@senticor/hive 1.80.2 → 1.82.0

package/hive.cjs

@@ -10376,22 +10376,22 @@ var artifactName = injectedString(
   true ? "hive-cli" : void 0
 ) || String(process.env.HIVE_CLI_ARTIFACT_NAME || "hive-cli").trim() || "hive-cli";
 var packageVersion = injectedString(
-  true ? "1.80.2" : void 0
+  true ? "1.82.0" : void 0
 ) || String(process.env.HIVE_CLI_PACKAGE_VERSION || "").trim() || readPackageVersion();
 var releaseVersion = injectedString(
-  true ? "1.80.2" : void 0
+  true ? "1.82.0" : void 0
 ) || String(process.env.HIVE_CLI_RELEASE_VERSION || "").trim() || packageVersion || "dev";
 var releaseChannel = injectedString(
   true ? "final" : void 0
 ) || String(process.env.HIVE_CLI_RELEASE_CHANNEL || "").trim() || (releaseVersion.includes("-rc.") ? "rc" : releaseVersion === "dev" ? "dev" : "final");
 var buildCommit = injectedString(
-  true ? "85fa5397b257276d240289d501c571f329a3402a" : void 0
+  true ? "2f846d7d534f6f999f7f38cdd33899cc544a2d4d" : void 0
 ) || String(process.env.HIVE_CLI_BUILD_COMMIT || "").trim() || "unknown";
 var buildTimestamp = injectedString(
-  true ? "2026-10-28T20:25:06Z" : void 0
+  true ? "2026-10-28T23:24:20Z" : void 0
 ) || String(process.env.HIVE_CLI_BUILD_TIMESTAMP || "").trim() || "unknown";
 var ociRef = injectedString(
-  true ? "registry.onstackit.cloud/senticor/hive-cli:1.80.2" : void 0
+  true ? "registry.onstackit.cloud/senticor/hive-cli:1.82.0" : void 0
 ) || String(process.env.HIVE_CLI_OCI_REF || "").trim() || `registry.onstackit.cloud/senticor/${artifactName}:${releaseVersion}`;
 var RELEASE_INFO = Object.freeze({
   packageVersion,
@@ -32580,6 +32580,127 @@ function canonicalPinKey(tenant) {
 function rolesFromArgs(args) {
   return [.../* @__PURE__ */ new Set([...normalizeCliList(args.roles), ...normalizeCliList(args.role)])];
 }
+async function listMembers(client, tenantId) {
+  const res = await client.get(`/api/admin/orgs/${enc(tenantId)}/members`);
+  ensureOk(res.status, res.data, "list tenant members");
+  const rows = recordOf2(res.data).memberships;
+  return (Array.isArray(rows) ? rows : []).map((row) => {
+    const m = recordOf2(row);
+    const principal = recordOf2(m.principal);
+    return {
+      membershipId: String(m.membershipId ?? ""),
+      membershipStatus: String(m.membershipStatus ?? ""),
+      roles: Array.isArray(m.roles) ? m.roles.map(String).sort() : [],
+      principalId: String(principal.principalId ?? ""),
+      email: String(principal.email ?? "").toLowerCase()
+    };
+  });
+}
+function findMember(members2, by) {
+  if (by.principalId) return members2.find((m) => m.principalId === by.principalId);
+  return members2.find((m) => m.email === by.email);
+}
+function memberSelector(args) {
+  const principalId = String(args.principalId || "").trim();
+  const email3 = String(args.email || "").trim().toLowerCase();
+  if (principalId && email3) {
+    throw commandError("CONFLICTING_ARGS", EXIT_GUARDRAIL, "Pass --principal-id or --email, not both.");
+  }
+  if (!principalId && !email3) {
+    throw commandError("MEMBER_REQUIRED", 1, "Pass --email <address> or --principal-id <uuid>.");
+  }
+  return principalId ? { principalId } : { email: email3 };
+}
+async function requireMember(client, tenantId, args) {
+  const by = memberSelector(args);
+  const member = findMember(await listMembers(client, tenantId), by);
+  if (!member) {
+    throw commandError(
+      "MEMBER_NOT_FOUND",
+      1,
+      `${by.email ?? by.principalId} is not a member of tenant ${tenantId}. Run 'hive org members list'.`
+    );
+  }
+  return member;
+}
+var without = (a, b) => a.filter((x) => !b.includes(x));
+async function forEachRole(roles, action, call) {
+  const done = [];
+  for (const role of roles) {
+    const res = await call(role);
+    if (!isHttpOk(res.status)) {
+      if (done.length) {
+        throw commandError(
+          "PARTIAL_ROLE_CHANGE",
+          3,
