@onesi/genesis 0.1.13 → 0.2.0

package/dist/hives-operations.d.ts

@@ -334,4 +334,118 @@ export declare function hivesOperations(client: GenesisClient): {
             updated_at: string;
         }>;
     };
+    logs: {
+        query: (project_id: string, q?: Omit<In<"hives_query_logs">, "project_id">) => Promise<{
+            logs: import("./index.js").components["schemas"]["Hives.LogEntry"][];
+            pagination: import("./index.js").components["schemas"]["Hives.PaginationMeta"];
+            time_range: import("./index.js").components["schemas"]["Hives.TimeRange"];
+        }>;
+        stream: (project_id: string, q?: import("./hives-platform.js").HivesLogStreamQuery, init?: {
+            signal?: AbortSignal;
+        }) => AsyncGenerator<import("./hives-platform.js").HivesLogStreamEvent, void, any>;
+        window: (project_id: string, q?: import("./hives-platform.js").HivesLogStreamQuery, options?: import("./hives-platform.js").HivesLogWindowOptions) => Promise<import("./hives-platform.js").HivesLogWindow>;
+    };
+    domains: {
+        list: (project_id: string, q?: Omit<In<"hives_list_domains">, "project_id">) => Promise<{
+            data: {
+                created_at: string;
+                dns_status: string;
+                domain: string;
+                domain_type: import("./index.js").components["schemas"]["Hives.DomainType"];
+                id: string;
+                ssl_expires_at?: string | null;
+                ssl_status: string;
+                verification_record?: null | import("./index.js").components["schemas"]["Hives.VerificationRecord"];
+            }[];
+            pagination: import("./index.js").components["schemas"]["Hives.PaginationMeta"];
+        }>;
+        add: (project_id: string, body: In<"hives_add_domain">["body"]) => Promise<{
+            created_at: string;
+            dns_status: string;
+            domain: string;
+            domain_type: import("./index.js").components["schemas"]["Hives.DomainType"];
+            id: string;
+            ssl_expires_at?: string | null;
+            ssl_status: string;
+            verification_record?: null | import("./index.js").components["schemas"]["Hives.VerificationRecord"];
+        }>;
+        verify: (project_id: string, domain_id: string) => Promise<{
+            checked_at: string;
+            dns_status: string;
+            error?: string | null;
+            verified: boolean;
+        }>;
+        provisionSsl: (project_id: string, domain_id: string) => Promise<{
+            error?: string | null;
+            expires_at?: string | null;
+            ssl_status: string;
+            started: boolean;
+        }>;
+    };
+    auth: {
+        me: () => Promise<{
+            avatar?: string | null;
+            createdAt: string;
+            email: string;
+            id: string;
+            name: string;
+            organizationId?: string | null;
+            role: string;
+        }>;
+    };
+    fleets: {
+        list: () => Promise<{
+            fleets: import("./index.js").components["schemas"]["Hives.FleetStatusView"][];
+        }>;
+        deploy: (body: In<"hives_deploy_fleet">["body"]) => Promise<{
+            fleetId: string;
+            gatewayEndpoint?: string | null;
+            totalInstances: number;
+        }>;
+        status: (fleet_id: string) => Promise<{
+            fleetId: string;
+            gateway?: null | import("./index.js").components["schemas"]["Hives.GatewaySummary"];
+            healthyInstances: number;
+            name: string;
+            protocols: import("./index.js").components["schemas"]["Hives.ProtocolStatusView"][];
+            state: string;
+            totalInstances: number;
+        }>;
+        teardown: (fleet_id: string) => Promise<void>;
+    };
+    remote: {
+        sessions: {
+            list: (project_id: string, q?: Omit<In<"hives_list_remote_sessions">, "project_id">) => Promise<Record<string, never>>;
+            close: (project_id: string, session_id: string) => Promise<Record<string, never>>;
+        };
+        ssh: (project_id: string, body: In<"hives_create_ssh_session">["body"]) => Promise<{
+            expires_at: string;
+            fingerprint: string;
+            host: string;
+            port: number;
+            session_id: string;
+            username: string;
+        }>;
+        terminal: (project_id: string, body: In<"hives_create_terminal_session">["body"]) => Promise<{
+            expires_at: string;
+            session_id: string;
+            token: string;
+            websocket_url: string;
+        }>;
+        debug: (project_id: string, body: In<"hives_create_debug_session">["body"]) => Promise<{
+            debug_url: string;
+            expires_at: string;
+            protocol: string;
+            session_id: string;
+            token: string;
+        }>;
+        sftp: {
+            list: (project_id: string, target_id: string, q?: {
+                path?: string;
+            }) => Promise<Record<string, never>>;
+            read: (project_id: string, target_id: string, path: string) => Promise<Record<string, never>>;
+            write: (project_id: string, target_id: string, body: In<"hives_sftp_write">["body"]) => Promise<Record<string, never>>;
+            delete: (project_id: string, target_id: string, body: In<"hives_sftp_delete">["body"]) => Promise<Record<string, never>>;
+        };
+    };
 };

