@warmhub/cli 0.62.0 → 0.64.0

package/dist/wh.js

@@ -18731,7 +18731,7 @@ function defaultMatchesCliArgType(type, value) {
 }
 function compileCliArgPattern(pattern) {
   try {
-    return new RegExp(pattern);
+    return new RegExp(`^(?:${pattern})$`);
   } catch {
     return;
   }
@@ -27353,7 +27353,7 @@ function findSystemComponent(componentId) {
 // ../../packages/sdk-ts/package.json
 var package_default = {
   name: "@warmhub/sdk-ts",
-  version: "0.62.0",
+  version: "0.63.0",
   private: false,
   type: "module",
   description: "The TypeScript SDK for WarmHub — create repos, commit and query data, and compound knowledge with your AI agents.",
@@ -27403,8 +27403,7 @@ var package_default = {
     }
   },
   scripts: {
-    prebuild: "tsc --noEmit",
-    build: "tsup && bun run scripts/inject-doc-links.ts",
+    build: "tsc --noEmit && tsup && bun run scripts/inject-doc-links.ts",
     "generate:api-contract": "bun run scripts/generate-api-contract.ts",
     "generate:backend-types": "bun run scripts/generate-backend-types.ts",
     "audit:api-contract": "bun run scripts/audit-api-contract.ts",
@@ -27439,6 +27438,7 @@ var package_default = {
     "@trpc/client": "11.17.0"
   },
   devDependencies: {
+    "@trpc/server": "11.17.0",
     "@vitest/coverage-v8": "catalog:",
     "@warmhub/backend": "workspace:*",
     "@warmhub/rules": "workspace:*",
@@ -27697,6 +27697,14 @@ function resolveRetryPolicy(retry) {
   };
 }
 var DEFINITE_CLIENT_REJECT_CODES = new Set([
+  "BAD_REQUEST",
+  "METHOD_NOT_SUPPORTED",
+  "PARSE_ERROR",
+  "PAYLOAD_TOO_LARGE",
+  "PRECONDITION_FAILED",
+  "UNAUTHORIZED",
+  "UNPROCESSABLE_CONTENT",
+  "UNSUPPORTED_MEDIA_TYPE",
   "UNAUTHENTICATED",
   "FORBIDDEN",
   "VALIDATION_ERROR",
@@ -27709,6 +27717,7 @@ var DEFINITE_CLIENT_REJECT_CODES = new Set([
   "ALREADY_RETRACTED",
   "ARCHIVED",
   "RATE_LIMITED",
+  "TOO_MANY_REQUESTS",
   "UNRESOLVED_TOKEN"
 ]);
 function extractErrorCode(cause) {
@@ -27726,9 +27735,24 @@ function extractErrorCode(cause) {
     return dc;
   return;
 }
+function extractHttpStatus(cause) {
+  if (!cause || typeof cause !== "object")
+    return;
+  const status = cause.data?.httpStatus;
+  if (typeof status === "number")
+    return status;
+  const warmhubStatus = cause.data?.warmhub?.status;
+  if (typeof warmhubStatus === "number")
+    return warmhubStatus;
+  const direct = cause.status;
+  return typeof direct === "number" ? direct : undefined;
+}
+function isDefiniteClientRejectionStatus(status) {
+  return status !== undefined && status >= 400 && status < 500 && status !== 408;
+}
 function isDefiniteClientError(cause) {
   const code = extractErrorCode(cause);
-  return code !== undefined && DEFINITE_CLIENT_REJECT_CODES.has(code);
+  return code !== undefined && DEFINITE_CLIENT_REJECT_CODES.has(code) || isDefiniteClientRejectionStatus(extractHttpStatus(cause));
 }
 function isTransientStreamFailure(cause) {
   if (isDefiniteClientError(cause))
@@ -28075,6 +28099,48 @@ function sanitizeSubscriptionUpdateInput(input) {
   } = input;
   return supported;
 }
+function trpcClientCodeToWarmHubCode(code) {
+  switch (code) {
+    case "BAD_REQUEST":
+    case "PARSE_ERROR":
+    case "PAYLOAD_TOO_LARGE":
+    case "UNPROCESSABLE_CONTENT":
+    case "UNSUPPORTED_MEDIA_TYPE":
+      return "VALIDATION_ERROR";
+    case "METHOD_NOT_SUPPORTED":
+      return "NOT_FOUND";
+    case "UNAUTHORIZED":
+      return "UNAUTHENTICATED";
+    case "FORBIDDEN":
+      return "FORBIDDEN";
+    case "NOT_FOUND":
+      return "NOT_FOUND";
+    case "CONFLICT":
+      return "CONFLICT";
+    case "PRECONDITION_FAILED":
+      return "PRECONDITION_FAILED";
+    case "TOO_MANY_REQUESTS":
+      return "RATE_LIMITED";
+    default:
+      return;
+  }
+}
+function trpcHttpStatusToWarmHubCode(status) {
+  if (status === undefined || status === 408)
+    return;
+  if (status === 405)
+    return "NOT_FOUND";
+  if (status === 412)
+    return "PRECONDITION_FAILED";
+  if (status === 422)
+    return "VALIDATION_ERROR";
+  const mapped = httpStatusToWarmHubCode(status);
+  if (mapped !== "BACKEND")
+    return mapped;
+  if (status >= 400 && status < 500)
+    return "VALIDATION_ERROR";
+  return mapped;
+}
 var INTERNAL_PATTERNS = [
   /\bselect\b.+?\bfrom\b/i,
   /\binsert\b.+?\binto\b/i,
@@ -28136,8 +28202,10 @@ function toWarmHubError(error) {
     }
     const data = error.data;
     const wireCode = data?.warmhub?.code;
+    const trpcCode = typeof data?.code === "string" ? trpcClientCodeToWarmHubCode(data.code) : undefined;
+    const trpcStatus = trpcHttpStatusToWarmHubCode(data?.httpStatus);
     const message = data?.warmhub?.message ?? sanitizeErrorMessage(error.message);
-    return new WarmHubError(wireCode ?? "BACKEND", message, data?.warmhub?.status, data?.warmhub?.hint, data?.warmhub?.retryAfter, wireCode, data?.warmhub?.details);
+    return new WarmHubError(wireCode ?? trpcCode ?? trpcStatus ?? "BACKEND", message, data?.warmhub?.status ?? data?.httpStatus, data?.warmhub?.hint, data?.warmhub?.retryAfter ?? data?.retryAfter, wireCode, data?.warmhub?.details);
   }
   if (error instanceof Error) {
     const warmhubLike = error;
@@ -28283,6 +28351,15 @@ class WarmHubClient {
       }
     }
   };
+  homepage = {
+    featuredLists: async () => {
+      try {
+        return await this.trpc.homepage.featuredLists.query();
+      } catch (error) {
+        throw toWarmHubError(error);
+      }
+    }
+  };
   access = {
     resolve: async (input) => {
       try {
@@ -29125,24 +29202,26 @@ class WarmHubClient {
         throw toWarmHubError(error);
       }
     },
-    claimDelivery: async (orgName, repoName, runId, holderId) => {
+    claimDelivery: async (orgName, repoName, target, holderId) => {
+      const deliveryTarget = typeof target === "string" ? { runId: target } : target;
       try {
         return await this.trpc.action.claimDelivery.mutate({
           orgName,
           repoName,
-          runId,
+          ...deliveryTarget,
           holderId
         });
       } catch (error) {
         throw toWarmHubError(error);
       }
     },
-    completeDelivery: async (orgName, repoName, runId, holderId) => {
+    completeDelivery: async (orgName, repoName, target, holderId) => {
+      const deliveryTarget = typeof target === "string" ? { runId: target } : target;
       try {
         return await this.trpc.action.completeDelivery.mutate({
           orgName,
           repoName,
-          runId,
+          ...deliveryTarget,
           holderId
         });
       } catch (error) {
@@ -30503,11 +30582,25 @@ function safeParseJson(input, label, options) {
 function parseJsonObject(input, label, options) {
   const parsed = safeParseJson(input, label, options);
   if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-    const got = Array.isArray(parsed) ? "array" : parsed === null ? "null" : typeof parsed;
+    const got = describeJsonType(parsed);
     throw new CliError(2 /* UserInput */, "USER_INPUT", `${label} must be a JSON object, got ${got}`, undefined, `Pass an object, e.g. '{"key":"value"}'.`);
   }
   return parsed;
 }
+function parseJsonArray(input, label, options) {
+  const parsed = safeParseJson(input, label, options);
+  if (!Array.isArray(parsed)) {
