@warmhub/cli 0.134.0 → 0.135.0

package/dist/wh.js

@@ -18010,6 +18010,154 @@ var DEFAULT_MAX_OPS_PER_STREAM = 1e6;
 var DEFAULT_STREAM_APPEND_CHUNK_SIZE = 1000;
 var MAX_STREAM_APPEND_OPERATION_COUNT = 1e4;
 var MAX_STREAMING_SUBMISSION_LINE_BYTES = 1024 * 1024;
+// ../../packages/rules/src/crockford-base32.ts
+var ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+var DECODE_TABLE = new Uint8Array(256).fill(255);
+for (let i = 0;i < ALPHABET.length; i++) {
+  const ch = ALPHABET.charCodeAt(i);
+  DECODE_TABLE[ch] = i;
+  if (ch >= 65)
+    DECODE_TABLE[ch + 32] = i;
+}
+function encodeBytes(data) {
+  const bitLen = data.length * 8;
+  const charCount = Math.ceil(bitLen / 5);
+  let out = "";
+  for (let i = 0;i < charCount; i++) {
+    const bitPos = i * 5;
+    const byteIdx = bitPos >> 3;
+    const bitOff = bitPos & 7;
+    const b1 = data[byteIdx] ?? 0;
+    let val;
+    if (bitOff <= 3) {
+      val = b1 >> 3 - bitOff & 31;
+    } else {
+      const b2 = data[byteIdx + 1] ?? 0;
+      val = (b1 << bitOff - 3 | b2 >> 11 - bitOff) & 31;
+    }
+    out += ALPHABET[val];
+  }
+  return out;
+}
+function decodeBytes(encoded) {
+  const byteLen = Math.floor(encoded.length * 5 / 8);
+  const bytes = new Uint8Array(byteLen);
+  let bitBuf = 0;
+  let bitsInBuf = 0;
+  let bytePos = 0;
+  for (let i = 0;i < encoded.length; i++) {
+    const ch = encoded.charCodeAt(i);
+    const val = DECODE_TABLE[ch];
+    if (val === undefined || val === 255)
+      return null;
+    bitBuf = bitBuf << 5 | val;
+    bitsInBuf += 5;
+    if (bitsInBuf >= 8) {
+      bitsInBuf -= 8;
+      if (bytePos < byteLen) {
+        bytes[bytePos++] = bitBuf >> bitsInBuf & 255;
+      }
+    }
+  }
+  return bytes;
+}
+
+// ../../packages/rules/src/durable-id.ts
+var THING_SCHEME = 1;
+var REPO_SCHEME = 2;
+var UUID_BYTES = 16;
+var CRC_BYTES = 4;
+function encodedLengthFor(payloadLen) {
+  return Math.ceil((1 + payloadLen + CRC_BYTES) * 8 / 5);
+}
+var CRC32C_TABLE = (() => {
+  const POLY = 2197175160;
+  const table = new Uint32Array(256);
+  for (let i = 0;i < 256; i++) {
+    let crc = i;
+    for (let j = 0;j < 8; j++) {
+      crc = crc & 1 ? crc >>> 1 ^ POLY : crc >>> 1;
+    }
+    table[i] = crc >>> 0;
+  }
+  return table;
+})();
+function crc32c(data) {
+  let crc = 4294967295;
+  for (const byte of data) {
+    crc = (crc >>> 8 ^ (CRC32C_TABLE[(crc ^ byte) & 255] ?? 0)) >>> 0;
+  }
+  return (crc ^ 4294967295) >>> 0;
+}
+function bytesToUuid(bytes, offset = 0) {
+  const hex = Array.from(bytes.slice(offset, offset + 16)).map((b) => b.toString(16).padStart(2, "0")).join("");
+  return [
+    hex.slice(0, 8),
+    hex.slice(8, 12),
+    hex.slice(12, 16),
+    hex.slice(16, 20),
+    hex.slice(20, 32)
+  ].join("-");
+}
+function unpackToken(scheme, token, payloadLen) {
+  const stripped = token.startsWith("wh:") ? token.slice(3) : token;
+  if (stripped.length !== encodedLengthFor(payloadLen))
+    return null;
+  const raw = decodeBytes(stripped);
+  if (!raw || raw.length !== 1 + payloadLen + CRC_BYTES)
+    return null;
+  if (raw[0] !== scheme)
+    return null;
+  const crcOffset = 1 + payloadLen;
+  const storedCrc = (raw[crcOffset] ?? 0) << 24 | (raw[crcOffset + 1] ?? 0) << 16 | (raw[crcOffset + 2] ?? 0) << 8 | (raw[crcOffset + 3] ?? 0);
+  const computedCrc = crc32c(raw.slice(0, crcOffset));
+  if (storedCrc >>> 0 !== computedCrc >>> 0)
+    return null;
+  if (encodeBytes(raw) !== stripped.toUpperCase())
+    return null;
+  return raw.slice(1, 1 + payloadLen);
+}
+function decodeDurableId(token) {
+  const payload = unpackToken(THING_SCHEME, token, UUID_BYTES * 2);
+  if (!payload)
+    return null;
+  return {
+    repoId: bytesToUuid(payload, 0),
+    thingId: bytesToUuid(payload, UUID_BYTES)
+  };
+}
+var VERSION_SELECTOR_RE = /^(?:v0*[1-9]\d*|[Hh][Ee][Aa][Dd]|[Aa][Ll][Ll])$/;
+function parseDurableReferenceToken(raw) {
+  const at = raw.lastIndexOf("@");
+  const selector = at >= 0 && VERSION_SELECTOR_RE.test(raw.slice(at + 1)) ? raw.slice(at + 1) : null;
+  const core = selector === null ? raw : raw.slice(0, at);
+  if (decodeDurableId(core) === null)
+    return null;
+  const stripped = core.startsWith("wh:") ? core.slice(3) : core;
