@onesi/genesis-cli 0.2.0 → 0.2.2

package/README.md

@@ -3,7 +3,7 @@
 `genesis`, the OneOS command line. It works against the Genesis API at `https://os.one.ml/api`.
 
 ```sh
-npx -y @onesi/genesis-cli@0.2.0 --help
+npx -y @onesi/genesis-cli@0.2.2 --help
 ```
 
 ## First run

package/dist/flocks.js

@@ -91,13 +91,20 @@ export function registerFlocks(program, client, emit, env = process.env, readCod
     // Account, grant, instance and job commands redact secret-looking fields; enrollment commands (join-token) must print theirs.
     const showSafe = (run, pretty) => show(async (g) => scrub(await run(g)), pretty);
     flocks.command('readiness').description('Check whether node enrollment is currently available').action(() => show(g => g.flocks.readiness.get()));
-    flocks.command('nodes').description('List your org nodes').action(() => show(g => g.flocks.nodes.list()));
+    const nodes = flocks.command('nodes').description('List your org nodes; `nodes activity <id>` shows one node').action(() => show(g => g.flocks.nodes.list()));
     const paging = (command) => command.option('--limit <n>', 'page size, 1–100').option('--cursor <cursor>', 'next_cursor from the previous page');
     const query = (opts) => ({
         ...(opts.limit === undefined ? {} : { limit: Number(opts.limit) }),
         ...(opts.cursor === undefined ? {} : { cursor: opts.cursor }),
         ...(opts.agentId === undefined ? {} : { agent_id: opts.agentId }),
     });
+    paging(nodes.command('activity <id>').description("One node's presence (online, heartbeat age, harnesses) and the runs recorded on it, newest first"))
+        .action((id, opts) => show(g => g.flocks.nodes.activity(id, query(opts)), (a) => [
+        `${safe(a.node.node_id)}  ${safe(a.node.nickname || a.node.name)}  ${safe(a.node.platform)}  ${a.node.online ? 'online' : 'offline'}  ${safe(a.node.state)}  heartbeat ${a.node.heartbeat_age_seconds}s ago`,
+        a.node.harnesses?.length ? 'harnesses ' + a.node.harnesses.map((h) => `${safe(h.name)}${h.version ? ' ' + safe(h.version) : ''}${h.ready ? '' : ' (not ready)'}`).join(', ') : 'no harnesses reported',
+        a.items.length ? table(a.items, ['id', 'state', 'agent_id', 'harness', 'created_at', 'error_code']) : 'no runs on this node',
+        a.next_cursor ? `More: --cursor ${safe(a.next_cursor)}` : '',
+    ].filter(Boolean).join('\n')));
     paging(flocks.command('harnesses').description('List the harnesses each node reports, with version and readiness'))
         .action((opts) => show(g => g.flocks.harnesses.list(query(opts))));
     const agents = flocks.command('agents').description('Harness agents, and canonical agent execution (a_<ULID>; needs a signed-in session, not an API key)');
@@ -118,6 +125,20 @@ export function registerFlocks(program, client, emit, env = process.env, readCod
     paging(runs.command('list').description('List runs').option('--agent-id <id>', 'only runs of this agent'))
         .action((opts) => show(g => g.flocks.runs.list(query(opts))));
     runs.command('get <run_id>').action((id) => show(g => g.flocks.runs.get(id)));
+    runs.command('create <agent_id>').description('Start a run of an agent; on an instance with a bound inference account it is dispatched with the next heartbeat')
+        .requiredOption('--task <text>', 'what the agent should do (1-4096 bytes)').option('--node <id>', 'run on this node instead of the agent\'s pinned one')
+        .option('--wait', 'follow the run until it completes or fails; exits non-zero if it failed')
+        .action(async (id, o) => {
+        const g = await client();
+        let run = await g.flocks.runs.create(id, { task: o.task, ...(o.node ? { node_id: o.node } : {}) });
+        if (o.wait)
+            run = await g.flocks.runs.wait(run.id, { intervalMs: Number(env.FLOCKS_POLL_INTERVAL_MS) > 0 ? Number(env.FLOCKS_POLL_INTERVAL_MS) : 2000 });
+        emit(run, () => [`${safe(run.id)}  ${safe(run.state)}  agent ${safe(run.agent_id)}  harness ${safe(run.harness)}  node ${safe(run.node_id ?? '')}`,
+            run.inference_account_id ? `account ${safe(run.inference_account_id)} (owner ${safe(run.account_owner_org)}, billed to ${safe(run.grantee_org)})` : '',
+            run.run_seconds != null ? `${run.run_seconds}s` : '', run.error_code ? `error ${safe(run.error_code)}` : ''].filter(Boolean).join('\n'));
+        if (o.wait && run.state === 'failed')
+            throw new Error(`Run ${safe(run.id)} failed${run.error_code ? ': ' + safe(run.error_code) : ''}.`);
+    });
     flocks.command('join-token').option('--ttl <seconds>', 'lifetime (60–600 seconds)', '600').action((opts) => {
         const ttl = Number(opts.ttl);
         if (!Number.isInteger(ttl) || ttl < 60 || ttl > 600)
@@ -245,6 +266,8 @@ function registerAccounts(flocks, client, show, emit, env, readCode, isJson) {
         }
         emit(job, () => jobText(job) + (job.state === 'running' ? `\nFinish with: genesis flocks jobs get ${safe(job.id)} --wait` : ''));
     });
+    accounts.command('reset-identity <account_id>').description('Clear the identity recorded for an account (owner only); the next verified switch on one of your own instances records it again')
+        .action((id) => show(g => g.flocks.accounts.resetIdentity(id), a => accountRows([a])));
     accounts.command('remove <account_id>').description('Sign the account out of every bound instance, then revoke its credential')
         .option('--wait', 'follow the logout job to the end')
         .action((id, o) => show(async (g) => withJobId(g, await g.flocks.accounts.delete(id), o.wait), r => `account ${safe(r.account?.id)} ${safe(r.account?.status)}; logout job ${safe(r.job_id)}` + (r.job ? '\n' + jobText(r.job) : '')));

