@warmhub/cli 0.133.0 → 0.134.0

package/dist/wh.js

@@ -26118,6 +26118,16 @@ function illegalOpSequences(operations, errors, checkAddAdd, options) {
   }
 }
 
+// ../../packages/rules/src/reserved-roots.ts
+var RESERVED_THING_ROOT = "hub";
+var RESERVED_THING_ROOT_PREFIX = `${RESERVED_THING_ROOT}/`;
+function isReservedThingRoot(name) {
+  return name === RESERVED_THING_ROOT || name.startsWith(RESERVED_THING_ROOT_PREFIX);
+}
+function reservedThingRootMessage(name) {
+  return `Name "${name}" is under the reserved root "${RESERVED_THING_ROOT_PREFIX}"; only Shapes live there, as ${RESERVED_THING_ROOT_PREFIX}shapes/<Name>`;
+}
+
 // ../../packages/rules/src/preflight-operation.ts
 var collectionTypes = ["arc", "bond", "set", "list", "pair"];
 var canonicalCollectionTypes = ["arc", "bond", "pair", "set", "list"];
@@ -26133,6 +26143,7 @@ function parseCollectionOp(value) {
 function preflightOpDiagnostics(op, operationIndex) {
   const errors = [];
   errors.push(...builtinShapeGuard(op, operationIndex));
+  errors.push(...reservedRootGuard(op, operationIndex));
   errors.push(...contentNameGuard(op, operationIndex));
   errors.push(...plusSignGuard(op, operationIndex));
   errors.push(...validateCollectionAbouts(op, operationIndex));
@@ -26187,6 +26198,29 @@ function builtinShapeGuard(op, operationIndex) {
   }
   return errors;
 }
+function reservedRootRefusal(name, operationIndex) {
+  return {
+    code: "RESERVED_NAME",
+    operationIndex,
+    message: reservedThingRootMessage(name)
+  };
+}
+function reservedRootGuard(op, operationIndex) {
+  if (op.kind === "shape")
+    return [];
+  if (op.operation === "add" && op.name) {
+    const stored = op.kind === "collection" ? op.name : splitLocalPath(op.name)?.bareName;
+    if (stored !== undefined && isReservedThingRoot(stored)) {
+      return [reservedRootRefusal(stored, operationIndex)];
+    }
+    return [];
+  }
+  const isShapeRename = op.name !== undefined && splitLocalPath(op.name) === null;
+  if (op.operation === "rename" && !isShapeRename && op.newName !== undefined && isReservedThingRoot(op.newName)) {
+    return [reservedRootRefusal(op.newName, operationIndex)];
+  }
+  return [];
+}
 function contentNameGuard(op, operationIndex) {
   if (op.kind !== "thing" || !op.name)
     return [];
@@ -45429,7 +45463,7 @@ function createStreamingSubmissionHandle(input, deps) {
 // ../../packages/sdk-ts/package.json
 var package_default = {
   name: "@warmhub/sdk-ts",
-  version: "0.131.0",
+  version: "0.132.0",
   private: false,
   type: "module",
   description: "The TypeScript SDK for WarmHub — create repos, commit and query data, and compound knowledge with your AI agents.",
@@ -49791,10 +49825,10 @@ class WorkOsAuthError extends Error {
     this.status = status;
   }
 }
-async function refreshAccessToken(tokens, signal) {
+async function refreshAccessToken(tokens, signal, options = {}) {
   const log = getLog();
   const { clientId } = tokens;
-  const workosUrl = "https://api.workos.com";
+  const workosUrl = (options.workosUrl ?? "https://api.workos.com").replace(/\/$/, "");
   const path = "/user_management/authenticate";
   const requestId = `${process.pid}-${Date.now()}-${Math.floor(Math.random() * 1e6)}`;
   log.debug("http.request", {
@@ -49804,7 +49838,8 @@ async function refreshAccessToken(tokens, signal) {
     request_id: requestId
   });
   const startedAt = Date.now();
-  const requestSignal = signal ?? AbortSignal.timeout(WORKOS_REFRESH_TIMEOUT_MS);
+  const timeoutSignal = AbortSignal.timeout(options.requestTimeoutMs ?? WORKOS_REFRESH_TIMEOUT_MS);
+  const requestSignal = signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
   let res;
   try {
     res = await fetch(`${workosUrl}${path}`, {
@@ -50379,6 +50414,9 @@ function corruptedAuthError(path, cause) {
 }
 
