@onesi/genesis 0.1.13 → 0.2.0

package/dist/client.js

@@ -9,12 +9,18 @@ import { isHivesObjectUpload, hivesObjectBody, hivesContentType, isHivesResource
 import { operationTable, services } from './generated/operations.js';
 import { GenesisError } from './errors.js';
 import { requireSecureUrl } from './urls.js';
+import { iamDirectoryFailure, isIamDirectoryOperation } from './iam-directory.js';
 import { validateHivesInvocation, hivesFunctionResponseHeaders, hivesFunctionMetadata, hivesOperationError } from './hives-functions.js';
-import { validateHivesEnvironment, hivesEnvironmentMetadata, hivesEnvironmentReveal } from './hives-environment.js';
+import { validateHivesEnvironment, validateHivesEnvironmentNames, hivesEnvironmentSetNames, hivesEnvironmentMetadata, hivesEnvironmentReveal } from './hives-environment.js';
 import { RUNNER_SELF_GRANT_OPERATION, snapshotRunnerSelfGrant, runnerGrantResponse, runnerGrantTransportError } from './runner-grant.js';
 /** The Genesis API gateway. `https://console.life.one/api` remains an alias for the same gateway. */
 export const DEFAULT_BASE_URL = 'https://os.one.ml/api';
 const env = globalThis.process?.env ?? {};
+/** Endless Server-Sent Events streams and the bounded reader for each; request() refuses these and any operation generated with `stream: true`. */
+const ENDLESS_STREAMS = {
+    hives_stream_logs: 'genesis.hives.logs.stream() or genesis.hives.logs.window()',
+    hives_stream_deployment_logs: 'hivesSseWindow(await genesis.raw(...))',
+};
 export class GenesisClient {
     baseUrl;
     routing;
@@ -45,11 +51,19 @@ export class GenesisClient {
             const v = input[k];
             if (v === undefined || v === null || v === '')
                 throw new GenesisError({ status: 0, type: 'invalid_request', message: `Missing required path parameter "${k}" for ${operationId}`, operationId });
-            return encodeURIComponent(String(v));
+            if (!op.tailParams?.includes(k))
+                return encodeURIComponent(String(v));
+            const segments = String(v).split('/');
+            if (segments.some(s => s === '' || s === '.' || s === '..' || s.includes('\\')))
+                throw new GenesisError({ status: 0, type: 'invalid_request', operationId,
+                    message: `Path parameter "${k}" for ${operationId} must be "/"-separated segments with no empty, "." or ".." segment and no backslash` });
+            return segments.map(encodeURIComponent).join('/');
         });
         let base;
         let p;
         if (this.routing === 'direct') {
+            if (op.service === 'gateway')
+                throw new GenesisError({ status: 0, type: 'invalid_request', operationId, message: 'Gateway operations are answered by the Genesis gateway itself and have no direct upstream.' });
             base = (this.opts.upstreams?.[op.service] ?? op.upstream.base).replace(/\/+$/, '');
             p = fill(op.upstream.path);
         }
@@ -72,9 +86,21 @@ export class GenesisClient {
     }
     /** Call any Genesis operation by id, fully typed from the merged spec. */
     async request(operationId, input, init = {}) {
+        // An endless SSE body never completes, so buffering it would hang: refuse before any request is sent.
+        // Finite SSE reads (for example traces_streamRun) are not marked and still use request().
+        const endless = ENDLESS_STREAMS[operationId]
+            ?? (operationTable[operationId]?.stream === true ? 'hivesSseWindow(await genesis.raw(...))' : undefined);
+        if (endless)
+            throw new GenesisError({ status: 0, type: 'invalid_request', operationId,
+                message: `${String(operationId)} is an endless Server-Sent Events stream. Read a bounded window with ${endless} instead of request().` });
         const res = await this.raw(operationId, (input ?? {}), init);
         if (operationTable[operationId].rawResponse)
             return res;
+        // DELETE /env answers 200 with an empty body.
+        if (operationId === 'hives_delete_project_env') {
+            void res.body?.cancel().catch(() => { });
+            return undefined;
+        }
         if (operationId === 'hives_stop_deployment' && res.status !== 200) {
             void res.body?.cancel().catch(() => { });
             throw new GenesisError({ status: 0, type: 'invalid_response', operationId, message: 'Hives did not confirm this deployment stopped. Read its current state before explicitly reconciling stop.' });
@@ -87,7 +113,7 @@ export class GenesisClient {
             value = ct.includes('json') ? await res.json() : await res.text();
         }
         catch (error) {
-            if (String(operationId).startsWith('hives_') && String(operationId).endsWith('_project_environment'))
+            if (String(operationId).startsWith('hives_') && /_project_env(?:ironment)?$/.test(operationId))
                 throw new Error('Hives returned invalid environment data.');
             if (String(operationId).startsWith('hives_') && /_functions?$/.test(operationId))
                 throw new Error('Hives returned invalid function metadata.');
@@ -111,6 +137,9 @@ export class GenesisClient {
         if (operationId === 'hives_list_project_environment' || operationId === 'hives_update_project_environment') {
             return hivesEnvironmentMetadata(value, input?.project_id, operationId === 'hives_update_project_environment');
         }
