@warmhub/cli 0.102.0 → 0.103.0

package/dist/wh.js

@@ -20614,6 +20614,99 @@ function joinFieldIdentityPath(...segments) {
 function joinFieldPathWithEscaper(escapeSegment, segments) {
   return segments.map((segment) => typeof segment === "number" ? `[${segment}]` : escapeSegment(segment)).join(".").replace(/\.\[/g, "[");
 }
+// ../../packages/rules/src/operation-event-identity.ts
+var STREAM_CHUNK_NAMESPACE = "003e7e6c-2f1e-53ea-9dfa-627edd04a8cc";
+var CANONICAL_UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+function uuidBytes(value) {
+  if (!CANONICAL_UUID.test(value)) {
+    throw new Error("Operation-event submission ID must be a canonical UUID");
+  }
+  const hex = value.toLowerCase().replaceAll("-", "");
+  return Uint8Array.from({ length: 16 }, (_, index) => Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16));
+}
+function rotateLeft(value, bits) {
+  return (value << bits | value >>> 32 - bits) >>> 0;
+}
+function sha1(input) {
+  const bitLength = input.length * 8;
+  const paddedLength = Math.ceil((input.length + 9) / 64) * 64;
+  const padded = new Uint8Array(paddedLength);
+  padded.set(input);
+  padded[input.length] = 128;
+  const view = new DataView(padded.buffer);
+  view.setUint32(paddedLength - 8, Math.floor(bitLength / 4294967296));
+  view.setUint32(paddedLength - 4, bitLength >>> 0);
+  let h0 = 1732584193;
+  let h1 = 4023233417;
+  let h2 = 2562383102;
+  let h3 = 271733878;
+  let h4 = 3285377520;
+  const words = new Uint32Array(80);
+  for (let offset = 0;offset < paddedLength; offset += 64) {
+    for (let index = 0;index < 16; index += 1) {
+      words[index] = view.getUint32(offset + index * 4);
+    }
+    for (let index = 16;index < 80; index += 1) {
+      words[index] = rotateLeft((words[index - 3] ?? 0) ^ (words[index - 8] ?? 0) ^ (words[index - 14] ?? 0) ^ (words[index - 16] ?? 0), 1);
+    }
+    let a = h0;
+    let b = h1;
+    let c = h2;
+    let d = h3;
+    let e = h4;
+    for (let index = 0;index < 80; index += 1) {
+      let f;
+      let k;
+      if (index < 20) {
+        f = b & c | ~b & d;
+        k = 1518500249;
+      } else if (index < 40) {
+        f = b ^ c ^ d;
+        k = 1859775393;
+      } else if (index < 60) {
+        f = b & c | b & d | c & d;
+        k = 2400959708;
+      } else {
+        f = b ^ c ^ d;
+        k = 3395469782;
+      }
+      const next = rotateLeft(a, 5) + f + e + k + (words[index] ?? 0) >>> 0;
+      e = d;
+      d = c;
+      c = rotateLeft(b, 30);
+      b = a;
+      a = next;
+    }
+    h0 = h0 + a >>> 0;
+    h1 = h1 + b >>> 0;
+    h2 = h2 + c >>> 0;
+    h3 = h3 + d >>> 0;
+    h4 = h4 + e >>> 0;
+  }
+  const digest = new Uint8Array(20);
+  const digestView = new DataView(digest.buffer);
+  for (const [index, value] of [h0, h1, h2, h3, h4].entries()) {
+    digestView.setUint32(index * 4, value);
+  }
+  return digest;
+}
+function formatUuid(bytes) {
+  const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("").slice(0, 32);
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+function operationEventStreamRequestId(submissionId, chunkOrdinal) {
+  if (!Number.isInteger(chunkOrdinal) || chunkOrdinal < 0 || chunkOrdinal > 2147483647) {
+    throw new Error("Stream chunk ordinal must be an integer from 0 through 2147483647");
+  }
+  uuidBytes(submissionId);
+  const normalizedSubmissionId = submissionId.toLowerCase();
+  const namespace = uuidBytes(STREAM_CHUNK_NAMESPACE);
