@onesi/genesis-cli 0.0.1-stage → 0.2.0

package/dist/index.js

@@ -0,0 +1,872 @@
+import { registerMinds } from './minds.js';
+import { registerRelaysEnrollment } from './relays-enrollment.js';
+import { RELAYS_COMMANDS } from './relays-commands/index.js';
+import { registerBeacons } from './beacons.js';
+import { registerDials } from './dials.js';
+import { registerIamDirectory } from './iam-directory.js';
+import { registerOperationCommands, registerProducts } from './products.js';
+import { registerOrgs } from './orgs.js';
+import { Command, CommanderError } from 'commander';
+import { Genesis, GenesisError, errorCatalog, errorOutcome, isMindsOperation, HivesOperationError, HivesQueueOperationError, MindsAgentError, MindsOwnerError, hivesResponseBytes, MAX_FUNCTION_BODY_BYTES, MAX_FUNCTION_JSON_BYTES, DEFAULT_BASE_URL, requireSecureUrl } from '@onesi/genesis';
+import { authConfig, completeLogin, selectSavedContext, savedLoginProvider, startLogin } from './auth.js';
+import { completeDeviceLogin, startDeviceLogin } from './device-login.js';
+import { keychainStore } from './store.js';
+import { c, listOf, safe, stdio, table } from './output.js';
+import { spawn } from 'node:child_process';
+import { addHenryCommands } from './henry.js';
+import { registerFleets } from './fleets.js';
+import { registerFlocks } from './flocks.js';
+import { registerRunner } from './runner.js';
+import { createHivesNodeTransport } from './hives-node-transport.js';
+import { registerHivesOperations } from './hives-operations.js';
+import { registerHivesCoverage } from './hives-coverage.js';
+import { readFunctionFile, readFunctionJson, writeFunctionOutput } from './function-input.js';
+import { basename } from 'node:path';
+import { readWasmFile } from './wasm-input.js';
+import { readSecretInput, validateSecret, validateSecretValue, parseSecretBatch } from './secret-input.js';
+function defaultOpen(url) {
+    const cmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'cmd' : 'xdg-open';
+    const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
+    try {
+        spawn(cmd, args, { stdio: 'ignore', detached: true }).on('error', () => { }).unref();
+    }
+    catch { /* print-only fallback */ }
+}
+export function buildProgram(deps = {}) {
+    const out = deps.out ?? stdio;
+    const env = deps.env ?? process.env;
+    const f = deps.fetch ?? fetch;
+    const getStore = deps.store ?? keychainStore;
+    const auth = { ...authConfig(env, f), sleep: deps.sleep };
+    const program = new Command('genesis')
+        .description('One CLI for every Genesis service.')
+        .version('0.2.0')
+        .option('--json', 'machine-readable JSON output')
+        .option('--api-key <key>', 'use this API key (default: GENESIS_API_KEY, then your `genesis login`)')
+        .option('--base-url <url>', 'gateway URL (default: GENESIS_BASE_URL or https://os.one.ml/api)')
+        .option('--direct', 'skip the gateway and call each service host directly (for local dev)')
+        .option('--org <org_id>', 'organization to act on')
+        .showHelpAfterError()
+        .exitOverride()
+        .configureOutput({ writeOut: (s) => out.log(s.trimEnd()), writeErr: (s) => out.err(s.trimEnd()) });
+    const g = () => program.opts();
+    const client = async (hivesTransport = false) => {
+        const o = g();
+        const store = await getStore().catch(() => undefined);
+        const opts = {
+            apiKey: o.apiKey ?? env.GENESIS_API_KEY, token: env.GENESIS_TOKEN,
+            baseUrl: o.baseUrl ?? env.GENESIS_BASE_URL, routing: o.direct || env.GENESIS_ROUTING === 'direct' ? 'direct' : 'gateway',
+            fetch: f, userAgent: 'genesis-cli/0.2.0',
+            credentials: store ? savedLoginProvider(auth, store) : undefined,
+        };
+        return new Genesis(hivesTransport ? { ...opts, fetch: createHivesNodeTransport(opts, deps.signal) } : opts);
+    };
+    const emit = (data, pretty) => out.log(g().json ? JSON.stringify(data, null, 2) : pretty());
+    const positiveInteger = (value, option, maximum) => {
+        if (value === undefined)
+            return undefined;
+        if (!/^\d+$/.test(value) || !Number.isSafeInteger(Number(value)) || Number(value) < 1 || Number(value) > maximum) {
+            throw new Error(`${option} must be an integer from 1 to ${maximum}.`);
+        }
+        return Number(value);
+    };
+    const projectName = (name) => {
+        if (name.length < 3 || name.length > 64 || !/^[a-z][a-z0-9-]*[a-z0-9]$/.test(name)) {
+            throw new Error('Project name must be 3–64 lowercase letters, numbers or hyphens, start with a letter and end with a letter or number.');
+        }
+        return name;
+    };
+    registerRunner(program, client, emit);
+    const orgId = async (gen) => {
+        if (g().org)
+            return g().org;
+        const s = await (await getStore().catch(() => undefined))?.get();
+        if (s?.organization_id && !g().apiKey && !env.GENESIS_API_KEY)
+            return s.organization_id;
+        return (await gen.whoami()).org;
+    };
+    const silos = program.command('silos').description('Serverless PostgreSQL');
+    const silosInstances = silos.command('instances').description('Database instances in the selected Genesis project (genesis select)');
+    silosInstances.command('list').action(async () => out.log(JSON.stringify(await (await client()).silos.instances.list(), null, 2)));
+    silosInstances.command('get <instance_id>').action(async (id) => out.log(JSON.stringify(await (await client()).silos.instances.get(id), null, 2)));
+    silosInstances.command('create').requiredOption('--name <name>', 'Instance name (lowercase, 1-63 characters)')
+        .action(async (options) => out.log(JSON.stringify(await (await client()).silos.instances.create({ name: options.name }), null, 2)));
+    const silosJson = (value) => out.log(JSON.stringify(value, null, 2));
+    silosInstances.command('rename <instance_id>').requiredOption('--name <name>', 'New instance name (lowercase, 1-63 characters)')
+        .action(async (id, options) => silosJson(await (await client()).silos.instances.update(id, { name: options.name })));
+    silosInstances.command('delete <instance_id>').description('Delete an instance and stop it; its name is free again at once')
+        .action(async (id) => silosJson((await (await client()).silos.instances.delete(id)) ?? { deleted: id }));
+    silosInstances.command('suspend <instance_id>').description('Checkpoint, then stop the instance')
+        .action(async (id) => silosJson(await (await client()).silos.instances.suspend(id)));
+    silosInstances.command('resume <instance_id>').description('Start the instance now')
+        .action(async (id) => silosJson(await (await client()).silos.instances.resume(id)));
+    silosInstances.command('query <instance_id>').description('Run one SQL statement (never replayed)')
+        .requiredOption('--sql <sql>', 'SQL statement').option('--params <json>', 'JSON array of positional parameters for $1, $2, …')
+        .option('--branch <branch_id>', 'run on this branch instead of the default branch')
+        .action(async (id, options) => {
+        let params;
+        if (options.params !== undefined) {
+            try {
+                params = JSON.parse(options.params);
+            }
+            catch {
+                params = undefined;
+            }
+            if (!Array.isArray(params))
+                throw new Error('--params must be a JSON array, for example \'[1,"a"]\'.');
+        }
+        silosJson(await (await client()).silos.instances.query(id, { sql: options.sql, ...(params ? { params } : {}), ...(options.branch ? { branchId: options.branch } : {}) }));
+    });
+    silosInstances.command('batch <instance_id>').description('Run up to 50 statements in one transaction (never replayed)')
+        .option('--file <path>', 'UTF-8 JSON file: {"statements":[{"sql":"…","params":[…]}]}').option('--stdin', 'read that JSON from stdin')
+        .action(async (id, o) => {
+        let body;
+        if (Boolean(o.file) === Boolean(o.stdin))
+            throw new Error('Choose exactly one input source: --file or --stdin.');
+        const text = await (deps.readSecretInput ?? readSecretInput)(o, 64 * 1024);
+        try {
+            body = JSON.parse(text);
+        }
+        catch {
+            throw new Error('Batch input must be JSON: {"statements":[{"sql":"…"}]}.');
+        }
+        silosJson(await (await client()).silos.instances.batch(id, body));
+    });
+    silosInstances.command('metrics <instance_id>').description('Live counters, storage and activity times')
+        .action(async (id) => silosJson(await (await client()).silos.instances.metrics(id)));
