@warmhub/cli 0.58.0 → 0.60.0

package/dist/wh.js

@@ -18531,6 +18531,12 @@ var DEFAULT_MAX_OPS_PER_STREAM = 1e6;
 var DEFAULT_STREAM_APPEND_CHUNK_SIZE = 1000;
 var MAX_STREAM_APPEND_OPERATION_COUNT = 1e4;
 // ../../packages/rules/src/commit-types.ts
+var COMMIT_OPERATION_KINDS = [
+  "shape",
+  "thing",
+  "assertion",
+  "collection"
+];
 function inferOperationKind(op) {
   if (op.kind === "shape" || op.kind === "thing" || op.kind === "assertion" || op.kind === "collection") {
     return op.kind;
@@ -21379,6 +21385,15 @@ function nestedObjectFields(typeDef) {
   }
   return fields;
 }
+// ../../packages/rules/src/subscribable-events.ts
+var COMMIT_EVENT_TYPE = "commit";
+var REPO_RENAMED_EVENT_TYPE = "repo.renamed";
+var ORG_RENAMED_EVENT_TYPE = "org.renamed";
+var SUBSCRIBABLE_EVENT_TYPES = [
+  COMMIT_EVENT_TYPE,
+  REPO_RENAMED_EVENT_TYPE,
+  ORG_RENAMED_EVENT_TYPE
+];
 // ../../packages/rules/src/system-components/system.ts
 var SYSTEM_COMPONENT_ID = "com.warmhub.system";
 var SYSTEM_REGISTERED_COMPONENT_REF = "warmhub/system";
@@ -21442,7 +21457,7 @@ function findSystemComponent(componentId) {
 // ../../packages/sdk-ts/package.json
 var package_default = {
   name: "@warmhub/sdk-ts",
-  version: "0.58.0",
+  version: "0.60.0",
   private: false,
   type: "module",
   description: "The TypeScript SDK for WarmHub — create repos, commit and query data, and compound knowledge with your AI agents.",
@@ -21563,6 +21578,14 @@ function toBackendStreamOperation(operation) {
       ...operation.leaseId ? { leaseId: operation.leaseId } : {}
     };
   }
+  if (operation.operation === "rename") {
+    return {
+      operation: "rename",
+      name: operation.name,
+      newName: operation.newName,
+      ...operation.kind ? { kind: operation.kind } : {}
+    };
+  }
   if (operation.operation === "revise") {
     const name = operation.name ?? operation.wref;
     if (!name) {
@@ -21955,7 +21978,7 @@ function toSubmittedStreamResult(writeResult, committer, createdByEmail, message
     operations: results.map((result) => ({
       ...result.opIndex !== undefined ? { opIndex: result.opIndex } : {},
       name: result.name ?? "",
-      operation: result.operation === "revise" || result.operation === "retract" || result.operation === "noop" ? result.operation : "add",
+      operation: result.operation === "revise" || result.operation === "retract" || result.operation === "rename" || result.operation === "noop" ? result.operation : "add",
       dataHash: result.dataHash ?? "",
       version: result.version ?? 0,
       status: streamAppendResultStatus(result),
@@ -22052,6 +22075,27 @@ function chunkArray(items, chunkSize) {
   }
   return chunks;
 }
+function toSubscriptionRef(args) {
+  const [first, repoName, name] = args;
+  return typeof first === "string" ? { orgName: first, repoName, name } : first;
+}
+function toSubscriptionListRef(args) {
+  const [first, repoName] = args;
+  return typeof first === "string" ? { orgName: first, repoName } : first;
+}
+function toSubscriptionBindRef(args) {
+  const [first, repoName, subscriptionName, credentialSetName] = args;
+  return typeof first === "string" ? {
+    orgName: first,
+    repoName,
+    subscriptionName,
+    credentialSetName
+  } : first;
+}
+function toSubscriptionUnbindRef(args) {
+  const [first, repoName, subscriptionName] = args;
+  return typeof first === "string" ? { orgName: first, repoName, subscriptionName } : first;
+}
 function sanitizeSubscriptionCreateInput(input) {
   const {
     actionContainer: _actionContainer,
@@ -23019,35 +23063,24 @@ class WarmHubClient {
         throw toWarmHubError(error);
       }
     },
-    get: async (orgName, repoName, name) => {
+    get: async (...args) => {
       try {
-        const result = await this.trpc.subscription.get.query({
-          orgName,
-          repoName,
-          name
-        });
+        const result = await this.trpc.subscription.get.query(toSubscriptionRef(args));
         return normalizeSubscriptionInfo(result);
       } catch (error) {
         throw toWarmHubError(error);
       }
     },
-    reveal: async (orgName, repoName, name) => {
+    reveal: async (...args) => {
       try {
-        return await this.trpc.subscription.reveal.query({
-          orgName,
-          repoName,
-          name
-        });
+        return await this.trpc.subscription.reveal.query(toSubscriptionRef(args));
       } catch (error) {
         throw toWarmHubError(error);
       }
     },
-    list: async (orgName, repoName) => {
+    list: async (...args) => {
       try {
-        const result = await this.trpc.subscription.list.query({
-          orgName,
-          repoName
-        });
+        const result = await this.trpc.subscription.list.query(toSubscriptionListRef(args));
         return normalizeSubscriptionList(result);
       } catch (error) {
         throw toWarmHubError(error);
@@ -23061,58 +23094,37 @@ class WarmHubClient {
         throw toWarmHubError(error);
       }
     },
-    pause: async (orgName, repoName, name) => {
+    pause: async (...args) => {
       try {
-        return await this.trpc.subscription.pause.mutate({
-          orgName,
-          repoName,
-          name
-        });
+        return await this.trpc.subscription.pause.mutate(toSubscriptionRef(args));
       } catch (error) {
         throw toWarmHubError(error);
       }
     },
-    resume: async (orgName, repoName, name) => {
+    resume: async (...args) => {
