@onesi/genesis 0.0.1-stage → 0.2.0

package/dist/client.js

@@ -0,0 +1,384 @@
+import { isHivesQueueFundingOperation, hivesQueueOperationError } from './hives-queue-funding.js';
+import { isMindsOperation, mindsTransport } from './minds.js';
+import { isMindsAgentOperation, mindsAgentTransport } from './minds-agent.js';
+import { isMindsOwnerOperation, mindsOwnerTransport } from './minds-owner.js';
+import { isFoundryBillingOperation, foundryBillingTransport } from './foundry-billing.js';
+import { isRelaysEnrollmentOperation, relaysEnrollmentTransport } from './relays-enrollment.js';
+import { blindsOperationKey, blindsOwnerTransport, isBlindsOwnerOperation } from './blinds-owner-enrollment.js';
+import { isHivesObjectUpload, hivesObjectBody, hivesContentType, isHivesResourceOperation, resourceError, resourceErrorFromResponse } from './hives-resources-transport.js';
+import { operationTable, services } from './generated/operations.js';
+import { GenesisError } from './errors.js';
+import { requireSecureUrl } from './urls.js';
+import { iamDirectoryFailure, isIamDirectoryOperation } from './iam-directory.js';
+import { validateHivesInvocation, hivesFunctionResponseHeaders, hivesFunctionMetadata, hivesOperationError } from './hives-functions.js';
+import { validateHivesEnvironment, validateHivesEnvironmentNames, hivesEnvironmentSetNames, hivesEnvironmentMetadata, hivesEnvironmentReveal } from './hives-environment.js';
+import { RUNNER_SELF_GRANT_OPERATION, snapshotRunnerSelfGrant, runnerGrantResponse, runnerGrantTransportError } from './runner-grant.js';
+/** The Genesis API gateway. `https://console.life.one/api` remains an alias for the same gateway. */
+export const DEFAULT_BASE_URL = 'https://os.one.ml/api';
+const env = globalThis.process?.env ?? {};
+/** Endless Server-Sent Events streams and the bounded reader for each; request() refuses these and any operation generated with `stream: true`. */
+const ENDLESS_STREAMS = {
+    hives_stream_logs: 'genesis.hives.logs.stream() or genesis.hives.logs.window()',
+    hives_stream_deployment_logs: 'hivesSseWindow(await genesis.raw(...))',
+};
+export class GenesisClient {
+    baseUrl;
+    routing;
+    opts;
+    fetchImpl;
+    get contextFetch() { return this.fetchImpl; }
+    constructor(opts = {}) {
+        this.opts = opts;
+        this.baseUrl = requireSecureUrl(opts.baseUrl ?? env.GENESIS_BASE_URL ?? DEFAULT_BASE_URL, 'baseUrl').replace(/\/+$/, '');
+        this.routing = opts.routing ?? (env.GENESIS_ROUTING === 'direct' ? 'direct' : 'gateway');
+        const f = opts.fetch ?? globalThis.fetch;
+        if (!f)
+            throw new Error('No fetch available; pass options.fetch');
+        this.fetchImpl = f.bind(globalThis);
+    }
+    static operations = operationTable;
+    static services = services;
+    /** Resolve the credential: explicit apiKey > token > env GENESIS_API_KEY > GENESIS_TOKEN > provider. */
+    async credential() {
+        return this.opts.apiKey ?? this.opts.token ?? env.GENESIS_API_KEY ?? env.GENESIS_TOKEN ?? (await this.opts.credentials?.());
+    }
+    /** Build the URL for an operation (exposed for tests and `--dry-run`). */
+    url(operationId, input = {}) {
+        const op = operationTable[operationId];
+        if (!op)
+            throw new Error(`Unknown Genesis operation: ${operationId}`);
+        const fill = (tpl) => tpl.replace(/\{([^}]+)\}/g, (_, k) => {
+            const v = input[k];
+            if (v === undefined || v === null || v === '')
+                throw new GenesisError({ status: 0, type: 'invalid_request', message: `Missing required path parameter "${k}" for ${operationId}`, operationId });
+            if (!op.tailParams?.includes(k))
+                return encodeURIComponent(String(v));
+            const segments = String(v).split('/');
+            if (segments.some(s => s === '' || s === '.' || s === '..' || s.includes('\\')))
+                throw new GenesisError({ status: 0, type: 'invalid_request', operationId,
+                    message: `Path parameter "${k}" for ${operationId} must be "/"-separated segments with no empty, "." or ".." segment and no backslash` });
+            return segments.map(encodeURIComponent).join('/');
+        });
+        let base;
+        let p;
+        if (this.routing === 'direct') {
+            if (op.service === 'gateway')
+                throw new GenesisError({ status: 0, type: 'invalid_request', operationId, message: 'Gateway operations are answered by the Genesis gateway itself and have no direct upstream.' });
+            base = (this.opts.upstreams?.[op.service] ?? op.upstream.base).replace(/\/+$/, '');
+            p = fill(op.upstream.path);
+        }
+        else {
+            base = this.baseUrl;
+            p = fill(op.path);
+        }
+        const qs = new URLSearchParams();