+  return { durableId: stripped.toUpperCase(), selector };
+}
+function decodeRepoDurableId(token) {
+  const payload = unpackToken(REPO_SCHEME, token, UUID_BYTES);
+  if (!payload)
+    return null;
+  return { repoId: bytesToUuid(payload, 0) };
+}
+
+// ../../packages/rules/src/wref.ts
+function splitLocalPath(value) {
+  const slashIndex = value.indexOf("/");
+  if (slashIndex <= 0 || slashIndex === value.length - 1) {
+    return null;
+  }
+  return {
+    shapeName: value.slice(0, slashIndex),
+    bareName: value.slice(slashIndex + 1)
+  };
+}
+function withVersion(wref, version) {
+  return `${wref}@v${version}`;
+}
+
 // ../../packages/rules/src/commit-types.ts
 var COMMIT_OPERATIONS = [
   "add",
@@ -18032,11 +18180,9 @@ var READ_KIND_FILTERS = [
   LEGACY_COLLECTION_READ_KIND,
   LEGACY_ASSERTION_READ_KIND
 ];
-function splitLocalPath(name) {
-  const idx = name.indexOf("/");
-  if (idx === -1)
-    return null;
-  return { shapePrefix: name.slice(0, idx), bareName: name.slice(idx + 1) };
+function splitLocalPath2(name) {
+  const local = splitLocalPath(name);
+  return local ? { shapePrefix: local.shapeName, bareName: local.bareName } : null;
 }
 function inferOperationKind(op) {
   if (op.kind === "shape" || op.kind === "thing" || op.kind === "assertion" || op.kind === "collection") {
@@ -25802,6 +25948,8 @@ function validateManifestSemantics(manifest) {
   }
   return findings;
 }
+// ../../packages/rules/src/edge-authz.ts
+var MAX_ALLOWED_SHAPES_PER_LIST = 64;
 // ../../packages/rules/src/external-contract.ts
 var FORBIDDEN_EXTERNAL_FIELDS = new Set([
   "_id",
@@ -26153,7 +26301,7 @@ function preflightOpDiagnostics(op, operationIndex) {
 function builtinShapeGuard(op, operationIndex) {
   const errors = [];
   const name = op.name;
-  const isShapeRename = op.operation === "rename" && (op.kind === "shape" || op.name !== undefined && !splitLocalPath(op.name));
+  const isShapeRename = op.operation === "rename" && (op.kind === "shape" || op.name !== undefined && !splitLocalPath2(op.name));
   const reservedSourcePassThrough = isShapeRename && name !== undefined && isRenameableSquattedShape(name) && op.newName !== undefined && !isReservedCollectionShape(op.newName) && !isBuiltinShape(op.newName);
   if (name && isRetiredCollectionShape(name) && !reservedSourcePassThrough) {
     errors.push({
@@ -26162,7 +26310,7 @@ function builtinShapeGuard(op, operationIndex) {
       message: `Shape "${name}" is a retired collection shape and cannot be written manually`
     });
   }
-  if (op.operation === "rename" && (op.kind === "shape" || op.name !== undefined && !splitLocalPath(op.name)) && op.newName && isRetiredCollectionShape(op.newName)) {
+  if (op.operation === "rename" && (op.kind === "shape" || op.name !== undefined && !splitLocalPath2(op.name)) && op.newName && isRetiredCollectionShape(op.newName)) {
     errors.push({
       code: "RESERVED_NAME",
       operationIndex,
@@ -26180,7 +26328,7 @@ function builtinShapeGuard(op, operationIndex) {
     }
   }
   if (name && op.operation !== "retract") {
-    const local = splitLocalPath(name);
+    const local = splitLocalPath2(name);
     if (local && isRetiredCollectionShape(local.shapePrefix)) {
       errors.push({
         code: "VALIDATION_ERROR",
@@ -26209,13 +26357,13 @@ function reservedRootGuard(op, operationIndex) {
   if (op.kind === "shape")
     return [];
   if (op.operation === "add" && op.name) {
-    const stored = op.kind === "collection" ? op.name : splitLocalPath(op.name)?.bareName;
+    const stored = op.kind === "collection" ? op.name : splitLocalPath2(op.name)?.bareName;
     if (stored !== undefined && isReservedThingRoot(stored)) {
       return [reservedRootRefusal(stored, operationIndex)];
     }
     return [];
   }
-  const isShapeRename = op.name !== undefined && splitLocalPath(op.name) === null;
+  const isShapeRename = op.name !== undefined && splitLocalPath2(op.name) === null;
   if (op.operation === "rename" && !isShapeRename && op.newName !== undefined && isReservedThingRoot(op.newName)) {
     return [reservedRootRefusal(op.newName, operationIndex)];
   }
@@ -26224,7 +26372,7 @@ function reservedRootGuard(op, operationIndex) {
 function contentNameGuard(op, operationIndex) {
