1h', '24h', '7d', '30d']))
+        .action(async (project, q) => output(await (await deps.client()).hives.metrics.dashboard(project, q)));
+    for (const kind of ['function', 'invocations']) {
+        metricsOptions(metrics.command(`${kind} <project_id> <function_id>`))
+            .action(async (project, id, q) => output(await (await deps.client()).hives.metrics[kind](project, id, q)));
+    }
+    metricsOptions(metrics.command('deployment <project_id> <deployment_id>'))
+        .action(async (project, id, q) => output(await (await deps.client()).hives.metrics.deployment(project, id, q)));
+    metrics.command('realtime <project_id>').action(async (project) => output(await (await deps.client()).hives.metrics.realtime(project)));
+}

package/dist/hives-resources.d.ts

@@ -0,0 +1,9 @@
+import { Command } from 'commander';
+import type { Genesis } from '@lifesi/genesis';
+type Deps = {
+    client: () => Promise<Genesis>;
+    emit: (data: unknown, pretty: () => string) => void;
+    readRequest?: (path: string, limit: number) => Promise<Record<string, unknown>>;
+};
+export declare function registerHivesResources(hives: Command, deps: Deps): void;
+export {};

package/dist/hives-resources.js

@@ -0,0 +1,79 @@
+import { registerHivesMarketplace } from './hives-marketplace.js';
+import { createReadStream } from 'node:fs';
+import { stat, writeFile } from 'node:fs/promises';
+import { readFunctionJson } from './function-input.js';
+async function bytes(path) {
+    const metadata = await stat(path);
+    if (!metadata.isFile() || metadata.size > 10 * 1024 * 1024)
+        throw new Error('Choose a regular file of at most 10 MiB.');
+    const stream = createReadStream(path);
+    const chunks = [];
+    let total = 0;
+    try {
+        for await (const chunk of stream) {
+            const value = Buffer.from(chunk);
+            total += value.byteLength;
+            if (total > 10 * 1024 * 1024)
+                throw new Error('Object file exceeds 10 MiB.');
+            chunks.push(value);
+        }
+    }
+    finally {
+        stream.destroy();
+    }
+    return Uint8Array.from(Buffer.concat(chunks, total));
+}
+function number(value, min, max) { if (value === undefined)
+    return undefined; if (!/^\d+$/.test(value) || !Number.isSafeInteger(Number(value)) || Number(value) < min || Number(value) > max)
+    throw new Error('Invalid bounded numeric option.'); return Number(value); }
+export function registerHivesResources(hives, deps) {
+    registerHivesMarketplace(hives, deps);
+    const output = (data) => deps.emit(data, () => JSON.stringify(data, null, 2));
+    const read = deps.readRequest ?? readFunctionJson;
+    const cells = hives.command('cells').description('Owned GCS buckets and objects; uncertain mutations require readback/reconciliation');
+    cells.command('list <project_id>').option('--page <number>').option('--per-page <number>').action(async (project, o) => output(await (await deps.client()).hives.cells.list(project, { page: number(o.page, 1, 10000), per_page: number(o.perPage, 1, 100) })));
+    cells.command('get <project_id> <bucket_id>').action(async (project, id) => output(await (await deps.client()).hives.cells.get(project, id)));
+    cells.command('create <project_id>').requiredOption('--request-file <path>', 'JSON name, region, visibility and CORS').action(async (project, o) => output(await (await deps.client()).hives.cells.create(project, await read(o.requestFile, 512 * 1024))));
+    for (const action of ['remove', 'reconcile'])
+        cells.command(`${action} <project_id> <bucket_id>`).action(async (project, id) => output(await (await deps.client()).hives.cells[action](project, id)));
+    const cors = cells.command('cors');
