@onesi/genesis-cli 0.0.1-stage → 0.2.0

package/dist/relays-commands/monitoring.js

@@ -0,0 +1,41 @@
+/** `genesis relays ...` words for the monitoring family (openapi/specs/relays/monitoring.openapi.yaml). */
+export const monitoringCommands = {
+    'monitors list': 'relays_listMonitors',
+    'monitors create': 'relays_createMonitor',
+    'monitors get': 'relays_getMonitor',
+    'monitors update': 'relays_updateMonitor',
+    'monitors delete': 'relays_deleteMonitor',
+    'monitors checks': 'relays_listMonitorChecks',
+    'monitors pause': 'relays_pauseMonitor',
+    'monitors resume': 'relays_resumeMonitor',
+    'monitors test': 'relays_testMonitor',
+    'monitors slos list': 'relays_listMonitorSlos',
+    'monitors slos create': 'relays_createMonitorSlo',
+    'monitors slos burn-rate': 'relays_getMonitorSloBurnRates',
+    'incidents list': 'relays_listIncidents',
+    'incidents create': 'relays_createIncident',
+    'incidents analytics': 'relays_getIncidentAnalytics',
+    'incidents get': 'relays_getIncident',
+    'incidents update': 'relays_updateIncident',
+    'incidents delete': 'relays_deleteIncident',
+    'oncall coverage': 'relays_getOncallCoverage',
+    'oncall schedules list': 'relays_listOncallSchedules',
+    'oncall schedules create': 'relays_createOncallSchedule',
+    'oncall schedules get': 'relays_getOncallSchedule',
+    'oncall schedules update': 'relays_updateOncallSchedule',
+    'oncall schedules delete': 'relays_deleteOncallSchedule',
+    'status-pages list': 'relays_listStatusPages',
+    'status-pages create': 'relays_createStatusPage',
+    'status-pages get': 'relays_getStatusPage',
+    'status-pages update': 'relays_updateStatusPage',
+    'status-pages delete': 'relays_deleteStatusPage',
+    'status-pages components list': 'relays_listStatusPageComponents',
+    'status-pages components create': 'relays_createStatusPageComponent',
+    'status-pages components update': 'relays_updateStatusPageComponent',
+    'status-pages components delete': 'relays_deleteStatusPageComponent',
+    'status-pages component-groups delete': 'relays_deleteStatusPageComponentGroup',
+    'status-pages incidents list': 'relays_listStatusPageIncidents',
+    'status-pages incidents create': 'relays_createStatusPageIncident',
+    'status-pages subscribers list': 'relays_listStatusPageSubscribers',
+    'status-pages subscribers delete': 'relays_deleteStatusPageSubscriber',
+};

package/dist/relays-commands/telemetry.d.ts

@@ -0,0 +1,3 @@
+import type { OperationId } from '@onesi/genesis';
+/** `genesis relays ...` words for the telemetry family (openapi/specs/relays/telemetry.openapi.yaml). */
+export declare const telemetryCommands: Readonly<Record<string, OperationId>>;

package/dist/relays-commands/telemetry.js

@@ -0,0 +1,28 @@
+/** `genesis relays ...` words for the telemetry family (openapi/specs/relays/telemetry.openapi.yaml). */
+export const telemetryCommands = {
+    'logs list': 'relays_listLogs',
+    'logs patterns list': 'relays_listLogPatterns',
+    'logs patterns alert': 'relays_dispatchLogPatternAlerts',
+    'logs policies list': 'relays_listLogPatternPolicies',
+    'logs policies create': 'relays_createLogPatternPolicy',
+    'logs policies evaluate': 'relays_evaluateLogPatternPolicy',
+    'logs retention get': 'relays_getLogRetention',
+    'logs retention set': 'relays_setLogRetention',
+    'audit-logs list': 'relays_listAuditLogs',
+    'audit-logs export': 'relays_exportAuditLogs',
+    'traces list': 'relays_listTraces',
+    'analytics get': 'relays_getAnalytics',
+    'errors projects list': 'relays_listErrorProjects',
+    'errors projects create': 'relays_createErrorProject',
+    'errors events send': 'relays_ingestErrorEvent',
+    'errors issues list': 'relays_listErrorIssues',
+    'errors issues update': 'relays_updateErrorIssue',
+    'errors issues context': 'relays_getErrorIssueContext',
+    'errors integrations list': 'relays_listErrorIssueIntegrations',
+    'errors integrations link': 'relays_linkErrorIssueIntegration',
+    'errors artifacts list': 'relays_listErrorArtifacts',
+    'errors artifacts create': 'relays_createErrorArtifact',
+    'errors deployments list': 'relays_listErrorDeployments',
+    'errors deployments create': 'relays_createErrorDeployment',
+    'errors releases list': 'relays_listErrorReleases',
+};

