@senticor/hive 1.87.2 → 1.88.1

package/hive.cjs

@@ -8630,6 +8630,21 @@ var ROLE_KEY_RE = /^[a-z0-9][a-z0-9._:-]{0,63}$/;
 function hasTenantAudienceDelimiter(displayKey) {
   return /[\s,]/.test(String(displayKey || "").trim());
 }
+var MAX_TENANT_DISPLAY_NAME_LENGTH = 200;
+var CONTROL_CHARS = new RegExp("\\p{Cc}", "u");
+function parseOptionalTenantDisplayName(value, field = "displayName") {
+  if (value === void 0) return void 0;
+  if (value === null) return null;
+  if (typeof value !== "string") throw new Error(`${field} must be a string or null`);
+  const name = value.trim();
+  if (!name) throw new Error(`${field} must be a non-empty string (send null to clear it)`);
+  if (CONTROL_CHARS.test(name)) throw new Error(`${field} must not contain control characters (line breaks, tabs, NUL)`);
+  const length = [...name].length;
+  if (length > MAX_TENANT_DISPLAY_NAME_LENGTH) {
+    throw new Error(`${field} is too long (${length} characters); at most ${MAX_TENANT_DISPLAY_NAME_LENGTH}`);
+  }
+  return name;
+}
 
 // src/lib/client.ts
 init_cjs_shims();
@@ -8686,6 +8701,14 @@ function promptText(query) {
     });
   });
 }
+var TOKEN_ENV_VARS = ["HIVE_TOKEN", "HIVE_TEST_TOKEN", "HIVE_BEARER_TOKEN"];
+function envToken(env = process.env) {
+  for (const variable of TOKEN_ENV_VARS) {
+    const token = env[variable];
+    if (token) return { token, variable };
+  }
+  return null;
+}
 function parseJwt(token) {
   try {
     const parts = token.split(".");
@@ -9375,7 +9398,7 @@ var HiveClient = class {
     const headers = { accept };
     if (this.tenant) headers["x-hive-tenant"] = this.tenant;
     try {
-      const token = process.env.HIVE_TOKEN || process.env.HIVE_TEST_TOKEN || process.env.HIVE_BEARER_TOKEN || await getValidToken();
+      const token = envToken()?.token || await getValidToken();
       if (token) headers["authorization"] = `Bearer ${token}`;
     } catch (e) {
       if (this.verbose) console.error("Warning: Could not fetch auth token", e.message);
@@ -9654,6 +9677,7 @@ var CliCommandError = class extends Error {
   remediation;
   tenant;
   problemType;
+  details;
   constructor(symbolicCode, exitCode, message, options) {
     super(message, options);
     this.name = "CliCommandError";
@@ -9662,6 +9686,7 @@ var CliCommandError = class extends Error {
     this.remediation = options?.remediation;
     this.tenant = options?.tenant;
     this.problemType = options?.problemType;
+    this.details = options?.details;
   }
 };
 function commandError(symbolicCode, exitCode, message, options) {
@@ -9693,6 +9718,16 @@ function remoteProblemType(data) {
   const body = data;
   return typeof body.type === "string" && typeof body.title === "string" && typeof body.status === "number" ? body.type : void 0;
 }
+function remoteProblemDetails(data) {
+  if (!remoteProblemType(data)) return void 0;
+  const raw = data.details;
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
+  const out = {};
+  for (const [name, value] of Object.entries(raw)) {
+    if (value === null || ["string", "number", "boolean"].includes(typeof value)) out[name] = value;
+  }
+  return Object.keys(out).length ? out : void 0;
+}
 function fieldText(value) {
   if (value === null || value === void 0) return "";
   if (typeof value === "object") {
@@ -9737,11 +9772,17 @@ function remoteFailureError(status2, data, action, exitCode = exitCodeForStatus(
   const remediation = remoteFailureRemediation(data);
   const tenant = remoteFailureTenant(data);
   const problemType = remoteProblemType(data);
+  const details = remoteProblemDetails(data);
   return commandError(
     "REMOTE_FAILED",
     exitCode,
     `${action} failed${status2 ? ` (HTTP ${status2})` : ""}: ${remoteFailureText(data)}${remediation ? ` \u2014 ${remediation}` : ""}`,
-    remediation || tenant || problemType ? { ...remediation ? { remediation } : {}, ...tenant ? { tenant } : {}, ...problemType ? { problemType } : {} } : void 0
+    remediation || tenant || problemType || details ? {
+      ...remediation ? { remediation } : {},
+      ...tenant ? { tenant } : {},
+      ...problemType ? { problemType } : {},
+      ...details ? { details } : {}
+    } : void 0
   );
 }
 function remoteFailureText(data) {