+  const name = new TextEncoder().encode(`${normalizedSubmissionId}:${chunkOrdinal}`);
+  const digest = sha1(Uint8Array.from([...namespace, ...name])).slice(0, 16);
+  digest[6] = (digest[6] ?? 0) & 15 | 80;
+  digest[8] = (digest[8] ?? 0) & 63 | 128;
+  return formatUuid(digest);
+}
 // ../../packages/rules/src/org-qualified-ref.ts
 function splitOrgQualified(ref) {
   const parts = ref.split("/");
@@ -35180,11 +35273,58 @@ function date4(params) {
 
 // ../../node_modules/.bun/zod@4.4.3/node_modules/zod/v4/classic/external.js
 config(en_default());
+// ../../packages/rules/src/repository-checkpoint/hash.ts
+var utf8Encoder = new TextEncoder;
+async function checkpointSha256Hex(bytes) {
+  const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", Uint8Array.from(bytes)));
+  return Array.from(digest, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function checkpointUtf8Bytes(value) {
+  assertCheckpointText(value);
+  return utf8Encoder.encode(value);
+}
+function assertCheckpointText(value) {
+  for (let index = 0;index < value.length; index += 1) {
+    const codeUnit = value.charCodeAt(index);
+    if (codeUnit >= 55296 && codeUnit <= 56319) {
+      const trailing = value.charCodeAt(index + 1);
+      if (!(trailing >= 56320 && trailing <= 57343)) {
+        throw new RangeError("Checkpoint text must be valid Unicode");
+      }
+      index += 1;
+    } else if (codeUnit >= 56320 && codeUnit <= 57343) {
+      throw new RangeError("Checkpoint text must be valid Unicode");
+    }
+  }
+}
+
+// ../../packages/rules/src/repository-checkpoint/order.ts
+function compareUnsignedUtf8(left, right) {
+  assertCheckpointText(left);
+  assertCheckpointText(right);
+  let leftIndex = 0;
+  let rightIndex = 0;
+  while (leftIndex < left.length && rightIndex < right.length) {
+    const leftCodePoint = left.codePointAt(leftIndex);
+    const rightCodePoint = right.codePointAt(rightIndex);
+    if (leftCodePoint === undefined || rightCodePoint === undefined)
+      break;
+    const difference = leftCodePoint - rightCodePoint;
+    if (difference !== 0)
+      return difference;
+    leftIndex += leftCodePoint > 65535 ? 2 : 1;
+    rightIndex += rightCodePoint > 65535 ? 2 : 1;
+  }
+  if (leftIndex === left.length && rightIndex === right.length)
+    return 0;
+  return leftIndex === left.length ? -1 : 1;
+}
+
 // ../../packages/rules/src/repository-checkpoint/types.ts
 var CHECKPOINT_CHUNK_BYTE_LIMIT = 67108864;
 var CHECKPOINT_PART_DIGITS = 10;
 var CHECKPOINT_FORMAT = "warmhub-repository-checkpoint";
-var CHECKPOINT_FORMAT_VERSION = 1;
+var CHECKPOINT_FORMAT_VERSION = 2;
 var CHECKPOINT_MANIFEST_NAME = "repository-checkpoint.json";
 var checkpointSha256Schema = exports_external.string().regex(/^[0-9a-f]{64}$/);
 var nonnegativeSafeIntegerSchema = exports_external.number().int().nonnegative().safe();
@@ -35205,7 +35345,20 @@ var checkpointRowBaseSchema = exports_external.object({
   active: exports_external.literal(true),
   data: jsonValueSchema
 });
-var pinnedWrefSchema = exports_external.string().regex(/^[^\r\n]+@v[1-9]\d*$/);
+var pinnedWrefSchema = exports_external.string().regex(/^[^\r\n]+@v[1-9]\d*$/, "Checkpoint wref must be pinned with @vN");
+var affirmedWrefsSchema = exports_external.array(pinnedWrefSchema).superRefine((wrefs, context) => {
+  for (let index = 1;index < wrefs.length; index += 1) {
+    const previous = wrefs[index - 1];
+    const current = wrefs[index];
