@senticor/hive 1.47.0 → 1.48.0

package/hive.cjs

@@ -3303,8 +3303,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path9) {
-      let input = path9;
+    function removeDotSegments(path10) {
+      let input = path10;
       const output2 = [];
       let nextSlash = -1;
       let len = 0;
@@ -3714,8 +3714,8 @@ var require_schemes = __commonJS({
       }
       if (wsComponent.resourceName) {
         const queryIndex = wsComponent.resourceName.indexOf("?");
-        const path9 = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
-        wsComponent.path = path9 && path9 !== "/" ? path9 : void 0;
+        const path10 = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
+        wsComponent.path = path10 && path10 !== "/" ? path10 : void 0;
         wsComponent.query = queryIndex === -1 ? void 0 : wsComponent.resourceName.slice(queryIndex + 1);
         wsComponent.resourceName = void 0;
       }
@@ -8531,13 +8531,9 @@ var HiveClient = class {
     this.tenant = opts.tenant === null ? null : opts.tenant || process.env.HIVE_TENANT || process.env.HIVE_TENANT_ID || "default";
     this.verbose = !!opts.verbose;
   }
-  /** Low-level request helper (no external deps, uses Node built-ins) */
-  async _request(method, path9, body) {
-    const url2 = new import_node_url2.URL(path9, this.baseUrl);
-    const mod = url2.protocol === "https:" ? import_node_https2.default : import_node_http2.default;
-    const headers = {
-      accept: "application/json"
-    };
+  /** Tenant + auth headers every request to the Hive API carries. */
+  async _baseHeaders(accept) {
+    const headers = { accept };
     if (this.tenant) headers["x-hive-tenant"] = this.tenant;
     try {
       const token = process.env.HIVE_TOKEN || process.env.HIVE_TEST_TOKEN || process.env.HIVE_BEARER_TOKEN || await getValidToken();
@@ -8545,6 +8541,13 @@ var HiveClient = class {
     } catch (e) {
       if (this.verbose) console.error("Warning: Could not fetch auth token", e.message);
     }
+    return headers;
+  }
+  /** Low-level request helper (no external deps, uses Node built-ins) */
+  async _request(method, path10, body) {
+    const url2 = new import_node_url2.URL(path10, this.baseUrl);
+    const mod = url2.protocol === "https:" ? import_node_https2.default : import_node_http2.default;
+    const headers = await this._baseHeaders("application/json");
     let payload = null;
     if (body !== void 0 && body !== null) {
       payload = typeof body === "string" ? body : JSON.stringify(body);
@@ -8572,7 +8575,7 @@ var HiveClient = class {
 `);
           }
           if (!isHttpOk(res.statusCode)) {
-            recordRemoteFailure({ method, path: path9, status: res.statusCode, body: data });
+            recordRemoteFailure({ method, path: path10, status: res.statusCode, body: data });
           }
           resolve3({ status: res.statusCode, data });
         });
@@ -8582,20 +8585,42 @@ var HiveClient = class {
       req2.end();
     });
   }
-  get(path9) {
-    return this._request("GET", path9);
+  /**
+   * Streaming request: resolves once the response headers arrive and hands back
+   * the body unread, for responses too large or too binary for `_request`
+   * (a mission export, a document's bytes). Sends the same tenant and auth
+   * headers. The caller reads or discards `body` and reports failures itself.
+   */
+  async getRaw(path10) {
+    const url2 = new import_node_url2.URL(path10, this.baseUrl);
+    const mod = url2.protocol === "https:" ? import_node_https2.default : import_node_http2.default;
+    const headers = await this._baseHeaders("*/*");
+    if (this.verbose) process.stderr.write(`\u2192 GET ${url2.href} (stream)
+`);
+    return new Promise((resolve3, reject) => {
+      const req2 = mod.request(url2, { method: "GET", headers }, (res) => {
+        if (this.verbose) process.stderr.write(`\u2190 ${res.statusCode} (stream)
+`);
+        resolve3({ status: res.statusCode, headers: res.headers, body: res });
+      });
+      req2.on("error", reject);
+      req2.end();
+    });
+  }
+  get(path10) {
+    return this._request("GET", path10);
   }
-  post(path9, body) {
-    return this._request("POST", path9, body || {});
+  post(path10, body) {
+    return this._request("POST", path10, body || {});
   }
-  put(path9, body) {
-    return this._request("PUT", path9, body || {});
+  put(path10, body) {
+    return this._request("PUT", path10, body || {});
   }
-  patch(path9, body) {
-    return this._request("PATCH", path9, body || {});
+  patch(path10, body) {
+    return this._request("PATCH", path10, body || {});
   }
-  del(path9) {
-    return this._request("DELETE", path9);
+  del(path10) {
+    return this._request("DELETE", path10);
   }
 };
 
@@ -8831,7 +8856,7 @@ function fieldText(value) {
 function schemaErrorFields(data) {
   const errors = data?.schemaErrors;
   if (!Array.isArray(errors)) return [];
-  const paths = errors.map((entry) => String(entry?.instancePath ?? "").trim()).filter(Boolean).map((path9) => path9.replace(/^\//, ""));
+  const paths = errors.map((entry) => String(entry?.instancePath ?? "").trim()).filter(Boolean).map((path10) => path10.replace(/^\//, ""));
   return [...new Set(paths)];
 }
 function remoteFailureRemediation(data) {
@@ -9177,11 +9202,11 @@ function parseBoolish(value) {
 }
 function readTlsKeysFromEnvFile(file2) {
   const out = {};
-  const path9 = cleanString(file2);
-  if (!path9) return out;
+  const path10 = cleanString(file2);
+  if (!path10) return out;
   let text;
   try {
-    text = import_node_fs3.default.readFileSync(path9, "utf-8");
+    text = import_node_fs3.default.readFileSync(path10, "utf-8");