+    cors.command('get <project_id> <bucket_id>').action(async (project, id) => output(await (await deps.client()).hives.cells.cors.get(project, id)));
+    cors.command('set <project_id> <bucket_id>').requiredOption('--request-file <path>', 'JSON object with rules array').action(async (project, id, o) => { const body = await read(o.requestFile, 512 * 1024); if (!Array.isArray(body.rules))
+        throw new Error('CORS JSON requires rules.'); output(await (await deps.client()).hives.cells.cors.set(project, id, body.rules)); });
+    const objects = cells.command('objects');
+    objects.command('list <project_id> <bucket_id>').option('--prefix <value>').option('--delimiter <value>').option('--continuation-token <value>').option('--max-keys <number>').action(async (project, id, o) => output(await (await deps.client()).hives.cells.objects.list(project, id, { prefix: o.prefix, delimiter: o.delimiter, continuation_token: o.continuationToken, max_keys: number(o.maxKeys, 1, 1000) })));
+    for (const action of ['put', 'put-flat'])
+        objects.command(`${action} <project_id> <bucket_id> <key>`).requiredOption('--file <path>', 'Exact binary bytes up to 10 MiB').option('--content-type <value>').action(async (project, id, key, o) => { const client = await deps.client(); output(await client.hives.cells.objects[action === 'put' ? 'put' : 'putFlat'](project, id, key, await bytes(o.file), { content_type: o.contentType })); });
+    for (const action of ['remove', 'remove-flat'])
+        objects.command(`${action} <project_id> <bucket_id> <key>`).action(async (project, id, key) => { await (await deps.client()).hives.cells.objects[action === 'remove' ? 'remove' : 'removeFlat'](project, id, key); output({ acknowledged: true }); });
+    objects.command('download <project_id> <bucket_id> <key>').requiredOption('--output-file <path>', 'Create a new file; existing files are never overwritten').action(async (project, id, key, o) => { const response = await (await deps.client()).hives.cells.objects.download(project, id, key); const data = new Uint8Array(await response.arrayBuffer()); await writeFile(o.outputFile, data, { flag: 'wx', mode: 0o600 }); output({ saved: true, bytes: data.byteLength }); });
+    cells.command('presign <project_id> <bucket_id>').requiredOption('--request-file <path>', 'Explicit GET/PUT capability request; PUT requires exact content_length').action(async (project, id, o) => output(await (await deps.client()).hives.cells.presign(project, id, await read(o.requestFile, 64 * 1024))));
+    const queues = hives.command('queues').description('Buzz durable messages and possessed temporary delivery receipts');
+    for (const action of ['list'])
+        queues.command(`${action} <project_id>`).action(async (project) => output(await (await deps.client()).hives.queues[action](project)));
+    for (const action of ['get', 'stats', 'consumers', 'pause', 'resume', 'purge', 'remove', 'dead-letter-stats', 'purge-dead-letters']) {
+        const names = { 'dead-letter-stats': 'deadLetterStats', 'purge-dead-letters': 'purgeDeadLetters' };
+        queues.command(`${action} <project_id> <queue_id>`).action(async (project, id) => { const client = await deps.client(); const method = action in names ? names[action] : action; output(await client.hives.queues[method](project, id)); });
+    }
+    queues.command('create <project_id>').requiredOption('--request-file <path>').action(async (project, o) => output(await (await deps.client()).hives.queues.create(project, await read(o.requestFile, 512 * 1024))));
+    queues.command('configure <project_id> <queue_id>').requiredOption('--request-file <path>').action(async (project, id, o) => output(await (await deps.client()).hives.queues.configure(project, id, await read(o.requestFile, 512 * 1024))));