package/dist/hives-operations.js

@@ -2,9 +2,11 @@ import { hivesTopics } from './hives-topics.js';
 import { hivesCells } from './hives-cells.js';
 import { hivesQueues } from './hives-queues.js';
 import { hivesRuntimes } from './hives-runtimes.js';
+import { hivesPlatform } from './hives-platform.js';
 /** The original Hives scheduler, settings and measured activity use the same gateway and identity. */
 export function hivesOperations(client) {
     return {
+        ...hivesPlatform(client),
         cells: hivesCells(client),
         queues: hivesQueues(client),
         topics: hivesTopics(client),

package/dist/hives-platform.d.ts

@@ -0,0 +1,149 @@
+import type { GenesisClient } from './client.js';
+import type { OperationInput as In } from './types.js';
+/** One Server-Sent Event from `GET /v1/hives/projects/{project_id}/logs/stream`. `data` is parsed JSON when it is JSON. */
+export interface HivesLogStreamEvent {
+    event: string;
+    id?: string;
+    data: unknown;
+}
+export type HivesLogStreamQuery = Omit<In<'hives_stream_logs'>, 'project_id'>;
+export interface HivesLogWindowOptions {
+    /** Stop after this many events (1–10000, default 100). */
+    maxEvents?: number;
+    /** Stop after this many seconds (1–300, default 10). */
+    seconds?: number;
+    signal?: AbortSignal;
+}
+export interface HivesLogWindow {
+    events: HivesLogStreamEvent[];
+    ended: 'max_events' | 'time' | 'closed';
+}
+/** Pull-based SSE reader. `cancel()` closes the connection even while a read is pending. */
+export declare function hivesSseReader(response: Response): {
+    next(): Promise<HivesLogStreamEvent | undefined>;
+    cancel(): Promise<void>;
+};
+/** Yield SSE events until the caller stops iterating, the signal aborts or the server closes the stream. */
+export declare function hivesSseEvents(response: Response): AsyncGenerator<HivesLogStreamEvent>;
+/**
+ * Hives platform reads and actions the gateway already routes: project logs (query and live SSE), custom domains,
+ * the Hives identity, Hives fleets and remote sessions/SFTP.
+ */
+export declare function hivesPlatform(client: GenesisClient): {
+    logs: {
+        query: (project_id: string, q?: Omit<In<"hives_query_logs">, "project_id">) => Promise<{
+            logs: import("./index.js").components["schemas"]["Hives.LogEntry"][];
+            pagination: import("./index.js").components["schemas"]["Hives.PaginationMeta"];
+            time_range: import("./index.js").components["schemas"]["Hives.TimeRange"];
+        }>;
+        /** Live SSE events. Iterate and `break` (or abort the signal) to close the connection; it never ends on its own. */
+        stream: (project_id: string, q?: HivesLogStreamQuery, init?: {
+            signal?: AbortSignal;
+        }) => AsyncGenerator<HivesLogStreamEvent, void, any>;
+        /** A bounded window of the live stream: the first `maxEvents` events or `seconds` of stream, whichever comes first. */
+        window: (project_id: string, q?: HivesLogStreamQuery, options?: HivesLogWindowOptions) => Promise<HivesLogWindow>;
+    };
+    domains: {
+        list: (project_id: string, q?: Omit<In<"hives_list_domains">, "project_id">) => Promise<{
+            data: {
+                created_at: string;
+                dns_status: string;
+                domain: string;
+                domain_type: import("./index.js").components["schemas"]["Hives.DomainType"];
+                id: string;
+                ssl_expires_at?: string | null;
+                ssl_status: string;
+                verification_record?: null | import("./index.js").components["schemas"]["Hives.VerificationRecord"];
+            }[];
+            pagination: import("./index.js").components["schemas"]["Hives.PaginationMeta"];