@@ -9751,7 +9792,10 @@ function remoteFailureText(data) {
   const parts = [code, message, ...isProblem ? [] : [fieldText(body?.detail)]].filter(Boolean);
   const fields = isProblem ? [] : schemaErrorFields(data);
   if (fields.length) parts.push(`(offending field${fields.length > 1 ? "s" : ""}: ${fields.join(", ")})`);
-  return [...new Set(parts)].join(": ") || "unexpected response";
+  const text = [...new Set(parts)].join(": ") || "unexpected response";
+  const details = remoteProblemDetails(data);
+  if (!details) return text;
+  return `${text} (${Object.entries(details).map(([name, value]) => `${name}: ${JSON.stringify(value)}`).join(", ")})`;
 }
 function toStructuredError(err) {
   const e = err;
@@ -9764,7 +9808,8 @@ function toStructuredError(err) {
       message,
       ...e?.remediation ? { remediation: e.remediation } : {},
       ...e?.problemType ? { type: e.problemType } : {},
-      ...e?.tenant ? { tenant: e.tenant } : {}
+      ...e?.tenant ? { tenant: e.tenant } : {},
+      ...e?.details ? { details: e.details } : {}
     }
   };
 }
@@ -9815,11 +9860,19 @@ function installRemoteFailureExit() {
     const remediation = remoteFailureRemediation(failure2.body) ?? (failure2.status === 401 ? "Run 'hive login' to authenticate, or set HIVE_TOKEN." : void 0);
     const tenant = remoteFailureTenant(failure2.body);
     const problemType = remoteProblemType(failure2.body);
+    const details = remoteProblemDetails(failure2.body);
     const message = `${failure2.method} ${failure2.path} failed${failure2.status ? ` (HTTP ${failure2.status})` : ""}: ${remoteFailureText(failure2.body)}`;
     if (isJsonMode()) {
       console.error(JSON.stringify({
         ok: false,
-        error: { code: symbolic, message, ...problemType ? { type: problemType } : {}, ...remediation ? { remediation } : {}, ...tenant ? { tenant } : {} }
+        error: {
+          code: symbolic,
+          message,
+          ...problemType ? { type: problemType } : {},
+          ...remediation ? { remediation } : {},
+          ...tenant ? { tenant } : {},
+          ...details ? { details } : {}
+        }
       }));
     } else {
       console.error(`\x1B[31mError:\x1B[0m ${symbolic}: ${message}`);
@@ -10376,22 +10429,22 @@ var artifactName = injectedString(
   true ? "hive-cli" : void 0
 ) || String(process.env.HIVE_CLI_ARTIFACT_NAME || "hive-cli").trim() || "hive-cli";
 var packageVersion = injectedString(
-  true ? "1.87.2" : void 0
+  true ? "1.88.1" : void 0
 ) || String(process.env.HIVE_CLI_PACKAGE_VERSION || "").trim() || readPackageVersion();
 var releaseVersion = injectedString(
-  true ? "1.87.2" : void 0
+  true ? "1.88.1" : void 0
 ) || String(process.env.HIVE_CLI_RELEASE_VERSION || "").trim() || packageVersion || "dev";
 var releaseChannel = injectedString(
   true ? "final" : void 0
 ) || String(process.env.HIVE_CLI_RELEASE_CHANNEL || "").trim() || (releaseVersion.includes("-rc.") ? "rc" : releaseVersion === "dev" ? "dev" : "final");
 var buildCommit = injectedString(
-  true ? "a96123fb3acccd513fb8e7aa2acd3767c46e56a2" : void 0
+  true ? "0389229ca319d58530b1a250cc0eaed6c50ab3e2" : void 0
 ) || String(process.env.HIVE_CLI_BUILD_COMMIT || "").trim() || "unknown";
 var buildTimestamp = injectedString(
-  true ? "2026-10-29T21:57:37Z" : void 0
+  true ? "2026-10-30T08:47:32Z" : void 0
 ) || String(process.env.HIVE_CLI_BUILD_TIMESTAMP || "").trim() || "unknown";
 var ociRef = injectedString(
-  true ? "registry.onstackit.cloud/senticor/hive-cli:1.87.2" : void 0
+  true ? "registry.onstackit.cloud/senticor/hive-cli:1.88.1" : void 0
 ) || String(process.env.HIVE_CLI_OCI_REF || "").trim() || `registry.onstackit.cloud/senticor/${artifactName}:${releaseVersion}`;
 var RELEASE_INFO = Object.freeze({
   packageVersion,
@@ -11386,21 +11439,64 @@ var logout = defineCommand({
     console.log("Signed out. Local tokens deleted.");
   }
 });
+var claimText = (v) => typeof v === "string" && v ? v : null;
+function currentSession() {
+  const env = envToken();
+  if (env) {
+    const claims2 = parseJwt(env.token);
+    const exp = typeof claims2?.exp === "number" ? claims2.exp * 1e3 : null;
+    return {
+      loggedIn: true,
+      source: "env",
+      variable: env.variable,
