@onesi/genesis 0.2.3 → 0.2.5

package/dist/hives-project.d.ts

@@ -0,0 +1,18 @@
+import { GenesisError } from './errors.js';
+import type { OperationMeta } from './types.js';
+/** The one description of a Hives `project_id` (spec, CLI help and MCP schemas). */
+export declare const HIVES_PROJECT_ID_DESCRIPTION = "Hives project id (prj_\u2026)";
+/** Appended where an omitted project_id resolves from the selected Genesis context. */
+export declare const HIVES_PROJECT_ID_DEFAULT = "omit it to use the Hives project bound to your selected Genesis context";
+/** A Genesis project id (`pr_…`). A Hives project id is `prj_…`, so the two never collide. */
+export declare const isGenesisProjectId: (value: unknown) => value is string;
+/** Hives operations addressed by a Hives project in their path. */
+export declare const isHivesProjectOperation: (op: OperationMeta | undefined) => boolean;
+/** A Genesis pr_… id given where Hives wants its own prj_… id: refused before any request. */
+export declare function hivesProjectIdRefusal(value: string, operationId?: string): GenesisError;
+/**
+ * Map a Hives project argument to a Hives project id. A prj_… (or any non-Genesis) value is returned unchanged.
+ * Omitted, or a Genesis pr_… id that is the selected context's project, resolves to that selection's Hives binding
+ * read from `hives_get_context_project`; anything else is refused with how to find the prj_… id.
+ */
+export declare function resolveHivesProjectId(value: unknown, readContext: () => Promise<unknown>): Promise<string>;

package/dist/hives-project.js

@@ -0,0 +1,51 @@
+import { GenesisError } from './errors.js';
+/** The one description of a Hives `project_id` (spec, CLI help and MCP schemas). */
+export const HIVES_PROJECT_ID_DESCRIPTION = 'Hives project id (prj_…)';
+/** Appended where an omitted project_id resolves from the selected Genesis context. */
+export const HIVES_PROJECT_ID_DEFAULT = 'omit it to use the Hives project bound to your selected Genesis context';
+/** A Genesis project id (`pr_…`). A Hives project id is `prj_…`, so the two never collide. */
+export const isGenesisProjectId = (value) => typeof value === 'string' && /^pr_[A-Za-z0-9]{1,124}$/.test(value);
+const HIVES_PROJECT = /^prj_[A-Za-z0-9]{1,124}$/;
+/** Hives operations addressed by a Hives project in their path. */
+export const isHivesProjectOperation = (op) => op?.service === 'hives' && op.pathParams.includes('project_id');
+const FIND = 'Find the Hives project bound to your selected Genesis context with `genesis hives context get` (SDK: genesis.hives.resolveProject()), or list Hives projects with `genesis hives projects list`.';
+/** A Genesis pr_… id given where Hives wants its own prj_… id: refused before any request. */
+export function hivesProjectIdRefusal(value, operationId) {
+    return new GenesisError({ status: 0, type: 'invalid_request', code: 'HIVES_PROJECT_ID_REQUIRED', operationId,
+        message: `${value} is a Genesis project id. Hives operations take a Hives project id (prj_…). ${FIND}` });
+}
+const notBound = (message, from) => new GenesisError({ status: from?.status ?? 0, type: 'invalid_request', code: 'HIVES_PROJECT_NOT_BOUND',
+    message, requestId: from?.requestId, operationId: 'hives_get_context_project' });
+/**
+ * Map a Hives project argument to a Hives project id. A prj_… (or any non-Genesis) value is returned unchanged.
+ * Omitted, or a Genesis pr_… id that is the selected context's project, resolves to that selection's Hives binding
+ * read from `hives_get_context_project`; anything else is refused with how to find the prj_… id.
+ */
+export async function resolveHivesProjectId(value, readContext) {
+    if (value !== undefined && value !== null && value !== '' && !isGenesisProjectId(value)) {
+        if (typeof value !== 'string')
+            throw new GenesisError({ status: 0, type: 'invalid_request', code: 'HIVES_PROJECT_ID_REQUIRED', message: `project_id must be a ${HIVES_PROJECT_ID_DESCRIPTION}.` });
+        return value;
+    }
+    let context;
+    try {
+        context = await readContext();
+    }
+    catch (e) {
+        if (!(e instanceof GenesisError) || ![404, 409].includes(e.status))
+            throw e;
+        const named = isGenesisProjectId(value) ? `${value} is a Genesis project id and ` : '';
+        throw notBound(e.status === 404
+            ? `${named}No Hives project is bound to your selected Genesis context. Bind one with \`genesis hives context create <name>\` or \`genesis hives context link <prj_…>\`, or pass a Hives project id (prj_…) from \`genesis hives projects list\`.`
+            : `${named}No Genesis project is selected. Select an organization, workspace and project with \`genesis context select\`, or pass a Hives project id (prj_…) from \`genesis hives projects list\`.`, e);
+    }
+    const row = context && typeof context === 'object' ? context : {};
+    const selected = row.selectedContext?.projectId, bound = row.binding?.hivesProjectId;
+    if (typeof bound !== 'string' || !HIVES_PROJECT.test(bound) || typeof selected !== 'string') {
+        throw new GenesisError({ status: 0, type: 'invalid_response', operationId: 'hives_get_context_project', message: 'Hives returned an invalid context binding.' });
+    }
+    if (isGenesisProjectId(value) && value !== selected) {
+        throw notBound(`${value} is a Genesis project id, and it is not your selected Genesis project (${selected}, bound to Hives project ${bound}). Select it with \`genesis context select\`, or pass its Hives project id (prj_…) from \`genesis hives projects list\`.`);
+    }
+    return bound;
+}

