@warmhub/cli 0.133.0 → 0.135.0

package/dist/wh.js

@@ -18010,6 +18010,154 @@ var DEFAULT_MAX_OPS_PER_STREAM = 1e6;
 var DEFAULT_STREAM_APPEND_CHUNK_SIZE = 1000;
 var MAX_STREAM_APPEND_OPERATION_COUNT = 1e4;
 var MAX_STREAMING_SUBMISSION_LINE_BYTES = 1024 * 1024;
+// ../../packages/rules/src/crockford-base32.ts
+var ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+var DECODE_TABLE = new Uint8Array(256).fill(255);
+for (let i = 0;i < ALPHABET.length; i++) {
+  const ch = ALPHABET.charCodeAt(i);
+  DECODE_TABLE[ch] = i;
+  if (ch >= 65)
+    DECODE_TABLE[ch + 32] = i;
+}
+function encodeBytes(data) {
+  const bitLen = data.length * 8;
+  const charCount = Math.ceil(bitLen / 5);
+  let out = "";
+  for (let i = 0;i < charCount; i++) {
+    const bitPos = i * 5;
+    const byteIdx = bitPos >> 3;
+    const bitOff = bitPos & 7;
+    const b1 = data[byteIdx] ?? 0;
+    let val;
+    if (bitOff <= 3) {
+      val = b1 >> 3 - bitOff & 31;
+    } else {
+      const b2 = data[byteIdx + 1] ?? 0;
+      val = (b1 << bitOff - 3 | b2 >> 11 - bitOff) & 31;
+    }
+    out += ALPHABET[val];
+  }
+  return out;
+}
+function decodeBytes(encoded) {
+  const byteLen = Math.floor(encoded.length * 5 / 8);
+  const bytes = new Uint8Array(byteLen);
+  let bitBuf = 0;
+  let bitsInBuf = 0;
+  let bytePos = 0;
+  for (let i = 0;i < encoded.length; i++) {
+    const ch = encoded.charCodeAt(i);
+    const val = DECODE_TABLE[ch];
+    if (val === undefined || val === 255)
+      return null;
+    bitBuf = bitBuf << 5 | val;
+    bitsInBuf += 5;
+    if (bitsInBuf >= 8) {
+      bitsInBuf -= 8;
+      if (bytePos < byteLen) {
+        bytes[bytePos++] = bitBuf >> bitsInBuf & 255;
+      }
+    }
+  }
+  return bytes;
+}
+
+// ../../packages/rules/src/durable-id.ts
+var THING_SCHEME = 1;
+var REPO_SCHEME = 2;
+var UUID_BYTES = 16;
+var CRC_BYTES = 4;
+function encodedLengthFor(payloadLen) {
+  return Math.ceil((1 + payloadLen + CRC_BYTES) * 8 / 5);
+}
+var CRC32C_TABLE = (() => {
+  const POLY = 2197175160;
+  const table = new Uint32Array(256);
+  for (let i = 0;i < 256; i++) {
+    let crc = i;
+    for (let j = 0;j < 8; j++) {
+      crc = crc & 1 ? crc >>> 1 ^ POLY : crc >>> 1;
+    }
+    table[i] = crc >>> 0;
+  }
+  return table;
+})();
+function crc32c(data) {
+  let crc = 4294967295;
+  for (const byte of data) {
+    crc = (crc >>> 8 ^ (CRC32C_TABLE[(crc ^ byte) & 255] ?? 0)) >>> 0;
+  }
+  return (crc ^ 4294967295) >>> 0;
+}
+function bytesToUuid(bytes, offset = 0) {
+  const hex = Array.from(bytes.slice(offset, offset + 16)).map((b) => b.toString(16).padStart(2, "0")).join("");
+  return [
+    hex.slice(0, 8),
+    hex.slice(8, 12),
+    hex.slice(12, 16),
+    hex.slice(16, 20),
+    hex.slice(20, 32)
+  ].join("-");
+}
+function unpackToken(scheme, token, payloadLen) {
+  const stripped = token.startsWith("wh:") ? token.slice(3) : token;
+  if (stripped.length !== encodedLengthFor(payloadLen))
+    return null;
+  const raw = decodeBytes(stripped);
+  if (!raw || raw.length !== 1 + payloadLen + CRC_BYTES)
+    return null;
+  if (raw[0] !== scheme)
+    return null;
+  const crcOffset = 1 + payloadLen;
+  const storedCrc = (raw[crcOffset] ?? 0) << 24 | (raw[crcOffset + 1] ?? 0) << 16 | (raw[crcOffset + 2] ?? 0) << 8 | (raw[crcOffset + 3] ?? 0);
+  const computedCrc = crc32c(raw.slice(0, crcOffset));
+  if (storedCrc >>> 0 !== computedCrc >>> 0)
+    return null;
+  if (encodeBytes(raw) !== stripped.toUpperCase())
+    return null;
+  return raw.slice(1, 1 + payloadLen);
+}
+function decodeDurableId(token) {
+  const payload = unpackToken(THING_SCHEME, token, UUID_BYTES * 2);
+  if (!payload)
+    return null;
+  return {
+    repoId: bytesToUuid(payload, 0),
+    thingId: bytesToUuid(payload, UUID_BYTES)
+  };
+}
+var VERSION_SELECTOR_RE = /^(?:v0*[1-9]\d*|[Hh][Ee][Aa][Dd]|[Aa][Ll][Ll])$/;
+function parseDurableReferenceToken(raw) {
+  const at = raw.lastIndexOf("@");
+  const selector = at >= 0 && VERSION_SELECTOR_RE.test(raw.slice(at + 1)) ? raw.slice(at + 1) : null;
+  const core = selector === null ? raw : raw.slice(0, at);
+  if (decodeDurableId(core) === null)
+    return null;
+  const stripped = core.startsWith("wh:") ? core.slice(3) : core;
+  return { durableId: stripped.toUpperCase(), selector };
+}
+function decodeRepoDurableId(token) {
+  const payload = unpackToken(REPO_SCHEME, token, UUID_BYTES);
+  if (!payload)
+    return null;
+  return { repoId: bytesToUuid(payload, 0) };
+}
+
+// ../../packages/rules/src/wref.ts
+function splitLocalPath(value) {
+  const slashIndex = value.indexOf("/");
+  if (slashIndex <= 0 || slashIndex === value.length - 1) {
+    return null;
+  }
+  return {
+    shapeName: value.slice(0, slashIndex),
+    bareName: value.slice(slashIndex + 1)
+  };
+}
+function withVersion(wref, version) {
+  return `${wref}@v${version}`;
+}
+
 // ../../packages/rules/src/commit-types.ts
 var COMMIT_OPERATIONS = [
   "add",
@@ -18032,11 +18180,9 @@ var READ_KIND_FILTERS = [
   LEGACY_COLLECTION_READ_KIND,
   LEGACY_ASSERTION_READ_KIND
 ];
-function splitLocalPath(name) {
-  const idx = name.indexOf("/");
-  if (idx === -1)
-    return null;
-  return { shapePrefix: name.slice(0, idx), bareName: name.slice(idx + 1) };
+function splitLocalPath2(name) {
+  const local = splitLocalPath(name);
+  return local ? { shapePrefix: local.shapeName, bareName: local.bareName } : null;
 }
 function inferOperationKind(op) {
   if (op.kind === "shape" || op.kind === "thing" || op.kind === "assertion" || op.kind === "collection") {
@@ -25802,6 +25948,8 @@ function validateManifestSemantics(manifest) {