package/dist/hives-coverage.js

@@ -1,5 +1,6 @@
 import { hivesSseWindow, idempotencyHeaders, operationTable } from '@onesi/genesis';
 import { readFunctionJson } from './function-input.js';
+import { bytes } from './hives-resources.js';
 /** `genesis hives <words>` -> Hives operation. Positional arguments are the path parameters, query
  * parameters become options, a JSON body comes from --body-file. Groups that already exist
  * (functions, deployments, environment, domains, logs) are extended, never replaced. */
@@ -19,9 +20,12 @@ export const HIVES_COVERAGE_COMMANDS = {
     'environment values': 'hives_get_project_env',
     'environment set': 'hives_set_project_env',
     'environment delete': 'hives_delete_project_env',
+    'environment delete-key': 'hives_delete_project_env_key',
     'domains get': 'hives_get_domain',
     'domains delete': 'hives_delete_domain',
     'domains verification-record': 'hives_get_verification_record',
+    'cells objects put-download': 'hives_upload_object_named_download',
+    'cells objects remove-download': 'hives_delete_object_named_download',
 };
 const DESCRIPTIONS = {
     flights: 'Flights: WASM HTTP workloads served at their own address',
@@ -71,6 +75,19 @@ export function registerHivesCoverage(hives, deps) {
                 .action(async (project, names) => output(await (await deps.client()).request(id, { project_id: project, body: names })));
             continue;
         }
+        if (id === 'hives_upload_object_named_download') {
+            // Raw object bytes from a file, through the same Cells checks as `cells objects put-flat`.
+            parent.command(`${parts.at(-1)} <project_id> <bucket_id>`).description(`${op.summary} (${op.method} ${op.path})`)
+                .requiredOption('--file <path>', 'Exact binary bytes up to 10 MiB').option('--content-type <value>')
+                .option('--idempotency-key <key>', '1-128 printable ASCII; reuse it only to replay the same write (a fresh key is sent when omitted)')
+                .action(async (project, bucket, o) => output(await (await deps.client()).hives.cells.objects.putDownload(project, bucket, await bytes(o.file), { content_type: o.contentType, idempotencyKey: o.idempotencyKey })));
+            continue;
+        }
+        if (id === 'hives_delete_object_named_download') {
+            parent.command(`${parts.at(-1)} <project_id> <bucket_id>`).description(`${op.summary} (${op.method} ${op.path})`)
+                .action(async (project, bucket) => { await (await deps.client()).hives.cells.objects.removeDownload(project, bucket); output({ acknowledged: true }); });
+            continue;
+        }
         const command = parent.command([parts.at(-1), ...op.pathParams.map((p) => `<${p}>`)].join(' '))
             .description(`${op.summary} (${op.method} ${op.path})`);
         for (const q of op.queryParams) {

package/dist/hives-node-transport.js

@@ -11,12 +11,12 @@ export async function closeHivesNodeTransport() {
     await current?.destroy();
 }
 export function hivesOperationBudget(id) {
-    if (['hives_list_buckets', 'hives_create_bucket', 'hives_get_bucket', 'hives_delete_bucket', 'hives_list_objects', 'hives_upload_object', 'hives_upload_object_by_key', 'hives_delete_object', 'hives_delete_object_by_key', 'hives_download_object_by_key', 'hives_get_cors_config', 'hives_set_cors_config', 'hives_generate_presigned_url', 'hives_reconcile'].includes(id))
+    if (['hives_list_buckets', 'hives_create_bucket', 'hives_get_bucket', 'hives_delete_bucket', 'hives_list_objects', 'hives_upload_object', 'hives_upload_object_by_key', 'hives_upload_object_named_download', 'hives_delete_object', 'hives_delete_object_by_key', 'hives_delete_object_named_download', 'hives_download_object_by_key', 'hives_get_cors_config', 'hives_set_cors_config', 'hives_generate_presigned_url', 'hives_reconcile'].includes(id))
         return 100_000;
     if (id === 'hives_cancel_deployment' || id === 'hives_delete_deployment' || id === 'hives_stop_deployment')
         return 330_000;
     // A live SSE subscription is bounded by its caller's window or --follow limit (at most 300 s).
-    if (id === 'hives_stream_logs')
+    if (id === 'hives_stream_logs' || id === 'hives_stream_deployment_logs')
         return 330_000;
     if (['hives_create_deployment', 'hives_upload_deployment', 'hives_invoke_deployment', 'hives_invoke_function', 'hives_invoke_function_async'].includes(id))
         return 40_000;

package/dist/hives-resources.d.ts

@@ -5,5 +5,6 @@ type Deps = {
     emit: (data: unknown, pretty: () => string) => void;
     readRequest?: (path: string, limit: number) => Promise<Record<string, unknown>>;
 };
+export declare function bytes(path: string): Promise<Uint8Array>;
 export declare function registerHivesResources(hives: Command, deps: Deps): void;
 export {};

package/dist/hives-resources.js

@@ -2,7 +2,7 @@ import { registerHivesMarketplace } from './hives-marketplace.js';
 import { createReadStream } from 'node:fs';
 import { stat, writeFile } from 'node:fs/promises';
 import { readFunctionJson } from './function-input.js';
-async function bytes(path) {
+export async function bytes(path) {
     const metadata = await stat(path);
     if (!metadata.isFile() || metadata.size > 10 * 1024 * 1024)
         throw new Error('Choose a regular file of at most 10 MiB.');
@@ -23,6 +23,8 @@ async function bytes(path) {
     }
     return Uint8Array.from(Buffer.concat(chunks, total));
 }
+/** Funded writes (topic publish, Cells object writes) carry one Idempotency-Key; without the option a fresh one is sent. */
+const FUNDED_KEY = '1-128 printable ASCII; reuse it only to replay the same write (a fresh key is sent when omitted)';
 function number(value, min, max) { if (value === undefined)
     return undefined; if (!/^\d+$/.test(value) || !Number.isSafeInteger(Number(value)) || Number(value) < min || Number(value) > max)
     throw new Error('Invalid bounded numeric option.'); return Number(value); }
@@ -43,7 +45,7 @@ export function registerHivesResources(hives, deps) {
     const objects = cells.command('objects');
     objects.command('list <project_id> <bucket_id>').option('--prefix <value>').option('--delimiter <value>').option('--continuation-token <value>').option('--max-keys <number>').action(async (project, id, o) => output(await (await deps.client()).hives.cells.objects.list(project, id, { prefix: o.prefix, delimiter: o.delimiter, continuation_token: o.continuationToken, max_keys: number(o.maxKeys, 1, 1000) })));
     for (const action of ['put', 'put-flat'])
-        objects.command(`${action} <project_id> <bucket_id> <key>`).requiredOption('--file <path>', 'Exact binary bytes up to 10 MiB').option('--content-type <value>').action(async (project, id, key, o) => { const client = await deps.client(); output(await client.hives.cells.objects[action === 'put' ? 'put' : 'putFlat'](project, id, key, await bytes(o.file), { content_type: o.contentType })); });
+        objects.command(`${action} <project_id> <bucket_id> <key>`).requiredOption('--file <path>', 'Exact binary bytes up to 10 MiB').option('--content-type <value>').option('--idempotency-key <key>', FUNDED_KEY).action(async (project, id, key, o) => { const client = await deps.client(); output(await client.hives.cells.objects[action === 'put' ? 'put' : 'putFlat'](project, id, key, await bytes(o.file), { content_type: o.contentType, idempotencyKey: o.idempotencyKey })); });
     for (const action of ['remove', 'remove-flat'])
         objects.command(`${action} <project_id> <bucket_id> <key>`).action(async (project, id, key) => { await (await deps.client()).hives.cells.objects[action === 'remove' ? 'remove' : 'removeFlat'](project, id, key); output({ acknowledged: true }); });
     objects.command('download <project_id> <bucket_id> <key>').requiredOption('--output-file <path>', 'Create a new file; existing files are never overwritten').action(async (project, id, key, o) => { const response = await (await deps.client()).hives.cells.objects.download(project, id, key); const data = new Uint8Array(await response.arrayBuffer()); await writeFile(o.outputFile, data, { flag: 'wx', mode: 0o600 }); output({ saved: true, bytes: data.byteLength }); });
@@ -75,7 +77,7 @@ export function registerHivesResources(hives, deps) {
     for (const action of ['get', 'remove'])
         topics.command(`${action} <project_id> <topic_id>`).action(async (project, id) => output(await (await deps.client()).hives.topics[action](project, id)));
     topics.command('create <project_id>').requiredOption('--request-file <path>', 'JSON topic name').action(async (project, o) => output(await (await deps.client()).hives.topics.create(project, await read(o.requestFile, 4096))));
-    topics.command('publish <project_id> <topic_id>').requiredOption('--request-file <path>', 'Exactly body or body_base64 plus optional string attributes; no automatic retry').action(async (project, id, o) => output(await (await deps.client()).hives.topics.publish(project, id, await read(o.requestFile, 512 * 1024))));
+    topics.command('publish <project_id> <topic_id>').requiredOption('--request-file <path>', 'Exactly body or body_base64 plus optional string attributes; no automatic retry').option('--idempotency-key <key>', FUNDED_KEY).action(async (project, id, o) => output(await (await deps.client()).hives.topics.publish(project, id, await read(o.requestFile, 512 * 1024), { idempotencyKey: o.idempotencyKey })));
     const subscriptions = topics.command('subscriptions').description('Same-project standard queue destinations; removing a subscription retains queued messages');
     subscriptions.command('list <project_id> <topic_id>').action(async (project, id) => output(await (await deps.client()).hives.topics.subscriptions.list(project, id)));
     subscriptions.command('add <project_id> <topic_id> <queue_id>').action(async (project, id, queue) => output(await (await deps.client()).hives.topics.subscriptions.add(project, id, queue)));

