@warmhub/cli 0.52.1 → 0.54.0

package/dist/wh.js

@@ -18914,6 +18914,10 @@ var RUNTIME_ACCESS_BUILTINS = new Set([
   "ComponentConfig",
   ...BUILTIN_SHAPE_NAMES
 ]);
+var SUBSCRIPTION_TRIGGER_BUILTINS = new Set([
+  "ComponentInstall",
+  "ComponentConfig"
+]);
 function validateProvisioning(obj, path, errors) {
   if (!("provisioning" in obj))
     return;
@@ -19206,8 +19210,19 @@ function validateManifestSemantics(manifest) {
   }
   const shapeNames = new Set(manifest.shapes.map((s) => s.name));
   const credentialNames = new Set(manifest.credentials.map((c) => c.name));
-  const knownShapes = new Set([...shapeNames, "ComponentConfig"]);
+  const knownSubscriptionTriggerShapes = new Set([
+    ...shapeNames,
+    ...SUBSCRIPTION_TRIGGER_BUILTINS
+  ]);
+  const knownSeedShapes = new Set([...shapeNames, "ComponentConfig"]);
   for (const sub of manifest.subscriptions) {
+    if (sub.trigger.kind === "event" && !knownSubscriptionTriggerShapes.has(sub.trigger.shape)) {
+      findings.push({
+        level: "error",
+        code: "MISSING_SUBSCRIPTION_TRIGGER_SHAPE_REF",
+        message: `subscription "${sub.name}" trigger references shape "${sub.trigger.shape}" which is not declared and is not a supported subscription trigger built-in`
+      });
+    }
     if (sub.credentials) {
       if (sub.credentials.length > 1) {
         findings.push({
@@ -19236,7 +19251,7 @@ function validateManifestSemantics(manifest) {
     }
   }
   for (const seed of manifest.seeds) {
-    if (!knownShapes.has(seed.shape)) {
+    if (!knownSeedShapes.has(seed.shape)) {
       findings.push({
         level: "error",
         code: "MISSING_SHAPE_REF",
@@ -19381,6 +19396,11 @@ function joinFieldIdentityPath(...segments) {
 function joinFieldPathWithEscaper(escapeSegment, segments) {
   return segments.map((segment) => typeof segment === "number" ? `[${segment}]` : escapeSegment(segment)).join(".").replace(/\.\[/g, "[");
 }
+// ../../packages/rules/src/permission-scopes.ts
+var PUBLIC_ORG_PERMISSIONS = new Set([
+  "org:read",
+  "components:read"
+]);
 // ../../packages/rules/src/platform-status.ts
 var PLATFORM_STATUS_CATALOG_SHAPE = "PlatformStatusCatalog";
 var PLATFORM_STATUS_CATALOG_NAME = "main";
@@ -21213,6 +21233,7 @@ function nestedObjectFields(typeDef) {
 }
 // ../../packages/rules/src/system-components/system.ts
 var SYSTEM_COMPONENT_ID = "com.warmhub.system";
+var SYSTEM_REGISTERED_COMPONENT_REF = "warmhub/system";
 var COMPONENT_INSTALL_FIELDS = {
   componentId: "string",
   name: "string",
@@ -21273,7 +21294,7 @@ function findSystemComponent(componentId) {
 // ../../packages/sdk-ts/package.json
 var package_default = {
   name: "@warmhub/sdk-ts",
-  version: "0.52.0",
+  version: "0.53.0",
   private: false,
   type: "module",
   description: "The TypeScript SDK for WarmHub — create repos, commit and query data, and compound knowledge with your AI agents.",
@@ -21601,7 +21622,7 @@ async function submitOperationsViaStream(client, args) {
           orgName: args.orgName,
           repoName: args.repoName,
           streamId,
-          componentId: args.componentId,
+          componentRef: args.componentRef,
           committer: args.committer,
           message: args.message,
           operations: chunk
@@ -22107,23 +22128,9 @@ class WarmHubClient {
     }
   };
   access = {
-    checkRepoPermission: async (orgName, repoName, permission) => {
-      try {
-        return await this.trpc.access.checkRepoPermission.query({
-          orgName,
-          repoName,
-          permission
-        });
-      } catch (error) {
-        throw toWarmHubError(error);
-      }
-    },
-    checkOrgPermission: async (orgName, permission) => {
+    resolve: async (input) => {
       try {
-        return await this.trpc.access.checkOrgPermission.query({
-          orgName,
-          permission
-        });
+        return await this.trpc.access.resolve.query(input);
       } catch (error) {
         throw toWarmHubError(error);
       }
@@ -22177,12 +22184,23 @@ class WarmHubClient {
         throw toWarmHubError(error);
       }
     },
-    get: async (orgName, repoName, componentId) => {
+    search: async (query, opts) => {
+      try {
+        return await this.trpc.component.search.query({
+          query,
+          limit: opts?.limit,
+          cursor: opts?.cursor
+        });
+      } catch (error) {
+        throw toWarmHubError(error);
+      }
+    },
+    get: async (orgName, repoName, componentRef) => {
       try {
         return await this.trpc.component.get.query({
           orgName,
           repoName,
-          componentId
+          componentRef
         });
       } catch (error) {
         throw toWarmHubError(error);
@@ -22277,7 +22295,7 @@ class WarmHubClient {
           repoName,
           committer: opts?.committer,
           message,
-          componentId: opts?.componentId,
+          componentRef: opts?.componentRef,
           chunkSize: opts?.chunkSize,
           skipExisting: opts?.skipExisting,
           streamId: opts?.streamId,
@@ -22512,6 +22530,17 @@ class WarmHubClient {
         throw toWarmHubError(error);
       }
     },
+    search: async (query, opts) => {
+      try {
+        return await this.trpc.repo.search.query({
+          query,
+          limit: opts?.limit,
+          cursor: opts?.cursor
+        });
+      } catch (error) {
+        throw toWarmHubError(error);
+      }
+    },
     create: async (orgName, repoName, description, visibility, displayName) => {
       try {
         return await this.trpc.repo.create.mutate({
@@ -22715,7 +22744,7 @@ class WarmHubClient {
           orgName,
           repoName,
           match: opts?.match,
-          componentId: opts?.componentId,
+          componentRef: opts?.componentRef,
           excludeComponents: opts?.excludeComponents,
           includeRetracted: opts?.includeRetracted
         });
@@ -23061,7 +23090,7 @@ class WarmHubClient {
           includeRetracted: opts?.includeRetracted,
           limit: opts?.limit,
           cursor: opts?.cursor,
-          componentId: opts?.componentId,
+          componentRef: opts?.componentRef,
           excludeComponents: opts?.excludeComponents,
           excludeInfraShapes: opts?.excludeInfraShapes,
           where: opts?.where
@@ -23282,7 +23311,7 @@ class WarmHubClient {
           resolveCollections: opts?.resolveCollections,
           limit: opts?.limit,
           cursor: opts?.cursor,
-          componentId: opts?.componentId,
+          componentRef: opts?.componentRef,
           excludeComponents: opts?.excludeComponents,
           excludeInfraShapes: opts?.excludeInfraShapes,
           where: opts?.where
@@ -23313,7 +23342,7 @@ class WarmHubClient {
           resolveCollections: opts?.resolveCollections,
           limit: opts?.limit,
           cursor: opts?.cursor,
-          componentId: opts?.componentId,
+          componentRef: opts?.componentRef,
           excludeComponents: opts?.excludeComponents,
           excludeInfraShapes: opts?.excludeInfraShapes,
           mode: opts?.mode
@@ -23334,7 +23363,7 @@ class WarmHubClient {
           match: opts?.match,
           includeRetracted: opts?.includeRetracted,
           resolveCollections: opts?.resolveCollections,
-          componentId: opts?.componentId,
+          componentRef: opts?.componentRef,
           excludeComponents: opts?.excludeComponents,
           excludeInfraShapes: opts?.excludeInfraShapes,
           where: opts?.where
@@ -24698,37 +24727,65 @@ function makeStderrSink(minLevel) {
 function enforceLineCap(record) {
   const initial = `${JSON.stringify(record)}
 `;
-  if (initial.length <= LINE_CAP + 1)
+  if (lineByteLength(initial) <= LINE_CAP + 1)
     return initial;
   const trimmed = { ...record };
   for (let pass = 0;pass < 8; pass++) {
     const candidate = `${JSON.stringify(trimmed)}
 `;
-    if (candidate.length <= LINE_CAP + 1)
+    if (lineByteLength(candidate) <= LINE_CAP + 1)
       return candidate;
     let largestKey = null;
     let largestLen = 0;
     for (const [key, val] of Object.entries(trimmed)) {
-      if (typeof val === "string" && val.length > largestLen) {
+      if (typeof val === "string") {
+        const byteLen = lineByteLength(val);
+        if (byteLen <= largestLen)
+          continue;
         largestKey = key;
-        largestLen = val.length;
+        largestLen = byteLen;
       }
     }
     if (largestKey === null)
       break;
-    const overage = candidate.length - LINE_CAP - 1;
+    const overage = lineByteLength(candidate) - LINE_CAP - 1;
     const current = trimmed[largestKey];
-    const allowed = Math.max(0, current.length - overage - TRUNCATED_MARKER.length);
-    trimmed[largestKey] = `${current.slice(0, allowed)}${TRUNCATED_MARKER}`;
+    const allowedBytes = Math.max(0, lineByteLength(current) - overage - lineByteLength(TRUNCATED_MARKER));
+    trimmed[largestKey] = `${sliceUtf8Bytes(current, allowedBytes)}${TRUNCATED_MARKER}`;
   }
-  return `${JSON.stringify({
+  const fallback = {
     v: trimmed.v,
     ts: trimmed.ts,
     level: trimmed.level,
     msg: trimmed.msg,
     truncated: TRUNCATED_MARKER
-  })}
+  };
+  let line = `${JSON.stringify(fallback)}
+`;
+  if (lineByteLength(line) <= LINE_CAP + 1)
+    return line;
+  const emptyMsgLine = `${JSON.stringify({ ...fallback, msg: "" })}
+`;
+  const msgBudget = Math.max(0, LINE_CAP + 1 - lineByteLength(emptyMsgLine));
+  fallback.msg = sliceUtf8Bytes(fallback.msg, msgBudget);
+  line = `${JSON.stringify(fallback)}
 `;
+  return line;
+}
+function lineByteLength(value) {
+  return Buffer.byteLength(value, "utf8");
+}
+function sliceUtf8Bytes(value, maxBytes) {
+  let bytes = 0;
+  let result = "";
+  for (const char of value) {
+    const charBytes = lineByteLength(char);
+    if (bytes + charBytes > maxBytes)
+      break;
+    result += char;
+    bytes += charBytes;
+  }
+  return result;
 }
 function rotateIfNeeded(path, dir) {
   if (!existsSync(path))
@@ -25176,7 +25233,7 @@ function loadProfileStore(path) {
   } catch (cause) {
     throw corruptedAuthError(p, cause);
   }
-  if (parsed === null || typeof parsed !== "object" || parsed.version !== 1 || parsed.profiles === null || typeof parsed.profiles !== "object") {
+  if (parsed === null || typeof parsed !== "object" || parsed.version !== 1 || parsed.profiles === null || typeof parsed.profiles !== "object" || Array.isArray(parsed.profiles)) {
     throw corruptedAuthError(p);
   }
   return parsed;
@@ -25403,10 +25460,11 @@ async function getValidToken(profile) {
         });
         await delay(1000);
         log.info("auth.refresh.retry", { profile: profileName, attempt: 2 });
+        let retryStarted = Date.now();
         try {
           const retryProf = getProfile(profileName, authPath);
           const retryTokens = retryProf?.tokens ?? lockedTokens;
-          const retryStarted = Date.now();
+          retryStarted = Date.now();
           const refreshed = await refreshAccessToken(retryTokens);
           saveProfileWhileLocked(profileName, { ...retryProf ?? lockedProf, tokens: refreshed }, authPath);
           log.info("auth.refresh.ok", {
@@ -25421,7 +25479,7 @@ async function getValidToken(profile) {
           const fields = {
             profile: profileName,
             classification,
-            duration_ms: Date.now() - refreshStarted,
+            duration_ms: Date.now() - retryStarted,
             error_name: retryErr instanceof Error ? retryErr.name : "Unknown",
             on_retry: true
           };
@@ -25481,20 +25539,34 @@ function recordBenchmarkResponse(response, benchmarkId) {
     benchmarkTelemetry.requestDbQueryCountSum += requestDbQueryCount;
   }
 }
-function createBenchmarkAwareFetch(benchmarkId) {
-  if (!benchmarkId)
+function createBenchmarkAwareFetch(benchmarkId, signal) {
+  if (!benchmarkId && !signal)
     return;
   return async (input, init) => {
     const headers = new Headers(init?.headers);
-    headers.set(BENCHMARK_HEADER, benchmarkId);
+    if (benchmarkId)
