@lifesi/genesis 0.1.1 → 0.1.3

package/dist/hives-volumes.js

@@ -0,0 +1,117 @@
+import { hivesResourceCall, hivesResourceId, resourceError } from './hives-resources-transport.js';
+const MIB = 1024 * 1024;
+const states = ['creating', 'available', 'attaching', 'attached', 'detaching', 'deleting', 'failed'];
+function object(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw resourceError(0);
+    return value;
+}
+function text(value, max = 128) {
+    if (typeof value !== 'string' || !value || value.length > max || /[\u0000-\u001f\u007f]/.test(value))
+        throw resourceError(0);
+    return value;
+}
+function count(value) {
+    if (!Number.isSafeInteger(value) || value < 0)
+        throw resourceError(0);
+    return value;
+}
+function date(value) { const result = text(value, 64); if (!Number.isFinite(Date.parse(result)))
+    throw resourceError(0); return result; }
+function volume(value, project, expectedId) {
+    const row = object(value);
+    if (row.project_id !== project || row.storage_class !== 'local' || row.access_mode !== 'read_write_once'
+        || !states.includes(row.state) || typeof row.operation_pending !== 'boolean')
+        throw resourceError(0);
+    const id = hivesResourceId(text(row.id));
+    if (expectedId && id !== expectedId)
+        throw resourceError(0);
+    const backing = count(row.backing_bytes);
+    const capacity = row.capacity_bytes === null ? null : count(row.capacity_bytes);
+    const used = row.used_bytes === null ? null : count(row.used_bytes);
+    if (backing < 32 * MIB || backing > 1024 * MIB || row.size_gib !== backing / (1024 * MIB)
+        || capacity !== null && capacity > backing || used !== null && (capacity === null || used > capacity))
+        throw resourceError(0);
+    const path = row.mount_path === null ? null : text(row.mount_path, 512);
+    const attached = row.attached_to === null ? null : hivesResourceId(text(row.attached_to));
+    if ((path === null) !== (attached === null) || (attached === null ? row.read_only !== null : typeof row.read_only !== 'boolean'))
+        throw resourceError(0);
+    const generation = count(row.generation);
+    if (generation < 1)
+        throw resourceError(0);
+    return { id, project_id: project, name: text(row.name, 64), size_gib: backing / (1024 * MIB), backing_bytes: backing,
+        capacity_bytes: capacity, used_bytes: used, storage_class: 'local', access_mode: 'read_write_once',
+        state: row.state, operation_pending: row.operation_pending, generation,
+        mount_path: path, attached_to: attached, read_only: row.read_only,
+        created_at: date(row.created_at), updated_at: date(row.updated_at) };
+}
+/** Persisted project storage. A failed acknowledgement never triggers an automatic write retry. */
+export function hivesVolumes(client) {
+    const ids = (project, id) => ({ project_id: hivesResourceId(project), ...(id === undefined ? {} : { volume_id: hivesResourceId(id) }) });
+    const call = (id, input, options) => hivesResourceCall(client, id, input, options);
+    return {
+        async list(project, query = {}, options) {
+            const page = query.page ?? 1;
+            const perPage = query.per_page ?? 25;
+            if (Object.keys(query).some(key => !['page', 'per_page'].includes(key)) || !Number.isSafeInteger(page) || page < 1 || page > 10000
+                || !Number.isSafeInteger(perPage) || perPage < 1 || perPage > 100)
+                throw resourceError(0);
+            const result = object(await call('hives_list_volumes', { ...ids(project), page, per_page: perPage }, options));
+            const pagination = object(result.pagination);
+            const total = count(pagination.total);
+            const pages = count(pagination.total_pages);
+            if (pagination.page !== page || pagination.per_page !== perPage || pages !== Math.ceil(total / perPage)
+                || !Array.isArray(result.volumes) || result.volumes.length > perPage)
+                throw resourceError(0);
+            const volumes = result.volumes.map(row => volume(row, project));
+            if (new Set(volumes.map(row => row.id)).size !== volumes.length)
+                throw resourceError(0);
+            return { volumes, pagination: { page, per_page: perPage, total, total_pages: pages } };
+        },
+        async get(project, id, options) { return volume(await call('hives_get_volume', ids(project, id), options), project, id); },
+        async create(project, input, options) {
+            const body = object(input);
+            const name = text(body.name, 64);
+            let size;
+            if (body.size_mib !== undefined && body.size_gib === undefined)
+                size = count(body.size_mib);
+            else if (body.size_mib === undefined && body.size_gib === 1)
+                size = 1024;
+            else
+                throw resourceError(0);
+            if (name.trim() !== name || size < 32 || size > 1024 || body.storage_class !== undefined && body.storage_class !== 'local'
+                || body.access_mode !== undefined && body.access_mode !== 'read_write_once'
+                || Object.keys(body).some(key => !['name', 'size_mib', 'size_gib', 'storage_class', 'access_mode'].includes(key)))
+                throw resourceError(0);
+            const result = volume(await call('hives_create_volume', { ...ids(project), body: { name, size_mib: size, storage_class: 'local', access_mode: 'read_write_once' } }, options), project);
+            if (result.name !== name || result.backing_bytes !== size * MIB)
+                throw resourceError(0);
+            return result;
+        },
+        async mount(project, id, input, options) {
+            const body = object(input);
+            const target = hivesResourceId(text(body.target_id));
+            const path = text(body.mount_path, 128);
+            if (!/^\/[A-Za-z0-9_-]+(?:\/[A-Za-z0-9_-]+)*$/.test(path) || typeof body.read_only !== 'boolean'
+                || Object.keys(body).some(key => !['target_id', 'mount_path', 'read_only'].includes(key)))
+                throw resourceError(0);
+            const readOnly = body.read_only;
+            const result = volume(await call('hives_mount_volume', { ...ids(project, id), body: { target_id: target, mount_path: path, read_only: readOnly } }, options), project, id);
+            if (result.attached_to !== target || result.mount_path !== path || result.read_only !== readOnly)
+                throw resourceError(0);
+            return result;
+        },
+        async unmount(project, id, options) {
+            const result = volume(await call('hives_unmount_volume', ids(project, id), options), project, id);
+            if (result.state !== 'available' || result.operation_pending || result.attached_to !== null || result.mount_path !== null || result.read_only !== null)
+                throw resourceError(0);
+            return result;
+        },
+        async remove(project, id, options) {
+            const result = object(await call('hives_delete_volume', ids(project, id), options));
+            if (result.id !== id || result.success !== true)
+                throw resourceError(0);
+            return { success: true, id, message: text(result.message, 256) };
+        },
+    };
+}