   } catch {
     return out;
   }
@@ -9449,8 +9474,8 @@ function resolvePrincipal(args) {
   }
   return email3 ? { principalEmail: email3.toLowerCase() } : { principalSub: sub };
 }
-function dryRunResult(method, path9, body) {
-  return body === void 0 ? { dryRun: true, method, path: path9 } : { dryRun: true, method, path: path9, body };
+function dryRunResult(method, path10, body) {
+  return body === void 0 ? { dryRun: true, method, path: path10 } : { dryRun: true, method, path: path10, body };
 }
 function runScript(script) {
   try {
@@ -9495,22 +9520,22 @@ var artifactName = injectedString(
   true ? "hive-cli" : void 0
 ) || String(process.env.HIVE_CLI_ARTIFACT_NAME || "hive-cli").trim() || "hive-cli";
 var packageVersion = injectedString(
-  true ? "1.47.0" : void 0
+  true ? "1.48.0" : void 0
 ) || String(process.env.HIVE_CLI_PACKAGE_VERSION || "").trim() || readPackageVersion();
 var releaseVersion = injectedString(
-  true ? "1.47.0" : void 0
+  true ? "1.48.0" : void 0
 ) || String(process.env.HIVE_CLI_RELEASE_VERSION || "").trim() || packageVersion || "dev";
 var releaseChannel = injectedString(
   true ? "final" : void 0
 ) || String(process.env.HIVE_CLI_RELEASE_CHANNEL || "").trim() || (releaseVersion.includes("-rc.") ? "rc" : releaseVersion === "dev" ? "dev" : "final");
 var buildCommit = injectedString(
-  true ? "aabcbc962684f6b4130138072c53314c80c0437b" : void 0
+  true ? "3faa9b71ef73e2fbcf86dce4bdd838ca7fb1fe85" : void 0
 ) || String(process.env.HIVE_CLI_BUILD_COMMIT || "").trim() || "unknown";
 var buildTimestamp = injectedString(
-  true ? "2026-09-29T12:03:30Z" : void 0
+  true ? "2026-09-30T15:02:20Z" : void 0
 ) || String(process.env.HIVE_CLI_BUILD_TIMESTAMP || "").trim() || "unknown";
 var ociRef = injectedString(
-  true ? "registry.onstackit.cloud/senticor/hive-cli:1.47.0" : void 0
+  true ? "registry.onstackit.cloud/senticor/hive-cli:1.48.0" : void 0
 ) || String(process.env.HIVE_CLI_OCI_REF || "").trim() || `registry.onstackit.cloud/senticor/${artifactName}:${releaseVersion}`;
 var RELEASE_INFO = Object.freeze({
   packageVersion,
@@ -11530,10 +11555,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path9) {
-  if (!path9)
+function getElementAtPath(obj, path10) {
+  if (!path10)
     return obj;
-  return path9.reduce((acc, key) => acc?.[key], obj);
+  return path10.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -11942,11 +11967,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path9, issues) {
+function prefixIssues(path10, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path9);
+    iss.path.unshift(path10);
     return iss;
   });
 }
@@ -12093,16 +12118,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path9 = []) => {
+  const processError = (error52, path10 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path9, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path10, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path9, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path10, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path9, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path10, ...issue2.path]);
       } else {
-        const fullpath = [...path9, ...issue2.path];
+        const fullpath = [...path10, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -12129,17 +12154,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path9 = []) => {
+  const processError = (error52, path10 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path9, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path10, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path9, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path10, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path9, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path10, ...issue2.path]);
       } else {
-        const fullpath = [...path9, ...issue2.path];
+        const fullpath = [...path10, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -12171,8 +12196,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path9 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path9) {
+  const path10 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path10) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -23964,8 +23989,8 @@ function hex2(_params) {
   return _stringFormat(ZodCustomStringFormat, "hex", regexes_exports.hex, _params);
 }
 function hash(alg, params) {
-  const enc2 = params?.enc ?? "hex";
-  const format = `${alg}_${enc2}`;
+  const enc3 = params?.enc ?? "hex";
+  const format = `${alg}_${enc3}`;
   const regex = regexes_exports[format];
   if (!regex)
     throw new Error(`Unrecognized hash format: ${format}`);
@@ -24945,13 +24970,13 @@ function resolveRef(ref, ctx2) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path9 = ref.slice(1).split("/").filter(Boolean);
-  if (path9.length === 0) {
+  const path10 = ref.slice(1).split("/").filter(Boolean);
+  if (path10.length === 0) {
     return ctx2.rootSchema;
   }
   const defsKey = ctx2.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path9[0] === defsKey) {
-    const key = path9[1];
+  if (path10[0] === defsKey) {
+    const key = path10[1];
     if (!key || !ctx2.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -25514,8 +25539,8 @@ function loadConfig(raw) {
   const result = BootstrapConfigSchema.safeParse(raw);
   if (!result.success) {
     const lines = result.error.issues.map((issue2) => {
-      const path9 = issue2.path.length ? issue2.path.join(".") : "(root)";
-      return `  \u2022 ${path9}: ${issue2.message}`;
+      const path10 = issue2.path.length ? issue2.path.join(".") : "(root)";