       try {
-        return await this.trpc.subscription.resume.mutate({
-          orgName,
-          repoName,
-          name
-        });
+        return await this.trpc.subscription.resume.mutate(toSubscriptionRef(args));
       } catch (error) {
         throw toWarmHubError(error);
       }
     },
-    remove: async (orgName, repoName, name) => {
+    remove: async (...args) => {
       try {
-        return await this.trpc.subscription.remove.mutate({
-          orgName,
-          repoName,
-          name
-        });
+        return await this.trpc.subscription.remove.mutate(toSubscriptionRef(args));
       } catch (error) {
         throw toWarmHubError(error);
       }
     },
-    bindCredentials: async (orgName, repoName, subscriptionName, credentialSetName) => {
+    bindCredentials: async (...args) => {
       try {
-        return await this.trpc.subscription.bindCredentials.mutate({
-          orgName,
-          repoName,
-          subscriptionName,
-          credentialSetName
-        });
+        return await this.trpc.subscription.bindCredentials.mutate(toSubscriptionBindRef(args));
       } catch (error) {
         throw toWarmHubError(error);
       }
     },
-    unbindCredentials: async (orgName, repoName, subscriptionName) => {
+    unbindCredentials: async (...args) => {
       try {
-        return await this.trpc.subscription.unbindCredentials.mutate({
-          orgName,
-          repoName,
-          subscriptionName
-        });
+        return await this.trpc.subscription.unbindCredentials.mutate(toSubscriptionUnbindRef(args));
       } catch (error) {
         throw toWarmHubError(error);
       }
@@ -24186,6 +24198,9 @@ function toCliError(err) {
       const defaultHint = typeof retryAfter === "number" ? `Rate limited. Retry after ${retryAfter}s.` : "Rate limited. Wait for the Retry-After window before retrying.";
       return fromWh(4 /* Backend */, "RATE_LIMITED", err, err.hint ?? defaultHint);
     }
+    if (err.code === "QUERY_TOO_EXPENSIVE") {
+      return fromWh(2 /* UserInput */, "QUERY_TOO_EXPENSIVE", err, err.hint ?? "Narrow the query with a more selective field predicate or retry with a shallower page.");
+    }
     if (err.status) {
       return fromWh(4 /* Backend */, "BACKEND", err);
     }
@@ -24342,6 +24357,14 @@ function generateSuggestions(code, message, context, errorCode) {
       command: "wh repo describe --indexed-fields"
     });
   }
+  if (code === "QUERY_TOO_EXPENSIVE") {
+    suggestions.push({
+      action: "Narrow the query with a more selective field predicate"
+    });
+    suggestions.push({
+      action: "Retry with a shallower page or smaller result window"
+    });
+  }
   if (code === "AUTH") {
     suggestions.push({
       action: "Re-authenticate",
@@ -24376,6 +24399,7 @@ function shouldLogToErrorTier(err) {
     case "UNKNOWN":
     case "RATE_LIMITED":
       return true;
+    case "QUERY_TOO_EXPENSIVE":
     case "FIELD_NOT_INDEXABLE":
       return false;
     case "FIELD_INDEX_UNAVAILABLE":
@@ -24427,6 +24451,9 @@ function cliErrorFromOpFailure(failure) {
   if (code === "RATE_LIMITED") {
     return make(4 /* Backend */, "RATE_LIMITED", "Rate limited. Wait for the Retry-After window before retrying.");
   }
+  if (code === "QUERY_TOO_EXPENSIVE") {
+    return make(2 /* UserInput */, "QUERY_TOO_EXPENSIVE", "Narrow the query with a more selective field predicate or retry with a shallower page.");
+  }
   return make(4 /* Backend */, "BACKEND");
 }
 function cliErrorFromAllFailed(failures) {
@@ -26640,16 +26667,16 @@ function renderThing(out, c, result) {
     out(`  ${c.dim}about:${c.reset}     ${String(aboutWref)}`);
   }
   const meta = result.metadata;
-  if (meta?.durableId || meta?.thingCreatedAt || meta?.versionCreatedAt) {
+  if (meta?.durableId || meta?.createdOn || meta?.revisedOn) {
     const now = Date.now();
     if (meta.durableId) {
       out(`  ${c.dim}durableId:${c.reset} ${meta.durableId}`);
     }
-    if (meta.thingCreatedAt) {
-      out(`  ${c.dim}thingCreated:${c.reset}  ${formatTime(meta.thingCreatedAt, now)}`);
+    if (meta.createdOn) {
+      out(`  ${c.dim}createdOn:${c.reset}  ${formatTime(meta.createdOn, now)}`);
     }
-    if (meta.versionCreatedAt) {
-      out(`  ${c.dim}versionCreated:${c.reset}${formatTime(meta.versionCreatedAt, now)}`);
+    if (meta.revisedOn) {
+      out(`  ${c.dim}revisedOn:${c.reset}  ${formatTime(meta.revisedOn, now)}`);
     }
   }
   const fields = shapeName && result.data ? collectionFields(shapeName, result.data) : null;
@@ -26762,8 +26789,8 @@ function renderHistory(out, c, result) {
     const wref = ver.wref ?? ver.thingName;
     const wrefStr = wref ? pinnedWref(c, wref, ver.version) : "";
     const by = ver.committerWref ? `  ${c.dim}by${c.reset} ${pinnedWref(c, ver.committerWref)}` : "";
-    const thingCreatedAt = ver.metadata?.thingCreatedAt;
-    const thingCreatedStr = thingCreatedAt ? `  ${c.dim}born:${formatTime(thingCreatedAt, now)}${c.reset}` : "";
+    const createdOn = ver.metadata?.createdOn;
+    const thingCreatedStr = createdOn ? `  ${c.dim}born:${formatTime(createdOn, now)}${c.reset}` : "";
     out(`  ${wrefStr}  ${op}  ${c.dim}${time}${c.reset}${by}${thingCreatedStr}`);
   }
 }
@@ -31087,7 +31114,7 @@ var handleTemplate = async (ctx, { flags, args }) => {
   if (operationType !== "add" && operationType !== "revise" && operationType !== "retract") {
