@warmhub/cli 0.146.0 → 0.148.0

package/dist/wh.js

@@ -18538,6 +18538,9 @@ function decodeDurableId(token) {
     thingId: bytesToUuid(payload, UUID_BYTES)
   };
 }
+function isDurableId(token) {
+  return decodeDurableId(token) !== null;
+}
 var VERSION_SELECTOR_RE = /^(?:v0*[1-9]\d*|[Hh][Ee][Aa][Dd]|[Aa][Ll][Ll])$/;
 function parseDurableReferenceToken(raw) {
   const at = raw.lastIndexOf("@");
@@ -18577,7 +18580,7 @@ function isReservedShapeName(name) {
   return name === RESERVED_THING_ROOT;
 }
 function reservedThingRootMessage(name) {
-  return `Name "${name}" is under the reserved root "${RESERVED_THING_ROOT_PREFIX}"; only Shapes live there, as ${RESERVED_THING_ROOT_PREFIX}shapes/<Name>`;
+  return `Name "${name}" is under the reserved root "${RESERVED_THING_ROOT_PREFIX}"; only platform-owned names may live there, including ${RESERVED_THING_ROOT_PREFIX}shapes/<Name> and ${RESERVED_THING_ROOT_PREFIX}redacted/<durable-id>`;
 }
 
 // ../../packages/rules/src/wref.ts
@@ -18754,11 +18757,13 @@ var COMMIT_OPERATIONS = [
   "retract",
   "reaffirm",
   "rename",
+  "redact",
   "remove",
   "restore",
   "rewrite"
 ];
 var PRIVILEGED_COMMIT_OPERATIONS = {
+  redact: "things:redact",
   remove: "things:delete",
   rewrite: "things:rewrite"
 };
@@ -18837,7 +18842,16 @@ var COMPONENT_TEMPLATE_VALUES = {
   "org-name": (ctx) => ctx.orgName,
   "repo-name": (ctx) => ctx.repoName
 };
-var TEMPLATE_TOKEN_RE = /<([a-z-]+)>/g;
+function parseComponentTemplateToken(raw) {
+  switch (raw) {
+    case "org-name":
+    case "repo-name":
+      return raw;
+    default:
+      return;
+  }
+}
+var TEMPLATE_TOKEN_RE = /<([^>]+)>/g;
 function listComponentTemplateTokens(value) {
   const tokens = new Set;
   for (const match of value.matchAll(TEMPLATE_TOKEN_RE)) {
@@ -18848,15 +18862,15 @@ function listComponentTemplateTokens(value) {
   return [...tokens];
 }
 function unsupportedComponentTemplateTokens(value) {
-  return listComponentTemplateTokens(value).filter((token) => !(token in COMPONENT_TEMPLATE_VALUES));
+  return listComponentTemplateTokens(value).filter((token) => parseComponentTemplateToken(token) === undefined);
 }
 function resolveComponentTemplate(value, ctx) {
   return value.replace(TEMPLATE_TOKEN_RE, (_match, token) => {
-    const resolver = COMPONENT_TEMPLATE_VALUES[token];
-    if (!resolver) {
+    const parsed = parseComponentTemplateToken(token);
+    if (!parsed) {
       throw new Error(`Unsupported component template token <${token}>`);
     }
-    return resolver(ctx);
+    return COMPONENT_TEMPLATE_VALUES[parsed](ctx);
   });
 }
 
