@onesi/genesis 0.2.0 → 0.2.1

package/dist/hives-cells.d.ts

@@ -1,5 +1,5 @@
 import type { GenesisClient } from './client.js';
-import { type HivesResourceOptions } from './hives-resources-transport.js';
+import { type HivesFundedWriteOptions, type HivesResourceOptions } from './hives-resources-transport.js';
 export interface HivesCorsRule {
     allowed_origins: string[];
     allowed_methods: string[];
@@ -112,16 +112,21 @@ export declare function hivesCells(client: GenesisClient): {
             continuation_token?: string;
             max_keys?: number;
         }, options?: HivesResourceOptions): Promise<HivesObjectList>;
-        put(project: string, id: string, key: string, bytes: Blob | ArrayBuffer | ArrayBufferView, options?: HivesResourceOptions & {
+        put(project: string, id: string, key: string, bytes: Blob | ArrayBuffer | ArrayBufferView, options?: HivesFundedWriteOptions & {
             content_type?: string;
         }): Promise<HivesObjectAcknowledgement>;
         remove: (project: string, id: string, key: string, options?: HivesResourceOptions) => Promise<void>;
         download: (project: string, id: string, key: string, options?: HivesResourceOptions) => Promise<Response>;
         /** Existing flat-key path compatibility; nested keys use canonical collection methods above. */
-        putFlat(project: string, id: string, key: string, bytes: Blob | ArrayBuffer | ArrayBufferView, options?: HivesResourceOptions & {
+        putFlat(project: string, id: string, key: string, bytes: Blob | ArrayBuffer | ArrayBufferView, options?: HivesFundedWriteOptions & {
             content_type?: string;
         }): Promise<HivesObjectAcknowledgement>;
         removeFlat: (project: string, id: string, key: string, options?: HivesResourceOptions) => Promise<void>;
+        /** The flat key "download" on its own static route, which shadows /objects/{key} for that key. */
+        putDownload(project: string, id: string, bytes: Blob | ArrayBuffer | ArrayBufferView, options?: HivesFundedWriteOptions & {
+            content_type?: string;
+        }): Promise<HivesObjectAcknowledgement>;
+        removeDownload: (project: string, id: string, options?: HivesResourceOptions) => Promise<void>;
     };
     presign(project: string, id: string, body: HivesPresign, options?: HivesResourceOptions): Promise<HivesPresignedUrl>;
 };