   if (op.kind !== "thing" || !op.name)
     return [];
-  const local = splitLocalPath(op.name);
+  const local = splitLocalPath2(op.name);
   if (!local || !isContentShape(local.shapePrefix))
     return [];
   const bareName = local.bareName;
@@ -26270,7 +26418,7 @@ function plusSignGuard(op, operationIndex) {
     }
     if (op.kind === "collection")
       return errors;
-    const local = splitLocalPath(name);
+    const local = splitLocalPath2(name);
     if (local && isReservedCollectionShape(local.shapePrefix))
       return errors;
     errors.push({
@@ -43539,139 +43687,6 @@ function commitValidateRequestBodyBytes(input) {
   return new TextEncoder().encode(encodeCommitValidateRequestBody(input)).byteLength;
 }
 
-// ../../packages/rules/src/crockford-base32.ts
-var ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
-var DECODE_TABLE = new Uint8Array(256).fill(255);
-for (let i = 0;i < ALPHABET.length; i++) {
-  const ch = ALPHABET.charCodeAt(i);
-  DECODE_TABLE[ch] = i;
-  if (ch >= 65)
-    DECODE_TABLE[ch + 32] = i;
-}
-function encodeBytes(data) {
-  const bitLen = data.length * 8;
-  const charCount = Math.ceil(bitLen / 5);
-  let out = "";
-  for (let i = 0;i < charCount; i++) {
-    const bitPos = i * 5;
-    const byteIdx = bitPos >> 3;
-    const bitOff = bitPos & 7;
-    const b1 = data[byteIdx] ?? 0;
-    let val;
-    if (bitOff <= 3) {
-      val = b1 >> 3 - bitOff & 31;
-    } else {
-      const b2 = data[byteIdx + 1] ?? 0;
-      val = (b1 << bitOff - 3 | b2 >> 11 - bitOff) & 31;
-    }
-    out += ALPHABET[val];
-  }
-  return out;
-}
-function decodeBytes(encoded) {
-  const byteLen = Math.floor(encoded.length * 5 / 8);
-  const bytes = new Uint8Array(byteLen);
-  let bitBuf = 0;
-  let bitsInBuf = 0;
-  let bytePos = 0;
-  for (let i = 0;i < encoded.length; i++) {
-    const ch = encoded.charCodeAt(i);
-    const val = DECODE_TABLE[ch];
-    if (val === undefined || val === 255)
-      return null;
-    bitBuf = bitBuf << 5 | val;
-    bitsInBuf += 5;
-    if (bitsInBuf >= 8) {
-      bitsInBuf -= 8;
-      if (bytePos < byteLen) {
-        bytes[bytePos++] = bitBuf >> bitsInBuf & 255;
-      }
-    }
-  }
-  return bytes;
-}
-
-// ../../packages/rules/src/durable-id.ts
-var THING_SCHEME = 1;
-var REPO_SCHEME = 2;
-var UUID_BYTES = 16;
-var CRC_BYTES = 4;
-function encodedLengthFor(payloadLen) {
-  return Math.ceil((1 + payloadLen + CRC_BYTES) * 8 / 5);
-}
-var CRC32C_TABLE = (() => {
-  const POLY = 2197175160;
-  const table = new Uint32Array(256);
-  for (let i = 0;i < 256; i++) {
-    let crc = i;
-    for (let j = 0;j < 8; j++) {
-      crc = crc & 1 ? crc >>> 1 ^ POLY : crc >>> 1;
-    }
-    table[i] = crc >>> 0;
-  }
-  return table;
-})();
-function crc32c(data) {
-  let crc = 4294967295;
-  for (const byte of data) {
-    crc = (crc >>> 8 ^ (CRC32C_TABLE[(crc ^ byte) & 255] ?? 0)) >>> 0;
-  }
-  return (crc ^ 4294967295) >>> 0;
-}
-function bytesToUuid(bytes, offset = 0) {
-  const hex3 = Array.from(bytes.slice(offset, offset + 16)).map((b) => b.toString(16).padStart(2, "0")).join("");
-  return [
-    hex3.slice(0, 8),
-    hex3.slice(8, 12),
-    hex3.slice(12, 16),
-    hex3.slice(16, 20),
-    hex3.slice(20, 32)
-  ].join("-");
-}
-function unpackToken(scheme, token, payloadLen) {
-  const stripped = token.startsWith("wh:") ? token.slice(3) : token;
-  if (stripped.length !== encodedLengthFor(payloadLen))
-    return null;
-  const raw = decodeBytes(stripped);
-  if (!raw || raw.length !== 1 + payloadLen + CRC_BYTES)
-    return null;
-  if (raw[0] !== scheme)
-    return null;
-  const crcOffset = 1 + payloadLen;
-  const storedCrc = (raw[crcOffset] ?? 0) << 24 | (raw[crcOffset + 1] ?? 0) << 16 | (raw[crcOffset + 2] ?? 0) << 8 | (raw[crcOffset + 3] ?? 0);
-  const computedCrc = crc32c(raw.slice(0, crcOffset));
-  if (storedCrc >>> 0 !== computedCrc >>> 0)
-    return null;
-  if (encodeBytes(raw) !== stripped.toUpperCase())
-    return null;
-  return raw.slice(1, 1 + payloadLen);
-}
-function decodeDurableId(token) {
-  const payload = unpackToken(THING_SCHEME, token, UUID_BYTES * 2);
-  if (!payload)
-    return null;
-  return {
-    repoId: bytesToUuid(payload, 0),
-    thingId: bytesToUuid(payload, UUID_BYTES)
-  };
-}
