@lifesi/genesis 0.1.0 → 0.1.2

package/dist/hives-cells.d.ts

@@ -0,0 +1,127 @@
+import type { GenesisClient } from './client.js';
+import { type HivesResourceOptions } from './hives-resources-transport.js';
+export interface HivesCorsRule {
+    allowed_origins: string[];
+    allowed_methods: string[];
+    allowed_headers: string[];
+    exposed_headers: string[];
+    max_age_secs: number;
+}
+export interface HivesBucket {
+    id: string;
+    tenant_id: string;
+    project_id: string;
+    name: string;
+    region: string;
+    visibility: string;
+    status: string;
+    object_count: number | null;
+    size_bytes: number | null;
+    statistics_scope: 'unmeasured_provider_inventory' | 'retained_legacy_metadata';
+    created_at: string;
+    provider_binding: {
+        provider: 'gcs';
+        region: string;
+        state: string;
+        requires_reconciliation: boolean;
+    } | null;
+    operation_state: string | null;
+}
+export interface HivesObject {
+    key: string;
+    bucket_id: string;
+    size_bytes: number;
+    etag: string;
+    last_modified: string;
+    generation: string;
+    content_type: string | null;
+    metadata: Record<string, string> | null;
+    metadata_scope: string;
+}
+export interface HivesObjectAcknowledgement {
+    bucket_id: string;
+    key: string;
+    size_bytes: number;
+    etag: string;
+    generation: string;
+    content_type: string | null;
+}
+export interface HivesObjectList {
+    objects: HivesObject[];
+    common_prefixes: string[];
+    is_truncated: boolean;
+    next_continuation_token: string | null;
+    total: number | null;
+}
+export interface HivesBucketList {
+    data: HivesBucket[];
+    pagination: {
+        page: number;
+        per_page: number;
+        total: number;
+        total_pages: number;
+        has_next: boolean;
+        has_prev: boolean;
+    };
+}
+export interface HivesCreateBucket {
+    name: string;
+    region?: 'us-central1';
+    visibility?: 'private' | 'publicread';
+    cors_rules?: HivesCorsRule[];
+}
+export interface HivesPresign {
+    key: string;
+    method?: 'GET' | 'PUT';
+    expires_in_secs?: number;
+    content_type?: string;
+    content_length?: number;
+}
+export interface HivesPresignedUrl {
+    url: string;
+    expires_at: string;
+    method: 'GET' | 'PUT';
+    required_headers?: Record<string, string>;
+}
+export declare function hivesObjectKey(key: string): string;
+export declare function hivesCells(client: GenesisClient): {
+    list(project: string, query?: {
+        page?: number;
+        per_page?: number;
+    }, options?: HivesResourceOptions): Promise<HivesBucketList>;
+    get(project: string, id: string, options?: HivesResourceOptions): Promise<HivesBucket>;
+    /** A pending provider_binding is an uncertain outcome, never a completed-create claim. */
+    create(project: string, body: HivesCreateBucket, options?: HivesResourceOptions): Promise<HivesBucket>;
+    remove(project: string, id: string, options?: HivesResourceOptions): Promise<{
+        id: string;
+        success: boolean;
+        message: string;
+    }>;
+    reconcile(project: string, id: string, options?: HivesResourceOptions): Promise<{
+        bucket: HivesBucket;
+        outcome: string;
+    }>;
+    cors: {
+        get: (project: string, id: string, options?: HivesResourceOptions) => Promise<HivesCorsRule[]>;
+        set: (project: string, id: string, rules: HivesCorsRule[], options?: HivesResourceOptions) => Promise<HivesCorsRule[]>;
+    };
+    objects: {
+        list(project: string, id: string, query?: {
+            prefix?: string;
+            delimiter?: string;
+            continuation_token?: string;
+            max_keys?: number;
+        }, options?: HivesResourceOptions): Promise<HivesObjectList>;
+        put(project: string, id: string, key: string, bytes: Blob | ArrayBuffer | ArrayBufferView, options?: HivesResourceOptions & {
+            content_type?: string;
+        }): Promise<HivesObjectAcknowledgement>;
+        remove: (project: string, id: string, key: string, options?: HivesResourceOptions) => Promise<void>;
+        download: (project: string, id: string, key: string, options?: HivesResourceOptions) => Promise<Response>;
+        /** Existing flat-key path compatibility; nested keys use canonical collection methods above. */
+        putFlat(project: string, id: string, key: string, bytes: Blob | ArrayBuffer | ArrayBufferView, options?: HivesResourceOptions & {
+            content_type?: string;
+        }): Promise<HivesObjectAcknowledgement>;
+        removeFlat: (project: string, id: string, key: string, options?: HivesResourceOptions) => Promise<void>;
+    };
+    presign(project: string, id: string, body: HivesPresign, options?: HivesResourceOptions): Promise<HivesPresignedUrl>;
+};

