@onesi/genesis-cli 0.1.13 → 0.2.1

package/dist/hives-coverage.d.ts

@@ -0,0 +1,12 @@
+import type { Command } from 'commander';
+import { type Genesis, type OperationId } from '@onesi/genesis';
+/** `genesis hives <words>` -> Hives operation. Positional arguments are the path parameters, query
+ * parameters become options, a JSON body comes from --body-file. Groups that already exist
+ * (functions, deployments, environment, domains, logs) are extended, never replaced. */
+export declare const HIVES_COVERAGE_COMMANDS: Record<string, OperationId>;
+/** Register after every other `hives` group so existing groups are found and extended. */
+export declare function registerHivesCoverage(hives: Command, deps: {
+    client: () => Promise<Genesis>;
+    emit: (data: unknown, pretty: () => string) => void;
+    readRequest?: (path: string, limit: number) => Promise<unknown>;
+}): void;

package/dist/hives-coverage.js

@@ -0,0 +1,133 @@
+import { hivesSseWindow, idempotencyHeaders, operationTable } from '@onesi/genesis';
+import { readFunctionJson } from './function-input.js';
+import { bytes } from './hives-resources.js';
+/** `genesis hives <words>` -> Hives operation. Positional arguments are the path parameters, query
+ * parameters become options, a JSON body comes from --body-file. Groups that already exist
+ * (functions, deployments, environment, domains, logs) are extended, never replaced. */
+export const HIVES_COVERAGE_COMMANDS = {
+    'flights list': 'hives_list_flights',
+    'flights create': 'hives_create_flight',
+    'flights get': 'hives_get_flight',
+    'flights files': 'hives_list_flight_files',
+    'flights read-file': 'hives_read_flight_file',
+    'flights processes': 'hives_list_flight_processes',
+    'flights env': 'hives_list_flight_env',
+    'flights debug-metrics': 'hives_list_flight_debug_metrics',
+    'functions logs': 'hives_query_function_logs',
+    'deployments stream-logs': 'hives_stream_deployment_logs',
+    'logs aggregate': 'hives_aggregate_logs',
+    'logs search': 'hives_search_logs',
+    'environment values': 'hives_get_project_env',
+    'environment set': 'hives_set_project_env',
+    'environment delete': 'hives_delete_project_env',
+    'environment delete-key': 'hives_delete_project_env_key',
+    'domains get': 'hives_get_domain',
+    'domains delete': 'hives_delete_domain',
+    'domains verification-record': 'hives_get_verification_record',
+    'cells objects put-download': 'hives_upload_object_named_download',
+    'cells objects remove-download': 'hives_delete_object_named_download',
+};
+const DESCRIPTIONS = {
+    flights: 'Flights: WASM HTTP workloads served at their own address',
+    logs: 'Project logs',
+    domains: 'Custom domains for a project',
+};
+const BODY_LIMIT = 1024 * 1024;
+const flag = (name) => name.replace(/_/g, '-').toLowerCase();
+const key = (name) => flag(name).replace(/-([a-z])/g, (_, c) => c.toUpperCase());
+const integer = (value, name, max) => {
+    if (value === undefined)
+        return undefined;
+    if (!/^\d+$/.test(value) || Number(value) < 1 || Number(value) > max)
+        throw new Error(`${name} must be an integer from 1 to ${max}.`);
+    return Number(value);
+};
+const subcommand = (parent, name) => parent.commands.find((c) => c.name() === name) ?? parent.command(name).description(DESCRIPTIONS[name] ?? name);
+function queryValue(schema, value) {
+    const type = schema?.type;
+    if (type === 'integer') {
+        if (!/^\d+$/.test(value))
+            throw new Error(`Expected an integer, got "${value}".`);
+        return Number(value);
+    }
+    if (type === 'boolean') {
+        if (value !== 'true' && value !== 'false')
+            throw new Error(`Expected true or false, got "${value}".`);
+        return value === 'true';
+    }
+    return value;
+}
+/** Register after every other `hives` group so existing groups are found and extended. */
+export function registerHivesCoverage(hives, deps) {
+    const read = deps.readRequest ?? readFunctionJson;
+    const output = (data) => deps.emit(data ?? { ok: true }, () => JSON.stringify(data ?? { ok: true }, null, 2));
+    for (const [words, id] of Object.entries(HIVES_COVERAGE_COMMANDS)) {
+        const op = operationTable[id];
+        const parts = words.split(' ');
+        let parent = hives;
+        for (const part of parts.slice(0, -1))
