@senticor/hive 1.87.2 → 1.88.0

package/hive.cjs

@@ -8630,6 +8630,21 @@ var ROLE_KEY_RE = /^[a-z0-9][a-z0-9._:-]{0,63}$/;
 function hasTenantAudienceDelimiter(displayKey) {
   return /[\s,]/.test(String(displayKey || "").trim());
 }
+var MAX_TENANT_DISPLAY_NAME_LENGTH = 200;
+var CONTROL_CHARS = new RegExp("\\p{Cc}", "u");
+function parseOptionalTenantDisplayName(value, field = "displayName") {
+  if (value === void 0) return void 0;
+  if (value === null) return null;
+  if (typeof value !== "string") throw new Error(`${field} must be a string or null`);
+  const name = value.trim();
+  if (!name) throw new Error(`${field} must be a non-empty string (send null to clear it)`);
+  if (CONTROL_CHARS.test(name)) throw new Error(`${field} must not contain control characters (line breaks, tabs, NUL)`);
+  const length = [...name].length;
+  if (length > MAX_TENANT_DISPLAY_NAME_LENGTH) {
+    throw new Error(`${field} is too long (${length} characters); at most ${MAX_TENANT_DISPLAY_NAME_LENGTH}`);
+  }
+  return name;
+}
 
 // src/lib/client.ts
 init_cjs_shims();
@@ -8686,6 +8701,14 @@ function promptText(query) {
     });
   });
 }
+var TOKEN_ENV_VARS = ["HIVE_TOKEN", "HIVE_TEST_TOKEN", "HIVE_BEARER_TOKEN"];
+function envToken(env = process.env) {
+  for (const variable of TOKEN_ENV_VARS) {
+    const token = env[variable];
+    if (token) return { token, variable };
+  }
+  return null;
+}
 function parseJwt(token) {
   try {
     const parts = token.split(".");
@@ -9375,7 +9398,7 @@ var HiveClient = class {
     const headers = { accept };
     if (this.tenant) headers["x-hive-tenant"] = this.tenant;
     try {
-      const token = process.env.HIVE_TOKEN || process.env.HIVE_TEST_TOKEN || process.env.HIVE_BEARER_TOKEN || await getValidToken();
+      const token = envToken()?.token || await getValidToken();
       if (token) headers["authorization"] = `Bearer ${token}`;
     } catch (e) {
       if (this.verbose) console.error("Warning: Could not fetch auth token", e.message);
@@ -10376,22 +10399,22 @@ var artifactName = injectedString(
   true ? "hive-cli" : void 0
 ) || String(process.env.HIVE_CLI_ARTIFACT_NAME || "hive-cli").trim() || "hive-cli";
 var packageVersion = injectedString(
-  true ? "1.87.2" : void 0
+  true ? "1.88.0" : void 0
 ) || String(process.env.HIVE_CLI_PACKAGE_VERSION || "").trim() || readPackageVersion();
 var releaseVersion = injectedString(
-  true ? "1.87.2" : void 0
+  true ? "1.88.0" : void 0
 ) || String(process.env.HIVE_CLI_RELEASE_VERSION || "").trim() || packageVersion || "dev";
 var releaseChannel = injectedString(
   true ? "final" : void 0
 ) || String(process.env.HIVE_CLI_RELEASE_CHANNEL || "").trim() || (releaseVersion.includes("-rc.") ? "rc" : releaseVersion === "dev" ? "dev" : "final");
 var buildCommit = injectedString(
-  true ? "a96123fb3acccd513fb8e7aa2acd3767c46e56a2" : void 0
+  true ? "a4b8f623f85bfc4248ab3a65fb34352f6b190584" : void 0
 ) || String(process.env.HIVE_CLI_BUILD_COMMIT || "").trim() || "unknown";
 var buildTimestamp = injectedString(
-  true ? "2026-10-29T21:57:37Z" : void 0
+  true ? "2026-10-30T00:41:24Z" : void 0
 ) || String(process.env.HIVE_CLI_BUILD_TIMESTAMP || "").trim() || "unknown";
 var ociRef = injectedString(
-  true ? "registry.onstackit.cloud/senticor/hive-cli:1.87.2" : void 0
+  true ? "registry.onstackit.cloud/senticor/hive-cli:1.88.0" : void 0
 ) || String(process.env.HIVE_CLI_OCI_REF || "").trim() || `registry.onstackit.cloud/senticor/${artifactName}:${releaseVersion}`;
 var RELEASE_INFO = Object.freeze({
   packageVersion,
@@ -11386,21 +11409,64 @@ var logout = defineCommand({
     console.log("Signed out. Local tokens deleted.");
   }
 });
+var claimText = (v) => typeof v === "string" && v ? v : null;
+function currentSession() {
+  const env = envToken();
+  if (env) {
+    const claims2 = parseJwt(env.token);
+    const exp = typeof claims2?.exp === "number" ? claims2.exp * 1e3 : null;
+    return {
+      loggedIn: true,
+      source: "env",
+      variable: env.variable,
+      verified: false,
+      subject: claimText(claims2?.sub),
+      user: claimText(claims2?.preferred_username) ?? claimText(claims2?.email),