+        }>;
+        add: (project_id: string, body: In<"hives_add_domain">["body"]) => Promise<{
+            created_at: string;
+            dns_status: string;
+            domain: string;
+            domain_type: import("./index.js").components["schemas"]["Hives.DomainType"];
+            id: string;
+            ssl_expires_at?: string | null;
+            ssl_status: string;
+            verification_record?: null | import("./index.js").components["schemas"]["Hives.VerificationRecord"];
+        }>;
+        verify: (project_id: string, domain_id: string) => Promise<{
+            checked_at: string;
+            dns_status: string;
+            error?: string | null;
+            verified: boolean;
+        }>;
+        provisionSsl: (project_id: string, domain_id: string) => Promise<{
+            error?: string | null;
+            expires_at?: string | null;
+            ssl_status: string;
+            started: boolean;
+        }>;
+    };
+    auth: {
+        me: () => Promise<{
+            avatar?: string | null;
+            createdAt: string;
+            email: string;
+            id: string;
+            name: string;
+            organizationId?: string | null;
+            role: string;
+        }>;
+    };
+    fleets: {
+        list: () => Promise<{
+            fleets: import("./index.js").components["schemas"]["Hives.FleetStatusView"][];
+        }>;
+        deploy: (body: In<"hives_deploy_fleet">["body"]) => Promise<{
+            fleetId: string;
+            gatewayEndpoint?: string | null;
+            totalInstances: number;
+        }>;
+        status: (fleet_id: string) => Promise<{
+            fleetId: string;
+            gateway?: null | import("./index.js").components["schemas"]["Hives.GatewaySummary"];
+            healthyInstances: number;
+            name: string;
+            protocols: import("./index.js").components["schemas"]["Hives.ProtocolStatusView"][];
+            state: string;
+            totalInstances: number;
+        }>;
+        teardown: (fleet_id: string) => Promise<void>;
+    };
+    remote: {
+        sessions: {
+            list: (project_id: string, q?: Omit<In<"hives_list_remote_sessions">, "project_id">) => Promise<Record<string, never>>;
+            close: (project_id: string, session_id: string) => Promise<Record<string, never>>;
+        };
+        ssh: (project_id: string, body: In<"hives_create_ssh_session">["body"]) => Promise<{
+            expires_at: string;
+            fingerprint: string;
+            host: string;
+            port: number;
+            session_id: string;
+            username: string;
+        }>;
+        terminal: (project_id: string, body: In<"hives_create_terminal_session">["body"]) => Promise<{
+            expires_at: string;
+            session_id: string;
+            token: string;
+            websocket_url: string;
+        }>;
+        debug: (project_id: string, body: In<"hives_create_debug_session">["body"]) => Promise<{
+            debug_url: string;
+            expires_at: string;
+            protocol: string;
+            session_id: string;
+            token: string;
+        }>;
+        sftp: {
+            list: (project_id: string, target_id: string, q?: {
+                path?: string;
+            }) => Promise<Record<string, never>>;
+            read: (project_id: string, target_id: string, path: string) => Promise<Record<string, never>>;
+            write: (project_id: string, target_id: string, body: In<"hives_sftp_write">["body"]) => Promise<Record<string, never>>;
+            delete: (project_id: string, target_id: string, body: In<"hives_sftp_delete">["body"]) => Promise<Record<string, never>>;
+        };
+    };
+};