+            parent = subcommand(parent, part);
+        const properties = (op.inputSchema.properties ?? {});
+        const required = op.inputSchema.required;
+        if (id === 'hives_delete_project_env') {
+            // The body is a JSON array of names: take them as arguments instead of a file.
+            parent.command(`${parts.at(-1)} <project_id> <names...>`).description(`${op.summary} (${op.method} ${op.path})`)
+                .action(async (project, names) => output(await (await deps.client()).request(id, { project_id: project, body: names })));
+            continue;
+        }
+        if (id === 'hives_upload_object_named_download') {
+            // Raw object bytes from a file, through the same Cells checks as `cells objects put-flat`.
+            parent.command(`${parts.at(-1)} <project_id> <bucket_id>`).description(`${op.summary} (${op.method} ${op.path})`)
+                .requiredOption('--file <path>', 'Exact binary bytes up to 10 MiB').option('--content-type <value>')
+                .option('--idempotency-key <key>', '1-128 printable ASCII; reuse it only to replay the same write (a fresh key is sent when omitted)')
+                .action(async (project, bucket, o) => output(await (await deps.client()).hives.cells.objects.putDownload(project, bucket, await bytes(o.file), { content_type: o.contentType, idempotencyKey: o.idempotencyKey })));
+            continue;
+        }
+        if (id === 'hives_delete_object_named_download') {
+            parent.command(`${parts.at(-1)} <project_id> <bucket_id>`).description(`${op.summary} (${op.method} ${op.path})`)
+                .action(async (project, bucket) => { await (await deps.client()).hives.cells.objects.removeDownload(project, bucket); output({ acknowledged: true }); });
+            continue;
+        }
+        const command = parent.command([parts.at(-1), ...op.pathParams.map((p) => `<${p}>`)].join(' '))
+            .description(`${op.summary} (${op.method} ${op.path})`);
+        for (const q of op.queryParams) {
+            const description = properties[q]?.description;
+            command[required.includes(q) ? 'requiredOption' : 'option'](`--${flag(q)} <value>`, description);
+        }
+        if (op.hasBody)
+            command[required.includes('body') ? 'requiredOption' : 'option']('--body-file <path>', 'JSON request body, up to 1 MiB');
+        if (op.idempotencyKey)
+            command.option('--idempotency-key <key>', 'Required when slug is omitted; reuse it to get the original result');
+        if (op.stream) {
+            command.option('--max-events <number>', 'stop after this many events (1-1000, default 100)')
+                .option('--seconds <number>', 'stop after this many seconds (1-15, default 10)');
+        }
+        if (id === 'hives_get_project_env')
+            command.option('--stdout', 'write every decrypted value to stdout (avoid retained output)');
+        command.action(async (...args) => {
+            const options = args[op.pathParams.length];
+            if (id === 'hives_get_project_env' && !options.stdout)
+                throw new Error('Reading every environment value requires --stdout. Avoid logging or retaining the plaintext.');
+            const input = Object.fromEntries(op.pathParams.map((p, i) => [p, args[i]]));
+            for (const q of op.queryParams) {
+                const value = options[key(q)];
+                if (value === undefined)
+                    continue;
+                input[q] = typeof value === 'boolean' ? value : queryValue(properties[q], value);
+            }
+            if (typeof options.bodyFile === 'string')
+                input.body = await read(options.bodyFile, BODY_LIMIT);
+            const client = await deps.client();
+            if (op.stream) {
+                const response = await client.raw(id, input, { headers: { accept: 'text/event-stream' } });
+                output(await hivesSseWindow(response, {
+                    maxEvents: integer(options.maxEvents, '--max-events', 1000),
+                    seconds: integer(options.seconds, '--seconds', 15),
+                }));
+                return;
+            }
+            const headers = idempotencyHeaders(id, options.idempotencyKey);
+            output(await client.request(id, input, { headers }));
+        });
+    }
+}