+    if (previous !== undefined && current !== undefined && compareUnsignedUtf8(previous, current) >= 0) {
+      context.addIssue({
+        code: "custom",
+        path: [index],
+        message: "Affirmed wrefs must be unique and strictly increasing"
+      });
+    }
+  }
+});
 var checkpointRowSchema = exports_external.discriminatedUnion("kind", [
   checkpointRowBaseSchema.extend({ kind: exports_external.literal("shape") }).strict(),
   checkpointRowBaseSchema.extend({
@@ -35215,7 +35368,8 @@ var checkpointRowSchema = exports_external.discriminatedUnion("kind", [
   checkpointRowBaseSchema.extend({
     kind: exports_external.literal("assertion"),
     shapeName: exports_external.string().min(1),
-    aboutWref: pinnedWrefSchema
+    aboutWref: pinnedWrefSchema,
+    affirmedWrefs: affirmedWrefsSchema
   }).strict()
 ]);
 var checkpointManifestChunkSchema = exports_external.object({
@@ -35245,54 +35399,7 @@ var checkpointManifestFields = {
   streams: exports_external.array(checkpointManifestStreamSchema)
 };
 var checkpointManifestContentSchema = exports_external.object(checkpointManifestFields).strict();
-var checkpointManifestV1Schema = checkpointManifestContentSchema.extend({ contentSha256: checkpointSha256Schema }).strict();
-
-// ../../packages/rules/src/repository-checkpoint/hash.ts
-var utf8Encoder = new TextEncoder;
-async function checkpointSha256Hex(bytes) {
-  const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", Uint8Array.from(bytes)));
-  return Array.from(digest, (byte) => byte.toString(16).padStart(2, "0")).join("");
-}
-function checkpointUtf8Bytes(value) {
-  assertCheckpointText(value);
-  return utf8Encoder.encode(value);
-}
-function assertCheckpointText(value) {
-  for (let index = 0;index < value.length; index += 1) {
-    const codeUnit = value.charCodeAt(index);
-    if (codeUnit >= 55296 && codeUnit <= 56319) {
-      const trailing = value.charCodeAt(index + 1);
-      if (!(trailing >= 56320 && trailing <= 57343)) {
-        throw new RangeError("Checkpoint text must be valid Unicode");
-      }
-      index += 1;
-    } else if (codeUnit >= 56320 && codeUnit <= 57343) {
-      throw new RangeError("Checkpoint text must be valid Unicode");
-    }
-  }
-}
-
-// ../../packages/rules/src/repository-checkpoint/order.ts
-function compareUnsignedUtf8(left, right) {
-  assertCheckpointText(left);
-  assertCheckpointText(right);
-  let leftIndex = 0;
-  let rightIndex = 0;
-  while (leftIndex < left.length && rightIndex < right.length) {
-    const leftCodePoint = left.codePointAt(leftIndex);
-    const rightCodePoint = right.codePointAt(rightIndex);
-    if (leftCodePoint === undefined || rightCodePoint === undefined)
-      break;
-    const difference = leftCodePoint - rightCodePoint;
-    if (difference !== 0)
-      return difference;
-    leftIndex += leftCodePoint > 65535 ? 2 : 1;
-    rightIndex += rightCodePoint > 65535 ? 2 : 1;
-  }
-  if (leftIndex === left.length && rightIndex === right.length)
-    return 0;
-  return leftIndex === left.length ? -1 : 1;
-}
+var checkpointManifestV2Schema = checkpointManifestContentSchema.extend({ contentSha256: checkpointSha256Schema }).strict();
 
 // ../../packages/rules/src/repository-checkpoint/paths.ts
 var MAX_CHECKPOINT_PART = 10 ** CHECKPOINT_PART_DIGITS - 1;
@@ -35322,7 +35429,7 @@ function assertCheckpointPart(part) {
 // ../../packages/rules/src/repository-checkpoint/manifest.ts
 var utf8Decoder = new TextDecoder("utf-8", { fatal: true });