+    throw new CliError(2 /* UserInput */, "USER_INPUT", `${label} must be a JSON array, got ${describeJsonType(parsed)}`, undefined, `Pass an array of operations, e.g. '[{"operation":"add","kind":"thing","name":"Shape/item","data":{}}]'.`);
+  }
+  return parsed;
+}
+function describeJsonType(value) {
+  if (Array.isArray(value))
+    return "array";
+  if (value === null)
+    return "null";
+  return typeof value;
+}
 function parsePositiveIntFlag(value, label, example) {
   if (value !== undefined && (!Number.isInteger(value) || value < 1)) {
     usageError(`${label} must be a positive integer`, example);
@@ -30576,7 +30669,12 @@ function parseArgs(argv) {
     positionals.push(arg);
     i += 1;
   }
-  return { positionals, flags, ...terminator ? { terminator } : {} };
+  return {
+    positionals,
+    flags,
+    ...terminator ? { terminator } : {},
+    rawArgv: [...argv]
+  };
 }
 function getStringFlag(flags, ...keys) {
   for (const key of keys) {
@@ -30598,8 +30696,9 @@ function getBoolFlag(flags, ...keys) {
 function getNumberFlag(flags, ...keys) {
   for (const key of keys) {
     const val = flags[key];
-    if (typeof val === "string") {
-      const num = Number(val);
+    const scalar = Array.isArray(val) ? val[val.length - 1] : val;
+    if (typeof scalar === "string") {
+      const num = Number(scalar);
       if (!Number.isNaN(num))
         return num;
     }
@@ -31448,10 +31547,21 @@ function writeStore(store, path) {
     }
   }
 }
+function hasProfile(store, name) {
+  return Object.hasOwn(store.profiles, name);
+}
+function setProfile(store, name, profile) {
+  Object.defineProperty(store.profiles, name, {
+    value: profile,
+    enumerable: true,
+    configurable: true,
+    writable: true
+  });
+}
 function saveProfile(name, profile, path) {
   const p = path ?? getAuthPath();
   const store = loadProfileStore(p);
-  store.profiles[name] = profile;
+  setProfile(store, name, profile);
   writeStore(store, p);
 }
 function saveProfileWhileLocked(name, profile, path) {
@@ -31460,7 +31570,7 @@ function saveProfileWhileLocked(name, profile, path) {
 function getProfile(name, path) {
   const p = path ?? getAuthPath();
   const store = loadProfileStore(p);
-  return store.profiles[name] ?? null;
+  return hasProfile(store, name) ? store.profiles[name] : null;
 }
 async function modifyStore(mutator, path) {
   const p = path ?? getAuthPath();
@@ -31473,12 +31583,12 @@ async function modifyStore(mutator, path) {
 }
 async function saveProfileLocked(name, profile, path) {
   await modifyStore((store) => {
-    store.profiles[name] = profile;
+    setProfile(store, name, profile);
   }, path);
 }
 async function deleteProfileLocked(name, path) {
   await modifyStore((store) => {
-    if (!(name in store.profiles))
+    if (!hasProfile(store, name))
       return;
     delete store.profiles[name];
   }, path);
@@ -31714,8 +31824,52 @@ var package_default2 = {
   }
 };
 
+// ../../packages/warmhub-cli/src/cli-trace-context.ts
+import { randomBytes } from "node:crypto";
+var TRACE_VERSION = "00";
+var TRACE_FLAGS_SAMPLED = "01";
+var activeTrace;
+function randomHex(byteLength) {
+  let value = "";
+  do {
+    value = randomBytes(byteLength).toString("hex");
+  } while (/^0+$/.test(value));
+  return value;
+}
+function createTraceContext() {
+  return {
+    traceId: randomHex(16),
+    rootSpanId: randomHex(8)
+  };
+}
+function startCliTraceContext() {
+  activeTrace = createTraceContext();
+  return activeTrace;
+}
+function getCliTraceContext() {
+  activeTrace ??= createTraceContext();
+  return activeTrace;
+}
+function cliTraceLogFields() {
+  const trace = getCliTraceContext();
+  return {
+    traceId: trace.traceId,
+    spanId: trace.rootSpanId
+  };
+}
+function createCliTraceparent() {
+  const trace = getCliTraceContext();
+  return [
+    TRACE_VERSION,
+    trace.traceId,
+    trace.rootSpanId,
+    TRACE_FLAGS_SAMPLED
+  ].join("-");
+}
+
 // ../../packages/warmhub-cli/src/client.ts
 var BENCHMARK_HEADER = "x-warmhub-benchmark-id";
+var TRACEPARENT_HEADER = "traceparent";
 var REQUEST_TOTAL_MS_HEADER = "x-warmhub-request-total-ms";
 var REQUEST_DB_QUERY_COUNT_HEADER = "x-warmhub-request-db-query-count";
 var benchmarkTelemetry = emptyBenchmarkTelemetry();
@@ -31753,10 +31907,9 @@ function recordBenchmarkResponse(response, benchmarkId) {
   }
 }
 function createBenchmarkAwareFetch(benchmarkId, signal) {
-  if (!benchmarkId && !signal)
-    return;
   return async (input, init) => {
     const headers = new Headers(init?.headers);
+    headers.set(TRACEPARENT_HEADER, createCliTraceparent());
     if (benchmarkId)
       headers.set(BENCHMARK_HEADER, benchmarkId);
     const response = await fetch(input, {
@@ -31812,6 +31965,15 @@ function createClient(config, opts = {}) {
     client: cliClientIdentity()
   });
 }
+function createUnauthenticatedClient(config, opts = {}) {
+  const benchmarkId = process.env.WH_BENCHMARK_ID?.trim();
+  return new WarmHubClient({
+    apiUrl: config.apiUrl,
+    fetch: createBenchmarkAwareFetch(benchmarkId),
+    functionLogs: opts.functionLogs,
+    client: cliClientIdentity()
+  });
+}
 function wantsStructuredLiveOutput(format) {
   return format === "json" || format === "jsonl";
 }
@@ -32186,9 +32348,18 @@ class DomainRegistry {
       throw new Error(`Domain '${def.name}' already registered`);
     }
     const spec = this.buildSpec(def);
-    this.domains.set(def.name, spec);
-    this.registerHandlers(def);
     this.validateDomain(spec, def);
+    const handlers = new Map;
+    this.collectHandlers(def, handlers);
+    for (const key of handlers.keys()) {
+      if (this.handlers.has(key)) {
+        throw new Error(`Handler '${key}' already registered`);
+      }
+    }
+    this.domains.set(def.name, spec);
+    for (const [key, handler] of handlers) {
+      this.handlers.set(key, handler);
+    }
   }
   buildSpec(def) {
     if (def.kind === "flat") {
@@ -32205,7 +32376,7 @@ class DomainRegistry {
     }
     const verbs = {};
     for (const [verbName, v] of Object.entries(def.verbs)) {
-      verbs[verbName] = {
+      const verbSpec = {
         status: v.status ?? "live",
         prime: v.prime ?? false,
         summary: v.summary,
@@ -32216,6 +32387,13 @@ class DomainRegistry {
         verbAliases: v.verbAliases,
         passthroughFlags: v.passthroughFlags
       };
+      if (v.rejectedFlags) {
+        Object.defineProperty(verbSpec, "rejectedFlags", {
+          value: v.rejectedFlags,
+          enumerable: false
+        });
+      }
+      verbs[verbName] = verbSpec;
     }
     const subdomains = def.subdomains ? Object.fromEntries(Object.entries(def.subdomains).map(([k, sd]) => [
       k,
@@ -32241,39 +32419,48 @@ class DomainRegistry {
       aliases: f.aliases
     }));
   }
-  registerHandlers(def, path = [def.name]) {
+  collectHandlers(def, handlers, path = [def.name]) {
     if (def.kind === "flat") {
       const key = [...path, ""].join(":");
-      if (this.handlers.has(key)) {
+      if (handlers.has(key)) {
         throw new Error(`Handler '${key}' already registered`);
       }
-      this.handlers.set(key, def.handler);
+      handlers.set(key, def.handler);
       return;
     }
     for (const [verbName, v] of Object.entries(def.verbs)) {
       const key = [...path, verbName].join(":");
