@onesi/genesis-cli 0.0.1-stage → 0.1.13

package/dist/index.js

@@ -0,0 +1,640 @@
+import { registerMinds } from './minds.js';
+import { registerRelaysEnrollment } from './relays-enrollment.js';
+import { registerBeacons } from './beacons.js';
+import { registerDials } from './dials.js';
+import { registerProducts } from './products.js';
+import { Command, CommanderError } from 'commander';
+import { Genesis, GenesisError, errorCatalog, errorOutcome, isMindsOperation, HivesOperationError, HivesQueueOperationError, MindsAgentError, MindsOwnerError, hivesResponseBytes, MAX_FUNCTION_BODY_BYTES, MAX_FUNCTION_JSON_BYTES, DEFAULT_BASE_URL, requireSecureUrl } from '@onesi/genesis';
+import { authConfig, completeLogin, selectSavedContext, savedLoginProvider, startLogin } from './auth.js';
+import { completeDeviceLogin, startDeviceLogin } from './device-login.js';
+import { keychainStore } from './store.js';
+import { c, listOf, safe, stdio, table } from './output.js';
+import { spawn } from 'node:child_process';
+import { addHenryCommands } from './henry.js';
+import { registerFleets } from './fleets.js';
+import { registerFlocks } from './flocks.js';
+import { registerRunner } from './runner.js';
+import { createHivesNodeTransport } from './hives-node-transport.js';
+import { registerHivesOperations } from './hives-operations.js';
+import { readFunctionFile, readFunctionJson, writeFunctionOutput } from './function-input.js';
+import { basename } from 'node:path';
+import { readWasmFile } from './wasm-input.js';
+import { readSecretInput, validateSecret, validateSecretValue, parseSecretBatch } from './secret-input.js';
+function defaultOpen(url) {
+    const cmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'cmd' : 'xdg-open';
+    const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
+    try {
+        spawn(cmd, args, { stdio: 'ignore', detached: true }).on('error', () => { }).unref();
+    }
+    catch { /* print-only fallback */ }
+}
+export function buildProgram(deps = {}) {
+    const out = deps.out ?? stdio;
+    const env = deps.env ?? process.env;
+    const f = deps.fetch ?? fetch;
+    const getStore = deps.store ?? keychainStore;
+    const auth = { ...authConfig(env, f), sleep: deps.sleep };
+    const program = new Command('genesis')
+        .description('One CLI for every Genesis service.')
+        .version('0.1.13')
+        .option('--json', 'machine-readable JSON output')
+        .option('--api-key <key>', 'use this API key (default: GENESIS_API_KEY, then your `genesis login`)')
+        .option('--base-url <url>', 'gateway URL (default: GENESIS_BASE_URL or https://os.one.ml/api)')
+        .option('--direct', 'skip the gateway and call each service host directly (for local dev)')
+        .option('--org <org_id>', 'organization to act on')
+        .showHelpAfterError()
+        .exitOverride()
+        .configureOutput({ writeOut: (s) => out.log(s.trimEnd()), writeErr: (s) => out.err(s.trimEnd()) });
+    const g = () => program.opts();
+    const client = async (hivesTransport = false) => {
+        const o = g();
+        const store = await getStore().catch(() => undefined);
+        const opts = {
+            apiKey: o.apiKey ?? env.GENESIS_API_KEY, token: env.GENESIS_TOKEN,
+            baseUrl: o.baseUrl ?? env.GENESIS_BASE_URL, routing: o.direct || env.GENESIS_ROUTING === 'direct' ? 'direct' : 'gateway',
+            fetch: f, userAgent: 'genesis-cli/0.1.13',
+            credentials: store ? savedLoginProvider(auth, store) : undefined,
+        };
+        return new Genesis(hivesTransport ? { ...opts, fetch: createHivesNodeTransport(opts, deps.signal) } : opts);
+    };
+    const emit = (data, pretty) => out.log(g().json ? JSON.stringify(data, null, 2) : pretty());
+    const positiveInteger = (value, option, maximum) => {
+        if (value === undefined)
+            return undefined;
+        if (!/^\d+$/.test(value) || !Number.isSafeInteger(Number(value)) || Number(value) < 1 || Number(value) > maximum) {
+            throw new Error(`${option} must be an integer from 1 to ${maximum}.`);
+        }
+        return Number(value);
+    };
+    const projectName = (name) => {
+        if (name.length < 3 || name.length > 64 || !/^[a-z][a-z0-9-]*[a-z0-9]$/.test(name)) {
+            throw new Error('Project name must be 3–64 lowercase letters, numbers or hyphens, start with a letter and end with a letter or number.');
+        }
+        return name;
+    };
+    registerRunner(program, client, emit);
+    const orgId = async (gen) => {
+        if (g().org)
+            return g().org;
+        const s = await (await getStore().catch(() => undefined))?.get();
+        if (s?.organization_id && !g().apiKey && !env.GENESIS_API_KEY)
+            return s.organization_id;
+        return (await gen.whoami()).org;
+    };
+    const silos = program.command('silos').description('Serverless PostgreSQL');
+    const silosDatabases = silos.command('databases').description('Read existing owned database metadata; no provisioning');
+    silosDatabases.command('list <project_id>').action(async (id) => out.log(JSON.stringify(await (await client()).silos.databases.list(id), null, 2)));
+    silosDatabases.command('get <project_id> <database_id>').action(async (project, database) => out.log(JSON.stringify(await (await client()).silos.databases.get(project, database), null, 2)));
+    const silosProjects = silos.command('projects').description('Projects in your verified organization');
+    silosProjects.command('list').action(async () => out.log(JSON.stringify(await (await client()).silos.projects.list(), null, 2)));
+    silosProjects.command('get <project_id>').action(async (id) => out.log(JSON.stringify(await (await client()).silos.projects.get(id), null, 2)));
+    silosProjects.command('create').requiredOption('--name <name>', 'Project name').requiredOption('--slug <slug>', 'Unique project slug')
+        .action(async (options) => out.log(JSON.stringify(await (await client()).silos.projects.create({ name: options.name, slug: options.slug }), null, 2)));
+    const traces = program.command('traces').description('Research and evidence');
+    const tracesRuns = traces.command('runs').description('Research runs in your verified organization');