+      return `  \u2022 ${path10}: ${issue2.message}`;
     });
     throw new Error(`Invalid customer config:
 ${lines.join("\n")}`);
@@ -25601,7 +25626,7 @@ function createHttpClient(baseUrl, token, fetchImpl = fetch) {
   const base = baseUrl.replace(/\/$/, "");
   return {
     baseUrl: base,
-    async request(method, path9, opts = {}) {
+    async request(method, path10, opts = {}) {
       const headers = {
         Authorization: `Bearer ${token}`,
         Accept: "application/json"
@@ -25612,7 +25637,7 @@ function createHttpClient(baseUrl, token, fetchImpl = fetch) {
         headers["Content-Type"] = "application/json";
         body = JSON.stringify(opts.body);
       }
-      const res = await fetchImpl(`${base}${path9}`, { method, headers, body });
+      const res = await fetchImpl(`${base}${path10}`, { method, headers, body });
       const text = await res.text().catch(() => "");
       let json2 = null;
       if (text) {
@@ -25633,21 +25658,21 @@ init_cjs_shims();
 // src/admin/state.mts
 init_cjs_shims();
 var import_node_fs7 = require("fs");
-function readState(path9) {
-  if (!(0, import_node_fs7.existsSync)(path9)) return {};
+function readState(path10) {
+  if (!(0, import_node_fs7.existsSync)(path10)) return {};
   try {
-    const parsed = JSON.parse((0, import_node_fs7.readFileSync)(path9, "utf-8"));
+    const parsed = JSON.parse((0, import_node_fs7.readFileSync)(path10, "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : {};
   } catch {
     return {};
   }
 }
-function writeState(path9, state) {
-  (0, import_node_fs7.writeFileSync)(path9, `${JSON.stringify(state, null, 2)}
+function writeState(path10, state) {
+  (0, import_node_fs7.writeFileSync)(path10, `${JSON.stringify(state, null, 2)}
 `, "utf-8");
 }
-function mergeState(path9, patch2, now) {
-  const current = readState(path9);
+function mergeState(path10, patch2, now) {
+  const current = readState(path10);
   const completed = /* @__PURE__ */ new Set([
     ...current.completedSteps ?? [],
     ...patch2.completedSteps ?? []
@@ -25658,7 +25683,7 @@ function mergeState(path9, patch2, now) {
     completedSteps: [...completed],
     ...now ? { updatedAt: now } : {}
   };
-  writeState(path9, merged);
+  writeState(path10, merged);
   return merged;
 }
 
@@ -25760,8 +25785,8 @@ async function ensureMission(client, mission2, opts) {
   }
   const body = { userIntent: mission2.userIntent };
   if (mission2.instantiationConfig) body.instantiationConfig = mission2.instantiationConfig;
-  const path9 = `/api/mission-templates/${encodeURIComponent(mission2.templateId)}/instantiate`;
-  const res = await client.request("POST", path9, { body, tenant: opts.tenant });
+  const path10 = `/api/mission-templates/${encodeURIComponent(mission2.templateId)}/instantiate`;
+  const res = await client.request("POST", path10, { body, tenant: opts.tenant });
   if (!res.ok) {
     throw new Error(
       `Instantiate '${mission2.templateId}' failed (HTTP ${res.status}): ${res.text}`
@@ -26125,10 +26150,10 @@ function defaultStatePath(configDir, override, cwd = process.cwd()) {
 }
 
 // src/admin/admin.mts
-function loadEnvFile(path9) {
+function loadEnvFile(path10) {
   let text;
   try {
-    text = (0, import_node_fs9.readFileSync)(path9, "utf-8");
+    text = (0, import_node_fs9.readFileSync)(path10, "utf-8");
   } catch {
     return;
   }
@@ -27281,7 +27306,7 @@ var completion = defineCommand({
 
 // src/commands/core.ts
 init_cjs_shims();
-var import_node_fs11 = require("fs");
+var import_node_fs12 = require("fs");
 
 // ../hive-api-contracts/src/cases-import.ts
 init_cjs_shims();
@@ -27392,9 +27417,282 @@ function parseCasesImportInput(body) {
   };
 }
 
+// src/lib/mission-transfer.ts
+init_cjs_shims();
+var import_node_crypto5 = require("crypto");
+var import_node_fs11 = require("fs");
+var import_node_path11 = __toESM(require("path"), 1);
+var import_promises = require("stream/promises");
+var EXPORT_FILE = "export.jsonl";
+var OBJECTS_DIR = "objects";
+var EXPORT_FORMAT = "hive.mission.export.v1";
+var BATCH_MAX_ROWS = 200;
+var BATCH_MAX_BYTES = 4 * 1024 * 1024;
+var enc2 = encodeURIComponent;
+function asRow(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function sha256(buf) {
+  return (0, import_node_crypto5.createHash)("sha256").update(buf).digest("hex");
+}
+async function readAll(stream) {
+  const chunks = [];
+  for await (const chunk of stream) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  return Buffer.concat(chunks);
+}
+function parseBody(buf) {
+  const text = buf.toString("utf8");
+  try {
+    return JSON.parse(text);
+  } catch {
+    return { _raw: text };
+  }
+}
+function objectFileName(docId) {
+  return enc2(docId);
+}
+function parseExport(text) {
+  const lines = text.split("\n").filter((l) => l.trim() !== "");
+  const parsed = lines.map((line, i) => {
+    try {
+      return JSON.parse(line);
+    } catch {
+      throw commandError("EXPORT_UNREADABLE", 1, `export line ${i + 1} is not JSON`);
+    }
+  });
+  const header = parsed[0];
+  if (!header || header.kind !== "header" || header.format !== EXPORT_FORMAT) {
+    throw commandError("EXPORT_UNREADABLE", 1, `not a ${EXPORT_FORMAT} export (first line must be its header)`);
+  }
+  const source = asRow(header.source);
+  if (!source || typeof source.tenantId !== "string" || typeof source.missionId !== "string") {
+    throw commandError("EXPORT_UNREADABLE", 1, "the export header names no source tenant and mission");
+  }
+  const summary = parsed[parsed.length - 1];
+  if (!summary || summary.kind !== "summary") {