package/dist/relays-commands/zones.d.ts

@@ -0,0 +1,5 @@
+import type { OperationId } from '@onesi/genesis';
+/** `genesis relays ...` words for the zones family (openapi/specs/relays/zones.openapi.yaml).
+ * DNSSEC disable is `disable-dnssec`, beside the hand-written `dnssec <zone>` read and the
+ * `create-zone` / `delete-zone` commands, so it does not shadow `dnssec <zone>`. */
+export declare const zonesCommands: Readonly<Record<string, OperationId>>;

package/dist/relays-commands/zones.js

@@ -0,0 +1,9 @@
+/** `genesis relays ...` words for the zones family (openapi/specs/relays/zones.openapi.yaml).
+ * DNSSEC disable is `disable-dnssec`, beside the hand-written `dnssec <zone>` read and the
+ * `create-zone` / `delete-zone` commands, so it does not shadow `dnssec <zone>`. */
+export const zonesCommands = {
+    'caa list': 'relays_listCaaRecords',
+    'caa create': 'relays_createCaaRecord',
+    'disable-dnssec': 'relays_disableDnssec',
+    'nameservers list': 'relays_listNameservers',
+};

package/dist/relays-enrollment.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+import type { Genesis } from '@onesi/genesis';
+export declare function registerRelaysEnrollment(relays: Command, client: () => Promise<Genesis>, emit: (value: unknown, pretty: () => string) => void): void;

package/dist/relays-enrollment.js

@@ -0,0 +1,7 @@
+export function registerRelaysEnrollment(relays, client, emit) {
+    const enrollment = relays.command('enrollment').description('Explicit empty Relays account for the current verified human selection');
+    for (const action of ['get', 'activate'])
+        enrollment.command(action).allowExcessArguments(false)
+            .description(action === 'get' ? 'Read status without creating an account' : 'Activate once; read status after any unconfirmed response')
+            .action(async () => { const value = await (await client()).relays.enrollment[action](); emit(value, () => JSON.stringify(value, null, 2)); });
+}

package/dist/runner.d.ts

@@ -0,0 +1,4 @@
+import type { Command } from 'commander';
+import type { Genesis } from '@onesi/genesis';
+/** Register only Runner commands. The authenticated credential determines org and subject. */
+export declare function registerRunner(program: Command, client: () => Promise<Genesis>, emit: (data: unknown, pretty: () => string) => void): void;