package/dist/hives-node-transport.js

@@ -11,10 +11,13 @@ export async function closeHivesNodeTransport() {
     await current?.destroy();
 }
 export function hivesOperationBudget(id) {
-    if (['hives_list_buckets', 'hives_create_bucket', 'hives_get_bucket', 'hives_delete_bucket', 'hives_list_objects', 'hives_upload_object', 'hives_upload_object_by_key', 'hives_delete_object', 'hives_delete_object_by_key', 'hives_download_object_by_key', 'hives_get_cors_config', 'hives_set_cors_config', 'hives_generate_presigned_url', 'hives_reconcile'].includes(id))
+    if (['hives_list_buckets', 'hives_create_bucket', 'hives_get_bucket', 'hives_delete_bucket', 'hives_list_objects', 'hives_upload_object', 'hives_upload_object_by_key', 'hives_upload_object_named_download', 'hives_delete_object', 'hives_delete_object_by_key', 'hives_delete_object_named_download', 'hives_download_object_by_key', 'hives_get_cors_config', 'hives_set_cors_config', 'hives_generate_presigned_url', 'hives_reconcile'].includes(id))
         return 100_000;
     if (id === 'hives_cancel_deployment' || id === 'hives_delete_deployment' || id === 'hives_stop_deployment')
         return 330_000;
+    // A live SSE subscription is bounded by its caller's window or --follow limit (at most 300 s).
+    if (id === 'hives_stream_logs' || id === 'hives_stream_deployment_logs')
+        return 330_000;
     if (['hives_create_deployment', 'hives_upload_deployment', 'hives_invoke_deployment', 'hives_invoke_function', 'hives_invoke_function_async'].includes(id))
         return 40_000;
     if (['hives_create_function', 'hives_update_function', 'hives_delete_function'].includes(id))

package/dist/hives-operations.d.ts

@@ -4,6 +4,7 @@ type Deps = {
     client: () => Promise<Genesis>;
     emit: (data: unknown, pretty: () => string) => void;
     readRequest?: (path: string, limit: number) => Promise<Record<string, unknown>>;
+    line?: (text: string) => void;
 };
 export declare function registerHivesOperations(hives: Command, deps: Deps): void;
 export {};

package/dist/hives-operations.js

@@ -1,4 +1,5 @@
 import { registerHivesResources } from './hives-resources.js';
+import { registerHivesPlatform } from './hives-platform.js';
 import { Option } from 'commander';
 import { readFunctionJson } from './function-input.js';
 function metricsOptions(command) {
@@ -18,6 +19,7 @@ const paging = (command) => command.option('--page <number>').option('--per-page
 const pagination = (o) => ({ page: integer(o.page, '--page', 10000), per_page: integer(o.perPage, '--per-page', 100) });
 export function registerHivesOperations(hives, deps) {
     registerHivesResources(hives, deps);
+    registerHivesPlatform(hives, { client: deps.client, emit: deps.emit, line: deps.line });
     const output = (data) => deps.emit(data, () => JSON.stringify(data, null, 2));
     const read = deps.readRequest ?? readFunctionJson;
     const settings = hives.command('settings').description('Stored project preferences and actual engine capabilities');

package/dist/hives-platform.d.ts

@@ -0,0 +1,13 @@
+import { Command } from 'commander';
+import type { Genesis } from '@onesi/genesis';
+type Deps = {
+    client: () => Promise<Genesis>;
+    emit: (data: unknown, pretty: () => string) => void;
+    /** Print one line as it arrives (live log streams). */
+    line?: (text: string) => void;
+    readText?: (path: string, limit: number) => Promise<Uint8Array>;
+    writeNew?: (path: string, bytes: Uint8Array) => Promise<void>;
+};
+/** Hives logs (query and live SSE), custom domains, regions, the Hives identity, Hives fleets and remote sessions/SFTP. */
+export declare function registerHivesPlatform(hives: Command, deps: Deps): void;
+export {};