package/dist/hives-cells.js

@@ -1,4 +1,4 @@
-import { HIVES_OBJECT_BYTES, hivesResourceCall, hivesResourceId, hivesObjectBody, hivesContentType, resourceError } from './hives-resources-transport.js';
+import { HIVES_OBJECT_BYTES, hivesFundedWriteHeaders, hivesResourceCall, hivesResourceId, hivesObjectBody, hivesContentType, resourceError } from './hives-resources-transport.js';
 export function hivesObjectKey(key) {
     const bytes = new TextEncoder().encode(key);
     if (typeof key !== 'string' || !key || bytes.length > 1024 || new TextDecoder('utf-8', { fatal: true }).decode(bytes) !== key
@@ -59,7 +59,12 @@ function object(value, id) {
     hivesObjectKey(value.key);
     return Object.fromEntries(['key', 'bucket_id', 'size_bytes', 'etag', 'last_modified', 'generation', 'content_type', 'metadata', 'metadata_scope'].map(k => [k, value[k]]));
 }
-function acknowledgement(value, key, id, size) {
+function acknowledgement(answer, key, id, size) {
+    // A funded write answers with its settled storage operation receipt; the acknowledgement is its result.
+    const receipt = answer;
+    if (receipt && receipt.object !== undefined && (receipt.object !== 'storage_write_operation' || receipt.state !== 'settled'))
+        throw resourceError(0);
+    const value = (receipt?.object === undefined ? answer : receipt.result);
     if (!value || value.bucket_id !== id || value.key !== key || value.size_bytes !== size || !Number.isSafeInteger(value.size_bytes) || value.size_bytes < 0 || typeof value.etag !== 'string' || typeof value.generation !== 'string' || value.content_type !== null && typeof value.content_type !== 'string')
         throw resourceError(0);
     return { key: value.key, bucket_id: value.bucket_id, size_bytes: value.size_bytes, etag: value.etag, generation: value.generation, content_type: value.content_type };
@@ -67,6 +72,8 @@ function acknowledgement(value, key, id, size) {
 export function hivesCells(client) {
     const ids = (project_id, bucket_id) => ({ project_id: hivesResourceId(project_id), ...(bucket_id === undefined ? {} : { bucket_id: hivesResourceId(bucket_id) }) });
     const call = (id, input, options, mode = 'json', limit = 2 * 1024 * 1024) => hivesResourceCall(client, id, input, options, mode, limit, 100_000);
+    // Object writes are funded: each carries one Idempotency-Key (the caller's, or a fresh one).
+    const write = (id, input, options) => hivesResourceCall(client, id, input, options, 'json', 2 * 1024 * 1024, 100_000, undefined, { headers: hivesFundedWriteHeaders(options, id) });
     return {
         async list(project, query = {}, options) {
             if (Object.keys(query).some(k => !['page', 'per_page'].includes(k)) || query.page !== undefined && (!Number.isInteger(query.page) || query.page < 1 || query.page > 10000) || query.per_page !== undefined && (!Number.isInteger(query.per_page) || query.per_page < 1 || query.per_page > 100))
@@ -113,7 +120,7 @@ export function hivesCells(client) {
             async put(project, id, key, bytes, options = {}) {
                 const body = await hivesObjectBody(bytes);
                 const content_type = hivesContentType(options.content_type);
-                return acknowledgement(await call('hives_upload_object_by_key', { ...ids(project, id), key_base64url: hivesObjectKey(key), body, content_type }, options), key, id, body.byteLength);
+                return acknowledgement(await write('hives_upload_object_by_key', { ...ids(project, id), key_base64url: hivesObjectKey(key), body, content_type }, options), key, id, body.byteLength);
             },
             remove: (project, id, key, options) => call('hives_delete_object_by_key', { ...ids(project, id), key_base64url: hivesObjectKey(key) }, options, 'empty'),
             download: (project, id, key, options) => call('hives_download_object_by_key', { ...ids(project, id), key_base64url: hivesObjectKey(key) }, options, 'binary', HIVES_OBJECT_BYTES),
@@ -123,10 +130,16 @@ export function hivesCells(client) {
                 if (!/^[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)*$/.test(key))
                     throw resourceError(0);
                 const body = await hivesObjectBody(bytes);
-                return acknowledgement(await call('hives_upload_object', { ...ids(project, id), key, body, content_type: hivesContentType(options.content_type) }, options), key, id, body.byteLength);
+                return acknowledgement(await write('hives_upload_object', { ...ids(project, id), key, body, content_type: hivesContentType(options.content_type) }, options), key, id, body.byteLength);
             },
             removeFlat: (project, id, key, options) => { hivesObjectKey(key); if (!/^[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)*$/.test(key))
                 throw resourceError(0); return call('hives_delete_object', { ...ids(project, id), key }, options, 'empty'); },
+            /** The flat key "download" on its own static route, which shadows /objects/{key} for that key. */
+            async putDownload(project, id, bytes, options = {}) {
+                const body = await hivesObjectBody(bytes);
+                return acknowledgement(await write('hives_upload_object_named_download', { ...ids(project, id), body, content_type: hivesContentType(options.content_type) }, options), 'download', id, body.byteLength);
+            },
+            removeDownload: (project, id, options) => call('hives_delete_object_named_download', ids(project, id), options, 'empty'),
         },
         async presign(project, id, body, options) {
             hivesObjectKey(body.key);

