@lifesi/genesis-cli 0.1.7 → 0.1.8

package/dist/auth.d.ts

@@ -1,3 +1,4 @@
+import { type GenesisContextSelection } from '@lifesi/genesis';
 import type { CredentialStore, SavedLogin } from './store.js';
 import { type NativeAttempt } from './lifeid-native.js';
 /** LifeID's admitted native product bridge, never a direct AuthKit bearer. */
@@ -20,5 +21,7 @@ export declare function jwtExp(token: string): number | undefined;
 export declare function parseLifeSession(c: AuthConfig, value: unknown, now?: number): SavedLogin;
 export declare function completeLogin(c: AuthConfig, attempt: NativeAttempt): Promise<SavedLogin>;
 export declare function refresh(c: AuthConfig, s: SavedLogin, organizationId?: string): Promise<SavedLogin>;
+/** Commit both replacement credentials through the existing atomic keychain entry. */
+export declare function selectSavedContext(c: AuthConfig, store: CredentialStore, selection: GenesisContextSelection, signal?: AbortSignal): Promise<SavedLogin>;
 /** OS-keychain bridge session; one committed rotation per store, never raw AuthKit. */
 export declare function savedLoginProvider(c: AuthConfig, store: CredentialStore, now?: () => number): () => Promise<string | undefined>;

package/dist/auth.js

@@ -1,3 +1,4 @@
+import { selectGenesisContext } from '@lifesi/genesis';
 import { LIFEID_ISSUER, startNativeAttempt, validateRegistration } from './lifeid-native.js';
 export function authConfig(env = process.env, f = fetch) {
     return { productId: env.GENESIS_AUTH_PRODUCT, redirectUri: env.GENESIS_AUTH_REDIRECT_URI,
@@ -179,29 +180,77 @@ export async function refresh(c, s, organizationId) {
     return n;
 }
 const rotations = new WeakMap();
+/** Queue before the first await, so parallel selection and refresh cannot use
+ * the same spent credential. A failed predecessor does not trigger a retry. */
+function serialize(store, run) {
+    const previous = rotations.get(store);
+    const pending = previous ? previous.then(run) : Promise.resolve().then(run);
+    rotations.set(store, pending);
+    return pending.finally(() => { if (rotations.get(store) === pending)
+        rotations.delete(store); });
+}
+async function commit(store, value) {
+    try {
+        await store.set(value);
+    }
+    catch {
+        throw new Error('The returned LifeID session could not be saved. No automatic retry was made.');
+    }
+}
+async function currentLogin(c, store) {
+    const saved = await store.get();
+    if (!saved)
+        throw new Error('Run `genesis login` before selecting a context.');
+    requireSaved(c, saved);
+    return saved;
+}
+function needsRefresh(saved, now) {
+    return Math.min(saved.expires_at ?? 0, jwtExp(saved.access_token) ?? 0) - 60 <= now;
+}
+/** Commit both replacement credentials through the existing atomic keychain entry. */
+export async function selectSavedContext(c, store, selection, signal) {
+    const requested = { ...selection };
+    return serialize(store, async () => {
+        let saved;
+        const response = await selectGenesisContext(requested, { signal, fetch: c.fetch, credential: async () => {
+                signal?.throwIfAborted();
+                saved = await currentLogin(c, store);
+                if (needsRefresh(saved, Date.now() / 1000)) {
+                    saved = await refresh(c, saved);
+                    await commit(store, saved);
+                }
+                signal?.throwIfAborted();
+                return saved.access_token;
+            } });
+        const next = parseLifeSession(c, response);
+        if (next.auth?.principal_id !== saved?.auth?.principal_id || next.organization_id !== requested.organizationId)
+            invalidEnvelope();
+        await commit(store, next);
+        return next;
+    });
+}
 /** OS-keychain bridge session; one committed rotation per store, never raw AuthKit. */
 export function savedLoginProvider(c, store, now = () => Date.now() / 1000) {
     return async () => {
-        let s = await store.get();
-        if (!s)
+        const mutation = rotations.get(store);
+        if (mutation)
+            return (await mutation).access_token;
+        const saved = await store.get();
+        if (!saved)
             return undefined;
-        requireSaved(c, s);
-        const exp = jwtExp(s.access_token);
-        const deadline = Math.min(s.expires_at ?? 0, exp ?? 0);
-        if (!Number.isFinite(deadline) || deadline - 60 <= now()) {
-            let pending = rotations.get(store);
-            if (!pending) {
-                pending = (async () => { const next = await refresh(c, s); await store.set(next); return next; })();
-                rotations.set(store, pending);
-            }
-            try {
-                s = await pending;
-            }
-            finally {
-                if (rotations.get(store) === pending)
-                    rotations.delete(store);
-            }
-        }
-        return s.access_token;
+        requireSaved(c, saved);
+        const newer = rotations.get(store);
+        if (newer)
+            return (await newer).access_token;
+        if (!needsRefresh(saved, now()))
+            return saved.access_token;
+        return (await serialize(store, async () => {
+            const current = await currentLogin(c, store);
+            if (!needsRefresh(current, now()))
+                return current;
+            const next = await refresh(c, current);
+            await commit(store, next);
+            return next;
+        })).access_token;
     };
 }