package/dist/hives-platform.js

@@ -0,0 +1,133 @@
+import { readFile, stat, writeFile } from 'node:fs/promises';
+const SFTP_BYTES = 10 * 1024 * 1024;
+const MANIFEST_BYTES = 64 * 1024;
+function integer(value, name, min, max) {
+    if (value === undefined)
+        return undefined;
+    if (!/^\d+$/.test(value) || !Number.isSafeInteger(Number(value)) || Number(value) < min || Number(value) > max) {
+        throw new Error(`${name} must be an integer from ${min} to ${max}.`);
+    }
+    return Number(value);
+}
+async function readBounded(path, limit) {
+    const metadata = await stat(path);
+    if (!metadata.isFile() || metadata.size > limit)
+        throw new Error(`Choose a regular file of at most ${limit} bytes.`);
+    const bytes = await readFile(path);
+    if (bytes.byteLength > limit)
+        throw new Error(`File exceeds ${limit} bytes.`);
+    return Uint8Array.from(bytes);
+}
+/** Hives logs (query and live SSE), custom domains, regions, the Hives identity, Hives fleets and remote sessions/SFTP. */
+export function registerHivesPlatform(hives, deps) {
+    const output = (data) => deps.emit(data, () => JSON.stringify(data, null, 2));
+    const line = deps.line ?? ((text) => process.stdout.write(text + '\n'));
+    const read = deps.readText ?? readBounded;
+    const writeNew = deps.writeNew ?? ((path, bytes) => writeFile(path, bytes, { flag: 'wx', mode: 0o600 }));
+    const api = async () => (await deps.client()).hives;
+    const logs = hives.command('logs').description('Project logs: retained query and live Server-Sent Events');
+    logs.command('query <project_id>').option('--level <level>').option('--source <source>').option('--search <text>')
+        .option('--start <time>', 'inclusive UTC timestamp').option('--end <time>', 'exclusive UTC timestamp').option('--request-id <id>')
+        .option('--page <number>').option('--per-page <number>')
+        .action(async (project, o) => output(await (await api()).logs.query(project, { level: o.level, source: o.source, search: o.search, start: o.start, end: o.end, request_id: o.requestId,
+        page: integer(o.page, '--page', 1, 10000), per_page: integer(o.perPage, '--per-page', 1, 100) })));
+    logs.command('stream <project_id>').description('Live events. Bounded by --max-events and --seconds; --follow prints each event as it arrives')
+        .option('--level <level>').option('--source <source>').option('--heartbeat', 'ask the server for heartbeat events')
+        .option('--max-events <number>', 'stop after this many events (1-10000; default 100, unlimited with --follow)')
+        .option('--seconds <number>', 'stop after this many seconds (1-300; default 10, or 300 with --follow)')
+        .option('--follow', 'print one JSON event per line as it arrives')
+        .action(async (project, o) => {
+        const q = { level: o.level, source: o.source, ...(o.heartbeat ? { heartbeat: true } : {}) };
+        const maxEvents = integer(o.maxEvents, '--max-events', 1, 10000);
+        const seconds = integer(o.seconds, '--seconds', 1, 300) ?? (o.follow ? 300 : 10);
+        const client = await api();
+        if (!o.follow) {
+            output(await client.logs.window(project, q, { maxEvents: maxEvents ?? 100, seconds }));
+            return;
+        }
+        const stop = new AbortController();
+        const timer = setTimeout(() => stop.abort(), seconds * 1000);
+        let count = 0;
+        try {
+            for await (const event of client.logs.stream(project, q, { signal: stop.signal })) {
+                line(JSON.stringify(event));
+                count++;
+                if (maxEvents !== undefined && count >= maxEvents)
+                    break;
+            }
+        }
+        catch (error) {
+            // Reaching --seconds closes the connection; that is the bounded end, not a failure.
+            if (!stop.signal.aborted)
+                throw error;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    });
+    const domains = hives.command('domains').description('Custom domains for a project: add, DNS verification and certificate provisioning');
+    domains.command('list <project_id>').option('--page <number>').option('--per-page <number>')
+        .action(async (project, o) => output(await (await api()).domains.list(project, { page: integer(o.page, '--page', 1, 10000), per_page: integer(o.perPage, '--per-page', 1, 100) })));
+    domains.command('add <project_id> <domain>').action(async (project, domain) => output(await (await api()).domains.add(project, { domain })));
+    domains.command('verify <project_id> <domain_id>').description('Check the DNS verification record now')
+        .action(async (project, id) => output(await (await api()).domains.verify(project, id)));
+    domains.command('provision-ssl <project_id> <domain_id>').description('Request a certificate for a verified domain')
+        .action(async (project, id) => output(await (await api()).domains.provisionSsl(project, id)));