package/dist/hives-node.js

@@ -12,12 +12,12 @@ export async function closeHivesNodeTransport() {
     await current?.destroy();
 }
 export function hivesOperationBudget(id) {
-    if (['hives_list_buckets', 'hives_create_bucket', 'hives_get_bucket', 'hives_delete_bucket', 'hives_list_objects', 'hives_upload_object', 'hives_upload_object_by_key', 'hives_delete_object', 'hives_delete_object_by_key', 'hives_download_object_by_key', 'hives_get_cors_config', 'hives_set_cors_config', 'hives_generate_presigned_url', 'hives_reconcile'].includes(id))
+    if (['hives_list_buckets', 'hives_create_bucket', 'hives_get_bucket', 'hives_delete_bucket', 'hives_list_objects', 'hives_upload_object', 'hives_upload_object_by_key', 'hives_upload_object_named_download', 'hives_delete_object', 'hives_delete_object_by_key', 'hives_delete_object_named_download', 'hives_download_object_by_key', 'hives_get_cors_config', 'hives_set_cors_config', 'hives_generate_presigned_url', 'hives_reconcile'].includes(id))
         return 100_000;
     if (id === 'hives_cancel_deployment' || id === 'hives_delete_deployment' || id === 'hives_stop_deployment')
         return 330_000;
     // A live SSE subscription is bounded by its caller's window or --follow limit (at most 300 s).
-    if (id === 'hives_stream_logs')
+    if (id === 'hives_stream_logs' || id === 'hives_stream_deployment_logs')
         return 330_000;
     if (['hives_create_deployment', 'hives_upload_deployment', 'hives_invoke_deployment', 'hives_invoke_function', 'hives_invoke_function_async'].includes(id))
         return 40_000;

package/dist/hives-operations.d.ts

@@ -29,15 +29,19 @@ export declare function hivesOperations(client: GenesisClient): {
                 continuation_token?: string;
                 max_keys?: number;
             }, options?: import("./hives-resources-transport.js").HivesResourceOptions): Promise<import("./hives-cells.js").HivesObjectList>;
-            put(project: string, id: string, key: string, bytes: Blob | ArrayBuffer | ArrayBufferView, options?: import("./hives-resources-transport.js").HivesResourceOptions & {
+            put(project: string, id: string, key: string, bytes: Blob | ArrayBuffer | ArrayBufferView, options?: import("./hives-resources-transport.js").HivesFundedWriteOptions & {
                 content_type?: string;
             }): Promise<import("./hives-cells.js").HivesObjectAcknowledgement>;
             remove: (project: string, id: string, key: string, options?: import("./hives-resources-transport.js").HivesResourceOptions) => Promise<void>;
             download: (project: string, id: string, key: string, options?: import("./hives-resources-transport.js").HivesResourceOptions) => Promise<Response>;
-            putFlat(project: string, id: string, key: string, bytes: Blob | ArrayBuffer | ArrayBufferView, options?: import("./hives-resources-transport.js").HivesResourceOptions & {
+            putFlat(project: string, id: string, key: string, bytes: Blob | ArrayBuffer | ArrayBufferView, options?: import("./hives-resources-transport.js").HivesFundedWriteOptions & {
                 content_type?: string;
             }): Promise<import("./hives-cells.js").HivesObjectAcknowledgement>;
             removeFlat: (project: string, id: string, key: string, options?: import("./hives-resources-transport.js").HivesResourceOptions) => Promise<void>;
+            putDownload(project: string, id: string, bytes: Blob | ArrayBuffer | ArrayBufferView, options?: import("./hives-resources-transport.js").HivesFundedWriteOptions & {
+                content_type?: string;
+            }): Promise<import("./hives-cells.js").HivesObjectAcknowledgement>;
+            removeDownload: (project: string, id: string, options?: import("./hives-resources-transport.js").HivesResourceOptions) => Promise<void>;
         };
         presign(project: string, id: string, body: import("./hives-cells.js").HivesPresign, options?: import("./hives-resources-transport.js").HivesResourceOptions): Promise<import("./hives-cells.js").HivesPresignedUrl>;
     };
@@ -125,7 +129,7 @@ export declare function hivesOperations(client: GenesisClient): {
                 deleted: true;
             }>;
         };
-        publish(project: string, id: string, body: import("./hives-topics.js").HivesTopicPublish, options?: import("./hives-resources-transport.js").HivesResourceOptions): Promise<import("./hives-topics.js").HivesTopicPublication>;
+        publish(project: string, id: string, body: import("./hives-topics.js").HivesTopicPublish, options?: import("./hives-resources-transport.js").HivesFundedWriteOptions): Promise<import("./hives-topics.js").HivesTopicPublication>;
     };
     runtimes: {
         list: (options?: import("./hives-resources-transport.js").HivesResourceOptions) => Promise<{