     throw new CliError(2 /* UserInput */, "USER_INPUT", `Invalid --operation "${operationType}". Must be "add", "revise", or "retract".`);
   }
-  const validKinds = operationType === "retract" ? ["thing", "assertion", "shape", "collection"] : ["thing", "assertion"];
+  const validKinds = operationType === "retract" ? COMMIT_OPERATION_KINDS : ["thing", "assertion"];
   if (!validKinds.includes(flags.kind ?? "thing")) {
     throw new CliError(2 /* UserInput */, "USER_INPUT", `Invalid --kind "${flags.kind}". Must be one of: ${validKinds.join(", ")}.`);
   }
@@ -31432,7 +31459,11 @@ var GLOBAL_FLAGS = [
     description: "Output mode: pretty|json (default: pretty)"
   },
   { long: "json", type: "boolean", description: "Alias for --format json" },
-  { long: "live", type: "boolean", description: "Reactive WebSocket mode" },
+  {
+    long: "live",
+    type: "boolean",
+    description: "Live mode (polls for updates)"
+  },
   {
     long: "max-updates",
     type: "number",
@@ -33820,7 +33851,7 @@ async function collectChecks(ctx) {
           name: "compatibility",
           status: "fail",
           message: `SDK v${SDK_VERSION} is older than minimum supported ${caps.minSupportedSdk} (apiVersion: ${caps.apiVersion})`,
-          fix: "Update with: bun install @warmhub/cli@latest"
+          fix: "Update with: wh update --yes"
         });
       } else {
         checks.push({
@@ -36471,10 +36502,19 @@ function renderSubscriptionLog(out, statusOut, c, subscriptionName, result) {
     }
   }
 }
+var orgScopeFlag = flag.string({
+  description: "Org slug for an org-scoped subscription (org.renamed); use instead of --repo"
+});
 var createFlags8 = {
   on: flag.string({
     description: "Shape to subscribe to"
   }),
+  event: flag.string({
+    description: "Event to watch: commit (default), repo.renamed, or org.renamed"
+  }),
+  org: flag.string({
+    description: "Org slug for an org-scoped subscription (org.renamed)"
+  }),
   kind: flag.string({
     description: "Subscription kind (webhook; the default)"
   }),
@@ -36519,18 +36559,34 @@ var updateFlags4 = {
     description: "Clear the fallback webhook URL"
   }),
   "allow-trace-reentry": createFlags8["allow-trace-reentry"],
-  name: createFlags8.name
+  name: createFlags8.name,
+  org: orgScopeFlag
 };
 var logFlags = {
   limit: flag.number({ description: "Max deliveries to return" })
 };
 var listFlags5 = {
-  limit: flag.number({ description: "Max subscriptions to return" })
+  limit: flag.number({ description: "Max subscriptions to return" }),
+  org: orgScopeFlag
+};
+function resolveSubScope(ctx, flags) {
+  if (typeof flags.org === "string" && flags.org) {
+    return { orgName: flags.org };
+  }
+  const { org, repo } = resolveRepoContext(ctx);
+  return { orgName: org, repoName: repo };
+}
+function scopeLabel(scope) {
+  return scope.repoName ? `${scope.orgName}/${scope.repoName}` : scope.orgName;
+}
+var scopeFlags = {
+  org: orgScopeFlag
 };
 var viewFlags5 = {
   "show-secrets": flag.boolean({
     description: "Reveal the raw webhook URL(s) instead of the redacted origin (audit-logged)"
-  })
+  }),
+  org: orgScopeFlag
 };
 function buildSubscriptionPatchArgs(flags, usage, example) {
   const args = {};
@@ -36576,22 +36632,83 @@ function buildSubscriptionMutationArgs(flags, usage, example) {
   }
   return mutationArgs;
 }
+function parseEventType(raw, _usage, example) {
+  if (raw === undefined) {
+    return COMMIT_EVENT_TYPE;
+  }
+  if (SUBSCRIBABLE_EVENT_TYPES.includes(raw)) {
+    return raw;
+  }
+  usageError(`--event must be one of: ${SUBSCRIBABLE_EVENT_TYPES.join(", ")}`, example);
+}
+function rejectCommitFlags(flags, eventType) {
+  for (const f of ["on", "filter", "source"]) {
+    const v = flags[f];
+    if (typeof v === "string" && v.length > 0) {
+      usageError(`--${f} is not valid for ${eventType} subscriptions — rename events have no shape or filter`, `wh sub create rename-hook --event ${eventType} --webhook-url https://example.com/hook`);
+    }
+  }
+}
 var handleCreate7 = async (ctx, { flags, args }) => {
   const name = args[0] ?? flags.name;
-  const usage = "Usage: wh sub create <name> --repo org/repo [--kind webhook] [options]";
+  const usage = "Usage: wh sub create <name> (--repo org/repo | --org org) [--event commit|repo.renamed|org.renamed] [options]";
   const example = `wh sub create signal-hook --repo myorg/myrepo --on Signal --filter '{"shape":"Signal"}' --webhook-url https://example.com/hook`;
   if (!name) {
     usageError(usage, example);
   }
   rejectRemovedCronFlags(flags);
   const kind = parseKind(flags.kind, usage, example);
-  const { org, repo } = resolveRepoContext(ctx);
-  const createArgs = buildSubscriptionMutationArgs(flags, usage, example);
-  const sourceRepoRef = typeof flags.source === "string" ? flags.source : undefined;
-  const webhookUrl = createArgs.webhookUrl;
+  const eventType = parseEventType(flags.event, usage, example);
+  const webhookUrl = typeof flags["webhook-url"] === "string" ? flags["webhook-url"] : typeof flags.url === "string" ? flags.url : undefined;
   if (!webhookUrl) {
     usageError(usage, example);
   }
+  const fallbackWebhookUrl = typeof flags["fallback-webhook-url"] === "string" ? flags["fallback-webhook-url"] : undefined;
+  const allowTraceReentry = flags["allow-trace-reentry"] === true;
+  const renameExtras = {
+    ...fallbackWebhookUrl ? { fallbackWebhookUrl } : {},
+    ...allowTraceReentry ? { allowTraceReentry: true } : {}
+  };
+  if (eventType === "org.renamed") {