+    hives.command('regions').description('Regions Hives can place projects in').command('list')
+        .action(async () => output(await (await api()).regions.list()));
+    hives.command('auth').description('The identity Hives sees for this credential').command('me')
+        .action(async () => output(await (await api()).auth.me()));
+    const fleets = hives.command('fleets').description('Hives fleets deployed from a map-fleet.toml manifest');
+    fleets.command('list').action(async () => output(await (await api()).fleets.list()));
+    fleets.command('deploy').requiredOption('--manifest-file <path>', 'map-fleet.toml manifest (at most 64 KiB)')
+        .action(async (o) => {
+        const manifestToml = new TextDecoder('utf-8', { fatal: true }).decode(await read(o.manifestFile, MANIFEST_BYTES));
+        output(await (await api()).fleets.deploy({ manifestToml }));
+    });
+    fleets.command('status <fleet_id>').action(async (id) => output(await (await api()).fleets.status(id)));
+    fleets.command('teardown <fleet_id>').action(async (id) => {
+        const result = await (await api()).fleets.teardown(id);
+        output(result ?? { torn_down: id });
+    });
+    const remote = hives.command('remote').description('Remote SSH, terminal and debug sessions, and SFTP, for a project target');
+    const sessions = remote.command('sessions').description('Open remote sessions');
+    sessions.command('list <project_id>').option('--type <session_type>', 'ssh, terminal or debug').option('--target <target_id>')
+        .action(async (project, o) => output(await (await api()).remote.sessions.list(project, { session_type: o.type, target_id: o.target })));
+    sessions.command('close <project_id> <session_id>').action(async (project, id) => output(await (await api()).remote.sessions.close(project, id)));
+    remote.command('ssh <project_id> <target_id>').requiredOption('--public-key-file <path>', 'your SSH public key (never a private key)')
+        .option('--ttl-secs <seconds>', 'session lifetime (60-86400; default 3600)')
+        .action(async (project, target, o) => {
+        const public_key = new TextDecoder('utf-8', { fatal: true }).decode(await read(o.publicKeyFile, 16 * 1024)).trim();
+        if (/PRIVATE KEY/.test(public_key) || !/^(ssh-|ecdsa-|sk-)/.test(public_key))
+            throw new Error('Provide an OpenSSH public key file (for example ~/.ssh/id_ed25519.pub).');
+        output(await (await api()).remote.ssh(project, { target_id: target, public_key, ttl_secs: integer(o.ttlSecs, '--ttl-secs', 60, 86400) }));
+    });
+    remote.command('terminal <project_id> <target_id>').option('--shell <path>').option('--cols <number>').option('--rows <number>')
+        .action(async (project, target, o) => output(await (await api()).remote.terminal(project, { target_id: target, shell: o.shell, cols: integer(o.cols, '--cols', 1, 1000), rows: integer(o.rows, '--rows', 1, 1000) })));
+    remote.command('debug <project_id> <target_id>').option('--protocol <protocol>', 'dap or chrome-devtools')
+        .action(async (project, target, o) => output(await (await api()).remote.debug(project, { target_id: target, protocol: o.protocol })));
+    const sftp = remote.command('sftp').description('Files on a remote target');
+    sftp.command('ls <project_id> <target_id>').option('--path <path>')
+        .action(async (project, target, o) => output(await (await api()).remote.sftp.list(project, target, { path: o.path })));
+    sftp.command('read <project_id> <target_id> <path>').option('--output-file <path>', 'write the decoded content_base64 to a new private file')
+        .action(async (project, target, path, o) => {
+        const result = await (await api()).remote.sftp.read(project, target, path);
+        if (!o.outputFile) {
+            output(result);
+            return;
+        }
+        const encoded = result?.content_base64;
+        if (typeof encoded !== 'string' || encoded.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/.test(encoded))
+            throw new Error('Hives returned no valid content_base64 for this file.');
+        const decoded = Buffer.from(encoded, 'base64');
+        if (decoded.toString('base64') !== encoded)
+            throw new Error('Hives returned no valid content_base64 for this file.');
+        const bytes = Uint8Array.from(decoded);
+        await writeNew(o.outputFile, bytes);
+        output({ saved: true, bytes: bytes.byteLength });
+    });
+    sftp.command('write <project_id> <target_id> <path>').requiredOption('--file <local_path>', 'local file to upload (at most 10 MiB)')
+        .action(async (project, target, path, o) => output(await (await api()).remote.sftp.write(project, target, { path, content_base64: Buffer.from(await read(o.file, SFTP_BYTES)).toString('base64') })));
+    sftp.command('delete <project_id> <target_id> <path>')
+        .action(async (project, target, path) => output(await (await api()).remote.sftp.delete(project, target, { path })));
+}