package/dist/idempotency.js

@@ -2,7 +2,7 @@ import { GenesisError } from './errors.js';
 import { operationTable } from './generated/operations.js';
 const REQUIRED = /^[\x21-\x7e]{8,128}$/;
 const OPTIONAL = /^[\x21-\x7e]{1,256}$/;
-/** Auto's Idempotency-Key grammar (l1felabs/auto src/operating.ts IDEMPOTENCY_KEY). */
+/** Auto's Idempotency-Key grammar (l1felabs/auto src/operating.ts IDEMPOTENCY_KEY); Foundry feedback uses the same. */
 const AUTO_KEY = /^[A-Za-z0-9_.:-]{8,128}$/;
 /** The Idempotency-Key header an operation's spec declares. A required key is refused locally when missing
  * or malformed, before any request is sent; reuse the same key to replay instead of acting twice. */
@@ -25,6 +25,11 @@ export function idempotencyHeaders(operationId, key) {
         throw new GenesisError({ status: 0, type: 'invalid_request', operationId,
             message: `${operationId} idempotency key must be 8-128 characters of A-Z a-z 0-9 _ . : -` });
     }
+    // Foundry generation feedback takes [A-Za-z0-9_.:-] only (openrouter_generations.rs validate_feedback).
+    if (operationId === 'foundry_submitGenerationFeedback' && !AUTO_KEY.test(key)) {
+        throw new GenesisError({ status: 0, type: 'invalid_request', operationId,
+            message: `${operationId} idempotency key must be 8-128 characters of A-Z a-z 0-9 _ . : -` });
+    }
     return { 'idempotency-key': key };
 }
 /** The If-Match header an operation's spec requires (Auto's optimistic concurrency): the resource `version`

