@onesi/genesis 0.0.1-stage → 0.2.0

package/dist/hives-topics.d.ts

@@ -0,0 +1,51 @@
+import type { GenesisClient } from './client.js';
+import { type HivesResourceOptions } from './hives-resources-transport.js';
+export interface HivesTopic {
+    id: string;
+    projectId: string;
+    name: string;
+    createdAt: string;
+}
+export interface HivesTopicSubscription {
+    id: string;
+    projectId: string;
+    topicId: string;
+    queueId: string;
+    createdAt: string;
+}
+export interface HivesTopicPublish {
+    body?: unknown;
+    body_base64?: string;
+    attributes?: Record<string, string>;
+}
+export interface HivesTopicPublication {
+    publication_id: string;
+    deliveries: {
+        subscription_id: string;
+        queue_id: string;
+        message_id: string;
+    }[];
+}
+export declare function hivesTopics(client: GenesisClient): {
+    list(project: string, options?: HivesResourceOptions): Promise<{
+        data: HivesTopic[];
+    }>;
+    get(project: string, id: string, options?: HivesResourceOptions): Promise<HivesTopic>;
+    create(project: string, body: {
+        name: string;
+    }, options?: HivesResourceOptions): Promise<HivesTopic>;
+    remove(project: string, id: string, options?: HivesResourceOptions): Promise<{
+        deleted: true;
+    }>;
+    subscriptions: {
+        list(project: string, id: string, options?: HivesResourceOptions): Promise<{
+            data: HivesTopicSubscription[];
+        }>;
+        add(project: string, id: string, queueId: string, options?: HivesResourceOptions): Promise<HivesTopicSubscription>;
+        remove(project: string, id: string, subscriptionId: string, options?: HivesResourceOptions): Promise<{
+            deleted: true;
+        }>;
+    };
+    /** Persists one delivery per subscription atomically. Never retried after an unknown outcome. */
+    publish(project: string, id: string, body: HivesTopicPublish, options?: HivesResourceOptions): Promise<HivesTopicPublication>;
+};

