@lifesi/genesis 0.1.0 → 0.1.2

package/dist/hives-resources-transport.js

@@ -0,0 +1,165 @@
+import { GenesisError } from './errors.js';
+export const HIVES_OBJECT_BYTES = 10 * 1024 * 1024;
+export const HIVES_QUEUE_BYTES = 256 * 1024;
+export const HIVES_RESOURCE_JSON_BYTES = 2 * 1024 * 1024;
+export function hivesResourceId(value) {
+    if (typeof value !== 'string' || !/^[A-Za-z0-9_-]{1,128}$/.test(value))
+        throw resourceError(0);
+    return value;
+}
+export function resourceError(status, id) {
+    return new GenesisError({ status, type: status ? `http_${status}` : 'invalid_request', operationId: id,
+        message: status === 404 ? 'Hives resource not found in the authenticated organization and project.'
+            : status === 409 ? 'Hives resource state conflicted. Read persisted state before another mutation.'
+                : status === 503 ? 'Hives outcome is unavailable. Read persisted state or reconcile before another mutation.'
+                    : 'Hives resource request failed. Check the request and persisted state; no automatic retry was made.' });
+}
+export const isHivesResourceOperation = (id) => /^(?:hives_.*_native_queue|hives_(?:list_buckets|create_bucket|get_bucket|delete_bucket|list_objects|upload_object(?:_by_key)?|delete_object(?:_by_key)?|download_object_by_key|get_cors_config|set_cors_config|generate_presigned_url|reconcile|list_runtimes|get_runtime|select_runtime|list_project_runtimes))$/.test(id);
+export const isHivesObjectUpload = (id) => id === 'hives_upload_object_by_key' || id === 'hives_upload_object';
+/** Shared-client hook proposal: snapshot only the two real raw Cells upload operations. */
+export async function hivesObjectBody(value) {
+    let bytes;
+    if (value instanceof Blob) {
+        if (value.size > HIVES_OBJECT_BYTES)
+            throw resourceError(0);
+        bytes = new Uint8Array(await value.arrayBuffer());
+    }
+    else if (value instanceof ArrayBuffer)
+        bytes = new Uint8Array(value);
+    else if (ArrayBuffer.isView(value))
+        bytes = new Uint8Array(value.buffer, value.byteOffset, value.byteLength);
+    else
+        throw resourceError(0);
+    if (bytes.byteLength > HIVES_OBJECT_BYTES)
+        throw resourceError(0);
+    return Uint8Array.from(bytes).buffer;
+}
+export function hivesContentType(value = 'application/octet-stream') {
+    if (typeof value !== 'string' || !value.length || new TextEncoder().encode(value).length > 512 || /[\u0000-\u001f\u007f]/.test(value))
+        throw resourceError(0);
+    return value;
+}
+export async function hivesResourceBytes(response, limit, signal) {
+    const chunks = [];
+    let length = 0;
+    const reader = response.body?.getReader();
+    if (!reader)
+        return new Uint8Array();
+    const cancel = () => { void reader.cancel().catch(() => { }); };
+    signal?.addEventListener('abort', cancel, { once: true });
+    if (signal?.aborted)
+        cancel();
+    try {
+        for (;;) {
+            const next = await reader.read();
+            if (signal?.aborted)
+                throw resourceError(0);
+            if (next.done)
+                break;
+            length += next.value.byteLength;
+            if (length > limit) {
+                await reader.cancel();
+                throw resourceError(0);
+            }
+            chunks.push(next.value);
+        }
+    }
+    finally {
+        signal?.removeEventListener('abort', cancel);
+        reader.releaseLock();
+    }
+    const bytes = new Uint8Array(length);
+    let offset = 0;
+    for (const part of chunks) {
+        bytes.set(part, offset);
+        offset += part.byteLength;
+    }
+    return bytes;
+}
+/** Whole operation budget includes credential/fetch and incremental body read. No retries or redirects. */
+export async function hivesResourceCall(client, id, input, options = {}, mode = 'json', limit = HIVES_RESOURCE_JSON_BYTES, budget = 20_000) {
+    let snapshot;
+    try {
+        if (input.body instanceof ArrayBuffer)
+            snapshot = { ...input, body: input.body.slice(0) };
+        else {
+            const value = JSON.stringify(input);
+            if (new TextEncoder().encode(value).length > 512 * 1024)
+                throw resourceError(0);
+            snapshot = JSON.parse(value);
+        }
+    }
+    catch {
+        throw resourceError(0, id);
+    }
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    let rejectAbort = () => { };
+    const failure = new Promise((_, reject) => { rejectAbort = reject; });
+    void failure.catch(() => { });
+    const aborted = () => rejectAbort(resourceError(0, id));
+    controller.signal.addEventListener('abort', aborted, { once: true });
+    options.signal?.addEventListener('abort', abort, { once: true });
+    const timer = setTimeout(abort, budget);
+    if (typeof timer === 'object' && 'unref' in timer)
+        timer.unref();
+    let response;
+    let completed = false;
+    const operation = (async () => {
+        if (options.signal?.aborted)
+            abort();
+        if (controller.signal.aborted)
+            throw resourceError(0, id);
+        response = await client.raw(id, snapshot, { signal: controller.signal });
+        if (controller.signal.aborted) {
+            await response.body?.cancel();
+            throw resourceError(0, id);
+        }
+        if (response.status < 200 || response.status >= 300) {
+            await response.body?.cancel();
+            throw resourceError(response.status, id);
+        }
+        if (mode === 'empty' && ![200, 204].includes(response.status))
+            throw resourceError(0, id);
+        const bytes = await hivesResourceBytes(response, mode === 'empty' ? 0 : limit, controller.signal);
+        if (controller.signal.aborted)
+            throw resourceError(0, id);
+        if (mode === 'empty')
+            return undefined;
+        if (mode === 'binary') {
+            if (response.status !== 200)
+                throw resourceError(0, id);
+            const headers = new Headers({ 'content-type': hivesContentType(response.headers.get('content-type') ?? undefined), 'cache-control': 'no-store', 'content-disposition': 'attachment' });
+            return new Response(Uint8Array.from(bytes).buffer, { status: 200, headers });
+        }
+        if (!response.headers.get('content-type')?.toLowerCase().includes('application/json'))
+            throw resourceError(0, id);
+        try {
+            return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+        }
+        catch {
+            throw resourceError(0, id);
+        }
+    })();
+    void operation.then(() => { if (controller.signal.aborted)
+        void response?.body?.cancel().catch(() => { }); }, () => { });
+    try {
+        const result = await Promise.race([operation, failure]);
+        completed = true;
+        return result;
+    }
+    catch (error) {
+        if (error instanceof GenesisError)
+            throw resourceError(error.status, id);
+        throw resourceError(0, id);
+    }
+    finally {
+        clearTimeout(timer);
+        options.signal?.removeEventListener('abort', abort);
+        controller.signal.removeEventListener('abort', aborted);
+        if (!completed) {
+            controller.abort();
+            void response?.body?.cancel().catch(() => { });
+        }
+    }
+}

