@onesi/genesis 0.2.0 → 0.2.1

package/dist/boxes.js

@@ -0,0 +1,338 @@
+import { idempotencyHeaders } from './idempotency.js';
+/** Boxes (mail, docs, files, sheets, slides, calendar, identity, MCP): one method per operation, grouped as the
+ * Boxes resource tree. Path parameters come first, then the body, then query options, then an optional
+ * idempotency key on the operations that take one. Operations that stream or download bytes return the raw Response;
+ * uploads take a FormData body. GET needs boxes:read, everything else boxes:write. Generated from the Boxes spec. */
+export function boxesModule(client) {
+    return {
+        mail: {
+            addresses: {
+                create: (body) => client.request('boxes_mail_addresses_create', { body }),
+                list: () => client.request('boxes_mail_addresses_list'),
+            },
+            domains: {
+                addresses: {
+                    create: (domainId, body) => client.request('boxes_mail_domains_addresses_create', { "domain_id": domainId, body }),
+                },
+                create: (body) => client.request('boxes_mail_domains_create', { body }),
+                list: () => client.request('boxes_mail_domains_list'),
+                verify: (domainId) => client.request('boxes_mail_domains_verify', { "domain_id": domainId }),
+            },
+            inbox: {
+                list: (q = {}) => client.request('boxes_mail_inbox_list', { ...q }),
+            },
+            mailboxes: {
+                list: () => client.request('boxes_mail_mailboxes_list'),
+                delegations: {
+                    list: (mailboxId) => client.request('boxes_mail_mailboxes_delegations_list', { "mailbox_id": mailboxId }),
+                },
+            },
+            messages: {
+                get: (id) => client.request('boxes_mail_messages_get', { "id": id }),
+                delete: (id) => client.request('boxes_mail_messages_delete', { "id": id }),
+                update: (id, body) => client.request('boxes_mail_messages_update', { "id": id, body }),
+                attachments: {
+                    list: (messageId) => client.request('boxes_mail_messages_attachments_list', { "messageId": messageId }),
+                },
+                delivery: {
+                    get: (id) => client.request('boxes_mail_messages_delivery_get', { "id": id }),
+                },
+            },
+            send: (body, idempotencyKey) => client.request('boxes_mail_send', { body }, { headers: idempotencyHeaders('boxes_mail_send', idempotencyKey) }),
+            threads: {
+                get: (id) => client.request('boxes_mail_threads_get', { "id": id }),
+                list: (q = {}) => client.request('boxes_mail_threads_list', { ...q }),
+            },
+            agent: {
+                batchSend: (body, idempotencyKey) => client.request('boxes_mail_agent_batch_send', { body }, { headers: idempotencyHeaders('boxes_mail_agent_batch_send', idempotencyKey) }),
+                webhooks: {
+                    create: (body) => client.request('boxes_mail_agent_webhooks_create', { body }),
+                    list: () => client.request('boxes_mail_agent_webhooks_list'),
+                    delete: (id) => client.request('boxes_mail_agent_webhooks_delete', { "id": id }),
+                },
+                activities: {
+                    list: (q = {}) => client.request('boxes_mail_agent_activities_list', { ...q }),
+                },
+                state: {
+                    list: (q = {}) => client.request('boxes_mail_agent_state_list', { ...q }),
+                    update: (messageId, body) => client.request('boxes_mail_agent_state_update', { "messageId": messageId, body }),
+                },
+            },
+            attachments: {
+                content: {
+                    get: (id) => client.raw('boxes_mail_attachments_content_get', { "id": id }),
+                },
+                get: (id) => client.request('boxes_mail_attachments_get', { "id": id }),
+                delete: (id) => client.request('boxes_mail_attachments_delete', { "id": id }),
+                upload: (body) => client.request('boxes_mail_attachments_upload', { body }),
+            },
+            search: (q) => client.request('boxes_mail_search', { ...q }),
+            stream: {
+                sse: () => client.raw('boxes_mail_stream_sse'),
+            },
+            batch: (body) => client.request('boxes_mail_batch', { body }),
+            delegations: {
+                revoke: (delegationId) => client.request('boxes_mail_delegations_revoke', { "delegation_id": delegationId }),
+            },
+            extraction: {
+                message: {
+                    get: (messageId) => client.request('boxes_mail_extraction_message_get', { "message_id": messageId }),
+                },
+                thread: {
+                    get: (threadId) => client.request('boxes_mail_extraction_thread_get', { "thread_id": threadId }),
+                },
+            },
+            folders: {
+                create: (body) => client.request('boxes_mail_folders_create', { body }),