package/dist/hives-platform.js

@@ -0,0 +1,183 @@
+import { GenesisError } from './errors.js';
+const bounded = (value, fallback, max, name) => {
+    if (value === undefined)
+        return fallback;
+    if (!Number.isInteger(value) || value < 1 || value > max) {
+        throw new GenesisError({ status: 0, type: 'invalid_request', operationId: 'hives_stream_logs', message: `${name} must be an integer from 1 to ${max}.` });
+    }
+    return value;
+};
+function parseEvent(lines) {
+    let event = 'message';
+    let id;
+    const data = [];
+    for (const line of lines) {
+        if (!line || line.startsWith(':'))
+            continue; // SSE comments carry keepalives only.
+        const colon = line.indexOf(':');
+        const field = colon < 0 ? line : line.slice(0, colon);
+        let value = colon < 0 ? '' : line.slice(colon + 1);
+        if (value.startsWith(' '))
+            value = value.slice(1);
+        if (field === 'event')
+            event = value;
+        else if (field === 'id')
+            id = value;
+        else if (field === 'data')
+            data.push(value);
+    }
+    if (!data.length)
+        return undefined;
+    const text = data.join('\n');
+    let parsed = text;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch { /* non-JSON data such as heartbeat "ping" stays text */ }
+    return { event, ...(id === undefined ? {} : { id }), data: parsed };
+}
+/** Pull-based SSE reader. `cancel()` closes the connection even while a read is pending. */
+export function hivesSseReader(response) {
+    const reader = response.body?.getReader();
+    const decoder = new TextDecoder();
+    let buffer = '';
+    let lines = [];
+    let finished = !reader;
+    const take = () => {
+        let index;
+        while ((index = buffer.search(/\r\n|\r|\n/)) >= 0) {
+            const line = buffer.slice(0, index);
+            buffer = buffer.slice(index + (buffer.startsWith('\r\n', index) ? 2 : 1));
+            if (line !== '') {
+                lines.push(line);
+                continue;
+            }
+            const event = parseEvent(lines);
+            lines = [];
+            if (event)
+                return event;
+        }
+        return undefined;
+    };
+    return {
+        async next() {
+            for (;;) {
+                const ready = take();
+                if (ready)
+                    return ready;
+                if (finished) {
+                    const tail = parseEvent(buffer ? [...lines, buffer] : lines);
+                    buffer = '';
+                    lines = [];
+                    return tail;
+                }
+                const { done, value } = await reader.read();
+                if (done)
+                    finished = true;
+                else
+                    buffer += decoder.decode(value, { stream: true });
+            }
+        },
+        async cancel() { finished = true; await reader?.cancel().catch(() => { }); },
+    };
+}
+/** Yield SSE events until the caller stops iterating, the signal aborts or the server closes the stream. */
+export async function* hivesSseEvents(response) {
+    const sse = hivesSseReader(response);
+    try {
+        for (let event = await sse.next(); event; event = await sse.next())
+            yield event;
+    }
+    finally {
+        await sse.cancel();
+    }
+}
+/**
+ * Hives platform reads and actions the gateway already routes: project logs (query and live SSE), custom domains,
+ * the Hives identity, Hives fleets and remote sessions/SFTP.
+ */
+export function hivesPlatform(client) {
+    const open = async (project_id, q = {}, init = {}) => {
+        const res = await client.raw('hives_stream_logs', { ...q, project_id }, { signal: init.signal, headers: { accept: 'text/event-stream' } });
+        if (!(res.headers.get('content-type') ?? '').toLowerCase().startsWith('text/event-stream')) {
+            void res.body?.cancel().catch(() => { });
+            throw new GenesisError({ status: res.status, type: 'invalid_response', operationId: 'hives_stream_logs', message: 'Hives did not return a Server-Sent Events stream.',
+                requestId: res.headers.get('x-request-id') ?? undefined });
+        }
+        return res;
+    };
+    return {
+        logs: {
+            query: (project_id, q = {}) => client.request('hives_query_logs', { ...q, project_id }),
