@warmhub/cli 0.132.2 → 0.134.0

package/dist/wh.js

@@ -26118,6 +26118,16 @@ function illegalOpSequences(operations, errors, checkAddAdd, options) {
   }
 }
 
+// ../../packages/rules/src/reserved-roots.ts
+var RESERVED_THING_ROOT = "hub";
+var RESERVED_THING_ROOT_PREFIX = `${RESERVED_THING_ROOT}/`;
+function isReservedThingRoot(name) {
+  return name === RESERVED_THING_ROOT || name.startsWith(RESERVED_THING_ROOT_PREFIX);
+}
+function reservedThingRootMessage(name) {
+  return `Name "${name}" is under the reserved root "${RESERVED_THING_ROOT_PREFIX}"; only Shapes live there, as ${RESERVED_THING_ROOT_PREFIX}shapes/<Name>`;
+}
+
 // ../../packages/rules/src/preflight-operation.ts
 var collectionTypes = ["arc", "bond", "set", "list", "pair"];
 var canonicalCollectionTypes = ["arc", "bond", "pair", "set", "list"];
@@ -26133,6 +26143,7 @@ function parseCollectionOp(value) {
 function preflightOpDiagnostics(op, operationIndex) {
   const errors = [];
   errors.push(...builtinShapeGuard(op, operationIndex));
+  errors.push(...reservedRootGuard(op, operationIndex));
   errors.push(...contentNameGuard(op, operationIndex));
   errors.push(...plusSignGuard(op, operationIndex));
   errors.push(...validateCollectionAbouts(op, operationIndex));
@@ -26187,6 +26198,29 @@ function builtinShapeGuard(op, operationIndex) {
   }
   return errors;
 }
+function reservedRootRefusal(name, operationIndex) {
+  return {
+    code: "RESERVED_NAME",
+    operationIndex,
+    message: reservedThingRootMessage(name)
+  };
+}
+function reservedRootGuard(op, operationIndex) {
+  if (op.kind === "shape")
+    return [];
+  if (op.operation === "add" && op.name) {
+    const stored = op.kind === "collection" ? op.name : splitLocalPath(op.name)?.bareName;
+    if (stored !== undefined && isReservedThingRoot(stored)) {
+      return [reservedRootRefusal(stored, operationIndex)];
+    }
+    return [];
+  }
+  const isShapeRename = op.name !== undefined && splitLocalPath(op.name) === null;
+  if (op.operation === "rename" && !isShapeRename && op.newName !== undefined && isReservedThingRoot(op.newName)) {
+    return [reservedRootRefusal(op.newName, operationIndex)];
+  }
+  return [];
+}
 function contentNameGuard(op, operationIndex) {
   if (op.kind !== "thing" || !op.name)
     return [];
@@ -45429,7 +45463,7 @@ function createStreamingSubmissionHandle(input, deps) {
 // ../../packages/sdk-ts/package.json
 var package_default = {
   name: "@warmhub/sdk-ts",
-  version: "0.130.2",
+  version: "0.132.0",
   private: false,
   type: "module",
   description: "The TypeScript SDK for WarmHub — create repos, commit and query data, and compound knowledge with your AI agents.",
@@ -49791,10 +49825,10 @@ class WorkOsAuthError extends Error {
     this.status = status;
   }
 }
-async function refreshAccessToken(tokens, signal) {
+async function refreshAccessToken(tokens, signal, options = {}) {
   const log = getLog();
   const { clientId } = tokens;
-  const workosUrl = "https://api.workos.com";
+  const workosUrl = (options.workosUrl ?? "https://api.workos.com").replace(/\/$/, "");
   const path = "/user_management/authenticate";
   const requestId = `${process.pid}-${Date.now()}-${Math.floor(Math.random() * 1e6)}`;
   log.debug("http.request", {
@@ -49804,7 +49838,8 @@ async function refreshAccessToken(tokens, signal) {
     request_id: requestId
   });
   const startedAt = Date.now();
-  const requestSignal = signal ?? AbortSignal.timeout(WORKOS_REFRESH_TIMEOUT_MS);
+  const timeoutSignal = AbortSignal.timeout(options.requestTimeoutMs ?? WORKOS_REFRESH_TIMEOUT_MS);
+  const requestSignal = signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
   let res;
   try {
     res = await fetch(`${workosUrl}${path}`, {
@@ -50379,6 +50414,9 @@ function corruptedAuthError(path, cause) {
 }
 