+                list: () => client.request('boxes_mail_folders_list'),
+            },
+            governance: {
+                audit: {
+                    list: (q = {}) => client.request('boxes_mail_governance_audit_list', { ...q }),
+                },
+            },
+            intelligence: {
+                thread: {
+                    get: (threadId) => client.request('boxes_mail_intelligence_thread_get', { "thread_id": threadId }),
+                },
+            },
+            labels: {
+                create: (body) => client.request('boxes_mail_labels_create', { body }),
+                list: () => client.request('boxes_mail_labels_list'),
+                delete: (id) => client.request('boxes_mail_labels_delete', { "id": id }),
+            },
+            memory: {
+                events: {
+                    submit: (body) => client.request('boxes_mail_memory_events_submit', { body }),
+                },
+                recall: (q) => client.request('boxes_mail_memory_recall', { ...q }),
+                search: (q) => client.request('boxes_mail_memory_search', { ...q }),
+                store: (body) => client.request('boxes_mail_memory_store', { body }),
+            },
+            personas: {
+                list: () => client.request('boxes_mail_personas_list'),
+            },
+            templates: {
+                list: () => client.request('boxes_mail_templates_list'),
+            },
+        },
+        files: {
+            list: (q = {}) => client.request('boxes_files_list', { ...q }),
+            search: (q) => client.request('boxes_files_search', { ...q }),
+            recent: {
+                list: (q = {}) => client.request('boxes_files_recent_list', { ...q }),
+            },
+            trash: {
+                list: (q = {}) => client.request('boxes_files_trash_list', { ...q }),
+            },
+            sharedWithMe: {
+                list: (q = {}) => client.request('boxes_files_shared_with_me_list', { ...q }),
+            },
+            upload: (body) => client.request('boxes_files_upload', { body }),
+            folders: {
+                create: (body) => client.request('boxes_files_folders_create', { body }),
+            },
+            get: (id) => client.request('boxes_files_get', { "id": id }),
+            update: (id, body) => client.request('boxes_files_update', { "id": id, body }),
+            delete: (id) => client.request('boxes_files_delete', { "id": id }),
+            download: (id) => client.raw('boxes_files_download', { "id": id }),
+            restore: (id) => client.request('boxes_files_restore', { "id": id }),
+            purge: (id) => client.request('boxes_files_purge', { "id": id }),
+            share: (id, body) => client.request('boxes_files_share', { "id": id, body }),
+            shares: {
+                list: (id) => client.request('boxes_files_shares_list', { "id": id }),
+            },
+            unshare: (id, shareId) => client.request('boxes_files_unshare', { "id": id, "share_id": shareId }),
+        },
+        docs: {
+            documents: {
+                list: (q = {}) => client.request('boxes_docs_documents_list', { ...q }),
+                create: (body) => client.request('boxes_docs_documents_create', { body }),
+                get: (id) => client.request('boxes_docs_documents_get', { "id": id }),
+                update: (id, body) => client.request('boxes_docs_documents_update', { "id": id, body }),
+                delete: (id) => client.request('boxes_docs_documents_delete', { "id": id }),
+                purge: (id) => client.request('boxes_docs_documents_purge', { "id": id }),
+                versions: {
+                    list: (id, q = {}) => client.request('boxes_docs_documents_versions_list', { "id": id, ...q }),
+                },
+                share: (id, body) => client.request('boxes_docs_documents_share', { "id": id, body }),
+                shares: {
+                    list: (id) => client.request('boxes_docs_documents_shares_list', { "id": id }),
+                },
+                unshare: (id, shareId) => client.request('boxes_docs_documents_unshare', { "id": id, "share_id": shareId }),
+                collaborators: {
+                    list: (id) => client.request('boxes_docs_documents_collaborators_list', { "id": id }),
+                },
+                presence: {
+                    update: (id, body) => client.request('boxes_docs_documents_presence_update', { "id": id, body }),
+                },
+                operations: {
+                    list: (id, q = {}) => client.request('boxes_docs_documents_operations_list', { "id": id, ...q }),
+                    apply: (id, body) => client.request('boxes_docs_documents_operations_apply', { "id": id, body }),
+                },
+                events: {
+                    stream: (id, q = {}) => client.raw('boxes_docs_documents_events_stream', { "id": id, ...q }),
+                },
+            },
+            folders: {
+                create: (body) => client.request('boxes_docs_folders_create', { body }),
+            },