+        for (const q of op.queryParams) {
+            const v = input[q];
+            if (v === undefined || v === null)
+                continue;
+            if (Array.isArray(v))
+                v.forEach((x) => qs.append(q, String(x)));
+            else
+                qs.set(q, String(v));
+        }
+        const s = qs.toString();
+        return `${base}${p}${s ? `?${s}` : ''}`;
+    }
+    /** Call any Genesis operation by id, fully typed from the merged spec. */
+    async request(operationId, input, init = {}) {
+        // An endless SSE body never completes, so buffering it would hang: refuse before any request is sent.
+        // Finite SSE reads (for example traces_streamRun) are not marked and still use request().
+        const endless = ENDLESS_STREAMS[operationId]
+            ?? (operationTable[operationId]?.stream === true ? 'hivesSseWindow(await genesis.raw(...))' : undefined);
+        if (endless)
+            throw new GenesisError({ status: 0, type: 'invalid_request', operationId,
+                message: `${String(operationId)} is an endless Server-Sent Events stream. Read a bounded window with ${endless} instead of request().` });
+        const res = await this.raw(operationId, (input ?? {}), init);
+        if (operationTable[operationId].rawResponse)
+            return res;
+        // DELETE /env answers 200 with an empty body.
+        if (operationId === 'hives_delete_project_env') {
+            void res.body?.cancel().catch(() => { });
+            return undefined;
+        }
+        if (operationId === 'hives_stop_deployment' && res.status !== 200) {
+            void res.body?.cancel().catch(() => { });
+            throw new GenesisError({ status: 0, type: 'invalid_response', operationId, message: 'Hives did not confirm this deployment stopped. Read its current state before explicitly reconciling stop.' });
+        }
+        if (res.status === 204)
+            return undefined;
+        const ct = res.headers.get('content-type') ?? '';
+        let value;
+        try {
+            value = ct.includes('json') ? await res.json() : await res.text();
+        }
+        catch (error) {
+            if (String(operationId).startsWith('hives_') && /_project_env(?:ironment)?$/.test(operationId))
+                throw new Error('Hives returned invalid environment data.');
+            if (String(operationId).startsWith('hives_') && /_functions?$/.test(operationId))
+                throw new Error('Hives returned invalid function metadata.');
+            throw error;
+        }
+        if (operationId === 'hives_stop_deployment') {
+            const requested = input;
+            if (!value || value.id !== requested.deployment_id || value.project_id !== requested.project_id || value.status !== 'cancelled') {
+                throw new GenesisError({ status: 0, type: 'invalid_response', operationId, message: 'Hives did not confirm this deployment stopped. Read its current state before explicitly reconciling stop.' });
+            }
+        }
+        if (operationId === 'hives_list_functions') {
+            if (!value || !Array.isArray(value.data) || !value.pagination)
+                throw new Error('Hives returned invalid function list metadata.');
+            const pagination = Object.fromEntries(['page', 'per_page', 'total', 'total_pages', 'has_next', 'has_prev'].map((key) => [key, value.pagination[key]]));
+            return { data: value.data.map((row) => hivesFunctionMetadata(row, input?.project_id)), pagination };
+        }
+        if (['hives_get_function', 'hives_create_function', 'hives_update_function'].includes(operationId)) {
+            return hivesFunctionMetadata(value, input?.project_id, operationId === 'hives_create_function' ? undefined : input?.function_id);
+        }
+        if (operationId === 'hives_list_project_environment' || operationId === 'hives_update_project_environment') {
+            return hivesEnvironmentMetadata(value, input?.project_id, operationId === 'hives_update_project_environment');
+        }
+        if (operationId === 'hives_set_project_env') {
+            return hivesEnvironmentSetNames(value, input?.project_id, input?.body);
+        }
+        if (operationId === 'hives_reveal_project_environment') {
+            return hivesEnvironmentReveal(value, input?.key);
+        }
+        return value;
+    }
+    /** Raw Response. Completed Hives guest responses retain their actual status, including non-2xx. */
+    async raw(operationId, input = {}, init = {}) {
+        if (!isIamDirectoryOperation(operationId))
+            return this.dispatch(operationId, input, init);
+        // The gateway binds the organization context itself. A refusal is only explained here; the client never changes a session or its context.