+    throw commandError("EXPORT_INCOMPLETE", 1, "the export has no closing summary line: the stream was cut short");
+  }
+  const out = {
+    header,
+    source: { tenantId: source.tenantId, missionId: source.missionId },
+    cases: [],
+    documents: [],
+    records: [],
+    members: [],
+    summary
+  };
+  for (const line of parsed.slice(1, -1)) {
+    if (line.kind === "case" && asRow(line.case)) out.cases.push(line.case);
+    else if (line.kind === "document" && asRow(line.document)) out.documents.push({ document: line.document, content: asRow(line.content) });
+    else if (line.kind === "record" && asRow(line.record)) out.records.push(line.record);
+    else if (line.kind === "member" && asRow(line.member)) out.members.push(line.member);
+  }
+  const counts = asRow(summary.counts) || {};
+  const expected = [
+    ["cases", out.cases.length],
+    ["documents", out.documents.length],
+    ["records", out.records.length],
+    ["members", out.members.length]
+  ];
+  for (const [kind, actual] of expected) {
+    if (Number(counts[kind]) !== actual) {
+      throw commandError("EXPORT_INCOMPLETE", 1, `the export summary counts ${String(counts[kind])} ${kind} but the stream holds ${actual}`);
+    }
+  }
+  return out;
+}
+async function downloadDocument(client, content, fetchImpl) {
+  const minted = await client.get(String(content.url));
+  if (isHttpOk(minted.status)) {
+    const url2 = asRow(minted.data)?.url;
+    if (typeof url2 !== "string" || !url2) throw commandError("DOCUMENT_URL_MISSING", 1, `${String(content.url)} answered without a url`);
+    const res = await fetchImpl(url2);
+    if (!res.ok) throw commandError("DOCUMENT_DOWNLOAD_FAILED", 1, `direct download failed (HTTP ${res.status}) for ${String(content.url)}`);
+    return { bytes: Buffer.from(await res.arrayBuffer()), via: "direct" };
+  }
+  if (minted.status !== 501) throw remoteFailureError(minted.status, minted.data, "document url");
+  remoteFailureHandled();
+  const raw = await client.getRaw(String(content.content));
+  const body = await readAll(raw.body);
+  if (!isHttpOk(raw.status)) throw remoteFailureError(raw.status, parseBody(body), "document content");
+  return { bytes: body, via: "api" };
+}
+async function exportMission(client, opts) {
+  const log = opts.log || (() => void 0);
+  const fetchImpl = opts.fetchImpl || globalThis.fetch;
+  const exportPath = import_node_path11.default.join(opts.outDir, EXPORT_FILE);
+  if ((0, import_node_fs11.existsSync)(exportPath)) {
+    throw commandError("EXPORT_EXISTS", 2, `${exportPath} already exists; choose an empty --out directory`);
+  }
+  (0, import_node_fs11.mkdirSync)(import_node_path11.default.join(opts.outDir, OBJECTS_DIR), { recursive: true, mode: 448 });
+  const res = await client.getRaw(`/api/admin/missions/${enc2(opts.missionId)}/export`);
+  if (!isHttpOk(res.status)) throw remoteFailureError(res.status, parseBody(await readAll(res.body)), "mission export");
+  const partial2 = `${exportPath}.partial`;
+  await (0, import_promises.pipeline)(res.body, (0, import_node_fs11.createWriteStream)(partial2, { mode: 384 }));
+  const exported = parseExport((0, import_node_fs11.readFileSync)(partial2, "utf8"));
+  (0, import_node_fs11.renameSync)(partial2, exportPath);
+  log(`export: ${exported.records.length} records, ${exported.documents.length} documents, ${exported.cases.length} cases`);
+  let direct = 0;
+  let viaApi = 0;
+  let reused = 0;
+  for (const { document: document3, content } of exported.documents) {
+    if (!content) continue;
+    const docId = String(document3.docId);
+    const file2 = import_node_path11.default.join(opts.outDir, OBJECTS_DIR, objectFileName(docId));
+    const expected = typeof content.sha256 === "string" ? content.sha256.toLowerCase() : null;
+    if (expected && (0, import_node_fs11.existsSync)(file2) && sha256((0, import_node_fs11.readFileSync)(file2)) === expected) {
+      reused += 1;
+      continue;
+    }
+    const { bytes, via } = await downloadDocument(client, content, fetchImpl);
+    if (expected && sha256(bytes) !== expected) {
+      throw commandError("DOCUMENT_HASH_MISMATCH", 1, `${docId}: downloaded bytes do not match the exported sha256`);
+    }
+    (0, import_node_fs11.writeFileSync)(file2, bytes, { mode: 384 });
+    if (via === "direct") direct += 1;
+    else viaApi += 1;
+  }
+  return {
+    ok: true,
+    source: exported.source,
+    outDir: opts.outDir,
+    counts: exported.summary.counts,
+    documentsWithoutContent: exported.summary.documentsWithoutContent,
+    downloads: { direct, viaApi, reused }
+  };
+}
+function emptyTotals() {
+  return { create: [], replace: [], unchanged: [] };
+}
+function batches(rows, maxRows = BATCH_MAX_ROWS, maxBytes = BATCH_MAX_BYTES) {
+  const out = [];
+  let current = [];
+  let size = 0;
+  for (const row of rows) {
+    const bytes = Buffer.byteLength(JSON.stringify(row));
+    if (current.length > 0 && (current.length >= maxRows || size + bytes > maxBytes)) {
+      out.push(current);
+      current = [];
+      size = 0;
+    }
+    current.push(row);
+    size += bytes;
+  }
+  if (current.length > 0) out.push(current);
+  return out;
+}
+async function runImportPass(client, exported, opts, dryRun) {
+  const base = `/api/admin/missions/${enc2(opts.missionId)}/import`;
+  const principalMap = opts.principalMap || {};
+  const documents = emptyTotals();
+  const failures = [];
+  const withoutContent = [];
+  for (const { document: document3, content } of exported.documents) {
+    const docId = String(document3.docId);
+    if (!content) {
+      withoutContent.push(docId);
+      continue;
+    }