+        if (operationId === 'hives_set_project_env') {
+            return hivesEnvironmentSetNames(value, input?.project_id, input?.body);
+        }
         if (operationId === 'hives_reveal_project_environment') {
             return hivesEnvironmentReveal(value, input?.key);
         }
@@ -118,6 +147,17 @@ export class GenesisClient {
     }
     /** Raw Response. Completed Hives guest responses retain their actual status, including non-2xx. */
     async raw(operationId, input = {}, init = {}) {
+        if (!isIamDirectoryOperation(operationId))
+            return this.dispatch(operationId, input, init);
+        // The gateway binds the organization context itself. A refusal is only explained here; the client never changes a session or its context.
+        try {
+            return await this.dispatch(operationId, input, init);
+        }
+        catch (e) {
+            throw iamDirectoryFailure(e, typeof input.org_id === 'string' ? input.org_id : '', operationId);
+        }
+    }
+    async dispatch(operationId, input, init) {
         if (isMindsOwnerOperation(operationId))
             return mindsOwnerTransport({ operationId, input, headers: init.headers, routing: this.routing, url: this.url(operationId, input), credential: () => this.credential(), fetch: this.fetchImpl, signal: init.signal });
         if (isMindsAgentOperation(operationId))
@@ -139,13 +179,15 @@ export class GenesisClient {
         const flocksNative = ['flocks_exchangeJoinToken', 'flocks_activateNode', 'flocks_rotateNodeCredential'].includes(operationId);
         if (flocksNative && this.routing === 'direct')
             throw new GenesisError({ status: 0, type: 'invalid_request', message: 'Native Flocks credentials are brokered only through the Genesis gateway.', operationId });
-        if (operationId === 'hives_update_project_environment')
+        if (operationId === 'hives_update_project_environment' || operationId === 'hives_set_project_env')
             input = { ...input, body: validateHivesEnvironment(input.body) };
+        if (operationId === 'hives_delete_project_env')
+            input = { ...input, body: validateHivesEnvironmentNames(input.body) };
         const objectBody = isHivesObjectUpload(operationId) ? await hivesObjectBody(input.body) : undefined;
         const url = this.url(operationId, input);
         const headers = {
             accept: 'application/json',
-            'user-agent': this.opts.userAgent ?? '@onesi/genesis/0.1.13',
+            'user-agent': this.opts.userAgent ?? '@onesi/genesis/0.2.0',
             ...this.opts.headers, ...init.headers,
         };
         if (op.service === 'blinds' && !['GET', 'HEAD', 'OPTIONS'].includes(op.method))
@@ -203,7 +245,7 @@ export class GenesisClient {
                 body = JSON.stringify(input.body);
             }
         }
-        const environmentOperation = op.service === 'hives' && operationId.endsWith('_project_environment');
+        const environmentOperation = op.service === 'hives' && /_project_env(?:ironment)?$/.test(operationId);
         const secretOperation = op.service === 'hives' && (/_secrets?$/.test(operationId) || environmentOperation);
         const functionOperation = op.service === 'hives' && (op.rawResponse || /_function(?:s|_async)?$/.test(operationId));
         let res;
@@ -224,13 +266,28 @@ export class GenesisClient {
         }
         if (runnerGrant)
             return runnerGrantResponse(res, runnerGrant);
+        // A raw (binary) answer outside Hives, e.g. a Panes screenshot: a success is the bytes; a
+        // failure takes the ordinary error path below.
+        if (op.rawResponse && op.service !== 'hives' && res.ok)
+            return res;
         if (op.rawResponse && /^exec_[a-f0-9]{32}$/.test(res.headers.get('x-execution-id') ?? '')) {
             return new Response(res.body, { status: res.status, statusText: res.statusText, headers: hivesFunctionResponseHeaders(res.headers) });
         }
         if (op.rawResponse && op.service === 'hives' && res.headers.has('x-hives-operation-id')) {
+            // 5xx stays invalid_response below: its outcome is uncertain, so keep the key and reconcile.
+            const copy = res.status >= 400 && res.status < 500 ? res.clone() : undefined;
             const error = await hivesOperationError(res);
-            if (error)
+            if (error) {
+                void copy?.body?.cancel().catch(() => { });
                 throw error;
+            }
+            // A refusal envelope that is not an operation receipt keeps its own status, code and request id (finding G2).
+            const detail = copy ? await hivesErrorDetail(copy) : {};
+            if (detail.code !== undefined) {
+                throw new GenesisError({ status: res.status, type: `http_${res.status}`, operationId, code: detail.code,
+                    message: detail.message ?? `Hives refused this invocation (${res.status}). Keep the original idempotency key and read its operation status before retrying.`,
+                    requestId: res.headers.get('x-request-id') ?? detail.requestId });
+            }
             throw new GenesisError({ status: res.status, type: 'invalid_response', operationId,
                 message: 'Hives operation status was not confirmed. Keep the original idempotency key and reconcile its operation.' });
         }
@@ -238,16 +295,21 @@ export class GenesisClient {
             throw new GenesisError({ status: res.status, type: 'invalid_response', operationId,