+    tracesRuns.command('create').requiredOption('--type <type>', 'Run type, e.g. deep_research').requiredOption('--query <query>', 'Research question')
+        .requiredOption('--idempotency-key <key>', 'Stable key; reuse it to replay instead of creating a second run')
+        .action(async (o) => out.log(JSON.stringify(await (await client()).traces.runs.create({ type: o.type, query: o.query }, o.idempotencyKey), null, 2)));
+    tracesRuns.command('list').action(async () => out.log(JSON.stringify(await (await client()).traces.runs.list(), null, 2)));
+    tracesRuns.command('get <run_id>').action(async (id) => out.log(JSON.stringify(await (await client()).traces.runs.get(id), null, 2)));
+    traces.command('search <query>').requiredOption('--idempotency-key <key>', 'Stable key; metered once')
+        .action(async (query, o) => out.log(JSON.stringify(await (await client()).traces.search({ query, max_results: 3 }, o.idempotencyKey), null, 2)));
+    traces.command('usage').action(async () => out.log(JSON.stringify(await (await client()).traces.usage.events(), null, 2)));
+    const blinds = program.command('blinds').description('Blinds credential custody');
+    const show = async (call) => out.log(JSON.stringify(await call((await client()).blinds), null, 2));
+    const key = (o) => ({ signal: deps.signal, ...(o.idempotencyKey ? { idempotencyKey: o.idempotencyKey } : {}) });
+    const keyOption = ['--idempotency-key <uuid>', 'Reuse the UUID from an uncertain earlier attempt; otherwise a new one is minted'];
+    const credentials = blinds.command('credentials').description('Credential variable names (values never leave Blinds)');
+    credentials.command('list').action(() => show(b => b.credentials.list({ signal: deps.signal })));
+    credentials.command('set <variable>').description('Store a static credential from a file or stdin, never argv')
+        .requiredOption('--type <type>', 'api_key, bearer, ...').option('--file <path>', 'Read the value from this file').option('--stdin', 'Read the value from stdin')
+        .option('--domain <domain...>', 'Destination domains the value may be injected into').option('--provider <slug>').option(...keyOption)
+        .action(async (variable, o) => {
+        const value = (await (deps.readSecretInput ?? readSecretInput)(o, 16 * 1024)).replace(/\r?\n$/, '');
+        await show(b => b.credentials.store({ variable_name: variable, value, credential_type: o.type,
+            ...(o.domain ? { destination_domains: o.domain } : {}), ...(o.provider ? { provider: o.provider } : {}) }, key(o)));
+    });
+    credentials.command('revoke <variable>').option(...keyOption).action((variable, o) => show(b => b.credentials.revoke(variable, key(o))));
+    blinds.command('connections').description('Active OAuth connections (metadata only)').action(() => show(b => b.oauth.connections({ signal: deps.signal })));
+    const consent = blinds.command('consent').description('Agent consent requests and decisions');
+    consent.command('pending').action(() => show(b => b.consent.pending({ signal: deps.signal })));
+    consent.command('list').action(() => show(b => b.consent.records({ signal: deps.signal })));
+    consent.command('approve <consent_id>').requiredOption('--signature <sig>', 'One account approval signature').option('--expires-in <seconds>').option(...keyOption)
+        .action((id, o) => show(b => b.consent.approve(id, { signature: o.signature, ...(o.expiresIn ? { expires_in_seconds: Number(o.expiresIn) } : {}) }, key(o))));
+    consent.command('deny <consent_id>').option(...keyOption).action((id, o) => show(b => b.consent.deny(id, key(o))));
+    consent.command('revoke <consent_id>').option(...keyOption).action((id, o) => show(b => b.consent.revoke(id, key(o))));
+    const delegates = blinds.command('delegates').description('Which agents hold which variables');
+    delegates.command('list').action(() => show(b => b.delegates.list({ signal: deps.signal })));
+    delegates.command('create <name>').requiredOption('--variable <name...>', 'Variables to delegate').requiredOption('--ttl <seconds>', 'Lifetime in seconds')
+        .option('--max-depth <n>', 'Sub-delegation depth', '1').option(...keyOption)
+        .action((name, o) => show(b => b.delegates.create({ name, delegated_variables: o.variable, ttl_seconds: Number(o.ttl), max_depth: Number(o.maxDepth) }, key(o))));
+    delegates.command('revoke <delegate_id>').option(...keyOption).action((id, o) => show(b => b.delegates.revoke(id, key(o))));
+    blinds.command('activity').description('Latest 200 Blinds audit events').action(() => show(b => b.activity({ signal: deps.signal })));
+    const owner = blinds.command('owner-enrollment')
+        .description('Original-human enrollment only; preserve operation and locator IDs after unknown outcomes');
+    for (const [action, operation] of Object.entries({ reserve: 'blinds_ownerReserve', sign: 'blinds_ownerSign', attach: 'blinds_ownerAttach', 'p256-ensure': 'blinds_ownerP256Ensure' })) {
+        owner.command(action).requiredOption('--body-file <path>', 'Closed JSON request, up to 2 KiB; original human login required')
+            .action(async (options) => {
+            const body = await readFunctionJson(options.bodyFile, 2048);
+            const result = await (await client()).request(operation, { body }, { signal: deps.signal });
+            out.log(JSON.stringify(result, null, 2));
+        });
+    }
+    registerDials(program, { client, orgId, emit });
+    registerProducts(program, { client, emit, signal: deps.signal });
+    // ---- auth ------------------------------------------------------------
+    program.command('login').description('Sign in with One in your browser').option('--no-browser', 'just print the link')
+        .option('--device', 'sign in from a machine without a local browser: approve a code from any signed-in browser')
+        .action(async (o) => {
+        const store = await getStore();
+        if (o.device) {
+            const start = await startDeviceLogin(auth, deps.signal);
+            const uri = safe(start.verificationUri), complete = safe(start.verificationUriComplete), userCode = safe(start.userCode);
+            if (g().json)
+                out.err(JSON.stringify({ user_code: userCode, verification_uri: uri,
+                    verification_uri_complete: complete, expires_in: start.expiresIn }));