+    const orgName = typeof flags.org === "string" ? flags.org : undefined;
+    if (!orgName) {
+      usageError("org.renamed subscriptions are org-scoped — pass --org <org> (not --repo)", "wh sub create org-rename-hook --org myorg --event org.renamed --webhook-url https://example.com/hook");
+    }
+    rejectCommitFlags(flags, eventType);
+    const result2 = await ctx.client.subscription.create({
+      orgName,
+      name,
+      eventType,
+      kind,
+      webhookUrl,
+      ...renameExtras
+    });
+    writeOutput(ctx, result2, () => {
+      const c = ctx.colors;
+      ctx.status(`${c.green}Created subscription${c.reset} ${c.cyan}${name}${c.reset} on org ${c.cyan}${orgName}${c.reset} (org.renamed)`);
+    });
+    return;
+  }
+  const { org, repo } = resolveRepoContext(ctx);
+  if (eventType === "repo.renamed") {
+    rejectCommitFlags(flags, eventType);
+    const result2 = await ctx.client.subscription.create({
+      orgName: org,
+      repoName: repo,
+      name,
+      eventType,
+      kind,
+      webhookUrl,
+      ...renameExtras
+    });
+    writeOutput(ctx, result2, () => {
+      const c = ctx.colors;
+      ctx.status(`${c.green}Created subscription${c.reset} ${c.cyan}${name}${c.reset} on ${c.cyan}${org}/${repo}${c.reset} (repo.renamed)`);
+    });
+    return;
+  }
+  const createArgs = buildSubscriptionMutationArgs(flags, usage, example);
+  const sourceRepoRef = typeof flags.source === "string" ? flags.source : undefined;
   const result = await ctx.client.subscription.create({
     orgName: org,
     repoName: repo,
@@ -36611,24 +36728,24 @@ var handleCreate7 = async (ctx, { flags, args }) => {
 };
 var handleUpdate4 = async (ctx, { flags, args }) => {
   const name = args[0] ?? flags.name;
-  const usage = "Usage: wh sub update <name> --repo org/repo [options]";
+  const usage = "Usage: wh sub update <name> (--repo org/repo | --org org) [options]";
   const example = "wh sub update signal-hook --repo myorg/myrepo";
   if (!name) {
     usageError(usage, example);
   }
   rejectRemovedCronFlags(flags);
-  const { org, repo } = resolveRepoContext(ctx);
-  const existing = await ctx.client.subscription.get(org, repo, name);
+  const scope = resolveSubScope(ctx, flags);
+  const scopeArg = scope.repoName ? `--repo ${scopeLabel(scope)}` : `--org ${scope.orgName}`;
+  const existing = await ctx.client.subscription.get({ ...scope, name });
   if (existing.kind !== "webhook") {
-    throw new CliError(2 /* UserInput */, "USER_INPUT", `Subscription "${name}" has kind "${existing.kind}", which is no longer supported and cannot be updated`, undefined, `Delete it with: wh sub delete ${name} --repo ${org}/${repo}`);
+    throw new CliError(2 /* UserInput */, "USER_INPUT", `Subscription "${name}" has kind "${existing.kind}", which is no longer supported and cannot be updated`, undefined, `Delete it with: wh sub delete ${name} ${scopeArg}`);
   }
   if (flags.kind && flags.kind !== existing.kind) {
     usageError(usage, example);
   }
   const patchArgs = buildSubscriptionPatchArgs(flags, usage, example);
   const result = await ctx.client.subscription.update({
-    orgName: org,
-    repoName: repo,
+    ...scope,
     name,
     ...patchArgs.shapeName != null ? { shapeName: patchArgs.shapeName } : {},
     ...patchArgs.filterJson != null ? {
@@ -36642,17 +36759,17 @@ var handleUpdate4 = async (ctx, { flags, args }) => {
   });
   writeOutput(ctx, result, () => {
     const c = ctx.colors;
-    ctx.status(`${c.green}Updated subscription${c.reset} ${c.cyan}${name}${c.reset} on ${c.cyan}${org}/${repo}${c.reset}`);
+    ctx.status(`${c.green}Updated subscription${c.reset} ${c.cyan}${name}${c.reset} on ${c.cyan}${scopeLabel(scope)}${c.reset}`);
   });
 };
 var handleView8 = async (ctx, { args, flags }) => {
   const name = args[0];
   if (!name) {
-    usageError("Usage: wh sub view <name> [--show-secrets] [--repo org/repo]", "wh sub view signal-hook --repo myorg/myrepo");
+    usageError("Usage: wh sub view <name> [--show-secrets] (--repo org/repo | --org org)", "wh sub view signal-hook --repo myorg/myrepo");
   }
-  const { org, repo } = resolveRepoContext(ctx);
-  const sub = await ctx.client.subscription.get(org, repo, name);
-  const revealed = flags["show-secrets"] ? await ctx.client.subscription.reveal(org, repo, name) : undefined;
+  const scope = resolveSubScope(ctx, flags);
+  const sub = await ctx.client.subscription.get({ ...scope, name });
+  const revealed = flags["show-secrets"] ? await ctx.client.subscription.reveal({ ...scope, name }) : undefined;
   writeOutput(ctx, revealed ? { ...sub, ...revealed } : sub, () => {
     const c = ctx.colors;
     ctx.out(`${c.bold}${sub.name}${c.reset}`);
@@ -36679,16 +36796,17 @@ var handleView8 = async (ctx, { args, flags }) => {
   });
 };
 var handleList7 = async (ctx, { flags }) => {
-  const { org, repo } = resolveRepoContext(ctx);
-  const all = await ctx.client.subscription.list(org, repo);
+  const scope = resolveSubScope(ctx, flags);
+  const label = scopeLabel(scope);
+  const all = await ctx.client.subscription.list(scope);
   const items = all.slice(0, flags.limit ?? all.length);
   writePageOutput(ctx, items, { limit: flags.limit ?? all.length, nextCursor: null }, () => {
     const c = ctx.colors;
     if (!items.length) {
-      ctx.status(`${c.dim}No subscriptions in ${org}/${repo}${c.reset}`);
+      ctx.status(`${c.dim}No subscriptions in ${label}${c.reset}`);
       return;
     }