+          `${action} '${role}' failed (HTTP ${res.status}) after ${done.join(", ")} succeeded. Re-run with the remaining roles.`
+        );
+      }
+      ensureOk(res.status, res.data, `${action} '${role}'`);
+    }
+    done.push(role);
+  }
+}
+async function changeRoles(args, action) {
+  printContextNotice(args, { adminScope: true });
+  const { tenantId } = await resolveTenantId(args);
+  const roles = rolesFromArgs(args);
+  if (!roles.length) throw commandError("ROLE_REQUIRED", 1, "Pass --roles <role-a,role-b> or --role <role-key>.");
+  const { client } = adminCtx(args);
+  const before = await requireMember(client, tenantId, args);
+  const base = `/api/admin/orgs/${enc(tenantId)}/members/${enc(before.principalId)}/roles`;
+  await forEachRole(
+    roles,
+    `${action} tenant role`,
+    (role) => action === "grant" ? client.put(base, { roleKey: role }) : client.del(`${base}/${enc(role)}`)
+  );
+  const after = findMember(await listMembers(client, tenantId), { principalId: before.principalId });
+  const rolesAfter = after?.roles ?? [];
+  const changed = action === "grant" ? without(rolesAfter, before.roles) : without(before.roles, rolesAfter);
+  return {
+    ok: true,
+    tenantId,
+    principalId: before.principalId,
+    // The single-role answer's field, kept for scripts that read it.
+    ...roles.length === 1 ? { roleKey: roles[0] } : {},
+    roles,
+    rolesBefore: before.roles,
+    rolesAfter,
+    [action === "grant" ? "rolesAdded" : "rolesRemoved"]: changed,
+    idempotent: changed.length === 0
+  };
+}
+async function changeMembership(args, target) {
+  printContextNotice(args, { adminScope: true });
+  const { tenantId } = await resolveTenantId(args);
+  const { client } = adminCtx(args);
+  const before = await requireMember(client, tenantId, args);
+  const path10 = `/api/admin/orgs/${enc(tenantId)}/members`;
+  let res;
+  if (target === "suspended") {
+    res = await client.patch(`${path10}/${enc(before.membershipId)}`, { status: "suspended" });
+  } else if (target === "revoked") {
+    res = await client.del(`${path10}/${enc(before.membershipId)}`);
+  } else {
+    if (!before.email) {
+      throw commandError("EMAIL_UNKNOWN", 1, `Member ${before.principalId} has no email, which re-admission needs.`);
+    }
+    res = await client.post(path10, { email: before.email, roles: [] });
+  }
+  ensureOk(res.status, res.data, `${target === "active" ? "reactivate" : target === "revoked" ? "revoke" : "suspend"} membership`);
+  const after = findMember(await listMembers(client, tenantId), { principalId: before.principalId });
+  return {
+    ok: true,
+    tenantId,
+    principalId: before.principalId,
+    email: before.email || null,
+    membershipId: before.membershipId,
+    membershipStatusBefore: before.membershipStatus,
+    membershipStatus: after?.membershipStatus ?? target,
+    rolesAfter: after?.roles ?? [],
+    idempotent: before.membershipStatus === target
+  };
+}
 function ensureAuthorized(status2, action) {
   if (status2 === 401 || status2 === 403) {
     throw commandError(
@@ -32689,9 +32810,45 @@ var org = defineCommand({
             if (args.displayName) body.displayName = args.displayName;
             if (args.kind) body.kind = args.kind;
             const { client, fmt } = adminCtx(args);
+            const email3 = String(args.email).trim().toLowerCase();
+            const before = findMember(await listMembers(client, tenantId), { email: email3 });
             const res = await client.post(`/api/admin/orgs/${enc(tenantId)}/members`, body);
             ensureOk(res.status, res.data, "admit tenant member");
-            return output({ ...recordOf2(res.data), idempotent: true }, fmt);
+            const after = findMember(await listMembers(client, tenantId), { email: email3 });
+            const rolesBefore = before?.roles ?? [];
+            const rolesAfter = after?.roles ?? [];