+    silosInstances.command('listen <instance_id>').description('Wait for NOTIFY on channels (up to --wait ms, at most 15000)')
+        .requiredOption('--channel <name...>', 'channel to listen on (repeatable, up to 10)').option('--wait <ms>', 'how long to wait (default 10000)')
+        .option('--branch <branch_id>', 'listen on this branch instead of the default branch')
+        .action(async (id, o) => {
+        const waitMs = o.wait === undefined ? undefined : Number(o.wait);
+        if (waitMs !== undefined && !(Number.isInteger(waitMs) && waitMs >= 0 && waitMs <= 15000))
+            throw new Error('--wait must be an integer from 0 to 15000.');
+        silosJson(await (await client()).silos.instances.listen(id, { channels: o.channel, ...(waitMs !== undefined ? { waitMs } : {}), ...(o.branch ? { branchId: o.branch } : {}) }));
+    });
+    silos.command('usage').description('Silos usage of the selected Genesis project, last 30 days')
+        .action(async () => silosJson(await (await client()).silos.usage()));
+    silos.command('regions').description('Regions Silos instances are created in')
+        .action(async () => silosJson(await (await client()).silos.regions.list()));
+    const silosBranches = silos.command('branches').description('Branches of a database instance');
+    silosBranches.command('list <instance_id>').action(async (id) => silosJson(await (await client()).silos.instances.branches.list(id)));
+    silosBranches.command('get <instance_id> <branch_id>').action(async (id, branch) => silosJson(await (await client()).silos.instances.branches.get(id, branch)));
+    silosBranches.command('create <instance_id>').description('Copy the latest checkpoint of the parent (default: the default branch)')
+        .requiredOption('--name <name>', 'Branch name (lowercase, 1-63 characters)').option('--parent <branch_id>', 'parent branch')
+        .action(async (id, o) => silosJson(await (await client()).silos.instances.branches.create(id, o.parent ? { name: o.name, parentBranchId: o.parent } : { name: o.name })));
+    silosBranches.command('rename <instance_id> <branch_id>').requiredOption('--name <name>', 'New branch name')
+        .action(async (id, branch, o) => silosJson(await (await client()).silos.instances.branches.update(id, branch, { name: o.name })));
+    silosBranches.command('delete <instance_id> <branch_id>').description('Delete a branch other than the default branch')
+        .action(async (id, branch) => silosJson((await (await client()).silos.instances.branches.delete(id, branch)) ?? { deleted: branch }));
+    silosBranches.command('restore <instance_id> <branch_id>').description('Replace the branch data with a stored snapshot')
+        .requiredOption('--snapshot <snapshot_id>', 'snapshot id from `genesis silos snapshots list`').option('--from <branch_id>', 'branch the snapshot was taken on (default: this branch)')
+        .action(async (id, branch, o) => silosJson(await (await client()).silos.instances.branches.restore(id, branch, o.from ? { snapshotId: o.snapshot, sourceBranchId: o.from } : { snapshotId: o.snapshot })));
+    const silosSnapshots = silos.command('snapshots').description('Stored snapshots of a database instance');
+    silosSnapshots.command('list <instance_id>').action(async (id) => silosJson(await (await client()).silos.instances.snapshots.list(id)));
+    silosSnapshots.command('create <instance_id>').description('Checkpoint a branch and store the snapshot').option('--branch <branch_id>', 'branch (default: the default branch)')
+        .action(async (id, o) => silosJson(await (await client()).silos.instances.snapshots.create(id, o.branch ? { branchId: o.branch } : {})));
+    const traces = program.command('traces').description('Research and evidence');
+    const tracesRuns = traces.command('runs').description('Research runs in your verified organization');
+    tracesRuns.command('create').requiredOption('--type <type>', 'Run type, e.g. deep_research').requiredOption('--query <query>', 'Research question')
+        .requiredOption('--idempotency-key <key>', 'Stable key; reuse it to replay instead of creating a second run')
+        .option('--max-sources <n>', 'Most sources the run may collect (1-100)')
+        .option('--include-domain <domain...>', 'Search only these domains, e.g. wikipedia.org')
+        .action(async (o) => {
+        const config = { ...(o.maxSources !== undefined ? { max_sources: positiveInteger(o.maxSources, '--max-sources', 100) } : {}), ...(o.includeDomain?.length ? { include_domains: o.includeDomain } : {}) };
+        out.log(JSON.stringify(await (await client()).traces.runs.create({ type: o.type, query: o.query, ...(Object.keys(config).length ? { config } : {}) }, o.idempotencyKey), null, 2));
+    });
+    tracesRuns.command('list').action(async () => out.log(JSON.stringify(await (await client()).traces.runs.list(), null, 2)));
+    tracesRuns.command('get <run_id>').action(async (id) => out.log(JSON.stringify(await (await client()).traces.runs.get(id), null, 2)));
+    traces.command('search <query>').requiredOption('--idempotency-key <key>', 'Stable key; metered once')
+        .option('--max-results <n>', 'Results to return (1-20, default 3)')
+        .option('--include-domain <domain...>', 'Search only these domains, e.g. wikipedia.org')
+        .action(async (query, o) => out.log(JSON.stringify(await (await client()).traces.search({
+        query, max_results: positiveInteger(o.maxResults, '--max-results', 20) ?? 3, ...(o.includeDomain?.length ? { include_domains: o.includeDomain } : {})
+    }, o.idempotencyKey), null, 2)));
+    traces.command('usage').action(async () => out.log(JSON.stringify(await (await client()).traces.usage.events(), null, 2)));
+    const blinds = program.command('blinds').description('Blinds credential custody');
+    const show = async (call) => out.log(JSON.stringify(await call((await client()).blinds), null, 2));
+    const key = (o) => ({ signal: deps.signal, ...(o.idempotencyKey ? { idempotencyKey: o.idempotencyKey } : {}) });
+    const keyOption = ['--idempotency-key <uuid>', 'Reuse the UUID from an uncertain earlier attempt; otherwise a new one is minted'];
+    const credentials = blinds.command('credentials').description('Credential variable names (values never leave Blinds)');
+    credentials.command('list').action(() => show(b => b.credentials.list({ signal: deps.signal })));
+    credentials.command('set <variable>').description('Store a static credential from a file or stdin, never argv')
+        .requiredOption('--type <type>', 'api_key, bearer, ...').option('--file <path>', 'Read the value from this file').option('--stdin', 'Read the value from stdin')
+        .option('--domain <domain...>', 'Destination domains the value may be injected into').option('--provider <slug>').option(...keyOption)
+        .action(async (variable, o) => {
+        const value = (await (deps.readSecretInput ?? readSecretInput)(o, 16 * 1024)).replace(/\r?\n$/, '');
+        await show(b => b.credentials.store({ variable_name: variable, value, credential_type: o.type,
+            ...(o.domain ? { destination_domains: o.domain } : {}), ...(o.provider ? { provider: o.provider } : {}) }, key(o)));
+    });
+    credentials.command('revoke <variable>').option(...keyOption).action((variable, o) => show(b => b.credentials.revoke(variable, key(o))));
+    credentials.command('revoke-all').description('Revoke every credential in the selected organization (irreversible)')
+        .requiredOption('--yes', 'Confirm the bulk revoke').option(...keyOption).action((o) => show(b => b.credentials.revokeAll(key(o))));
+    blinds.command('connections').description('Active OAuth connections (metadata only)').action(() => show(b => b.oauth.connections({ signal: deps.signal })));
+    const offsetInteger = (value) => {
+        if (value === undefined)
+            return undefined;
+        if (!/^\d+$/.test(value) || !Number.isSafeInteger(Number(value)))
+            throw new Error('--offset must be a non-negative integer.');
+        return Number(value);
+    };
+    const catalog = (o) => {
+        const limit = positiveInteger(o.limit, '--limit', 1000), offset = offsetInteger(o.offset);
+        return { ...(o.q ? { q: o.q } : {}), ...(o.category ? { category: o.category } : {}),
+            ...(limit !== undefined ? { limit } : {}), ...(offset !== undefined ? { offset } : {}) };
+    };
+    const providers = blinds.command('providers').description('Provider catalog: what a credential can be bound to');
+    providers.command('list').option('--q <text>', 'Match slug, name or description').option('--category <name>').option('--auth-mode <mode>', 'oauth2, api_key, ...')