+    queues.command('send <project_id> <queue_id>').requiredOption('--request-file <path>', 'Exactly body or body_base64; decoded body 256 KiB').action(async (project, id, o) => output(await (await deps.client()).hives.queues.send(project, id, await read(o.requestFile, 512 * 1024))));
+    queues.command('receive <project_id> <queue_id>').option('--max-messages <number>').option('--wait-seconds <number>').action(async (project, id, o) => output(await (await deps.client()).hives.queues.receive(project, id, { maxMessages: number(o.maxMessages, 1, 10), waitSeconds: number(o.waitSeconds, 0, 10) })));
+    for (const action of ['ack', 'nack'])
+        queues.command(`${action} <project_id> <queue_id> <message_id>`).requiredOption('--receipt-file <path>', 'JSON receiptHandle; not a credential/header/query').action(async (project, id, message, o) => { const body = await read(o.receiptFile, 4096); if (typeof body.receiptHandle !== 'string')
+            throw new Error('Receipt JSON requires receiptHandle.'); output(await (await deps.client()).hives.queues[action](project, id, message, body.receiptHandle)); });
+    queues.command('dead-letters <project_id> <queue_id>').option('--limit <number>').option('--offset <number>').action(async (project, id, o) => output(await (await deps.client()).hives.queues.deadLetters(project, id, { limit: number(o.limit, 1, 10), offset: number(o.offset, 0, 8192) })));
+    for (const action of ['replay', 'delete-dead-letter'])
+        queues.command(`${action} <project_id> <queue_id> <message_id>`).action(async (project, id, message) => output(await (await deps.client()).hives.queues[action === 'replay' ? 'replay' : 'deleteDeadLetter'](project, id, message)));
+    const volumes = hives.command('volumes').description('Persistent local storage; refresh saved state after an uncertain acknowledgement');
+    volumes.command('list <project_id>').option('--page <number>').option('--per-page <number>').action(async (project, o) => output(await (await deps.client()).hives.volumes.list(project, { page: number(o.page, 1, 10000), per_page: number(o.perPage, 1, 100) })));
+    for (const action of ['get', 'unmount', 'remove'])
+        volumes.command(`${action} <project_id> <volume_id>`).action(async (project, id) => output(await (await deps.client()).hives.volumes[action](project, id)));
+    volumes.command('create <project_id>').requiredOption('--request-file <path>', 'JSON name and size_mib (32–1024); local read_write_once only').action(async (project, o) => output(await (await deps.client()).hives.volumes.create(project, await read(o.requestFile, 4096))));
+    volumes.command('mount <project_id> <volume_id>').requiredOption('--request-file <path>', 'JSON target_id, mount_path and explicit read_only; preserve these values when reconnecting').action(async (project, id, o) => output(await (await deps.client()).hives.volumes.mount(project, id, await read(o.requestFile, 4096))));
+    const runtime = hives.command('runtimes').description('Compiled serving implementation metadata; not available capacity');
+    runtime.command('list').action(async () => output(await (await deps.client()).hives.runtimes.list()));
+    runtime.command('project <project_id>').action(async (project) => output(await (await deps.client()).hives.runtimes.project(project)));
+    runtime.command('get <name>').action(async (name) => output(await (await deps.client()).hives.runtimes.get(name)));
+    runtime.command('select').requiredOption('--wasi <value>').requiredOption('--runner <value>').requiredOption('--artifact <value>').action(async (input) => output(await (await deps.client()).hives.runtimes.select(input)));
+}