package/dist/hives-response.d.ts

@@ -0,0 +1,2 @@
+/** Bound completed response bytes without losing binary data or treating HTTP errors as JSON wrappers. */
+export declare function hivesResponseBytes(response: Response): Promise<Uint8Array>;

package/dist/hives-response.js

@@ -0,0 +1,32 @@
+import { MAX_FUNCTION_BODY_BYTES } from './hives-functions.js';
+/** Bound completed response bytes without losing binary data or treating HTTP errors as JSON wrappers. */
+export async function hivesResponseBytes(response) {
+    if (!response.body)
+        return new Uint8Array();
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        for (;;) {
+            const { value, done } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > MAX_FUNCTION_BODY_BYTES) {
+                await reader.cancel();
+                throw new Error('Hives guest response exceeds 10 MiB.');
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.length;
+    }
+    return bytes;
+}

package/dist/hives-runtimes.d.ts

@@ -0,0 +1,34 @@
+import type { GenesisClient } from './client.js';
+import { type HivesResourceOptions } from './hives-resources-transport.js';
+export interface HivesRuntime {
+    name: string;
+    version: string;
+    wasiVersions: string[];
+    runners: string[];
+    artifactKinds: string[];
+    compiledFeatures: string[];
+    capabilityScope: 'compiled_serving_implementation';
+    features: string[];
+    useCases: string[];
+}
+export interface HivesRuntimeSelection {
+    selected: string;
+    reason: string;
+    wasi: string;
+    runner: string;
+    artifact: string;
+}
+export declare function hivesRuntimes(client: GenesisClient): {
+    list: (options?: HivesResourceOptions) => Promise<{
+        runtimes: HivesRuntime[];
+    }>;
+    project: (project_id: string, options?: HivesResourceOptions) => Promise<{
+        runtimes: HivesRuntime[];
+    }>;
+    get: (name: string, options?: HivesResourceOptions) => Promise<HivesRuntime>;
+    select: (input: {
+        wasi: string;
+        runner: string;
+        artifact: string;
+    }, options?: HivesResourceOptions) => Promise<HivesRuntimeSelection>;
+};

package/dist/hives-runtimes.js

@@ -0,0 +1,32 @@
+import { hivesResourceCall, hivesResourceId, resourceError } from './hives-resources-transport.js';
+function runtime(value) {
+    if (!value || typeof value !== 'object')
+        throw resourceError(0);
+    const row = value;
+    if (typeof row.name !== 'string' || typeof row.version !== 'string' || row.capabilityScope !== 'compiled_serving_implementation'
+        || ['wasiVersions', 'runners', 'artifactKinds', 'compiledFeatures', 'features', 'useCases'].some(k => !Array.isArray(row[k]) || !row[k].every(v => typeof v === 'string'))
+        || !row.wasiVersions.length || !row.runners.length || !row.artifactKinds.length)
+        throw resourceError(0);
+    return { name: row.name, version: row.version, wasiVersions: [...row.wasiVersions], runners: [...row.runners], artifactKinds: [...row.artifactKinds], compiledFeatures: [...row.compiledFeatures], capabilityScope: row.capabilityScope, features: [...row.features], useCases: [...row.useCases] };
+}
+export function hivesRuntimes(client) {
+    const list = async (id, input, options) => {
+        const result = await hivesResourceCall(client, id, input, options);
+        if (!result || !Array.isArray(result.runtimes))
+            throw resourceError(0);
+        return { runtimes: result.runtimes.map(runtime) };
+    };
+    return {
+        list: (options) => list('hives_list_runtimes', {}, options),
+        project: (project_id, options) => list('hives_list_project_runtimes', { project_id: hivesResourceId(project_id) }, options),
+        get: async (name, options) => runtime(await hivesResourceCall(client, 'hives_get_runtime', { name: hivesResourceId(name) }, options)),
+        select: async (input, options) => {
+            if (Object.keys(input).some(k => !['wasi', 'runner', 'artifact'].includes(k)) || Object.values(input).some(v => typeof v !== 'string' || !/^[A-Za-z0-9_-]{1,128}$/.test(v)))
+                throw resourceError(0);
+            const result = await hivesResourceCall(client, 'hives_select_runtime', { ...input }, options);
+            if (!result || typeof result.selected !== 'string' || typeof result.reason !== 'string' || result.wasi !== input.wasi || result.runner !== input.runner || result.artifact !== input.artifact)
+                throw resourceError(0);
+            return result;
+        },
+    };
+}