package/dist/index.d.ts

@@ -8,5 +8,12 @@ export { hivesUploadBody, MAX_WASM_BYTES, type HivesUploadOptions } from './hive
 export { validateHivesInvocation, hivesFunctionResponseHeaders, MAX_FUNCTION_BODY_BYTES, MAX_FUNCTION_JSON_BYTES, type HivesInvokeRequest } from './hives-functions.js';
 export { hivesResponseBytes } from './hives-response.js';
 export { runnerModule, type RunnerStartInput, type RunnerSnapshot, type RunnerCatalog, type RunnerEvent, type RunnerProviderResult, type RunnerRequestOptions } from './runner.js';
+export type { RunnerSelfExecutionGrantInput, RunnerSelfExecutionGrant } from './runner-grant.js';
 export { beaconsModule } from './beacons.js';
-export { dialsModule, dialsEmergencyAddressFeedback, type DialsEmergencyAddressFeedback, type DialsScope, type DialsOutboundCall, type DialsCallControl, type DialsEmergencyAddress } from './dials.js';
+export { dialsModule, dialsEmergencyAddressFeedback, type DialsEmergencyAddressFeedback, type DialsScope, type DialsOutboundCall, type DialsCallControl, type DialsEmergencyAddress, type DialsCallListItem, type DialsCallDispatchState, type DialsMessage, type DialsMessageTemplate, type DialsMessagingBrand, type DialsMessagingCampaign, type DialsWorkflowDocument, type DialsRoutingAction, type DialsRoutingRule, type DialsRoutingRuleReceipt, type DialsOutboundCallReceipt, type DialsRecoveredOutboundCallReceipt } from './dials.js';
+export { hivesObjectKey, type HivesBucket, type HivesObject, type HivesObjectAcknowledgement, type HivesObjectList, type HivesCorsRule, type HivesCreateBucket, type HivesPresign, type HivesPresignedUrl } from './hives-cells.js';
+export { hivesQueueBody, type HivesQueue, type HivesQueueConfig, type HivesQueueCreate, type HivesQueueSend, type HivesQueueDelivery, type HivesDeadLetter, type HivesDeadLetterStats } from './hives-queues.js';
+export type { HivesRuntime, HivesRuntimeSelection } from './hives-runtimes.js';
+export type { HivesVolume, HivesVolumeCreate, HivesVolumeMount, HivesVolumePage } from './hives-volumes.js';
+export { HIVES_OBJECT_BYTES, HIVES_QUEUE_BYTES, type HivesResourceOptions } from './hives-resources-transport.js';
+export type { HivesMarketplacePackage, HivesMarketplaceVersion, HivesMarketplaceInstallation, HivesMarketplaceCategory, HivesMarketplacePage, HivesMarketplacePublish, HivesMarketplaceInstall, HivesMarketplaceSearch, HivesMarketplaceDetail } from './hives-marketplace.js';