package/dist/hives-cells.js

@@ -0,0 +1,151 @@
+import { HIVES_OBJECT_BYTES, hivesResourceCall, hivesResourceId, hivesObjectBody, hivesContentType, resourceError } from './hives-resources-transport.js';
+export function hivesObjectKey(key) {
+    const bytes = new TextEncoder().encode(key);
+    if (typeof key !== 'string' || !key || bytes.length > 1024 || new TextDecoder('utf-8', { fatal: true }).decode(bytes) !== key
+        || key.startsWith('/') || key.endsWith('/') || /[\u0000-\u001f\u007f-\u009f\\]/.test(key) || key.split('/').some(p => !p || p === '.' || p === '..'))
+        throw resourceError(0);
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function cors(rules) {
+    if (!Array.isArray(rules) || rules.length > 100)
+        throw resourceError(0);
+    return rules.map(rule => {
+        if (!rule || typeof rule !== 'object' || Object.keys(rule).some(k => !['allowed_origins', 'allowed_methods', 'allowed_headers', 'exposed_headers', 'max_age_secs'].includes(k))
+            || !Array.isArray(rule.allowed_origins) || !rule.allowed_origins.length || rule.allowed_origins.length > 100
+            || !Array.isArray(rule.allowed_methods) || !rule.allowed_methods.length || rule.allowed_methods.length > 6
+            || !Array.isArray(rule.allowed_headers) || rule.allowed_headers.length !== 1 || rule.allowed_headers[0] !== '*'
+            || !Array.isArray(rule.exposed_headers) || rule.exposed_headers.length > 100
+            || !Number.isInteger(rule.max_age_secs) || rule.max_age_secs < 0 || rule.max_age_secs > 86400)
+            throw resourceError(0);
+        for (const origin of rule.allowed_origins) {
+            if (origin === '*')
+                continue;
+            if (typeof origin !== 'string')
+                throw resourceError(0);
+            let url;
+            try {
+                url = new URL(origin);
+            }
+            catch {
+                throw resourceError(0);
+            }
+            if (!['http:', 'https:'].includes(url.protocol) || !url.hostname || url.username || url.password || url.pathname !== '/' || url.search || url.hash)
+                throw resourceError(0);
+        }
+        if (rule.allowed_methods.some(m => !['GET', 'HEAD', 'PUT', 'POST', 'DELETE'].includes(m))
+            || rule.exposed_headers.some(h => typeof h !== 'string' || h.length > 256 || !/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(h)))
+            throw resourceError(0);
+        return { allowed_origins: [...rule.allowed_origins], allowed_methods: [...rule.allowed_methods], allowed_headers: ['*'], exposed_headers: [...rule.exposed_headers], max_age_secs: rule.max_age_secs };
+    });
+}
+function bucket(value, project, id) {
+    if (!value || typeof value !== 'object' || value.project_id !== project || typeof value.id !== 'string' || id !== undefined && value.id !== id
+        || !['unmeasured_provider_inventory', 'retained_legacy_metadata'].includes(value.statistics_scope)
+        || [value.object_count, value.size_bytes].some(v => v !== null && (!Number.isSafeInteger(v) || v < 0))
+        || (value.statistics_scope === 'unmeasured_provider_inventory' && (value.object_count !== null || value.size_bytes !== null)))
+        throw resourceError(0);
+    if (value.statistics_scope === 'unmeasured_provider_inventory' && !value.provider_binding)
+        throw resourceError(0);
+    if (value.provider_binding !== null && (!value.provider_binding || value.provider_binding.provider !== 'gcs' || typeof value.provider_binding.state !== 'string' || typeof value.provider_binding.requires_reconciliation !== 'boolean'))
+        throw resourceError(0);
+    return Object.fromEntries(['id', 'tenant_id', 'project_id', 'name', 'region', 'visibility', 'status', 'object_count', 'size_bytes', 'statistics_scope', 'created_at', 'provider_binding', 'operation_state'].map(k => [k, value[k]]));
+}
+function object(value, id) {
+    if (!value || value.bucket_id !== id || typeof value.key !== 'string' || !Number.isSafeInteger(value.size_bytes) || value.size_bytes < 0 || typeof value.generation !== 'string')