-var VERSION_SELECTOR_RE = /^(?:v0*[1-9]\d*|[Hh][Ee][Aa][Dd]|[Aa][Ll][Ll])$/;
-function parseDurableReferenceToken(raw) {
-  const at = raw.lastIndexOf("@");
-  const selector = at >= 0 && VERSION_SELECTOR_RE.test(raw.slice(at + 1)) ? raw.slice(at + 1) : null;
-  const core2 = selector === null ? raw : raw.slice(0, at);
-  if (decodeDurableId(core2) === null)
-    return null;
-  const stripped = core2.startsWith("wh:") ? core2.slice(3) : core2;
-  return { durableId: stripped.toUpperCase(), selector };
-}
-function decodeRepoDurableId(token) {
-  const payload = unpackToken(REPO_SCHEME, token, UUID_BYTES);
-  if (!payload)
-    return null;
-  return { repoId: bytesToUuid(payload, 0) };
-}
-
 // ../../packages/rules/src/json-string-walk.ts
 function walkJsonStringLeaves(value, spec) {
   const { childContext, onStringValue, onObjectKey } = spec;
@@ -45463,7 +45478,7 @@ function createStreamingSubmissionHandle(input, deps) {
 // ../../packages/sdk-ts/package.json
 var package_default = {
   name: "@warmhub/sdk-ts",
-  version: "0.132.0",
+  version: "0.133.0",
   private: false,
   type: "module",
   description: "The TypeScript SDK for WarmHub — create repos, commit and query data, and compound knowledge with your AI agents.",
@@ -52326,7 +52341,7 @@ function pinnedWref(c, wref, version2) {
     return `${c.cyan}${escapeTerminalTextForDisplay(wref)}${c.reset}`;
   }
   const base = wref.replace(/@v\d+$/, "");
-  return `${c.cyan}${escapeTerminalTextForDisplay(base)}@v${version2}${c.reset}`;
+  return `${c.cyan}${withVersion(escapeTerminalTextForDisplay(base), version2)}${c.reset}`;
 }
 function kindLabel(c, kind) {
   return `${c.dim}${kind}${c.reset}`;
@@ -52337,16 +52352,21 @@ function asCollectionSummaries(value) {
   const entries = value.filter((entry) => typeof entry === "object" && entry !== null && typeof entry.shape === "string");
   return entries.length > 0 ? entries : undefined;
 }
-function bareShapeName(token) {
+function bareShapeName2(token) {
   const withoutVersion = token.split("@", 1)[0] ?? "";
   return withoutVersion.slice(withoutVersion.lastIndexOf("/") + 1);
 }
-function effectiveKind(kind, shapeName, collections) {
+function effectiveKind(kind, collections) {
   if (kind !== "thing" && kind)
     return kind;
   const summaryShape = collections?.[0]?.shape;
   if (summaryShape)
-    return bareShapeName(summaryShape).toLowerCase();
+    return bareShapeName2(summaryShape).toLowerCase();
+  return kind;
+}
+function kindWithoutCertificate(kind, shapeName) {
+  if (kind !== "thing" && kind)
+    return kind;
   if (shapeName && isBuiltinCollectionShape(shapeName)) {
     return shapeName.toLowerCase();
   }
@@ -53258,9 +53278,6 @@ var handleCreate2 = async (ctx, { flags, args }) => {
 };
 
 // ../../packages/warmhub-cli/src/domains/thing/render.ts
-function singularShapeName(result) {
-  return result.shapeName ?? result.shape;
-}
 function renderHead(out, c, chars, result, org, repo, shape, kind) {
   const items = result.items ?? [];
   const decorations = getResponseDecorations(result);
@@ -53272,8 +53289,7 @@ function renderHead(out, c, chars, result, org, repo, shape, kind) {
   out(`${c.dim}${chars.hLine.repeat(60)}${c.reset}`);
   for (const item of items) {
     const wref = pinnedWref(c, item.wref ?? item.name ?? "(unknown)", item.version);
-    const shapeName = item.shapeName;
-    const kl = kindLabel(c, effectiveKind(item.kind ?? "thing", shapeName, asCollectionSummaries(item.collections)));
+    const kl = kindLabel(c, effectiveKind(item.kind ?? "thing", asCollectionSummaries(item.collections)));
     const retractedTag = item.active === false ? `  ${c.red}[RETRACTED]${c.reset}` : "";
     out(`  ${wref}  ${kl}${retractedTag}`);
     if (item.declaredShapes?.length) {
@@ -53301,8 +53317,7 @@ function renderHead(out, c, chars, result, org, repo, shape, kind) {
 function renderThing(out, c, result) {
   const decorations = getResponseDecorations(result);
   const wref = result.wref ?? result.name ?? "(unknown)";
-  const shapeName = singularShapeName(result);
-  const displayKind = effectiveKind(result.kind ?? "thing", shapeName, result.collections);
+  const displayKind = effectiveKind(result.kind ?? "thing", result.collections);