+        .option('--oauth', 'Only providers that use OAuth 2.0 (cannot be combined with --auth-mode)').option('--limit <n>', 'Page size, 1 to 1000').option('--offset <n>')
+        .action((o) => {
+        if (o.oauth && o.authMode)
+            throw new Error('--oauth already selects auth mode oauth2; drop --auth-mode.');
+        const query = catalog(o);
+        return show(b => o.oauth ? b.oauth.providers(query, { signal: deps.signal })
+            : b.providers.list({ ...query, ...(o.authMode ? { auth_mode: o.authMode } : {}) }, { signal: deps.signal }));
+    });
+    providers.command('get <slug>').action((slug) => show(b => b.providers.get(slug, { signal: deps.signal })));
+    const settings = blinds.command('settings').description('Consent policy and notifications');
+    settings.command('get').action(() => show(b => b.settings.get({ signal: deps.signal })));
+    settings.command('set').description('Replace the settings: an omitted --email or --slack turns that notification off').requiredOption('--consent-policy <policy>', 'never, per_variable or per_delegate')
+        .option('--email', 'Email notifications on').option('--slack', 'Slack notifications on').option(...keyOption)
+        .action((o) => show(b => b.settings.update({ consent_policy: o.consentPolicy, email_notifications: !!o.email, slack_notifications: !!o.slack }, key(o))));
+    blinds.command('agents').description('Agents seen using Blinds, with request counts').action(() => show(b => b.agents({ signal: deps.signal })));
+    blinds.command('alerts').description('Failed or denied Blinds events').action(() => show(b => b.alerts({ signal: deps.signal })));
+    blinds.command('operation <operation_id>').description('Receipt for a mutation, by its Idempotency-Key')
+        .action((id) => show(b => b.operations.get(id, { signal: deps.signal })));
+    const consent = blinds.command('consent').description('Agent consent requests and decisions');
+    consent.command('pending').action(() => show(b => b.consent.pending({ signal: deps.signal })));
+    consent.command('list').action(() => show(b => b.consent.records({ signal: deps.signal })));
+    consent.command('approve <consent_id>').requiredOption('--signature <sig>', 'One account approval signature').option('--expires-in <seconds>').option(...keyOption)
+        .action((id, o) => show(b => b.consent.approve(id, { signature: o.signature, ...(o.expiresIn ? { expires_in_seconds: Number(o.expiresIn) } : {}) }, key(o))));
+    consent.command('deny <consent_id>').option(...keyOption).action((id, o) => show(b => b.consent.deny(id, key(o))));
+    consent.command('revoke <consent_id>').option(...keyOption).action((id, o) => show(b => b.consent.revoke(id, key(o))));
+    const delegates = blinds.command('delegates').description('Which agents hold which variables');
+    delegates.command('list').action(() => show(b => b.delegates.list({ signal: deps.signal })));
+    delegates.command('create <name>').requiredOption('--variable <name...>', 'Variables to delegate').requiredOption('--ttl <seconds>', 'Lifetime in seconds')
+        .option('--max-depth <n>', 'Sub-delegation depth', '1').option(...keyOption)
+        .action((name, o) => show(b => b.delegates.create({ name, delegated_variables: o.variable, ttl_seconds: Number(o.ttl), max_depth: Number(o.maxDepth) }, key(o))));
+    delegates.command('revoke <delegate_id>').option(...keyOption).action((id, o) => show(b => b.delegates.revoke(id, key(o))));
+    blinds.command('activity').description('Latest 200 Blinds audit events').action(() => show(b => b.activity({ signal: deps.signal })));
+    const owner = blinds.command('owner-enrollment')
+        .description('Original-human enrollment only; preserve operation and locator IDs after unknown outcomes');
+    for (const [action, operation] of Object.entries({ reserve: 'blinds_ownerReserve', sign: 'blinds_ownerSign', attach: 'blinds_ownerAttach', 'p256-ensure': 'blinds_ownerP256Ensure' })) {
+        owner.command(action).requiredOption('--body-file <path>', 'Closed JSON request, up to 2 KiB; original human login required')
+            .action(async (options) => {
+            const body = await readFunctionJson(options.bodyFile, 2048);
+            const result = await (await client()).request(operation, { body }, { signal: deps.signal });
+            out.log(JSON.stringify(result, null, 2));
+        });
+    }
+    registerDials(program, { client, orgId, emit });
+    registerIamDirectory(program, { client, orgId, emit });
+    registerProducts(program, { client, emit, signal: deps.signal });
+    registerOrgs(program, { client, emit, signal: deps.signal });
+    // Agent enrollment sends only the grant's enrollment key (mek_...), never this CLI's login or API key.
+    (program.commands.find(c => c.name() === 'iam').commands.find(c => c.name() === 'agents')).command('enroll')
+        .description('Enroll an agent under an agent enrollment grant (POST /v1/iam/agents/enroll); the credential secret is shown once')
+        .requiredOption('--body-file <path>', 'JSON request body (externalKey, displayName, mindId, permissions, ...)')
+        .option('--key-file <path>', 'file holding the enrollment key (mek_...)').option('--key-stdin', 'read the enrollment key from stdin')
+        .action(async (o) => {
+        const key = o.keyFile || o.keyStdin ? (await (deps.readSecretInput ?? readSecretInput)({ file: o.keyFile, stdin: o.keyStdin }, 1024)).trim() : env.GENESIS_ENROLLMENT_KEY;
+        if (!key)
+            throw new Error('Give the enrollment key with --key-file, --key-stdin or GENESIS_ENROLLMENT_KEY; it is never accepted as an argument.');
+        const body = await readFunctionJson(o.bodyFile, 16 * 1024);
+        const result = await new Genesis({ baseUrl: g().baseUrl ?? env.GENESIS_BASE_URL, fetch: f, userAgent: 'genesis-cli/0.1.13' }).iam.agents.enroll(key, body);
+        emit(result, () => JSON.stringify(result, null, 2));
+    });
+    // ---- auth ------------------------------------------------------------
+    program.command('login').description('Sign in with One in your browser').option('--no-browser', 'just print the link')
+        .option('--device', 'sign in from a machine without a local browser: approve a code from any signed-in browser')
+        .action(async (o) => {
+        const store = await getStore();
+        if (o.device) {
+            const start = await startDeviceLogin(auth, deps.signal);
+            const uri = safe(start.verificationUri), complete = safe(start.verificationUriComplete), userCode = safe(start.userCode);
+            if (g().json)
+                out.err(JSON.stringify({ user_code: userCode, verification_uri: uri,
+                    verification_uri_complete: complete, expires_in: start.expiresIn }));
+            else
+                out.err(`\n  On any device, open ${c.bold(uri)}\n  and enter the code ${c.bold(userCode)}\n\n  Or open ${complete}\n  ${c.dim(`Waiting for approval (expires in ${Math.round(start.expiresIn / 60)} min)…`)}\n`);
+            const s = await completeDeviceLogin(auth, start, deps.signal);
+            await store.set(s);
+            emit({ user: s.user, organization_id: s.organization_id, store: store.kind, via: 'device' }, () => `${c.green('✓')} Signed in as ${c.bold(s.user?.email ?? s.user?.id ?? 'you')}${s.organization_id ? ` (${s.organization_id})` : ''}. Token saved to your ${store.kind === 'os-keychain' ? 'OS keychain' : store.kind}.`);
+            return;
+        }
+        const attempt = await startLogin(auth, { signal: deps.signal });
+        let s;
+        try {
+            out.err(`\n  Open ${attempt.browserUrl}\n  ${c.dim('Waiting for One account sign-in in the browser…')}\n`);
+            if (o.browser)
+                (deps.openBrowser ?? defaultOpen)(attempt.browserUrl);
+            s = await completeLogin(auth, attempt);
+        }
+        finally {
+            attempt.close();
+        }
+        await store.set(s);
+        emit({ user: s.user, organization_id: s.organization_id, store: store.kind }, () => `${c.green('✓')} Signed in as ${c.bold(s.user?.email ?? s.user?.id ?? 'you')}${s.organization_id ? ` (${s.organization_id})` : ''}. Token saved to your ${store.kind === 'os-keychain' ? 'OS keychain' : store.kind}.`);
+    });
+    program.command('logout').description('Forget your saved login').action(async () => {
+        const had = await (await getStore()).clear();
+        emit({ logged_out: had }, () => had ? `${c.green('✓')} Signed out.` : 'You were not signed in.');
+    });
+    program.command('whoami').description('Show who you are signed in as').action(async () => {
+        const gen = await client();
+        const saved = await (await getStore().catch(() => undefined))?.get();
+        try {
+            const p = await gen.whoami();
+            emit({ ...p, user: saved?.user }, () => [
+                `${c.bold('Org')}        ${p.org}`, `${c.bold('Principal')}  ${p.principal ?? '-'}`,
+                `${c.bold('Via')}        ${p.kind}`, `${c.bold('Scopes')}     ${p.scopes.join(', ') || '-'}`,
+                ...(saved?.user?.email ? [`${c.bold('User')}       ${saved.user.email}`] : [])
+            ].join('\n'));
+        }
+        catch (e) {
+            if (!saved || g().apiKey || env.GENESIS_API_KEY)
+                throw e;
+            // Saved login exists but One account verify isn't reachable yet (auth-v4-backend PR #30 not deployed).