@@ -25940,6 +25954,8 @@ var CORRECTED_THING_SHAPE_NAME = "CorrectedThing";
 var CORRECTED_THING_FIELDS = {
   correctionLog: { type: "array", items: { reason: "string" }, minItems: 1 }
 };
+var REDACTED_THING_SHAPE_NAME = "RedactedThing";
+var REDACTED_THING_FIELDS = {};
 var SYSTEM_SHAPES = [
   {
     name: "ComponentInstall",
@@ -25965,6 +25981,12 @@ var SYSTEM_SHAPES = [
     name: CORRECTED_THING_SHAPE_NAME,
     fields: CORRECTED_THING_FIELDS,
     onDemand: true
+  },
+  {
+    name: REDACTED_THING_SHAPE_NAME,
+    fields: REDACTED_THING_FIELDS,
+    onDemand: true,
+    systemOnlyCertification: true
   }
 ];
 var SYSTEM_MANIFEST = {
@@ -26006,6 +26028,7 @@ var SYSTEM_PROTECTED_SHAPES = SYSTEM_COMPONENT.shapes.filter((shape) => shape.in
 var SYSTEM_PROTECTED_FAMILY_SHAPES = SYSTEM_PROTECTED_SHAPES.filter((shape) => shape.onDemand !== true);
 var SYSTEM_INFRA_SHAPE_NAMES = new Set(SYSTEM_COMPONENTS.flatMap((entry) => entry.shapes.filter((shape) => shape.installInfra === true).map((shape) => shape.name)));
 var SYSTEM_SHAPE_NAMES2 = new Set(SYSTEM_MANIFEST.shapes.map((shape) => shape.name));
+var SYSTEM_ONLY_CERTIFICATE_SHAPE_NAMES = new Set(SYSTEM_COMPONENT.shapes.filter((shape) => shape.systemOnlyCertification === true).map((shape) => shape.name));
 function isSystemShapeName(name) {
   return SYSTEM_SHAPE_NAMES2.has(name);
 }
@@ -44826,6 +44849,7 @@ var DEFINITE_CLIENT_REJECT_CODES = new Set([
   "CONFLICT",
   "NAME_TAKEN",
   "TARGET_REMOVED",
+  "TARGET_REDACTED",
   "ALREADY_RETRACTED",
   "ARCHIVED",
   "RATE_LIMITED",
@@ -46325,6 +46349,11 @@ var currentErrorDetailsSchema = exports_external.discriminatedUnion("reason", [
     reason: exports_external.literal("target_removed"),
     targetDurableId: exports_external.string().min(1),
     fieldPath: exports_external.string().optional()
+  }).loose(),
+  exports_external.object({
+    reason: exports_external.literal("target_redacted"),
+    targetDurableId: exports_external.string().min(1),
+    fieldPath: exports_external.string().optional()
   }).loose()
 ]);
 var currentBaseShape = {
@@ -46831,7 +46860,7 @@ function createStreamingSubmissionHandle(input, deps) {
 // ../../packages/sdk-ts/package.json
 var package_default = {
   name: "@warmhub/sdk-ts",
-  version: "0.144.0",
+  version: "0.146.0",
   private: false,
   type: "module",
   description: "The TypeScript SDK for WarmHub — create repos, commit and query data, and compound knowledge with your AI agents.",
@@ -49049,6 +49078,19 @@ class WarmHubClient {
         throw toWarmHubError(error51);
       }
     },
+    redact: async (orgName, repoName, durableId, opts) => {
+      try {
+        return await this.trpc.thing.redact.mutate({
+          orgName,
+          repoName,
+          durableId,
+          expectedVersion: opts.expectedVersion,
+          eventRequestId: opts.eventRequestId
+        });
+      } catch (error51) {
+        throw toWarmHubError(error51);
+      }
+    },
     rewrite: async (orgName, repoName, wref, opts) => {
       try {
         return await this.trpc.thing.rewrite.mutate({
@@ -49802,6 +49844,10 @@ function unauthenticatedHint(message) {
   }
   return "Check credentials and backend permissions.";
 }
+function signedOutNotFoundHint(profile) {
+  const flag = profile && profile !== "default" ? ` --profile ${profile}` : "";
+  return `Not logged in, so only public data is visible. If this is private, run \`wh auth login${flag}\`.`;
+}
 function reloginHint(profile) {
   const named = profile ? ` for profile "${profile}"` : "";
   const flag = profile && profile !== "default" ? ` --profile ${profile}` : "";
