@onesi/genesis 0.0.1-stage → 0.2.0

package/dist/blinds-owner-enrollment.d.ts

@@ -0,0 +1,280 @@
+import type { GenesisClient } from './client.js';
+import type { OperationInput } from './types.js';
+export declare const isBlindsOwnerOperation: (id: string) => boolean;
+/** One original-human operation; all public metadata, no arbitrary signing payload or private key. */
+export declare function blindsOwnerTransport(options: {
+    operationId: string;
+    input: Record<string, unknown>;
+    routing: string;
+    url: string;
+    credential: () => Promise<string | undefined>;
+    fetch: typeof fetch;
+    signal?: AbortSignal;
+}): Promise<Response>;
+export declare function blindsModule(client: GenesisClient): {
+    credentials: {
+        /** Variable names only; values never leave Blinds. */
+        list: (init?: {
+            signal?: AbortSignal;
+        }) => Promise<{
+            credentials: string[];
+        }>;
+        /** Connect a static credential. The value is KMS-encrypted and never returned. */
+        store: (body: OperationInput<"blinds_storeCredential">["body"], init?: {
+            signal?: AbortSignal;
+            idempotencyKey?: string;
+        }) => Promise<{
+            variable_name: string;
+        }>;
+        revoke: (variable: string, init?: {
+            signal?: AbortSignal;
+            idempotencyKey?: string;
+        }) => Promise<unknown>;
+        /** Revoke every credential in the selected organization. Bulk and irreversible. */
+        revokeAll: (init?: {
+            signal?: AbortSignal;
+            idempotencyKey?: string;
+        }) => Promise<{
+            revoked: number;
+        }>;
+    };
+    oauth: {
+        connections: (init?: {
+            signal?: AbortSignal;
+        }) => Promise<{
+            connections: import("./index.js").components["schemas"]["Blinds.OAuthConnection"][];
+            total: number;
+        }>;
+        /** Catalog providers that use OAuth 2.0. */
+        providers: (query?: {
+            q?: string;
+            category?: string;
+            limit?: number;
+            offset?: number;
+        }, init?: {
+            signal?: AbortSignal;
+        }) => Promise<{
+            providers: import("./index.js").components["schemas"]["Blinds.ProviderSummary"][];
+            total: number;
+            limit: number;
+            offset: number;
+        }>;
+    };
+    /** What a credential can be bound to: auth mode and allowed destination domains. */
+    providers: {
+        list: (query?: {
+            q?: string;
+            category?: string;
+            limit?: number;
+            offset?: number;
+        } & {
+            auth_mode?: string;
+        }, init?: {
+            signal?: AbortSignal;
+        }) => Promise<{
+            providers: import("./index.js").components["schemas"]["Blinds.ProviderSummary"][];
+            total: number;
+            limit: number;
+            offset: number;
+        }>;
+        get: (slug: string, init?: {
+            signal?: AbortSignal;
+        }) => Promise<{
+            provider: import("./index.js").components["schemas"]["Blinds.ProviderSummary"];
+            oauth2?: {
+                authorization_url?: string;
+                token_url?: string;
+                refresh_url?: string | null;
+                revocation_url?: string | null;
+                default_scopes?: string[];
+                scopes_separator?: string;
+                supports_refresh?: boolean;
+                supports_pkce?: boolean;
+                pkce_method?: string | null;
+            } | null;
+            api_key?: {
+                placement?: string;
+                key_name?: string;
+                prefix?: string | null;
+            } | null;
+            destination: {
+                allowed_domains?: string[];
+                allow_subdomains?: boolean;
+                require_tls?: boolean;
+                allowed_ports?: number[];
+            };
+            auth_header_template?: Record<string, never> | null;
+        }>;
+    };
+    settings: {
+        get: (init?: {
+            signal?: AbortSignal;
+        }) => Promise<{
+            consent_policy: "never" | "per_variable" | "per_delegate";
+            dashboard_notifications: boolean;
+            email_notifications: boolean;
+            slack_notifications: boolean;
+            updated_at: string;
+        }>;
+        update: (body: OperationInput<"blinds_updateSettings">["body"], init?: {
+            signal?: AbortSignal;
+            idempotencyKey?: string;