+            emit({ user: saved.user, organization_id: saved.organization_id, verified: false, reason: e.message }, () => `${c.bold('User')}  ${saved.user?.email ?? saved.user?.id}\n${c.bold('Org')}   ${saved.organization_id ?? '-'}\n${c.yellow('!')} ${c.dim('From your saved login; One account verify unavailable: ' + e.message)}`);
+        }
+    });
+    // `orgs usage|observations|billing|payment-methods|service` and the Orgs (legal entity) commands are registered by registerProducts and registerOrgs.
+    const orgs = (program.commands.find(command => command.name() === 'orgs') ?? program.command('orgs')).description('Your organizations, their usage and billing reads, and Orgs: legal entities, seats, resolutions, documents, filings, formation and the record');
+    orgs.command('list', { isDefault: true }).description('Show your current organization').action(async () => {
+        const s = await (await getStore()).get();
+        if (!s)
+            throw new Error('Not signed in. Run `genesis login`.');
+        const rows = s.organization_id ? [{ id: s.organization_id, current: '*' }] : [];
+        emit({ current: s.organization_id ?? null, organizations: rows }, () => `${table(rows, ['id', 'current'])}\n${c.dim('Listing every org you belong to needs a One account memberships endpoint (not built yet). Switch with `genesis orgs switch <org_id>`.')}`);
+    });
+    orgs.command('switch <org_id>').description('Switch your login to another organization').action(async (id) => {
+        const store = await getStore();
+        const s = await store.get();
+        if (!s)
+            throw new Error('Not signed in. Run `genesis login`.');
+        const n = await selectSavedContext(auth, store, { organizationId: id }, deps.signal);
+        emit({ organization_id: n.organization_id }, () => `${c.green('✓')} Now using ${c.bold(n.organization_id ?? id)}.`);
+    });
+    const selection = program.command('context').description('Select an authorized Genesis organization, workspace and project');
+    selection.command('select').requiredOption('--organization <id>').requiredOption('--workspace <id>').requiredOption('--project <id>')
+        .description('Bind the saved human login to a Console Sandbox context and atomically replace its credentials')
+        .action(async (options) => {
+        const target = { organizationId: options.organization, workspaceId: options.workspace, projectId: options.project,
+            platformId: 'pf_console', fleetId: null, environmentId: 'sandbox' };
+        const next = await selectSavedContext(auth, await getStore(), target, deps.signal);
+        emit({ principal_id: next.auth?.principal_id, ...target }, () => `Selected ${target.organizationId} / ${target.workspaceId} / ${target.projectId} (Sandbox).`);
+    });
+    // ---- keys ------------------------------------------------------------
+    const keys = program.command('keys').description('Org API keys (One account / WorkOS)');
+    keys.command('list').action(async () => {
+        const gen = await client();
+        const org = await orgId(gen);
+        const r = await gen.keys.list(org);
+        emit(r, () => table(r.data, ['id', 'name', 'obfuscated_value', 'scopes', 'last_used_at', 'expires_at']));
+    });
+    keys.command('create <name>').description('Create a key (shown once), or with --blinds hand it straight to Blinds so nobody ever sees it')
+        .option('--scopes <list>', 'comma-separated scopes, e.g. hives:read,relays:write')
+        .option('--blinds', 'store the key in Blinds; the raw key is never shown to anyone')
+        .option('--expires <iso>', 'expiry, e.g. 2027-01-01T00:00:00Z')
+        .action(async (name, o) => {
+        const gen = await client();
+        const org = await orgId(gen);
+        const k = await gen.keys.create(org, { name, custody: o.blinds ? 'blinds' : 'reveal', ...(o.scopes ? { scopes: o.scopes.split(',').map((x) => x.trim()).filter(Boolean) } : {}), ...(o.expires ? { expires_at: o.expires } : {}) });
+        emit(k, () => o.blinds
+            ? `${c.green('✓')} Key ${c.bold(k.id)} created and stored in Blinds as ${c.bold(String(k.blinds_credential_ref))}.\n  ${c.dim('No one, human or agent, will ever see the raw key.')}`
+            : `${c.green('✓')} Key ${c.bold(k.id)} created. Copy it now; it won't be shown again:\n\n  ${c.bold(String(k.value))}\n`);
+    });
+    keys.command('revoke <key_id>').action(async (id) => {
+        const gen = await client();
+        await gen.keys.revoke(id);
+        emit({ revoked: id }, () => `${c.green('✓')} Revoked ${id} ${c.dim('(takes effect within 60s)')}`);
+    });
+    // ---- foundry ---------------------------------------------------------
+    // registerProducts (above) already added the generated `foundry` commands; the hand-written ones join them.
+    const foundry = program.commands.find(c => c.name() === 'foundry') ?? program.command('foundry').description('Foundry: models and inference');
+    const foundryBilling = foundry.command('billing').description('Current organization’s native TEST billing; original One account human login required');
+    foundryBilling.command('profile').action(async () => out.log(JSON.stringify(await (await client()).foundry.billing.profile({ signal: deps.signal }), null, 2)));
+    foundryBilling.command('ensure').requiredOption('--operation-key <key>', 'Persisted operation key; reconcile unknown outcomes before retrying').action(async (o) => out.log(JSON.stringify(await (await client()).foundry.billing.ensureProfile(o.operationKey, { signal: deps.signal }), null, 2)));
+    foundryBilling.command('checkout').requiredOption('--purchase-key <key>', 'Persisted purchase key; server controls the TEST amount').action(async (o) => out.log(JSON.stringify(await (await client()).foundry.billing.checkoutCredits(o.purchaseKey, { signal: deps.signal }), null, 2)));
+    foundryBilling.command('balance').action(async () => out.log(JSON.stringify(await (await client()).foundry.billing.creditBalance({ signal: deps.signal }), null, 2)));
+    foundry.command('models').action(async () => {
+        const r = await (await client()).foundry.models.list();
+        const rows = listOf(r).map((m) => ({ id: m.id, owned_by: m.owned_by ?? m.provider ?? '' }));
+        emit(r, () => table(rows, ['id', 'owned_by']));
+    });
+    foundry.command('chat <prompt...>').description('Chat with a model').option('-m, --model <model>', 'model id', env.GENESIS_MODEL)
+        .option('--no-stream', 'wait for the full answer').option('-s, --system <text>', 'system prompt')
+        .action(async (prompt, o) => {
+        if (!o.model)
+            throw new Error('Pick a model with --model (see `genesis foundry models`) or set GENESIS_MODEL.');
+        const gen = await client();
+        const messages = [...(o.system ? [{ role: 'system', content: o.system }] : []), { role: 'user', content: prompt.join(' ') }];
+        if (o.stream && !g().json) {
+            for await (const d of gen.foundry.chatStream({ model: o.model, messages }))
+                process.stdout.write(d);
+            process.stdout.write('\n');
+            return;
+        }
+        const r = await gen.foundry.chat({ model: o.model, messages });
+        emit(r, () => r.choices?.[0]?.message?.content ?? JSON.stringify(r));
+    });
+    registerMinds(program, client, data => emit(data, () => JSON.stringify(data, null, 2)), async () => new Genesis({
+        apiKey: g().apiKey ?? env.GENESIS_API_KEY, token: env.GENESIS_TOKEN, baseUrl: g().baseUrl ?? env.GENESIS_BASE_URL,
+        routing: g().direct || env.GENESIS_ROUTING === 'direct' ? 'direct' : 'gateway', fetch: f,
+    }), deps.signal, async () => {
+        if (g().org !== undefined)
+            throw new Error('Minds owner commands use the selected Console organization; --org is not supported.');
+        return client();
+    });
+    const hivesClient = () => client(true);
+    // ---- hives -----------------------------------------------------------
+    const hives = program.command('hives').description('Hives: projects, secrets, deployments, functions, schedules and activity');
+    registerHivesOperations(hives, { client: hivesClient, emit, readRequest: deps.readHivesRequest, line: (text) => out.log(text) });
+    const deployments = hives.command('deployments').description('Real WASM artifacts and deployment lifecycle');
+    const emitDeployment = (data) => emit(data, () => table(data && typeof data === 'object' && !Array.isArray(data) && !('data' in data) ? [data] : listOf(data), ['id', 'version', 'status', 'module_hash', 'created_at']));
+    deployments.command('list <project_id>')
+        .option('--page <number>', 'page (1–10000)').option('--per-page <number>', 'items (1–100)')
+        .option('--status <status>', 'persisted deployment status').option('--author <id>', 'creator ID')
+        .action(async (project, o) => {
+        emitDeployment(await (await hivesClient()).hives.deployments.list(project, {