 async function validateCheckpointManifest(input) {
-  const manifest = checkpointManifestV1Schema.parse(input);
+  const manifest = checkpointManifestV2Schema.parse(input);
   const { contentSha256, ...content } = manifest;
   await validateCheckpointManifestContent(content);
   const expectedDigest = await checkpointManifestContentSha256(content);
@@ -35339,7 +35446,7 @@ async function encodeCheckpointManifest(input) {
 async function parseCheckpointManifest(bytes) {
   assertCanonicalManifestFraming(bytes);
   const decoded = utf8Decoder.decode(bytes);
-  const manifest = await validateCheckpointManifest(checkpointManifestV1Schema.parse(JSON.parse(decoded.slice(0, -1))));
+  const manifest = await validateCheckpointManifest(checkpointManifestV2Schema.parse(JSON.parse(decoded.slice(0, -1))));
   const canonical = await encodeCheckpointManifest(manifest);
   if (!bytesEqual(bytes, canonical)) {
     throw new Error("Checkpoint manifest bytes are not canonical");
@@ -43400,85 +43507,6 @@ class StreamSubmissionAggregator {
   }
 }
 // ../../packages/sdk-ts/src/operation-event-identity.ts
-var STREAM_CHUNK_NAMESPACE = "003e7e6c-2f1e-53ea-9dfa-627edd04a8cc";
-var CANONICAL_UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
-function uuidBytes(value) {
-  if (!CANONICAL_UUID.test(value)) {
-    throw new Error("Operation-event submission ID must be a canonical UUID");
-  }
-  const hex3 = value.toLowerCase().replaceAll("-", "");
-  return Uint8Array.from({ length: 16 }, (_, index) => Number.parseInt(hex3.slice(index * 2, index * 2 + 2), 16));
-}
-function rotateLeft(value, bits) {
-  return (value << bits | value >>> 32 - bits) >>> 0;
-}
-function sha1(input) {
-  const bitLength = input.length * 8;
-  const paddedLength = Math.ceil((input.length + 9) / 64) * 64;
-  const padded = new Uint8Array(paddedLength);
-  padded.set(input);
-  padded[input.length] = 128;
-  const view = new DataView(padded.buffer);
-  view.setUint32(paddedLength - 8, Math.floor(bitLength / 4294967296));
-  view.setUint32(paddedLength - 4, bitLength >>> 0);
-  let h0 = 1732584193;
-  let h1 = 4023233417;
-  let h2 = 2562383102;
-  let h3 = 271733878;
-  let h4 = 3285377520;
-  const words = new Uint32Array(80);
-  for (let offset = 0;offset < paddedLength; offset += 64) {
-    for (let index = 0;index < 16; index += 1) {
-      words[index] = view.getUint32(offset + index * 4);
-    }
-    for (let index = 16;index < 80; index += 1) {
-      words[index] = rotateLeft(words[index - 3] ^ words[index - 8] ^ words[index - 14] ^ words[index - 16], 1);
-    }
-    let a = h0;
-    let b = h1;
-    let c = h2;
-    let d = h3;
-    let e = h4;
-    for (let index = 0;index < 80; index += 1) {
-      let f;
-      let k;
-      if (index < 20) {
-        f = b & c | ~b & d;
-        k = 1518500249;
-      } else if (index < 40) {
-        f = b ^ c ^ d;
-        k = 1859775393;
-      } else if (index < 60) {
-        f = b & c | b & d | c & d;
-        k = 2400959708;
-      } else {
-        f = b ^ c ^ d;
-        k = 3395469782;
-      }
-      const next = rotateLeft(a, 5) + f + e + k + words[index] >>> 0;
-      e = d;
-      d = c;
-      c = rotateLeft(b, 30);
-      b = a;
-      a = next;
-    }
-    h0 = h0 + a >>> 0;
-    h1 = h1 + b >>> 0;
-    h2 = h2 + c >>> 0;
-    h3 = h3 + d >>> 0;
-    h4 = h4 + e >>> 0;
-  }
-  const digest = new Uint8Array(20);
-  const digestView = new DataView(digest.buffer);
-  for (const [index, value] of [h0, h1, h2, h3, h4].entries()) {