package/dist/hives-topics.js

@@ -0,0 +1,79 @@
+import { hivesQueueBody } from './hives-queues.js';
+import { HIVES_QUEUE_BYTES, hivesResourceCall, hivesResourceId, resourceError } from './hives-resources-transport.js';
+const invalid = () => resourceError(0);
+const object = (v) => { if (!v || typeof v !== 'object' || Array.isArray(v))
+    throw invalid(); return v; };
+function nativeId(value, prefix) { if (typeof value !== 'string' || !new RegExp(`^${prefix}_[a-f0-9]{32}$`).test(value))
+    throw invalid(); return value; }
+function date(value) { if (typeof value !== 'string' || !Number.isFinite(Date.parse(value)))
+    throw invalid(); return value; }
+function name(value) { if (typeof value !== 'string' || !/^[A-Za-z0-9_-]{1,128}$/.test(value))
+    throw invalid(); return value; }
+function topic(value, project, id) {
+    const v = object(value);
+    if (v.projectId !== project || id !== undefined && v.id !== id)
+        throw invalid();
+    return { id: nativeId(v.id, 'top'), projectId: project, name: name(v.name), createdAt: date(v.createdAt) };
+}
+function subscription(value, project, topicId, queueId) {
+    const v = object(value);
+    if (v.projectId !== project || v.topicId !== topicId || queueId !== undefined && v.queueId !== queueId)
+        throw invalid();
+    return { id: nativeId(v.id, 'sub'), projectId: project, topicId, queueId: hivesResourceId(v.queueId), createdAt: date(v.createdAt) };
+}
+function publishInput(value) {
+    const v = object(value);
+    if (Object.keys(v).some(k => !['body', 'body_base64', 'attributes'].includes(k)) || (v.body != null) === (v.body_base64 != null))
+        throw invalid();
+    if (v.body_base64 != null)
+        hivesQueueBody(v.body_base64);
+    else {
+        let encoded;
+        try {
+            encoded = typeof v.body === 'string' ? v.body : JSON.stringify(v.body);
+        }
+        catch {
+            throw invalid();
+        }
+        if (encoded === undefined || new TextEncoder().encode(encoded).length > HIVES_QUEUE_BYTES)
+            throw invalid();
+    }
+    if (v.attributes !== undefined) {
+        const attrs = object(v.attributes);
+        if (Object.keys(attrs).length > 61 || Object.entries(attrs).some(([k, a]) => !k || new TextEncoder().encode(k).length > 128 || k.startsWith('buzz.') || typeof a !== 'string') || new TextEncoder().encode(JSON.stringify(attrs)).length > 8192)
+            throw invalid();
+    }
+}
+export function hivesTopics(client) {
+    const ids = (project, id) => ({ project_id: hivesResourceId(project), ...(id === undefined ? {} : { topic_id: hivesResourceId(id) }) });
+    const call = (operation, input, options, status = 200) => hivesResourceCall(client, operation, input, options, 'json', 2 * 1024 * 1024, 20_000, status);
+    const removed = (value) => { if (object(value).deleted !== true)
+        throw invalid(); return { deleted: true }; };
+    return {
+        async list(project, options) { const v = object(await call('hives_list_native_topic', ids(project), options)); if (!Array.isArray(v.data) || v.data.length > 16)
+            throw invalid(); const data = v.data.map(row => topic(row, project)); if (new Set(data.map(x => x.id)).size !== data.length)
+            throw invalid(); return { data }; },
+        async get(project, id, options) { return topic(await call('hives_inspect_native_topic', ids(project, id), options), project, id); },
+        async create(project, body, options) { const v = object(body); if (Object.keys(v).length !== 1)
+            throw invalid(); name(v.name); return topic(await call('hives_create_native_topic', { ...ids(project), body }, options, 201), project); },
+        async remove(project, id, options) { return removed(await call('hives_delete_native_topic', ids(project, id), options)); },
+        subscriptions: {
+            async list(project, id, options) { const v = object(await call('hives_subscriptions_native_topic', ids(project, id), options)); if (!Array.isArray(v.data) || v.data.length > 32)
+                throw invalid(); const data = v.data.map(row => subscription(row, project, id)); if (new Set(data.map(x => x.id)).size !== data.length || new Set(data.map(x => x.queueId)).size !== data.length)
+                throw invalid(); return { data }; },
+            async add(project, id, queueId, options) { const queue = hivesResourceId(queueId); return subscription(await call('hives_subscribe_native_topic', { ...ids(project, id), body: { queueId: queue } }, options, 201), project, id, queue); },
+            async remove(project, id, subscriptionId, options) { return removed(await call('hives_unsubscribe_native_topic', { ...ids(project, id), subscription_id: hivesResourceId(subscriptionId) }, options)); },
+        },
+        /** Persists one delivery per subscription atomically. Never retried after an unknown outcome. */
+        async publish(project, id, body, options) {
+            publishInput(body);
+            const v = object(await call('hives_publish_native_topic', { ...ids(project, id), body }, options, 201));
+            if (!Array.isArray(v.deliveries) || v.deliveries.length > 32)
+                throw invalid();
+            const deliveries = v.deliveries.map(raw => { const d = object(raw); return { subscription_id: nativeId(d.subscription_id, 'sub'), queue_id: hivesResourceId(d.queue_id), message_id: hivesResourceId(d.message_id) }; });
+            if (new Set(deliveries.map(x => x.subscription_id)).size !== deliveries.length || new Set(deliveries.map(x => x.queue_id)).size !== deliveries.length || new Set(deliveries.map(x => x.message_id)).size !== deliveries.length)
+                throw invalid();
+            return { publication_id: nativeId(v.publication_id, 'pub'), deliveries };
+        },
+    };
+}

package/dist/hives-upload.d.ts

@@ -0,0 +1,9 @@
+export declare const MAX_WASM_BYTES: number;
+export interface HivesUploadOptions {
+    filename?: string;
+    git_sha?: string;
+    git_branch?: string;
+    git_message?: string;
+}
+/** Real multipart binary; the org and digest are resolved by the authenticated backend. */
+export declare function hivesUploadBody(file: Blob, options?: HivesUploadOptions): Promise<FormData>;