package/dist/index.js

@@ -7,11 +7,11 @@ import { registerIamDirectory } from './iam-directory.js';
 import { registerOperationCommands, registerProducts } from './products.js';
 import { registerOrgs } from './orgs.js';
 import { Command, CommanderError } from 'commander';
-import { Genesis, GenesisError, errorCatalog, errorOutcome, isMindsOperation, HivesOperationError, HivesQueueOperationError, MindsAgentError, MindsOwnerError, hivesResponseBytes, MAX_FUNCTION_BODY_BYTES, MAX_FUNCTION_JSON_BYTES, DEFAULT_BASE_URL, requireSecureUrl } from '@onesi/genesis';
+import { Genesis, GenesisError, errorBody, errorCatalog, errorOutcome, isMindsOperation, HivesOperationError, HivesQueueOperationError, MindsAgentError, MindsOwnerError, hivesResponseBytes, MAX_FUNCTION_BODY_BYTES, MAX_FUNCTION_JSON_BYTES, DEFAULT_BASE_URL, requireSecureUrl } from '@onesi/genesis';
 import { authConfig, completeLogin, selectSavedContext, savedLoginProvider, startLogin } from './auth.js';
 import { completeDeviceLogin, startDeviceLogin } from './device-login.js';
 import { keychainStore } from './store.js';
-import { c, listOf, safe, stdio, table } from './output.js';
+import { c, errorText, listOf, printable, redactMessage, safe, stdio, table } from './output.js';
 import { spawn } from 'node:child_process';
 import { addHenryCommands } from './henry.js';
 import { registerFleets } from './fleets.js';
@@ -40,7 +40,7 @@ export function buildProgram(deps = {}) {
     const auth = { ...authConfig(env, f), sleep: deps.sleep };
     const program = new Command('genesis')
         .description('One CLI for every Genesis service.')
-        .version('0.2.0')
+        .version('0.2.2')
         .option('--json', 'machine-readable JSON output')
         .option('--api-key <key>', 'use this API key (default: GENESIS_API_KEY, then your `genesis login`)')
         .option('--base-url <url>', 'gateway URL (default: GENESIS_BASE_URL or https://os.one.ml/api)')
@@ -56,7 +56,7 @@ export function buildProgram(deps = {}) {
         const opts = {
             apiKey: o.apiKey ?? env.GENESIS_API_KEY, token: env.GENESIS_TOKEN,
             baseUrl: o.baseUrl ?? env.GENESIS_BASE_URL, routing: o.direct || env.GENESIS_ROUTING === 'direct' ? 'direct' : 'gateway',
-            fetch: f, userAgent: 'genesis-cli/0.2.0',
+            fetch: f, userAgent: 'genesis-cli/0.2.2',
             credentials: store ? savedLoginProvider(auth, store) : undefined,
         };
         return new Genesis(hivesTransport ? { ...opts, fetch: createHivesNodeTransport(opts, deps.signal) } : opts);
@@ -247,6 +247,12 @@ export function buildProgram(deps = {}) {
         .action((name, o) => show(b => b.delegates.create({ name, delegated_variables: o.variable, ttl_seconds: Number(o.ttl), max_depth: Number(o.maxDepth) }, key(o))));
     delegates.command('revoke <delegate_id>').option(...keyOption).action((id, o) => show(b => b.delegates.revoke(id, key(o))));
     blinds.command('activity').description('Latest 200 Blinds audit events').action(() => show(b => b.activity({ signal: deps.signal })));
+    blinds.command('proxy').description('One HTTPS call made by Blinds under a delegation you hold; values never leave Blinds')
+        .requiredOption('--body-file <path>', 'JSON {delegate_id, request_id, method, url, headers?, body?}; templates as {{VARIABLE}}').option(...keyOption)
+        .action(async (o) => {
+        const body = await readFunctionJson(o.bodyFile, 64 * 1024);
+        await show(b => b.proxy(body, key(o)));
+    });
     const owner = blinds.command('owner-enrollment')
         .description('Original-human enrollment only; preserve operation and locator IDs after unknown outcomes');
     for (const [action, operation] of Object.entries({ reserve: 'blinds_ownerReserve', sign: 'blinds_ownerSign', attach: 'blinds_ownerAttach', 'p256-ensure': 'blinds_ownerP256Ensure' })) {
@@ -271,7 +277,7 @@ export function buildProgram(deps = {}) {
         if (!key)
             throw new Error('Give the enrollment key with --key-file, --key-stdin or GENESIS_ENROLLMENT_KEY; it is never accepted as an argument.');
         const body = await readFunctionJson(o.bodyFile, 16 * 1024);
-        const result = await new Genesis({ baseUrl: g().baseUrl ?? env.GENESIS_BASE_URL, fetch: f, userAgent: 'genesis-cli/0.1.13' }).iam.agents.enroll(key, body);
+        const result = await new Genesis({ baseUrl: g().baseUrl ?? env.GENESIS_BASE_URL, fetch: f, userAgent: 'genesis-cli/0.2.2' }).iam.agents.enroll(key, body);
         emit(result, () => JSON.stringify(result, null, 2));
     });
     // ---- auth ------------------------------------------------------------
@@ -325,7 +331,8 @@ export function buildProgram(deps = {}) {
             if (!saved || g().apiKey || env.GENESIS_API_KEY)
                 throw e;
             // Saved login exists but One account verify isn't reachable yet (auth-v4-backend PR #30 not deployed).
-            emit({ user: saved.user, organization_id: saved.organization_id, verified: false, reason: e.message }, () => `${c.bold('User')}  ${saved.user?.email ?? saved.user?.id}\n${c.bold('Org')}   ${saved.organization_id ?? '-'}\n${c.yellow('!')} ${c.dim('From your saved login; One account verify unavailable: ' + e.message)}`);
+            const reason = errorText(e);
+            emit({ user: saved.user, organization_id: saved.organization_id, verified: false, reason }, () => `${c.bold('User')}  ${saved.user?.email ?? saved.user?.id}\n${c.bold('Org')}   ${saved.organization_id ?? '-'}\n${c.yellow('!')} ${c.dim('From your saved login; One account verify unavailable: ' + reason)}`);
         }
     });
     // `orgs usage|observations|billing|payment-methods|service` and the Orgs (legal entity) commands are registered by registerProducts and registerOrgs.
@@ -803,7 +810,7 @@ export function buildProgram(deps = {}) {
         const url = `${base.href.replace(/\/+$/, '')}/v1/status`;
         let response;
         try {
-            response = await f(url, { method: 'GET', headers: { accept: 'application/json', 'user-agent': 'genesis-cli/0.2.0' }, signal: AbortSignal.timeout(15_000) });
+            response = await f(url, { method: 'GET', headers: { accept: 'application/json', 'user-agent': 'genesis-cli/0.2.2' }, signal: AbortSignal.timeout(15_000) });
         }
         catch (e) {
             throw new Error(`Gateway unreachable at ${safe(url)}: ${safe(e.message)}`);
@@ -853,20 +860,24 @@ export async function main(argv, deps = {}) {
             // Dials needs a project, workspace and environment: from flags, a selected context or an org key's binding.
             const dialsScopeHint = e.operationId?.startsWith('dials_') && /invalid_scope/i.test(`${e.code ?? ''} ${e.message} ${e.type}`)