+            else
+                out.err(`\n  On any device, open ${c.bold(uri)}\n  and enter the code ${c.bold(userCode)}\n\n  Or open ${complete}\n  ${c.dim(`Waiting for approval (expires in ${Math.round(start.expiresIn / 60)} min)…`)}\n`);
+            const s = await completeDeviceLogin(auth, start, deps.signal);
+            await store.set(s);
+            emit({ user: s.user, organization_id: s.organization_id, store: store.kind, via: 'device' }, () => `${c.green('✓')} Signed in as ${c.bold(s.user?.email ?? s.user?.id ?? 'you')}${s.organization_id ? ` (${s.organization_id})` : ''}. Token saved to your ${store.kind === 'os-keychain' ? 'OS keychain' : store.kind}.`);
+            return;
+        }
+        const attempt = await startLogin(auth, { signal: deps.signal });
+        let s;
+        try {
+            out.err(`\n  Open ${attempt.browserUrl}\n  ${c.dim('Waiting for One account sign-in in the browser…')}\n`);
+            if (o.browser)
+                (deps.openBrowser ?? defaultOpen)(attempt.browserUrl);
+            s = await completeLogin(auth, attempt);
+        }
+        finally {
+            attempt.close();
+        }
+        await store.set(s);
+        emit({ user: s.user, organization_id: s.organization_id, store: store.kind }, () => `${c.green('✓')} Signed in as ${c.bold(s.user?.email ?? s.user?.id ?? 'you')}${s.organization_id ? ` (${s.organization_id})` : ''}. Token saved to your ${store.kind === 'os-keychain' ? 'OS keychain' : store.kind}.`);
+    });
+    program.command('logout').description('Forget your saved login').action(async () => {
+        const had = await (await getStore()).clear();
+        emit({ logged_out: had }, () => had ? `${c.green('✓')} Signed out.` : 'You were not signed in.');
+    });
+    program.command('whoami').description('Show who you are signed in as').action(async () => {
+        const gen = await client();
+        const saved = await (await getStore().catch(() => undefined))?.get();
+        try {
+            const p = await gen.whoami();
+            emit({ ...p, user: saved?.user }, () => [
+                `${c.bold('Org')}        ${p.org}`, `${c.bold('Principal')}  ${p.principal ?? '-'}`,
+                `${c.bold('Via')}        ${p.kind}`, `${c.bold('Scopes')}     ${p.scopes.join(', ') || '-'}`,
+                ...(saved?.user?.email ? [`${c.bold('User')}       ${saved.user.email}`] : [])
+            ].join('\n'));
+        }
+        catch (e) {
+            if (!saved || g().apiKey || env.GENESIS_API_KEY)
+                throw e;
+            // Saved login exists but One account verify isn't reachable yet (auth-v4-backend PR #30 not deployed).
+            emit({ user: saved.user, organization_id: saved.organization_id, verified: false, reason: e.message }, () => `${c.bold('User')}  ${saved.user?.email ?? saved.user?.id}\n${c.bold('Org')}   ${saved.organization_id ?? '-'}\n${c.yellow('!')} ${c.dim('From your saved login; One account verify unavailable: ' + e.message)}`);
+        }
+    });
+    const orgs = program.command('orgs').description('Your organizations');
+    orgs.command('list', { isDefault: true }).description('Show your current organization').action(async () => {
+        const s = await (await getStore()).get();
+        if (!s)
+            throw new Error('Not signed in. Run `genesis login`.');
+        const rows = s.organization_id ? [{ id: s.organization_id, current: '*' }] : [];
+        emit({ current: s.organization_id ?? null, organizations: rows }, () => `${table(rows, ['id', 'current'])}\n${c.dim('Listing every org you belong to needs a One account memberships endpoint (not built yet). Switch with `genesis orgs switch <org_id>`.')}`);
+    });
+    orgs.command('switch <org_id>').description('Switch your login to another organization').action(async (id) => {
+        const store = await getStore();
+        const s = await store.get();
+        if (!s)
+            throw new Error('Not signed in. Run `genesis login`.');
+        const n = await selectSavedContext(auth, store, { organizationId: id }, deps.signal);
+        emit({ organization_id: n.organization_id }, () => `${c.green('✓')} Now using ${c.bold(n.organization_id ?? id)}.`);
+    });
+    const selection = program.command('context').description('Select an authorized Genesis organization, workspace and project');
+    selection.command('select').requiredOption('--organization <id>').requiredOption('--workspace <id>').requiredOption('--project <id>')
+        .description('Bind the saved human login to a Console Sandbox context and atomically replace its credentials')
+        .action(async (options) => {
+        const target = { organizationId: options.organization, workspaceId: options.workspace, projectId: options.project,
+            platformId: 'pf_console', fleetId: null, environmentId: 'sandbox' };
+        const next = await selectSavedContext(auth, await getStore(), target, deps.signal);
+        emit({ principal_id: next.auth?.principal_id, ...target }, () => `Selected ${target.organizationId} / ${target.workspaceId} / ${target.projectId} (Sandbox).`);
+    });
+    // ---- keys ------------------------------------------------------------
+    const keys = program.command('keys').description('Org API keys (One account / WorkOS)');
+    keys.command('list').action(async () => {
+        const gen = await client();
+        const org = await orgId(gen);
+        const r = await gen.keys.list(org);
+        emit(r, () => table(r.data, ['id', 'name', 'obfuscated_value', 'scopes', 'last_used_at', 'expires_at']));
+    });
+    keys.command('create <name>').description('Create a key (shown once), or with --blinds hand it straight to Blinds so nobody ever sees it')
+        .option('--scopes <list>', 'comma-separated scopes, e.g. hives:read,relays:write')
+        .option('--blinds', 'store the key in Blinds; the raw key is never shown to anyone')
+        .option('--expires <iso>', 'expiry, e.g. 2027-01-01T00:00:00Z')
+        .action(async (name, o) => {
+        const gen = await client();
+        const org = await orgId(gen);
+        const k = await gen.keys.create(org, { name, custody: o.blinds ? 'blinds' : 'reveal', ...(o.scopes ? { scopes: o.scopes.split(',').map((x) => x.trim()).filter(Boolean) } : {}), ...(o.expires ? { expires_at: o.expires } : {}) });