   }
   return findings;
 }
+// ../../packages/rules/src/edge-authz.ts
+var MAX_ALLOWED_SHAPES_PER_LIST = 64;
 // ../../packages/rules/src/external-contract.ts
 var FORBIDDEN_EXTERNAL_FIELDS = new Set([
   "_id",
@@ -26118,6 +26266,16 @@ function illegalOpSequences(operations, errors, checkAddAdd, options) {
   }
 }
 
+// ../../packages/rules/src/reserved-roots.ts
+var RESERVED_THING_ROOT = "hub";
+var RESERVED_THING_ROOT_PREFIX = `${RESERVED_THING_ROOT}/`;
+function isReservedThingRoot(name) {
+  return name === RESERVED_THING_ROOT || name.startsWith(RESERVED_THING_ROOT_PREFIX);
+}
+function reservedThingRootMessage(name) {
+  return `Name "${name}" is under the reserved root "${RESERVED_THING_ROOT_PREFIX}"; only Shapes live there, as ${RESERVED_THING_ROOT_PREFIX}shapes/<Name>`;
+}
+
 // ../../packages/rules/src/preflight-operation.ts
 var collectionTypes = ["arc", "bond", "set", "list", "pair"];
 var canonicalCollectionTypes = ["arc", "bond", "pair", "set", "list"];
@@ -26133,6 +26291,7 @@ function parseCollectionOp(value) {
 function preflightOpDiagnostics(op, operationIndex) {
   const errors = [];
   errors.push(...builtinShapeGuard(op, operationIndex));
+  errors.push(...reservedRootGuard(op, operationIndex));
   errors.push(...contentNameGuard(op, operationIndex));
   errors.push(...plusSignGuard(op, operationIndex));
   errors.push(...validateCollectionAbouts(op, operationIndex));
@@ -26142,7 +26301,7 @@ function preflightOpDiagnostics(op, operationIndex) {
 function builtinShapeGuard(op, operationIndex) {
   const errors = [];
   const name = op.name;
-  const isShapeRename = op.operation === "rename" && (op.kind === "shape" || op.name !== undefined && !splitLocalPath(op.name));
+  const isShapeRename = op.operation === "rename" && (op.kind === "shape" || op.name !== undefined && !splitLocalPath2(op.name));
   const reservedSourcePassThrough = isShapeRename && name !== undefined && isRenameableSquattedShape(name) && op.newName !== undefined && !isReservedCollectionShape(op.newName) && !isBuiltinShape(op.newName);
   if (name && isRetiredCollectionShape(name) && !reservedSourcePassThrough) {
     errors.push({
@@ -26151,7 +26310,7 @@ function builtinShapeGuard(op, operationIndex) {
       message: `Shape "${name}" is a retired collection shape and cannot be written manually`
     });
   }
-  if (op.operation === "rename" && (op.kind === "shape" || op.name !== undefined && !splitLocalPath(op.name)) && op.newName && isRetiredCollectionShape(op.newName)) {
+  if (op.operation === "rename" && (op.kind === "shape" || op.name !== undefined && !splitLocalPath2(op.name)) && op.newName && isRetiredCollectionShape(op.newName)) {
     errors.push({
       code: "RESERVED_NAME",
       operationIndex,
@@ -26169,7 +26328,7 @@ function builtinShapeGuard(op, operationIndex) {
     }
   }
   if (name && op.operation !== "retract") {
-    const local = splitLocalPath(name);
+    const local = splitLocalPath2(name);
     if (local && isRetiredCollectionShape(local.shapePrefix)) {
       errors.push({
         code: "VALIDATION_ERROR",
@@ -26187,10 +26346,33 @@ function builtinShapeGuard(op, operationIndex) {
   }
   return errors;
 }
+function reservedRootRefusal(name, operationIndex) {
+  return {
+    code: "RESERVED_NAME",
+    operationIndex,
+    message: reservedThingRootMessage(name)
+  };
+}
+function reservedRootGuard(op, operationIndex) {
+  if (op.kind === "shape")
+    return [];
+  if (op.operation === "add" && op.name) {
+    const stored = op.kind === "collection" ? op.name : splitLocalPath2(op.name)?.bareName;
+    if (stored !== undefined && isReservedThingRoot(stored)) {
+      return [reservedRootRefusal(stored, operationIndex)];
+    }
+    return [];
+  }
+  const isShapeRename = op.name !== undefined && splitLocalPath2(op.name) === null;
+  if (op.operation === "rename" && !isShapeRename && op.newName !== undefined && isReservedThingRoot(op.newName)) {
+    return [reservedRootRefusal(op.newName, operationIndex)];
+  }
+  return [];
+}
 function contentNameGuard(op, operationIndex) {
   if (op.kind !== "thing" || !op.name)
     return [];
-  const local = splitLocalPath(op.name);
+  const local = splitLocalPath2(op.name);
   if (!local || !isContentShape(local.shapePrefix))
     return [];
   const bareName = local.bareName;
@@ -26236,7 +26418,7 @@ function plusSignGuard(op, operationIndex) {
     }
     if (op.kind === "collection")
       return errors;
-    const local = splitLocalPath(name);
+    const local = splitLocalPath2(name);
     if (local && isReservedCollectionShape(local.shapePrefix))
       return errors;
     errors.push({
@@ -43505,139 +43687,6 @@ function commitValidateRequestBodyBytes(input) {
   return new TextEncoder().encode(encodeCommitValidateRequestBody(input)).byteLength;
 }
 
-// ../../packages/rules/src/crockford-base32.ts
-var ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
-var DECODE_TABLE = new Uint8Array(256).fill(255);
-for (let i = 0;i < ALPHABET.length; i++) {
-  const ch = ALPHABET.charCodeAt(i);
-  DECODE_TABLE[ch] = i;
-  if (ch >= 65)
-    DECODE_TABLE[ch + 32] = i;
-}
-function encodeBytes(data) {
-  const bitLen = data.length * 8;
-  const charCount = Math.ceil(bitLen / 5);
-  let out = "";
-  for (let i = 0;i < charCount; i++) {
-    const bitPos = i * 5;
-    const byteIdx = bitPos >> 3;
-    const bitOff = bitPos & 7;
-    const b1 = data[byteIdx] ?? 0;
-    let val;
-    if (bitOff <= 3) {
-      val = b1 >> 3 - bitOff & 31;
-    } else {
-      const b2 = data[byteIdx + 1] ?? 0;