+      headers.set(BENCHMARK_HEADER, benchmarkId);
     const response = await fetch(input, {
       ...init,
-      headers
+      headers,
+      signal: mergeAbortSignals(init?.signal, signal)
     });
-    recordBenchmarkResponse(response, benchmarkId);
+    if (benchmarkId)
+      recordBenchmarkResponse(response, benchmarkId);
     return response;
   };
 }
+function mergeAbortSignals(requestSignal, liveSignal) {
+  if (!requestSignal)
+    return liveSignal;
+  if (!liveSignal)
+    return requestSignal;
+  if (requestSignal.aborted)
+    return requestSignal;
+  if (liveSignal.aborted)
+    return liveSignal;
+  return AbortSignal.any([requestSignal, liveSignal]);
+}
 function resetBenchmarkTelemetry() {
   benchmarkTelemetry = emptyBenchmarkTelemetry();
 }
@@ -25522,18 +25594,34 @@ function createClient(config, opts = {}) {
 function wantsStructuredLiveOutput(format) {
   return format === "json" || format === "jsonl";
 }
+var LIVE_ABORTED = Symbol("live-aborted");
+function pollUntilAbort(poll, signal) {
+  if (signal.aborted)
+    return Promise.resolve(LIVE_ABORTED);
+  return new Promise((resolve, reject) => {
+    const onAbort = () => resolve(LIVE_ABORTED);
+    signal.addEventListener("abort", onAbort, { once: true });
+    poll.then((result) => {
+      signal.removeEventListener("abort", onAbort);
+      resolve(result);
+    }, (error) => {
+      signal.removeEventListener("abort", onAbort);
+      reject(error);
+    });
+  });
+}
 async function runLive(opts) {
   const auth = opts.auth ?? {
     getToken: async () => await getValidToken(opts.profile) ?? undefined
   };
   const benchmarkId = process.env.WH_BENCHMARK_ID?.trim();
+  const controller = new AbortController;
   const client = new WarmHubClient({
     apiUrl: opts.apiUrl,
     auth,
-    fetch: createBenchmarkAwareFetch(benchmarkId),
+    fetch: createBenchmarkAwareFetch(benchmarkId, controller.signal),
     functionLogs: opts.functionLogs
   });
-  const controller = new AbortController;
   if (opts.signal) {
     if (opts.signal.aborted)
       controller.abort();
@@ -25557,7 +25645,12 @@ async function runLive(opts) {
       startTimer = setTimeout(() => controller.abort(), opts.startTimeoutMs);
     }
     while (!controller.signal.aborted) {
-      const result = await opts.poll(client);
+      const poll = opts.poll(client, controller.signal);
+      const result = await pollUntilAbort(poll, controller.signal);
+      if (result === LIVE_ABORTED) {
+        poll.catch(() => {});
+        break;
+      }
       updates += 1;
       if (startTimer) {
         clearTimeout(startTimer);
@@ -26130,9 +26223,34 @@ function writeOutput(ctx, data, prettyFn) {
   }
   prettyFn();
 }
-function emitPartialPageHint(ctx, count, nextCursor, limit) {
+function pageEnvelope(items, opts) {
+  const nextCursor = opts.nextCursor ?? null;
+  return {
+    items,
+    page: {
+      limit: opts.limit,
+      count: items.length,
+      hasMore: nextCursor !== null,
+      nextCursor
+    }
+  };
+}
+function writePageOutput(ctx, items, opts, prettyFn) {
+  if (ctx.format === "json") {
+    printJson(ctx.out, pageEnvelope(items, opts));
+    return;
+  }
+  if (ctx.format === "jsonl") {
+    printJsonl(ctx.out, items);
+    return;
+  }
+  prettyFn();
+}
+function emitPartialPageHint(ctx, count, _nextCursor, _limit) {
+  if (ctx.format === "json" || ctx.format === "jsonl")
+    return;
   const c = ctx.colors;
-  ctx.status(`${c.yellow}${count} shown, more available${c.reset} — use ${c.cyan}--all${c.reset} to fetch every page, ` + `or re-run the same command plus ${c.cyan}--limit=${limit} --cursor=${nextCursor}${c.reset} to resume from here.`);
+  ctx.status(`${c.yellow}${count} shown; more available${c.reset}. Use ${c.cyan}--all${c.reset} to fetch every page.`);
 }
 
 // ../../packages/warmhub-cli/src/domains/thing/shared.ts
@@ -26208,7 +26326,7 @@ var handleAbout = async (ctx, { flags, args }) => {
       apiUrl: ctx.config.apiUrl,
       poll: (c) => c.thing.about(org, repo, wref, aboutOpts),
       render: (r) => {
-        renderAboutResult(ctx.out, ctx.colors, r, wref, boundedLimit);
+        renderAboutResult(ctx.out, ctx.colors, r, wref);
       },
       out: ctx.out,
       err: ctx.err,
@@ -26236,22 +26354,21 @@ var handleAbout = async (ctx, { flags, args }) => {
       cur = page.nextCursor;
     }
     const result2 = { target, assertions, nextCursor: undefined };
-    writeOutput(ctx, result2, () => renderAboutResult(ctx.out, ctx.colors, result2, wref, boundedLimit));
+    writePageOutput(ctx, assertions, { limit: pageLimit, nextCursor: null }, () => renderAboutResult(ctx.out, ctx.colors, result2, wref));
     return;
   }
   const result = await fetchPage(cursor);
   if (result.nextCursor) {
     emitPartialPageHint(ctx, result.assertions.length, result.nextCursor, boundedLimit);
   }
-  writeOutput(ctx, result, () => renderAboutResult(ctx.out, ctx.colors, result, wref, boundedLimit));
+  writePageOutput(ctx, result.assertions, { limit: boundedLimit, nextCursor: result.nextCursor ?? null }, () => renderAboutResult(ctx.out, ctx.colors, result, wref));
 };
-function renderAboutResult(out, c, result, wref, limit) {
-  const resumeHint = `${c.dim}Next: --limit=${limit} --cursor=${result.nextCursor}${c.reset}`;
+function renderAboutResult(out, c, result, wref) {
   out(`${c.bold}Assertions about${c.reset} ${pinnedWref(c, wref)}  (${result.assertions.length}${result.nextCursor ? "+" : ""})`);
   if (result.assertions.length === 0) {
     out(`  ${c.dim}(no assertions found)${c.reset}`);
     if (result.nextCursor) {
-      out(resumeHint);
+      out(`${c.dim}More available. Use --all to fetch every page.${c.reset}`);
     }
     return;
   }
@@ -26259,7 +26376,7 @@ function renderAboutResult(out, c, result, wref, limit) {
     renderAboutAssertion(out, c, a, "  ");
   }
   if (result.nextCursor) {
-    out(resumeHint);
+    out(`${c.dim}More available. Use --all to fetch every page.${c.reset}`);
   }
 }
 function renderAboutAssertion(out, c, assertion, indent) {
@@ -26570,14 +26687,14 @@ function renderBatchView(out, c, result, wrefs, flagsVersion) {
 // ../../packages/warmhub-cli/src/domains/thing/graph.ts
 var graphFlags = {
   depth: flag.number({
-    description: "Resolve embedded graph to this depth (default: 2, max: 5)"
+    description: "Resolve outbound wref fields, assertion backlinks, and assertion about targets to this depth (default: 2, max: 5)"
   }),
   version: flag.number({ description: "Specific version number" })
 };
 var handleThingGraph = async (ctx, { flags, args }) => {
   const wref = args[0];
   if (!wref) {
-    usageError("Usage: wh thing graph <wref> [--depth N]", "wh thing graph Game/base");
+    usageError("Usage: wh thing graph <wref> [--depth N]", "wh thing graph Game/base", "wh thing refs Game/base --inbound");
   }
   const depth = flags.depth;
   if (depth !== undefined && (depth < 1 || depth > 5)) {
@@ -26672,7 +26789,10 @@ var handleHistory = async (ctx, { flags, args }) => {
   if (!all && result.nextCursor) {
     emitPartialPageHint(ctx, (result.versions ?? []).length, result.nextCursor, boundedLimit);
   }
-  writeOutput(ctx, result, () => renderHistory(ctx.out, ctx.colors, result));
+  writePageOutput(ctx, result.versions ?? [], {
+    limit: all ? pageLimit : boundedLimit,
+    nextCursor: result.nextCursor ?? null
+  }, () => renderHistory(ctx.out, ctx.colors, result));
 };
 async function fetchAllHistoryPages(ctx, org, repo, opts) {
   const versions = [];
@@ -26758,8 +26878,8 @@ function validateKind(value, flagName = "--kind") {
 function resolveRepoContext(ctx) {
   return parseOrgRepo(getRepoRef(ctx), ctx.config);
 }
-function validateComponentFilters(componentId, excludeComponents, ...examples) {
-  if (componentId && excludeComponents) {
+function validateComponentFilters(componentRef, excludeComponents, ...examples) {
+  if (componentRef && excludeComponents) {
     usageError("Cannot combine --component with --exclude-components.", ...examples);
   }
 }
@@ -26835,7 +26955,7 @@ var headFlags = {
     description: "Include retracted things"
   }),
   component: flag.string({
-    description: "Filter to things owned by this component ID"
+    description: "Filter to things owned by this component (Org/Name ref)"
   }),
   "exclude-components": flag.boolean({
     description: "Exclude component-owned things from results"
@@ -26861,15 +26981,15 @@ var handleHead = async (ctx, { flags, args }) => {
     if (cursor || all || limit || ctx.liveMode) {
       usageError("Usage: wh thing list --count [--shape SHAPE] [--kind KIND] [--match PATTERN]", "wh thing list --shape Player --count");
     }
-    const componentId2 = flags.component;
+    const componentRef2 = flags.component;
     const strictExclude2 = !!flags["exclude-components"];
-    validateComponentFilters(componentId2, strictExclude2, "wh thing list --component com.example.pkg");
+    validateComponentFilters(componentRef2, strictExclude2, "wh thing list --component acme/veritas");
     return handleCount(ctx, org, repo, {
       shape,
       kind,
       match,
       includeRetracted,
-      componentId: componentId2,
+      componentRef: componentRef2,
       excludeComponents: strictExclude2,
       excludeInfraShapes: !strictExclude2 && !shape,
       where: where.length > 0 ? where : undefined
@@ -26883,10 +27003,10 @@ var handleHead = async (ctx, { flags, args }) => {
   }
   const boundedLimit = Math.min(limit ?? DEFAULT_PAGE_LIMIT, MAX_PAGE_LIMIT);
   const pageLimit = all ? Math.min(limit ?? AUTO_PAGE_LIMIT, MAX_PAGE_LIMIT) : boundedLimit;
-  const componentId = flags.component;
+  const componentRef = flags.component;
   const hasShape = !!shape;
   const strictExclude = !!flags["exclude-components"];
-  validateComponentFilters(componentId, strictExclude, "wh thing list --component com.example.pkg");
+  validateComponentFilters(componentRef, strictExclude, "wh thing list --component acme/veritas");
   const excludeComponents = strictExclude;
   const excludeInfraShapes = !strictExclude && !hasShape;
   const headOpts = {
@@ -26896,7 +27016,7 @@ var handleHead = async (ctx, { flags, args }) => {
     includeRetracted,
     limit: pageLimit,
     cursor,
-    componentId,
+    componentRef,
     excludeComponents,
     excludeInfraShapes,
     where: where.length > 0 ? where : undefined
@@ -26928,7 +27048,7 @@ var handleHead = async (ctx, { flags, args }) => {
     includeRetracted,
     limit: pageLimit,
     cursor,
-    componentId,
+    componentRef,
     excludeComponents,
     excludeInfraShapes,
     where: where.length > 0 ? where : undefined
@@ -26939,7 +27059,7 @@ var handleHead = async (ctx, { flags, args }) => {
     includeRetracted,
     limit: boundedLimit,
     cursor,
-    componentId,
+    componentRef,
     excludeComponents,
     excludeInfraShapes,
     where: where.length > 0 ? where : undefined
@@ -26947,7 +27067,10 @@ var handleHead = async (ctx, { flags, args }) => {
   if (!all && result.nextCursor) {
     emitPartialPageHint(ctx, (result.items ?? []).length, result.nextCursor, boundedLimit);
   }
-  writeOutput(ctx, result, () => renderHead(ctx.out, ctx.colors, ctx.chars, result, org, repo, shape, kind));
+  writePageOutput(ctx, result.items ?? [], {
+    limit: all ? pageLimit : boundedLimit,
+    nextCursor: result.nextCursor ?? null
+  }, () => renderHead(ctx.out, ctx.colors, ctx.chars, result, org, repo, shape, kind));
 };
 async function fetchAllHeadPages(ctx, org, repo, opts) {
   const items = [];
@@ -26960,7 +27083,7 @@ async function fetchAllHeadPages(ctx, org, repo, opts) {
       includeRetracted: opts.includeRetracted,
       limit: opts.limit,
       cursor,
-      componentId: opts.componentId,
+      componentRef: opts.componentRef,
       excludeComponents: opts.excludeComponents,
       excludeInfraShapes: opts.excludeInfraShapes,
       where: opts.where
@@ -26992,7 +27115,7 @@ var queryFlags = {
     description: "Include assertions about collections (Pair/Triple/Set/List) containing the target. Only applies with --about."