@@ -50288,6 +50334,13 @@ function usageError(usage, ...examples) {
   `)}`;
   throw new CliError(2 /* UserInput */, "USER_INPUT", usage, undefined, hint);
 }
+function withSignedOutHint(error51, profile) {
+  const notFound = error51.errorCode === "NOT_FOUND" || error51.cause instanceof WarmHubError && error51.cause.code === "NOT_FOUND";
+  const login = signedOutNotFoundHint(profile);
+  if (!notFound || error51.hint?.includes(login))
+    return error51;
+  return new CliError(error51.code, error51.kind, error51.message, error51.cause, error51.hint ? `${error51.hint} ${login}` : login, error51.context, error51.errorCode, error51.recovery);
+}
 function toCliError(err, opts) {
   if (err instanceof CliError)
     return err;
@@ -51867,11 +51920,13 @@ function loadProfileStore(path) {
   } catch (cause) {
     throw corruptedAuthError(p, cause);
   }
-  if (parsed === null || typeof parsed !== "object" || parsed.version !== 1 || parsed.profiles === null || typeof parsed.profiles !== "object" || Array.isArray(parsed.profiles)) {
+  if (!isProfileStore(parsed))
     throw corruptedAuthError(p);
-  }
   return parsed;
 }
+function isProfileStore(value) {
+  return isPlainObject(value) && value.version === 1 && isPlainObject(value.profiles) && Object.values(value.profiles).every((profile) => isPlainObject(profile) && isPlainObject(profile.tokens));
+}
 function corruptedAuthError(path, cause) {
   getLog().error("auth.profile.corrupt", { path });
   return new CliError(3 /* Config */, "CONFIG", `Auth file at ${path} is unreadable or in an unknown format.`, cause, `Remove the file (\`rm ${path}\`) and run \`wh auth login\` to re-authenticate.`);
@@ -51941,6 +51996,14 @@ function getTokenInfo(profile) {
     canRefresh: source === "device" && !!tokens.refreshToken
   };
 }
+function isSignedOut(profile) {
+  try {
+    const info = getTokenInfo(profile);
+    return !info || info.source === "token" && info.expired;
+  } catch {
+    return false;
+  }
+}
 async function getValidToken(profile, signal, options = {}) {
   const log = getLog();
   const envToken = process.env.WH_TOKEN;
@@ -53199,21 +53262,17 @@ function writeInstallSnapshotCache(repoSlug, cache) {
     renameSync3(tmp, path);
   }
 }
-function isPlainObject3(value) {
-  return typeof value === "object" && value !== null;
-}
 function isInstallSnapshotCacheShape(value) {
-  if (!isPlainObject3(value))
+  if (!isPlainObject(value))
     return false;
   if (typeof value.cachedAt !== "number")
     return false;
   if (typeof value.repoSlug !== "string")
     return false;
-  if (!isPlainObject3(value.components))
+  if (!isPlainObject(value.components))
     return false;
-  const components = value.components;
-  for (const entry of Object.values(components)) {
-    if (!isPlainObject3(entry))
+  for (const entry of Object.values(value.components)) {
+    if (!isPlainObject(entry))
       return false;
     const component = entry;
     if (typeof component.ref !== "string")
@@ -53232,11 +53291,10 @@ function isInstallSnapshotCacheShape(value) {
     if (!Array.isArray(component.methods))
       return false;
   }
-  if (!isPlainObject3(value.installs))
+  if (!isPlainObject(value.installs))
     return false;
-  const installs = value.installs;
-  for (const entry of Object.values(installs)) {
-    if (!isPlainObject3(entry))
+  for (const entry of Object.values(value.installs)) {
+    if (!isPlainObject(entry))
       return false;
     const install = entry;
     if (typeof install.ref !== "string")
@@ -54142,7 +54200,7 @@ function emitNoMatchHint(ctx, match, count) {
 }
 