package/dist/runner.js

@@ -0,0 +1,57 @@
+/** Register only Runner commands. The authenticated credential determines org and subject. */
+export function registerRunner(program, client, emit) {
+    const runner = program.command('runner').description('Runner: agent task execution');
+    const output = (value) => emit(value, () => JSON.stringify(value, null, 2));
+    runner.command('permission-grant').description('Request only your current native human Sandbox execution permission; preserve operation/scope/expiry on retry')
+        .requiredOption('--organization <id>', 'current approved Life organization assertion')
+        .requiredOption('--project <id>', 'current approved project assertion')
+        .requiredOption('--workspace <id>', 'current approved workspace assertion')
+        .requiredOption('--operation-id <uuid>', 'stable canonical UUIDv4 for this immutable authorization operation')
+        .requiredOption('--request-id <uuid>', 'fresh canonical UUIDv4 correlation for this attempt')
+        .requiredOption('--expires-at-ms <ms>', 'exact retained future integer expiry, at most 30 minutes and current session/access expiry')
+        .action(async (o) => {
+        if (!/^[1-9]\d*$/.test(o.expiresAtMs) || !Number.isSafeInteger(Number(o.expiresAtMs)))
+            throw new TypeError('Runner permission expiry must be a positive safe integer literal');
+        const input = { schemaVersion: 1, organizationId: o.organization, projectId: o.project,
+            workspaceId: o.workspace, platformId: 'pf_console', fleetId: null, resourceEnvironment: 'sandbox',
+            operationId: o.operationId, requestId: o.requestId, expiresAtMs: Number(o.expiresAtMs) };
+        output(await (await client()).runner.permission.grant(input));
+    });
+    runner.command('catalog').description('Authorized workspaces and execution routes')
+        .action(async () => output(await (await client()).runner.catalog()));
+    const jobs = runner.command('jobs').description('Jobs belonging to your verified identity');
+    jobs.command('list', { isDefault: true }).description('Newest 100 jobs')
+        .action(async () => output(await (await client()).runner.jobs.list()));
+    jobs.command('start').description('Start a bounded task; refs must come from catalog')
+        .requiredOption('--task-id <id>', 'opaque task ID')
+        .requiredOption('--text <text>', 'task instructions (at most 32768 characters)')
+        .requiredOption('--workspace <ref>', 'authorized workspace key')
+        .requiredOption('--kind <kind>', 'external-harness or internal-model')
+        .requiredOption('--route <id>', 'authorized execution route')
+        .requiredOption('--idempotency-key <key>', 'stable key for retries of the same task')
+        .option('--duration-ms <ms>', 'maximum execution duration', '600000')
+        .option('--output-bytes <bytes>', 'maximum output size', '1048576')
+        .option('--max-events <count>', 'retained event limit', '200')
+        .action(async (o) => {
+        if (!['external-harness', 'internal-model'].includes(o.kind))
+            throw new TypeError('Runner kind must be external-harness or internal-model');
+        const body = {
+            task: { id: o.taskId, text: o.text }, workspaceRef: o.workspace,
+            executionRef: { kind: o.kind, routeId: o.route },
+            limits: { maxDurationMs: Number(o.durationMs), maxOutputBytes: Number(o.outputBytes), maxEvents: Number(o.maxEvents) },
+            idempotencyKey: o.idempotencyKey,
+        };
+        output(await (await client()).runner.jobs.start(body));
+    });
+    jobs.command('get <job_id>').description('Read the authoritative snapshot')
+        .action(async (id) => output(await (await client()).runner.jobs.get(id)));
+    jobs.command('events <job_id>').description('Read one event page; continue with nextAfterSeq while hasMore')
+        .option('--after-seq <seq>', 'exclusive event cursor', '0')
+        .action(async (id, o) => output(await (await client()).runner.jobs.events(id, Number(o.afterSeq))));
+    jobs.command('result <job_id>').description('Read the verified completed provider deliverable')
+        .action(async (id) => output(await (await client()).runner.jobs.result(id)));
+    jobs.command('cancel <job_id>').description('Request cancellation; then watch status and cleanupPending')
+        .action(async (id) => output(await (await client()).runner.jobs.cancel(id)));
+    jobs.command('delete <job_id>').description('Delete a finished job and its events (active or cleanup-pending jobs return E_JOB_ACTIVE)')
+        .action(async (id) => output(await (await client()).runner.jobs.delete(id)));
+}

package/dist/secret-input.d.ts

@@ -0,0 +1,14 @@
+export interface SecretInputOptions {
+    file?: string;
+    stdin?: boolean;
+}
+export interface SecretInput {
+    name: string;
+    value: string;
+    description?: string;
+}
+/** Read plaintext only from an explicitly selected file or stdin, never argv. */
+export declare function readSecretInput(options: SecretInputOptions, limit: number): Promise<string>;
+export declare function validateSecretValue(value: string): string;
+export declare function validateSecret(input: unknown): SecretInput;
+export declare function parseSecretBatch(text: string): SecretInput[];