+            search: (q) => client.request('boxes_docs_search', { ...q }),
+            recent: {
+                list: (q = {}) => client.request('boxes_docs_recent_list', { ...q }),
+            },
+            trash: {
+                list: (q = {}) => client.request('boxes_docs_trash_list', { ...q }),
+            },
+            templates: {
+                list: (q = {}) => client.request('boxes_docs_templates_list', { ...q }),
+            },
+            sharedWithMe: {
+                list: (q = {}) => client.request('boxes_docs_shared_with_me_list', { ...q }),
+            },
+            mcp: {
+                action: (action, body) => client.request('boxes_docs_mcp_action', { "action": action, body }),
+            },
+        },
+        sheets: {
+            cells: {
+                batch: (id, tabId, body) => client.request('boxes_sheets_cells_batch', { "id": id, "tab_id": tabId, body }),
+                delete: (id, tabId, row, col) => client.request('boxes_sheets_cells_delete', { "id": id, "tab_id": tabId, "row": row, "col": col }),
+                get: (id, tabId, row, col) => client.request('boxes_sheets_cells_get', { "id": id, "tab_id": tabId, "row": row, "col": col }),
+                list: (id, tabId, q = {}) => client.request('boxes_sheets_cells_list', { "id": id, "tab_id": tabId, ...q }),
+                set: (id, tabId, body) => client.request('boxes_sheets_cells_set', { "id": id, "tab_id": tabId, body }),
+                query: (id, tabId, q) => client.request('boxes_sheets_cells_query', { "id": id, "tab_id": tabId, ...q }),
+                range: {
+                    get: (id, tabId, q) => client.request('boxes_sheets_cells_range_get', { "id": id, "tab_id": tabId, ...q }),
+                },
+            },
+            search: (q) => client.request('boxes_sheets_search', { ...q }),
+            sharedWithMe: {
+                list: (q = {}) => client.request('boxes_sheets_shared_with_me_list', { ...q }),
+            },
+            spreadsheets: {
+                create: (body) => client.request('boxes_sheets_spreadsheets_create', { body }),
+                list: (q = {}) => client.request('boxes_sheets_spreadsheets_list', { ...q }),
+                delete: (id) => client.request('boxes_sheets_spreadsheets_delete', { "id": id }),
+                get: (id) => client.request('boxes_sheets_spreadsheets_get', { "id": id }),
+                update: (id, body) => client.request('boxes_sheets_spreadsheets_update', { "id": id, body }),
+                purge: (id) => client.request('boxes_sheets_spreadsheets_purge', { "id": id }),
+                share: (id, body) => client.request('boxes_sheets_spreadsheets_share', { "id": id, body }),
+                shares: {
+                    list: (id) => client.request('boxes_sheets_spreadsheets_shares_list', { "id": id }),
+                },
+                unshare: (id, shareId) => client.request('boxes_sheets_spreadsheets_unshare', { "id": id, "share_id": shareId }),
+            },
+            tabs: {
+                create: (id, body) => client.request('boxes_sheets_tabs_create', { "id": id, body }),
+                list: (id) => client.request('boxes_sheets_tabs_list', { "id": id }),
+                delete: (id, tabId) => client.request('boxes_sheets_tabs_delete', { "id": id, "tab_id": tabId }),
+                get: (id, tabId) => client.request('boxes_sheets_tabs_get', { "id": id, "tab_id": tabId }),
+                update: (id, tabId, body) => client.request('boxes_sheets_tabs_update', { "id": id, "tab_id": tabId, body }),
+            },
+        },
+        slides: {
+            presentations: {
+                create: (body) => client.request('boxes_slides_presentations_create', { body }),
+                list: (q = {}) => client.request('boxes_slides_presentations_list', { ...q }),
+                delete: (id) => client.request('boxes_slides_presentations_delete', { "id": id }),
+                get: (id) => client.request('boxes_slides_presentations_get', { "id": id }),
+                update: (id, body) => client.request('boxes_slides_presentations_update', { "id": id, body }),
+                share: (id, body) => client.request('boxes_slides_presentations_share', { "id": id, body }),
+                sharedWithMe: {
+                    list: (q = {}) => client.request('boxes_slides_presentations_shared_with_me_list', { ...q }),
+                },
+                shares: {
+                    list: (id) => client.request('boxes_slides_presentations_shares_list', { "id": id }),
+                },
+                unshare: (id, shareId) => client.request('boxes_slides_presentations_unshare', { "id": id, "share_id": shareId }),
+            },
+            slides: {
+                create: (presentationId, body) => client.request('boxes_slides_slides_create', { "presentation_id": presentationId, body }),
+                list: (presentationId) => client.request('boxes_slides_slides_list', { "presentation_id": presentationId }),
+                delete: (presentationId, slideId) => client.request('boxes_slides_slides_delete', { "presentation_id": presentationId, "slide_id": slideId }),