package/dist/hives-upload.js

@@ -0,0 +1,23 @@
+export const MAX_WASM_BYTES = 10 * 1024 * 1024;
+/** Real multipart binary; the org and digest are resolved by the authenticated backend. */
+export async function hivesUploadBody(file, options = {}) {
+    if (!(file instanceof Blob) || file.size < 4 || file.size > MAX_WASM_BYTES)
+        throw new Error('Choose a WebAssembly binary of 4 bytes to 10 MiB.');
+    const magic = new Uint8Array(await file.slice(0, 4).arrayBuffer());
+    if (magic[0] !== 0 || magic[1] !== 97 || magic[2] !== 115 || magic[3] !== 109)
+        throw new Error('The file must be a WebAssembly binary.');
+    const limits = { git_sha: 40, git_branch: 255, git_message: 1000 };
+    if (options.filename !== undefined && (typeof options.filename !== 'string' || !options.filename.length || options.filename.length > 255 || /[\r\n]/.test(options.filename)))
+        throw new Error('WASM filename must contain 1–255 characters without newlines.');
+    const form = new FormData();
+    form.append('file', file, options.filename ?? 'module.wasm');
+    for (const key of Object.keys(limits)) {
+        const value = options[key];
+        if (value === undefined)
+            continue;
+        if (typeof value !== 'string' || value.length > limits[key] || (key === 'git_sha' && value.length < 7))
+            throw new Error('Invalid deployment Git metadata.');
+        form.append(key, value);
+    }
+    return form;
+}

package/dist/hives-volumes.d.ts

@@ -0,0 +1,64 @@
+import type { GenesisClient } from './client.js';
+import { type HivesResourceOptions } from './hives-resources-transport.js';
+declare const states: readonly ["creating", "available", "attaching", "attached", "detaching", "deleting", "failed"];
+export interface HivesVolume {
+    id: string;
+    project_id: string;
+    name: string;
+    size_gib: number;
+    backing_bytes: number;
+    capacity_bytes: number | null;
+    used_bytes: number | null;
+    storage_class: 'local';
+    access_mode: 'read_write_once';
+    state: typeof states[number];
+    operation_pending: boolean;
+    generation: number;
+    mount_path: string | null;
+    attached_to: string | null;
+    read_only: boolean | null;
+    created_at: string;
+    updated_at: string;
+}
+export type HivesVolumeCreate = {
+    name: string;
+    storage_class?: 'local';
+    access_mode?: 'read_write_once';
+} & ({
+    size_mib: number;
+    size_gib?: never;
+} | {
+    size_gib: 1;
+    size_mib?: never;
+});
+export interface HivesVolumeMount {
+    target_id: string;
+    mount_path: string;
+    read_only: boolean;
+}
+export interface HivesVolumePage {
+    volumes: HivesVolume[];
+    pagination: {
+        page: number;
+        per_page: number;
+        total: number;
+        total_pages: number;
+    };
+}
+/** Persisted project storage. A failed acknowledgement never triggers an automatic write retry. */
+export declare function hivesVolumes(client: GenesisClient): {
+    list(project: string, query?: {
+        page?: number;
+        per_page?: number;
+    }, options?: HivesResourceOptions): Promise<HivesVolumePage>;
+    get(project: string, id: string, options?: HivesResourceOptions): Promise<HivesVolume>;
+    create(project: string, input: HivesVolumeCreate, options?: HivesResourceOptions): Promise<HivesVolume>;
+    mount(project: string, id: string, input: HivesVolumeMount, options?: HivesResourceOptions): Promise<HivesVolume>;
+    unmount(project: string, id: string, options?: HivesResourceOptions): Promise<HivesVolume>;
+    remove(project: string, id: string, options?: HivesResourceOptions): Promise<{
+        success: true;
+        id: string;
+        message: string;
+    }>;
+};
+export {};