-      val = (b1 << bitOff - 3 | b2 >> 11 - bitOff) & 31;
-    }
-    out += ALPHABET[val];
-  }
-  return out;
-}
-function decodeBytes(encoded) {
-  const byteLen = Math.floor(encoded.length * 5 / 8);
-  const bytes = new Uint8Array(byteLen);
-  let bitBuf = 0;
-  let bitsInBuf = 0;
-  let bytePos = 0;
-  for (let i = 0;i < encoded.length; i++) {
-    const ch = encoded.charCodeAt(i);
-    const val = DECODE_TABLE[ch];
-    if (val === undefined || val === 255)
-      return null;
-    bitBuf = bitBuf << 5 | val;
-    bitsInBuf += 5;
-    if (bitsInBuf >= 8) {
-      bitsInBuf -= 8;
-      if (bytePos < byteLen) {
-        bytes[bytePos++] = bitBuf >> bitsInBuf & 255;
-      }
-    }
-  }
-  return bytes;
-}
-
-// ../../packages/rules/src/durable-id.ts
-var THING_SCHEME = 1;
-var REPO_SCHEME = 2;
-var UUID_BYTES = 16;
-var CRC_BYTES = 4;
-function encodedLengthFor(payloadLen) {
-  return Math.ceil((1 + payloadLen + CRC_BYTES) * 8 / 5);
-}
-var CRC32C_TABLE = (() => {
-  const POLY = 2197175160;
-  const table = new Uint32Array(256);
-  for (let i = 0;i < 256; i++) {
-    let crc = i;
-    for (let j = 0;j < 8; j++) {
-      crc = crc & 1 ? crc >>> 1 ^ POLY : crc >>> 1;
-    }
-    table[i] = crc >>> 0;
-  }
-  return table;
-})();
-function crc32c(data) {
-  let crc = 4294967295;
-  for (const byte of data) {
-    crc = (crc >>> 8 ^ (CRC32C_TABLE[(crc ^ byte) & 255] ?? 0)) >>> 0;
-  }
-  return (crc ^ 4294967295) >>> 0;
-}
-function bytesToUuid(bytes, offset = 0) {
-  const hex3 = Array.from(bytes.slice(offset, offset + 16)).map((b) => b.toString(16).padStart(2, "0")).join("");
-  return [
-    hex3.slice(0, 8),
-    hex3.slice(8, 12),
-    hex3.slice(12, 16),
-    hex3.slice(16, 20),
-    hex3.slice(20, 32)
-  ].join("-");
-}
-function unpackToken(scheme, token, payloadLen) {
-  const stripped = token.startsWith("wh:") ? token.slice(3) : token;
-  if (stripped.length !== encodedLengthFor(payloadLen))
-    return null;
-  const raw = decodeBytes(stripped);
-  if (!raw || raw.length !== 1 + payloadLen + CRC_BYTES)
-    return null;
-  if (raw[0] !== scheme)
-    return null;
-  const crcOffset = 1 + payloadLen;
-  const storedCrc = (raw[crcOffset] ?? 0) << 24 | (raw[crcOffset + 1] ?? 0) << 16 | (raw[crcOffset + 2] ?? 0) << 8 | (raw[crcOffset + 3] ?? 0);
-  const computedCrc = crc32c(raw.slice(0, crcOffset));
-  if (storedCrc >>> 0 !== computedCrc >>> 0)
-    return null;
-  if (encodeBytes(raw) !== stripped.toUpperCase())
-    return null;
-  return raw.slice(1, 1 + payloadLen);
-}
-function decodeDurableId(token) {
-  const payload = unpackToken(THING_SCHEME, token, UUID_BYTES * 2);
-  if (!payload)
-    return null;
-  return {
-    repoId: bytesToUuid(payload, 0),
-    thingId: bytesToUuid(payload, UUID_BYTES)
-  };
-}
-var VERSION_SELECTOR_RE = /^(?:v0*[1-9]\d*|[Hh][Ee][Aa][Dd]|[Aa][Ll][Ll])$/;
-function parseDurableReferenceToken(raw) {
-  const at = raw.lastIndexOf("@");
-  const selector = at >= 0 && VERSION_SELECTOR_RE.test(raw.slice(at + 1)) ? raw.slice(at + 1) : null;
-  const core2 = selector === null ? raw : raw.slice(0, at);
-  if (decodeDurableId(core2) === null)
-    return null;
-  const stripped = core2.startsWith("wh:") ? core2.slice(3) : core2;
-  return { durableId: stripped.toUpperCase(), selector };
-}
-function decodeRepoDurableId(token) {
-  const payload = unpackToken(REPO_SCHEME, token, UUID_BYTES);
-  if (!payload)
-    return null;
-  return { repoId: bytesToUuid(payload, 0) };
-}
-
 // ../../packages/rules/src/json-string-walk.ts
 function walkJsonStringLeaves(value, spec) {
   const { childContext, onStringValue, onObjectKey } = spec;
@@ -45429,7 +45478,7 @@ function createStreamingSubmissionHandle(input, deps) {
 // ../../packages/sdk-ts/package.json
 var package_default = {
   name: "@warmhub/sdk-ts",
-  version: "0.131.0",
+  version: "0.133.0",
   private: false,
   type: "module",
   description: "The TypeScript SDK for WarmHub — create repos, commit and query data, and compound knowledge with your AI agents.",
@@ -49791,10 +49840,10 @@ class WorkOsAuthError extends Error {
     this.status = status;
   }
 }
-async function refreshAccessToken(tokens, signal) {
+async function refreshAccessToken(tokens, signal, options = {}) {
   const log = getLog();
   const { clientId } = tokens;
-  const workosUrl = "https://api.workos.com";
+  const workosUrl = (options.workosUrl ?? "https://api.workos.com").replace(/\/$/, "");
   const path = "/user_management/authenticate";
   const requestId = `${process.pid}-${Date.now()}-${Math.floor(Math.random() * 1e6)}`;
   log.debug("http.request", {
@@ -49804,7 +49853,8 @@ async function refreshAccessToken(tokens, signal) {
     request_id: requestId
   });
   const startedAt = Date.now();
-  const requestSignal = signal ?? AbortSignal.timeout(WORKOS_REFRESH_TIMEOUT_MS);
+  const timeoutSignal = AbortSignal.timeout(options.requestTimeoutMs ?? WORKOS_REFRESH_TIMEOUT_MS);
+  const requestSignal = signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
   let res;
   try {
     res = await fetch(`${workosUrl}${path}`, {
@@ -50379,6 +50429,9 @@ function corruptedAuthError(path, cause) {
 }
 
 // ../../packages/warmhub-cli/src/auth.ts
+var AUTH_REFRESH_BUDGET_MS = 30000;
+var AUTH_REFRESH_RETRY_DELAY_MS = 1000;
+var TRANSIENT_REFRESH_COOLDOWN_MS = 5000;
 function isAuthLockError(error51, authPath) {
   return error51 instanceof Error && error51.code === "ELOCKED" && (error51.file === undefined || error51.file === authPath);
 }
@@ -50400,6 +50453,17 @@ function delay2(ms, signal) {
     signal?.addEventListener("abort", onAbort, { once: true });
   });