+    const file2 = import_node_path11.default.join(opts.fromDir, OBJECTS_DIR, objectFileName(docId));
+    if (!(0, import_node_fs11.existsSync)(file2)) throw commandError("DOCUMENT_BYTES_MISSING", 1, `${file2} is missing; re-run the export into this directory to fetch it`);
+    const res = await client.post(`${base}/documents`, {
+      source: exported.source,
+      document: document3,
+      bytesBase64: (0, import_node_fs11.readFileSync)(file2).toString("base64"),
+      principalMap,
+      dryRun,
+      ...opts.changeId ? { changeId: opts.changeId } : {}
+    });
+    if (!isHttpOk(res.status)) {
+      remoteFailureHandled();
+      failures.push({ kind: "document", id: docId, status: res.status, error: asRow(res.data)?.error ?? res.data });
+      continue;
+    }
+    const action = String(asRow(res.data)?.action || "");
+    if (action === "create" || action === "replace" || action === "unchanged") documents[action].push(docId);
+  }
+  const records = emptyTotals();
+  const cases = emptyTotals();
+  const collisions = [];
+  const invalid = [];
+  const unresolvedDocumentRefs = [];
+  const unmapped = /* @__PURE__ */ new Set();
+  const sourcePrincipals = exported.members.map((m) => String(m.userId || "")).filter(Boolean);
+  const calls = [
+    ...batches(exported.cases).map((rows) => ({ cases: rows })),
+    ...batches(exported.records).map((rows) => ({ records: rows }))
+  ];
+  for (const rows of calls) {
+    const res = await client.post(base, {
+      source: exported.source,
+      ...rows,
+      principalMap,
+      sourcePrincipals,
+      dryRun,
+      ...opts.changeId ? { changeId: opts.changeId } : {}
+    });
+    const body = asRow(res.data) || {};
+    if (!isHttpOk(res.status)) remoteFailureHandled();
+    if (!isHttpOk(res.status) && res.status !== 400 && res.status !== 409) {
+      throw remoteFailureError(res.status, res.data, "mission import");
+    }
+    for (const [key, totals] of [["records", records], ["cases", cases]]) {
+      const part = asRow(body[key]) || {};
+      for (const action of ["create", "replace", "unchanged"]) {
+        const ids = part[action];
+        if (Array.isArray(ids)) totals[action].push(...ids.map(String));
+      }
+    }
+    for (const [list, key] of [[collisions, "collisions"], [invalid, "invalid"], [unresolvedDocumentRefs, "unresolvedDocumentRefs"]]) {
+      const items = body[key];
+      if (Array.isArray(items)) list.push(...items);
+    }
+    const unmappedHere = body.unmappedPrincipals;
+    if (Array.isArray(unmappedHere)) unmappedHere.forEach((p) => unmapped.add(String(p)));
+  }
+  return {
+    ok: failures.length === 0 && collisions.length === 0 && invalid.length === 0,
+    dryRun,
+    source: exported.source,
+    target: { missionId: opts.missionId },
+    documents: { ...documents, withoutContent, failures },
+    records,
+    cases,
+    collisions,
+    invalid,
+    unresolvedDocumentRefs,
+    unmappedPrincipals: [...unmapped].sort()
+  };
+}
+async function importMission(client, opts) {
+  const exportPath = import_node_path11.default.join(opts.fromDir, EXPORT_FILE);
+  if (!(0, import_node_fs11.existsSync)(exportPath)) throw commandError("EXPORT_NOT_FOUND", 2, `${exportPath} not found`);
+  const exported = parseExport((0, import_node_fs11.readFileSync)(exportPath, "utf8"));
+  if (!opts.dryRun && !opts.changeId) throw commandError("CHANGE_ID_REQUIRED", 2, "--change-id is required unless --dry-run");
+  const plan = await runImportPass(client, exported, opts, true);
+  if (opts.dryRun) return plan;
+  if (!plan.ok) {
+    throw commandError("IMPORT_BLOCKED", 1, `the dry-run found problems; nothing was written: ${JSON.stringify({
+      documentFailures: asRow(plan.documents)?.failures,
+      collisions: plan.collisions,
+      invalid: plan.invalid
+    })}`);
+  }
+  opts.log?.("import: dry-run clean, writing");
+  const written = await runImportPass(client, exported, opts, false);
+  if (!written.ok) {
+    throw commandError("IMPORT_INCOMPLETE", 1, `the import stopped part-way; re-run it once resolved: ${JSON.stringify({
+      documentFailures: asRow(written.documents)?.failures,
+      collisions: written.collisions,
+      invalid: written.invalid
+    })}`);
+  }
+  return written;
+}
+
 // src/commands/core.ts
-function readItemsFile(path9) {
-  const trimmed2 = (0, import_node_fs11.readFileSync)(path9, "utf-8").trim();
+function readItemsFile(path10) {
+  const trimmed2 = (0, import_node_fs12.readFileSync)(path10, "utf-8").trim();
   if (trimmed2.startsWith("[")) {
     const arr = JSON.parse(trimmed2);
     if (!Array.isArray(arr)) throw new Error("--file JSON must be an array of row objects");
@@ -27874,6 +28172,26 @@ var missionArgs = withArgs({
   dryRun: { type: "boolean", description: "Print the request that would be sent; perform no write" },
   pin: { type: "boolean", description: "Pin created/reused mission as CLI context" }
 });
+var missionTransferArgs = withArgs({
+  out: { type: "string", description: "mission export: directory to write export.jsonl and objects/ into (must not hold an export yet)" },
+  from: { type: "string", description: "mission import: directory written by `hive mission export`" },
+  changeId: { type: "string", description: "mission import: change or ticket id, recorded in the audit event (required unless --dry-run)" },
+  principalMap: { type: "string", description: "mission import: JSON file mapping source principal ids to target principal ids" },
+  dryRun: { type: "boolean", description: "mission import: report what would change; write nothing" }
+});
+function explicitMissionId(args, action) {
