@senticor/hive 1.56.2 → 1.56.6

package/chive.cjs

@@ -32,8 +32,8 @@ var getImportMetaUrl = () => typeof document === "undefined" ? new URL(`file:${_
 var importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
 
 // src/chive.mts
-var import_node_fs = __toESM(require("fs"), 1);
-var import_node_path = __toESM(require("path"), 1);
+var import_node_fs2 = __toESM(require("fs"), 1);
+var import_node_path2 = __toESM(require("path"), 1);
 
 // ../hive-kernel-code-context/src/index.ts
 var src_exports = {};
@@ -362,7 +362,7 @@ __export(graph_builder_exports, {
 var path4 = __toESM(require("path"), 1);
 
 // ../hive-utils/dist/index.js
-var import_node_crypto2 = require("crypto");
+var import_node_crypto3 = require("crypto");
 
 // ../hive-utils/dist/pagination.js
 var import_node_crypto = require("crypto");
@@ -391,6 +391,20 @@ var INGEST_LIMIT_SPEC = {
   manifestMaxApplicationIds: { env: "HIVE_MANIFEST_MAX_APPLICATION_IDS", default: 1e5, ceiling: 1e5 },
   /** Max attached documents per application. */
   maxDocsPerApplication: { env: "HIVE_MAX_DOCS_PER_APPLICATION", default: 50 },
+  /**
+   * Max decoded bytes for one REST application submit (#242) — the whole
+   * dossier travels as one base64 JSON body on
+   * POST /api/missions/:missionId/applications, so this is a heap/DoS bound:
+   * a ~35 MiB body (25 MiB of PDFs) costs ~65-70 MiB peak heap per request.
+   * The submit route sizes its own bodyLimit from this cap (base64 + JSON
+   * envelope), the decoded total is enforced on the door (413
+   * APPLICATION_TOO_LARGE — L4, an advertised cap is never unenforced), and an
+   * env override is clamped to `ceiling` so a typo cannot turn the door into an
+   * unbounded body sink (L3). Default 26 MiB: the realistic upper end is 25 MiB
+   * of PDFs (same figure as maxIngestFileBytes) plus headroom for the
+   * application form and file names.
+   */
+  maxApplicationBytes: { env: "HIVE_MAX_APPLICATION_BYTES", default: 26 * 1024 * 1024, ceiling: 100 * 1024 * 1024 },
   // NOTE: a per-jobposting application ceiling is intentionally NOT advertised
   // here yet — enforcing it needs a durable per-jobposting counter at ingest,
   // deferred to a follow-up. Advertising an unenforced limit would mislead
@@ -424,9 +438,17 @@ var INGEST_LIMIT_SPEC = {
   maxKafkaTlsCaPemBytes: { env: "HIVE_MAX_KAFKA_TLS_CA_PEM_BYTES", default: 64 * 1024, ceiling: 64 * 1024 }
 };
 