-    digestView.setUint32(index * 4, value);
-  }
-  return digest;
-}
-function formatUuid(bytes) {
-  const hex3 = Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("").slice(0, 32);
-  return `${hex3.slice(0, 8)}-${hex3.slice(8, 12)}-${hex3.slice(12, 16)}-${hex3.slice(16, 20)}-${hex3.slice(20)}`;
-}
 function createOperationEventSubmissionId() {
   const submissionId = globalThis.crypto?.randomUUID?.();
   if (!submissionId) {
@@ -43487,19 +43515,6 @@ function createOperationEventSubmissionId() {
   return submissionId.toLowerCase();
 }
 var createOperationEventRequestId = createOperationEventSubmissionId;
-function operationEventStreamRequestId(submissionId, chunkOrdinal) {
-  if (!Number.isInteger(chunkOrdinal) || chunkOrdinal < 0 || chunkOrdinal > 2147483647) {
-    throw new Error("Stream chunk ordinal must be an integer from 0 through 2147483647");
-  }
-  uuidBytes(submissionId);
-  const normalizedSubmissionId = submissionId.toLowerCase();
-  const namespace = uuidBytes(STREAM_CHUNK_NAMESPACE);
-  const name = new TextEncoder().encode(`${normalizedSubmissionId}:${chunkOrdinal}`);
-  const digest = sha1(Uint8Array.from([...namespace, ...name])).slice(0, 16);
-  digest[6] = digest[6] & 15 | 80;
-  digest[8] = digest[8] & 63 | 128;
-  return formatUuid(digest);
-}
 
 // ../../packages/sdk-ts/src/stream-submit-types.ts
 var DEFAULT_STREAM_CHUNK_SIZE = DEFAULT_STREAM_APPEND_CHUNK_SIZE;
@@ -44481,7 +44496,7 @@ function createStreamingSubmissionHandle(input, deps) {
 // ../../packages/sdk-ts/package.json
 var package_default = {
   name: "@warmhub/sdk-ts",
-  version: "0.100.0",
+  version: "0.101.0",
   private: false,
   type: "module",
   description: "The TypeScript SDK for WarmHub — create repos, commit and query data, and compound knowledge with your AI agents.",
@@ -48065,6 +48080,8 @@ function redactArgv(argv) {
   const out = [];
   for (let i = 0;i < argv.length; i++) {
     const arg = argv[i];
+    if (arg === undefined)
+      continue;
     const eqIdx = arg.indexOf("=");
     if (eqIdx > 0) {
       const lhs = arg.slice(0, eqIdx);
@@ -48421,7 +48438,7 @@ function parseLockOwner(raw) {
     }
   } catch {}
   const rawPid = raw.split(":", 1)[0];
-  if (!/^\d+$/.test(rawPid))
+  if (rawPid === undefined || !/^\d+$/.test(rawPid))
     return null;
   const pid = Number(rawPid);
   return Number.isSafeInteger(pid) && pid > 0 ? { pid, processStart: null } : null;
@@ -48724,7 +48741,10 @@ function isExpired(tokens) {
 }
 function safeDecodeExpiry(jwt2) {
   try {
-    const payload = JSON.parse(Buffer.from(jwt2.split(".")[1], "base64url").toString());
+    const encodedPayload = jwt2.split(".")[1];
+    if (encodedPayload === undefined)
+      return null;
+    const payload = JSON.parse(Buffer.from(encodedPayload, "base64url").toString());
     if (typeof payload.exp === "number") {
       return new Date(payload.exp * 1000).toISOString();
     }
@@ -48997,7 +49017,7 @@ function ownerPid(ownerToken) {
 }
 function ownerIdentity(ownerToken) {
   const [, , identity2, nonce] = ownerToken.trim().split(":", 4);
-  return nonce && /^[a-f0-9]{64}$/.test(identity2 ?? "") ? identity2 : null;
+  return nonce && identity2 && /^[a-f0-9]{64}$/.test(identity2) ? identity2 : null;
 }
 function processStillOwnsClaim(pid, identity2) {
   if (pid === null)
@@ -49263,7 +49283,9 @@ function saveProfileWhileLocked(name, profile, path) {
 function getProfile(name, path) {