+        throw resourceError(0);
+    hivesObjectKey(value.key);
+    return Object.fromEntries(['key', 'bucket_id', 'size_bytes', 'etag', 'last_modified', 'generation', 'content_type', 'metadata', 'metadata_scope'].map(k => [k, value[k]]));
+}
+function acknowledgement(value, key, id, size) {
+    if (!value || value.bucket_id !== id || value.key !== key || value.size_bytes !== size || !Number.isSafeInteger(value.size_bytes) || value.size_bytes < 0 || typeof value.etag !== 'string' || typeof value.generation !== 'string' || value.content_type !== null && typeof value.content_type !== 'string')
+        throw resourceError(0);
+    return { key: value.key, bucket_id: value.bucket_id, size_bytes: value.size_bytes, etag: value.etag, generation: value.generation, content_type: value.content_type };
+}
+export function hivesCells(client) {
+    const ids = (project_id, bucket_id) => ({ project_id: hivesResourceId(project_id), ...(bucket_id === undefined ? {} : { bucket_id: hivesResourceId(bucket_id) }) });
+    const call = (id, input, options, mode = 'json', limit = 2 * 1024 * 1024) => hivesResourceCall(client, id, input, options, mode, limit, 100_000);
+    return {
+        async list(project, query = {}, options) {
+            if (Object.keys(query).some(k => !['page', 'per_page'].includes(k)) || query.page !== undefined && (!Number.isInteger(query.page) || query.page < 1 || query.page > 10000) || query.per_page !== undefined && (!Number.isInteger(query.per_page) || query.per_page < 1 || query.per_page > 100))
+                throw resourceError(0);
+            const result = await call('hives_list_buckets', { ...query, ...ids(project) }, options);
+            if (!result || !Array.isArray(result.data) || !result.pagination)
+                throw resourceError(0);
+            return { ...result, data: result.data.map(row => bucket(row, project)) };
+        },
+        async get(project, id, options) { return bucket(await call('hives_get_bucket', ids(project, id), options), project, id); },
+        /** A pending provider_binding is an uncertain outcome, never a completed-create claim. */
+        async create(project, body, options) {
+            if (!body || typeof body.name !== 'string' || !/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(body.name) || body.region !== undefined && body.region !== 'us-central1'
+                || body.visibility !== undefined && !['private', 'publicread'].includes(body.visibility) || Object.keys(body).some(k => !['name', 'region', 'visibility', 'cors_rules'].includes(k)))
+                throw resourceError(0);
+            const checked = { ...body, ...(body.cors_rules === undefined ? {} : { cors_rules: cors(body.cors_rules) }) };
+            return bucket(await call('hives_create_bucket', { ...ids(project), body: checked }, options), project);
+        },
+        async remove(project, id, options) {
+            const result = await call('hives_delete_bucket', ids(project, id), options);
+            if (!result || result.id !== id || result.success !== true)
+                throw resourceError(0);
+            return result;
+        },
+        async reconcile(project, id, options) {
+            const result = await call('hives_reconcile', ids(project, id), options);
+            if (!result || typeof result.outcome !== 'string' || result.bucket?.id !== id)
+                throw resourceError(0);
+            return { ...result, bucket: bucket(result.bucket, project) };
+        },
+        cors: {
+            get: async (project, id, options) => cors(await call('hives_get_cors_config', ids(project, id), options)),
+            set: async (project, id, rules, options) => cors(await call('hives_set_cors_config', { ...ids(project, id), body: { rules: cors(rules) } }, options)),
+        },
+        objects: {
+            async list(project, id, query = {}, options) {