package/dist/hives-upload.d.ts

@@ -0,0 +1,9 @@
+export declare const MAX_WASM_BYTES: number;
+export interface HivesUploadOptions {
+    filename?: string;
+    git_sha?: string;
+    git_branch?: string;
+    git_message?: string;
+}
+/** Real multipart binary; the org and digest are resolved by the authenticated backend. */
+export declare function hivesUploadBody(file: Blob, options?: HivesUploadOptions): Promise<FormData>;

package/dist/hives-upload.js

@@ -0,0 +1,23 @@
+export const MAX_WASM_BYTES = 10 * 1024 * 1024;
+/** Real multipart binary; the org and digest are resolved by the authenticated backend. */
+export async function hivesUploadBody(file, options = {}) {
+    if (!(file instanceof Blob) || file.size < 4 || file.size > MAX_WASM_BYTES)
+        throw new Error('Choose a WebAssembly binary of 4 bytes to 10 MiB.');
+    const magic = new Uint8Array(await file.slice(0, 4).arrayBuffer());
+    if (magic[0] !== 0 || magic[1] !== 97 || magic[2] !== 115 || magic[3] !== 109)
+        throw new Error('The file must be a WebAssembly binary.');
+    const limits = { git_sha: 40, git_branch: 255, git_message: 1000 };
+    if (options.filename !== undefined && (typeof options.filename !== 'string' || !options.filename.length || options.filename.length > 255 || /[\r\n]/.test(options.filename)))
+        throw new Error('WASM filename must contain 1–255 characters without newlines.');
+    const form = new FormData();
+    form.append('file', file, options.filename ?? 'module.wasm');
+    for (const key of Object.keys(limits)) {
+        const value = options[key];
+        if (value === undefined)
+            continue;
+        if (typeof value !== 'string' || value.length > limits[key] || (key === 'git_sha' && value.length < 7))
+            throw new Error('Invalid deployment Git metadata.');
+        form.append(key, value);
+    }
+    return form;
+}

package/dist/index.d.ts

@@ -4,6 +4,14 @@ export { GenesisError } from './errors.js';
 export { operationTable, services, type OperationId } from './generated/operations.js';
 export type { OperationInput, OperationOutput, OperationMeta, ServiceMeta } from './types.js';
 export type { paths, operations, components } from './generated/schema.js';
+export { hivesUploadBody, MAX_WASM_BYTES, type HivesUploadOptions } from './hives-upload.js';
+export { validateHivesInvocation, hivesFunctionResponseHeaders, MAX_FUNCTION_BODY_BYTES, MAX_FUNCTION_JSON_BYTES, type HivesInvokeRequest } from './hives-functions.js';
+export { hivesResponseBytes } from './hives-response.js';
 export { runnerModule, type RunnerStartInput, type RunnerSnapshot, type RunnerCatalog, type RunnerEvent, type RunnerProviderResult, type RunnerRequestOptions } from './runner.js';
+export type { RunnerSelfExecutionGrantInput, RunnerSelfExecutionGrant } from './runner-grant.js';
 export { beaconsModule } from './beacons.js';
-export { dialsModule, type DialsScope, type DialsOutboundCall, type DialsCallControl, type DialsEmergencyAddress } from './dials.js';
+export { dialsModule, dialsEmergencyAddressFeedback, type DialsEmergencyAddressFeedback, type DialsScope, type DialsOutboundCall, type DialsCallControl, type DialsEmergencyAddress, type DialsCallListItem, type DialsCallDispatchState, type DialsMessage, type DialsMessageTemplate, type DialsMessagingBrand, type DialsMessagingCampaign, type DialsWorkflowDocument, type DialsRoutingAction, type DialsRoutingRule, type DialsRoutingRuleReceipt, type DialsOutboundCallReceipt, type DialsRecoveredOutboundCallReceipt } from './dials.js';
+export { hivesObjectKey, type HivesBucket, type HivesObject, type HivesObjectAcknowledgement, type HivesObjectList, type HivesCorsRule, type HivesCreateBucket, type HivesPresign, type HivesPresignedUrl } from './hives-cells.js';
+export { hivesQueueBody, type HivesQueue, type HivesQueueConfig, type HivesQueueCreate, type HivesQueueSend, type HivesQueueDelivery, type HivesDeadLetter, type HivesDeadLetterStats } from './hives-queues.js';
+export type { HivesRuntime, HivesRuntimeSelection } from './hives-runtimes.js';
+export { HIVES_OBJECT_BYTES, HIVES_QUEUE_BYTES, type HivesResourceOptions } from './hives-resources-transport.js';