                 ? ' Pass --workspace, --project and --environment, select a context (genesis context select), or use an org API key bound to a project.' : '';
+            const receipt = e instanceof HivesOperationError || e instanceof HivesQueueOperationError;
+            const code = errorCatalog(e).code, body = json ? errorBody(e) : undefined;
             if (json)
-                out.err(JSON.stringify({ error: { type: e.type, status: e.status, message: e.message, request_id: e.requestId, ...errorCatalog(e),
+                out.err(JSON.stringify({ error: { type: e.type, status: e.status, message: redactMessage(e.message), request_id: e.requestId, ...errorCatalog(e),
                         ...((e instanceof HivesOperationError || e instanceof HivesQueueOperationError) ? { operation: e.operation } : {}),
                         ...(e.operationId && isMindsOperation(e.operationId) && errorOutcome(e.body) === 'unknown' ? { outcome: 'unknown' } : {}),
                         ...(e instanceof MindsAgentError || e instanceof MindsOwnerError ? { code: e.code, ...(e instanceof MindsAgentError ? { dpop_nonce: e.dpopNonce } : {}),
-                            ...(errorOutcome(e.body) !== undefined ? { outcome: errorOutcome(e.body) } : {}) } : {}) } }));
+                            ...(errorOutcome(e.body) !== undefined ? { outcome: errorOutcome(e.body) } : {}) } : {}),
+                        // The service's whole error body (redacted and bounded), e.g. the failed Flocks `run` beside a 503.
+                        ...(receipt || body === undefined ? {} : { body }) } }));
             else
-                out.err(`${c.red('✗')} ${safe(e.message)}${dialsScopeHint}${(e instanceof HivesOperationError || e instanceof HivesQueueOperationError) ? ` Operation: ${safe(e.operation.operation_id)} (${safe(e.operation.state)}).` : ''}${e.status ? c.dim(` (${e.status} ${safe(e.type)})`) : ''}${e.requestId ? `\n${c.dim(`request_id: ${safe(e.requestId)}`)}` : ''}`);
+                out.err(`${c.red('✗')} ${printable(e.message)}${dialsScopeHint}${(e instanceof HivesOperationError || e instanceof HivesQueueOperationError) ? ` Operation: ${safe(e.operation.operation_id)} (${safe(e.operation.state)}).` : ''}${e.status ? c.dim(` (${e.status} ${safe(e.type)})`) : ''}${code ? `\n${c.dim(`code: ${safe(code)}`)}` : ''}${e.requestId ? `\n${c.dim(`request_id: ${safe(e.requestId)}`)}` : ''}`);
             return 1;
         }
-        const msg = e.message ?? String(e);
+        const msg = redactMessage(e.message ?? String(e));
         const net = /fetch failed|ENOTFOUND|ECONNREFUSED/.test(msg + (e.cause?.code ?? ''));
         out.err(json ? JSON.stringify({ error: { type: net ? 'network' : 'error', message: msg } })
-            : `${c.red('✗')} ${net ? `Could not reach the Genesis API gateway (${safe(msg)}). Try --direct to call service hosts directly.` : safe(msg)}`);
+            : `${c.red('✗')} ${net ? `Could not reach the Genesis API gateway (${printable(msg)}). Try --direct to call service hosts directly.` : printable(msg)}`);
         return 1;
     }
 }

package/dist/onboard/index.js

@@ -8,7 +8,7 @@
  */
 import { hostname } from 'node:os';
 import { spawn } from 'node:child_process';
-import { safe } from '../output.js';
+import { errorText, safe } from '../output.js';
 import { detect, probe, systemPreferences } from './caps.js';
 import { Term, Interrupted } from './term.js';
 import { Style, welcome, select, confirm, input, pick, waitBeside, delight, busy, typeLines } from './ui.js';
@@ -98,7 +98,7 @@ export async function runSetup(d) {
                 if (e instanceof Interrupted)
                     throw e;
                 // One step failing never ends setup: say why, keep it for next time, and carry on.
-                term.say(`${style.error(caps.unicode ? '✗' : 'x')} ${safe(e.message)}`);
+                term.say(`${style.error(caps.unicode ? '✗' : 'x')} ${errorText(e)}`);
                 term.say(style.muted(`This step stays open; run genesis setup ${id} to try it again.`));
                 result = { state: 'skipped', note: 'failed' };
             }
@@ -157,7 +157,7 @@ class Steps {
             store = await this.getStore();
         }
         catch (e) {
-            this.note(`${safe(e.message)}`);
+            this.note(`${errorText(e)}`);
             return { state: 'skipped', note: 'keychain unavailable' };
         }
         const saved = await store.get();
@@ -265,7 +265,7 @@ class Steps {
         const token = () => d.login.savedLoginProvider(d.auth, store)().then((t) => t ?? '');
         const iam = new Iam(secureUrl(d.env.GENESIS_IAM_URL ?? 'https://iam.l1fe.ai', 'GENESIS_IAM_URL'), d.fetch, token);
         const orgs = await busy(term, style, 'Finding your organizations', iam.list('/v4/iam/orgs').catch((e) => {
-            this.note(`Your organizations could not be listed (${safe(e.message)}); using the one you signed in to.`);
+            this.note(`Your organizations could not be listed (${errorText(e)}); using the one you signed in to.`);
             return [];
         }));
         const known = orgs.length ? orgs : saved.organization_id ? [{ id: saved.organization_id, name: saved.organization_id }] : [];
@@ -297,7 +297,7 @@ class Steps {
             }));
         }
         catch (e) {
-            this.note(`Projects could not be read (${safe(e.message)}). Choose one later with:`);
+            this.note(`Projects could not be read (${errorText(e)}). Choose one later with:`);
             this.note(COMMANDS.context);
             return { state: 'skipped', note: 'iam unavailable' };
         }
@@ -415,7 +415,7 @@ class Steps {
             }
             catch (e) {
                 okAll = false;
-                term.say(`${style.error('✗')} ${c.name} ${style.muted(safe(e.message))}`);
+                term.say(`${style.error('✗')} ${c.name} ${style.muted(errorText(e))}`);
             }
         }
         if (chosen.includes('claude-desktop'))
@@ -432,7 +432,7 @@ class Steps {
             if (!r.ok)
                 throw new Error(`HTTP ${r.status}`);
             return await r.json();
-        })()).catch((e) => { this.note(`The gateway did not answer (${safe(e.message)}). Try genesis status later.`); return null; });
+        })()).catch((e) => { this.note(`The gateway did not answer (${errorText(e)}). Try genesis status later.`); return null; });
         if (!report?.services?.length)
             return { state: 'skipped' };
         // Only what the gateway is documented to send reaches the terminal: names and states through safe(), latency