-    ctx.out(`${c.bold}Subscriptions:${c.reset} ${c.cyan}${org}/${repo}${c.reset}`);
+    ctx.out(`${c.bold}Subscriptions:${c.reset} ${c.cyan}${label}${c.reset}`);
     for (const sub of items) {
       const active = sub.active ? `${c.green}active` : `${c.yellow}paused`;
       let line = `  ${c.cyan}${sub.name}${c.reset} ${c.dim}[${sub.kind}]${c.reset} ${active}${c.reset}`;
@@ -36699,37 +36817,37 @@ var handleList7 = async (ctx, { flags }) => {
     }
   });
 };
-var handlePause = async (ctx, { args }) => {
+var handlePause = async (ctx, { args, flags }) => {
   const name = args[0];
   if (!name) {
-    usageError("Usage: wh sub pause <name> [--repo org/repo]", "wh sub pause signal-hook --repo myorg/myrepo");
+    usageError("Usage: wh sub pause <name> (--repo org/repo | --org org)", "wh sub pause signal-hook --repo myorg/myrepo");
   }
-  const { org, repo } = resolveRepoContext(ctx);
-  const result = await ctx.client.subscription.pause(org, repo, name);
+  const scope = resolveSubScope(ctx, flags);
+  const result = await ctx.client.subscription.pause({ ...scope, name });
   writeOutput(ctx, result, () => {
     const c = ctx.colors;
     ctx.status(`${c.yellow}Paused subscription${c.reset} ${c.cyan}${name}${c.reset}`);
   });
 };
-var handleResume = async (ctx, { args }) => {
+var handleResume = async (ctx, { args, flags }) => {
   const name = args[0];
   if (!name) {
-    usageError("Usage: wh sub resume <name> [--repo org/repo]", "wh sub resume signal-hook --repo myorg/myrepo");
+    usageError("Usage: wh sub resume <name> (--repo org/repo | --org org)", "wh sub resume signal-hook --repo myorg/myrepo");
   }
-  const { org, repo } = resolveRepoContext(ctx);
-  const result = await ctx.client.subscription.resume(org, repo, name);
+  const scope = resolveSubScope(ctx, flags);
+  const result = await ctx.client.subscription.resume({ ...scope, name });
   writeOutput(ctx, result, () => {
     const c = ctx.colors;
     ctx.status(`${c.green}Resumed subscription${c.reset} ${c.cyan}${name}${c.reset}`);
   });
 };
-var handleDelete3 = async (ctx, { args }) => {
+var handleDelete3 = async (ctx, { args, flags }) => {
   const name = args[0];
   if (!name) {
-    usageError("Usage: wh sub delete <name> [--repo org/repo]", "wh sub delete signal-hook --repo myorg/myrepo");
+    usageError("Usage: wh sub delete <name> (--repo org/repo | --org org)", "wh sub delete signal-hook --repo myorg/myrepo");
   }
-  const { org, repo } = resolveRepoContext(ctx);
-  const result = await ctx.client.subscription.remove(org, repo, name);
+  const scope = resolveSubScope(ctx, flags);
+  const result = await ctx.client.subscription.remove({ ...scope, name });
   writeOutput(ctx, result, () => {
     const c = ctx.colors;
     ctx.status(`${c.red}Deleted subscription${c.reset} ${c.cyan}${name}${c.reset}`);
@@ -36738,28 +36856,36 @@ var handleDelete3 = async (ctx, { args }) => {
 var bindFlags = {
   credentials: flag.string({
     description: "Name of the credential set to bind"
-  })
+  }),
+  org: orgScopeFlag
 };
 var handleBind = async (ctx, { flags, args }) => {
   const name = args[0];
   const setName = flags.credentials;
   if (!name || !setName) {
-    usageError("Usage: wh sub bind <name> --credentials <setName> [--repo org/repo]", "wh sub bind signal-hook --credentials webhook-keys --repo myorg/myrepo");
+    usageError("Usage: wh sub bind <name> --credentials <setName> (--repo org/repo | --org org)", "wh sub bind signal-hook --credentials webhook-keys --repo myorg/myrepo");
   }
-  const { org, repo } = resolveRepoContext(ctx);
-  const result = await ctx.client.subscription.bindCredentials(org, repo, name, setName);
+  const scope = resolveSubScope(ctx, flags);
+  const result = await ctx.client.subscription.bindCredentials({
+    ...scope,
+    subscriptionName: name,
+    credentialSetName: setName
+  });
   writeOutput(ctx, result, () => {
     const c = ctx.colors;
     ctx.status(`${c.green}Bound${c.reset} ${c.cyan}${setName}${c.reset} to ${c.cyan}${name}${c.reset}`);
   });
 };
-var handleUnbind = async (ctx, { args }) => {
+var handleUnbind = async (ctx, { args, flags }) => {
   const name = args[0];
   if (!name) {
-    usageError("Usage: wh sub unbind <name> [--repo org/repo]", "wh sub unbind signal-hook --repo myorg/myrepo");
+    usageError("Usage: wh sub unbind <name> (--repo org/repo | --org org)", "wh sub unbind signal-hook --repo myorg/myrepo");
   }
-  const { org, repo } = resolveRepoContext(ctx);
-  const result = await ctx.client.subscription.unbindCredentials(org, repo, name);
+  const scope = resolveSubScope(ctx, flags);
+  const result = await ctx.client.subscription.unbindCredentials({
+    ...scope,
+    subscriptionName: name
+  });
   writeOutput(ctx, result, () => {
     const c = ctx.colors;
     ctx.status(`${c.yellow}Unbound${c.reset} credentials from ${c.cyan}${name}${c.reset}`);
@@ -36844,6 +36970,12 @@ var SUB_DOMAIN = defineDomain({
         "# Subscribe to shape retracts only",
         `  $ wh sub create shape-retracts --repo myorg/myrepo --kind webhook --filter '{"all":[{"kind":"shape"},{"operation":"retract"}]}' --webhook-url https://hooks.example.com/shapes`,
         "",
+        "# Subscribe to repo renames (metadata event — no shape/filter)",
+        "  $ wh sub create repo-rename-hook --repo myorg/myrepo --event repo.renamed --webhook-url https://example.com/hook",
+        "",
+        "# Subscribe to org renames (org-scoped — use --org, not --repo)",