+            /** Live SSE events. Iterate and `break` (or abort the signal) to close the connection; it never ends on its own. */
+            stream: async function* (project_id, q = {}, init = {}) {
+                yield* hivesSseEvents(await open(project_id, q, init));
+            },
+            /** A bounded window of the live stream: the first `maxEvents` events or `seconds` of stream, whichever comes first. */
+            window: async (project_id, q = {}, options = {}) => {
+                const maxEvents = bounded(options.maxEvents, 100, 10_000, 'maxEvents');
+                const seconds = bounded(options.seconds, 10, 300, 'seconds');
+                const events = [];
+                // The window starts before the request, so a server that withholds headers cannot outlast it.
+                const deadline = new AbortController();
+                let timer;
+                const elapsed = new Promise((resolve) => { timer = setTimeout(() => { resolve('time'); deadline.abort(); }, seconds * 1000); });
+                const signal = options.signal ? AbortSignal.any([options.signal, deadline.signal]) : deadline.signal;
+                let sse;
+                try {
+                    const response = await Promise.race([open(project_id, q, { signal }), elapsed]);
+                    if (response === 'time')
+                        return { events, ended: 'time' };
+                    sse = hivesSseReader(response);
+                    for (;;) {
+                        const next = await Promise.race([sse.next(), elapsed]);
+                        if (next === 'time')
+                            return { events, ended: 'time' };
+                        if (!next)
+                            return { events, ended: 'closed' };
+                        events.push(next);
+                        if (events.length >= maxEvents)
+                            return { events, ended: 'max_events' };
+                    }
+                }
+                catch (error) {
+                    if (deadline.signal.aborted && !options.signal?.aborted)
+                        return { events, ended: 'time' };
+                    throw error;
+                }
+                finally {
+                    clearTimeout(timer);
+                    await sse?.cancel();
+                }
+            },
+        },
+        domains: {
+            list: (project_id, q = {}) => client.request('hives_list_domains', { ...q, project_id }),
+            add: (project_id, body) => client.request('hives_add_domain', { project_id, body }),
+            verify: (project_id, domain_id) => client.request('hives_verify_domain', { project_id, domain_id }),
+            provisionSsl: (project_id, domain_id) => client.request('hives_provision_ssl', { project_id, domain_id }),
+        },
+        auth: { me: () => client.request('hives_me') },
+        fleets: {
+            list: () => client.request('hives_list_fleets'),
+            deploy: (body) => client.request('hives_deploy_fleet', { body }),
+            status: (fleet_id) => client.request('hives_get_fleet_status', { fleet_id }),
+            teardown: (fleet_id) => client.request('hives_teardown_fleet', { fleet_id }),
+        },
+        remote: {
+            sessions: {
+                list: (project_id, q = {}) => client.request('hives_list_remote_sessions', { ...q, project_id }),
+                close: (project_id, session_id) => client.request('hives_close_remote_session', { project_id, session_id }),
+            },
+            ssh: (project_id, body) => client.request('hives_create_ssh_session', { project_id, body }),
+            terminal: (project_id, body) => client.request('hives_create_terminal_session', { project_id, body }),
+            debug: (project_id, body) => client.request('hives_create_debug_session', { project_id, body }),
+            sftp: {
+                list: (project_id, target_id, q = {}) => client.request('hives_sftp_list', { ...q, project_id, target_id }),
+                read: (project_id, target_id, path) => client.request('hives_sftp_read', { project_id, target_id, path }),
+                write: (project_id, target_id, body) => client.request('hives_sftp_write', { project_id, target_id, body }),
+                delete: (project_id, target_id, body) => client.request('hives_sftp_delete', { project_id, target_id, body }),
+            },
+        },
+    };
+}