package/dist/orgs.js

@@ -7,7 +7,7 @@ const MEDIA_TYPES = {
     '.pdf': 'application/pdf', '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg',
     '.txt': 'text/plain', '.md': 'text/markdown', '.markdown': 'text/markdown', '.json': 'application/json',
 };
-const DOCUMENT_KINDS = ['articles', 'certificate', 'operating_agreement', 'bylaws', 'resolution', 'filing_receipt', 'tax_letter', 'other'];
+const DOCUMENT_KINDS = ['agent_consent', 'articles', 'certificate', 'operating_agreement', 'bylaws', 'resolution', 'filing_receipt', 'tax_letter', 'other'];
 const group = (parent, name) => parent.commands.find(c => c.name() === name) ?? parent.command(name);
 /**
  * The Orgs commands that are more than one JSON request: uploading a document from a file, downloading

package/dist/output.d.ts

@@ -21,7 +21,19 @@ export declare const c: {
  * operators (U+2060-2064), Mongolian vowel separator (U+180E), soft hyphen
  * (U+00AD) and tag characters (U+E0000-E007F).
  */
-export declare function safe(v: unknown): string;
+export declare function safe(v: unknown, keepLines?: boolean): string;
+/**
+ * A message cleaned for redaction: terminal controls and invisible characters are stripped first (line breaks
+ * kept, so header lines still match), so none can split a secret and hide it from the patterns.
+ */
+export declare function redactMessage(message: string): string;
+/**
+ * A message as the terminal prints it: redacted, made safe, then redacted again, because `safe` drops the tabs and
+ * line breaks redaction kept, which could join the pieces of a split secret back together.
+ */
+export declare function printable(message: string): string;
+/** The message of a caught error, redacted (tokens, card numbers, emails...) and safe to print. */
+export declare function errorText(e: unknown): string;
 /** Render rows as an aligned table; every cell is passed through safe(). */
 export declare function table(rows: Record<string, unknown>[], cols: string[]): string;
 /** Pull the array out of the various list envelopes ({data}, {zones}, {records}, bare array). */

package/dist/output.js

@@ -1,3 +1,4 @@
+import { redactErrorText } from '@onesi/genesis';
 export const stdio = { log: (s) => process.stdout.write(s + '\n'), err: (s) => process.stderr.write(s + '\n') };
 const tty = () => !!process.stdout.isTTY && !process.env.NO_COLOR;
 export const c = {
@@ -18,14 +19,32 @@ export const c = {
  * operators (U+2060-2064), Mongolian vowel separator (U+180E), soft hyphen
  * (U+00AD) and tag characters (U+E0000-E007F).
  */
-export function safe(v) {
+export function safe(v, keepLines = false) {
     return String(v)
         .replace(/(?:\x1b\]|\x9d)[^\x07\x1b\x9c]*(?:\x07|\x1b\\|\x9c)?/g, '')
         .replace(/(?:\x1b\[|\x9b)[\x30-\x3f]*[\x20-\x2f]*[\x40-\x7e]?/g, '')
         .replace(/\x1b[\x20-\x2f]*[\x30-\x7e]?/g, '')
-        .replace(/[\x00-\x1f\x7f-\x9f]/g, '')
+        .replace(keepLines ? /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f-\x9f]/g : /[\x00-\x1f\x7f-\x9f]/g, '')
         .replace(/[\u202a-\u202e\u2066-\u2069\u200b-\u200f\u061c\ufeff\u2028\u2029\u2060-\u2064\u180e\u00ad\u{e0000}-\u{e007f}]/gu, '');
 }
+/**
+ * A message cleaned for redaction: terminal controls and invisible characters are stripped first (line breaks
+ * kept, so header lines still match), so none can split a secret and hide it from the patterns.
+ */
+export function redactMessage(message) {
+    return redactErrorText(safe(message, true));
+}
+/**
+ * A message as the terminal prints it: redacted, made safe, then redacted again, because `safe` drops the tabs and
+ * line breaks redaction kept, which could join the pieces of a split secret back together.
+ */
+export function printable(message) {
+    return redactErrorText(safe(redactMessage(message)));
+}
+/** The message of a caught error, redacted (tokens, card numbers, emails...) and safe to print. */
+export function errorText(e) {
+    return printable(e instanceof Error ? e.message : String(e));
+}
 /** Render rows as an aligned table; every cell is passed through safe(). */
 export function table(rows, cols) {
     if (!rows.length)