 }
+function refreshCooldownActive(failedAt) {
+  if (!failedAt)
+    return false;
+  const ageMs = Date.now() - new Date(failedAt).getTime();
+  return ageMs >= 0 && ageMs < TRANSIENT_REFRESH_COOLDOWN_MS;
+}
+function withoutRefreshFailure(profile) {
+  const next = { ...profile };
+  delete next.transientRefreshFailedAt;
+  return next;
+}
 function getTokenInfo(profile) {
   const envToken = process.env.WH_TOKEN;
   if (envToken) {
@@ -50428,7 +50492,7 @@ function getTokenInfo(profile) {
     canRefresh: source === "device" && !!tokens.refreshToken
   };
 }
-async function getValidToken(profile, signal) {
+async function getValidToken(profile, signal, options = {}) {
   const log = getLog();
   const envToken = process.env.WH_TOKEN;
   if (envToken) {
@@ -50460,7 +50524,10 @@ async function getValidToken(profile, signal) {
     const classification = err.error === "invalid_grant" ? "invalid_grant" : "terminal";
     const staleProf = getProfile(profileName, authPath);
     if (staleProf) {
-      saveProfileWhileLocked(profileName, { ...staleProf, tokens: { ...staleProf.tokens, refreshToken: "" } }, authPath);
+      saveProfileWhileLocked(profileName, withoutRefreshFailure({
+        ...staleProf,
+        tokens: { ...staleProf.tokens, refreshToken: "" }
+      }), authPath);
       log.error("auth.refresh_token.wiped", {
         profile: profileName,
         reason: classification
@@ -50472,6 +50539,16 @@ async function getValidToken(profile, signal) {
     }
     throw new CliError(5 /* Auth */, "AUTH", `Session could not be refreshed (${err.error}).${err.errorDescription ? ` ${err.errorDescription}` : ""}`, err, `Run ${loginCmd} to re-authenticate.`);
   };
+  const transientRefreshError = (cause) => new CliError(5 /* Auth */, "AUTH", "Token refresh failed (transient).", cause, `Check network connectivity, or run ${loginCmd} to re-authenticate.`);
+  const markTransientRefreshFailure = () => {
+    const failedProf = getProfile(profileName, authPath);
+    if (!failedProf)
+      return;
+    saveProfileWhileLocked(profileName, {
+      ...failedProf,
+      transientRefreshFailedAt: new Date().toISOString()
+    }, authPath);
+  };
   try {
     return await withAuthLock(authPath, async () => {
       const lockedProf = getProfile(profileName, authPath);
@@ -50486,14 +50563,20 @@ async function getValidToken(profile, signal) {
       if (!lockedTokens.refreshToken) {
         throw new CliError(5 /* Auth */, "AUTH", "Session expired.", undefined, `Run ${loginCmd} to re-authenticate.`);
       }
+      if (refreshCooldownActive(lockedProf.transientRefreshFailedAt)) {
+        log.info("auth.refresh.cooldown", { profile: profileName });
+        throw transientRefreshError();
+      }
+      const budgetSignal = AbortSignal.timeout(options.refreshBudgetMs ?? AUTH_REFRESH_BUDGET_MS);
+      const refreshSignal = signal ? AbortSignal.any([signal, budgetSignal]) : budgetSignal;
       const refreshStarted = Date.now();
       log.info("auth.refresh.start", {
         profile: profileName,
         client_id: lockedTokens.clientId
       });
       try {
-        const refreshed = await refreshAccessToken(lockedTokens, signal);
-        saveProfileWhileLocked(profileName, { ...lockedProf, tokens: refreshed }, authPath);
+        const refreshed = await refreshAccessToken(lockedTokens, refreshSignal);
+        saveProfileWhileLocked(profileName, withoutRefreshFailure({ ...lockedProf, tokens: refreshed }), authPath);
         log.info("auth.refresh.ok", {
           profile: profileName,
           duration_ms: Date.now() - refreshStarted,
@@ -50521,15 +50604,25 @@ async function getValidToken(profile, signal) {
           duration_ms: Date.now() - refreshStarted,
           error_name: err instanceof Error ? err.name : "Unknown"
         });
-        await delay2(1000, signal);
+        try {
+          await delay2(options.retryDelayMs ?? AUTH_REFRESH_RETRY_DELAY_MS, refreshSignal);
+        } catch (delayErr) {
+          if (signal?.aborted)
+            throw delayErr;
+          markTransientRefreshFailure();
+          throw transientRefreshError(delayErr);
+        }
         log.info("auth.refresh.retry", { profile: profileName, attempt: 2 });
         let retryStarted = Date.now();
         try {
           const retryProf = getProfile(profileName, authPath);
           const retryTokens = retryProf?.tokens ?? lockedTokens;
           retryStarted = Date.now();
-          const refreshed = await refreshAccessToken(retryTokens, signal);
-          saveProfileWhileLocked(profileName, { ...retryProf ?? lockedProf, tokens: refreshed }, authPath);
+          const refreshed = await refreshAccessToken(retryTokens, refreshSignal);
+          saveProfileWhileLocked(profileName, withoutRefreshFailure({
+            ...retryProf ?? lockedProf,
+            tokens: refreshed
+          }), authPath);
           log.info("auth.refresh.ok", {
             profile: profileName,
             duration_ms: Date.now() - retryStarted,
@@ -50554,7 +50647,8 @@ async function getValidToken(profile, signal) {
             failTerminalRefresh(retryErr);
           }
           log.info("auth.refresh.failed", fields);
-          throw new CliError(5 /* Auth */, "AUTH", "Token refresh failed (transient).", retryErr, `Check network connectivity, or run ${loginCmd} to re-authenticate.`);
+          markTransientRefreshFailure();
+          throw transientRefreshError(retryErr);
         }
       }
     });
@@ -50873,7 +50967,7 @@ function shouldGuardDomain(domainPath, canonicalVerb, args) {
 }