+  const missionId = String(args.missionId || args.id || "").trim();
+  if (!missionId) throw commandError("MISSION_REQUIRED", 2, `${action} needs --mission-id <id> (a pinned mission is not used here)`);
+  return missionId;
+}
+function readPrincipalMap(file2) {
+  if (!file2) return {};
+  const raw = readJsonFile(String(file2));
+  if (!raw || typeof raw !== "object" || Array.isArray(raw) || !Object.values(raw).every((v) => typeof v === "string" && v !== "")) {
+    throw commandError("INVALID_PRINCIPAL_MAP", 2, "--principal-map must be a JSON object of source id \u2192 target id strings");
+  }
+  return raw;
+}
 var mission = defineCommand({
   meta: { name: "mission", description: "Missions, their cases, bundles and members" },
   args: missionArgs,
@@ -27914,6 +28232,45 @@ var mission = defineCommand({
         return runMissionSummary(args);
       }
     }),
+    export: defineCommand({
+      meta: {
+        name: "export",
+        description: "Export a mission (records, cases, documents with their bytes, member ids) into a directory (--mission-id, --out; admin)"
+      },
+      args: missionTransferArgs,
+      async run({ args }) {
+        const { client, fmt } = ctx(args);
+        const missionId = explicitMissionId(args, "mission export");
+        const outDir = String(args.out || "").trim();
+        if (!outDir) throw commandError("OUT_REQUIRED", 2, "mission export needs --out <directory>");
+        const result = await exportMission(client, { missionId, outDir, log: (l) => process.stderr.write(`${l}
+`) });
+        return output(result, fmt);
+      }
+    }),
+    import: defineCommand({
+      meta: {
+        name: "import",
+        description: "Import a `hive mission export` directory into an existing mission of this tenant, without re-evaluation (--mission-id, --from, --change-id; admin)"
+      },
+      args: missionTransferArgs,
+      async run({ args }) {
+        const { client, fmt } = ctx(args);
+        const missionId = explicitMissionId(args, "mission import");
+        const fromDir = String(args.from || "").trim();
+        if (!fromDir) throw commandError("FROM_REQUIRED", 2, "mission import needs --from <directory>");
+        const result = await importMission(client, {
+          missionId,
+          fromDir,
+          changeId: args.changeId ? String(args.changeId) : void 0,
+          principalMap: readPrincipalMap(args.principalMap),
+          dryRun: args.dryRun === true,
+          log: (l) => process.stderr.write(`${l}
+`)
+        });
+        return output(result, fmt);
+      }
+    }),
     use: defineCommand({
       meta: { name: "use", description: "Pin a mission id for later commands (--id)" },
       args: missionArgs,
@@ -28094,9 +28451,9 @@ var mission = defineCommand({
             const missionId = requireMissionContext(args, "mission member grant");
             const principal = resolvePrincipal(args);
             const body = { ...principal, role: validateMissionGrantRole(args.role) };
-            const path9 = `/api/missions/${enc(missionId)}/members`;
-            if (args.dryRun) return output(dryRunResult("POST", path9, body), fmt);
-            const res = await client.post(path9, body);
+            const path10 = `/api/missions/${enc(missionId)}/members`;
+            if (args.dryRun) return output(dryRunResult("POST", path10, body), fmt);
+            const res = await client.post(path10, body);
             assertMissionMembershipOk(res.status, res.data, "grant mission member");
             const data = recordOf3(res.data);
             const created = data.created === true;
@@ -28122,9 +28479,9 @@ var mission = defineCommand({
               throw commandError("EMAIL_INVALID", 2, `--email '${raw}' is not an email. admit is by email; use \`mission members grant --principal-sub\` for an OIDC sub.`);
             }
             const body = { principalEmail: raw, role: validateMissionGrantRole(args.role) };
-            const path9 = `/api/missions/${enc(missionId)}/members`;
-            if (args.dryRun) return output(dryRunResult("POST", path9, body), fmt);
-            const res = await client.post(path9, body);
+            const path10 = `/api/missions/${enc(missionId)}/members`;
+            if (args.dryRun) return output(dryRunResult("POST", path10, body), fmt);
+            const res = await client.post(path10, body);
             assertMissionMembershipOk(res.status, res.data, "admit mission member");
             const data = recordOf3(res.data);
             const created = data.created === true;
@@ -28176,9 +28533,9 @@ var mission = defineCommand({
             printContextNotice(args, { mission: true });
             const missionId = requireMissionContext(args, "mission member revoke");
             const userId = reqAny(args, "userId", "id", "principalSub");
-            const path9 = `/api/missions/${enc(missionId)}/members/${enc(userId)}`;
-            if (args.dryRun) return output(dryRunResult("DELETE", path9), fmt);
-            const res = await client.del(path9);
+            const path10 = `/api/missions/${enc(missionId)}/members/${enc(userId)}`;
+            if (args.dryRun) return output(dryRunResult("DELETE", path10), fmt);
+            const res = await client.del(path10);
             if (res.status === 404 && recordOf3(res.data).error === "member_not_found") {
               remoteFailureHandled();
               return output({ revoked: false, notFound: true, userId }, fmt);
@@ -28227,10 +28584,10 @@ var mission = defineCommand({
                 "Changing tenantWideRead to true broadens mission visibility to the whole tenant. Re-run with --yes."