                 message: 'Hives did not confirm a completed guest execution. Keep the original invocation key and reconcile its operation.' });
         if (functionOperation && !res.ok) {
-            const message = res.status === 401 ? 'Genesis credential rejected. Sign in again.'
-                : res.status === 403 ? 'Missing the authorized Hives scope for this function action.'
-                    : res.status === 404 ? 'Function/deployment, project or artifact not found in the authenticated organization and project.'
-                        : res.status === 409 ? 'Function mutation conflicted. Refresh its metadata before retrying.'
-                            : res.status === 400 || res.status === 422 ? 'Invalid function request. Check artifact, resource bounds and guest request syntax.'
-                                : res.status === 413 ? 'Function request exceeds a body or serialized guest envelope limit.'
-                                    : res.status >= 300 && res.status < 400 ? 'Unexpected function service redirect. No redirect was followed.'
-                                        : `Hives function operation failed (${res.status}). Refresh and retry.`;
-            throw new GenesisError({ status: res.status, type: `http_${res.status}`, operationId, message,
-                requestId: res.headers.get('x-request-id') ?? undefined });
+            // Keep the service's own refusal code and text (findings G3, G4); the fixed texts are fallbacks only.
+            const detail = await hivesErrorDetail(res);
+            const invocation = op.rawResponse === true;
+            const scope = detail.code === undefined || /scope/i.test(detail.code);
+            const message = detail.code !== undefined && detail.message !== undefined && !(res.status === 403 && scope) ? detail.message
+                : res.status === 401 ? 'Genesis credential rejected. Sign in again.'
+                    : res.status === 403 ? (scope ? 'Missing the authorized Hives scope for this function action.' : `Hives refused this ${invocation ? 'invocation' : 'function action'} (${detail.code}).`)
+                        : res.status === 404 ? 'Function/deployment, project or artifact not found in the authenticated organization and project.'
+                            : res.status === 409 ? (invocation ? `Hives refused this invocation as a conflict${detail.code ? ` (${detail.code})` : ''}. Read the target's current state before retrying.` : 'Function mutation conflicted. Refresh its metadata before retrying.')
+                                : res.status === 400 || res.status === 422 ? 'Invalid function request. Check artifact, resource bounds and guest request syntax.'
+                                    : res.status === 413 ? 'Function request exceeds a body or serialized guest envelope limit.'
+                                        : res.status >= 300 && res.status < 400 ? 'Unexpected function service redirect. No redirect was followed.'
+                                            : `Hives function operation failed (${res.status}). Refresh and retry.`;
+            throw new GenesisError({ status: res.status, type: `http_${res.status}`, operationId, message, code: detail.code,
+                requestId: res.headers.get('x-request-id') ?? detail.requestId });
         }
         if (!res.ok && secretOperation) {
             const message = res.status === 401 ? 'Genesis credential rejected. Sign in again.'
@@ -275,3 +337,48 @@ export class GenesisClient {
         return res;
     }
 }
+/**
+ * The refusal code, short message and request id of a Hives function/invocation error body. Reads at most
+ * 8 KiB and keeps nothing else: a body without a platform code may reflect guest request data.
+ */
+async function hivesErrorDetail(res) {
+    if (!res.body)
+        return {};
+    const reader = res.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        for (;;) {
+            const { value, done } = await reader.read();
+            if (done)
+                break;
+            size += value.length;
+            if (size > 8192) {
+                await reader.cancel().catch(() => { });
+                return {};
+            }
+            chunks.push(value);
+        }
+        const bytes = new Uint8Array(size);
+        let offset = 0;
+        for (const chunk of chunks) {
+            bytes.set(chunk, offset);
+            offset += chunk.length;
+        }
+        const body = JSON.parse(new TextDecoder().decode(bytes));
+        const e = body && typeof body === 'object' ? body.error : undefined;
+        // Only an error envelope: a top-level `code` belongs to an operation receipt, never to a refusal.
+        const raw = e && typeof e === 'object' ? e.code : typeof e === 'string' ? e : undefined;
+        const code = typeof raw === 'string' && /^[A-Za-z][A-Za-z0-9_.:-]{0,63}$/.test(raw) ? raw : undefined;
+        const text = e && typeof e === 'object' ? e.message : undefined;
+        const message = code && typeof text === 'string' && text.length <= 300 && !/[\u0000-\u001f\u007f]/.test(text) ? text : undefined;
+        const id = (e && typeof e === 'object' ? e.request_id : undefined) ?? body?.request_id;
+        return { code, message, requestId: typeof id === 'string' && /^[A-Za-z0-9_.:-]{1,128}$/.test(id) ? id : undefined };
+    }
+    catch {
+        return {};
+    }
+    finally {
+        reader.releaseLock();
+    }
+}