+        }) => Promise<{
+            consent_policy: "never" | "per_variable" | "per_delegate";
+            dashboard_notifications: boolean;
+            email_notifications: boolean;
+            slack_notifications: boolean;
+            updated_at: string;
+        }>;
+    };
+    agents: (init?: {
+        signal?: AbortSignal;
+    }) => Promise<{
+        agents: import("./index.js").components["schemas"]["Blinds.AgentSummary"][];
+    }>;
+    alerts: (init?: {
+        signal?: AbortSignal;
+    }) => Promise<{
+        events: import("./index.js").components["schemas"]["Blinds.ActivityEvent"][];
+    }>;
+    /** The receipt for a mutation, by the Idempotency-Key it was sent with. Read it after an uncertain outcome; never replay. */
+    operations: {
+        get: (operation_id: string, init?: {
+            signal?: AbortSignal;
+        }) => Promise<{
+            operation_id: string;
+            state: "pending" | "completed";
+            response_status?: number | null;
+            response?: unknown;
+        }>;
+    };
+    consent: {
+        pending: (init?: {
+            signal?: AbortSignal;
+        }) => Promise<{
+            requests: import("./index.js").components["schemas"]["Blinds.ConsentPending"][];
+        }>;
+        records: (init?: {
+            signal?: AbortSignal;
+        }) => Promise<{
+            records: import("./index.js").components["schemas"]["Blinds.ConsentRecord"][];
+        }>;
+        approve: (consent_id: string, body: OperationInput<"blinds_approveConsent">["body"], init?: {
+            signal?: AbortSignal;
+            idempotencyKey?: string;
+        }) => Promise<unknown>;
+        deny: (consent_id: string, init?: {
+            signal?: AbortSignal;
+            idempotencyKey?: string;
+        }) => Promise<unknown>;
+        revoke: (consent_id: string, init?: {
+            signal?: AbortSignal;
+            idempotencyKey?: string;
+        }) => Promise<unknown>;
+    };
+    delegates: {
+        list: (init?: {
+            signal?: AbortSignal;
+        }) => Promise<{
+            delegates: import("./index.js").components["schemas"]["Blinds.Delegate"][];
+        }>;
+        create: (body: OperationInput<"blinds_createDelegate">["body"], init?: {
+            signal?: AbortSignal;
+            idempotencyKey?: string;
+        }) => Promise<{
+            delegate_id: string;
+            parent_id?: string | null;
+            name: string;
+            issuer_did: string;
+            delegated_variables: string[];
+            max_depth?: number;
+            current_depth?: number;
+            ttl_seconds?: number;
+            created_at?: string;
+            expires_at: string;
+        }>;
+        revoke: (delegate_id: string, init?: {
+            signal?: AbortSignal;
+            idempotencyKey?: string;
+        }) => Promise<unknown>;
+    };
+    activity: (init?: {
+        signal?: AbortSignal;
+    }) => Promise<{
+        events: import("./index.js").components["schemas"]["Blinds.ActivityEvent"][];
+    }>;
+    ownerEnrollment: {
+        reserve: (body: OperationInput<"blinds_ownerReserve">["body"], init?: {
+            signal?: AbortSignal;
+        }) => Promise<{
+            schemaVersion: 1;
+            requestId: string;
+            edReservationId: string;
+            operationId: string;
+            publicKey: string;
+            state: "key_ready" | "attached";
+            expiresAtMs: number;
+            originalOrganizationGeneration: number;
+        }>;
+        sign: (body: OperationInput<"blinds_ownerSign">["body"], init?: {
+            signal?: AbortSignal;
+        }) => Promise<{
+            schemaVersion: 1;
+            requestId: string;
+            edReservationId: string;
+            enrollmentIntentId: string;
+            operationId: string;
+            signingPayloadSha256: string;
+            signatureMultibase: string;
+        }>;
+        attach: (body: OperationInput<"blinds_ownerAttach">["body"], init?: {
+            signal?: AbortSignal;
+        }) => Promise<{
+            schemaVersion: 1;
+            requestId: string;
+            edReservationId: string;
+            enrollmentIntentId: string;
+            state: "attached";
+            creation: {
+                intent_id: string;
+                operation_id: string;
+                creation_receipt_id: string;
+                agent_id: string;
+                canonical_did: string;
+                registered_public_key: string;
+                owner: {