+            page: positiveInteger(o.page, '--page', 10000), per_page: positiveInteger(o.perPage, '--per-page', 100), status: o.status, author: o.author,
+        }));
+    });
+    deployments.command('get <project_id> <deployment_id>')
+        .action(async (project, deployment) => emitDeployment(await (await hivesClient()).hives.deployments.get(project, deployment)));
+    deployments.command('upload <project_id> <wasm_file>').description('Upload actual WASM bytes; Git options are labels only')
+        .option('--git-sha <sha>', 'commit label (7–40 characters)').option('--git-branch <branch>', 'branch label').option('--git-message <message>', 'commit label')
+        .action(async (project, path, o) => {
+        const file = await (deps.readWasmFile ?? readWasmFile)(path);
+        emitDeployment(await (await hivesClient()).hives.deployments.upload(project, file, {
+            filename: basename(path), git_sha: o.gitSha, git_branch: o.gitBranch, git_message: o.gitMessage,
+        }));
+    });
+    deployments.command('reuse <project_id> <module_hash>').description('Deploy a real artifact already owned by this org and project')
+        .option('--no-auto-promote', 'keep the completed deployment ready for explicit promotion')
+        .action(async (project, module_hash, o) => {
+        if (!/^[a-f0-9]{64}$/.test(module_hash))
+            throw new Error('module_hash must be the lowercase SHA-256 returned by a real Hives upload.');
+        emitDeployment(await (await hivesClient()).hives.deployments.create(project, { module_hash, auto_promote: o.autoPromote }));
+    });
+    deployments.command('promote <project_id> <deployment_id>')
+        .action(async (project, deployment) => emitDeployment(await (await hivesClient()).hives.deployments.promote(project, deployment)));
+    deployments.command('rollback <project_id> <deployment_id>').description('Activate this owned previous deployment')
+        .option('--reason <text>', 'audit reason')
+        .action(async (project, deployment, o) => emitDeployment(await (await hivesClient()).hives.deployments.rollback(project, deployment, { reason: o.reason })));
+    deployments.command('cancel <project_id> <deployment_id>')
+        .action(async (project, deployment) => emitDeployment(await (await hivesClient()).hives.deployments.cancel(project, deployment)));
+    deployments.command('stop <project_id> <deployment_id>').description('Stop the runtime; read its state before explicitly reconciling an uncertain result')
+        .action(async (project, deployment) => emitDeployment(await (await hivesClient()).hives.deployments.stop(project, deployment)));
+    deployments.command('delete <project_id> <deployment_id>').description('Delete a deployment that is not currently active')
+        .action(async (project, deployment) => { const result = await (await hivesClient()).hives.deployments.delete(project, deployment); emit(result, () => `Deleted deployment ${deployment}.`); });
+    deployments.command('logs <project_id> <deployment_id>').description('Read real persisted deployment logs')
+        .option('--page <number>', 'page (1–10000)').option('--per-page <number>', 'items (1–100)')
+        .option('--level <level>', 'minimum level').option('--search <text>', 'search log messages')
+        .option('--start <iso>', 'RFC 3339 start time').option('--end <iso>', 'RFC 3339 end time')
+        .action(async (project, deployment, o) => {
+        for (const timestamp of [o.start, o.end])
+            if (timestamp !== undefined && !Number.isFinite(Date.parse(timestamp)))
+                throw new Error('Log timestamps must use RFC 3339.');
+        const result = await (await hivesClient()).hives.deployments.logs(project, deployment, {
+            page: positiveInteger(o.page, '--page', 10000), per_page: positiveInteger(o.perPage, '--per-page', 100),
+            level: o.level, search: o.search, start: o.start, end: o.end,
+        });
+        emit(result, () => table(result.logs, ['timestamp', 'level', 'message', 'source']));
+    });
+    const emitFunction = (value) => emit(value, () => table(listOf(value).length ? listOf(value) : [value], ['id', 'name', 'status', 'handler', 'memory_mb', 'timeout_ms']));
+    const functions = hives.command('functions').description('Owned WASM functions; invocation returns the completed raw guest response');
+    functions.command('list <project_id>').option('--page <n>').option('--per-page <n>').option('--status <status>').option('--search <text>')
+        .action(async (project, o) => emitFunction(await (await hivesClient()).hives.functions.list(project, {
+        page: positiveInteger(o.page, '--page', 1000000), per_page: positiveInteger(o.perPage, '--per-page', 100), status: o.status, search: o.search,
+    })));
+    functions.command('get <project_id> <function_id>').action(async (project, id) => emitFunction(await (await hivesClient()).hives.functions.get(project, id)));
+    functions.command('create <project_id> <name> <module_hash>').option('--request-file <file>', 'JSON metadata and encrypted env overrides; input values are never printed')
+        .action(async (project, name, hash, o) => {
+        if (!/^[a-f0-9]{64}$/.test(hash))
+            throw new Error('Use a full lowercase artifact hash from an owned Hives upload.');
+        const extra = o.requestFile ? await readFunctionJson(o.requestFile, 256 * 1024) : {};
+        emitFunction(await (await hivesClient()).hives.functions.create(project, { ...extra, name, handler: `wasm://sha256/${hash}` }));
+    });
+    functions.command('update <project_id> <function_id>').requiredOption('--request-file <file>', 'JSON supported metadata/env/remove_env fields; values are never printed')
+        .action(async (project, id, o) => emitFunction(await (await hivesClient()).hives.functions.update(project, id, await readFunctionJson(o.requestFile, 256 * 1024))));
+    functions.command('delete <project_id> <function_id>').action(async (project, id) => {
+        const result = await (await hivesClient()).hives.functions.delete(project, id);
+        emit(result, () => `Deleted function ${id}.`);
+    });
+    function invocationCommand(command, kind, alias = false) {
+        if (kind === 'functions')
+            command.option('--idempotency-key <key>', 'Persisted original invocation key; required by Genesis funding. Reuse it after uncertainty.');
+        command.description(alias ? 'Compatibility alias of invoke (/invoke/async): the same completed guest response, no durable queue' : 'Complete real guest execution; write exact bytes, including executed HTTP error bodies')
+            .option('--request-file <file>', 'JSON method/path/headers/body or body_base64')
+            .option('--body-file <file>', 'Exact binary body (up to 10 MiB; serialized guest envelope may reach its cap earlier)')
+            .option('--method <method>', 'guest HTTP method', 'POST').option('--path <path>', 'guest path including query', '/')
+            .option('--output <file>', 'create a new private file containing exact response bytes')
+            .action(async (project, id, o) => {
+            if (o.requestFile && o.bodyFile)
+                throw new Error('Choose --request-file or --body-file.');
+            if (g().json && o.output)
+                throw new Error('Choose --json or --output.');
+            let request = o.requestFile ? await readFunctionJson(o.requestFile, MAX_FUNCTION_JSON_BYTES) : { method: o.method, path: o.path };
+            if (o.bodyFile)
+                request.body_base64 = Buffer.from(await readFunctionFile(o.bodyFile, MAX_FUNCTION_BODY_BYTES)).toString('base64');
+            const hivesApi = (await hivesClient()).hives;
+            const response = alias ? await hivesApi.functions.invokeAsync(project, id, request, { idempotencyKey: o.idempotencyKey }) : await hivesApi[kind].invoke(project, id, request, { idempotencyKey: o.idempotencyKey });
+            const bytes = await hivesResponseBytes(response);
+            if (g().json)
+                out.log(JSON.stringify({ status: response.status, headers: Object.fromEntries(response.headers), body_base64: Buffer.from(bytes).toString('base64') }));
+            else {
+                out.err(JSON.stringify({ status: response.status, headers: Object.fromEntries(response.headers), bytes: bytes.length }));
+                if (o.output)
+                    await (deps.writeOutputFile ?? writeFunctionOutput)(o.output, bytes);
+                else
+                    (deps.writeBytes ?? ((value) => { process.stdout.write(value); }))(bytes);
+            }
+        });
+    }
+    invocationCommand(functions.command('invoke <project_id> <function_id>'), 'functions');
+    invocationCommand(deployments.command('invoke <project_id> <deployment_id>'), 'deployments');
+    // The service's /invoke/async compatibility alias: the same completed guest response, no durable queue.