   const retractedTag = result.active === false ? `  ${c.red}[RETRACTED]${c.reset}` : "";
   out(`${pinnedWref(c, wref, result.version)}  ${kindLabel(c, displayKind)}${retractedTag}`);
   out(`  ${c.dim}wref:${c.reset}      ${escapeTerminalTextForDisplay(wref)}`);
@@ -53382,8 +53397,7 @@ function renderGraphValue(out, c, value, indent, decorations) {
 }
 function renderGraphNode(out, c, result, indent = "", decorations) {
   const wref = result.wref ?? result.name ?? "(unknown)";
-  const shapeName = singularShapeName(result);
-  const displayKind = effectiveKind(result.kind ?? "thing", shapeName, result.collections);
+  const displayKind = effectiveKind(result.kind ?? "thing", result.collections);
   out(`${indent}${pinnedWref(c, wref, result.version)}  ${kindLabel(c, displayKind)}`);
   if (result.about) {
     out(`${indent}  ${c.dim}about:${c.reset}`);
@@ -53423,7 +53437,9 @@ function renderHistory(out, c, result) {
   const decorations = getResponseDecorations(result);
   if (result.thing && typeof result.thing === "object") {
     const wref = result.thing.wref ?? result.thing.name ?? "(unknown)";
-    out(`${c.bold}History: ${pinnedWref(c, wref)}${c.reset}  ${kindLabel(c, effectiveKind(result.thing.kind ?? "thing", result.thing.shapeName))}`);
+    const newest = (result.versions ?? []).reduce((best, v) => !best || v.version > best.version ? v : best, undefined);
+    const kind = effectiveKind(result.thing.kind ?? "thing", asCollectionSummaries(newest?.collections));
+    out(`${c.bold}History: ${pinnedWref(c, wref)}${c.reset}  ${kindLabel(c, kind)}`);
   }
   const firstMeta = result.versions?.[0]?.metadata;
   if (firstMeta?.durableId) {
@@ -53474,7 +53490,7 @@ function renderRefs(out, c, result, wref, direction) {
   out(`${c.dim}${"─".repeat(60)}${c.reset}`);
   for (const item of items) {
     const refWref = refDisplay(c, item.wref, decorations, item.version);
-    const kl = kindLabel(c, effectiveKind(item.kind ?? "thing", item.shapeName));
+    const kl = kindLabel(c, kindWithoutCertificate(item.kind ?? "thing", item.shapeName));
     const field = `${c.dim}via ${c.reset}${escapeTerminalTextForDisplay(item.fieldPath ?? "(unknown)")}`;
     const binding = item.binding ? `  ${c.dim}${item.binding}${c.reset}` : "";
     out(`  ${refWref}  ${kl}  ${field}${binding}`);
@@ -53486,7 +53502,7 @@ function* walkBatchResult(wrefs, result, flagsVersion) {
   let missIdx = 0;
   for (const requested of wrefs) {
     const nextMiss = result.missing[missIdx];
-    const qualified = flagsVersion !== undefined && !/@v\d+$/.test(requested) ? `${requested}@v${flagsVersion}` : requested;
+    const qualified = flagsVersion !== undefined && !/@v\d+$/.test(requested) ? withVersion(requested, flagsVersion) : requested;
     if (nextMiss !== undefined && (nextMiss === requested || nextMiss === qualified)) {
       yield { kind: "miss", requested, missWref: nextMiss };
       missIdx++;
@@ -53513,9 +53529,9 @@ function renderBatchView(out, c, result, wrefs, flagsVersion) {
     const requestedBase = requested.replace(/@.+$/, "");
     const fallback = item.wref ?? `${item.shapeName ?? "?"}/${item.name ?? "(unknown)"}`;
     const base = requestedBase.length > 0 ? requestedBase : fallback.replace(/@v\d+$/, "");
-    const kl = kindLabel(c, effectiveKind(item.kind ?? "thing", item.shapeName, asCollectionSummaries(item.collections)));
+    const kl = kindLabel(c, effectiveKind(item.kind ?? "thing", asCollectionSummaries(item.collections)));
     const retractedTag = item.active === false ? `  ${c.red}[RETRACTED]${c.reset}` : "";
-    const display = labeledRef(c, `${base}@v${item.version}`, fallback) ?? `${escapeTerminalTextForDisplay(base)}@v${item.version}`;
+    const display = labeledRef(c, withVersion(base, item.version), fallback) ?? withVersion(escapeTerminalTextForDisplay(base), item.version);
     out(`  ${display}  ${kl}${retractedTag}`);
   }
   if (result.missing.length > 0) {
@@ -54264,8 +54280,7 @@ function renderQueryResults(out, c, result) {
   }
   for (const item of items) {
     const wref = pinnedWref(c, item.wref ?? item.name ?? "(unknown)", item.version);
-    const shapeName = item.shapeName;