-      if (this.handlers.has(key)) {
+      if (handlers.has(key)) {
         throw new Error(`Handler '${key}' already registered`);
       }
-      this.handlers.set(key, v.handler);
+      handlers.set(key, v.handler);
     }
     if (def.subdomains) {
       for (const [subName, subDef] of Object.entries(def.subdomains)) {
-        this.registerHandlers(subDef, [...path, subName]);
+        this.collectHandlers(subDef, handlers, [...path, subName]);
       }
     }
   }
-  validateDomain(spec, def) {
+  validateDomain(spec, def, path = [def.name]) {
     if (spec.kind === "noun") {
+      const displayPath = path.join(".");
       for (const [verbName, v] of Object.entries(spec.verbs)) {
         for (const alias of v.verbAliases ?? []) {
           if (spec.verbs[alias]) {
-            throw new Error(`Alias '${alias}' for ${spec.name}.${verbName} conflicts with verb '${alias}'`);
+            throw new Error(`Alias '${alias}' for ${displayPath}.${verbName} conflicts with verb '${alias}'`);
           }
         }
       }
       if (def.kind !== "flat" && def.defaultVerb && !def.verbs[def.defaultVerb]) {
-        throw new Error(`Domain '${def.name}': defaultVerb '${def.defaultVerb}' does not name a canonical verb`);
+        throw new Error(`Domain '${displayPath}': defaultVerb '${def.defaultVerb}' does not name a canonical verb`);
+      }
+      if (def.kind !== "flat" && def.subdomains) {
+        for (const [subName, subDef] of Object.entries(def.subdomains)) {
+          const subSpec = spec.subdomains?.[subName];
+          if (subSpec) {
+            this.validateDomain(subSpec, subDef, [...path, subName]);
+          }
+        }
       }
     }
   }
@@ -32299,6 +32486,14 @@ class DomainRegistry {
       path.push(tokens[i]);
       i++;
     }
+    if (cursor.kind === "flat") {
+      return {
+        domain,
+        domainPath: path,
+        verb: undefined,
+        remaining: tokens.slice(i)
+      };
+    }
     const verb = tokens[i];
     const remaining = tokens.slice(i + 1);
     return { domain, domainPath: path, verb, remaining };
@@ -32498,6 +32693,54 @@ function extractShapeName(name) {
   const slash = name.indexOf("/");
   return slash > 0 ? name.slice(0, slash) : "";
 }
+var DANGEROUS_TERMINAL_FORMAT_CODEPOINTS = new Set([
+  8203,
+  8204,
+  8205,
+  8288,
+  8294,
+  8295,
+  8296,
+  8297,
+  8234,
+  8235,
+  8236,
+  8237,
+  8238,
+  8232,
+  8233
+]);
+function isTerminalControlCodePoint(codePoint) {
+  return codePoint <= 31 || codePoint === 127 || codePoint >= 128 && codePoint <= 159;
+}
+function escapeTerminalCodePoint(codePoint) {
+  return codePoint <= 65535 ? `\\u${codePoint.toString(16).padStart(4, "0")}` : `\\u{${codePoint.toString(16)}}`;
+}
+function terminalTextNeedsEscape(value) {
+  for (const char of value) {
+    const codePoint = char.codePointAt(0);
+    if (codePoint === undefined)
+      continue;
+    if (isTerminalControlCodePoint(codePoint))
+      return true;
+    if (DANGEROUS_TERMINAL_FORMAT_CODEPOINTS.has(codePoint))
+      return true;
+  }
+  return false;
+}
+function escapeTerminalTextForDisplay(value) {
+  if (!terminalTextNeedsEscape(value))
+    return value;
+  const jsonEscaped = JSON.stringify(value).slice(1, -1);
+  let output = "";
+  for (const char of jsonEscaped) {
+    const codePoint = char.codePointAt(0);
+    if (codePoint === undefined)
+      continue;
+    output += isTerminalControlCodePoint(codePoint) || DANGEROUS_TERMINAL_FORMAT_CODEPOINTS.has(codePoint) ? escapeTerminalCodePoint(codePoint) : char;
+  }
+  return output;
+}
 var escapeInlineTerminalText = escapeFieldNameForDisplay;
 function renderWarningLine(out, c, chars, op) {
   const warnings = op.warnings;
@@ -34105,10 +34348,10 @@ var searchFlags = {
   cursor: flag.string({ description: "Opaque pagination cursor (text mode)" }),
   all: flag.boolean({ description: "Fetch all pages (text mode)" }),
   component: flag.string({
-    description: "Filter to things owned by this component (Org/Name ref)"
+    description: "Filter to things owned by this component (Org/Name ref, text mode)"
   }),
   "exclude-components": flag.boolean({
-    description: "Exclude component-owned things from results"
+    description: "Exclude component-owned things from results (text mode)"
   })
 };
 var handleSearch = async (ctx, { flags, args }) => {
@@ -34142,10 +34385,14 @@ var handleSearch = async (ctx, { flags, args }) => {
   const pageLimit = all ? Math.min(limit ?? AUTO_PAGE_LIMIT, MAX_PAGE_LIMIT) : boundedTextLimit;
   const resolveCollections = mode !== "hybrid" ? flags["resolve-collections"] : undefined;
   const supportsComponentFilters = !mode || mode === "text";
-  const componentRef = supportsComponentFilters ? flags.component : undefined;
   const hasShape = !!flags.shape;
-  const strictExclude = supportsComponentFilters ? !!flags["exclude-components"] : false;
-  validateComponentFilters(componentRef, strictExclude, 'wh thing search "policy" --component acme/veritas');
+  const hasComponentFilter = flags.component !== undefined;
+  const strictExclude = !!flags["exclude-components"];
+  validateComponentFilters(flags.component, strictExclude, 'wh thing search "policy" --component acme/veritas');
+  if (!supportsComponentFilters && (hasComponentFilter || strictExclude)) {
+    usageError("--component/--exclude-components are only supported with text search mode.", 'wh thing search "policy" --mode text --component acme/veritas');
+  }
+  const componentRef = supportsComponentFilters ? flags.component : undefined;
   const excludeComponents = supportsComponentFilters && strictExclude ? true : undefined;
   const excludeInfraShapes = supportsComponentFilters && !strictExclude && !hasShape ? true : undefined;
   const rawResult = all ? await fetchAllSearchPages(ctx, org, repo, queryText, {
@@ -35720,8 +35967,9 @@ var handleLogin = async (ctx, { flags }) => {
   try {
     clientId = await ctx.client.auth.getClientId();
   } catch {
-    await deleteProfileLocked(profile);
-    clientId = await ctx.client.auth.getClientId();
+    clientId = await createUnauthenticatedClient(ctx.config, {
+      functionLogs: ctx.functionLogMode
+    }).auth.getClientId();
   }
   if (!clientId) {
     throw new CliError(5 /* Auth */, "AUTH", "Backend has no WORKOS_CLIENT_ID configured.");
@@ -35895,7 +36143,7 @@ var HEADER_DELIMITER = `\r
 `;
 var CONTENT_LENGTH_RE = /^Content-Length:\s*(\d+)$/im;
 var MAX_MESSAGE_BYTES = 64 * 1024 * 1024;
-function parseFramedMessage(buffer, maxContentLength = MAX_MESSAGE_BYTES) {
+function parseFramedMessage(buffer, maxContentLength = MAX_MESSAGE_BYTES, bufferByteLength) {
   const headerEnd = buffer.indexOf(HEADER_DELIMITER);
   if (headerEnd === -1)
     return null;
@@ -35908,11 +36156,36 @@ function parseFramedMessage(buffer, maxContentLength = MAX_MESSAGE_BYTES) {
     throw new RangeError(`Content-Length ${contentLength} exceeds the maximum allowed ${maxContentLength} bytes`);
   }
   const bodyStart = headerEnd + HEADER_DELIMITER.length;
-  const remaining = Buffer.from(buffer.slice(bodyStart), "utf8");
-  if (remaining.length < contentLength)
+  const bodyStartBytes = Buffer.byteLength(buffer.slice(0, bodyStart), "utf8");
+  const totalBytes = bufferByteLength ?? Buffer.byteLength(buffer, "utf8");