 async function probeCapabilities(ctx) {
   try {
-    return await ctx.client.diagnostics.capabilities();
+    return await (ctx.compatibilityClient ?? ctx.client).diagnostics.capabilities();
   } catch {
     return;
   }
@@ -50887,7 +50981,7 @@ async function checkCompatibility(ctx, domainPath, canonicalVerb, args) {
   }
   let capabilities;
   try {
-    const diagnostics = ctx.client.diagnostics;
+    const diagnostics = (ctx.compatibilityClient ?? ctx.client).diagnostics;
     if (typeof diagnostics.assertCompatible === "function") {
       await diagnostics.assertCompatible();
       if (clientFlags.length > 0)
@@ -50896,6 +50990,8 @@ async function checkCompatibility(ctx, domainPath, canonicalVerb, args) {
       capabilities = await diagnostics.capabilities();
     }
   } catch (err) {
+    if (err instanceof CliError && err.kind === "AUTH")
+      throw err;
     const message = err instanceof Error ? err.message : String(err);
     if (message.includes("Could not find") || message.includes("NOT_FOUND") || message.includes("is not a function")) {
       ctx.err("Backend does not support capabilities check (upgrade backend)");
@@ -52245,7 +52341,7 @@ function pinnedWref(c, wref, version2) {
     return `${c.cyan}${escapeTerminalTextForDisplay(wref)}${c.reset}`;
   }
   const base = wref.replace(/@v\d+$/, "");
-  return `${c.cyan}${escapeTerminalTextForDisplay(base)}@v${version2}${c.reset}`;
+  return `${c.cyan}${withVersion(escapeTerminalTextForDisplay(base), version2)}${c.reset}`;
 }
 function kindLabel(c, kind) {
   return `${c.dim}${kind}${c.reset}`;
@@ -52256,16 +52352,21 @@ function asCollectionSummaries(value) {
   const entries = value.filter((entry) => typeof entry === "object" && entry !== null && typeof entry.shape === "string");
   return entries.length > 0 ? entries : undefined;
 }
-function bareShapeName(token) {
+function bareShapeName2(token) {
   const withoutVersion = token.split("@", 1)[0] ?? "";
   return withoutVersion.slice(withoutVersion.lastIndexOf("/") + 1);
 }
-function effectiveKind(kind, shapeName, collections) {
+function effectiveKind(kind, collections) {
   if (kind !== "thing" && kind)
     return kind;
   const summaryShape = collections?.[0]?.shape;
   if (summaryShape)
-    return bareShapeName(summaryShape).toLowerCase();
+    return bareShapeName2(summaryShape).toLowerCase();
+  return kind;
+}
+function kindWithoutCertificate(kind, shapeName) {
+  if (kind !== "thing" && kind)
+    return kind;
   if (shapeName && isBuiltinCollectionShape(shapeName)) {
     return shapeName.toLowerCase();
   }
@@ -53177,9 +53278,6 @@ var handleCreate2 = async (ctx, { flags, args }) => {
 };
 
 // ../../packages/warmhub-cli/src/domains/thing/render.ts
-function singularShapeName(result) {
-  return result.shapeName ?? result.shape;
-}
 function renderHead(out, c, chars, result, org, repo, shape, kind) {
   const items = result.items ?? [];
   const decorations = getResponseDecorations(result);
@@ -53191,8 +53289,7 @@ function renderHead(out, c, chars, result, org, repo, shape, kind) {
   out(`${c.dim}${chars.hLine.repeat(60)}${c.reset}`);
   for (const item of items) {
     const wref = pinnedWref(c, item.wref ?? item.name ?? "(unknown)", item.version);
-    const shapeName = item.shapeName;
-    const kl = kindLabel(c, effectiveKind(item.kind ?? "thing", shapeName, asCollectionSummaries(item.collections)));
+    const kl = kindLabel(c, effectiveKind(item.kind ?? "thing", asCollectionSummaries(item.collections)));
     const retractedTag = item.active === false ? `  ${c.red}[RETRACTED]${c.reset}` : "";
     out(`  ${wref}  ${kl}${retractedTag}`);
     if (item.declaredShapes?.length) {
@@ -53220,8 +53317,7 @@ function renderHead(out, c, chars, result, org, repo, shape, kind) {
 function renderThing(out, c, result) {
   const decorations = getResponseDecorations(result);
   const wref = result.wref ?? result.name ?? "(unknown)";
-  const shapeName = singularShapeName(result);
-  const displayKind = effectiveKind(result.kind ?? "thing", shapeName, result.collections);
+  const displayKind = effectiveKind(result.kind ?? "thing", result.collections);
   const retractedTag = result.active === false ? `  ${c.red}[RETRACTED]${c.reset}` : "";
   out(`${pinnedWref(c, wref, result.version)}  ${kindLabel(c, displayKind)}${retractedTag}`);
   out(`  ${c.dim}wref:${c.reset}      ${escapeTerminalTextForDisplay(wref)}`);
@@ -53301,8 +53397,7 @@ function renderGraphValue(out, c, value, indent, decorations) {
 }
 function renderGraphNode(out, c, result, indent = "", decorations) {
   const wref = result.wref ?? result.name ?? "(unknown)";
-  const shapeName = singularShapeName(result);
-  const displayKind = effectiveKind(result.kind ?? "thing", shapeName, result.collections);
+  const displayKind = effectiveKind(result.kind ?? "thing", result.collections);
   out(`${indent}${pinnedWref(c, wref, result.version)}  ${kindLabel(c, displayKind)}`);
   if (result.about) {
     out(`${indent}  ${c.dim}about:${c.reset}`);
@@ -53342,7 +53437,9 @@ function renderHistory(out, c, result) {
   const decorations = getResponseDecorations(result);
   if (result.thing && typeof result.thing === "object") {
     const wref = result.thing.wref ?? result.thing.name ?? "(unknown)";
-    out(`${c.bold}History: ${pinnedWref(c, wref)}${c.reset}  ${kindLabel(c, effectiveKind(result.thing.kind ?? "thing", result.thing.shapeName))}`);
+    const newest = (result.versions ?? []).reduce((best, v) => !best || v.version > best.version ? v : best, undefined);
+    const kind = effectiveKind(result.thing.kind ?? "thing", asCollectionSummaries(newest?.collections));