package/dist/index.d.ts

@@ -4,13 +4,14 @@ export { iamDirectoryOperations, isIamDirectoryOperation, iamDirectoryFailure }
 export { iamModule } from './iam.js';
 export { GenesisError, errorCatalog, errorBody, errorToken, errorOutcome } from './errors.js';
 export { ERROR_BODY_LIMITS, cardNumber, redactErrorBody, redactErrorText, secretField } from './redact.js';
-export { requireSecureUrl } from './urls.js';
+export { requireSecureUrl, redactUserinfo, stripUserinfo } from './urls.js';
 export { operationTable, services, type OperationId } from './generated/operations.js';
 export type { OperationInput, OperationOutput, OperationMeta, ServiceMeta } from './types.js';
 export type { paths, operations, components } from './generated/schema.js';
 export { hivesUploadBody, MAX_WASM_BYTES, type HivesUploadOptions } from './hives-upload.js';
 export { validateHivesInvocation, hivesFunctionResponseHeaders, HivesOperationError, MAX_FUNCTION_BODY_BYTES, MAX_FUNCTION_JSON_BYTES, type HivesInvokeRequest, type HivesInvokeOptions, type HivesOperationStatus } from './hives-functions.js';
 export { hivesResponseBytes } from './hives-response.js';
+export { HIVES_PROJECT_ID_DESCRIPTION, HIVES_PROJECT_ID_DEFAULT, isGenesisProjectId, isHivesProjectOperation, hivesProjectIdRefusal } from './hives-project.js';
 export { runnerModule, type RunnerStartInput, type RunnerSnapshot, type RunnerCatalog, type RunnerEvent, type RunnerProviderResult, type RunnerRequestOptions } from './runner.js';
 export type { RunnerSelfExecutionGrantInput, RunnerSelfExecutionGrant } from './runner-grant.js';
 export { beaconsModule, BEACONS_RESOURCE_FAMILIES, BEACONS_CLIENT_PLATFORMS, type BeaconsResourceFamily } from './beacons.js';

package/dist/index.js

@@ -4,11 +4,12 @@ export { iamDirectoryOperations, isIamDirectoryOperation, iamDirectoryFailure }
 export { iamModule } from './iam.js';
 export { GenesisError, errorCatalog, errorBody, errorToken, errorOutcome } from './errors.js';
 export { ERROR_BODY_LIMITS, cardNumber, redactErrorBody, redactErrorText, secretField } from './redact.js';
-export { requireSecureUrl } from './urls.js';
+export { requireSecureUrl, redactUserinfo, stripUserinfo } from './urls.js';
 export { operationTable, services } from './generated/operations.js';
 export { hivesUploadBody, MAX_WASM_BYTES } from './hives-upload.js';
 export { validateHivesInvocation, hivesFunctionResponseHeaders, HivesOperationError, MAX_FUNCTION_BODY_BYTES, MAX_FUNCTION_JSON_BYTES } from './hives-functions.js';
 export { hivesResponseBytes } from './hives-response.js';
+export { HIVES_PROJECT_ID_DESCRIPTION, HIVES_PROJECT_ID_DEFAULT, isGenesisProjectId, isHivesProjectOperation, hivesProjectIdRefusal } from './hives-project.js';
 export { runnerModule } from './runner.js';
 export { beaconsModule, BEACONS_RESOURCE_FAMILIES, BEACONS_CLIENT_PLATFORMS } from './beacons.js';
 export { rigsModule, panesModule, shellsModule } from './instances.js';

package/dist/redact.d.ts

@@ -1,9 +1,3 @@
-/**
- * Redaction for service error bodies and messages before the CLI or MCP prints them. The design is
- * conservative: when a key or value might be a secret, it is replaced with `[redacted]`. Field names are
- * matched after normalisation (camelCase split, `-`/`.`/space to `_`, lower-cased), so `x-api-key`,
- * `privateKey`, `Set-Cookie` and `client_secret` are all the same kind of name.
- */
 export declare const REDACTED = "[redacted]";
 /** Bounds of the printed body: serialized bytes, per string, per array/object, nesting and the oversize preview. */
 export declare const ERROR_BODY_LIMITS: {