+        "  $ wh sub create org-rename-hook --org myorg --event org.renamed --webhook-url https://example.com/hook",
+        "",
         "# Webhook auth: create a credential set with WEBHOOK_* keys, then bind it to the subscription.",
         "# See `wh credential set --help` for supported key names and `wh sub bind --help`.",
         "  $ wh credential create webhook-keys --repo myorg/myrepo",
@@ -36860,7 +36992,9 @@ var SUB_DOMAIN = defineDomain({
       flags: updateFlags4,
       examples: [
         "# Update only the webhook URL",
-        "  $ wh sub update signal-hook --repo myorg/myrepo --webhook-url https://example.com/v2/hook"
+        "  $ wh sub update signal-hook --repo myorg/myrepo --webhook-url https://example.com/v2/hook",
+        "# Repoint an org-scoped (org.renamed) rename hook in place",
+        "  $ wh sub update org-rename-hook --org myorg --webhook-url https://example.com/v2/hook"
       ],
       handler: handleUpdate4
     },
@@ -36872,7 +37006,9 @@ var SUB_DOMAIN = defineDomain({
       flags: viewFlags5,
       examples: [
         "wh sub view signal-hook --repo myorg/myrepo",
-        "wh sub view signal-hook --show-secrets --repo myorg/myrepo"
+        "wh sub view signal-hook --show-secrets --repo myorg/myrepo",
+        "# Org-scoped (org.renamed) subscription",
+        "  $ wh sub view org-rename-hook --org myorg"
       ],
       handler: handleView8
     },
@@ -36882,7 +37018,12 @@ var SUB_DOMAIN = defineDomain({
       summary: "List all subscriptions",
       args: "",
       flags: listFlags5,
-      examples: ["wh sub list --repo myorg/myrepo", "wh sub list --limit 10"],
+      examples: [
+        "wh sub list --repo myorg/myrepo",
+        "wh sub list --limit 10",
+        "# Org-scoped (org.renamed) subscriptions",
+        "  $ wh sub list --org myorg"
+      ],
       handler: handleList7
     },
     log: {
@@ -36922,7 +37063,12 @@ var SUB_DOMAIN = defineDomain({
       prime: true,
       summary: "Pause a subscription",
       args: "<name>",
-      examples: ["wh sub pause signal-hook --repo myorg/myrepo"],
+      flags: scopeFlags,
+      examples: [
+        "wh sub pause signal-hook --repo myorg/myrepo",
+        "# Org-scoped (org.renamed) subscription",
+        "  $ wh sub pause org-rename-hook --org myorg"
+      ],
       handler: handlePause
     },
     resume: {
@@ -36930,7 +37076,11 @@ var SUB_DOMAIN = defineDomain({
       prime: true,
       summary: "Resume a paused subscription",
       args: "<name>",
-      examples: ["wh sub resume signal-hook --repo myorg/myrepo"],
+      flags: scopeFlags,
+      examples: [
+        "wh sub resume signal-hook --repo myorg/myrepo",
+        "  $ wh sub resume org-rename-hook --org myorg"
+      ],
       handler: handleResume
     },
     bind: {
@@ -36941,7 +37091,9 @@ var SUB_DOMAIN = defineDomain({
       flags: bindFlags,
       examples: [
         "# Bind credentials to inject auth headers on webhook delivery",
-        "  $ wh sub bind signal-hook --credentials webhook-keys --repo myorg/myrepo"
+        "  $ wh sub bind signal-hook --credentials webhook-keys --repo myorg/myrepo",
+        "# Org-scoped (org.renamed) subscription + org-scoped credential set",
+        "  $ wh sub bind org-rename-hook --credentials org-webhook-keys --org myorg"
       ],
       handler: handleBind
     },
@@ -36950,7 +37102,11 @@ var SUB_DOMAIN = defineDomain({
       prime: true,
       summary: "Remove credential binding from a subscription",
       args: "<name>",
-      examples: ["wh sub unbind signal-hook --repo myorg/myrepo"],
+      flags: scopeFlags,
+      examples: [
+        "wh sub unbind signal-hook --repo myorg/myrepo",
+        "  $ wh sub unbind org-rename-hook --org myorg"
+      ],
       handler: handleUnbind
     },
     delete: {
@@ -36958,7 +37114,11 @@ var SUB_DOMAIN = defineDomain({
       prime: true,
       summary: "Delete a subscription",
       args: "<name>",
-      examples: ["wh sub delete signal-hook --repo myorg/myrepo"],
+      flags: scopeFlags,
+      examples: [
+        "wh sub delete signal-hook --repo myorg/myrepo",
+        "  $ wh sub delete org-rename-hook --org myorg"
+      ],
       handler: handleDelete3
     }
   }
@@ -37249,7 +37409,7 @@ var TOKEN_DOMAIN = defineDomain({
 
 // ../../packages/warmhub-cli/src/domains/update.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync7, readFileSync as readFileSync10 } from "node:fs";
+import { existsSync as existsSync7, readFileSync as readFileSync10, realpathSync } from "node:fs";
 import { homedir as homedir6 } from "node:os";
 import { dirname as dirname8, resolve as resolve4 } from "node:path";
 
@@ -37398,10 +37558,144 @@ var resolveUpdateStatus = async (currentVersion, deps = {}) => {
     cacheHit
   };
 };
-var defaultRunInstall = (latestVersion, registry2) => {
-  const proc = spawnSync2("npm", ["install", "-g", `@warmhub/cli@${latestVersion}`, "--registry", registry2], { stdio: "inherit", timeout: 120000 });
+var normalizePath = (path2) => path2 ? path2.replaceAll("\\", "/") : "";
+var pathStartsWith = (path2, prefix) => {
+  if (!prefix)
+    return false;
+  const normalizedPath = normalizePath(path2);
+  const normalizedPrefix = normalizePath(prefix).replace(/\/+$/, "");
+  return normalizedPath === normalizedPrefix || normalizedPath.startsWith(`${normalizedPrefix}/`);
+};
+var homeRelative = (homePath, suffix) => `${homePath.replace(/\/+$/, "")}/${suffix.replace(/^\/+/, "")}`;