package/dist/hives-volumes.js

@@ -0,0 +1,117 @@
+import { hivesResourceCall, hivesResourceId, resourceError } from './hives-resources-transport.js';
+const MIB = 1024 * 1024;
+const states = ['creating', 'available', 'attaching', 'attached', 'detaching', 'deleting', 'failed'];
+function object(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw resourceError(0);
+    return value;
+}
+function text(value, max = 128) {
+    if (typeof value !== 'string' || !value || value.length > max || /[\u0000-\u001f\u007f]/.test(value))
+        throw resourceError(0);
+    return value;
+}
+function count(value) {
+    if (!Number.isSafeInteger(value) || value < 0)
+        throw resourceError(0);
+    return value;
+}
+function date(value) { const result = text(value, 64); if (!Number.isFinite(Date.parse(result)))
+    throw resourceError(0); return result; }
+function volume(value, project, expectedId) {
+    const row = object(value);
+    if (row.project_id !== project || row.storage_class !== 'local' || row.access_mode !== 'read_write_once'
+        || !states.includes(row.state) || typeof row.operation_pending !== 'boolean')
+        throw resourceError(0);
+    const id = hivesResourceId(text(row.id));
+    if (expectedId && id !== expectedId)
+        throw resourceError(0);
+    const backing = count(row.backing_bytes);
+    const capacity = row.capacity_bytes === null ? null : count(row.capacity_bytes);
+    const used = row.used_bytes === null ? null : count(row.used_bytes);
+    if (backing < 32 * MIB || backing > 1024 * MIB || row.size_gib !== backing / (1024 * MIB)
+        || capacity !== null && capacity > backing || used !== null && (capacity === null || used > capacity))
+        throw resourceError(0);
+    const path = row.mount_path === null ? null : text(row.mount_path, 512);
+    const attached = row.attached_to === null ? null : hivesResourceId(text(row.attached_to));
+    if ((path === null) !== (attached === null) || (attached === null ? row.read_only !== null : typeof row.read_only !== 'boolean'))
+        throw resourceError(0);
+    const generation = count(row.generation);
+    if (generation < 1)
+        throw resourceError(0);
+    return { id, project_id: project, name: text(row.name, 64), size_gib: backing / (1024 * MIB), backing_bytes: backing,
+        capacity_bytes: capacity, used_bytes: used, storage_class: 'local', access_mode: 'read_write_once',
+        state: row.state, operation_pending: row.operation_pending, generation,
+        mount_path: path, attached_to: attached, read_only: row.read_only,
+        created_at: date(row.created_at), updated_at: date(row.updated_at) };
+}
+/** Persisted project storage. A failed acknowledgement never triggers an automatic write retry. */
+export function hivesVolumes(client) {
+    const ids = (project, id) => ({ project_id: hivesResourceId(project), ...(id === undefined ? {} : { volume_id: hivesResourceId(id) }) });
+    const call = (id, input, options) => hivesResourceCall(client, id, input, options);
+    return {
+        async list(project, query = {}, options) {
+            const page = query.page ?? 1;
+            const perPage = query.per_page ?? 25;
+            if (Object.keys(query).some(key => !['page', 'per_page'].includes(key)) || !Number.isSafeInteger(page) || page < 1 || page > 10000
+                || !Number.isSafeInteger(perPage) || perPage < 1 || perPage > 100)
+                throw resourceError(0);
+            const result = object(await call('hives_list_volumes', { ...ids(project), page, per_page: perPage }, options));
+            const pagination = object(result.pagination);
+            const total = count(pagination.total);
+            const pages = count(pagination.total_pages);
+            if (pagination.page !== page || pagination.per_page !== perPage || pages !== Math.ceil(total / perPage)
+                || !Array.isArray(result.volumes) || result.volumes.length > perPage)
+                throw resourceError(0);
+            const volumes = result.volumes.map(row => volume(row, project));
+            if (new Set(volumes.map(row => row.id)).size !== volumes.length)
+                throw resourceError(0);
+            return { volumes, pagination: { page, per_page: perPage, total, total_pages: pages } };
+        },
+        async get(project, id, options) { return volume(await call('hives_get_volume', ids(project, id), options), project, id); },
+        async create(project, input, options) {
+            const body = object(input);
+            const name = text(body.name, 64);
+            let size;
+            if (body.size_mib !== undefined && body.size_gib === undefined)
+                size = count(body.size_mib);
+            else if (body.size_mib === undefined && body.size_gib === 1)
+                size = 1024;
+            else
+                throw resourceError(0);
+            if (name.trim() !== name || size < 32 || size > 1024 || body.storage_class !== undefined && body.storage_class !== 'local'
+                || body.access_mode !== undefined && body.access_mode !== 'read_write_once'
+                || Object.keys(body).some(key => !['name', 'size_mib', 'size_gib', 'storage_class', 'access_mode'].includes(key)))
+                throw resourceError(0);
+            const result = volume(await call('hives_create_volume', { ...ids(project), body: { name, size_mib: size, storage_class: 'local', access_mode: 'read_write_once' } }, options), project);
+            if (result.name !== name || result.backing_bytes !== size * MIB)
+                throw resourceError(0);
+            return result;
+        },
+        async mount(project, id, input, options) {
+            const body = object(input);
+            const target = hivesResourceId(text(body.target_id));
+            const path = text(body.mount_path, 128);
+            if (!/^\/[A-Za-z0-9_-]+(?:\/[A-Za-z0-9_-]+)*$/.test(path) || typeof body.read_only !== 'boolean'
+                || Object.keys(body).some(key => !['target_id', 'mount_path', 'read_only'].includes(key)))
+                throw resourceError(0);
+            const readOnly = body.read_only;
+            const result = volume(await call('hives_mount_volume', { ...ids(project, id), body: { target_id: target, mount_path: path, read_only: readOnly } }, options), project, id);
+            if (result.attached_to !== target || result.mount_path !== path || result.read_only !== readOnly)
+                throw resourceError(0);
+            return result;
+        },
+        async unmount(project, id, options) {
+            const result = volume(await call('hives_unmount_volume', ids(project, id), options), project, id);
+            if (result.state !== 'available' || result.operation_pending || result.attached_to !== null || result.mount_path !== null || result.read_only !== null)
+                throw resourceError(0);
+            return result;
+        },
+        async remove(project, id, options) {
+            const result = object(await call('hives_delete_volume', ids(project, id), options));
+            if (result.id !== id || result.success !== true)
+                throw resourceError(0);
+            return { success: true, id, message: text(result.message, 256) };
+        },
+    };
+}