package/dist/hives-resources-transport.d.ts

@@ -6,12 +6,18 @@ export declare const HIVES_RESOURCE_JSON_BYTES: number;
 export interface HivesResourceOptions {
     signal?: AbortSignal;
 }
+/** Funded Hives writes (topic publish, Cells object writes): Hives refuses them without one Idempotency-Key. */
+export interface HivesFundedWriteOptions extends HivesResourceOptions {
+    idempotencyKey?: string;
+}
+/** The caller's key, or a fresh one when none is given. Reuse a key only to replay the same write, never to act twice. */
+export declare function hivesFundedWriteHeaders(options?: HivesFundedWriteOptions, id?: string): Record<string, string>;
 export declare function hivesResourceId(value: string): string;
 export declare function resourceError(status: number, id?: string): GenesisError;
 /** A non-2xx Hives resource reply as a GenesisError with the gateway's code, request id and required scope (bounded read, body discarded). */
 export declare function resourceErrorFromResponse(response: Response, id?: string): Promise<GenesisError>;
 export declare const isHivesResourceOperation: (id: string) => boolean;
-export declare const isHivesObjectUpload: (id: string) => id is "hives_upload_object_by_key" | "hives_upload_object";
+export declare const isHivesObjectUpload: (id: string) => id is "hives_upload_object_by_key" | "hives_upload_object_named_download" | "hives_upload_object";
 /** Shared-client hook proposal: snapshot only the two real raw Cells upload operations. */
 export declare function hivesObjectBody(value: unknown): Promise<ArrayBuffer>;
 export declare function hivesContentType(value?: string): string;