package/dist/index.js

@@ -1,9 +1,10 @@
+import { registerMinds } from './minds.js';
 import { registerRelaysEnrollment } from './relays-enrollment.js';
 import { registerBeacons } from './beacons.js';
 import { registerDials } from './dials.js';
 import { Command, CommanderError } from 'commander';
 import { Genesis, GenesisError, hivesResponseBytes, MAX_FUNCTION_BODY_BYTES, MAX_FUNCTION_JSON_BYTES, services } from '@lifesi/genesis';
-import { authConfig, completeLogin, refresh, savedLoginProvider, startLogin } from './auth.js';
+import { authConfig, completeLogin, selectSavedContext, savedLoginProvider, startLogin } from './auth.js';
 import { keychainStore } from './store.js';
 import { c, listOf, stdio, table } from './output.js';
 import { spawn } from 'node:child_process';
@@ -33,7 +34,7 @@ export function buildProgram(deps = {}) {
     const auth = { ...authConfig(env, f), sleep: deps.sleep };
     const program = new Command('genesis')
         .description('One CLI for every Genesis service.')
-        .version('0.1.7')
+        .version('0.1.8')
         .option('--json', 'machine-readable JSON output')
         .option('--api-key <key>', 'use this API key (default: GENESIS_API_KEY, then your `genesis login`)')
         .option('--base-url <url>', 'gateway URL (default: GENESIS_BASE_URL or https://console.life.one/api)')
@@ -49,7 +50,7 @@ export function buildProgram(deps = {}) {
         const opts = {
             apiKey: o.apiKey ?? env.GENESIS_API_KEY, token: env.GENESIS_TOKEN,
             baseUrl: o.baseUrl ?? env.GENESIS_BASE_URL, routing: o.direct || env.GENESIS_ROUTING === 'direct' ? 'direct' : 'gateway',
-            fetch: f, userAgent: 'genesis-cli/0.1.7',
+            fetch: f, userAgent: 'genesis-cli/0.1.8',
             credentials: store ? savedLoginProvider(auth, store) : undefined,
         };
         return new Genesis(hivesTransport ? { ...opts, fetch: createHivesNodeTransport(opts, deps.signal) } : opts);
@@ -148,10 +149,18 @@ export function buildProgram(deps = {}) {
         const s = await store.get();
         if (!s)
             throw new Error('Not signed in. Run `genesis login`.');
-        const n = await refresh(auth, s, id);
-        await store.set(n);
+        const n = await selectSavedContext(auth, store, { organizationId: id }, deps.signal);
         emit({ organization_id: n.organization_id }, () => `${c.green('✓')} Now using ${c.bold(n.organization_id ?? id)}.`);
     });
+    const selection = program.command('context').description('Select an authorized Genesis organization, workspace and project');
+    selection.command('select').requiredOption('--organization <id>').requiredOption('--workspace <id>').requiredOption('--project <id>')
+        .description('Bind the saved human login to a Console Sandbox context and atomically replace its credentials')
+        .action(async (options) => {
+        const target = { organizationId: options.organization, workspaceId: options.workspace, projectId: options.project,
+            platformId: 'pf_console', fleetId: null, environmentId: 'sandbox' };
+        const next = await selectSavedContext(auth, await getStore(), target, deps.signal);
+        emit({ principal_id: next.auth?.principal_id, ...target }, () => `Selected ${target.organizationId} / ${target.workspaceId} / ${target.projectId} (Sandbox).`);
+    });
     // ---- keys ------------------------------------------------------------
     const keys = program.command('keys').description('Org API keys (LifeID / WorkOS)');
     keys.command('list').action(async () => {
@@ -205,6 +214,7 @@ export function buildProgram(deps = {}) {
         const r = await gen.foundry.chat({ model: o.model, messages });
         emit(r, () => r.choices?.[0]?.message?.content ?? JSON.stringify(r));
     });
+    registerMinds(program, client, data => emit(data, () => JSON.stringify(data, null, 2)));
     const hivesClient = () => client(true);
     // ---- hives -----------------------------------------------------------
     const hives = program.command('hives').description('Hives: projects, secrets, deployments, functions, schedules and activity');