               );
             }
-            const path9 = `/api/missions/${enc(missionId)}/access-policy`;
+            const path10 = `/api/missions/${enc(missionId)}/access-policy`;
             const body = { tenantWideRead };
-            if (args.dryRun) return output(dryRunResult("PATCH", path9, body), fmt);
-            const res = await client.patch(path9, body);
+            if (args.dryRun) return output(dryRunResult("PATCH", path10, body), fmt);
+            const res = await client.patch(path10, body);
             assertRemoteOk(res.status, res.data, "set mission access policy");
             return output({ updated: true, missionId, policy: recordOf3(res.data).policy ?? { tenantWideRead } }, fmt);
           }
@@ -28519,16 +28876,16 @@ var upgrade = defineCommand({
 
 // src/commands/data.ts
 init_cjs_shims();
-var import_node_fs13 = __toESM(require("fs"), 1);
-var import_node_path12 = __toESM(require("path"), 1);
+var import_node_fs14 = __toESM(require("fs"), 1);
+var import_node_path13 = __toESM(require("path"), 1);
 var ajvModule2 = __toESM(require_ajv(), 1);
 var ajvFormatsModule2 = __toESM(require_dist(), 1);
 
 // src/lib/application-package.ts
 init_cjs_shims();
-var import_node_crypto5 = require("crypto");
-var import_node_fs12 = require("fs");
-var import_node_path11 = require("path");
+var import_node_crypto6 = require("crypto");
+var import_node_fs13 = require("fs");
+var import_node_path12 = require("path");
 var ajvModule = __toESM(require_ajv(), 1);
 var ajvFormatsModule = __toESM(require_dist(), 1);
 
@@ -28646,7 +29003,7 @@ var envelopeAjv = new AjvCtor({ allErrors: true, strict: false });
 addFormats(envelopeAjv);
 var validateStarterEnvelope = envelopeAjv.compile(DEFAULT_ENVELOPE_SCHEMA);
 function sha256Hex(bytes) {
-  return (0, import_node_crypto5.createHash)("sha256").update(bytes).digest("hex");
+  return (0, import_node_crypto6.createHash)("sha256").update(bytes).digest("hex");
 }
 function formatBytes(n) {
   if (n >= 1024 * 1024) return `${(n / (1024 * 1024)).toFixed(1)} MiB`;
@@ -28654,7 +29011,7 @@ function formatBytes(n) {
   return `${n} B`;
 }
 function loadApplicationPackage(inputPath, opts = {}) {
-  const st = (0, import_node_fs12.statSync)(inputPath);
+  const st = (0, import_node_fs13.statSync)(inputPath);
   const envelope = st.isDirectory() ? buildEnvelopeFromDirectory(inputPath) : readEnvelopeJson(inputPath);
   const validation = validateApplicationEnvelope(envelope, {
     inputPath,
@@ -28664,7 +29021,7 @@ function loadApplicationPackage(inputPath, opts = {}) {
   return { envelope, summary: validation.summary, validation };
 }
 function readEnvelopeJson(inputPath) {
-  const parsed = JSON.parse((0, import_node_fs12.readFileSync)(inputPath, "utf8"));
+  const parsed = JSON.parse((0, import_node_fs13.readFileSync)(inputPath, "utf8"));
   const envelope = parsed?.envelope && typeof parsed.envelope === "object" ? parsed.envelope : parsed;
   if (!envelope || typeof envelope !== "object" || Array.isArray(envelope)) {
     throw new Error(`${inputPath}: expected a JobApplication envelope object or { "envelope": ... } wrapper`);
@@ -28673,10 +29030,10 @@ function readEnvelopeJson(inputPath) {
 }
 function buildEnvelopeFromDirectory(folder) {
   const entries = [];
-  for (const name of (0, import_node_fs12.readdirSync)(folder).sort((a, b) => a.localeCompare(b))) {
+  for (const name of (0, import_node_fs13.readdirSync)(folder).sort((a, b) => a.localeCompare(b))) {
     if (name.startsWith(".")) continue;
-    const full = (0, import_node_path11.join)(folder, name);
-    if (!(0, import_node_fs12.statSync)(full).isFile()) continue;
+    const full = (0, import_node_path12.join)(folder, name);
+    if (!(0, import_node_fs13.statSync)(full).isFile()) continue;
     const match = name.match(APP_FILE_RE);
     const wireMatch = match ? null : name.match(WIRE_FILE_RE);
     if (!match && !wireMatch) continue;
@@ -28685,7 +29042,7 @@ function buildEnvelopeFromDirectory(folder) {
     const ext = (match ? match[3] : wireMatch[2]).toLowerCase();
     let role = "pdf";
     if (ext === "xml") {
-      const xml = (0, import_node_fs12.readFileSync)(full, "utf8");
+      const xml = (0, import_node_fs13.readFileSync)(full, "utf8");
       if (/<Document[\s>]/i.test(xml)) role = "manifest";
       else if (FORM_XML_RE.test(xml)) role = "form";
       else continue;
@@ -28708,8 +29065,8 @@ function buildEnvelopeFromDirectory(folder) {
   group.sort((a, b) => roleOrder[a.role] - roleOrder[b.role] || partNo(a.partName) - partNo(b.partName));
   const applicationId = group[0].applicationId;
   const form = group.find((entry) => entry.role === "form");