+                    issuer: "https://auth.life.one";
+                    original_owner: string;
+                    organization_generation: number;
+                    scope: {
+                        platform_id: "blinds";
+                        organization_id: string;
+                        workspace_id: string | null;
+                        project_id: string | null;
+                        environment_id: "sandbox" | "live";
+                    };
+                };
+            };
+        }>;
+        ensureP256: (body: OperationInput<"blinds_ownerP256Ensure">["body"], init?: {
+            signal?: AbortSignal;
+        }) => Promise<{
+            schemaVersion: 1;
+            requestId: string;
+            edReservationId: string;
+            enrollmentIntentId: string;
+            state: "ready";
+            dpopPublicJwk: {
+                kty: "EC";
+                crv: "P-256";
+                x: string;
+                y: string;
+            };
+            senderJkt: string;
+        }>;
+    };
+};
+/** Blinds admits a mutation only with one UUID Idempotency-Key, the logical operation ID it
+ *  records a receipt under. Take the caller's (input.idempotency_key or the header) so a retry
+ *  after an uncertain outcome is recognised, else mint a new one. Never retried here. */
+export declare function blindsOperationKey(operationId: string, input: Record<string, unknown>, headers: Record<string, string>): string;

package/dist/blinds-owner-enrollment.js

@@ -0,0 +1,169 @@
+import { GenesisError } from './errors.js';
+const operations = ['blinds_ownerReserve', 'blinds_ownerSign', 'blinds_ownerAttach', 'blinds_ownerP256Ensure'];
+export const isBlindsOwnerOperation = (id) => operations.includes(id);
+const uuid = (v) => typeof v === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(v);
+/** One original-human operation; all public metadata, no arbitrary signing payload or private key. */
+export async function blindsOwnerTransport(options) {
+    const { operationId, input, signal } = options;
+    const error = (status, type) => new GenesisError({ status, type, operationId,
+        message: 'Blinds owner enrollment was not confirmed. Preserve the original operation and locators; do not replay an unknown outcome automatically.' });
+    if (options.routing !== 'gateway')
+        throw error(0, 'invalid_request');
+    const body = input.body;
+    if (!body || typeof body !== 'object' || Array.isArray(body) || body.schemaVersion !== 1 || !uuid(body.requestId))
+        throw error(0, 'invalid_request');
+    const serialized = JSON.stringify(body);
+    if (new TextEncoder().encode(serialized).byteLength > 2048)
+        throw error(0, 'invalid_request');
+    const controller = new AbortController(), cancel = () => controller.abort(signal?.reason);
+    if (signal?.aborted)
+        cancel();
+    else
+        signal?.addEventListener('abort', cancel, { once: true });
+    const timer = setTimeout(() => controller.abort(), 12_000);
+    let abort = () => { };
+    const bounded = async (promise) => {
+        controller.signal.throwIfAborted();
+        try {
+            return await Promise.race([promise, new Promise((_, reject) => { abort = () => reject(error(0, 'transport_error')); controller.signal.addEventListener('abort', abort, { once: true }); })]);
+        }
+        finally {
+            controller.signal.removeEventListener('abort', abort);
+        }
+    };
+    try {
+        const credential = await bounded(options.credential());
+        controller.signal.throwIfAborted();
+        if (!credential)
+            throw error(401, 'unauthenticated');
+        const response = await bounded(options.fetch(options.url, { method: 'POST', body: serialized,
+            headers: { authorization: `Bearer ${credential}`, 'content-type': 'application/json', accept: 'application/json', 'x-l1fe-request-id': body.requestId },
+            redirect: 'error', cache: 'no-store', signal: controller.signal }).then(response => { if (controller.signal.aborted) {
+            void response.body?.cancel().catch(() => { });
+            throw error(0, 'transport_error');
+        } return response; }));
+        if (response.status !== 200) {
+            void response.body?.cancel().catch(() => { });
+            throw error(response.status, 'unconfirmed_operation');
+        }
+        if (!response.body || !/^application\/json(?:;|$)/i.test(response.headers.get('content-type') ?? ''))
+            throw error(0, 'invalid_response');
+        const reader = response.body.getReader(), chunks = [];