+                get: (presentationId, slideId) => client.request('boxes_slides_slides_get', { "presentation_id": presentationId, "slide_id": slideId }),
+                update: (presentationId, slideId, body) => client.request('boxes_slides_slides_update', { "presentation_id": presentationId, "slide_id": slideId, body }),
+                reorder: (presentationId, slideId, body) => client.request('boxes_slides_slides_reorder', { "presentation_id": presentationId, "slide_id": slideId, body }),
+            },
+            templates: {
+                create: (body) => client.request('boxes_slides_templates_create', { body }),
+                list: (q = {}) => client.request('boxes_slides_templates_list', { ...q }),
+                delete: (id) => client.request('boxes_slides_templates_delete', { "id": id }),
+                get: (id) => client.request('boxes_slides_templates_get', { "id": id }),
+                update: (id, body) => client.request('boxes_slides_templates_update', { "id": id, body }),
+            },
+        },
+        calendar: {
+            availability: {
+                get: (q) => client.request('boxes_calendar_availability_get', { ...q }),
+            },
+            calendars: {
+                create: (body) => client.request('boxes_calendar_calendars_create', { body }),
+                list: () => client.request('boxes_calendar_calendars_list'),
+                delete: (id) => client.request('boxes_calendar_calendars_delete', { "id": id }),
+                get: (id) => client.request('boxes_calendar_calendars_get', { "id": id }),
+                update: (id, body) => client.request('boxes_calendar_calendars_update', { "id": id, body }),
+            },
+            events: {
+                attendees: {
+                    list: (id) => client.request('boxes_calendar_events_attendees_list', { "id": id }),
+                },
+                create: (body) => client.request('boxes_calendar_events_create', { body }),
+                list: (q = {}) => client.request('boxes_calendar_events_list', { ...q }),
+                delete: (id) => client.request('boxes_calendar_events_delete', { "id": id }),
+                get: (id) => client.request('boxes_calendar_events_get', { "id": id }),
+                update: (id, body) => client.request('boxes_calendar_events_update', { "id": id, body }),
+                rsvp: (id, body) => client.request('boxes_calendar_events_rsvp', { "id": id, body }),
+                search: (q) => client.request('boxes_calendar_events_search', { ...q }),
+            },
+            schedulingLinks: {
+                book: (id, body) => client.request('boxes_calendar_scheduling_links_book', { "id": id, body }),
+                bySlug: {
+                    get: (slug) => client.request('boxes_calendar_scheduling_links_by_slug_get', { "slug": slug }),
+                },
+                create: (body) => client.request('boxes_calendar_scheduling_links_create', { body }),
+                list: () => client.request('boxes_calendar_scheduling_links_list'),
+                delete: (id) => client.request('boxes_calendar_scheduling_links_delete', { "id": id }),
+                get: (id) => client.request('boxes_calendar_scheduling_links_get', { "id": id }),
+                update: (id, body) => client.request('boxes_calendar_scheduling_links_update', { "id": id, body }),
+            },
+        },
+        identity: {
+            me: {
+                get: () => client.request('boxes_identity_me_get'),
+            },
+            tenants: {
+                current: {
+                    get: () => client.request('boxes_identity_tenants_current_get'),
+                },
+            },
+            users: {
+                get: (id) => client.request('boxes_identity_users_get', { "id": id }),
+                list: (q = {}) => client.request('boxes_identity_users_list', { ...q }),
+            },
+            workspaces: {
+                list: (q = {}) => client.request('boxes_identity_workspaces_list', { ...q }),
+                get: (id) => client.request('boxes_identity_workspaces_get', { "id": id }),
+                members: {
+                    list: (id) => client.request('boxes_identity_workspaces_members_list', { "id": id }),
+                },
+            },
+        },
+        mcp: {
+            sessions: {
+                context: {
+                    set: (sessionId, body) => client.request('boxes_mcp_sessions_context_set', { "session_id": sessionId, body }),
+                },
+                create: (body) => client.request('boxes_mcp_sessions_create', { body }),
+                list: () => client.request('boxes_mcp_sessions_list'),
+                delete: (sessionId) => client.request('boxes_mcp_sessions_delete', { "session_id": sessionId }),
+                get: (sessionId) => client.request('boxes_mcp_sessions_get', { "session_id": sessionId }),
+            },
+            tools: {
+                call: (body) => client.request('boxes_mcp_tools_call', { body }),
+                list: () => client.request('boxes_mcp_tools_list'),
+            },
+        },
+    };
+}