 // ../../packages/warmhub-cli/src/auth.ts
+var AUTH_REFRESH_BUDGET_MS = 30000;
+var AUTH_REFRESH_RETRY_DELAY_MS = 1000;
+var TRANSIENT_REFRESH_COOLDOWN_MS = 5000;
 function isAuthLockError(error51, authPath) {
   return error51 instanceof Error && error51.code === "ELOCKED" && (error51.file === undefined || error51.file === authPath);
 }
@@ -50400,6 +50438,17 @@ function delay2(ms, signal) {
     signal?.addEventListener("abort", onAbort, { once: true });
   });
 }
+function refreshCooldownActive(failedAt) {
+  if (!failedAt)
+    return false;
+  const ageMs = Date.now() - new Date(failedAt).getTime();
+  return ageMs >= 0 && ageMs < TRANSIENT_REFRESH_COOLDOWN_MS;
+}
+function withoutRefreshFailure(profile) {
+  const next = { ...profile };
+  delete next.transientRefreshFailedAt;
+  return next;
+}
 function getTokenInfo(profile) {
   const envToken = process.env.WH_TOKEN;
   if (envToken) {
@@ -50428,7 +50477,7 @@ function getTokenInfo(profile) {
     canRefresh: source === "device" && !!tokens.refreshToken
   };
 }
-async function getValidToken(profile, signal) {
+async function getValidToken(profile, signal, options = {}) {
   const log = getLog();
   const envToken = process.env.WH_TOKEN;
   if (envToken) {
@@ -50460,7 +50509,10 @@ async function getValidToken(profile, signal) {
     const classification = err.error === "invalid_grant" ? "invalid_grant" : "terminal";
     const staleProf = getProfile(profileName, authPath);
     if (staleProf) {
-      saveProfileWhileLocked(profileName, { ...staleProf, tokens: { ...staleProf.tokens, refreshToken: "" } }, authPath);
+      saveProfileWhileLocked(profileName, withoutRefreshFailure({
+        ...staleProf,
+        tokens: { ...staleProf.tokens, refreshToken: "" }
+      }), authPath);
       log.error("auth.refresh_token.wiped", {
         profile: profileName,
         reason: classification
@@ -50472,6 +50524,16 @@ async function getValidToken(profile, signal) {
     }
     throw new CliError(5 /* Auth */, "AUTH", `Session could not be refreshed (${err.error}).${err.errorDescription ? ` ${err.errorDescription}` : ""}`, err, `Run ${loginCmd} to re-authenticate.`);
   };
+  const transientRefreshError = (cause) => new CliError(5 /* Auth */, "AUTH", "Token refresh failed (transient).", cause, `Check network connectivity, or run ${loginCmd} to re-authenticate.`);
+  const markTransientRefreshFailure = () => {
+    const failedProf = getProfile(profileName, authPath);
+    if (!failedProf)
+      return;
+    saveProfileWhileLocked(profileName, {
+      ...failedProf,
+      transientRefreshFailedAt: new Date().toISOString()
+    }, authPath);
+  };
   try {
     return await withAuthLock(authPath, async () => {
       const lockedProf = getProfile(profileName, authPath);
@@ -50486,14 +50548,20 @@ async function getValidToken(profile, signal) {
       if (!lockedTokens.refreshToken) {
         throw new CliError(5 /* Auth */, "AUTH", "Session expired.", undefined, `Run ${loginCmd} to re-authenticate.`);
       }
+      if (refreshCooldownActive(lockedProf.transientRefreshFailedAt)) {
+        log.info("auth.refresh.cooldown", { profile: profileName });
+        throw transientRefreshError();
+      }
+      const budgetSignal = AbortSignal.timeout(options.refreshBudgetMs ?? AUTH_REFRESH_BUDGET_MS);
+      const refreshSignal = signal ? AbortSignal.any([signal, budgetSignal]) : budgetSignal;
       const refreshStarted = Date.now();
       log.info("auth.refresh.start", {
         profile: profileName,
         client_id: lockedTokens.clientId
       });
       try {
-        const refreshed = await refreshAccessToken(lockedTokens, signal);
-        saveProfileWhileLocked(profileName, { ...lockedProf, tokens: refreshed }, authPath);
+        const refreshed = await refreshAccessToken(lockedTokens, refreshSignal);