+                if (query.max_keys !== undefined && (!Number.isInteger(query.max_keys) || query.max_keys < 1 || query.max_keys > 1000))
+                    throw resourceError(0);
+                const result = await call('hives_list_objects', { ...query, ...ids(project, id) }, options);
+                if (!result || !Array.isArray(result.objects) || !Array.isArray(result.common_prefixes) || typeof result.is_truncated !== 'boolean' || result.total !== null)
+                    throw resourceError(0);
+                return { ...result, objects: result.objects.map(row => object(row, id)) };
+            },
+            async put(project, id, key, bytes, options = {}) {
+                const body = await hivesObjectBody(bytes);
+                const content_type = hivesContentType(options.content_type);
+                return acknowledgement(await call('hives_upload_object_by_key', { ...ids(project, id), key_base64url: hivesObjectKey(key), body, content_type }, options), key, id, body.byteLength);
+            },
+            remove: (project, id, key, options) => call('hives_delete_object_by_key', { ...ids(project, id), key_base64url: hivesObjectKey(key) }, options, 'empty'),
+            download: (project, id, key, options) => call('hives_download_object_by_key', { ...ids(project, id), key_base64url: hivesObjectKey(key) }, options, 'binary', HIVES_OBJECT_BYTES),
+            /** Existing flat-key path compatibility; nested keys use canonical collection methods above. */
+            async putFlat(project, id, key, bytes, options = {}) {
+                hivesObjectKey(key);
+                if (!/^[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)*$/.test(key))
+                    throw resourceError(0);
+                const body = await hivesObjectBody(bytes);
+                return acknowledgement(await call('hives_upload_object', { ...ids(project, id), key, body, content_type: hivesContentType(options.content_type) }, options), key, id, body.byteLength);
+            },
+            removeFlat: (project, id, key, options) => { hivesObjectKey(key); if (!/^[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)*$/.test(key))
+                throw resourceError(0); return call('hives_delete_object', { ...ids(project, id), key }, options, 'empty'); },
+        },
+        async presign(project, id, body, options) {
+            hivesObjectKey(body.key);
+            const method = body.method ?? 'GET';
+            if (!['GET', 'PUT'].includes(method) || body.expires_in_secs !== undefined && (!Number.isInteger(body.expires_in_secs) || body.expires_in_secs < 60 || body.expires_in_secs > 900)
+                || method === 'PUT' && (body.content_length === undefined || !Number.isInteger(body.content_length) || body.content_length < 0 || body.content_length > HIVES_OBJECT_BYTES))
+                throw resourceError(0);
+            if (body.content_type !== undefined)
+                hivesContentType(body.content_type);
+            const result = await call('hives_generate_presigned_url', { ...ids(project, id), body }, options);
+            if (!result || typeof result.url !== 'string' || result.method !== method || typeof result.expires_at !== 'string')
+                throw resourceError(0);
+            const url = new URL(result.url);
+            if (url.protocol !== 'https:' || url.hostname !== 'storage.googleapis.com' || url.username || url.password || url.hash)
+                throw resourceError(0);
+            const headers = result.required_headers;
+            if (headers !== undefined && (!headers || typeof headers !== 'object' || Array.isArray(headers) || Object.entries(headers).some(([k, v]) => !['content-type', 'content-length', 'x-goog-if-generation-match'].includes(k.toLowerCase()) || typeof v !== 'string' || /[\u0000-\u001f\u007f]/.test(v))))
+                throw resourceError(0);
+            return { url: result.url, expires_at: result.expires_at, method: result.method, ...(headers ? { required_headers: { ...headers } } : {}) };
+        },
+    };
+}