+        emit(k, () => o.blinds
+            ? `${c.green('✓')} Key ${c.bold(k.id)} created and stored in Blinds as ${c.bold(String(k.blinds_credential_ref))}.\n  ${c.dim('No one, human or agent, will ever see the raw key.')}`
+            : `${c.green('✓')} Key ${c.bold(k.id)} created. Copy it now; it won't be shown again:\n\n  ${c.bold(String(k.value))}\n`);
+    });
+    keys.command('revoke <key_id>').action(async (id) => {
+        const gen = await client();
+        await gen.keys.revoke(id);
+        emit({ revoked: id }, () => `${c.green('✓')} Revoked ${id} ${c.dim('(takes effect within 60s)')}`);
+    });
+    // ---- foundry ---------------------------------------------------------
+    const foundry = program.command('foundry').description('Foundry: models and inference');
+    const foundryBilling = foundry.command('billing').description('Current organization’s native TEST billing; original One account human login required');
+    foundryBilling.command('profile').action(async () => out.log(JSON.stringify(await (await client()).foundry.billing.profile({ signal: deps.signal }), null, 2)));
+    foundryBilling.command('ensure').requiredOption('--operation-key <key>', 'Persisted operation key; reconcile unknown outcomes before retrying').action(async (o) => out.log(JSON.stringify(await (await client()).foundry.billing.ensureProfile(o.operationKey, { signal: deps.signal }), null, 2)));
+    foundryBilling.command('checkout').requiredOption('--purchase-key <key>', 'Persisted purchase key; server controls the TEST amount').action(async (o) => out.log(JSON.stringify(await (await client()).foundry.billing.checkoutCredits(o.purchaseKey, { signal: deps.signal }), null, 2)));
+    foundryBilling.command('balance').action(async () => out.log(JSON.stringify(await (await client()).foundry.billing.creditBalance({ signal: deps.signal }), null, 2)));
+    foundry.command('models').action(async () => {
+        const r = await (await client()).foundry.models.list();
+        const rows = listOf(r).map((m) => ({ id: m.id, owned_by: m.owned_by ?? m.provider ?? '' }));
+        emit(r, () => table(rows, ['id', 'owned_by']));
+    });
+    foundry.command('chat <prompt...>').description('Chat with a model').option('-m, --model <model>', 'model id', env.GENESIS_MODEL)
+        .option('--no-stream', 'wait for the full answer').option('-s, --system <text>', 'system prompt')
+        .action(async (prompt, o) => {
+        if (!o.model)
+            throw new Error('Pick a model with --model (see `genesis foundry models`) or set GENESIS_MODEL.');
+        const gen = await client();
+        const messages = [...(o.system ? [{ role: 'system', content: o.system }] : []), { role: 'user', content: prompt.join(' ') }];
+        if (o.stream && !g().json) {
+            for await (const d of gen.foundry.chatStream({ model: o.model, messages }))
+                process.stdout.write(d);
+            process.stdout.write('\n');
+            return;
+        }
+        const r = await gen.foundry.chat({ model: o.model, messages });
+        emit(r, () => r.choices?.[0]?.message?.content ?? JSON.stringify(r));
+    });
+    registerMinds(program, client, data => emit(data, () => JSON.stringify(data, null, 2)), async () => new Genesis({
+        apiKey: g().apiKey ?? env.GENESIS_API_KEY, token: env.GENESIS_TOKEN, baseUrl: g().baseUrl ?? env.GENESIS_BASE_URL,
+        routing: g().direct || env.GENESIS_ROUTING === 'direct' ? 'direct' : 'gateway', fetch: f,
+    }), deps.signal, async () => {
+        if (g().org !== undefined)
+            throw new Error('Minds owner commands use the selected Console organization; --org is not supported.');
+        return client();
+    });
+    const hivesClient = () => client(true);
+    // ---- hives -----------------------------------------------------------
+    const hives = program.command('hives').description('Hives: projects, secrets, deployments, functions, schedules and activity');
+    registerHivesOperations(hives, { client: hivesClient, emit, readRequest: deps.readHivesRequest });
+    const deployments = hives.command('deployments').description('Real WASM artifacts and deployment lifecycle');
+    const emitDeployment = (data) => emit(data, () => table(data && typeof data === 'object' && !Array.isArray(data) && !('data' in data) ? [data] : listOf(data), ['id', 'version', 'status', 'module_hash', 'created_at']));
+    deployments.command('list <project_id>')
+        .option('--page <number>', 'page (1–10000)').option('--per-page <number>', 'items (1–100)')
+        .option('--status <status>', 'persisted deployment status').option('--author <id>', 'creator ID')
+        .action(async (project, o) => {
+        emitDeployment(await (await hivesClient()).hives.deployments.list(project, {
+            page: positiveInteger(o.page, '--page', 10000), per_page: positiveInteger(o.perPage, '--per-page', 100), status: o.status, author: o.author,
+        }));
+    });
+    deployments.command('get <project_id> <deployment_id>')
+        .action(async (project, deployment) => emitDeployment(await (await hivesClient()).hives.deployments.get(project, deployment)));
+    deployments.command('upload <project_id> <wasm_file>').description('Upload actual WASM bytes; Git options are labels only')
+        .option('--git-sha <sha>', 'commit label (7–40 characters)').option('--git-branch <branch>', 'branch label').option('--git-message <message>', 'commit label')
+        .action(async (project, path, o) => {
+        const file = await (deps.readWasmFile ?? readWasmFile)(path);
+        emitDeployment(await (await hivesClient()).hives.deployments.upload(project, file, {
+            filename: basename(path), git_sha: o.gitSha, git_branch: o.gitBranch, git_message: o.gitMessage,
+        }));
+    });
+    deployments.command('reuse <project_id> <module_hash>').description('Deploy a real artifact already owned by this org and project')
+        .option('--no-auto-promote', 'keep the completed deployment ready for explicit promotion')
+        .action(async (project, module_hash, o) => {
+        if (!/^[a-f0-9]{64}$/.test(module_hash))
+            throw new Error('module_hash must be the lowercase SHA-256 returned by a real Hives upload.');