package/dist/index.d.ts

@@ -15,6 +15,7 @@ export interface Deps {
     readWasmFile?: (path: string) => Promise<Blob>;
     writeBytes?: (bytes: Uint8Array) => void;
     writeOutputFile?: (path: string, bytes: Uint8Array) => Promise<void>;
+    readHivesRequest?: (path: string, limit: number) => Promise<Record<string, unknown>>;
 }
 export declare function buildProgram(deps?: Deps): Command;
 export declare function main(argv: string[], deps?: Deps): Promise<number>;

package/dist/index.js

@@ -2,14 +2,16 @@ import { registerBeacons } from './beacons.js';
 import { registerDials } from './dials.js';
 import { Command, CommanderError } from 'commander';
 import { Genesis, GenesisError, hivesResponseBytes, MAX_FUNCTION_BODY_BYTES, MAX_FUNCTION_JSON_BYTES, services } from '@lifesi/genesis';
-import { authConfig, pollDevice, refresh, savedLoginProvider, startDevice } from './auth.js';
+import { authConfig, completeLogin, refresh, savedLoginProvider, startLogin } from './auth.js';
 import { keychainStore } from './store.js';
 import { c, listOf, stdio, table } from './output.js';
 import { spawn } from 'node:child_process';
 import { addHenryCommands } from './henry.js';
 import { registerFleets } from './fleets.js';
+import { registerFlocks } from './flocks.js';
 import { registerRunner } from './runner.js';
 import { createHivesNodeTransport } from './hives-node-transport.js';
+import { registerHivesOperations } from './hives-operations.js';
 import { readFunctionFile, readFunctionJson, writeFunctionOutput } from './function-input.js';
 import { basename } from 'node:path';
 import { readWasmFile } from './wasm-input.js';
@@ -30,7 +32,7 @@ export function buildProgram(deps = {}) {
     const auth = { ...authConfig(env, f), sleep: deps.sleep };
     const program = new Command('genesis')
         .description('One CLI for every Genesis service.')
-        .version('0.1.1')
+        .version('0.1.2')
         .option('--json', 'machine-readable JSON output')
         .option('--api-key <key>', 'use this API key (default: GENESIS_API_KEY, then your `genesis login`)')
         .option('--base-url <url>', 'gateway URL (default: GENESIS_BASE_URL or https://console.life.one/api)')
@@ -46,7 +48,7 @@ export function buildProgram(deps = {}) {
         const opts = {
             apiKey: o.apiKey ?? env.GENESIS_API_KEY, token: env.GENESIS_TOKEN,
             baseUrl: o.baseUrl ?? env.GENESIS_BASE_URL, routing: o.direct || env.GENESIS_ROUTING === 'direct' ? 'direct' : 'gateway',
-            fetch: f, userAgent: 'genesis-cli/0.1.1',
+            fetch: f, userAgent: 'genesis-cli/0.1.2',
             credentials: store ? savedLoginProvider(auth, store) : undefined,
         };
         return new Genesis(hivesTransport ? { ...opts, fetch: createHivesNodeTransport(opts, deps.signal) } : opts);
@@ -80,11 +82,17 @@ export function buildProgram(deps = {}) {
     program.command('login').description('Sign in with LifeID in your browser').option('--no-browser', 'just print the link')
         .action(async (o) => {
         const store = await getStore();
-        const d = await startDevice(auth);
-        out.err(`\n  Your code: ${c.bold(d.user_code)}\n  Opening ${d.verification_uri_complete}\n  ${c.dim('Waiting for you to approve in the browser…')}\n`);
-        if (o.browser)
-            (deps.openBrowser ?? defaultOpen)(d.verification_uri_complete);
-        const s = await pollDevice(auth, d);
+        const attempt = await startLogin(auth, { signal: deps.signal });
+        let s;
+        try {
+            out.err(`\n  Open ${attempt.browserUrl}\n  ${c.dim('Waiting for LifeID sign-in in the browser…')}\n`);
+            if (o.browser)
+                (deps.openBrowser ?? defaultOpen)(attempt.browserUrl);
+            s = await completeLogin(auth, attempt);
+        }
+        finally {
+            attempt.close();
+        }
         await store.set(s);
         emit({ user: s.user, organization_id: s.organization_id, store: store.kind }, () => `${c.green('✓')} Signed in as ${c.bold(s.user?.email ?? s.user?.id ?? 'you')}${s.organization_id ? ` (${s.organization_id})` : ''}. Token saved to your ${store.kind === 'os-keychain' ? 'OS keychain' : store.kind}.`);
     });
@@ -177,7 +185,8 @@ export function buildProgram(deps = {}) {
     });
     const hivesClient = () => client(true);
     // ---- hives -----------------------------------------------------------
-    const hives = program.command('hives').description('Hives: projects, secrets, deployments, functions');
+    const hives = program.command('hives').description('Hives: projects, secrets, deployments, functions, schedules and activity');
+    registerHivesOperations(hives, { client: hivesClient, emit, readRequest: deps.readHivesRequest });
     const deployments = hives.command('deployments').description('Real WASM artifacts and deployment lifecycle');