package/dist/hives-resources.d.ts

@@ -5,5 +5,6 @@ type Deps = {
     emit: (data: unknown, pretty: () => string) => void;
     readRequest?: (path: string, limit: number) => Promise<Record<string, unknown>>;
 };
+export declare function bytes(path: string): Promise<Uint8Array>;
 export declare function registerHivesResources(hives: Command, deps: Deps): void;
 export {};

package/dist/hives-resources.js

@@ -2,7 +2,7 @@ import { registerHivesMarketplace } from './hives-marketplace.js';
 import { createReadStream } from 'node:fs';
 import { stat, writeFile } from 'node:fs/promises';
 import { readFunctionJson } from './function-input.js';
-async function bytes(path) {
+export async function bytes(path) {
     const metadata = await stat(path);
     if (!metadata.isFile() || metadata.size > 10 * 1024 * 1024)
         throw new Error('Choose a regular file of at most 10 MiB.');
@@ -23,6 +23,8 @@ async function bytes(path) {
     }
     return Uint8Array.from(Buffer.concat(chunks, total));
 }
+/** Funded writes (topic publish, Cells object writes) carry one Idempotency-Key; without the option a fresh one is sent. */
+const FUNDED_KEY = '1-128 printable ASCII; reuse it only to replay the same write (a fresh key is sent when omitted)';
 function number(value, min, max) { if (value === undefined)
     return undefined; if (!/^\d+$/.test(value) || !Number.isSafeInteger(Number(value)) || Number(value) < min || Number(value) > max)
     throw new Error('Invalid bounded numeric option.'); return Number(value); }
@@ -43,7 +45,7 @@ export function registerHivesResources(hives, deps) {
     const objects = cells.command('objects');
     objects.command('list <project_id> <bucket_id>').option('--prefix <value>').option('--delimiter <value>').option('--continuation-token <value>').option('--max-keys <number>').action(async (project, id, o) => output(await (await deps.client()).hives.cells.objects.list(project, id, { prefix: o.prefix, delimiter: o.delimiter, continuation_token: o.continuationToken, max_keys: number(o.maxKeys, 1, 1000) })));
     for (const action of ['put', 'put-flat'])
-        objects.command(`${action} <project_id> <bucket_id> <key>`).requiredOption('--file <path>', 'Exact binary bytes up to 10 MiB').option('--content-type <value>').action(async (project, id, key, o) => { const client = await deps.client(); output(await client.hives.cells.objects[action === 'put' ? 'put' : 'putFlat'](project, id, key, await bytes(o.file), { content_type: o.contentType })); });
+        objects.command(`${action} <project_id> <bucket_id> <key>`).requiredOption('--file <path>', 'Exact binary bytes up to 10 MiB').option('--content-type <value>').option('--idempotency-key <key>', FUNDED_KEY).action(async (project, id, key, o) => { const client = await deps.client(); output(await client.hives.cells.objects[action === 'put' ? 'put' : 'putFlat'](project, id, key, await bytes(o.file), { content_type: o.contentType, idempotencyKey: o.idempotencyKey })); });
     for (const action of ['remove', 'remove-flat'])
         objects.command(`${action} <project_id> <bucket_id> <key>`).action(async (project, id, key) => { await (await deps.client()).hives.cells.objects[action === 'remove' ? 'remove' : 'removeFlat'](project, id, key); output({ acknowledged: true }); });
     objects.command('download <project_id> <bucket_id> <key>').requiredOption('--output-file <path>', 'Create a new file; existing files are never overwritten').action(async (project, id, key, o) => { const response = await (await deps.client()).hives.cells.objects.download(project, id, key); const data = new Uint8Array(await response.arrayBuffer()); await writeFile(o.outputFile, data, { flag: 'wx', mode: 0o600 }); output({ saved: true, bytes: data.byteLength }); });
@@ -75,7 +77,7 @@ export function registerHivesResources(hives, deps) {
     for (const action of ['get', 'remove'])
         topics.command(`${action} <project_id> <topic_id>`).action(async (project, id) => output(await (await deps.client()).hives.topics[action](project, id)));
     topics.command('create <project_id>').requiredOption('--request-file <path>', 'JSON topic name').action(async (project, o) => output(await (await deps.client()).hives.topics.create(project, await read(o.requestFile, 4096))));
-    topics.command('publish <project_id> <topic_id>').requiredOption('--request-file <path>', 'Exactly body or body_base64 plus optional string attributes; no automatic retry').action(async (project, id, o) => output(await (await deps.client()).hives.topics.publish(project, id, await read(o.requestFile, 512 * 1024))));
+    topics.command('publish <project_id> <topic_id>').requiredOption('--request-file <path>', 'Exactly body or body_base64 plus optional string attributes; no automatic retry').option('--idempotency-key <key>', FUNDED_KEY).action(async (project, id, o) => output(await (await deps.client()).hives.topics.publish(project, id, await read(o.requestFile, 512 * 1024), { idempotencyKey: o.idempotencyKey })));
     const subscriptions = topics.command('subscriptions').description('Same-project standard queue destinations; removing a subscription retains queued messages');
     subscriptions.command('list <project_id> <topic_id>').action(async (project, id) => output(await (await deps.client()).hives.topics.subscriptions.list(project, id)));
     subscriptions.command('add <project_id> <topic_id> <queue_id>').action(async (project, id, queue) => output(await (await deps.client()).hives.topics.subscriptions.add(project, id, queue)));