-    const kl = kindLabel(c, effectiveKind(item.kind ?? "thing", shapeName, asCollectionSummaries(item.collections)));
+    const kl = kindLabel(c, effectiveKind(item.kind ?? "thing", asCollectionSummaries(item.collections)));
     const retractedTag = item.active === false ? `  ${c.red}[RETRACTED]${c.reset}` : "";
     out(`  ${wref}  ${kl}${retractedTag}`);
     if (item.declaredShapes?.length) {
@@ -55649,6 +55664,129 @@ Run \`wh auth login --profile ${explicitProfile}\` to create it.`);
   };
 }
 
+// ../../packages/warmhub-cli/src/scope-parse.ts
+var ENTRY_KEYS = new Set([
+  "resource",
+  "permissions",
+  "allowedMatches",
+  "allowedShapes"
+]);
+var SHAPE_LIST_KEYS = ["shapes", "shapesAll", "shapesNot"];
+var SHAPE_CLAUSE_KEYS = new Set([...SHAPE_LIST_KEYS, "shapeless"]);
+function shapeClauseExample(allowResource) {
+  const resource = allowResource ? '"resource":"myorg/myrepo",' : "";
+  return `[{${resource}"permissions":["repo:read"],"allowedMatches":["**"],"allowedShapes":{"shapes":["Player"],"shapesNot":["Secret"]}}]`;
+}
+function parseScopeEntriesJson(json2, opts) {
+  const { flagLabel, allowResource } = opts;
+  let parsed;
+  try {
+    parsed = JSON.parse(json2);
+  } catch {
+    throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} must be valid JSON`);
+  }
+  if (!Array.isArray(parsed) || parsed.length === 0) {
+    throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} must be a non-empty JSON array`);
+  }
+  return parsed.map((entry, i) => {
+    if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
+      throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} entry ${i + 1}: must be an object`);
+    }
+    const obj = entry;
+    const unknownKey = Object.keys(obj).find((key) => !ENTRY_KEYS.has(key));
+    if (unknownKey !== undefined) {
+      throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} entry ${i + 1}: unknown key "${unknownKey}"`, undefined, `Entry keys are resource, permissions, allowedMatches, allowedShapes. Example: ${flagLabel} '${shapeClauseExample(allowResource)}'`);
+    }
+    if (!Array.isArray(obj.permissions) || obj.permissions.length === 0 || obj.permissions.some((p) => typeof p !== "string" || p.trim().length === 0)) {
+      throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} entry ${i + 1}: "permissions" must be a non-empty array of non-empty strings`);
+    }
+    if (obj.resource !== undefined) {
+      if (!allowResource) {
+        throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} entry ${i + 1}: "resource" is not supported (resource is set automatically)`);
+      }
+      if (typeof obj.resource !== "string") {
+        throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} entry ${i + 1}: "resource" must be a string`);
+      }
+    }
+    if (obj.allowedMatches !== undefined) {
+      if (!Array.isArray(obj.allowedMatches) || obj.allowedMatches.some((m) => typeof m !== "string" || m.trim().length === 0)) {
+        throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} entry ${i + 1}: "allowedMatches" must be an array of non-empty strings`);
+      }
+    }
+    const allowedShapes = obj.allowedShapes === undefined ? undefined : parseAllowedShapes(obj.allowedShapes, flagLabel, i + 1, allowResource);
+    if (allowResource && (obj.allowedMatches !== undefined || allowedShapes !== undefined) && (typeof obj.resource !== "string" || !obj.resource.includes("/"))) {
+      const fields = [
+        obj.allowedMatches !== undefined && '"allowedMatches"',
+        allowedShapes !== undefined && '"allowedShapes"'
+      ].filter(Boolean).join(" and ");
+      throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} entry ${i + 1}: ${fields} would restrict nothing on ${typeof obj.resource === "string" ? `the org entry "${obj.resource}"` : "an entry without a resource"}; name and Shape restrictions apply only to a repository entry`, undefined, `Name the repository. Example: ${flagLabel} '${shapeClauseExample(allowResource)}'`);
+    }
+    const result = {
+      permissions: obj.permissions.map((p) => p.trim())
+    };
+    if (obj.resource !== undefined)
+      result.resource = obj.resource;
+    if (obj.allowedMatches !== undefined)
+      result.allowedMatches = obj.allowedMatches.map((m) => m.trim());