   const p = path ?? getAuthPath();
   const store = loadProfileStore(p);
-  return hasProfile(store, name) ? store.profiles[name] : null;
+  if (!hasProfile(store, name))
+    return null;
+  return store.profiles[name] ?? null;
 }
 async function modifyStore(mutator, path) {
   const p = path ?? getAuthPath();
@@ -50431,9 +50453,10 @@ class DomainRegistry {
     }
   }
   resolveDomain(tokens) {
-    if (tokens.length < 1)
+    const rootToken = tokens[0];
+    if (rootToken === undefined)
       return;
-    const domain2 = this.domains.get(tokens[0]);
+    const domain2 = this.domains.get(rootToken);
     if (!domain2)
       return;
     if (domain2.kind === "flat") {
@@ -50447,9 +50470,15 @@ class DomainRegistry {
     let cursor = domain2;
     const path = [domain2.name];
     let i = 1;
-    while (cursor.kind === "noun" && cursor.subdomains && i < tokens.length && cursor.subdomains[tokens[i]]) {
-      cursor = cursor.subdomains[tokens[i]];
-      path.push(tokens[i]);
+    while (cursor.kind === "noun" && cursor.subdomains && i < tokens.length) {
+      const token = tokens[i];
+      if (token === undefined)
+        break;
+      const subdomain = cursor.subdomains[token];
+      if (subdomain === undefined)
+        break;
+      cursor = subdomain;
+      path.push(token);
       i++;
     }
     if (cursor.kind === "flat") {
@@ -51063,11 +51092,26 @@ function levenshtein(a, b) {
   const m = a.length, n = b.length;
   const dp = Array.from({ length: m + 1 }, (_, i) => Array.from({ length: n + 1 }, (_2, j) => i === 0 ? j : j === 0 ? i : 0));
   for (let i = 1;i <= m; i++) {
+    const row = dp[i];
+    const previousRow = dp[i - 1];
+    if (row === undefined || previousRow === undefined) {
+      throw new RangeError("Levenshtein matrix row is missing");
+    }
     for (let j = 1;j <= n; j++) {
-      dp[i][j] = a[i - 1] === b[j - 1] ? dp[i - 1][j - 1] : 1 + Math.min(dp[i - 1][j], dp[i][j - 1], dp[i - 1][j - 1]);
+      const diagonal = previousRow[j - 1];
+      const above = previousRow[j];
+      const left = row[j - 1];
+      if (diagonal === undefined || above === undefined || left === undefined) {
+        throw new RangeError("Levenshtein matrix cell is missing");
+      }
+      row[j] = a[i - 1] === b[j - 1] ? diagonal : 1 + Math.min(above, left, diagonal);
     }
   }
-  return dp[m][n];
+  const distance = dp[m]?.[n];
+  if (distance === undefined) {
+    throw new RangeError("Levenshtein result is missing");
+  }
+  return distance;
 }
 function findClosest(input, candidates, maxDistance = 2) {
   let best;
@@ -53703,7 +53747,8 @@ var handleView = async (ctx, { flags, args, terminator }) => {
     file: flags.file,
     stdin: ctx.stdin ?? process.stdin
   });
-  if (wrefs.length === 0) {
+  const singleWref = wrefs[0];
+  if (singleWref === undefined) {
     throw new CliError(2 /* UserInput */, "USER_INPUT", "Missing required <wref>. Pass a wref as a positional arg, via --file <path>, or pipe newline-delimited wrefs on stdin.", undefined, "Example: wh thing view Game/base --depth 2");
   }
   if (wrefs.length > MAX_GET_MANY_WREFS2) {
@@ -53718,7 +53763,6 @@ var handleView = async (ctx, { flags, args, terminator }) => {
   }
   if (isBatch)
     return runBatchView(ctx, wrefs, flags);
-  const [singleWref] = wrefs;
   return runSingleView(ctx, singleWref, flags);
 };
 
@@ -54689,13 +54733,7 @@ var handleLogin = async (ctx, { flags }) => {
     deadline: Date.now() + device.expires_in * 1000,