package/dist/products.js

@@ -1,5 +1,6 @@
-import { writeFile } from 'node:fs/promises';
 import { idempotencyHeaders, ifMatchHeaders, mindsEngineCommands, operationTable } from '@onesi/genesis';
+import { readFile, writeFile } from 'node:fs/promises';
+import { basename } from 'node:path';
 import { readFunctionJson } from './function-input.js';
 /** Command words -> operation. Positional arguments are the operation's path parameters, query
  * parameters become options, a body comes from --body-file, and --idempotency-key carries the
@@ -117,6 +118,15 @@ export const PRODUCT_COMMANDS = {
             command: 'zaps_zapCommand', 'kv command': 'zaps_command', 'kv pipeline': 'zaps_pipeline', stats: 'zaps_getStats', metrics: 'zaps_getMetrics',
             'audit search': 'zaps_searchAudit', 'audit stats': 'zaps_getAuditStats',
         } },
+    brews: { description: 'Brews: agent recipes, the exchange, decisions and selections (Sandbox; org API key or One account login; scope comes from the selection)', commands: {
+            create: 'brews_createBrew', list: 'brews_listBrews', get: 'brews_getBrew', card: 'brews_getBrewCard', compile: 'brews_compileBrew',
+            run: 'brews_runBrew', eval: 'brews_evalBrew', 'bench run': 'brews_runBrewBench', 'tools call': 'brews_callTool',
+            'exchange public': 'brews_listPublicExchange', 'exchange list': 'brews_listExchange', 'exchange get': 'brews_getExchangeListing',
+            'exchange install': 'brews_installBrew',
+            'decisions status': 'brews_getDecisionStatus', 'decisions create': 'brews_createDecision', 'decisions get': 'brews_getDecision',
+            'decisions reconcile': 'brews_reconcileDecision',
+            'selections create': 'brews_createSelection', 'selections get': 'brews_getSelection', 'selections recover': 'brews_recoverSelection',
+        } },
     flares: { description: 'Flares: agent notifications, conversations, commitments, presence, trust and choreography (Sandbox; One account login)', commands: {
             list: 'flares_listFlares', get: 'flares_getFlare', send: 'flares_sendFlare', 'send-batch': 'flares_sendFlareBatch',
             acknowledge: 'flares_acknowledgeFlare', act: 'flares_actOnFlare',
@@ -161,6 +171,7 @@ export const PRODUCT_COMMANDS = {
             messages: 'foundry_createMessage', responses: 'foundry_createResponse', embeddings: 'foundry_createEmbedding', rerank: 'foundry_createRerank',
             'images create': 'foundry_createImage', 'images models': 'foundry_listImageModels', transcribe: 'foundry_createAudioTranscription',
             'receipts get': 'foundry_getGenerationReceipt', 'receipts by-request': 'foundry_getGenerationReceiptByRequest', 'receipts verification-key': 'foundry_getReceiptVerificationKey',
+            'receipts verification-keys': 'foundry_listReceiptVerificationKeys',
             'keys list': 'foundry_listApiKeys', 'keys create': 'foundry_createApiKey', 'keys delete': 'foundry_deleteApiKey', 'keys rotate': 'foundry_rotateApiKey', 'keys current': 'foundry_getCurrentApiKey',
             'reporting request-logs': 'foundry_listRequestLogs', 'reporting provider-credentials': 'foundry_getProviderCredentialSummary',
             'activity list': 'foundry_getActivity', 'activity export': 'foundry_exportActivity', 'analytics meta': 'foundry_getAnalyticsMeta', 'analytics query': 'foundry_queryAnalytics',
@@ -218,6 +229,173 @@ export const PRODUCT_COMMANDS = {
         } },
     // `genesis minds engine <family> <verb> <mind_id> [params]`: every Minds engine route, generated from the grant table.
     minds: { description: 'Minds: your Sandbox Minds (One account login)', commands: mindsEngineCommands },
+    boxes: { description: 'Boxes: mail, docs, files, sheets, slides, calendar and identity (org API key; GET boxes:read, writes boxes:write)', commands: {
+            // boxes:begin
+            'mail addresses create': 'boxes_mail_addresses_create',
+            'mail addresses list': 'boxes_mail_addresses_list',
+            'mail domains addresses create': 'boxes_mail_domains_addresses_create',
+            'mail domains create': 'boxes_mail_domains_create',
+            'mail domains list': 'boxes_mail_domains_list',
+            'mail domains verify': 'boxes_mail_domains_verify',
+            'mail inbox list': 'boxes_mail_inbox_list',
+            'mail mailboxes list': 'boxes_mail_mailboxes_list',
+            'mail messages get': 'boxes_mail_messages_get',
+            'mail messages delete': 'boxes_mail_messages_delete',
+            'mail messages update': 'boxes_mail_messages_update',
+            'mail send': 'boxes_mail_send',
+            'mail threads get': 'boxes_mail_threads_get',
+            'mail threads list': 'boxes_mail_threads_list',
+            'mail agent batch-send': 'boxes_mail_agent_batch_send',
+            'mail agent webhooks create': 'boxes_mail_agent_webhooks_create',
+            'mail agent webhooks list': 'boxes_mail_agent_webhooks_list',
+            'mail agent webhooks delete': 'boxes_mail_agent_webhooks_delete',
+            'mail agent activities list': 'boxes_mail_agent_activities_list',
+            'mail agent state list': 'boxes_mail_agent_state_list',
+            'mail agent state update': 'boxes_mail_agent_state_update',
+            'mail attachments content get': 'boxes_mail_attachments_content_get',
+            'mail attachments get': 'boxes_mail_attachments_get',
+            'mail attachments delete': 'boxes_mail_attachments_delete',
+            'mail attachments upload': 'boxes_mail_attachments_upload',
+            'mail messages attachments list': 'boxes_mail_messages_attachments_list',
+            'mail messages delivery get': 'boxes_mail_messages_delivery_get',
+            'mail search': 'boxes_mail_search',
+            'mail stream sse': 'boxes_mail_stream_sse',
+            'mail batch': 'boxes_mail_batch',
+            'mail delegations revoke': 'boxes_mail_delegations_revoke',
+            'mail extraction message get': 'boxes_mail_extraction_message_get',
+            'mail extraction thread get': 'boxes_mail_extraction_thread_get',
+            'mail folders create': 'boxes_mail_folders_create',
+            'mail folders list': 'boxes_mail_folders_list',
+            'mail governance audit list': 'boxes_mail_governance_audit_list',
+            'mail intelligence thread get': 'boxes_mail_intelligence_thread_get',
+            'mail labels create': 'boxes_mail_labels_create',
+            'mail labels list': 'boxes_mail_labels_list',
+            'mail labels delete': 'boxes_mail_labels_delete',
+            'mail mailboxes delegations list': 'boxes_mail_mailboxes_delegations_list',
+            'mail memory events submit': 'boxes_mail_memory_events_submit',
+            'mail memory recall': 'boxes_mail_memory_recall',
+            'mail memory search': 'boxes_mail_memory_search',
+            'mail memory store': 'boxes_mail_memory_store',
+            'mail personas list': 'boxes_mail_personas_list',
+            'mail templates list': 'boxes_mail_templates_list',
+            'files list': 'boxes_files_list',
+            'files search': 'boxes_files_search',
+            'files recent list': 'boxes_files_recent_list',
+            'files trash list': 'boxes_files_trash_list',
+            'files shared-with-me list': 'boxes_files_shared_with_me_list',
+            'files upload': 'boxes_files_upload',
+            'files folders create': 'boxes_files_folders_create',
+            'files get': 'boxes_files_get',
+            'files update': 'boxes_files_update',
+            'files delete': 'boxes_files_delete',
+            'files download': 'boxes_files_download',
+            'files restore': 'boxes_files_restore',
+            'files purge': 'boxes_files_purge',
+            'files share': 'boxes_files_share',
+            'files shares list': 'boxes_files_shares_list',
+            'files unshare': 'boxes_files_unshare',
+            'docs documents list': 'boxes_docs_documents_list',
+            'docs documents create': 'boxes_docs_documents_create',
+            'docs folders create': 'boxes_docs_folders_create',
+            'docs search': 'boxes_docs_search',
+            'docs recent list': 'boxes_docs_recent_list',
+            'docs trash list': 'boxes_docs_trash_list',
+            'docs templates list': 'boxes_docs_templates_list',
+            'docs shared-with-me list': 'boxes_docs_shared_with_me_list',
+            'docs mcp action': 'boxes_docs_mcp_action',
+            'docs documents get': 'boxes_docs_documents_get',
+            'docs documents update': 'boxes_docs_documents_update',
+            'docs documents delete': 'boxes_docs_documents_delete',
+            'docs documents purge': 'boxes_docs_documents_purge',
+            'docs documents versions list': 'boxes_docs_documents_versions_list',
+            'docs documents share': 'boxes_docs_documents_share',
+            'docs documents shares list': 'boxes_docs_documents_shares_list',
+            'docs documents unshare': 'boxes_docs_documents_unshare',
+            'docs documents collaborators list': 'boxes_docs_documents_collaborators_list',
+            'docs documents presence update': 'boxes_docs_documents_presence_update',
+            'docs documents operations list': 'boxes_docs_documents_operations_list',
+            'docs documents operations apply': 'boxes_docs_documents_operations_apply',
+            'docs documents events stream': 'boxes_docs_documents_events_stream',
+            'sheets cells batch': 'boxes_sheets_cells_batch',
+            'sheets cells delete': 'boxes_sheets_cells_delete',
+            'sheets cells get': 'boxes_sheets_cells_get',
+            'sheets cells list': 'boxes_sheets_cells_list',
+            'sheets cells set': 'boxes_sheets_cells_set',
+            'sheets cells query': 'boxes_sheets_cells_query',
+            'sheets cells range get': 'boxes_sheets_cells_range_get',
+            'sheets search': 'boxes_sheets_search',
+            'sheets shared-with-me list': 'boxes_sheets_shared_with_me_list',
+            'sheets spreadsheets create': 'boxes_sheets_spreadsheets_create',