package/dist/hives-resources-transport.js

@@ -2,6 +2,14 @@ import { GenesisError } from './errors.js';
 export const HIVES_OBJECT_BYTES = 10 * 1024 * 1024;
 export const HIVES_QUEUE_BYTES = 256 * 1024;
 export const HIVES_RESOURCE_JSON_BYTES = 2 * 1024 * 1024;
+/** The caller's key, or a fresh one when none is given. Reuse a key only to replay the same write, never to act twice. */
+export function hivesFundedWriteHeaders(options = {}, id) {
+    const key = options.idempotencyKey ?? globalThis.crypto.randomUUID();
+    // Hives' bound (operation_funding.rs key()): one value of 1-128 printable ASCII bytes.
+    if (typeof key !== 'string' || !/^[ -~]{1,128}$/.test(key))
+        throw resourceError(0, id);
+    return { 'idempotency-key': key };
+}
 export function hivesResourceId(value) {
     if (typeof value !== 'string' || !/^[A-Za-z0-9_-]{1,128}$/.test(value))
         throw resourceError(0);
@@ -50,8 +58,8 @@ export async function resourceErrorFromResponse(response, id) {
         code: fields.code, requestId: fields.requestId,
         body: fields.code || fields.requiredScope ? { error: { code: fields.code, request_id: fields.requestId, required_scope: fields.requiredScope } } : undefined });
 }
-export const isHivesResourceOperation = (id) => /^(?:hives_marketplace_(?:categories|featured|installed|get_installation|uninstall|reconcile|list_packages|publish|get_package|install|update|list_versions)|hives_(?:get|configure|remove)_native_queue_consumer|hives_.*_native_queue|hives_.*_native_topic|hives_(?:(?:list_volumes|create_volume|get_volume|delete_volume|mount_volume|unmount_volume)|list_buckets|create_bucket|get_bucket|delete_bucket|list_objects|upload_object(?:_by_key)?|delete_object(?:_by_key)?|download_object_by_key|get_cors_config|set_cors_config|generate_presigned_url|reconcile|list_runtimes|get_runtime|select_runtime|list_project_runtimes))$/.test(id);
-export const isHivesObjectUpload = (id) => id === 'hives_upload_object_by_key' || id === 'hives_upload_object';
+export const isHivesResourceOperation = (id) => /^(?:hives_marketplace_(?:categories|featured|installed|get_installation|uninstall|reconcile|list_packages|publish|get_package|install|update|list_versions)|hives_(?:get|configure|remove)_native_queue_consumer|hives_.*_native_queue|hives_.*_native_topic|hives_(?:(?:list_volumes|create_volume|get_volume|delete_volume|mount_volume|unmount_volume)|list_buckets|create_bucket|get_bucket|delete_bucket|list_objects|upload_object(?:_by_key|_named_download)?|delete_object(?:_by_key|_named_download)?|download_object_by_key|get_cors_config|set_cors_config|generate_presigned_url|reconcile|list_runtimes|get_runtime|select_runtime|list_project_runtimes))$/.test(id);
+export const isHivesObjectUpload = (id) => id === 'hives_upload_object_by_key' || id === 'hives_upload_object' || id === 'hives_upload_object_named_download';
 /** Shared-client hook proposal: snapshot only the two real raw Cells upload operations. */
 export async function hivesObjectBody(value) {
     let bytes;

package/dist/hives-topics.d.ts

@@ -1,5 +1,5 @@
 import type { GenesisClient } from './client.js';
-import { type HivesResourceOptions } from './hives-resources-transport.js';
+import { type HivesFundedWriteOptions, type HivesResourceOptions } from './hives-resources-transport.js';
 export interface HivesTopic {
     id: string;
     projectId: string;
@@ -46,6 +46,7 @@ export declare function hivesTopics(client: GenesisClient): {
             deleted: true;
         }>;
     };
-    /** Persists one delivery per subscription atomically. Never retried after an unknown outcome. */
-    publish(project: string, id: string, body: HivesTopicPublish, options?: HivesResourceOptions): Promise<HivesTopicPublication>;
+    /** Persists one delivery per subscription atomically. Never retried after an unknown outcome. Carries one
+     * Idempotency-Key (options.idempotencyKey, or a fresh one); reuse that key only to replay this publication. */
+    publish(project: string, id: string, body: HivesTopicPublish, options?: HivesFundedWriteOptions): Promise<HivesTopicPublication>;
 };