   }),
   component: flag.string({
-    description: "Filter to things owned by this component ID"
+    description: "Filter to things owned by this component (Org/Name ref)"
   }),
   "exclude-components": flag.boolean({
     description: "Exclude component-owned things from results"
@@ -27014,10 +27137,10 @@ var handleQuery = async (ctx, { flags }) => {
   const count = flags.count;
   const includeRetracted = flags["include-retracted"];
   const resolveCollections = flags["resolve-collections"];
-  const componentId = flags.component;
+  const componentRef = flags.component;
   const hasShape = !!shape;
   const strictExclude = !!flags["exclude-components"];
-  validateComponentFilters(componentId, strictExclude, "wh thing query --component com.example.pkg");
+  validateComponentFilters(componentRef, strictExclude, "wh thing query --component acme/veritas");
   const excludeComponents = strictExclude;
   const excludeInfraShapes = !strictExclude && !hasShape;
   const c = ctx.colors;
@@ -27034,7 +27157,7 @@ var handleQuery = async (ctx, { flags }) => {
       about,
       includeRetracted,
       resolveCollections,
-      componentId,
+      componentRef,
       excludeComponents,
       excludeInfraShapes,
       where: where.length > 0 ? where : undefined
@@ -27057,7 +27180,7 @@ var handleQuery = async (ctx, { flags }) => {
     resolveCollections,
     limit: pageLimit,
     cursor,
-    componentId,
+    componentRef,
     excludeComponents,
     excludeInfraShapes,
     where: where.length > 0 ? where : undefined
@@ -27091,7 +27214,7 @@ var handleQuery = async (ctx, { flags }) => {
     resolveCollections,
     limit: pageLimit,
     cursor,
-    componentId,
+    componentRef,
     excludeComponents,
     excludeInfraShapes,
     where: where.length > 0 ? where : undefined
@@ -27104,7 +27227,7 @@ var handleQuery = async (ctx, { flags }) => {
     resolveCollections,
     limit: boundedLimit,
     cursor,
-    componentId,
+    componentRef,
     excludeComponents,
     excludeInfraShapes,
     where: where.length > 0 ? where : undefined
@@ -27112,7 +27235,10 @@ var handleQuery = async (ctx, { flags }) => {
   if (!all && result.nextCursor) {
     emitPartialPageHint(ctx, (result.items ?? []).length, result.nextCursor, boundedLimit);
   }
-  writeOutput(ctx, result, () => renderQueryResults(ctx.out, c, result));
+  writePageOutput(ctx, result.items ?? [], {
+    limit: all ? pageLimit : boundedLimit,
+    nextCursor: result.nextCursor ?? null
+  }, () => renderQueryResults(ctx.out, c, result));
 };
 async function fetchAllQueryPages(ctx, org, repo, opts) {
   const items = [];
@@ -27127,7 +27253,7 @@ async function fetchAllQueryPages(ctx, org, repo, opts) {
       resolveCollections: opts.resolveCollections,
       limit: opts.limit,
       cursor,
-      componentId: opts.componentId,
+      componentRef: opts.componentRef,
       excludeComponents: opts.excludeComponents,
       excludeInfraShapes: opts.excludeInfraShapes,
       where: opts.where
@@ -27218,7 +27344,7 @@ var handleRefs = async (ctx, { flags, args }) => {
       cur = page.nextCursor;
     }
     const result2 = { items, nextCursor: undefined };
-    writeOutput(ctx, result2, () => renderRefs(ctx.out, ctx.colors, result2, wref, direction));
+    writePageOutput(ctx, items, { limit: pageLimit, nextCursor: null }, () => renderRefs(ctx.out, ctx.colors, result2, wref, direction));
     maybeEmitAboutHint(ctx, direction, items.length, refsQueryIsNarrowed);
     return;
   }
@@ -27226,7 +27352,7 @@ var handleRefs = async (ctx, { flags, args }) => {
   if (result.nextCursor) {
     emitPartialPageHint(ctx, (result.items ?? []).length, result.nextCursor, boundedLimit);
   }
-  writeOutput(ctx, result, () => renderRefs(ctx.out, ctx.colors, result, wref, direction));
+  writePageOutput(ctx, result.items ?? [], { limit: boundedLimit, nextCursor: result.nextCursor ?? null }, () => renderRefs(ctx.out, ctx.colors, result, wref, direction));
   maybeEmitAboutHint(ctx, direction, result.items?.length ?? 0, refsQueryIsNarrowed);
 };
 function maybeEmitAboutHint(ctx, direction, itemCount, refsQueryIsNarrowed) {
@@ -27405,7 +27531,7 @@ var searchFlags = {
   cursor: flag.string({ description: "Opaque pagination cursor (text mode)" }),
   all: flag.boolean({ description: "Fetch all pages (text mode)" }),
   component: flag.string({
-    description: "Filter to things owned by this component ID"
+    description: "Filter to things owned by this component (Org/Name ref)"
   }),
   "exclude-components": flag.boolean({
     description: "Exclude component-owned things from results"
@@ -27442,10 +27568,10 @@ var handleSearch = async (ctx, { flags, args }) => {
   const pageLimit = all ? Math.min(limit ?? AUTO_PAGE_LIMIT, MAX_PAGE_LIMIT) : boundedTextLimit;
   const resolveCollections = mode !== "hybrid" ? flags["resolve-collections"] : undefined;
   const supportsComponentFilters = !mode || mode === "text";
-  const componentId = supportsComponentFilters ? flags.component : undefined;
+  const componentRef = supportsComponentFilters ? flags.component : undefined;
   const hasShape = !!flags.shape;
   const strictExclude = supportsComponentFilters ? !!flags["exclude-components"] : false;
-  validateComponentFilters(componentId, strictExclude, 'wh thing search "policy" --component com.example.pkg');
+  validateComponentFilters(componentRef, strictExclude, 'wh thing search "policy" --component acme/veritas');
   const excludeComponents = supportsComponentFilters && strictExclude ? true : undefined;
   const excludeInfraShapes = supportsComponentFilters && !strictExclude && !hasShape ? true : undefined;
   const rawResult = all ? await fetchAllSearchPages(ctx, org, repo, queryText, {
@@ -27456,7 +27582,7 @@ var handleSearch = async (ctx, { flags, args }) => {
     resolveCollections,
     limit: pageLimit,
     cursor,
-    componentId,
+    componentRef,
     excludeComponents,
     excludeInfraShapes
   }) : await ctx.client.thing.search(org, repo, queryText, {
@@ -27468,7 +27594,7 @@ var handleSearch = async (ctx, { flags, args }) => {
     limit: boundedTextLimit,
     cursor,
     mode,
-    componentId,
+    componentRef,
     excludeComponents,
     excludeInfraShapes
   });
@@ -27479,7 +27605,10 @@ var handleSearch = async (ctx, { flags, args }) => {
   if (!all && result.nextCursor) {
     emitPartialPageHint(ctx, result.items.length, result.nextCursor, boundedTextLimit);
   }
-  writeOutput(ctx, result, () => renderQueryResults(ctx.out, c, result));
+  writePageOutput(ctx, result.items, {
+    limit: all ? pageLimit : boundedTextLimit,
+    nextCursor: result.nextCursor ?? null
+  }, () => renderQueryResults(ctx.out, c, result));
 };
 async function fetchAllSearchPages(ctx, org, repo, queryText, opts) {
   const items = [];
@@ -27494,7 +27623,7 @@ async function fetchAllSearchPages(ctx, org, repo, queryText, opts) {
       limit: opts.limit,
       cursor,
       mode: "text",
-      componentId: opts.componentId,
+      componentRef: opts.componentRef,
       excludeComponents: opts.excludeComponents,
       excludeInfraShapes: opts.excludeInfraShapes
     });
@@ -27847,13 +27976,16 @@ var THING_DOMAIN = defineDomain({
     },
     graph: {
       prime: true,
-      summary: "Fetch a thing's graph (forward + reverse references) at a given depth",
+      summary: "Fetch a thing's graph (outbound wref fields, assertion backlinks, and assertion about targets)",
       args: "<wref>",
       flags: graphFlags,
       examples: [
         "wh thing graph Game/base",
         "wh thing graph Game/base --depth 2"
       ],
+      notes: [
+        "`graph` does not traverse inbound wref-field references; use `wh thing refs <wref> --inbound` to find things whose fields point at this thing."
+      ],
       handler: handleThingGraph
     }
   }
@@ -28161,7 +28293,10 @@ var handleHistory2 = async (ctx, { flags, args }) => {
     versions,
     nextCursor: flags.all ? undefined : nextCursor
   };
-  writeOutput(ctx, result, () => renderHistory(ctx.out, ctx.colors, result));
+  if (!flags.all && result.nextCursor) {
+    emitPartialPageHint(ctx, result.versions.length, result.nextCursor, limit);
+  }
+  writePageOutput(ctx, result.versions, { limit, nextCursor: result.nextCursor ?? null }, () => renderHistory(ctx.out, ctx.colors, result));
 };
 var handleCreate2 = async (ctx, { flags, args }) => {
   const { org, repo } = parseOrgRepo(getRepoRef(ctx) ?? args[0], ctx.config);
@@ -28291,7 +28426,10 @@ var handleList = async (ctx, { flags, args }) => {
     if (!all && result2.nextCursor) {
       emitPartialPageHint(ctx, (result2.items ?? []).length, result2.nextCursor, boundedLimit);
     }
-    writeOutput(ctx, result2, () => renderHead(ctx.out, ctx.colors, ctx.chars, result2, org, repo, shape, "assertion"));
+    writePageOutput(ctx, result2.items ?? [], {
+      limit: all ? pageLimit : boundedLimit,
+      nextCursor: result2.nextCursor ?? null
+    }, () => renderHead(ctx.out, ctx.colors, ctx.chars, result2, org, repo, shape, "assertion"));
     return;
   }
   const aboutOpts = {
@@ -28343,7 +28481,10 @@ var handleList = async (ctx, { flags, args }) => {
   if (!all && result.nextCursor) {
     emitPartialPageHint(ctx, (result.assertions ?? []).length, result.nextCursor, boundedLimit);
   }
-  writeOutput(ctx, result, () => renderAbout(ctx.out, ctx.colors, result));
+  writePageOutput(ctx, result.assertions ?? [], {
+    limit: all ? pageLimit : boundedLimit,
+    nextCursor: result.nextCursor ?? null
+  }, () => renderAbout(ctx.out, ctx.colors, result));
 };
 async function fetchAllAssertionAboutPages(ctx, org, repo, wref, opts) {
   const assertions = [];
@@ -29417,7 +29558,7 @@ function ndjsonMessage(msg) {
   return `${JSON.stringify(msg)}
 `;
 }
-function createMessageReader(input, onMessage) {
+function createMessageReader(input, onMessage, onError = () => {}) {
   let buffer = "";
   let mode = null;
   function drain() {
@@ -29440,9 +29581,12 @@ function createMessageReader(input, onMessage) {
             continue;
           }
         } else {
-          const idx = buffer.indexOf(HEADER_DELIMITER);
-          if (idx !== -1) {
-            buffer = buffer.slice(idx + 4);
+          const headerEnd = buffer.indexOf(HEADER_DELIMITER);
+          if (headerEnd !== -1) {
+            const resyncFrom = headerEnd + HEADER_DELIMITER.length;
+            const nextHeaderMatch = /Content-Length:/i.exec(buffer.slice(resyncFrom));
+            const nextHeader = nextHeaderMatch === null ? -1 : resyncFrom + nextHeaderMatch.index;
+            buffer = nextHeader === -1 ? "" : buffer.slice(nextHeader);
             continue;
           }
         }
@@ -29462,12 +29606,14 @@ function createMessageReader(input, onMessage) {
   };
   input.setEncoding("utf8");
   input.on("data", onData);
+  input.on("error", onError);
   if ("resume" in input && typeof input.resume === "function") {
     input.resume();
   }
   return {
     close() {
       input.removeListener("data", onData);
+      input.removeListener("error", onError);
     }
   };
 }
@@ -29477,9 +29623,25 @@ var MCP_PROTOCOL_VERSION2 = "2025-11-25";
 function createChannelServer(opts) {
   let reader = null;
   let resolveReady;
-  const onReady = new Promise((resolve) => {
+  let rejectReady;
+  let readySettled = false;
+  const onReady = new Promise((resolve, reject) => {
     resolveReady = resolve;
+    rejectReady = reject;
   });
+  function settleReady() {
+    if (readySettled)
+      return;
+    readySettled = true;
+    resolveReady();
+  }
+  function failReady(error) {
+    if (readySettled)
+      return;
+    readySettled = true;
+    reader?.close();
+    rejectReady(error);
+  }
   function send(msg) {
     opts.output.write(ndjsonMessage(msg));
   }
@@ -29502,7 +29664,7 @@ function createChannelServer(opts) {
       return;
     }
     if (method === "notifications/initialized") {
-      resolveReady();
+      settleReady();
       return;
     }
     if (method === "ping") {
@@ -29519,7 +29681,7 @@ function createChannelServer(opts) {
   }
   return {
     start() {
-      reader = createMessageReader(opts.input, handleMessage);
+      reader = createMessageReader(opts.input, handleMessage, failReady);
     },
     notify(content, meta) {
       send({
@@ -29531,6 +29693,7 @@ function createChannelServer(opts) {
     onReady,
     close() {
       reader?.close();
+      settleReady();
     }
   };
 }
@@ -29593,7 +29756,16 @@ var handleChannel = async (ctx) => {
     else
       signal.addEventListener("abort", () => resolve("aborted"), { once: true });
   });
-  const ready = await Promise.race([server.onReady, aborted]);
+  let ready;
+  try {