package/dist/hives-environment.d.ts

@@ -0,0 +1,28 @@
+/** Environment metadata never carries stored values. Reveals are explicit. */
+export declare function validateHivesEnvironment(input: unknown): Record<string, string>;
+export declare function hivesEnvironmentMetadata(value: unknown, project: unknown, updated: boolean): {
+    project_id: string;
+    updated: {
+        name: string;
+    }[];
+    data?: undefined;
+    pagination?: undefined;
+} | {
+    project_id: string;
+    data: {
+        name: string;
+    }[];
+    pagination: {
+        page: unknown;
+        per_page: unknown;
+        total: unknown;
+        total_pages: unknown;
+        has_next: boolean;
+        has_prev: boolean;
+    };
+    updated?: undefined;
+};
+export declare function hivesEnvironmentReveal(value: unknown, key: unknown): {
+    name: string;
+    value: string;
+};

package/dist/hives-environment.js

@@ -0,0 +1,58 @@
+/** Environment metadata never carries stored values. Reveals are explicit. */
+export function validateHivesEnvironment(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        throw new Error('Environment input must be a flat JSON map of names to string values.');
+    const entries = Object.entries(input);
+    if (entries.length < 1 || entries.length > 100)
+        throw new Error('Environment updates require 1–100 names.');
+    const result = Object.create(null);
+    for (const [name, value] of entries) {
+        if (name.length > 255 || !/^[A-Za-z][A-Za-z0-9_]*$/.test(name))
+            throw new Error('Environment names must start with a letter and contain only letters, numbers and underscores (up to 255 characters).');
+        if (typeof value !== 'string' || new TextEncoder().encode(value).length > 65536)
+            throw new Error('Environment values must be strings of at most 65,536 UTF-8 bytes. Empty values are allowed.');
+        result[name] = value;
+    }
+    if (new TextEncoder().encode(JSON.stringify(result)).length > 2 * 1024 * 1024)
+        throw new Error('Environment input exceeds 2 MiB. Split it into smaller batches.');
+    return result;
+}
+function record(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('Hives returned invalid environment metadata.');
+    return value;
+}
+function names(value) {
+    if (!Array.isArray(value))
+        throw new Error('Hives returned invalid environment metadata.');
+    return value.map((value) => {
+        const row = record(value);
+        if (typeof row.name !== 'string')
+            throw new Error('Hives returned invalid environment metadata.');
+        return { name: row.name };
+    });
+}
+export function hivesEnvironmentMetadata(value, project, updated) {
+    const data = record(value);
+    if (typeof project !== 'string' || data.project_id !== project)
+        throw new Error('Hives returned environment metadata for a different project.');
+    if (updated)
+        return { project_id: project, updated: names(data.updated) };
+    const pagination = record(data.pagination);
+    for (const key of ['page', 'per_page', 'total', 'total_pages']) {
+        if (!Number.isSafeInteger(pagination[key]) || pagination[key] < (key === 'page' || key === 'per_page' ? 1 : 0))
+            throw new Error('Hives returned invalid environment pagination.');
+    }
+    if (typeof pagination.has_next !== 'boolean' || typeof pagination.has_prev !== 'boolean')
+        throw new Error('Hives returned invalid environment pagination.');
+    return { project_id: project, data: names(data.data), pagination: {
+            page: pagination.page, per_page: pagination.per_page, total: pagination.total, total_pages: pagination.total_pages,
+            has_next: pagination.has_next, has_prev: pagination.has_prev,
+        } };
+}
+export function hivesEnvironmentReveal(value, key) {
+    const data = record(value);
+    if (typeof key !== 'string' || data.name !== key || typeof data.value !== 'string' || new TextEncoder().encode(data.value).length > 65536)
+        throw new Error('Hives returned invalid environment reveal data.');
+    return { name: data.name, value: data.value };
+}

package/dist/hives-functions.d.ts

@@ -0,0 +1,15 @@
+/** The service separately bounds its serialized guest stdin envelope at 10 MiB. */
+export declare const MAX_FUNCTION_BODY_BYTES: number;
+export declare const MAX_FUNCTION_JSON_BYTES: number;
+export interface HivesInvokeRequest {
+    method?: string;
+    path?: string;
+    headers?: Record<string, string>;
+    body?: unknown;
+    body_base64?: string;
+}
+export declare function validateHivesInvocation(input: unknown): asserts input is HivesInvokeRequest;
+/** Safe display/transport headers; customer headers never establish identity. */
+export declare function hivesFunctionResponseHeaders(headers: Headers): Headers;
+/** Metadata contracts cannot accidentally expose an upstream env/ciphertext field. */
+export declare function hivesFunctionMetadata(input: unknown, project: unknown): Record<string, unknown>;