package/dist/hives-topics.js

@@ -1,5 +1,5 @@
 import { hivesQueueBody } from './hives-queues.js';
-import { HIVES_QUEUE_BYTES, hivesResourceCall, hivesResourceId, resourceError } from './hives-resources-transport.js';
+import { HIVES_QUEUE_BYTES, hivesFundedWriteHeaders, hivesResourceCall, hivesResourceId, resourceError } from './hives-resources-transport.js';
 const invalid = () => resourceError(0);
 const object = (v) => { if (!v || typeof v !== 'object' || Array.isArray(v))
     throw invalid(); return v; };
@@ -46,7 +46,7 @@ function publishInput(value) {
 }
 export function hivesTopics(client) {
     const ids = (project, id) => ({ project_id: hivesResourceId(project), ...(id === undefined ? {} : { topic_id: hivesResourceId(id) }) });
-    const call = (operation, input, options, status = 200) => hivesResourceCall(client, operation, input, options, 'json', 2 * 1024 * 1024, 20_000, status);
+    const call = (operation, input, options, status = 200, headers) => hivesResourceCall(client, operation, input, options, 'json', 2 * 1024 * 1024, 20_000, status, headers && { headers });
     const removed = (value) => { if (object(value).deleted !== true)
         throw invalid(); return { deleted: true }; };
     return {
@@ -64,10 +64,15 @@ export function hivesTopics(client) {
             async add(project, id, queueId, options) { const queue = hivesResourceId(queueId); return subscription(await call('hives_subscribe_native_topic', { ...ids(project, id), body: { queueId: queue } }, options, 201), project, id, queue); },
             async remove(project, id, subscriptionId, options) { return removed(await call('hives_unsubscribe_native_topic', { ...ids(project, id), subscription_id: hivesResourceId(subscriptionId) }, options)); },
         },
-        /** Persists one delivery per subscription atomically. Never retried after an unknown outcome. */
+        /** Persists one delivery per subscription atomically. Never retried after an unknown outcome. Carries one
+         * Idempotency-Key (options.idempotencyKey, or a fresh one); reuse that key only to replay this publication. */
         async publish(project, id, body, options) {
             publishInput(body);
-            const v = object(await call('hives_publish_native_topic', { ...ids(project, id), body }, options, 201));
+            const headers = hivesFundedWriteHeaders(options, 'hives_publish_native_topic');
+            const v = object(await call('hives_publish_native_topic', { ...ids(project, id), body }, options, 201, headers));
+            // A funded publication answers with its settled operation receipt, which carries the same publication fields.
+            if (v.object !== undefined && (v.object !== 'pubsub_publish_operation' || v.state !== 'settled'))
+                throw invalid();
             if (!Array.isArray(v.deliveries) || v.deliveries.length > 32)
                 throw invalid();
             const deliveries = v.deliveries.map(raw => { const d = object(raw); return { subscription_id: nativeId(d.subscription_id, 'sub'), queue_id: hivesResourceId(d.queue_id), message_id: hivesResourceId(d.message_id) }; });

package/dist/iam.d.ts

@@ -363,7 +363,13 @@ export declare function iamModule(client: GenesisClient): {
         next_cursor?: string | null;
     }>;
     tenantContext: () => Promise<{
-        tenant: import("./index.js").components["schemas"]["Iam.TenantContext"];
+        organizationId: string;
+        projectId: string;
+        platformId: string;
+        workspaceId?: string;
+        fleetId?: string;
+        organizationName?: string;
+        environmentId?: string;
     }>;
     checkPermission: (body: Body<"iam_checkPermission">) => Promise<{
         allowed: boolean;

package/dist/idempotency.js

@@ -15,6 +15,11 @@ export function idempotencyHeaders(operationId, key) {
             message: need === 'required' ? `${operationId} needs a stable idempotency key (8-128 printable ASCII characters)`
                 : need ? `${operationId} idempotency key must be 1-256 printable ASCII characters` : `${operationId} does not take an idempotency key` });
     }
+    // Zaps (spec IdempotencyKey, gateway key lane) admits only 8-128 printable characters, required or optional.
+    if (operationTable[operationId].service === 'zaps' && !REQUIRED.test(key)) {
+        throw new GenesisError({ status: 0, type: 'invalid_request', operationId,
+            message: `${operationId} idempotency key must be 8-128 printable ASCII characters` });
+    }
     // Auto takes 8-128 characters of [A-Za-z0-9_.:-] (its authority check); refuse anything it would 422 before sending.
     if (operationTable[operationId].service === 'auto' && !AUTO_KEY.test(key)) {
         throw new GenesisError({ status: 0, type: 'invalid_request', operationId,