+    ready = await Promise.race([server.onReady.then(() => {
+      return;
+    }), aborted]);
+  } catch (err) {
+    server.close();
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new CliError(4 /* Backend */, "BACKEND", `channel startup failed: ${msg}`);
+  }
   if (ready === "aborted") {
     server.close();
     return;
@@ -30969,13 +31141,16 @@ async function refreshFromSummaries(repoSlug, parsed, activeItems, client, now,
   const components = {};
   let detailReadFailures = 0;
   for (const item of activeItems) {
+    if (!item.ref)
+      continue;
+    const itemRef = item.ref;
     let detail;
     try {
-      detail = await client.component.get(parsed.org, parsed.repo, item.componentId);
+      detail = await client.component.get(parsed.org, parsed.repo, itemRef);
     } catch {
       detailReadFailures++;
       const previousEntry = previousCache?.components[item.componentName];
-      if (previousEntry?.componentId === item.componentId) {
+      if (previousEntry?.ref === itemRef) {
         components[item.componentName] = previousEntry;
       }
       continue;
@@ -30990,7 +31165,7 @@ async function refreshFromSummaries(repoSlug, parsed, activeItems, client, now,
     if (!ref)
       continue;
     components[item.componentName] = {
-      componentId: item.componentId,
+      ref: itemRef,
       ownerOrgName: ref.ownerOrgName,
       registeredComponentName: ref.registeredComponentName,
       version: manifest.component.version ?? item.version ?? "",
@@ -31350,7 +31525,7 @@ var handleComponentExec = async (ctx, { args, terminator }) => {
   }
   const method = entry.methods.find((m) => m.name === methodName);
   if (!method) {
-    throw new CliError(2 /* UserInput */, "USER_INPUT", `Method '${methodName}' not found on component '${componentName}'.`, undefined, `Available: ${entry.methods.map((m) => m.name).join(", ")}. Run wh component update ${componentName} --repo ${installRepo} if you expect a newer method.`);
+    throw new CliError(2 /* UserInput */, "USER_INPUT", `Method '${methodName}' not found on component '${componentName}'.`, undefined, `Available: ${entry.methods.map((m) => m.name).join(", ")}. Run wh component update ${entry.ref} --repo ${installRepo} if you expect a newer method.`);
   }
   if (helpRequested) {
     renderMethodHelp(ctx, componentName, method);
@@ -31402,6 +31577,40 @@ function formatReservedNameWarning(name) {
   return `warning: component name "${name}" shadows the builtin \`wh ${name}\` domain. Operators will need to invoke methods via \`wh component exec ${name} <method>\` — the shorthand \`wh ${name} <method>\` will route to the builtin instead.`;
 }
 
+// ../../packages/warmhub-cli/src/global-search-command.ts
+var DEFAULT_LIMIT = 25;
+async function runGlobalSearchCommand(ctx, args) {
+  const c = ctx.colors;
+  const first = await args.fetch({ limit: args.limit, cursor: args.cursor });
+  const items = [...first.items];
+  let nextCursor = first.nextCursor;
+  if (args.all) {
+    while (nextCursor) {
+      const page = await args.fetch({ limit: args.limit, cursor: nextCursor });
+      items.push(...page.items);
+      nextCursor = page.nextCursor;
+    }
+  }
+  if (!args.all && nextCursor) {
+    emitPartialPageHint(ctx, items.length, nextCursor, args.limit ?? DEFAULT_LIMIT);
+  }
+  writePageOutput(ctx, items, {
+    limit: args.limit ?? DEFAULT_LIMIT,
+    nextCursor: args.all ? null : nextCursor ?? null
+  }, () => {
+    if (items.length === 0) {
+      ctx.status(`${c.dim}No ${args.emptyLabel} matching "${args.query}"${c.reset}`);
+      return;
+    }
+    ctx.out(`${c.bold}${args.title}${c.reset} ${c.dim}"${args.query}"${c.reset}`);
+    ctx.out("");
+    for (const item of items) {
+      const desc = item.description ? `  ${c.dim}${item.description}${c.reset}` : "";
+      ctx.out(`  ${c.cyan}${item.orgName}/${item.name}${c.reset}${desc}`);
+    }
+  });
+}
+
 // ../../packages/warmhub-cli/src/manifest/name-resolution.ts
 function resolveManifestCredentialName(name, ctx) {
   return resolveComponentTemplate(name, {
@@ -31459,7 +31668,7 @@ async function ensureSharedInfra(client, org, repo) {
           name: shape.name,
           data: { fields: shape.fields }
         }
-      ], { componentId: SYSTEM_COMPONENT_ID });
+      ], { componentRef: SYSTEM_REGISTERED_COMPONENT_REF });
     } catch (err) {
       if (!isAlreadyExistsError(err)) {
         throw err;
@@ -31472,7 +31681,7 @@ async function ensureSharedInfra(client, org, repo) {
             name: shape.name,
             data: { fields: shape.fields }
           }
-        ], { componentId: SYSTEM_COMPONENT_ID });
+        ], { componentRef: SYSTEM_REGISTERED_COMPONENT_REF });
       } catch {}
     }
   }
@@ -31505,6 +31714,15 @@ async function doctorComponent(client, org, repo, componentId) {
     };
   }
   const componentName = typeof installData.name === "string" ? installData.name : componentId;
+  const registeredComponentRef = typeof installData.registeredComponentRef === "string" && installData.registeredComponentRef.length > 0 ? installData.registeredComponentRef : undefined;
+  if (!registeredComponentRef) {
+    findings.push({
+      resource: "ComponentInstall",
+      status: "error",
+      message: "Install record is missing registeredComponentRef"
+    });
+    return { componentId, componentName, state: "error", findings };
+  }
   const existingState = typeof installData.state === "string" ? installData.state : undefined;
   if (existingState === "error") {
     findings.push({
@@ -31543,12 +31761,12 @@ async function doctorComponent(client, org, repo, componentId) {
           message: `Shape "${shape.name}" exists but is inactive`
         });
       } else {
-        const shapeComponentId = s && typeof s === "object" && "componentId" in s ? s.componentId : undefined;
-        if (shapeComponentId !== undefined && shapeComponentId !== componentId) {
+        const shapeComponentRef = s && typeof s === "object" && "componentRef" in s ? s.componentRef : undefined;
+        if (shapeComponentRef !== undefined && shapeComponentRef !== registeredComponentRef) {
           findings.push({
             resource: `shape:${shape.name}`,
             status: "warning",
-            message: `Shape "${shape.name}" exists but is owned by "${shapeComponentId}"`
+            message: `Shape "${shape.name}" exists but is owned by "${shapeComponentRef}"`
           });
         } else {
           const expectedShapeData = manifestShapeData(shape);
@@ -31582,19 +31800,19 @@ async function doctorComponent(client, org, repo, componentId) {
     hasSubs = true;
     try {
       const s = await client.subscription.get(org, repo, sub.name);
-      const subComponentId = s && typeof s === "object" && "componentId" in s ? s.componentId : undefined;
-      if (!s.active) {
+      const subComponentRef = s && typeof s === "object" && "componentRef" in s ? s.componentRef : undefined;
+      if (subComponentRef !== undefined && subComponentRef !== registeredComponentRef) {
+        allSubsPaused = false;
         findings.push({
           resource: `sub:${sub.name}`,
-          status: "inactive",
-          message: `Subscription "${sub.name}" is paused`
+          status: "warning",
+          message: `Subscription "${sub.name}" is owned by "${subComponentRef}"`
         });
-      } else if (subComponentId !== undefined && subComponentId !== componentId) {
-        allSubsPaused = false;
+      } else if (!s.active) {
         findings.push({
           resource: `sub:${sub.name}`,
-          status: "warning",
-          message: `Subscription "${sub.name}" is owned by "${subComponentId}"`
+          status: "inactive",
+          message: `Subscription "${sub.name}" is paused`
         });
       } else {
         allSubsPaused = false;
@@ -31664,10 +31882,11 @@ async function doctorComponent(client, org, repo, componentId) {
   const hasMissing = findings.some((f) => f.status === "missing");
   const hasInactive = findings.some((f) => f.status === "inactive" && !f.resource.startsWith("sub:"));
   const hasShapeDrift = findings.some((f) => f.resource.startsWith("shape:") && f.status === "warning" && f.message.includes("differs from installed manifest"));
+  const hasOwnershipConflict = findings.some((f) => (f.resource.startsWith("shape:") || f.resource.startsWith("sub:")) && f.status === "warning" && f.message.includes("owned by"));
   let state;
-  if (hasSubs && allSubsPaused && !hasMissing && !hasInactive && !hasShapeDrift) {
+  if (hasSubs && allSubsPaused && !hasMissing && !hasInactive && !hasShapeDrift && !hasOwnershipConflict) {
     state = "paused";
-  } else if (hasMissing || hasInactive || hasShapeDrift) {
+  } else if (hasMissing || hasInactive || hasShapeDrift || hasOwnershipConflict) {
     state = "degraded";
   } else {
     state = "ready";
@@ -31680,7 +31899,7 @@ async function doctorComponent(client, org, repo, componentId) {
         name: `ComponentInstall/${componentId}`,
         data: { ...installData, state, checkedAt: new Date().toISOString() }
       }
-    ], { componentId: SYSTEM_COMPONENT_ID });
+    ], { componentRef: SYSTEM_REGISTERED_COMPONENT_REF });
   } catch {
     findings.push({
       resource: "state-update",
@@ -31774,6 +31993,22 @@ async function teardownComponent(client, org, repo, componentId) {
     };
   }
   const componentName = typeof installData.name === "string" ? installData.name : componentId;
+  const registeredComponentRef = typeof installData.registeredComponentRef === "string" && installData.registeredComponentRef.length > 0 ? installData.registeredComponentRef : undefined;
+  if (!registeredComponentRef) {
+    return {
+      componentId,
+      componentName,
+      state: "error",
+      steps: [
+        {
+          step: "load-install",
+          status: "error",
+          message: "Install record is missing registeredComponentRef"
+        }
+      ],
+      errors: ["Install record is missing registeredComponentRef"]
+    };
+  }
   let subscriptionNames = [];
   let teardownPolicy = {};
   try {
@@ -31796,9 +32031,9 @@ async function teardownComponent(client, org, repo, componentId) {
     for (const subName of subscriptionNames) {
       try {
         const sub = await client.subscription.get(org, repo, subName);
-        const ownerComponentId = sub && typeof sub === "object" && "componentId" in sub ? sub.componentId : undefined;
-        if (typeof ownerComponentId === "string" && ownerComponentId !== componentId) {
-          const msg = `Subscription "${subName}" is owned by "${ownerComponentId}", not "${componentId}"`;
+        const ownerComponentRef = sub && typeof sub === "object" && "componentRef" in sub ? sub.componentRef : undefined;
+        if (typeof ownerComponentRef === "string" && ownerComponentRef !== registeredComponentRef) {
+          const msg = `Subscription "${subName}" is owned by "${ownerComponentRef}", not "${registeredComponentRef}"`;
           errors.push(msg);
           steps.push({
             step: `pause-${subName}`,
@@ -31847,7 +32082,7 @@ async function teardownComponent(client, org, repo, componentId) {
           updatedAt: new Date().toISOString()
         }
       }
-    ], { componentId: SYSTEM_COMPONENT_ID });
+    ], { componentRef: SYSTEM_REGISTERED_COMPONENT_REF });
     steps.push({ step: "update-state", status: "ok" });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -31920,6 +32155,12 @@ function resolveMintedTokensFlag(args) {
     return false;
   return;
 }
+var showSecretsFlag = flag.boolean({
+  description: "Reveal raw lifecycle URLs in command output"
+});
+var showSecretsStructuredOutputFlag = flag.boolean({
+  description: "Reveal raw lifecycle URLs in JSON/JSONL output"
+});
 var installFlags = {};
 var updateFlags = {};
 var validateFlags = {};
@@ -31932,13 +32173,15 @@ var listFlags2 = {
     description: "Fetch all pages (auto-paginate until exhausted)"
   })
 };
+var DEFAULT_COMPONENT_LIST_LIMIT = 50;
+var MAX_COMPONENT_LIST_LIMIT = 500;
 var viewFlags3 = {};
 var teardownFlags = {};
 var doctorFlags = {};
 var initFlags = {};
 var searchFlags2 = {
   limit: flag.number({
-    description: "Maximum components per page (default: 50, max: 500)"
+    description: "Maximum results per page"
   }),
   cursor: flag.string({ description: "Opaque pagination cursor" }),
   all: flag.boolean({
@@ -31984,7 +32227,8 @@ var registerFlags = {
   }),
   "no-minted-tokens": flag.boolean({
     description: "Disable minted tokens (default)"
-  })
+  }),
+  "show-secrets": showSecretsFlag
 };
 function readManifestArg(path2) {
   let raw;
@@ -32008,9 +32252,12 @@ var unregisterFlags = {};
 var registryListFlags = {