+    out(`${c.bold}History: ${pinnedWref(c, wref)}${c.reset}  ${kindLabel(c, kind)}`);
   }
   const firstMeta = result.versions?.[0]?.metadata;
   if (firstMeta?.durableId) {
@@ -53393,7 +53490,7 @@ function renderRefs(out, c, result, wref, direction) {
   out(`${c.dim}${"─".repeat(60)}${c.reset}`);
   for (const item of items) {
     const refWref = refDisplay(c, item.wref, decorations, item.version);
-    const kl = kindLabel(c, effectiveKind(item.kind ?? "thing", item.shapeName));
+    const kl = kindLabel(c, kindWithoutCertificate(item.kind ?? "thing", item.shapeName));
     const field = `${c.dim}via ${c.reset}${escapeTerminalTextForDisplay(item.fieldPath ?? "(unknown)")}`;
     const binding = item.binding ? `  ${c.dim}${item.binding}${c.reset}` : "";
     out(`  ${refWref}  ${kl}  ${field}${binding}`);
@@ -53405,7 +53502,7 @@ function* walkBatchResult(wrefs, result, flagsVersion) {
   let missIdx = 0;
   for (const requested of wrefs) {
     const nextMiss = result.missing[missIdx];
-    const qualified = flagsVersion !== undefined && !/@v\d+$/.test(requested) ? `${requested}@v${flagsVersion}` : requested;
+    const qualified = flagsVersion !== undefined && !/@v\d+$/.test(requested) ? withVersion(requested, flagsVersion) : requested;
     if (nextMiss !== undefined && (nextMiss === requested || nextMiss === qualified)) {
       yield { kind: "miss", requested, missWref: nextMiss };
       missIdx++;
@@ -53432,9 +53529,9 @@ function renderBatchView(out, c, result, wrefs, flagsVersion) {
     const requestedBase = requested.replace(/@.+$/, "");
     const fallback = item.wref ?? `${item.shapeName ?? "?"}/${item.name ?? "(unknown)"}`;
     const base = requestedBase.length > 0 ? requestedBase : fallback.replace(/@v\d+$/, "");
-    const kl = kindLabel(c, effectiveKind(item.kind ?? "thing", item.shapeName, asCollectionSummaries(item.collections)));
+    const kl = kindLabel(c, effectiveKind(item.kind ?? "thing", asCollectionSummaries(item.collections)));
     const retractedTag = item.active === false ? `  ${c.red}[RETRACTED]${c.reset}` : "";
-    const display = labeledRef(c, `${base}@v${item.version}`, fallback) ?? `${escapeTerminalTextForDisplay(base)}@v${item.version}`;
+    const display = labeledRef(c, withVersion(base, item.version), fallback) ?? withVersion(escapeTerminalTextForDisplay(base), item.version);
     out(`  ${display}  ${kl}${retractedTag}`);
   }
   if (result.missing.length > 0) {
@@ -54183,8 +54280,7 @@ function renderQueryResults(out, c, result) {
   }
   for (const item of items) {
     const wref = pinnedWref(c, item.wref ?? item.name ?? "(unknown)", item.version);
-    const shapeName = item.shapeName;
-    const kl = kindLabel(c, effectiveKind(item.kind ?? "thing", shapeName, asCollectionSummaries(item.collections)));
+    const kl = kindLabel(c, effectiveKind(item.kind ?? "thing", asCollectionSummaries(item.collections)));
     const retractedTag = item.active === false ? `  ${c.red}[RETRACTED]${c.reset}` : "";
     out(`  ${wref}  ${kl}${retractedTag}`);
     if (item.declaredShapes?.length) {
@@ -55552,7 +55648,143 @@ Run \`wh auth login --profile ${explicitProfile}\` to create it.`);
     clientFlags,
     decorateResponses: decorate
   });
-  return { config: config2, profile: effectiveProfile, client, clientFlags, decorate };
+  const compatibilityClient = args.client ?? createUnauthenticatedClient(config2, {
+    functionLogs: args.functionLogs,
+    signal: args.signal,
+    clientFlags,
+    decorateResponses: decorate
+  });
+  return {
+    config: config2,
+    profile: effectiveProfile,
+    client,
+    compatibilityClient,
+    clientFlags,
+    decorate
+  };
+}
+
+// ../../packages/warmhub-cli/src/scope-parse.ts
+var ENTRY_KEYS = new Set([
+  "resource",
+  "permissions",
+  "allowedMatches",
+  "allowedShapes"
+]);
+var SHAPE_LIST_KEYS = ["shapes", "shapesAll", "shapesNot"];
+var SHAPE_CLAUSE_KEYS = new Set([...SHAPE_LIST_KEYS, "shapeless"]);
+function shapeClauseExample(allowResource) {
+  const resource = allowResource ? '"resource":"myorg/myrepo",' : "";
+  return `[{${resource}"permissions":["repo:read"],"allowedMatches":["**"],"allowedShapes":{"shapes":["Player"],"shapesNot":["Secret"]}}]`;
+}
+function parseScopeEntriesJson(json2, opts) {
+  const { flagLabel, allowResource } = opts;
+  let parsed;
+  try {
+    parsed = JSON.parse(json2);
+  } catch {
+    throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} must be valid JSON`);
+  }
+  if (!Array.isArray(parsed) || parsed.length === 0) {
+    throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} must be a non-empty JSON array`);
+  }
+  return parsed.map((entry, i) => {
+    if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
+      throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} entry ${i + 1}: must be an object`);
+    }
+    const obj = entry;
+    const unknownKey = Object.keys(obj).find((key) => !ENTRY_KEYS.has(key));
+    if (unknownKey !== undefined) {
+      throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} entry ${i + 1}: unknown key "${unknownKey}"`, undefined, `Entry keys are resource, permissions, allowedMatches, allowedShapes. Example: ${flagLabel} '${shapeClauseExample(allowResource)}'`);
+    }
+    if (!Array.isArray(obj.permissions) || obj.permissions.length === 0 || obj.permissions.some((p) => typeof p !== "string" || p.trim().length === 0)) {
+      throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} entry ${i + 1}: "permissions" must be a non-empty array of non-empty strings`);