package/dist/index.d.ts

@@ -2,7 +2,8 @@ export { Genesis, type ChatMessage } from './genesis.js';
 export { GenesisClient, DEFAULT_BASE_URL, type GenesisOptions, type CredentialProvider } from './client.js';
 export { iamDirectoryOperations, isIamDirectoryOperation, iamDirectoryFailure } from './iam-directory.js';
 export { iamModule } from './iam.js';
-export { GenesisError, errorCatalog, errorToken, errorOutcome } from './errors.js';
+export { GenesisError, errorCatalog, errorBody, errorToken, errorOutcome } from './errors.js';
+export { ERROR_BODY_LIMITS, cardNumber, redactErrorBody, redactErrorText, secretField } from './redact.js';
 export { requireSecureUrl } from './urls.js';
 export { operationTable, services, type OperationId } from './generated/operations.js';
 export type { OperationInput, OperationOutput, OperationMeta, ServiceMeta } from './types.js';
@@ -20,19 +21,20 @@ export { tapsModule } from './taps.js';
 export { lanesModule } from './lanes.js';
 export { flaresModule } from './flares.js';
 export { idempotencyHeaders, ifMatchHeaders } from './idempotency.js';
-export type { FlocksWriteOptions, WaitForJobOptions, FlocksJob } from './flocks.js';
+export type { FlocksWriteOptions, WaitForJobOptions, FlocksJob, FlocksRun } from './flocks.js';
 export { autoModule } from './auto.js';
 export { gardenModule } from './garden.js';
 export { orgsEntitiesModule, type OrgsDocumentContent } from './orgs.js';
 export { scopesModule } from './scopes.js';
 export { billingModule, gatewayModule, orgsModule } from './gateway.js';
+export { boxesModule } from './boxes.js';
 export { dialsModule, dialsEmergencyAddressFeedback, type DialsEmergencyAddressFeedback, type DialsScope, type DialsOutboundCall, type DialsCallControl, type DialsEmergencyAddress, type DialsCallListItem, type DialsCallDispatchState, type DialsMessage, type DialsMessageTemplate, type DialsMessagingBrand, type DialsMessagingCampaign, type DialsWorkflowDocument, type DialsRoutingAction, type DialsRoutingRule, type DialsRoutingRuleReceipt, type DialsOutboundCallReceipt, type DialsRecoveredOutboundCallReceipt } from './dials.js';
 export { hivesObjectKey, type HivesBucket, type HivesObject, type HivesObjectAcknowledgement, type HivesObjectList, type HivesCorsRule, type HivesCreateBucket, type HivesPresign, type HivesPresignedUrl } from './hives-cells.js';
 export { hivesSseEvents, hivesSseReader, type HivesLogStreamEvent, type HivesLogStreamQuery, type HivesLogWindow, type HivesLogWindowOptions } from './hives-platform.js';
 export { hivesQueueBody, type HivesQueue, type HivesQueueConfig, type HivesQueueCreate, type HivesQueueSend, type HivesQueueDelivery, type HivesDeadLetter, type HivesDeadLetterStats } from './hives-queues.js';
 export type { HivesRuntime, HivesRuntimeSelection } from './hives-runtimes.js';
 export type { HivesVolume, HivesVolumeCreate, HivesVolumeMount, HivesVolumePage } from './hives-volumes.js';
-export { HIVES_OBJECT_BYTES, HIVES_QUEUE_BYTES, type HivesResourceOptions } from './hives-resources-transport.js';
+export { HIVES_OBJECT_BYTES, HIVES_QUEUE_BYTES, type HivesResourceOptions, type HivesFundedWriteOptions } from './hives-resources-transport.js';
 export type { HivesMarketplacePackage, HivesMarketplaceVersion, HivesMarketplaceInstallation, HivesMarketplaceCategory, HivesMarketplacePage, HivesMarketplacePublish, HivesMarketplaceInstall, HivesMarketplaceSearch, HivesMarketplaceDetail } from './hives-marketplace.js';
 export type { HivesQueueConsumerConfig, HivesQueueConsumerBinding, HivesQueueConsumerAttempt, HivesQueueConsumerStatus } from './hives-queue-consumer.js';
 export { foundryBillingOperations, isFoundryBillingOperation } from './foundry-billing.js';