+        try {
+            return await this.dispatch(operationId, input, init);
+        }
+        catch (e) {
+            throw iamDirectoryFailure(e, typeof input.org_id === 'string' ? input.org_id : '', operationId);
+        }
+    }
+    async dispatch(operationId, input, init) {
+        if (isMindsOwnerOperation(operationId))
+            return mindsOwnerTransport({ operationId, input, headers: init.headers, routing: this.routing, url: this.url(operationId, input), credential: () => this.credential(), fetch: this.fetchImpl, signal: init.signal });
+        if (isMindsAgentOperation(operationId))
+            return mindsAgentTransport({ operationId, input, headers: init.headers, routing: this.routing, url: this.url(operationId, input), credential: () => this.credential(), fetch: this.fetchImpl, signal: init.signal });
+        if (isMindsOperation(operationId))
+            return mindsTransport({ operationId, input, headers: init.headers, routing: this.routing, url: this.url(operationId, input), credential: () => this.credential(), fetch: this.fetchImpl, signal: init.signal });
+        if (isFoundryBillingOperation(operationId))
+            return foundryBillingTransport({ operationId, input, headers: init.headers, routing: this.routing, url: this.url(operationId, input), credential: () => this.credential(), fetch: this.fetchImpl, signal: init.signal });
+        if (isRelaysEnrollmentOperation(operationId))
+            return relaysEnrollmentTransport({ operationId, input, routing: this.routing, url: this.url(operationId, input), credential: () => this.credential(), fetch: this.fetchImpl, signal: init.signal });
+        if (isBlindsOwnerOperation(operationId))
+            return blindsOwnerTransport({ operationId, input, routing: this.routing, url: this.url(operationId, input), credential: () => this.credential(), fetch: this.fetchImpl, signal: init.signal });
+        const runnerGrant = operationId === RUNNER_SELF_GRANT_OPERATION ? snapshotRunnerSelfGrant(input, this.routing) : undefined;
+        if (runnerGrant)
+            input = { body: runnerGrant };
+        const op = operationTable[operationId];
+        if (op.rawResponse && op.service === 'hives')
+            validateHivesInvocation(input.body);
+        const flocksNative = ['flocks_exchangeJoinToken', 'flocks_activateNode', 'flocks_rotateNodeCredential'].includes(operationId);
+        if (flocksNative && this.routing === 'direct')
+            throw new GenesisError({ status: 0, type: 'invalid_request', message: 'Native Flocks credentials are brokered only through the Genesis gateway.', operationId });
+        if (operationId === 'hives_update_project_environment' || operationId === 'hives_set_project_env')
+            input = { ...input, body: validateHivesEnvironment(input.body) };
+        if (operationId === 'hives_delete_project_env')
+            input = { ...input, body: validateHivesEnvironmentNames(input.body) };
+        const objectBody = isHivesObjectUpload(operationId) ? await hivesObjectBody(input.body) : undefined;
+        const url = this.url(operationId, input);
+        const headers = {
+            accept: 'application/json',
+            'user-agent': this.opts.userAgent ?? '@onesi/genesis/0.2.0',
+            ...this.opts.headers, ...init.headers,
+        };
+        if (op.service === 'blinds' && !['GET', 'HEAD', 'OPTIONS'].includes(op.method))
+            blindsOperationKey(operationId, input, headers);
+        if (isHivesQueueFundingOperation(operationId)) {
+            const keys = Object.keys(headers).filter(name => name.toLowerCase() === 'idempotency-key');
+            if (keys.length > 1 || keys.some(name => !/^[ -~]{1,128}$/.test(headers[name])))
+                throw resourceError(0, operationId);
+        }
+        if (runnerGrant) {
+            for (const key of Object.keys(headers))
+                if (!['accept', 'user-agent'].includes(key.toLowerCase()))
+                    delete headers[key];
+            headers['x-request-id'] = runnerGrant.requestId;
+            headers['idempotency-key'] = runnerGrant.operationId;
+        }
+        if (operationId === 'flocks_exchangeJoinToken') {
+            for (const key of Object.keys(headers))
+                if (!['accept', 'user-agent'].includes(key.toLowerCase()))
+                    delete headers[key];
+        }
+        if (!op.public) {
+            const cred = await this.credential();
+            // Direct mode: let the upstream decide (some, like Foundry's model list, are public).
