@senticor/hive 1.31.3 → 1.33.1

package/hive.cjs

@@ -9014,22 +9014,22 @@ var artifactName = injectedString(
   true ? "hive-cli" : void 0
 ) || String(process.env.HIVE_CLI_ARTIFACT_NAME || "hive-cli").trim() || "hive-cli";
 var packageVersion = injectedString(
-  true ? "1.31.3" : void 0
+  true ? "1.33.1" : void 0
 ) || String(process.env.HIVE_CLI_PACKAGE_VERSION || "").trim() || readPackageVersion();
 var releaseVersion = injectedString(
-  true ? "1.31.3" : void 0
+  true ? "1.33.1" : void 0
 ) || String(process.env.HIVE_CLI_RELEASE_VERSION || "").trim() || packageVersion || "dev";
 var releaseChannel = injectedString(
   true ? "final" : void 0
 ) || String(process.env.HIVE_CLI_RELEASE_CHANNEL || "").trim() || (releaseVersion.includes("-rc.") ? "rc" : releaseVersion === "dev" ? "dev" : "final");
 var buildCommit = injectedString(
-  true ? "a4e10e16fc6a527e456f1cb68d5126166c7f9583" : void 0
+  true ? "0bba73f7b6060454678d8f9f3763cabe75532ad4" : void 0
 ) || String(process.env.HIVE_CLI_BUILD_COMMIT || "").trim() || "unknown";
 var buildTimestamp = injectedString(
-  true ? "2026-09-06T22:05:05Z" : void 0
+  true ? "2026-09-09T18:17:52Z" : void 0
 ) || String(process.env.HIVE_CLI_BUILD_TIMESTAMP || "").trim() || "unknown";
 var ociRef = injectedString(
-  true ? "registry.onstackit.cloud/senticor/hive-cli:1.31.3" : void 0
+  true ? "registry.onstackit.cloud/senticor/hive-cli:1.33.1" : void 0
 ) || String(process.env.HIVE_CLI_OCI_REF || "").trim() || `registry.onstackit.cloud/senticor/${artifactName}:${releaseVersion}`;
 var RELEASE_INFO = Object.freeze({
   packageVersion,
@@ -24838,6 +24838,24 @@ function isValidCorsOrigin(value) {
 }
 var ROLE_KEY_RE = /^[a-z0-9][a-z0-9._:-]{0,63}$/;
 
+// ../hive-api-contracts/src/mission-kafka-ingest.ts
+init_cjs_shims();
+var MISSION_KAFKA_SASL_MECHANISMS = [
+  "plain",
+  "scram-sha-256",
+  "scram-sha-512"
+];
+var MISSION_KAFKA_TLS_CA_MAX_BYTES = 64 * 1024;
+function utf8ByteLength(value) {
+  return new TextEncoder().encode(value).length;
+}
+function looksLikePemCertificate(value) {
+  return value.includes("-----BEGIN CERTIFICATE-----") && value.includes("-----END CERTIFICATE-----");
+}
+function looksLikeJsonSchema(value) {
+  return "$schema" in value || "type" in value || "$id" in value || "properties" in value;
+}
+
 // src/admin/config.mts
 var TENANT_KINDS = ["customer", "organization"];
 var RoleKeySchema = external_exports.string().regex(ROLE_KEY_RE, "role key must be lower-case, 1-64 chars of [a-z0-9._:-]");
@@ -24899,9 +24917,25 @@ var KafkaSchema = external_exports.object({
   manifestTopic: external_exports.string().min(1).optional(),
   consumerGroup: external_exports.string().min(1).optional(),
   schemaSource: external_exports.enum(SCHEMA_SOURCES).default("inline"),
+  // Round 8 (#83 review): buildKafkaPatchBody supported these since bms#257,
+  // but the strict schema rejected the keys and the orchestrator never
+  // forwarded them — the documented SCRAM enclave flow exited with
+  // 'Unrecognized key: "saslMechanism"', and removing the key silently
+  // provisioned PLAIN against a SCRAM-SHA-512 broker.
+  saslMechanism: external_exports.enum(MISSION_KAFKA_SASL_MECHANISMS).optional(),
+  // Round 9 (#83 review): trim before the min-length check — a whitespace-only
+  // value otherwise passes local validation and 400s only at the Kafka PATCH,
+  // after tenant/members/mission are already provisioned.
+  fileNameHeaderKey: external_exports.string().trim().min(1).optional(),
   // Path (relative to the config file) to an inline JSON Schema. Required
   // when schemaSource === 'inline'.
   envelopeSchemaPath: external_exports.string().min(1).optional(),
+  // #83 — path (relative to the config file) to the broker CA bundle in PEM
+  // form, for private-CA/self-signed brokers (the normal enclave/Strimzi
+  // setup). Resolved at build time and sent as `tls.caPem`; omit to trust
+  // the default store. A path, not inline PEM: multi-line certificate
+  // blocks do not belong in a JSON config.
+  tlsCaPemPath: external_exports.string().min(1).optional(),
   schemaRegistry: SchemaRegistrySchema.optional(),
   classification: external_exports.string().min(1).optional(),
   sourceType: external_exports.string().min(1).optional()
@@ -25221,14 +25255,6 @@ async function ensureMission(client, mission2, opts) {
 