+var getActiveWhLookupCommand = (platform2 = process.platform) => platform2 === "win32" ? { command: "where.exe", args: ["wh"] } : { command: "sh", args: ["-lc", "command -v wh"] };
+var resolveActiveWh = (deps = {}) => {
+  const env = deps.env ?? process.env;
+  const lookup = getActiveWhLookupCommand(deps.platform);
+  const spawn = deps.spawn ?? spawnSync2;
+  const realpath = deps.realpath ?? realpathSync.native;
+  const proc = spawn(lookup.command, lookup.args, {
+    encoding: "utf8",
+    env,
+    timeout: 5000
+  });
+  const activePath = proc.status === 0 ? proc.stdout.split(/\r?\n/).map((line) => line.trim()).find(Boolean) : undefined;
+  let realPath;
+  if (activePath) {
+    try {
+      realPath = realpath(activePath);
+    } catch {
+      realPath = activePath;
+    }
+  }
+  return { activePath, realPath };
+};
+var classifyActiveInstallManager = ({
+  activePath,
+  realPath,
+  env = process.env,
+  homePath = homedir6()
+}) => {
+  if (!activePath)
+    return;
+  const active = normalizePath(activePath);
+  const real = normalizePath(realPath ?? activePath);
+  const paths = [active, real];
+  const bunInstall = env.BUN_INSTALL ?? homeRelative(homePath, ".bun");
+  const pnpmHome = env.PNPM_HOME;
+  const windowsPnpmHome = env.LOCALAPPDATA ? `${env.LOCALAPPDATA}/pnpm` : undefined;
+  const npmPrefix = env.npm_config_prefix ?? env.NPM_CONFIG_PREFIX;
+  const windowsNpmHome = env.APPDATA ? `${env.APPDATA}/npm` : undefined;
+  if (paths.some((path2) => pathStartsWith(path2, homeRelative(homePath, ".bun/bin")) || pathStartsWith(path2, homeRelative(homePath, ".bun/install/global")) || pathStartsWith(path2, `${bunInstall}/bin`) || pathStartsWith(path2, `${bunInstall}/install/global`))) {
+    return "bun";
+  }
+  if (paths.some((path2) => pathStartsWith(path2, pnpmHome) || pathStartsWith(path2, windowsPnpmHome) || path2.includes("/pnpm-global/") || path2.includes("/.local/share/pnpm/") || path2.includes("/Library/pnpm/") || path2.includes("/AppData/Local/pnpm/") || path2.includes("/node_modules/.pnpm/"))) {
+    return "pnpm";
+  }
+  if (paths.some((path2) => pathStartsWith(path2, npmPrefix) || pathStartsWith(path2, windowsNpmHome) || path2.includes("/lib/node_modules/@warmhub/cli/") || path2.includes("/AppData/Roaming/npm/") || path2.includes("/node_modules/@warmhub/cli/"))) {
+    return "npm";
+  }
+  return;
+};
+var buildManualCommand = (manager, latestVersion, registry2) => {
+  const spec = `${WH_CACHE_PACKAGE_NAME}@${latestVersion}`;
+  switch (manager) {
+    case "bun":
+      return `bun add -g ${spec} --registry ${registry2}`;
+    case "pnpm":
+      return `pnpm add -g ${spec} --registry ${registry2}`;
+    case "npm":
+      return `npm install -g ${spec} --registry ${registry2}`;
+  }
+};
+var buildInstallPlan = (manager, latestVersion, registry2, activePath, realPath) => {
+  const spec = `${WH_CACHE_PACKAGE_NAME}@${latestVersion}`;
+  const manualCommand = buildManualCommand(manager, latestVersion, registry2);
+  switch (manager) {
+    case "bun":
+      return {
+        manager,
+        activePath,
+        realPath,
+        command: "bun",
+        args: ["add", "-g", spec, "--registry", registry2],
+        manualCommand
+      };
+    case "pnpm":
+      return {
+        manager,
+        activePath,
+        realPath,
+        command: "pnpm",
+        args: ["add", "-g", spec, "--registry", registry2],
+        manualCommand
+      };
+    case "npm":
+      return {
+        manager,
+        activePath,
+        realPath,
+        command: "npm",
+        args: ["install", "-g", spec, "--registry", registry2],
+        manualCommand
+      };
+  }
+};
+var defaultRunInstall = (plan) => {
+  const proc = spawnSync2(plan.command, plan.args, {
+    stdio: "inherit",
+    timeout: 120000
+  });
   return { status: proc.status, signal: proc.signal, error: proc.error };
 };
+var verifyActiveVersion = (activePath, deps = {}) => {
+  const platform2 = deps.platform ?? process.platform;
+  const spawn = deps.spawn ?? spawnSync2;
+  const shell = platform2 === "win32" && /\.(?:cmd|bat)$/i.test(normalizePath(activePath));
+  const proc = spawn(activePath, ["--version"], {
+    encoding: "utf8",
+    timeout: 15000,
+    ...shell ? { shell: true } : {}
+  });
+  return {
+    status: proc.status,
+    signal: proc.signal,
+    error: proc.error,
+    stdout: proc.stdout,
+    stderr: proc.stderr
+  };
+};
+var defaultVerifyActiveVersion = (activePath) => verifyActiveVersion(activePath);
+var parseVersionOutput = (output) => output?.match(/\b\d+\.\d+\.\d+(?:[-+][^\s]+)?\b/)?.[0];
+var formatInstallFailureMessage = (plan, result) => result.error ? `${plan.manager} install failed: ${result.error.message}` : result.signal ? `${plan.manager} install terminated by signal ${result.signal}` : `${plan.manager} install exited with status ${result.status}`;
+var formatUnknownInstallHint = (activePath, realPath, latestVersion, registry2) => [
+  activePath ? `Active wh path: ${activePath}` : "Active wh path: (not found)",
+  realPath && realPath !== activePath ? `Resolved path: ${realPath}` : "",
+  "Install manually with the package manager that owns that path:",
+  `  ${buildManualCommand("npm", latestVersion, registry2)}`,
+  `  ${buildManualCommand("bun", latestVersion, registry2)}`,
+  `  ${buildManualCommand("pnpm", latestVersion, registry2)}`
+].filter(Boolean).join(`
+`);
 var isDevInstall = (scriptPath) => {
   if (!scriptPath)
     return false;