+            if (!cred && this.routing !== 'direct')
+                throw new GenesisError({ status: 401, type: 'unauthorized', message: 'No Genesis credential. Run `genesis login`, or set GENESIS_API_KEY.', operationId });
+            if (cred)
+                headers.authorization = `Bearer ${cred}`;
+        }
+        // A timed-out credential provider must not dispatch a later resource mutation.
+        if (init.signal?.aborted && isHivesResourceOperation(operationId))
+            throw resourceError(0, operationId);
+        let body;
+        if (op.hasBody && input.body !== undefined) {
+            // Fetch owns multipart boundary generation. Never serialize a File/Blob as JSON.
+            for (const key of Object.keys(headers))
+                if (key.toLowerCase() === 'content-type')
+                    delete headers[key];
+            if (objectBody !== undefined && op.requestContentType === 'application/octet-stream') {
+                headers['content-type'] = hivesContentType(input.content_type);
+                headers['content-length'] = String(objectBody.byteLength);
+                body = objectBody;
+            }
+            else if (op.requestContentType === 'multipart/form-data') {
+                if (!(input.body instanceof FormData))
+                    throw new GenesisError({ status: 0, type: 'invalid_request', operationId,
+                        message: 'This operation requires a FormData body containing a real binary file.' });
+                body = input.body;
+            }
+            else {
+                if (input.body instanceof FormData || input.body instanceof Blob || input.body instanceof ArrayBuffer || ArrayBuffer.isView(input.body)) {
+                    throw new GenesisError({ status: 0, type: 'invalid_request', operationId, message: 'This operation requires a JSON body.' });
+                }
+                headers['content-type'] = 'application/json';
+                body = JSON.stringify(input.body);
+            }
+        }
+        const environmentOperation = op.service === 'hives' && /_project_env(?:ironment)?$/.test(operationId);
+        const secretOperation = op.service === 'hives' && (/_secrets?$/.test(operationId) || environmentOperation);
+        const functionOperation = op.service === 'hives' && (op.rawResponse || /_function(?:s|_async)?$/.test(operationId));
+        let res;
+        try {
+            res = await this.fetchImpl(url, { method: op.method, headers, body, signal: init.signal,
+                ...(op.service === 'hives' || op.service === 'flocks' || runnerGrant ? { cache: 'no-store', redirect: op.rawResponse && !runnerGrant ? 'manual' : 'error' } : {}) });
+        }
+        catch (error) {
+            if (runnerGrant)
+                throw runnerGrantTransportError();
+            if (functionOperation)
+                throw new GenesisError({ status: 0, type: 'transport_error', operationId,
+                    message: 'Hives function transport failed. Keep the original invocation key and reconcile its operation before retrying.' });
+            if (!secretOperation)
+                throw error;
+            throw new GenesisError({ status: 0, type: 'transport_error', operationId,
+                message: 'Hives secret transport failed. Redirects are refused; check the service address and retry.' });
+        }
+        if (runnerGrant)
+            return runnerGrantResponse(res, runnerGrant);
+        // A raw (binary) answer outside Hives, e.g. a Panes screenshot: a success is the bytes; a
+        // failure takes the ordinary error path below.
+        if (op.rawResponse && op.service !== 'hives' && res.ok)
+            return res;
+        if (op.rawResponse && /^exec_[a-f0-9]{32}$/.test(res.headers.get('x-execution-id') ?? '')) {
+            return new Response(res.body, { status: res.status, statusText: res.statusText, headers: hivesFunctionResponseHeaders(res.headers) });
+        }
+        if (op.rawResponse && op.service === 'hives' && res.headers.has('x-hives-operation-id')) {
+            // 5xx stays invalid_response below: its outcome is uncertain, so keep the key and reconcile.