package/dist/index.js

@@ -2,6 +2,12 @@ export { Genesis } from './genesis.js';
 export { GenesisClient, DEFAULT_BASE_URL } from './client.js';
 export { GenesisError } from './errors.js';
 export { operationTable, services } from './generated/operations.js';
+export { hivesUploadBody, MAX_WASM_BYTES } from './hives-upload.js';
+export { validateHivesInvocation, hivesFunctionResponseHeaders, MAX_FUNCTION_BODY_BYTES, MAX_FUNCTION_JSON_BYTES } from './hives-functions.js';
+export { hivesResponseBytes } from './hives-response.js';
 export { runnerModule } from './runner.js';
 export { beaconsModule } from './beacons.js';
-export { dialsModule } from './dials.js';
+export { dialsModule, dialsEmergencyAddressFeedback } from './dials.js';
+export { hivesObjectKey } from './hives-cells.js';
+export { hivesQueueBody } from './hives-queues.js';
+export { HIVES_OBJECT_BYTES, HIVES_QUEUE_BYTES } from './hives-resources-transport.js';

package/dist/runner-grant.d.ts

@@ -0,0 +1,10 @@
+import { GenesisError } from './errors.js';
+import type { components } from './generated/schema.js';
+export type RunnerSelfExecutionGrantInput = components['schemas']['Iam.RunnerSelfExecutionGrantRequest'];
+export type RunnerSelfExecutionGrant = components['schemas']['Iam.RunnerSelfExecutionGrant'];
+export declare const RUNNER_SELF_GRANT_OPERATION: "iam_runnerSelfExecutionGrant";
+/** Copy only primitive data descriptors before any asynchronous credential call. */
+export declare function snapshotRunnerSelfGrant(args: Record<string, unknown>, routing: string): RunnerSelfExecutionGrantInput;
+export declare function runnerGrantTransportError(): GenesisError;
+/** A bounded closed response; no arbitrary upstream body reaches CLI or MCP. */
+export declare function runnerGrantResponse(res: Response, input: RunnerSelfExecutionGrantInput): Promise<Response>;