@@ -37461,6 +37755,8 @@ var runUpdate = async (ctx, { flags, args }, deps = {}) => {
     throw new CliError(2 /* UserInput */, "USER_INPUT", `Unexpected argument: '${args[0]}'`, undefined, "'wh update' takes no positional arguments");
   }
   const runInstall = deps.runInstall ?? defaultRunInstall;
+  const verifyActiveVersion2 = deps.verifyActiveVersion ?? defaultVerifyActiveVersion;
+  const resolveActiveInstall = deps.resolveActiveInstall ?? (() => resolveActiveWh({ env: deps.statusDeps?.env }));
   const isDev = deps.isDev ?? isDevInstall;
   const markNotified = deps.markNotified ?? ((latestVersion) => markUpdateNoticeShown({ latestVersion }));
   const scriptPath = deps.scriptPath ?? process.argv[1];
@@ -37486,6 +37782,19 @@ var runUpdate = async (ctx, { flags, args }, deps = {}) => {
     });
     return;
   }
+  const activeInstall = resolveActiveInstall();
+  const activePath = activeInstall.activePath;
+  const realPath = activeInstall.realPath ?? activePath;
+  const manager = classifyActiveInstallManager({
+    activePath,
+    realPath,
+    env: deps.statusDeps?.env,
+    homePath: deps.statusDeps?.homePath
+  });
+  if (!manager || !activePath || !realPath) {
+    throw new CliError(1 /* Runtime */, "UNKNOWN", "Unable to determine which package manager owns the active wh binary.", undefined, formatUnknownInstallHint(activePath, realPath, status.latestVersion, status.registry));
+  }
+  const installPlan = buildInstallPlan(manager, status.latestVersion, status.registry, activePath, realPath);
   if (!flags.yes) {
     const ok = await ctx.confirm?.(`Update @warmhub/cli ${currentVersion} -> ${status.latestVersion}?`);
     if (!ok) {
@@ -37493,9 +37802,22 @@ var runUpdate = async (ctx, { flags, args }, deps = {}) => {
       return;
     }
   }
-  const result = runInstall(status.latestVersion, status.registry);
+  const result = runInstall(installPlan);
   if (result.error || result.signal !== null || result.status !== 0 && result.status !== null) {
-    throw new CliError(1 /* Runtime */, "UNKNOWN", result.error ? `npm install failed: ${result.error.message}` : result.signal ? `npm install terminated by signal ${result.signal}` : `npm install exited with status ${result.status}`, result.error, `Try running manually: npm install -g @warmhub/cli@${status.latestVersion} --registry ${status.registry}`);
+    throw new CliError(1 /* Runtime */, "UNKNOWN", formatInstallFailureMessage(installPlan, result), result.error, `Try running manually: ${installPlan.manualCommand}`);
+  }
+  const verify = verifyActiveVersion2(activePath);
+  const observedVersion = parseVersionOutput([verify.stdout, verify.stderr].filter(Boolean).join(`
+`));
+  if (verify.error || verify.signal !== null || verify.status !== 0 && verify.status !== null || observedVersion !== status.latestVersion) {
+    throw new CliError(1 /* Runtime */, "UNKNOWN", observedVersion ? `Updated install, but active wh reports ${observedVersion} instead of ${status.latestVersion}.` : "Updated install, but active wh version could not be verified.", verify.error, [
+      `Active wh path: ${activePath}`,
+      realPath !== activePath ? `Resolved path: ${realPath}` : "",
+      observedVersion ? `Observed version: ${observedVersion}` : "",
+      `Expected version: ${status.latestVersion}`,
+      `Manual command: ${installPlan.manualCommand}`
+    ].filter(Boolean).join(`
+`));
   }
   markNotified(status.latestVersion);
   ctx.status(`Updated to ${status.latestVersion}.`);
@@ -37671,7 +37993,7 @@ async function checkCompatibility(ctx, domainPath, canonicalVerb, args) {
   try {
     const caps = await ctx.client.diagnostics.capabilities();
     if (isNewerVersion(caps.minSupportedSdk, SDK_VERSION)) {
-      throw new CliError(4 /* Backend */, "BACKEND", `Your CLI (SDK v${SDK_VERSION}) is older than the minimum supported version (${caps.minSupportedSdk}).`, undefined, "Update with: bun install @warmhub/cli@latest");
+      throw new CliError(4 /* Backend */, "BACKEND", `Your CLI (SDK v${SDK_VERSION}) is older than the minimum supported version (${caps.minSupportedSdk}).`, undefined, "Update with: wh update --yes");
     }
   } catch (err) {
     if (err instanceof CliError)
@@ -37714,7 +38036,7 @@ var GLOBAL_FLAGS2 = [
   {
     long: "live",
     type: "boolean",
-    description: "Reactive WebSocket mode"
+    description: "Live mode (polls for updates)"
   },
   {
     long: "max-updates",
@@ -38737,7 +39059,7 @@ function resolveLogLevel(flags, env) {
 // package.json
 var package_default3 = {
   name: "@warmhub/cli",
-  version: "0.58.0",
+  version: "0.60.0",
   private: false,
   type: "module",
   description: "The wh CLI for WarmHub — create repos, commit and query data, and compound knowledge with your AI agents.",
@@ -39378,4 +39700,4 @@ if (!updateCheckSuppressedByArgv && shouldRunUpdateCheck(updateEligibility)) {
 var interceptedExitCode = await maybeHandleComponentShellBoundary(dispatchArgv);
 process.exitCode = interceptedExitCode === undefined ? await runCli(dispatchArgv, { version: package_default3.version }) : interceptedExitCode;
 
-//# debugId=53E5AABF4D88726F64756E2164756E21
+//# debugId=E83ADE028217301D64756E2164756E21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@warmhub/cli",
-  "version": "0.58.0",
+  "version": "0.60.0",
   "private": false,
   "type": "module",
   "description": "The wh CLI for WarmHub — create repos, commit and query data, and compound knowledge with your AI agents.",