+            const copy = res.status >= 400 && res.status < 500 ? res.clone() : undefined;
+            const error = await hivesOperationError(res);
+            if (error) {
+                void copy?.body?.cancel().catch(() => { });
+                throw error;
+            }
+            // A refusal envelope that is not an operation receipt keeps its own status, code and request id (finding G2).
+            const detail = copy ? await hivesErrorDetail(copy) : {};
+            if (detail.code !== undefined) {
+                throw new GenesisError({ status: res.status, type: `http_${res.status}`, operationId, code: detail.code,
+                    message: detail.message ?? `Hives refused this invocation (${res.status}). Keep the original idempotency key and read its operation status before retrying.`,
+                    requestId: res.headers.get('x-request-id') ?? detail.requestId });
+            }
+            throw new GenesisError({ status: res.status, type: 'invalid_response', operationId,
+                message: 'Hives operation status was not confirmed. Keep the original idempotency key and reconcile its operation.' });
+        }
+        if (op.rawResponse && res.ok)
+            throw new GenesisError({ status: res.status, type: 'invalid_response', operationId,
+                message: 'Hives did not confirm a completed guest execution. Keep the original invocation key and reconcile its operation.' });
+        if (functionOperation && !res.ok) {
+            // Keep the service's own refusal code and text (findings G3, G4); the fixed texts are fallbacks only.
+            const detail = await hivesErrorDetail(res);
+            const invocation = op.rawResponse === true;
+            const scope = detail.code === undefined || /scope/i.test(detail.code);
+            const message = detail.code !== undefined && detail.message !== undefined && !(res.status === 403 && scope) ? detail.message
+                : res.status === 401 ? 'Genesis credential rejected. Sign in again.'
+                    : res.status === 403 ? (scope ? 'Missing the authorized Hives scope for this function action.' : `Hives refused this ${invocation ? 'invocation' : 'function action'} (${detail.code}).`)
+                        : res.status === 404 ? 'Function/deployment, project or artifact not found in the authenticated organization and project.'
+                            : res.status === 409 ? (invocation ? `Hives refused this invocation as a conflict${detail.code ? ` (${detail.code})` : ''}. Read the target's current state before retrying.` : 'Function mutation conflicted. Refresh its metadata before retrying.')
+                                : res.status === 400 || res.status === 422 ? 'Invalid function request. Check artifact, resource bounds and guest request syntax.'
+                                    : res.status === 413 ? 'Function request exceeds a body or serialized guest envelope limit.'
+                                        : res.status >= 300 && res.status < 400 ? 'Unexpected function service redirect. No redirect was followed.'
+                                            : `Hives function operation failed (${res.status}). Refresh and retry.`;
+            throw new GenesisError({ status: res.status, type: `http_${res.status}`, operationId, message, code: detail.code,
+                requestId: res.headers.get('x-request-id') ?? detail.requestId });
+        }
+        if (!res.ok && secretOperation) {
+            const message = res.status === 401 ? 'Genesis credential rejected. Sign in again.'
+                : res.status === 403 ? 'Missing the authorized Hives scope for this action (hives:read or hives:write).'
+                    : res.status === 404 ? 'Secret or project not found in your authenticated organization.'
+                        : res.status === 409 ? 'A secret with this name already exists. Update it instead.'
+                            : res.status === 400 || res.status === 422 ? 'Invalid secret request. Check names and UTF-8 value size.'
+                                : res.status === 413 ? 'Secret request too large. Use a smaller batch.'
+                                    : res.status === 429 ? 'Too many requests. Wait briefly before retrying.'
+                                        : res.status === 503 ? 'Hives customer encryption is unavailable or stored secrets require protected migration.'
+                                            : `Hives secret operation failed (${res.status}). Refresh metadata and retry.`;
+            // Validation/provider bodies may reflect submitted plaintext. Never retain or log them.