package/dist/secret-input.js

@@ -0,0 +1,85 @@
+import { open } from 'node:fs/promises';
+/** Read plaintext only from an explicitly selected file or stdin, never argv. */
+export async function readSecretInput(options, limit) {
+    if (Boolean(options.file) === Boolean(options.stdin))
+        throw new Error('Choose exactly one input source: a file or --stdin. Secret values are not accepted as command arguments.');
+    const chunks = [];
+    let size = 0;
+    const append = (chunk) => {
+        size += chunk.byteLength;
+        if (size > limit)
+            throw new Error(`Secret input exceeds ${limit} UTF-8 bytes. Use a smaller value or batch.`);
+        chunks.push(chunk);
+    };
+    if (options.file) {
+        let file;
+        try {
+            file = await open(options.file, 'r');
+        }
+        catch {
+            throw new Error('Could not open the secret input file. Check its path and permissions.');
+        }
+        try {
+            for (;;) {
+                const buffer = new Uint8Array(Math.min(8192, limit + 1));
+                const { bytesRead } = await file.read(buffer, 0, buffer.length, null);
+                if (!bytesRead)
+                    break;
+                append(buffer.subarray(0, bytesRead));
+            }
+        }
+        finally {
+            await file.close();
+        }
+    }
+    else {
+        for await (const chunk of process.stdin)
+            append(typeof chunk === 'string' ? new TextEncoder().encode(chunk) : chunk);
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    try {
+        return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    }
+    catch {
+        throw new Error('Secret input must be valid UTF-8 text.');
+    }
+}
+export function validateSecretValue(value) {
+    if (!value.length || new TextEncoder().encode(value).length > 65536)
+        throw new Error('Secret values must contain 1–65,536 UTF-8 bytes.');
+    return value;
+}
+export function validateSecret(input) {
+    if (!input || typeof input !== 'object')
+        throw new Error('Each secret needs a name and value.');
+    const { name, value, description } = input;
+    if (typeof name !== 'string' || name.length > 255 || !/^[A-Za-z][A-Za-z0-9_]*$/.test(name))
+        throw new Error('Secret names must start with a letter and contain only letters, numbers and underscores (up to 255 characters).');
+    if (typeof value !== 'string')
+        throw new Error('Each secret value must be a string.');
+    if (description !== undefined && description !== null && (typeof description !== 'string' || description.length > 500))
+        throw new Error('Secret descriptions must contain at most 500 characters.');
+    return { name, value: validateSecretValue(value), ...(typeof description === 'string' ? { description } : {}) };
+}
+export function parseSecretBatch(text) {
+    let data;
+    try {
+        data = JSON.parse(text);
+    }
+    catch {
+        throw new Error('Bulk input must be a JSON array with secret name and value fields.');
+    }
+    if (!Array.isArray(data) || !data.length)
+        throw new Error('Bulk input must be a non-empty JSON array.');
+    const batch = data.map(validateSecret);
+    if (new Set(batch.map((secret) => secret.name)).size !== batch.length)
+        throw new Error('Each secret name must appear once in a bulk update.');
+    if (new TextEncoder().encode(JSON.stringify(batch)).length > 256 * 1024)
+        throw new Error('Bulk input must fit within 256 KiB. Split it into smaller batches.');
+    return batch;
+}

package/dist/store.d.ts

@@ -0,0 +1,39 @@
+/** Saved `genesis login`: kept in the OS keychain (macOS Keychain, Windows Credential Manager, libsecret). */
+export interface SavedLogin {
+    access_token: string;
+    refresh_token?: string;
+    user?: {
+        id: string;
+        email?: string;
+        first_name?: string | null;
+        last_name?: string | null;
+    };
+    organization_id?: string;
+    /** epoch seconds, from the access token's exp claim */
+    expires_at?: number;
+    client_id: string;
+    /** One account provenance: the native bridge, or the RFC 8628 device grant. Legacy raw AuthKit credentials are never reused. */
+    auth?: {
+        kind: 'lifeid-bridge';
+        issuer: string;
+        audience: string;
+        product_id: string;
+        redirect_uri: string;
+        principal_id: string;
+        session_id: string;
+    } | {
+        kind: 'lifeid-device';
+        issuer: string;
+        client_id: string;
+        principal_id: string;
+        session_id: string;
+    };
+}
+export interface CredentialStore {
+    get(): Promise<SavedLogin | undefined>;
+    set(v: SavedLogin): Promise<void>;
+    clear(): Promise<boolean>;
+    readonly kind: string;
+}
+export declare function keychainStore(): Promise<CredentialStore>;
+export declare function memoryStore(initial?: SavedLogin): CredentialStore;