+  if (totalBytes - bodyStartBytes < contentLength)
     return null;
-  const body = remaining.subarray(0, contentLength).toString("utf8");
-  return { message: JSON.parse(body), consumed: bodyStart + body.length };
+  const bodyEnd = findUtf8ByteBoundary(buffer, bodyStart, contentLength);
+  if (bodyEnd === null)
+    return null;
+  const body = buffer.slice(bodyStart, bodyEnd);
+  return { message: JSON.parse(body), consumed: bodyEnd };
+}
+function findUtf8ByteBoundary(value, start, targetBytes) {
+  let bytes = 0;
+  let index = start;
+  while (index < value.length && bytes < targetBytes) {
+    const codePoint = value.codePointAt(index);
+    if (codePoint === undefined)
+      return null;
+    bytes += utf8CodePointByteLength(codePoint);
+    index += codePoint > 65535 ? 2 : 1;
+  }
+  return bytes === targetBytes ? index : null;
+}
+function utf8CodePointByteLength(codePoint) {
+  if (codePoint <= 127)
+    return 1;
+  if (codePoint <= 2047)
+    return 2;
+  if (codePoint <= 65535)
+    return 3;
+  return 4;
 }
 function parseNdjsonMessage(buffer) {
   const newlineIdx = buffer.indexOf(`
@@ -35960,7 +36233,7 @@ function createMessageReader(input, onMessage, onError = () => {}, maxMessageByt
       }
       let result;
       try {
-        result = mode === "ndjson" ? parseNdjsonMessage(buffer) : parseFramedMessage(buffer, maxMessageBytes);
+        result = mode === "ndjson" ? parseNdjsonMessage(buffer) : parseFramedMessage(buffer, maxMessageBytes, bufferBytes);
       } catch (err) {
         if (err instanceof RangeError) {
           onError(err);
@@ -36022,27 +36295,47 @@ function createMessageReader(input, onMessage, onError = () => {}, maxMessageByt
 var MCP_PROTOCOL_VERSION2 = "2025-11-25";
 function createChannelServer(opts) {
   let reader = null;
+  let removeInputCloseListeners = () => {};
   let resolveReady;
   let rejectReady;
   let readySettled = false;
+  let resolveClosed;
+  let closedSettled = false;
   const onReady = new Promise((resolve, reject) => {
     resolveReady = resolve;
     rejectReady = reject;
   });
+  const onClosed = new Promise((resolve) => {
+    resolveClosed = resolve;
+  });
   function settleReady() {
     if (readySettled)
       return;
     readySettled = true;
     resolveReady();
   }
-  function failReady(error) {
-    if (readySettled)
+  function settleClosed() {
+    if (closedSettled)
       return;
-    readySettled = true;
+    closedSettled = true;
+    removeInputCloseListeners();
     reader?.close();
-    rejectReady(error);
+    resolveClosed();
+  }
+  function closeServer() {
+    settleClosed();
+    settleReady();
+  }
+  function failReady(error) {
+    if (!readySettled) {
+      readySettled = true;
+      rejectReady(error);
+    }
+    settleClosed();
   }
   function send(msg) {
+    if (closedSettled)
+      return;
     opts.output.write(ndjsonMessage(msg));
   }
   function handleMessage(msg) {
@@ -36081,6 +36374,13 @@ function createChannelServer(opts) {
   }
   return {
     start() {
+      const handleInputClose = () => closeServer();
+      opts.input.on("end", handleInputClose);
+      opts.input.on("close", handleInputClose);
+      removeInputCloseListeners = () => {
+        opts.input.removeListener("end", handleInputClose);
+        opts.input.removeListener("close", handleInputClose);
+      };
       reader = createMessageReader(opts.input, handleMessage, failReady);
     },
     notify(content, meta) {
@@ -36091,14 +36391,15 @@ function createChannelServer(opts) {
       });
     },
     onReady,
+    onClosed,
     close() {
-      reader?.close();
-      settleReady();
+      closeServer();
     }
   };
 }
 
 // ../../packages/warmhub-cli/src/domains/channel.ts
+var RECONNECT_DELAY_MS = 2000;
 function formatChannelEvent(org, repo, event) {
   const things = event.affectedThings.join(", ");
   const shapes = event.affectedShapes.join(",");
@@ -36115,6 +36416,22 @@ function formatChannelEvent(org, repo, event) {
   };
 }
 async function subscribeLoop(client, org, repo, signal, server) {
+  const pauseBeforeReconnect = () => new Promise((resolve) => {
+    if (signal.aborted) {
+      resolve();
+      return;
+    }
+    let timeout;
+    const onAbort = () => {
+      clearTimeout(timeout);
+      resolve();
+    };
+    timeout = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve();
+    }, RECONNECT_DELAY_MS);
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
   while (!signal.aborted) {
     try {
       const handle = await client.live.subscribe(org, repo, { signal }, (event) => {
@@ -36122,6 +36439,8 @@ async function subscribeLoop(client, org, repo, signal, server) {
         server.notify(content, meta);
       });
       await handle.closed;
+      if (!signal.aborted)
+        await pauseBeforeReconnect();
     } catch (err) {
       if (signal.aborted)
         break;
@@ -36129,7 +36448,7 @@ async function subscribeLoop(client, org, repo, signal, server) {
       if (msg.includes("401") || msg.includes("403") || msg.includes("404") || msg.includes("AUTH") || msg.includes("not found") || msg.includes("Session expired")) {
         throw new Error(`${org}/${repo}: ${msg}`);
       }
-      await new Promise((r) => setTimeout(r, 2000));
+      await pauseBeforeReconnect();
     }
   }
 }
@@ -36148,7 +36467,6 @@ var handleChannel = async (ctx) => {
     input: process.stdin,
     output: process.stdout
   });
-  server.start();
   const signal = ctx.signal ?? new AbortController().signal;
   const aborted = new Promise((resolve) => {
     if (signal.aborted)
@@ -36158,15 +36476,19 @@ var handleChannel = async (ctx) => {
   });
   let ready;
   try {
-    ready = await Promise.race([server.onReady.then(() => {
-      return;
-    }), aborted]);
+    const startup = Promise.race([
+      server.onClosed.then(() => "closed"),
+      server.onReady.then(() => "ready"),
+      aborted
+    ]);
+    server.start();
+    ready = await startup;
   } catch (err) {
     server.close();
     const msg = err instanceof Error ? err.message : String(err);
     throw new CliError(4 /* Backend */, "BACKEND", `channel startup failed: ${msg}`);
   }
-  if (ready === "aborted") {
+  if (ready !== "ready") {
     server.close();
     return;
   }
@@ -36177,7 +36499,11 @@ var handleChannel = async (ctx) => {
     signal.addEventListener("abort", () => controller.abort(), { once: true });
   let fatal;
   try {
-    await Promise.all(repos.map(({ org, repo }) => subscribeLoop(ctx.client, org, repo, controller.signal, server)));
+    const subscriptions = Promise.all(repos.map(({ org, repo }) => subscribeLoop(ctx.client, org, repo, controller.signal, server)));
+    const closed = server.onClosed.then(() => {
+      controller.abort();
+    });
+    await Promise.race([subscriptions, closed]);
   } catch (err) {
     controller.abort();
     fatal = err;
@@ -36208,7 +36534,7 @@ var CHANNEL_DOMAIN = defineDomain({
 // ../../packages/warmhub-cli/src/domains/commit-submit-flags.ts
 var createFlags3 = {
   ops: flag.string({
-    description: "Operations JSON (inline). For ops from a file, use -f/--file <path> instead; --ops accepts inline JSON only."
+    description: "Operations JSON array (inline). For ops from a file, use -f/--file <path> instead; --ops accepts an inline JSON array only."