+        let length = 0;
+        const stop = () => { void reader.cancel().catch(() => { }); };
+        controller.signal.addEventListener('abort', stop, { once: true });
+        try {
+            for (;;) {
+                const r = await bounded(reader.read());
+                if (r.done)
+                    break;
+                length += r.value.length;
+                if (length > 16384)
+                    throw error(0, 'invalid_response');
+                chunks.push(r.value);
+            }
+        }
+        finally {
+            controller.signal.removeEventListener('abort', stop);
+            stop();
+            try {
+                reader.releaseLock();
+            }
+            catch { /* pending cancelled read */ }
+        }
+        const data = new Uint8Array(length);
+        let offset = 0;
+        for (const chunk of chunks) {
+            data.set(chunk, offset);
+            offset += chunk.length;
+        }
+        let value;
+        try {
+            value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(data));
+        }
+        catch {
+            throw error(0, 'invalid_response');
+        }
+        if (!value || value.schemaVersion !== 1 || value.requestId !== body.requestId || !uuid(value.edReservationId)
+            || operationId === 'blinds_ownerReserve' && value.operationId !== body.operationId
+            || operationId !== 'blinds_ownerReserve' && (value.edReservationId !== body.edReservationId || value.enrollmentIntentId !== body.enrollmentIntentId))
+            throw error(0, 'invalid_response');
+        return Response.json(value, { headers: { 'cache-control': 'no-store' } });
+    }
+    catch (e) {
+        if (e instanceof GenesisError)
+            throw e;
+        throw error(0, 'transport_error');
+    }
+    finally {
+        clearTimeout(timer);
+        controller.abort();
+        signal?.removeEventListener('abort', cancel);
+    }
+}
+export function blindsModule(client) {
+    const write = (id, input, init = {}) => client.request(id, { ...input, ...(init.idempotencyKey ? { idempotency_key: init.idempotencyKey } : {}) }, { signal: init.signal });
+    const read = (id, init = {}, input = {}) => client.request(id, input, init);
+    return {
+        credentials: {
+            /** Variable names only; values never leave Blinds. */
+            list: (init) => read('blinds_listCredentials', init),
+            /** Connect a static credential. The value is KMS-encrypted and never returned. */
+            store: (body, init) => write('blinds_storeCredential', { body }, init),
+            revoke: (variable, init) => write('blinds_deleteCredential', { variable }, init),
+            /** Revoke every credential in the selected organization. Bulk and irreversible. */
+            revokeAll: (init) => write('blinds_revokeAllCredentials', { all: 'true' }, init),
+        },
+        oauth: {
+            connections: (init) => read('blinds_listOAuthConnections', init),
+            /** Catalog providers that use OAuth 2.0. */
+            providers: (query = {}, init) => read('blinds_listOAuthProviders', init, query),
+        },
+        /** What a credential can be bound to: auth mode and allowed destination domains. */
+        providers: {
+            list: (query = {}, init) => read('blinds_listProviders', init, query),
+            get: (slug, init) => read('blinds_getProvider', init, { slug }),
+        },
+        settings: {
+            get: (init) => read('blinds_getSettings', init),
+            update: (body, init) => write('blinds_updateSettings', { body }, init),
+        },
+        agents: (init) => read('blinds_listAgents', init),
+        alerts: (init) => read('blinds_listAlerts', init),
+        /** The receipt for a mutation, by the Idempotency-Key it was sent with. Read it after an uncertain outcome; never replay. */
+        operations: { get: (operation_id, init) => read('blinds_getOperation', init, { operation_id }) },
+        consent: {
+            pending: (init) => read('blinds_listPendingConsent', init),
+            records: (init) => read('blinds_listConsentRecords', init),
+            approve: (consent_id, body, init) => write('blinds_approveConsent', { consent_id, body }, init),
+            deny: (consent_id, init) => write('blinds_denyConsent', { consent_id }, init),
+            revoke: (consent_id, init) => write('blinds_revokeConsent', { consent_id }, init),
+        },
+        delegates: {
+            list: (init) => read('blinds_listDelegates', init),