+            throw new GenesisError({ status: res.status, type: `http_${res.status}`, message, operationId,
+                requestId: environmentOperation ? undefined : res.headers.get('x-request-id') ?? undefined });
+        }
+        if (!res.ok && isHivesQueueFundingOperation(operationId)) {
+            const receipt = await hivesQueueOperationError(res, input.operation_id);
+            if (receipt)
+                throw receipt;
+        }
+        if (!res.ok && isHivesResourceOperation(operationId))
+            throw await resourceErrorFromResponse(res, operationId);
+        if (!res.ok)
+            throw await GenesisError.fromResponse(res, operationId);
+        return res;
+    }
+}
+/**
+ * The refusal code, short message and request id of a Hives function/invocation error body. Reads at most
+ * 8 KiB and keeps nothing else: a body without a platform code may reflect guest request data.
+ */
+async function hivesErrorDetail(res) {
+    if (!res.body)
+        return {};
+    const reader = res.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        for (;;) {
+            const { value, done } = await reader.read();
+            if (done)
+                break;
+            size += value.length;
+            if (size > 8192) {
+                await reader.cancel().catch(() => { });
+                return {};
+            }
+            chunks.push(value);
+        }
+        const bytes = new Uint8Array(size);
+        let offset = 0;
+        for (const chunk of chunks) {
+            bytes.set(chunk, offset);
+            offset += chunk.length;
+        }
+        const body = JSON.parse(new TextDecoder().decode(bytes));
+        const e = body && typeof body === 'object' ? body.error : undefined;
+        // Only an error envelope: a top-level `code` belongs to an operation receipt, never to a refusal.
+        const raw = e && typeof e === 'object' ? e.code : typeof e === 'string' ? e : undefined;
+        const code = typeof raw === 'string' && /^[A-Za-z][A-Za-z0-9_.:-]{0,63}$/.test(raw) ? raw : undefined;
+        const text = e && typeof e === 'object' ? e.message : undefined;
+        const message = code && typeof text === 'string' && text.length <= 300 && !/[\u0000-\u001f\u007f]/.test(text) ? text : undefined;
+        const id = (e && typeof e === 'object' ? e.request_id : undefined) ?? body?.request_id;
+        return { code, message, requestId: typeof id === 'string' && /^[A-Za-z0-9_.:-]{1,128}$/.test(id) ? id : undefined };
+    }
+    catch {
+        return {};
+    }
+    finally {
+        reader.releaseLock();
+    }
+}

package/dist/context.d.ts

@@ -0,0 +1,50 @@
+export type GenesisContextSelection = {
+    organizationId: string;
+} | {
+    organizationId: string;
+    projectId: string;
+    platformId: 'pf_console';
+    workspaceId: string;
+    fleetId: null;
+    environmentId: 'sandbox';
+};
+export interface GenesisContextSession {
+    principal: {
+        id: string;
+        kind: 'human';
+        email?: string;
+    };
+    session: {
+        id: string;
+        principalKind: 'human';
+        accessToken: string;
+        issuer: string;
+        audience: string;
+        issuedAt: string;
+        expiresAt: string;
+        organizationId: string;
+        tenantId?: string;
+        projectId?: string | null;
+        platformId?: string | null;
+        workspaceId?: string | null;
+        fleetId?: string | null;
+        resourceEnvironment?: string | null;
+    };
+    tenant: {
+        organizationId: string;
+        projectId?: string | null;
+        platformId?: string | null;
+        workspaceId?: string | null;
+        fleetId?: string | null;
+        environmentId?: string | null;
+    };
+    refresh_token: string;
+}
+/** Response consistency only: Auth verifies credentials, membership and IAM. */