   }),
   file: flag.string({
     short: "f",
@@ -37296,7 +37622,7 @@ var handleSubmit = async (ctx, { flags, args }) => {
       }
     ];
   } else if (opsJson) {
-    operations = safeParseJson(opsJson, "--ops", {
+    operations = parseJsonArray(opsJson, "--ops", {
       fileFlagSibling: "-f/--file"
     });
   } else if (opsFile) {
@@ -37309,7 +37635,7 @@ var handleSubmit = async (ctx, { flags, args }) => {
       } catch (e) {
         throw new CliError(2 /* UserInput */, "USER_INPUT", `Cannot read file '${opsFile}': ${e instanceof Error ? e.message : String(e)}`, undefined, "Check that the file path is correct and the file exists.");
       }
-      operations = safeParseJson(file, "--file contents");
+      operations = parseJsonArray(file, "--file contents");
     }
   } else if (addNames.length > 0) {
     operations = buildAddOperations({
@@ -37818,7 +38144,8 @@ function resolveInvocation(parsed) {
     subcommand,
     positional: positionals,
     flags,
-    ...parsed.terminator ? { terminator: parsed.terminator } : {}
+    ...parsed.terminator ? { terminator: parsed.terminator } : {},
+    ...parsed.rawArgv ? { rawArgv: [...parsed.rawArgv] } : {}
   };
 }
 
@@ -37829,6 +38156,68 @@ function isRawGlobalFlagForComponentExec(key) {
     return true;
   return isGlobalShortFlag(key) && key !== key.toLowerCase();
 }
+function isNegativeNumericToken(token) {
+  if (!token.startsWith("-") || token === "-")
+    return false;
+  return Number.isFinite(Number(token));
+}
+function isNumericMethodArg(method, name) {
+  return method.args.some((arg) => arg.name === name && (arg.type === "number" || arg.type === "integer"));
+}
+function normalizeNegativeNumericMethodArgs(method, argv) {
+  const normalized = [];
+  for (let i = 0;i < argv.length; i += 1) {
+    const token = argv[i];
+    if (token.startsWith("--") && !token.includes("=") && isNumericMethodArg(method, token.slice(2)) && argv[i + 1] !== undefined && isNegativeNumericToken(argv[i + 1])) {
+      normalized.push(`${token}=${argv[i + 1]}`);
+      i += 1;
+      continue;
+    }
+    normalized.push(token);
+  }
+  return normalized;
+}
+function flagValueTokenLength(argv, index) {
+  const token = argv[index];
+  if (token === undefined)
+    return 0;
+  if (token.startsWith("--")) {
+    if (token.includes("="))
+      return 1;
+    const next = argv[index + 1];
+    return next !== undefined && !next.startsWith("-") ? 2 : 1;
+  }
+  if (token.startsWith("-") && token !== "-") {
+    const next = argv[index + 1];
+    return next !== undefined && !next.startsWith("-") ? 2 : 1;
+  }
+  return 0;
+}
+function findComponentMethodArgStart(rawArgv, componentName, methodName) {
+  const terminatorIndex = rawArgv.indexOf("--");
+  const scanEnd = terminatorIndex === -1 ? rawArgv.length : terminatorIndex;
+  const positionalIndexes = [];
+  for (let i = 0;i < scanEnd; ) {
+    const consumedFlagTokens = flagValueTokenLength(rawArgv, i);
+    if (consumedFlagTokens > 0) {
+      i += consumedFlagTokens;
+      continue;
+    }
+    positionalIndexes.push(i);
+    i += 1;
+  }
+  const positionals = positionalIndexes.map((index) => rawArgv[index]);
+  if (positionals[0] === "component" && positionals[1] === "exec" && positionals[2] === componentName && positionals[3] === methodName) {
+    return positionalIndexes[3] + 1;
+  }
+  if (positionals[0] === componentName && positionals[1] === methodName) {
+    return positionalIndexes[1] + 1;
+  }
+  return;
+}
+function parseComponentMethodTokenStream(method, argv) {
+  return parseArgs(normalizeNegativeNumericMethodArgs(method, argv));
+}
 function parseMethodArgs(method, rawFlags, terminatorFlags = {}) {
   const argsByName = new Map;
   for (const a of method.args)
@@ -37884,7 +38273,7 @@ function coerceArg(arg, value) {
       if (arg.pattern) {
         let re;
         try {
-          re = new RegExp(arg.pattern);
+          re = new RegExp(`^(?:${arg.pattern})$`);
         } catch {
           throw new CliError(2 /* UserInput */, "USER_INPUT", `invalid regex pattern for --${arg.name}: /${arg.pattern}/`);
         }
@@ -37971,9 +38360,6 @@ var handleComponentExec = async (ctx, { args, terminator }) => {
   }
   const componentName = args[0];
   const methodName = args[1];
-  if (args.length > 2) {
-    throw new CliError(2 /* UserInput */, "USER_INPUT", `Unexpected argument: '${args[2]}'`, undefined, "'wh component exec' accepts at most 2 positional arguments (<component> <method>); pass method inputs as flags");
-  }
   const { org, repo } = parseOrgRepo(getRepoRef(ctx), ctx.config);
   const installRepo = `${org}/${repo}`;
   const cache = await ensureFreshInstallSnapshotCache(installRepo, ctx.client);
@@ -37996,14 +38382,29 @@ var handleComponentExec = async (ctx, { args, terminator }) => {
     renderMethodHelp(ctx, componentName, method);
     return;
   }
-  const terminatorArgs = terminator && terminator.length > 0 ? parseArgs([...terminator]) : undefined;
+  const rawArgv = ctx.invocation.rawArgv;
+  const methodArgStart = rawArgv === undefined ? undefined : findComponentMethodArgStart(rawArgv, componentName, methodName);
+  const terminatorIndex = rawArgv?.indexOf("--") ?? -1;
+  const preTerminatorEnd = rawArgv === undefined ? undefined : terminatorIndex === -1 ? rawArgv.length : terminatorIndex;
+  const preMethodArgs = rawArgv !== undefined && methodArgStart !== undefined ? parseComponentMethodTokenStream(method, rawArgv.slice(0, methodArgStart)) : undefined;
+  const methodArgs = rawArgv !== undefined && methodArgStart !== undefined && preTerminatorEnd !== undefined ? parseComponentMethodTokenStream(method, rawArgv.slice(methodArgStart, preTerminatorEnd)) : undefined;
+  const unexpectedMethodPositional = methodArgs?.positionals[0] ?? (methodArgStart === undefined ? args[2] : undefined);
+  if (unexpectedMethodPositional !== undefined) {
+    throw new CliError(2 /* UserInput */, "USER_INPUT", `Unexpected argument: '${unexpectedMethodPositional}'`, undefined, "'wh component exec' accepts at most 2 positional arguments (<component> <method>); pass method inputs as flags");
+  }
+  const terminatorArgs = terminator && terminator.length > 0 ? parseComponentMethodTokenStream(method, terminator) : undefined;
   if (terminatorArgs?.positionals.length) {
     throw new CliError(2 /* UserInput */, "USER_INPUT", `Unexpected argument: '${terminatorArgs.positionals[0]}'`, undefined, "Component CLI method inputs must be passed as named flags, even after --");
   }
   const terminatorFlags = terminatorArgs?.flags ?? {};
   let parsedArgs;
+  const rawFlags = {
+    ...methodArgStart === undefined ? ctx.invocation.flags : {},
+    ...preMethodArgs?.flags,
+    ...methodArgs?.flags
+  };
   try {
-    parsedArgs = parseMethodArgs(method, ctx.invocation.flags, terminatorFlags);
+    parsedArgs = parseMethodArgs(method, rawFlags, terminatorFlags);
   } catch (error) {
     withMethodHelpHint(error, methodHelpHint(componentName, methodName, installRepo));
   }
@@ -40426,8 +40827,9 @@ function renderActionNotifications(out, statusOut, c, notifications) {
     const subscriptionName = notification.subscriptionName ? `${c.cyan}${notification.subscriptionName}${c.reset}` : `${c.dim}(unknown subscription)${c.reset}`;
     out(`  ${status} ${c.dim}${time}${c.reset} ${subscriptionName} attempt #${notification.attempt} ${c.dim}${notification.channel}${c.reset}`);
     if (notification.errorMessage) {
-      const code = notification.errorCode ? `${notification.errorCode}: ` : "";
-      out(`    ${c.red}${code}${notification.errorMessage}${c.reset}`);
+      const code = notification.errorCode ? `${escapeTerminalTextForDisplay(notification.errorCode)}: ` : "";
+      const message = escapeTerminalTextForDisplay(notification.errorMessage);
+      out(`    ${c.red}${code}${message}${c.reset}`);
     }
   }
 }
@@ -41479,6 +41881,17 @@ function buildContentPrompt(ctx) {
 }
 
 // ../../packages/warmhub-cli/src/domains/repo/helpers.ts
+function parseExplicitOrgRepoArg(ref, usage, example) {
+  if (!ref?.includes("/")) {
+    usageError(usage, example);
+  }
+  const parts = ref.split("/");