+        emitDeployment(await (await hivesClient()).hives.deployments.create(project, { module_hash, auto_promote: o.autoPromote }));
+    });
+    deployments.command('promote <project_id> <deployment_id>')
+        .action(async (project, deployment) => emitDeployment(await (await hivesClient()).hives.deployments.promote(project, deployment)));
+    deployments.command('rollback <project_id> <deployment_id>').description('Activate this owned previous deployment')
+        .option('--reason <text>', 'audit reason')
+        .action(async (project, deployment, o) => emitDeployment(await (await hivesClient()).hives.deployments.rollback(project, deployment, { reason: o.reason })));
+    deployments.command('cancel <project_id> <deployment_id>')
+        .action(async (project, deployment) => emitDeployment(await (await hivesClient()).hives.deployments.cancel(project, deployment)));
+    deployments.command('stop <project_id> <deployment_id>').description('Stop the runtime; read its state before explicitly reconciling an uncertain result')
+        .action(async (project, deployment) => emitDeployment(await (await hivesClient()).hives.deployments.stop(project, deployment)));
+    deployments.command('delete <project_id> <deployment_id>').description('Delete a deployment that is not currently active')
+        .action(async (project, deployment) => { const result = await (await hivesClient()).hives.deployments.delete(project, deployment); emit(result, () => `Deleted deployment ${deployment}.`); });
+    deployments.command('logs <project_id> <deployment_id>').description('Read real persisted deployment logs')
+        .option('--page <number>', 'page (1–10000)').option('--per-page <number>', 'items (1–100)')
+        .option('--level <level>', 'minimum level').option('--search <text>', 'search log messages')
+        .option('--start <iso>', 'RFC 3339 start time').option('--end <iso>', 'RFC 3339 end time')
+        .action(async (project, deployment, o) => {
+        for (const timestamp of [o.start, o.end])
+            if (timestamp !== undefined && !Number.isFinite(Date.parse(timestamp)))
+                throw new Error('Log timestamps must use RFC 3339.');
+        const result = await (await hivesClient()).hives.deployments.logs(project, deployment, {
+            page: positiveInteger(o.page, '--page', 10000), per_page: positiveInteger(o.perPage, '--per-page', 100),
+            level: o.level, search: o.search, start: o.start, end: o.end,
+        });
+        emit(result, () => table(result.logs, ['timestamp', 'level', 'message', 'source']));
+    });
+    const emitFunction = (value) => emit(value, () => table(listOf(value).length ? listOf(value) : [value], ['id', 'name', 'status', 'handler', 'memory_mb', 'timeout_ms']));
+    const functions = hives.command('functions').description('Owned WASM functions; invocation returns the completed raw guest response');
+    functions.command('list <project_id>').option('--page <n>').option('--per-page <n>').option('--status <status>').option('--search <text>')
+        .action(async (project, o) => emitFunction(await (await hivesClient()).hives.functions.list(project, {
+        page: positiveInteger(o.page, '--page', 1000000), per_page: positiveInteger(o.perPage, '--per-page', 100), status: o.status, search: o.search,
+    })));
+    functions.command('get <project_id> <function_id>').action(async (project, id) => emitFunction(await (await hivesClient()).hives.functions.get(project, id)));
+    functions.command('create <project_id> <name> <module_hash>').option('--request-file <file>', 'JSON metadata and encrypted env overrides; input values are never printed')
+        .action(async (project, name, hash, o) => {
+        if (!/^[a-f0-9]{64}$/.test(hash))
+            throw new Error('Use a full lowercase artifact hash from an owned Hives upload.');
+        const extra = o.requestFile ? await readFunctionJson(o.requestFile, 256 * 1024) : {};
+        emitFunction(await (await hivesClient()).hives.functions.create(project, { ...extra, name, handler: `wasm://sha256/${hash}` }));
+    });
+    functions.command('update <project_id> <function_id>').requiredOption('--request-file <file>', 'JSON supported metadata/env/remove_env fields; values are never printed')
+        .action(async (project, id, o) => emitFunction(await (await hivesClient()).hives.functions.update(project, id, await readFunctionJson(o.requestFile, 256 * 1024))));
+    functions.command('delete <project_id> <function_id>').action(async (project, id) => {
+        const result = await (await hivesClient()).hives.functions.delete(project, id);
+        emit(result, () => `Deleted function ${id}.`);
+    });
+    function invocationCommand(command, kind) {
+        if (kind === 'functions')
+            command.option('--idempotency-key <key>', 'Persisted original invocation key; required by Genesis funding. Reuse it after uncertainty.');
+        command.description('Complete real guest execution; write exact bytes, including executed HTTP error bodies')
+            .option('--request-file <file>', 'JSON method/path/headers/body or body_base64')
+            .option('--body-file <file>', 'Exact binary body (up to 10 MiB; serialized guest envelope may reach its cap earlier)')
+            .option('--method <method>', 'guest HTTP method', 'POST').option('--path <path>', 'guest path including query', '/')
+            .option('--output <file>', 'create a new private file containing exact response bytes')
+            .action(async (project, id, o) => {
+            if (o.requestFile && o.bodyFile)
+                throw new Error('Choose --request-file or --body-file.');
+            if (g().json && o.output)
+                throw new Error('Choose --json or --output.');
+            let request = o.requestFile ? await readFunctionJson(o.requestFile, MAX_FUNCTION_JSON_BYTES) : { method: o.method, path: o.path };
+            if (o.bodyFile)
+                request.body_base64 = Buffer.from(await readFunctionFile(o.bodyFile, MAX_FUNCTION_BODY_BYTES)).toString('base64');
+            const response = await (await hivesClient()).hives[kind].invoke(project, id, request, { idempotencyKey: o.idempotencyKey });
+            const bytes = await hivesResponseBytes(response);
+            if (g().json)