+    }
+    if (obj.resource !== undefined) {
+      if (!allowResource) {
+        throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} entry ${i + 1}: "resource" is not supported (resource is set automatically)`);
+      }
+      if (typeof obj.resource !== "string") {
+        throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} entry ${i + 1}: "resource" must be a string`);
+      }
+    }
+    if (obj.allowedMatches !== undefined) {
+      if (!Array.isArray(obj.allowedMatches) || obj.allowedMatches.some((m) => typeof m !== "string" || m.trim().length === 0)) {
+        throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} entry ${i + 1}: "allowedMatches" must be an array of non-empty strings`);
+      }
+    }
+    const allowedShapes = obj.allowedShapes === undefined ? undefined : parseAllowedShapes(obj.allowedShapes, flagLabel, i + 1, allowResource);
+    if (allowResource && (obj.allowedMatches !== undefined || allowedShapes !== undefined) && (typeof obj.resource !== "string" || !obj.resource.includes("/"))) {
+      const fields = [
+        obj.allowedMatches !== undefined && '"allowedMatches"',
+        allowedShapes !== undefined && '"allowedShapes"'
+      ].filter(Boolean).join(" and ");
+      throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} entry ${i + 1}: ${fields} would restrict nothing on ${typeof obj.resource === "string" ? `the org entry "${obj.resource}"` : "an entry without a resource"}; name and Shape restrictions apply only to a repository entry`, undefined, `Name the repository. Example: ${flagLabel} '${shapeClauseExample(allowResource)}'`);
+    }
+    const result = {
+      permissions: obj.permissions.map((p) => p.trim())
+    };
+    if (obj.resource !== undefined)
+      result.resource = obj.resource;
+    if (obj.allowedMatches !== undefined)
+      result.allowedMatches = obj.allowedMatches.map((m) => m.trim());
+    if (allowedShapes !== undefined)
+      result.allowedShapes = allowedShapes;
+    return result;
+  });
+}
+function parseAllowedShapes(value, flagLabel, entry, allowResource) {
+  const refuse = (message) => {
+    throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} entry ${entry}: "allowedShapes" ${message}`, undefined, `Keys are shapes, shapesAll, shapesNot (1-${MAX_ALLOWED_SHAPES_PER_LIST} Shape names each) and shapeless (boolean). Example: ${flagLabel} '${shapeClauseExample(allowResource)}'`);
+  };
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    refuse("must be an object");
+  }
+  const obj = value;
+  const unknownKey = Object.keys(obj).find((key) => !SHAPE_CLAUSE_KEYS.has(key));
+  if (unknownKey !== undefined)
+    refuse(`has unknown key "${unknownKey}"`);
+  const clause = {};
+  for (const key of SHAPE_LIST_KEYS) {
+    const list = obj[key];
+    if (list === undefined)
+      continue;
+    if (!Array.isArray(list) || list.length === 0 || list.some((n) => typeof n !== "string" || n.trim().length === 0)) {
+      refuse(`"${key}" must be a non-empty array of non-empty Shape names`);
+    }
+    const names = list;
+    if (names.length > MAX_ALLOWED_SHAPES_PER_LIST) {
+      refuse(`"${key}" names ${names.length} Shapes; the limit is ${MAX_ALLOWED_SHAPES_PER_LIST}`);
+    }
+    clause[key] = names.map((n) => n.trim());
+  }
+  if (obj.shapeless !== undefined) {
+    if (typeof obj.shapeless !== "boolean")
+      refuse('"shapeless" must be a boolean');
+    clause.shapeless = obj.shapeless;
+  }
+  return clause;
+}
+function formatAllowedShapes(allowedShapes) {
+  if (allowedShapes === undefined)
+    return "";
+  const parts = [];
+  for (const key of SHAPE_LIST_KEYS) {
+    const list = allowedShapes[key];
+    if (list !== undefined) {
+      parts.push(`${key}: ${list.length > 0 ? list.join(", ") : "[none]"}`);
+    }
+  }
+  if (allowedShapes.shapeless !== undefined)
+    parts.push(allowedShapes.shapeless ? "shapeless" : "no shapeless");
+  return parts.map((part) => `  ${part}`).join("");
+}
+function formatAllowedMatches(allowedMatches) {
+  if (allowedMatches === undefined)
+    return "";
+  if (allowedMatches.length === 0)
+    return "  match: [deny-all]";
+  return `  match: ${allowedMatches.join(", ")}`;
 }
 
 // ../../packages/warmhub-cli/src/domains/auth-shared.ts
@@ -61723,10 +61955,11 @@ async function collectChecks(ctx) {
         if (whoami.scopes && whoami.scopes.length > 0) {
           const scopeParts = whoami.scopes.map((s) => {
             const perms = s.permissions.join(", ");
+            const shapes = formatAllowedShapes(s.allowedShapes);
             if (s.redactedResource) {
-              return `${perms} on redacted/inaccessible repo`;
+              return `${perms} on redacted/inaccessible repo${shapes}`;
             }
-            return s.resource ? `${perms} on ${s.resource}` : perms;
+            return `${s.resource ? `${perms} on ${s.resource}` : perms}${shapes}`;
           });
           detailLines.push(`Scopes: ${scopeParts.join(", ")}`);
         }
@@ -67179,57 +67412,6 @@ var SUB_DOMAIN = defineDomain({
     }
   }
 });
-// ../../packages/warmhub-cli/src/scope-parse.ts
-function parseScopeEntriesJson(json2, opts) {
-  const { flagLabel, allowResource } = opts;
-  let parsed;
-  try {
-    parsed = JSON.parse(json2);
-  } catch {
-    throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} must be valid JSON`);
-  }
-  if (!Array.isArray(parsed) || parsed.length === 0) {
-    throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} must be a non-empty JSON array`);
-  }
-  return parsed.map((entry, i) => {