+        saveProfileWhileLocked(profileName, withoutRefreshFailure({ ...lockedProf, tokens: refreshed }), authPath);
         log.info("auth.refresh.ok", {
           profile: profileName,
           duration_ms: Date.now() - refreshStarted,
@@ -50521,15 +50589,25 @@ async function getValidToken(profile, signal) {
           duration_ms: Date.now() - refreshStarted,
           error_name: err instanceof Error ? err.name : "Unknown"
         });
-        await delay2(1000, signal);
+        try {
+          await delay2(options.retryDelayMs ?? AUTH_REFRESH_RETRY_DELAY_MS, refreshSignal);
+        } catch (delayErr) {
+          if (signal?.aborted)
+            throw delayErr;
+          markTransientRefreshFailure();
+          throw transientRefreshError(delayErr);
+        }
         log.info("auth.refresh.retry", { profile: profileName, attempt: 2 });
         let retryStarted = Date.now();
         try {
           const retryProf = getProfile(profileName, authPath);
           const retryTokens = retryProf?.tokens ?? lockedTokens;
           retryStarted = Date.now();
-          const refreshed = await refreshAccessToken(retryTokens, signal);
-          saveProfileWhileLocked(profileName, { ...retryProf ?? lockedProf, tokens: refreshed }, authPath);
+          const refreshed = await refreshAccessToken(retryTokens, refreshSignal);
+          saveProfileWhileLocked(profileName, withoutRefreshFailure({
+            ...retryProf ?? lockedProf,
+            tokens: refreshed
+          }), authPath);
           log.info("auth.refresh.ok", {
             profile: profileName,
             duration_ms: Date.now() - retryStarted,
@@ -50554,7 +50632,8 @@ async function getValidToken(profile, signal) {
             failTerminalRefresh(retryErr);
           }
           log.info("auth.refresh.failed", fields);
-          throw new CliError(5 /* Auth */, "AUTH", "Token refresh failed (transient).", retryErr, `Check network connectivity, or run ${loginCmd} to re-authenticate.`);
+          markTransientRefreshFailure();
+          throw transientRefreshError(retryErr);
         }
       }
     });
@@ -50873,7 +50952,7 @@ function shouldGuardDomain(domainPath, canonicalVerb, args) {
 }
 async function probeCapabilities(ctx) {
   try {
-    return await ctx.client.diagnostics.capabilities();
+    return await (ctx.compatibilityClient ?? ctx.client).diagnostics.capabilities();
   } catch {
     return;
   }
@@ -50887,7 +50966,7 @@ async function checkCompatibility(ctx, domainPath, canonicalVerb, args) {
   }
   let capabilities;
   try {
-    const diagnostics = ctx.client.diagnostics;
+    const diagnostics = (ctx.compatibilityClient ?? ctx.client).diagnostics;
     if (typeof diagnostics.assertCompatible === "function") {
       await diagnostics.assertCompatible();
       if (clientFlags.length > 0)
@@ -50896,6 +50975,8 @@ async function checkCompatibility(ctx, domainPath, canonicalVerb, args) {
       capabilities = await diagnostics.capabilities();
     }
   } catch (err) {
+    if (err instanceof CliError && err.kind === "AUTH")
+      throw err;
     const message = err instanceof Error ? err.message : String(err);
     if (message.includes("Could not find") || message.includes("NOT_FOUND") || message.includes("is not a function")) {
       ctx.err("Backend does not support capabilities check (upgrade backend)");
@@ -54270,7 +54351,7 @@ var handleRefs = async (ctx, { flags, args }) => {
     }
     const result2 = withDecorations({ items, nextCursor: undefined }, decorations);
     writePageOutput(ctx, items, { limit: pageLimit, nextCursor: null, decorations }, () => renderRefs(ctx.out, ctx.colors, result2, wref, direction));
-    maybeEmitAboutHint(ctx, direction, items.length, refsQueryIsNarrowed);
+    maybeEmitAboutHint(ctx, direction, items.length, refsQueryIsNarrowed, false);