-  const createdAt = form ? extractElement((0, import_node_fs12.readFileSync)(form.path, "utf8"), "sendtimestamp") : null;
-  const files = group.map((entry) => inlineFile(entry.filename, (0, import_node_fs12.readFileSync)(entry.path), entry.ext));
+  const createdAt = form ? extractElement((0, import_node_fs13.readFileSync)(form.path, "utf8"), "sendtimestamp") : null;
+  const files = group.map((entry) => inlineFile(entry.filename, (0, import_node_fs13.readFileSync)(entry.path), entry.ext));
   return {
     schema_version: "1.0",
     application_id: applicationId,
@@ -28815,13 +29172,13 @@ function appendStarterSchemaErrors(envelope, errors) {
   }
 }
 function formatSchemaError(error51) {
-  const path9 = error51.instancePath || "/";
+  const path10 = error51.instancePath || "/";
   if (error51.keyword === "additionalProperties") {
     const params = recordOf4(error51.params);
     const prop = String(params.additionalProperty || "");
-    return `schema ${path9}: additional property '${prop}' is not allowed`;
+    return `schema ${path10}: additional property '${prop}' is not allowed`;
   }
-  return `schema ${path9}: ${error51.message || error51.keyword}`;
+  return `schema ${path10}: ${error51.message || error51.keyword}`;
 }
 function recordOf4(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
@@ -28905,7 +29262,7 @@ function extractManifestParts(xml) {
   return parts;
 }
 function producerPartName(filename) {
-  const match = (0, import_node_path11.basename)(filename).match(APP_FILE_RE);
+  const match = (0, import_node_path12.basename)(filename).match(APP_FILE_RE);
   return match?.[2] || null;
 }
 function textOf(xml, tag) {
@@ -28922,7 +29279,7 @@ function summarizeEnvelope(envelope, opts) {
   return {
     compatibility: APPLICATION_PACKAGE_COMPATIBILITY,
     source: opts.source,
-    inputPath: opts.inputPath ? statMaybe(opts.inputPath)?.isDirectory() ? opts.inputPath : (0, import_node_path11.basename)(opts.inputPath) : "",
+    inputPath: opts.inputPath ? statMaybe(opts.inputPath)?.isDirectory() ? opts.inputPath : (0, import_node_path12.basename)(opts.inputPath) : "",
     schemaVersion: envelope.schema_version ? String(envelope.schema_version) : null,
     packageFormatVersion: envelope.package_format_version ? String(envelope.package_format_version) : null,
     applicationId: envelope.application_id ? String(envelope.application_id) : null,
@@ -28945,7 +29302,7 @@ function summarizeEnvelope(envelope, opts) {
 }
 function statMaybe(inputPath) {
   try {
-    return (0, import_node_fs12.statSync)(inputPath);
+    return (0, import_node_fs13.statSync)(inputPath);
   } catch {
     return null;
   }
@@ -29026,7 +29383,7 @@ function localValidationOutput(validation) {
 }
 function contentTypeFor(filePath, override) {
   if (typeof override === "string" && override.trim()) return override.trim();
-  const ext = import_node_path12.default.extname(filePath).toLowerCase();
+  const ext = import_node_path13.default.extname(filePath).toLowerCase();
   if (ext === ".pdf") return "application/pdf";
   if (ext === ".xml") return "application/xml";
   if (ext === ".json") return "application/json";
@@ -29046,8 +29403,8 @@ var ingest = defineCommand({
         const body = { missionId: args.missionId, caseId: args.caseId };
         if (args.url) body.url = args.url;
         if (args.file) {
-          body.filename = import_node_path12.default.basename(args.file);
-          body.contentBase64 = import_node_fs13.default.readFileSync(args.file).toString("base64");
+          body.filename = import_node_path13.default.basename(args.file);
+          body.contentBase64 = import_node_fs14.default.readFileSync(args.file).toString("base64");
         }
         return output((await client.post("/api/ingest", body)).data, fmt);
       }
@@ -29635,10 +29992,10 @@ var document2 = defineCommand({
         const missionId = requireMissionContext(args, "document upload");
         req(args, "file");
         const filePath = String(args.file);
-        const bytes = import_node_fs13.default.readFileSync(filePath);
+        const bytes = import_node_fs14.default.readFileSync(filePath);
         if (!bytes.length) throw commandError("EMPTY_FILE", 1, `${filePath} is empty`);
         const body = {
-          filename: args.filename || import_node_path12.default.basename(filePath),
+          filename: args.filename || import_node_path13.default.basename(filePath),
           contentType: contentTypeFor(filePath, args.contentType),
           bytesBase64: bytes.toString("base64")
         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@senticor/hive",
-  "version": "1.47.0",
+  "version": "1.48.0",
   "description": "Cognitive Hive OS — unified CLI",
   "type": "commonjs",
   "bin": {