package/dist/errors.js

@@ -29,7 +29,7 @@ export class GenesisError extends Error {
             (typeof e === 'string' && e) || (typeof body === 'string' && body) || `${res.status} ${res.statusText}`;
         return new GenesisError({
             status: res.status, type, message, code: typeof e === 'object' ? e?.code : undefined,
-            requestId: res.headers.get('x-request-id') ?? (typeof e === 'object' ? e?.request_id : undefined) ?? body?.request_id,
+            requestId: [typeof e === 'object' ? e?.request_id : undefined, body?.request_id, res.headers.get('x-request-id')].find((v) => typeof v === 'string' && v !== ''),
             operationId, body,
         });
     }

package/dist/flares.d.ts

@@ -92,6 +92,15 @@ export declare function flaresModule(client: GenesisClient): {
         }>;
     };
     presence: {
+        list: () => Promise<({
+            did?: string;
+            status?: string;
+            sessionId?: string;
+            sessionCount?: number;
+            lastSeenAt?: string;
+        } & {
+            [key: string]: unknown;
+        })[]>;
         heartbeat: (body: In<"flares_presenceHeartbeat">["body"], key: string) => Promise<{
             did?: string;
             status?: string;
@@ -112,6 +121,18 @@ export declare function flaresModule(client: GenesisClient): {
         }>;
     };
     trust: {
+        list: () => Promise<({
+            did?: string;
+            score?: number;
+            confidence?: number;
+            dataPoints?: number;
+            computedAt?: string;
+            expiresAt?: string;
+            trustLevel?: string;
+            endorsementCount?: number;
+        } & {
+            [key: string]: unknown;
+        })[]>;
         score: (did: string) => Promise<{
             did?: string;
             score?: number;
@@ -137,6 +158,17 @@ export declare function flaresModule(client: GenesisClient): {
             [key: string]: unknown;
         }>;
     };
+    activity: {
+        list: (q?: In<"flares_listActivity">) => Promise<({
+            id?: string;
+            at?: string;
+            action?: string;
+            resourceId?: string | null;
+            actor?: string;
+        } & {
+            [key: string]: unknown;
+        })[]>;
+    };
     choreography: {
         workflows: {
             list: () => Promise<{

