@onesi/genesis 0.0.0-stage → 0.1.13

package/dist/runner.js

@@ -0,0 +1,116 @@
+import { RUNNER_SELF_GRANT_OPERATION } from './runner-grant.js';
+const requestOptions = (options) => ({ signal: options.signal });
+const opaqueId = (v) => typeof v === 'string' && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(v);
+const pathLike = (v) => /^[A-Za-z]:/.test(v) || v.includes('..');
+const invalid = () => new TypeError('Runner input must match the bounded runner/task-client/v0 contract');
+function checkedJobId(value) {
+    if (!opaqueId(value) || pathLike(value)
+        || /^(?:https?|ftp|file|data|javascript|bearer|basic):|^(?:sk[-_]|pk[-_]|gh[pousr]_|github_pat_|xox[baprs]-|eyJ)/i.test(value)) {
+        throw invalid();
+    }
+    return value;
+}
+function closed(value, required, optional = []) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        && required.every((key) => Object.hasOwn(value, key))
+        && Object.keys(value).every((key) => required.includes(key) || optional.includes(key));
+}
+// Match the core's input bounds and copy once so a caller cannot mutate a validated request
+// while the asynchronous credential provider runs. Identity is never an input property.
+function copyBoundedInput(value) {
+    let nodes = 0;
+    let chars = 0;
+    const ancestors = new Set();
+    const countText = (text) => {
+        chars += text.length;
+        if (text.length > 32768 || chars > 65536)
+            throw invalid();
+        return text;
+    };
+    const walk = (v, depth) => {
+        if (++nodes > 256)
+            throw invalid();
+        if (v === null || typeof v === 'boolean')
+            return v;
+        if (typeof v === 'string')
+            return countText(v);
+        if (typeof v === 'number' && Number.isFinite(v))
+            return v;
+        if (typeof v !== 'object' || depth >= 6 || ancestors.has(v))
+            throw invalid();
+        ancestors.add(v);
+        try {
+            if (Array.isArray(v)) {
+                if (Object.getPrototypeOf(v) !== Array.prototype || v.length > 64 || Reflect.ownKeys(v).length !== v.length + 1)
+                    throw invalid();
+                return Array.from({ length: v.length }, (_, index) => {
+                    const d = Object.getOwnPropertyDescriptor(v, String(index));
+                    if (!d || !('value' in d) || !d.enumerable)
+                        throw invalid();
+                    return walk(d.value, depth + 1);
+                });
+            }
+            const prototype = Object.getPrototypeOf(v);
+            if (prototype !== null && prototype !== Object.prototype)
+                throw invalid();
+            const keys = Reflect.ownKeys(v);
+            if (keys.length > 32)
+                throw invalid();
+            const out = Object.create(null);
+            for (const key of keys) {
+                if (typeof key !== 'string')
+                    throw invalid();
+                countText(key);
+                const d = Object.getOwnPropertyDescriptor(v, key);
+                if (!('value' in d) || !d.enumerable)
+                    throw invalid();
+                out[key] = walk(d.value, depth + 1);
+            }
+            return out;
+        }
+        finally {
+            ancestors.delete(v);
+        }
+    };
+    return walk(value, 0);
+}
+function checkedStartInput(input) {
+    const v = copyBoundedInput(input);
+    if (!closed(v, ['task', 'workspaceRef', 'executionRef', 'limits', 'idempotencyKey'])
+        || !closed(v.task, ['id', 'text'], ['meta']) || !opaqueId(v.task.id)
+        || typeof v.task.text !== 'string' || !v.task.text.trim()
+        || (Object.hasOwn(v.task, 'meta') && (v.task.meta === null || typeof v.task.meta !== 'object' || Array.isArray(v.task.meta)))
+        || !opaqueId(v.workspaceRef) || pathLike(v.workspaceRef)
+        || !closed(v.executionRef, ['kind', 'routeId'])
+        || !['external-harness', 'internal-model'].includes(v.executionRef.kind) || !opaqueId(v.executionRef.routeId)
+        || !closed(v.limits, ['maxDurationMs', 'maxOutputBytes'], ['maxEvents']) || !opaqueId(v.idempotencyKey))
+        throw invalid();
+    const limit = (n, maximum) => Number.isInteger(n) && n > 0 && n <= maximum;
+    if (!limit(v.limits.maxDurationMs, 86400000) || !limit(v.limits.maxOutputBytes, 67108864)
+        || (Object.hasOwn(v.limits, 'maxEvents') && !limit(v.limits.maxEvents, 1000)))
+        throw invalid();
+    if (new TextEncoder().encode(JSON.stringify(v)).byteLength > 65536)
+        throw invalid();
+    return v;
+}
+/** Runner routes use the Genesis client's credential; the backend owns org/subject scoping. */
+export function runnerModule(client) {
+    return Object.freeze({
+        permission: Object.freeze({
+            grant: (input, opts = {}) => client.request(RUNNER_SELF_GRANT_OPERATION, { body: input }, requestOptions(opts)),
+        }),
+        catalog: (opts = {}) => client.request('runner_getCatalog', undefined, requestOptions(opts)),
+        jobs: Object.freeze({
+            list: (opts = {}) => client.request('runner_listJobs', undefined, requestOptions(opts)),
+            start: (input, opts = {}) => client.request('runner_startJob', { body: checkedStartInput(input) }, requestOptions(opts)),
+            get: (jobId, opts = {}) => client.request('runner_getJob', { jobId: checkedJobId(jobId) }, requestOptions(opts)),
+            events: (jobId, afterSeq = 0, opts = {}) => {
+                if (!Number.isSafeInteger(afterSeq) || afterSeq < 0)
+                    throw invalid();
+                return client.request('runner_getJobEvents', { jobId: checkedJobId(jobId), afterSeq }, requestOptions(opts));
+            },
+            result: (jobId, opts = {}) => client.request('runner_getJobResult', { jobId: checkedJobId(jobId) }, requestOptions(opts)),
+            cancel: (jobId, opts = {}) => client.request('runner_cancelJob', { jobId: checkedJobId(jobId) }, requestOptions(opts)),
+        }),
+    });
+}