+    invocationCommand(functions.command('invoke-async <project_id> <function_id>'), 'functions', true);
+    const operations = functions.command('operations').description('Read or release the original funding operation without replaying the guest');
+    operations.command('get <project_id> <function_id> <operation_id>').action(async (project, fn, operation) => {
+        const result = await (await hivesClient()).hives.functions.operations.get(project, fn, operation);
+        emit(result, () => JSON.stringify(result, null, 2));
+    });
+    operations.command('release <project_id> <function_id> <operation_id>').description('Release an unused reservation only when the backend proves no guest was dispatched')
+        .action(async (project, fn, operation) => {
+        const result = await (await hivesClient()).hives.functions.operations.release(project, fn, operation);
+        emit(result, () => JSON.stringify(result, null, 2));
+    });
+    const secrets = hives.command('secrets').description('Project secrets encrypted with Genesis KMS');
+    const readInput = async (options, limit) => {
+        if (Boolean(options.file) === Boolean(options.stdin))
+            throw new Error('Choose exactly one input source: a file or --stdin. Secret values are not accepted as command arguments.');
+        return (deps.readSecretInput ?? readSecretInput)(options, limit);
+    };
+    const emitSecret = (data) => emit(data, () => table(listOf(data), ['id', 'name', 'version', 'description', 'updated_at']));
+    const context = hives.command('context').description('Explicit Hives binding for the current verified interactive Genesis selection');
+    context.command('get').action(async () => {
+        const r = await (await hivesClient()).hives.context.get();
+        emit(r, () => table([r.project], ['id', 'name', 'slug', 'kind', 'status']));
+    });
+    context.command('create <name>').option('--kind <kind>', 'worker|function|site|api', 'worker').option('--description <text>', 'project description')
+        .action(async (name, o) => {
+        if (!['worker', 'function', 'site', 'api'].includes(o.kind))
+            throw new Error('Choose worker, function, site or api.');
+        if (o.description && o.description.length > 500)
+            throw new Error('Project descriptions must contain at most 500 characters.');
+        const r = await (await hivesClient()).hives.context.set({ create: { name: projectName(name), kind: o.kind, description: o.description } });
+        emit(r, () => table([r.project], ['id', 'name', 'slug', 'kind', 'status']));
+    });
+    context.command('link <project_id>').description('Link a Hives project owned by the verified org')
+        .action(async (id) => { const r = await (await hivesClient()).hives.context.set({ link: { project_id: id } }); emit(r, () => table([r.project], ['id', 'name', 'slug', 'kind', 'status'])); });
+    context.command('detach').description('Remove this selection binding; retain the Hives project and its resources')
+        .action(async () => { const r = await (await hivesClient()).hives.context.detach(); emit(r, () => 'Detached selection; retained Hives project ' + r.hivesProjectId + '.'); });
+    const environment = hives.command('environment').description('Encrypted project environment; names-only metadata and explicit KMS reveal');
+    environment.command('list <project_id>').option('--page <number>', 'page number (1–10000)').option('--per-page <number>', 'items per page (1–100)')
+        .action(async (id, o) => {
+        const r = await (await hivesClient()).hives.environment.list(id, { page: positiveInteger(o.page, '--page', 10000), per_page: positiveInteger(o.perPage, '--per-page', 100) });
+        emit(r, () => table(r.data, ['name']));
+    });
+    environment.command('upsert <project_id>').description('Encrypt a flat JSON map; empty string values are allowed')
+        .option('--file <path>', 'UTF-8 JSON input file').option('--stdin', 'read JSON from stdin')
+        .action(async (id, o) => {
+        const text = await readInput(o, 2 * 1024 * 1024);
+        let body;
+        try {
+            body = JSON.parse(text);
+        }
+        catch {
+            throw new Error('Environment input must be a flat JSON map of names to string values.');
+        }
+        const r = await (await hivesClient()).hives.environment.upsert(id, body);
+        emit(r, () => table(r.updated, ['name']));
+    });
+    environment.command('reveal <project_id> <key>').description('Explicit audit-logged environment reveal; requires --stdout')
+        .option('--stdout', 'write sensitive plaintext to stdout (avoid retained output)')
+        .action(async (id, key, o) => {
+        if (!o.stdout)
+            throw new Error('Environment reveal requires --stdout. Avoid logging or retaining the plaintext.');
+        const r = await (await hivesClient()).hives.environment.reveal(id, key);
+        emit(r, () => r.value);
+    });
+    secrets.command('list <project_id>').description('List secret metadata without values')
+        .option('--page <number>', 'page number (1–10000)').option('--per-page <number>', 'items per page (1–100)')
+        .action(async (id, o) => {
+        const q = { page: positiveInteger(o.page, '--page', 10000), per_page: positiveInteger(o.perPage, '--per-page', 100) };
+        emitSecret(await (await hivesClient()).hives.secrets.list(id, q));
+    });
+    secrets.command('get <project_id> <secret_id>').description('Inspect secret metadata without its value')
+        .action(async (project, secret) => {
+        const r = await (await hivesClient()).hives.secrets.get(project, secret);
+        emit(r, () => table([r], ['id', 'name', 'version', 'description', 'updated_at']));
+    });
+    secrets.command('create <project_id> <name>').description('Create a secret; plaintext is read from a file or stdin')
+        .option('--value-file <path>', 'UTF-8 file containing the value').option('--stdin', 'read value from stdin')
+        .option('--description <text>', 'description (up to 500 characters)')
+        .action(async (project, name, o) => {
+        const body = validateSecret({ name, value: await readInput({ file: o.valueFile, stdin: o.stdin }, 65536), description: o.description });
+        const r = await (await hivesClient()).hives.secrets.create(project, body);
+        emit(r, () => table([r], ['id', 'name', 'version']));
+    });
+    secrets.command('update <project_id> <secret_id>').description('Replace a secret value, creating a new version')
+        .option('--value-file <path>', 'UTF-8 file containing the new value').option('--stdin', 'read value from stdin')
+        .action(async (project, secret, o) => {
+        const value = validateSecretValue(await readInput({ file: o.valueFile, stdin: o.stdin }, 65536));
+        const r = await (await hivesClient()).hives.secrets.update(project, secret, { value });
+        emit(r, () => table([r], ['id', 'name', 'version']));
+    });
+    secrets.command('delete <project_id> <secret_id>').description('Delete a secret in your authenticated org')
+        .action(async (project, secret) => { const r = await (await hivesClient()).hives.secrets.delete(project, secret); emit(r, () => `Deleted secret ${secret}.`); });
+    secrets.command('reveal <project_id> <secret_id>').description('Explicit, audit-logged plaintext reveal; requires --stdout')
+        .option('--stdout', 'write sensitive plaintext to stdout (avoid logs and retained output)')
+        .action(async (project, secret, o) => {
+        if (!o.stdout)
+            throw new Error('Reveal requires --stdout. This writes sensitive plaintext to your terminal or pipe; avoid logging or retaining it.');
+        const r = await (await hivesClient()).hives.secrets.reveal(project, secret);
+        emit(r, () => r.value);
+    });
+    secrets.command('bulk <project_id>').description('PUT a JSON array of secret names and values; existing names receive new versions')
+        .option('--file <path>', 'UTF-8 JSON input file').option('--stdin', 'read JSON from stdin')
+        .action(async (project, o) => {
+        const batch = parseSecretBatch(await readInput(o, 256 * 1024));
+        const r = await (await hivesClient()).hives.secrets.bulkUpsert(project, batch);
+        emit(r, () => table(r.secrets, ['id', 'name', 'version']));
+    });
+    const projects = hives.command('projects').description('Hives projects');
+    projects.command('list', { isDefault: true }).option('--search <text>', 'filter by project name')
+        .option('--page <number>', 'page number (1–10000)').option('--per-page <number>', 'items per page (1–100)')
+        .action(async (o) => {
+        const r = await (await hivesClient()).hives.projects.list({ search: o.search,
+            page: positiveInteger(o.page, '--page', 10000), per_page: positiveInteger(o.perPage, '--per-page', 100) });
+        emit(r, () => table(listOf(r), ['id', 'name', 'slug', 'region', 'total_deployments', 'active_instances']));
+    });
+    projects.command('get <project_id>').action(async (id) => {
+        const r = await (await hivesClient()).hives.projects.get(id);
+        emit(r, () => JSON.stringify(r, null, 2));
+    });
+    projects.command('create <name>').description('Create a project in your authenticated org')
+        .option('--kind <kind>', 'worker, function, site or api', 'worker')
+        .option('--description <text>', 'project description (up to 500 characters)')
