@onesi/genesis-cli 0.0.0-stage → 0.1.13

package/dist/secret-input.js

@@ -0,0 +1,85 @@
+import { open } from 'node:fs/promises';
+/** Read plaintext only from an explicitly selected file or stdin, never argv. */
+export async function readSecretInput(options, limit) {
+    if (Boolean(options.file) === Boolean(options.stdin))
+        throw new Error('Choose exactly one input source: a file or --stdin. Secret values are not accepted as command arguments.');
+    const chunks = [];
+    let size = 0;
+    const append = (chunk) => {
+        size += chunk.byteLength;
+        if (size > limit)
+            throw new Error(`Secret input exceeds ${limit} UTF-8 bytes. Use a smaller value or batch.`);
+        chunks.push(chunk);
+    };
+    if (options.file) {
+        let file;
+        try {
+            file = await open(options.file, 'r');
+        }
+        catch {
+            throw new Error('Could not open the secret input file. Check its path and permissions.');
+        }
+        try {
+            for (;;) {
+                const buffer = new Uint8Array(Math.min(8192, limit + 1));
+                const { bytesRead } = await file.read(buffer, 0, buffer.length, null);
+                if (!bytesRead)
+                    break;
+                append(buffer.subarray(0, bytesRead));
+            }
+        }
+        finally {
+            await file.close();
+        }
+    }
+    else {
+        for await (const chunk of process.stdin)
+            append(typeof chunk === 'string' ? new TextEncoder().encode(chunk) : chunk);
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    try {
+        return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    }
+    catch {
+        throw new Error('Secret input must be valid UTF-8 text.');
+    }
+}
+export function validateSecretValue(value) {
+    if (!value.length || new TextEncoder().encode(value).length > 65536)
+        throw new Error('Secret values must contain 1–65,536 UTF-8 bytes.');
+    return value;
+}
+export function validateSecret(input) {
+    if (!input || typeof input !== 'object')
+        throw new Error('Each secret needs a name and value.');
+    const { name, value, description } = input;
+    if (typeof name !== 'string' || name.length > 255 || !/^[A-Za-z][A-Za-z0-9_]*$/.test(name))
+        throw new Error('Secret names must start with a letter and contain only letters, numbers and underscores (up to 255 characters).');
+    if (typeof value !== 'string')
+        throw new Error('Each secret value must be a string.');
+    if (description !== undefined && description !== null && (typeof description !== 'string' || description.length > 500))
+        throw new Error('Secret descriptions must contain at most 500 characters.');
+    return { name, value: validateSecretValue(value), ...(typeof description === 'string' ? { description } : {}) };
+}
+export function parseSecretBatch(text) {
+    let data;
+    try {
+        data = JSON.parse(text);
+    }
+    catch {
+        throw new Error('Bulk input must be a JSON array with secret name and value fields.');
+    }
+    if (!Array.isArray(data) || !data.length)
+        throw new Error('Bulk input must be a non-empty JSON array.');
+    const batch = data.map(validateSecret);
+    if (new Set(batch.map((secret) => secret.name)).size !== batch.length)
+        throw new Error('Each secret name must appear once in a bulk update.');
+    if (new TextEncoder().encode(JSON.stringify(batch)).length > 256 * 1024)
+        throw new Error('Bulk input must fit within 256 KiB. Split it into smaller batches.');
+    return batch;
+}

package/dist/store.d.ts

@@ -0,0 +1,39 @@
+/** Saved `genesis login`: kept in the OS keychain (macOS Keychain, Windows Credential Manager, libsecret). */
+export interface SavedLogin {
+    access_token: string;
+    refresh_token?: string;
+    user?: {
+        id: string;
+        email?: string;
+        first_name?: string | null;
+        last_name?: string | null;
+    };
+    organization_id?: string;
+    /** epoch seconds, from the access token's exp claim */
+    expires_at?: number;
+    client_id: string;
+    /** One account provenance: the native bridge, or the RFC 8628 device grant. Legacy raw AuthKit credentials are never reused. */
+    auth?: {
+        kind: 'lifeid-bridge';
+        issuer: string;
+        audience: string;
+        product_id: string;
+        redirect_uri: string;
+        principal_id: string;
+        session_id: string;
+    } | {
+        kind: 'lifeid-device';
+        issuer: string;
+        client_id: string;
+        principal_id: string;
+        session_id: string;
+    };
+}
+export interface CredentialStore {
+    get(): Promise<SavedLogin | undefined>;
+    set(v: SavedLogin): Promise<void>;
+    clear(): Promise<boolean>;
+    readonly kind: string;
+}
+export declare function keychainStore(): Promise<CredentialStore>;
+export declare function memoryStore(initial?: SavedLogin): CredentialStore;