package/dist/iam-directory.d.ts

@@ -0,0 +1,15 @@
+import type { Command } from 'commander';
+import type { Genesis } from '@onesi/genesis';
+type Dependencies = {
+    client: () => Promise<Genesis>;
+    orgId: (client: Genesis) => Promise<string>;
+    emit: (data: unknown, pretty: () => string) => void;
+};
+/**
+ * `genesis projects` and `genesis workspaces`: the IAM organization directory of the org you are
+ * signed in to (or --org). IAM accepts only a One account login; API keys get IAM_HUMAN_SESSION_REQUIRED.
+ * Writes need iam:write and owner/admin authority in the organization. The gateway binds the organization
+ * context (Auth organization-context exchange) itself; this CLI sends one request and changes no session or context.
+ */
+export declare function registerIamDirectory(program: Command, dependencies: Dependencies): void;
+export {};

package/dist/iam-directory.js

@@ -0,0 +1,71 @@
+import { randomUUID } from 'node:crypto';
+import { table } from './output.js';
+const KEY = ['--idempotency-key <key>', 'Reuse the key from an uncertain earlier attempt to replay it; otherwise a new one is minted'];
+const rows = (r) => (r?.items ?? []);
+/**
+ * `genesis projects` and `genesis workspaces`: the IAM organization directory of the org you are
+ * signed in to (or --org). IAM accepts only a One account login; API keys get IAM_HUMAN_SESSION_REQUIRED.
+ * Writes need iam:write and owner/admin authority in the organization. The gateway binds the organization
+ * context (Auth organization-context exchange) itself; this CLI sends one request and changes no session or context.
+ */
+export function registerIamDirectory(program, dependencies) {
+    const { client, orgId, emit } = dependencies;
+    const scope = async () => { const gen = await client(); return { gen, org: await orgId(gen) }; };
+    const projects = program.command('projects').description('Projects in your organization (One account login; writes need owner or admin)');
+    projects.command('list', { isDefault: true }).action(async () => {
+        const { gen, org } = await scope();
+        const r = await gen.projects.list(org);
+        emit(r, () => table(rows(r), ['id', 'name', 'slug']));
+    });
+    projects.command('get <project_id>').action(async (id) => {
+        const { gen, org } = await scope();
+        const r = await gen.projects.get(org, id);
+        emit(r, () => table([r], ['id', 'name', 'slug', 'organization_id']));
+    });
+    projects.command('create <name>').description('Create a project').requiredOption('--slug <slug>', 'unique within the organization').option(...KEY)
+        .action(async (name, o) => {
+        const { gen, org } = await scope();
+        const r = await gen.projects.create(org, { name, slug: o.slug }, o.idempotencyKey ?? randomUUID());
+        emit(r, () => table([r], ['id', 'name', 'slug']));
+    });
+    projects.command('rename <project_id> <name>').description('Rename a project').option('--slug <slug>', 'also change the slug')