package/dist/hives-sse.d.ts

@@ -0,0 +1,24 @@
+/** One Server-Sent Event. `data` is parsed JSON when it is JSON, otherwise the raw text. */
+export interface HivesSseEvent {
+    event: string;
+    id?: string;
+    data: unknown;
+}
+export interface HivesSseWindowOptions {
+    /** Stop after this many events (1-1000, default 100). */
+    maxEvents?: number;
+    /** Stop after this many seconds (1-15, default 10). The CLI and MCP Hives node transport allows a body 20 s, so a window stays below it. */
+    seconds?: number;
+    signal?: AbortSignal;
+}
+/** A bounded read of an endless stream; `ended` says which bound closed it. */
+export interface HivesSseWindow {
+    events: HivesSseEvent[];
+    ended: 'max_events' | 'time' | 'closed' | 'aborted';
+}
+/**
+ * Read one bounded window of a Server-Sent Events response (for example
+ * `await genesis.raw('hives_stream_deployment_logs', {...})`) and close the connection.
+ * Never buffers the whole body: an SSE stream does not end on its own.
+ */
+export declare function hivesSseWindow(response: Response, options?: HivesSseWindowOptions): Promise<HivesSseWindow>;

package/dist/hives-sse.js

@@ -0,0 +1,111 @@
+import { GenesisError } from './errors.js';
+const bound = (value, fallback, max, name) => {
+    if (value === undefined)
+        return fallback;
+    if (!Number.isInteger(value) || value < 1 || value > max) {
+        throw new GenesisError({ status: 0, type: 'invalid_request', message: `${name} must be an integer from 1 to ${max}.` });
+    }
+    return value;
+};
+function parse(lines) {
+    let event = 'message';
+    let id;
+    const data = [];
+    for (const line of lines) {
+        if (!line || line.startsWith(':'))
+            continue; // comments carry keepalives only
+        const colon = line.indexOf(':');
+        const field = colon < 0 ? line : line.slice(0, colon);
+        let value = colon < 0 ? '' : line.slice(colon + 1);
+        if (value.startsWith(' '))
+            value = value.slice(1);
+        if (field === 'event')
+            event = value;
+        else if (field === 'id')
+            id = value;
+        else if (field === 'data')
+            data.push(value);
+    }
+    if (!data.length)
+        return undefined;
+    const text = data.join('\n');
+    let value = text;
+    try {
+        value = JSON.parse(text);
+    }
+    catch { /* keepalive text such as "ping" */ }
+    return { event, ...(id === undefined ? {} : { id }), data: value };
+}
+/**
+ * Read one bounded window of a Server-Sent Events response (for example
+ * `await genesis.raw('hives_stream_deployment_logs', {...})`) and close the connection.
+ * Never buffers the whole body: an SSE stream does not end on its own.
+ */
+export async function hivesSseWindow(response, options = {}) {
+    const maxEvents = bound(options.maxEvents, 100, 1000, 'maxEvents');
+    const seconds = bound(options.seconds, 10, 15, 'seconds');
+    const reader = response.body?.getReader();
+    const events = [];
+    if (!reader)
+        return { events, ended: 'closed' };
+    const decoder = new TextDecoder();
+    let buffer = '';
+    let lines = [];
+    let ended;
+    const stop = (why) => { ended ??= why; void reader.cancel().catch(() => { }); };
+    const timer = setTimeout(() => stop('time'), seconds * 1000);
+    const abort = () => stop('aborted');
+    options.signal?.addEventListener('abort', abort, { once: true });
+    if (options.signal?.aborted)
+        abort();
+    try {
+        while (!ended) {
+            let chunk;
+            try {
+                chunk = await reader.read();
+            }
+            catch (error) {
+                if (ended)
+                    break;
+                throw error;
+            }
+            if (ended)
+                break;
+            if (chunk.done) {
+                buffer += decoder.decode();
+                ended = 'closed';
+            }
+            else
+                buffer += decoder.decode(chunk.value, { stream: true });
+            let index;
+            while ((index = buffer.search(/\r\n|\r|\n/)) >= 0) {
+                const line = buffer.slice(0, index);
+                buffer = buffer.slice(index + (buffer.startsWith('\r\n', index) ? 2 : 1));
+                if (line !== '') {
+                    lines.push(line);
+                    continue;
+                }
+                const event = parse(lines);
+                lines = [];
+                if (event)
+                    events.push(event);
+                if (events.length >= maxEvents) {
+                    stop('max_events');
+                    break;
+                }
+            }
+            if (ended === 'closed' && events.length < maxEvents) {
+                const tail = parse(buffer ? [...lines, buffer] : lines);
+                if (tail)
+                    events.push(tail);
+            }
+        }
+    }
+    finally {
+        clearTimeout(timer);
+        options.signal?.removeEventListener('abort', abort);
+        if (ended !== 'closed')
+            void reader.cancel().catch(() => { });
+    }
+    return { events, ended: ended ?? 'closed' };
+}