+        .action(async (name, o) => {
+        if (!['worker', 'function', 'site', 'api'].includes(o.kind))
+            throw new Error('--kind must be worker, function, site or api.');
+        if (o.description && o.description.length > 500)
+            throw new Error('--description must be at most 500 characters.');
+        const r = await (await hivesClient()).hives.projects.create({ name: projectName(name), kind: o.kind,
+            ...(o.description === undefined ? {} : { description: o.description }) });
+        emit(r, () => table([r], ['id', 'name', 'slug', 'status']));
+    });
+    projects.command('delete <project_id>').description('Delete a project in your authenticated org')
+        .action(async (id) => { const r = await (await hivesClient()).hives.projects.delete(id); emit(r ?? { deleted: id }, () => `Deleted project ${id}.`); });
+    projects.command('rename <project_id> <name>').description('Rename a project in your authenticated org')
+        .action(async (id, name) => {
+        const r = await (await hivesClient()).hives.projects.update(id, { name: projectName(name) });
+        emit(r, () => table([r], ['id', 'name', 'slug', 'status']));
+    });
+    projects.command('activity <project_id>').description('Read persisted project activity')
+        .option('--action <action>', 'filter by action')
+        .option('--actor-type <type>', 'filter by actor type')
+        .option('--resource-type <type>', 'filter by resource type')
+        .option('--since <timestamp>', 'inclusive start timestamp in ISO 8601')
+        .option('--until <timestamp>', 'inclusive end timestamp in ISO 8601')
+        .option('--page <number>', 'page number (1–10000)')
+        .option('--per-page <number>', 'items per page (1–100)')
+        .action(async (id, o) => {
+        for (const [option, value] of [['--since', o.since], ['--until', o.until]]) {
+            if (value !== undefined && (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/.test(value) || !Number.isFinite(Date.parse(value)))) {
+                throw new Error(`${option} must be an ISO 8601 timestamp.`);
+            }
+        }
+        const r = await (await hivesClient()).hives.projects.activity(id, { action: o.action,
+            actor_type: o.actorType, resource_type: o.resourceType, since: o.since, until: o.until,
+            page: positiveInteger(o.page, '--page', 10000), per_page: positiveInteger(o.perPage, '--per-page', 100) });
+        emit(r, () => table(listOf(r), ['created_at', 'action', 'actor_id', 'resource_type', 'resource_name']));
+    });
+    // Last: extends the hives groups defined above (flights, logs, env values, domain reads).
+    registerHivesCoverage(hives, { client: hivesClient, emit, readRequest: deps.readHivesRequest });
+    // ---- relays ----------------------------------------------------------
+    const relays = program.command('relays').description('Relays: DNS zones and records');
+    registerRelaysEnrollment(relays, client, emit);
+    registerOperationCommands(relays, RELAYS_COMMANDS, { client, emit, signal: deps.signal });
+    relays.command('zones').description('List DNS zones').option('--search <q>').action(async (o) => {
+        const r = await (await client()).relays.zones.list(o.search ? { search: o.search } : {});
+        emit(r, () => table((r.zones ?? []), ['name', 'type', 'record_count', 'dnssec_enabled', 'status']));
+    });
+    relays.command('zone <zone>').description('Read one DNS zone').action(async (zone) => {
+        const result = await (await client()).relays.zones.get(zone);
+        emit(result, () => JSON.stringify(result, null, 2));
+    });
+    relays.command('dnssec <zone>').description('Read DNSSEC status and authoritative key availability').action(async (zone) => {
+        const result = await (await client()).relays.zones.dnssec(zone);
+        emit(result, () => JSON.stringify(result, null, 2));
+    });
+    // Writes need relays:write and act on the selected project's existing Relays account.
+    const dnsInt = (value, option, minimum, maximum) => {
+        if (value === undefined)
+            return undefined;
+        if (!/^\d+$/.test(value) || Number(value) < minimum || Number(value) > maximum)
+            throw new Error(`${option} must be an integer from ${minimum} to ${maximum}.`);
+        return Number(value);
+    };
+    const recordId = (value) => dnsInt(value, '<record_id>', 1, Number.MAX_SAFE_INTEGER);
+    relays.command('create-zone <name>').description('Create a DNS zone')
+        .option('--type <type>', 'NATIVE, MASTER or SLAVE (default NATIVE)').option('--no-default-records', 'skip the default records')
+        .action(async (name, o) => {
+        const result = await (await client()).relays.zones.create({ name, ...(o.type ? { type: o.type.toUpperCase() } : {}),
+            create_default_records: o.defaultRecords });
+        emit(result, () => `${c.green('✓')} Created zone ${name}`);
+    });
+    relays.command('update-zone <zone>').description('Update a zone\'s type or SOA settings')
+        .option('--type <type>', 'NATIVE, MASTER or SLAVE').option('--primary-ns <host>').option('--hostmaster <email>')
+        .option('--refresh <seconds>').option('--retry <seconds>').option('--expire <seconds>').option('--soa-ttl <seconds>')
+        .action(async (zone, o) => {
+        const soa = Object.fromEntries(Object.entries({ primary_ns: o.primaryNs, hostmaster: o.hostmaster,
+            refresh: dnsInt(o.refresh, '--refresh', 60, 2 ** 31), retry: dnsInt(o.retry, '--retry', 60, 2 ** 31),
+            expire: dnsInt(o.expire, '--expire', 3600, 2 ** 31), ttl: dnsInt(o.soaTtl, '--soa-ttl', 60, 2 ** 31) }).filter(([, v]) => v !== undefined));
+        const body = { ...(o.type ? { type: o.type.toUpperCase() } : {}), ...(Object.keys(soa).length ? { soa } : {}) };
+        if (!Object.keys(body).length)
+            throw new Error('Nothing to update: pass --type or an SOA option.');
+        const result = await (await client()).relays.zones.update(zone, body);
+        emit(result, () => `${c.green('✓')} Updated zone ${zone}`);
+    });
+    relays.command('delete-zone <zone>').description('Delete a zone and all its records').action(async (zone) => {
+        const result = await (await client()).relays.zones.delete(zone);
+        emit(result, () => `${c.green('✓')} Deleted zone ${zone}`);
+    });
+    const records = relays.command('records').description('DNS records in a zone');
+    records.command('get <zone> <record_id>').description('Read one record').action(async (zone, id) => {
+        const result = await (await client()).relays.records.get(zone, recordId(id));
+        emit(result, () => JSON.stringify(result, null, 2));
+    });
+    records.command('update <zone> <record_id>').description('Update a record')
+        .option('--name <name>').option('--type <type>').option('--content <content>').option('--ttl <seconds>', 'TTL, 60 to 86400')
+        .option('--priority <n>', '0 to 65535').option('--comment <text>').option('--disable', 'disable the record').option('--enable', 'enable the record')
+        .action(async (zone, id, o) => {
+        if (o.disable && o.enable)
+            throw new Error('Pass --disable or --enable, not both.');
+        const body = Object.fromEntries(Object.entries({ name: o.name, type: o.type?.toUpperCase(), content: o.content,
+            ttl: dnsInt(o.ttl, '--ttl', 60, 86400), priority: dnsInt(o.priority, '--priority', 0, 65535), comment: o.comment,
+            disabled: o.disable ? true : o.enable ? false : undefined }).filter(([, v]) => v !== undefined));
+        if (!Object.keys(body).length)
+            throw new Error('Nothing to update: pass at least one field option.');
+        const result = await (await client()).relays.records.update(zone, recordId(id), body);
+        emit(result, () => `${c.green('✓')} Updated record ${id} in ${zone}`);
+    });
+    records.command('list <zone>', { isDefault: true }).option('--type <type>').action(async (zone, o) => {
+        const r = await (await client()).relays.records.list(zone, o.type ? { type: o.type } : {});
+        emit(r, () => table((r.records ?? []), ['id', 'name', 'type', 'content', 'ttl']));
+    });
+    records.command('add <zone> <name> <type> <content>').option('--ttl <seconds>', 'TTL', '3600').action(async (zone, name, type, content, o) => {
+        const r = await (await client()).relays.records.create(zone, { name, type: type.toUpperCase(), content, ttl: Number(o.ttl) });
+        emit(r, () => `${c.green('✓')} Added ${type.toUpperCase()} ${name} → ${content} in ${zone}${r.id ? ` (id ${r.id})` : ''}`);
+    });
+    records.command('rm <zone> <record_id>').action(async (zone, id) => {
+        await (await client()).relays.records.delete(zone, Number(id));
+        emit({ deleted: Number(id) }, () => `${c.green('✓')} Deleted record ${id} from ${zone}`);
+    });
+    addHenryCommands(program, client, value => out.log(JSON.stringify(value, null, 2)), { line: text => out.log(text), ...(deps.signal ? { signal: deps.signal } : {}) });
+    registerFleets(program, client, (data) => emit(data, () => JSON.stringify(data, null, 2)));
+    registerFlocks(program, client, emit, env, deps.readFlocksCode, () => !!g().json);
+    registerBeacons(program, client, emit);
+    // ---- setup -----------------------------------------------------------
+    // The first-run experience lives in ./onboard and is imported only here, so no other command loads it.
