@senticor/hive 1.89.0 → 1.90.0

package/hive.cjs

@@ -10429,22 +10429,22 @@ var artifactName = injectedString(
   true ? "hive-cli" : void 0
 ) || String(process.env.HIVE_CLI_ARTIFACT_NAME || "hive-cli").trim() || "hive-cli";
 var packageVersion = injectedString(
-  true ? "1.89.0" : void 0
+  true ? "1.90.0" : void 0
 ) || String(process.env.HIVE_CLI_PACKAGE_VERSION || "").trim() || readPackageVersion();
 var releaseVersion = injectedString(
-  true ? "1.89.0" : void 0
+  true ? "1.90.0" : void 0
 ) || String(process.env.HIVE_CLI_RELEASE_VERSION || "").trim() || packageVersion || "dev";
 var releaseChannel = injectedString(
   true ? "final" : void 0
 ) || String(process.env.HIVE_CLI_RELEASE_CHANNEL || "").trim() || (releaseVersion.includes("-rc.") ? "rc" : releaseVersion === "dev" ? "dev" : "final");
 var buildCommit = injectedString(
-  true ? "642365f7b0779891c14f08da5723ea1fe9307cdf" : void 0
+  true ? "2300d236d468220cf0f51188023b175234b566b7" : void 0
 ) || String(process.env.HIVE_CLI_BUILD_COMMIT || "").trim() || "unknown";
 var buildTimestamp = injectedString(
-  true ? "2026-10-30T19:49:55Z" : void 0
+  true ? "2026-10-30T22:56:05Z" : void 0
 ) || String(process.env.HIVE_CLI_BUILD_TIMESTAMP || "").trim() || "unknown";
 var ociRef = injectedString(
-  true ? "registry.onstackit.cloud/senticor/hive-cli:1.89.0" : void 0
+  true ? "registry.onstackit.cloud/senticor/hive-cli:1.90.0" : void 0
 ) || String(process.env.HIVE_CLI_OCI_REF || "").trim() || `registry.onstackit.cloud/senticor/${artifactName}:${releaseVersion}`;
 var RELEASE_INFO = Object.freeze({
   packageVersion,
@@ -32705,6 +32705,7 @@ async function listMembers(client, tenantId) {
     return {
       membershipId: String(m.membershipId ?? ""),
       membershipStatus: String(m.membershipStatus ?? ""),
+      directoryScope: typeof m.directoryScope === "string" ? m.directoryScope : void 0,
       roles: Array.isArray(m.roles) ? m.roles.map(String).sort() : [],
       principalId: String(principal.principalId ?? ""),
       email: String(principal.email ?? "").toLowerCase()
@@ -32945,9 +32946,13 @@ var org = defineCommand({
         }),
         admit: defineCommand({
           meta: { name: "admit", description: "Admit a user/principal by email and optional roles" },
-          args: orgArgs,
+          args: withArgs({ ...orgArgs, directoryScope: { type: "string", description: "tenant | shared-missions; omission preserves an existing scope" } }),
           async run({ args }) {
             printContextNotice(args, { adminScope: true });
+            const directoryScope = args.directoryScope;
+            if (directoryScope !== void 0 && directoryScope !== "tenant" && directoryScope !== "shared-missions") {
+              throw commandError("INVALID_DIRECTORY_SCOPE", 1, "--directory-scope must be tenant or shared-missions.");
+            }
             const { tenantId } = await resolveTenantId(args);
             req(args, "email");
             const body = {
@@ -32956,12 +32961,38 @@ var org = defineCommand({
             };
             if (args.displayName) body.displayName = args.displayName;
             if (args.kind) body.kind = args.kind;
+            if (directoryScope !== void 0) body.directoryScope = directoryScope;
             const { client, fmt } = adminCtx(args);
+            if (directoryScope !== void 0) {
+              const capability = await client.get("/api/capabilities");
+              const supported = recordOf2(recordOf2(capability.data).tenantDirectoryScopes);
+              if (!isHttpOk(capability.status) || supported.contractVersion !== 1) {
+                throw commandError(
+                  "DIRECTORY_SCOPE_UNSUPPORTED",
+                  EXIT_GUARDRAIL,
+                  "This API does not advertise membership directory scopes. No admission was attempted; upgrade the API first."
+                );
+              }
+            }
             const email3 = String(args.email).trim().toLowerCase();
             const before = findMember(await listMembers(client, tenantId), { email: email3 });
             const res = await client.post(`/api/admin/orgs/${enc(tenantId)}/members`, body);
             ensureOk(res.status, res.data, "admit tenant member");
+            if (directoryScope !== void 0 && recordOf2(recordOf2(res.data).membership).directoryScope !== directoryScope) {
+              throw commandError(
+                "DIRECTORY_SCOPE_NOT_APPLIED",
+                EXIT_GUARDRAIL,
+                "The API did not confirm the requested directory scope. Verify the membership before using external access."
+              );
+            }
             const after = findMember(await listMembers(client, tenantId), { email: email3 });
+            if (directoryScope !== void 0 && after?.directoryScope !== directoryScope) {
+              throw commandError(
+                "DIRECTORY_SCOPE_NOT_APPLIED",
+                EXIT_GUARDRAIL,
+                "The membership read-back did not confirm the requested directory scope. Verify the membership before using external access."
+              );
+            }
             const rolesBefore = before?.roles ?? [];
             const rolesAfter = after?.roles ?? [];
             const rolesAdded = without(rolesAfter, rolesBefore);
@@ -32970,10 +33001,12 @@ var org = defineCommand({
               created: !before,
               membershipStatusBefore: before?.membershipStatus ?? null,
               membershipStatus: after?.membershipStatus ?? null,
+              directoryScopeBefore: before?.directoryScope,
+              directoryScope: after?.directoryScope,
               rolesBefore,
               rolesAfter,
               rolesAdded,
-              idempotent: Boolean(before) && before?.membershipStatus === "active" && rolesAdded.length === 0
+              idempotent: Boolean(before) && before?.membershipStatus === "active" && rolesAdded.length === 0 && (directoryScope === void 0 || before.directoryScope === directoryScope)
             }, fmt);
           }
         }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@senticor/hive",
-  "version": "1.89.0",
+  "version": "1.90.0",
   "description": "Cognitive Hive OS — unified CLI",
   "type": "commonjs",
   "bin": {