   org: flag.string({
     description: "Owner org to list registrations for"
-  })
+  }),
+  "show-secrets": showSecretsStructuredOutputFlag
+};
+var registryViewFlags = {
+  "show-secrets": showSecretsFlag
 };
-var registryViewFlags = {};
 var registryUpdateFlags = {
   manifest: flag.string({
     description: "Path to a manifest.json to publish as a new version (optional; must have a strictly-greater semver)"
@@ -32049,7 +32296,8 @@ var registryUpdateFlags = {
   }),
   "no-minted-tokens": flag.boolean({
     description: "Disable minted tokens"
-  })
+  }),
+  "show-secrets": showSecretsFlag
 };
 function asRecord(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
@@ -32069,38 +32317,11 @@ function componentInstallCanonicalId(item) {
   const data = asRecord(item.data);
   return componentInstallIdFromWref(item.wref) ?? readString(data, "id") ?? readString(data, "componentId") ?? item.name;
 }
-function uniqueStrings(values) {
-  return [...new Set(values.filter((value) => Boolean(value)))];
-}
-function componentInstallIdentityIds(item) {
-  const data = asRecord(item.data);
-  return uniqueStrings([
-    componentInstallCanonicalId(item),
-    readString(data, "id"),
-    readString(data, "componentId"),
-    item.name
-  ]);
-}
-function componentInstallHasExactId(item, name) {
-  return componentInstallIdentityIds(item).includes(name);
+function componentInstallHasRegisteredRef(item, ref) {
+  return readString(asRecord(item.data), "registeredComponentRef") === ref;
 }
-function componentInstallHasDisplayName(item, name) {
-  return readString(asRecord(item.data), "name") === name;
-}
-function formatComponentInstallAmbiguity(name, matches) {
-  const componentIds = uniqueStrings(matches.map((item) => componentInstallCanonicalId(item)));
-  const listedIds = componentIds.map((id) => `- ${id}`).join(`
-`);
-  const exampleId = componentIds[0] ?? name;
-  return {
-    message: `Component name "${name}" is ambiguous. It matches multiple installed components:
-${listedIds}`,
-    hint: `Use a component id instead, for example: wh component doctor ${exampleId}`
-  };
-}
-async function resolveComponentDoctorId(client, org, repo, name) {
+async function resolveInstalledComponentRefId(client, org, repo, ref) {
   let cursor;
-  const displayNameMatches = [];
   do {
     const result = await client.thing.head(org, repo, {
       shape: "ComponentInstall",
@@ -32109,35 +32330,27 @@ async function resolveComponentDoctorId(client, org, repo, name) {
       cursor
     });
     const items = result.items ?? [];
-    const exactMatch = items.find((item) => componentInstallHasExactId(item, name));
+    const exactMatch = items.find((item) => componentInstallHasRegisteredRef(item, ref));
     const resolved = exactMatch ? componentInstallCanonicalId(exactMatch) : undefined;
     if (resolved) {
       return resolved;
     }
-    displayNameMatches.push(...items.filter((item) => componentInstallHasDisplayName(item, name)));
     cursor = result.nextCursor;
   } while (cursor);
-  if (displayNameMatches.length === 1) {
-    return componentInstallCanonicalId(displayNameMatches[0]) ?? name;
-  }
-  if (displayNameMatches.length > 1) {
-    const { message, hint } = formatComponentInstallAmbiguity(name, displayNameMatches);
-    throw new CliError(2 /* UserInput */, "USER_INPUT", message, undefined, hint);
-  }
-  return name;
+  throw new CliError(2 /* UserInput */, "USER_INPUT", `Component '${ref}' is not installed. Run 'wh component install <org>/<name>' first.`);
 }
 var handleUpdate = async (ctx, { args }) => {
-  const name = args[0];
-  if (!name) {
-    usageError("Usage: wh component update <name> --repo org/repo", "wh component update research-knowledge --repo org/repo");
+  const ref = args[0];
+  const usage = "Usage: wh component update <org/name> --repo org/repo";
+  const example = "wh component update warmhub/research-knowledge --repo org/repo";
+  if (!ref) {
+    usageError(usage, example);
   }
-  const { org, repo } = parseOrgRepo(getRepoRef(ctx), ctx.config);
-  try {
-    await ctx.client.thing.get(org, repo, `ComponentInstall/${name}`);
-  } catch {
-    throw new CliError(2 /* UserInput */, "USER_INPUT", `Component '${name}' is not installed. Run 'wh component install <org>/<name>' first.`);
+  resolveRegisteredComponentRef(ref, usage, example);
+  if (ctx.liveMode === false) {
+    usageError("Dry-run is not supported for component update.", "wh component update warmhub/research-knowledge --repo org/repo");
   }
-  throw new CliError(2 /* UserInput */, "USER_INPUT", `Component '${name}' was not installed from a registered component and can no longer be updated in place.`, undefined, "Register the component (`wh component register <name> --org <org> --manifest <path>`) and reinstall it with `wh component install <org>/<name>`.");
+  throw new CliError(2 /* UserInput */, "USER_INPUT", `Component '${ref}' could not be updated through the component shell boundary.`, undefined, "Run `wh component update <org/name> --repo org/repo` without --dry-run.");
 };
 var handleRegister = async (ctx, { flags, args }) => {
   const componentName = args[0];
@@ -32178,7 +32391,8 @@ var handleRegister = async (ctx, { flags, args }) => {
   if (reservedWarning) {
     ctx.err(reservedWarning);
   }
-  writeOutput(ctx, result, () => renderRegistryEntry(ctx, result));
+  const output = redactRegistryEntryLifecycleUrls(result, flags["show-secrets"]);
+  writeOutput(ctx, output, () => renderRegistryEntry(ctx, output));
 };
 var handleUnregister = async (ctx, { args }) => {
   const { orgName, componentName } = resolveRegisteredComponentRef(args[0], "Usage: wh component unregister <org/name>", "wh component unregister warmhub/veritas");
@@ -32193,12 +32407,14 @@ var handleRegistryList = async (ctx, { flags, args }) => {
     usageError("Usage: wh component registry list --org <org>", "wh component registry list --org warmhub");
   }
   const result = await ctx.client.component.registry.list(orgName);
-  writeOutput(ctx, result.items, () => renderRegistryList(ctx, orgName, result));
+  const items = redactRegistryEntryListLifecycleUrls(result.items, flags["show-secrets"]);
+  writePageOutput(ctx, items, { limit: items.length, nextCursor: null }, () => renderRegistryList(ctx, orgName, { ...result, items }));
 };
-var handleRegistryView = async (ctx, { args }) => {
+var handleRegistryView = async (ctx, { flags, args }) => {
   const { orgName, componentName } = resolveRegisteredComponentRef(args[0], "Usage: wh component registry view <org/name>", "wh component registry view warmhub/veritas");
   const result = await ctx.client.component.registry.view(orgName, componentName);
-  writeOutput(ctx, result, () => renderRegistryEntry(ctx, result));
+  const output = redactRegistryEntryLifecycleUrls(result, flags["show-secrets"]);
+  writeOutput(ctx, output, () => renderRegistryEntry(ctx, output));
 };
 var handleRegistryUpdate = async (ctx, { flags, args }) => {
   const { orgName, componentName } = resolveRegisteredComponentRef(args[0], "Usage: wh component registry update <org/name> [flags]", "wh component registry update warmhub/veritas --public");
@@ -32226,12 +32442,12 @@ var handleRegistryUpdate = async (ctx, { flags, args }) => {
     description: flags.description,
     mintedTokens
   });
-  writeOutput(ctx, result, () => renderRegistryEntry(ctx, result));
+  const output = redactRegistryEntryLifecycleUrls(result, flags["show-secrets"]);
+  writeOutput(ctx, output, () => renderRegistryEntry(ctx, output));
 };
-var handleInstall = async (ctx, { args }) => {
+var handleInstall = async (_ctx, { args }) => {
   const source = args[0];
-  const usage = `Usage: wh component install <source> --repo org/repo
-  source: <org>/<name> (registered component)`;
+  const usage = "Usage: wh component install <org/name> --repo org/repo";
   const example = "wh component install warmhub/veritas --repo myorg/myrepo";
   if (!source) {
     usageError(usage, example);
@@ -32262,9 +32478,12 @@ var handleList2 = async (ctx, { flags }) => {
   const c = ctx.colors;
   const { items, nextCursor } = await fetchComponentPages(ctx.client, org, repo, { all: flags.all, limit: flags.limit, cursor: flags.cursor });
   if (!flags.all && nextCursor) {
-    ctx.status(`${c.yellow}${items.length} shown, more available${c.reset} — use ${c.cyan}--all${c.reset} to fetch every page, ` + `or re-run the same command plus ${c.cyan}--cursor=${nextCursor}${c.reset} to resume from here.`);
+    emitPartialPageHint(ctx, items.length, nextCursor, Math.min(flags.limit ?? DEFAULT_COMPONENT_LIST_LIMIT, MAX_COMPONENT_LIST_LIMIT));
   }
-  writeOutput(ctx, items, () => {
+  writePageOutput(ctx, items, {
+    limit: Math.min(flags.limit ?? DEFAULT_COMPONENT_LIST_LIMIT, MAX_COMPONENT_LIST_LIMIT),
+    nextCursor: flags.all ? null : nextCursor ?? null
+  }, () => {
     if (!items.length) {
       ctx.status(`${c.dim}No components installed${c.reset}`);
       return;
@@ -32276,51 +32495,41 @@ var handleList2 = async (ctx, { flags }) => {
       const state = item.state ?? "unknown";
       const source = item.source ?? "-";
       const stateColor = stateToColor(c, state);
-      ctx.out(`  ${c.cyan}${item.componentId}${c.reset}  ${stateColor}${state}${c.reset}  ${c.dim}v${version}${c.reset}  ${source}`);
+      ctx.out(`  ${c.cyan}${item.ref ?? item.componentName}${c.reset}  ${stateColor}${state}${c.reset}  ${c.dim}v${version}${c.reset}  ${source}`);
     }
   });
 };
 var handleSearch2 = async (ctx, { flags, args }) => {
   const query = args[0]?.trim();
   if (!query) {
-    usageError("Usage: wh component search <query> --repo org/repo", "wh component search research --repo myorg/myrepo");
+    usageError("Usage: wh component search <query>", 'wh component search "subjective logic"');
   }
-  const { org, repo } = parseOrgRepo(getRepoRef(ctx), ctx.config);
-  const c = ctx.colors;
-  const { items: allItems, nextCursor } = await fetchComponentPages(ctx.client, org, repo, { all: flags.all, limit: flags.limit, cursor: flags.cursor });
-  const needle = query.toLowerCase();
-  const items = allItems.filter((item) => [item.componentId, item.componentName, item.source].filter((value) => typeof value === "string").some((value) => value.toLowerCase().includes(needle)));
-  if (!flags.all && nextCursor) {
-    ctx.status(`${c.yellow}${allItems.length} component(s) searched, more pages available${c.reset} — matches beyond this page were not searched. ` + `Use ${c.cyan}--all${c.reset} to search every page, ` + `or re-run the same command plus ${c.cyan}--cursor=${nextCursor}${c.reset} to continue from here.`);
+  if (getRepoRef(ctx)) {
+    const c = ctx.colors;
+    ctx.status(`${c.dim}--repo is ignored: \`wh component search\` searches the cross-org registry. ` + `Use \`wh component list --repo <org/repo>\` to see installed components.${c.reset}`);
   }
-  writeOutput(ctx, items, () => {
-    if (!items.length) {
-      ctx.status(`${c.dim}No components matching "${query}" in ${org}/${repo}${c.reset}`);
-      return;
-    }
-    ctx.out(`${c.bold}Matching Components${c.reset} ${c.cyan}${org}/${repo}${c.reset}`);
-    ctx.out("");
-    for (const item of items) {
-      const version = item.version ?? "unknown";
-      const state = item.state ?? "unknown";
-      const source = item.source ?? "-";
-      const stateColor = stateToColor(c, state);
-      ctx.out(`  ${c.cyan}${item.componentId}${c.reset}  ${stateColor}${state}${c.reset}  ${c.dim}v${version}${c.reset}  ${source}`);
-    }
+  await runGlobalSearchCommand(ctx, {
+    query,
+    all: flags.all,
+    limit: flags.limit,
+    cursor: flags.cursor,
+    fetch: (opts) => ctx.client.component.search(query, opts),
+    title: "Component search",
+    emptyLabel: "public components"
   });
 };
 var handleView3 = async (ctx, { args }) => {
-  const name = args[0];
-  const usage = "Usage: wh component view <name> --repo org/repo";
-  const example = "wh component view research-knowledge --repo myorg/myrepo";
-  if (!name) {
+  const ref = args[0];
+  const usage = "Usage: wh component view <org/name> --repo org/repo";
+  const example = "wh component view myorg/research-knowledge --repo myorg/myrepo";
+  if (!ref) {
     usageError(usage, example);
   }
   const { org, repo } = parseOrgRepo(getRepoRef(ctx), ctx.config);
-  const viewData = await ctx.client.component.get(org, repo, name);
+  const viewData = await ctx.client.component.get(org, repo, ref);
   writeOutput(ctx, viewData, () => {
     const c = ctx.colors;
-    ctx.out(`${c.bold}Component:${c.reset} ${c.cyan}${name}${c.reset}`);
+    ctx.out(`${c.bold}Component:${c.reset} ${c.cyan}${viewData.ref ?? ref}${c.reset}`);