package/dist/index.js

@@ -8,3 +8,6 @@ export { hivesResponseBytes } from './hives-response.js';
 export { runnerModule } from './runner.js';
 export { beaconsModule } from './beacons.js';
 export { dialsModule, dialsEmergencyAddressFeedback } from './dials.js';
+export { hivesObjectKey } from './hives-cells.js';
+export { hivesQueueBody } from './hives-queues.js';
+export { HIVES_OBJECT_BYTES, HIVES_QUEUE_BYTES } from './hives-resources-transport.js';

package/dist/runner-grant.d.ts

@@ -0,0 +1,10 @@
+import { GenesisError } from './errors.js';
+import type { components } from './generated/schema.js';
+export type RunnerSelfExecutionGrantInput = components['schemas']['Iam.RunnerSelfExecutionGrantRequest'];
+export type RunnerSelfExecutionGrant = components['schemas']['Iam.RunnerSelfExecutionGrant'];
+export declare const RUNNER_SELF_GRANT_OPERATION: "iam_runnerSelfExecutionGrant";
+/** Copy only primitive data descriptors before any asynchronous credential call. */
+export declare function snapshotRunnerSelfGrant(args: Record<string, unknown>, routing: string): RunnerSelfExecutionGrantInput;
+export declare function runnerGrantTransportError(): GenesisError;
+/** A bounded closed response; no arbitrary upstream body reaches CLI or MCP. */
+export declare function runnerGrantResponse(res: Response, input: RunnerSelfExecutionGrantInput): Promise<Response>;