package/dist/flares.js

@@ -28,16 +28,21 @@ export function flaresModule(client) {
             fail: (id, body, key) => write('flares_failCommitment', { id, body }, key),
         },
         presence: {
+            list: () => client.request('flares_listPresence'),
             heartbeat: (body, key) => write('flares_presenceHeartbeat', { body }, key),
             get: (did) => client.request('flares_getPresence', { did }),
         },
         trust: {
+            list: () => client.request('flares_listTrust'),
             score: (did) => client.request('flares_getTrustScore', { did }),
             check: (body, key) => write('flares_checkTrust', { body }, key),
             endorsements: (did) => client.request('flares_listEndorsements', { did }),
             endorse: (body, key) => write('flares_createEndorsement', { body }, key),
             revoke: (id, key) => write('flares_revokeEndorsement', { id }, key),
         },
+        activity: {
+            list: (q = {}) => client.request('flares_listActivity', q),
+        },
         choreography: {
             workflows: {
                 list: () => client.request('flares_listChoreographyWorkflows'),

package/dist/fleets.d.ts

@@ -3,6 +3,9 @@ import type { OperationInput } from './types.js';
 type TaskInput = NonNullable<OperationInput<'fleets_submitTask'>['body']>;
 type AgentLaunchInput = NonNullable<OperationInput<'fleets_launchAgent'>['body']>;
 type AgentCommandInput = NonNullable<OperationInput<'fleets_commandAgent'>['body']>;
+type AgentUpdateInput = NonNullable<OperationInput<'fleets_updateAgent'>['body']>;
+type AgentLogsQuery = Omit<OperationInput<'fleets_getAgentLogs'>, 'agent_id'>;
+type TaskLogsQuery = Omit<OperationInput<'fleets_getTaskLogs'>, 'task_id'>;
 export interface FleetsInstanceOptions {
     idempotencyKey?: string;
     signal?: AbortSignal;
@@ -62,6 +65,27 @@ export declare function fleetsModule(client: GenesisClient): {
                 [key: string]: unknown;
             };
         }>;
+        /** Change name, model, instructions or memory. A memory change needs a stopped agent. */
+        update: (agent_id: string, body: AgentUpdateInput) => Promise<{
+            agent: import("./index.js").components["schemas"]["Fleets.Agent"];
+            operation_id: string;
+            result?: {
+                [key: string]: unknown;
+            };
+        }>;
+        /** Delete a stopped (or recovery_required) idle agent and its log. */
+        delete: (agent_id: string) => Promise<{
+            id: string;
+            deleted: true;
+            operation_id: string;
+        }>;
+        /** Operation log, oldest first; page with after = next_after. */
+        logs: (agent_id: string, query?: AgentLogsQuery) => Promise<{
+            agent_id: string;
+            state: "launching" | "running" | "stopping" | "stopped" | "recovering" | "recovery_required";
+            entries: import("./index.js").components["schemas"]["Fleets.AgentLogEntry"][];
+            next_after: number | null;
+        }>;
     };
     instances: {
         list: (query?: OperationInput<"fleets_listInstances">) => Promise<{
@@ -181,6 +205,14 @@ export declare function fleetsModule(client: GenesisClient): {
                 [key: string]: unknown;
             };
         }>;
+        /** Lifecycle and output log; poll with after = next_after until complete. */
+        logs: (task_id: string, query?: TaskLogsQuery) => Promise<{
+            task_id: string;
+            state: "pending" | "running" | "cancelling" | "completed" | "failed" | "cancelled" | "timed_out";
+            complete: boolean;
+            entries: import("./index.js").components["schemas"]["Fleets.TaskLogEntry"][];
+            next_after: number | null;
+        }>;
     };
 };
 export {};