     signal: ctx.signal
   });
-  let expiresAt;
-  try {
-    const payload = JSON.parse(Buffer.from(tokenResponse.access_token.split(".")[1], "base64url").toString());
-    expiresAt = typeof payload.exp === "number" ? new Date(payload.exp * 1000).toISOString() : new Date(Date.now() + 5 * 60 * 1000).toISOString();
-  } catch {
-    expiresAt = new Date(Date.now() + 5 * 60 * 1000).toISOString();
-  }
+  const expiresAt = accessTokenExpiry(tokenResponse.access_token);
   await saveProfileWithFlagsLocked(profile, {
     tokens: {
       accessToken: tokenResponse.access_token,
@@ -54861,7 +54899,10 @@ function parseFramedBody(buffer, maxContentLength, bufferByteLength) {
   const match = CONTENT_LENGTH_RE.exec(header);
   if (!match)
     return null;
-  const contentLength = parseInt(match[1], 10);
+  const rawContentLength = match[1];
+  if (rawContentLength === undefined)
+    return null;
+  const contentLength = parseInt(rawContentLength, 10);
   if (contentLength > maxContentLength) {
     throw new RangeError(`Content-Length ${contentLength} exceeds the maximum allowed ${maxContentLength} bytes`);
   }
@@ -60591,14 +60632,14 @@ async function collectChecks(ctx) {
     }
   }
   const settingsHealth = await checkClaudeSettingsHealth(harnessPaths);
-  if (settingsHealth.malformedFiles.length > 0) {
-    const first = settingsHealth.malformedFiles[0];
+  const firstMalformedFile = settingsHealth.malformedFiles[0];
+  if (firstMalformedFile !== undefined) {
     checks3.push({
       key: "claude-settings-health",
       name: "claude-settings-health",
       status: "fail",
-      message: `Malformed Claude settings JSON in ${first.path}`,
-      detail: first.error,
+      message: `Malformed Claude settings JSON in ${firstMalformedFile.path}`,
+      detail: firstMalformedFile.error,
       fix: "Fix malformed JSON manually, then rerun doctor"
     });
   } else {
@@ -61318,8 +61359,9 @@ data of their own. You read; they watch the data model become legible.
 2. Describe the repo at a high level: call \`warmhub_repo_describe\` and summarize
    what kinds of things it holds, in plain language (1–2 sentences). **Wait.**
 3. Pull a few real records: call \`warmhub_thing_query\` (filter by a shape) and
-   then \`warmhub_thing_get\` on one interesting result. Show them one concrete
-   thing and explain what its fields mean. **Wait.**
+   then \`warmhub_thing_get\` with \`wrefs: [...]\` on the interesting results — it
+   takes a list, so fetch them in one call. Show them one concrete thing and
+   explain what its fields mean. **Wait.**
 4. The bridge moment: ask them a real question about the repo, then answer it by
    querying — so they see the agent get an answer *they didn't have to write*.
 
@@ -61346,8 +61388,9 @@ authored by their agent lands in a repo of their own.
    definition and a short note (a \`Note\` that says they finished onboarding)
    together in one commit. Tell them what you're saving first, then save it.
    **Wait** for their go-ahead before writing.
-5. Confirm the write: read it back (\`warmhub_thing_get\`) and tell them the commit
-   landed and that it's attributed to this agent.
+5. Confirm the write: read it back (\`warmhub_thing_get\` with the new wref in
+   \`wrefs\`) and tell them the commit landed and that it's attributed to this
+   agent.
 
 **Done when:** a commit authored by their connected agent exists on HEAD of a
 repo they own, and you've read it back to confirm.