package/dist/hives-functions.js

@@ -0,0 +1,94 @@
+/** The service separately bounds its serialized guest stdin envelope at 10 MiB. */
+export const MAX_FUNCTION_BODY_BYTES = 10 * 1024 * 1024;
+export const MAX_FUNCTION_JSON_BYTES = 16 * 1024 * 1024;
+const reservedHeaders = new Set(['host', 'connection', 'content-length', 'transfer-encoding', 'keep-alive',
+    'proxy-authenticate', 'proxy-authorization', 'te', 'trailer', 'upgrade', 'set-cookie', 'clear-site-data',
+    'authorization', 'cookie', 'forwarded', 'origin', 'referer', 'x-org-id', 'x-workspace-id', 'x-project-id',
+    'x-admin-token', 'x-tenant-id', 'x-cold-start']);
+const platformHeader = (name) => /^x-(?:auth|genesis|life|l1fe|hives|forwarded|execution)-/.test(name);
+const bytes = (value) => new TextEncoder().encode(value).length;
+const fail = () => { throw new Error('Invalid function request. Check method, path, headers, exclusive body encoding and size limits.'); };
+export function validateHivesInvocation(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        fail();
+    const r = input;
+    if (Object.keys(r).some((k) => !['method', 'path', 'headers', 'body', 'body_base64'].includes(k)))
+        fail();
+    if (r.method !== undefined && (typeof r.method !== 'string' || bytes(r.method) > 64 || !/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(r.method)))
+        fail();
+    if (r.path !== undefined && (typeof r.path !== 'string' || !r.path.startsWith('/') || r.path.startsWith('//') || r.path.includes('#') || bytes(r.path) > 8192 || /[\s\u0000-\u001f\u007f]/.test(r.path)))
+        fail();
+    let headerBytes = 0;
+    if (r.headers !== undefined) {
+        if (!r.headers || typeof r.headers !== 'object' || Array.isArray(r.headers) || Object.keys(r.headers).length > 128)
+            fail();
+        for (const [key, value] of Object.entries(r.headers)) {
+            if (!/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(key) || typeof value !== 'string' || /[\u0000-\u0008\u000a-\u001f\u007f]/.test(value)
+                || reservedHeaders.has(key.toLowerCase()) || platformHeader(key.toLowerCase()))
+                fail();
+            headerBytes += bytes(key) + bytes(value);
+            if (headerBytes > 64 * 1024)
+                fail();
+        }
+    }
+    let size = 0;
+    if (r.body_base64 !== undefined) {
+        const value = r.body_base64;
+        if (r.body != null || typeof value !== 'string' || value.length > Math.ceil(MAX_FUNCTION_BODY_BYTES / 3) * 4
+            || value.length % 4 || !/^[A-Za-z0-9+/]*={0,2}$/.test(value))
+            fail();
+        try {
+            const bytes = atob(value);
+            if (btoa(bytes) !== value)
+                fail();
+            size = bytes.length;
+        }
+        catch {
+            fail();
+        }
+    }
+    else if (r.body != null) {
+        let value;
+        try {
+            value = typeof r.body === 'string' ? r.body : JSON.stringify(r.body);
+        }
+        catch {
+            fail();
+        }
+        if (value === undefined)
+            fail();
+        size = new TextEncoder().encode(value).length;
+    }
+    let serialized;
+    try {
+        serialized = JSON.stringify(r);
+    }
+    catch {
+        fail();
+    }
+    if (size + headerBytes > MAX_FUNCTION_BODY_BYTES || !serialized || new TextEncoder().encode(serialized).length > MAX_FUNCTION_JSON_BYTES)
+        fail();
+}
+/** Safe display/transport headers; customer headers never establish identity. */
+export function hivesFunctionResponseHeaders(headers) {
+    const blocked = new Set(['connection', 'keep-alive', 'transfer-encoding', 'upgrade', 'proxy-authenticate', 'proxy-authorization',
+        'te', 'trailer', 'content-length', 'content-encoding', 'set-cookie', 'clear-site-data', 'authorization', 'cookie', 'forwarded', 'host', 'x-org-id', 'x-workspace-id', 'x-project-id', 'x-admin-token', 'x-tenant-id', 'x-hives-guest-status']);
+    for (const value of (headers.get('connection') ?? '').split(','))
+        blocked.add(value.trim().toLowerCase());
+    const safe = new Headers();
+    headers.forEach((value, name) => {
+        if (!blocked.has(name) && (!platformHeader(name) || ['x-execution-id', 'x-execution-duration-ms'].includes(name)))
+            safe.set(name, value);
+    });
+    safe.set('cache-control', 'no-store');
+    return safe;
+}
+/** Metadata contracts cannot accidentally expose an upstream env/ciphertext field. */
+export function hivesFunctionMetadata(input, project) {
+    if (!input || typeof input !== 'object' || input.project_id !== project) {
+        throw new Error('Hives returned invalid or wrong-project function metadata.');
+    }
+    const row = input;
+    return Object.fromEntries(['id', 'tenant_id', 'project_id', 'name', 'description', 'handler', 'route', 'memory_mb', 'timeout_ms',
+        'status', 'invocations', 'avg_duration_ms', 'created_at', 'updated_at'].map((key) => [key, row[key]]));
+}