package/dist/minds.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+import type { Genesis } from '@lifesi/genesis';
+export declare function registerMinds(program: Command, client: () => Promise<Genesis>, emit: (data: unknown) => void): void;

package/dist/minds.js

@@ -0,0 +1,28 @@
+import { readFile, stat } from 'node:fs/promises';
+export function registerMinds(program, client, emit) {
+    const minds = program.command('minds').description('Owned Minds and persisted memory; requires an admitted human Console Sandbox session');
+    minds.command('list').option('--after <uuid>').option('--limit <number>').description('List real Minds and the current creation context fingerprint').action(async (options) => {
+        emit(await (await client()).minds.list({ ...(options.after ? { after: options.after } : {}), ...(options.limit ? { limit: Number(options.limit) } : {}) }));
+    });
+    minds.command('get <mind_id>').action(async (id) => emit(await (await client()).minds.get(id)));
+    minds.command('create <name>').description('Create a capped Free/F1 Sandbox Mind; 202 means provisioning')
+        .requiredOption('--idempotency-key <uuid>', 'persist this UUID4 and retain it after an uncertain response')
+        .requiredOption('--context-sha256 <hash>', 'context_sha256 from the current minds list response')
+        .action(async (name, options) => emit(await (await client()).minds.create(name, { idempotencyKey: options.idempotencyKey, contextSha256: options.contextSha256 })));
+    const memory = minds.command('memory').description('Every operation selects one owned, ready Mind');
+    memory.command('insert <mind_id>').requiredOption('--event-file <path>', 'JSON event with id, content and timestamp; returned id is its storage UUID')
+        .action(async (id, options) => {
+        const metadata = await stat(options.eventFile);
+        if (!metadata.isFile() || metadata.size > 65_536)
+            throw new Error('Event file must be at most 64 KiB.');
+        const bytes = await readFile(options.eventFile);
+        if (bytes.length > 65_536)
+            throw new Error('Event file exceeds 64 KiB.');
+        const event = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+        emit(await (await client()).minds.memory.insert(id, event));
+    });
+    memory.command('get <mind_id> <storage_id>').action(async (mind, storage) => emit(await (await client()).minds.memory.get(mind, storage)));
+    memory.command('search <mind_id> <text>').option('--limit <number>', '1–100 results', '20').action(async (mind, text, options) => {
+        emit(await (await client()).minds.memory.search(mind, text, Number(options.limit)));
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifesi/genesis-cli",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/l1felabs/genesis-api.git",
@@ -18,11 +18,21 @@
   "dependencies": {
     "commander": "^14.0.0",
     "undici": "6.29.0",
-    "@lifesi/genesis": "0.1.7"
+    "@lifesi/genesis": "0.1.8"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "^1.2.0"
   },
+  "exports": {
+    "./auth": {
+      "types": "./dist/auth.d.ts",
+      "default": "./dist/auth.js"
+    },
+    "./store": {
+      "types": "./dist/store.d.ts",
+      "default": "./dist/store.js"
+    }
+  },
   "scripts": {
     "build": "tsc -p tsconfig.json"
   }