 // ../../packages/warmhub-cli/src/auth.ts
+var AUTH_REFRESH_BUDGET_MS = 30000;
+var AUTH_REFRESH_RETRY_DELAY_MS = 1000;
+var TRANSIENT_REFRESH_COOLDOWN_MS = 5000;
 function isAuthLockError(error51, authPath) {
   return error51 instanceof Error && error51.code === "ELOCKED" && (error51.file === undefined || error51.file === authPath);
 }
@@ -50400,6 +50438,17 @@ function delay2(ms, signal) {
     signal?.addEventListener("abort", onAbort, { once: true });
   });
 }
+function refreshCooldownActive(failedAt) {
+  if (!failedAt)
+    return false;
+  const ageMs = Date.now() - new Date(failedAt).getTime();
+  return ageMs >= 0 && ageMs < TRANSIENT_REFRESH_COOLDOWN_MS;
+}
+function withoutRefreshFailure(profile) {
+  const next = { ...profile };
+  delete next.transientRefreshFailedAt;
+  return next;
+}
 function getTokenInfo(profile) {
   const envToken = process.env.WH_TOKEN;
   if (envToken) {
@@ -50428,7 +50477,7 @@ function getTokenInfo(profile) {
     canRefresh: source === "device" && !!tokens.refreshToken
   };
 }
-async function getValidToken(profile, signal) {
+async function getValidToken(profile, signal, options = {}) {
   const log = getLog();
   const envToken = process.env.WH_TOKEN;
   if (envToken) {
@@ -50460,7 +50509,10 @@ async function getValidToken(profile, signal) {
     const classification = err.error === "invalid_grant" ? "invalid_grant" : "terminal";
     const staleProf = getProfile(profileName, authPath);
     if (staleProf) {
-      saveProfileWhileLocked(profileName, { ...staleProf, tokens: { ...staleProf.tokens, refreshToken: "" } }, authPath);
+      saveProfileWhileLocked(profileName, withoutRefreshFailure({
+        ...staleProf,
+        tokens: { ...staleProf.tokens, refreshToken: "" }
+      }), authPath);
       log.error("auth.refresh_token.wiped", {
         profile: profileName,
         reason: classification
@@ -50472,6 +50524,16 @@ async function getValidToken(profile, signal) {
     }
     throw new CliError(5 /* Auth */, "AUTH", `Session could not be refreshed (${err.error}).${err.errorDescription ? ` ${err.errorDescription}` : ""}`, err, `Run ${loginCmd} to re-authenticate.`);
   };
+  const transientRefreshError = (cause) => new CliError(5 /* Auth */, "AUTH", "Token refresh failed (transient).", cause, `Check network connectivity, or run ${loginCmd} to re-authenticate.`);
+  const markTransientRefreshFailure = () => {
+    const failedProf = getProfile(profileName, authPath);
+    if (!failedProf)
+      return;
+    saveProfileWhileLocked(profileName, {
+      ...failedProf,
+      transientRefreshFailedAt: new Date().toISOString()
+    }, authPath);
+  };
   try {
     return await withAuthLock(authPath, async () => {
       const lockedProf = getProfile(profileName, authPath);
@@ -50486,14 +50548,20 @@ async function getValidToken(profile, signal) {
       if (!lockedTokens.refreshToken) {
         throw new CliError(5 /* Auth */, "AUTH", "Session expired.", undefined, `Run ${loginCmd} to re-authenticate.`);
       }
+      if (refreshCooldownActive(lockedProf.transientRefreshFailedAt)) {
+        log.info("auth.refresh.cooldown", { profile: profileName });
+        throw transientRefreshError();
+      }
+      const budgetSignal = AbortSignal.timeout(options.refreshBudgetMs ?? AUTH_REFRESH_BUDGET_MS);
+      const refreshSignal = signal ? AbortSignal.any([signal, budgetSignal]) : budgetSignal;
       const refreshStarted = Date.now();
       log.info("auth.refresh.start", {
         profile: profileName,
         client_id: lockedTokens.clientId
       });
       try {
-        const refreshed = await refreshAccessToken(lockedTokens, signal);
-        saveProfileWhileLocked(profileName, { ...lockedProf, tokens: refreshed }, authPath);
+        const refreshed = await refreshAccessToken(lockedTokens, refreshSignal);
+        saveProfileWhileLocked(profileName, withoutRefreshFailure({ ...lockedProf, tokens: refreshed }), authPath);
         log.info("auth.refresh.ok", {
           profile: profileName,
           duration_ms: Date.now() - refreshStarted,
@@ -50521,15 +50589,25 @@ async function getValidToken(profile, signal) {
           duration_ms: Date.now() - refreshStarted,
           error_name: err instanceof Error ? err.name : "Unknown"
         });
-        await delay2(1000, signal);
+        try {
+          await delay2(options.retryDelayMs ?? AUTH_REFRESH_RETRY_DELAY_MS, refreshSignal);
+        } catch (delayErr) {
+          if (signal?.aborted)
+            throw delayErr;
+          markTransientRefreshFailure();
+          throw transientRefreshError(delayErr);
+        }
         log.info("auth.refresh.retry", { profile: profileName, attempt: 2 });
         let retryStarted = Date.now();
         try {
           const retryProf = getProfile(profileName, authPath);
           const retryTokens = retryProf?.tokens ?? lockedTokens;
           retryStarted = Date.now();
-          const refreshed = await refreshAccessToken(retryTokens, signal);
-          saveProfileWhileLocked(profileName, { ...retryProf ?? lockedProf, tokens: refreshed }, authPath);
+          const refreshed = await refreshAccessToken(retryTokens, refreshSignal);
+          saveProfileWhileLocked(profileName, withoutRefreshFailure({
+            ...retryProf ?? lockedProf,
+            tokens: refreshed
+          }), authPath);
           log.info("auth.refresh.ok", {
             profile: profileName,
             duration_ms: Date.now() - retryStarted,
@@ -50554,7 +50632,8 @@ async function getValidToken(profile, signal) {
             failTerminalRefresh(retryErr);
           }
           log.info("auth.refresh.failed", fields);
-          throw new CliError(5 /* Auth */, "AUTH", "Token refresh failed (transient).", retryErr, `Check network connectivity, or run ${loginCmd} to re-authenticate.`);
+          markTransientRefreshFailure();
+          throw transientRefreshError(retryErr);
         }
       }
     });
@@ -50873,7 +50952,7 @@ function shouldGuardDomain(domainPath, canonicalVerb, args) {
 }
 async function probeCapabilities(ctx) {
   try {
-    return await ctx.client.diagnostics.capabilities();
+    return await (ctx.compatibilityClient ?? ctx.client).diagnostics.capabilities();
   } catch {
     return;
   }
@@ -50887,7 +50966,7 @@ async function checkCompatibility(ctx, domainPath, canonicalVerb, args) {
   }
   let capabilities;
   try {
-    const diagnostics = ctx.client.diagnostics;
+    const diagnostics = (ctx.compatibilityClient ?? ctx.client).diagnostics;
     if (typeof diagnostics.assertCompatible === "function") {
       await diagnostics.assertCompatible();
       if (clientFlags.length > 0)
@@ -50896,6 +50975,8 @@ async function checkCompatibility(ctx, domainPath, canonicalVerb, args) {
       capabilities = await diagnostics.capabilities();
     }
   } catch (err) {
+    if (err instanceof CliError && err.kind === "AUTH")
+      throw err;
     const message = err instanceof Error ? err.message : String(err);
     if (message.includes("Could not find") || message.includes("NOT_FOUND") || message.includes("is not a function")) {
       ctx.err("Backend does not support capabilities check (upgrade backend)");
@@ -55552,7 +55633,20 @@ Run \`wh auth login --profile ${explicitProfile}\` to create it.`);
     clientFlags,
     decorateResponses: decorate
   });
-  return { config: config2, profile: effectiveProfile, client, clientFlags, decorate };
+  const compatibilityClient = args.client ?? createUnauthenticatedClient(config2, {
+    functionLogs: args.functionLogs,
+    signal: args.signal,
+    clientFlags,
+    decorateResponses: decorate
+  });
+  return {
+    config: config2,
+    profile: effectiveProfile,
+    client,
+    compatibilityClient,
+    clientFlags,
+    decorate
+  };
 }
 