+      issuer: claimText(claims2?.iss),
+      expiresAt: exp === null ? null : new Date(exp).toISOString(),
+      expired: exp === null ? null : exp <= Date.now()
+    };
+  }
+  const creds = getStoredCredentials();
+  if (!creds || !creds.access_token) return null;
+  const expiresAt = Number.isFinite(creds.expires_at) ? creds.expires_at : null;
+  return {
+    loggedIn: true,
+    source: "stored",
+    variable: null,
+    verified: false,
+    subject: claimText(parseJwt(creds.access_token)?.sub),
+    user: creds.user ?? null,
+    issuer: creds.issuer ?? null,
+    expiresAt: expiresAt === null ? null : new Date(expiresAt).toISOString(),
+    expired: expiresAt === null ? null : expiresAt <= Date.now()
+  };
+}
 var whoami = defineCommand({
-  meta: { name: "whoami", description: "Show active session info" },
+  meta: { name: "whoami", description: "Show the session the next command uses (HIVE_TOKEN or the stored login)" },
   args: { ...globalArgs },
-  run() {
-    const creds = getStoredCredentials();
-    if (!creds || !creds.access_token) {
-      console.log("\x1B[33mNot logged in. Run 'hive login' to authenticate.\x1B[0m");
+  run({ args }) {
+    const asJson = args.json === true || String(args.format ?? "").toLowerCase() === "json";
+    const session = currentSession();
+    if (!session) {
+      if (asJson) console.log(JSON.stringify({ loggedIn: false }, null, 2));
+      else console.log("\x1B[33mNot logged in. Run 'hive login' to authenticate, or set HIVE_TOKEN.\x1B[0m");
       process.exit(1);
     }
-    const left = Math.floor((creds.expires_at - Date.now()) / 1e3);
-    console.log(`User:     \x1B[36m${creds.user}\x1B[0m`);
-    console.log(`Issuer:   ${creds.issuer}`);
-    console.log(
-      `Status:   ${left > 0 ? `\x1B[32mActive\x1B[0m (expires in ${Math.floor(left / 60)} min)` : "\x1B[31mExpired\x1B[0m"}`
-    );
+    if (asJson) {
+      console.log(JSON.stringify(session, null, 2));
+    } else {
+      const unknown2 = "(not in token)";
+      const left = session.expiresAt === null ? null : Math.floor((Date.parse(session.expiresAt) - Date.now()) / 1e3);
+      console.log(`User:     \x1B[36m${session.user ?? unknown2}\x1B[0m`);
+      if (session.subject) console.log(`Subject:  ${session.subject}`);
+      console.log(`Issuer:   ${session.issuer ?? unknown2}`);
+      console.log(
+        `Status:   ${left === null ? "Expiry unknown" : left > 0 ? `\x1B[32mActive\x1B[0m (expires in ${Math.floor(left / 60)} min)` : "\x1B[31mExpired\x1B[0m"}`
+      );
+      console.log(session.source === "env" ? `Source:   env (${session.variable}); claims read from the token, not verified` : "Source:   stored login (hive login)");
+    }
+    if (session.source === "env" && session.expired === true) process.exit(1);
   }
 });
 
@@ -32465,8 +32531,27 @@ var orgArgs = withArgs({
   role: { type: "string", description: "Role key (repeat as comma-separated values where supported)" },
   roles: { type: "string", description: "Comma-separated role keys" },
   reuse: { type: "boolean", description: "On already-exists, reuse the existing tenant" },
-  pin: { type: "boolean", description: "Pin created/reused tenant display key in ~/.hive/config.json" }
+  pin: { type: "boolean", description: "Pin created/reused tenant display key in ~/.hive/config.json" },
+  orgName: { type: "string", description: "The organisation's display name for choosers (a label; --display-key stays the selector)" },
+  clearOrgName: { type: "boolean", description: "rename: clear the organisation's display name, so clients show the key" },
+  expectOrgName: { type: "string", description: "rename: change only if the stored name is this one ('' = no name yet)" }
 });
+function orgNameArg(args) {
+  if (args.orgName === void 0) return void 0;
+  try {
+    return parseOptionalTenantDisplayName(String(args.orgName), "--org-name") ?? void 0;
+  } catch (err) {
+    throw commandError("INVALID_ORG_NAME", 1, err.message);
+  }
+}
+function orgNameApplied(tenant, requested, reused) {
+  if (!reused || tenant.displayName === requested) return true;
+  const key = String(tenant.displayKey || "");
+  console.error(