package/dist/redact.js

@@ -4,6 +4,7 @@
  * matched after normalisation (camelCase split, `-`/`.`/space to `_`, lower-cased), so `x-api-key`,
  * `privateKey`, `Set-Cookie` and `client_secret` are all the same kind of name.
  */
+import { redactUserinfo } from './urls.js';
 export const REDACTED = '[redacted]';
 /** Bounds of the printed body: serialized bytes, per string, per array/object, nesting and the oversize preview. */
 export const ERROR_BODY_LIMITS = { bytes: 16384, string: 2048, items: 100, depth: 8, preview: 4096 };
@@ -174,8 +175,8 @@ const SECRET_TEXT = [
     [/(?<![A-Za-z0-9])ek_(?:live|test)_[A-Za-z0-9_-]{8,}/g, REDACTED],
     // PEM private keys (whole block, or to the end when cut).
     [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g, REDACTED],
-    // URL userinfo: scheme://user:pass@host.
-    [/\b([a-z][a-z0-9+.-]{0,31}:\/\/)[^\s/?#@]+@/gi, `$1${REDACTED}@`],
+    // URL userinfo: scheme://user:pass@host, and the scheme-less, protocol-relative, percent-encoded and JSON-escaped forms.
+    [/^[\s\S]*$/, (t) => redactUserinfo(t, REDACTED)],
     // An Authorization / Proxy-Authorization header in text, any scheme.
     [/\b((?:proxy[-_ ]?)?authorization["']?\s*[:=]\s*["']?)(?!\[redacted\])(?:[A-Za-z][A-Za-z0-9_-]*\s+)?[^\s"',;]{8,}/gi, `$1${REDACTED}`],
     // Auth schemes followed by a credential.

package/dist/urls.d.ts

@@ -4,3 +4,12 @@
  * Credentials ride on every request, so a plain-http endpoint off the local machine is refused.
  */
 export declare function requireSecureUrl(value: string, what: string): string;
+/**
+ * Replace the userinfo of every URL in `text` with `mask` (default `***`): `https://user:pass@host` becomes
+ * `https://***@host` and `user:pass@host` becomes `***@host`, including scheme-less, protocol-relative,
+ * percent-encoded (also double-encoded) and JSON-escaped forms, and passwords holding an unencoded `@`.
+ * Linear time on any input. Use on error and status text only, never on data the user asked to see.
+ */
+export declare function redactUserinfo(text: string, mask?: string): string;
+/** `url` without its userinfo (`https://u:p@host/x` becomes `https://host/x`); text that is not an absolute URL passes through redactUserinfo. */
+export declare function stripUserinfo(url: string): string;