+// ../hive-utils/dist/metrics-auth.js
+var import_node_fs = require("fs");
+var import_node_crypto2 = require("crypto");
+
+// ../hive-utils/dist/cgroup-metrics.js
+var import_promises = require("fs/promises");
+var import_node_path = require("path");
+
 // ../hive-utils/dist/index.js
 function sha256Hex(input) {
-  const h = (0, import_node_crypto2.createHash)("sha256");
+  const h = (0, import_node_crypto3.createHash)("sha256");
   h.update(input);
   return h.digest("hex");
 }
@@ -1142,9 +1164,9 @@ function stringListFlag(name) {
   return splitList(stringFlag(name));
 }
 function readJsonFile(p, label) {
-  if (!import_node_fs.default.existsSync(p)) dieUsage(`${label} not found at ${p}`);
+  if (!import_node_fs2.default.existsSync(p)) dieUsage(`${label} not found at ${p}`);
   try {
-    return JSON.parse(import_node_fs.default.readFileSync(p, "utf8"));
+    return JSON.parse(import_node_fs2.default.readFileSync(p, "utf8"));
   } catch (error) {
     dieRuntime(new Error(`${label} is not valid JSON: ${errorMessage2(error)}`));
   }
@@ -1153,8 +1175,8 @@ function writeResult(obj) {
   const json = JSON.stringify(obj, null, 2);
   const out = stringFlag("out");
   if (out) {
-    import_node_fs.default.writeFileSync(out, json + "\n");
-    console.error(`chive: wrote ${import_node_path.default.resolve(out)}`);
+    import_node_fs2.default.writeFileSync(out, json + "\n");
+    console.error(`chive: wrote ${import_node_path2.default.resolve(out)}`);
   } else {
     process.stdout.write(json + "\n");
   }
@@ -1198,9 +1220,9 @@ async function patchRecord(recordId, patch) {
 function readPacketIfSet() {
   const packetPath = stringFlag("packet");
   if (!packetPath) return null;
-  if (!import_node_fs.default.existsSync(packetPath)) dieUsage(`packet file not found at ${packetPath}`);
+  if (!import_node_fs2.default.existsSync(packetPath)) dieUsage(`packet file not found at ${packetPath}`);
   try {
-    return JSON.parse(import_node_fs.default.readFileSync(packetPath, "utf8"));
+    return JSON.parse(import_node_fs2.default.readFileSync(packetPath, "utf8"));
   } catch (error) {
     dieRuntime(new Error(`packet is not valid JSON: ${errorMessage2(error)}`));
   }
@@ -1210,8 +1232,8 @@ function readBodyIfSet() {
   if (body) return body;
   const bodyFile = stringFlag("body-file");
   if (bodyFile) {
-    if (!import_node_fs.default.existsSync(bodyFile)) dieUsage(`body-file not found at ${bodyFile}`);
-    return import_node_fs.default.readFileSync(bodyFile, "utf8");
+    if (!import_node_fs2.default.existsSync(bodyFile)) dieUsage(`body-file not found at ${bodyFile}`);
+    return import_node_fs2.default.readFileSync(bodyFile, "utf8");
   }
   return null;
 }

package/hive.cjs

@@ -10376,22 +10376,22 @@ var artifactName = injectedString(
   true ? "hive-cli" : void 0
 ) || String(process.env.HIVE_CLI_ARTIFACT_NAME || "hive-cli").trim() || "hive-cli";
 var packageVersion = injectedString(
-  true ? "1.56.2" : void 0
+  true ? "1.56.6" : void 0
 ) || String(process.env.HIVE_CLI_PACKAGE_VERSION || "").trim() || readPackageVersion();
 var releaseVersion = injectedString(
-  true ? "1.56.2" : void 0
+  true ? "1.56.6" : void 0
 ) || String(process.env.HIVE_CLI_RELEASE_VERSION || "").trim() || packageVersion || "dev";
 var releaseChannel = injectedString(
   true ? "final" : void 0
 ) || String(process.env.HIVE_CLI_RELEASE_CHANNEL || "").trim() || (releaseVersion.includes("-rc.") ? "rc" : releaseVersion === "dev" ? "dev" : "final");
 var buildCommit = injectedString(
-  true ? "407c8e75d7df35ee0507938070ba9e60e415fd14" : void 0
+  true ? "073497b4b00ea31b2afe6c121da4a60ad4e2f6c5" : void 0
 ) || String(process.env.HIVE_CLI_BUILD_COMMIT || "").trim() || "unknown";
 var buildTimestamp = injectedString(
-  true ? "2026-10-08T13:48:26Z" : void 0
+  true ? "2026-10-09T12:26:32Z" : void 0
 ) || String(process.env.HIVE_CLI_BUILD_TIMESTAMP || "").trim() || "unknown";
 var ociRef = injectedString(
-  true ? "registry.onstackit.cloud/senticor/hive-cli:1.56.2" : void 0
+  true ? "registry.onstackit.cloud/senticor/hive-cli:1.56.6" : void 0
 ) || String(process.env.HIVE_CLI_OCI_REF || "").trim() || `registry.onstackit.cloud/senticor/${artifactName}:${releaseVersion}`;
 var RELEASE_INFO = Object.freeze({
   packageVersion,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@senticor/hive",
-  "version": "1.56.2",
+  "version": "1.56.6",
   "description": "Cognitive Hive OS — unified CLI",
   "type": "commonjs",
   "bin": {