package/dist/runner-grant.js

@@ -0,0 +1,133 @@
+import { GenesisError } from './errors.js';
+export const RUNNER_SELF_GRANT_OPERATION = 'iam_runnerSelfExecutionGrant';
+const requestKeys = ['schemaVersion', 'requestId', 'operationId', 'organizationId', 'projectId', 'platformId', 'workspaceId', 'fleetId', 'resourceEnvironment', 'expiresAtMs'];
+const receiptKeys = ['id', 'principal_id', 'organization_id', 'project_id', 'platform_id', 'workspace_id', 'environmentId', 'role_ids', 'permissions', 'expires_at', 'created_at'];
+const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+const match = (p, v) => typeof v === 'string' && p.exec(v)?.[0] === v;
+const native = (v, prefix) => match(new RegExp('^' + prefix + '[A-Za-z0-9_]{1,32}$'), v);
+const instant = (v) => typeof v === 'number' && Number.isSafeInteger(v) && v > 0;
+function exact(v, keys) {
+    return !!v && typeof v === 'object' && !Array.isArray(v) && Object.keys(v).length === keys.length && keys.every(k => Object.hasOwn(v, k));
+}
+const invalid = () => new TypeError('Runner self-execution permission requires the exact ordinary-human Sandbox selection, operation, request correlation and finite expiry');
+/** Copy only primitive data descriptors before any asynchronous credential call. */
+export function snapshotRunnerSelfGrant(args, routing) {
+    if (routing !== 'gateway' || !exact(args, ['body']) || Reflect.ownKeys(args).length !== 1)
+        throw invalid();
+    const descriptor = Object.getOwnPropertyDescriptor(args, 'body');
+    if (!descriptor || !('value' in descriptor))
+        throw invalid();
+    const body = descriptor.value;
+    if (!exact(body, requestKeys) || ![Object.prototype, null].includes(Object.getPrototypeOf(body)) || Reflect.ownKeys(body).length !== requestKeys.length)
+        throw invalid();
+    const copy = {};
+    for (const key of requestKeys) {
+        const d = Object.getOwnPropertyDescriptor(body, key);
+        if (!d || !('value' in d) || !d.enumerable || (d.value !== null && !['string', 'number'].includes(typeof d.value)))
+            throw invalid();
+        copy[key] = d.value;
+    }
+    const now = Date.now();
+    if (copy.schemaVersion !== 1 || !match(uuid, copy.requestId) || !match(uuid, copy.operationId)
+        || !native(copy.organizationId, 'o_') || !native(copy.projectId, 'pr_') || !native(copy.workspaceId, 'w_')
+        || copy.platformId !== 'pf_console' || copy.fleetId !== null || copy.resourceEnvironment !== 'sandbox'
+        || !instant(copy.expiresAtMs) || copy.expiresAtMs <= now || copy.expiresAtMs > now + 1_800_000)
+        throw invalid();
+    return Object.freeze(copy);
+}
+function closedJson(raw) {
+    const value = JSON.parse(raw);
+    const stack = [];
+    for (const token of raw.match(/"(?:\\.|[^"\\])*"|[{}\[\],:]|true|false|null|-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?/g) ?? []) {
+        const frame = stack.at(-1);
+        if (token === '{' || token === '[')
+            stack.push({ object: token === '{', key: token === '{', keys: new Set() });
+        else if (token === '}' || token === ']')
+            stack.pop();
+        else if (token === ',' && frame?.object)
+            frame.key = true;
+        else if (token === ':' && frame?.object)
+            frame.key = false;
+        else if (token.startsWith('"') && frame?.object && frame.key) {
+            const key = JSON.parse(token);
+            if (frame.keys.has(key))
+                throw invalid();
+            frame.keys.add(key);
+        }
+        else if (/^-?\d/.test(token) && !/^-?(?:0|[1-9]\d*)$/.test(token))
+            throw invalid();
+    }
+    return value;
+}
+const errorRows = [
+    [400, 'INVALID_ARGUMENT', 'invalid Runner self-execution grant request', 'invalid_runner_self_execution_grant_request'],
+    [400, 'INVALID_ARGUMENT', 'Runner self-execution grant expiry is out of bounds', 'runner_self_execution_grant_expiry_out_of_bounds'],
+    [401, 'UNAUTHENTICATED', 'Runner self-execution authority inactive', 'runner_self_execution_grant_inactive'],