package/dist/client.js

@@ -97,7 +97,7 @@ export class GenesisClient {
         if (operationTable[operationId].rawResponse)
             return res;
         // DELETE /env answers 200 with an empty body.
-        if (operationId === 'hives_delete_project_env') {
+        if (operationId === 'hives_delete_project_env' || operationId === 'hives_delete_project_env_key') {
             void res.body?.cancel().catch(() => { });
             return undefined;
         }
@@ -183,11 +183,13 @@ export class GenesisClient {
             input = { ...input, body: validateHivesEnvironment(input.body) };
         if (operationId === 'hives_delete_project_env')
             input = { ...input, body: validateHivesEnvironmentNames(input.body) };
+        if (operationId === 'hives_delete_project_env_key')
+            validateHivesEnvironmentNames([input.key]);
         const objectBody = isHivesObjectUpload(operationId) ? await hivesObjectBody(input.body) : undefined;
         const url = this.url(operationId, input);
         const headers = {
             accept: 'application/json',
-            'user-agent': this.opts.userAgent ?? '@onesi/genesis/0.2.0',
+            'user-agent': this.opts.userAgent ?? '@onesi/genesis/0.2.1',
             ...this.opts.headers, ...init.headers,
         };
         if (op.service === 'blinds' && !['GET', 'HEAD', 'OPTIONS'].includes(op.method))
@@ -245,7 +247,7 @@ export class GenesisClient {
                 body = JSON.stringify(input.body);
             }
         }
-        const environmentOperation = op.service === 'hives' && /_project_env(?:ironment)?$/.test(operationId);
+        const environmentOperation = op.service === 'hives' && /_project_env(?:ironment|_key)?$/.test(operationId);
         const secretOperation = op.service === 'hives' && (/_secrets?$/.test(operationId) || environmentOperation);
         const functionOperation = op.service === 'hives' && (op.rawResponse || /_function(?:s|_async)?$/.test(operationId));
         let res;
@@ -291,7 +293,7 @@ export class GenesisClient {
             throw new GenesisError({ status: res.status, type: 'invalid_response', operationId,
                 message: 'Hives operation status was not confirmed. Keep the original idempotency key and reconcile its operation.' });
         }
-        if (op.rawResponse && res.ok)
+        if (op.rawResponse && op.service === 'hives' && res.ok)
             throw new GenesisError({ status: res.status, type: 'invalid_response', operationId,
                 message: 'Hives did not confirm a completed guest execution. Keep the original invocation key and reconcile its operation.' });
         if (functionOperation && !res.ok) {

package/dist/errors.d.ts

@@ -33,3 +33,9 @@ export declare function errorOutcome(body: unknown): string | undefined;
 /** Optional fields the gateway adds to an envelope; each must be a bounded string when present. */
 export declare const ENVELOPE_EXTRA_FIELDS: readonly string[];
 export declare const envelopeExtrasValid: (error: Record<string, unknown>) => boolean;
+/**
+ * The service's error body as the CLI (`--json`) and MCP print it beside the envelope, redacted and bounded
+ * by `redactErrorBody` (see redact.ts). Undefined when the SDK kept no body: it deliberately drops bodies
+ * that may echo submitted secrets or guest data (Hives secret and function refusals).
+ */
+export declare function errorBody(e: GenesisError): unknown;