@@ -61378,6 +61421,7 @@ identical for every agent; only the connection details in the header above diffe
 
 // ../../packages/warmhub-cli/src/domains/onboard.ts
 var NEUTRAL_ASK = "present the options as a short numbered list and wait for the user to choose before continuing.";
+var SUPPORTED_AGENTS = ["claude", "gemini", "codex", "cursor"];
 var ADAPTERS = {
   claude: {
     header: claude_default,
@@ -61396,13 +61440,15 @@ var ADAPTERS = {
     ask: NEUTRAL_ASK
   }
 };
-var SUPPORTED_AGENTS = Object.keys(ADAPTERS);
+function isSupportedAgent(agent) {
+  return SUPPORTED_AGENTS.some((supported) => supported === agent);
+}
 function buildOnboarding(opts = {}) {
-  const ask = opts.agent ? ADAPTERS[opts.agent].ask : NEUTRAL_ASK;
-  const body = onboard_content_default.trimEnd().replace("{{ASK_PRIMITIVE}}", ask);
-  if (!opts.agent)
+  const adapter = opts.agent === undefined ? null : ADAPTERS[opts.agent];
+  const body = onboard_content_default.trimEnd().replace("{{ASK_PRIMITIVE}}", adapter === null ? NEUTRAL_ASK : adapter.ask);
+  if (adapter === null)
     return body;
-  const header = ADAPTERS[opts.agent].header.trimEnd();
+  const header = adapter.header.trimEnd();
   return `${header}
 
 ---
@@ -61416,7 +61462,7 @@ var onboardFlags = {
 };
 var handleOnboard = async (ctx, { flags }) => {
   const agent = flags.agent;
-  if (agent !== undefined && !SUPPORTED_AGENTS.includes(agent)) {
+  if (agent !== undefined && !isSupportedAgent(agent)) {
     throw new CliError(2 /* UserInput */, "USER_INPUT", `Unknown agent '${agent}'.`, undefined, `Supported agents: ${SUPPORTED_AGENTS.join(", ")}. Omit --agent for the model-agnostic script.`);
   }
   const script = buildOnboarding({ agent });
@@ -65532,20 +65578,21 @@ function formatAllowedMatches(allowedMatches) {
 }
 
 // ../../packages/warmhub-cli/src/domains/token.ts
+var DURATION_MULTIPLIERS = {
+  h: 3600000,
+  d: 86400000,
+  m: 30 * 86400000,
+  y: 365 * 86400000
+};
 function parseDuration(input) {
   const match = input.match(/^(\d+)([dhmy])$/);
-  if (!match) {
+  const rawValue = match?.[1];
+  const unit = match?.[2];
+  const multiplier = unit === undefined ? undefined : DURATION_MULTIPLIERS[unit];
+  if (rawValue === undefined || multiplier === undefined) {
     throw new CliError(2 /* UserInput */, "USER_INPUT", `Invalid duration: "${input}". Expected format: 30d, 90d, 1y`);
   }
-  const value = Number(match[1]);
-  const unit = match[2];
-  const multipliers = {
-    h: 3600000,
-    d: 86400000,
-    m: 30 * 86400000,
-    y: 365 * 86400000
-  };
-  return value * multipliers[unit];
+  return Number(rawValue) * multiplier;
 }
 function tokenStatus(pat) {
   if (pat.revokedAt)
@@ -66556,7 +66603,9 @@ function emitDryRun(ctx, invocation, verb, localFlags) {
   ];
   for (const flag2 of displaySpecs) {
     if (Object.hasOwn(invocation.flags, flag2.long)) {
-      flags[flag2.long] = invocation.flags[flag2.long];
+      const value = invocation.flags[flag2.long];
+      if (value !== undefined)
+        flags[flag2.long] = value;
     }
   }
   for (const [long, value] of Object.entries(invocation.flags)) {
@@ -68155,7 +68204,7 @@ function resolveLogLevel(flagLevel, env) {
 // package.json
 var package_default3 = {
   name: "@warmhub/cli",
-  version: "0.102.0",
+  version: "0.103.0",
   private: false,
   type: "module",
   description: "The wh CLI for WarmHub — create repos, commit and query data, and compound knowledge with your AI agents.",
@@ -68780,5 +68829,5 @@ process.exitCode = interceptedExitCode === undefined ? await runPreparedCli(laun
   version: package_default3.version
 }) : interceptedExitCode;
 
-//# debugId=4B5B53D1177A949C64756E2164756E21
-//# warmhub-cli-build-info {"cliVersion":"0.102.0","sdkVersion":"0.100.0"}
+//# debugId=9DB78BF7B29E792864756E2164756E21
+//# warmhub-cli-build-info {"cliVersion":"0.103.0","sdkVersion":"0.101.0"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@warmhub/cli",
-  "version": "0.102.0",
+  "version": "0.103.0",
   "private": false,
   "type": "module",
   "description": "The wh CLI for WarmHub — create repos, commit and query data, and compound knowledge with your AI agents.",