+    program.command('setup [step]').description('Set up Genesis: sign in, pick a project, add the MCP server to your agents (resumable)')
+        .option('--restart', 'start again from the first step')
+        .option('--no-animation', 'draw every step still (also GENESIS_REDUCED_MOTION=1)')
+        .option('--screen-reader', 'linear output for screen readers (also GENESIS_SCREEN_READER=1)')
+        .option('--screencast', 'mask account names, emails and IDs, for recording demos (also GENESIS_SCREENCAST=1)')
+        .option('--sound', 'a soft chime when you are signed in and when setup finishes (also GENESIS_SOUND=1)')
+        .action(async (step, o) => {
+        const code = await runSetupLazily(o, step);
+        if (code)
+            throw new CommanderError(code, 'genesis.setup', '');
+    });
+    const runSetupLazily = async (o, step) => {
+        const [{ runSetup }, authModule, deviceModule] = await Promise.all([import('./onboard/index.js'), import('./auth.js'), import('./device-login.js')]);
+        return runSetup({ version: program.version() ?? '', env, fetch: f, auth, getStore, client: () => client(), openBrowser: deps.openBrowser ?? defaultOpen,
+            baseUrl: g().baseUrl ?? env.GENESIS_BASE_URL ?? DEFAULT_BASE_URL, log: (s) => out.log(s),
+            flags: { json: g().json, animation: o.animation, screenReader: o.screenReader, sound: o.sound, screencast: o.screencast, restart: o.restart, step },
+            login: { startLogin: authModule.startLogin, completeLogin: authModule.completeLogin, selectSavedContext: authModule.selectSavedContext,
+                savedLoginProvider: authModule.savedLoginProvider, startDeviceLogin: deviceModule.startDeviceLogin, completeDeviceLogin: deviceModule.completeDeviceLogin } });
+    };
+    // ---- status ----------------------------------------------------------
+    program.command('status').description('Live state of each Genesis service, from the gateway (GET /v1/status)').action(async () => {
+        const configured = g().baseUrl ?? env.GENESIS_BASE_URL ?? DEFAULT_BASE_URL;
+        // Same transport rule as the SDK client (https, or http only on exact loopback hosts).
+        try {
+            requireSecureUrl(configured, 'base URL');
+        }
+        catch (e) {
+            throw new Error(`Refusing base URL ${safe(configured)}: ${safe(e.message)}`);
+        }
+        const base = new URL(configured);
+        const url = `${base.href.replace(/\/+$/, '')}/v1/status`;
+        let response;
+        try {
+            response = await f(url, { method: 'GET', headers: { accept: 'application/json', 'user-agent': 'genesis-cli/0.2.0' }, signal: AbortSignal.timeout(15_000) });
+        }
+        catch (e) {
+            throw new Error(`Gateway unreachable at ${safe(url)}: ${safe(e.message)}`);
+        }
+        if (!response.ok)
+            throw new Error(`Gateway status check failed: GET ${safe(url)} returned HTTP ${response.status}`);
+        const report = await response.json().catch(() => undefined);
+        if (!report || !Array.isArray(report.services))
+            throw new Error(`Gateway status check failed: GET ${safe(url)} did not return a service list`);
+        const rows = report.services;
+        emit(report, () => [
+            table(rows.map((s) => ({ service: s.service, state: s.state, http_status: s.http_status, latency_ms: s.latency_ms, reason: s.reason })), ['service', 'state', 'http_status', 'latency_ms', 'reason']),
+            ...(report.checked_at ? [c.dim(`checked ${safe(report.checked_at)} via ${safe(url)}`)] : []),
+        ].join('\n'));
+    });
+    return program;
+}
+/**
+ * A bare `genesis` on a terminal, before setup is finished, is the first run: it opens `genesis setup`. Everywhere
+ * else (a pipe, CI, TERM=dumb, setup complete) it prints the help as before. Only the setup state file is read here.
+ */
+async function firstRun(argv, deps) {
+    if (argv.length > 2 || deps.out)
+        return false;
+    const env = deps.env ?? process.env;
+    const set = (v) => !!v && v !== '0' && v !== 'false';
+    if (!process.stdout.isTTY || !process.stdin.isTTY || env.TERM === 'dumb'
+        || set(env.CI) || env.GITHUB_ACTIONS || env.BUILDKITE || env.GITLAB_CI || env.TF_BUILD)
+        return false;
+    const { SetupStore, complete } = await import('./onboard/state.js');
+    return !complete(await SetupStore.for(env).read());
+}
+export async function main(argv, deps = {}) {
+    const out = deps.out ?? stdio;
+    const program = buildProgram(deps);
+    if (await firstRun(argv, deps).catch(() => false))
+        argv = [...argv, 'setup'];
+    try {
+        await program.parseAsync(argv);
+        return 0;
+    }
+    catch (e) {
+        if (e instanceof CommanderError)
+            return e.exitCode;
+        const json = program.opts().json;
+        if (e instanceof GenesisError) {
+            // Dials needs a project, workspace and environment: from flags, a selected context or an org key's binding.
+            const dialsScopeHint = e.operationId?.startsWith('dials_') && /invalid_scope/i.test(`${e.code ?? ''} ${e.message} ${e.type}`)
+                ? ' Pass --workspace, --project and --environment, select a context (genesis context select), or use an org API key bound to a project.' : '';
+            if (json)
+                out.err(JSON.stringify({ error: { type: e.type, status: e.status, message: e.message, request_id: e.requestId, ...errorCatalog(e),
+                        ...((e instanceof HivesOperationError || e instanceof HivesQueueOperationError) ? { operation: e.operation } : {}),
+                        ...(e.operationId && isMindsOperation(e.operationId) && errorOutcome(e.body) === 'unknown' ? { outcome: 'unknown' } : {}),
+                        ...(e instanceof MindsAgentError || e instanceof MindsOwnerError ? { code: e.code, ...(e instanceof MindsAgentError ? { dpop_nonce: e.dpopNonce } : {}),
+                            ...(errorOutcome(e.body) !== undefined ? { outcome: errorOutcome(e.body) } : {}) } : {}) } }));
+            else
+                out.err(`${c.red('✗')} ${safe(e.message)}${dialsScopeHint}${(e instanceof HivesOperationError || e instanceof HivesQueueOperationError) ? ` Operation: ${safe(e.operation.operation_id)} (${safe(e.operation.state)}).` : ''}${e.status ? c.dim(` (${e.status} ${safe(e.type)})`) : ''}${e.requestId ? `\n${c.dim(`request_id: ${safe(e.requestId)}`)}` : ''}`);
+            return 1;
+        }
+        const msg = e.message ?? String(e);
+        const net = /fetch failed|ENOTFOUND|ECONNREFUSED/.test(msg + (e.cause?.code ?? ''));
+        out.err(json ? JSON.stringify({ error: { type: net ? 'network' : 'error', message: msg } })
+            : `${c.red('✗')} ${net ? `Could not reach the Genesis API gateway (${safe(msg)}). Try --direct to call service hosts directly.` : safe(msg)}`);
+        return 1;
+    }
+}