+    `Note: tenant '${key}' already exists; its display name was not changed. Run: hive org rename --tenant-key ${key} --org-name ${JSON.stringify(requested)}`
+  );
+  return false;
+}
 function ensureOk(status2, data, action) {
   if (isHttpOk(status2)) return;
   throw remoteFailureError(status2, data, action);
@@ -32733,10 +32818,12 @@ var org = defineCommand({
         printContextNotice(args, { adminScope: true });
         req(args, "displayKey");
         assertCanonicalTenantSelector(String(args.displayKey), "--display-key");
+        const orgName = orgNameArg(args);
         const body = {
           kind: args.kind || "organization",
           displayKey: args.displayKey
         };
+        if (orgName !== void 0) body.displayName = orgName;
         applyRuntimeConfig(args, body);
         if (args.ownerPrincipalId) body.ownerPrincipalId = args.ownerPrincipalId;
         const requestedKind = String(body.kind || "organization").trim();
@@ -32777,7 +32864,37 @@ var org = defineCommand({
         const pinKey = canonicalPinKey(tenant);
         const pinnable = Boolean(args.pin && pinKey);
         if (pinnable && pinKey) saveConfig({ tenant: pinKey });
-        return output({ ...recordOf2(res.data), reused, pinned: pinnable }, fmt);
+        const named = orgName === void 0 ? {} : { orgNameApplied: orgNameApplied(tenant, orgName, reused) };
+        return output({ ...recordOf2(res.data), reused, pinned: pinnable, ...named }, fmt);
+      }
+    }),
+    rename: defineCommand({
+      meta: {
+        name: "rename",
+        description: "Set or clear an organisation's display name (--org-name or --clear-org-name; [--expect-org-name])"
+      },
+      args: orgArgs,
+      async run({ args }) {
+        printContextNotice(args, { adminScope: true });
+        const name = orgNameArg(args);
+        if (args.clearOrgName && name !== void 0) {
+          throw commandError("CONFLICTING_ARGS", EXIT_GUARDRAIL, "Pass --org-name or --clear-org-name, not both.");
+        }
+        if (!args.clearOrgName && name === void 0) {
+          throw commandError("ORG_NAME_REQUIRED", 1, "Pass --org-name <name>, or --clear-org-name to remove the name.");
+        }
+        const body = { displayName: args.clearOrgName ? null : name };
+        if (args.expectOrgName !== void 0) {
+          const expected = String(args.expectOrgName).trim();
+          body.expectedDisplayName = expected || null;
+        }
+        const { tenantId } = await resolveTenantId(args);
+        const { client, fmt } = adminCtx(args);
+        const res = await client.patch(`/api/admin/orgs/${enc(tenantId)}`, body);
+        ensureAuthorized(res.status, "Renaming an organisation");
+        ensureOk(res.status, res.data, "rename organisation");
+        const data = recordOf2(res.data);
+        return output({ ...data, idempotent: data.changed === false }, fmt);
       }
     }),
     members: defineCommand({
@@ -32898,7 +33015,9 @@ var org = defineCommand({
         }
         const kind = String(args.kind || "organization").trim();
         const { client, fmt } = adminCtx(args);
+        const orgName = orgNameArg(args);
         const createBody = { kind, displayKey: args.displayKey };
+        if (orgName !== void 0) createBody.displayName = orgName;
         applyRuntimeConfig(args, createBody);
         if (args.ownerPrincipalId) createBody.ownerPrincipalId = args.ownerPrincipalId;
         let reusedTenant = false;
@@ -32947,6 +33066,7 @@ var org = defineCommand({
         if (!tenantId) {
           throw commandError("TENANT_NOT_FOUND", 1, "Tenant was created/reused but no id was returned.");
         }
+        if (orgName !== void 0) orgNameApplied(tenant, orgName, reusedTenant);
         const admitBody = { email: email3, roles };
         if (args.displayName) admitBody.displayName = args.displayName;
         const admitRes = await client.post(`/api/admin/orgs/${enc(tenantId)}/members`, admitBody);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@senticor/hive",
-  "version": "1.87.2",
+  "version": "1.88.0",
   "description": "Cognitive Hive OS — unified CLI",
   "type": "commonjs",
   "bin": {