+      verified: false,
+      subject: claimText(claims2?.sub),
+      user: claimText(claims2?.preferred_username) ?? claimText(claims2?.email),
+      issuer: claimText(claims2?.iss),
+      expiresAt: exp === null ? null : new Date(exp).toISOString(),
+      expired: exp === null ? null : exp <= Date.now()
+    };
+  }
+  const creds = getStoredCredentials();
+  if (!creds || !creds.access_token) return null;
+  const expiresAt = Number.isFinite(creds.expires_at) ? creds.expires_at : null;
+  return {
+    loggedIn: true,
+    source: "stored",
+    variable: null,
+    verified: false,
+    subject: claimText(parseJwt(creds.access_token)?.sub),
+    user: creds.user ?? null,
+    issuer: creds.issuer ?? null,
+    expiresAt: expiresAt === null ? null : new Date(expiresAt).toISOString(),
+    expired: expiresAt === null ? null : expiresAt <= Date.now()
+  };
+}
 var whoami = defineCommand({
-  meta: { name: "whoami", description: "Show active session info" },
+  meta: { name: "whoami", description: "Show the session the next command uses (HIVE_TOKEN or the stored login)" },
   args: { ...globalArgs },
-  run() {
-    const creds = getStoredCredentials();
-    if (!creds || !creds.access_token) {
-      console.log("\x1B[33mNot logged in. Run 'hive login' to authenticate.\x1B[0m");
+  run({ args }) {
+    const asJson = args.json === true || String(args.format ?? "").toLowerCase() === "json";
+    const session = currentSession();
+    if (!session) {
+      if (asJson) console.log(JSON.stringify({ loggedIn: false }, null, 2));
+      else console.log("\x1B[33mNot logged in. Run 'hive login' to authenticate, or set HIVE_TOKEN.\x1B[0m");
       process.exit(1);
     }
-    const left = Math.floor((creds.expires_at - Date.now()) / 1e3);
-    console.log(`User:     \x1B[36m${creds.user}\x1B[0m`);
-    console.log(`Issuer:   ${creds.issuer}`);
-    console.log(
-      `Status:   ${left > 0 ? `\x1B[32mActive\x1B[0m (expires in ${Math.floor(left / 60)} min)` : "\x1B[31mExpired\x1B[0m"}`
-    );
+    if (asJson) {
+      console.log(JSON.stringify(session, null, 2));
+    } else {
+      const unknown2 = "(not in token)";
+      const left = session.expiresAt === null ? null : Math.floor((Date.parse(session.expiresAt) - Date.now()) / 1e3);
+      console.log(`User:     \x1B[36m${session.user ?? unknown2}\x1B[0m`);
+      if (session.subject) console.log(`Subject:  ${session.subject}`);
+      console.log(`Issuer:   ${session.issuer ?? unknown2}`);
+      console.log(
+        `Status:   ${left === null ? "Expiry unknown" : left > 0 ? `\x1B[32mActive\x1B[0m (expires in ${Math.floor(left / 60)} min)` : "\x1B[31mExpired\x1B[0m"}`
+      );
+      console.log(session.source === "env" ? `Source:   env (${session.variable}); claims read from the token, not verified` : "Source:   stored login (hive login)");
+    }
+    if (session.source === "env" && session.expired === true) process.exit(1);
   }
 });
 
@@ -32465,8 +32561,27 @@ var orgArgs = withArgs({
   role: { type: "string", description: "Role key (repeat as comma-separated values where supported)" },
   roles: { type: "string", description: "Comma-separated role keys" },
   reuse: { type: "boolean", description: "On already-exists, reuse the existing tenant" },
-  pin: { type: "boolean", description: "Pin created/reused tenant display key in ~/.hive/config.json" }
+  pin: { type: "boolean", description: "Pin created/reused tenant display key in ~/.hive/config.json" },
+  orgName: { type: "string", description: "The organisation's display name for choosers (a label; --display-key stays the selector)" },
+  clearOrgName: { type: "boolean", description: "rename: clear the organisation's display name, so clients show the key" },
+  expectOrgName: { type: "string", description: "rename: change only if the stored name is this one ('' = no name yet)" }
 });
+function orgNameArg(args) {
+  if (args.orgName === void 0) return void 0;
+  try {
+    return parseOptionalTenantDisplayName(String(args.orgName), "--org-name") ?? void 0;
+  } catch (err) {
+    throw commandError("INVALID_ORG_NAME", 1, err.message);
+  }
+}
+function orgNameApplied(tenant, requested, reused) {
+  if (!reused || tenant.displayName === requested) return true;