package/dist/index.js

@@ -2,7 +2,8 @@ export { Genesis } from './genesis.js';
 export { GenesisClient, DEFAULT_BASE_URL } from './client.js';
 export { iamDirectoryOperations, isIamDirectoryOperation, iamDirectoryFailure } from './iam-directory.js';
 export { iamModule } from './iam.js';
-export { GenesisError, errorCatalog, errorToken, errorOutcome } from './errors.js';
+export { GenesisError, errorCatalog, errorBody, errorToken, errorOutcome } from './errors.js';
+export { ERROR_BODY_LIMITS, cardNumber, redactErrorBody, redactErrorText, secretField } from './redact.js';
 export { requireSecureUrl } from './urls.js';
 export { operationTable, services } from './generated/operations.js';
 export { hivesUploadBody, MAX_WASM_BYTES } from './hives-upload.js';
@@ -21,6 +22,7 @@ export { gardenModule } from './garden.js';
 export { orgsEntitiesModule } from './orgs.js';
 export { scopesModule } from './scopes.js';
 export { billingModule, gatewayModule, orgsModule } from './gateway.js';
+export { boxesModule } from './boxes.js';
 export { dialsModule, dialsEmergencyAddressFeedback } from './dials.js';
 export { hivesObjectKey } from './hives-cells.js';
 export { hivesSseEvents, hivesSseReader } from './hives-platform.js';

package/dist/redact.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Redaction for service error bodies and messages before the CLI or MCP prints them. The design is
+ * conservative: when a key or value might be a secret, it is replaced with `[redacted]`. Field names are
+ * matched after normalisation (camelCase split, `-`/`.`/space to `_`, lower-cased), so `x-api-key`,
+ * `privateKey`, `Set-Cookie` and `client_secret` are all the same kind of name.
+ */
+export declare const REDACTED = "[redacted]";
+/** Bounds of the printed body: serialized bytes, per string, per array/object, nesting and the oversize preview. */
+export declare const ERROR_BODY_LIMITS: {
+    readonly bytes: 16384;
+    readonly string: 2048;
+    readonly items: 100;
+    readonly depth: 8;
+    readonly preview: 4096;
+};
+/** True when a field of this name may hold a secret. */
+export declare function secretField(key: string, value?: unknown): boolean;
+/** True when a run of 12 to 19 digits passes the Luhn check and could be a card number (a `1` prefix only for 15-digit UATP cards, so ms timestamps stay readable). */
+export declare function cardNumber(digits: string): boolean;
+/** A value that looks random (letters and digits, no separators, 16 or more characters): an authorization code, never an error code. */
+export declare const randomCode: (v: unknown) => boolean;
+/** Redacts secret forms in free text: an error message, a raw body or a string field. Control and invisible characters are removed first. */
+export declare function redactErrorText(text: string): string;
+/** True when an object looks like an OAuth token or authorize answer (so `code` may be an authorization code). */
+export declare const oauthShaped: (row: Record<string, unknown>) => boolean;
+/**
+ * True when the `code` of this object may be an authorization code: an OAuth-shaped object, a `code` beside an
+ * OAuth error token (`{error: "invalid_grant", code}`), or a random-looking value. `errorBody` redacts that `code`.
+ */
+export declare const authorizationCode: (row: Record<string, unknown>) => boolean;
+/**
+ * A redacted, bounded copy of an error body: secret-named fields (after key normalisation, glued names included),
+ * header pairs (`{name, value}` in any case, `[name, value]` tuples, flat `rawHeaders`, `Name: value` lines) and
+ * validation echoes of secret fields, OAuth authorization codes, card numbers (Luhn-checked) and other payment or
+ * personal data, Stripe client secrets, secret-shaped keys and values, and JSON nested in strings, escaped or not. A result still over 16 KiB serialized becomes `{truncated, bytes, preview}` of the redacted text.
+ */
+export declare function redactErrorBody(body: unknown): unknown;