package/dist/runner-grant.js

@@ -0,0 +1,133 @@
+import { GenesisError } from './errors.js';
+export const RUNNER_SELF_GRANT_OPERATION = 'iam_runnerSelfExecutionGrant';
+const requestKeys = ['schemaVersion', 'requestId', 'operationId', 'organizationId', 'projectId', 'platformId', 'workspaceId', 'fleetId', 'resourceEnvironment', 'expiresAtMs'];
+const receiptKeys = ['id', 'principal_id', 'organization_id', 'project_id', 'platform_id', 'workspace_id', 'environmentId', 'role_ids', 'permissions', 'expires_at', 'created_at'];
+const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+const match = (p, v) => typeof v === 'string' && p.exec(v)?.[0] === v;
+const native = (v, prefix) => match(new RegExp('^' + prefix + '[A-Za-z0-9_]{1,32}$'), v);
+const instant = (v) => typeof v === 'number' && Number.isSafeInteger(v) && v > 0;
+function exact(v, keys) {
+    return !!v && typeof v === 'object' && !Array.isArray(v) && Object.keys(v).length === keys.length && keys.every(k => Object.hasOwn(v, k));
+}
+const invalid = () => new TypeError('Runner self-execution permission requires the exact ordinary-human Sandbox selection, operation, request correlation and finite expiry');
+/** Copy only primitive data descriptors before any asynchronous credential call. */
+export function snapshotRunnerSelfGrant(args, routing) {
+    if (routing !== 'gateway' || !exact(args, ['body']) || Reflect.ownKeys(args).length !== 1)
+        throw invalid();
+    const descriptor = Object.getOwnPropertyDescriptor(args, 'body');
+    if (!descriptor || !('value' in descriptor))
+        throw invalid();
+    const body = descriptor.value;
+    if (!exact(body, requestKeys) || ![Object.prototype, null].includes(Object.getPrototypeOf(body)) || Reflect.ownKeys(body).length !== requestKeys.length)
+        throw invalid();
+    const copy = {};
+    for (const key of requestKeys) {
+        const d = Object.getOwnPropertyDescriptor(body, key);
+        if (!d || !('value' in d) || !d.enumerable || (d.value !== null && !['string', 'number'].includes(typeof d.value)))
+            throw invalid();
+        copy[key] = d.value;
+    }
+    const now = Date.now();
+    if (copy.schemaVersion !== 1 || !match(uuid, copy.requestId) || !match(uuid, copy.operationId)
+        || !native(copy.organizationId, 'o_') || !native(copy.projectId, 'pr_') || !native(copy.workspaceId, 'w_')
+        || copy.platformId !== 'pf_console' || copy.fleetId !== null || copy.resourceEnvironment !== 'sandbox'
+        || !instant(copy.expiresAtMs) || copy.expiresAtMs <= now || copy.expiresAtMs > now + 1_800_000)
+        throw invalid();
+    return Object.freeze(copy);
+}
+function closedJson(raw) {
+    const value = JSON.parse(raw);
+    const stack = [];
+    for (const token of raw.match(/"(?:\\.|[^"\\])*"|[{}\[\],:]|true|false|null|-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?/g) ?? []) {
+        const frame = stack.at(-1);
+        if (token === '{' || token === '[')
+            stack.push({ object: token === '{', key: token === '{', keys: new Set() });
+        else if (token === '}' || token === ']')
+            stack.pop();
+        else if (token === ',' && frame?.object)
+            frame.key = true;
+        else if (token === ':' && frame?.object)
+            frame.key = false;
+        else if (token.startsWith('"') && frame?.object && frame.key) {
+            const key = JSON.parse(token);
+            if (frame.keys.has(key))
+                throw invalid();
+            frame.keys.add(key);
+        }
+        else if (/^-?\d/.test(token) && !/^-?(?:0|[1-9]\d*)$/.test(token))
+            throw invalid();
+    }
+    return value;
+}
+const errorRows = [
+    [400, 'INVALID_ARGUMENT', 'invalid Runner self-execution grant request', 'invalid_runner_self_execution_grant_request'],
+    [400, 'INVALID_ARGUMENT', 'Runner self-execution grant expiry is out of bounds', 'runner_self_execution_grant_expiry_out_of_bounds'],
+    [401, 'UNAUTHENTICATED', 'Runner self-execution authority inactive', 'runner_self_execution_grant_inactive'],
+    [403, 'PERMISSION_DENIED', 'Runner self-execution authority denied', 'runner_self_execution_grant_denied'],
+    [409, 'CONFLICT', 'Runner self-execution grant operation conflict', 'runner_self_execution_grant_conflict'],
+    [409, 'CONFLICT', 'Runner self-execution grant replay is stale', 'runner_self_execution_grant_replay_stale'],
+    [503, 'PROVIDER_UNAVAILABLE', 'Runner self-execution grant unavailable', 'runner_self_execution_grant_unavailable'],
+];
+function uncertain(status, message) {
+    return new GenesisError({ status, type: 'runner_grant_uncertain', operationId: RUNNER_SELF_GRANT_OPERATION, message });
+}
+export function runnerGrantTransportError() {
+    return uncertain(0, 'Runner permission response was lost. Retry the same operation, scope and expiry with fresh request correlation.');
+}
+/** A bounded closed response; no arbitrary upstream body reaches CLI or MCP. */
+export async function runnerGrantResponse(res, input) {
+    let value;
+    try {
+        if (res.redirected || res.headers.get('content-type')?.split(';')[0].trim().toLowerCase() !== 'application/json')
+            throw invalid();
+        const reader = res.body?.getReader();
+        const chunks = [];
+        let size = 0;
+        if (reader) {
+            try {
+                while (true) {
+                    const next = await reader.read();
+                    if (next.done)
+                        break;
+                    size += next.value.byteLength;
+                    if (size > 8192) {
+                        await reader.cancel();
+                        throw invalid();
+                    }
+                    chunks.push(next.value);
+                }
+            }
+            finally {
+                reader.releaseLock();
+            }
+        }
+        const bytes = new Uint8Array(size);
+        let offset = 0;
+        for (const chunk of chunks) {
+            bytes.set(chunk, offset);
+            offset += chunk.byteLength;
+        }
+        value = closedJson(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+    }
+    catch {
+        throw uncertain(res.status, 'Runner permission could not be confirmed. Retry the same operation, scope and expiry with fresh request correlation.');
+    }
+    if (res.status !== 200) {
+        if (exact(value, ['code', 'message', 'details']) && exact(value.details, ['schemaVersion', 'reason']) && value.details.schemaVersion === 1) {
+            const details = value.details;
+            const row = errorRows.find(r => r[0] === res.status && r[1] === value.code && r[2] === value.message && r[3] === details.reason);
+            if (row)
+                throw new GenesisError({ status: res.status, type: 'runner_grant_denied', code: row[1], operationId: RUNNER_SELF_GRANT_OPERATION, message: row[2], body: value });
+        }
+        throw uncertain(res.status, 'Runner permission is unavailable or unconfirmed. Retry the same operation, scope and expiry with fresh request correlation.');
+    }
+    if (!exact(value, receiptKeys) || !match(/^g_[0-7][0123456789ABCDEFGHJKMNPQRSTVWXYZ]{25}$/, value.id)
+        || !native(value.principal_id, 'h_') || value.organization_id !== input.organizationId || value.project_id !== input.projectId
+        || value.platform_id !== input.platformId || value.workspace_id !== input.workspaceId || value.environmentId !== input.resourceEnvironment
+        || !Array.isArray(value.role_ids) || value.role_ids.length !== 0 || !Array.isArray(value.permissions)
+        || value.permissions.length !== 1 || value.permissions[0] !== 'runner.tasks.execute'
+        || value.expires_at !== input.expiresAtMs || input.expiresAtMs <= Date.now() || !instant(value.created_at) || value.created_at >= input.expiresAtMs) {
+        throw uncertain(502, 'Runner returned an unqualified permission receipt. Retry the same operation, scope and expiry to reconcile it.');
+    }
+    return Response.json(value, { status: 200, headers: { 'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff' } });
+}