+                out.log(JSON.stringify({ status: response.status, headers: Object.fromEntries(response.headers), body_base64: Buffer.from(bytes).toString('base64') }));
+            else {
+                out.err(JSON.stringify({ status: response.status, headers: Object.fromEntries(response.headers), bytes: bytes.length }));
+                if (o.output)
+                    await (deps.writeOutputFile ?? writeFunctionOutput)(o.output, bytes);
+                else
+                    (deps.writeBytes ?? ((value) => { process.stdout.write(value); }))(bytes);
+            }
+        });
+    }
+    invocationCommand(functions.command('invoke <project_id> <function_id>'), 'functions');
+    invocationCommand(deployments.command('invoke <project_id> <deployment_id>'), 'deployments');
+    const operations = functions.command('operations').description('Read or release the original funding operation without replaying the guest');
+    operations.command('get <project_id> <function_id> <operation_id>').action(async (project, fn, operation) => {
+        const result = await (await hivesClient()).hives.functions.operations.get(project, fn, operation);
+        emit(result, () => JSON.stringify(result, null, 2));
+    });
+    operations.command('release <project_id> <function_id> <operation_id>').description('Release an unused reservation only when the backend proves no guest was dispatched')
+        .action(async (project, fn, operation) => {
+        const result = await (await hivesClient()).hives.functions.operations.release(project, fn, operation);
+        emit(result, () => JSON.stringify(result, null, 2));
+    });
+    const secrets = hives.command('secrets').description('Project secrets encrypted with Genesis KMS');
+    const readInput = async (options, limit) => {
+        if (Boolean(options.file) === Boolean(options.stdin))
+            throw new Error('Choose exactly one input source: a file or --stdin. Secret values are not accepted as command arguments.');
+        return (deps.readSecretInput ?? readSecretInput)(options, limit);
+    };
+    const emitSecret = (data) => emit(data, () => table(listOf(data), ['id', 'name', 'version', 'description', 'updated_at']));
+    const context = hives.command('context').description('Explicit Hives binding for the current verified interactive Genesis selection');
+    context.command('get').action(async () => {
+        const r = await (await hivesClient()).hives.context.get();
+        emit(r, () => table([r.project], ['id', 'name', 'slug', 'kind', 'status']));
+    });
+    context.command('create <name>').option('--kind <kind>', 'worker|function|site|api', 'worker').option('--description <text>', 'project description')
+        .action(async (name, o) => {
+        if (!['worker', 'function', 'site', 'api'].includes(o.kind))
+            throw new Error('Choose worker, function, site or api.');
+        if (o.description && o.description.length > 500)
+            throw new Error('Project descriptions must contain at most 500 characters.');
+        const r = await (await hivesClient()).hives.context.set({ create: { name: projectName(name), kind: o.kind, description: o.description } });
+        emit(r, () => table([r.project], ['id', 'name', 'slug', 'kind', 'status']));
+    });
+    context.command('link <project_id>').description('Link a Hives project owned by the verified org')
+        .action(async (id) => { const r = await (await hivesClient()).hives.context.set({ link: { project_id: id } }); emit(r, () => table([r.project], ['id', 'name', 'slug', 'kind', 'status'])); });
+    context.command('detach').description('Remove this selection binding; retain the Hives project and its resources')
+        .action(async () => { const r = await (await hivesClient()).hives.context.detach(); emit(r, () => 'Detached selection; retained Hives project ' + r.hivesProjectId + '.'); });
+    const environment = hives.command('environment').description('Encrypted project environment; names-only metadata and explicit KMS reveal');
+    environment.command('list <project_id>').option('--page <number>', 'page number (1–10000)').option('--per-page <number>', 'items per page (1–100)')
+        .action(async (id, o) => {
+        const r = await (await hivesClient()).hives.environment.list(id, { page: positiveInteger(o.page, '--page', 10000), per_page: positiveInteger(o.perPage, '--per-page', 100) });
+        emit(r, () => table(r.data, ['name']));
+    });
+    environment.command('upsert <project_id>').description('Encrypt a flat JSON map; empty string values are allowed')
+        .option('--file <path>', 'UTF-8 JSON input file').option('--stdin', 'read JSON from stdin')
+        .action(async (id, o) => {
+        const text = await readInput(o, 2 * 1024 * 1024);
+        let body;
+        try {
+            body = JSON.parse(text);
+        }
+        catch {
+            throw new Error('Environment input must be a flat JSON map of names to string values.');
+        }
+        const r = await (await hivesClient()).hives.environment.upsert(id, body);
+        emit(r, () => table(r.updated, ['name']));
+    });
+    environment.command('reveal <project_id> <key>').description('Explicit audit-logged environment reveal; requires --stdout')
+        .option('--stdout', 'write sensitive plaintext to stdout (avoid retained output)')
+        .action(async (id, key, o) => {
+        if (!o.stdout)
+            throw new Error('Environment reveal requires --stdout. Avoid logging or retaining the plaintext.');
+        const r = await (await hivesClient()).hives.environment.reveal(id, key);
+        emit(r, () => r.value);
+    });
+    secrets.command('list <project_id>').description('List secret metadata without values')
+        .option('--page <number>', 'page number (1–10000)').option('--per-page <number>', 'items per page (1–100)')
+        .action(async (id, o) => {
+        const q = { page: positiveInteger(o.page, '--page', 10000), per_page: positiveInteger(o.perPage, '--per-page', 100) };
+        emitSecret(await (await hivesClient()).hives.secrets.list(id, q));
+    });
+    secrets.command('get <project_id> <secret_id>').description('Inspect secret metadata without its value')
+        .action(async (project, secret) => {
+        const r = await (await hivesClient()).hives.secrets.get(project, secret);