 // src/admin/steps/kafka.mts
 init_cjs_shims();
-
-// ../hive-api-contracts/src/mission-kafka-ingest.ts
-init_cjs_shims();
-function looksLikeJsonSchema(value) {
-  return "$schema" in value || "type" in value || "$id" in value || "properties" in value;
-}
-
-// src/admin/steps/kafka.mts
 function buildKafkaPatchBody(input) {
   if (!input.apiKey || !input.apiSecret) {
     throw new Error(
@@ -25266,6 +25292,7 @@ function buildKafkaPatchBody(input) {
   if (input.fileNameHeaderKey) body.fileNameHeaderKey = input.fileNameHeaderKey;
   if (input.classification) body.classification = input.classification;
   if (input.sourceType) body.sourceType = input.sourceType;
+  if (input.tlsCaPem) body.tls = { caPem: input.tlsCaPem };
   if (input.schemaSource === "inline") {
     body.envelopeSchema = input.envelopeSchema;
   } else {
@@ -25335,8 +25362,13 @@ async function runBootstrap(deps) {
     topic: config3.kafka.topic,
     manifestTopic: config3.kafka.manifestTopic,
     consumerGroup: config3.kafka.consumerGroup,
+    // Round 8: forward the bms#257 fields — the schema accepted... nothing, and
+    // this call silently dropped them, so SCRAM configs provisioned PLAIN.
+    saslMechanism: config3.kafka.saslMechanism,
+    fileNameHeaderKey: config3.kafka.fileNameHeaderKey,
     schemaSource: config3.kafka.schemaSource,
     envelopeSchema: deps.envelopeSchema,
+    tlsCaPem: deps.tlsCaPem,
     schemaRegistry: config3.kafka.schemaRegistry ? {
       url: config3.kafka.schemaRegistry.url,
       apiKey: secrets.schemaRegistryApiKey,
@@ -25347,6 +25379,20 @@ async function runBootstrap(deps) {
     apiKey: secrets.kafkaApiKey ?? "",
     apiSecret: secrets.kafkaApiSecret ?? ""
   });
+  if (deps.tlsCaPem) {
+    const advertised = await advertisedTlsCaLimit(client);
+    if (advertised == null) {
+      throw new Error(
+        "kafka.tlsCaPemPath is set, but this deployment does not advertise maxKafkaTlsCaPemBytes via GET /api/me/limits \u2014 it predates broker-CA support (#83) and would silently drop the CA from the binding. Upgrade the deployment, or remove tlsCaPemPath to trust the default store. Aborting BEFORE any mutation."
+      );
+    }
+    const bytes = utf8ByteLength(deps.tlsCaPem);
+    if (bytes > advertised) {
+      throw new Error(
+        `kafka.tlsCaPemPath: the CA bundle is ${bytes} UTF-8 bytes, but this deployment advertises maxKafkaTlsCaPemBytes=${advertised} via GET /api/me/limits \u2014 shrink the bundle or raise HIVE_MAX_KAFKA_TLS_CA_PEM_BYTES on the server.`
+      );
+    }
+  }
   const state = readState(statePath);
   log(`Ensuring tenant ${displayKey} \u2026`);
   const tenant = await ensureTenant(client, config3.tenant);
@@ -25415,6 +25461,36 @@ async function runBootstrap(deps) {
     probe
   };
 }
+async function advertisedTlsCaLimit(client) {
+  let res;
+  try {
+    res = await client.request("GET", "/api/me/limits");
+  } catch (err) {
+    throw new Error(
+      `cannot reach GET /api/me/limits to check the deployment's CA size limit \u2014 aborting BEFORE any mutation (${err?.message ?? err})`
+    );
+  }
+  if (!res.ok) {
+    if (res.status === 404) return null;
+    throw new Error(
+      `GET /api/me/limits answered HTTP ${res.status} \u2014 cannot verify the deployment's CA size limit; aborting BEFORE any mutation`
+    );
+  }
+  const body = res.json;
+  if (body === null || typeof body !== "object") {
+    throw new Error(
+      "GET /api/me/limits returned an unparseable body \u2014 cannot verify the deployment's CA size limit; aborting BEFORE any mutation"
+    );
+  }
+  const v = body.ingestLimits?.maxKafkaTlsCaPemBytes;
+  if (v === void 0 || v === null) return null;
+  if (typeof v !== "number" || !Number.isFinite(v) || v <= 0) {
+    throw new Error(
+      `GET /api/me/limits advertises a malformed maxKafkaTlsCaPemBytes (${JSON.stringify(v)}) \u2014 cannot verify the deployment's CA size limit; aborting BEFORE any mutation`
+    );
+  }
+  return v;
+}
 