package/dist/urls.js

@@ -29,3 +29,86 @@ export function requireSecureUrl(value, what) {
         return value;
     throw new Error(`${what} must use https (http is allowed only on loopback hosts)`);
 }
+// The scheme before the slashes is left as it is, so it is never matched. Every quantifier is bounded (userinfo 512, bare user 64 / password 128) and none is nested or overlaps
+// another, so one start position costs O(1). On top of that, only the stretches within WINDOW characters before an
+// `@` (or `%40`) are scanned at all: a userinfo cannot end anywhere else. Redaction is therefore linear in the text
+// length times a constant, and text with no `@`, fullwidth `＠` or `%40` is returned as it is.
+// scheme://userinfo@, //userinfo@, https:/\userinfo@ and JSON-escaped :\/\/userinfo@ (greedy to the last @ before the path).
+const USERINFO = /([/\\]{2}|\\\/\\\/)[^\s/?#\\"'<>]{0,512}[@＠]/gi;
+// The same, percent-encoded (also double-encoded): https%3A%2F%2Fuser%3Apass%40host, https%253A%252F%252Fuser%2540host.
+const ENCODED_USERINFO = /(%(?:25){0,2}2F%(?:25){0,2}2F)(?:(?!%(?:25){0,2}2F)[^\s/?#&"'<>]){0,512}%(?:25){0,2}40/gi;
+// Scheme-less user:pass@host (a colon is required, so plain addresses like user@host are left alone).
+const BARE_USERINFO = /(^|[\s"'(<=,;[{])[^\s/?#@＠:"'<>\\]{1,64}:[^\s/?#"'<>\\]{0,128}[@＠](?=[\w[])/g;
+/** Every place a userinfo can end: `@`, fullwidth `＠`, or an encoded `%40` / `%2540`. */
+const AT_HITS = /[@＠]|%(?:25){0,2}40/gi;
+/** The scheme-less form can only end at an `@` or `＠` that is followed by a word character or `[` (see BARE_USERINFO). */
+const BARE_HITS = /[@＠](?=[\w[])/g;
+/** The longest URL-form match (slashes and userinfo, encoded) is under 640 characters; the bare form is under 200. */
+const URL_WINDOW = 700;
+const BARE_WINDOW = 200;
+/** With at least one hit per DENSE characters the windows would cover the text anyway, so it is scanned whole. The regexes are linear on their own; the windows only skip stretches that cannot hold a userinfo. */
+const DENSE = 64;
+/** Start and end of every hit of `re` in `text`, flattened; `null` when they are dense. */
+function hitSpans(text, re) {
+    const limit = Math.floor(text.length / DENSE);
+    const spans = [];
+    re.lastIndex = 0;
+    for (let hit = re.exec(text); hit; hit = re.exec(text)) {
+        if (spans.length >= 2 * limit)
+            return null;
+        spans.push(hit.index, hit.index + hit[0].length);
+    }
+    return spans;
+}
+/**
+ * Apply `fn` to the stretches of `text` within `window` characters before a hit, and copy the rest as it is.
+ * `spans` of `null` means dense: `fn` runs over the whole text. A stretch without the character `needs` cannot hold a match.
+ */
+function overHits(text, spans, window, fn, needs = '') {
+    if (spans === null)
+        return fn(text);
+    if (spans.length === 0)
+        return text;
+    let out = '';
+    let copied = 0;
+    let start = Math.max(0, spans[0] - window);
+    let end = spans[1] + 1;
+    const flush = () => {
+        const seg = text.slice(start, end);
+        // A sentinel before a window that does not start the text keeps `^` (start of text) from matching mid-text.
+        const piece = needs && !seg.includes(needs) ? seg : start > 0 ? fn(`x${seg}`).slice(1) : fn(seg);
+        out += text.slice(copied, start) + piece;
+        copied = Math.min(end, text.length);
+    };
+    for (let i = 2; i < spans.length; i += 2) {
+        const s = Math.max(0, spans[i] - window);
+        if (s <= end) {
+            end = spans[i + 1] + 1;
+            continue;
+        }
+        flush();
+        start = s;
+        end = spans[i + 1] + 1;
+    }
+    flush();
+    return out + text.slice(copied);
+}
+/**
+ * Replace the userinfo of every URL in `text` with `mask` (default `***`): `https://user:pass@host` becomes
+ * `https://***@host` and `user:pass@host` becomes `***@host`, including scheme-less, protocol-relative,
+ * percent-encoded (also double-encoded) and JSON-escaped forms, and passwords holding an unencoded `@`.
+ * Linear time on any input. Use on error and status text only, never on data the user asked to see.
+ */
+export function redactUserinfo(text, mask = '***') {
+    // Pre-check: no `@`, `＠` or `%40` means no userinfo in any form.
+    if (!/[@＠]|%(?:25){0,2}40/i.test(text))
+        return text;
+    const urlForms = overHits(text, hitSpans(text, AT_HITS), URL_WINDOW, (t) => t.replace(ENCODED_USERINFO, `$1${mask}%40`).replace(USERINFO, `$1${mask}@`));
+    if (!urlForms.includes(':'))
+        return urlForms; // the scheme-less form needs its colon
+    return overHits(urlForms, hitSpans(urlForms, BARE_HITS), BARE_WINDOW, (t) => t.replace(BARE_USERINFO, `$1${mask}@`), ':');
+}
+/** `url` without its userinfo (`https://u:p@host/x` becomes `https://host/x`); text that is not an absolute URL passes through redactUserinfo. */
+export function stripUserinfo(url) {
+    return /^[a-z][a-z0-9+.-]*:\/\//i.test(url) ? url.replace(/^([a-z][a-z0-9+.-]*:\/\/)[^/?#]*@/i, '$1') : redactUserinfo(url);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onesi/genesis",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/l1felabs/genesis-api.git",