package/dist/types.d.ts

@@ -0,0 +1,87 @@
+import type { operations } from './generated/schema.js';
+export interface ServiceMeta {
+    name: string;
+    title: string;
+    upstream: string;
+    operations: number;
+    /** @deprecated No longer shipped; always undefined. Read live state from `GET /v1/status` (`genesis status`). */
+    status?: string;
+    /** @deprecated No longer shipped; always undefined. */
+    statusNote?: string;
+    /** `dedicated`: the gateway admits this service only through its own composition, never a default registry route. */
+    gatewayRoute?: 'dedicated';
+}
+export interface OperationMeta {
+    method: string;
+    path: string;
+    service: string;
+    summary: string;
+    upstream: {
+        base: string;
+        method: string;
+        path: string;
+        /** @deprecated No longer shipped; always undefined. Read live state from `GET /v1/status`. */
+        status?: string;
+    };
+    mcp: boolean;
+    internal: boolean;
+    public: boolean;
+    pathParams: readonly string[];
+    queryParams: readonly string[];
+    hasBody: boolean;
+    requestContentType?: string;
+    rawResponse?: boolean;
+    /** The operation reads an Idempotency-Key header: `required` refuses without one. */
+    idempotencyKey?: 'required' | 'optional';
+    inputSchema: Record<string, unknown>;
+}
+type Ops = operations;
+type Clean<T> = [T] extends [never] ? {} : [NonNullable<T>] extends [never] ? {} : NonNullable<T>;
+type Part<K extends keyof Ops, L extends 'path' | 'query'> = Ops[K] extends {
+    parameters: infer P;
+} ? (P extends {
+    [X in L]?: infer T;
+} ? Clean<T> : {}) : {};
+type Body<K extends keyof Ops> = Ops[K] extends {
+    requestBody?: infer B;
+} ? [NonNullable<B>] extends [never] ? {} : NonNullable<B> extends {
+    content: {
+        'application/json': infer J;
+    };
+} ? (undefined extends B ? {
+    body?: J;
+} : {
+    body: J;
+}) : NonNullable<B> extends {
+    content: {
+        'multipart/form-data': unknown;
+    };
+} ? (undefined extends B ? {
+    body?: FormData;
+} : {
+    body: FormData;
+}) : {} : {};
+/** Flat input for an operation: path params + query params + `body`. */
+export type OperationInput<K extends keyof Ops> = Part<K, 'path'> & Part<K, 'query'> & Body<K>;
+type Ok<R> = R extends {
+    200: infer X;
+} ? X : R extends {
+    201: infer X;
+} ? X : R extends {
+    202: infer X;
+} ? X : R extends {
+    204: unknown;
+} ? {
+    content: {
+        'application/json': void;
+    };
+} : unknown;
+/** Parsed JSON success body for an operation. */
+export type OperationOutput<K extends keyof Ops> = K extends 'hives_invoke_function' | 'hives_invoke_function_async' | 'hives_invoke_deployment' ? Response : Ops[K] extends {
+    responses: infer R;
+} ? (Ok<R> extends {
+    content: {
+        'application/json': infer J;
+    };
+} ? J : unknown) : unknown;
+export {};