package/dist/iam-directory.d.ts

@@ -0,0 +1,8 @@
+export declare const iamDirectoryOperations: readonly string[];
+export declare const isIamDirectoryOperation: (operationId: string) => boolean;
+/**
+ * The actionable form of a directory refusal; any other error is returned unchanged. The gateway, not the client, exchanges
+ * the One account session for an organization context at Auth and forwards the short-lived child to IAM. The client sends
+ * one request, never changes a session or its selected context, and only explains what came back.
+ */
+export declare function iamDirectoryFailure(e: unknown, org: string, operationId: string): unknown;

package/dist/iam-directory.js

@@ -0,0 +1,23 @@
+import { GenesisError, errorCatalog } from './errors.js';
+/** The IAM v4 organization directory: projects and workspaces at /v1/iam/orgs/{org_id}/... */
+const READS = ['iam_listProjects', 'iam_getProject', 'iam_listWorkspaces', 'iam_getWorkspace'];
+const WRITES = ['iam_createProject', 'iam_updateProject', 'iam_deleteProject', 'iam_createWorkspace', 'iam_updateWorkspace', 'iam_deleteWorkspace'];
+export const iamDirectoryOperations = [...READS, ...WRITES];
+export const isIamDirectoryOperation = (operationId) => iamDirectoryOperations.includes(operationId);
+const codeOf = (e) => errorCatalog(e).code?.toUpperCase();
+/**
+ * The actionable form of a directory refusal; any other error is returned unchanged. The gateway, not the client, exchanges
+ * the One account session for an organization context at Auth and forwards the short-lived child to IAM. The client sends
+ * one request, never changes a session or its selected context, and only explains what came back.
+ */
+export function iamDirectoryFailure(e, org, operationId) {
+    if (!(e instanceof GenesisError))
+        return e;
+    const keep = (message) => new GenesisError({ status: e.status, type: e.type, code: e.code, requestId: e.requestId, operationId, body: e.body, message });
+    const code = codeOf(e);
+    if (code === 'TENANT_REQUIRED')
+        return keep(`IAM sees no organization on your One account session for ${org}. Use the Console to manage projects and workspaces for now.`);
+    if (WRITES.includes(operationId) && code === 'SCOPE_MISSING' && errorCatalog(e).required_scope === 'iam:write')
+        return keep(`This credential cannot change projects and workspaces in ${org}: a login needs the organization owner or manager role in IAM, and an API key needs iam:write. Use the Console.`);
+    return e;
+}