package/dist/runner.d.ts

@@ -1,5 +1,6 @@
 import type { GenesisClient } from './client.js';
 import type { components } from './generated/schema.js';
+import { type RunnerSelfExecutionGrantInput } from './runner-grant.js';
 type Schemas = components['schemas'];
 export type RunnerStartInput = Schemas['Runner.StartInput'];
 export type RunnerSnapshot = Schemas['Runner.Snapshot'];
@@ -11,6 +12,21 @@ export type RunnerRequestOptions = {
 };
 /** Runner routes use the Genesis client's credential; the backend owns org/subject scoping. */
 export declare function runnerModule(client: GenesisClient): Readonly<{
+    permission: Readonly<{
+        grant: (input: RunnerSelfExecutionGrantInput, opts?: RunnerRequestOptions) => Promise<{
+            id: string;
+            principal_id: string;
+            organization_id: string;
+            project_id: string;
+            platform_id: "pf_console";
+            workspace_id: string;
+            environmentId: "sandbox";
+            role_ids: unknown[];
+            permissions: "runner.tasks.execute"[];
+            expires_at: number;
+            created_at: number;
+        }>;
+    }>;
     catalog: (opts?: RunnerRequestOptions) => Promise<{
         workspaces: {
             key: components["schemas"]["Runner.SafeOpaqueRef"];

package/dist/runner.js

@@ -1,3 +1,4 @@
+import { RUNNER_SELF_GRANT_OPERATION } from './runner-grant.js';
 const requestOptions = (options) => ({ signal: options.signal });
 const opaqueId = (v) => typeof v === 'string' && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(v);
 const pathLike = (v) => /^[A-Za-z]:/.test(v) || v.includes('..');
@@ -95,6 +96,9 @@ function checkedStartInput(input) {
 /** Runner routes use the Genesis client's credential; the backend owns org/subject scoping. */
 export function runnerModule(client) {
     return Object.freeze({
+        permission: Object.freeze({
+            grant: (input, opts = {}) => client.request(RUNNER_SELF_GRANT_OPERATION, { body: input }, requestOptions(opts)),
+        }),
         catalog: (opts = {}) => client.request('runner_getCatalog', undefined, requestOptions(opts)),
         jobs: Object.freeze({
             list: (opts = {}) => client.request('runner_listJobs', undefined, requestOptions(opts)),

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "@lifesi/genesis",
-  "version": "0.1.1",
+  "version": "0.1.3",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/l1felabs/genesis-api.git",
+    "directory": "packages/sdk"
+  },
   "description": "One typed SDK for every Genesis service (Foundry, Hives, Relays, IAM...) via the Genesis API gateway",
   "type": "module",
   "main": "dist/index.js",