+    if (allowedShapes !== undefined)
+      result.allowedShapes = allowedShapes;
+    return result;
+  });
+}
+function parseAllowedShapes(value, flagLabel, entry, allowResource) {
+  const refuse = (message) => {
+    throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} entry ${entry}: "allowedShapes" ${message}`, undefined, `Keys are shapes, shapesAll, shapesNot (1-${MAX_ALLOWED_SHAPES_PER_LIST} Shape names each) and shapeless (boolean). Example: ${flagLabel} '${shapeClauseExample(allowResource)}'`);
+  };
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    refuse("must be an object");
+  }
+  const obj = value;
+  const unknownKey = Object.keys(obj).find((key) => !SHAPE_CLAUSE_KEYS.has(key));
+  if (unknownKey !== undefined)
+    refuse(`has unknown key "${unknownKey}"`);
+  const clause = {};
+  for (const key of SHAPE_LIST_KEYS) {
+    const list = obj[key];
+    if (list === undefined)
+      continue;
+    if (!Array.isArray(list) || list.length === 0 || list.some((n) => typeof n !== "string" || n.trim().length === 0)) {
+      refuse(`"${key}" must be a non-empty array of non-empty Shape names`);
+    }
+    const names = list;
+    if (names.length > MAX_ALLOWED_SHAPES_PER_LIST) {
+      refuse(`"${key}" names ${names.length} Shapes; the limit is ${MAX_ALLOWED_SHAPES_PER_LIST}`);
+    }
+    clause[key] = names.map((n) => n.trim());
+  }
+  if (obj.shapeless !== undefined) {
+    if (typeof obj.shapeless !== "boolean")
+      refuse('"shapeless" must be a boolean');
+    clause.shapeless = obj.shapeless;
+  }
+  return clause;
+}
+function formatAllowedShapes(allowedShapes) {
+  if (allowedShapes === undefined)
+    return "";
+  const parts = [];
+  for (const key of SHAPE_LIST_KEYS) {
+    const list = allowedShapes[key];
+    if (list !== undefined) {
+      parts.push(`${key}: ${list.length > 0 ? list.join(", ") : "[none]"}`);
+    }
+  }
+  if (allowedShapes.shapeless !== undefined)
+    parts.push(allowedShapes.shapeless ? "shapeless" : "no shapeless");
+  return parts.map((part) => `  ${part}`).join("");
+}
+function formatAllowedMatches(allowedMatches) {
+  if (allowedMatches === undefined)
+    return "";
+  if (allowedMatches.length === 0)
+    return "  match: [deny-all]";
+  return `  match: ${allowedMatches.join(", ")}`;
+}
+
 // ../../packages/warmhub-cli/src/domains/auth-shared.ts
 function clientForStoredFlags(ctx, profile) {
   const { flags } = resolveClientFlags(getProfile(profile)?.flags);
@@ -61817,10 +61955,11 @@ async function collectChecks(ctx) {
         if (whoami.scopes && whoami.scopes.length > 0) {
           const scopeParts = whoami.scopes.map((s) => {
             const perms = s.permissions.join(", ");
+            const shapes = formatAllowedShapes(s.allowedShapes);
             if (s.redactedResource) {
-              return `${perms} on redacted/inaccessible repo`;
+              return `${perms} on redacted/inaccessible repo${shapes}`;
             }
-            return s.resource ? `${perms} on ${s.resource}` : perms;
+            return `${s.resource ? `${perms} on ${s.resource}` : perms}${shapes}`;
           });
           detailLines.push(`Scopes: ${scopeParts.join(", ")}`);
         }
@@ -67273,57 +67412,6 @@ var SUB_DOMAIN = defineDomain({
     }
   }
 });
-// ../../packages/warmhub-cli/src/scope-parse.ts
-function parseScopeEntriesJson(json2, opts) {
-  const { flagLabel, allowResource } = opts;
-  let parsed;
-  try {
-    parsed = JSON.parse(json2);
-  } catch {
-    throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} must be valid JSON`);
-  }
-  if (!Array.isArray(parsed) || parsed.length === 0) {
-    throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} must be a non-empty JSON array`);
-  }
-  return parsed.map((entry, i) => {
-    if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
-      throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} entry ${i + 1}: must be an object`);
-    }
-    const obj = entry;
-    if (!Array.isArray(obj.permissions) || obj.permissions.length === 0 || obj.permissions.some((p) => typeof p !== "string" || p.trim().length === 0)) {
-      throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} entry ${i + 1}: "permissions" must be a non-empty array of non-empty strings`);