+            'sheets spreadsheets list': 'boxes_sheets_spreadsheets_list',
+            'sheets spreadsheets delete': 'boxes_sheets_spreadsheets_delete',
+            'sheets spreadsheets get': 'boxes_sheets_spreadsheets_get',
+            'sheets spreadsheets update': 'boxes_sheets_spreadsheets_update',
+            'sheets spreadsheets purge': 'boxes_sheets_spreadsheets_purge',
+            'sheets spreadsheets share': 'boxes_sheets_spreadsheets_share',
+            'sheets spreadsheets shares list': 'boxes_sheets_spreadsheets_shares_list',
+            'sheets spreadsheets unshare': 'boxes_sheets_spreadsheets_unshare',
+            'sheets tabs create': 'boxes_sheets_tabs_create',
+            'sheets tabs list': 'boxes_sheets_tabs_list',
+            'sheets tabs delete': 'boxes_sheets_tabs_delete',
+            'sheets tabs get': 'boxes_sheets_tabs_get',
+            'sheets tabs update': 'boxes_sheets_tabs_update',
+            'slides presentations create': 'boxes_slides_presentations_create',
+            'slides presentations list': 'boxes_slides_presentations_list',
+            'slides presentations delete': 'boxes_slides_presentations_delete',
+            'slides presentations get': 'boxes_slides_presentations_get',
+            'slides presentations update': 'boxes_slides_presentations_update',
+            'slides presentations share': 'boxes_slides_presentations_share',
+            'slides presentations shared-with-me list': 'boxes_slides_presentations_shared_with_me_list',
+            'slides presentations shares list': 'boxes_slides_presentations_shares_list',
+            'slides presentations unshare': 'boxes_slides_presentations_unshare',
+            'slides slides create': 'boxes_slides_slides_create',
+            'slides slides list': 'boxes_slides_slides_list',
+            'slides slides delete': 'boxes_slides_slides_delete',
+            'slides slides get': 'boxes_slides_slides_get',
+            'slides slides update': 'boxes_slides_slides_update',
+            'slides slides reorder': 'boxes_slides_slides_reorder',
+            'slides templates create': 'boxes_slides_templates_create',
+            'slides templates list': 'boxes_slides_templates_list',
+            'slides templates delete': 'boxes_slides_templates_delete',
+            'slides templates get': 'boxes_slides_templates_get',
+            'slides templates update': 'boxes_slides_templates_update',
+            'calendar availability get': 'boxes_calendar_availability_get',
+            'calendar calendars create': 'boxes_calendar_calendars_create',
+            'calendar calendars list': 'boxes_calendar_calendars_list',
+            'calendar calendars delete': 'boxes_calendar_calendars_delete',
+            'calendar calendars get': 'boxes_calendar_calendars_get',
+            'calendar calendars update': 'boxes_calendar_calendars_update',
+            'calendar events attendees list': 'boxes_calendar_events_attendees_list',
+            'calendar events create': 'boxes_calendar_events_create',
+            'calendar events list': 'boxes_calendar_events_list',
+            'calendar events delete': 'boxes_calendar_events_delete',
+            'calendar events get': 'boxes_calendar_events_get',
+            'calendar events update': 'boxes_calendar_events_update',
+            'calendar events rsvp': 'boxes_calendar_events_rsvp',
+            'calendar events search': 'boxes_calendar_events_search',
+            'calendar scheduling-links book': 'boxes_calendar_scheduling_links_book',
+            'calendar scheduling-links by-slug get': 'boxes_calendar_scheduling_links_by_slug_get',
+            'calendar scheduling-links create': 'boxes_calendar_scheduling_links_create',
+            'calendar scheduling-links list': 'boxes_calendar_scheduling_links_list',
+            'calendar scheduling-links delete': 'boxes_calendar_scheduling_links_delete',
+            'calendar scheduling-links get': 'boxes_calendar_scheduling_links_get',
+            'calendar scheduling-links update': 'boxes_calendar_scheduling_links_update',
+            'identity me get': 'boxes_identity_me_get',
+            'identity tenants current get': 'boxes_identity_tenants_current_get',
+            'identity users get': 'boxes_identity_users_get',
+            'identity users list': 'boxes_identity_users_list',
+            'identity workspaces list': 'boxes_identity_workspaces_list',
+            'identity workspaces get': 'boxes_identity_workspaces_get',
+            'identity workspaces members list': 'boxes_identity_workspaces_members_list',
+            'mcp sessions context set': 'boxes_mcp_sessions_context_set',
+            'mcp sessions create': 'boxes_mcp_sessions_create',
+            'mcp sessions list': 'boxes_mcp_sessions_list',
+            'mcp sessions delete': 'boxes_mcp_sessions_delete',
+            'mcp sessions get': 'boxes_mcp_sessions_get',
+            'mcp tools call': 'boxes_mcp_tools_call',
+            'mcp tools list': 'boxes_mcp_tools_list',
+            // boxes:end
+        } },
 };
 const BODY_LIMIT = 1024 * 1024;
 const flag = (name) => name.replace(/_/g, '-').replace(/([a-z])([A-Z])/g, '$1-$2').toLowerCase();
@@ -260,8 +438,21 @@ export function registerOperationCommands(root, commands, dependencies) {
                 else
                     command.option(`--${flag(q)} <value>`);
             }
-            if (op.hasBody)
+            // Boxes only: multipart uploads, and raw bytes or event streams read through a --duration window.
+            // Every other service keeps the plain path below (Foundry infer-stream is read to its end).
+            const boxes = op.service === 'boxes';
+            const multipart = boxes && op.requestContentType === 'multipart/form-data';
+            const boxesRaw = boxes && !!op.rawResponse;
+            if (multipart) {
+                command.option('--file <part=path>', 'File part, repeatable: part name and local path', (v, all = []) => [...all, v]);
+                command.option('--field <part=value>', 'Text part, repeatable', (v, all = []) => [...all, v]);
+            }
+            else if (op.hasBody)
                 command[bodyRequired ? 'requiredOption' : 'option']('--body-file <path>', 'JSON request body, up to 1 MiB');
+            // Boxes raw answers use the generic --out below; event streams also take a --duration window.
+            if (boxesRaw) {
+                command.option('--duration <seconds>', 'For event streams: stop reading after this many seconds (default 10)');
+            }
             if (op.ifMatch)
                 command.requiredOption('--if-match <version>', 'The version you read (the version field of the object you are changing, or its ETag); a stale one is refused');
             if (op.idempotencyKey === 'required')
@@ -282,6 +473,50 @@ export function registerOperationCommands(root, commands, dependencies) {
                 if (options.bodyFile)
                     input.body = await readFunctionJson(options.bodyFile, BODY_LIMIT);
                 const headers = { ...idempotencyHeaders(id, options.idempotencyKey), ...(op.ifMatch ? ifMatchHeaders(id, options.ifMatch) : {}) };
+                const extra = options;
+                if (multipart) {
+                    const form = new FormData();
+                    const split = (entry) => { const at = entry.indexOf('='); if (at < 1)
+                        throw new Error(`Expected part=value, got "${entry}"`); return [entry.slice(0, at), entry.slice(at + 1)]; };
+                    for (const entry of extra.file ?? []) {
+                        const [part, file] = split(entry);
+                        form.append(part, new Blob([new Uint8Array(await readFile(file))]), basename(file));
+                    }
+                    for (const entry of extra.field ?? [])
+                        form.append(...split(entry));
+                    input.body = form;
+                }
+                if (boxesRaw) {
+                    const stream = new AbortController();
+                    const signal = dependencies.signal ? AbortSignal.any([dependencies.signal, stream.signal]) : stream.signal;
+                    const response = await (await dependencies.client()).raw(id, input, { headers, signal });
+                    if (!response.ok)
+                        throw new Error(`HTTP ${response.status}: ${(await response.text()).slice(0, 500)}`);
+                    const type = response.headers.get('content-type') ?? '';
+                    const timer = type.startsWith('text/event-stream') ? setTimeout(() => stream.abort(), Math.max(1, Number.isFinite(Number(extra.duration)) ? Number(extra.duration) : 10) * 1000) : undefined;
+                    const chunks = [];
+                    try {
+                        for await (const chunk of response.body ?? [])
+                            chunks.push(chunk);
+                    }
+                    catch (e) {
+                        if (!stream.signal.aborted)
+                            throw e;
+                    }
+                    finally {
+                        clearTimeout(timer);
+                    }
+                    const bytes = Buffer.concat(chunks);
+                    if (extra.out) {
+                        await writeFile(extra.out, bytes);
+                        dependencies.emit({ ok: true, path: extra.out, bytes: bytes.length, contentType: type }, () => `wrote ${bytes.length} bytes to ${extra.out}`);
+                    }
+                    else if (/^(text\/|application\/json)/.test(type))
+                        dependencies.emit(bytes.toString('utf8'), () => bytes.toString('utf8'));
+                    else
+                        throw new Error(`The response is ${type || 'binary'}; pass --out <path> to save it.`);
+                    return;
+                }
                 const result = await (await dependencies.client()).request(id, input, { headers, signal: dependencies.signal });
                 if (result instanceof Response) {
                     // With --out, a raw answer (e.g. a Panes screenshot) is written to the file as bytes.