package/dist/errors.js

@@ -1,3 +1,4 @@
+import { authorizationCode, redactErrorBody } from './redact.js';
 /** Normalized error for every Genesis service (gateway `{error:{type,message}}`, IAM `{error,error_description}`, Relays `{error}`, Foundry/OpenAI shape). */
 export class GenesisError extends Error {
     status;
@@ -25,15 +26,41 @@ export class GenesisError extends Error {
         // An OAuth-style token (`{"error":"forbidden"}`) is the type; any other string is a message, and type stays a stable token.
         const type = typeof e === 'object' && e ? (e.type ?? e.code ?? 'error')
             : typeof e === 'string' && /^[a-z][a-z0-9_]{0,63}$/.test(e) ? e : statusType(res.status);
+        const code = backendCode(body);
         const message = (typeof e === 'object' && e?.message) || body?.error_description || body?.message ||
-            (typeof e === 'string' && e) || (typeof body === 'string' && body) || `${res.status} ${res.statusText}`;
+            (typeof e === 'string' && e) || (typeof body === 'string' && body) || `${res.status} ${res.statusText}${code ? ` (${code})` : ''}`;
         return new GenesisError({
-            status: res.status, type, message, code: typeof e === 'object' ? e?.code : undefined,
+            status: res.status, type, message, code,
             requestId: [typeof e === 'object' ? e?.request_id : undefined, body?.request_id, res.headers.get('x-request-id')].find((v) => typeof v === 'string' && v !== ''),
             operationId, body,
         });
     }
 }
+const CODE_TOKEN = /^[A-Za-z][A-Za-z0-9_.:-]{0,63}$/;
+/** A refusal code is one case (`release_not_proven_safe`, `HARNESS_NOT_ON_NODE`), never a mixed-case random string. */
+const ONE_CASE = /^(?:[a-z][a-z0-9_.:-]*|[A-Z][A-Z0-9_.:-]*)$/;
+/**
+ * The refusal code of an error body. The envelope's `error.code` wins, unless it is only the gateway's generic
+ * `UPSTREAM_<status>`; otherwise the backend's own top-level `code`, which the gateway keeps beside its envelope
+ * or passes through unwrapped (Hives `{"code":"release_not_proven_safe",...}` on a 409 release).
+ *
+ * Accepting a top-level `code` here is deliberate and differs from the Hives function/invocation error path
+ * (`hivesErrorDetail` in client.ts), which rejects it because there a top-level `code` belongs to an operation
+ * receipt. A top-level `code` can also be an OAuth authorization code echoed by an authorize/token answer, so
+ * it is not taken when the body looks like one (`redirect_uri`, `access_token`, `iss`...), beside any string
+ * `error`, when the value looks random, or when it is not a one-case code. `errorBody` redacts that `code` in an
+ * OAuth-shaped body, beside an OAuth error token (`{error: "invalid_grant", code}`) and when it looks random
+ * (16 or more letters and digits). Any other refused `code`, such as one beside a non-OAuth string `error`, is
+ * printed in the body but never reported as the error code.
+ */
+function backendCode(body) {
+    if (!row(body))
+        return undefined;
+    const envelope = row(body.error) && typeof body.error.code === 'string' && body.error.code !== '' ? body.error.code : undefined;
+    const own = typeof body.code === 'string' && CODE_TOKEN.test(body.code) && ONE_CASE.test(body.code)
+        && typeof body.error !== 'string' && !authorizationCode(body) ? body.code : undefined;
+    return envelope !== undefined && !(own && /^UPSTREAM_\d{3}$/.test(envelope)) ? envelope : own;
+}
 const statusType = (s) => s === 401 ? 'unauthorized' : s === 403 ? 'forbidden' : s === 404 ? 'not_found' : s === 429 ? 'rate_limited' : s >= 500 ? 'upstream_error' : 'error';
 /** The gateway catalog fields of an error, for JSON output: `code`, `required_scope` and `docs_url` when the gateway sent them. */
 export function errorCatalog(e) {
@@ -64,3 +91,11 @@ export function errorOutcome(body) {
 /** Optional fields the gateway adds to an envelope; each must be a bounded string when present. */
 export const ENVELOPE_EXTRA_FIELDS = ['type', 'message', 'docs_url', 'layer', 'reason', 'required_scope'];
 export const envelopeExtrasValid = (error) => ENVELOPE_EXTRA_FIELDS.every(name => error[name] === undefined || typeof error[name] === 'string' && error[name].length <= 2048);
+/**
+ * The service's error body as the CLI (`--json`) and MCP print it beside the envelope, redacted and bounded
+ * by `redactErrorBody` (see redact.ts). Undefined when the SDK kept no body: it deliberately drops bodies
+ * that may echo submitted secrets or guest data (Hives secret and function refusals).
+ */
+export function errorBody(e) {
+    return redactErrorBody(e.body);
+}