+        .action(async (id, name, o) => {
+        const { gen, org } = await scope();
+        const r = await gen.projects.update(org, id, { name, ...(o.slug ? { slug: o.slug } : {}) });
+        emit(r, () => table([r], ['id', 'name', 'slug']));
+    });
+    projects.command('delete <project_id>').description('Permanently delete a project (refused while workspaces, fleets or grants use it)')
+        .action(async (id) => {
+        const { gen, org } = await scope();
+        await gen.projects.delete(org, id);
+        emit({ deleted: id }, () => `Deleted project ${id}.`);
+    });
+    const workspaces = program.command('workspaces').description('Workspaces in your organization (One account login; writes need owner or admin)');
+    workspaces.command('list', { isDefault: true }).action(async () => {
+        const { gen, org } = await scope();
+        const r = await gen.workspaces.list(org);
+        emit(r, () => table(rows(r), ['id', 'name', 'projectId']));
+    });
+    workspaces.command('get <workspace_id>').action(async (id) => {
+        const { gen, org } = await scope();
+        const r = await gen.workspaces.get(org, id);
+        emit(r, () => table([r], ['id', 'name', 'projectId', 'organizationId']));
+    });
+    workspaces.command('create <name>').description('Create a workspace').option('--project <project_id>', 'the project it belongs to').option(...KEY)
+        .action(async (name, o) => {
+        const { gen, org } = await scope();
+        const r = await gen.workspaces.create(org, { name, ...(o.project ? { project_id: o.project } : {}) }, o.idempotencyKey ?? randomUUID());
+        emit(r, () => table([r], ['id', 'name', 'projectId']));
+    });
+    workspaces.command('rename <workspace_id> <name>').description('Rename a workspace').action(async (id, name) => {
+        const { gen, org } = await scope();
+        const r = await gen.workspaces.rename(org, id, name);
+        emit(r, () => table([r], ['id', 'name', 'projectId']));
+    });
+    workspaces.command('delete <workspace_id>').description('Permanently delete a workspace (refused while fleets or grants use it)')
+        .action(async (id) => {
+        const { gen, org } = await scope();
+        await gen.workspaces.delete(org, id);
+        emit({ deleted: id }, () => `Deleted workspace ${id}.`);
+    });
+}

package/dist/index.d.ts

@@ -12,6 +12,8 @@ export interface Deps {
     openBrowser?: (url: string) => void;
     sleep?: (ms: number) => Promise<void>;
     readSecretInput?: (options: SecretInputOptions, limit: number) => Promise<string>;
+    /** Reads the pasted sign-in code for `flocks accounts login` and `flocks jobs login-input` (one line, never echoed). */
+    readFlocksCode?: () => Promise<string>;
     readWasmFile?: (path: string) => Promise<Blob>;
     writeBytes?: (bytes: Uint8Array) => void;
     writeOutputFile?: (path: string, bytes: Uint8Array) => Promise<void>;