     const emitDeployment = (data) => emit(data, () => table(data && typeof data === 'object' && !Array.isArray(data) && !('data' in data) ? [data] : listOf(data), ['id', 'version', 'status', 'module_hash', 'created_at']));
     deployments.command('list <project_id>')
@@ -284,6 +293,52 @@ export function buildProgram(deps = {}) {
         return (deps.readSecretInput ?? readSecretInput)(options, limit);
     };
     const emitSecret = (data) => emit(data, () => table(listOf(data), ['id', 'name', 'version', 'description', 'updated_at']));
+    const context = hives.command('context').description('Explicit Hives binding for the current verified interactive Genesis selection');
+    context.command('get').action(async () => {
+        const r = await (await hivesClient()).hives.context.get();
+        emit(r, () => table([r.project], ['id', 'name', 'slug', 'kind', 'status']));
+    });
+    context.command('create <name>').option('--kind <kind>', 'worker|function|site|api', 'worker').option('--description <text>', 'project description')
+        .action(async (name, o) => {
+        if (!['worker', 'function', 'site', 'api'].includes(o.kind))
+            throw new Error('Choose worker, function, site or api.');
+        if (o.description && o.description.length > 500)
+            throw new Error('Project descriptions must contain at most 500 characters.');
+        const r = await (await hivesClient()).hives.context.set({ create: { name: projectName(name), kind: o.kind, description: o.description } });
+        emit(r, () => table([r.project], ['id', 'name', 'slug', 'kind', 'status']));
+    });
+    context.command('link <project_id>').description('Link a Hives project owned by the verified org')
+        .action(async (id) => { const r = await (await hivesClient()).hives.context.set({ link: { project_id: id } }); emit(r, () => table([r.project], ['id', 'name', 'slug', 'kind', 'status'])); });
+    context.command('detach').description('Remove this selection binding; retain the Hives project and its resources')
+        .action(async () => { const r = await (await hivesClient()).hives.context.detach(); emit(r, () => 'Detached selection; retained Hives project ' + r.hivesProjectId + '.'); });
+    const environment = hives.command('environment').description('Encrypted project environment; names-only metadata and explicit KMS reveal');
+    environment.command('list <project_id>').option('--page <number>', 'page number (1–10000)').option('--per-page <number>', 'items per page (1–100)')
+        .action(async (id, o) => {
+        const r = await (await hivesClient()).hives.environment.list(id, { page: positiveInteger(o.page, '--page', 10000), per_page: positiveInteger(o.perPage, '--per-page', 100) });
+        emit(r, () => table(r.data, ['name']));
+    });
+    environment.command('upsert <project_id>').description('Encrypt a flat JSON map; empty string values are allowed')
+        .option('--file <path>', 'UTF-8 JSON input file').option('--stdin', 'read JSON from stdin')
+        .action(async (id, o) => {
+        const text = await readInput(o, 2 * 1024 * 1024);
+        let body;
+        try {
+            body = JSON.parse(text);
+        }
+        catch {
+            throw new Error('Environment input must be a flat JSON map of names to string values.');
+        }
+        const r = await (await hivesClient()).hives.environment.upsert(id, body);
+        emit(r, () => table(r.updated, ['name']));
+    });
+    environment.command('reveal <project_id> <key>').description('Explicit audit-logged environment reveal; requires --stdout')
+        .option('--stdout', 'write sensitive plaintext to stdout (avoid retained output)')
+        .action(async (id, key, o) => {
+        if (!o.stdout)
+            throw new Error('Environment reveal requires --stdout. Avoid logging or retaining the plaintext.');
+        const r = await (await hivesClient()).hives.environment.reveal(id, key);
+        emit(r, () => r.value);
+    });
     secrets.command('list <project_id>').description('List secret metadata without values')
         .option('--page <number>', 'page number (1–10000)').option('--per-page <number>', 'items per page (1–100)')
         .action(async (id, o) => {
@@ -396,6 +451,7 @@ export function buildProgram(deps = {}) {
     });
     addHenryCommands(program, client, value => out.log(JSON.stringify(value, null, 2)));
     registerFleets(program, client, (data) => emit(data, () => JSON.stringify(data, null, 2)));
+    registerFlocks(program, client, (data) => emit(data, () => JSON.stringify(data, null, 2)), env);
     registerBeacons(program, client, emit);
     // ---- status ----------------------------------------------------------
     program.command('status').description('Which Genesis services are wired up').action(async () => {