package/dist/hives-node.d.ts

@@ -0,0 +1,9 @@
+import { Genesis } from './genesis.js';
+import type { GenesisOptions } from './client.js';
+export declare function closeHivesNodeTransport(): Promise<void>;
+export declare function hivesOperationBudget(id: string): number;
+/** Hives leaf transport. Caller fetch overrides stay authoritative; only native
+ * global fetch gets our Agent. Every operation retains an overall body deadline. */
+export declare function createHivesNodeTransport(opts?: GenesisOptions, callerSignal?: AbortSignal): typeof fetch;
+/** Node opt-in for Hives calls. Other services retain the caller transport. */
+export declare function createHivesNodeClient(opts?: GenesisOptions, callerSignal?: AbortSignal): Genesis;

package/dist/hives-node.js

@@ -0,0 +1,152 @@
+import { Agent } from 'undici';
+import { Genesis } from './genesis.js';
+import { operationTable } from './generated/operations.js';
+// Node's native fetch accepts a compatible per-request dispatcher. Never change
+// the global dispatcher or the portable SDK: other products retain their transport.
+const agentOptions = { headersTimeout: 340_000, bodyTimeout: 340_000, connect: { timeout: 5_000 }, connections: 4, pipelining: 1 };
+let agent;
+const nativeAgent = () => agent ??= new Agent(agentOptions);
+export async function closeHivesNodeTransport() {
+    const current = agent;
+    agent = undefined;
+    await current?.destroy();
+}
+export function hivesOperationBudget(id) {
+    if (['hives_list_buckets', 'hives_create_bucket', 'hives_get_bucket', 'hives_delete_bucket', 'hives_list_objects', 'hives_upload_object', 'hives_upload_object_by_key', 'hives_delete_object', 'hives_delete_object_by_key', 'hives_download_object_by_key', 'hives_get_cors_config', 'hives_set_cors_config', 'hives_generate_presigned_url', 'hives_reconcile'].includes(id))
+        return 100_000;
+    if (id === 'hives_cancel_deployment' || id === 'hives_delete_deployment')
+        return 330_000;
+    if (['hives_create_deployment', 'hives_upload_deployment', 'hives_invoke_deployment', 'hives_invoke_function', 'hives_invoke_function_async'].includes(id))
+        return 40_000;
+    if (['hives_create_function', 'hives_update_function', 'hives_delete_function'].includes(id))
+        return 100_000;
+    return 20_000;
+}
+const escape = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+const templatePattern = (value) => new RegExp('^' + value.split(/(\{[^}]+\})/).map((part) => part.startsWith('{') ? '[^/]+' : escape(part)).join('') + '$');
+/** Hives leaf transport. Caller fetch overrides stay authoritative; only native
+ * global fetch gets our Agent. Every operation retains an overall body deadline. */
+export function createHivesNodeTransport(opts = {}, callerSignal) {
+    const supplied = opts.fetch ?? globalThis.fetch;
+    const underlying = supplied.bind(globalThis);
+    const useNative = supplied === globalThis.fetch;
+    const resolver = new Genesis(opts);
+    const routes = Object.entries(operationTable)
+        .filter(([, op]) => op.service === 'hives' && !op.internal)
+        .flatMap(([id, op]) => {
+        const direct = resolver.routing === 'direct';
+        let base;
+        try {
+            base = new URL(direct ? (opts.upstreams?.hives ?? op.upstream.base) : resolver.baseUrl);
+        }
+        catch {
+            throw new Error('Invalid Hives service address.');
+        }
+        const path = direct ? op.upstream.path : op.path;
+        const prefix = base.pathname.replace(/\/+$/, '');
+        const paths = [path];
+        if (!direct && path.startsWith('/v1/hives/'))
+            paths.push(path.replace('/v1/hives/', '/hives/v1/'));
+        return paths.map((p) => ({ id, origin: base.origin, method: direct ? op.upstream.method : op.method, pattern: templatePattern(prefix + p) }));
+    });
+    return (async (input, init = {}) => {
+        let url;
+        try {
+            url = new URL(input instanceof Request ? input.url : String(input));
+        }
+        catch {
+            throw new Error('Invalid Hives request address.');
+        }
+        const method = (init.method ?? (input instanceof Request ? input.method : 'GET')).toUpperCase();