     ctx.out(`${c.bold}Version:${c.reset} ${viewData.version ?? "unknown"}`);
     ctx.out(`${c.bold}State:${c.reset} ${viewData.state ?? "-"}`);
     ctx.out(`${c.bold}Source:${c.reset} ${viewData.source ?? "-"}`);
@@ -32396,23 +32605,24 @@ function renderValidationResult(ctx, result) {
 var handleDoctor = async (ctx, { args }) => {
   const name = args[0];
   if (!name) {
-    usageError("Usage: wh component doctor <name> --repo org/repo", "wh component doctor research-knowledge --repo myorg/myrepo");
+    usageError("Usage: wh component doctor <org/name> --repo org/repo", "wh component doctor warmhub/research-knowledge --repo myorg/myrepo");
   }
   const { org, repo } = parseOrgRepo(getRepoRef(ctx), ctx.config);
-  const componentId = await resolveComponentDoctorId(ctx.client, org, repo, name);
+  const componentId = await resolveInstalledComponentRefId(ctx.client, org, repo, name);
   const result = await doctorComponent(ctx.client, org, repo, componentId);
   writeOutput(ctx, result, () => renderDoctorResult(ctx, result));
 };
 var handleTeardown = async (ctx, { args }) => {
   const name = args[0];
   if (!name) {
-    usageError("Usage: wh component teardown <name> --repo org/repo", "wh component teardown research-knowledge --repo myorg/myrepo");
+    usageError("Usage: wh component teardown <org/name> --repo org/repo", "wh component teardown warmhub/research-knowledge --repo myorg/myrepo");
   }
   const { org, repo } = parseOrgRepo(getRepoRef(ctx), ctx.config);
   const repoSlug = `${org}/${repo}`;
+  const componentId = await resolveInstalledComponentRefId(ctx.client, org, repo, name);
   let result;
   try {
-    result = await teardownComponent(ctx.client, org, repo, name);
+    result = await teardownComponent(ctx.client, org, repo, componentId);
   } catch (error) {
     invalidateInstallSnapshotCache(repoSlug);
     throw error;
@@ -32480,10 +32690,10 @@ function renderRegistryEntry(ctx, entry) {
     ctx.out(`  Source: ${c.dim}(not installable — no source URL)${c.reset}`);
   }
   if (entry.setupUrl) {
-    ctx.out(`  Setup: ${entry.setupUrl}`);
+    ctx.out(`  Setup: ${formatLifecycleUrl(entry.setupUrl, c)}`);
   }
   if (entry.uninstallUrl) {
-    ctx.out(`  Uninstall: ${entry.uninstallUrl}`);
+    ctx.out(`  Uninstall: ${formatLifecycleUrl(entry.uninstallUrl, c)}`);
   }
   if (entry.credentialSetName || entry.credentialSetId) {
     ctx.out(`  Credential set: ${entry.credentialSetName ?? entry.credentialSetId}`);
@@ -32493,6 +32703,43 @@ function renderRegistryEntry(ctx, entry) {
   }
   ctx.out(`  ${c.dim}Updated: ${new Date(entry.updatedAt).toISOString().slice(0, 16)}${c.reset}`);
 }
+function redactRegistryEntryLifecycleUrls(entry, showSecrets) {
+  if (showSecrets)
+    return entry;
+  return {
+    ...entry,
+    ...entry.setupUrl ? { setupUrl: redactSecretBearingUrl(entry.setupUrl) } : {},
+    ...entry.uninstallUrl ? { uninstallUrl: redactSecretBearingUrl(entry.uninstallUrl) } : {}
+  };
+}
+function redactRegistryEntryListLifecycleUrls(entries, showSecrets) {
+  if (showSecrets)
+    return entries;
+  return entries.map((entry) => redactRegistryEntryLifecycleUrls(entry, showSecrets));
+}
+var REDACTED_LIFECYCLE_URL = "[redacted-url]";
+var REDACTED_LIFECYCLE_PATH_SUFFIX = "/***";
+function redactSecretBearingUrl(rawUrl) {
+  try {
+    const origin = new URL(rawUrl).origin;
+    if (origin === "null") {
+      return REDACTED_LIFECYCLE_URL;
+    }
+    return `${origin}${REDACTED_LIFECYCLE_PATH_SUFFIX}`;
+  } catch {
+    return REDACTED_LIFECYCLE_URL;
+  }
+}
+function formatLifecycleUrl(url, colors) {
+  if (url === REDACTED_LIFECYCLE_URL) {
+    return `${colors.dim}${url}${colors.reset}`;
+  }
+  if (url.endsWith(REDACTED_LIFECYCLE_PATH_SUFFIX)) {
+    const visiblePrefix = url.slice(0, -REDACTED_LIFECYCLE_PATH_SUFFIX.length);
+    return `${visiblePrefix}${colors.dim}${REDACTED_LIFECYCLE_PATH_SUFFIX}${colors.reset}`;
+  }
+  return url;
+}
 function renderRegistryList(ctx, orgName, result) {
   const c = ctx.colors;
   if (!result.items.length) {
@@ -32543,7 +32790,7 @@ var COMPONENT_DOMAIN = defineDomain({
     install: {
       prime: true,
       summary: "Install a registered component by its <org>/<name> ref",
-      args: "<source>",
+      args: "<org/name>",
       flags: installFlags,
       examples: [
         "wh component install warmhub/identity --repo org/repo",
@@ -32553,9 +32800,9 @@ var COMPONENT_DOMAIN = defineDomain({
     },
     update: {
       summary: "Update an installed registered component to the latest manifest",
-      args: "<name>",
+      args: "<org/name>",
       flags: updateFlags,
-      examples: ["wh component update research-knowledge --repo org/repo"],
+      examples: ["wh component update warmhub/identity --repo org/repo"],
       handler: handleUpdate
     },
     list: {
@@ -32569,25 +32816,25 @@ var COMPONENT_DOMAIN = defineDomain({
     view: {
       prime: true,
       summary: "Show component details",
-      args: "<name>",
+      args: "<org/name>",
       flags: viewFlags3,
-      examples: ["wh component view research-knowledge --repo org/repo"],
+      examples: ["wh component view warmhub/identity --repo org/repo"],
       handler: handleView3
     },
     teardown: {
       prime: true,
       summary: "Pause component subscriptions",
-      args: "<name>",
+      args: "<org/name>",
       flags: teardownFlags,
-      examples: ["wh component teardown research-knowledge --repo org/repo"],
+      examples: ["wh component teardown warmhub/identity --repo org/repo"],
       handler: handleTeardown
     },
     doctor: {
       prime: true,
       summary: "Run component health checks",
-      args: "<name>",
+      args: "<org/name>",
       flags: doctorFlags,
-      examples: ["wh component doctor research-knowledge --repo org/repo"],
+      examples: ["wh component doctor warmhub/identity --repo org/repo"],
       handler: handleDoctor
     },
     init: {
@@ -32616,10 +32863,13 @@ var COMPONENT_DOMAIN = defineDomain({
       handler: handleComponentExec
     },
     search: {
-      summary: "Search for components on GitHub",
+      summary: "Search public components across all orgs (the registry). To list components installed in a repo, use `wh component list --repo`.",
       args: "<query>",
       flags: searchFlags2,
-      examples: ["wh component search research"],
+      examples: [
+        'wh component search "subjective logic"',
+        "wh component search reputation"
+      ],
       handler: handleSearch2
     }
   },
@@ -32742,7 +32992,7 @@ var handleCreate3 = async (ctx, { flags, args }) => {
 var handleList3 = async (ctx, { flags }) => {
   const context = resolveCredentialContext({ ctx, orgFlag: flags.org });
   const items = await ctx.client.credential.listSets(context.org, context.repo);
-  writeOutput(ctx, items, () => {
+  writePageOutput(ctx, items, { limit: items.length, nextCursor: null }, () => {
     const c = ctx.colors;
     if (!items.length) {
       ctx.status(`${c.dim}No credential sets in ${formatCredentialContextTarget(context)}${c.reset}`);
@@ -32893,7 +33143,7 @@ var handleAudit = async (ctx, { flags, args }) => {
       limit: flags.limit
     })
   });
-  writeOutput(ctx, entries, () => {
+  writePageOutput(ctx, entries, { limit: flags.limit ?? entries.length, nextCursor: null }, () => {
     const c = ctx.colors;
     if (!entries.length) {
       ctx.status(`${c.dim}No audit entries for ${setName}${c.reset}`);
@@ -33035,7 +33285,7 @@ import { basename } from "node:path";
 // ../../packages/warmhub-cli/src/harness.ts
 import { mkdir, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
 import { homedir as homedir4 } from "node:os";
-import { dirname as dirname6, join as join6 } from "node:path";
+import { dirname as dirname6, join as join5 } from "node:path";
 var AGENTS_BEGIN_MARKER = "<!-- BEGIN WARMHUB CLI INTEGRATION -->";
 var AGENTS_END_MARKER = "<!-- END WARMHUB CLI INTEGRATION -->";
 var PRIME_COMMAND = "wh prime";
@@ -33055,10 +33305,10 @@ function getHarnessPaths(opts) {
   const userHome = opts?.homeDir ?? homedir4();
   return {
     repoDir,
-    agentsPath: join6(repoDir, "AGENTS.md"),
-    projectSettingsPath: join6(repoDir, ".claude", "settings.json"),
-    projectLocalSettingsPath: join6(repoDir, ".claude", "settings.local.json"),
-    globalSettingsPath: join6(userHome, ".claude", "settings.json")
+    agentsPath: join5(repoDir, "AGENTS.md"),
+    projectSettingsPath: join5(repoDir, ".claude", "settings.json"),
+    projectLocalSettingsPath: join5(repoDir, ".claude", "settings.local.json"),
+    globalSettingsPath: join5(userHome, ".claude", "settings.json")
   };
 }
 async function readJsonFile(path2) {
@@ -33302,7 +33552,7 @@ function comparePrereleaseIdentifiers2(a, b) {
     return -1;
   if (!aNum && bNum)
     return 1;
-  return a.localeCompare(b);
+  return a < b ? -1 : a > b ? 1 : 0;
 }
 function compareVersions(candidate, current) {
   if (candidate.major !== current.major)
@@ -33965,7 +34215,7 @@ var handleNotifications = async (ctx, { flags }) => {
     since: parseSince(flags.since, usage, example),
     limit: flags.limit
   });
-  writeOutput(ctx, result, () => renderActionNotifications(ctx.out, ctx.status, ctx.colors, result));
+  writePageOutput(ctx, result, { limit: flags.limit ?? result.length, nextCursor: null }, () => renderActionNotifications(ctx.out, ctx.status, ctx.colors, result));
 };
 var NOTIFICATIONS_DOMAIN = defineDomain({
   kind: "flat",
@@ -34038,7 +34288,7 @@ var handleList4 = async (ctx, { flags }) => {
   const result = await ctx.client.org.list({
     includeArchived: flags["include-archived"]
   });
-  writeOutput(ctx, result.items, () => {
+  writePageOutput(ctx, result.items, { limit: result.items.length, nextCursor: null }, () => {
     if (!result.items.length) {
       ctx.status(`${c.dim}No organizations${c.reset}`);
       return;
@@ -34459,17 +34709,18 @@ cat wrefs.txt | wh thing view --format jsonl        # one JSON line per *deduped
 - \`wh credential revoke <setName> [--repo org/repo | --org org] [--reason]\` — Revoke a credential set (blocks new binds and strips auth from existing webhook deliveries)
 
 ### component — Component management
-- \`wh component validate <path>\` — Validate a component package from disk
-- \`wh component install <source>\` — Install a component from a bundled system id or a registered \`<org>/<name>\`
-- \`wh component register <name> --org <org> --manifest <path> [flags]\` — Register a component identity (first manifest version) for \`install <org/name>\`
+- \`wh component validate <path>\` — Validate package
+- \`wh component install <org/name>\` — Install a registered component
+- \`wh component register <name> --org <org> --manifest <path> [flags]\` — Register component identity
 - \`wh component unregister <org/name>\` — Remove a registered component identity
 - \`wh component registry list --org <org>\` — List registered components
 - \`wh component registry view <org/name>\` — View a registered component
 - \`wh component registry update <org/name> [flags]\` — Update a registered component
 - \`wh component list\` — List installed components
-- \`wh component view <name>\` — Show component details (alias: show)
-- \`wh component doctor <name>\` — Run component health checks
-- \`wh component teardown <name>\` — Pause component subscriptions
+- \`wh component update <org/name>\` — Update installed component
+- \`wh component view <org/name>\` — Show component details (alias: show)
+- \`wh component doctor <org/name>\` — Run component health checks
+- \`wh component teardown <org/name>\` — Pause component subscriptions
 
 ### Getting More Info
 - \`wh help\` — full help overview
@@ -34799,6 +35050,8 @@ var repoListFlags = {
     description: "Fetch all pages (auto-paginate until exhausted)"
   })
 };
+var DEFAULT_REPO_LIST_LIMIT = 50;
+var MAX_REPO_LIST_LIMIT = 200;
 var handleList5 = async (ctx, { flags, args }) => {
   const orgName = args[0] ?? ctx.config.defaultOrg;
   if (!orgName) {
@@ -34826,9 +35079,12 @@ var handleList5 = async (ctx, { flags, args }) => {
     }
   }
   if (!all && nextCursor) {
-    ctx.status(`${c.yellow}${items.length} shown, more available${c.reset} — use ${c.cyan}--all${c.reset} to fetch every page, ` + `or re-run the same command plus ${c.cyan}--cursor=${nextCursor}${c.reset} to resume from here.`);
+    emitPartialPageHint(ctx, items.length, nextCursor, Math.min(flags.limit ?? DEFAULT_REPO_LIST_LIMIT, MAX_REPO_LIST_LIMIT));
   }
-  writeOutput(ctx, items, () => {
+  writePageOutput(ctx, items, {
+    limit: Math.min(flags.limit ?? DEFAULT_REPO_LIST_LIMIT, MAX_REPO_LIST_LIMIT),
+    nextCursor: all ? null : nextCursor ?? null