+  if (parts.length !== 2 || !parts[0] || !parts[1]) {
+    usageError(`Invalid repo format "${ref}". Expected "org/repo" with no extra slashes or empty segments.`, example);
+  }
+  const [orgName, repoName] = parts;
+  return { orgName, repoName };
+}
 function ensureNonEmptyDisplayName(value, exampleCommand) {
   if (value !== undefined && value.trim() === "") {
     usageError("--display-name requires a non-empty value", exampleCommand);
@@ -41730,11 +42143,7 @@ var confirmFlags2 = {
   yes: flag.boolean({ short: "y", description: "Skip confirmation prompt" })
 };
 var handleArchive2 = async (ctx, { flags, args }) => {
-  const orgRepo = args[0];
-  if (!orgRepo?.includes("/")) {
-    usageError("Usage: wh repo archive <org/repo> [--yes]", "wh repo archive myorg/old-repo");
-  }
-  const [orgName, repoName] = orgRepo.split("/", 2);
+  const { orgName, repoName } = parseExplicitOrgRepoArg(args[0], "Usage: wh repo archive <org/repo> [--yes]", "wh repo archive myorg/old-repo");
   if (!flags.yes) {
     const confirmed = await ctx.confirm?.(`Archive repo "${orgName}/${repoName}"? This will block new commits.`);
     if (!confirmed) {
@@ -41749,11 +42158,7 @@ var handleArchive2 = async (ctx, { flags, args }) => {
   });
 };
 var handleUnarchive2 = async (ctx, { args }) => {
-  const orgRepo = args[0];
-  if (!orgRepo?.includes("/")) {
-    usageError("Usage: wh repo unarchive <org/repo>", "wh repo unarchive myorg/old-repo");
-  }
-  const [orgName, repoName] = orgRepo.split("/", 2);
+  const { orgName, repoName } = parseExplicitOrgRepoArg(args[0], "Usage: wh repo unarchive <org/repo>", "wh repo unarchive myorg/old-repo");
   const c = ctx.colors;
   const result = await ctx.client.repo.unarchive(orgName, repoName);
   writeOutput(ctx, result, () => {
@@ -41764,11 +42169,7 @@ var deleteFlags = {
   yes: flag.boolean({ short: "y", description: "Skip confirmation prompt" })
 };
 var handleDelete2 = async (ctx, { flags, args }) => {
-  const orgRepo = args[0];
-  if (!orgRepo?.includes("/")) {
-    usageError("Usage: wh repo delete <org/repo> [--yes]", "wh repo delete myorg/old-repo");
-  }
-  const [orgName, repoName] = orgRepo.split("/", 2);
+  const { orgName, repoName } = parseExplicitOrgRepoArg(args[0], "Usage: wh repo delete <org/repo> [--yes]", "wh repo delete myorg/old-repo");
   const c = ctx.colors;
   if (!flags.yes) {
     const prompt = `Delete "${orgName}/${repoName}"? The repo will be hidden immediately and permanently deleted after a 30-day grace window.`;
@@ -41866,21 +42267,23 @@ var handleRepoRename = async (ctx, { args, flags }) => {
   const flagSlug = flags.slug;
   const displayName2 = flags["display-name"];
   const rawSlugFromInvocation = ctx.invocation.positional[2];
+  const usage = 'Usage: wh repo rename <org/repoName> [<newName>] [--slug <slug>] [--display-name "..."]';
+  const example = 'wh repo rename myorg/oldrepo newrepo --display-name "New Repo"';
   if (!orgRepo?.includes("/")) {
-    usageError('Usage: wh repo rename <org/repoName> [<newName>] [--slug <slug>] [--display-name "..."]', 'wh repo rename myorg/oldrepo newrepo --display-name "New Repo"');
+    usageError(usage, example);
   }
   if (positionalSlug && flagSlug !== undefined && positionalSlug !== flagSlug) {
     usageError("Specify the new slug as either a positional or --slug, not both", "wh repo rename myorg/foo bar  # or: wh repo rename myorg/foo --slug bar");
   }
   const newSlug = positionalSlug !== undefined ? positionalSlug : flagSlug;
   if (newSlug === undefined && displayName2 === undefined) {
-    usageError('Usage: wh repo rename <org/repoName> [<newName>] [--slug <slug>] [--display-name "..."]', 'wh repo rename myorg/oldrepo newrepo --display-name "New Repo"');
+    usageError(usage, example);
   }
   if (newSlug !== undefined && newSlug.length === 0 || rawSlugFromInvocation === "" || flagSlug === "") {
     usageError("New slug must be a non-empty string", "wh repo rename myorg/oldrepo newrepo");
   }
   ensureNonEmptyDisplayName(displayName2, 'wh repo rename myorg/oldrepo --display-name "New Repo"');
-  const [orgName, oldName] = orgRepo.split("/", 2);
+  const { orgName, repoName: oldName } = parseExplicitOrgRepoArg(orgRepo, usage, example);
   const c = ctx.colors;
   const slugChange = newSlug && newSlug !== oldName ? newSlug : undefined;
   if (displayName2 !== undefined && slugChange) {
@@ -41909,14 +42312,12 @@ var updateFlags3 = {
   description: flag.string({ short: "d", description: "New repo description" })
 };
 var handleUpdate3 = async (ctx, { args, flags }) => {
-  const orgRepo = args[0];
-  if (!orgRepo?.includes("/")) {
-    usageError('Usage: wh repo update <org/repo> --description "..."', 'wh repo update myorg/myrepo -d "My repo description"');
-  }
+  const usage = 'Usage: wh repo update <org/repo> --description "..."';
+  const example = 'wh repo update myorg/myrepo -d "My repo description"';
+  const { orgName, repoName } = parseExplicitOrgRepoArg(args[0], usage, example);
   if (flags.description === undefined) {
     usageError("At least one field must be specified to update", 'wh repo update myorg/myrepo --description "New description"');
   }
-  const [orgName, repoName] = orgRepo.split("/", 2);
   const c = ctx.colors;
   const description = flags.description === "" ? undefined : flags.description;
   const result = await ctx.client.repo.setDescription(orgName, repoName, description);
@@ -42005,7 +42406,7 @@ var handleDescribe = async (ctx, { args, flags }) => {
       const data = version?.data;
       const shapeDesc = data?.description;
       if (typeof shapeDesc === "string" && shapeDesc) {
-        ctx.out(`    ${c.dim}${shapeDesc}${c.reset}`);
+        ctx.out(`    ${c.dim}${escapeTerminalTextForDisplay(shapeDesc)}${c.reset}`);
       }
       const fields = data?.fields;
       if (fields) {
@@ -42017,9 +42418,10 @@ var handleDescribe = async (ctx, { args, flags }) => {
           return Math.max(m, ts.length);
         }, 0);
         for (const [fieldName, fieldType] of entries) {
+          const safeFieldName = escapeFieldNameForDisplay(fieldName);
           const typeStr = displayFieldType(fieldType);
           const fieldDesc = fieldDescriptionFromSpec(fieldType);
-          const line = fieldDesc ? `      ${c.cyan}${fieldName.padEnd(maxName)}${c.reset}  ${c.dim}${typeStr.padEnd(maxType)}${c.reset}  ${fieldDesc}` : `      ${c.cyan}${fieldName.padEnd(maxName)}${c.reset}  ${c.dim}${typeStr}${c.reset}`;
+          const line = fieldDesc ? `      ${c.cyan}${safeFieldName.padEnd(maxName)}${c.reset}  ${c.dim}${typeStr.padEnd(maxType)}${c.reset}  ${escapeTerminalTextForDisplay(fieldDesc)}` : `      ${c.cyan}${safeFieldName.padEnd(maxName)}${c.reset}  ${c.dim}${typeStr}${c.reset}`;
           ctx.out(line);
         }
       }
@@ -42408,7 +42810,7 @@ var handleList6 = async (ctx, { flags }) => {
       const shapeData = shape.version?.data;
       const shapeDescription = shapeData?.description;
       if (typeof shapeDescription === "string" && shapeDescription) {
-        ctx.out(`    ${c.dim}${shapeDescription}${c.reset}`);
+        ctx.out(`    ${c.dim}${escapeTerminalTextForDisplay(shapeDescription)}${c.reset}`);
       }
       const fields = shapeData?.fields;
       if (fields) {
@@ -42423,7 +42825,7 @@ var handleList6 = async (ctx, { flags }) => {
           const typeStr = displayFieldType(fieldType);
           const padded = fieldName.padEnd(maxLen);
           const fieldDesc = fieldDescriptionFromSpec(fieldType);
-          const descSuffix = fieldDesc ? `  ${typeStr.padEnd(maxTypeLen)}  ${fieldDesc}` : `  ${typeStr}`;
+          const descSuffix = fieldDesc ? `  ${typeStr.padEnd(maxTypeLen)}  ${escapeTerminalTextForDisplay(fieldDesc)}` : `  ${typeStr}`;
           ctx.out(`    ${c.cyan}${padded}${c.reset}  ${c.dim}${descSuffix}${c.reset}`);
         }
       }
@@ -42455,7 +42857,7 @@ var handleView7 = async (ctx, { flags, args }) => {
     const shapeData = shapeVersion?.data;
     const shapeDescription = shapeData?.description;
     if (typeof shapeDescription === "string" && shapeDescription) {
-      ctx.out(`  ${c.dim}${shapeDescription}${c.reset}`);