     return;
   }
   const result = await fetchPage(cursor);
@@ -54282,13 +54363,15 @@ var handleRefs = async (ctx, { flags, args }) => {
     nextCursor: result.nextCursor ?? null,
     decorations: getResponseDecorations(result)
   }, () => renderRefs(ctx.out, ctx.colors, result, wref, direction));
-  maybeEmitAboutHint(ctx, direction, result.items?.length ?? 0, refsQueryIsNarrowed);
+  maybeEmitAboutHint(ctx, direction, result.items?.length ?? 0, refsQueryIsNarrowed, Boolean(result.nextCursor));
 };
-function maybeEmitAboutHint(ctx, direction, itemCount, refsQueryIsNarrowed) {
+function maybeEmitAboutHint(ctx, direction, itemCount, refsQueryIsNarrowed, hasMore) {
   if (direction !== "inbound")
     return;
   if (refsQueryIsNarrowed)
     return;
+  if (hasMore)
+    return;
   if (itemCount > 0)
     return;
   if (ctx.format === "json" || ctx.format === "jsonl")
@@ -55550,7 +55633,20 @@ Run \`wh auth login --profile ${explicitProfile}\` to create it.`);
     clientFlags,
     decorateResponses: decorate
   });
-  return { config: config2, profile: effectiveProfile, client, clientFlags, decorate };
+  const compatibilityClient = args.client ?? createUnauthenticatedClient(config2, {
+    functionLogs: args.functionLogs,
+    signal: args.signal,
+    clientFlags,
+    decorateResponses: decorate
+  });
+  return {
+    config: config2,
+    profile: effectiveProfile,
+    client,
+    compatibilityClient,
+    clientFlags,
+    decorate
+  };
 }
 
 // ../../packages/warmhub-cli/src/domains/auth-shared.ts
@@ -57334,6 +57430,9 @@ var createFlags3 = {
   committer: flag.string({
     description: "Committer wref (shape or shaped thing; e.g. Agent/bot-1)"
   }),
+  "component-ref": flag.string({
+    description: "attribute writes to an actively installed component (Org/Name); the server checks caller authorization."
+  }),
   add: flag.string({
     description: "Add a new thing (bare name — use --shape to set the shape). Repeatable; pair each --add with its own --data. For >20 ops, use --file <path>.",
     multiple: true
@@ -58111,6 +58210,7 @@ async function applyJsonlCommit(ctx, args) {
           repoName: args.repo,
           streamId,
           submissionId: args.submissionId,
+          ...args.componentRef !== undefined ? { componentRef: args.componentRef } : {},
           ...args.committer ? { committer: args.committer } : {},
           ...args.message ? { message: args.message } : {},
           ...args.returnRepoSeq === true ? { returnRepoSeq: true } : {},
@@ -58473,6 +58573,7 @@ async function executeCommitValidation(ctx, args) {
   const options = {
     ...args.message !== undefined ? { message: args.message } : {},
     ...args.committer !== undefined ? { committer: args.committer } : {},
+    ...args.componentRef !== undefined ? { componentRef: args.componentRef } : {},
     ...args.skipExisting ? { skipExisting: true } : {},
     ...args.includeWouldBeBody ? { includeWouldBeBody: true } : {},
     ...ctx.signal ? { signal: ctx.signal } : {}
@@ -58518,6 +58619,7 @@ async function executeCommitValidation(ctx, args) {
 var handleSubmit = async (ctx, { flags, args }) => {
   const { org, repo } = parseOrgRepo(getRepoRef(ctx) ?? args[0], ctx.config);
   const committer = flags.committer;
+  const componentRef = flags["component-ref"];
   const messageFlag = flags.message;
   const opsJson = flags.ops;
   const opsFile = flags.file;
@@ -58709,6 +58811,7 @@ var handleSubmit = async (ctx, { flags, args }) => {
       operations,
       message,
       committer,
+      componentRef,
       skipExisting,
       includeWouldBeBody: flags["include-would-be-body"] === true,
       progressRequested,
@@ -58737,6 +58840,7 @@ var handleSubmit = async (ctx, { flags, args }) => {
       org,
       repo,
       committer,