+        const route = routes.find((entry) => entry.origin === url.origin && entry.method === method && entry.pattern.test(url.pathname));
+        if (!route)
+            return underlying(input, init);
+        const controller = new AbortController();
+        let message = 'Hives transport failed. Refresh the resource and retry.';
+        const safeError = () => new Error(message);
+        const signals = [...new Set([callerSignal, init.signal, input instanceof Request ? input.signal : undefined].filter((signal) => !!signal))];
+        const canceled = () => {
+            message = 'Hives request canceled before completion. Refresh the resource before retrying.';
+            controller.abort();
+        };
+        for (const signal of signals)
+            signal.addEventListener('abort', canceled, { once: true });
+        const timer = setTimeout(() => {
+            message = 'Hives request deadline exceeded. Refresh the resource before retrying.';
+            controller.abort();
+        }, hivesOperationBudget(route.id));
+        timer.unref();
+        let abortReject = () => { };
+        let reader;
+        let bodyController;
+        const aborted = () => {
+            abortReject(safeError());
+            bodyController?.error(safeError());
+            void reader?.cancel().catch(() => { });
+            cleanup();
+        };
+        controller.signal.addEventListener('abort', aborted, { once: true });
+        const abortPromise = new Promise((_, reject) => { abortReject = reject; });
+        void abortPromise.catch(() => { });
+        const cleanup = () => {
+            clearTimeout(timer);
+            for (const signal of signals)
+                signal.removeEventListener('abort', canceled);
+            controller.signal.removeEventListener('abort', aborted);
+        };
+        if (signals.some((signal) => signal.aborted))
+            canceled();
+        try {
+            if (controller.signal.aborted)
+                throw safeError();
+            const requestInit = {
+                ...init, signal: controller.signal, cache: 'no-store',
+                redirect: init.redirect === 'manual' ? 'manual' : 'error',
+                ...(useNative ? { dispatcher: nativeAgent() } : {}),
+            };
+            const pending = underlying(input, requestInit);
+            // A caller transport may ignore AbortSignal. Reject on our budget anyway,
+            // and discard any late response rather than presenting an acknowledgement.
+            void pending.then((response) => { if (controller.signal.aborted)
+                void response.body?.cancel().catch(() => { }); }, () => { });
+            const response = await Promise.race([pending, abortPromise]);
+            if (controller.signal.aborted)
+                throw safeError();
+            if (!response.body) {
+                cleanup();
+                return response;
+            }
+            reader = response.body.getReader();
+            const body = new ReadableStream({
+                start(value) { bodyController = value; },
+                async pull(value) {
+                    try {
+                        const next = await reader.read();
+                        if (controller.signal.aborted)
+                            return;
+                        if (next.done) {
+                            cleanup();
+                            value.close();
+                        }
+                        else
+                            value.enqueue(next.value);
+                    }
+                    catch {
+                        cleanup();
+                        value.error(safeError());
+                    }
+                },
+                async cancel() { cleanup(); await reader.cancel().catch(() => { }); },
+            });
+            return new Response(body, { status: response.status, statusText: response.statusText, headers: response.headers });
+        }
+        catch {
+            cleanup();
+            throw safeError();
+        }
+    });
+}
+/** Node opt-in for Hives calls. Other services retain the caller transport. */
+export function createHivesNodeClient(opts = {}, callerSignal) {
+    return new Genesis({ ...opts, fetch: createHivesNodeTransport(opts, callerSignal) });
+}