-    if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
-      throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} entry ${i + 1}: must be an object`);
-    }
-    const obj = entry;
-    if (!Array.isArray(obj.permissions) || obj.permissions.length === 0 || obj.permissions.some((p) => typeof p !== "string" || p.trim().length === 0)) {
-      throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} entry ${i + 1}: "permissions" must be a non-empty array of non-empty strings`);
-    }
-    if (obj.resource !== undefined) {
-      if (!allowResource) {
-        throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} entry ${i + 1}: "resource" is not supported (resource is set automatically)`);
-      }
-      if (typeof obj.resource !== "string") {
-        throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} entry ${i + 1}: "resource" must be a string`);
-      }
-    }
-    if (obj.allowedMatches !== undefined) {
-      if (!Array.isArray(obj.allowedMatches) || obj.allowedMatches.some((m) => typeof m !== "string" || m.trim().length === 0)) {
-        throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} entry ${i + 1}: "allowedMatches" must be an array of non-empty strings`);
-      }
-    }
-    const result = {
-      permissions: obj.permissions.map((p) => p.trim())
-    };
-    if (obj.resource !== undefined)
-      result.resource = obj.resource;
-    if (obj.allowedMatches !== undefined)
-      result.allowedMatches = obj.allowedMatches.map((m) => m.trim());
-    return result;
-  });
-}
-function formatAllowedMatches(allowedMatches) {
-  if (allowedMatches === undefined)
-    return "";
-  if (allowedMatches.length === 0)
-    return "  match: [deny-all]";
-  return `  match: ${allowedMatches.join(", ")}`;
-}
-
 // ../../packages/warmhub-cli/src/domains/token.ts
 var DURATION_MULTIPLIERS = {
   h: 3600000,
@@ -67262,7 +67444,7 @@ var createFlags10 = {
     multiple: true
   }),
   "scopes-json": flag.string({
-    description: "Structured scope entries as JSON array (advanced; use for allowedMatches or repeated resource entries; mutually exclusive with --scope)"
+    description: "Structured scope entries as JSON array (advanced; use for allowedMatches, allowedShapes, or repeated resource entries; mutually exclusive with --scope)"
   }),
   description: flag.string({ short: "d", description: "Token description" }),
   expires: flag.string({
@@ -67307,10 +67489,10 @@ function formatScopes(scopes) {
     return "full access";
   return scopes.map((e) => {
     if (e.redactedResource) {
-      return `redacted/inaccessible repo=${e.permissions.join(",")}${formatAllowedMatches(e.allowedMatches)}`;
+      return `redacted/inaccessible repo=${e.permissions.join(",")}${formatAllowedMatches(e.allowedMatches)}${formatAllowedShapes(e.allowedShapes)}`;
     }
     const base = e.resource ? `${e.resource}=${e.permissions.join(",")}` : e.permissions.join(",");
-    return `${base}${formatAllowedMatches(e.allowedMatches)}`;
+    return `${base}${formatAllowedMatches(e.allowedMatches)}${formatAllowedShapes(e.allowedShapes)}`;
   }).join(" ");
 }
 var handleCreate9 = async (ctx, { flags }) => {
@@ -68177,7 +68359,7 @@ var handleEvaluate = async (ctx, { args, flags }) => {
     nextCursor: result.nextCursor ?? null,
     decorations: getResponseDecorations(result)
   }, () => {
-    const selected = `${result.view.wref}@v${result.view.version}`;
+    const selected = withVersion(result.view.wref, result.view.version);
     ctx.out(`${ctx.colors.bold}View ${escapeTerminalTextForDisplay(selected)}${ctx.colors.reset}`);
     renderQueryResults(ctx.out, ctx.colors, result);
   });
@@ -69712,9 +69894,17 @@ async function runPreparedCli(rawArgv, prepared, opts) {
       requestedMode: requestedFunctionLogs
     });
     const localOnlyCommand = isLocalOnlyInvocation(invocation);
-    const { config: config2, client, profile, clientFlags, decorate } = localOnlyCommand ? {
+    const {
+      config: config2,
+      client,
+      compatibilityClient,
+      profile,
+      clientFlags,
+      decorate
+    } = localOnlyCommand ? {
       config: loadConfig(),
       client: createLocalOnlyClient(),
+      compatibilityClient: undefined,
       profile: "default",
       clientFlags: [],
       decorate: true
@@ -69735,6 +69925,7 @@ async function runPreparedCli(rawArgv, prepared, opts) {
     const signal = abortController.signal;
     const commandContext = {
       client,
+      compatibilityClient,
       config: config2,
       invocation,
       profile,
@@ -69861,7 +70052,7 @@ function resolveLogLevel(flagLevel, env) {
 // package.json
 var package_default3 = {
   name: "@warmhub/cli",
-  version: "0.133.0",
+  version: "0.135.0",
   private: false,
   type: "module",
   description: "The wh CLI for WarmHub — create repos, commit and query data, and compound knowledge with your AI agents.",
@@ -70486,5 +70677,5 @@ process.exitCode = interceptedExitCode === undefined ? await runPreparedCli(laun
   version: package_default3.version
 }) : interceptedExitCode;
 
-//# debugId=AF530C2A20E5B7C564756E2164756E21
-//# warmhub-cli-build-info {"cliVersion":"0.133.0","sdkVersion":"0.131.0"}
+//# debugId=BE49CDDCED2454CC64756E2164756E21
+//# warmhub-cli-build-info {"cliVersion":"0.135.0","sdkVersion":"0.133.0"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@warmhub/cli",
-  "version": "0.133.0",
+  "version": "0.135.0",
   "private": false,
   "type": "module",
   "description": "The wh CLI for WarmHub — create repos, commit and query data, and compound knowledge with your AI agents.",