+export declare function checkedGenesisContextSession(value: unknown, priorToken: string, selection: GenesisContextSelection, now?: number): GenesisContextSession;
+/** One authoritative tenant-context remint. Persist both returned tokens together before using the selection. No org header or local grant is created. */
+export declare function selectGenesisContext(selection: GenesisContextSelection, options: {
+    credential: () => Promise<string | undefined>;
+    fetch?: typeof fetch;
+    signal?: AbortSignal;
+}): Promise<GenesisContextSession>;

package/dist/context.js

@@ -0,0 +1,153 @@
+import { GenesisError } from './errors.js';
+const AUTH = 'https://auth.life.one';
+const object = (v) => v && typeof v === 'object' && !Array.isArray(v) ? v : undefined;
+const id = (v, prefix) => typeof v === 'string' && new RegExp('^' + prefix + '_[A-Za-z0-9_-]{1,128}$').exec(v)?.[0] === v;
+const secret = (v) => typeof v === 'string' && v.length > 0 && v.length <= 16_384 && !/[\s,\x00-\x1f\x7f]/.test(v);
+function fail(status = 0) { throw new GenesisError({ status, type: 'context_unconfirmed', message: 'One account did not confirm this context. No automatic retry was made.' }); }
+function claims(token) {
+    if (!secret(token))
+        return fail();
+    try {
+        const parts = token.split('.');
+        if (parts.length !== 3 || parts.some(p => !p || /[^A-Za-z0-9_-]/.test(p)))
+            return fail();
+        const json = atob(parts[1].replaceAll('-', '+').replaceAll('_', '/'));
+        const value = object(JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(Uint8Array.from(json, c => c.charCodeAt(0)))));
+        if (!value)
+            return fail();
+        return value;
+    }
+    catch {
+        return fail();
+    }
+}
+function audiences(value) {
+    const values = Array.isArray(value) ? value : [value];
+    return values.length && values.every(v => typeof v === 'string' && v.length > 0 && v.length <= 256) ? values : fail();
+}
+function human(token, now) {
+    const c = claims(token);
+    if (c.iss !== AUTH || c.kind !== 'human' || !id(c.sub, 'h') || c.tid !== c.sub || !id(c.sid, 'sess')
+        || !Number.isSafeInteger(c.exp) || c.exp <= now || c.cnf !== undefined || c.cap !== undefined || c.obo !== undefined)
+        return fail(401);
+    return c;
+}
+/** Response consistency only: Auth verifies credentials, membership and IAM. */
+export function checkedGenesisContextSession(value, priorToken, selection, now = Date.now() / 1000) {
+    const prior = human(priorToken, now), root = object(value), p = object(root?.principal), s = object(root?.session), t = object(root?.tenant);
+    if (!root || !p || !s || !t || p.kind !== 'human' || p.id !== prior.sub || s.principalKind !== 'human' || !id(s.id, 'sess')
+        || s.issuer !== AUTH || !secret(s.accessToken) || !secret(root.refresh_token) || s.organizationId !== selection.organizationId
+        || t.organizationId !== selection.organizationId || typeof s.audience !== 'string' || typeof s.issuedAt !== 'string' || typeof s.expiresAt !== 'string')
+        return fail();
+    const next = human(s.accessToken, now), aud = audiences(next.aud), previousAud = audiences(prior.aud);
+    if (s.id === prior.sid || next.sub !== prior.sub || next.sid !== s.id || next.org !== selection.organizationId || !aud.includes(s.audience) || !previousAud.includes(s.audience)
+        || !Number.isFinite(Date.parse(s.issuedAt)) || !Number.isFinite(Date.parse(s.expiresAt)) || Date.parse(s.issuedAt) / 1000 > now + 60
+        || Date.parse(s.expiresAt) / 1000 <= now || Date.parse(s.expiresAt) <= Date.parse(s.issuedAt)
+        || (s.tenantId !== undefined && s.tenantId !== null && s.tenantId !== prior.sub))
+        return fail();
+    // Validate optional projections even for an organization-only remint. Never
+    // cast unvalidated provider fields into a public selected-context result.