+        emit(r, () => table([r], ['id', 'name', 'version', 'description', 'updated_at']));
+    });
+    secrets.command('create <project_id> <name>').description('Create a secret; plaintext is read from a file or stdin')
+        .option('--value-file <path>', 'UTF-8 file containing the value').option('--stdin', 'read value from stdin')
+        .option('--description <text>', 'description (up to 500 characters)')
+        .action(async (project, name, o) => {
+        const body = validateSecret({ name, value: await readInput({ file: o.valueFile, stdin: o.stdin }, 65536), description: o.description });
+        const r = await (await hivesClient()).hives.secrets.create(project, body);
+        emit(r, () => table([r], ['id', 'name', 'version']));
+    });
+    secrets.command('update <project_id> <secret_id>').description('Replace a secret value, creating a new version')
+        .option('--value-file <path>', 'UTF-8 file containing the new value').option('--stdin', 'read value from stdin')
+        .action(async (project, secret, o) => {
+        const value = validateSecretValue(await readInput({ file: o.valueFile, stdin: o.stdin }, 65536));
+        const r = await (await hivesClient()).hives.secrets.update(project, secret, { value });
+        emit(r, () => table([r], ['id', 'name', 'version']));
+    });
+    secrets.command('delete <project_id> <secret_id>').description('Delete a secret in your authenticated org')
+        .action(async (project, secret) => { const r = await (await hivesClient()).hives.secrets.delete(project, secret); emit(r, () => `Deleted secret ${secret}.`); });
+    secrets.command('reveal <project_id> <secret_id>').description('Explicit, audit-logged plaintext reveal; requires --stdout')
+        .option('--stdout', 'write sensitive plaintext to stdout (avoid logs and retained output)')
+        .action(async (project, secret, o) => {
+        if (!o.stdout)
+            throw new Error('Reveal requires --stdout. This writes sensitive plaintext to your terminal or pipe; avoid logging or retaining it.');
+        const r = await (await hivesClient()).hives.secrets.reveal(project, secret);
+        emit(r, () => r.value);
+    });
+    secrets.command('bulk <project_id>').description('PUT a JSON array of secret names and values; existing names receive new versions')
+        .option('--file <path>', 'UTF-8 JSON input file').option('--stdin', 'read JSON from stdin')
+        .action(async (project, o) => {
+        const batch = parseSecretBatch(await readInput(o, 256 * 1024));
+        const r = await (await hivesClient()).hives.secrets.bulkUpsert(project, batch);
+        emit(r, () => table(r.secrets, ['id', 'name', 'version']));
+    });
+    const projects = hives.command('projects').description('Hives projects');
+    projects.command('list', { isDefault: true }).option('--search <text>', 'filter by project name')
+        .option('--page <number>', 'page number (1–10000)').option('--per-page <number>', 'items per page (1–100)')
+        .action(async (o) => {
+        const r = await (await hivesClient()).hives.projects.list({ search: o.search,
+            page: positiveInteger(o.page, '--page', 10000), per_page: positiveInteger(o.perPage, '--per-page', 100) });
+        emit(r, () => table(listOf(r), ['id', 'name', 'slug', 'region', 'total_deployments', 'active_instances']));
+    });
+    projects.command('get <project_id>').action(async (id) => {
+        const r = await (await hivesClient()).hives.projects.get(id);
+        emit(r, () => JSON.stringify(r, null, 2));
+    });
+    projects.command('create <name>').description('Create a project in your authenticated org')
+        .option('--kind <kind>', 'worker, function, site or api', 'worker')
+        .option('--description <text>', 'project description (up to 500 characters)')
+        .action(async (name, o) => {
+        if (!['worker', 'function', 'site', 'api'].includes(o.kind))
+            throw new Error('--kind must be worker, function, site or api.');
+        if (o.description && o.description.length > 500)
+            throw new Error('--description must be at most 500 characters.');
+        const r = await (await hivesClient()).hives.projects.create({ name: projectName(name), kind: o.kind,
+            ...(o.description === undefined ? {} : { description: o.description }) });
+        emit(r, () => table([r], ['id', 'name', 'slug', 'status']));
+    });
+    projects.command('delete <project_id>').description('Delete a project in your authenticated org')
+        .action(async (id) => { const r = await (await hivesClient()).hives.projects.delete(id); emit(r ?? { deleted: id }, () => `Deleted project ${id}.`); });
+    projects.command('rename <project_id> <name>').description('Rename a project in your authenticated org')
+        .action(async (id, name) => {
+        const r = await (await hivesClient()).hives.projects.update(id, { name: projectName(name) });
+        emit(r, () => table([r], ['id', 'name', 'slug', 'status']));
+    });
+    projects.command('activity <project_id>').description('Read persisted project activity')
+        .option('--action <action>', 'filter by action')
+        .option('--actor-type <type>', 'filter by actor type')
+        .option('--resource-type <type>', 'filter by resource type')
+        .option('--since <timestamp>', 'inclusive start timestamp in ISO 8601')
+        .option('--until <timestamp>', 'inclusive end timestamp in ISO 8601')
+        .option('--page <number>', 'page number (1–10000)')
+        .option('--per-page <number>', 'items per page (1–100)')
+        .action(async (id, o) => {
+        for (const [option, value] of [['--since', o.since], ['--until', o.until]]) {
+            if (value !== undefined && (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/.test(value) || !Number.isFinite(Date.parse(value)))) {
+                throw new Error(`${option} must be an ISO 8601 timestamp.`);
+            }
+        }
+        const r = await (await hivesClient()).hives.projects.activity(id, { action: o.action,
+            actor_type: o.actorType, resource_type: o.resourceType, since: o.since, until: o.until,
+            page: positiveInteger(o.page, '--page', 10000), per_page: positiveInteger(o.perPage, '--per-page', 100) });
+        emit(r, () => table(listOf(r), ['created_at', 'action', 'actor_id', 'resource_type', 'resource_name']));