+      ctx.out(`  ${c.dim}${escapeTerminalTextForDisplay(shapeDescription)}${c.reset}`);
     }
     const componentRef = result.componentRef;
     if (componentRef) {
@@ -42467,7 +42869,7 @@ var handleView7 = async (ctx, { flags, args }) => {
       for (const [fieldName, fieldType] of Object.entries(fields)) {
         const typeStr = displayFieldType(fieldType);
         const fieldDesc = fieldDescriptionFromSpec(fieldType);
-        const descSuffix = fieldDesc ? `  ${c.dim}${fieldDesc}${c.reset}` : "";
+        const descSuffix = fieldDesc ? `  ${c.dim}${escapeTerminalTextForDisplay(fieldDesc)}${c.reset}` : "";
         const safeFieldName = escapeFieldNameForDisplay(fieldName);
         ctx.out(`    ${c.cyan}${safeFieldName}${c.reset}: ${c.dim}${typeStr}${c.reset}${descSuffix}`);
       }
@@ -42568,8 +42970,10 @@ var handleShapeRename = async (ctx, { args }) => {
   }
   const { org, repo } = parseOrgRepo(getRepoRef(ctx), ctx.config);
   const c = ctx.colors;
-  await ctx.client.shape.rename(org, repo, oldName, newName);
-  ctx.out(`${c.green}Renamed shape${c.reset} ${c.magenta}${oldName}${c.reset} → ${c.magenta}${newName}${c.reset}`);
+  const result = await ctx.client.shape.rename(org, repo, oldName, newName);
+  writeOutput(ctx, { ...result, oldName, newName }, () => {
+    ctx.out(`${c.green}Renamed shape${c.reset} ${c.magenta}${oldName}${c.reset} → ${c.magenta}${newName}${c.reset}`);
+  });
 };
 
 // ../../packages/warmhub-cli/src/domains/shape.ts
@@ -43026,6 +43430,11 @@ function renderResponseSnippet(out, c, snippet, baseIndent) {
     out(`${baseIndent}  ${c.dim}${line}${c.reset}`);
   }
 }
+function renderErrorMessageLine(out, c, code, message, baseIndent) {
+  const safeCode = code ? `${escapeTerminalTextForDisplay(code)}: ` : "";
+  const safeMessage = escapeTerminalTextForDisplay(message);
+  out(`${baseIndent}${c.red}${safeCode}${safeMessage}${c.reset}`);
+}
 function statusColor(c, status) {
   switch (status) {
     case "completed":
@@ -43066,11 +43475,10 @@ function renderSubscriptionLog(out, statusOut, c, subscriptionName, result) {
     const sourceLabel = (item.matchedOperationIndexes?.length ?? 0) > 0 ? `${c.cyan}write${c.reset}` : `${c.magenta}cron tick${c.reset}`;
     const matched = (item.matchedOperationIndexes ?? []).join(",") || "-";
     const attemptSuffix = item.attemptCount != null && item.maxAttempts != null ? ` ${c.dim}${item.attemptCount}/${item.maxAttempts}${c.reset}` : "";
-    const runSuffix = item.runId ? ` ${c.dim}run ${item.runId}${c.reset}` : "";
-    out(`  ${status}${attemptSuffix} ${c.dim}${time}${c.reset}${runSuffix} ${sourceLabel} ops[${matched}]`);
+    const idSuffix = item.runId ? ` ${c.dim}run ${item.runId}${c.reset}` : item.deliveryId ? ` ${c.dim}delivery ${item.deliveryId}${c.reset}` : "";
+    out(`  ${status}${attemptSuffix} ${c.dim}${time}${c.reset}${idSuffix} ${sourceLabel} ops[${matched}]`);
     if ((displayStatus === "failed_terminal" || displayStatus === "dead_letter") && item.lastErrorMessage) {
-      const code = item.lastErrorCode ? `${item.lastErrorCode}: ` : "";
-      out(`    ${c.red}${code}${item.lastErrorMessage}${c.reset}`);
+      renderErrorMessageLine(out, c, item.lastErrorCode, item.lastErrorMessage, "    ");
     }
     if ((displayStatus === "failed_terminal" || displayStatus === "dead_letter") && item.lastResponseSnippet) {
       renderResponseSnippet(out, c, item.lastResponseSnippet, "    ");
@@ -43181,7 +43589,12 @@ var handleLog = async (ctx, { flags, args }) => {
   if (!name) {
     usageError("Usage: wh sub log <name> [--repo org/repo]", "wh sub log my-sub");
   }
-  const { org, repo } = parseOrgRepo(getRepoRef(ctx), ctx.config);
+  const scope = resolveSubScope(ctx, flags);
+  if (!scope.repoName) {
+    usageError("Usage: wh sub log <name> [--repo org/repo]", "wh sub log my-sub --repo myorg/myrepo");
+  }
+  const org = scope.orgName;
+  const repo = scope.repoName;
   if (ctx.liveMode) {
     await runLive({
       apiUrl: ctx.config.apiUrl,
@@ -43225,8 +43638,7 @@ var handleAttempts = async (ctx, { args }) => {
       const http = attempt.httpStatus ? ` ${c.dim}HTTP ${attempt.httpStatus}${c.reset}` : "";
       ctx.out(`  #${attempt.attempt} ${sc}${attempt.status}${c.reset}${dur}${http}`);
       if (attempt.errorMessage) {
-        const code = attempt.errorCode ? `${attempt.errorCode}: ` : "";
-        ctx.out(`    ${c.red}${code}${attempt.errorMessage}${c.reset}`);
+        renderErrorMessageLine(ctx.out, c, attempt.errorCode, attempt.errorMessage, "    ");
       }
       if (attempt.status === "failed" && attempt.responseSnippet) {
         renderResponseSnippet(ctx.out, c, attempt.responseSnippet, "    ");
@@ -43319,6 +43731,9 @@ var SUB_DOMAIN = defineDomain({
       summary: "Tail subscription delivery feed with failed response snippets",
       args: "<name>",
       flags: logFlags,
+      rejectedFlags: {
+        org: "Use repo-scoped delivery logs: wh sub log my-sub --repo myorg/myrepo"
+      },
       examples: [
         "# Show recent deliveries",
         "  $ wh sub log signal-hook --repo org/repo",
@@ -43327,7 +43742,10 @@ var SUB_DOMAIN = defineDomain({
         "  $ wh sub log daily-digest --repo org/repo",
         "",
         "# Follow deliveries in live mode",
-        "  $ wh sub log signal-hook --repo org/repo --live"
+        "  $ wh sub log signal-hook --repo org/repo --live",
+        "",
+        "# Delivery logs currently require a repo-scoped subscription",
+        "  $ wh sub log signal-hook --repo org/repo"
       ],
       handler: handleLog
     },
@@ -44284,9 +44702,9 @@ function extractFlagsForVerb(flags, verbSpec) {
     }
     return flags;
   }
-  return extractFlags(flags, verbSpec.flags);
+  return extractFlags(flags, verbSpec.flags, verbSpec.rejectedFlags);
 }
-function extractFlags(flags, specs) {
+function extractFlags(flags, specs, rejectedFlags = {}) {
   const normalized = { ...flags };
   const result = {};
   const specLongs = specs.map((s) => s.long);
@@ -44321,11 +44739,19 @@ function extractFlags(flags, specs) {
   }
   for (const key of Object.keys(normalized)) {
     if (key.length === 1) {
+      const rejectedHint2 = rejectedFlags[key];
+      if (rejectedHint2) {
+        throw new CliError(2 /* UserInput */, "USER_INPUT", `Unknown flag: -${key}`, undefined, rejectedHint2);
+      }
       if (!allowedShorts.has(key) && !isGlobalFlag(key)) {
         throw new CliError(2 /* UserInput */, "USER_INPUT", `Unknown flag: -${key}`);
       }
       continue;
     }
+    const rejectedHint = rejectedFlags[key];
+    if (rejectedHint) {
+      throw new CliError(2 /* UserInput */, "USER_INPUT", `Unknown flag: --${key}`, undefined, rejectedHint);
+    }
     if (!allowedLongs.has(key) && !isGlobalFlag(key)) {
       const hint = findClosest(key, [...allowedLongs]);
       throw new CliError(2 /* UserInput */, "USER_INPUT", `Unknown flag: --${key}`, undefined, hint ? `Did you mean '--${hint}'?` : undefined);
@@ -44345,12 +44771,13 @@ function extractFlags(flags, specs) {
         result[spec.long] = Boolean(value);
         break;
       case "number": {
-        if (typeof value === "boolean") {
+        const scalarValue = Array.isArray(value) ? value[value.length - 1] : value;
+        if (typeof scalarValue === "boolean") {
           throw new CliError(2 /* UserInput */, "USER_INPUT", `Flag --${spec.long} requires a numeric value`, undefined, `Usage: --${spec.long} <number>`);
         }
-        const n = Number(value);
+        const n = Number(scalarValue);
         if (!Number.isFinite(n)) {
-          throw new CliError(2 /* UserInput */, "USER_INPUT", `Invalid number for --${spec.long}: '${value}'`, undefined, `Expected a number, e.g. --${spec.long} 10`);
+          throw new CliError(2 /* UserInput */, "USER_INPUT", `Invalid number for --${spec.long}: '${scalarValue}'`, undefined, `Expected a number, e.g. --${spec.long} 10`);
         }
         result[spec.long] = n;
         break;
@@ -44558,6 +44985,11 @@ function walkSubdomainsForHelpAll(out) {
             for (const [verbName, verb] of Object.entries(sub.verbs)) {