 // ../../packages/warmhub-cli/src/domains/commit-output-contract-id.ts
-var COMMIT_SUBMIT_OUTPUT_SCHEMA_ID = "wh.commit.submit.result/v0.11";
+var COMMIT_SUBMIT_OUTPUT_SCHEMA_ID = "wh.commit.submit.result/v0.12";
 function identifyCommitSubmitOutput(value) {
   if ("schema" in value) {
     if (value.schema === COMMIT_SUBMIT_OUTPUT_SCHEMA_ID) {
@@ -56136,6 +56194,59 @@ function renderQueryResults(out, c, result) {
   out(`${c.dim}${items.length} result(s)${c.reset}`);
 }
 
+// ../../packages/warmhub-cli/src/domains/thing/redact.ts
+var USAGE = "Usage: wh thing redact <durableId> [--expected-version <n>] [--yes]";
+var EXAMPLE = "wh thing redact 040T1QCTF2Y79... --expected-version 3 --yes";
+var redactFlags = {
+  "expected-version": flag.number({
+    description: "only redact if the Thing is still at this version (default: the version read before redacting)"
+  }),
+  yes: flag.boolean({ short: "y", description: "Skip confirmation prompt" }),
+  "event-request-id": operationEventRequestIdFlag
+};
+var handleThingRedact = async (ctx, { flags, args }) => {
+  const durableId = args[0];
+  if (!durableId)
+    usageError(USAGE, EXAMPLE);
+  const repoRef = getRepoRef(ctx);
+  if (!isDurableId(durableId)) {
+    usageError(`${USAGE}
+Redaction requires the Thing's bare durable ID, never a wref.`, `wh thing resolve ${durableId}${repoRef ? ` --repo ${repoRef}` : ""}`);
+  }
+  const { org, repo } = parseOrgRepo(repoRef, ctx.config);
+  const c = ctx.colors;
+  let expectedVersion = parsePositiveIntFlag(flags["expected-version"], "--expected-version", EXAMPLE);
+  let label = durableId;
+  if (expectedVersion === undefined || !flags.yes) {
+    const thing = await ctx.client.thing.get(org, repo, durableId, undefined, {
+      includeRetracted: true
+    });
+    expectedVersion ??= thing.version;
+    label = `${thing.wref} (${durableId})`;
+  }
+  if (!flags.yes) {
+    const confirmed = await ctx.confirm?.(`Irreversibly redact ${label} at v${expectedVersion}? This erases its canonical content and former name, but not backups, completed exports, logs, or downstream copies.`);
+    if (!confirmed) {
+      ctx.status("Cancelled");
+      return;
+    }
+  }
+  const eventRequestId = flags["event-request-id"] ?? createOperationEventRequestId();
+  ctx.status(`Operation event request: ${eventRequestId}`);
+  const receipt = await ctx.client.thing.redact(org, repo, durableId, {
+    eventRequestId,
+    expectedVersion
+  });
+  writeOutput(ctx, receipt, () => {
+    if (receipt.pruned) {
+      ctx.out(`${c.dim}Replayed${c.reset} ${displayName(c, durableId)} (the receipt was pruned; the Thing was removed since)`);
+      return;
+    }
+    const operation = receipt.operations.find((candidate) => candidate.operation === "redact");
+    ctx.out(operation?.status === "noop" ? `${c.dim}Already redacted${c.reset} ${displayName(c, durableId)}` : `${c.green}Redacted${c.reset} ${displayName(c, durableId)}`);
+  });
+};
+
 // ../../packages/warmhub-cli/src/domains/thing/refs.ts
 var refsFlags = {
   inbound: flag.boolean({
@@ -56254,8 +56365,8 @@ var handleReleaseLease = async (ctx, { flags, args }) => {
 };
 
 // ../../packages/warmhub-cli/src/domains/thing/remove.ts
-var USAGE = "Usage: wh thing remove <wref|durableId> [--expected-version <n>] [--yes]";
-var EXAMPLE = "wh thing remove cave --yes";
+var USAGE2 = "Usage: wh thing remove <wref|durableId> [--expected-version <n>] [--yes]";
+var EXAMPLE2 = "wh thing remove cave --yes";
 var removeFlags = {
   "expected-version": flag.number({
     description: "only remove if the Thing is still at this version (default: the version read before removing)"
@@ -56266,7 +56377,7 @@ var removeFlags = {
 var handleThingRemove = async (ctx, { flags, args }) => {
   const target = args[0];
   if (!target)
-    usageError(USAGE, EXAMPLE);
+    usageError(USAGE2, EXAMPLE2);
   const { org, repo } = parseOrgRepo(getRepoRef(ctx), ctx.config);
   const c = ctx.colors;
   let expectedVersion = parsePositiveIntFlag(flags["expected-version"], "--expected-version", "wh thing remove cave --expected-version 3");
@@ -56476,8 +56587,8 @@ var handleRevise2 = async (ctx, { flags, args }) => {
 };
 