package/dist/types.js

@@ -0,0 +1 @@
+export {};

package/dist/urls.d.ts

@@ -0,0 +1,6 @@
+/** Transport-safety checks for configured endpoints (mirrors sdk/python/src/lifesi_genesis/_urls.py). */
+/**
+ * Return `value` if it is https, or http on a loopback host; throw otherwise.
+ * Credentials ride on every request, so a plain-http endpoint off the local machine is refused.
+ */
+export declare function requireSecureUrl(value: string, what: string): string;

package/dist/urls.js

@@ -0,0 +1,31 @@
+/** Transport-safety checks for configured endpoints (mirrors sdk/python/src/lifesi_genesis/_urls.py). */
+function isLoopback(hostname) {
+    const host = hostname.replace(/^\[|\]$/g, '').toLowerCase();
+    // Exact names only: *.localhost is not guaranteed to resolve to loopback.
+    if (host === 'localhost')
+        return true;
+    if (host === '::1')
+        return true;
+    const v4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+    return !!v4 && v4.slice(1).every((o) => Number(o) <= 255) && v4[1] === '127';
+}
+/**
+ * Return `value` if it is https, or http on a loopback host; throw otherwise.
+ * Credentials ride on every request, so a plain-http endpoint off the local machine is refused.
+ */
+export function requireSecureUrl(value, what) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error(`${what} must be an absolute https URL`);
+    }
+    if (!url.hostname)
+        throw new Error(`${what} must be an absolute https URL`);
+    if (url.protocol === 'https:')
+        return value;
+    if (url.protocol === 'http:' && isLoopback(url.hostname))
+        return value;
+    throw new Error(`${what} must use https (http is allowed only on loopback hosts)`);
+}

package/package.json

@@ -1,6 +1,49 @@
 {
   "name": "@onesi/genesis",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.13",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/l1felabs/genesis-api.git",
+    "directory": "packages/sdk"
+  },
+  "description": "One typed SDK for every Genesis service (Foundry, Hives, Relays, IAM...) via the Genesis API gateway",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./spec.json": "./dist/genesis.openapi.json",
+    "./hives-node": {
+      "types": "./dist/hives-node.d.ts",
+      "default": "./dist/hives-node.js"
+    }
+  },
+  "keywords": [
+    "genesis",
+    "oneos",
+    "sdk",
+    "cli",
+    "mcp",
+    "model-context-protocol",
+    "ai-agents",
+    "api"
+  ],
+  "author": "One Superintelligence, Inc.",
+  "homepage": "https://os.one.ml/docs",
+  "engines": {
+    "node": ">=20.19"
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "undici": "6.29.0"
+  },
+  "scripts": {
+    "gen": "node scripts/gen.mjs",
+    "build": "tsc -p tsconfig.json && cp ../../openapi/genesis.openapi.json dist/"
+  }
 }