               out(`    ${domain.name} ${subName} ${verbName.padEnd(12)} ${verb.summary}`);
             }
+          } else {
+            out(`    ${domain.name} ${subName.padEnd(12)} ${sub.summary}`);
+            if (sub.args) {
+              out(`      Usage: wh ${domain.name} ${subName} ${sub.args}`);
+            }
           }
         }
       }
@@ -44725,6 +45157,20 @@ function printVerbHelp(out, domain, verbName, verb, format, domainPath) {
 }
 
 // ../../packages/warmhub-cli/src/domain-dispatch-core.ts
+function resolveDomainPathSpec(domain, domainPath) {
+  let cursor = domain;
+  for (const seg of domainPath.slice(1)) {
+    if (cursor.kind !== "noun") {
+      throw new CliError(1 /* Runtime */, "UNKNOWN", `Invalid subdomain path: ${seg}`);
+    }
+    const next = cursor.subdomains?.[seg];
+    if (!next) {
+      throw new CliError(1 /* Runtime */, "UNKNOWN", `Invalid subdomain path: ${seg}`);
+    }
+    cursor = next;
+  }
+  return cursor;
+}
 async function dispatchDomain(ctx, depth = 0) {
   const tokens = [
     ctx.invocation.command ?? "",
@@ -44752,9 +45198,10 @@ async function dispatchDomain(ctx, depth = 0) {
   }
   const { domain, domainPath, verb, remaining } = resolved;
   const helpRequested = ctx.invocation.flags.help === true || ctx.invocation.flags.h === true;
-  if (domain.kind === "flat") {
+  const pathSpec = resolveDomainPathSpec(domain, domainPath);
+  if (pathSpec.kind === "flat") {
     if (helpRequested) {
-      printDomainVerbHelp(ctx.out, domain, ctx.format, domainPath);
+      printDomainVerbHelp(ctx.out, pathSpec, ctx.format, domainPath);
       return true;
     }
     if (remaining.length > 0) {
@@ -44764,13 +45211,13 @@ async function dispatchDomain(ctx, depth = 0) {
         throwRenameHint(flatRenameHint);
       }
     }
-    const maxPositional = countMaxPositional(domain.args);
+    const maxPositional = countMaxPositional(pathSpec.args);
     if (remaining.length > maxPositional) {
       const extra = remaining[maxPositional];
-      const usageHint = maxPositional === 0 ? `'wh ${domainPath.join(" ")}' takes no positional arguments` : `'wh ${domainPath.join(" ")}' accepts at most ${maxPositional} positional argument${maxPositional === 1 ? "" : "s"} (${domain.args})`;
+      const usageHint = maxPositional === 0 ? `'wh ${domainPath.join(" ")}' takes no positional arguments` : `'wh ${domainPath.join(" ")}' accepts at most ${maxPositional} positional argument${maxPositional === 1 ? "" : "s"} (${pathSpec.args})`;
       throw new CliError(2 /* UserInput */, "USER_INPUT", `Unexpected argument: '${extra}'`, undefined, usageHint);
     }
-    const typedFlags2 = extractFlags(ctx.invocation.flags, domain.flags);
+    const typedFlags2 = extractFlags(ctx.invocation.flags, pathSpec.flags);
     const allArgs = verb ? [verb, ...remaining] : remaining;
     if (ctx.dryRun) {
       ctx.out(JSON.stringify({
@@ -44793,12 +45240,7 @@ async function dispatchDomain(ctx, depth = 0) {
     });
     return true;
   }
-  const specCursor = domainPath.slice(1).reduce((d, seg) => {
-    const next = d.subdomains?.[seg];
-    if (!next || next.kind === "flat")
-      throw new CliError(1 /* Runtime */, "UNKNOWN", `Invalid subdomain path: ${seg}`);
-    return next;
-  }, domain);
+  const specCursor = pathSpec;
   const verbs = Object.keys(specCursor.verbs);
   const invokeSingleVerb = async (args) => {
     if (verbs.length !== 1 || helpRequested)
@@ -45108,6 +45550,8 @@ function parseFunctionLogMode(flags, env) {
 async function runCli(argv, opts) {
   const version = opts?.version ?? package_default2.version;
   setCliClientVersion(version);
+  startCliTraceContext();
+  const traceFields = cliTraceLogFields();
   const startedAt = Date.now();
   const { out, err } = stdioWriter();
   const parsed = parseArgs(argv);
@@ -45135,7 +45579,8 @@ async function runCli(argv, opts) {
     cwd: process.cwd(),
     node: process.version,
     pid: process.pid,
-    profile: getStringFlag(invocation.flags, "profile", "P") ?? undefined
+    profile: getStringFlag(invocation.flags, "profile", "P") ?? undefined,
+    ...traceFields
   });
   let exitCode = 0 /* Ok */;
   let removeSignalListeners;
@@ -45194,14 +45639,14 @@ async function runCli(argv, opts) {
     let cancelledExitCode;
     const handleSigint = () => {
       ac.abort();
-      logger.info("cli.cancelled", { signal: "SIGINT" });
+      logger.info("cli.cancelled", { signal: "SIGINT", ...traceFields });
       cancelledExitCode = cancellationExitCode("SIGINT", liveMode);
       if (!liveMode)
         process.exitCode = 130 /* Cancelled */;
     };
     const handleSigterm = () => {
       ac.abort();
-      logger.info("cli.cancelled", { signal: "SIGTERM" });
+      logger.info("cli.cancelled", { signal: "SIGTERM", ...traceFields });
       cancelledExitCode = cancellationExitCode("SIGTERM", liveMode);
       process.exitCode = 143;
     };
@@ -45241,7 +45686,8 @@ async function runCli(argv, opts) {
     const cliError = toCliError2(error);
     const fields = {
       kind: cliError.kind,
-      exit_code: cliError.code
+      exit_code: cliError.code,
+      ...traceFields
     };
     if (cliError.kind !== "USER_INPUT" && cliError.kind !== "CONFIG") {
       fields.message = cliError.message;
@@ -45261,7 +45707,8 @@ async function runCli(argv, opts) {
     removeSignalListeners?.();
     logger.info("cli.end", {
       exit_code: exitCode,
-      duration_ms: Date.now() - startedAt
+      duration_ms: Date.now() - startedAt,
+      ...traceFields
     });
     await logger.shutdown();
   }
@@ -45314,7 +45761,7 @@ function resolveLogLevel(flags, env) {
 // package.json
 var package_default3 = {
   name: "@warmhub/cli",
-  version: "0.62.0",
+  version: "0.64.0",
   private: false,
   type: "module",
   description: "The wh CLI for WarmHub — create repos, commit and query data, and compound knowledge with your AI agents.",
@@ -45355,6 +45802,7 @@ var package_default3 = {
   },
   scripts: {
     build: "bun run scripts/build.ts",
+    prepack: "bun run build",
     "check:boundary": "node ../../scripts/lint/boundary-imports.mjs bin src scripts",
     "audit:bundle": "bun run scripts/audit-bundle.ts",
     "audit:pack": "bun run scripts/audit-pack.ts",
@@ -45374,6 +45822,14 @@ var package_default3 = {
 };
 
 // ../../packages/warmhub-cli/src/component-shell.ts
+function registeredComponentUsageHint(verb) {
+  const example = verb === "install" ? "wh component install warmhub/veritas --repo myorg/myrepo" : "wh component update warmhub/identity --repo org/repo";
+  return [
+    `Usage: wh component ${verb} <org/name> --repo org/repo`,
+    `Example: ${example}`
+  ].join(`
+`);
+}
 async function maybeHandleComponentShellBoundary(argv, deps = {}) {
   const parsed = parseArgs(argv);
   const invocation = resolveInvocation(parsed);
@@ -45397,6 +45853,11 @@ async function maybeHandleComponentShellBoundary(argv, deps = {}) {
     if (getBoolFlag(invocation.flags, "dry-run")) {
       return;
     }
+    const source = invocation.positional[1];
+    if (source && invocation.positional.length > 2) {
+      const unexpected = invocation.positional[2];
+      throw new CliError(2 /* UserInput */, "USER_INPUT", `Unexpected argument '${unexpected}' for wh component ${componentShellVerb}.`, undefined, registeredComponentUsageHint(componentShellVerb));
+    }
     const { config, client } = resolveCliContext({
       invocation,
       format,
@@ -45404,7 +45865,6 @@ async function maybeHandleComponentShellBoundary(argv, deps = {}) {
       config: deps.config,
       client: deps.client
     });
-    const source = invocation.positional[1];
     if (!source) {
       return;
     }
@@ -45956,4 +46416,4 @@ if (!updateCheckSuppressedByArgv && shouldRunUpdateCheck(updateEligibility)) {
 var interceptedExitCode = await maybeHandleComponentShellBoundary(dispatchArgv);
 process.exitCode = interceptedExitCode === undefined ? await runCli(dispatchArgv, { version: package_default3.version }) : interceptedExitCode;
 
-//# debugId=FB7C860F078FFF2164756E2164756E21
+//# debugId=7FF3388CDD4F972C64756E2164756E21