+  const key = String(tenant.displayKey || "");
+  console.error(
+    `Note: tenant '${key}' already exists; its display name was not changed. Run: hive org rename --tenant-key ${key} --org-name ${JSON.stringify(requested)}`
+  );
+  return false;
+}
 function ensureOk(status2, data, action) {
   if (isHttpOk(status2)) return;
   throw remoteFailureError(status2, data, action);
@@ -32733,10 +32848,12 @@ var org = defineCommand({
         printContextNotice(args, { adminScope: true });
         req(args, "displayKey");
         assertCanonicalTenantSelector(String(args.displayKey), "--display-key");
+        const orgName = orgNameArg(args);
         const body = {
           kind: args.kind || "organization",
           displayKey: args.displayKey
         };
+        if (orgName !== void 0) body.displayName = orgName;
         applyRuntimeConfig(args, body);
         if (args.ownerPrincipalId) body.ownerPrincipalId = args.ownerPrincipalId;
         const requestedKind = String(body.kind || "organization").trim();
@@ -32777,7 +32894,37 @@ var org = defineCommand({
         const pinKey = canonicalPinKey(tenant);
         const pinnable = Boolean(args.pin && pinKey);
         if (pinnable && pinKey) saveConfig({ tenant: pinKey });
-        return output({ ...recordOf2(res.data), reused, pinned: pinnable }, fmt);
+        const named = orgName === void 0 ? {} : { orgNameApplied: orgNameApplied(tenant, orgName, reused) };
+        return output({ ...recordOf2(res.data), reused, pinned: pinnable, ...named }, fmt);
+      }
+    }),
+    rename: defineCommand({
+      meta: {
+        name: "rename",
+        description: "Set or clear an organisation's display name (--org-name or --clear-org-name; [--expect-org-name])"
+      },
+      args: orgArgs,
+      async run({ args }) {
+        printContextNotice(args, { adminScope: true });
+        const name = orgNameArg(args);
+        if (args.clearOrgName && name !== void 0) {
+          throw commandError("CONFLICTING_ARGS", EXIT_GUARDRAIL, "Pass --org-name or --clear-org-name, not both.");
+        }
+        if (!args.clearOrgName && name === void 0) {
+          throw commandError("ORG_NAME_REQUIRED", 1, "Pass --org-name <name>, or --clear-org-name to remove the name.");
+        }
+        const body = { displayName: args.clearOrgName ? null : name };
+        if (args.expectOrgName !== void 0) {
+          const expected = String(args.expectOrgName).trim();
+          body.expectedDisplayName = expected || null;
+        }
+        const { tenantId } = await resolveTenantId(args);
+        const { client, fmt } = adminCtx(args);
+        const res = await client.patch(`/api/admin/orgs/${enc(tenantId)}`, body);
+        ensureAuthorized(res.status, "Renaming an organisation");
+        ensureOk(res.status, res.data, "rename organisation");
+        const data = recordOf2(res.data);
+        return output({ ...data, idempotent: data.changed === false }, fmt);
       }
     }),
     members: defineCommand({
@@ -32898,7 +33045,9 @@ var org = defineCommand({
         }
         const kind = String(args.kind || "organization").trim();
         const { client, fmt } = adminCtx(args);
+        const orgName = orgNameArg(args);
         const createBody = { kind, displayKey: args.displayKey };
+        if (orgName !== void 0) createBody.displayName = orgName;
         applyRuntimeConfig(args, createBody);
         if (args.ownerPrincipalId) createBody.ownerPrincipalId = args.ownerPrincipalId;
         let reusedTenant = false;
@@ -32947,6 +33096,7 @@ var org = defineCommand({
         if (!tenantId) {
           throw commandError("TENANT_NOT_FOUND", 1, "Tenant was created/reused but no id was returned.");
         }
+        if (orgName !== void 0) orgNameApplied(tenant, orgName, reusedTenant);
         const admitBody = { email: email3, roles };
         if (args.displayName) admitBody.displayName = args.displayName;
         const admitRes = await client.post(`/api/admin/orgs/${enc(tenantId)}/members`, admitBody);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@senticor/hive",
-  "version": "1.87.2",
+  "version": "1.88.1",
   "description": "Cognitive Hive OS — unified CLI",
   "type": "commonjs",
   "bin": {