package/dist/flocks.d.ts

@@ -11,6 +11,7 @@ export interface WaitForJobOptions {
     onUpdate?: (job: FlocksJob) => void;
 }
 export type FlocksJob = OperationOutput<'flocks_getAccountJob'>;
+export type FlocksRun = OperationOutput<'flocks_getRun'>;
 /** Org scope comes from the One account credential verified by the gateway. */
 export declare function flocksModule(client: GenesisClient): {
     readiness: {
@@ -35,6 +36,12 @@ export declare function flocksModule(client: GenesisClient): {
             accounts?: import("./index.js").components["schemas"]["Flocks.HeartbeatAccount"][];
             accounts_supported?: boolean;
         }[]>;
+        /** One node's presence (online, heartbeat age, harnesses) and a page of the runs recorded on it, newest first. */
+        activity: (id: string, query?: Omit<OperationInput<"flocks_getNodeActivity">, "id">) => Promise<{
+            node: import("./index.js").components["schemas"]["Flocks.NodePresence"];
+            items: import("./index.js").components["schemas"]["Flocks.Run"][];
+            next_cursor: string | null;
+        }>;
         rename: (id: string, nickname: string) => Promise<{
             id: string;
             name: string;
@@ -205,7 +212,34 @@ export declare function flocksModule(client: GenesisClient): {
             owner_subject?: string;
             created_at: number;
             updated_at: number;
+            inference_account_id: string | null;
+            account_owner_org: string | null;
+            grantee_org: string | null;
+            run_seconds: number | null;
         }>;
+        /** Starts a run of an agent (202 Run). `node_id` overrides the agent's pinned node for this run. */
+        create: (agent_id: string, body: OperationInput<"flocks_createRun">["body"], o?: {
+            signal?: AbortSignal;
+        }) => Promise<{
+            id: string;
+            agent_id: string;
+            harness: string;
+            node_id: string | null;
+            task: string;
+            state: "pending" | "running" | "completed" | "failed";
+            error_code: string | null;
+            owner_subject?: string;
+            created_at: number;
+            updated_at: number;
+            inference_account_id: string | null;
+            account_owner_org: string | null;
+            grantee_org: string | null;
+            run_seconds: number | null;
+        }>;
+        /** Polls a run until it is completed or failed. Rejects with a timeout error after `timeoutMs` (default 30 minutes). */
+        wait: (run_id: string, o?: WaitForJobOptions & {
+            onUpdate?: (run: FlocksRun) => void;
+        }) => Promise<FlocksRun>;
     };
     joinTokens: {
         exchange: (body: OperationInput<"flocks_exchangeJoinToken">["body"]) => Promise<{
@@ -262,6 +296,21 @@ export declare function flocksModule(client: GenesisClient): {
             updated_at: number;
             bound_instances?: number;
         }>;
+        /** Owner only: clears the recorded identity (the next verified switch on one of your own instances records it again). */
+        resetIdentity: (id: string, o?: FlocksWriteOptions) => Promise<{
+            id: string;
+            provider: string;
+            label: string;
+            auth_kind: "subscription_oauth" | "api_key";
+            identity: string | null;
+            status: "pending_login" | "active" | "needs_login" | "revoked" | "deleted";
+            owner_org: string;
+            granted: boolean;
+            created_by: string;
+            created_at: number;
+            updated_at: number;
+            bound_instances?: number;
+        }>;
         /** Signs the account out of every bound instance, then revokes the credential. Returns { account, job_id }. */
         delete: (id: string, o?: FlocksWriteOptions) => Promise<{
             account: import("./index.js").components["schemas"]["Flocks.Account"];