+    [403, 'PERMISSION_DENIED', 'Runner self-execution authority denied', 'runner_self_execution_grant_denied'],
+    [409, 'CONFLICT', 'Runner self-execution grant operation conflict', 'runner_self_execution_grant_conflict'],
+    [409, 'CONFLICT', 'Runner self-execution grant replay is stale', 'runner_self_execution_grant_replay_stale'],
+    [503, 'PROVIDER_UNAVAILABLE', 'Runner self-execution grant unavailable', 'runner_self_execution_grant_unavailable'],
+];
+function uncertain(status, message) {
+    return new GenesisError({ status, type: 'runner_grant_uncertain', operationId: RUNNER_SELF_GRANT_OPERATION, message });
+}
+export function runnerGrantTransportError() {
+    return uncertain(0, 'Runner permission response was lost. Retry the same operation, scope and expiry with fresh request correlation.');
+}
+/** A bounded closed response; no arbitrary upstream body reaches CLI or MCP. */
+export async function runnerGrantResponse(res, input) {
+    let value;
+    try {
+        if (res.redirected || res.headers.get('content-type')?.split(';')[0].trim().toLowerCase() !== 'application/json')
+            throw invalid();
+        const reader = res.body?.getReader();
+        const chunks = [];
+        let size = 0;
+        if (reader) {
+            try {
+                while (true) {
+                    const next = await reader.read();
+                    if (next.done)
+                        break;
+                    size += next.value.byteLength;
+                    if (size > 8192) {
+                        await reader.cancel();
+                        throw invalid();
+                    }
+                    chunks.push(next.value);
+                }
+            }
+            finally {
+                reader.releaseLock();
+            }
+        }
+        const bytes = new Uint8Array(size);
+        let offset = 0;
+        for (const chunk of chunks) {
+            bytes.set(chunk, offset);
+            offset += chunk.byteLength;
+        }
+        value = closedJson(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+    }
+    catch {
+        throw uncertain(res.status, 'Runner permission could not be confirmed. Retry the same operation, scope and expiry with fresh request correlation.');
+    }
+    if (res.status !== 200) {
+        if (exact(value, ['code', 'message', 'details']) && exact(value.details, ['schemaVersion', 'reason']) && value.details.schemaVersion === 1) {
+            const details = value.details;
+            const row = errorRows.find(r => r[0] === res.status && r[1] === value.code && r[2] === value.message && r[3] === details.reason);
+            if (row)
+                throw new GenesisError({ status: res.status, type: 'runner_grant_denied', code: row[1], operationId: RUNNER_SELF_GRANT_OPERATION, message: row[2], body: value });
+        }
+        throw uncertain(res.status, 'Runner permission is unavailable or unconfirmed. Retry the same operation, scope and expiry with fresh request correlation.');
+    }
+    if (!exact(value, receiptKeys) || !match(/^g_[0-7][0123456789ABCDEFGHJKMNPQRSTVWXYZ]{25}$/, value.id)
+        || !native(value.principal_id, 'h_') || value.organization_id !== input.organizationId || value.project_id !== input.projectId
+        || value.platform_id !== input.platformId || value.workspace_id !== input.workspaceId || value.environmentId !== input.resourceEnvironment
+        || !Array.isArray(value.role_ids) || value.role_ids.length !== 0 || !Array.isArray(value.permissions)
+        || value.permissions.length !== 1 || value.permissions[0] !== 'runner.tasks.execute'
+        || value.expires_at !== input.expiresAtMs || input.expiresAtMs <= Date.now() || !instant(value.created_at) || value.created_at >= input.expiresAtMs) {
+        throw uncertain(502, 'Runner returned an unqualified permission receipt. Retry the same operation, scope and expiry to reconcile it.');
+    }
+    return Response.json(value, { status: 200, headers: { 'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff' } });
+}