package/dist/iam-directory.d.ts

@@ -0,0 +1,8 @@
+export declare const iamDirectoryOperations: readonly string[];
+export declare const isIamDirectoryOperation: (operationId: string) => boolean;
+/**
+ * The actionable form of a directory refusal; any other error is returned unchanged. The gateway, not the client, exchanges
+ * the One account session for an organization context at Auth and forwards the short-lived child to IAM. The client sends
+ * one request, never changes a session or its selected context, and only explains what came back.
+ */
+export declare function iamDirectoryFailure(e: unknown, org: string, operationId: string): unknown;

package/dist/iam-directory.js

@@ -0,0 +1,23 @@
+import { GenesisError, errorCatalog } from './errors.js';
+/** The IAM v4 organization directory: projects and workspaces at /v1/iam/orgs/{org_id}/... */
+const READS = ['iam_listProjects', 'iam_getProject', 'iam_listWorkspaces', 'iam_getWorkspace'];
+const WRITES = ['iam_createProject', 'iam_updateProject', 'iam_deleteProject', 'iam_createWorkspace', 'iam_updateWorkspace', 'iam_deleteWorkspace'];
+export const iamDirectoryOperations = [...READS, ...WRITES];
+export const isIamDirectoryOperation = (operationId) => iamDirectoryOperations.includes(operationId);
+const codeOf = (e) => errorCatalog(e).code?.toUpperCase();
+/**
+ * The actionable form of a directory refusal; any other error is returned unchanged. The gateway, not the client, exchanges
+ * the One account session for an organization context at Auth and forwards the short-lived child to IAM. The client sends
+ * one request, never changes a session or its selected context, and only explains what came back.
+ */
+export function iamDirectoryFailure(e, org, operationId) {
+    if (!(e instanceof GenesisError))
+        return e;
+    const keep = (message) => new GenesisError({ status: e.status, type: e.type, code: e.code, requestId: e.requestId, operationId, body: e.body, message });
+    const code = codeOf(e);
+    if (code === 'TENANT_REQUIRED')
+        return keep(`IAM sees no organization on your One account session for ${org}. Use the Console to manage projects and workspaces for now.`);
+    if (WRITES.includes(operationId) && code === 'SCOPE_MISSING' && errorCatalog(e).required_scope === 'iam:write')
+        return keep(`This credential cannot change projects and workspaces in ${org}: a login needs the organization owner or manager role in IAM, and an API key needs iam:write. Use the Console.`);
+    return e;
+}