package/dist/fleets.js

@@ -46,12 +46,7 @@ function validateAgentLaunch(body) {
     if (body.model !== undefined && (!body.model || byteLength(body.model) > 128)) {
         throw invalid('fleets_launchAgent', 'Agent model must contain 1–128 UTF-8 bytes.');
     }
-    if (body.memory !== undefined) {
-        if (!['minds', 'files', 'custom'].includes(body.memory.provider))
-            throw invalid('fleets_launchAgent', 'Memory provider must be minds, files, or custom.');
-        if (body.memory.provider === 'custom' && !body.memory.endpoint)
-            throw invalid('fleets_launchAgent', 'Custom memory requires an endpoint.');
-    }
+    validateMemory('fleets_launchAgent', body.memory);
     if (body.idempotency_key !== undefined && (typeof body.idempotency_key !== 'string' || !/^[!-~]{1,128}$/.test(body.idempotency_key))) {
         throw invalid('fleets_launchAgent', 'Idempotency key must contain 1–128 visible ASCII characters.');
     }
@@ -61,6 +56,39 @@ function validateAgentCommand(body) {
         throw invalid('fleets_commandAgent', 'Agent input must contain 1–65536 UTF-8 bytes without NUL.');
     }
 }
+function validateMemory(operation, memory) {
+    if (memory === undefined)
+        return;
+    if (!memory || !['minds', 'files', 'custom'].includes(memory.provider))
+        throw invalid(operation, 'Memory provider must be minds, files, or custom.');
+    if (memory.provider === 'custom' && !memory.endpoint)
+        throw invalid(operation, 'Custom memory requires an endpoint.');
+}
+function validateAgentUpdate(body) {
+    const op = 'fleets_updateAgent';
+    if (!body || typeof body !== 'object' || Array.isArray(body))
+        throw invalid(op, 'Provide at least one of name, model, instructions or memory.');
+    const keys = Object.keys(body);
+    if (!keys.length || keys.some(key => !['name', 'model', 'instructions', 'memory'].includes(key))) {
+        throw invalid(op, 'Provide at least one of name, model, instructions or memory.');
+    }
+    if (body.name !== undefined && (typeof body.name !== 'string' || !body.name.trim() || byteLength(body.name) > 128)) {
+        throw invalid(op, 'Agent name must contain 1–128 UTF-8 bytes.');
+    }
+    if (body.model !== undefined && body.model !== null && (typeof body.model !== 'string' || !body.model || byteLength(body.model) > 128)) {
+        throw invalid(op, 'Agent model must contain 1–128 UTF-8 bytes, or be null to clear it.');
+    }
+    if (body.instructions !== undefined && body.instructions !== null
+        && (typeof body.instructions !== 'string' || byteLength(body.instructions) > 65536 || body.instructions.includes('\0'))) {
+        throw invalid(op, 'Agent instructions must contain at most 65536 UTF-8 bytes without NUL, or be null to clear them.');
+    }
+    validateMemory(op, body.memory);
+}
+const cursor = (value, operation, max) => {
+    if (value !== undefined && (!Number.isSafeInteger(value) || value < 0 || value > max)) {
+        throw invalid(operation, 'after must be a non-negative integer cursor (next_after).');
+    }
+};
 /** Managed Henry instances and tasks scoped to the credential's verified org. */
 export function fleetsModule(client) {
     return {
@@ -87,6 +115,26 @@ export function fleetsModule(client) {
                 agentId(agent_id, 'fleets_recoverAgent');
                 return client.request('fleets_recoverAgent', { agent_id });
             },
+            /** Change name, model, instructions or memory. A memory change needs a stopped agent. */
+            update: async (agent_id, body) => {
+                agentId(agent_id, 'fleets_updateAgent');
+                validateAgentUpdate(body);
+                return client.request('fleets_updateAgent', { agent_id, body });
+            },
+            /** Delete a stopped (or recovery_required) idle agent and its log. */
+            delete: async (agent_id) => {
+                agentId(agent_id, 'fleets_deleteAgent');
+                return client.request('fleets_deleteAgent', { agent_id });
+            },
+            /** Operation log, oldest first; page with after = next_after. */
+            logs: async (agent_id, query = {}) => {
+                agentId(agent_id, 'fleets_getAgentLogs');
+                cursor(query.after, 'fleets_getAgentLogs', Number.MAX_SAFE_INTEGER);
+                if (query.limit !== undefined && (!Number.isInteger(query.limit) || query.limit < 1 || query.limit > 200)) {
+                    throw invalid('fleets_getAgentLogs', 'Limit must be 1–200.');
+                }
+                return client.request('fleets_getAgentLogs', { agent_id, ...query });
+            },
         },
         instances: {
             list: async (query = {}) => {
@@ -131,6 +179,11 @@ export function fleetsModule(client) {
             get: (task_id) => client.request('fleets_getTask', { task_id }),
             cancel: (task_id) => client.request('fleets_cancelTask', { task_id }),
             receipt: (task_id) => client.request('fleets_getTaskReceipt', { task_id }),
+            /** Lifecycle and output log; poll with after = next_after until complete. */
+            logs: async (task_id, query = {}) => {
+                cursor(query.after, 'fleets_getTaskLogs', 4294967295);
+                return client.request('fleets_getTaskLogs', { task_id, ...query });
+            },
         },
     };
 }