package/dist/runner.d.ts

@@ -1,5 +1,6 @@
 import type { GenesisClient } from './client.js';
 import type { components } from './generated/schema.js';
+import { type RunnerSelfExecutionGrantInput } from './runner-grant.js';
 type Schemas = components['schemas'];
 export type RunnerStartInput = Schemas['Runner.StartInput'];
 export type RunnerSnapshot = Schemas['Runner.Snapshot'];
@@ -11,6 +12,21 @@ export type RunnerRequestOptions = {
 };
 /** Runner routes use the Genesis client's credential; the backend owns org/subject scoping. */
 export declare function runnerModule(client: GenesisClient): Readonly<{
+    permission: Readonly<{
+        grant: (input: RunnerSelfExecutionGrantInput, opts?: RunnerRequestOptions) => Promise<{
+            id: string;
+            principal_id: string;
+            organization_id: string;
+            project_id: string;
+            platform_id: "pf_console";
+            workspace_id: string;
+            environmentId: "sandbox";
+            role_ids: unknown[];
+            permissions: "runner.tasks.execute"[];
+            expires_at: number;
+            created_at: number;
+        }>;
+    }>;
     catalog: (opts?: RunnerRequestOptions) => Promise<{
         workspaces: {
             key: components["schemas"]["Runner.SafeOpaqueRef"];