-    }
-    if (obj.resource !== undefined) {
-      if (!allowResource) {
-        throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} entry ${i + 1}: "resource" is not supported (resource is set automatically)`);
-      }
-      if (typeof obj.resource !== "string") {
-        throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} entry ${i + 1}: "resource" must be a string`);
-      }
-    }
-    if (obj.allowedMatches !== undefined) {
-      if (!Array.isArray(obj.allowedMatches) || obj.allowedMatches.some((m) => typeof m !== "string" || m.trim().length === 0)) {
-        throw new CliError(2 /* UserInput */, "USER_INPUT", `${flagLabel} entry ${i + 1}: "allowedMatches" must be an array of non-empty strings`);
-      }
-    }
-    const result = {
-      permissions: obj.permissions.map((p) => p.trim())
-    };
-    if (obj.resource !== undefined)
-      result.resource = obj.resource;
-    if (obj.allowedMatches !== undefined)
-      result.allowedMatches = obj.allowedMatches.map((m) => m.trim());
-    return result;
-  });
-}
-function formatAllowedMatches(allowedMatches) {
-  if (allowedMatches === undefined)
-    return "";
-  if (allowedMatches.length === 0)
-    return "  match: [deny-all]";
-  return `  match: ${allowedMatches.join(", ")}`;
-}
-
 // ../../packages/warmhub-cli/src/domains/token.ts
 var DURATION_MULTIPLIERS = {
   h: 3600000,
@@ -67356,7 +67444,7 @@ var createFlags10 = {
     multiple: true
   }),
   "scopes-json": flag.string({
-    description: "Structured scope entries as JSON array (advanced; use for allowedMatches or repeated resource entries; mutually exclusive with --scope)"
+    description: "Structured scope entries as JSON array (advanced; use for allowedMatches, allowedShapes, or repeated resource entries; mutually exclusive with --scope)"
   }),
   description: flag.string({ short: "d", description: "Token description" }),
   expires: flag.string({
@@ -67401,10 +67489,10 @@ function formatScopes(scopes) {
     return "full access";
   return scopes.map((e) => {
     if (e.redactedResource) {
-      return `redacted/inaccessible repo=${e.permissions.join(",")}${formatAllowedMatches(e.allowedMatches)}`;
+      return `redacted/inaccessible repo=${e.permissions.join(",")}${formatAllowedMatches(e.allowedMatches)}${formatAllowedShapes(e.allowedShapes)}`;
     }
     const base = e.resource ? `${e.resource}=${e.permissions.join(",")}` : e.permissions.join(",");
-    return `${base}${formatAllowedMatches(e.allowedMatches)}`;
+    return `${base}${formatAllowedMatches(e.allowedMatches)}${formatAllowedShapes(e.allowedShapes)}`;
   }).join(" ");
 }
 var handleCreate9 = async (ctx, { flags }) => {
@@ -68271,7 +68359,7 @@ var handleEvaluate = async (ctx, { args, flags }) => {
     nextCursor: result.nextCursor ?? null,
     decorations: getResponseDecorations(result)
   }, () => {
-    const selected = `${result.view.wref}@v${result.view.version}`;
+    const selected = withVersion(result.view.wref, result.view.version);
     ctx.out(`${ctx.colors.bold}View ${escapeTerminalTextForDisplay(selected)}${ctx.colors.reset}`);
     renderQueryResults(ctx.out, ctx.colors, result);
   });
@@ -69964,7 +70052,7 @@ function resolveLogLevel(flagLevel, env) {
 // package.json
 var package_default3 = {
   name: "@warmhub/cli",
-  version: "0.134.0",
+  version: "0.135.0",
   private: false,
   type: "module",
   description: "The wh CLI for WarmHub — create repos, commit and query data, and compound knowledge with your AI agents.",
@@ -70589,5 +70677,5 @@ process.exitCode = interceptedExitCode === undefined ? await runPreparedCli(laun
   version: package_default3.version
 }) : interceptedExitCode;
 
-//# debugId=59E58BA2C90F5E3C64756E2164756E21
-//# warmhub-cli-build-info {"cliVersion":"0.134.0","sdkVersion":"0.132.0"}
+//# debugId=BE49CDDCED2454CC64756E2164756E21
+//# warmhub-cli-build-info {"cliVersion":"0.135.0","sdkVersion":"0.133.0"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@warmhub/cli",
-  "version": "0.134.0",
+  "version": "0.135.0",
   "private": false,
   "type": "module",
   "description": "The wh CLI for WarmHub — create repos, commit and query data, and compound knowledge with your AI agents.",