+  }, () => {
     if (!items.length) {
       ctx.status(`${c.dim}No repos in ${orgName}${c.reset}`);
       return;
@@ -35349,6 +35605,30 @@ var CONTENT_SUBDOMAIN = defineDomain({
     }
   }
 });
+var repoSearchFlags = {
+  limit: flag.number({
+    description: "Maximum results per page (default: 25, max: 100)"
+  }),
+  cursor: flag.string({ description: "Opaque pagination cursor" }),
+  all: flag.boolean({
+    description: "Fetch all pages (auto-paginate until exhausted)"
+  })
+};
+var handleRepoSearch = async (ctx, { flags, args }) => {
+  const query = args[0]?.trim();
+  if (!query) {
+    usageError("Usage: wh repo search <query>", 'wh repo search "payment processing"');
+  }
+  await runGlobalSearchCommand(ctx, {
+    query,
+    all: flags.all,
+    limit: flags.limit,
+    cursor: flags.cursor,
+    fetch: (opts) => ctx.client.repo.search(query, opts),
+    title: "Repo search",
+    emptyLabel: "public repos"
+  });
+};
 var REPO_DOMAIN = defineDomain({
   name: "repo",
   summary: "Repository management",
@@ -35379,6 +35659,14 @@ var REPO_DOMAIN = defineDomain({
       ],
       handler: handleList5
     },
+    search: {
+      prime: true,
+      summary: "Search public repos across all orgs",
+      args: "<query>",
+      flags: repoSearchFlags,
+      examples: ["wh repo search users", "wh repo search users --limit 10"],
+      handler: handleRepoSearch
+    },
     view: {
       prime: true,
       summary: "Show repo details",
@@ -35481,7 +35769,7 @@ var FIELD_CONSTRAINTS_NOTES = [
 var listFlags4 = {
   match: flag.string({ description: "Filter by name glob pattern" }),
   component: flag.string({
-    description: "Filter to shapes owned by this component ID"
+    description: "Filter to shapes owned by this component (Org/Name ref)"
   }),
   "exclude-components": flag.boolean({
     description: "Exclude component-owned shapes from results"
@@ -35494,18 +35782,18 @@ var handleList6 = async (ctx, { flags }) => {
   const { org, repo } = parseOrgRepo(getRepoRef(ctx), ctx.config);
   const c = ctx.colors;
   const match = flags.match;
-  const componentId = flags.component;
+  const componentRef = flags.component;
   const excludeComponents = !!flags["exclude-components"];
   const includeRetracted = flags["include-retracted"];
-  validateComponentFilters(componentId, excludeComponents, "wh shape list --component com.example.pkg", "wh shape list --exclude-components");
+  validateComponentFilters(componentRef, excludeComponents, "wh shape list --component acme/veritas", "wh shape list --exclude-components");
   const result = await ctx.client.shape.list(org, repo, {
     match,
-    componentId,
+    componentRef,
     excludeComponents,
     includeRetracted
   });
   const items = result.items;
-  writeOutput(ctx, items, () => {
+  writePageOutput(ctx, items, { limit: items.length, nextCursor: null }, () => {
     if (!items.length) {
       ctx.status(`${c.dim}No shapes registered${c.reset}`);
       return;
@@ -35567,9 +35855,9 @@ var handleView7 = async (ctx, { flags, args }) => {
     if (typeof shapeDescription === "string" && shapeDescription) {
       ctx.out(`  ${c.dim}${shapeDescription}${c.reset}`);
     }
-    const cid = result.componentId;
-    if (cid) {
-      ctx.out(`  ${c.dim}owner:${c.reset} ${c.yellow}${cid}${c.reset}`);
+    const componentRef = result.componentRef;
+    if (componentRef) {
+      ctx.out(`  ${c.dim}owner:${c.reset} ${c.yellow}${componentRef}${c.reset}`);
     }
     const fields = shapeData?.fields;
     if (fields) {
@@ -35742,7 +36030,7 @@ var handleHistory3 = async (ctx, { flags, args }) => {
   if (!all && result.nextCursor) {
     emitPartialPageHint(ctx, (result.versions ?? []).length, result.nextCursor, pageLimit);
   }
-  writeOutput(ctx, result, () => renderHistory(ctx.out, ctx.colors, result));
+  writePageOutput(ctx, result.versions ?? [], { limit: pageLimit, nextCursor: result.nextCursor ?? null }, () => renderHistory(ctx.out, ctx.colors, result));
 };
 var handleShapeRename = async (ctx, { args }) => {
   const oldName = args[0];
@@ -36184,7 +36472,7 @@ var handleList7 = async (ctx, { flags }) => {
   const { org, repo } = resolveRepoContext(ctx);
   const all = await ctx.client.subscription.list(org, repo);
   const items = all.slice(0, flags.limit ?? all.length);
-  writeOutput(ctx, items, () => {
+  writePageOutput(ctx, items, { limit: flags.limit ?? all.length, nextCursor: null }, () => {
     const c = ctx.colors;
     if (!items.length) {
       ctx.status(`${c.dim}No subscriptions in ${org}/${repo}${c.reset}`);
@@ -36651,7 +36939,7 @@ var handleCreate8 = async (ctx, { flags }) => {
 var handleList8 = async (ctx, { flags }) => {
   const c = ctx.colors;
   const items = await ctx.client.token.list({ includeInactive: flags.all });
-  writeOutput(ctx, items, () => {
+  writePageOutput(ctx, items, { limit: items.length, nextCursor: null }, () => {
     if (!items.length) {
       ctx.status(`${c.dim}No tokens${c.reset}`);
       return;
@@ -37869,10 +38157,6 @@ async function dispatch(ctx) {
   const { command } = ctx.invocation;
   if (!command || command === "help") {
     const helpTarget = command === "help" ? ctx.invocation.positional[0] : undefined;
-    if (ctx.format === "json") {
-      printJson(ctx.out, buildCliSpec());
-      return;
-    }
     if (helpTarget) {
       const domain = registry.getDomain(helpTarget);
       if (domain) {
@@ -37881,6 +38165,10 @@ async function dispatch(ctx) {
         throw new CliError(2 /* UserInput */, "USER_INPUT", `Unknown command: ${helpTarget}`, undefined, "Run 'wh help' for available commands.");
       }
     } else {
+      if (ctx.format === "json") {
+        printJson(ctx.out, buildCliSpec());
+        return;
+      }
       let repoSlug;
       try {
         const { org, repo } = parseOrgRepo(getRepoRef(ctx), ctx.config);
@@ -37932,6 +38220,7 @@ async function reconcileComponent(client, org, repo, pkg, source, existingInstal
   const errors = [];
   const { meta, manifest } = pkg;
   const componentId = meta.id;
+  const componentRef = source.registeredComponentRef;
   const validation = validateComponentPackage(pkg);
   if (!validation.valid) {
     const validationErrors = validation.findings.filter((f) => f.level === "error").map((f) => f.message);
@@ -37982,7 +38271,7 @@ async function reconcileComponent(client, org, repo, pkg, source, existingInstal
   const oldCredNames = wasIncomplete ? new Set : new Set(oldManifest?.credentials?.map((c) => c.name) ?? []);
   const liveShapeNames = new Set;
   const liveShapeDataByName = new Map;
-  const liveShapeComponentIdByName = new Map;
+  const liveShapeComponentRefByName = new Map;
   for (const shape of reconcileShapes) {
     if (isFailedInstallState || previousState !== "degraded" && !oldShapeNames.has(shape.name)) {
       continue;
@@ -37999,7 +38288,7 @@ async function reconcileComponent(client, org, repo, pkg, source, existingInstal
           includeRetracted: true
         });
         liveShapeDataByName.set(shape.name, liveShape.version?.data);
-        liveShapeComponentIdByName.set(shape.name, liveShape.componentId);
+        liveShapeComponentRefByName.set(shape.name, liveShape.componentRef);
       } catch {}
     } catch {}
   }
@@ -38034,7 +38323,7 @@ async function reconcileComponent(client, org, repo, pkg, source, existingInstal
       data: manifestShapeData(shape)
     }));
     try {
-      await client.commit.apply(org, repo, `Add new shapes for ${meta.name}`, shapeOps, { componentId });
+      await client.commit.apply(org, repo, `Add new shapes for ${meta.name}`, shapeOps, { componentRef });
       steps.push({ step: "add-new-shapes", status: "ok" });
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
@@ -38050,8 +38339,8 @@ async function reconcileComponent(client, org, repo, pkg, source, existingInstal
     if (!liveShapeNames.has(shape.name))
       return false;
     const liveData = liveShapeDataByName.get(shape.name);
-    const liveComponentId = liveShapeComponentIdByName.get(shape.name);
-    return liveComponentId !== componentId || !shapeDataEquals(manifestShapeData(shape), liveData);
+    const liveComponentRef = liveShapeComponentRefByName.get(shape.name);
+    return liveComponentRef !== componentRef || !shapeDataEquals(manifestShapeData(shape), liveData);
   });
   if (changedShapes.length > 0) {
     const shapeOps = changedShapes.map((shape) => ({
@@ -38061,7 +38350,7 @@ async function reconcileComponent(client, org, repo, pkg, source, existingInstal
       data: manifestShapeData(shape)
     }));
     try {
-      await client.commit.apply(org, repo, `Reconcile shapes for ${meta.name}`, shapeOps, { componentId });
+      await client.commit.apply(org, repo, `Reconcile shapes for ${meta.name}`, shapeOps, { componentRef });
       steps.push({ step: "claim-existing-shapes", status: "ok" });
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
@@ -38127,7 +38416,7 @@ async function reconcileComponent(client, org, repo, pkg, source, existingInstal
         filterJson: compiled.filterJson,
         webhookUrl: compiled.webhookUrl,
         fallbackWebhookUrl: compiled.fallbackWebhookUrl,
-        componentId
+        componentRef
       });
       steps.push({ step: `add-sub-${sub.name}`, status: "ok" });
     } catch (err) {
@@ -38166,8 +38455,8 @@ async function reconcileComponent(client, org, repo, pkg, source, existingInstal
     }
     try {
       const liveSub = await client.subscription.get(org, repo, sub.name);
-      if (liveSub.componentId && liveSub.componentId !== componentId) {
-        const msg = `Subscription "${sub.name}" is owned by component "${liveSub.componentId}"`;
+      if (liveSub.componentRef && liveSub.componentRef !== componentRef) {
+        const msg = `Subscription "${sub.name}" is owned by component "${liveSub.componentRef}"`;
         errors.push(msg);
         steps.push({ step: stepName, status: "error", message: msg });
         continue;
@@ -38185,7 +38474,7 @@ async function reconcileComponent(client, org, repo, pkg, source, existingInstal
             filterJson: compiled.filterJson,
             webhookUrl: compiled.webhookUrl,
             fallbackWebhookUrl: compiled.fallbackWebhookUrl,
-            componentId
+            componentRef
           });
         } catch (createErr) {
           const createMsg = createErr instanceof Error ? createErr.message : String(createErr);
@@ -38242,7 +38531,7 @@ async function reconcileComponent(client, org, repo, pkg, source, existingInstal
             name: `${seed.shape}/${seed.name}`,
             data: seed.data
           }
-        ], { componentId });
+        ], { componentRef });
       } catch (reviseErr) {
         const reviseMsg = reviseErr instanceof Error ? reviseErr.message : String(reviseErr);
         const reviseLooksMissing = reviseMsg.includes("not found") || reviseMsg.includes("NOT_FOUND");
@@ -38258,7 +38547,7 @@ async function reconcileComponent(client, org, repo, pkg, source, existingInstal
               name: `${seed.shape}/${seed.name}`,
               data: seed.data
             }
-          ], { componentId });
+          ], { componentRef });
         } catch (addErr) {
           const msg = addErr instanceof Error ? addErr.message : String(addErr);
           if (!isAlreadyExistsError(addErr)) {
@@ -38283,8 +38572,8 @@ async function reconcileComponent(client, org, repo, pkg, source, existingInstal
           componentId,
           name: meta.name,
           version: meta.version,
-          source: source.githubUrl ?? "local",
-          sourceKind: source.sourceKind ?? (source.githubUrl ? "github" : "local"),
+          source: "registry",
+          sourceKind: "registered",
           sourceRef: source.ref ?? "",
           resolvedSha: source.resolvedSha ?? "",
           ...source.registeredComponentRef ? { registeredComponentRef: source.registeredComponentRef } : {},
@@ -38296,7 +38585,7 @@ async function reconcileComponent(client, org, repo, pkg, source, existingInstal
           ...source.installId ?? persistedInstallId ? { installId: source.installId ?? persistedInstallId } : {}
         }
       }
-    ], { componentId: SYSTEM_COMPONENT_ID });
+    ], { componentRef: SYSTEM_REGISTERED_COMPONENT_REF });
     steps.push({ step: "update-install-record", status: "ok" });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -38411,8 +38700,8 @@ async function installComponent(client, org, repo, pkg, source) {
           componentId,
           name: meta.name,
           version: meta.version,
-          source: source.githubUrl ?? "local",
-          sourceKind: source.sourceKind ?? (source.githubUrl ? "github" : "local"),