 // ../../packages/warmhub-cli/src/domains/thing/rewrite.ts
-var USAGE2 = "Usage: wh thing rewrite <name@vN|durableId@vN> --shape <Shape>... (--data <json-object> | --file <path>) [--yes]";
-var EXAMPLE2 = "wh thing rewrite cave@v2 --shape Location --shape CorrectedThing --file corrected.json --yes";
+var USAGE3 = "Usage: wh thing rewrite <name@vN|durableId@vN> --shape <Shape>... (--data <json-object> | --file <path>) [--yes]";
+var EXAMPLE3 = "wh thing rewrite cave@v2 --shape Location --shape CorrectedThing --file corrected.json --yes";
 var rewriteFlags = {
   shape: flag.string({
     multiple: true,
@@ -56497,24 +56608,24 @@ function parseTarget(target) {
   try {
     parsed = parseWref(target);
   } catch (error51) {
-    usageError(`${USAGE2}
-${error51 instanceof Error ? error51.message : String(error51)}`, EXAMPLE2);
+    usageError(`${USAGE3}
+${error51 instanceof Error ? error51.message : String(error51)}`, EXAMPLE3);
   }
   if (parsed.version.type !== "pinned") {
-    usageError(`${USAGE2}
-Name the exact version to correct, e.g. cave@v2.`, EXAMPLE2);
+    usageError(`${USAGE3}
+Name the exact version to correct, e.g. cave@v2.`, EXAMPLE3);
   }
   return { wref: stripWrefVersion(target), version: parsed.version.n };
 }
 var handleThingRewrite = async (ctx, { flags, args }) => {
   const target = args[0];
   if (!target)
-    usageError(USAGE2, EXAMPLE2);
+    usageError(USAGE3, EXAMPLE3);
   const { wref, version: version2 } = parseTarget(target);
   const shapes = flags.shape ?? [];
   if (shapes.length === 0) {
-    usageError(`${USAGE2}
-State the Shapes the version declares, plus CorrectedThing.`, EXAMPLE2);
+    usageError(`${USAGE3}
+State the Shapes the version declares, plus CorrectedThing.`, EXAMPLE3);
   }
   const { org, repo } = parseOrgRepo(getRepoRef(ctx), ctx.config);
   const c = ctx.colors;
@@ -56523,7 +56634,7 @@ State the Shapes the version declares, plus CorrectedThing.`, EXAMPLE2);
     file: flags.file,
     inlineFlag: "--data",
     missingMessage: "--data is required for rewrite unless --file is provided: the complete replacement body",
-    example: EXAMPLE2
+    example: EXAMPLE3
   });
   if (ctx.dryRun) {
     const validation = await ctx.client.commit.validate(org, repo, [
@@ -57126,6 +57237,20 @@ var THING_DOMAIN = defineDomain({
       ],
       handler: handleThingRemove
     },
+    redact: {
+      prime: false,
+      summary: "Irreversibly erase canonical content while preserving identity (needs things:redact)",
+      args: "<durableId>",
+      flags: redactFlags,
+      examples: [
+        "wh thing redact 040T1QCTF2Y79... --yes",
+        "wh thing redact 040T1QCTF2Y79... --expected-version 3 --yes"
+      ],
+      notes: [
+        "Core redaction does not erase backups, completed exports, logs, or copies already delivered downstream."
+      ],
+      handler: handleThingRedact
+    },
     rewrite: {
       prime: false,
       summary: "Replace the body of one exact version in place (needs things:rewrite)",
@@ -59687,7 +59812,7 @@ var createFlags3 = {
 };
 
 // ../../packages/warmhub-cli/src/domains/commit-stream-output-contract-id.ts
-var COMMIT_SUBMIT_STREAM_ROW_SCHEMA_ID = "wh.commit.submit.stream.row/v0.10";
+var COMMIT_SUBMIT_STREAM_ROW_SCHEMA_ID = "wh.commit.submit.stream.row/v0.11";
 function identify(row) {
   if ("schema" in row) {
     throw new Error("Streaming submission row already defines a schema field");
@@ -59954,6 +60079,7 @@ function retractHint(name) {
   return `use {"operation":"retract","name":"${name ?? "<wref>"}"} or \`wh commit submit --retract${name ? ` ${name}` : ""}\``;
 }
 var PRIVILEGED_OPERATION_HINTS = {
+  redact: ({ name }) => `To irreversibly erase canonical Thing content while preserving its identity, use \`wh thing redact ${name && isDurableId(name) ? name : "<durable-id>"} --expected-version <n> --yes\`.`,
   remove: ({ name }) => `To delete the Thing permanently, use \`wh thing remove ${name ?? "<wref>"}\`. To withdraw it, ${retractHint(name)}.`,
   rewrite: ({ name, version: version2 }) => `To correct a version in place, use \`wh thing rewrite ${name ?? "<wref>"}@v${typeof version2 === "number" ? version2 : "<n>"} --shape <Shape>... --file <body.json>\`.`
 };
@@ -61665,7 +61791,7 @@ function bindComponentMethodArgs(invocation, method) {
 }
 