+    const fields = [['projectId', 'pid', 'pr'], ['platformId', 'pfid', 'pf'], ['workspaceId', 'wid', 'w'], ['fleetId', 'flid', 'fl']];
+    for (const [name, claim, prefix] of fields) {
+        if ([s[name], t[name], next[claim]].some(v => v !== undefined && v !== null && !id(v, prefix))
+            || (s[name] ?? null) !== (t[name] ?? null) || (s[name] ?? null) !== (next[claim] ?? null))
+            return fail();
+    }
+    if (![undefined, null, 'sandbox', 'live'].includes(s.resourceEnvironment)
+        || (s.resourceEnvironment ?? null) !== (t.environmentId ?? null))
+        return fail();
+    if ('projectId' in selection) {
+        for (const [name, claim] of [['projectId', 'pid'], ['platformId', 'pfid'], ['workspaceId', 'wid'], ['fleetId', 'flid']]) {
+            if ((s[name] ?? null) !== selection[name] || (t[name] ?? null) !== selection[name] || (next[claim] ?? null) !== selection[name])
+                return fail();
+        }
+        if (s.resourceEnvironment !== selection.environmentId || t.environmentId !== selection.environmentId)
+            return fail();
+    }
+    return { principal: { id: p.id, kind: 'human', ...(typeof p.email === 'string' ? { email: p.email } : {}) },
+        session: { id: s.id, principalKind: 'human', accessToken: s.accessToken, issuer: AUTH, audience: s.audience, issuedAt: s.issuedAt, expiresAt: s.expiresAt,
+            organizationId: s.organizationId, tenantId: prior.sub, projectId: s.projectId,
+            platformId: s.platformId, workspaceId: s.workspaceId,
+            fleetId: s.fleetId, resourceEnvironment: s.resourceEnvironment },
+        tenant: { organizationId: t.organizationId, projectId: t.projectId, platformId: t.platformId,
+            workspaceId: t.workspaceId, fleetId: t.fleetId, environmentId: t.environmentId },
+        refresh_token: root.refresh_token };
+}
+/** One authoritative tenant-context remint. Persist both returned tokens together before using the selection. No org header or local grant is created. */
+export async function selectGenesisContext(selection, options) {
+    const requested = { ...selection };
+    const keys = Object.keys(requested), full = 'projectId' in requested;
+    if (!id(requested.organizationId, 'o') || keys.some(k => !(full ? ['organizationId', 'projectId', 'platformId', 'workspaceId', 'fleetId', 'environmentId'] : ['organizationId']).includes(k))
+        || (full && (!id(requested.projectId, 'pr') || !id(requested.workspaceId, 'w') || requested.platformId !== 'pf_console' || requested.fleetId !== null || requested.environmentId !== 'sandbox')))
+        return fail(400);
+    const controller = new AbortController(), cancel = () => controller.abort();
+    options.signal?.addEventListener('abort', cancel, { once: true });
+    if (options.signal?.aborted)
+        cancel();
+    const timer = setTimeout(cancel, 30_000);
+    let reader;
+    const stopped = new Promise((_, reject) => controller.signal.addEventListener('abort', () => { void reader?.cancel().catch(() => { }); reject(new Error('cancelled')); }, { once: true }));
+    try {
+        controller.signal.throwIfAborted();
+        const token = await Promise.race([options.credential(), stopped]);
+        if (!token)
+            return fail(401);
+        human(token, Date.now() / 1000);
+        controller.signal.throwIfAborted();
+        const response = await Promise.race([(options.fetch ?? fetch)(AUTH + '/v4/auth/tenant-context', { method: 'POST', headers: { authorization: 'Bearer ' + token, accept: 'application/json', 'content-type': 'application/json' },
+                body: JSON.stringify(requested), signal: controller.signal, redirect: 'error', cache: 'no-store' }).then(value => {
+                if (controller.signal.aborted) {
+                    void value.body?.cancel().catch(() => { });
+                    throw new Error('cancelled');
+                }
+                return value;
+            }), stopped]);
+        if (!response.ok) {
+            void response.body?.cancel().catch(() => { });
+            return fail(response.status);
+        }
+        if (!/^application\/json(?:;|$)/i.test(response.headers.get('content-type') ?? '')) {
+            void response.body?.cancel().catch(() => { });
+            return fail();
+        }
+        reader = response.body?.getReader();
+        if (!reader)
+            return fail();
+        const parts = [];
+        let size = 0;
+        for (;;) {
+            const next = await Promise.race([reader.read(), stopped]);
+            if (next.done)
+                break;
+            size += next.value.length;
+            if (size > 65536)
+                return fail();
+            parts.push(next.value);
+        }
+        const bytes = new Uint8Array(size);
+        let at = 0;
+        for (const part of parts) {
+            bytes.set(part, at);
+            at += part.length;
+        }
+        controller.signal.throwIfAborted();
+        const value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+        return checkedGenesisContextSession(value, token, requested);
+    }
+    catch (error) {
+        if (error instanceof GenesisError)
+            throw error;
+        return fail();
+    }
+    finally {
+        clearTimeout(timer);
+        options.signal?.removeEventListener('abort', cancel);
+        if (reader) {
+            void reader.cancel().catch(() => { });
+            try {
+                reader.releaseLock();
+            }
+            catch { /* cancelled pending read */ }
+        }
+    }
+}