package/dist/lifeid-native.d.ts

@@ -0,0 +1,24 @@
+export declare const LIFEID_ISSUER = "https://auth.life.one";
+export declare const GENESIS_CLI_PRODUCT = "genesis-cli";
+export declare const CALLBACK_PATH = "/lifeid/callback";
+/** Exact Auth-owned admission metadata; supplying it does not register a client. */
+export interface NativeRegistration {
+    productId: string;
+    redirectUri: string;
+    audience: string;
+}
+export interface NativeAttempt {
+    readonly browserUrl: string;
+    readonly codeVerifier: string;
+    readonly registration: NativeRegistration;
+    readonly code: Promise<string>;
+    readonly signal: AbortSignal;
+    close(): void;
+}
+export declare function validateRegistration(r: NativeRegistration): number;
+/** Bind the sole registered port before the caller opens or prints the browser URL. */
+export declare function startNativeAttempt(registration: NativeRegistration, options?: {
+    signal?: AbortSignal;
+    timeoutMs?: number;
+    organizationHint?: string;
+}): Promise<NativeAttempt>;

package/dist/lifeid-native.js

@@ -0,0 +1,113 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { createServer } from 'node:http';
+export const LIFEID_ISSUER = 'https://auth.life.one';
+export const GENESIS_CLI_PRODUCT = 'genesis-cli';
+export const CALLBACK_PATH = '/lifeid/callback';
+export function validateRegistration(r) {
+    const m = /^http:\/\/127\.0\.0\.1:([1-9][0-9]{3,4})\/lifeid\/callback$/.exec(r.redirectUri);
+    const port = m ? Number(m[1]) : 0;
+    if (r.productId !== GENESIS_CLI_PRODUCT || !m || port < 1024 || port > 65535
+        || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(r.audience)) {
+        throw new Error('LifeID native login requires the exact admitted Genesis product, loopback callback and audience.');
+    }
+    return port;
+}
+/** Bind the sole registered port before the caller opens or prints the browser URL. */
+export async function startNativeAttempt(registration, options = {}) {
+    registration = { ...registration };
+    const port = validateRegistration(registration);
+    const timeout = options.timeoutMs ?? 300_000;
+    if (!Number.isInteger(timeout) || timeout < 1 || timeout > 300_000)
+        throw new Error('Invalid login deadline.');
+    if (options.signal?.aborted)
+        throw new Error('LifeID login cancelled.');
+    if (options.organizationHint && !/^o_[0-9A-HJKMNP-TV-Z]{26}$/.test(options.organizationHint)) {
+        throw new Error('Invalid LifeID organization hint.');
+    }
+    const verifier = randomBytes(48).toString('base64url');
+    const controller = new AbortController();
+    let settled = false;
+    let resolveCode;
+    let rejectCode;
+    const code = new Promise((resolve, reject) => { resolveCode = resolve; rejectCode = reject; });
+    // Binding/open-browser errors may happen before the caller awaits the code.
+    void code.catch(() => { });
+    const server = createServer({ maxHeaderSize: 4096 }, (req, res) => {
+        const reject = (status) => {
+            res.writeHead(status, { 'content-type': 'text/plain', 'cache-control': 'no-store', connection: 'close' });
+            res.end('Invalid LifeID callback.');
+        };
+        // A malformed request cannot consume a pending code. No body is read/logged.
+        if (settled || req.method !== 'GET' || req.headers.host !== `127.0.0.1:${port}`
+            || req.headers.origin !== undefined || req.headers['transfer-encoding'] !== undefined
+            || (req.headers['content-length'] !== undefined && req.headers['content-length'] !== '0')) {
+            reject(400);
+            return;
+        }
+        const m = /^\/lifeid\/callback\?life_code=([A-Za-z0-9_-]{43})$/.exec(req.url ?? '');
+        if (!m) {
+            reject(400);
+            return;
+        }
+        settled = true;
+        res.writeHead(200, { 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-store',
+            'referrer-policy': 'no-referrer', 'content-security-policy': "default-src 'none'", connection: 'close' });
+        res.end('LifeID callback received. Return to Genesis CLI.');
+        server.close();
+        resolveCode(m[1]);
+    });
+    server.requestTimeout = 5000;
+    server.headersTimeout = 5000;
+    server.keepAliveTimeout = 1;
+    server.maxConnections = 4;
+    const close = () => {
+        clearTimeout(timer);
+        options.signal?.removeEventListener('abort', onAbort);
+        server.close();
+        server.closeAllConnections();
+        if (!settled) {
+            settled = true;
+            rejectCode(new Error('LifeID login cancelled.'));
+        }
+        controller.abort();
+    };
+    const onAbort = () => close();
+    const timer = setTimeout(() => {
+        if (!settled) {
+            settled = true;
+            rejectCode(new Error('LifeID login timed out. Run `genesis login` again.'));
+        }
+        close();
+    }, timeout);
+    options.signal?.addEventListener('abort', onAbort, { once: true });
+    try {
+        await new Promise((resolve, reject) => {
+            const aborted = () => { cleanup(); reject(new Error('LifeID login cancelled.')); };
+            const cleanup = () => { server.removeListener('error', error); controller.signal.removeEventListener('abort', aborted); };
+            const error = () => { cleanup(); reject(new Error('The registered LifeID callback port is unavailable. No other port was tried.')); };
+            server.once('error', error);
+            controller.signal.addEventListener('abort', aborted, { once: true });
+            if (controller.signal.aborted) {
+                aborted();
+                return;
+            }
+            server.listen({ port, host: '127.0.0.1', signal: controller.signal }, () => { cleanup(); resolve(); });
+        });
+        if (controller.signal.aborted || options.signal?.aborted)
+            throw new Error('LifeID login cancelled.');
+    }
+    catch (error) {
+        close();
+        throw error;
+    }
+    server.on('error', () => close());
+    const url = new URL('/v4/lifeid/start', LIFEID_ISSUER);
+    url.searchParams.set('product_id', registration.productId);
+    url.searchParams.set('return_path', '/');
+    url.searchParams.set('code_challenge', createHash('sha256').update(verifier).digest('base64url'));
+    url.searchParams.set('code_challenge_method', 'S256');
+    if (options.organizationHint)
+        url.searchParams.set('org_hint', options.organizationHint);
+    return { browserUrl: url.toString(), codeVerifier: verifier, registration: { ...registration }, code,
+        signal: controller.signal, close };
+}