 // src/admin/steps/inject.mts
 init_cjs_shims();
@@ -25463,6 +25539,7 @@ async function runConnector(client, missionId, tenant, config3) {
 // src/admin/cli-support.mts
 init_cjs_shims();
 var import_node_fs8 = require("fs");
+var import_node_crypto3 = require("crypto");
 var import_node_path7 = require("path");
 function loadConfigFile(configPath2, cwd = process.cwd()) {
   const abs = (0, import_node_path7.isAbsolute)(configPath2) ? configPath2 : (0, import_node_path7.resolve)(cwd, configPath2);
@@ -25480,6 +25557,46 @@ function resolveEnvelopeSchema(config3, configDir) {
   const abs = (0, import_node_path7.isAbsolute)(p) ? p : (0, import_node_path7.resolve)(configDir, p);
   return JSON.parse((0, import_node_fs8.readFileSync)(abs, "utf-8"));
 }
+function resolveTlsCaPem(config3, configDir) {
+  const p = config3.kafka.tlsCaPemPath;
+  if (!p) return void 0;
+  const abs = (0, import_node_path7.isAbsolute)(p) ? p : (0, import_node_path7.resolve)(configDir, p);
+  const pem = (0, import_node_fs8.readFileSync)(abs, "utf-8").trim();
+  if (!looksLikePemCertificate(pem)) {
+    throw new Error(
+      `kafka.tlsCaPemPath (${p}) does not look like a PEM certificate bundle (missing BEGIN/END CERTIFICATE markers)`
+    );
+  }
+  if (utf8ByteLength(pem) > MISSION_KAFKA_TLS_CA_MAX_BYTES) {
+    throw new Error(
+      `kafka.tlsCaPemPath (${p}) exceeds ${MISSION_KAFKA_TLS_CA_MAX_BYTES} UTF-8 bytes \u2014 a broker CA bundle should be a handful of certificates`
+    );
+  }
+  for (const match of pem.matchAll(/-----BEGIN ([A-Z0-9 ]+)-----/g)) {
+    if (match[1] !== "CERTIFICATE") {
+      throw new Error(
+        `kafka.tlsCaPemPath (${p}) contains a "${match[1]}" PEM block \u2014 only CERTIFICATE blocks belong in a CA bundle (if it is a private key, treat it as exposed and rotate it)`
+      );
+    }
+  }
+  const blocks = pem.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g) ?? [];
+  const beginCount = (pem.match(/-----BEGIN CERTIFICATE-----/g) ?? []).length;
+  if (blocks.length === 0 || blocks.length !== beginCount) {
+    throw new Error(
+      `kafka.tlsCaPemPath (${p}) looks truncated \u2014 every certificate needs both its BEGIN and END marker`
+    );
+  }
+  blocks.forEach((block, i) => {
+    try {
+      new import_node_crypto3.X509Certificate(block);
+    } catch {
+      throw new Error(
+        `kafka.tlsCaPemPath (${p}): certificate block ${i + 1} of ${blocks.length} does not parse as X.509 \u2014 re-copy the bundle from its source (truncated or corrupted base64?)`
+      );
+    }
+  });
+  return pem;
+}
 function defaultStatePath(configDir, override, cwd = process.cwd()) {
   if (override) return (0, import_node_path7.isAbsolute)(override) ? override : (0, import_node_path7.resolve)(cwd, override);
   return (0, import_node_path7.resolve)(configDir, ".bootstrap-state.json");
@@ -25529,6 +25646,7 @@ async function cmdBootstrap(configPath2, envPath, flags) {
   const { config: config3, dir } = loadConfigFile(configPath2);
   loadEnvFile(envPath);
   const envelopeSchema = resolveEnvelopeSchema(config3, dir);
+  const tlsCaPem = resolveTlsCaPem(config3, dir);
   const secrets = resolveSecrets(process.env);
   const dryRun = flags["dry-run"] === true;
   const client = dryRun ? createHttpClient(config3.apiUrl, "") : createHttpClient(config3.apiUrl, await acquireToken({ oidc: config3.oidc, secrets }));
@@ -25537,6 +25655,7 @@ async function cmdBootstrap(configPath2, envPath, flags) {
     config: config3,
     secrets,
     envelopeSchema,
+    tlsCaPem,
     statePath: defaultStatePath(dir, flagStr(flags, "state")),
     options: { dryRun, force: flags.force === true, probe: flags["no-probe"] !== true },
     log: (m) => console.log(m)
@@ -26144,7 +26263,7 @@ var stack = defineCommand({
 