+            create: (body, init) => write('blinds_createDelegate', { body }, init),
+            revoke: (delegate_id, init) => write('blinds_revokeDelegate', { delegate_id }, init),
+        },
+        activity: (init) => read('blinds_listActivity', init),
+        ownerEnrollment: {
+            reserve: (body, init = {}) => client.request('blinds_ownerReserve', { body }, init),
+            sign: (body, init = {}) => client.request('blinds_ownerSign', { body }, init),
+            attach: (body, init = {}) => client.request('blinds_ownerAttach', { body }, init),
+            ensureP256: (body, init = {}) => client.request('blinds_ownerP256Ensure', { body }, init),
+        }
+    };
+}
+const blindsKey = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** Blinds admits a mutation only with one UUID Idempotency-Key, the logical operation ID it
+ *  records a receipt under. Take the caller's (input.idempotency_key or the header) so a retry
+ *  after an uncertain outcome is recognised, else mint a new one. Never retried here. */
+export function blindsOperationKey(operationId, input, headers) {
+    const names = Object.keys(headers).filter(name => name.toLowerCase() === 'idempotency-key');
+    const given = [...names.map(name => headers[name]), ...(input.idempotency_key === undefined ? [] : [input.idempotency_key])];
+    if (new Set(given).size > 1 || given.some(v => typeof v !== 'string' || !blindsKey.test(v))) {
+        throw new GenesisError({ status: 0, type: 'invalid_request', message: 'A Blinds mutation takes one UUID idempotency key.', operationId });
+    }
+    for (const name of names)
+        delete headers[name];
+    return headers['idempotency-key'] = given[0] ?? crypto.randomUUID();
+}

package/dist/client.d.ts

@@ -0,0 +1,52 @@
+import { type OperationId } from './generated/operations.js';
+import type { OperationInput, OperationOutput, OperationMeta } from './types.js';
+/** The Genesis API gateway. `https://console.life.one/api` remains an alias for the same gateway. */
+export declare const DEFAULT_BASE_URL = "https://os.one.ml/api";
+/** Returns a bearer credential (API key, M2M token or saved login token), or undefined. */
+export type CredentialProvider = () => string | undefined | Promise<string | undefined>;
+export interface GenesisOptions {
+    /** One account org API key (WorkOS). Env: GENESIS_API_KEY */
+    apiKey?: string;
+    /** WorkOS M2M access token or session token. Env: GENESIS_TOKEN */
+    token?: string;
+    /** Fallback credential source, e.g. the CLI's saved `genesis login` (keychain). */
+    credentials?: CredentialProvider;
+    /** Gateway base URL. Env: GENESIS_BASE_URL. Default https://os.one.ml/api */
+    baseUrl?: string;
+    /**
+     * 'gateway' (default): call os.one.ml/api/v1/<service>/... (Genesis API gateway)
+     * 'direct': call each service's own upstream host (for local dev or when the gateway is unavailable;
+     *  the credential must then be one that service itself accepts).
+     */
+    routing?: 'gateway' | 'direct';
+    /** Per-service upstream override in direct mode, e.g. { relays: 'http://localhost:3000/api' }. */
+    upstreams?: Record<string, string>;
+    fetch?: typeof fetch;
+    headers?: Record<string, string>;
+    userAgent?: string;
+}
+export declare class GenesisClient {
+    readonly baseUrl: string;
+    readonly routing: 'gateway' | 'direct';
+    private readonly opts;
+    private readonly fetchImpl;
+    protected get contextFetch(): typeof fetch;
+    constructor(opts?: GenesisOptions);
+    static operations: Readonly<Record<OperationId, OperationMeta>>;
+    static services: import("./types.js").ServiceMeta[];
+    /** Resolve the credential: explicit apiKey > token > env GENESIS_API_KEY > GENESIS_TOKEN > provider. */
+    credential(): Promise<string | undefined>;
+    /** Build the URL for an operation (exposed for tests and `--dry-run`). */
+    url(operationId: OperationId, input?: Record<string, unknown>): string;
+    /** Call any Genesis operation by id, fully typed from the merged spec. */
+    request<K extends OperationId>(operationId: K, input?: OperationInput<K>, init?: {
+        signal?: AbortSignal;
+        headers?: Record<string, string>;
+    }): Promise<OperationOutput<K>>;
+    /** Raw Response. Completed Hives guest responses retain their actual status, including non-2xx. */
+    raw(operationId: OperationId, input?: Record<string, unknown>, init?: {
+        signal?: AbortSignal;
+        headers?: Record<string, string>;
+    }): Promise<Response>;
+    private dispatch;
+}