+          source: "registry",
+          sourceKind: "registered",
           sourceRef: source.ref ?? "",
           resolvedSha: source.resolvedSha ?? "",
           ...source.registeredComponentRef ? { registeredComponentRef: source.registeredComponentRef } : {},
@@ -38423,7 +38712,7 @@ async function installComponent(client, org, repo, pkg, source) {
           ...source.installId ? { installId: source.installId } : {}
         }
       }
-    ], { componentId: SYSTEM_COMPONENT_ID });
+    ], { componentRef: SYSTEM_REGISTERED_COMPONENT_REF });
     steps.push({ step: "create-install-record", status: "ok" });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -38439,13 +38728,13 @@ async function installComponent(client, org, repo, pkg, source) {
       data: manifestShapeData(shape)
     }));
     try {
-      await client.commit.apply(org, repo, `Add shapes for ${meta.name}`, shapeOps, { componentId });
+      await client.commit.apply(org, repo, `Add shapes for ${meta.name}`, shapeOps, { componentRef: source.registeredComponentRef });
       steps.push({ step: "create-shapes", status: "ok" });
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       if (isAlreadyExistsError(err)) {
         try {
-          await reconcileShapesAfterCreateConflict(client, org, repo, pkg);
+          await reconcileShapesAfterCreateConflict(client, org, repo, pkg, source);
           steps.push({
             step: "create-shapes",
             status: "ok",
@@ -38522,7 +38811,7 @@ async function installComponent(client, org, repo, pkg, source) {
         filterJson: compiled.filterJson,
         webhookUrl: compiled.webhookUrl,
         fallbackWebhookUrl: compiled.fallbackWebhookUrl,
-        componentId
+        componentRef: source.registeredComponentRef
       });
       steps.push({ step: `create-sub-${sub.name}`, status: "ok" });
     } catch (err) {
@@ -38561,7 +38850,7 @@ async function installComponent(client, org, repo, pkg, source) {
           name: seedName,
           data: seed.data
         }
-      ], { componentId });
+      ], { componentRef: source.registeredComponentRef });
       steps.push({ step: `seed-${seedName}`, status: "ok" });
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
@@ -38588,8 +38877,8 @@ async function installComponent(client, org, repo, pkg, source) {
           componentId,
           name: meta.name,
           version: meta.version,
-          source: source.githubUrl ?? "local",
-          sourceKind: source.sourceKind ?? (source.githubUrl ? "github" : "local"),
+          source: "registry",
+          sourceKind: "registered",
           sourceRef: source.ref ?? "",
           resolvedSha: source.resolvedSha ?? "",
           ...source.registeredComponentRef ? { registeredComponentRef: source.registeredComponentRef } : {},
@@ -38601,7 +38890,7 @@ async function installComponent(client, org, repo, pkg, source) {
           ...source.installId ? { installId: source.installId } : {}
         }
       }
-    ], { componentId: SYSTEM_COMPONENT_ID });
+    ], { componentRef: SYSTEM_REGISTERED_COMPONENT_REF });
     steps.push({ step: "finalize", status: "ok" });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -38619,12 +38908,12 @@ function assertCliMethodsAllowedForSource(pkg, source) {
   const hasCliMethods = (pkg.manifest.cli?.methods?.length ?? 0) > 0;
   if (!hasCliMethods)
     return;
-  if (source.sourceKind === "registered" && typeof source.registeredComponentRef === "string" && source.registeredComponentRef.length > 0) {
+  if (typeof source.registeredComponentRef === "string" && source.registeredComponentRef.length > 0) {
     return;
   }
   throw new CliError(2 /* UserInput */, "USER_INPUT", "Components that declare manifest.cli.methods must be installed from the registry.", undefined, "Register the component, then install it as <org>/<name>. Local path and GitHub URL installs cannot expose CLI methods.");
 }
-async function reconcileShapesAfterCreateConflict(client, org, repo, pkg) {
+async function reconcileShapesAfterCreateConflict(client, org, repo, pkg, source) {
   const { meta, manifest } = pkg;
   const existingShapes = new Map;
   for (const shape of manifest.shapes) {
@@ -38632,8 +38921,8 @@ async function reconcileShapesAfterCreateConflict(client, org, repo, pkg) {
       const existingShape = await client.shape.get(org, repo, shape.name, {
         includeRetracted: true
       });
-      if (existingShape.componentId !== meta.id) {
-        const owner = existingShape.componentId ? `owned by component "${existingShape.componentId}"` : "not owned by this component";
+      if (existingShape.componentRef !== source.registeredComponentRef) {
+        const owner = existingShape.componentRef ? `owned by component "${existingShape.componentRef}"` : "not owned by this component";
         throw new Error(`Shape "${shape.name}" already exists and is ${owner}; cannot reconcile during fresh install`);
       }
       existingShapes.set(shape.name, existingShape);
@@ -38655,7 +38944,7 @@ async function reconcileShapesAfterCreateConflict(client, org, repo, pkg) {
           name: shape.name,
           data
         }
-      ], { componentId: meta.id });
+      ], { componentRef: source.registeredComponentRef });
       continue;
     }
     try {
@@ -38666,7 +38955,7 @@ async function reconcileShapesAfterCreateConflict(client, org, repo, pkg) {
           name: shape.name,
           data
         }
-      ], { componentId: meta.id });
+      ], { componentRef: source.registeredComponentRef });
     } catch (err) {
       if (isAlreadyExistsError(err)) {
         throw new Error(`Shape "${shape.name}" already exists but ownership could not be verified; cannot reconcile during fresh install`);
@@ -38888,14 +39177,16 @@ async function runCli(argv, opts) {
     teeStderr: debugMode,
     whVersion: version
   });
-  process.once("uncaughtException", (e) => {
+  const handleUncaughtException = (e) => {
     logger.crash(e, "uncaughtException");
     process.exit(1);
-  });
-  process.once("unhandledRejection", (reason) => {
+  };
+  const handleUnhandledRejection = (reason) => {
     logger.crash(reason, "unhandledRejection");
     process.exit(1);
-  });
+  };
+  process.once("uncaughtException", handleUncaughtException);
+  process.once("unhandledRejection", handleUnhandledRejection);
   logger.info("cli.start", {
     argv: redactArgv(argv),
     version,
@@ -38905,6 +39196,7 @@ async function runCli(argv, opts) {
     profile: getStringFlag(invocation.flags, "profile", "P") ?? undefined
   });
   let exitCode = 0 /* Ok */;
+  let removeSignalListeners;
   try {
     canonicalizeGlobalFlags({ invocation });
     const retirementHint = lookupInvocationRenameHint(invocation);
@@ -38957,17 +39249,23 @@ async function runCli(argv, opts) {
     const chars = makeChars();
     const ac = new AbortController;
     const liveMode = getBoolFlag(invocation.flags, "live");
-    process.on("SIGINT", () => {
+    const handleSigint = () => {
       ac.abort();
       logger.info("cli.cancelled", { signal: "SIGINT" });
       if (!liveMode)
         process.exitCode = 130 /* Cancelled */;
-    });
-    process.on("SIGTERM", () => {
+    };
+    const handleSigterm = () => {
       ac.abort();
       logger.info("cli.cancelled", { signal: "SIGTERM" });
       process.exitCode = 143;
-    });
+    };
+    process.on("SIGINT", handleSigint);
+    process.on("SIGTERM", handleSigterm);
+    removeSignalListeners = () => {
+      process.removeListener("SIGINT", handleSigint);
+      process.removeListener("SIGTERM", handleSigterm);
+    };
     await dispatch({
       client,
       config,
@@ -39026,6 +39324,9 @@ async function runCli(argv, opts) {
     });
     return exitCode;
   } finally {
+    process.removeListener("uncaughtException", handleUncaughtException);
+    process.removeListener("unhandledRejection", handleUnhandledRejection);
+    removeSignalListeners?.();
     logger.info("cli.end", {
       exit_code: exitCode,
       duration_ms: Date.now() - startedAt
@@ -39081,7 +39382,7 @@ function resolveLogLevel(flags, env) {
 // package.json
 var package_default3 = {
   name: "@warmhub/cli",
-  version: "0.52.1",
+  version: "0.54.0",
   private: false,
   type: "module",
   description: "The wh CLI for WarmHub — create repos, commit and query data, and compound knowledge with your AI agents.",
@@ -39228,14 +39529,17 @@ async function maybeHandleComponentShellBoundary(argv, deps = {}) {
         callRegisteredSetup: callRegisteredSetupImpl
       });
     }
-    const name = invocation.positional[1];
-    if (!name) {
+    const componentRef = invocation.positional[1];
+    if (!componentRef) {
       return;
     }
+    if (!isRegisteredComponentSource(componentRef)) {
+      throw new CliError(2 /* UserInput */, "USER_INPUT", `Invalid component reference '${componentRef}'. Expected '<org>/<name>' with no extra slashes and no empty parts.`, undefined, "Usage: wh component update <org/name> --repo org/repo");
+    }
     const repoFlag = getStringFlag(invocation.flags, "repo") ?? config.defaultRepo;
     const refOverride = getStringFlag(invocation.flags, "ref");
     return await handleComponentUpdate({
-      name,
+      componentRef,
       repoFlag,
       refOverride,
       client,
@@ -39306,7 +39610,6 @@ async function performRegisteredInstall(args) {
   invalidateInstallSnapshotCache(installRepo);
   const result = await args.installFromManifest(args.client, args.parsedRepo.org, args.parsedRepo.repo, resolved.manifest, {
     installId,
-    sourceKind: "registered",
     registeredComponentRef: args.componentRef
   });
   if (!result.ok) {
@@ -39371,11 +39674,15 @@ function warmHubErrorBackendCode(error) {
 async function handleComponentUpdate(args) {
   const parsedRepo = parseOrgRepo(args.repoFlag, args.config);
   const installRepo = `${parsedRepo.org}/${parsedRepo.repo}`;
-  const installThing = await args.client.thing.get(parsedRepo.org, parsedRepo.repo, `ComponentInstall/${args.name}`);
+  const componentId = await resolveInstalledComponentRefId(args.client, parsedRepo.org, parsedRepo.repo, args.componentRef);
+  const installThing = await args.client.thing.get(parsedRepo.org, parsedRepo.repo, `ComponentInstall/${componentId}`);
   const installData = installThing.data && typeof installThing.data === "object" ? installThing.data : {};
   const source = resolveComponentUpdateSource(installData);
   if (source.kind === "registered") {
     rejectRefForRegistered(source.componentRef, args.refOverride);
+    if (source.componentRef !== args.componentRef) {
+      throw new CliError(2 /* UserInput */, "USER_INPUT", `Component '${args.componentRef}' resolved to an install for '${source.componentRef}', which is inconsistent with the install record.`);
+    }
     return performRegisteredInstall({
       componentRef: source.componentRef,
       persistedInstallData: installData,
@@ -39391,9 +39698,9 @@ async function handleComponentUpdate(args) {
     });
   }
   if (source.kind === "system") {
-    throw new CliError(2 /* UserInput */, "USER_INPUT", `Component '${args.name}' is a platform-managed system install and cannot be updated via the CLI; it is reconciled automatically by the WarmHub backend.`);
+    throw new CliError(2 /* UserInput */, "USER_INPUT", `Component '${args.componentRef}' is a platform-managed system install and cannot be updated via the CLI; it is reconciled automatically by the WarmHub backend.`);
   }
-  throw new CliError(2 /* UserInput */, "USER_INPUT", `Component '${args.name}' was not installed from a registered component and can no longer be updated in place.`, undefined, "Register the component (`wh component register <name> --org <org> --manifest <path>`) and reinstall it with `wh component install <org>/<name>`.");
+  throw new CliError(2 /* UserInput */, "USER_INPUT", `Component '${args.componentRef}' was not installed from a registered component and can no longer be updated in place.`, undefined, "Register the component (`wh component register <name> --org <org> --manifest <path>`) and reinstall it with `wh component install <org>/<name>`.");
 }
 async function writeInstallResult(writeOut, writeErr, format, verb, result, installRepo, client) {
   if (result.ok) {
@@ -39866,4 +40173,4 @@ if (!updateCheckSuppressedByArgv && shouldRunUpdateCheck(updateEligibility)) {
 var interceptedExitCode = await maybeHandleComponentShellBoundary(dispatchArgv);
 process.exitCode = interceptedExitCode === undefined ? await runCli(dispatchArgv, { version: package_default3.version }) : interceptedExitCode;
 
-//# debugId=4117FD49D270041C64756E2164756E21
+//# debugId=194B08F51AA9569F64756E2164756E21