package/dist/runner.js

@@ -1,3 +1,4 @@
+import { RUNNER_SELF_GRANT_OPERATION } from './runner-grant.js';
 const requestOptions = (options) => ({ signal: options.signal });
 const opaqueId = (v) => typeof v === 'string' && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(v);
 const pathLike = (v) => /^[A-Za-z]:/.test(v) || v.includes('..');
@@ -95,6 +96,9 @@ function checkedStartInput(input) {
 /** Runner routes use the Genesis client's credential; the backend owns org/subject scoping. */
 export function runnerModule(client) {
     return Object.freeze({
+        permission: Object.freeze({
+            grant: (input, opts = {}) => client.request(RUNNER_SELF_GRANT_OPERATION, { body: input }, requestOptions(opts)),
+        }),
         catalog: (opts = {}) => client.request('runner_getCatalog', undefined, requestOptions(opts)),
         jobs: Object.freeze({
             list: (opts = {}) => client.request('runner_listJobs', undefined, requestOptions(opts)),

package/dist/types.d.ts

@@ -24,6 +24,8 @@ export interface OperationMeta {
     pathParams: readonly string[];
     queryParams: readonly string[];
     hasBody: boolean;
+    requestContentType?: string;
+    rawResponse?: boolean;
     inputSchema: Record<string, unknown>;
 }
 type Ops = operations;
@@ -43,6 +45,14 @@ type Body<K extends keyof Ops> = Ops[K] extends {
     body?: J;
 } : {
     body: J;
+}) : NonNullable<B> extends {
+    content: {
+        'multipart/form-data': unknown;
+    };
+} ? (undefined extends B ? {
+    body?: FormData;
+} : {
+    body: FormData;
 }) : {} : {};
 /** Flat input for an operation: path params + query params + `body`. */
 export type OperationInput<K extends keyof Ops> = Part<K, 'path'> & Part<K, 'query'> & Body<K>;
@@ -60,7 +70,7 @@ type Ok<R> = R extends {
     };
 } : unknown;
 /** Parsed JSON success body for an operation. */
-export type OperationOutput<K extends keyof Ops> = Ops[K] extends {
+export type OperationOutput<K extends keyof Ops> = K extends 'hives_invoke_function' | 'hives_invoke_function_async' | 'hives_invoke_deployment' ? Response : Ops[K] extends {
     responses: infer R;
 } ? (Ok<R> extends {
     content: {

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "@lifesi/genesis",
-  "version": "0.1.0",
+  "version": "0.1.2",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/l1felabs/genesis-api.git",
+    "directory": "packages/sdk"
+  },
   "description": "One typed SDK for every Genesis service (Foundry, Hives, Relays, IAM...) via the Genesis API gateway",
   "type": "module",
   "main": "dist/index.js",
@@ -10,11 +15,18 @@
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
-    "./spec.json": "./dist/genesis.openapi.json"
+    "./spec.json": "./dist/genesis.openapi.json",
+    "./hives-node": {
+      "types": "./dist/hives-node.d.ts",
+      "default": "./dist/hives-node.js"
+    }
   },
   "files": [
     "dist"
   ],
+  "dependencies": {
+    "undici": "6.29.0"
+  },
   "scripts": {
     "gen": "node scripts/gen.mjs",
     "build": "tsc -p tsconfig.json && cp ../../openapi/genesis.openapi.json dist/"