package/dist/relays-commands/domains.js

@@ -5,6 +5,7 @@ export const domainsCommands = {
     'registrar domains get': 'relays_getRegistrarDomain',
     'domains analyze': 'relays_analyzeDomain',
     'domains suggest': 'relays_suggestDomains',
+    'domains specials': 'relays_listDomainSpecials',
     'forwarding list': 'relays_listDomainForwardingRules',
     'forwarding create': 'relays_createDomainForwardingRule',
     'forwarding delete': 'relays_deleteDomainForwardingRule',

package/dist/relays-commands/zones.d.ts

@@ -1,5 +1,7 @@
 import type { OperationId } from '@onesi/genesis';
 /** `genesis relays ...` words for the zones family (openapi/specs/relays/zones.openapi.yaml).
  * DNSSEC disable is `disable-dnssec`, beside the hand-written `dnssec <zone>` read and the
- * `create-zone` / `delete-zone` commands, so it does not shadow `dnssec <zone>`. */
+ * `create-zone` / `delete-zone` commands, so it does not shadow `dnssec <zone>`. Zone files and
+ * bulk records follow the same verb-noun form (`export-zone`, `import-zone`, `bulk-records`),
+ * so they never collide with the hand-written `zone <zone>` and `records ...` commands. */
 export declare const zonesCommands: Readonly<Record<string, OperationId>>;

package/dist/relays-commands/zones.js

@@ -1,9 +1,16 @@
 /** `genesis relays ...` words for the zones family (openapi/specs/relays/zones.openapi.yaml).
  * DNSSEC disable is `disable-dnssec`, beside the hand-written `dnssec <zone>` read and the
- * `create-zone` / `delete-zone` commands, so it does not shadow `dnssec <zone>`. */
+ * `create-zone` / `delete-zone` commands, so it does not shadow `dnssec <zone>`. Zone files and
+ * bulk records follow the same verb-noun form (`export-zone`, `import-zone`, `bulk-records`),
+ * so they never collide with the hand-written `zone <zone>` and `records ...` commands. */
 export const zonesCommands = {
     'caa list': 'relays_listCaaRecords',
     'caa create': 'relays_createCaaRecord',
     'disable-dnssec': 'relays_disableDnssec',
     'nameservers list': 'relays_listNameservers',
+    'export-zone': 'relays_exportZone',
+    'import-zone': 'relays_importZone',
+    'bulk-records': 'relays_bulkRecords',
+    'propagation check': 'relays_checkDnsPropagation',
+    'propagation global': 'relays_checkGlobalDnsPropagation',
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onesi/genesis-cli",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/l1felabs/genesis-api.git",
@@ -33,7 +33,7 @@
   "dependencies": {
     "commander": "^14.0.0",
     "undici": "6.29.0",
-    "@onesi/genesis": "0.2.0"
+    "@onesi/genesis": "0.2.2"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "^1.2.0"