 // ../../packages/warmhub-cli/src/domains/auth-shared.ts
@@ -69712,9 +69806,17 @@ async function runPreparedCli(rawArgv, prepared, opts) {
       requestedMode: requestedFunctionLogs
     });
     const localOnlyCommand = isLocalOnlyInvocation(invocation);
-    const { config: config2, client, profile, clientFlags, decorate } = localOnlyCommand ? {
+    const {
+      config: config2,
+      client,
+      compatibilityClient,
+      profile,
+      clientFlags,
+      decorate
+    } = localOnlyCommand ? {
       config: loadConfig(),
       client: createLocalOnlyClient(),
+      compatibilityClient: undefined,
       profile: "default",
       clientFlags: [],
       decorate: true
@@ -69735,6 +69837,7 @@ async function runPreparedCli(rawArgv, prepared, opts) {
     const signal = abortController.signal;
     const commandContext = {
       client,
+      compatibilityClient,
       config: config2,
       invocation,
       profile,
@@ -69861,7 +69964,7 @@ function resolveLogLevel(flagLevel, env) {
 // package.json
 var package_default3 = {
   name: "@warmhub/cli",
-  version: "0.133.0",
+  version: "0.134.0",
   private: false,
   type: "module",
   description: "The wh CLI for WarmHub — create repos, commit and query data, and compound knowledge with your AI agents.",
@@ -70486,5 +70589,5 @@ process.exitCode = interceptedExitCode === undefined ? await runPreparedCli(laun
   version: package_default3.version
 }) : interceptedExitCode;
 
-//# debugId=AF530C2A20E5B7C564756E2164756E21
-//# warmhub-cli-build-info {"cliVersion":"0.133.0","sdkVersion":"0.131.0"}
+//# debugId=59E58BA2C90F5E3C64756E2164756E21
+//# warmhub-cli-build-info {"cliVersion":"0.134.0","sdkVersion":"0.132.0"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@warmhub/cli",
-  "version": "0.133.0",
+  "version": "0.134.0",
   "private": false,
   "type": "module",
   "description": "The wh CLI for WarmHub — create repos, commit and query data, and compound knowledge with your AI agents.",