package/dist/store.js

@@ -0,0 +1,33 @@
+const SERVICE = 'one.life.genesis';
+const ACCOUNT = 'default';
+export async function keychainStore() {
+    let Entry;
+    try {
+        ({ Entry } = await import('@napi-rs/keyring'));
+    }
+    catch {
+        throw new Error('OS keychain is unavailable (@napi-rs/keyring not installed). Use GENESIS_API_KEY instead.');
+    }
+    const entry = new Entry(SERVICE, ACCOUNT);
+    return {
+        kind: 'os-keychain',
+        async get() { try {
+            const s = entry.getPassword();
+            return s ? JSON.parse(s) : undefined;
+        }
+        catch {
+            return undefined;
+        } },
+        async set(v) { entry.setPassword(JSON.stringify(v)); },
+        async clear() { try {
+            return entry.deletePassword();
+        }
+        catch {
+            return false;
+        } },
+    };
+}
+export function memoryStore(initial) {
+    let v = initial;
+    return { kind: 'memory', async get() { return v; }, async set(x) { v = x; }, async clear() { const had = !!v; v = undefined; return had; } };
+}

package/dist/wasm-input.d.ts

@@ -0,0 +1,2 @@
+/** Read only the explicitly requested regular file, with a bounded allocation. */
+export declare function readWasmFile(path: string): Promise<Blob>;

package/dist/wasm-input.js

@@ -0,0 +1,31 @@
+import { open } from 'node:fs/promises';
+import { MAX_WASM_BYTES } from '@onesi/genesis';
+/** Read only the explicitly requested regular file, with a bounded allocation. */
+export async function readWasmFile(path) {
+    let file;
+    try {
+        file = await open(path, 'r');
+    }
+    catch {
+        throw new Error('Could not open the WASM file. Check its path and permissions.');
+    }
+    try {
+        const stat = await file.stat();
+        if (!stat.isFile() || stat.size < 4 || stat.size > MAX_WASM_BYTES)
+            throw new Error('Choose a regular WASM file of 4 bytes to 10 MiB.');
+        const bytes = new Uint8Array(MAX_WASM_BYTES + 1);
+        let size = 0;
+        for (;;) {
+            const { bytesRead } = await file.read(bytes, size, bytes.length - size, null);
+            if (!bytesRead)
+                break;
+            size += bytesRead;
+            if (size > MAX_WASM_BYTES)
+                throw new Error('WASM file exceeds 10 MiB.');
+        }
+        return new Blob([bytes.slice(0, size)], { type: 'application/wasm' });
+    }
+    finally {
+        await file.close();
+    }
+}

package/package.json

@@ -1,6 +1,54 @@
 {
   "name": "@onesi/genesis-cli",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.13",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/l1felabs/genesis-api.git",
+    "directory": "packages/cli"
+  },
+  "description": "genesis: one CLI for every Genesis service",
+  "type": "module",
+  "bin": {
+    "genesis": "bin/genesis.js"
+  },
+  "keywords": [
+    "genesis",
+    "oneos",
+    "sdk",
+    "cli",
+    "mcp",
+    "model-context-protocol",
+    "ai-agents",
+    "api"
+  ],
+  "author": "One Superintelligence, Inc.",
+  "homepage": "https://os.one.ml/docs",
+  "engines": {
+    "node": ">=20.19"
+  },
+  "files": [
+    "bin",
+    "dist"
+  ],
+  "dependencies": {
+    "commander": "^14.0.0",
+    "undici": "6.29.0",
+    "@onesi/genesis": "0.1.13"
+  },
+  "optionalDependencies": {
+    "@napi-rs/keyring": "^1.2.0"
+  },
+  "exports": {
+    "./auth": {
+      "types": "./dist/auth.d.ts",
+      "default": "./dist/auth.js"
+    },
+    "./store": {
+      "types": "./dist/store.d.ts",
+      "default": "./dist/store.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json"
+  }
 }