package/dist/flocks.js

@@ -1,4 +1,14 @@
 import { GenesisError } from './errors.js';
+/** Sleeps `ms`, rejecting early on abort; the abort listener is removed when the timer fires. */
+function pause(ms, signal) {
+    return new Promise((resolve, reject) => {
+        const onAbort = () => { clearTimeout(t); reject(signal.reason ?? new Error('aborted')); };
+        const t = setTimeout(() => { signal?.removeEventListener('abort', onAbort); resolve(); }, ms);
+        if (signal?.aborted)
+            return onAbort();
+        signal?.addEventListener('abort', onAbort, { once: true });
+    });
+}
 /** Org scope comes from the One account credential verified by the gateway. */
 export function flocksModule(client) {
     const nodePath = (id) => ({ id });
@@ -10,6 +20,8 @@ export function flocksModule(client) {
         },
         nodes: {
             list: () => client.request('flocks_listNodes'),
+            /** One node's presence (online, heartbeat age, harnesses) and a page of the runs recorded on it, newest first. */
+            activity: (id, query = {}) => client.request('flocks_getNodeActivity', { id, ...query }),
             rename: (id, nickname) => client.request('flocks_renameNode', { ...nodePath(id), body: { nickname } }),
             /** Set an instance nickname and/or labels (the label key `flock` groups instances). */
             update: (id, body) => client.request('flocks_renameNode', { ...nodePath(id), body }),
@@ -39,6 +51,21 @@ export function flocksModule(client) {
         runs: {
             list: (query = {}) => client.request('flocks_listRuns', query),
             get: (run_id) => client.request('flocks_getRun', { run_id }),
+            /** Starts a run of an agent (202 Run). `node_id` overrides the agent's pinned node for this run. */
+            create: (agent_id, body, o = {}) => client.request('flocks_createRun', { agent_id, body }, o.signal ? { signal: o.signal } : undefined),
+            /** Polls a run until it is completed or failed. Rejects with a timeout error after `timeoutMs` (default 30 minutes). */
+            wait: async (run_id, o = {}) => {
+                const interval = o.intervalMs ?? 2000, deadline = Date.now() + (o.timeoutMs ?? 1_800_000);
+                for (;;) {
+                    const run = await client.request('flocks_getRun', { run_id }, o.signal ? { signal: o.signal } : undefined);
+                    o.onUpdate?.(run);
+                    if (run.state === 'completed' || run.state === 'failed')
+                        return run;
+                    if (Date.now() + interval > deadline)
+                        throw new GenesisError({ status: 0, type: 'timeout', operationId: 'flocks_getRun', message: `Run ${run_id} was still ${run.state} after ${o.timeoutMs ?? 1_800_000} ms; poll runs.get again.` });
+                    await pause(interval, o.signal);
+                }
+            },
         },
         joinTokens: {
             exchange: (body) => client.request('flocks_exchangeJoinToken', { body }),
@@ -53,6 +80,8 @@ export function flocksModule(client) {
             list: (query = {}) => client.request('flocks_listAccounts', query),
             create: (body, o) => write('flocks_createAccount', { body }, o),
             get: (id) => client.request('flocks_getAccount', { id }),
+            /** Owner only: clears the recorded identity (the next verified switch on one of your own instances records it again). */
+            resetIdentity: (id, o) => write('flocks_resetAccountIdentity', { id }, o),
             /** Signs the account out of every bound instance, then revokes the credential. Returns { account, job_id }. */
             delete: (id, o) => write('flocks_deleteAccount', { id }, o),
             /** Starts a login on one of your instances; the device url and code appear on the job item for you only. */
@@ -87,10 +116,7 @@ export function flocksModule(client) {
                         return job;
                     if (Date.now() + interval > deadline)
                         throw new GenesisError({ status: 0, type: 'timeout', operationId: 'flocks_getAccountJob', message: `Job ${id} was still running after ${o.timeoutMs ?? 600_000} ms; poll jobs.get again.` });
-                    await new Promise((resolve, reject) => {
-                        const t = setTimeout(resolve, interval);
-                        o.signal?.addEventListener('abort', () => { clearTimeout(t); reject(o.signal.reason ?? new Error('aborted')); }, { once: true });
-                    });
+                    await pause(interval, o.signal);
                 }
             },
         },

package/dist/foundry.d.ts

@@ -70,6 +70,11 @@ export declare function foundryModule(client: GenesisClient): {
         verificationKey: () => Promise<{
             [key: string]: unknown;
         }>;
+        /** Public: the current key plus the retired keys that still verify receipts signed before a rotation. */
+        verificationKeys: () => Promise<{
+            current: import("./index.js").components["schemas"]["Foundry.ReceiptVerificationKey"];
+            retired: import("./index.js").components["schemas"]["Foundry.ReceiptVerificationKey"][];
+        }>;
     };
     keys: {
         list: () => Promise<{

package/dist/foundry.js

@@ -20,6 +20,8 @@ export function foundryModule(client) {
             get: (receipt_id) => client.request('foundry_getGenerationReceipt', { receipt_id }),
             byRequest: (request_id) => client.request('foundry_getGenerationReceiptByRequest', { request_id }),
             verificationKey: () => client.request('foundry_getReceiptVerificationKey'),
+            /** Public: the current key plus the retired keys that still verify receipts signed before a rotation. */
+            verificationKeys: () => client.request('foundry_listReceiptVerificationKeys'),
         },
         keys: {
             list: () => client.request('foundry_listApiKeys'),