package/dist/store.js

@@ -0,0 +1,33 @@
+const SERVICE = 'one.life.genesis';
+const ACCOUNT = 'default';
+export async function keychainStore() {
+    let Entry;
+    try {
+        ({ Entry } = await import('@napi-rs/keyring'));
+    }
+    catch {
+        throw new Error('OS keychain is unavailable (@napi-rs/keyring not installed). Use GENESIS_API_KEY instead.');
+    }
+    const entry = new Entry(SERVICE, ACCOUNT);
+    return {
+        kind: 'os-keychain',
+        async get() { try {
+            const s = entry.getPassword();
+            return s ? JSON.parse(s) : undefined;
+        }
+        catch {
+            return undefined;
+        } },
+        async set(v) { entry.setPassword(JSON.stringify(v)); },
+        async clear() { try {
+            return entry.deletePassword();
+        }
+        catch {
+            return false;
+        } },
+    };
+}
+export function memoryStore(initial) {
+    let v = initial;
+    return { kind: 'memory', async get() { return v; }, async set(x) { v = x; }, async clear() { const had = !!v; v = undefined; return had; } };
+}

package/dist/wasm-input.d.ts

@@ -0,0 +1,2 @@
+/** Read only the explicitly requested regular file, with a bounded allocation. */
+export declare function readWasmFile(path: string): Promise<Blob>;

package/dist/wasm-input.js

@@ -0,0 +1,31 @@
+import { open } from 'node:fs/promises';
+import { MAX_WASM_BYTES } from '@onesi/genesis';
+/** Read only the explicitly requested regular file, with a bounded allocation. */
+export async function readWasmFile(path) {
+    let file;
+    try {
+        file = await open(path, 'r');
+    }
+    catch {
+        throw new Error('Could not open the WASM file. Check its path and permissions.');
+    }
+    try {
+        const stat = await file.stat();
+        if (!stat.isFile() || stat.size < 4 || stat.size > MAX_WASM_BYTES)
+            throw new Error('Choose a regular WASM file of 4 bytes to 10 MiB.');
+        const bytes = new Uint8Array(MAX_WASM_BYTES + 1);
+        let size = 0;
+        for (;;) {
+            const { bytesRead } = await file.read(bytes, size, bytes.length - size, null);
+            if (!bytesRead)
+                break;
+            size += bytesRead;
+            if (size > MAX_WASM_BYTES)
+                throw new Error('WASM file exceeds 10 MiB.');
+        }
+        return new Blob([bytes.slice(0, size)], { type: 'application/wasm' });
+    }
+    finally {
+        await file.close();
+    }
+}

package/package.json

@@ -1 +1,54 @@
-{"name":"@onesi/genesis-cli","version":"0.0.1-stage","description":"Reserved for the OneOS Genesis SDK"}
+{
+  "name": "@onesi/genesis-cli",
+  "version": "0.2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/l1felabs/genesis-api.git",
+    "directory": "packages/cli"
+  },
+  "description": "genesis: one CLI for every Genesis service",
+  "type": "module",
+  "bin": {
+    "genesis": "bin/genesis.js"
+  },
+  "keywords": [
+    "genesis",
+    "oneos",
+    "sdk",
+    "cli",
+    "mcp",
+    "model-context-protocol",
+    "ai-agents",
+    "api"
+  ],
+  "author": "One Superintelligence, Inc.",
+  "homepage": "https://os.one.ml/docs",
+  "engines": {
+    "node": ">=20.19"
+  },
+  "files": [
+    "bin",
+    "dist"
+  ],
+  "dependencies": {
+    "commander": "^14.0.0",
+    "undici": "6.29.0",
+    "@onesi/genesis": "0.2.0"
+  },
+  "optionalDependencies": {
+    "@napi-rs/keyring": "^1.2.0"
+  },
+  "exports": {
+    "./auth": {
+      "types": "./dist/auth.d.ts",
+      "default": "./dist/auth.js"
+    },
+    "./store": {
+      "types": "./dist/store.d.ts",
+      "default": "./dist/store.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json"
+  }
+}