+    });
+    // ---- relays ----------------------------------------------------------
+    const relays = program.command('relays').description('Relays: DNS zones and records');
+    registerRelaysEnrollment(relays, client, emit);
+    relays.command('zones').description('List DNS zones').option('--search <q>').action(async (o) => {
+        const r = await (await client()).relays.zones.list(o.search ? { search: o.search } : {});
+        emit(r, () => table((r.zones ?? []), ['name', 'type', 'record_count', 'dnssec_enabled', 'status']));
+    });
+    relays.command('zone <zone>').description('Read one DNS zone').action(async (zone) => {
+        const result = await (await client()).relays.zones.get(zone);
+        emit(result, () => JSON.stringify(result, null, 2));
+    });
+    relays.command('dnssec <zone>').description('Read DNSSEC status and authoritative key availability').action(async (zone) => {
+        const result = await (await client()).relays.zones.dnssec(zone);
+        emit(result, () => JSON.stringify(result, null, 2));
+    });
+    const records = relays.command('records').description('DNS records in a zone');
+    records.command('list <zone>', { isDefault: true }).option('--type <type>').action(async (zone, o) => {
+        const r = await (await client()).relays.records.list(zone, o.type ? { type: o.type } : {});
+        emit(r, () => table((r.records ?? []), ['id', 'name', 'type', 'content', 'ttl']));
+    });
+    records.command('add <zone> <name> <type> <content>').option('--ttl <seconds>', 'TTL', '3600').action(async (zone, name, type, content, o) => {
+        const r = await (await client()).relays.records.create(zone, { name, type: type.toUpperCase(), content, ttl: Number(o.ttl) });
+        emit(r, () => `${c.green('✓')} Added ${type.toUpperCase()} ${name} → ${content} in ${zone}${r.id ? ` (id ${r.id})` : ''}`);
+    });
+    records.command('rm <zone> <record_id>').action(async (zone, id) => {
+        await (await client()).relays.records.delete(zone, Number(id));
+        emit({ deleted: Number(id) }, () => `${c.green('✓')} Deleted record ${id} from ${zone}`);
+    });
+    addHenryCommands(program, client, value => out.log(JSON.stringify(value, null, 2)));
+    registerFleets(program, client, (data) => emit(data, () => JSON.stringify(data, null, 2)));
+    registerFlocks(program, client, (data) => emit(data, () => JSON.stringify(data, null, 2)), env);
+    registerBeacons(program, client, emit);
+    // ---- status ----------------------------------------------------------
+    program.command('status').description('Live state of each Genesis service, from the gateway (GET /v1/status)').action(async () => {
+        const configured = g().baseUrl ?? env.GENESIS_BASE_URL ?? DEFAULT_BASE_URL;
+        // Same transport rule as the SDK client (https, or http only on exact loopback hosts).
+        try {
+            requireSecureUrl(configured, 'base URL');
+        }
+        catch (e) {
+            throw new Error(`Refusing base URL ${safe(configured)}: ${safe(e.message)}`);
+        }
+        const base = new URL(configured);
+        const url = `${base.href.replace(/\/+$/, '')}/v1/status`;
+        let response;
+        try {
+            response = await f(url, { method: 'GET', headers: { accept: 'application/json', 'user-agent': 'genesis-cli/0.1.13' }, signal: AbortSignal.timeout(15_000) });
+        }
+        catch (e) {
+            throw new Error(`Gateway unreachable at ${safe(url)}: ${safe(e.message)}`);
+        }
+        if (!response.ok)
+            throw new Error(`Gateway status check failed: GET ${safe(url)} returned HTTP ${response.status}`);
+        const report = await response.json().catch(() => undefined);
+        if (!report || !Array.isArray(report.services))
+            throw new Error(`Gateway status check failed: GET ${safe(url)} did not return a service list`);
+        const rows = report.services;
+        emit(report, () => [
+            table(rows.map((s) => ({ service: s.service, state: s.state, http_status: s.http_status, latency_ms: s.latency_ms, reason: s.reason })), ['service', 'state', 'http_status', 'latency_ms', 'reason']),
+            ...(report.checked_at ? [c.dim(`checked ${safe(report.checked_at)} via ${safe(url)}`)] : []),
+        ].join('\n'));
+    });
+    return program;
+}
+export async function main(argv, deps = {}) {
+    const out = deps.out ?? stdio;
+    const program = buildProgram(deps);
+    try {
+        await program.parseAsync(argv);
+        return 0;
+    }
+    catch (e) {
+        if (e instanceof CommanderError)
+            return e.exitCode;
+        const json = program.opts().json;
+        if (e instanceof GenesisError) {
+            if (json)
+                out.err(JSON.stringify({ error: { type: e.type, status: e.status, message: e.message, request_id: e.requestId, ...errorCatalog(e),
+                        ...((e instanceof HivesOperationError || e instanceof HivesQueueOperationError) ? { operation: e.operation } : {}),
+                        ...(e.operationId && isMindsOperation(e.operationId) && errorOutcome(e.body) === 'unknown' ? { outcome: 'unknown' } : {}),
+                        ...(e instanceof MindsAgentError || e instanceof MindsOwnerError ? { code: e.code, ...(e instanceof MindsAgentError ? { dpop_nonce: e.dpopNonce } : {}),
+                            ...(errorOutcome(e.body) !== undefined ? { outcome: errorOutcome(e.body) } : {}) } : {}) } }));
+            else
+                out.err(`${c.red('✗')} ${safe(e.message)}${(e instanceof HivesOperationError || e instanceof HivesQueueOperationError) ? ` Operation: ${safe(e.operation.operation_id)} (${safe(e.operation.state)}).` : ''}${e.status ? c.dim(` (${e.status} ${safe(e.type)}${e.requestId ? `, request ${safe(e.requestId)}` : ''})`) : ''}`);
+            return 1;
+        }
+        const msg = e.message ?? String(e);
+        const net = /fetch failed|ENOTFOUND|ECONNREFUSED/.test(msg + (e.cause?.code ?? ''));
+        out.err(json ? JSON.stringify({ error: { type: net ? 'network' : 'error', message: msg } })
+            : `${c.red('✗')} ${net ? `Could not reach the Genesis API gateway (${safe(msg)}). Try --direct to call service hosts directly.` : safe(msg)}`);
+        return 1;
+    }
+}