+            const rolesAdded = without(rolesAfter, rolesBefore);
+            return output({
+              ...recordOf2(res.data),
+              created: !before,
+              membershipStatusBefore: before?.membershipStatus ?? null,
+              membershipStatus: after?.membershipStatus ?? null,
+              rolesBefore,
+              rolesAfter,
+              rolesAdded,
+              idempotent: Boolean(before) && before?.membershipStatus === "active" && rolesAdded.length === 0
+            }, fmt);
+          }
+        }),
+        suspend: defineCommand({
+          meta: { name: "suspend", description: "Suspend a membership (--email or --principal-id); reactivate undoes it" },
+          args: orgArgs,
+          async run({ args }) {
+            return output(await changeMembership(args, "suspended"), adminCtx(args).fmt);
+          }
+        }),
+        revoke: defineCommand({
+          meta: { name: "revoke", description: "Remove a person from the tenant (--email or --principal-id); their roles go too" },
+          args: orgArgs,
+          async run({ args }) {
+            return output(await changeMembership(args, "revoked"), adminCtx(args).fmt);
+          }
+        }),
+        reactivate: defineCommand({
+          meta: { name: "reactivate", description: "Make a suspended or revoked membership active again (--email or --principal-id)" },
+          args: orgArgs,
+          async run({ args }) {
+            return output(await changeMembership(args, "active"), adminCtx(args).fmt);
           }
         })
       }
@@ -32701,33 +32858,17 @@ var org = defineCommand({
       args: orgArgs,
       subCommands: {
         grant: defineCommand({
-          meta: { name: "grant", description: "Grant a tenant role to a principal" },
+          meta: { name: "grant", description: "Grant tenant roles to a member (--roles a,b; --email or --principal-id)" },
           args: orgArgs,
           async run({ args }) {
-            printContextNotice(args, { adminScope: true });
-            const { tenantId } = await resolveTenantId(args);
-            req(args, "principalId");
-            const role = rolesFromArgs(args)[0];
-            if (!role) throw commandError("ROLE_REQUIRED", 1, "Pass --role <role-key>.");
-            const { client, fmt } = adminCtx(args);
-            const res = await client.put(`/api/admin/orgs/${enc(tenantId)}/members/${enc(args.principalId)}/roles`, { roleKey: role });
-            ensureOk(res.status, res.data, "grant tenant role");
-            return output({ ...recordOf2(res.data), idempotent: true }, fmt);
+            return output(await changeRoles(args, "grant"), adminCtx(args).fmt);
           }
         }),
         revoke: defineCommand({
-          meta: { name: "revoke", description: "Revoke a tenant role from a principal" },
+          meta: { name: "revoke", description: "Revoke tenant roles from a member (--roles a,b; --email or --principal-id)" },
           args: orgArgs,
           async run({ args }) {
-            printContextNotice(args, { adminScope: true });
-            const { tenantId } = await resolveTenantId(args);
-            req(args, "principalId");
-            const role = rolesFromArgs(args)[0];
-            if (!role) throw commandError("ROLE_REQUIRED", 1, "Pass --role <role-key>.");
-            const { client, fmt } = adminCtx(args);
-            const res = await client.del(`/api/admin/orgs/${enc(tenantId)}/members/${enc(args.principalId)}/roles/${enc(role)}`);
-            ensureOk(res.status, res.data, "revoke tenant role");
-            return output(res.data, fmt);
+            return output(await changeRoles(args, "revoke"), adminCtx(args).fmt);
           }
         })
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@senticor/hive",
-  "version": "1.80.2",
+  "version": "1.82.0",
   "description": "Cognitive Hive OS — unified CLI",
   "type": "commonjs",
   "bin": {