 // src/commands/diag.ts
 init_cjs_shims();
-var import_node_crypto3 = __toESM(require("crypto"), 1);
+var import_node_crypto4 = __toESM(require("crypto"), 1);
 var import_node_os4 = __toESM(require("os"), 1);
 var import_node_fs10 = __toESM(require("fs"), 1);
 var import_node_path10 = __toESM(require("path"), 1);
@@ -26213,12 +26332,12 @@ function runDiagOffline(sub, verbose) {
       "cli"
     ];
     let totalSpec = 0;
-    const masterH = import_node_crypto3.default.createHash("sha256");
+    const masterH = import_node_crypto4.default.createHash("sha256");
     for (const dir of specDirs) {
       const full = import_node_path10.default.join(specsBase, dir);
       if (!import_node_fs10.default.existsSync(full)) continue;
       const files = import_node_fs10.default.readdirSync(full).filter((f) => /\.(json|ya?ml)$/i.test(f)).sort();
-      const h = import_node_crypto3.default.createHash("sha256");
+      const h = import_node_crypto4.default.createHash("sha256");
       for (const f of files) h.update(import_node_fs10.default.readFileSync(import_node_path10.default.join(full, f)));
       const hash2 = h.digest("hex").slice(0, 12);
       totalSpec += files.length;
@@ -27833,7 +27952,7 @@ var ajvFormatsModule2 = __toESM(require_dist(), 1);
 
 // src/lib/application-package.ts
 init_cjs_shims();
-var import_node_crypto4 = require("crypto");
+var import_node_crypto5 = require("crypto");
 var import_node_fs12 = require("fs");
 var import_node_path11 = require("path");
 var ajvModule = __toESM(require_ajv(), 1);
@@ -27953,7 +28072,7 @@ var envelopeAjv = new AjvCtor({ allErrors: true, strict: false });
 addFormats(envelopeAjv);
 var validateStarterEnvelope = envelopeAjv.compile(DEFAULT_ENVELOPE_SCHEMA);
 function sha256Hex(bytes) {
-  return (0, import_node_crypto4.createHash)("sha256").update(bytes).digest("hex");
+  return (0, import_node_crypto5.createHash)("sha256").update(bytes).digest("hex");
 }
 function formatBytes(n) {
   if (n >= 1024 * 1024) return `${(n / (1024 * 1024)).toFixed(1)} MiB`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@senticor/hive",
-  "version": "1.31.3",
+  "version": "1.33.1",
   "description": "Cognitive Hive OS — unified CLI",
   "type": "commonjs",
   "bin": {