 // ../../packages/warmhub-cli/src/component-exec.ts
-var USAGE3 = "wh component exec <component> <method> [args] --repo org/repo";
+var USAGE4 = "wh component exec <component> <method> [args] --repo org/repo";
 function methodHelpHint(componentName, methodName, installRepo) {
   return `wh component exec ${componentName} ${methodName} --help --repo ${installRepo}`;
 }
@@ -61719,7 +61845,7 @@ var handleComponentExec = async (ctx, _domain) => {
   const helpRequested = invocation.help;
   const dryRun = invocation.flags["dry-run"] === true;
   if (!invocation.component)
-    usageError("Component name is required", USAGE3);
+    usageError("Component name is required", USAGE4);
   const componentName = invocation.component;
   const methodName = invocation.method;
   const { org, repo } = parseOrgRepo(getRepoRef(ctx), ctx.config);
@@ -72158,7 +72284,8 @@ async function runPreparedCli(rawArgv, prepared, opts) {
       exitCode = cancelledExitCode;
       return exitCode;
     }
-    const cliError = toCliError2(error51, { profile: activeProfile });
+    const converted = toCliError2(error51, { profile: activeProfile });
+    const cliError = isSignedOut(activeProfile) ? withSignedOutHint(converted, activeProfile) : converted;
     const fields = {
       kind: cliError.kind,
       exit_code: cliError.code,
@@ -72248,7 +72375,7 @@ function resolveLogLevel(flagLevel, env) {
 // package.json
 var package_default3 = {
   name: "@warmhub/cli",
-  version: "0.146.0",
+  version: "0.148.0",
   private: false,
   type: "module",
   description: "The wh CLI for WarmHub — create repos, commit and query data, and compound knowledge with your AI agents.",
@@ -72331,17 +72458,20 @@ async function maybeHandleComponentShellBoundary(prepared, deps = {}) {
   const writeErr = deps.err ?? err;
   const debug = prepared.presentation.debug === true || process.env.WARMHUB_DEBUG === "1";
   const format = prepared.presentation.format;
+  let profile;
   try {
     if (invocation.flags["dry-run"] === true)
       return;
     const source = invocation.positionals[0];
-    const { config: config2, client } = resolveCliContext({
+    const context = resolveCliContext({
       invocation,
       format,
       functionLogs: "off",
       config: deps.config,
       client: deps.client
     });
+    const { config: config2, client } = context;
+    profile = context.profile;
     if (!source) {
       return;
     }
@@ -72366,7 +72496,9 @@ async function maybeHandleComponentShellBoundary(prepared, deps = {}) {
       writeErr
     });
   } catch (error51) {
-    return printCliError(toCliError2(error51), writeErr, {
+    const converted = toCliError2(error51, { profile });
+    const cliError = isSignedOut(profile) ? withSignedOutHint(converted, profile) : converted;
+    return printCliError(cliError, writeErr, {
       format,
       debug
     });
@@ -72873,5 +73005,5 @@ process.exitCode = interceptedExitCode === undefined ? await runPreparedCli(laun
   version: package_default3.version
 }) : interceptedExitCode;
 
-//# debugId=C60966EBD66E31FA64756E2164756E21
-//# warmhub-cli-build-info {"cliVersion":"0.146.0","sdkVersion":"0.144.0"}
+//# debugId=1702690161D073CA64756E2164756E21
+//# warmhub-cli-build-info {"cliVersion":"0.148.0","sdkVersion":"0.146.0"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@warmhub/cli",
-  "version": "0.146.0",
+  "version": "0.148.0",
   "private": false,
   "type": "module",
   "description": "The wh CLI for WarmHub — create repos, commit and query data, and compound knowledge with your AI agents.",