+      componentRef,
       message,
       chunkSize,
       progressRequested,
@@ -58749,6 +58853,7 @@ var handleSubmit = async (ctx, { flags, args }) => {
       org,
       repo,
       committer,
+      componentRef,
       message,
       opsFile,
       chunkSize,
@@ -58761,6 +58866,7 @@ var handleSubmit = async (ctx, { flags, args }) => {
       allowNulBytes
     }) : identifyCommitSubmitOutput(await ctx.client.commit.apply(org, repo, message, operations, {
       committer,
+      componentRef,
       skipExisting,
       submissionId,
       ...returnRepoSeq === true ? { returnRepoSeq: true } : {}
@@ -58923,6 +59029,7 @@ function assertServerStreamOptions(ctx, flags, source) {
     userInput("--submission-id must be a UUID.");
   }
   const incompatible = [
+    ["--component-ref", flags["component-ref"] !== undefined],
     ["--chunk-size", flags["chunk-size"] !== undefined],
     ["--skip-existing", flags["skip-existing"] === true],
     ["--progress", flags.progress === true],
@@ -61574,7 +61681,7 @@ async function checkRepoLicenseDeclaration(ctx, repo, repoInfo) {
       name: "repo-license",
       status: "warn",
       message: `Public repo ${safeRepoRef} has no repository license declaration.`,
-      detail: `Choose the correct license, then create the native LicenseSubject/repo thing and LicenseDeclaration/repo assertion. Set spdxIdRaw and, when applicable, licenseWref to a canonical License in ${LICENSE_SUBSTRATE}. No component installation is required.`
+      detail: `Choose the correct license, then create the native LicenseSubject/license/subject thing and the LicenseDeclaration/license assertion about it. Set spdxIdRaw and, when applicable, licenseWref to a canonical License in ${LICENSE_SUBSTRATE}. No component installation is required.`
     };
   } catch (error51) {
     const failure = classifyDoctorLookupError(error51);
@@ -69699,9 +69806,17 @@ async function runPreparedCli(rawArgv, prepared, opts) {
       requestedMode: requestedFunctionLogs
     });
     const localOnlyCommand = isLocalOnlyInvocation(invocation);
-    const { config: config2, client, profile, clientFlags, decorate } = localOnlyCommand ? {
+    const {
+      config: config2,
+      client,
+      compatibilityClient,
+      profile,
+      clientFlags,
+      decorate
+    } = localOnlyCommand ? {
       config: loadConfig(),
       client: createLocalOnlyClient(),
+      compatibilityClient: undefined,
       profile: "default",
       clientFlags: [],
       decorate: true
@@ -69722,6 +69837,7 @@ async function runPreparedCli(rawArgv, prepared, opts) {
     const signal = abortController.signal;
     const commandContext = {
       client,
+      compatibilityClient,
       config: config2,
       invocation,
       profile,
@@ -69848,7 +69964,7 @@ function resolveLogLevel(flagLevel, env) {
 // package.json
 var package_default3 = {
   name: "@warmhub/cli",
-  version: "0.132.2",
+  version: "0.134.0",
   private: false,
   type: "module",
   description: "The wh CLI for WarmHub — create repos, commit and query data, and compound knowledge with your AI agents.",
@@ -70473,5 +70589,5 @@ process.exitCode = interceptedExitCode === undefined ? await runPreparedCli(laun
   version: package_default3.version
 }) : interceptedExitCode;
 
-//# debugId=FFF74F1A1894DD3464756E2164756E21
-//# warmhub-cli-build-info {"cliVersion":"0.132.2","sdkVersion":"0.130.2"}
+//# debugId=59E58BA2C90F5E3C64756E2164756E21
+//# warmhub-cli-build-info {"cliVersion":"0.134.0","sdkVersion":"0.132.0"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@warmhub/cli",
-  "version": "0.132.2",
+  "version": "0.134.0",
   "private": false,
   "type": "module",
   "description": "The wh CLI for WarmHub — create repos, commit and query data, and compound knowledge with your AI agents.",