package/dist/runner.js

@@ -2,6 +2,21 @@
 export function registerRunner(program, client, emit) {
     const runner = program.command('runner').description('Runner: agent task execution');
     const output = (value) => emit(value, () => JSON.stringify(value, null, 2));
+    runner.command('permission-grant').description('Request only your current native human Sandbox execution permission; preserve operation/scope/expiry on retry')
+        .requiredOption('--organization <id>', 'current approved Life organization assertion')
+        .requiredOption('--project <id>', 'current approved project assertion')
+        .requiredOption('--workspace <id>', 'current approved workspace assertion')
+        .requiredOption('--operation-id <uuid>', 'stable canonical UUIDv4 for this immutable authorization operation')
+        .requiredOption('--request-id <uuid>', 'fresh canonical UUIDv4 correlation for this attempt')
+        .requiredOption('--expires-at-ms <ms>', 'exact retained future integer expiry, at most 30 minutes and current session/access expiry')
+        .action(async (o) => {
+        if (!/^[1-9]\d*$/.test(o.expiresAtMs) || !Number.isSafeInteger(Number(o.expiresAtMs)))
+            throw new TypeError('Runner permission expiry must be a positive safe integer literal');
+        const input = { schemaVersion: 1, organizationId: o.organization, projectId: o.project,
+            workspaceId: o.workspace, platformId: 'pf_console', fleetId: null, resourceEnvironment: 'sandbox',
+            operationId: o.operationId, requestId: o.requestId, expiresAtMs: Number(o.expiresAtMs) };
+        output(await (await client()).runner.permission.grant(input));
+    });
     runner.command('catalog').description('Authorized workspaces and execution routes')
         .action(async () => output(await (await client()).runner.catalog()));
     const jobs = runner.command('jobs').description('Jobs belonging to your verified identity');

package/dist/store.d.ts

@@ -12,6 +12,16 @@ export interface SavedLogin {
     /** epoch seconds, from the access token's exp claim */
     expires_at?: number;
     client_id: string;
+    /** LifeID bridge provenance. Legacy raw AuthKit credentials are never reused. */
+    auth?: {
+        kind: 'lifeid-bridge';
+        issuer: string;
+        audience: string;
+        product_id: string;
+        redirect_uri: string;
+        principal_id: string;
+        session_id: string;
+    };
 }
 export interface CredentialStore {
     get(): Promise<SavedLogin | undefined>;

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "@lifesi/genesis-cli",
-  "version": "0.1.1",
+  "version": "0.1.3",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/l1felabs/genesis-api.git",
+    "directory": "packages/cli"
+  },
   "description": "genesis: one CLI for every Genesis service",
   "type": "module",
   "bin": {
@@ -13,7 +18,7 @@
   "dependencies": {
     "commander": "^14.0.0",
     "undici": "6.29.0",
-    "@lifesi/genesis": "0.1.1"
+    "@lifesi/genesis": "0.1.3"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "^1.2.0"